On 8/28/20 2:52 PM, Stephen Hemminger wrote: > On Fri, 28 Aug 2020 22:44:47 +0200 > Bart Groeneveld <avi@xxxxxxxxxx> wrote: > >> IANA specifies User ports as 1024-49151, >> and Private ports (local/ephemeral/dynamic/w/e) as 49152-65535 [1]. >> >> This means Linux uses 32768-49151 'illegally'. >> This is not just a matter of following specifications: >> IANA actually assigns numbers in this range [1]. >> >> I understand that Linux uses 61000-65535 for masquarading/NAT [2], >> so I left the high value at 60999. >> This means the high value still does not follow the specification, >> but it also doesn't conflict with it. >> >> This change will effectively halve the available ephemeral ports, >> increasing the risk of port exhaustion. But: >> a) I don't think that warrants ignoring standards. >> Consider for example setting up a (corporate) firewall blocking >> all unknown external services. >> It will only allow outgoing trafiic at port 80,443 and 49152-65535. >> A Linux computer behind such a firewall will not be able to connect >> to *any* external service *half of the time*. >> Of course, the firewall can be adjusted to also allow 32768-49151, >> but that allows computers to use some services against the policy. >> b) It is only an issue with more than 11848 *outgoing* connections. >> I think that is a niche case (I know, citation needed, but still). >> If someone finds themselves in such a niche case, >> they can still modify ip_local_port_range. >> >> This patch keeps the low and high value at different parity, >> as to optimize port assignment [3]. >> >> [1]: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt >> [2]: https://marc.info/?l=linux-kernel&m=117900026927289 >> [3]: See for example commit 1580ab63fc9a03593072cc5656167a75c4f1d173 ("tcp/dccp: better use of ephemeral ports in connect()") >> >> Signed-off-by: Bart Groeneveld <avi@xxxxxxxxxx> > > Changing the default range impacts existing users. Since Linux has been doing > this for so long, I don't think just because a standards body decided to reserve > some space is sufficient justification to do this. > Agreed. There is a sysctl, allowing admins/distros to opt-in to whatever IANA values of the days if they really want. We have already many issues caused by ephemeral range being too small. For instance I often have to debug issues caused by some distros changing sysctl_tcp_rfc1337 to 1, hurting some real applications.
