将套接字绑定到特定接口

Question

I am trying to bind a socket to the specific (loopback) interface lo to prevent outside traffic from interfering with it:

int bind_socket(uint8_t *iface, uint8_t port) {
        int rv;
        struct sockaddr_in addr;
        rv = socket(AF_INET, SOCK_STREAM, 0);
        if (rv < 0) return -1;
        if (setsockopt(rv, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface)) < 0) {
                return -2;
        }
        bzero((char *) &addr, sizeof(addr));
        addr.sin_family = AF_INET;
        addr.sin_addr.s_addr = INADDR_ANY;
        addr.sin_port = htons(port);
        if (bind(rv, (struct sockaddr *) &addr, sizeof(addr)) < 0)
                return -3;
        return rv;
}

...

int ss;
ss = bind_socket("lo", 100);

However, if I run nmap localhost -e wlpXsX , I should not be getting output indicating the socket is available through that interface. It is instead being reported as available; and I can't seem to be able to deduce why. Why is this interface globally available with a program designed to make it unavailable to all other interfaces?

Answer 1

You wrote:

I am trying to bind a socket to the specific (loopback) interface

but you coded:

addr.sin_addr.s_addr = INADDR_ANY;

INADDR_ANY (0.0.0.0) is not the loopback interface. You need to change it to INADDR_LOOPBACK (127.0.0.1) instead:

addr.sin_addr.s_addr = htons(INADDR_LOOPBACK);

Answer 2

It seems nmap was ignoring the interface switch, and routing its probes through the loopback interface anyway. Passing my LAN address as the target instead of localhost , and my LAN interface as the interface argument to nmap produced the intended result of the socket being invisible to outside the local host with the following source code:

int bind_lo(int port) {
        int rv;
        const char iface[] = "lo";
        struct sockaddr_in addr;
        rv = socket(AF_INET, SOCK_STREAM, 0);
        if (rv < 0) return -1;
        bzero((char *) &addr, sizeof(addr));
        addr.sin_family = AF_INET;
        addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
        addr.sin_port = htons(port);
        if (bind(rv, (struct sockaddr *) &addr, sizeof(addr)) < 0)
                return -2;
        if (setsockopt(rv, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1) < 0) {
                return -3;
        }
        return rv;
}