Security: SO_EXCLUSIVEADDRUSE should be enabled when binding to ports on Windows

New submission from davidsarah <None>:

This is necessary to prevent socket hijacking for servers on ports >= 1024. On Windows, a port that has a socket bound to it can by default be taken over by any other process (even one run by a different user account, such as a Guest account), if that process uses SO_REUSEADDR. On Unix this [http://www.opennet.ru/base/sun/1121013484_536.txt.html would be considered a security bug]. The SO_EXCLUSIVEADDRUSE option is required in order to get the default Unix behaviour of "first-come first-served" binding to ports. See [http://www.foundstone.com/us/resources/whitepapers/wp_socket_hijacking.pdf wp_socket_hijacking.pdf] (not readable in some PDF viewers), and [http://www.hsc.fr/ressources/articles/win_net_srv/socket_bind_hijack.html here] for more details. (The latter is slightly out of date si
 nce Windows does restrict binding to privileged ports since Windows XP SP2, but mostly still relevant.)

This affects the security of Tahoe-LAFS (http://allmydata.org/trac/tahoe/ticket/870) on Windows, and potentially any software using twisted on Windows to run a server on a non-privileged port.

There was some discussion of SO_EXCLUSIVEADDRUSE in bug #1151, but it wasn't the focus of the bug. #1151 was correctly closed as invalid because SO_REUSEADDR should ''not'' be used on Windows. The behaviour of Windows TCP when SO_EXCLUSIVEADDRUSE is set but SO_REUSEADDR isn't, is approximately the same as that of Unix TCP when SO_REUSEADDR is set (see the [http://msdn.microsoft.com/en-us/library/ms740621(VS.85).aspx MSDN documentation]).

SO_EXCLUSIVEADDRUSE was also mentioned by Trent.Nelson in bug #2981, as something that should be set on all connections, but twisted does not currently do so.

Note that before Windows 2000 SP4, Windows XP SP2 or Windows Server 2003, SO_EXCLUSIVEADDRUSE can only be used by processes running with administrator credentials. This bug is documented in the [http://support.microsoft.com/kb/870562 Microsoft knowledge base article #870562]. So if it is intended to still run on these versions of Windows, twisted should fall back to not using the option if the Winsock call fails.

----------
Type     : enhancement
Component: core
Keywords : security
Priority : normal
Nosy     : [email protected]
----------
http://twistedmatrix.com/trac/ticket/4195