Skip to content

Commit

Permalink
net: document a side effect of ip_local_reserved_ports
Browse files Browse the repository at this point in the history
If there is overlapp between ip_local_port_range and ip_local_reserved_ports with a huge reserved block, it will affect probability of selecting ephemeral ports, see file net/ipv4/inet_hashtables.c:723

    int __inet_hash_connect(
    ...
            for (i = 0; i < remaining; i += 2, port += 2) {
                    if (unlikely(port >= high))
                            port -= remaining;
                    if (inet_is_local_reserved_port(net, port))
                            continue;

    E.g. if there is reserved block of 10000 ports, two ports right after this block will be 5000 more likely selected than others.
    If this was intended, we can/should add note into documentation as proposed in this commit, otherwise we should think about different solution. One option could be mapping table of continuous port ranges. Second option could be letting user to modify step (port+=2) in above loop, e.g. using new sysctl parameter.

Signed-off-by: Otto Hollmann <otto.hollmann@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Otto Hollmann authored and David S. Miller committed Apr 1, 2021
1 parent e228c0d commit a7a80b1
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion Documentation/networking/ip-sysctl.rst
Original file line number Diff line number Diff line change
Expand Up @@ -1073,7 +1073,9 @@ ip_local_reserved_ports - list of comma separated ranges

although this is redundant. However such a setting is useful
if later the port range is changed to a value that will
include the reserved ports.
include the reserved ports. Also keep in mind, that overlapping
of these ranges may affect probability of selecting ephemeral
ports which are right after block of reserved ports.

Default: Empty

Expand Down

0 comments on commit a7a80b1

Please sign in to comment.