[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Handle-info] Option to configure bind address for outgoing connections?

I implemented the preload option as described in the link from stackoverflow you suggested.

 

Some notes for others who might want to use this:

After server management installed /usr/local/lib64/bind.so, I am now starting the Handle server with

 

BIND_ADDR="xxx.xxx.xxx.xxx" LD_PRELOAD=/usr/local/lib64/bind.so /path/to/handle/handle-9.3.0/bin/hdl-server /path/to/server/config

(where xxx.xxx.xxx.xxx is the IP address I needed to use for outgoing connections)

 

Because this does not work for IPv6 and not for UDP, I changed the following:

 

In config.dct in the server configuration directory: added

"no_udp_resolution" = "yes"

 

In handle-9.3.0/bin/hdl: added

-Djava.net.preferIPv4Stack=true

to the server startup command (line 42) to prevent java from using IPv4 mapped IPv6 addresses.

 

In order to not be dependent on either making changes to the networking stack or using this bind.so trick, it think it would be nice if there would be an option to configure the IP address of outgoing connections in config.dct in some future version of the Handle server, maybe use the addresses that are configured with bind_address in config.dct as default?

With restrictions on outgoing traffic becoming more common due to tightening security policies I think this might get useful for others too.

 

Thanks,

Jasper

 

 

 

 

From: Robert Tupelo-Schneck <schneck@cnri.reston.va.us>
Sent: Tuesday, October 4, 2022 23:18
To: Jasper Bedaux <J.Bedaux@uva.nl>
Cc: handle-info@cnri.reston.va.us
Subject: Re: [Handle-info] Option to configure bind address for outgoing connections?

 

Unfortunately, there is no existing handle software configuration to set the local IP address used for outgoing connections.

 

You can change the configuration of your OS / network stack in order to make .61 the default choice for outgoing connections instead of .58.

 

I came across this technique which might possibly be useful to you:  https://stackoverflow.com/questions/33961459/java-set-local-ip-address-without-changing-code

You could also use the techniques in Chapter 10 of http://www.handle.net/tech_manual/HN_Tech_Manual_9.pdf to make it so that you do not need your handle server to make outgoing calls in order to administer your handle server.

 

Best,

Robert

 

 

On Fri, Sep 30, 2022 at 3:36 AM Jasper Bedaux <J.Bedaux@uva.nl> wrote:

Hello all,

 

In consultation with our security/network/server management departments, we have a separate IP address for a Handle server (ending with .61). The main IP address of this server ends with .58.

 

Incoming and outgoing traffic is allowed for ports 2641 and 8000 for the IP address ending with .61, but not for the IP address ending with .58. For incoming connections, this is working fine but for outgoing connections, the Handle server tries to initiate connections on the IP address ending with .58, which is not allowed in our network.

 

Is it possible to configure the Handle server to bind to a certain IP address for OUTGOING connections like this is possible for incoming connections by using "bind_address" in the config.dct?

 

ss -a | grep hdl-srv

udp   UNCONN     0      0    [::ffff:***.***.***.61]:hdl-srv    *:*

tcp   LISTEN     0      50   [::ffff:***.***.***.61]:hdl-srv    *:*

tcp   CLOSE-WAIT 1      0    [::ffff:***.***.***.61]:hdl-srv    [::ffff:52.32.51.238]:37770              

tcp   SYN-SENT   0      1    [::ffff:***.***.***.58]:54304      [::ffff:212.193.120.1]:hdl-srv

 

In the last line it can be seen the IP address ending with .58 is used for an outgoing connection instead of the desired IP address ending with .61, resulting in our Handle server not being able to setup outgoing connections.

 

Thanks,

Jasper

_______________________________________________
Handle-Info mailing list
Handle-Info@cnri.reston.va.us
http://www.handle.net/mailman/listinfo/handle-info

_______________________________________________
Handle-Info mailing list
Handle-Info@cnri.reston.va.us
http://www.handle.net/mailman/listinfo/handle-info