views:

488

answers:

5

Hi,

I have a Java server that opens up a socket using ServerSocket (using Thrift with it). This server has a client on the local machine in Obj-c that communicates with the Java server. Everything happens on localhost. Right now the java server is visible on the network as well, I would like the java server to only be accessible on localhost. Otherwise it is a potential security vulnerability and it freaks users out when their firewall warns them.

I tried creating the server socket using an InetSocketAddress('localhost', 9090) but that seems to have no effect. How can I limit this thing to localhost?

A: 

You can't have a "Unix domain socket"-like thing with Java because Java was designed to be cross-platform. However, that's the case without a third party library. I haven't dealt with it myself, but you can take a look at this project and see if it's what you need.

And of course, you'll be able to use it on *nix systems only.

Good luck!

shinkou
-1 - he doesn't want a "Unix domain socket". He wants a socket on the lookback interface; i.e. on 127.0.0.1.
Stephen C
Yes, but that's the only way which guarantees the server only accepts local connections. i.e. "localhost" could be mapped to something else, depending on the network settings, although it is not very likely to be the case.
shinkou
+4  A: 

Try

new ServerSocket(9090, 0, InetAddress.getByName("localhost"))

The last parameter to the constructor specifies which address to bind the listening socket to.

Geoff Reedy
+1 - but bear in mind that some machines don't understand "localhost". So using the IP address 127.0.0.1 is probably more robust.
Stephen C
Is that really how that constructor works? I had posted that suggestion, but after rereading the description, thought that it sounds like that constructor just chooses only one network connection to accept connections on, instead of all of them (if the system has more than one network device).
Kaleb Brasee
@Stephen that could cause problems in the future with a host that is primarily IPv6 or even IPv6 only.
Geoff Reedy
@Kaleb yeah, in principle the localhost address is considered to be a separate network device, usually referred to as the loopback device.
Geoff Reedy
@Geoff - so either you are screwed because some (real windows) machine does not have a "localhost" entry, or because some (hypothetical) machine is does not support IPv4.
Stephen C
-1 for believing "localhost" is always mapped to the local machine.
shinkou
+1  A: 

Check this other question and the given answers: How to determine an incoming connection is from local machine

Abel Morelos
+1  A: 

new ServerSocket(9090, 0, InetAddress.getByName("127.0.0.1"));

EJP
A: 

Taken from another question:

new ServerSocket(9090, 0, InetAddress.getByName(null));

InetAddress.getByName(null) points to the loopback address (127.0.0.1)

And here's the Javadoc where it says that

Matías