#36305 net: Use exclusive P2P listen sockets on Windows

ReviewabilityReviewsAgreementSize
#36305 winterrdog net: Use exclusive P2P listen sockets on WindowsReady2Strong12 + 19 tests
  • Prevent local processes on Windows from hijacking or intercepting incoming P2P connections
  • Ensure bitcoind exclusively binds its P2P listen port and fails startup if the port is already in use
  • Ready to review
  • No open blockers or pending author updates
  • Strong support with all requested adjustments addressed
  • Verified by running functional tests on Windows (hodlinator)
  • Suggested handling socket option errors as fatal and adding conflict tests, which were applied (hodlinator)
  • Concept approval and suggestion on commit ordering (hebasto)
  • Approval without stated reasons (jpk68)
  • 12 lines added or modified outside tests
  • 19 lines added or modified in tests
  • 0 lines removed in total
  • 2 files, 2 commits
P2P#22 of 71
P2 · platform fix
  • P2 because it prevents local connection hijacking on Windows nodes
  • Stops other processes under the same user account from binding the P2P listen port
  • Ranking pass: Supported-platform hijacking risk kept adjacent to the other security fixes in the band.
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Sets SO_EXCLUSIVEADDRUSE instead of SO_REUSEADDR on P2P listen sockets on Windows, preventing other local sockets from binding to the same port. Fails socket binding if setting the exclusive address option fails, and adds functional tests covering both binding conflict orderings.

Problem: On Windows, SO_REUSEADDR semantics allow another process running under the same user account to bind to an in-use port if it also sets SO_REUSEADDR. This permits a local process to intercept incoming P2P connections intended for bitcoind.

Evidence of importance:

  • PR description cites Microsoft Winsock documentation: on Windows, SO_REUSEADDR permits a second socket to bind a port already in use by another process under the same user account unless SO_EXCLUSIVEADDRUSE is set.
  • Follows merged PR #36169, which applied the same SO_EXCLUSIVEADDRUSE fix to the RPC/HTTP listener on Windows.

Risk of a mistake: medium (p2p). If SO_EXCLUSIVEADDRUSE fails or behaves unexpectedly on certain Windows configurations, bitcoind will fail to bind the P2P socket and refuse to start.

Changed since the previous assessment: Added a functional test checking the reverse ordering: verifying that bitcoind fails during startup if another process is already bound to its P2P listen port.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • reviewer: hebasto to verify the commit swap 2026-10-27

Agreement

Strong

substantive support, no open objection (hodlinator)

Thread notes: hebasto suggested swapping commit order to keep Windows tests passing per-commit, which the author implemented and hodlinator re-ACKed; commit ordering preferences are not tracked as claims. jpk68 updated their bare ACK to the latest commit hash.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
hodlinator (member)suggestion, safetytreat failure when setting SO_EXCLUSIVEADDRUSE as a fatal error, matching httpserver.cppaccepted · fix pushed · author implemented the error handling and reviewer acceptedansweredyes2026-10-23: 'Not sure why setting the option would fail, but I think we should treat it as a fatal error, same as in httpserver.cpp.'
Status from: 2026-10-26: hodlinator: 'Thanks for taking my suggestions!'
hodlinator (member)suggestion, approachadd a test for when the socket is bound before bitcoind runsaccepted · fix pushed · author added the test and reviewer acceptedansweredyes2026-10-23: 'Could also add a test for when the socket is bound before bitcoind:'
Status from: 2026-10-26: hodlinator: 'Thanks for taking my suggestions!'

Support:

  • jpk68 (contributor) (ACK, 2026-10-20): (no reason given) [not substantive]
  • hodlinator (member) (Concept ACK, 2026-10-23): (no reason given) [not substantive]
  • hodlinator (member) (ACK, 2026-10-26) [tested]: Ran functional test on Windows. Thanks for taking my suggestions!
  • hebasto (member) (Concept ACK, 2026-10-26): (no reason given) [not substantive]
  • hodlinator (member) (ACK, 2026-10-27) [read]: agrees it is more correct to swap the commit order [not substantive]

Participants:

  • jpk68 (contributor, support, 1 statements 2026-10-20 to 2026-10-20): ACKed the latest commit
  • hodlinator (member, support, 5 statements 2026-10-23 to 2026-10-27): tested ACK, suggested fatal error handling and test case, re-ACKed after commit swap
  • hebasto (member, support, 2 statements 2026-10-26 to 2026-10-27): Concept ACK; suggested swapping commit order to avoid test failure on Windows

Files

19 lines under test/bench/ci.

  • test/functional/feature_port.py +19/-0
  • src/net.cpp +12/-0

Card

The short text the ranking pass compares across PRs.

Sets SO_EXCLUSIVEADDRUSE instead of SO_REUSEADDR on P2P listen sockets on Windows and adds functional tests for port exclusivity. On Windows, default SO_REUSEADDR semantics allow another process under the same user account to bind to an active port and intercept incoming P2P connections. This extends socket exclusivity protections previously merged for RPC listeners in PR #36169.

Data

dossier JSON · extract JSON · model ledger, generated 2026-10-28T01:22, confidence high, input hash 71c78b526f49ddcf
thread read through 2026-10-27 (12 statements), head db31a3ad1f
labels: Windows, P2P

Categories

P2P

P2 · platform fix (ranking pass: Supported-platform hijacking risk kept adjacent to the other security fixes in the band.)

Prevents local processes on Windows from hijacking or intercepting incoming P2P connections. Under Windows SO_REUSEADDR semantics, another process running under the same user could otherwise bind the same port without an error.

Membership: Labeled P2P and modifies listener socket options in src/net.cpp.

Factors: security/stability 2, bug 1, performance 0, user value 0, leverage 0