Project

General

Profile

Feature #9251

DNS Resolver (Unbound) Python Integration

Added by BBcan177 . about 1 year ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
DNS Resolver
Target version:
Start date:
01/03/2019
Due date:
% Done:

100%

Estimated time:

Description

Add the python module integration to the DNS Resolver (Unbound)

The only remaining function, would be to mount the /bin and /lib folders to the /var/unbound folder.

mkdir -p /var/unbound/usr/local/bin
mkdir -p /var/unbound/usr/local/lib
mount_nullfs -o ro /usr/local/bin/ /var/unbound/usr/local/bin
mount_nullfs -o ro /usr/local/lib/ /var/unbound/usr/local/lib

I have coded the following for pfBlockerNG for testing purposes, but this will need to be adapted for pfSense and called at bootup before Unbound starts or it will fail to load without the mounts. It will also need notices/log info message code added.
https://gist.github.com/BBcan177/b5d9506f9d1ca1ff2457f62bbaaaf878

netflix-no-aaaa.py (1.37 KB) netflix-no-aaaa.py Jim Pingle, 01/08/2020 11:16 AM

Associated revisions

Revision 741892ee (diff)
Added by Jim Pingle about 1 month ago

Mount devfs for unbound when python is enabled. Fixes #9251

Revision d83d2280 (diff)
Added by Jim Pingle about 1 month ago

Mount devfs for unbound when python is enabled. Fixes #9251

(cherry picked from commit 741892ee23a9085b71fa94fcfb8375044fec6ee2)

History

#1 Updated by BBcan177 . about 1 year ago

The final code for mounting the /bin and /lib folders has been submitted for review (Services.inc):
https://github.com/pfsense/pfsense/pull/4029/commits/a4ca3a94fe7dbbed2177bcb3eccbd667bc6ca993

#2 Updated by Joshua Sign about 1 year ago

+1 : good feature !
nice work!

#3 Updated by Renato Botelho 6 months ago

  • Category set to DNS Resolver
  • Status changed from New to Feedback
  • Assignee set to Renato Botelho
  • Target version set to 2.5.0
  • % Done changed from 0 to 100

PR has been merged. Thanks!

#4 Updated by Renato Botelho about 1 month ago

PR 4155 has been merged to RELENG_2_4_5. Thanks

#5 Updated by Renato Botelho about 1 month ago

  • Target version changed from 2.5.0 to 2.4.5

#6 Updated by Jim Pingle about 1 month ago

This doesn't appear to be working on 2.4.5.

On 2.5.0 I can copy over netflix-no-aaaa.py (attached) and enable the module, select the script, and it works as expected (resolving netflix.com only returns A records. Without the script, both A and AAAA records are returned).

On 2.4.5, using the same actions, unbound fails to run. Unbound quits without logging any errors. Starting it manually in the foreground results in an error:

 /usr/local/sbin/unbound -d -c /var/unbound/unbound.conf
Fatal Python error: _Py_HashRandomization_Init: failed to get random numbers to initialize Python

#7 Updated by BBcan177 . about 1 month ago

For my python PHP include files, I added a mount to address random number generation:

/sbin/mount -t devfs devfs /var/unbound/dev
devfs on /var/unbound/dev (devfs, local)

#8 Updated by Jim Pingle about 1 month ago

If it's a required action, it should be done when setting up the environment. I'm mostly curious about why that isn't necessary on 2.5.0 but seems to be necessary on 2.4.5, though it may be a FreeBSD 11 vs 12 environment issue.

#9 Updated by Jim Pingle about 1 month ago

  • Assignee changed from Renato Botelho to Jim Pingle

Mounting devfs does fix the problem. I added some code to set that up as needed when the module is enabled.

#10 Updated by Jim Pingle about 1 month ago

  • Status changed from New to Feedback

#11 Updated by Jim Pingle about 1 month ago

  • Status changed from Feedback to Resolved

Appears to work fine now on 2.4.5.a.20200114.0923 and 2.5.0.a.20200113.1543

Also available in: Atom PDF