[RFC] tcp: randomize TCP source ports

Eric Dumazet
2013-11-08T00:54:14Z

TCP does proper randomization of ports on active connections only if
bind() is used between socket() and connect()

If bind() is not specifically used, kernel performs autobind, and TCP
autobind typically uses a sequential allocation for a given (dst
address, dst port, src address) tuple.

UDP autobind does a randomization, as part of the effort to make DNS
more secure.

TCP autobind uses a global sequential number (called @hint in source
code) with a perturbation done by secure_ipv4_port_ephemeral(),
so that the 'hint' of the next port is per (saddr, daddr, dport) tuple

This was probably done to maximize port use and avoid hitting timewait
sockets, but I think it should be OK to replace this stuff by a random
selection to have more entropy in the various flow hashing functions,
and in general higher security levels. TCP timestamps are now well
deployed.

Patch would be trivial, but I'd like to get some comments if
you think this idea is wrong.

Thanks !