unbound 1.19.0_1 - Add OPNsense GUI menu item to display dhcpleases.conf & host_entries.conf in a table

[phaze75]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

I just tried out the new Kea DHCP service and wanted to check if the DHCP leases and host entries are correctly added and maintained in Unbound. But I realized that there is still no way to check Unbound's config files /var/unbound/dhcpleases.conf and /var/unbound/host_entries.conf via the OPNsense GUI. It is still necessary to open the console via SSH and access the files there.

Describe the solution you like

Could we please get an additional GUI menu item under "/Services/Unbound DNS" where the current host entries and DHCP leases (static and dynamic) are displayed in a table? What is the point of being able to configure Unbound in the GUI and not being able to list its "resulting" DNS records that are currently being served to the network? This is a fundamental feature.

Describe alternatives you considered

The only alternative is to continue to review Unbound DNS's records via the console.

Additional context

https://forum.opnsense.org/index.php?topic=38663.0
https://forum.opnsense.org/index.php?topic=31871.0

[AdSchellevis]

I just tried out the new Kea DHCP service and wanted to check if the DHCP leases and host entries are correctly added and maintained in Unbound.

They will not, given how this currently works with isc-dhcpd it's the question if we would like to support a feature like that at all. Service coupling isn't great.

But I realized that there is still no way to check Unbound's config files /var/unbound/dhcpleases.conf and /var/unbound/host_entries.conf via the OPNsense GUI. It is still necessary to open the console via SSH and access the files there.

Same as with every other config file.... you can always access them from a console as it's an open system, no need to treat these differently. Both are "downstream" files, which unfortunately do contain a bit more logic than needed, but not different than advertised in the gui when it comes to host_entries:

core/src/etc/inc/plugins.inc.d/unbound.inc

Line 426 in d8df599

function unbound_add_host_entries($ifconfig_details)

DHCP leasesare me or less a tail on the same file the isc leases are showing:

core/src/opnsense/scripts/dhcp/unbound_watcher.py

Line 224 in d8df599

parser.add_argument('--target', help='target config file, used when unbound restarts',

Adding a note to the help text for unbound and dnsmasq would be fine.

[phaze75]

Well, "being able to access every file via console in an open system" is - sorry to say so - a killer argument. Then why bother to provide a GUI at all?

To list/display a consolidated DNS zone, especially if it is pieced together from multiple sources, is a very common use case if troubleshooting DNS resolution issues. Wouldn't you say so?

But let me give you another use case. What if OPNsense Unbound DNS is not used as a primary, but as a backup DNS server? After a zone transfer, I would also like to check if the zone transfer has been completed successfully. How do I do that? By looking at the zone (files) if the zone data presented to the network is identical. The only thing I ask for is the comfort of a consolidated view in the GUI rather than opening a console and to "cat" each of the files manually...

[AdSchellevis]

I don't think any of these files have anything todo with zone transfers, but parsing configuration data back to the gui is not a pattern being supported by any of our modules and doesn't need to reflect the actual state of the daemon in question (certainly not for a complicated component as dns, which has multiple sources feeding it).

[phaze75]

I think we are talking cross-purposes here. Anyway, I leave it and cancel my request.