Bind upgrade producing errors on pfsense 2.5 upgrade

[wrgraves]

@matthijs did bind work before you installed your config ?

[matthijs]

I have a working 2.4.5 VM running (with no bind problems), If I upgrade to 2.5 I have bind issues.
I also did a fresh 2.5.0 install and restored my 2.4.5 configuration, in both situations I have bind issues

[matthijs]

I also have ACME implemented with Bind/DNS, so I have ACME keys in Global Settings (main configuration menu - > Advanced Options button) Maybe this is something in common with other people also having issues with bind and 2.5.0 ?

[wrgraves]

@matthijs I was asking if you tried to install and test Bind on a fresh install of 2.5 before your loaded your config into it ?

[matthijs]

@wrgraves No I did not do a fresh bind install on a fresh 2.5.0 install (I guess that works fine, like in your situation?)

[nordeep]

After upgrade to 2.5. Simple run: /usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ result is Segmentation fault.

I'm using common bind setup - 1 view, 2 zones, 4 ACLs, No Sync.

[wrgraves]

@matthijs I have not done that yet. It would take too much downtime. I have a spare system on order that is do tomorrow. Once that's available I should be able to build a stand alone system and try that.

[matthijs]

@wrgraves
I guess that would work, but I am hoping a full manual reconfiguration of my bind/acme setup with all the dns zones wont be necessary ;-)

[anthonypants]

@wrgraves I mentioned it earlier, but if you run named from the console and don't give it the configuration file, it seems to work fine.

[viktor_g]

@nordeep said in Bind upgrade producing errors on pfsense 2.5 upgrade:

After upgrade to 2.5. Simple run: /usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ result is Segmentation fault.

I'm using common bind setup - 1 view, 2 zones, 4 ACLs, No Sync.

/usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ works fine for me

Could you provide your views/zones/acls configuration?
You can hide your private data by changing domain/IP.

[nordeep]

@viktor_g said in Bind upgrade producing errors on pfsense 2.5 upgrade:

Could you provide your views/zones/acls configuration?

cat /cf/named//etc/namedb/named.conf

#Bind pfsense configuration
#Do not edit this file!!!

 key "rndc-key" {
        algorithm hmac-sha256;
        secret "====";
 };

 controls {
        inet 127.0.0.1 port 953
                allow { 127.0.0.1; } keys { "rndc-key"; };
 };



options {
        directory "/etc/namedb";
        pid-file "/var/run/named/pid";
        statistics-file "/var/log/named.stats";
        max-cache-size 256M;
        dnssec-validation auto;

        listen-on-v6 port 53 { any; };
        listen-on port 53 { any; };
        notify yes;
        version none;

};



acl "ff" {
        8.8.8.8;
        8.8.4.4;
        4.4.8.8;
};

acl "dd" {
        8.8.8.8;
};

acl "gw" {
        9.9.9.9;
};

view "default" {
        recursion yes;
        match-clients { any; };
        allow-recursion { localhost; localnets; };

        zone "13" {
                type master;
                file "/etc/namedb/master/default/13.DB";
                allow-query { any; localhost; localnets; ff; dd; gw; };
                allow-transfer { ff; };
                allow-update { localhost; gw; };
                also-notify { 9.9.9.9;};
        };

        zone "tt.spb.ru" {
                type master;
                file "/etc/namedb/master/default/tt.spb.ru.DB";
                allow-query { any; };
                allow-transfer { ff; };
                allow-update { localhost; };
        };

        zone "." {
                type hint;
                file "/etc/namedb/named.root";
        };

};

[madforic]

Same issue after upgrade to 2.5.0
unable to start bind

[wrgraves]

@viktor_g Ok, brought up a test machine and installed a fresh pfsense 2.5 and of course the caching bind config works so I restored my config and of course it gets the segment fault in named and dies so I decided to find an example install for bind, I used this one -> https://www.youtube.com/watch?v=Sgn4oNy85_o
And as I went thru it I corrected several mistakes in my zones. Then used Status/Services to restart named and it works now. It looks like a bad zone will segment fault and crash your bind. I've been using these zones for years and that never happened in the past. A new feature?
I put the changes in my production machine.
and now I am up!!!

[matthijs]

@viktor_g What mistakes were in your zones ? and how to correct if all this configuration gets generated by the webinterface ?

[horrza]

@wrgraves Thank you!

[horrza]

@matthijs "Name Server" and "Base Domain IP" was the problem in my case.

[matthijs]

@horrza

I cannot understand that is causing the issue in my case these fields will result in the following records in de zone file (fictional IP and FQDN)

@ IN NS nameserver.fqdn.com.
@ IN A 1.1.1.1

[horrza]

@matthijs

I did as shown in the video on YouTube https://www.youtube.com/watch?v=Sgn4oNy85_o&t=337s

[wrgraves]

@matthijs The video is a tutorial about configuring bind in pfsense and I just followed it while I looked at my config via the GUI. I wouldn't of even though some of the mistakes were mistakes. Like I put in the wrong base ip in the reverse zone and one of the reverse zones had localhost in the name of the nameserver and I changed it to 127.0.0.1. I cleared all the serial numbers so they were generated, probably no effect on that one. In my 2.16.172 reverse some I changed the first record from 1.2.16.172 to 1 PTR pfsense.localdomain. I increased the the Memory limit in the main config from 256M to 1024M, now that could of had an effect. Most of it was just little differences and all of the changes were made with the GUI.

[wrgraves]

Here's a diff of the bind part of my backed up config...
</serial>
<allowupdate>localhost,localnets,localdomain</allowup | <allowupdate>any</allowupdate>
<allowquery>localhost,localnets,localdomain</allowque | <allowquery>none,any</allowquery>
<allowtransfer>localhost,localnets,localdomain</allow | <allowtransfer>any</allowtransfer>
<hostname>1.2.16.172.in-addr.arpa.</hostname> | <hostname>1</hostname>
<resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMi4xNi4xNzIuaW4 | <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMi4xNi4xNzIuaW4
<serial>3</serial> | <serial>2614104211</serial>
<allowupdate>localhost,localnets</allowupdate> | <allowupdate>any</allowupdate>
<allowquery>localhost,localnets</allowquery> | <allowquery>any</allowquery>
<allowtransfer>localhost,localnets</allowtransfer> | <allowtransfer>any</allowtransfer>
<row> <
<hostname>KB9UNZ.DDNS.WS</hostname> <
<hosttype>A</hosttype> <
<hostvalue></hostvalue> <
<hostdst>127.0.0.1</hostdst> <
</row> <
<customzonerecords>R1cxLkFNUFIuREFWRVMuTkVUIElOIEEgMT | <customzonerecords></customzonerecords>
<resultconfig>JFRUTCA0MzIwMAo7CiRPUklHSU4gbG9jYWxob3N | <resultconfig>JFRUTCA0MzIwMAo7CiRPUklHSU4gbG9jYWxob3N
> <rpz></rpz>
<serial>2</serial> | <serial>2614104300</serial>
<allowupdate>localhost,localnets</allowupdate> | <allowupdate>any</allowupdate>
<allowquery>localhost,localnets</allowquery> | <allowquery>any</allowquery>
<allowtransfer>localhost,localnets</allowtransfer> | <allowtransfer>any</allowtransfer>
<hostname>1.0.0.127.in-addr.arpa.</hostname> | <hostname>1</hostname>
<resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMC4wLjEyNy5pbi1 | <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMC4wLjEyNy5pbi1
<wireguard> | <wireguard></wireguard>
</wireguard> <
root@ubt:~/Downloads#

Well that didn't turn out like I hoped but I deleted a couple of things too.