TCP listen on any IPv6 in a block on Debian

Question

I have a /64 block of IPv6 addresses, and I'd like to be able to start a TCP server listening on any one of them. Currently I can bind to any static IP address, but not any others. If I try to bind to an address not statically routed (by the way, I'm not sure if I'm using the right terms), I get an error message, "bind: cannot assign requested address".

Here's from ifconfig:

eth0      Link encap:Ethernet  HWaddr 56:00:00:60:af:c6
          inet addr:104.238.191.172  Bcast:104.238.191.255  Mask:255.255.254.0
          inet6 addr: fe80::5400:ff:fe60:afc6/64 Scope:Link
          inet6 addr: 2001:19f0:6801:187:5400:ff:fe60:afc6/64 Scope:Global
          inet6 addr: 2001:19f0:6801:187:ea1e:eb99:13ae:d49a/128 Scope:Global
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:1526389 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1622562 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:280302410 (267.3 MiB)  TX bytes:266740313 (254.3 MiB)

If I try to bind to e.g. 2001:19f0:6801:187:a:b:c:d, it fails with "bind: cannot assign requested address". But if I do ip -6 addr add dev eth0 2001:19f0:6801:187:a:b:c:d, then I'm able to start the server listening on that IP address.

How can I configure Linux so that I can listen on any 2001:19f0:6801:187::/64 address? That is, I want to bind to some specific IP address without having to ip addr add it first.

Or should I just have my server ip addr add an address before binding, then maybe ip addr del it when I'm done?

Addendum: In case my problem isn't clear, I've already gotten far enough that the whole prefix is getting routed to my server so that it can, for example, respond to pings for any address with that prefix. If I start a TCP listening on "[::]:80", it will respond to requests to any IP address. What I want is to be able to listen on a specific IP address so that only requests addressed to that IP address will hit the server. Other ServerFault questions linked to are asking how to get a server to respond to requests to any IP address. I've already gotten that far. I want to be able to bind to any arbitrary address, but only one specific one. The problem is that Linux won't even let me start the server on a specific address if that particular address isn't statically assigned to an interface, and I'd like to work around that.

To be even more concrete, I can presently run a TCP echo server on my VPS on all interfaces:

ncat -l 2000 --keep-open --exec "/bin/cat"

Then from my laptop, I can connect to it using any random IPv6 address:

telnet 2001:19f0:6801:187:: 2000
telnet 2001:19f0:6801:187:abc:def:: 2000
telnet 2001:19f0:6801:187:abc:def:123:0 2000

This all works. If I start the server on a statically assigned address, it also works:

ncat -l 2001:19f0:6801:187:5400:ff:fe60:afc6 2000 --keep-open --exec "/bin/cat"

Now I can only connect to that particular IP address. So far so good.

Now I'd like to be able to start a server on some random address:

ncat -l 2001:19f0:6801:187:abc:123:: 2000 --keep-open --exec "/bin/cat"

But I get an error: "Ncat: bind to 2001:19f0:6801:187:abc:123:::2000: Cannot assign requested address. QUITTING." But if I ip -6 addr add dev eth0 2001:19f0:6801:187:abc:123::/64, then the previous ncat command works, and the server starts and only responds to connections to 2001:19f0:6801:187:abc:123::.

So can I configure Linux to let me start a server on any arbitrary address in my block without first adding it as a static address?

(Actually, my question is very similar to https://stackoverflow.com/questions/40198619/can-docker-automatically-add-ip-addresses-to-the-host-upon-running-container, although there they're talking about IPv4. There the answer is to statically add all addresses.)

Answer 1

The feature you are asking for appears to not be present in ncat, so you may have to download the source and add it yourself.

The way I verified whether the feature existed was as follows (done on Ubuntu 16.04 because that's the closest to a Debian system which I have immediate access to). First I tried to type the command to see if it is installed on my system:

$ ncat
The program 'ncat' is currently not installed. You can install it by typing:
sudo apt install nmap

So it is not installed, but is available in the nmap package. So I go ahead and download the source:

$ apt-get source nmap

And I look if IP_FREEBIND or IP_TRANSPARENT is used anywhere in that source code:

$ find nmap-7.01 -type f -print0 | xargs -0 grep -l 'IP_FREEBIND\|IP_TRANSPARENT'

That does not appear to be the case. So the next question is where in the source would we add it.

$ grep bind nmap-7.01/ncat/*c
nmap-7.01/ncat/ncat_connect.c:    /* TODO just two bytes for now, need to read more for bind */
nmap-7.01/ncat/ncat_main.c:            bye("-l and -s are incompatible.  Specify the address and port to bind to like you would a host to connect to.");
nmap-7.01/ncat/ncat_main.c:        /* Try to bind to IPv6 first; on AIX a bound IPv4 socket blocks an IPv6
nmap-7.01/ncat/util.c:        /* Tell it to not try and bind to IPV4 */
nmap-7.01/ncat/util.c:            die("Unable to set IPV6 socket to bind only to IPV6");
nmap-7.01/ncat/util.c:    if (bind(sock, &srcaddr_u->sockaddr, sa_len) < 0) {
nmap-7.01/ncat/util.c:            bye("bind to %s: %s.", srcaddr_u->un.sun_path,
nmap-7.01/ncat/util.c:            bye("bind to %s:%hu: %s.", inet_socktop(srcaddr_u),
nmap-7.01/ncat/util.c:        if (bind(sock, &srcaddr.sockaddr, sa_len) < 0) {
nmap-7.01/ncat/util.c:            bye("bind to %s:%hu: %s.", inet_socktop(&srcaddr),

The bind function is called from two places inside util.c, setting the IP_FREEBIND in one of those locations (or both) should do what you need.