From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jGN2F4HVpz2yVK for ; Fri, 30 Oct 2026 13:57:09 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jGN2F3yKCz2xP7 for ; Fri, 30 Oct 2026 13:57:09 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jGN2F0QWNzvF for ; Fri, 30 Oct 2026 13:57:09 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793368629; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=BlLD+pBWlwhl5YJiM/4Qnv4CJaRiqhQEs1ZyioDsM8I=; b=CXK7pgIxU0f9tHER5CosJF5dqqC9oYevcZiTrJk8scx9GPG5OO0a0Os+iZbrarY/lqG10N QxJdlmEasFCacTBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793368629; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=BlLD+pBWlwhl5YJiM/4Qnv4CJaRiqhQEs1ZyioDsM8I=; b=nQYN//Rekcz9VqynZHlH+inwiuMqZwHpMr35WLk4n7I0DiZDu0N1yeMImznXjQfTdiG8PB Tz/Xj1GVS1zuADMm0yegVoLMaQ4i7zcUZSAG26fO1kTHUmqSHKAbyLZH3RX3myIQF+iual 5WJLp3MQavQBLGK3ZMUYz3RKgTMXUG0yLIUEUBRBomzlq1SYJAO/iqp52o1DSHSQRkeACv AH0uf+AWh0DnJCCe8XIKe/RBudkHBhq3ov2ZTXT7L5mnNRxIxux+/kxn+Dja7V+kIsmI4a KYSQWxFQTxXDQqbcAfNBTSgugkOpDH8cBsLeVYnNeqby1p+7I1Ujczb0Gtz0fw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4jGN2D1HRBz2y4d; Fri, 30 Oct 2026 13:57:08 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 6463138c6369f419608204e290e619e7abb2ee26 X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: 185c0c13f929bd33d5200d10c857d9438b226558 X-Git-Newrev: 6463138c6369f419608204e290e619e7abb2ee26 Message-Id: <4jGN2D1HRBz2y4d@people01.haj.ipfire.org> Date: Fri, 30 Oct 2026 13:57:08 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 6463138c6369f419608204e290e619e7abb2ee26 (commit) via f068a2f0ad85a5a3954129bf34b1ca26782c7480 (commit) via b34710a4e270d5c50114c81a8e4d181d1378a037 (commit) via 1ae1752ba2f2375768f81be8d9f92b37a1014cef (commit) from 185c0c13f929bd33d5200d10c857d9438b226558 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6463138c6369f419608204e290e619e7abb2ee26 Merge: 185c0c13f f068a2f0a Author: Michael Tremer Date: Fri Oct 30 13:57:05 2026 +0000 Merge branch 'knot-resolver-transparent-dhcp-domain' Signed-off-by: Michael Tremer commit f068a2f0ad85a5a3954129bf34b1ca26782c7480 Author: Michael Tremer Date: Fri Oct 30 13:43:09 2026 +0000 knot-resolver: Do not discard the cleared rule database when loading hosts The policy loader starts with clearing the rule database, but that change is only part of an open transaction that is committed at the end. load_hosts() called kr_rules_commit(false) which rolled back that transaction, so all hosts that had ever been loaded stayed in the rule database. Removing or disabling a host on the hosts page had no effect until the database was removed by hand. The explicit transaction is not needed as kr_rule_local_data_merge() opens one itself. Signed-off-by: Michael Tremer commit b34710a4e270d5c50114c81a8e4d181d1378a037 Author: Michael Tremer Date: Fri Oct 30 13:19:45 2026 +0000 knot-resolver: Only create PTR records for hosts that have it enabled hints.set() always creates the forward and the reverse record, so the PTR setting of the hosts page was ignored (bug #14371), and reverse lookups returned all names that share an address. Add the forward record directly for hosts that have PTR disabled and only use hints.set() for those that have it enabled. Fixes: #14371 Signed-off-by: Michael Tremer commit 1ae1752ba2f2375768f81be8d9f92b37a1014cef Author: Michael Tremer Date: Fri Oct 30 13:06:19 2026 +0000 knot-resolver: Pass on queries for unknown leases Since the lease policy covers the entire DHCP domain, sending NXDOMAIN for every name that is not in the leases database also blocked names from the hosts page (bug #14755), and anything else that could have been resolved elsewhere. Return nothing for unknown names so that the query is answered by the next source (e.g. static hosts) or the upstream servers. Names in the leases database are still answered, including NODATA for other types. Fixes: #14755 Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/knot-resolver/config.lua | 42 +++++++++++++++++++++++++++++++++-------- config/knot-resolver/leases.lua | 16 ++++++++-------- 2 files changed, 42 insertions(+), 16 deletions(-) Difference in files: diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua index 21ac063c7..2ee8a0519 100644 --- a/config/knot-resolver/config.lua +++ b/config/knot-resolver/config.lua @@ -29,6 +29,12 @@ local notify = require("cqueues.notify") -- Get access to the C interface local C = ffi.C +-- Declare functions that are not exposed by Knot Resolver +ffi.cdef[[ + int kr_rule_local_data_merge(const knot_rrset_t *rrs, kr_rule_tags_t tags, + kr_rule_opts_t opts); +]] + -- Helper function to load a key/value configuration file function config.load_settings(path) local settings = {} @@ -238,6 +244,26 @@ function config.load_forwarders(settings) policy.rule_forward_add(".", { dnssec=true, auth=false, tcp=tcp }, forwarders) end +-- Adds a forward record without creating the corresponding PTR record +-- (hints.set() always creates both) +local function add_forward_record(name, address) + -- Convert the address into wire format + local rdata = kres.str2ip(address) + if not rdata then + return + end + + -- Select the record type + local rtype = (#rdata == 16) and kres.type.AAAA or kres.type.A + + -- Create the RRset + local rr = kres.rrset(todname(name), rtype, kres.class.IN, 60) + rr:add_rdata(rdata, #rdata) + + -- Merge the record so that multiple addresses for the same name are kept + C.kr_rule_local_data_merge(rr, 0, C.KR_RULE_OPTS_DEFAULT) +end + -- Load any hosts function config.load_hosts() local path = "/var/ipfire/main/hosts" @@ -260,12 +286,6 @@ function config.load_hosts() -- Open the file local f = csv.open(path, { separator = "," }) - -- Start a new transaction - -- This is needed to make hints.set() not crash the entire process as it - -- calls kr_rule_local_data_merge() which requires to be called inside - -- a transaction. - ffi.C.kr_rules_commit(false) - for fields in f:lines() do local status, address, hostname, domainname, ptr = unpack(fields) @@ -281,8 +301,14 @@ function config.load_hosts() hostname, address) end - -- Add the hint - hints.set(hint) + -- Add the hint (including the PTR record) + if ptr == "on" then + hints.set(hint) + + -- Otherwise only add the forward record + else + add_forward_record(hint:match("^(%S+)"), address) + end end end diff --git a/config/knot-resolver/leases.lua b/config/knot-resolver/leases.lua index d1c174103..6d259ee5c 100644 --- a/config/knot-resolver/leases.lua +++ b/config/knot-resolver/leases.lua @@ -156,16 +156,16 @@ function M.answer() end end - -- If the name exists, we send the answer (or NODATA if we have nothing - -- for this query type) - if exists then - answer = policy.ANSWER(answer, true) - - -- Otherwise we send NXDOMAIN - else - answer = policy.DENY + -- If the name is unknown, we do nothing so that the query can be answered + -- by another source (e.g. static hosts) or the upstream servers + if not exists then + return end + -- Otherwise we send the answer (or NODATA if we have nothing for this + -- query type) + answer = policy.ANSWER(answer, true) + -- Pass the state and request return answer(state, req) end hooks/post-receive -- IPFire 2.x development tree