unbound: config zone of type forward_zone not creating a forward-zone:

Maintainer: @EricLuehrsen
Environment: ath-79(put here arch, model, OpenWrt version) ath79/generic GL.iNet GL-AR750 21.02.3 r16554-1d4dea6d4f

Description:

When adding a config_zone for type forward_zone given the following config:

config unbound 'ub_main'
	option dns64 '0'
	option domain 'lan'
	option edns_size '1232'
	option extended_stats '0'
	option hide_binddata '1'
	option interface_auto '1'
	option localservice '1'
	option manual_conf '0'
	option num_threads '1'
	option protocol 'default'
	option rate_limit '0'
	option rebind_localhost '0'
	option recursion 'default'
	option resource 'default'
	option root_age '9'
	option ttl_min '120'
	option ttl_neg_max '1000'
	option unbound_control '1'
	option validator '0'
	option verbosity '1'
	list iface_wan 'wan'
	option enabled '1'
	option listen_port '53'
	option dhcp_link 'dnsmasq'
	option rebind_protection '0'
	list iface_trig 'lan'
	list iface_trig 'wan'

config zone 'auth_icann'
	option enabled '0'
	option fallback '1'
	option url_dir 'https://www.internic.net/domain/'
	option zone_type 'auth_zone'
	list server 'lax.xfr.dns.icann.org'
	list server 'iad.xfr.dns.icann.org'
	list zone_name '.'
	list zone_name 'arpa.'
	list zone_name 'in-addr.arpa.'
	list zone_name 'ip6.arpa.'

config zone 'fwd_isp'
	option enabled '0'
	option fallback '1'
	option resolv_conf '1'
	option zone_type 'forward_zone'
	list zone_name 'isp-bill.example.com.'
	list zone_name 'isp-mail.example.net.'

config zone 'fwd_google'
	option enabled '0'
	option fallback '1'
	option tls_index 'dns.google'
	option tls_upstream '1'
	option zone_type 'forward_zone'
	list server '8.8.4.4'
	list server '8.8.8.8'
	list server '2001:4860:4860::8844'
	list server '2001:4860:4860::8888'
	list zone_name '.'

config zone 'fwd_cloudflare'
	option enabled '0'
	option fallback '1'
	option tls_index 'cloudflare-dns.com'
	option tls_upstream '1'
	option zone_type 'forward_zone'
	list server '1.1.1.1'
	list server '1.0.0.1'
	list server '2606:4700:4700::1111'
	list server '2606:4700:4700::1001'
	list zone_name '.'

config zone 'fwd_example_com'
	option fallback '0'
	option enabled '1'
	option zone_type 'forward_zone'
	option zone_name 'example.com'
	option server '10.75.22.247'

config zone 'fwd_10_75_22'
	option fallback '1'
	option enabled '1'
	option zone_type 'forward_zone'
	option zone_name '22.75.10.in-addr.arpa'
	option server '10.75.22.247'

the example.com forward zone (or it's reverse) don't actually appear in the unbound configuration:

# /var/lib/unbound/unbound.conf generated by UCI 2022-08-07T08:07:23-04:00
# /var/lib/unbound/server.conf.tmp generated by UCI 2022-08-07T08:07:23-04:00
server:
  username: unbound
  chroot: /var/lib/unbound
  directory: /var/lib/unbound
  pidfile: /var/run/unbound.pid
  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

  num-threads: 1
  msg-cache-slabs: 1
  rrset-cache-slabs: 1
  infra-cache-slabs: 1
  key-cache-slabs: 1
  ratelimit-slabs: 1
  ip-ratelimit-slabs: 1

  use-syslog: yes
  statistics-interval: 0
  statistics-cumulative: no
  verbosity: 1
  extended-statistics: no

  interface-automatic: yes
  edns-buffer-size: 1232
  port: 53
  outgoing-port-permit: 10240-65535
  module-config: "iterator"

  cache-min-ttl: 120
  cache-max-ttl: 72000
  cache-max-negative-ttl: 1000
  val-bogus-ttl: 300
  infra-host-ttl: 900

  hide-identity: yes
  hide-version: yes

  access-control: 10.75.24.254/24 allow
  access-control: 192.168.102.254/24 allow
  access-control: 127.0.0.0/8 allow
  access-control: ::1/128 allow
  access-control: fe80::/10 allow

# /var/lib/unbound/host.conf.tmp generated by UCI 2022-08-07T08:07:23-04:00
# Local zone is handled by dnsmasq

# /var/lib/unbound/dnsmasq_srv.conf.tmp generated by UCI 2022-08-07T08:07:23-04:00
  do-not-query-localhost: no

  domain-insecure: lan
  private-domain: lan
  local-zone: lan transparent

  domain-insecure: 24.75.10.in-addr.arpa
  private-domain: 24.75.10.in-addr.arpa
  local-zone: 24.75.10.in-addr.arpa transparent

  domain-insecure: 102.168.192.in-addr.arpa
  private-domain: 102.168.192.in-addr.arpa
  local-zone: 102.168.192.in-addr.arpa transparent

include: /var/lib/unbound/adb_list.*

include: /var/lib/unbound/unbound_srv.conf

# /var/lib/unbound/zone.conf.tmp generated by UCI 2022-08-07T08:07:22-04:00
 # Special zone  was not enabled or had UCI conflicts.

 # Special zone  was not enabled or had UCI conflicts.

 # Special zone  was not enabled or had UCI conflicts.

 # Special zone  was not enabled or had UCI conflicts.

# /var/lib/unbound/ctrl.conf.tmp generated by UCI 2022-08-07T08:07:23-04:00
remote-control:
  control-enable: yes
  control-use-cert: no
  control-interface: 127.0.0.1
  control-interface: ::1

# /var/lib/unbound/dnsmasq_ext.conf.tmp generated by UCI 2022-08-07T08:07:23-04:00
forward-zone:
  name: lan
  forward-first: no
  forward-addr: 127.0.0.1@5353

forward-zone:
  name: 24.75.10.in-addr.arpa
  forward-first: no
  forward-addr: 127.0.0.1@5353

forward-zone:
  name: 102.168.192.in-addr.arpa
  forward-first: no
  forward-addr: 127.0.0.1@5353

include: /var/lib/unbound/unbound_ext.conf

Start by comparing the UCI zone definitions in the issue with the generated /var/lib/unbound/zone.conf.tmp output and the related unbound configuration files. Trace why enabled forward_zone entries become “Special zone was not enabled or had UCI conflicts”; done means the example.com and reverse forward zones appear correctly in the generated configuration.