Messages in this thread | | | Date | Tue, 18 Mar 2008 06:48:19 +0100 | From | Willy Tarreau <> | Subject | Re: SO_REUSEADDR not allowing server and client to use same port |
| |
On Mon, Mar 17, 2008 at 01:17:29PM -0500, Nebojsa Miljanovic wrote: > OK. I see. So, it would have to be some malicious application running together > with the server (i.e. on the same CPU). I do see now why you said it would be > very very hard to make this happen. > > Still, it would be nice to introduce SO_REUSEPORT socket options so secure > servers (who happen to be clients as well) can re-use ports when necessary. > > Another option would be to check if port re-use is happening inside same > application and allow it. That may make half of the folks happy, so I am not > sure if I like it as much as I like SO_REUSEPORT option.
It is most often useful for hot-restart without interrupting service. As an example, when I update a config in haproxy, I restart a new instance which does everything and binds to the ports, and then signals the old one it may go. That way, there is a complete continuity of service. This is possible by default on *BSD, and with a (very) little patch on linux.
And I agree with Alan about the security implications. If a service binds itself with SO_REUSEPORT, it definitely says "I agree to share my connection". So this is not to be used by default in any random application. But for servers, it's really useful.
Willy
| |