Hi,

I noticed that Knot Resolver 6.5.0 drops UDP queries when the source port is lower than 1024.
This is caused by min_udp_source_port = 1024 added in version 6.0.7 (!1507).
There is no config option to change this, and there are no logs unless debug mode is enabled.

Environment
- Knot Resolver 6.5.0-cznic.1~bookworm
- Debian 12

What happens
Some of our clients send DNS queries from low source ports:

- Port 53: home routers asking for AFTR and NTP server names
- Port 753: online fiscal cash registers
- Ports 1, 565, and others

In just 60 seconds, we saw about 600 client IPs that did not get an answer.

How to reproduce

dig -b 127.0.0.2#53 @127.0.0.1 example.com
# Timeout

dig -b 127.0.0.2#1023 @127.0.0.1 example.com
# Timeout

dig -b 127.0.0.2#1024 @127.0.0.1 example.com
# Answer

RFC

RFC 5452, section 9.2, allows source ports "53, or 1024 and above".
RFC 1035 only defines the server port, so at least source port 53 should be accepted.

Workaround
I found that this works in config.yaml:

lua:
  script: |
    require('ffi').C.the_network.min_udp_source_port = 0
But it uses an internal structure, so it may not be safe for future versions.

Question

Could Knot Resolver accept queries from source port 53 by default, as RFC 5452 allows ?
Maybe other low ports could also be accepted, while blocking only ports that may cause UDP loops, like echo (7) and chargen (19).
It would also be useful to have an official config option to change the minimum UDP source port.

Best regards,
Mateusz Masłowski