Fix GH-13025: sapi/cli Windows using SO_EXCLUSIVEADDRUSE flag.

[devnexen]

With this, connections attempts when ip address and port already bound prior will be refused, thus the behaviod will be closer to unixes ; only little difference tough once the server shutdown the said binding might still be made unavailable for future connections for a little undetermined time.

[devnexen]

I put it on 8.1 because malicious code can use this "ability" to interfere, even tough this sapi cli is "just" a server for dev, it does not kill. But if refused I ll apply the patch from 8.2 no pb.

[nielsdos]

I put it on 8.1 because malicious code can use this "ability" to interfere, even tough this sapi cli is "just" a server for dev, it does not kill.

I don't think it fits in the attack model that is used for security issues.

Anyway, looks like SO_REUSEADDR is used on *nix:

php-src/sapi/cli/php_cli_server.c

Lines 1326 to 1331 in 2ab1c3d

	#ifdef SO_REUSEADDR
	{
	int val = 1;
	setsockopt(retval, SOL_SOCKET, SO_REUSEADDR, (char*)&val, sizeof(val));
	}
	#endif

That was introduced in the commit that introduced the CLI server: 5b921a8, RFC: https://wiki.php.net/rfc/builtinwebserver The RFC does not contain many details at all.

I didn't really dig into that much, but if I had to take a guess it may be because the CLI server allows multiple workers on *nix. On Windows, such a mode does not exist (yet). So perhaps the fact that addresses can be reused on Windows was an oversight. Although I'd be interested in the backstory

[mvorisek]

I am the issue reporter and I would like to get it closed.

Can someone review this PR?

[nielsdos]

I'll check this in the evening, but I would retarget to 8.3, probably a bit risky for 8.2 given we tag the last 8.2 bugfix release early next week

[nielsdos]

I pulled this and tested this on a Windows machine, and I was still able to start two CLI servers on the same IP+port combination