Bug #10445: BIND crashed when added RPZ. rpz is not a master or slave zone. - pfSense Packages - pfSense bugtracker

Actions

Copy link

Bug #10445

open

BIND crashed when added RPZ. rpz is not a master or slave zone.

Added by lexxai lexxai over 4 years ago. Updated over 2 years ago.

Status:

Feedback

Priority:

Normal

Assignee:

Category:

BIND

Target version:

Start date:

04/07/2020

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

Affected Version:

2.4.4-p3

Affected Plus Version:

Affected Architecture:

amd64

Description

Before upgrade pfsense to version 2.4.5 i try update packages on 2.4.4p3.
After updating BIND to 9.14_3 (Package Dependencies: bind914-9.14.9), I found that bind now crash with message:

rpz 'rpz.local' is not a master or slave zone 
loading configuration: not found
exiting (due to fatal error)

rpz.local is Response Policy Zone.

When I uncheck that zone is used in a response policy, then BIND started.
I try create clear new zone for test, the same result - crash when zone promoted to 'Response Policy Zone'.

Some like me error described here:
https://forum.netgate.com/topic/152139/possible-bug-with-bind-config-generate-in-2-4-5-bind-package-9-14_3

But user can resolve problem by edit local config file, in my sitiation it not help.

Actions

Copy link

Updated by Manuel Piovan over 4 years ago

i was able to reproduce it here
https://forum.netgate.com/topic/152274/rpz-rpz-local-is-not-a-master-or-slave-zone-crash-bind

Actions

Copy link

Updated by Brandon Rock over 4 years ago

I found that the issue was occurring for me because the response-policy setting was defined in the global options section, but not all views were referencing the zones defined in that setting. Moving the response-policy setting to the individual views fixed the issue for me. I think a good fix for this would be for the UI to define the response-policy setting in the individual views, when views are in use.

I was able to work around the issue in the user interface by unchecking the Response Policy Zone checkbox in the zone, and manually adding the response-policy setting to the views. To do this, follow these instructions:

In the response policy zone, uncheck the Response Policy Zone checkbox. This will prevent the response-policy setting from being added to the global options.
For each view you define that needs to use a response policy zone, add a response-policy entry to the Custom Options portion of the view. For example, since my response policy zone is called rpz-default, I added the following custom options: response-policy { zone "rpz-default"; };