From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gQRFC1KjRz2y5m for ; Wed, 27 May 2026 10:49:03 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gQRFC0py8z2xJk for ; Wed, 27 May 2026 10:49:03 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gQRFB39zpz1v3 for ; Wed, 27 May 2026 10:49:02 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779878942; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=D+AmO3lQXgHGT8SIcyrwNJd7yo0D1wASRkZDHak0F84=; b=sawg5b8f7XkhTJpEwW7cuv9hxc2c4IXRo7pdRgWlOuKlcIjxi1JNTGDhTJvyXvb3sdc//U nb3sPxjgWH0hETDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779878942; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=D+AmO3lQXgHGT8SIcyrwNJd7yo0D1wASRkZDHak0F84=; b=hmWOH45RSoAiZzi1dzpplGk9NPcgJqBenMqOaSeL666DIA6itgH1gJaCT7GA+hTZUJbKFr QjUSMuf9fi2b+OcypGvXgpub9JAwGsVckuRNw40QkahL2PtuEm4Xuy613lqxbESPIb9HV4 2pYBsMjRnITHgq0ZqEYZxoJBfpy3LW6SNQRyLKP3wAiP1eKbZvswuzfQrISSL2HqG+K/Ez 373Xy/3fNF8x6zWuhzRZfDrvc3TCeUGf6p1I/RN0Itin7dr19Ib4TfJoAmCk3CJBTznipU QvZNkJ98RNZucf+tD1VdHqwxYm5/fSbcrbN539EyDmCKW6qhFxNwK1lPvQubVA== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gQRFB1Ssqz2xKs; Wed, 27 May 2026 10:49:02 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. a2022dc1fb46dc599c974a398b8d5c7a6b87c94e X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: de80f74152e08080c5f302cf56cab6daa79169b4 X-Git-Newrev: a2022dc1fb46dc599c974a398b8d5c7a6b87c94e Message-Id: <4gQRFB1Ssqz2xKs@people01.haj.ipfire.org> Date: Wed, 27 May 2026 10:49:02 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a2022dc1fb46dc599c974a398b8d5c7a6b87c94e (commit) via c06a7913849005891582ecac5d830454684dbdc1 (commit) from de80f74152e08080c5f302cf56cab6daa79169b4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a2022dc1fb46dc599c974a398b8d5c7a6b87c94e Author: Michael Tremer Date: Wed May 27 11:48:09 2026 +0100 knot resolver: Force TCP flag only on TCP This is required for TLS, too, but the policy.FORWARD_TLS function is already setting this. Signed-off-by: Michael Tremer commit c06a7913849005891582ecac5d830454684dbdc1 Author: Michael Tremer Date: Wed May 27 11:47:18 2026 +0100 knot resolver: Configure forwarders in the workers, too Fixes: #13987 - KRESD - TLS forwarding doesn't work Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/knot-resolver/config.lua | 4 ++-- config/knot-resolver/config.yaml | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua index 2e741e864..a38a83303 100644 --- a/config/knot-resolver/config.lua +++ b/config/knot-resolver/config.lua @@ -141,8 +141,8 @@ function config.transport() -- Load the settings local settings = config.load_settings("/var/ipfire/dns/settings") - -- Force using TCP (and/or TLS) if configured - if settings["PROTO"] == "TCP" or settings["PROTO"] == "TLS" then + -- Force using TCP if configured + if settings["PROTO"] == "TCP" then policy.add( policy.all( policy.FLAGS("TCP") diff --git a/config/knot-resolver/config.yaml b/config/knot-resolver/config.yaml index 9fc6d069b..dfc849614 100644 --- a/config/knot-resolver/config.yaml +++ b/config/knot-resolver/config.yaml @@ -42,12 +42,18 @@ lua: -- Load config helpers local config = require("config") + -- Load the settings + local settings = config.load_settings("/var/ipfire/dns/settings") + -- Configure transport config.transport() -- Load DHCP Leases Lookup config.load_leases() + -- Load Forwarders + config.load_forwarders(settings) + # Load policies policy-script: | -- Load config helpers hooks/post-receive -- IPFire 2.x development tree