lost and found ( for me ? )

lost and found ( for me ? )

↑ Grab this Headline Animator

Showing posts with label unbound. Show all posts
Showing posts with label unbound. Show all posts

FreeBSD 9.3 : how to configure carp

Here is how to configure carp on FreeBSD 9.3.
Reference
Two FreeBSD 9.3 machines are running as virtual machines and these VMs have two vNICs.
SW-  em0 VM1 em1 -------|
| ---   em0 VM2 em1  ---- SW
edit /boot/loader.conf so that the OS loads carp module when booting.
root@bsd93-vm1:~ # cat /boot/loader.conf
if_carp_load="YES"
reboot the OS
make sure the OS is loading carp module.
root@bsd93-vm1:~ # kldstat
Id Refs Address            Size     Name
1    3 0xffffffff80200000 1611638  kernel
2    1 0xffffffff81812000 10db0    if_carp.ko
on the VM1
add carp0 device to em1
root@bsd93-vm1:~ # cat /etc/rc.conf
hostname="bsd93-vm1"
keymap="jp.106x.kbd"
ifconfig_em0="DHCP"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
unbound_enable="YES"

ifconfig_em1="inet 192.168.1.3 netmask 255.255.255.0"
cloned_interfaces="carp0"
ifconfig_carp0="vhid 1 pass testpass 192.168.1.50/24"
on the VM2
root@bsd93-vm2:~ # cat /etc/rc.conf
hostname="bsd93-vm2"
keymap="jp.106x.kbd"
ifconfig_em0="DHCP"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
unbound_enable="YES"

ifconfig_em1="inet 192.168.1.4 netmask 255.255.255.0"
cloned_interfaces="carp0"
ifconfig_carp0="vhid 1 advskew 100 pass testpass 192.168.1.50/24"
reboot VM1 and VM2.
Both VM has same IP 192.168.1.50 on carp0 device.
Backup box also grabs the VIP when that machine is in backup state.
VM1 is master.
root@bsd93-vm1:~ # ifconfig -a
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
ether 52:54:00:16:a6:9e
inet 192.168.11.20 netmask 0xffffff00 broadcast 192.168.11.255
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
em1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
ether 52:54:00:2c:8b:7b
inet 192.168.1.3 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fe80::5054:ff:fe2c:8b7b%em1 prefixlen 64 scopeid 0x3
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: MASTER vhid 1 advbase 1 advskew 0
root@bsd93-vm1:~ #

on the VM2
VM2 is backup.
root@bsd93-vm2:~ # ifconfig -a
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
ether 52:54:00:de:6d:92
inet 192.168.11.17 netmask 0xffffff00 broadcast 192.168.11.255
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
ether 52:54:00:e1:ea:69
inet 192.168.1.4 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fe80::5054:ff:fee1:ea69%em1 prefixlen 64 scopeid 0x3
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: BACKUP vhid 1 advbase 1 advskew 100
VM1 ( 192.168.1.3 ) is sending advertisement packets every second.
root@bsd93-vm2:~ # tcpdump -i em1 -n carp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
17:23:10.707902 IP 192.168.1.3 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 0, authtype none, intvl 1s, length 36
17:23:11.717968 IP 192.168.1.3 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 0, authtype none, intvl 1s, length 36
reboot the VM1.
VM2 is master
root@bsd93-vm2:~ # ifconfig carp0
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: MASTER vhid 1 advbase 1 advskew 100
VM1 is backup.
root@bsd93-vm1:~ # ifconfig carp0
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: BACKUP vhid 1 advbase 1 advskew 0


[ make high availability of DNS “unbound” with CARP ]
With CARP, backup machine can grab VIPs when that machine is in backup state, so you do not need to restart unbound process when master-backup state has changed.
VM1
unbound.conf
       interface: 192.168.1.50
       interface: 127.0.0.1
VM2
unbound.conf
       interface: 192.168.1.50
       interface: 127.0.0.1
When VM2 is master
root@bsd93-vm2:~ # ifconfig carp0
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: MASTER vhid 1 advbase 1 advskew 100


# /var/log/messages
Sep  7 17:57:56 bsd93-vm2 unbound: [858:0] info: 192.168.1.100 www.google.com. A IN
When VM1 is master
root@bsd93-vm1:~ # ifconfig carp0
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 192.168.1.50 netmask 0xffffff00
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
carp: MASTER vhid 1 advbase 1 advskew 0


# /var/log/messages
Sep  7 17:58:45 bsd93-vm1 kernel: carp0: link state changed to UP
Sep  7 17:59:25 bsd93-vm1 unbound: [853:0] info: 192.168.1.100 www.google.com. A IN

No comments:
Labels: , , ,

DNS : unbound dnstap

Reference
http://dnstap.info/Tutorials/NANOG60/
Here are trial and error logs when building unbound dnstap.
In short, you can dump both request and response logs with dnstap.
# tail -1 /etc/lsb-release ;uname –ri
DISTRIB_DESCRIPTION="Ubuntu 12.04.4 LTS"
3.2.0-60-generic x86_64
install required packages to build dnstap.
# apt-get install build-essential pkg-config protobuf-compiler libpro
tobuf-dev libprotoc-dev git mercurial
install C components
1548  wget https://dl.farsightsecurity.com/dist/presentations/nanog60/fstrm-0.1.0.tar.gz
1549  tar xzvf fstrm-0.1.0.tar.gz
1550  cd fstrm-0.1.0/
1551  ./configure
1552  make
1553  make install
1556  wget https://dl.farsightsecurity.com/dist/presentations/nanog60/protobuf-c-1.0.0-pre.tar.gz
1557  tar xzvf protobuf-c-1.0.0-pre.tar.gz
1558  cd protobuf-c-1.0.0-pre/
1559  ./configure
1560  make
1561  make install
install Go.
# tar -C /usr/local -xzf go1.2.1.linux-amd64.tar.gz
# export PATH=$PATH:/usr/local/go/bin
# export GOROOT=/usr/local/go
# export GOPATH=$HOME/gocode

# which go
/usr/local/go/bin/go

# go version
go version go1.2.1 linux/amd64
# go env
GOARCH="amd64"
GOBIN=""
GOCHAR="6"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/root/gocode"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
TERM="dumb"
CC="gcc"
GOGCCFLAGS="-g -O2 -fPIC -m64 -pthread"
CXX="g++"
CGO_ENABLED="1"
install Go components
# go get -u -v github.com/dnstap/golang-dnstap/dnstap
github.com/dnstap/golang-dnstap (download)
code.google.com/p/goprotobuf (download)
github.com/farsightsec/golang-framestream (download)
github.com/miekg/dns (download)
code.google.com/p/goprotobuf/proto
github.com/farsightsec/golang-framestream
github.com/miekg/dns
github.com/dnstap/golang-dnstap
github.com/dnstap/golang-dnstap/dnstap
dnstap has been installed under $GOPATH/bin
# pwd
/root/gocode/bin

# ./dnstap --help
Usage: ./dnstap [OPTION]...
 -q=false: use quiet text output
 -r="": read dnstap payloads from file
 -u="": read dnstap payloads from unix socket
 -w="-": write output to file
 -y=false: use verbose YAML output

Quiet text output format mnemonics:
   AQ: AUTH_QUERY
   AR: AUTH_RESPONSE
   RQ: RESOLVER_QUERY
   RR: RESOLVER_RESPONSE
   CQ: CLIENT_QUERY
   CR: CLIENT_RESPONSE
   FQ: FORWARDER_QUERY
   FR: FORWARDER_RESPONSE
   SQ: STUB_QUERY
   SR: STUB_RESPONSE
install unbound
# tar xvf unbound-1.4.21+dnstap1.tar.gz
# cd unbound-1.4.21+dnstap1/

# ./configure --enable-dnstap
checking if openssl supports SHA2 and ECDSA with EVP... yes
checking for libexpat... configure: error: Could not find libexpat, expat.h

# apt-cache search libexpat1

# ./configure --enable-dnstap
checking for ldns_rr_new in -lldns... no
configure: error: No ldns library found, install the ldns library into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Install the package ldns or download source http://www.nlnetlabs.nl/projects/ldns

# apt-get install libldns1 libldns-dev ldnsutils

# ./configure --enable-dnstap
checking for ldns/ldns.h... yes
configure: error: ldns library is not recent, update the ldns library, install it into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Package libldns or download source http://www.nlnetlabs.nl/projects/ldns
ldns which I have installed via apt-get seems to be old..
install ldns from source.
remove libldns
# apt-get remove libldns1 libldns-dev ldnsutils
install libldns from source.
# tar xzvf ldns-1.6.17.tar.gz
# cd ldns-1.6.17/
# ./configure
# make
# make install
build unbound-dnstap
# cd unbound-1.4.21+dnstap1/
# ./configure --enable-dnstap
# make
# make install

# /usr/local/sbin/unbound --version
Version 1.4.21
linked libs: mini-event internal (it uses select), ldns 1.6.17, OpenSSL 1.0.1 14 Mar 2012
linked modules: validator iterator
configured for x86_64-unknown-linux-gnu on Mon Mar 24 11:44:59 JST 2014 with options: '--enable-dnstap'
BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl
download a sample configuration of unbound dnstap.
# wget -O /tmp/unbound.conf https://dl.farsightsecurity.com/dist/presentations/nanog60/unbound.conf
# cat /tmp/unbound.conf
server:
   verbosity: 1
   num-threads: 1
#    interface: 127.0.0.1@53053
   interface: 127.0.0.1
   do-daemonize: no
   chroot: ""
   pidfile: "/tmp/unbound.pid"
   username: ""
   directory: "/tmp"
   logfile: ""
   log-time-ascii: yes
   log-queries: yes
   target-fetch-policy: "0 0 0 0 0"

dnstap:
   dnstap-enable: yes
   dnstap-socket-path: "/tmp/dnstap.sock"

   dnstap-identity: "nanog60-dnstap-demo"
   dnstap-version: "unbound 1.4.21+dnstap1"
   dnstap-send-identity: yes
   dnstap-send-version: yes

   dnstap-log-client-query-messages: yes
   dnstap-log-client-response-messages: yes
   dnstap-log-resolver-query-messages: yes
   dnstap-log-resolver-response-messages: yes
   dnstap-log-forwarder-query-messages: yes
   dnstap-log-forwarder-response-messages: yes

stub-zone:
   name: "."
   stub-addr: 192.5.5.241

forward-zone:
   name: "google.com"
   forward-addr: 8.8.8.8
start unbound
# /usr/local/sbin/unbound -c /tmp/unbound.conf
run dnstap
# ./dnstap -u /tmp/dnstap.sock -w /tmp/dnstap.out
dnstap: opened input socket /tmp/dnstap.sock
dnstap.FrameStreamSockInput: accepted a socket connection
issue dig command
# dig @127.1 www.google.com
stop dnstap and then read dnstap.out with dnstap command.
CR = Client Query
CR = Client Response
# ./dnstap -r /tmp/dnstap.out
dnstap: opened input file /tmp/dnstap.out
19:51:00.692605 CQ 127.0.0.1 UDP 32b "www.google.com." IN A
19:51:00.692689 CR 127.0.0.1 UDP 112b "www.google.com." IN A
20:03:53.935890 CQ 127.0.0.1 TCP 25b "isc.org." IN ANY
20:03:53.935975 CR 127.0.0.1 TCP 3272b "isc.org." IN ANY
# ./dnstap -y -r /tmp/dnstap.out | head -10
dnstap: opened input file /tmp/dnstap.out
type: MESSAGE
identity: "nanog60-dnstap-demo"
version: "unbound 1.4.21+dnstap1"
message:
 type: CLIENT_QUERY
 query_time: !!timestamp 2014-03-24 05:16:04.087846
 socket_family: INET
 socket_protocol: UDP
 query_address: 127.0.0.1
 query_port: 38914

No comments:
Labels: , ,
Subscribe to: Posts (Atom)