[S] Change in openvpn[master]: dns: correctly handle dnssec settings

Attention is currently required from: d12fk, flichtenheld, plaisthos.

selvanair has posted comments on this change by selvanair. ( http://gerrit.openvpn.net/c/openvpn/+/1643?usp=email )

Change subject: dns: correctly handle dnssec settings
......................................................................


Patch Set 1:

(3 comments)

File include/openvpn-msg.h:

http://gerrit.openvpn.net/c/openvpn/+/1643/comment/d51f138a_6bc6d024?usp=email :
PS1, Line 114:     nrpt_dnssec_required = 1 << 1,
> Is this really needed? As far as I can remember Windows has no `optional` setting, i.e. […]
man-page  says user can set  optional, and I had no idea how to provide that rather than this. What this does is for the resolver to set DO flag but not require validation. Treating anything other than "no" as "yes" is not correct when we allo user to set yes/no/optional.


File src/openvpn/dns.h:

http://gerrit.openvpn.net/c/openvpn/+/1643/comment/5873967f_9eb03412?usp=email :
PS1, Line 32:     DNS_SECURITY_UNSET,
> Not sure if we should get rid of `unset` since might not have a `optional` setting. […]
As "dns server n dnssec foo" is not a mandatory option, UNSET is useless and error-prone. Just decide on a defualt value and let the variable have that by default. UNSET is not handled anywhere.


File src/openvpnserv/interactive.c:

http://gerrit.openvpn.net/c/openvpn/+/1643/comment/95f23091_fe96ccc6?usp=email :
PS1, Line 2472:             nrpt_flags_t dnssec)
> Think it makes sense to rename `dnssec` -> `flags` or `nrpt_flags`, since it could have additional t […]
Acknowledged



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1643?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id514b06223cb55295c92b1fa6727f03d6e06befe
Gerrit-Change-Number: 1643
Gerrit-PatchSet: 1
Gerrit-Owner: selvanair <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: d12fk <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Attention: d12fk <[email protected]>
Gerrit-Comment-Date: Wed, 29 Apr 2026 13:01:50 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: d12fk <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel