opnsense / opnsense/plugins

os-bind: port conflict validation for port 53 is not IP-specific

Open
#5,389 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

support
Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

The os-bind GUI validation blocks setting BIND to port 53 when another DNS service reports port 53 in dns_ports, even if the concrete listen address intended for BIND is actually free.

This means validation is done only by port number, not by the effective (IP, port) socket combination.

To Reproduce

  1. Run Unbound on port 53, but only on selected interfaces.
  2. Free one specific address from Unbound, for example 10.2.0.1:53.
  3. Attempt to configure BIND to listen on that free address on port 53.
  4. Save/apply the BIND configuration.

Actual behavior

The GUI rejects the port with a message equivalent to:

Unbound DNS is currently using this port.

even though the intended target address is not actually bound by Unbound.

Observed evidence

  • sockstat confirms the target address can be free, e.g. 10.2.0.1:53 not used by Unbound.
  • However, BIND validation still rejects port 53.

Root cause

The validation logic in OPNsense\Bind\General::performValidation() checks only whether another service reports the same port in dns_ports:

if ($service['name'] != 'named' && in_array((string)$this->port, $service['dns_ports'])) {
    ...
}

It does not evaluate the configured BIND listen addresses.

Expected behavior

Port conflict validation should be IP-aware, or at least not reject configurations where the selected BIND listen addresses are not actually occupied by the other DNS service.

Why this matters

This prevents legitimate split setups such as:

  • Unbound on one local/interface address on port 53
  • BIND on another local/interface address on port 53

even when the sockets would not overlap.

Environment

  • OPNsense 26.1 / FreeBSD 14.3
  • os-bind package version observed: 1.34_2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at OPNsense\Bind\General::performValidation() and inspect how dns_ports and the configured BIND listen addresses are represented. Reproduce the split-address setup with sockstat, then verify that validation distinguishes overlapping and non-overlapping address/port combinations without rejecting a free target address.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.