[root@poisonivy ~]# ./client 192.168.147.132
getpeercon: Protocol not available Received: Hello, (null) from (null)
[root@scarecrow ~]# ./server
getsockopt: Protocol not available server: got connection from
192.168.147.130, (null)
getpeercon()返回协议不可用，因为在本次连接中没有标记被启用，你可以根据
错误信息来判断你是否使用了标记网络套接字。
如果我们在这两台机器之间不指定一个上下文而产生一个SA，我们将得到同样的结果：
[root@scarecrow ~]# cat dev/ipsec/setkey.scarecrow.test
spdflush;
flush;
spdadd 192.168.147.130 192.168.147.132 any
-P in ipsec esp/transport//require;
spdadd 192.168.147.132 192.168.147.130 any
-P out ipsec esp/transport//require;
[root@poisonivy ~]# cat dev/ipsec/setkey.poisonivy.test
spdflush;
flush;
spdadd 192.168.147.132 192.168.147.130 any
-P in ipsec esp/transport//require;
spdadd 192.168.147.130 192.168.147.132 any
-P out ipsec esp/transport//require;
值得特别感谢的是那些为这个技术努力工作的人们，将来他们会使网络架构更安全，这些人包括：James Morris, Venkat Yekkirala, Joy Latten, Paul Moore (实现了NetLabel)等
附录A：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 3490 // the port client will be connecting to
#define MAXDATASIZE 100 // max number of bytes we can get at once
int main(int argc, char *argv[])
{
int sockfd, numbytes;
char buf[MAXDATASIZE];
struct hostent *he;
struct sockaddr_in their_addr; // connector's address information
security_context_t con = NULL;
if (argc != 2) {
fprintf(stderr,"usage: client hostnamen");
exit(1);
}
if ((he=gethostbyname(argv[1])) == NULL) { // get the host info
herror("gethostbyname");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
their_addr.sin_family = AF_INET; // host byte order
their_addr.sin_port = htons(PORT); // short, network byte order
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(their_addr.sin_zero), '', 8); // zero the rest of the struct
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
perror("connect");
exit(1);
}
if ((numbytes=recv(sockfd, buf, MAXDATASIZE-1, 0)) == -1) {
perror("recv");
exit(1);
}
if (getpeercon(sockfd, &con)) {
perror("getpeercon");
}
buf[numbytes] = '';
printf("Received: %s from %sn",buf, con);
close(sockfd);
return 0;
}
附录B：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define MYPORT 3490 // the port users will be connecting to
#define BACKLOG 10 // how many pending connections queue will hold
void sigchld_handler(int s)
{
while(waitpid(-1, NULL, WNOHANG) > 0);
}
int main(void)
{
int sockfd, new_fd; // listen on sock_fd, new connection on new_fd
struct sockaddr_in my_addr; // my address information
struct sockaddr_in their_addr; // connector's address information
socklen_t sin_size;
struct sigaction sa;
int yes=1;
char buf[255];
socklen_t len=254;
security_context_t con = NULL;
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) {
perror("setsockopt");
exit(1);
}
my_addr.sin_family = AF_INET; // host byte order
my_addr.sin_port = htons(MYPORT); // short, network byte order作者: lusspan 时间: 2009-9-11 08:57
my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP
memset(&(my_addr.sin_zero), '', 8); // zero the rest of the struct
if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr))
== -1) {
perror("bind");
exit(1);
}
if (listen(sockfd, BACKLOG) == -1) {
perror("listen");
exit(1);
}
sa.sa_handler = sigchld_handler; // reap all dead processes
sigemptyset(&sa.sa_mask);
sa.sa_flags = SA_RESTART;
if (sigaction(SIGCHLD, &sa, NULL) == -1) {
perror("sigaction");
exit(1);
}
while(1) { // main accept() loop
sin_size = sizeof(struct sockaddr_in);
if ((new_fd = accept(sockfd, (struct sockaddr *)&their_addr,
&sin_size)) == -1) {
perror("accept");
continue;
}
// if (getsockopt(new_fd, SOL_SOCKET, SO_PEERSEC, con, &len)) {
if (getpeercon(new_fd, &con)) {
perror("getsockopt");
}
printf("server: got connection from %s, %sn",
inet_ntoa(their_addr.sin_addr), con);
if (!fork()) { // this is the child process
close(sockfd); // child doesn't need the listener
sprintf(buf, "Hello, %s", con);
if (send(new_fd, buf, strlen(buf), 0) == -1)
perror("send");
close(new_fd);
exit(0);
}
close(new_fd); // parent doesn't need this
}
return 0;
}
