From 112ba5f7ca24776790b295617104a5cb370709d5 Mon Sep 17 00:00:00 2001 From: Daniel Akulenok Date: Wed, 28 Jan 2026 23:02:59 +0100 Subject: [PATCH 01/13] feat: implement list_address_port_tls and parent_address_port_tls macros - Add list_address_port_tls macro for rendering address lists with port and tls parameters - Add parent_address_port_tls macro for parent statements with global port/tls - Follow existing naming pattern with separate list_ and parent_ macros - Supports forwarders, primaries, and similar blocks with port/tls grammar --- templates/named.conf.functions.j2 | 32 +++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/templates/named.conf.functions.j2 b/templates/named.conf.functions.j2 index 0ba8399..06cc86a 100644 --- a/templates/named.conf.functions.j2 +++ b/templates/named.conf.functions.j2 @@ -110,4 +110,36 @@ {% else %} {{ name }} "{{ value }}"; {% endif %} +{% endmacro %} + +{% macro list_address_port_tls(dict, indent=bind9_config_indent) %} +{# This macro is for use for statements with grammar like #} +{# address port 00 tls str; address port 00 tls str; #} +{# it is usually called by a parent macro #} +{% filter indent(indent, true) %} +{% for item in dict %} +{% if item is not mapping %} +{{ item }}; +{% else %} +{{ item.address }} +{{- (' port ' + item.port | string) if item.port is defined and item.port -}} +{{- (' tls ' + item.tls | string) if item.tls is defined and item.tls -}}; +{% endif %} +{% endfor %} +{% endfilter %} +{% endmacro %} + +{% macro parent_address_port_tls(name, dict) %} +{# This macro is for use for statements with grammar like #} +{# statement port 00 tls str { address port 00 tls str; address port 00 tls str; } #} +{# the list inside the statement is handled by list_address_port_tls #} +{% if dict is not mapping and dict is iterable %} +{{ name }} { +{{ list_address_port_tls(dict) }}}; +{% else %} +{{ name }} +{{- (' port ' + dict.port | string) if dict.port is defined and dict.port -}} +{{- (' tls ' + dict.tls | string) if dict.tls is defined and dict.tls }} { +{{ list_address_port_tls(dict.addresses) }}}; +{% endif %} {% endmacro %} \ No newline at end of file From 3d2919721b4ba5cdf0bdd197831619ef3dbd26b5 Mon Sep 17 00:00:00 2001 From: Daniel Akulenok Date: Wed, 28 Jan 2026 23:03:07 +0100 Subject: [PATCH 02/13] feat: use parent_address_port_tls macro for forwarders - Update named.conf.options.j2 to use parent_address_port_tls for forwarders - Update named.conf.zone.j2 to use parent_address_port_tls for forwarders - Enables support for per-address and global port/tls parameters --- templates/named.conf.options.j2 | 2 +- templates/named.conf.zone.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/named.conf.options.j2 b/templates/named.conf.options.j2 index afdbaf7..27c2237 100644 --- a/templates/named.conf.options.j2 +++ b/templates/named.conf.options.j2 @@ -101,7 +101,7 @@ listen-on {{ functions.simple_item_list(item.options.listen_on.addresses) }}}; {% endfor %} {% endif %} -{{ functions.parent_address_port_dscp("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}} +{{ functions.parent_address_port_tls("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}} {% if item.options.dual_stack_servers is defined and item.options.dual_stack_servers %} dual-stack-servers {{ (' port ' + item.options.dual_stack_servers.port | string) if item.options.dual_stack_servers.port is defined and item.options.dual_stack_servers }} { diff --git a/templates/named.conf.zone.j2 b/templates/named.conf.zone.j2 index 0423220..bdf12ce 100644 --- a/templates/named.conf.zone.j2 +++ b/templates/named.conf.zone.j2 @@ -47,7 +47,7 @@ server-names { server-addresses { {{ functions.simple_item_list(zone.server_addresses) }}}; {% endif %} -{{ functions.parent_address_port_dscp('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}} +{{ functions.parent_address_port_tls('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}} {% if zone.allow_transfer is defined and zone.allow_transfer is not string %} allow-transfer {{- (' port ' + zone.allow_transfer.port | string) if zone.allow_transfer.port is defined and zone.allow_transfer.port -}} From e8f84fce0b4e17a1eeca957ba93817254e18e232 Mon Sep 17 00:00:00 2001 From: Daniel Akulenok Date: Wed, 28 Jan 2026 23:03:19 +0100 Subject: [PATCH 03/13] docs: update CONFIGURATION_GRAMMAR.md for forwarders port/tls support - Add tls parameter to forwarders grammar in options section - Add tls parameter to forwarders grammar in zone section - Update options and zone examples to demonstrate tls usage - Rename 'Address with Port/DSCP' section to 'Address with Port/TLS' - Update all data type examples to show port/tls patterns instead of port/dscp - Document global and per-address port/tls configuration options --- CONFIGURATION_GRAMMAR.md | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/CONFIGURATION_GRAMMAR.md b/CONFIGURATION_GRAMMAR.md index 2c8442a..fdde2df 100644 --- a/CONFIGURATION_GRAMMAR.md +++ b/CONFIGURATION_GRAMMAR.md @@ -458,6 +458,7 @@ options: -
- address:
port: + tls: # DNSSEC dnssec_enable: # DEPRECATED in 9.15+ @@ -593,7 +594,8 @@ options: forwarders: - 1.1.1.1 - - 8.8.8.8 + - address: 8.8.8.8 + tls: dot-tls dnssec_validation: auto @@ -917,6 +919,7 @@ zones: -
- address:
port: + tls: # DNSSEC dnssec_policy: # DNSSEC policy to use @@ -1017,7 +1020,8 @@ zones: forward: only forwarders: - 10.0.0.1 - - 10.0.0.2 + - address: 10.0.0.2 + tls: internal-tls ``` --- @@ -1079,9 +1083,9 @@ addresses: - 10.0.0.0/8 ``` -### Address with Port/DSCP +### Address with Port/TLS -For options accepting `address [port X] [dscp Y]`: +For options accepting `address [port X] [tls Y]` (e.g., `forwarders`): ```yaml # Simple list @@ -1089,27 +1093,28 @@ forwarders: - 1.1.1.1 - 8.8.8.8 -# With source port/dscp +# With global port/tls forwarders: - port: 5353 - dscp: 46 + port: 853 + tls: dot-tls addresses: - 1.1.1.1 - 8.8.8.8 -# Per-address port/dscp +# Per-address port/tls forwarders: - address: 1.1.1.1 port: 53 - address: 8.8.8.8 - port: 5353 - dscp: 46 + port: 853 + tls: cloudflare-tls # Mixed format forwarders: - 1.1.1.1 - address: 8.8.8.8 - port: 5353 + port: 853 + tls: dot-tls ``` ### Address with Key/TLS From d075e3ec1725183b137384e4e3dc2e90f1eae3b2 Mon Sep 17 00:00:00 2001 From: Daniel Akulenok Date: Wed, 28 Jan 2026 23:03:25 +0100 Subject: [PATCH 04/13] docs: update README.md with port/tls parameter patterns - Add clarification on different parameter combinations (port/dscp vs port/tls) - Replace generic 'IP_PORT_DSCP_OPTION' with 'ADDRESS_PORT_TLS_OPTION' example - Update all configuration examples to show port/tls parameters - Document usage of forwarders with TLS support - Improve documentation of flexible configuration formats --- README.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 8330195..9491dee 100644 --- a/README.md +++ b/README.md @@ -126,38 +126,43 @@ Simple options are defined just as that. ``` Some options have several optional parameters. For those, a somewhat flexible -configuration format has been created +configuration format has been created. Common patterns include: + +- **Address with Port/DSCP**: Used by options like `primaries`, `parental_agents` (e.g., `address [ port ] [ dscp ]`) +- **Address with Port/TLS**: Used by options like `forwarders` (e.g., `address [ port ] [ tls ]`) + ``` - IP_PORT_DSCP_OPTION: # Any option that is defined as one of: - #