In order to play some tricks and send requests to myself
over external network interfaces, I need to enable the
SO_BINDTODEVICE socket option.

Here's the patch that I'm trying out. If there is a better patch format
or place to send this, please let me know.

Thanks,
Ben


From fe7226036848bd1f4f74dd8186a176b17f974614 Mon Sep 17 00:00:00 2001
From: Ben Greear <greearb@candelatech.com>
Date: Wed, 9 Jan 2013 15:01:35 -0800
Subject: [PATCH] Support bind_dev=[ifname] in accept configuration clause.

If this option is enabled, nginx will call SO_BINDTODEVICE
on the particular device name. This can be helpful for
some types of firewalling, and routing setups.

Signed-off-by: Ben Greear <greearb@candelatech.com>
---
src/core/ngx_connection.c | 21 +++++++++++++++++++++
src/core/ngx_connection.h | 1 +
src/http/ngx_http.c | 13 +++++++++++++
src/http/ngx_http_core_module.c | 6 ++++++
src/http/ngx_http_core_module.h | 1 +
5 files changed, 42 insertions(+)

diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c
index c818114..a3a8101 100644
--- a/src/core/ngx_connection.c
+++ b/src/core/ngx_connection.c
@@ -397,6 +397,27 @@ ngx_open_listening_sockets(ngx_cycle_t *cycle)
continue;
}

+ if (ls[i].dev_name[0]) {
+#ifdef SO_BINDTODEVICE
+ if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE,
+ ls[i].dev_name, strlen(ls[i].dev_name))) {
+ ngx_log_error(NGX_LOG_EMERG, log, errno, "setsockopt (%i, BINDTODEVICE, %s) failed",
+ s, ls[i].dev_name);
+ return NGX_ERROR;
+ }
+ else {
+ ngx_log_error(NGX_LOG_EMERG, log, 0, "setsockopt (%i, BINDTODEVICE, %s) succeeded!",
+ s, ls[i].dev_name);
+ }
+#else
+ ngx_log_error(NGX_LOG_EMERG, log, 0,
+ "setsockopt (%i, BINDTODEVICE, %s) not supported on this platform. Please remove the bind_dev= option for 'listen' directive.",
+ s, ls[i].dev_name);
+ return NGX_ERROR;
+#endif
+ }
+
+
#if (NGX_HAVE_UNIX_DOMAIN)

if (ls[i].sockaddr->sa_family == AF_UNIX) {
diff --git a/src/core/ngx_connection.h b/src/core/ngx_connection.h
index 87fd087..e5c030c 100644
--- a/src/core/ngx_connection.h
+++ b/src/core/ngx_connection.h
@@ -18,6 +18,7 @@ typedef struct ngx_listening_s ngx_listening_t;
struct ngx_listening_s {
ngx_socket_t fd;

+ char dev_name[32]; /* Use SO_BINDTODEVICE if this is not zero-length */
struct sockaddr *sockaddr;
socklen_t socklen; /* size of sockaddr */
size_t addr_text_max_len;
diff --git a/src/http/ngx_http.c b/src/http/ngx_http.c
index f1f8a48..9aa732b 100644
--- a/src/http/ngx_http.c
+++ b/src/http/ngx_http.c
@@ -1618,6 +1618,16 @@ ngx_http_cmp_conf_addrs(const void *one, const void *two)
return -1;
}

+ if (first->opt.dev_name[0] && !second->opt.dev_name[0]) {
+ /* shift explicit bind_dev()ed addresses to the start */
+ return -1;
+ }
+
+ if (!first->opt.dev_name[0] && second->opt.dev_name[0]) {
+ /* shift explicit bind_dev()ed addresses to the start */
+ return 1;
+ }
+
if (first->opt.bind && !second->opt.bind) {
/* shift explicit bind()ed addresses to the start */
return -1;
@@ -1768,6 +1778,9 @@ ngx_http_add_listening(ngx_conf_t *cf, ngx_http_conf_addr_t *addr)
ls->rcvbuf = addr->opt.rcvbuf;
ls->sndbuf = addr->opt.sndbuf;

+ strncpy(ls->dev_name, addr->opt.dev_name, sizeof(ls->dev_name));
+ ls->dev_name[sizeof(ls->dev_name) - 1] = 0;
+
ls->keepalive = addr->opt.so_keepalive;
#if (NGX_HAVE_KEEPALIVE_TUNABLE)
ls->keepidle = addr->opt.tcp_keepidle;
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 27f082e..664f9b7 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -3937,6 +3937,12 @@ ngx_http_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
continue;
}

+ if (ngx_strncmp(value[n].data, "bind_dev=", 9) == 0) {
+ strncpy(lsopt.dev_name, (char*)(value[n].data + 9), sizeof(lsopt.dev_name));
+ lsopt.dev_name[sizeof(lsopt.dev_name) - 1] = 0;
+ continue;
+ }
+
#if (NGX_HAVE_SETFIB)
if (ngx_strncmp(value[n].data, "setfib=", 7) == 0) {
lsopt.setfib = ngx_atoi(value[n].data + 7, value[n].len - 7);
diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h
index ff1c2df..8ac0a7a 100644
--- a/src/http/ngx_http_core_module.h
+++ b/src/http/ngx_http_core_module.h
@@ -67,6 +67,7 @@ typedef struct {
} u;

socklen_t socklen;
+ char dev_name[32]; /* for use with bind_dev */

unsigned set:1;
unsigned default_server:1;
--
1.7.11.7

--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel