linux-kernel - Re: [PATCH v3] net: Use standardized (IANA) local port range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 31 Aug 2020 10:07:19 +0200
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Stephen Hemminger <stephen@...workplumber.org>,
        Bart Groeneveld <avi@...tavi.nl>
Cc:     linux-kernel@...r.kernel.org,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Jonathan Corbet <corbet@....net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        netdev@...r.kernel.org, linux-doc@...r.kernel.org
Subject: Re: [PATCH v3] net: Use standardized (IANA) local port range



On 8/28/20 2:52 PM, Stephen Hemminger wrote:
> On Fri, 28 Aug 2020 22:44:47 +0200
> Bart Groeneveld <avi@...tavi.nl> wrote:
> 
>> IANA specifies User ports as 1024-49151,
>> and Private ports (local/ephemeral/dynamic/w/e) as 49152-65535 [1].
>>
>> This means Linux uses 32768-49151 'illegally'.
>> This is not just a matter of following specifications:
>> IANA actually assigns numbers in this range [1].
>>
>> I understand that Linux uses 61000-65535 for masquarading/NAT [2],
>> so I left the high value at 60999.
>> This means the high value still does not follow the specification,
>> but it also doesn't conflict with it.
>>
>> This change will effectively halve the available ephemeral ports,
>> increasing the risk of port exhaustion. But:
>> a) I don't think that warrants ignoring standards.
>> 	Consider for example setting up a (corporate) firewall blocking
>> 	all unknown external services.
>> 	It will only allow outgoing trafiic at port 80,443 and 49152-65535.
>> 	A Linux computer behind such a firewall will not be able to connect
>> 	to *any* external service *half of the time*.
>> 	Of course, the firewall can be adjusted to also allow 32768-49151,
>> 	but that allows computers to use some services against the policy.
>> b) It is only an issue with more than 11848 *outgoing* connections.
>> 	I think that is a niche case (I know, citation needed, but still).
>> 	If someone finds themselves in such a niche case,
>> 	they can still modify ip_local_port_range.
>>
>> This patch keeps the low and high value at different parity,
>> as to optimize port assignment [3].
>>
>> [1]: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
>> [2]: https://marc.info/?l=linux-kernel&m=117900026927289
>> [3]: See for example commit 1580ab63fc9a03593072cc5656167a75c4f1d173 ("tcp/dccp: better use of ephemeral ports in connect()")
>>
>> Signed-off-by: Bart Groeneveld <avi@...tavi.nl>
> 
> Changing the default range impacts existing users. Since Linux has been doing
> this for so long, I don't think just because a standards body decided to reserve
> some space is sufficient justification to do this.
> 

Agreed.

There is a sysctl, allowing admins/distros to opt-in to whatever IANA values of the days
if they really want.

We have already many issues caused by ephemeral range being too small.

For instance I often have to debug issues caused by some distros
changing sysctl_tcp_rfc1337 to 1, hurting some real applications.