Re: Transport protocol agnostic way to multiplex ports and forward metainfo?

--qhzm2ltzkq2uydwu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, May 01, 2018 at 06:18:30PM +0200, Alexander Huemer wrote:
> Word of caution: I reference netfilter in this email, please bear with=20
> me.
>=20
> I would like to create a network service that is available on multiple=20
> ports on multiple transport protocols.
> Since opening a lot of ports on the application layer is inefficient, I
> would prefer to multiplex on the network layer, like this:
>=20
>                        +----- pf
>                        V
>=20
> --> TCP port 1001 -->--+
>                        |
> --> TCP port 1002 -->--+--> TCP port 1001
>                        |
> --> TCP port 1003 -->--+
>=20
>                        +----- pf
>                        V
>=20
> --> UDP port 2001 -->--+
>                        |
> --> UDP port 2002 -->--+--> UDP port 2001
>                        |
> --> UDP port 2003 -->--+
>=20
> [Same possibly for SCTP, DCCP, ...]
>=20
> Additionally I would like to be able to know in the application on which=
=20
> port the connection reached the system originally.
>=20
> I am aware of the following mechanisms that allow what I want to do in=20
> netfilter on linux:
>=20
> For TCP: Using a REDIRECT rule with a port range and getsockopt with
>          SO_ORIGINAL_DST.
>=20
> For UDP: Using a TPROXY rule with a port range and recvmsg, then consume
>          ancillary message that is provided
>=20
> For SCTP, DCCP, others: I don't know a way to do that in netfilter.
>=20
> With pf, I don't know what the options are that I have.
>=20
> So, my question is: In pf, is there a transport protocol agnostic way to
> multiplex ports to an application, enabling the application to know on
> which port the connection came in?
>=20
> Any advise appreciated.

Since I still haven't found a way to do that I'd like to bump the topic. =
=20
Does anybody here have any ideas how to approach this?

Thanks,
-Alex

--qhzm2ltzkq2uydwu
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEs5W3p6vTzTb+fDjZ98cjeZNVOHMFAl1SrMUACgkQ98cjeZNV
OHPbmg/6AhBYo7ule3NHhsXLNmuswccthCdFJ52UQBGG8qyYGsITIRbagQYj1jQj
fo5txDVdsYYMUx8T934UlITYjA/Q+y0EZhLTVDm6POuLUCp1jU+p8AFT9+K57LNb
D7HHi86rsLcXvkOzH21C46K0ET25GxZOyqvZgCW5OmNATnQ33I1QYsIdsakBTisM
53tkTMbBb7O7ykdZipvSmLeJGVy8XW9CEQU7pdaoRKb+29n1dxMPEt2XNqvqZSQM
vPyjRgCIuvO51v/agmTAwRses7U2UMG4KMemNq37j6A1org+QFCBhJXw7zkli+l2
rZ9TSyPrj5GdKq9LtCrNQ3wHD++eWsNDVTRfR0E9HCKoKbe47lVRGJNiNPfUm2yt
kmJ8Fe945Kz/aLNn5DLb1V0oVXiZpwtUUiNMaJ3BlDD709ReuRMDns8loJyWgaKS
+eJ0lIInM9CUIwpoqYUN2MH7I4Z35zpZfXL49r8S0H3UKYjD4SZM6ofLcvQ0NYNk
/fi+8aOKTaBlK1TtrSS+902RYTjWqjdw2AIAfYlQQOA8Ms+Y3Sw0Etyd5007asf6
wXMNEFLY+QuRWs69wpSBeTAXhLqZULlpRhJ2n+mdblkhk2+tii0Jbh7XE63+ryAF
Jl1VdqlWtBYEUaNiS3IFfDB+Is54dHSosfgJJgd2kjaTE/AnIDU=
=isMN
-----END PGP SIGNATURE-----

--qhzm2ltzkq2uydwu--