On Thu, Apr 1, 2021 at 5:58 PM Otto Hollmann <[email protected]> wrote: > > If there is overlapp between ip_local_port_range and > ip_local_reserved_ports with a huge reserved block, it will affect > probability of selecting ephemeral ports, see file > net/ipv4/inet_hashtables.c:723 > > int __inet_hash_connect( > ... > for (i = 0; i < remaining; i += 2, port += 2) { > if (unlikely(port >= high)) > port -= remaining; > if (inet_is_local_reserved_port(net, port)) > continue; > > E.g. if there is reserved block of 10000 ports, two ports right after > this block will be 5000 more likely selected than others. > If this was intended, we can/should add note into documentation as > proposed in this commit, otherwise we should think about different solution. > One option could be mapping table of continuous port ranges. Second option > could be letting user to modify step (port+=2) in above loop, e.g. using new > sysctl parameter. > > Signed-off-by: Otto Hollmann <[email protected]>
I think we can view this as a security bug that needs a fix.
