Unbound can't start after snapshot update (new thread!)

wagonza

wagonza is one of the additional (advanced) features going to be DNSSEC encryption

By encryption I assume you mean you want the contents of the DNS packets encrypted? DNSSEC's aim is to ensure the authenticity of the record i.e unbound will use the public key to authenticate whether the RRSet that it receives is authorized. This is obviously already in the package.

I think you may want to look at DNSCurve which provides encryption of DNS packets.

The advanced features are more related optimization and fine tuning features for Unbound, which are mainly aimed for larger/busy installs.

iFloris

Since yesterday evening something changed in my installation of unbound.

I've been getting a lot of the following:```
php[2147483647] /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1309508768] unbound[21850:0] error: can't bind socket: Can't assign requested address [1309508768] unbound[21850:0] debug: failed address 2001:470:snip:snip::1 port 53 [1309508768] unbound[21850:0] fatal error: could not open ports'


Those errors only show when I have the lan interface selected to query from.
Using either wan or wan-v6 I see the following:

php[2147483647] : The command '/usr/local/sbin/unbound-control dump_cache > /var/tmp/unbound_cache' returned exit code '1', the output was ''


What could be wrong?
Is there something that I have set up incorrectly?

Edit 19-07:

Sorry to bump an old thread, but there might be something new here.
I've been doing some additional digging while running the default dns forwarder while unbound was out of order.
After setting unbound's logging level to the maximum I found some interesting errors in /var/log/unbound.log.

Jul 19 18:27:32 firebox1 unbound: [58109:0] debug: setup SSL certificates
Jul 19 18:27:32 firebox1 unbound: [58109:0] warning: did not exit gracefully last time (33360)
Jul 19 18:27:32 firebox1 unbound: [58380:0] debug: chdir to /usr/local/etc/unbound
Jul 19 18:27:32 firebox1 unbound: [58380:0] debug: drop user privileges, run as unbound
Jul 19 18:27:32 firebox1 unbound: [58380:0] error: error parsing local-data 'www.facebook.com IN A 2620:0:1cfe:face:b00c::3': Syntax error, could not parse the RR's rdata
Jul 19 18:27:32 firebox1 unbound: [58380:0] error: Bad local-data RR www.facebook.com IN A 2620:0:1cfe:face:b00c::3
Jul 19 18:27:32 firebox1 unbound: [58380:0] fatal error: Could not set up local zones
Jul 19 18:29:11 firebox1 unbound: [42872:0] debug: setup SSL certificates
Jul 19 18:29:11 firebox1 unbound: [42872:0] warning: did not exit gracefully last time (58380)
Jul 19 18:29:11 firebox1 unbound: [43007:0] debug: chdir to /usr/local/etc/unbound
Jul 19 18:29:11 firebox1 unbound: [43007:0] debug: drop user privileges, run as unbound
Jul 19 18:29:11 firebox1 unbound: [43007:0] error: error parsing local-data 'firebox1.domain IN A 2001:470:xxxx:xxx::1': Syntax error, could not parse the RR's rdata
Jul 19 18:29:11 firebox1 unbound: [43007:0] error: Bad local-data RR firebox1.domain IN A 2001:470:xxxx:xxx::1
Jul 19 18:29:11 firebox1 unbound: [43007:0] fatal error: Could not set up local zones

Etcetera.

In dnsforwarder I've made some edits to always forward the dns request for my pfsense installation to the v6 address as well as always using the v6 facebook.
I've also added numerous other dns overrides to have clients use v6.
It seems that unbound /really/ doesn't like those addresses.

What do you guys think?

Is there a different (right?) way of doing this?
Would removing all of my overrides help?

Update 01-08:

I've removed all my v6 overrides in dns forwarder and unbound now successfully starts up.

wagonza

@iFloris:

Jul 19 18:29:11 firebox1 unbound: [43007:0] error: error parsing local-data 'firebox1.domain IN A 2001:470:xxxx:xxx::1': Syntax error, could not parse the RR's rdata
Jul 19 18:29:11 firebox1 unbound: [43007:0] error: Bad local-data RR firebox1.domain IN A 2001:470:xxxx:xxx::1

In dnsforwarder I've made some edits to always forward the dns request for my pfsense installation to the v6 address as well as always using the v6 facebook.
I've also added numerous other dns overrides to have clients use v6.
It seems that unbound /really/ doesn't like those addresses.

For v6 RR's it should be "IN AAAA". Ive just committed a fix - so reinstall the package and you can add your v6 host entries back.

iFloris

Thanks a lot!

wagonza

Cool - all working for you?

iFloris

Unfortunately, not everything is working as I imagine it should.
I've been getting errors about ssl handshakes and was only able to get unbound up and running after enabling forwarding mode and removing the testing v6 dns overrides.

php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control load_cache < /var/tmp/unbound_cache' returned exit code '1', the output was '[1313843955] unbound-control[44879:0] debug: address 127.0.0.1 port 953 [1313843955] unbound-control[44879:0] error: connect: Operation timed out'
php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control forward ' returned exit code '1', the output was 'error: SSL handshake failed'
php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1313843873] unbound[44392:0] debug: creating udp4 socket xxx.xxx.xxx.xxx 53 [1313843873] unbound[44392:0] error: bind: address already in use [1313843873] unbound[44392:0] fatal error: could not open ports'

I am not entirely sure what is happening here.

wagonza

@iFloris:

Unfortunately, not everything is working as I imagine it should.
I've been getting errors about ssl handshakes and was only able to get unbound up and running after enabling forwarding mode and removing the testing v6 dns overrides.

php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control load_cache < /var/tmp/unbound_cache' returned exit code '1', the output was '[1313843955] unbound-control[44879:0] debug: address 127.0.0.1 port 953 [1313843955] unbound-control[44879:0] error: connect: Operation timed out'
php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control forward ' returned exit code '1', the output was 'error: SSL handshake failed'
php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1313843873] unbound[44392:0] debug: creating udp4 socket xxx.xxx.xxx.xxx 53 [1313843873] unbound[44392:0] error: bind: address already in use [1313843873] unbound[44392:0] fatal error: could not open ports'

I am not entirely sure what is happening here.

The ssl handshake problem is related to the first error where Unbound could not connect to the local remote control.
Im investigating…

wagonza

ok all fixed - reinstall. Also fixed some other startup errors.

iFloris

Sorry wagonza, but unbound still doesn't fully work for me.

Unbound is reporting the following error over and over again:```
php[2147483647] : The command '/usr/local/sbin/unbound-control forward ' returned exit code '1', the output was '[1314033304] unbound-control[45855:0] debug: address 127.0.0.1 port 953 [1314033304] unbound-control[45855:0] error: connect: Operation timed out'


Also, when clicking save in the webconfigurator, everything php-related seems to lock up for a while.
Ssh still works.
After a while, the webconfigurator starts working again and I see the following line in the syslog:```
kernel: pid 62904 (php), uid 0: exited on signal 11 (core dumped)

Removing the testing v6 redirects helps unbound start again.

wagonza

You did reinstall the package right?

iFloris

To be certain I just reinstalled Unbound again, although I think I did.
When I have v6 overrides in dns forwarder, unbound fails to start without error messages.
It's not a big deal, as the v6 overrides are merely out of curiosity and to drive global v6 traffic a bit higher.

wagonza

Hrmm odd if i add a v6 override, for example:

v6 google.com 2800:3f0:XXX:XXX::1014

And restart unbound it is fine.
Do me a favour please, log in via ssh and execute a unbound-checkconf - it should return "unbound-checkconf: no errors in /usr/local/etc/unbound/unbound.conf"

iFloris

Unbound gives me a no errors reply, just as you said it should. I'll try and enable my testing v6 forwards one by one to see if there is a specific scenario which causes unbound to stop working. Thanks for your help so far!

wagonza

@iFloris:

Unbound gives me a no errors reply, just as you said it should. I'll try and enable my testing v6 forwards one by one to see if there is a specific scenario which causes unbound to stop working. Thanks for your help so far!

Have you managed to test the v6 forwards?

iFloris

Hello Wagonza,

Unbound still gives me errors in the log but works with the forwards.
Adding the forwards one by one and reloading unbound in the ssh-console has helped unbound start properly.

Thanks for all your help!

wagonza

@iFloris:

Hello Wagonza,

Unbound still gives me errors in the log but works with the forwards.
Adding the forwards one by one and reloading unbound in the ssh-console has helped unbound start properly.

Thanks for all your help!

What error did you see in the logs, the same timeout one? Can you do me a favour please and pm me the xml of the unbound section of your config.xml?

Thanks

iFloris

The very same. I will send you the unbound section(s) of my config.xml.

Edit: Sent.

wagonza

Thanks, got it - will go through it a little later and let you know.

wagonza

Problem sorted with host over rides that have empty host values. So just reinstall the package. Otherwise any other problems, please open up a new thread.

iFloris

Having set some v6 forwards yesterday, I can confirm that the new fixes work as expected.
Thanks a lot wagonza!