Bug 391931
| Summary: | Bind doesn't obey net.ipv4.ip_local_port_range | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bojan Smojver <bojan> |
| Component: | bind | Assignee: | Adam Tkac <atkac> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 8 | CC: | ovasik |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-12-03 09:10:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Bojan Smojver
2007-11-20 11:25:38 UTC
You're right. Code which creates sockets is changed in 9.5 . I recommend you use
query-source{,-v6} option before I create patch.
Or if you have firewall with iptables you will add rule like iptables -A FORWARD -m state --state ESTABILISHED,RELATED -j ACCEPT this rule should allow random incomming ports as response to named's query Could you please test http://koji.fedoraproject.org/koji/taskinfo?taskID=250133 ? All should work as expected. I used the query-source option from comment #1 to work around the issue. Thanks for the hints! I'll download and test new build now... Still the same. Picks random ports, not the one defined in net.ipv4.ip_local_port_range. Should have said: not the _ones_ defined. BTW, does avoid-v4-udp-ports take a range of ports as an argument? I tried port:port and port-port, but got syntax errors there. Typing thousands of ports, each is followed by ; seems rather unpractical... grr, I created patch but forgot apply it :) Could you please test http://koji.fedoraproject.org/koji/taskinfo?taskID=252611 ? Patch is really applied now. About avoid-v4-udp-ports - from manpage and ARM you have to specify list, not range. Let me discuss this option with upstream. Specifying list is really unpractical Lookin' good! Thanks for the prompt fix. PS. Yeah, you're right about avoid-v4-udp-ports - it more or less useless as it is. Thank you for feedback. I'm going to apply that patch in next build but upstream doesn't like it because linux kernel doesn't pick port numbers randomly (= lover security). Patch will be temporary solution before upstream extends avoid-v4-udp-ports or query-source options. I expect in the end port numbers will be controlled in named.conf Hm, upstream doesn't want to do anything now. Would it be possible to use
query-source{,-v6} for you? I don't want keep discussed patch downstream
As I understand it, it's the same as the patch in .2 anyway, so should be OK. Hopefully, they'll have a range there (like for instance vsftpd does), so that people can pick ports they want. (In reply to comment #12) > As I understand it, it's the same as the patch in .2 anyway, so should be OK. > Hopefully, they'll have a range there (like for instance vsftpd does), so that > people can pick ports they want. Yes, I told them it. |