Bug 729349

Description of problem:

Resolving via NIS uses a disproportionate number of TCP connects from
ports in the reserved range (below 1024) when root. This can break server
(NFS) and any other machine in several ways (out of privileged ports,
conflicting ports in use). In some cases the issue can be mitigated
though the use of nscd.

When exporting a number (20) of mounts over NFS (version 3, UDP only)
to a number (60) of clients via a NIS netgroup the server start up
broke because there were too many lookups involved consuming way to many
privileged ports:

Aug  8 16:46:13 nfs5 kernel: svc: failed to register lockdv1 RPC service (errno 5).
Aug  8 16:46:13 nfs5 kernel: lockd_up: makesock failed, error=-5
Aug  8 18:28:53 nfs5 kernel: svc: failed to register nfsdv2 RPC service (errno 5).
Aug  8 18:28:53 nfs5 kernel: svc: failed to register nfsaclv2 RPC service (errno 5).
Aug  8 18:28:53 nfs5 kernel: nfsd: last server has exited, flushing export cache
Aug  8 18:28:53 nfs5 xinetd[3298]: bind failed (Address already in use (errno = 98)). service = login
Aug  8 18:28:53 nfs5 xinetd[3298]: bind failed (Address already in use (errno = 98)). service = shell
Aug  8 18:28:53 nfs5 xinetd[3298]: bind failed (Address already in use (errno = 98)). service = rsync

This is all due to excessive numbers of privileged TCP ports part of
connections in TIME_WAIT state. This issue can be mitigated by an early

	echo 1 >/proc/sys/net/ipv4/tcp_fin_timeout

during startup (maybe '0' works even better, not sure).


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
Install and configure ypbind, do not run nscd. Match "netstat -ant"
output against "rpcinfo -p" output after (do this as "root"):
-	ls -l causing many user/group lookups
-	service nfslock start 
-	service nfs start 
-	rsh as non-root
Rsh is an interesting case since it requires a privileged port but uses
many of them too for NIS lookups for no reason: it should use unprivileged
ports for that.


Actual results:
Lots of TCP connections in TIME_WAIT from privileged TCP ports to ypbind
TCP port registered at rpcbind.


Expected results:


Additional info:
This could be considered an RPC (glibc/sunrpc) issue. Maybe it will
resurface in libtirpc (has a /etc/netconfig however).
Things to consider:
-	ypbind UDP-only option.
-	local RPC should always use UDP.
-	RPC by root: Don't use privileged ports unless explicitly asked for.
-	separate TCP FIN timeout (=zero) for local TCP connects.