mystery solved: The ip_local_port_range used by rpc services (and others) is set via /etc/sysctl.conf during boot, and the application that needs ports from that range sets ip_local_reserved_ports, but later in the boot process. Too late. I need to solve this there. Thanks for the support, you put me on the right track. BR, Joachim 2016-12-02 9:32 GMT+01:00 Joachim Banzhaf <joachim.banzhaf@xxxxxxxxxxxxxx>: > Hi Neil and Trond, thanks for the infos. Already helped a lot. > > My primary goal is not to pin lockd to a specific port. > I want to prevent any ip service that does not ask for a specific port > to use ports I know are needed later for something else. > > I thought, the mechanism is (sorry, had a cut&paste error here) by > defining range /proc/sys/net/ipv4/ip_local_port_range minus ports or > ranges in /proc/sys/net/ipv4/ip_local_reserved_ports (as described > here: http://lxr.free-electrons.com/source/Documentation/networking/ip-sysctl.txt#L809). > > I wasn't sure, this mechanism is used here, but Neil, you already > confirmed at least part 1, and that is what happened. Just the > exclusion via /proc/sys/net/ipv4/ip_local_reserved_ports has not > worked. > To be specific, the ip_local_port_range is "40000 65299", and > ip_local_reserved_ports includes, among many others, 50000-50628 and > the port to protect but still picked for lockd was 50213. > > Unfortunately, choosing another ip_local_port_range outside 50213 is > not possible, because there is no single range left that is big enough > (and there are other ports to protect like this one). > > So, either ip_local_reserved_ports is not used (although I think it > should) or it is used but too long (at least sysctl used in SLES 12 > has a bug: it cannot display the whole list) or the list is not > defined at the time lockd gets its port (I did not find where this is > defined, it is not in /etc/sysctl.conf, like ip_local_port_range). > > BR, > Joachim -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
