[knot-resolver-users] Knot Resolver 6 drops UDP queries from source port < 1024 (including port 53)

Hi, I noticed that Knot Resolver 6.5.0 drops UDP queries when the source port is lower than 1024. This is caused by min_udp_source_port = 1024 added in version 6.0.7 (!1507). There is no config option to change this, and there are no logs unless debug mode is enabled. Environment - Knot Resolver 6.5.0-cznic.1~bookworm - Debian 12 What happens Some of our clients send DNS queries from low source ports: - Port 53: home routers asking for AFTR and NTP server names - Port 753: online fiscal cash registers - Ports 1, 565, and others In just 60 seconds, we saw about 600 client IPs that did not get an answer. How to reproduce dig -b 127.0.0.2#53 @127.0.0.1 example.com # Timeout dig -b 127.0.0.2#1023 @127.0.0.1 example.com # Timeout dig -b 127.0.0.2#1024 @127.0.0.1 example.com # Answer RFC RFC 5452, section 9.2, allows source ports "53, or 1024 and above". RFC 1035 only defines the server port, so at least source port 53 should be accepted. Workaround I found that this works in config.yaml: lua: script: | require('ffi').C.the_network.min_udp_source_port = 0 But it uses an internal structure, so it may not be safe for future versions. Question Could Knot Resolver accept queries from source port 53 by default, as RFC 5452 allows ? Maybe other low ports could also be accepted, while blocking only ports that may cause UDP loops, like echo (7) and chargen (19). It would also be useful to have an official config option to change the minimum UDP source port. Best regards, Mateusz Masłowski