Re: [Libtirpc-devel] [PATCH] Do not bind to reserved ports registered in /etc/services

[Thorsten Kukuk <kukuk@suse.de>]

On Fri, Jan 12, Guillem Jover wrote:

> On Thu, 2018-01-11 at 10:18:46 -0500, Steve Dickson wrote:
> > Overall I think this makes sense, but this eliminates 240 privilege
> > ports and worried we would run out of port (due to them in TIME_WAIT)
> > during a v3 mount storms. A port goes into TIME_WAIT after a v3 mount
> > is done... But on the other hand v3 is no longer the default and
> > there are 784 available ports.... Hopefully that is enough.
> 
> Hmm, those numbers do not match my own. bindresvport() uses the port
> range between 512 and 1023 inclusive. On my Debian stable (stretch)
> and unstable systems these are the number of registered ports in
> /etc/services:
> 
>   ,---
>   # UDP
>   $ awk '/^[^#]/ { print $2 }' /etc/services | \
>     sed -n -e 's,/udp,,p' | \
>     while read port; do if [ $port -ge 512 -a $port -lt 1024 ]; \
>     then echo $port; fi; done | sort -u | wc -l
>   31
>   # TCP
>   $ awk '/^[^#]/ { print $2 }' /etc/services | \
>     sed -n -e 's,/tcp,,p' | \
>     while read port; do if [ $port -ge 512 -a $port -lt 1024 ]; \
>     then echo $port; fi; done | sort -u | wc -l
>   48
>   `---

This numbers are only low, since Debian is using a hand selected
/etc/services file with most entries missing. But your change 
would not be limited to libtirpc on Debian.
I have 276 for TCP and 276 for UDP, that's much, much more. So
already about 50% of the available range.

  Thorsten

-- 
Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & CaaSP
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendoerffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nuernberg)