From 1be1c4a21bb54e60ec60456374d9ef55aaf55e2f Mon Sep 17 00:00:00 2001
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date: Tue, 10 Feb 2015 21:11:27 +0100
Subject: Force NX proxy to bind to loopback devices only (loopback option)
 (220_nxproxy_bind-loopback-only.full+lite.patch).

---
 nxcomp/Loop.cpp | 41 +++++++++++++++++++++++++++++++++++++----
 nxcomp/Misc.cpp | 10 ++++++++++
 nxcomp/Misc.h   |  8 ++++++++
 3 files changed, 55 insertions(+), 4 deletions(-)

(limited to 'nxcomp')

diff --git a/nxcomp/Loop.cpp b/nxcomp/Loop.cpp
index 05b514570..77b0c806c 100644
--- a/nxcomp/Loop.cpp
+++ b/nxcomp/Loop.cpp
@@ -952,6 +952,7 @@ static char listenHost[DEFAULT_STRING_LENGTH]  = { 0 };
 static char displayHost[DEFAULT_STRING_LENGTH] = { 0 };
 static char authCookie[DEFAULT_STRING_LENGTH]  = { 0 };
 
+static int loopbackBind = DEFAULT_LOOPBACK_BIND;
 static int proxyPort = DEFAULT_NX_PROXY_PORT;
 static int xPort     = DEFAULT_NX_X_PORT;
 
@@ -3959,7 +3960,14 @@ int SetupTcpSocket()
 
   tcpAddr.sin_family = AF_INET;
   tcpAddr.sin_port = htons(proxyPortTCP);
-  tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  if ( loopbackBind )
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  }
+  else
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  }
 
   if (bind(tcpFD, (sockaddr *) &tcpAddr, sizeof(tcpAddr)) == -1)
   {
@@ -4550,7 +4558,14 @@ int ListenConnection(int port, const char *label)
 
   tcpAddr.sin_family = AF_INET;
   tcpAddr.sin_port = htons(portTCP);
-  tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  if ( loopbackBind )
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  }
+  else
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  }
 
   if (bind(newFD, (sockaddr *) &tcpAddr, sizeof(tcpAddr)) == -1)
   {
@@ -6718,7 +6733,14 @@ int WaitForRemote(int portNum)
 
   #ifdef __APPLE__
 
-  tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  if ( loopbackBind )
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  }
+  else
+  {
+    tcpAddr.sin_addr.s_addr = htonl(INADDR_ANY);
+  }
 
   #else
 
@@ -8397,6 +8419,10 @@ int ParseEnvironmentOptions(const char *env, int force)
 
       listenPort = ValidateArg("local", name, value);
     }
+    else if (strcasecmp(name, "loopback") == 0)
+    {
+      loopbackBind = ValidateArg("local", name, value);
+    }
     else if (strcasecmp(name, "accept") == 0)
     {
       if (*connectHost != '\0')
@@ -13778,7 +13804,14 @@ int ParseListenOption(int &address)
     }
     else
     {
-      address = htonl(INADDR_ANY);
+      if ( loopbackBind )
+      {
+        address = htonl(INADDR_LOOPBACK);
+      }
+      else
+      {
+        address = htonl(INADDR_ANY);
+      }
     }
   }
   else
diff --git a/nxcomp/Misc.cpp b/nxcomp/Misc.cpp
index 7303c595b..0095eaa74 100644
--- a/nxcomp/Misc.cpp
+++ b/nxcomp/Misc.cpp
@@ -41,6 +41,14 @@
 #undef  TEST
 #undef  DEBUG
 
+//
+// By default nxproxy binds to all network interfaces, setting
+// DEFAULT_LOOPBACK_BIND to 1 enables binding to the loopback
+// device only.
+//
+
+const int DEFAULT_LOOPBACK_BIND = 0;
+
 //
 // TCP port offset applied to any NX port specification.
 //
@@ -136,6 +144,8 @@ static const char UsageInfo[] =
                to be forwarded by the proxy running on the client.\n\
 \n\
   listen=n     Local port used for accepting the proxy connection.\n\
+\n\
+  loopback=b   Bind to the loopback device only.\n\
 \n\
   accept=s     Name or IP of host that can connect to the proxy.\n\
 \n\
diff --git a/nxcomp/Misc.h b/nxcomp/Misc.h
index 3f37836f5..21a503082 100644
--- a/nxcomp/Misc.h
+++ b/nxcomp/Misc.h
@@ -89,6 +89,14 @@ extern const int DEFAULT_NX_FONT_PORT_OFFSET;
 extern const int DEFAULT_NX_SLAVE_PORT_CLIENT_OFFSET;
 extern const int DEFAULT_NX_SLAVE_PORT_SERVER_OFFSET;
 
+//
+// NX proxy binds to all network interfaces by default
+// With the -loopback parameter, you can switch
+// over to binding to the loopback device only.
+//
+
+extern const int DEFAULT_LOOPBACK_BIND;
+
 //
 // Return strings containing various info.
 //
-- 
cgit v1.2.3