Receive sockets from the local client on all interfaces; Remote client rejcct

Question

I need to write a small socket server proxy application that accepts connections from local applications on ALL interfaces (the socket must bind to 0.0.0.0).

I do not know how to do this (I have additional requirements that prevent binding to 127.0.0.1).

The first attempt is as follows:

bindings (0.0.0.0) ... s = accept () ... // reject the remote connection if (s.src_addr is not in local_interfaces) close () ... // continue normally with local conenction

This implementation has a side effect for remote applications - they see the accept / close combination. The system should behave so that the remote application perceives that "nothing exists": -> SYN <- RST / ACK

To implement this behavior, I used a combination of the winsock API from SO_CONDITIONAL_ACCEPT and the WSAAccept callback (LPCONDITIONPROC lpfnCondition) to accept / reject the connection based on its original interface (i.e. it is one of the local addresses or not).

This leads to the desired functional behavior: local applications work; remote applications receive the requested WSAECONNREFUSED error.

This is due to certain prices: SO_CONDITIONAL_ACCEPT has certain side effects (see MSDN), but more importantly, we need a LINUX implementation, and later it will have to port this to other UNIX.

- LINUX. , API , .

Answer 1

.

Answer 2

, , , . iptables . http://www.netfilter.org/ ( libnfnetlink, API , , -, ).

AF_UNIX?

Answer 3

- , , , , .

, , BSD.

Answer 4

Netfilters / iptables are already mentioned, so I don’t go into it - its the most convenient way to deal with it, but again, this is not part of “your program”, but a kernel function.

But there is a tcpwrappers tool that many system daemons also use — you know these hosts.allow and hosts.deny files in your / etc folder — they are part of tcpwrappers and can archive the exact script that you described.