Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bind upgrade producing errors on pfsense 2.5 upgrade

    Scheduled Pinned Locked Moved pfSense Packages
    112 Posts 16 Posters 30.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      matthijs @wrgraves
      last edited by matthijs

      @wrgraves No I did not do a fresh bind install on a fresh 2.5.0 install (I guess that works fine, like in your situation?)

      W 1 Reply Last reply Reply Quote 0
      • N
        nordeep
        last edited by

        After upgrade to 2.5. Simple run: /usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ result is Segmentation fault.

        I'm using common bind setup - 1 view, 2 zones, 4 ACLs, No Sync.

        viktor_gV 1 Reply Last reply Reply Quote 0
        • W
          wrgraves @matthijs
          last edited by

          @matthijs I have not done that yet. It would take too much downtime. I have a spare system on order that is do tomorrow. Once that's available I should be able to build a stand alone system and try that.

          M 1 Reply Last reply Reply Quote 0
          • M
            matthijs @wrgraves
            last edited by

            @wrgraves
            I guess that would work, but I am hoping a full manual reconfiguration of my bind/acme setup with all the dns zones wont be necessary ;-)

            1 Reply Last reply Reply Quote 0
            • A
              anthonypants @wrgraves
              last edited by

              @wrgraves I mentioned it earlier, but if you run named from the console and don't give it the configuration file, it seems to work fine.

              1 Reply Last reply Reply Quote 0
              • viktor_gV
                viktor_g Netgate @nordeep
                last edited by

                @nordeep said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                After upgrade to 2.5. Simple run: /usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ result is Segmentation fault.

                I'm using common bind setup - 1 view, 2 zones, 4 ACLs, No Sync.

                /usr/local/sbin/named -4 -c /etc/namedb/named.conf -u bind -t /cf/named/ works fine for me

                Could you provide your views/zones/acls configuration?
                You can hide your private data by changing domain/IP.

                N 1 Reply Last reply Reply Quote 0
                • N
                  nordeep @viktor_g
                  last edited by

                  @viktor_g said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                  Could you provide your views/zones/acls configuration?

                  cat /cf/named//etc/namedb/named.conf

                  #Bind pfsense configuration
                  #Do not edit this file!!!
                  
                   key "rndc-key" {
                          algorithm hmac-sha256;
                          secret "====";
                   };
                  
                   controls {
                          inet 127.0.0.1 port 953
                                  allow { 127.0.0.1; } keys { "rndc-key"; };
                   };
                  
                  
                  
                  options {
                          directory "/etc/namedb";
                          pid-file "/var/run/named/pid";
                          statistics-file "/var/log/named.stats";
                          max-cache-size 256M;
                          dnssec-validation auto;
                  
                          listen-on-v6 port 53 { any; };
                          listen-on port 53 { any; };
                          notify yes;
                          version none;
                  
                  };
                  
                  
                  
                  acl "ff" {
                          8.8.8.8;
                          8.8.4.4;
                          4.4.8.8;
                  };
                  
                  acl "dd" {
                          8.8.8.8;
                  };
                  
                  acl "gw" {
                          9.9.9.9;
                  };
                  
                  view "default" {
                          recursion yes;
                          match-clients { any; };
                          allow-recursion { localhost; localnets; };
                  
                          zone "13" {
                                  type master;
                                  file "/etc/namedb/master/default/13.DB";
                                  allow-query { any; localhost; localnets; ff; dd; gw; };
                                  allow-transfer { ff; };
                                  allow-update { localhost; gw; };
                                  also-notify { 9.9.9.9;};
                          };
                  
                          zone "tt.spb.ru" {
                                  type master;
                                  file "/etc/namedb/master/default/tt.spb.ru.DB";
                                  allow-query { any; };
                                  allow-transfer { ff; };
                                  allow-update { localhost; };
                          };
                  
                          zone "." {
                                  type hint;
                                  file "/etc/namedb/named.root";
                          };
                  
                  };
                  
                  1 Reply Last reply Reply Quote 0
                  • M
                    madforic
                    last edited by

                    Same issue after upgrade to 2.5.0
                    unable to start bind

                    1 Reply Last reply Reply Quote 0
                    • W
                      wrgraves
                      last edited by wrgraves

                      @viktor_g Ok, brought up a test machine and installed a fresh pfsense 2.5 and of course the caching bind config works so I restored my config and of course it gets the segment fault in named and dies so I decided to find an example install for bind, I used this one -> https://www.youtube.com/watch?v=Sgn4oNy85_o
                      And as I went thru it I corrected several mistakes in my zones. Then used Status/Services to restart named and it works now. It looks like a bad zone will segment fault and crash your bind. I've been using these zones for years and that never happened in the past. A new feature?
                      I put the changes in my production machine.
                      and now I am up!!!

                      H 1 Reply Last reply Reply Quote 1
                      • M
                        matthijs
                        last edited by

                        @viktor_g What mistakes were in your zones ? and how to correct if all this configuration gets generated by the webinterface ?

                        H W 2 Replies Last reply Reply Quote 0
                        • H
                          horrza @wrgraves
                          last edited by

                          @wrgraves Thank you!

                          7d583597-4669-44fa-a39e-76514c074dbd-image.png

                          1 Reply Last reply Reply Quote 1
                          • H
                            horrza @matthijs
                            last edited by

                            @matthijs "Name Server" and "Base Domain IP" was the problem in my case.

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              matthijs @horrza
                              last edited by matthijs

                              @horrza

                              I cannot understand that is causing the issue in my case these fields will result in the following records in de zone file (fictional IP and FQDN)

                              @ IN NS nameserver.fqdn.com.
                              @ IN A 1.1.1.1

                              H 1 Reply Last reply Reply Quote 0
                              • H
                                horrza @matthijs
                                last edited by horrza

                                @matthijs e6bfe4b6-eea6-475b-a8dc-3b0a2bba2e5c-image.png

                                I did as shown in the video on YouTube https://www.youtube.com/watch?v=Sgn4oNy85_o&t=337s

                                1 Reply Last reply Reply Quote 0
                                • W
                                  wrgraves @matthijs
                                  last edited by

                                  @matthijs The video is a tutorial about configuring bind in pfsense and I just followed it while I looked at my config via the GUI. I wouldn't of even though some of the mistakes were mistakes. Like I put in the wrong base ip in the reverse zone and one of the reverse zones had localhost in the name of the nameserver and I changed it to 127.0.0.1. I cleared all the serial numbers so they were generated, probably no effect on that one. In my 2.16.172 reverse some I changed the first record from 1.2.16.172 to 1 PTR pfsense.localdomain. I increased the the Memory limit in the main config from 256M to 1024M, now that could of had an effect. Most of it was just little differences and all of the changes were made with the GUI.

                                  1 Reply Last reply Reply Quote 1
                                  • W
                                    wrgraves
                                    last edited by wrgraves

                                    Here's a diff of the bind part of my backed up config...
                                    </serial>
                                    <allowupdate>localhost,localnets,localdomain</allowup | <allowupdate>any</allowupdate>
                                    <allowquery>localhost,localnets,localdomain</allowque | <allowquery>none,any</allowquery>
                                    <allowtransfer>localhost,localnets,localdomain</allow | <allowtransfer>any</allowtransfer>
                                    <hostname>1.2.16.172.in-addr.arpa.</hostname> | <hostname>1</hostname>
                                    <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMi4xNi4xNzIuaW4 | <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMi4xNi4xNzIuaW4
                                    <serial>3</serial> | <serial>2614104211</serial>
                                    <allowupdate>localhost,localnets</allowupdate> | <allowupdate>any</allowupdate>
                                    <allowquery>localhost,localnets</allowquery> | <allowquery>any</allowquery>
                                    <allowtransfer>localhost,localnets</allowtransfer> | <allowtransfer>any</allowtransfer>
                                    <row> <
                                    <hostname>KB9UNZ.DDNS.WS</hostname> <
                                    <hosttype>A</hosttype> <
                                    <hostvalue></hostvalue> <
                                    <hostdst>127.0.0.1</hostdst> <
                                    </row> <
                                    <customzonerecords>R1cxLkFNUFIuREFWRVMuTkVUIElOIEEgMT | <customzonerecords></customzonerecords>
                                    <resultconfig>JFRUTCA0MzIwMAo7CiRPUklHSU4gbG9jYWxob3N | <resultconfig>JFRUTCA0MzIwMAo7CiRPUklHSU4gbG9jYWxob3N
                                    > <rpz></rpz>
                                    <serial>2</serial> | <serial>2614104300</serial>
                                    <allowupdate>localhost,localnets</allowupdate> | <allowupdate>any</allowupdate>
                                    <allowquery>localhost,localnets</allowquery> | <allowquery>any</allowquery>
                                    <allowtransfer>localhost,localnets</allowtransfer> | <allowtransfer>any</allowtransfer>
                                    <hostname>1.0.0.127.in-addr.arpa.</hostname> | <hostname>1</hostname>
                                    <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMC4wLjEyNy5pbi1 | <resultconfig>JFRUTCAxRAo7CiRPUklHSU4gMC4wLjEyNy5pbi1
                                    <wireguard> | <wireguard></wireguard>
                                    </wireguard> <
                                    root@ubt:~/Downloads#

                                    Well that didn't turn out like I hoped but I deleted a couple of things too.

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wrgraves
                                      last edited by wrgraves

                                      missed a line
                                      <bind_ram_limit>256M</bind_ra | <bind_ram_limit>1024M</bind_r
                                      Been marked as a spammer so I can't edit the previous entry. Note that you can turn off zones and that may help in debugging. Just go to the little box at the beginning of the zone and disable it and see if it stops crashing.

                                      1 Reply Last reply Reply Quote 0
                                      • freebsd-manF
                                        freebsd-man
                                        last edited by freebsd-man

                                        Hi!

                                        Could the usage of an additional ACL cause the problem?

                                        Debian Discussion: Bug#980786: named: after upgrade to bind9=1:9.16.11-1 named is killed with status=11/SEGV

                                        N M 2 Replies Last reply Reply Quote 2
                                        • N
                                          nordeep @freebsd-man
                                          last edited by

                                          @freebsd-man Thanks. It's make sense.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            madforic @freebsd-man
                                            last edited by

                                            @freebsd-man That is the issue!
                                            In my case I disabled any named acl and bind started as expected.
                                            Named acls make sense only for master zones. Slave and forward zones works with named acls without proplems.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.