[Solved] Update to 23.1.1: Unbound reporting broken/not working

[dumbo]

Hi,

with todays update it looks like something strange happened to unbound (and it's reporting tool).

Reporting stopped working. And getting a lot of errors within ounbound log:
[35098:1] error: recvfrom 40 failed: Protocol not available
...
[71101:0] error: remote control failed ssl crypto error:00000000:lib(0):func(0):reason(0)   
...

Looks like something is broken.

Restarted OPNsense and tried everything - but doesn't work.

EDIT: Issue solved!

Code: [Select]

opnsense-patch -a kulikov-a 404b9d5

[franco]

Do you really need to post in two threads and open a third?


Cheers,
Franco

[Fright]

at least some info..
this is unbound errors, not blocklist or logger modules i think.
is unbound itself working?

[dumbo]

is unbound itself working?

Yes - Unbound itself works without any issues. Despite all the errors within the logs and not working Unbound reporting.

[dumbo]

Do you really need to post in two threads and open a third?

Sorry - found out, that the other two topics do not fit.
So I thought it would be the best to have a separate topic on it to not influence the other topics in the wrong way.

[dumbo]

Looks like I found something.

1. It doesn't resolve client hostnames
2. when 'disabling'  Register DHCP leases &  Register DHCP static mappings it starts working again

But as I said - no hostname resolution (of local clients)

EDIT: Have to correct me... Stopped again working since a few minutes. 🤷🏼‍♂️

[cookiemonster]

You might have missed in the hurry to seek assistance, that you haven't provided any information about your setup. The Unbound setup and the system one that can affect this behaviour i.e. DNS settings in other parts of the system.

[Fright]

@dumbo
sorry, but it's a bit confusing. Are there any errors in the general log? does the unbound itself work exactly (does the resolution of at least some names work)? if you enable display of all messages (Deebug) in the unbound log, are there any messages like "info: dnsbl_module: no logging backend found."?

@tuto2
Hi!
after the update, I had a several times when the logger was tried to start before the pipe was ready.
producing "Unable to open pipe. This is likely because Unbound isn't running." and exit
making the pipe before list load fixed this.  (https://github.com/opnsense/core/blob/bc1a8778ab2140e46175ecf2546b634f87087f07/src/opnsense/service/templates/OPNsense/Unbound/core/dnsbl_module.py#L68)

Code: [Select]

        if self.stats_enabled:
            self.create_pipe_rdv()

        self.update_dnsbl(self.log_update_time)

maybe that makes sense?

[dumbo]

@dumbo
sorry, but it's a bit confusing. Are there any errors in the general log? does the unbound itself work exactly (does the resolution of at least some names work)? if you enable display of all messages (Deebug) in the unbound log, are there any messages like "info: dnsbl_module: no logging backend found."?

Hi. Concerning your questions:

• yes a lot of errors within general log of unbound
• Unbound still does work - only reporting is broken
• yes - it's flooding the unbound log

Code: [Select]

info: dnsbl_module: attempting to open pipe AND info: dnsbl_module: no logging backend found.

If I play with unbound settings it starts to work again for a short amount of time - then again no reporting and a lot of those messages within unbound debug log.

And what else does occour is, that the reporting tool (old not updated entries are still there) lost their client name resolution and only showing IPs instead of names.

[Fright]

ok, thanks. may be now the db is initializing so quickly that the pipe is not yet ready because the lists is still loading into memory.
can you try with:

Code: [Select]

opnsense-patch -a kulikov-a 404b9d5please? (need to reload unbound after the patch)

[Syon]

THX a lot. It solved my Problem from here.

[dumbo]

can you try with:

Code: [Select]

opnsense-patch -a kulikov-a 404b9d5please? (need to reload unbound after the patch)

Will try it later. Thanks.

[dumbo]

can you try with:

Code: [Select]

opnsense-patch -a kulikov-a 404b9d5please? (need to reload unbound after the patch)

Issue solved! As it's one of the main new features of 23.1 I hope there will be/come an update patch for the release.

Thx a lot!

[Fright]

@Syon @dumbo
thanks for the feedback!
I'll try to make a pr

[Fright]

for the ref. https://github.com/opnsense/core/pull/6331
AdSchellevis insisted that the patch do the right thing right away, not just play with the actions order 
so its

Code: [Select]

opnsense-patch 7ebe361now
imho it is better to use it now instead of the test one, but if everything works, then it can wait for the next release
included in 23.1.1_2