From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gPyqy4tDBz2xjZ for ; Tue, 26 May 2026 16:29:02 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gPyqy4WHNz2xMD for ; Tue, 26 May 2026 16:29:02 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gPyqx6S9Bz6v8 for ; Tue, 26 May 2026 16:29:01 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779812941; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=WFLYNUvgyog7N79u5ZY9e/owLncKfhUhThDBQPRjcHg=; b=fcyTbKzSuip/x6s860F0zQHvh3fwRedSZIUKeJn1lhZqVCUqGUV6DdIoNtaGgzBhabeSPp 5qdfPrN0VGA+wvCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779812941; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=WFLYNUvgyog7N79u5ZY9e/owLncKfhUhThDBQPRjcHg=; b=kgEY6EYHYSexDO6bHrN9fa3nK000zQDCnaUXeFtXAqpD0APFXMyUAPxv538P+OiECxOi8m EBIc2mRzKphSWTEr74QNEVWmVZzfouS0rfcmm+j5daGdbsD9ZlO5bwhSSaxws4lFwzQEKR MdmQzlOL5VM7miNT8H8fo8LKiyfe14oM5lRydOl41HVEbOU/jhXOhggTf7NozbqorR9TWx wDPst9fIerj32+2cE+cjAz7WBZgR03Ns7NFklAMcRA3ELdwpZVT/xw9OVqQRZbi+ZzRGz8 Lu+tBE6hYHB5CZHHT92shgSjHhTUZjjFAU6hImeUeJBE+ZnaexFz/YZWgK/8uw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gPyqx4bvgz2xMt; Tue, 26 May 2026 16:29:01 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9a45c759d6367516bfb0c9a5516a50fc7920c5e5 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: 240827441761c4eb7640d0cf98e857659cb66cfb X-Git-Newrev: 9a45c759d6367516bfb0c9a5516a50fc7920c5e5 Message-Id: <4gPyqx4bvgz2xMt@people01.haj.ipfire.org> Date: Tue, 26 May 2026 16:29:01 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9a45c759d6367516bfb0c9a5516a50fc7920c5e5 (commit) from 240827441761c4eb7640d0cf98e857659cb66cfb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9a45c759d6367516bfb0c9a5516a50fc7920c5e5 Author: Michael Tremer Date: Tue May 26 17:18:55 2026 +0100 knot resolver: Explicitely use TCP/TLS for outbound queries Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/knot-resolver/config.lua | 15 +++++++++++++++ config/knot-resolver/config.yaml | 3 +++ 2 files changed, 18 insertions(+) Difference in files: diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua index bb8546ec4..2e741e864 100644 --- a/config/knot-resolver/config.lua +++ b/config/knot-resolver/config.lua @@ -136,6 +136,21 @@ local function reverse_zones(address, netmask) return zones end +-- Configure transport +function config.transport() + -- Load the settings + local settings = config.load_settings("/var/ipfire/dns/settings") + + -- Force using TCP (and/or TLS) if configured + if settings["PROTO"] == "TCP" or settings["PROTO"] == "TLS" then + policy.add( + policy.all( + policy.FLAGS("TCP") + ) + ) + end +end + -- Setup DNS Forwarders function config.load_forwarders(settings) -- Fetch the transport protocol diff --git a/config/knot-resolver/config.yaml b/config/knot-resolver/config.yaml index 4114939f1..9fc6d069b 100644 --- a/config/knot-resolver/config.yaml +++ b/config/knot-resolver/config.yaml @@ -42,6 +42,9 @@ lua: -- Load config helpers local config = require("config") + -- Configure transport + config.transport() + -- Load DHCP Leases Lookup config.load_leases() hooks/post-receive -- IPFire 2.x development tree