Merge release-20210301.0-29-gabbdcebc5 (automated)

14 files changed, 427 insertions, 29 deletions

diff --git a/pkg/sentry/fs/proc/proc_state_autogen.go b/pkg/sentry/fs/proc/proc_state_autogen.go
index 3b52128f9..bbbc29f8a 100644
--- a/pkg/sentry/fs/proc/proc_state_autogen.go
+++ b/pkg/sentry/fs/proc/proc_state_autogen.go
@@ -930,6 +930,61 @@ func (f *ipForwardingFile) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.LoadWait(1, &f.stack)
 }
 
+func (in *portRangeInode) StateTypeName() string {
+	return "pkg/sentry/fs/proc.portRangeInode"
+}
+
+func (in *portRangeInode) StateFields() []string {
+	return []string{
+		"SimpleFileInode",
+		"stack",
+		"start",
+		"end",
+	}
+}
+
+func (in *portRangeInode) beforeSave() {}
+
+func (in *portRangeInode) StateSave(stateSinkObject state.Sink) {
+	in.beforeSave()
+	stateSinkObject.Save(0, &in.SimpleFileInode)
+	stateSinkObject.Save(1, &in.stack)
+	stateSinkObject.Save(2, &in.start)
+	stateSinkObject.Save(3, &in.end)
+}
+
+func (in *portRangeInode) afterLoad() {}
+
+func (in *portRangeInode) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &in.SimpleFileInode)
+	stateSourceObject.LoadWait(1, &in.stack)
+	stateSourceObject.Load(2, &in.start)
+	stateSourceObject.Load(3, &in.end)
+}
+
+func (pf *portRangeFile) StateTypeName() string {
+	return "pkg/sentry/fs/proc.portRangeFile"
+}
+
+func (pf *portRangeFile) StateFields() []string {
+	return []string{
+		"inode",
+	}
+}
+
+func (pf *portRangeFile) beforeSave() {}
+
+func (pf *portRangeFile) StateSave(stateSinkObject state.Sink) {
+	pf.beforeSave()
+	stateSinkObject.Save(0, &pf.inode)
+}
+
+func (pf *portRangeFile) afterLoad() {}
+
+func (pf *portRangeFile) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &pf.inode)
+}
+
 func (t *taskDir) StateTypeName() string {
 	return "pkg/sentry/fs/proc.taskDir"
 }
@@ -1598,6 +1653,8 @@ func init() {
 	state.Register((*tcpRecoveryFile)(nil))
 	state.Register((*ipForwarding)(nil))
 	state.Register((*ipForwardingFile)(nil))
+	state.Register((*portRangeInode)(nil))
+	state.Register((*portRangeFile)(nil))
 	state.Register((*taskDir)(nil))
 	state.Register((*subtasks)(nil))
 	state.Register((*subtasksFile)(nil))
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index 52061175f..bbe282c03 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -17,6 +17,7 @@ package proc
 import (
 	"fmt"
 	"io"
+	"math"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
@@ -26,6 +27,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sync"
+	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/usermem"
 	"gvisor.dev/gvisor/pkg/waiter"
@@ -498,6 +500,120 @@ func (f *ipForwardingFile) Write(ctx context.Context, _ *fs.File, src usermem.IO
 	return n, f.stack.SetForwarding(ipv4.ProtocolNumber, *f.ipf.enabled)
 }
 
+// portRangeInode implements fs.InodeOperations. It provides and allows
+// modification of the range of ephemeral ports that IPv4 and IPv6 sockets
+// choose from.
+//
+// +stateify savable
+type portRangeInode struct {
+	fsutil.SimpleFileInode
+
+	stack inet.Stack `state:"wait"`
+
+	// start and end store the port range. We must save/restore this here,
+	// since a netstack instance is created on restore.
+	start *uint16
+	end   *uint16
+}
+
+func newPortRangeInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *fs.Inode {
+	ipf := &portRangeInode{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0644), linux.PROC_SUPER_MAGIC),
+		stack:           s,
+	}
+	sattr := fs.StableAttr{
+		DeviceID:  device.ProcDevice.DeviceID(),
+		InodeID:   device.ProcDevice.NextIno(),
+		BlockSize: usermem.PageSize,
+		Type:      fs.SpecialFile,
+	}
+	return fs.NewInode(ctx, ipf, msrc, sattr)
+}
+
+// Truncate implements fs.InodeOperations.Truncate. Truncate is called when
+// O_TRUNC is specified for any kind of existing Dirent but is not called via
+// (f)truncate for proc files.
+func (*portRangeInode) Truncate(context.Context, *fs.Inode, int64) error {
+	return nil
+}
+
+// +stateify savable
+type portRangeFile struct {
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+
+	inode *portRangeInode
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (in *portRangeInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	flags.Pwrite = true
+	return fs.NewFile(ctx, dirent, flags, &portRangeFile{
+		inode: in,
+	}), nil
+}
+
+// Read implements fs.FileOperations.Read.
+func (pf *portRangeFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	if offset != 0 {
+		return 0, io.EOF
+	}
+
+	if pf.inode.start == nil {
+		start, end := pf.inode.stack.PortRange()
+		pf.inode.start = &start
+		pf.inode.end = &end
+	}
+
+	contents := fmt.Sprintf("%d %d\n", *pf.inode.start, *pf.inode.end)
+	n, err := dst.CopyOut(ctx, []byte(contents))
+	return int64(n), err
+}
+
+// Write implements fs.FileOperations.Write.
+//
+// Offset is ignored, multiple writes are not supported.
+func (pf *portRangeFile) Write(ctx context.Context, _ *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
+	if src.NumBytes() == 0 {
+		return 0, nil
+	}
+
+	// Only consider size of one memory page for input for performance
+	// reasons.
+	src = src.TakeFirst(usermem.PageSize - 1)
+
+	ports := make([]int32, 2)
+	n, err := usermem.CopyInt32StringsInVec(ctx, src.IO, src.Addrs, ports, src.Opts)
+	if err != nil {
+		return 0, err
+	}
+
+	// Port numbers must be uint16s.
+	if ports[0] < 0 || ports[1] < 0 || ports[0] > math.MaxUint16 || ports[1] > math.MaxUint16 {
+		return 0, syserror.EINVAL
+	}
+
+	if err := pf.inode.stack.SetPortRange(uint16(ports[0]), uint16(ports[1])); err != nil {
+		return 0, err
+	}
+	if pf.inode.start == nil {
+		pf.inode.start = new(uint16)
+		pf.inode.end = new(uint16)
+	}
+	*pf.inode.start = uint16(ports[0])
+	*pf.inode.end = uint16(ports[1])
+	return n, nil
+}
+
 func (p *proc) newSysNetIPv4Dir(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *fs.Inode {
 	contents := map[string]*fs.Inode{
 		// Add tcp_sack.
@@ -506,12 +622,15 @@ func (p *proc) newSysNetIPv4Dir(ctx context.Context, msrc *fs.MountSource, s ine
 		// Add ip_forward.
 		"ip_forward": newIPForwardingInode(ctx, msrc, s),
 
+		// Allow for configurable ephemeral port ranges. Note that this
+		// controls ports for both IPv4 and IPv6 sockets.
+		"ip_local_port_range": newPortRangeInode(ctx, msrc, s),
+
 		// The following files are simple stubs until they are
 		// implemented in netstack, most of these files are
 		// configuration related. We use the value closest to the
 		// actual netstack behavior or any empty file, all of these
 		// files will have mode 0444 (read-only for all users).
-		"ip_local_port_range":     newStaticProcInode(ctx, msrc, []byte("16000   65535")),
 		"ip_local_reserved_ports": newStaticProcInode(ctx, msrc, []byte("")),
 		"ipfrag_time":             newStaticProcInode(ctx, msrc, []byte("30")),
 		"ip_nonlocal_bind":        newStaticProcInode(ctx, msrc, []byte("0")),
diff --git a/pkg/sentry/fsimpl/proc/proc_state_autogen.go b/pkg/sentry/fsimpl/proc/proc_state_autogen.go
index 6b511ab7d..e1714d1a3 100644
--- a/pkg/sentry/fsimpl/proc/proc_state_autogen.go
+++ b/pkg/sentry/fsimpl/proc/proc_state_autogen.go
@@ -1994,6 +1994,38 @@ func (ipf *ipForwarding) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(2, &ipf.enabled)
 }
 
+func (pr *portRange) StateTypeName() string {
+	return "pkg/sentry/fsimpl/proc.portRange"
+}
+
+func (pr *portRange) StateFields() []string {
+	return []string{
+		"DynamicBytesFile",
+		"stack",
+		"start",
+		"end",
+	}
+}
+
+func (pr *portRange) beforeSave() {}
+
+func (pr *portRange) StateSave(stateSinkObject state.Sink) {
+	pr.beforeSave()
+	stateSinkObject.Save(0, &pr.DynamicBytesFile)
+	stateSinkObject.Save(1, &pr.stack)
+	stateSinkObject.Save(2, &pr.start)
+	stateSinkObject.Save(3, &pr.end)
+}
+
+func (pr *portRange) afterLoad() {}
+
+func (pr *portRange) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &pr.DynamicBytesFile)
+	stateSourceObject.LoadWait(1, &pr.stack)
+	stateSourceObject.Load(2, &pr.start)
+	stateSourceObject.Load(3, &pr.end)
+}
+
 func (s *yamaPtraceScope) StateTypeName() string {
 	return "pkg/sentry/fsimpl/proc.yamaPtraceScope"
 }
@@ -2090,5 +2122,6 @@ func init() {
 	state.Register((*tcpRecoveryData)(nil))
 	state.Register((*tcpMemData)(nil))
 	state.Register((*ipForwarding)(nil))
+	state.Register((*portRange)(nil))
 	state.Register((*yamaPtraceScope)(nil))
 }
diff --git a/pkg/sentry/fsimpl/proc/tasks_sys.go b/pkg/sentry/fsimpl/proc/tasks_sys.go
index fd7823daa..fb274b78e 100644
--- a/pkg/sentry/fsimpl/proc/tasks_sys.go
+++ b/pkg/sentry/fsimpl/proc/tasks_sys.go
@@ -17,6 +17,7 @@ package proc
 import (
 	"bytes"
 	"fmt"
+	"math"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
@@ -69,17 +70,17 @@ func (fs *filesystem) newSysNetDir(ctx context.Context, root *auth.Credentials,
 	if stack := k.RootNetworkNamespace().Stack(); stack != nil {
 		contents = map[string]kernfs.Inode{
 			"ipv4": fs.newStaticDir(ctx, root, map[string]kernfs.Inode{
-				"tcp_recovery": fs.newInode(ctx, root, 0644, &tcpRecoveryData{stack: stack}),
-				"tcp_rmem":     fs.newInode(ctx, root, 0644, &tcpMemData{stack: stack, dir: tcpRMem}),
-				"tcp_sack":     fs.newInode(ctx, root, 0644, &tcpSackData{stack: stack}),
-				"tcp_wmem":     fs.newInode(ctx, root, 0644, &tcpMemData{stack: stack, dir: tcpWMem}),
-				"ip_forward":   fs.newInode(ctx, root, 0444, &ipForwarding{stack: stack}),
+				"ip_forward":          fs.newInode(ctx, root, 0444, &ipForwarding{stack: stack}),
+				"ip_local_port_range": fs.newInode(ctx, root, 0644, &portRange{stack: stack}),
+				"tcp_recovery":        fs.newInode(ctx, root, 0644, &tcpRecoveryData{stack: stack}),
+				"tcp_rmem":            fs.newInode(ctx, root, 0644, &tcpMemData{stack: stack, dir: tcpRMem}),
+				"tcp_sack":            fs.newInode(ctx, root, 0644, &tcpSackData{stack: stack}),
+				"tcp_wmem":            fs.newInode(ctx, root, 0644, &tcpMemData{stack: stack, dir: tcpWMem}),
 
 				// The following files are simple stubs until they are implemented in
 				// netstack, most of these files are configuration related. We use the
 				// value closest to the actual netstack behavior or any empty file, all
 				// of these files will have mode 0444 (read-only for all users).
-				"ip_local_port_range":     fs.newInode(ctx, root, 0444, newStaticFile("16000   65535")),
 				"ip_local_reserved_ports": fs.newInode(ctx, root, 0444, newStaticFile("")),
 				"ipfrag_time":             fs.newInode(ctx, root, 0444, newStaticFile("30")),
 				"ip_nonlocal_bind":        fs.newInode(ctx, root, 0444, newStaticFile("0")),
@@ -421,3 +422,68 @@ func (ipf *ipForwarding) Write(ctx context.Context, src usermem.IOSequence, offs
 	}
 	return n, nil
 }
+
+// portRange implements vfs.WritableDynamicBytesSource for
+// /proc/sys/net/ipv4/ip_local_port_range.
+//
+// +stateify savable
+type portRange struct {
+	kernfs.DynamicBytesFile
+
+	stack inet.Stack `state:"wait"`
+
+	// start and end store the port range. We must save/restore this here,
+	// since a netstack instance is created on restore.
+	start *uint16
+	end   *uint16
+}
+
+var _ vfs.WritableDynamicBytesSource = (*portRange)(nil)
+
+// Generate implements vfs.DynamicBytesSource.Generate.
+func (pr *portRange) Generate(ctx context.Context, buf *bytes.Buffer) error {
+	if pr.start == nil {
+		start, end := pr.stack.PortRange()
+		pr.start = &start
+		pr.end = &end
+	}
+	_, err := fmt.Fprintf(buf, "%d %d\n", *pr.start, *pr.end)
+	return err
+}
+
+// Write implements vfs.WritableDynamicBytesSource.Write.
+func (pr *portRange) Write(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
+	if offset != 0 {
+		// No need to handle partial writes thus far.
+		return 0, syserror.EINVAL
+	}
+	if src.NumBytes() == 0 {
+		return 0, nil
+	}
+
+	// Limit input size so as not to impact performance if input size is
+	// large.
+	src = src.TakeFirst(usermem.PageSize - 1)
+
+	ports := make([]int32, 2)
+	n, err := usermem.CopyInt32StringsInVec(ctx, src.IO, src.Addrs, ports, src.Opts)
+	if err != nil {
+		return 0, err
+	}
+
+	// Port numbers must be uint16s.
+	if ports[0] < 0 || ports[1] < 0 || ports[0] > math.MaxUint16 || ports[1] > math.MaxUint16 {
+		return 0, syserror.EINVAL
+	}
+
+	if err := pr.stack.SetPortRange(uint16(ports[0]), uint16(ports[1])); err != nil {
+		return 0, err
+	}
+	if pr.start == nil {
+		pr.start = new(uint16)
+		pr.end = new(uint16)
+	}
+	*pr.start = uint16(ports[0])
+	*pr.end = uint16(ports[1])
+	return n, nil
+}
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index f31277d30..6b71bd3a9 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -93,6 +93,14 @@ type Stack interface {
 
 	// SetForwarding enables or disables packet forwarding between NICs.
 	SetForwarding(protocol tcpip.NetworkProtocolNumber, enable bool) error
+
+	// PortRange returns the UDP and TCP inclusive range of ephemeral ports
+	// used in both IPv4 and IPv6.
+	PortRange() (uint16, uint16)
+
+	// SetPortRange sets the UDP and TCP IPv4 and IPv6 ephemeral port range
+	// (inclusive).
+	SetPortRange(start uint16, end uint16) error
 }
 
 // Interface contains information about a network interface.
diff --git a/pkg/sentry/inet/test_stack.go b/pkg/sentry/inet/test_stack.go
index 9ebeba8a3..03e2608c2 100644
--- a/pkg/sentry/inet/test_stack.go
+++ b/pkg/sentry/inet/test_stack.go
@@ -164,3 +164,15 @@ func (s *TestStack) SetForwarding(protocol tcpip.NetworkProtocolNumber, enable b
 	s.IPForwarding = enable
 	return nil
 }
+
+// PortRange implements inet.Stack.PortRange.
+func (*TestStack) PortRange() (uint16, uint16) {
+	// Use the default Linux values per net/ipv4/af_inet.c:inet_init_net().
+	return 32768, 28232
+}
+
+// SetPortRange implements inet.Stack.SetPortRange.
+func (*TestStack) SetPortRange(start uint16, end uint16) error {
+	// No-op.
+	return nil
+}
diff --git a/pkg/sentry/socket/hostinet/stack.go b/pkg/sentry/socket/hostinet/stack.go
index e6323244c..5bcf92e14 100644
--- a/pkg/sentry/socket/hostinet/stack.go
+++ b/pkg/sentry/socket/hostinet/stack.go
@@ -504,3 +504,14 @@ func (s *Stack) Forwarding(protocol tcpip.NetworkProtocolNumber) bool {
 func (s *Stack) SetForwarding(tcpip.NetworkProtocolNumber, bool) error {
 	return syserror.EACCES
 }
+
+// PortRange implements inet.Stack.PortRange.
+func (*Stack) PortRange() (uint16, uint16) {
+	// Use the default Linux values per net/ipv4/af_inet.c:inet_init_net().
+	return 32768, 28232
+}
+
+// SetPortRange implements inet.Stack.SetPortRange.
+func (*Stack) SetPortRange(start uint16, end uint16) error {
+	return syserror.EACCES
+}
diff --git a/pkg/sentry/socket/netstack/stack.go b/pkg/sentry/socket/netstack/stack.go
index 71c3bc034..b215067cf 100644
--- a/pkg/sentry/socket/netstack/stack.go
+++ b/pkg/sentry/socket/netstack/stack.go
@@ -478,3 +478,13 @@ func (s *Stack) SetForwarding(protocol tcpip.NetworkProtocolNumber, enable bool)
 	}
 	return nil
 }
+
+// PortRange implements inet.Stack.PortRange.
+func (s *Stack) PortRange() (uint16, uint16) {
+	return s.Stack.PortRange()
+}
+
+// SetPortRange implements inet.Stack.SetPortRange.
+func (s *Stack) SetPortRange(start uint16, end uint16) error {
+	return syserr.TranslateNetstackError(s.Stack.SetPortRange(start, end)).ToError()
+}
diff --git a/pkg/syserr/netstack.go b/pkg/syserr/netstack.go
index 0b9139570..79e564de6 100644
--- a/pkg/syserr/netstack.go
+++ b/pkg/syserr/netstack.go
@@ -51,6 +51,7 @@ var (
 	ErrNotPermittedNet       = New((&tcpip.ErrNotPermitted{}).String(), linux.EPERM)
 	ErrBadBuffer             = New((&tcpip.ErrBadBuffer{}).String(), linux.EFAULT)
 	ErrMalformedHeader       = New((&tcpip.ErrMalformedHeader{}).String(), linux.EINVAL)
+	ErrInvalidPortRange      = New((&tcpip.ErrInvalidPortRange{}).String(), linux.EINVAL)
 )
 
 // TranslateNetstackError converts an error from the tcpip package to a sentry
@@ -135,6 +136,8 @@ func TranslateNetstackError(err tcpip.Error) *Error {
 		return ErrBadBuffer
 	case *tcpip.ErrMalformedHeader:
 		return ErrMalformedHeader
+	case *tcpip.ErrInvalidPortRange:
+		return ErrInvalidPortRange
 	default:
 		panic(fmt.Sprintf("unknown error %T", err))
 	}
diff --git a/pkg/tcpip/errors.go b/pkg/tcpip/errors.go
index 3b7cc52f3..5d478ac32 100644
--- a/pkg/tcpip/errors.go
+++ b/pkg/tcpip/errors.go
@@ -300,6 +300,19 @@ func (*ErrInvalidOptionValue) IgnoreStats() bool {
 }
 func (*ErrInvalidOptionValue) String() string { return "invalid option value specified" }
 
+// ErrInvalidPortRange indicates an attempt to set an invalid port range.
+//
+// +stateify savable
+type ErrInvalidPortRange struct{}
+
+func (*ErrInvalidPortRange) isError() {}
+
+// IgnoreStats implements Error.
+func (*ErrInvalidPortRange) IgnoreStats() bool {
+	return true
+}
+func (*ErrInvalidPortRange) String() string { return "invalid port range" }
+
 // ErrMalformedHeader indicates the operation encountered a malformed header.
 //
 // +stateify savable
diff --git a/pkg/tcpip/ports/ports.go b/pkg/tcpip/ports/ports.go
index 11dbdbbcf..101872b47 100644
--- a/pkg/tcpip/ports/ports.go
+++ b/pkg/tcpip/ports/ports.go
@@ -16,7 +16,6 @@
 package ports
 
 import (
-	"math"
 	"math/rand"
 	"sync/atomic"
 
@@ -24,16 +23,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
-const (
-	// FirstEphemeral is the first ephemeral port.
-	FirstEphemeral = 16000
-
-	// numEphemeralPorts it the mnumber of available ephemeral ports to
-	// Netstack.
-	numEphemeralPorts = math.MaxUint16 - FirstEphemeral + 1
-
-	anyIPAddress tcpip.Address = ""
-)
+const anyIPAddress tcpip.Address = ""
 
 type portDescriptor struct {
 	network   tcpip.NetworkProtocolNumber
@@ -83,9 +73,16 @@ func (f Flags) Effective() Flags {
 
 // PortManager manages allocating, reserving and releasing ports.
 type PortManager struct {
+	// mu protects allocatedPorts.
+	// LOCK ORDERING: mu > ephemeralMu.
 	mu             sync.RWMutex
 	allocatedPorts map[portDescriptor]bindAddresses
 
+	// ephemeralMu protects firstEphemeral and numEphemeral.
+	ephemeralMu    sync.RWMutex
+	firstEphemeral uint16
+	numEphemeral   uint16
+
 	// hint is used to pick ports ephemeral ports in a stable order for
 	// a given port offset.
 	//
@@ -322,7 +319,13 @@ func (b bindAddresses) isAvailable(addr tcpip.Address, flags Flags, bindToDevice
 
 // NewPortManager creates new PortManager.
 func NewPortManager() *PortManager {
-	return &PortManager{allocatedPorts: make(map[portDescriptor]bindAddresses)}
+	return &PortManager{
+		allocatedPorts: make(map[portDescriptor]bindAddresses),
+		// Match Linux's default ephemeral range. See:
+		// https://github.com/torvalds/linux/blob/e54937963fa249595824439dc839c948188dea83/net/ipv4/af_inet.c#L1842
+		firstEphemeral: 32768,
+		numEphemeral:   28232,
+	}
 }
 
 // PickEphemeralPort randomly chooses a starting point and iterates over all
@@ -330,13 +333,18 @@ func NewPortManager() *PortManager {
 // is suitable for its needs, and stopping when a port is found or an error
 // occurs.
 func (s *PortManager) PickEphemeralPort(testPort func(p uint16) (bool, tcpip.Error)) (port uint16, err tcpip.Error) {
-	offset := uint32(rand.Int31n(numEphemeralPorts))
-	return s.pickEphemeralPort(offset, numEphemeralPorts, testPort)
+	s.ephemeralMu.RLock()
+	firstEphemeral := s.firstEphemeral
+	numEphemeral := s.numEphemeral
+	s.ephemeralMu.RUnlock()
+
+	offset := uint16(rand.Int31n(int32(numEphemeral)))
+	return pickEphemeralPort(offset, firstEphemeral, numEphemeral, testPort)
 }
 
 // portHint atomically reads and returns the s.hint value.
-func (s *PortManager) portHint() uint32 {
-	return atomic.LoadUint32(&s.hint)
+func (s *PortManager) portHint() uint16 {
+	return uint16(atomic.LoadUint32(&s.hint))
 }
 
 // incPortHint atomically increments s.hint by 1.
@@ -348,8 +356,13 @@ func (s *PortManager) incPortHint() {
 // iterates over all ephemeral ports, allowing the caller to decide whether a
 // given port is suitable for its needs and stopping when a port is found or an
 // error occurs.
-func (s *PortManager) PickEphemeralPortStable(offset uint32, testPort func(p uint16) (bool, tcpip.Error)) (port uint16, err tcpip.Error) {
-	p, err := s.pickEphemeralPort(s.portHint()+offset, numEphemeralPorts, testPort)
+func (s *PortManager) PickEphemeralPortStable(offset uint16, testPort func(p uint16) (bool, tcpip.Error)) (port uint16, err tcpip.Error) {
+	s.ephemeralMu.RLock()
+	firstEphemeral := s.firstEphemeral
+	numEphemeral := s.numEphemeral
+	s.ephemeralMu.RUnlock()
+
+	p, err := pickEphemeralPort(s.portHint()+offset, firstEphemeral, numEphemeral, testPort)
 	if err == nil {
 		s.incPortHint()
 	}
@@ -361,9 +374,9 @@ func (s *PortManager) PickEphemeralPortStable(offset uint32, testPort func(p uin
 // and iterates over the number of ports specified by count and allows the
 // caller to decide whether a given port is suitable for its needs, and stopping
 // when a port is found or an error occurs.
-func (s *PortManager) pickEphemeralPort(offset, count uint32, testPort func(p uint16) (bool, tcpip.Error)) (port uint16, err tcpip.Error) {
-	for i := uint32(0); i < count; i++ {
-		port = uint16(FirstEphemeral + (offset+i)%count)
+func pickEphemeralPort(offset, first, count uint16, testPort func(p uint16) (bool, tcpip.Error)) (port uint16, err tcpip.Error) {
+	for i := uint16(0); i < count; i++ {
+		port = first + (offset+i)%count
 		ok, err := testPort(port)
 		if err != nil {
 			return 0, err
@@ -567,3 +580,24 @@ func (s *PortManager) releasePortLocked(networks []tcpip.NetworkProtocolNumber,
 		}
 	}
 }
+
+// PortRange returns the UDP and TCP inclusive range of ephemeral ports used in
+// both IPv4 and IPv6.
+func (s *PortManager) PortRange() (uint16, uint16) {
+	s.ephemeralMu.RLock()
+	defer s.ephemeralMu.RUnlock()
+	return s.firstEphemeral, s.firstEphemeral + s.numEphemeral - 1
+}
+
+// SetPortRange sets the UDP and TCP IPv4 and IPv6 ephemeral port range
+// (inclusive).
+func (s *PortManager) SetPortRange(start uint16, end uint16) tcpip.Error {
+	if start > end {
+		return &tcpip.ErrInvalidPortRange{}
+	}
+	s.ephemeralMu.Lock()
+	defer s.ephemeralMu.Unlock()
+	s.firstEphemeral = start
+	s.numEphemeral = end - start + 1
+	return nil
+}
diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go
index de94ddfda..53370c354 100644
--- a/pkg/tcpip/stack/stack.go
+++ b/pkg/tcpip/stack/stack.go
@@ -813,6 +813,18 @@ func (s *Stack) Forwarding(protocolNum tcpip.NetworkProtocolNumber) bool {
 	return forwardingProtocol.Forwarding()
 }
 
+// PortRange returns the UDP and TCP inclusive range of ephemeral ports used in
+// both IPv4 and IPv6.
+func (s *Stack) PortRange() (uint16, uint16) {
+	return s.PortManager.PortRange()
+}
+
+// SetPortRange sets the UDP and TCP IPv4 and IPv6 ephemeral port range
+// (inclusive).
+func (s *Stack) SetPortRange(start uint16, end uint16) tcpip.Error {
+	return s.PortManager.SetPortRange(start, end)
+}
+
 // SetRouteTable assigns the route table to be used by this stack. It
 // specifies which NIC to use for given destination address ranges.
 //
diff --git a/pkg/tcpip/tcpip_state_autogen.go b/pkg/tcpip/tcpip_state_autogen.go
index e628e662d..743e1b598 100644
--- a/pkg/tcpip/tcpip_state_autogen.go
+++ b/pkg/tcpip/tcpip_state_autogen.go
@@ -386,6 +386,25 @@ func (e *ErrInvalidOptionValue) afterLoad() {}
 func (e *ErrInvalidOptionValue) StateLoad(stateSourceObject state.Source) {
 }
 
+func (e *ErrInvalidPortRange) StateTypeName() string {
+	return "pkg/tcpip.ErrInvalidPortRange"
+}
+
+func (e *ErrInvalidPortRange) StateFields() []string {
+	return []string{}
+}
+
+func (e *ErrInvalidPortRange) beforeSave() {}
+
+func (e *ErrInvalidPortRange) StateSave(stateSinkObject state.Sink) {
+	e.beforeSave()
+}
+
+func (e *ErrInvalidPortRange) afterLoad() {}
+
+func (e *ErrInvalidPortRange) StateLoad(stateSourceObject state.Source) {
+}
+
 func (e *ErrMalformedHeader) StateTypeName() string {
 	return "pkg/tcpip.ErrMalformedHeader"
 }
@@ -1120,6 +1139,7 @@ func init() {
 	state.Register((*ErrDuplicateNICID)(nil))
 	state.Register((*ErrInvalidEndpointState)(nil))
 	state.Register((*ErrInvalidOptionValue)(nil))
+	state.Register((*ErrInvalidPortRange)(nil))
 	state.Register((*ErrMalformedHeader)(nil))
 	state.Register((*ErrMessageTooLong)(nil))
 	state.Register((*ErrNetworkUnreachable)(nil))
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index 687b9f459..4836f8adc 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -2220,7 +2220,7 @@ func (e *endpoint) connect(addr tcpip.FullAddress, handshake bool, run bool) tcp
 		portBuf := make([]byte, 2)
 		binary.LittleEndian.PutUint16(portBuf, e.ID.RemotePort)
 		h.Write(portBuf)
-		portOffset := h.Sum32()
+		portOffset := uint16(h.Sum32())
 
 		var twReuse tcpip.TCPTimeWaitReuseOption
 		if err := e.stack.TransportProtocolOption(ProtocolNumber, &twReuse); err != nil {