From owner-freebsd-stable@freebsd.org Wed Aug 7 09:51:24 2019 Return-Path: Delivered-To: freebsd-stable@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id DDB75C4D6C for ; Wed, 7 Aug 2019 09:51:24 +0000 (UTC) (envelope-from wolfgang@lyxys.ka.sub.org) Received: from saturn.lyxys.ka.sub.org (saturn.lyxys.ka.sub.org [217.29.35.151]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 463Rbb5jHbz4Tw5 for ; Wed, 7 Aug 2019 09:51:23 +0000 (UTC) (envelope-from wolfgang@lyxys.ka.sub.org) Received: from juno.lyxys.ka.sub.org (juno.lyx [IPv6:fd2a:89ca:7d54:0:240:caff:fe92:4f47]) by saturn.lyxys.ka.sub.org (8.15.2/8.15.2) with ESMTPS id x779MLDc002623 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Wed, 7 Aug 2019 11:22:23 +0200 (CEST) (envelope-from wolfgang@lyxys.ka.sub.org) Received: from juno.lyxys.ka.sub.org (localhost [127.0.0.1]) by juno.lyxys.ka.sub.org (8.15.2/8.15.2) with ESMTPS id x779MLAq050363 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for ; Wed, 7 Aug 2019 11:22:21 +0200 (CEST) (envelope-from wolfgang@lyxys.ka.sub.org) Received: (from wolfgang@localhost) by juno.lyxys.ka.sub.org (8.15.2/8.15.2/Submit) id x779MKkk050360 for freebsd-stable@freebsd.org; Wed, 7 Aug 2019 11:22:20 +0200 (CEST) (envelope-from wolfgang@lyxys.ka.sub.org) X-Authentication-Warning: juno.lyx: wolfgang set sender to wolfgang@lyxys.ka.sub.org using -f Date: Wed, 7 Aug 2019 11:22:20 +0200 From: Wolfgang Zenker To: freebsd-stable@freebsd.org Subject: local_unbound broken in 11.2-p13 Message-ID: <20190807092220.GA49811@lyxys.ka.sub.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Organization: private site User-Agent: Mutt/1.12.1 (2019-06-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3 (saturn.lyxys.ka.sub.org [IPv6:fd2a:89ca:7d54:1:200:24ff:feca:b4cc]); Wed, 07 Aug 2019 11:22:23 +0200 (CEST) X-Rspamd-Queue-Id: 463Rbb5jHbz4Tw5 X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of wolfgang@lyxys.ka.sub.org designates 217.29.35.151 as permitted sender) smtp.mailfrom=wolfgang@lyxys.ka.sub.org X-Spamd-Result: default: False [-3.44 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-0.99)[-0.990,0]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+mx]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-stable@freebsd.org]; HAS_XAW(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; HAS_ORG_HEADER(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; TO_DN_NONE(0.00)[]; NEURAL_HAM_LONG(-0.95)[-0.951,0]; NEURAL_HAM_SHORT(-0.96)[-0.963,0]; DMARC_NA(0.00)[sub.org]; IP_SCORE(-0.23)[ipnet: 217.29.32.0/20(-0.65), asn: 16188(-0.52), country: DE(-0.01)]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:16188, ipnet:217.29.32.0/20, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_TLS_ALL(0.00)[] X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 09:51:24 -0000 Hi, I was trying to use local_unbound in a jail on a newly configured server running 11.2-p13. First using an external nameserver in resolv.conf (works) and after starting local_unbound for the first time, config was created and local_unbound starts ok, but any queries get an answer with rcode SERVFAIL. No information in /var/log/messages. Same setup on 11.2-p9 works as expected. Comparing config on both servers, it appears that local_inbound now creates a root.key file with a DS record for the root zone, while the working installation has a DNSKEY record for the root zone. Changing the root.key file to one with DNSKEY record gets local_unbound working again. Wolfgang