[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 6463138c6369f419608204e290e619e7abb2ee26

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 6463138c6369f419608204e290e619e7abb2ee26

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  6463138c6369f419608204e290e619e7abb2ee26 (commit)
       via  f068a2f0ad85a5a3954129bf34b1ca26782c7480 (commit)
       via  b34710a4e270d5c50114c81a8e4d181d1378a037 (commit)
       via  1ae1752ba2f2375768f81be8d9f92b37a1014cef (commit)
      from  185c0c13f929bd33d5200d10c857d9438b226558 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6463138c6369f419608204e290e619e7abb2ee26
Merge: 185c0c13f f068a2f0a
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Oct 30 13:57:05 2026 +0000

    Merge branch 'knot-resolver-transparent-dhcp-domain'
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit f068a2f0ad85a5a3954129bf34b1ca26782c7480
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Oct 30 13:43:09 2026 +0000

    knot-resolver: Do not discard the cleared rule database when loading hosts
    
    The policy loader starts with clearing the rule database, but that
    change is only part of an open transaction that is committed at the end.
    load_hosts() called kr_rules_commit(false) which rolled back that
    transaction, so all hosts that had ever been loaded stayed in the rule
    database. Removing or disabling a host on the hosts page had no effect
    until the database was removed by hand.
    
    The explicit transaction is not needed as kr_rule_local_data_merge()
    opens one itself.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit b34710a4e270d5c50114c81a8e4d181d1378a037
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Oct 30 13:19:45 2026 +0000

    knot-resolver: Only create PTR records for hosts that have it enabled
    
    hints.set() always creates the forward and the reverse record, so the
    PTR setting of the hosts page was ignored (bug #14371), and reverse
    lookups returned all names that share an address.
    
    Add the forward record directly for hosts that have PTR disabled and
    only use hints.set() for those that have it enabled.
    
    Fixes: #14371
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 1ae1752ba2f2375768f81be8d9f92b37a1014cef
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Oct 30 13:06:19 2026 +0000

    knot-resolver: Pass on queries for unknown leases
    
    Since the lease policy covers the entire DHCP domain, sending NXDOMAIN
    for every name that is not in the leases database also blocked names
    from the hosts page (bug #14755), and anything else that could have been
    resolved elsewhere.
    
    Return nothing for unknown names so that the query is answered by the
    next source (e.g. static hosts) or the upstream servers. Names in the
    leases database are still answered, including NODATA for other types.
    
    Fixes: #14755
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/knot-resolver/config.lua | 42 +++++++++++++++++++++++++++++++++--------
 config/knot-resolver/leases.lua | 16 ++++++++--------
 2 files changed, 42 insertions(+), 16 deletions(-)

Difference in files:
diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua
index 21ac063c7..2ee8a0519 100644
--- a/config/knot-resolver/config.lua
+++ b/config/knot-resolver/config.lua
@@ -29,6 +29,12 @@ local notify = require("cqueues.notify")
 -- Get access to the C interface
 local C = ffi.C
 
+-- Declare functions that are not exposed by Knot Resolver
+ffi.cdef[[
+	int kr_rule_local_data_merge(const knot_rrset_t *rrs, kr_rule_tags_t tags,
+		kr_rule_opts_t opts);
+]]
+
 -- Helper function to load a key/value configuration file
 function config.load_settings(path)
 	local settings = {}
@@ -238,6 +244,26 @@ function config.load_forwarders(settings)
 	policy.rule_forward_add(".", { dnssec=true, auth=false, tcp=tcp }, forwarders)
 end
 
+-- Adds a forward record without creating the corresponding PTR record
+-- (hints.set() always creates both)
+local function add_forward_record(name, address)
+	-- Convert the address into wire format
+	local rdata = kres.str2ip(address)
+	if not rdata then
+		return
+	end
+
+	-- Select the record type
+	local rtype = (#rdata == 16) and kres.type.AAAA or kres.type.A
+
+	-- Create the RRset
+	local rr = kres.rrset(todname(name), rtype, kres.class.IN, 60)
+	rr:add_rdata(rdata, #rdata)
+
+	-- Merge the record so that multiple addresses for the same name are kept
+	C.kr_rule_local_data_merge(rr, 0, C.KR_RULE_OPTS_DEFAULT)
+end
+
 -- Load any hosts
 function config.load_hosts()
 	local path = "/var/ipfire/main/hosts"
@@ -260,12 +286,6 @@ function config.load_hosts()
 	-- Open the file
 	local f = csv.open(path, { separator = "," })
 
-	-- Start a new transaction
-	-- This is needed to make hints.set() not crash the entire process as it
-	-- calls kr_rule_local_data_merge() which requires to be called inside
-	-- a transaction.
-	ffi.C.kr_rules_commit(false)
-
 	for fields in f:lines() do
 		local status, address, hostname, domainname, ptr = unpack(fields)
 
@@ -281,8 +301,14 @@ function config.load_hosts()
 					hostname, address)
 			end
 
-			-- Add the hint
-			hints.set(hint)
+			-- Add the hint (including the PTR record)
+			if ptr == "on" then
+				hints.set(hint)
+
+			-- Otherwise only add the forward record
+			else
+				add_forward_record(hint:match("^(%S+)"), address)
+			end
 		end
 	end
 
diff --git a/config/knot-resolver/leases.lua b/config/knot-resolver/leases.lua
index d1c174103..6d259ee5c 100644
--- a/config/knot-resolver/leases.lua
+++ b/config/knot-resolver/leases.lua
@@ -156,16 +156,16 @@ function M.answer()
 			end
 		end
 
-		-- If the name exists, we send the answer (or NODATA if we have nothing
-		-- for this query type)
-		if exists then
-			answer = policy.ANSWER(answer, true)
-
-		-- Otherwise we send NXDOMAIN
-		else
-			answer = policy.DENY
+		-- If the name is unknown, we do nothing so that the query can be answered
+		-- by another source (e.g. static hosts) or the upstream servers
+		if not exists then
+			return
 		end
 
+		-- Otherwise we send the answer (or NODATA if we have nothing for this
+		-- query type)
+		answer = policy.ANSWER(answer, true)
+
 		-- Pass the state and request
 		return answer(state, req)
 	end


hooks/post-receive
--
IPFire 2.x development tree