From owner-freebsd-net@FreeBSD.ORG Mon Jul 3 17:48:09 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4B40D16A412 for ; Mon, 3 Jul 2006 17:48:09 +0000 (UTC) (envelope-from maxim@macomnet.ru) Received: from mp2.macomnet.net (mp2.macomnet.net [195.128.64.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7755E4429D for ; Mon, 3 Jul 2006 16:25:56 +0000 (GMT) (envelope-from maxim@macomnet.ru) Received: from localhost (localhost.int.ru [127.0.0.1] (may be forged)) by mp2.macomnet.net (8.13.7/8.13.3) with ESMTP id k63GPtLA061019; Mon, 3 Jul 2006 20:25:55 +0400 (MSD) (envelope-from maxim@macomnet.ru) Date: Mon, 3 Jul 2006 20:25:55 +0400 (MSD) From: Maxim Konovalov To: Nikolay Pavlov In-Reply-To: <20060703154113.GA28598@zone3000.net> Message-ID: <20060703201300.U57594@mp2.macomnet.net> References: <20060703154113.GA28598@zone3000.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: freebsd-net@freebsd.org Subject: Re: tftpd not working when net.inet.udp.blackhole=1 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2006 17:48:09 -0000 Hello, On Mon, 3 Jul 2006, 18:41+0300, Nikolay Pavlov wrote: > Hi folks. > I have a strange problem with tftpd when using sysctl > net.inet.udp.blackhole=1 It's not working with this variable enabled. > > I use tftp to upload images from my routers. Here is details of the > problem: > > OS FreeBSD 6.0-RELEASE-p6 > > root@ipstat:~/projects/route_tools# sysctl net.inet.udp.blackhole=1 > net.inet.udp.blackhole: 0 -> 1 > > telnet@fbi8000-Border-NY#copy running-conf tftp XX.XX.48.25 > XX.XX.51.194.runcfg.new > TFTP session timed out > Error - can't upload running-config to TFTP server. [...] Nice question indeed. I spent 20 minutes trying to get wtf is going on. There are several moments: a) I guess you are running stock tftpd from inetd i.e. tftpd -s /tftproot. In that case tftpd chroots to /tftproot. b) tftpd wants to resolve a peer ip address but there is no /etc/resolv.conf in its new root directory so it asks 127.0.0.1 for resolve. c) net.inet.udp.blackhole=1 forces the kernel just drop tftpd DNS requests. d) From this point several timing issues starts: tftpd still trying to resolve a client ip address, then gives up but now client gives up. I see several solutions: a) Don't use chroot. In general this is not good from security point of view. b) Run a named @127.0.0.1. c) Put a valid resolv.conf to /tftpboot/etc/. d) Don't use net.inet.udp.blackhole=1. HTH. -- Maxim Konovalov