bind_random_port ignores OS ephemeral port range

[dmz-uk]

This issue was first seen due to failed Puppet runs on a system with strict firewalling, as it uses this library. In bind_random_port, port = random(1024..65535) assumes that the ephemeral port range is 1024..65535. This is almost never the case. e.g. on a modern Linux Redhat-like system, the default range is (32768..60999) but of course can be modified by changing /proc/sys/net/ipv4/ip_local_port_range. This is not limited to being a firewall issue - modern services may bind to ports above 1024, which is especially problematic during eg a puppet run, where this random port selection may be holding open the required port during service configuration. Solution - instead of randomly choosing ports, port = 0 is defined as specifying an unused ephemeral port on at least Linux, FreeBSD, SunOS and Windows - udpsock.bind(bind_host, 0) is sufficient. There should be absolutely no need in the first place to specify a random port, or to keep trying ports until an unused one is discovered, which also does not scale particularly well on systems with heavy network usage.

[nobu]

It was to remediate CVE-2008-1447.
However, since RFC-6056 was published in 2011, it may be okay to simply use 0.