On 9/15/19 9:55 AM, Richard W.M. Jones wrote: > Works essentially just like calling getpeername(2), because that's how > it is implemented. > --- > TODO | 6 ++++++ > docs/nbdkit-plugin.pod | 23 +++++++++++++++++++++++ > include/nbdkit-common.h | 2 ++ > server/nbdkit.syms | 1 + > server/public.c | 21 +++++++++++++++++++++ > 5 files changed, 53 insertions(+) > > diff --git a/TODO b/TODO > index 04def3c..d2cf0ae 100644 > --- a/TODO > +++ b/TODO > @@ -77,6 +77,12 @@ General ideas for improvements > name(s) that a plugin might want to support. Probably we should > deprecate the -e option entirely since it does nothing useful. > > +* Add plugin "connect" method. This would be called on a connection > + before handshaking or TLS negotiation, and could be used (with > + nbdkit_peer_name) to accept or reject connections based on IP > + address, rather like a poor man's TCP wrappers. See also commit > + c05686f9577f.
Yes, you now have more justification for why a .connect would be a
useful callback (and we would document that the plugin is responsible
for NOT sticking a lot of code into .connect, so that it does not become
an amplification attack).
> +int
> +nbdkit_peer_name (struct sockaddr *addr, socklen_t *addrlen)
> +{
> + struct connection *conn = threadlocal_get_conn ();
> + int s;
> +
> + if (!conn) {
> + nbdkit_error ("no connection in this thread");
> + return -1;
> + }
> +
> + s = conn->sockin;
> + if (s == -1) {
> + nbdkit_error ("socket not open");
> + return -1;
> + }
> +
> + return getpeername (s, addr, addrlen);
You need to call nbdkit_error() if getpeername() returns -1
Otherwise, looks reasonable.
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Libguestfs mailing list [email protected] https://www.redhat.com/mailman/listinfo/libguestfs
