From 47a583dfa235d14f19aa69467b2cf75ec602b161 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 6 Jul 2026 11:46:23 +0200 Subject: [PATCH] socket-win: Bind the sockets exclusively This prevents other processes from binding the same ports and misusing the protocol/port-specific bypass rules installed in WFP to bypass the VPN. Fixes: 11e7d0677c3e ("socket-win: Install IKE bypass policies using bypass_socket()") --- src/libcharon/plugins/socket_win/socket_win_socket.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/socket_win/socket_win_socket.c b/src/libcharon/plugins/socket_win/socket_win_socket.c index 9856d7f02..fa3688210 100644 --- a/src/libcharon/plugins/socket_win/socket_win_socket.c +++ b/src/libcharon/plugins/socket_win/socket_win_socket.c @@ -339,7 +339,7 @@ static SOCKET open_socket(private_socket_win_socket_t *this, int i) .sin6_port = htons(this->ports[i]), }; int addrlen = sizeof(addr); - BOOL off = FALSE; + BOOL off = FALSE, on = TRUE; DWORD dwon = TRUE; SOCKET s; @@ -349,6 +349,16 @@ static SOCKET open_socket(private_socket_win_socket_t *this, int i) DBG1(DBG_NET, "creating socket failed: %d", WSAGetLastError()); return INVALID_SOCKET; } + /* prevent other local processes from sharing the bound port and misusing + * the bypass rules */ + if (setsockopt(s, SOL_SOCKET, SO_EXCLUSIVEADDRUSE, + (const char*)&on, sizeof(on)) == SOCKET_ERROR) + { + DBG1(DBG_NET, "unable to set SO_EXCLUSIVEADDRUSE: %d", + WSAGetLastError()); + closesocket(s); + return INVALID_SOCKET; + } /* enable IPv4 on IPv6 socket */ if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&off, sizeof(off)) == SOCKET_ERROR)