fix(server): SO_REUSEPORT to coexist with mDNSResponder on macOS Sequoia - #250
Open
eejd wants to merge 1 commit into
Open
fix(server): SO_REUSEPORT to coexist with mDNSResponder on macOS Sequoia#250eejd wants to merge 1 commit into
eejd wants to merge 1 commit into
Conversation
…Sequoia On macOS Sequoia (Darwin 25+), mDNSResponder permanently binds *:53 (UDP+TCP) as a unicast DNS proxy. It is SIP-protected and cannot be removed via launchctl. zeronsd already binds to the specific ZeroTier interface IP (not INADDR_ANY), but mDNSResponder's exclusive wildcard binding blocks it regardless. Fix: use socket2 to create the UDP and TCP sockets with SO_REUSEPORT before handing them to trust_dns_server. On BSD/macOS, SO_REUSEPORT allows a new socket to coexist with an existing binding on the same port; the more-specific IP address match (zeronsd's ZT interface IP) takes priority over the wildcard (*) for incoming packets. mDNSResponder continues to operate normally on port 5353 (mDNS). SO_REUSEPORT is supported on macOS 10.4+ and is harmless on Linux, where it can also improve multi-process deployment. The socket2 crate (already a transitive dependency via tokio) provides the cross-platform socket option API. Fixes: macOS issue where zeronsd starts and loads records but never serves DNS (trust_dns_server bind fails silently, leaving DNS queries unanswered). Related: zerotier#199 (macOS port 53 binding failure, reported 2022) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On macOS Sequoia (Darwin 25+), mDNSResponder permanently binds *:53 (UDP+TCP) as a unicast DNS proxy. It is SIP-protected and cannot be removed via launchctl. zeronsd already binds to the specific ZeroTier interface IP (not INADDR_ANY), but mDNSResponder's exclusive wildcard binding blocks, causing zeronsd to appear to load but not respond to any requests as it cannot acquire the port 53 for the ZeroTier IP.
Fix: use socket2 to create the UDP and TCP sockets with SO_REUSEPORT before handing them to trust_dns_server. On BSD/macOS, SO_REUSEPORT allows a new socket to coexist with an existing binding on the same port; the more-specific IP address match (zeronsd's ZT interface IP) takes priority over the wildcard (*) for incoming packets. mDNSResponder continues to operate normally on port 5353 (mDNS).
SO_REUSEPORT is supported on macOS 10.4+ and is harmless on Linux, where it can also improve multi-process deployment. The socket2 crate (already a transitive dependency via tokio) provides the cross-platform socket option API.
Fixes: macOS issue where zeronsd starts and loads records but never serves DNS (trust_dns_server bind fails silently, leaving DNS queries unanswered). Related: #199 (macOS port 53 binding failure, reported 2022)