C and C++ Binaries

IO.SOCK.REUSE : Use of SO_REUSEADDR

Summary

The code sets the SO_REUSEADDR socket option, which can lead to multiple binds to the same port and thence to stolen or spoofed services.

Properties

Class Name Use of SO_REUSEADDR
Significance security
Mnemonic IO.SOCK.REUSE
Categories
CWE CWE:605 Multiple Binds to the Same Port
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Use of SO_REUSEADDR"

Example 

#include <sys/socket.h>
#include <netdb.h>
#include <unistd.h>

int reuseaddr_socket(char *hostname){
    int status;
    struct addrinfo *res;
    int socketfd;
    int optval=1;

    status = getaddrinfo(hostname,"80", NULL, &res);
    if (status)  return status ;

    socketfd = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
    freeaddrinfo(res);
    if (socketfd == -1)  return -1 ;

    status = setsockopt(socketfd,     /* 'Use of SO_REUSEADDR' warning issued here */
                        SOL_SOCKET,
                        SO_REUSEADDR,
                        &optval,
                        sizeof optval);
    if (status == -1) { close(socketfd); return -1; }

    /* ... remainder of function */
    close(socketfd);
    return 1;
}

Triggers

CodeSonar ships with library models that allow it to recognize functions such as libc setsockopt() that can enable SO_REUSEADDR. If one of these functions is called with arguments that enable SO_REUSEADDR, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Use of SO_REUSEADDR warnings.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.