From eb79c42b057c7cb2654d0a86213edb3494b8d4fb Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Mon, 20 Jul 2026 15:48:57 +0000
Subject: [PATCH] Bind to source with -e, not only -S. Fixes #2122

---
 nse_nsock.cc           | 15 ++++++---------
 scan_engine_connect.cc |  3 +--
 service_scan.cc        |  3 +--
 tcpip.cc               | 10 +---------
 4 files changed, 9 insertions(+), 22 deletions(-)

diff --git a/nse_nsock.cc b/nse_nsock.cc
index f1c3f5a07..2162f221d 100644
--- a/nse_nsock.cc
+++ b/nse_nsock.cc
@@ -417,15 +417,14 @@ static nse_nsock_udata *check_nsock_udata (lua_State *L, int idx, bool open)
        throw an error if that's not possible. */
     if (nu->proto == IPPROTO_UDP) {
       nsock_pool nsp;
+      struct sockaddr_storage ss;
+      size_t sslen;
 
       nsp = get_pool(L);
       nu->nsiod = nsock_iod_new(nsp, NULL);
       if (nu->source_addr.ss_family != AF_UNSPEC) {
         nsock_iod_set_localaddr(nu->nsiod, &nu->source_addr, nu->source_addrlen);
-      } else if (o.spoofsource) {
-        struct sockaddr_storage ss;
-        size_t sslen;
-        o.SourceSockAddr(&ss, &sslen);
+      } else if (0 == o.SourceSockAddr(&ss, &sslen)) {
         nsock_iod_set_localaddr(nu->nsiod, &ss, sslen);
       }
       if (o.ipoptionslen)
@@ -544,13 +543,11 @@ static int connect (lua_State *L, int status, lua_KContext ctx)
   if (nu->nsiod != NULL)
     close_internal(L, nu);
   nu->nsiod = nsock_iod_new(nsp, NULL);
+  struct sockaddr_storage ss;
+  size_t sslen;
   if (nu->source_addr.ss_family != AF_UNSPEC) {
     nsock_iod_set_localaddr(nu->nsiod, &nu->source_addr, nu->source_addrlen);
-  } else if (o.spoofsource) {
-    struct sockaddr_storage ss;
-    size_t sslen;
-
-    o.SourceSockAddr(&ss, &sslen);
+  } else if (0 == o.SourceSockAddr(&ss, &sslen)) {
     nsock_iod_set_localaddr(nu->nsiod, &ss, sslen);
   }
   if (o.ipoptionslen)
diff --git a/scan_engine_connect.cc b/scan_engine_connect.cc
index 16acc2f32..ace0b6d10 100644
--- a/scan_engine_connect.cc
+++ b/scan_engine_connect.cc
@@ -433,8 +433,7 @@ static void init_socket(int sd, const HostScanStats *hss, UltraScanInfo *USI) {
   }
 #endif
 
-  if (o.spoofsource && !bind_failed) {
-    o.SourceSockAddr(&ss, &sslen);
+  if (!bind_failed && 0 == o.SourceSockAddr(&ss, &sslen)) {
     if (::bind(sd, (struct sockaddr*)&ss, sslen) != 0) {
       error("%s: Problem binding source address (%s), errno: %d", __func__, inet_socktop_safe(&ss), socket_errno());
       perror("bind");
diff --git a/service_scan.cc b/service_scan.cc
index 92d1bd2ba..c5df713d9 100644
--- a/service_scan.cc
+++ b/service_scan.cc
@@ -2139,8 +2139,7 @@ static void startNextProbe(nsock_pool nsp, nsock_iod nsi, ServiceGroup *SG,
       if ((svc->niod = nsock_iod_new(nsp, svc)) == NULL) {
         fatal("Failed to allocate Nsock I/O descriptor in %s()", __func__);
       }
-      if (o.spoofsource) {
-        o.SourceSockAddr(&ss, &ss_len);
+      if (0 == svc->target->SourceSockAddr(&ss, &ss_len)) {
         nsock_iod_set_localaddr(svc->niod, &ss, ss_len);
       }
       if (o.ipoptionslen)
diff --git a/tcpip.cc b/tcpip.cc
index de17fcc7d..c38ed41c6 100644
--- a/tcpip.cc
+++ b/tcpip.cc
@@ -1566,15 +1566,7 @@ bool setTargetNextHopMAC(Target *target) {
 }
 
 int nmap_route_dst(const struct sockaddr_storage *dst, struct route_nfo *rnfo) {
-  struct sockaddr_storage spoofss;
-  size_t spoofsslen;
-
-  if (o.spoofsource) {
-    o.SourceSockAddr(&spoofss, &spoofsslen);
-    return route_dst(dst, rnfo, o.device, &spoofss);
-  } else {
-    return route_dst(dst, rnfo, o.device, NULL);
-  }
+  return route_dst(dst, rnfo, o.device, o.SourceSockAddr());
 }