Re: rpcbind allowed port range on linux

[Joachim Banzhaf <joachim.banzhaf@googlemail.com>]

Hi Neil and Trond, thanks for the infos. Already helped a lot.

My primary goal is not to pin lockd to a specific port.
I want to prevent any ip service that does not ask for a specific port
to use ports I know are needed later for something else.

I thought, the mechanism is (sorry, had a cut&paste error here) by
defining range /proc/sys/net/ipv4/ip_local_port_range minus ports or
ranges in /proc/sys/net/ipv4/ip_local_reserved_ports (as described
here: http://lxr.free-electrons.com/source/Documentation/networking/ip-sysctl.txt#L809).

I wasn't sure, this mechanism is used here, but Neil, you already
confirmed at least part 1, and that is what happened. Just the
exclusion via /proc/sys/net/ipv4/ip_local_reserved_ports has not
worked.
To be specific, the ip_local_port_range is "40000   65299", and
ip_local_reserved_ports includes, among many others, 50000-50628 and
the port to protect but still picked for lockd was 50213.

Unfortunately, choosing another ip_local_port_range outside 50213 is
not possible, because there is no single range left that is big enough
(and there are other ports to protect like this one).

So, either ip_local_reserved_ports is not used (although I think it
should) or it is used but too long (at least sysctl used in SLES 12
has a bug: it cannot display the whole list) or the list is not
defined at the time lockd gets its port (I did not find where this is
defined, it is not in /etc/sysctl.conf, like ip_local_port_range).

BR,
Joachim