Red Hat Bugzilla – Bug 554316
ISC BIND (named) crashes with "keytable.c:286: REQUIRE(nextnodep != ((void *)0) && *nextnodep == ((void *)0)) failed"
Last modified: 2013-04-30 19:45:29 EDT
+++ This bug was initially created as a clone of Bug #549284 +++
Description of problem:
named repeatedly crashes (on several independent sites), in "/var/log/messages" are lines:
Dec 21 07:21:43 ns named: no valid KEY resolving '77.in-addr.arpa/DNSKEY/IN': 188.8.131.52#53
Dec 21 07:21:43 ns named: no valid KEY resolving '77.in-addr.arpa/DNSKEY/IN': 184.108.40.206#53
Dec 21 07:21:43 ns named: no valid KEY resolving '77.in-addr.arpa/DNSKEY/IN': 220.127.116.11#53
Dec 21 07:21:43 ns named: no valid KEY resolving '77.in-addr.arpa/DNSKEY/IN': 18.104.22.168#53
Dec 21 07:21:44 ns named: keytable.c:286: REQUIRE(nextnodep != ((void *)0) && *nextnodep == ((void *)0)) failed
Dec 21 07:21:44 ns named: exiting (due to assertion failure)
Version-Release number of selected component (if applicable):
At affected nodes named run with DNSSEC enabled. Crashes may be related with dlv.isc.org inaccessibility. But crashes are non acceptable
--- Additional comment from firstname.lastname@example.org on 2009-12-28 08:37:41 EST ---
Disabling DNSSEC (I suppose comment named.conf lines
// dnssec-enable yes;
// dnssec-validation yes;
// dnssec-lookaside . trust-anchor dlv.isc.org.;
do it) does not help.
I call for increase priority of this bug.
--- Additional comment from email@example.com on 2009-12-29 14:51:36 EST ---
For me this seems to relate to something about lots of bad lookups or doing inaddr lookups. (or at least that is when I see it)
Dec 28 07:47:23 * named: network unreachable resolving '92.in-addr.arpa/DNSKEY/IN': 2001:660:3006:1::1:1#53
Dec 28 07:47:23 * named: network unreachable resolving '92.in-addr.arpa/DNSKEY/IN': 2001:dc0:1:0:4777::140#53
By the way we are not doing ip6, but the system regularly insists on trying to do lookups on ip6 addresses.
Hope this helps.
--- Additional comment from firstname.lastname@example.org on 2010-01-05 23:29:41 EST ---
On my sites we are not doing IPv6 too (loading ipv6.ko kernel module is supressed, then no interface own IPv6 address), and bind does not ip6 lookups.
But messages as:
Dec 21 07:21:42 ns named: no valid KEY resolving '95.in-addr.arpa/DNSKEY/IN': 22.214.171.124#53
Dec 21 07:21:42 ns named: unexpected RCODE (SERVFAIL) resolving '95.in-addr.arpa/DNSKEY/IN': 126.96.36.199#53
Jan 1 05:20:12 ns named: not insecure resolving '188.8.131.52.in-addr.arpa/PTR/IN': 184.108.40.206#53
Jan 1 05:20:18 ns named: no valid RRSIG resolving '220.127.116.11.in-addr.arpa/PTR/IN': 18.104.22.168#53
Jan 1 05:55:14 ns named: unexpected RCODE (REFUSED) resolving 'cache.freebsd.lublin.pl/A/IN': 22.214.171.124#53
appears frequently in /var/log/messages, first one even 10x per second.
--- Additional comment from email@example.com on 2010-01-11 05:27:07 EST ---
*** Bug 553814 has been marked as a duplicate of this bug. ***
--- Additional comment from firstname.lastname@example.org on 2010-01-11 05:55:24 EST ---
Created an attachment (id=382949)
Patch has been sent to upstream for review, will be part of next update.
*** Bug 551003 has been marked as a duplicate of this bug. ***
Still have the problem with bind-9.6.1-13.P2.fc12.i686
I just built updated package but I'm not going to release it because I expect upstream release soon (~ 1 week). You can use it if you would like to fix this issue right now. Build is located on http://kojiweb.fedoraproject.org/koji/buildinfo?buildID=150708.
Tell them to hurry up, I have about 2 crashes a day from this.
I have created a crude script to monitor the daemon via a cron job for the servers I maintain.
CHECK=`/sbin/service named status | grep -c "server is up"`
if [ $CHECK = 0 ]; then
service named restart
I call this file 'named-monitor' and I placed it in /root with 700 permissions and root:root ownership. I call the script from /etc/cron.d/named-monitor thus:
# Cron script to run named-check every 5 minutes.
*/5 * * * * root /root/named-check
If the named daemon is not running for any reason, it will be restarted. If it is running, the script simply exits. This should keep us going until the new packages are released.
On four production servers bind-9.6.1-8.P2.fc11.i586 from koji run over 13 hours
This version is probably patched similarly to bind-9.6.1-14.P2.fc12
On four servers bind-9.6.1-8.P2.fc11.i586 successfully run for four days, thus this bug is probably solved.
Fixed in bind-9.6.1-15.P3.fc12.