Unbound-checkconf taking LONG time because of large RPZ lists

Unbound
1

We have unbound 1.24.2 and after adding some large RPZ lists we have problems with restart under systemd.

Systemd timeouts on precheck, because unboud-checkonf takes around 13 minutes!!

This time is also inaxeptable (even with no timeout) for a fast unbound restart.

We can disable precheck, but the question is if its necessary for unbound-checkconf to read all downloaded RPZ zones.

It’s possible to add a flag to avoid this?

Thanks!!!

2

To be curious, how many records in total are we talking about??

I load ~2.5 to ~3mill records in less than seconds, are you caching existing records between reload|restart or are you loading fresh copies from source each time?

For example, setup a zone file like this


rpz:
  name:	'phishing.mypdns.cloud'
  zonefile: '/var/lib/unbound/zones/phishing.mypdns.cloud.zone'
  allow-notify: 0.0.0.0/0
  master: 127.0.0.1@5300
  # master: 192.168.2.100@5300
  master: 141.95.3.138
  rpz-log: no
  rpz-log-name: 'phishing policy'
  rpz-signal-nxdomain-ra: yes
  for-downstream: yes
3

thanks for the comment.
The problem is not in the time spent restarting unbound itself.

The issue is that unbound-checkconf (wich is run as ExecStartPre in the systemd unit)
checks also the downloaded rpz zones (checked with strace).

The solution is to remove the ExecStartPre line from the unit, then the reload takes
a couple of seconds (~8).

unbound-checkconf takes more than 3 minutes with a ~11 mill records zone.