Changeset 13911 in hybrid

Timestamp:

Jun 13, 2017, 8:18:57 AM (7 years ago)

Author:

rick

Message:

Stripping the number of resolvers unbound can use.

Unbound does not handle multiple resolvers well it internal 'logic' keeps
pounding and checking all resolvers making it a very slow process. By limiting
the count of resolvers it sould be more happy.

Count limititing is done using two-phase approch, firstly the initial resolvers
are limited to a fixed set of resolvers, secondly the list is updated based on
the results of the zone inquiries.

While here, ensure the listen is set on dynamic ranges ensuring failing
interfaces will not bring down the DNS server.

Making the list more limited and based on active resolvers.

Location:

branches/releng-11/nanobsd/files

Files:

• etc/crontab (modified) (3 diffs)
• tools/nameserver-shuffle (modified) (1 diff)
• tools/update-nsd-zones (modified) (1 diff)
• usr/local/etc/unbound/unbound.conf (modified) (1 diff)

branches/releng-11/nanobsd/files/etc/crontab

@@ -4 +4 @@
 #
 SHELL=/bin/sh
-PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
+PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
 HOME=/var/log
 #
@@ -31 +31 @@
 # Write updates for ntp.drift to flash
 0       12      *       *       *       root    /tools/store-ntpdrift
-#
 # Nagios checks
 */15    *       *       *       *       root    /tools/check-inet-alive
@@ -37 +36 @@
 */15    *       *       *       *       root    /tools/nameserver-shuffle cron
 # Autoritive zone file updater
-0       *       *       *       *       root    sleep `jot -r 1 900` && /tools/update-nsd-zones
+0       *       *       *       *       root    /tools/update-nsd-zones cron

branches/releng-11/nanobsd/files/tools/nameserver-shuffle

@@ -65 +65 @@
   $verbose && echo "################################"
   cat $NEWRESOLV > /etc/resolv.conf || exit 1
+
+  # Update unbound forwarders list
+  unbound-control forward $(grep 'nameserver' /etc/resolv.conf | grep -v '127.0.0.1' | awk '{print $2}' | tail -3 )
 fi 

branches/releng-11/nanobsd/files/tools/update-nsd-zones

@@ -1 +1 @@
 #!/bin/sh
 #
-# Update local autoritive DNS server
+# Rick van der Zwet <info@rickvanderzwet.nl>
 #
+# Update local autoritive DNS server, by transfering zone files from master
+# using HTTP protocol
+#
+
+# Avoid hammering source, sleep random delay
+if [ "$1" = "cron" ]; then
+        sleep $(jot -r 1 900)
+fi
+
+# Fetch source files
 fetch -T 5 -o /tmp/dns.tar.gz.enc http://wirelessleiden.nl/dns/latest.tar.gz.enc || exit 1
 

branches/releng-11/nanobsd/files/usr/local/etc/unbound/unbound.conf

@@ -6 +6 @@
 # this is a comment.
 
-#Use this to include other text into the file.
+# Bind to specific IP addresses & initial forward zones
 include: "/usr/local/etc/unbound.wleiden.conf"