SSLServerSocket that only accepts client connections from localhost

Question

My end goal is to create an SSLServerSocket that will only accept client connections requested by localhost.
I've tried creating a new SocketPermission:
p1 = new SocketPermission("localhost:1024-65535", "listen,connect,accept")I am able to add it to a custom Policy's PermissionCollection, but it doesn't seem to work. I believe SecurityManager.checkAccept() only checks the host's name and not the client's...
This following code works and illustrates what I'm trying to achieve, but I'd like it to happen before the socket is actually accepted:
SSLSocket socket = (SSLSocket)m_sslServerSocket.accept();
Strintg clientIP = socket.getSession().getPeerHost();
if( !clientIP.equals( "127.0.0.1" ) & !clientIP.equals( InetAddress.getLocalHost().getHostAddress() )
    // reject connection
}Any help is appreciated.
Edited by: misterE on Oct 24, 2007 10:46 PM

Answer 1

I'm not clear whether you are doing this Permission thing on the server side or the client side, and/or whether you have a SecurityManager installed.
If the server only has SocketPermission("localhost:...", "listen,connect,accept") it should only accept connections from localhost, not from B. So I don't know why the first scenario worked.
If the server only has this SocketPermission with some other hostname, it shouldn't be able to listen at any port. So I don't know why the first scenario worked.
Unless there is no security manager installed.
You can run it with -Djava.security.debug=access,failure to see what permission checks are being executed.
BTW because connections are accepted by the TCP stack before permission checking takes place, as described above, the client won't get a ConnectionException if the permission is refused at the server: it will get most probably a SocketConnection: connection reset by peer when writing to the server.