Bug 1299562 - dhcpd/dhclient create an random listening port in addition to UDP 67/68
Summary: dhcpd/dhclient create an random listening port in addition to UDP 67/68
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: dhcp
Version: 7.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Pavel Zhukov
QA Contact: Release Test Team
URL:
Whiteboard:
Keywords: Patch
: 1486801 (view as bug list)
Depends On:
Blocks: 1298243 1420851 1386624 1465887 1465928
TreeView+ depends on / blocked
 
Reported: 2016-01-18 16:00 UTC by mpathan
Modified: 2018-04-10 08:01 UTC (History)
10 users (show)

(edit)
Cause: dhclient opened additional random port for listening
Consequence: Security applications reported issue.
Fix: Port are opened only if the DDNS functionality is used by dhclient.
Result: No additional port opened in case if DNS update is not in use.
Clone Of:
(edit)
Last Closed: 2018-04-10 08:00:52 UTC


Attachments (Terms of Use)
spawn dns ports on demand later (2.25 KB, patch)
2017-04-05 17:21 UTC, Petr Menšík
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0658 None None None 2018-04-10 08:01 UTC

Description mpathan 2016-01-18 16:00:08 UTC
Description of problem:


DHClient creates an additional listening port in addition to UDP 68 which seems to be a random registered port value. 


How reproducible:
Install dhclient, start the service and perform a netstat -l -u -p and check each of the ports opened by dhclient.


Actual results:

In this example Opening 60964 port unnecessary :

# netstat -panl |grep dhcl
udp     0   0 0.0.0.0:60964   0.0.0.0:*           7594/dhclient       
udp     0   0 0.0.0.0:68      0.0.0.0:*           7594/dhclient       

Expected results:

It should open only 68 port :

udp     0   0 0.0.0.0:68      0.0.0.0:*           7594/dhclient       

Additional info:

Additional Info:
https://bugzilla.redhat.com/show_bug.cgi?id=962950
http://forums.debian.net/viewtopic.php?f=10&t=95273
http://forums.debian.net/viewtopic.php?f=10&t=95273&p=495605#p495605

Comment 2 Jiri Popelka 2016-03-31 07:41:43 UTC
As described in bug #962950, comment #5 it's libdns (bind package) what opens these ports and that the only workaround I'm aware of is building dhcpd/dhclient without DDNS support which is most likely not what we want. I can reassign this to bind to further investigate whether it'd be possible to not open these ports in libdns during initialization.

Comment 11 Petr Menšík 2017-04-05 17:21 UTC
Created attachment 1269039 [details]
spawn dns ports on demand later

Simple fix delaying creation of those ports. I did not check for possible race conditions much, but it seems to fix the issue.

Comment 21 Charlie Brady 2017-08-31 03:08:04 UTC
I think it would be useful for Red Hat to report this bug and the proposed fix to the upstream bug tracker:

https://bugs.isc.org/Public/Dist/Display.html?Name=dhcp-public

Comment 22 Pavel Zhukov 2017-08-31 05:05:54 UTC
*** Bug 1486801 has been marked as a duplicate of this bug. ***

Comment 23 Tomáš Hozza 🤓 2017-08-31 08:07:35 UTC
(In reply to Charlie Brady from comment #21)
> I think it would be useful for Red Hat to report this bug and the proposed
> fix to the upstream bug tracker:
> 
> https://bugs.isc.org/Public/Dist/Display.html?Name=dhcp-public

Since we follow the rule "upstream first", this was done months ago...

https://bugs.isc.org/Public/Bug/Display.html?id=45290
https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=ca22af89996483efd820de0084c964fc336ee7c1

Comment 28 errata-xmlrpc 2018-04-10 08:00:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0658


Note You need to log in before you can comment on or make changes to this bug.