From 6a4ea692d4357487b92e6c12e722a42b3430050b Mon Sep 17 00:00:00 2001 From: =?utf8?q?Cristian=20Rodr=C3=ADguez?= Date: Sat, 23 Apr 2022 23:08:45 +0000 Subject: [PATCH] Set IP_BIND_ADDRESS_NO_PORT on outbound tcp sockets When bound to a local address the kernel does not know if the socket will listen() or connect() and must reserve a port inmediately after bind() effectively limiting the random port range to ~32k. when IP_BIND_ADDRESS_NO_PORT is set, the kernel delays source port allocation until the time the complete 4-tuple is known allowing a much larger number of combinations --- services/outside_network.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/services/outside_network.c b/services/outside_network.c index 4578bf8fc..2a081ad71 100644 --- a/services/outside_network.c +++ b/services/outside_network.c @@ -247,6 +247,9 @@ pick_outgoing_tcp(struct pending_tcp* pend, struct waiting_tcp* w, int s) if(addr_is_ip6(&pi->addr, pi->addrlen)) ((struct sockaddr_in6*)&pi->addr)->sin6_port = 0; else ((struct sockaddr_in*)&pi->addr)->sin_port = 0; +#ifdef IP_BIND_ADDRESS_NO_PORT + setsockopt(s, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &(int) {1}, sizeof(int)); +#endif if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) { #ifndef USE_WINSOCK #ifdef EADDRNOTAVAIL -- 2.39.5