From patchwork Fri Nov 13 13:42:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 34 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jQz3R1PzPz3wjn for ; Fri, 13 Nov 2026 13:42:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jQz3P34R9z5QH for ; Fri, 13 Nov 2026 13:42:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jQz3P2DxLz2xrV for ; Fri, 13 Nov 2026 13:42:57 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jQz3L5FpKz2xLw for ; Fri, 13 Nov 2026 13:42:54 +0000 (UTC) Received: from mout-b-107.mailbox.org (mout-b-107.mailbox.org [195.10.208.47]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "*.mailbox.org", Issuer "Thawte TLS RSA CA G1" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jQz3K4TVtz1Tc for ; Fri, 13 Nov 2026 13:42:53 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=mandelbit.com header.s=MBO0001 header.b="CGCD9/4G"; spf=pass (mail01.ipfire.org: domain of antonio@mandelbit.com designates 195.10.208.47 as permitted sender) smtp.mailfrom=antonio@mandelbit.com; dmarc=none ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1794577374; b=uAx1wYtKC1Vow6a+apbObl1CNHE0JfiU7YoOHwwAs3Z+wzN51ubslsalxp50jJKqxNFaeg rR8b3c3iW5vck17OGOwwK92ow010hRtwXBXE+6h/jceTT7UYBzmZB74e7k+IqgldAZ1yip 8gC8q9Nqws2eWtc6W12YHO+qeXEFbQKr4SaUoPSBRud9533512Mg/vpXmu9yIYxw1F0vvN OYxlh2h4lYb4yn0nRhhAfozLbEvE24VSGMtrsjqX0VkJG0IUQ5vBnEUBPYnxqZR0wZ2Vfb lhO1o6vBzmzL/WRP936ujtQgLpQDKhOKalO5euv6zgCGRolOnMF4REMPRZyaRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1794577374; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=6odLF8SRJmG8Zd8q1ixR3bKALR5PL+V45mCI5UFL9vI=; b=pUNCaIyvvvhybiw8Mfhpl5P40tb2nxE+A5YrDCDhW/AUKa1vICM9X/piu5EW2pkAsK2ol4 U84wiWswJvLFOy5u24i5BdJLEmfQCda91GbiSKo7Of+mv0VxEAnz5TA9G3bJeSKW8qiSbG 6i3Mbzk11D8Gj2bEDUFSZhSS8yAUA3y4mlaNC3dONwwoqNj5WRMwiFP5iHmji7qbCAGz65 y7gv/UDK5ICRWemI89oaiTbYLLqR7efVV9ZmD2TxxAOgXstn7d3oC92ZSNCPaCYqfbnKkd LIXQX+UA4G3NydZxSEwb8/JA3BaTMfYdq74OKxKjwQhfqH4INAfjIs2u3hxc4A== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=mandelbit.com header.s=MBO0001 header.b="CGCD9/4G"; spf=pass (mail01.ipfire.org: domain of antonio@mandelbit.com designates 195.10.208.47 as permitted sender) smtp.mailfrom=antonio@mandelbit.com; dmarc=none Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4jQz3G3cXmz3ygX; Fri, 13 Nov 2026 14:42:50 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1794577370; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=6odLF8SRJmG8Zd8q1ixR3bKALR5PL+V45mCI5UFL9vI=; b=CGCD9/4Gf0RjfhEIZyKbZ70+xF2JuYXoFxSpLIQ0N0uYEMc7BRwAChd59/V/GdfhVXqdZT j5avso3XCdJ3/eSF7maJVfQBg0Zp72Z7mux8xyjPiBTJPRvLav6JP8nXNj0gskq6twSM3f a9tGlCDAYmGnYPiarE9nRBt8KG9lqZcqxAoE3ZtYa4dYhCop0rFMVJX9Pm0BFH+vt9djJ8 cmN1AWZeei6vFiVyxLK1uidCfFODc62i7GRafDZZJmRrBjVFhQxoACOwW0iPFkQkWHvIpf 0/GMR/pkpMnvI887qyxnvPhbol1NEcxW9mBqvIeZbVnaTJYEGOx+qt26k10aKw== From: Antonio Quartulli To: development@lists.ipfire.org Cc: Antonio Quartulli Subject: [PATCH 0/2] Fix DNS-over-TLS after changing DNS settings (#14781) Date: Fri, 13 Nov 2026 14:42:41 +0100 Message-ID: <20261113134243.382773-1-antonio@mandelbit.com> X-Mailer: git-send-email 2.56.0 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 X-Spamd-Result: default: False [-8.26 / 11.00]; NEURAL_HAM(-3.00)[-1.000]; BAYES_HAM(-3.00)[100.00%]; R_DKIM_ALLOW(-1.51)[mandelbit.com:s=MBO0001]; MID_CONTAINS_FROM(1.00)[]; SPF_REPUTATION_HAM(-0.88)[-0.87643658127081]; DKIM_REPUTATION(-0.88)[-0.87643658127081]; R_MISSING_CHARSET(0.50)[]; R_SPF_ALLOW(-0.20)[+ip4:195.10.208.0/24]; MIME_GOOD(-0.10)[text/plain]; RCVD_IN_DNSWL_LOW(-0.10)[2001:67c:2050:b231:465::1:received]; R_DKIM_ALIGNED(-0.10)[strict]; IP_REPUTATION_HAM(0.00)[asn: 199118(-0.35), country: DE(-0.01), ip: 195.10.208.47(0.00)]; ARC_NA(0.00)[]; MX_INFLIGHT(0.00)[mxext4.mailbox.org]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; RCPT_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[195.10.208.47:from]; TO_MATCH_ENVRCPT_SOME(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; DMARC_NA(0.00)[mandelbit.com]; ASN(0.00)[asn:199118, ipnet:195.10.208.0/24, country:DE]; DKIM_TRACE(0.00)[mandelbit.com:+]; RCVD_COUNT_ONE(0.00)[1]; FROM_HAS_DN(0.00)[] X-Rspamd-Server: mail01.haj.ipfire.org X-Rspamd-Queue-Id: 4jQz3K4TVtz1Tc X-Rspamd-Action: no action Enabling DNS-over-TLS in dns.cgi breaks DNS until knot-resolver is restarted: a reload doesn't restart the kresd workers, which only set up TLS forwarders at startup. Also, changes to the server list weren't applied at all. Patch 1 adds a force-reload (rolling restart of the workers), patch 2 uses it in dns.cgi. The other reload callers are unchanged. With a single worker, each save causes a sub-second DNS gap. Files to ship: /srv/web/ipfire/cgi-bin/dns.cgi, /etc/rc.d/init.d/knot-resolver, /usr/local/bin/dnsctrl Antonio Quartulli (2): knot-resolver: Add force-reload dns.cgi: Force a reload after every change html/cgi-bin/dns.cgi | 7 ++++--- src/initscripts/system/knot-resolver | 9 ++++++++- src/misc-progs/dnsctrl.c | 7 +++++++ 3 files changed, 19 insertions(+), 4 deletions(-)