<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Turned out to a leak in the resgen code logic and/or a CNAME response that automatically gave the client an IP address for a A query we were blocking.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We are now getting a 40-80ms average DNS resolution time for the Alexa top sites (<a href="http://www.securly.com">securly.com</a>). Pretty pleased with unbound!<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Vinay.<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> unbound-users-bounces@unbound.net [mailto:unbound-users-bounces@unbound.net] <b>On Behalf Of </b>vinay3@justemail.net<br><b>Sent:</b> Wednesday, July 11, 2012 12:09 AM<br><b>To:</b> unbound-users@unbound.net<br><b>Subject:</b> [Unbound-users] Unbound Python vs Unbound Cache<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hey guys,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We are seeing a peculiar issue with the unbound python script (we are using the latest unbound code). We found that if a domain is Not cached, resgen.py is called and gets a chance to provide a IP address resolution (A query). However, if the domain is in the unbound’s cache, resgen.py is not called until the cached entry times out – which is 3600 seconds for us given a cache-min-ttl of 3600. This is still okay – as we were hoping for certain domains we blacklist, resgen would always give an IP address of a “blocked page” on our webserver, and this way we would never see the real IP address get cached. However, we are seeing “leaks” from time to time where resgen is either not called or for some other reason, the real IP address somehow gets cached. E.g. let’s say baddomain.com needs to be blocked. When this domain is not cached (first time), resgen is called everytime, responds with a blocked IP of say x.x.x.x, and this IP is never cached by unbound (we are okay if it is cached), and this way the real IP of baddomain.com is never served and thus never cached. However, in about 100-1000 queries, one query for baddomain.com still gets resolved to the real IP, and thus gets cached by unbound for an entire hour (cache min ttl period) and we are left with a gaping hole for this domain for that long.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Under what circumstances can resgen be skipped OR fail and hand over the domain resolution to the iterator? If we can avoid this situation, we can prevent the leaks 100% and would then not have to see blocked domains leak for 1 hour at a time!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If unbound-users is not the right place for python module related questions, where can we directed these questions? If we make modifications to the code to fix this issue, where can we send the patches?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks!<o:p></o:p></p><p class=MsoNormal>Vinay.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>