socket-win: Bind the sockets exclusively

This prevents other processes from binding the same ports and
misusing the protocol/port-specific bypass rules installed in WFP to
bypass the VPN.

Fixes: 11e7d0677c ("socket-win: Install IKE bypass policies using bypass_socket()")

src/libcharon/plugins/socket_win/socket_win_socket.c

@@ -339,7 +339,7 @@ static SOCKET open_socket(private_socket_win_socket_t *this, int i)
 		.sin6_port = htons(this->ports[i]),
 	};
 	int addrlen = sizeof(addr);
-	BOOL off = FALSE;
+	BOOL off = FALSE, on = TRUE;
 	DWORD dwon = TRUE;
 	SOCKET s;
 
@@ -349,6 +349,16 @@ static SOCKET open_socket(private_socket_win_socket_t *this, int i)
 		DBG1(DBG_NET, "creating socket failed: %d", WSAGetLastError());
 		return INVALID_SOCKET;
 	}
+	/* prevent other local processes from sharing the bound port and misusing
+	 * the bypass rules */
+	if (setsockopt(s, SOL_SOCKET, SO_EXCLUSIVEADDRUSE,
+				   (const char*)&on, sizeof(on)) == SOCKET_ERROR)
+	{
+		DBG1(DBG_NET, "unable to set SO_EXCLUSIVEADDRUSE: %d",
+			 WSAGetLastError());
+		closesocket(s);
+		return INVALID_SOCKET;
+	}
 	/* enable IPv4 on IPv6 socket */
 	if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
 				   (const char*)&off, sizeof(off)) == SOCKET_ERROR)