Re: [PATCH v3] net: Use standardized (IANA) local port range

From: Stephen Hemminger <stephen@networkplumber.org>
To: Bart Groeneveld <avi@bartavi.nl>
Cc: linux-kernel@vger.kernel.org,
	"David S . Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>,
	Jonathan Corbet <corbet@lwn.net>,
	Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	netdev@vger.kernel.org, linux-doc@vger.kernel.org
Subject: Re: [PATCH v3] net: Use standardized (IANA) local port range
Date: Fri, 28 Aug 2020 14:52:03 -0700	[thread overview]
Message-ID: <20200828145203.65395ad8@hermes.lan> (raw)
In-Reply-To: <20200828204447.32838-1-avi@bartavi.nl>

On Fri, 28 Aug 2020 22:44:47 +0200
Bart Groeneveld <avi@bartavi.nl> wrote:

> IANA specifies User ports as 1024-49151,
> and Private ports (local/ephemeral/dynamic/w/e) as 49152-65535 [1].
> 
> This means Linux uses 32768-49151 'illegally'.
> This is not just a matter of following specifications:
> IANA actually assigns numbers in this range [1].
> 
> I understand that Linux uses 61000-65535 for masquarading/NAT [2],
> so I left the high value at 60999.
> This means the high value still does not follow the specification,
> but it also doesn't conflict with it.
> 
> This change will effectively halve the available ephemeral ports,
> increasing the risk of port exhaustion. But:
> a) I don't think that warrants ignoring standards.
> 	Consider for example setting up a (corporate) firewall blocking
> 	all unknown external services.
> 	It will only allow outgoing trafiic at port 80,443 and 49152-65535.
> 	A Linux computer behind such a firewall will not be able to connect
> 	to *any* external service *half of the time*.
> 	Of course, the firewall can be adjusted to also allow 32768-49151,
> 	but that allows computers to use some services against the policy.
> b) It is only an issue with more than 11848 *outgoing* connections.
> 	I think that is a niche case (I know, citation needed, but still).
> 	If someone finds themselves in such a niche case,
> 	they can still modify ip_local_port_range.
> 
> This patch keeps the low and high value at different parity,
> as to optimize port assignment [3].
> 
> [1]: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
> [2]: https://marc.info/?l=linux-kernel&m=117900026927289
> [3]: See for example commit 1580ab63fc9a03593072cc5656167a75c4f1d173 ("tcp/dccp: better use of ephemeral ports in connect()")
> 
> Signed-off-by: Bart Groeneveld <avi@bartavi.nl>

Changing the default range impacts existing users. Since Linux has been doing
this for so long, I don't think just because a standards body decided to reserve
some space is sufficient justification to do this.