DNS Resolver (unbound) / Can't change config

[svaldes]

Hi, I can change the configuration of the DNS Resolver settings, we can add Host Overrides, but no change General DNS Resolver Options. After change something when I save I get this error:

The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1473785216] unbound-checkconf[7939:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
I have this problem on others pfSenses too. All of them and this one included are in version 2.3.2-RELEASE but they were upgraded from previous versions. I have tried to disable DNS Resolver but when I re-enable the settings persist and still can't make any change.

The DNS Resolver is working, but now I need to add another interface and I can't.

[fscms]

Hi,

i'am getting exactly the same error, when i make some change and save this error appear and config stay unchanged.

tanks

[fscms]

Hi, svaldes

try to reboot the PFsense, work with me, the error dissapear.

[Fabio72]

same error for me

The following input errors were detected:

    The generated config file cannot be parsed by unbound. Please correct the following errors:
    /var/unbound/test/unbound_server.key: No such file or directory
    [1484640674] unbound-checkconf[16694:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist

Version 	2.3.2-RELEASE-p1 (amd64)
built on Tue Sep 27 12:13:07 CDT 2016
FreeBSD 10.3-RELEASE-p9

##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:

chroot: /var/unbound
username: "unbound"
directory: "/var/unbound"
pidfile: "/var/run/unbound.pid"
use-syslog: yes
port: 53
verbosity: 1
hide-identity: yes
hide-version: yes
harden-glue: yes
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "validator iterator"
unwanted-reply-threshold: 0
num-queries-per-thread: 4096
jostle-timeout: 200
infra-host-ttl: 900
infra-cache-numhosts: 10000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 4096
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
msg-cache-size: 4m
rrset-cache-size: 8m

num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
outgoing-range: 4096
#so-rcvbuf: 4m
auto-trust-anchor-file: /var/unbound/root.key
prefetch: no
prefetch-key: no
use-caps-for-id: no
# Statistics
# Unbound Statistics
statistics-interval: 0
extended-statistics: yes
statistics-cumulative: yes

# Interface IP(s) to bind to
interface: 0.0.0.0
interface: ::0
interface-automatic: yes

# Outgoing interfaces to be used

# DNS Rebinding
# For DNS Rebinding prevention
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 169.254.0.0/16
private-address: 192.168.0.0/16
private-address: fd00::/8
private-address: fe80::/10

# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# dhcp lease entries
include: /var/unbound/dhcpleases_entries.conf

# Domain overrides
include: /var/unbound/domainoverrides.conf

# Unbound custom options
server:include: /var/unbound/pfb_dnsbl.conf

###
# Remote Control Config
###
include: /var/unbound/remotecontrol.conf

[johnpoz]

I would guess this is your problem

server:include: /var/unbound/pfb_dnsbl.conf

No mention that your running pfblocker…

[Fabio72]

So it's a pfblocker issue?
May I open a discussion on pfblocker thread?

[johnpoz]

Well I am not sure that is the issue, but that would be my educated guess… Why don't you remove it and see if that fixes your problem.  If so then yes you could start a thread on the packages section.

For starters you could look to see what is being loaded from that conf file.. Since your conf doesn't point to that key file that is saying is not there, etc.

your says
auto-trust-anchor-file: /var/unbound/root.key

Error says
/var/unbound/test/unbound_server.key" does not exist

[Fabio72]

The file /var/unbound/pfb_dnsbl.conf only contains a logn list of local-data/local-zone entries

And I cannot save settings also if I remove the pfblocker include (using the gui)

[johnpoz]

well look into any included conf files.. since fro the conf posted there is no reference to that file.

[Fabio72]

[2.3.2-RELEASE][admin@pfSense.arda]/var/unbound: grep -R -i unbound_server.key *
remotecontrol.conf:	server-key-file: "/var/unbound/unbound_server.key"

Where else can I search? Is unbound chrooted?

[2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /unbound_server.key *
unbound.inc:	server-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.key"
[2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 

[2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /test *
unbound.inc:	$cfgsubdir = "/test";
[2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 

content of /etc/inc/unbound.inc

function test_unbound_config($unboundcfg, &$output) {
        global $g;

        $cfgsubdir = "/test";
        unbound_generate_config($unboundcfg, $cfgsubdir);
        unbound_remote_control_setup($cfgsubdir);
        do_as_unbound_user("unbound-anchor", $cfgsubdir);

        $cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";

        $rv = 0;
        exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
        rmdir_recursive($cfgdir);

        return $rv;
}

[doktornotor]

Just disable DNSSEC if you cannot get it working. Are you using some kind of RAM disks or nanobsd?

[Fabio72]

I cannot disable DNSSEC for the same error. I'm using the full 64bit release without ramdisk.
DNS resolver works but I cannot make any change. Reload works.

[doktornotor]

Have you tried to reboot as suggested above? Also, no idea why did you use this thread since you definitely do NOT have the same error.

Anyway.

mkdir /var/unbound/test/
cp -ax /var/unbound/*.{key,pem} /var/unbound/test/

and try again.

[Fabio72]

Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

[doktornotor]

No idea what kind of legacy configuration crap have you imported on all of your boxes across some upgrades, sorry. You can try with 2.3.3 but I sincerely doubt it'd change anything. Other that that

• wipe /var/unbound altogether
• switch to DNS forwarder
• make a config backup, wipe everything between <unbound>…</unbound> tags, restore the config (will force a reboot)
• reconfigure the resolver from from scratch

[voxeljorz]

@Fabio72:

Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

Same here too.

_The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
    /var/unbound/test/unbound_server.key: No such file or directory
    [1484738643] unbound-checkconf[70766:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist_

I have to execute this everytime there are changes to be made:
_  mkdir /var/unbound/test/
  cp -ax /var/unbound/*.{key,pem} /var/unbound/test/_

I am also getting this error on DNS Resolver log: (a lot of them)
  notice: remote address is 192.168.2.245 port 53134
  notice: sendmsg failed: No buffer space available

[johnpoz]

Not sure where this /test dir is coming from.. I look on my /var/unbound dir and I don't see any test dir..

I can change my unbound conf without any issues.

Are you running 2.3.3 or 2.4 of pfsense??

[voxeljorz]

I am currently using 2.3.2-RELEASE-p1

[johnpoz]

So from the code it looks like that sub dir is created but then removed after the test

function test_unbound_config($unboundcfg, &$output) {
	global $g;
	$cfgsubdir = "/test";
	unbound_generate_config($unboundcfg, $cfgsubdir);
	unbound_remote_control_setup($cfgsubdir);
	do_as_unbound_user("unbound-anchor", $cfgsubdir);
	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
	$rv = 0;
	exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
	rmdir_recursive($cfgdir);
	return $rv;
}

rmdir_recursive($cfgdir);

So something is failing here?  Just not sure what..

[Veldkornet]

I'm also having this problem. Setup pfSense from scratch on 2.3.3_p1.

The below does indeed work once off, so I need to run it every time I change the configuration.

mkdir /var/unbound/test/
cp -ax /var/unbound/*.{key,pem} /var/unbound/test/

Is there a bug logged for it already?