Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Usage of SO_REUSEADDR is confusing on Windows and might pose a security issue #218

Open
simendsjo opened this issue Sep 20, 2023 · 0 comments

Comments

@simendsjo
Copy link

Hunchentoot calls socket-listen with :reuseaddress t (which is deprecated and :reuse-address should be used)

This behavior is confusing on Windows as it wont raise EADDRINUSE on listen when existing sockets exist on the same port. It will gladly bind the port, having two processes listening on the same port. Only the first socket will receive all data until it stops. But for the other socket, everything looks fine, it just doesn't receive any data.

Took me a while to find this out as it's different from other operating systems, and frankly a quite strange default as it looks like things are fine when in practice you won't get any data.

This could also bea security risk as someone can "steal" hunchentoot traffic by binding the same port and wait for an application restart. Or bind it before hunchentoot starts.

So maybe the default should change? Or at least make it configurable

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant