Hi,
Between countless parcel notifications in my inbox, I suddenly found this message...
...just moments after I posted my modification (which is entirely focussed on setup.py):
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292197
I'm now merging that with what's suggested here.
So it's getting further than before, but is not yet completing successfully.
Leo.
On Fri, 02 Jan 2026, Michael Grimm wrote:
> Vladim??r ??un??t via knot-resolver-users <knot-resolver-users(a)lists.nic.cz> wrote:
> > On 31/12/2025 13.37, Michael Grimm via knot-resolver-users wrote:
>
> >> FYI: This is FreeBSD and kresctl tool isn't available here.
>
> > OK, that's a complication. In 6.0.17 we added FreeBSD support to code added in 6.x, and now we're in contact with the maintainer of the [port], but the last version I saw didn't seem to package all parts needed for YAML (e.g. executables called knot-resolver and kresctl).
>
> In March 2024 I tried to create a FreeBSD port for knot-resolver-6.0.8. I got it compiled after applying the following changes (see tar file attached). I do remember that I could use kresctl in a poudriere testport jail, only, but I can't reproduce that as of today, sorry.
>
> (This is intended as a FYI, just in case it helps.)
>
> 1) files/patch-meson_options.txt
>
> This adds a manager section to meson_options.txt.
> With that I could tell meson to use '-Dmanager=enabled' within the port's Makefile
>
> This section is missing in 6.0.17 as well. If added meson log file tells me that a manager is enabled.
>
> I do not have the knowledge if that is necessary at all, though
>
>
> 2) files/patch-controller_supervisord_plugin_notifymodule.c
>
> This patch addresses:
>
> #) include sys/ucred.h
> #) use LOCAL_PEERCRED instead of SO_PASSCRED
> #) use 'struct xucred' instead of 'struct ucred'
> #) use SCM_CREDS instead of SCM_CREDENTIALS
> #) use cred.cr_pid instead of cred.pid as returned value
>
> Again, I do not have the knowledge if that is of relevance at all.
>
>
> I applied both patches to Leo's port and modified the Makefile accordingly (see tar), and it compiles successfully; but is still lacking kresctl and knot-resolver.
>
>
> I hope that this might be of interest for you.
>
> Regards,
> Michael
>
On 02/01/2026 16.45, Michael Grimm wrote:
> 1) files/patch-meson_options.txt
This patch adds the option but doesn't act on the option in any way.
(i.e. it doesn't affect the result except for some lines in the log)
> 2) files/patch-controller_supervisord_plugin_notifymodule.c
This patch might be interesting, though we just avoided the notify
module on non-Linux since 6.0.17, so it's not really needed anymore.
Maybe we'd need that notify-free code-path anyway for some other BSD or
macOS; I don't remember details about this.
--Vladimir
Hi,
it seems kresd 5.7.6 falls back from UDP to TCP transport but never retries over UDP.
Impact:
udp/53-only services (incorrect but happens in the wild[1]) may become ~permanently (long TTL) unreachable when udp/53 is not 100% reliable.
When temporal udp/53 communication error occurs, kresd will fall back to tcp/53, fail to connect, store negative information and return SERVFAIL.
Since retries only consider tcp/53 transport, there is no easy way to recover for udp/53-only domains.
I believe it would be nice to retry with UDP as well as TCP (other implementations do this) to handle such cases more gently.
[iterat][55073123.04] <= rcode: NOERROR
[valdtr][55073123.04] <= cached insecure response, going insecure
[iterat][55073123.02] 'www.somefooservice.com.' type 'A' new uid was assigned .05, parent uid .00
[select][55073123.05] => id: '37763' choosing from addresses: 0 v4 + 0 v6; names to resolve: 0 v4 + 0 v6; force_resolve: 0; NO6: IPv6 is OK
[select][55073123.05] => id: '37763' no suitable transport, zone cut: 'www.somefooservice.com.'
[iterat][55073123.05] 'www.somefooservice.com.' type 'A' new uid was assigned .06, parent uid .00
[select][55073123.06] => id: '27070' choosing from addresses: 0 v4 + 0 v6; names to resolve: 0 v4 + 0 v6; force_resolve: 0; NO6: IPv6 is OK
[select][55073123.06] => id: '27070' no suitable transport, zone cut: 'www.somefooservice.com.'
[resolv][55073123.06] AD: request NOT classified as SECURE
[resolv][55073123.06] finished in state: 8, queries: 2, mempool: 81952 B
Workaround:
cache.max_ttl() - haven't tried
cache.clear('FQDN record affected') does NOT work
cache.clear('entire TLD affected') does NOT work
cache.clear('.') DOES work
cache.clear() DOES work
[1] It took us some time to reach major mobile device producer and convince them to expose tcp/53 ;)
/PM
Hello,
I'm doing tests of filtering DNS with RPZ lists. Now, I would like to collect stats and metrics about blocked requests (blocked domains, sources IP, count of blocked requests...).
In journalctl I have logs like this : "[rules ] => local data applied, user: xxx.xxx.xxx.xxx, name: blocked-domain.tld." Main infos I want to collect exist.
Is there a way to do this with Prometheus format metrics + Grafana ? I didn't really find anything in documentation.
Thank you so much if you have a tip to help me.
Hello,
I was using Knot resolver 5 with configuration where I was replacing some parts of DNS tree (https://knot-resolver.readthedocs.io/en/latest/modules-policy.html#replacin…).
Since I updated to Knot Resolver 6 and rewrite configuration to YAML using forward directive (https://www.knot-resolver.cz/documentation/latest/config-forward.html#forwa…) it seems that this configuration is not working as planned. After short time Knot Resolver started responding to replaced part of tree as NXDOMAIN.
Is this behavior intended, or is it some unintended bug?
Configuration for v6 was:
forward:
# Internal Domains
- subtree:
- internal.corp
- 10.in-addr.arpa
servers:
- 10.3.0.102
- 10.3.0.103
options:
authoritative: false
dnssec: false
I've tried to find if I do have something misconfigured, but without any luck. I have only a theory - in docs, it states like this: "Forwarding configuration instructs resolver to forward cache-miss queries from clients to manually specified DNS resolvers". Can the real reason of malfunction be, that Knot resolver 6 uses information from cache BEFORE it even tries to forward the query?
Since I am not sure how Knot resolver handles these rules internally, it is only theory.
Is there any correct way to replicate behavior from Knot Resolver 5? My config in v5 was:
internalDomains = policy.todnames({
'10.in-addr.arpa',
'mydomain.corp'
})
policy.add(policy.suffix(policy.FLAGS({'NO_CACHE'}), internalDomains))
policy.add(policy.suffix(policy.STUB({
'10.3.0.102',
'10.3.0.103'
}), internalDomains))
Regards,
Jiri Masek
Hi,
I run my knot-resolver on a raspberry pi with pxe boot and the root file
system on nfs.
I realize that this is not recommended operations.
Therefore I try to run my cache on an tmpfs file system.
> tmpfs on /var/cache/knot-resolver type tmpfs (rw,relatime,size=102400k)
But now my knot-resolver refuses to start
Oct 2 20:14:39 pi-hole1 systemd[1]: Starting Knot Resolver daemon...
Oct 2 20:14:40 pi-hole1 kresd[1052]: [system] error while loading
config: /etc/knot-resolver/kresd.conf:69: can't open cache path
'/var/cache/knot-resolver'; working directory '/var/lib/knot-resolver';
No space left on device (workdir '/var/lib/knot-resolver')
Oct 2 20:14:40 pi-hole1 systemd[1]: kresd(a)1.service: Main process
exited, code=exited, status=1/FAILURE
Oct 2 20:14:40 pi-hole1 systemd[1]: kresd(a)1.service: Failed with result
'exit-code'.
Oct 2 20:14:40 pi-hole1 systemd[1]: Failed to start Knot Resolver daemon.
Besides the fact that this message makes no sense (why wouldn't the
cache be opened in /var/cache when /var/lib is full?), the cache gets
actually opened and a database created. The kres-cache-gc process runs
without problems.
The /var/lib/knot-resolver directory exists and is writeable.
I have tried to put it on tmpfs too, no luck.
What solved the problem was
root@pi-hole1:~# umount /var/cache/knot-resolver
root@pi-hole1:~# systemctl start kresd@1
But now the cache is on nfs. That seems risky.
I think this is the relevant part of the configuration
-- Cache size
workdir = '/var/cache/knot-resolver'
cache.open(100 * MB, 'lmdb:///var/cache/knot-resolver')
But it comes with a distro pre-config of
-- Set cache location
rawset(cache, 'current_storage', 'lmdb:///var/cache/knot-resolver')
Which by the way makes it very hard to change cache location. Not to
mention the hard coded location in the systemd script for kres-cache-gc.
What do I do wrong?
/Ulrich
Dear Knot Resolver users,
Knot Resolver 6.0.15 (early-access) has been released!
Security:
- DoS: fix a rare segfault in `resolve` function (!1717)
Someone controlling the DNS traffic might be able
to trigger this crash intentionally and too often.
- DoS: drop a wrong assertion/crash (!1718)
Someone controlling the DNS traffic will most likely be able
to trigger this crash intentionally and too often.
Bugfixes:
- manager: prometheus metrics update (!1703, #917, !1712)
- added missing metrics split by IPv4 and IPv6
- typo: resolver_answer_flags_rd_total -> resolver_answer_flag_rd_total
- /dnssec/trust-anchors-files: fix resolver startup (!1704)
- /network/edns-buffer-size: fix swapped upstream+downstream (!1711)
- cache: fix a crash in case garbage collection is too slow (!1713)
[system] assertion "env->is_cache" failed in cdb_write
- /cache/prefill: fix 6.0.13 regression (!1705)
- datamodel: improve file permission check (#933, !1714)
- NO_CACHE flag: fix and tweak its behavior (!1715)
Improvements:
- update/more precise default answers for special names (!1709)
https://www.iana.org/assignments/special-use-domain-nameshttps://www.iana.org/assignments/locally-served-dns-zones
- kresctl: strict validation is now disabled by default (!1714)
Full changelog:
https://gitlab.nic.cz/knot/knot-resolver/raw/v6.0.15/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-6.0.15.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-6.0.15.tar.xz.asc
Documentation:
https://www.knot-resolver.cz/documentation/v6.0.15/
--
Ales Mrazek
PGP: 3057 EE9A 448F 362D 7420 5A77 9AB1 20DA 0A76 F6DE
Hello.
On 23/06/2025 10.18, Stéphane Paillet wrote:
> I would like to know if it's possible to split the config.yaml in
> several files (the main config in one file, acl and views section in
> another, data-local section with rpz lists and tags to rely acl lists
> to blocklists in another), and if the answer is yes, how can I do ?
Currently it's not possible. You could of course use some generator
that produces the config.yaml, but that's of course less ergonomic.
Incidentally we have this WIP:
https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1710
--Vladimir
