I have just updatet to 201. And I was curious to try the new DNS firewall. So I activated the sections Advertising, Malware, Phishing and Pornography. Memory consumtion then immediately went up to consume almost all my 4 GB.
I thought “ooops, that’s pretty high” so I deactivated the first category, but memory consupmtion didn’t go down. So I deactivated all of them (no category left activated anymore) but memory consumption doesn’t drop at all.
I can confirm this. I suppose there is an issue in the new function fast_reload, that is used by IPFire to minimize downtime of DNS server. fast_reload operates on a local copy of the config. After update the copy or old config isn’t freed.
Only cure is IMO to restart unbound at a time downtime of DNS of ~2 min doesn’t matter.
I think the main change between 200 and 201 is the DNS Firewall. Because this means more possible changes to the DNS configuration, each yielding a reload.
The ‘reload’ operation makes DNS unresponsive during processing. With large configs, which are a consequence of blocking lists, this downtime is 1-2 min. This isn’t acceptable in many installations.
To circumvent this, a new operation ‘fast-reload’ was implemented in unbound. This operation is used in IPFire CU201 to allow the feature of DNS Firewall.
This operation is new to unbound and may have issues in memory handling. I posted a question in the unbound community. Still awaiting an answer.
In the meantime, I only see my suggestion of restart as remedy. It is working in my system.
Thanks, I’ve read this. I activated 4 lists and the 4 GB were gone. Guess next time I buy hardware I’ll invest more into RAM
BTW: I restarted the firewall and RAM-usage was back to normal. So I think that in order to release the memory from unselected categories, one needs to reboot the system. Maybe next time I’ll try to wait 24 or 48 hours to see if it drops after some time even without reboot. I am patient, but only for a very short period of time
