inpcb: treat the ephemeral port range as inclusive

[nprice]

Summary

in_pcb_lport_dest() sized [first, last] as last - first, so the random
start never picked last and the search tried one port too few. With
first == last the random start divided by zero: once root sets the
range, any user's connect() panics the host. The sysctls are per-VNET,
so root in a vnet jail can do it.

[glebius]

IMHO, it would be better to cover invalid sysctl setting in sysctl_net_ipport_check().

AFAIU, the arc4random_uniform() could be more expensive than regular one. Given that we have very little space for a quality randomness here anyway, I don't think it is worth to spend extra CPU cycles on connect().

[glebius]

AFAIK, the random port allocation can't be really considered a security feature against connection forging these days. An attacker can just inject 50k packets in a millisecond. However, the random port allocation is still useful to avoid revealing information on how many connections a host makes. For the latter purpose a cheaper random is fine.