linux-kernel - Re: [PATCH] net: Provide sysctl to tune local port range to IANA specification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240724092555.3ecc2538@hermes.local>
Date: Wed, 24 Jul 2024 09:25:55 -0700
From: Stephen Hemminger <stephen@...workplumber.org>
To: <jiang.kun2@....com.cn>
Cc: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
 <pabeni@...hat.com>, <corbet@....net>, <dsahern@...nel.org>,
 <netdev@...r.kernel.org>, <linux-doc@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <fan.yu9@....com.cn>,
 <xu.xin16@....com.cn>, <zhang.yunkai@....com.cn>, <tu.qiang35@....com.cn>,
 <he.peilin@....com.cn>, <yang.yang29@....com.cn>
Subject: Re: [PATCH] net: Provide sysctl to tune local port range to IANA  
 specification

On Wed, 24 Jul 2024 14:03:54 +0800 (CST)
<jiang.kun2@....com.cn> wrote:

> From: Fan Yu <fan.yu9@....com.cn>
> 
> The Importance of Following IANA Standards
> ========================================
> IANA specifies User ports as 1024-49151, and it just so happens
> that my application uses port 33060 (reserved for MySQL Database Extended),
> which conflicts with the Linux default dynamic port range (32768-60999)[1].
> 
> In fact, IANA assigns numbers in port range from 32768 to 49151,
> which is uniformly accepted by the industry. To do this,
> it is necessary for the kernel to follow the IANA specification.
> 
> Drawbacks of existing implementations
> ========================================
> In past discussions, follow the IANA specification by modifying the
> system defaults has been discouraged, which would greatly affect
> existing users[2].
> 
> Theoretically, this can be done by tuning net.ipv4.local_port_range,
> but there are inconveniences such as:
> (1) For cloud-native scenarios, each container is expected to follow
> the IANA specification uniformly, so it is necessary to do sysctl
> configuration in each container individually, which increases the user's
> resource management costs.
> (2) For new applications, since sysctl(net.ipv4.local_port_range) is
> isolated across namespaces, the container cannot inherit the host's value,
> so after startup, it remains at the kernel default value of 32768-60999,
> which reduces the ease of use of the system.
> 
> Solution
> ========================================
> In order to maintain compatibility, we provide a sysctl interface in
> host namespace, which makes it easy to tune local port range to
> IANA specification.
> 
> When ip_local_port_range_use_iana=1, the local port range of all network
> namespaces is tuned to IANA specification (49152-60999), and IANA
> specification is also used for newly created network namespaces. Therefore,
> each container does not need to do sysctl settings separately, which
> improves the convenience of configuration.
> When ip_local_port_range_use_iana=0, the local port range of all network
> namespaces are tuned to the original kernel defaults (32768-60999).
> For example:
> 	# cat /proc/sys/net/ipv4/ip_local_port_range 
> 	32768   60999
> 	# echo 1 > /proc/sys/net/ipv4/ip_local_port_range_use_iana
> 	# cat /proc/sys/net/ipv4/ip_local_port_range 
> 	49152   60999
> 
> 	# unshare -n
> 	# cat /proc/sys/net/ipv4/ip_local_port_range 
> 	49152   60999
> 
> Notes
> ========================================
> The lower value(49152), consistent with IANA dynamic port lower limit.
> The upper limit value(60999), which differs from the IANA dynamic upper
> limit due to the fact that Linux will use 61000-65535 as masquarading/NAT,
> but this does not conflict with the IANA specification[3].
> 
> Note that following the above specification reduces the number of ephemeral
> ports by half, increasing the risk of port exhaustion[2].
> 
> [1]:https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
> [2]:https://lore.kernel.org/all/bf42f6fd-cd06-02d6-d7b6-233a0602c437@gmail.com/
> [3]:https://lore.kernel.org/all/20070512210830.514c7709@the-village.bc.nu/
> 
> Co-developed-by: Kun Jiang <jiang.kun2@....com.cn>
> Signed-off-by: Fan Yu <fan.yu9@....com.cn>
> Signed-off-by: Kun Jiang <jiang.kun2@....com.cn>
> Reviewed-by: xu xin <xu.xin16@....com.cn>
> Reviewed-by: Yunkai Zhang <zhang.yunkai@....com.cn>
> Reviewed-by: Qiang Tu <tu.qiang35@....com.cn>
> Reviewed-by: Peilin He<he.peilin@....com.cn>
> Cc: Yang Yang <yang.yang29@....com.cn>
> ---

Yet another NAK

Rather than buggy and verbose new sysctl, why not just allow setting
the port range you want through existing sysctls?

You can configure this through existing sysctl files and startup in your distro.