Project

General

Profile

Actions

Bug #4407

closed

unbound advanced settings broken

Added by Andreas Pflug over 6 years ago. Updated about 6 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Category:
DNS Resolver
Target version:
-
Start date:
02/11/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:
All

Description

Same symptom as https://redmine.pfsense.org/issues/4090, but a different reason:

When domain overrides are set, any custom option will break the unbound.conf (syntax error). This happens, because custom unbound options are written to unbound.conf after domain overrides which apparently isn't legal (the options are probably interpreted as stub-domain parameter).

Moving {$custom_options} in /etc/inc/unbound.inc BEFORE all includes fixes the problem.

Actions #1

Updated by Phillip Davis over 6 years ago

If you have a patch change that works, it will be very easy for the devs if you make the edit at https://github.com/pfsense and submit a pull request.
That will save someone else working out exactly where is the place to move custom_options.

Actions #2

Updated by Kill Bill over 6 years ago

What advanced settings? This is just not true in general. Prefix the custom options with server: as noted on the bug you linked. I have many domain overrides, placing stuff like

server:
harden-below-nxdomain: yes

into advanced settings works perfectly fine and breaks nothing.

Actions #3

Updated by Andreas Pflug over 6 years ago

In my case, I need do-not-query-localhost: no set.

Actions #4

Updated by Andreas Pflug over 6 years ago

Kill Bill wrote:

What advanced settings? This is just not true in general. Prefix the custom options with server: as noted on the bug you linked. I have many domain overrides, placing stuff like

[...]

into advanced settings works perfectly fine and breaks nothing.

Ok, taken from your example, I found that adding server: makes the config working again. This is fine if you know it, but appears as quite a pitfall to me. Moving the custom option generation as suggested would make any option appear under the server section automatically, just as it is without domain/host overrides.

Actions #5

Updated by Kill Bill over 6 years ago

Andreas Pflug wrote:

Moving the custom option generation as suggested would make any option appear under the server section automatically, just as it is without domain/host overrides.

How does that fix anything? The server: clause is not the place for different kind of things, like the stub zone and forward zone options, which need to go under stub-zone: and forward-zone: clauses, respectively.

Actions #6

Updated by Kill Bill over 6 years ago

Can we please append a link to unbound.conf(5) manpage (https://www.unbound.net/documentation/unbound.conf.html) with a note to stick any advanced options under appropriate clause? Like, after the "Enter any additional configuration parameters to add to the DNS Resolver configuration here, separated by a newline" text below the General Settings - Advanced box... (Users should know what they are doing with advanced stuff, or just not use it at all.)

Actions #7

Updated by Andreas Pflug over 6 years ago

Kill Bill wrote:

The server: clause is not the place for different kind of things, like the stub zone and forward zone options, which need to go under stub-zone: and forward-zone: clauses, respectively.

I don't question that. But currently, a single custom option is generated under an arbitrary zone. It might be server: if no overrides are present, might be stub-zone: , or something different.
Generating it before other includes would make the server: section default, with the possibility to override it later.

Actions #8

Updated by Chris Buechler over 6 years ago

  • Status changed from New to Rejected

nothing is broken, just have to put things in correctly. added #4411 to add input validation at some point to prevent foot-shooting.

Actions #9

Updated by Chris Buechler about 6 years ago

  • Target version deleted (2.2.1)
Actions

Also available in: Atom PDF