From owner-freebsd-net@FreeBSD.ORG  Wed Dec 27 17:52:29 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@freebsd.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 4E86616A40F
	for <net@freebsd.org>; Wed, 27 Dec 2006 17:52:29 +0000 (UTC)
	(envelope-from freebsd.org@ab.ote.we.lv)
Received: from mx0.nttmcl.com (MX0.nttmcl.com [216.69.68.201])
	by mx1.freebsd.org (Postfix) with ESMTP id 1F18813C463
	for <net@freebsd.org>; Wed, 27 Dec 2006 17:52:27 +0000 (UTC)
	(envelope-from freebsd.org@ab.ote.we.lv)
Received: from [216.69.70.43] (bbq.nttmcl.com [216.69.70.43])
	by mx0.nttmcl.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id
	kBRHZJ53029078 for <net@freebsd.org>; Wed, 27 Dec 2006 09:35:24 -0800
Message-ID: <4592AED6.4040508@ab.ote.we.lv>
Date: Wed, 27 Dec 2006 09:35:18 -0800
From: "Eugene M. Kim" <freebsd.org@ab.ote.we.lv>
User-Agent: Thunderbird 1.5.0.8 (X11/20061130)
MIME-Version: 1.0
To: net@freebsd.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Cc: 
Subject: BIND running setuid with interface changes
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Dec 2006 17:52:29 -0000

Greetings,

I am running a VPN gateway, where interfaces come and go frequently.  I
set up BIND so that it listens on all interfaces.
It seems that, instead of listening on a wildcard IPv4 address (*:53,
that is), BIND monitors for address changes on all interfaces and
creates a separate listening socket for each address (note that IPv6
uses the wildcard address, but IPv4 does not):

home 09:22:27 namedb # 61 sockstat|grep 'named.*:53'
bind     named      38200 20 udp6   *:53                  *:*
bind     named      38200 21 tcp6   *:53                  *:*
bind     named      38200 22 udp4   10.0.0.1:53           *:*
bind     named      38200 23 tcp4   10.0.0.1:53           *:*
bind     named      38200 24 udp4   127.0.0.1:53          *:*
bind     named      38200 25 tcp4   127.0.0.1:53          *:*
home 09:25:12 namedb # 62 


Then, when a new address comes up (such as on a dynamically created L2TP
tun(4) interface), BIND tries to listen on it, but fails because it is
running setuid as bind:

Dec 27 02:32:00 home named[1121]: listening on IPv4 interface tun0, 10.0.2.129#53
Dec 27 02:32:00 home named[1121]: could not listen on UDP socket: permission denied


The only workarounds that I can think of is either to run BIND as setuid
root, or to restart (not reload) BIND every time a new VPN connection
comes up, both of which I am not comfortable with.

Any better ideas?

Cheers,
Eugene