From owner-freebsd-net@freebsd.org Mon Jun 15 13:58:54 2020 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 1A8B0334FF6 for ; Mon, 15 Jun 2020 13:58:54 +0000 (UTC) (envelope-from freebsd-rwg@gndrsh.dnsmgr.net) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 49ltGj6MD7z4dhp for ; Mon, 15 Jun 2020 13:58:53 +0000 (UTC) (envelope-from freebsd-rwg@gndrsh.dnsmgr.net) Received: by mailman.nyi.freebsd.org (Postfix) id DA2C633531F; Mon, 15 Jun 2020 13:58:53 +0000 (UTC) Delivered-To: net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id D9F59335483 for ; Mon, 15 Jun 2020 13:58:53 +0000 (UTC) (envelope-from freebsd-rwg@gndrsh.dnsmgr.net) Received: from gndrsh.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 49ltGj4fB7z4dq2; Mon, 15 Jun 2020 13:58:53 +0000 (UTC) (envelope-from freebsd-rwg@gndrsh.dnsmgr.net) Received: from gndrsh.dnsmgr.net (localhost [127.0.0.1]) by gndrsh.dnsmgr.net (8.13.3/8.13.3) with ESMTP id 05FDwoFP076922; Mon, 15 Jun 2020 06:58:50 -0700 (PDT) (envelope-from freebsd-rwg@gndrsh.dnsmgr.net) Received: (from freebsd-rwg@localhost) by gndrsh.dnsmgr.net (8.13.3/8.13.3/Submit) id 05FDwo7X076921; Mon, 15 Jun 2020 06:58:50 -0700 (PDT) (envelope-from freebsd-rwg) From: "Rodney W. Grimes" Message-Id: <202006151358.05FDwo7X076921@gndrsh.dnsmgr.net> Subject: Re: unbound and (isc) dhcpd startup order In-Reply-To: To: Andriy Gapon Date: Mon, 15 Jun 2020 06:58:50 -0700 (PDT) CC: "Rodney W. Grimes" , Ryan Steinmetz , jaap@NLnetLabs.nl, net@freebsd.org X-Mailer: ELM [version 2.4ME+ PL121h (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII X-Rspamd-Queue-Id: 49ltGj4fB7z4dq2 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:13868, ipnet:69.59.192.0/19, country:US] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2020 13:58:54 -0000 > On 15/06/2020 15:57, Rodney W. Grimes wrote: > >> > >> I am configuring a small LAN -- mostly a gateway / router for it -- and I am > >> using unbound for a local DNS and isc-dhcp44-server for DHCP. > >> I have a few hosts with static IP addresses (for various reasons). > >> So, in unbound.conf I have an entry like > >> local-data: "hipster.home.arpa. IN A 192.168.0.222" > >> and in dhcpd.conf have: > >> host hipster { > >> > >> > >> hardware ethernet 40:74:e0:xx:xx:xx; > >> > >> > >> fixed-address hipster.home.arpa; > >> > >> > >> } > >> > >> I am using a DNS name to avoid hardcoding the same IP address twice. > >> But obviously this depends on the local DNS server starting before the HDCP > >> server if they are on the same host / router. > >> It seems that at the moment there is nothing to ensure that order. > >> > >> For the moment I modified rc.d/unbound to add this line: > >> # BEFORE: dhcpd > > > >>From looking at /etc/rc.d/local_unbound we see: > > # PROVIDE: local_unbound > > # REQUIRE: FILESYSTEMS defaultroute netwait resolv > > # BEFORE: NETWORKING > > # KEYWORD: shutdown > > > > What makes it work for that case is the BEFORE: NETWORKING is that > > line missing for the port version? > > Yes, it is: > # PROVIDE: unbound > # REQUIRE: SERVERS cleanvar > # KEYWORD: shutdown > > If we add BEFORE: NETWORKING then REQUIRE will also have to be adjusted as it's > impossible to be before NETWORKING and after SERVERS. Um, yea, I guess the bigger question is why is the port different than the base system in this respect? I would expect unbound to be the same, as unbound_local in almost every respect, especially with respect to its startup sequencing, providers and requires. > >> I am not sure if this is the best solution and it's something that can be > >> included into the port. > > > > I think that DNS needs to be started before more than just dhcpd, > > so this is just 1 of many possible cases. This can also be issues > > with almost any network stuff that wants to do stuff by DNS value, > > including the networkself. DNS creates a chicken/egg problem in > > that you may, or may not need the network to resolve names, I have > > always hated that aspect of it. Modern tooling can help, you use > > stuff to build your /etc/rc config files that can me run while the > > network is up and functional so that this entering IP addresses in > > N places is less painful. > > > > I seen no problem in adding a BEFORE: NETWORKING to the port, covering > > a larger number of casses than your narrow BEFORE: dhcpd. > > I agree. > I hope it doesn't break any currently working configurations too. I have no idea how to hunt through ports looking for this. I suppose find all ports that need unbound and see what there startup scripts look like. > >> On a related note, unbound rc script provides "unbound" service. > >> I think that maybe it should provide something more generic such as "nameserver" > >> or "dns-server" (not sure if there is an established name for that). > >> The reason I am saying this is that, IMO, if unbound is replaced with some other > >> name server implementation the rc dependency chains should stay the same. > > > > I do not see anything in the base system that uses unbound or local_unbound > > service name, so this looks like it could be straightforward, though there > > may be some ports that have use of this token. > > > > For the blue bikeshed I find that "server" is just noise in the token > > and that "dns" already has "s" for system, so just "dns" is good with me :-) > > That's a good point. > I've just checked bind ports and they use PROVIDE: named > Not sure if "named" here is a bind specific name or a generic one. named is specifically the name of the binary included in the bind product, which included the resolver stub, named, and some other support utilities like rndc and nslookup. It would make since to unify these, though that is going to take some cafeful thought and co-ordination as to not break peoples running systems. I suspect the ports conflict stuff is keeping one from installing unbound, and bind at the same time, arguable wrong as one should be able to install both, but only run one at a time, or even run both on different ports. > -- > Andriy Gapon -- Rod Grimes rgrimes@freebsd.org