Question

我有一个SocketServer接受传入连接。出于安全原因，我应该只允许本地连接（来自运行服务器的计算机的连接）。

如何确定传入连接是否来自其他计算机？以下代码是否安全？

Socket socket = someServerSocket.accept();
String remoteAddress = socket .getInetAddress().getHostAddress();
if (!fromThisMachine(remoteAddress)) {
    // Not from this machine.
}

虽然fromThisMachine()方法是这样的：

public boolean fromThisMachine(String remoteAddress) {
    try {
        Enumeration<NetworkInterface> interfaces = NetworkInterface.getNetworkInterfaces();
        while (interfaces.hasMoreElements()) {
            NetworkInterface networkInterface = interfaces.nextElement();
            Enumeration<InetAddress> addresses = networkInterface.getInetAddresses();
            while (addresses.hasMoreElements()) {
                InetAddress inetAddress = addresses.nextElement();
                String hostName = inetAddress.getHostName();
                String hostAddr = inetAddress.getHostAddress();
                if (hostName.equals(remoteAddress) || hostAddr.equals(remoteAddress)) {
                    return true;
                }
            }
        }
    } catch (Exception e) {
        e.printStackTrace();
        return false;
    }
    log("Unauthorized request to server from: " + remoteAddress);
    return false;
}

谢谢，穆赫辛

Answer 1

InetAddress.getByName（null）始终返回环回地址。请参阅javadoc

    int port = .....
    SocketAddress socketAddress =
        new InetSocketAddress( InetAddress.getByName( null ), port);
    ServerSocket serverSocket = new ServerSocket();
    serverSocket.bind(socketAddress);
    serverSocket.accept();

Answer 2

如果要限制来自localhost的连接，请在打开ServerSocket时指定。如果你只听localhost，那么你只能从localhost获得连接。

    int port = .....
    SocketAddress socketAddress = new InetSocketAddress("127.0.0.1", port);
    ServerSocket serverSocket = new ServerSocket();
    serverSocket.bind(socketAddress);
    serverSocket.accept();

Answer 3

谢谢skaffman。以下代码使用了一点操作（硬编码127.0.0.1）。

int port = .....
SocketAddress socketAddress = new InetSocketAddress("127.0.0.1", port);
ServerSocket serverSocket = new ServerSocket();
serverSocket.bind(socketAddress);
serverSocket.accept();

如果我从InetAddress.getLocalHost（）读取本地地址，则同一子网上的其他网络用户仍然可以看到我的服务器。

穆赫辛。

如何确定传入连接来自本地计算机

3 个答案: