os-bind: port conflict validation for port 53 is not IP-specific
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 1.2k
- Forks
- 863
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 10
Description
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
- I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
- I have searched the existing issues, open and closed, and I'm convinced that mine is new.
- When the request is meant for an existing plugin, I've added its name to the title.
Describe the bug
The os-bind GUI validation blocks setting BIND to port 53 when another DNS service reports port 53 in dns_ports, even if the concrete listen address intended for BIND is actually free.
This means validation is done only by port number, not by the effective (IP, port) socket combination.
To Reproduce
- Run Unbound on port 53, but only on selected interfaces.
- Free one specific address from Unbound, for example
10.2.0.1:53. - Attempt to configure BIND to listen on that free address on port 53.
- Save/apply the BIND configuration.
Actual behavior
The GUI rejects the port with a message equivalent to:
Unbound DNS is currently using this port.
even though the intended target address is not actually bound by Unbound.
Observed evidence
sockstatconfirms the target address can be free, e.g.10.2.0.1:53not used by Unbound.- However, BIND validation still rejects port 53.
Root cause
The validation logic in OPNsense\Bind\General::performValidation() checks only whether another service reports the same port in dns_ports:
if ($service['name'] != 'named' && in_array((string)$this->port, $service['dns_ports'])) {
...
}
It does not evaluate the configured BIND listen addresses.
Expected behavior
Port conflict validation should be IP-aware, or at least not reject configurations where the selected BIND listen addresses are not actually occupied by the other DNS service.
Why this matters
This prevents legitimate split setups such as:
- Unbound on one local/interface address on port 53
- BIND on another local/interface address on port 53
even when the sockets would not overlap.
Environment
- OPNsense 26.1 / FreeBSD 14.3
- os-bind package version observed: 1.34_2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at OPNsense\Bind\General::performValidation() and inspect how dns_ports and the configured BIND listen addresses are represented. Reproduce the split-address setup with sockstat, then verify that validation distinguishes overlapping and non-overlapping address/port combinations without rejecting a free target address.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100