Line data Source code
1 : /* setsockopt functions
2 : * Copyright (C) 1999 Kunihiro Ishiguro
3 : *
4 : * This file is part of GNU Zebra.
5 : *
6 : * GNU Zebra is free software; you can redistribute it and/or modify it
7 : * under the terms of the GNU General Public License as published by the
8 : * Free Software Foundation; either version 2, or (at your option) any
9 : * later version.
10 : *
11 : * GNU Zebra is distributed in the hope that it will be useful, but
12 : * WITHOUT ANY WARRANTY; without even the implied warranty of
13 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 : * General Public License for more details.
15 : *
16 : * You should have received a copy of the GNU General Public License along
17 : * with this program; see the file COPYING; if not, write to the Free Software
18 : * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19 : */
20 :
21 : #include <zebra.h>
22 :
23 : #include "log.h"
24 : #include "sockopt.h"
25 : #include "sockunion.h"
26 : #include "lib_errors.h"
27 :
28 : #if (defined(__FreeBSD__) \
29 : && ((__FreeBSD_version >= 500022 && __FreeBSD_version < 700000) \
30 : || (__FreeBSD_version < 500000 && __FreeBSD_version >= 440000))) \
31 : || (defined(__NetBSD__) && defined(__NetBSD_Version__) \
32 : && __NetBSD_Version__ >= 106010000) \
33 : || defined(__OpenBSD__) || defined(__APPLE__) \
34 : || defined(__DragonFly__) || defined(__sun)
35 : #define HAVE_BSD_STRUCT_IP_MREQ_HACK
36 : #endif
37 :
38 2 : void setsockopt_so_recvbuf(int sock, int size)
39 : {
40 2 : int orig_req = size;
41 :
42 2 : while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof(size))
43 2 : == -1)
44 0 : size /= 2;
45 :
46 2 : if (size != orig_req)
47 0 : flog_err(EC_LIB_SOCKET,
48 : "%s: fd %d: SO_RCVBUF set to %d (requested %d)",
49 : __func__, sock, size, orig_req);
50 2 : }
51 :
52 8 : void setsockopt_so_sendbuf(const int sock, int size)
53 : {
54 8 : int orig_req = size;
55 :
56 8 : while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size))
57 8 : == -1)
58 0 : size /= 2;
59 :
60 8 : if (size != orig_req)
61 0 : flog_err(EC_LIB_SOCKET,
62 : "%s: fd %d: SO_SNDBUF set to %d (requested %d)",
63 : __func__, sock, size, orig_req);
64 8 : }
65 :
66 4 : int getsockopt_so_sendbuf(const int sock)
67 : {
68 4 : uint32_t optval;
69 4 : socklen_t optlen = sizeof(optval);
70 4 : int ret = getsockopt(sock, SOL_SOCKET, SO_SNDBUF, (char *)&optval,
71 : &optlen);
72 4 : if (ret < 0) {
73 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
74 : "fd %d: can't getsockopt SO_SNDBUF: %d (%s)", sock,
75 : errno, safe_strerror(errno));
76 0 : return ret;
77 : }
78 4 : return optval;
79 : }
80 :
81 4 : int getsockopt_so_recvbuf(const int sock)
82 : {
83 4 : uint32_t optval;
84 4 : socklen_t optlen = sizeof(optval);
85 4 : int ret = getsockopt(sock, SOL_SOCKET, SO_RCVBUF, (char *)&optval,
86 : &optlen);
87 4 : if (ret < 0) {
88 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
89 : "fd %d: can't getsockopt SO_RCVBUF: %d (%s)", sock,
90 : errno, safe_strerror(errno));
91 0 : return ret;
92 : }
93 4 : return optval;
94 : }
95 :
96 0 : static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
97 : {
98 0 : struct cmsghdr *cmsg;
99 :
100 0 : for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL;
101 0 : cmsg = CMSG_NXTHDR(msgh, cmsg))
102 0 : if (cmsg->cmsg_level == level && cmsg->cmsg_type == type)
103 0 : return CMSG_DATA(cmsg);
104 :
105 : return NULL;
106 : }
107 :
108 : /* Set IPv6 packet info to the socket. */
109 2 : int setsockopt_ipv6_pktinfo(int sock, int val)
110 : {
111 2 : int ret;
112 :
113 : #ifdef IPV6_RECVPKTINFO /*2292bis-01*/
114 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val,
115 : sizeof(val));
116 2 : if (ret < 0)
117 0 : flog_err(EC_LIB_SOCKET,
118 : "can't setsockopt IPV6_RECVPKTINFO : %s",
119 : safe_strerror(errno));
120 : #else /*RFC2292*/
121 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
122 : if (ret < 0)
123 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_PKTINFO : %s",
124 : safe_strerror(errno));
125 : #endif /* IANA_IPV6 */
126 2 : return ret;
127 : }
128 :
129 : /* Set multicast hops val to the socket. */
130 2 : int setsockopt_ipv6_multicast_hops(int sock, int val)
131 : {
132 2 : int ret;
133 :
134 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val,
135 : sizeof(val));
136 2 : if (ret < 0)
137 0 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_HOPS");
138 2 : return ret;
139 : }
140 :
141 : /* Set multicast hops val to the socket. */
142 2 : int setsockopt_ipv6_unicast_hops(int sock, int val)
143 : {
144 2 : int ret;
145 :
146 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val,
147 : sizeof(val));
148 2 : if (ret < 0)
149 0 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_UNICAST_HOPS");
150 2 : return ret;
151 : }
152 :
153 2 : int setsockopt_ipv6_hoplimit(int sock, int val)
154 : {
155 2 : int ret;
156 :
157 : #ifdef IPV6_RECVHOPLIMIT /*2292bis-01*/
158 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val,
159 : sizeof(val));
160 2 : if (ret < 0)
161 0 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_RECVHOPLIMIT");
162 : #else /*RFC2292*/
163 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
164 : if (ret < 0)
165 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_HOPLIMIT");
166 : #endif
167 2 : return ret;
168 : }
169 :
170 : /* Set multicast loop zero to the socket. */
171 2 : int setsockopt_ipv6_multicast_loop(int sock, int val)
172 : {
173 2 : int ret;
174 :
175 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
176 : sizeof(val));
177 2 : if (ret < 0)
178 0 : flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_LOOP");
179 2 : return ret;
180 : }
181 :
182 0 : static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
183 : {
184 0 : struct in6_pktinfo *pktinfo;
185 :
186 0 : pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);
187 :
188 0 : return pktinfo->ipi6_ifindex;
189 : }
190 :
191 2 : int setsockopt_ipv6_tclass(int sock, int tclass)
192 : {
193 2 : int ret = 0;
194 :
195 : #ifdef IPV6_TCLASS /* RFC3542 */
196 2 : ret = setsockopt(sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass,
197 : sizeof(tclass));
198 2 : if (ret < 0)
199 0 : flog_err(EC_LIB_SOCKET,
200 : "Can't set IPV6_TCLASS option for fd %d to %#x: %s",
201 : sock, tclass, safe_strerror(errno));
202 : #endif
203 2 : return ret;
204 : }
205 :
206 : /*
207 : * Process multicast socket options for IPv4 in an OS-dependent manner.
208 : * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
209 : *
210 : * Many operating systems have a limit on the number of groups that
211 : * can be joined per socket (where each group and local address
212 : * counts). This impacts OSPF, which joins groups on each interface
213 : * using a single socket. The limit is typically 20, derived from the
214 : * original BSD multicast implementation. Some systems have
215 : * mechanisms for increasing this limit.
216 : *
217 : * In many 4.4BSD-derived systems, multicast group operations are not
218 : * allowed on interfaces that are not UP. Thus, a previous attempt to
219 : * leave the group may have failed, leaving it still joined, and we
220 : * drop/join quietly to recover. This may not be necessary, but aims to
221 : * defend against unknown behavior in that we will still return an error
222 : * if the second join fails. It is not clear how other systems
223 : * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
224 : * but this behavior should not be harmful if they behave the same way,
225 : * allow leaves, or implicitly leave all groups joined to down interfaces.
226 : */
227 0 : int setsockopt_ipv4_multicast(int sock, int optname, struct in_addr if_addr,
228 : unsigned int mcast_addr, ifindex_t ifindex)
229 : {
230 : #ifdef HAVE_RFC3678
231 0 : struct group_req gr;
232 0 : struct sockaddr_in *si;
233 0 : int ret;
234 0 : memset(&gr, 0, sizeof(gr));
235 0 : si = (struct sockaddr_in *)&gr.gr_group;
236 0 : gr.gr_interface = ifindex;
237 0 : si->sin_family = AF_INET;
238 : #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
239 : si->sin_len = sizeof(struct sockaddr_in);
240 : #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
241 0 : si->sin_addr.s_addr = mcast_addr;
242 0 : ret = setsockopt(sock, IPPROTO_IP,
243 : (optname == IP_ADD_MEMBERSHIP) ? MCAST_JOIN_GROUP
244 : : MCAST_LEAVE_GROUP,
245 : (void *)&gr, sizeof(gr));
246 0 : if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
247 0 : && (errno == EADDRINUSE)) {
248 0 : setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr,
249 : sizeof(gr));
250 0 : ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP,
251 : (void *)&gr, sizeof(gr));
252 : }
253 0 : return ret;
254 :
255 : #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
256 : struct ip_mreqn mreqn;
257 : int ret;
258 :
259 : assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
260 : memset(&mreqn, 0, sizeof(mreqn));
261 :
262 : mreqn.imr_multiaddr.s_addr = mcast_addr;
263 : mreqn.imr_ifindex = ifindex;
264 :
265 : ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreqn,
266 : sizeof(mreqn));
267 : if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
268 : && (errno == EADDRINUSE)) {
269 : /* see above: handle possible problem when interface comes back
270 : * up */
271 : zlog_info(
272 : "setsockopt_ipv4_multicast attempting to drop and re-add (fd %d, mcast %pI4, ifindex %u)",
273 : sock, &mreqn.imr_multiaddr, ifindex);
274 : setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreqn,
275 : sizeof(mreqn));
276 : ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
277 : (void *)&mreqn, sizeof(mreqn));
278 : }
279 : return ret;
280 :
281 : /* Example defines for another OS, boilerplate off other code in this
282 : function, AND handle optname as per other sections for consistency !! */
283 : /* #elif defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
284 : /* Add your favourite OS here! */
285 :
286 : #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
287 : /* standard BSD API */
288 :
289 : struct ip_mreq mreq;
290 : int ret;
291 :
292 : assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
293 :
294 :
295 : memset(&mreq, 0, sizeof(mreq));
296 : mreq.imr_multiaddr.s_addr = mcast_addr;
297 : #if !defined __OpenBSD__
298 : mreq.imr_interface.s_addr = htonl(ifindex);
299 : #else
300 : mreq.imr_interface.s_addr = if_addr.s_addr;
301 : #endif
302 :
303 : ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreq,
304 : sizeof(mreq));
305 : if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
306 : && (errno == EADDRINUSE)) {
307 : /* see above: handle possible problem when interface comes back
308 : * up */
309 : zlog_info(
310 : "setsockopt_ipv4_multicast attempting to drop and re-add (fd %d, mcast %pI4, ifindex %u)",
311 : sock, &mreq.imr_multiaddr, ifindex);
312 : setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreq,
313 : sizeof(mreq));
314 : ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
315 : (void *)&mreq, sizeof(mreq));
316 : }
317 : return ret;
318 :
319 : #else
320 : #error "Unsupported multicast API"
321 : #endif /* #if OS_TYPE */
322 : }
323 :
324 : /*
325 : * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
326 : */
327 0 : int setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
328 : ifindex_t ifindex)
329 : {
330 :
331 : #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
332 0 : struct ip_mreqn mreqn;
333 0 : memset(&mreqn, 0, sizeof(mreqn));
334 :
335 0 : mreqn.imr_ifindex = ifindex;
336 0 : return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn,
337 : sizeof(mreqn));
338 :
339 : /* Example defines for another OS, boilerplate off other code in this
340 : function */
341 : /* #elif defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
342 : /* Add your favourite OS here! */
343 : #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
344 : struct in_addr m;
345 :
346 : #if !defined __OpenBSD__
347 : m.s_addr = htonl(ifindex);
348 : #else
349 : m.s_addr = if_addr.s_addr;
350 : #endif
351 :
352 : return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m,
353 : sizeof(m));
354 : #else
355 : #error "Unsupported multicast API"
356 : #endif
357 : }
358 :
359 0 : int setsockopt_ipv4_multicast_loop(int sock, uint8_t val)
360 : {
361 0 : int ret;
362 :
363 0 : ret = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *)&val,
364 : sizeof(val));
365 0 : if (ret < 0)
366 0 : flog_err(EC_LIB_SOCKET, "can't setsockopt IP_MULTICAST_LOOP");
367 :
368 0 : return ret;
369 : }
370 :
371 0 : static int setsockopt_ipv4_ifindex(int sock, ifindex_t val)
372 : {
373 0 : int ret;
374 :
375 : #if defined(IP_PKTINFO)
376 0 : ret = setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val));
377 0 : if (ret < 0)
378 0 : flog_err(EC_LIB_SOCKET,
379 : "Can't set IP_PKTINFO option for fd %d to %d: %s",
380 : sock, val, safe_strerror(errno));
381 : #elif defined(IP_RECVIF)
382 : ret = setsockopt(sock, IPPROTO_IP, IP_RECVIF, &val, sizeof(val));
383 : if (ret < 0)
384 : flog_err(EC_LIB_SOCKET,
385 : "Can't set IP_RECVIF option for fd %d to %d: %s", sock,
386 : val, safe_strerror(errno));
387 : #else
388 : #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
389 : #warning "Will not be able to receive link info."
390 : #warning "Things might be seriously broken.."
391 : /* XXX Does this ever happen? Should there be a zlog_warn message here?
392 : */
393 : ret = -1;
394 : #endif
395 0 : return ret;
396 : }
397 :
398 4 : int setsockopt_ipv4_tos(int sock, int tos)
399 : {
400 4 : int ret;
401 :
402 4 : ret = setsockopt(sock, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
403 4 : if (ret < 0)
404 0 : flog_err(EC_LIB_SOCKET,
405 : "Can't set IP_TOS option for fd %d to %#x: %s", sock,
406 : tos, safe_strerror(errno));
407 4 : return ret;
408 : }
409 :
410 :
411 0 : int setsockopt_ifindex(int af, int sock, ifindex_t val)
412 : {
413 0 : int ret = -1;
414 :
415 0 : switch (af) {
416 0 : case AF_INET:
417 0 : ret = setsockopt_ipv4_ifindex(sock, val);
418 0 : break;
419 0 : case AF_INET6:
420 0 : ret = setsockopt_ipv6_pktinfo(sock, val);
421 0 : break;
422 0 : default:
423 0 : flog_err(EC_LIB_DEVELOPMENT,
424 : "setsockopt_ifindex: unknown address family %d", af);
425 : }
426 0 : return ret;
427 : }
428 :
429 : /*
430 : * Requires: msgh is not NULL and points to a valid struct msghdr, which
431 : * may or may not have control data about the incoming interface.
432 : *
433 : * Returns the interface index (small integer >= 1) if it can be
434 : * determined, or else 0.
435 : */
436 0 : static ifindex_t getsockopt_ipv4_ifindex(struct msghdr *msgh)
437 : {
438 0 : ifindex_t ifindex;
439 :
440 : #if defined(IP_PKTINFO)
441 : /* Linux pktinfo based ifindex retrieval */
442 0 : struct in_pktinfo *pktinfo;
443 :
444 0 : pktinfo = (struct in_pktinfo *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
445 : IP_PKTINFO);
446 :
447 : /* getsockopt_ifindex() will forward this, being 0 "not found" */
448 0 : if (pktinfo == NULL)
449 : return 0;
450 :
451 0 : ifindex = pktinfo->ipi_ifindex;
452 :
453 : #elif defined(IP_RECVIF)
454 :
455 : /* retrieval based on IP_RECVIF */
456 :
457 : /* BSD systems use a sockaddr_dl as the control message payload. */
458 : struct sockaddr_dl *sdl;
459 :
460 : /* BSD */
461 : sdl = (struct sockaddr_dl *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
462 : IP_RECVIF);
463 : if (sdl != NULL)
464 : ifindex = sdl->sdl_index;
465 : else
466 : ifindex = 0;
467 :
468 : #else
469 : /*
470 : * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
471 : * XXX Decide if this is a core service, or if daemons have to cope.
472 : * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
473 : * daemons have to cope.
474 : */
475 : #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
476 : #warning "Some daemons may fail to operate correctly!"
477 : ifindex = 0;
478 :
479 : #endif /* IP_PKTINFO */
480 :
481 0 : return ifindex;
482 : }
483 :
484 : /* return ifindex, 0 if none found */
485 0 : ifindex_t getsockopt_ifindex(int af, struct msghdr *msgh)
486 : {
487 0 : switch (af) {
488 0 : case AF_INET:
489 0 : return (getsockopt_ipv4_ifindex(msgh));
490 : case AF_INET6:
491 0 : return (getsockopt_ipv6_ifindex(msgh));
492 0 : default:
493 0 : flog_err(EC_LIB_DEVELOPMENT,
494 : "getsockopt_ifindex: unknown address family %d", af);
495 0 : return 0;
496 : }
497 : }
498 :
499 : /* swab iph between order system uses for IP_HDRINCL and host order */
500 0 : void sockopt_iphdrincl_swab_htosys(struct ip *iph)
501 : {
502 : /* BSD and derived take iph in network order, except for
503 : * ip_len and ip_off
504 : */
505 : #ifndef HAVE_IP_HDRINCL_BSD_ORDER
506 0 : iph->ip_len = htons(iph->ip_len);
507 0 : iph->ip_off = htons(iph->ip_off);
508 : #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
509 :
510 0 : iph->ip_id = htons(iph->ip_id);
511 0 : }
512 :
513 0 : void sockopt_iphdrincl_swab_systoh(struct ip *iph)
514 : {
515 : #ifndef HAVE_IP_HDRINCL_BSD_ORDER
516 0 : iph->ip_len = ntohs(iph->ip_len);
517 0 : iph->ip_off = ntohs(iph->ip_off);
518 : #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
519 :
520 0 : iph->ip_id = ntohs(iph->ip_id);
521 0 : }
522 :
523 6 : int sockopt_tcp_rtt(int sock)
524 : {
525 : #ifdef TCP_INFO
526 6 : struct tcp_info ti;
527 6 : socklen_t len = sizeof(ti);
528 :
529 6 : if (getsockopt(sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
530 : return 0;
531 :
532 6 : return ti.tcpi_rtt / 1000;
533 : #else
534 : return 0;
535 : #endif
536 : }
537 :
538 0 : int sockopt_tcp_signature_ext(int sock, union sockunion *su, uint16_t prefixlen,
539 : const char *password)
540 : {
541 : #ifndef HAVE_DECL_TCP_MD5SIG
542 : /*
543 : * We have been asked to enable MD5 auth for an address, but our
544 : * platform doesn't support that
545 : */
546 : return -2;
547 : #endif
548 :
549 : #ifndef TCP_MD5SIG_EXT
550 : /*
551 : * We have been asked to enable MD5 auth for a prefix, but our platform
552 : * doesn't support that
553 : */
554 : if (prefixlen > 0)
555 : return -2;
556 : #endif
557 :
558 : #if HAVE_DECL_TCP_MD5SIG
559 0 : int ret;
560 :
561 0 : int optname = TCP_MD5SIG;
562 : #ifndef GNU_LINUX
563 : /*
564 : * XXX Need to do PF_KEY operation here to add/remove an SA entry,
565 : * and add/remove an SP entry for this peer's packet flows also.
566 : */
567 : int md5sig = password && *password ? 1 : 0;
568 : #else
569 0 : int keylen = password ? strlen(password) : 0;
570 0 : struct tcp_md5sig md5sig;
571 0 : union sockunion *su2, *susock;
572 :
573 : /* Figure out whether the socket and the sockunion are the same family..
574 : * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
575 : */
576 0 : if (!(susock = sockunion_getsockname(sock)))
577 : return -1;
578 :
579 0 : if (susock->sa.sa_family == su->sa.sa_family)
580 : su2 = su;
581 : else {
582 : /* oops.. */
583 0 : su2 = susock;
584 :
585 0 : if (su2->sa.sa_family == AF_INET) {
586 0 : sockunion_free(susock);
587 0 : return 0;
588 : }
589 :
590 : /* If this does not work, then all users of this sockopt will
591 : * need to
592 : * differentiate between IPv4 and IPv6, and keep separate
593 : * sockets for
594 : * each.
595 : *
596 : * Sadly, it doesn't seem to work at present. It's unknown
597 : * whether
598 : * this is a bug or not.
599 : */
600 0 : if (su2->sa.sa_family == AF_INET6
601 0 : && su->sa.sa_family == AF_INET) {
602 0 : su2->sin6.sin6_family = AF_INET6;
603 : /* V4Map the address */
604 0 : memset(&su2->sin6.sin6_addr, 0,
605 : sizeof(struct in6_addr));
606 0 : su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
607 0 : memcpy(&su2->sin6.sin6_addr.s6_addr32[3],
608 : &su->sin.sin_addr, 4);
609 : }
610 : }
611 :
612 0 : memset(&md5sig, 0, sizeof(md5sig));
613 0 : memcpy(&md5sig.tcpm_addr, su2, sizeof(*su2));
614 :
615 0 : md5sig.tcpm_keylen = keylen;
616 0 : if (keylen)
617 0 : memcpy(md5sig.tcpm_key, password, keylen);
618 0 : sockunion_free(susock);
619 :
620 : /*
621 : * Handle support for MD5 signatures on prefixes, if available and
622 : * requested. Technically the #ifdef check below is not needed because
623 : * if prefixlen > 0 and we don't have support for this feature we would
624 : * have already returned by now, but leaving it there to be explicit.
625 : */
626 : #ifdef TCP_MD5SIG_EXT
627 0 : if (prefixlen > 0) {
628 0 : md5sig.tcpm_prefixlen = prefixlen;
629 0 : md5sig.tcpm_flags = TCP_MD5SIG_FLAG_PREFIX;
630 0 : optname = TCP_MD5SIG_EXT;
631 : }
632 : #endif /* TCP_MD5SIG_EXT */
633 :
634 : #endif /* GNU_LINUX */
635 :
636 0 : ret = setsockopt(sock, IPPROTO_TCP, optname, &md5sig, sizeof(md5sig));
637 0 : if (ret < 0) {
638 0 : if (ENOENT == errno)
639 : ret = 0;
640 : else
641 0 : flog_err_sys(
642 : EC_LIB_SYSTEM_CALL,
643 : "sockopt_tcp_signature: setsockopt(%d): %s",
644 : sock, safe_strerror(errno));
645 : }
646 : return ret;
647 : #endif /* HAVE_TCP_MD5SIG */
648 :
649 : /*
650 : * Making compiler happy. If we get to this point we probably
651 : * have done something really really wrong.
652 : */
653 : return -2;
654 : }
655 :
656 0 : int sockopt_tcp_signature(int sock, union sockunion *su, const char *password)
657 : {
658 0 : return sockopt_tcp_signature_ext(sock, su, 0, password);
659 : }
660 :
661 : /* set TCP mss value to socket */
662 0 : int sockopt_tcp_mss_set(int sock, int tcp_maxseg)
663 : {
664 0 : int ret = 0;
665 0 : socklen_t tcp_maxseg_len = sizeof(tcp_maxseg);
666 :
667 0 : ret = setsockopt(sock, IPPROTO_TCP, TCP_MAXSEG, &tcp_maxseg,
668 : tcp_maxseg_len);
669 0 : if (ret != 0) {
670 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
671 : "%s failed: setsockopt(%d): %s", __func__, sock,
672 : safe_strerror(errno));
673 : }
674 :
675 0 : return ret;
676 : }
677 :
678 : /* get TCP mss value synced by socket */
679 0 : int sockopt_tcp_mss_get(int sock)
680 : {
681 0 : int ret = 0;
682 0 : int tcp_maxseg = 0;
683 0 : socklen_t tcp_maxseg_len = sizeof(tcp_maxseg);
684 :
685 0 : ret = getsockopt(sock, IPPROTO_TCP, TCP_MAXSEG, &tcp_maxseg,
686 : &tcp_maxseg_len);
687 0 : if (ret != 0) {
688 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
689 : "%s failed: getsockopt(%d): %s", __func__, sock,
690 : safe_strerror(errno));
691 0 : return 0;
692 : }
693 :
694 0 : return tcp_maxseg;
695 : }
696 :
697 0 : int setsockopt_tcp_keepalive(int sock, uint16_t keepalive_idle,
698 : uint16_t keepalive_intvl,
699 : uint16_t keepalive_probes)
700 : {
701 0 : int val = 1;
702 :
703 0 : if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, &val, sizeof(val)) < 0) {
704 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
705 : "%s failed: setsockopt SO_KEEPALIVE (%d): %s",
706 : __func__, sock, safe_strerror(errno));
707 0 : return -1;
708 : }
709 :
710 : #if defined __OpenBSD__
711 : return 0;
712 : #else
713 : /* Send first probe after keepalive_idle seconds */
714 0 : val = keepalive_idle;
715 0 : if (setsockopt(sock, IPPROTO_TCP, TCP_KEEPIDLE, &val, sizeof(val)) <
716 : 0) {
717 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
718 : "%s failed: setsockopt TCP_KEEPIDLE (%d): %s",
719 : __func__, sock, safe_strerror(errno));
720 0 : return -1;
721 : }
722 :
723 : /* Set interval between two probes */
724 0 : val = keepalive_intvl;
725 0 : if (setsockopt(sock, IPPROTO_TCP, TCP_KEEPINTVL, &val, sizeof(val)) <
726 : 0) {
727 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
728 : "%s failed: setsockopt TCP_KEEPINTVL (%d): %s",
729 : __func__, sock, safe_strerror(errno));
730 0 : return -1;
731 : }
732 :
733 : /* Set maximum probes */
734 0 : val = keepalive_probes;
735 0 : if (setsockopt(sock, IPPROTO_TCP, TCP_KEEPCNT, &val, sizeof(val)) < 0) {
736 0 : flog_err_sys(EC_LIB_SYSTEM_CALL,
737 : "%s failed: setsockopt TCP_KEEPCNT (%d): %s",
738 : __func__, sock, safe_strerror(errno));
739 0 : return -1;
740 : }
741 :
742 : return 0;
743 : #endif
744 : }
|
