Possible bug with BIND config generate in 2.4.5 (bind package: 9.14_3)

eda2000

I have just upgraded pfsense to version 2.4.5. After that action bind stopped working (cannot start) ending with errors:

rpz is not master or slave zone
loading configuration: not found

After analysis I found that invalid /cf/named/etc/namedb/named.conf file was generated.

In section OPTIONS, response-policy configuration is missing ".in-addr.arpa" suffix for reverse zone. In a view reverse zone has correct format (also with suffix).

That cause miscofiguration.

Generated invalid config file example:

options {
        ...
	response-policy {
		zone "0.168.192";
	};
        ....
};

view "local view" { 
	recursion yes;

	zone "0.168.192.in-addr.arpa" {
		type master;
		file "/etc/namedb/master/local view/0.168.192.DB";
		allow-query { localhost; localnets; };
		allow-update { localhost; localnets; };
	};

	zone "." {
		type hint;
		file "/etc/namedb/named.root";
	};

};

Manual edit of file /cf/named/etc/namedb/named.conf and adding suffix fix the issue.

Can you clarify, please?

kiokoman

i have bind on a dedicated server not inside pfsense but
for me, response policy is defined inside view also i don't have a reverse for rpz, noob question but why a reverse?

RPZ is essentially a filtering mechanism, either preventing people from visiting internet domains, or pointing them to other locations by manipulating the DNS answers in different ways

sandbrock

My bind service also failed to start after upgrading to 2.4.5, with this same exact error. After deleting my RPZ zone, it started up fine. I believe it is likely a bug, as you said.

kiokoman

This post is deleted!

eda2000

Linked issue:
https://redmine.pfsense.org/issues/10445