Created attachment 473474 [details] Patch to fix this problem. Description of problem: 2.6.18-238.el5 forgot to backport inet_is_reserved_local_port() calls in net/ipv6/inet6_hashtables.c and net/ipv6/udp.c (because local port allocation functions are not shared as of 2.6.18). As a result, IPv6 socket's TCP/connect UDP/bind UDP/connect UDP/sendto operations ignore reserved local port ranges configured via /proc/sys/net/ipv4/ip_local_reserved_ports (whereas IPv6's TCP/bind and IPv4's all operations follow reserved local port ranges). The attached patch fixes this issue. Version-Release number of selected component (if applicable): 2.6.18-238.el5
Hi, Is that patch in upstream? If yes, which commit? I searched Linus tree and net-next-2.6, and didn't find it. Also, your patch seems broken? Its header is --- file_not_specified_in_diff +++ file_not_specified_in_diff which could not be applied.
(In reply to comment #1) > Hi, > > Is that patch in upstream? If yes, which commit? I searched Linus tree and > net-next-2.6, and didn't find it. There is no corresponding commit in upstream. We need to create a new commit for backporting to RHEL5's 2.6.18 kernel. When /proc/sys/net/ipv4/ip_local_reserved_ports was added in 2.6.35 , the source code of net/ipv6/inet6_hashtables.c and net/ipv6/udp.c are very much different from these of 2.6.18. For example, int inet6_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk) { return __inet_hash_connect(death_row, sk, inet6_sk_port_offset(sk), __inet6_check_established, __inet6_hash); } in 2.6.35 is int inet6_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk) { struct inet_hashinfo *hinfo = death_row->hashinfo; const unsigned short snum = inet_sk(sk)->num; struct inet_bind_hashbucket *head; struct inet_bind_bucket *tb; int ret; if (snum == 0) { (...snipped...) /* No definite answer... Walk to established hash table */ ret = __inet6_check_established(death_row, sk, snum, NULL); out: local_bh_enable(); return ret; } } in 2.6.18. > Also, your patch seems broken? Its header is > > --- file_not_specified_in_diff > +++ file_not_specified_in_diff > > which could not be applied. Please open https://bugzilla.redhat.com/attachment.cgi?id=473474 . It is a patch file made using quilt command. Regards.
I see, thanks, Tetsuo!
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
in kernel-2.6.18-243.el5 You can download this test kernel (or newer) from http://people.redhat.com/jwilson/el5 Detailed testing feedback is always welcomed.
> in kernel-2.6.18-243.el5 Confirmed that this problem was solved. Thank you.
Verified on 252.el5 1.Reduce the port ranges [root@dell-t5500-01 ~]# echo '50000 50008' > /proc/sys/net/ipv4/ip_local_port_range 2.Set the local reserved ports [root@dell-t5500-01 ~]# echo '50000-50007' > /proc/sys/net/ipv4/ip_local_reserved_ports 3.tcpdump to see the available port is 50008 [root@dell-t5500-01 ~]# tcpdump -i eth2 dst fec0:0:a10:4000:21f:29ff:fe01:358 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes 01:05:50.222383 IP6 2620:52:0:102f:223:aeff:fe7b:9821.50008 > fec0:0:a10:4000:21f:29ff:fe01:358.0: UDP, length 256 01:06:49.287351 IP6 2620:52:0:102f:223:aeff:fe7b:9821.50008 > fec0:0:a10:4000:21f:29ff:fe01:358.0: UDP, length 256 01:06:57.087211 IP6 2620:52:0:102f:223:aeff:fe7b:9821.50008 > fec0:0:a10:4000:21f:29ff:fe01:358.0: UDP, length 256 01:07:03.999214 IP6 2620:52:0:102f:223:aeff:fe7b:9821.50008 > fec0:0:a10:4000:21f:29ff:fe01:358.0: UDP, length 256 01:07:07.803196 IP6 2620:52:0:102f:223:aeff:fe7b:9821.50008 > fec0:0:a10:4000:21f:29ff:fe01:358.0: UDP, length 256 So it works on ipv6.Set verified.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-1065.html