Unbound crashing

[seed]

Sometimes unbound is crashing and the whole device gets unresponsive


2023-08-22T04:14:01   Critical   unbound   [85028:3] fatal error: Could not initialize thread   
2023-08-22T04:14:01   Error   unbound   [85028:3] error: Could not set root or stub hints
2023-08-22T04:14:01   Error   unbound   [85028:3] error: reading root hints /root.hints 2:12: Syntax error, could not parse the RR's type   
           TypeError: an integer is required (got type NoneType)   
           os.write(self._pipe_fd, res.encode())   
           File "dnsbl_module.py", line 226, in log_entry   
           mod_env['logger'].log_entry(   
           File "dnsbl_module.py", line 378, in cache_cb   
           logger.close()   
           File "dnsbl_module.py", line 443, in deinit

[CJ]

Can you post your Unbound config?  Are you using any custom blocklists?

[seed]

i have no blocklist activated. No DNS blocking

my config from configctl
host overrides redacted.

Code Select Expand

   <unboundplus version="1.0.6">
      <general>
        <enabled>1</enabled>
        <port>53</port>
        <stats>1</stats>
        <active_interface/>
        <dnssec>1</dnssec>
        <dns64>0</dns64>
        <dns64prefix>64:ff9b::/96</dns64prefix>
        <noarecords>0</noarecords>
        <regdhcp>0</regdhcp>
        <regdhcpdomain/>
        <regdhcpstatic>0</regdhcpstatic>
        <noreglladdr6>1</noreglladdr6>
        <noregrecords>0</noregrecords>
        <txtsupport>0</txtsupport>
        <cacheflush>1</cacheflush>
        <local_zone_type>transparent</local_zone_type>
        <outgoing_interface/>
        <enable_wpad>0</enable_wpad>
      </general>
      <advanced>
        <hideidentity>1</hideidentity>
        <hideversion>1</hideversion>
        <prefetch>0</prefetch>
        <prefetchkey>0</prefetchkey>
        <dnssecstripped>1</dnssecstripped>
        <serveexpired>0</serveexpired>
        <serveexpiredreplyttl/>
        <serveexpiredttl/>
        <serveexpiredttlreset>0</serveexpiredttlreset>
        <serveexpiredclienttimeout/>
        <qnameminstrict>0</qnameminstrict>
        <extendedstatistics>1</extendedstatistics>
        <logqueries>1</logqueries>
        <logreplies>0</logreplies>
        <logtagqueryreply>0</logtagqueryreply>
        <logservfail>0</logservfail>
        <loglocalactions>0</loglocalactions>
        <logverbosity>1</logverbosity>
        <valloglevel>0</valloglevel>
        <privatedomain/>
        <privateaddress>0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,169.254.0.0/16,172.16.0.0/12,192.0.2.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,233.252.0.0/24,::1/128,2001:db8::/32,fc00::/8,fd00::/8,fe80::/10</privateaddress>
        <insecuredomain/>
        <msgcachesize>100m</msgcachesize>
        <rrsetcachesize>200m</rrsetcachesize>
        <outgoingnumtcp>10</outgoingnumtcp>
        <incomingnumtcp>10</incomingnumtcp>
        <numqueriesperthread>4096</numqueriesperthread>
        <outgoingrange>8192</outgoingrange>
        <jostletimeout>200</jostletimeout>
        <cachemaxttl/>
        <cachemaxnegativettl/>
        <cacheminttl/>
        <infrahostttl>900</infrahostttl>
        <infrakeepprobing>0</infrakeepprobing>
        <infracachenumhosts>50000</infracachenumhosts>
        <unwantedreplythreshold>10000000</unwantedreplythreshold>
      </advanced>
      <acls>
        <default_action>allow</default_action>
      </acls>
      <dnsbl>
        <enabled>0</enabled>
        <safesearch>0</safesearch>
        <type>atf,aa,ag,bla0,bla,blf,blg,blp,blr,blr0,bls,blt,blt1,ep</type>
        <lists/>        <whitelists>*.redacted.tld,*.redacted.tld,*.redacted.tld,*.redacted.internal.tld</whitelists>
        <blocklists/>
        <wildcards/>
        <address/>
        <nxdomain>0</nxdomain>
      </dnsbl>
      <forwarding>
        <enabled>0</enabled>
      </forwarding>

[CJ]

Odd.  What version are you running?  23.7?

Why do you have dnsbl items configured if you're not using it?

[karlson2k]

Not sure that it is related, but I have problems with Unbound as well.
In my case ubound process starts eating 100% of CPU (as reported by top command).
Neither pluginctl nor web-interface can restart or stop the unbound daemon. When tried from web-interface it freezes for a minute (or so) and ends with nothing.
kill command can stop unbound only if used as "kill -9" (or "kill -kill").
This is pretty annoying.

I've removed "so-reuseport: no" from custom config to see whether it could fix anything. Unbound is running again with single thread only.

Problem started after upgrading from 23.1.x

I reported first here: https://forum.opnsense.org/index.php?topic=35475.0
Another similar report is here: https://forum.opnsense.org/index.php?topic=35523.0

[seed]

Odd.  What version are you running?  23.7?

Why do you have dnsbl items configured if you're not using it?

Running the latest 23.7.1_3 always updating to the latest version within 7 days.

DNSbl was configured buit caused probles so its disabled.


No idea why unbound is crashing once every few months?

[karlson2k]

In my case it's crashing once per day.

[karlson2k]

Probably related as well: https://forum.opnsense.org/index.php?topic=35566.0

[franco]

Thanks for the report. Can you try this patch? https://github.com/opnsense/core/commit/7406a5067f8

# opnsense-patch 7406a5067f8


Cheers,
Franco

[seed]

Thank you.

Applied the patch and restarted the service. DNS still works. Since i dont know how to trigger the bug i hope its fixed.

[franco]

If it should crash again posting the error helps a lot to take another look.


Cheers,
Franco

[karlson2k]

Applied the patch.
Tried to restart the Unbound from GUI, got in log

Code Select Expand

/usr/local/sbin/pluginctl: The command '/bin/kill -'TERM' '4507''(pid:/var/run/unbound.pid) returned exit code '1', the output was 'kill: 4507: No such process'
Unbound stopped. Had to start it manually.
Manual start was successful.

[franco]

The error only tells us Unbound was already stopped when it was attempted to be stopped. Hardly a fatal issue here ;)


Cheers,
Franco

[bbin]

So good news, bad news.  The bad news is that unbound is still failing after roughly 30 minutes.  The good news is that the patch allows me to restart the service without rebooting.

[seed]

it might help sending the debug log entry from the crash