1 /* setsockopt functions
2 * Copyright (C) 1999 Kunihiro Ishiguro
3 *
4 * This file is part of GNU Zebra.
5 *
6 * GNU Zebra is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2, or (at your option) any
9 * later version.
10 *
11 * GNU Zebra is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License along
17 * with this program; see the file COPYING; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #include <zebra.h>
22
23 #ifdef SUNOS_5
24 #include <ifaddrs.h>
25 #endif
26
27 #include "log.h"
28 #include "sockopt.h"
29 #include "sockunion.h"
30 #include "lib_errors.h"
31
setsockopt_so_recvbuf(int sock,int size)32 void setsockopt_so_recvbuf(int sock, int size)
33 {
34 int orig_req = size;
35
36 while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof(size))
37 == -1)
38 size /= 2;
39
40 if (size != orig_req)
41 flog_err(EC_LIB_SOCKET,
42 "%s: fd %d: SO_RCVBUF set to %d (requested %d)",
43 __func__, sock, size, orig_req);
44 }
45
setsockopt_so_sendbuf(const int sock,int size)46 void setsockopt_so_sendbuf(const int sock, int size)
47 {
48 int orig_req = size;
49
50 while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size))
51 == -1)
52 size /= 2;
53
54 if (size != orig_req)
55 flog_err(EC_LIB_SOCKET,
56 "%s: fd %d: SO_SNDBUF set to %d (requested %d)",
57 __func__, sock, size, orig_req);
58 }
59
getsockopt_so_sendbuf(const int sock)60 int getsockopt_so_sendbuf(const int sock)
61 {
62 uint32_t optval;
63 socklen_t optlen = sizeof(optval);
64 int ret = getsockopt(sock, SOL_SOCKET, SO_SNDBUF, (char *)&optval,
65 &optlen);
66 if (ret < 0) {
67 flog_err_sys(EC_LIB_SYSTEM_CALL,
68 "fd %d: can't getsockopt SO_SNDBUF: %d (%s)", sock,
69 errno, safe_strerror(errno));
70 return ret;
71 }
72 return optval;
73 }
74
getsockopt_so_recvbuf(const int sock)75 int getsockopt_so_recvbuf(const int sock)
76 {
77 uint32_t optval;
78 socklen_t optlen = sizeof(optval);
79 int ret = getsockopt(sock, SOL_SOCKET, SO_RCVBUF, (char *)&optval,
80 &optlen);
81 if (ret < 0) {
82 flog_err_sys(EC_LIB_SYSTEM_CALL,
83 "fd %d: can't getsockopt SO_RCVBUF: %d (%s)", sock,
84 errno, safe_strerror(errno));
85 return ret;
86 }
87 return optval;
88 }
89
getsockopt_cmsg_data(struct msghdr * msgh,int level,int type)90 static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
91 {
92 struct cmsghdr *cmsg;
93
94 for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL;
95 cmsg = CMSG_NXTHDR(msgh, cmsg))
96 if (cmsg->cmsg_level == level && cmsg->cmsg_type == type)
97 return CMSG_DATA(cmsg);
98
99 return NULL;
100 }
101
102 /* Set IPv6 packet info to the socket. */
setsockopt_ipv6_pktinfo(int sock,int val)103 int setsockopt_ipv6_pktinfo(int sock, int val)
104 {
105 int ret;
106
107 #ifdef IPV6_RECVPKTINFO /*2292bis-01*/
108 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val,
109 sizeof(val));
110 if (ret < 0)
111 flog_err(EC_LIB_SOCKET,
112 "can't setsockopt IPV6_RECVPKTINFO : %s",
113 safe_strerror(errno));
114 #else /*RFC2292*/
115 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
116 if (ret < 0)
117 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_PKTINFO : %s",
118 safe_strerror(errno));
119 #endif /* INIA_IPV6 */
120 return ret;
121 }
122
123 /* Set multicast hops val to the socket. */
setsockopt_ipv6_multicast_hops(int sock,int val)124 int setsockopt_ipv6_multicast_hops(int sock, int val)
125 {
126 int ret;
127
128 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val,
129 sizeof(val));
130 if (ret < 0)
131 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_HOPS");
132 return ret;
133 }
134
135 /* Set multicast hops val to the socket. */
setsockopt_ipv6_unicast_hops(int sock,int val)136 int setsockopt_ipv6_unicast_hops(int sock, int val)
137 {
138 int ret;
139
140 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val,
141 sizeof(val));
142 if (ret < 0)
143 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_UNICAST_HOPS");
144 return ret;
145 }
146
setsockopt_ipv6_hoplimit(int sock,int val)147 int setsockopt_ipv6_hoplimit(int sock, int val)
148 {
149 int ret;
150
151 #ifdef IPV6_RECVHOPLIMIT /*2292bis-01*/
152 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val,
153 sizeof(val));
154 if (ret < 0)
155 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_RECVHOPLIMIT");
156 #else /*RFC2292*/
157 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
158 if (ret < 0)
159 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_HOPLIMIT");
160 #endif
161 return ret;
162 }
163
164 /* Set multicast loop zero to the socket. */
setsockopt_ipv6_multicast_loop(int sock,int val)165 int setsockopt_ipv6_multicast_loop(int sock, int val)
166 {
167 int ret;
168
169 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
170 sizeof(val));
171 if (ret < 0)
172 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_LOOP");
173 return ret;
174 }
175
getsockopt_ipv6_ifindex(struct msghdr * msgh)176 static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
177 {
178 struct in6_pktinfo *pktinfo;
179
180 pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);
181
182 return pktinfo->ipi6_ifindex;
183 }
184
setsockopt_ipv6_tclass(int sock,int tclass)185 int setsockopt_ipv6_tclass(int sock, int tclass)
186 {
187 int ret = 0;
188
189 #ifdef IPV6_TCLASS /* RFC3542 */
190 ret = setsockopt(sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass,
191 sizeof(tclass));
192 if (ret < 0)
193 flog_err(EC_LIB_SOCKET,
194 "Can't set IPV6_TCLASS option for fd %d to %#x: %s",
195 sock, tclass, safe_strerror(errno));
196 #endif
197 return ret;
198 }
199
200 /*
201 * Process multicast socket options for IPv4 in an OS-dependent manner.
202 * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
203 *
204 * Many operating systems have a limit on the number of groups that
205 * can be joined per socket (where each group and local address
206 * counts). This impacts OSPF, which joins groups on each interface
207 * using a single socket. The limit is typically 20, derived from the
208 * original BSD multicast implementation. Some systems have
209 * mechanisms for increasing this limit.
210 *
211 * In many 4.4BSD-derived systems, multicast group operations are not
212 * allowed on interfaces that are not UP. Thus, a previous attempt to
213 * leave the group may have failed, leaving it still joined, and we
214 * drop/join quietly to recover. This may not be necessary, but aims to
215 * defend against unknown behavior in that we will still return an error
216 * if the second join fails. It is not clear how other systems
217 * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
218 * but this behavior should not be harmful if they behave the same way,
219 * allow leaves, or implicitly leave all groups joined to down interfaces.
220 */
setsockopt_ipv4_multicast(int sock,int optname,struct in_addr if_addr,unsigned int mcast_addr,ifindex_t ifindex)221 int setsockopt_ipv4_multicast(int sock, int optname, struct in_addr if_addr,
222 unsigned int mcast_addr, ifindex_t ifindex)
223 {
224 #ifdef HAVE_RFC3678
225 struct group_req gr;
226 struct sockaddr_in *si;
227 int ret;
228 memset(&gr, 0, sizeof(gr));
229 si = (struct sockaddr_in *)&gr.gr_group;
230 gr.gr_interface = ifindex;
231 si->sin_family = AF_INET;
232 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
233 si->sin_len = sizeof(struct sockaddr_in);
234 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
235 si->sin_addr.s_addr = mcast_addr;
236 ret = setsockopt(sock, IPPROTO_IP,
237 (optname == IP_ADD_MEMBERSHIP) ? MCAST_JOIN_GROUP
238 : MCAST_LEAVE_GROUP,
239 (void *)&gr, sizeof(gr));
240 if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
241 && (errno == EADDRINUSE)) {
242 setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr,
243 sizeof(gr));
244 ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP,
245 (void *)&gr, sizeof(gr));
246 }
247 return ret;
248
249 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
250 struct ip_mreqn mreqn;
251 int ret;
252
253 assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
254 memset(&mreqn, 0, sizeof(mreqn));
255
256 mreqn.imr_multiaddr.s_addr = mcast_addr;
257 mreqn.imr_ifindex = ifindex;
258
259 ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreqn,
260 sizeof(mreqn));
261 if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
262 && (errno == EADDRINUSE)) {
263 /* see above: handle possible problem when interface comes back
264 * up */
265 char buf[1][INET_ADDRSTRLEN];
266 zlog_info(
267 "setsockopt_ipv4_multicast attempting to drop and re-add (fd %d, mcast %s, ifindex %u)",
268 sock, inet_ntop(AF_INET, &mreqn.imr_multiaddr, buf[0],
269 sizeof(buf[0])),
270 ifindex);
271 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreqn,
272 sizeof(mreqn));
273 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
274 (void *)&mreqn, sizeof(mreqn));
275 }
276 return ret;
277
278 /* Example defines for another OS, boilerplate off other code in this
279 function, AND handle optname as per other sections for consistency !! */
280 /* #elif defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
281 /* Add your favourite OS here! */
282
283 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
284 /* standard BSD API */
285
286 struct ip_mreq mreq;
287 int ret;
288
289 assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
290
291
292 memset(&mreq, 0, sizeof(mreq));
293 mreq.imr_multiaddr.s_addr = mcast_addr;
294 #if !defined __OpenBSD__
295 mreq.imr_interface.s_addr = htonl(ifindex);
296 #else
297 mreq.imr_interface.s_addr = if_addr.s_addr;
298 #endif
299
300 ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreq,
301 sizeof(mreq));
302 if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
303 && (errno == EADDRINUSE)) {
304 /* see above: handle possible problem when interface comes back
305 * up */
306 char buf[1][INET_ADDRSTRLEN];
307 zlog_info(
308 "setsockopt_ipv4_multicast attempting to drop and re-add (fd %d, mcast %s, ifindex %u)",
309 sock, inet_ntop(AF_INET, &mreq.imr_multiaddr, buf[0],
310 sizeof(buf[0])),
311 ifindex);
312 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreq,
313 sizeof(mreq));
314 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
315 (void *)&mreq, sizeof(mreq));
316 }
317 return ret;
318
319 #else
320 #error "Unsupported multicast API"
321 #endif /* #if OS_TYPE */
322 }
323
324 /*
325 * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
326 */
setsockopt_ipv4_multicast_if(int sock,struct in_addr if_addr,ifindex_t ifindex)327 int setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
328 ifindex_t ifindex)
329 {
330
331 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
332 struct ip_mreqn mreqn;
333 memset(&mreqn, 0, sizeof(mreqn));
334
335 mreqn.imr_ifindex = ifindex;
336 return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn,
337 sizeof(mreqn));
338
339 /* Example defines for another OS, boilerplate off other code in this
340 function */
341 /* #elif defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
342 /* Add your favourite OS here! */
343 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
344 struct in_addr m;
345
346 #if !defined __OpenBSD__
347 m.s_addr = htonl(ifindex);
348 #else
349 m.s_addr = if_addr.s_addr;
350 #endif
351
352 return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m,
353 sizeof(m));
354 #elif defined(SUNOS_5)
355 char ifname[IF_NAMESIZE];
356 struct ifaddrs *ifa, *ifap;
357 struct in_addr ifaddr;
358
359 if (if_indextoname(ifindex, ifname) == NULL)
360 return -1;
361
362 if (getifaddrs(&ifa) != 0)
363 return -1;
364
365 for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next) {
366 struct sockaddr_in *sa;
367
368 if (strcmp(ifap->ifa_name, ifname) != 0)
369 continue;
370 if (ifap->ifa_addr->sa_family != AF_INET)
371 continue;
372 sa = (struct sockaddr_in *)ifap->ifa_addr;
373 memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
374 break;
375 }
376
377 freeifaddrs(ifa);
378 if (!ifap) /* This means we did not find an IP */
379 return -1;
380
381 return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr,
382 sizeof(ifaddr));
383 #else
384 #error "Unsupported multicast API"
385 #endif
386 }
387
setsockopt_ipv4_multicast_loop(int sock,uint8_t val)388 int setsockopt_ipv4_multicast_loop(int sock, uint8_t val)
389 {
390 int ret;
391
392 ret = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *)&val,
393 sizeof(val));
394 if (ret < 0)
395 flog_err(EC_LIB_SOCKET, "can't setsockopt IP_MULTICAST_LOOP");
396
397 return ret;
398 }
399
setsockopt_ipv4_ifindex(int sock,ifindex_t val)400 static int setsockopt_ipv4_ifindex(int sock, ifindex_t val)
401 {
402 int ret;
403
404 #if defined(IP_PKTINFO)
405 if ((ret = setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val)))
406 < 0)
407 flog_err(EC_LIB_SOCKET,
408 "Can't set IP_PKTINFO option for fd %d to %d: %s",
409 sock, val, safe_strerror(errno));
410 #elif defined(IP_RECVIF)
411 if ((ret = setsockopt(sock, IPPROTO_IP, IP_RECVIF, &val, sizeof(val)))
412 < 0)
413 flog_err(EC_LIB_SOCKET,
414 "Can't set IP_RECVIF option for fd %d to %d: %s", sock,
415 val, safe_strerror(errno));
416 #else
417 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
418 #warning "Will not be able to receive link info."
419 #warning "Things might be seriously broken.."
420 /* XXX Does this ever happen? Should there be a zlog_warn message here?
421 */
422 ret = -1;
423 #endif
424 return ret;
425 }
426
setsockopt_ipv4_tos(int sock,int tos)427 int setsockopt_ipv4_tos(int sock, int tos)
428 {
429 int ret;
430
431 ret = setsockopt(sock, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
432 if (ret < 0)
433 flog_err(EC_LIB_SOCKET,
434 "Can't set IP_TOS option for fd %d to %#x: %s", sock,
435 tos, safe_strerror(errno));
436 return ret;
437 }
438
439
setsockopt_ifindex(int af,int sock,ifindex_t val)440 int setsockopt_ifindex(int af, int sock, ifindex_t val)
441 {
442 int ret = -1;
443
444 switch (af) {
445 case AF_INET:
446 ret = setsockopt_ipv4_ifindex(sock, val);
447 break;
448 case AF_INET6:
449 ret = setsockopt_ipv6_pktinfo(sock, val);
450 break;
451 default:
452 flog_err(EC_LIB_DEVELOPMENT,
453 "setsockopt_ifindex: unknown address family %d", af);
454 }
455 return ret;
456 }
457
458 /*
459 * Requires: msgh is not NULL and points to a valid struct msghdr, which
460 * may or may not have control data about the incoming interface.
461 *
462 * Returns the interface index (small integer >= 1) if it can be
463 * determined, or else 0.
464 */
getsockopt_ipv4_ifindex(struct msghdr * msgh)465 static ifindex_t getsockopt_ipv4_ifindex(struct msghdr *msgh)
466 {
467 ifindex_t ifindex;
468
469 #if defined(IP_PKTINFO)
470 /* Linux pktinfo based ifindex retrieval */
471 struct in_pktinfo *pktinfo;
472
473 pktinfo = (struct in_pktinfo *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
474 IP_PKTINFO);
475
476 /* getsockopt_ifindex() will forward this, being 0 "not found" */
477 if (pktinfo == NULL)
478 return 0;
479
480 ifindex = pktinfo->ipi_ifindex;
481
482 #elif defined(IP_RECVIF)
483
484 /* retrieval based on IP_RECVIF */
485
486 #ifndef SUNOS_5
487 /* BSD systems use a sockaddr_dl as the control message payload. */
488 struct sockaddr_dl *sdl;
489 #else
490 /* SUNOS_5 uses an integer with the index. */
491 ifindex_t *ifindex_p;
492 #endif /* SUNOS_5 */
493
494 #ifndef SUNOS_5
495 /* BSD */
496 sdl = (struct sockaddr_dl *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
497 IP_RECVIF);
498 if (sdl != NULL)
499 ifindex = sdl->sdl_index;
500 else
501 ifindex = 0;
502 #else
503 /*
504 * Solaris. On Solaris 8, IP_RECVIF is defined, but the call to
505 * enable it fails with errno=99, and the struct msghdr has
506 * controllen 0.
507 */
508 ifindex_p = (uint_t *)getsockopt_cmsg_data(msgh, IPPROTO_IP, IP_RECVIF);
509 if (ifindex_p != NULL)
510 ifindex = *ifindex_p;
511 else
512 ifindex = 0;
513 #endif /* SUNOS_5 */
514
515 #else
516 /*
517 * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
518 * XXX Decide if this is a core service, or if daemons have to cope.
519 * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
520 * daemons have to cope.
521 */
522 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
523 #warning "Some daemons may fail to operate correctly!"
524 ifindex = 0;
525
526 #endif /* IP_PKTINFO */
527
528 return ifindex;
529 }
530
531 /* return ifindex, 0 if none found */
getsockopt_ifindex(int af,struct msghdr * msgh)532 ifindex_t getsockopt_ifindex(int af, struct msghdr *msgh)
533 {
534 switch (af) {
535 case AF_INET:
536 return (getsockopt_ipv4_ifindex(msgh));
537 case AF_INET6:
538 return (getsockopt_ipv6_ifindex(msgh));
539 default:
540 flog_err(EC_LIB_DEVELOPMENT,
541 "getsockopt_ifindex: unknown address family %d", af);
542 return 0;
543 }
544 }
545
546 /* swab iph between order system uses for IP_HDRINCL and host order */
sockopt_iphdrincl_swab_htosys(struct ip * iph)547 void sockopt_iphdrincl_swab_htosys(struct ip *iph)
548 {
549 /* BSD and derived take iph in network order, except for
550 * ip_len and ip_off
551 */
552 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
553 iph->ip_len = htons(iph->ip_len);
554 iph->ip_off = htons(iph->ip_off);
555 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
556
557 iph->ip_id = htons(iph->ip_id);
558 }
559
sockopt_iphdrincl_swab_systoh(struct ip * iph)560 void sockopt_iphdrincl_swab_systoh(struct ip *iph)
561 {
562 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
563 iph->ip_len = ntohs(iph->ip_len);
564 iph->ip_off = ntohs(iph->ip_off);
565 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
566
567 iph->ip_id = ntohs(iph->ip_id);
568 }
569
sockopt_tcp_rtt(int sock)570 int sockopt_tcp_rtt(int sock)
571 {
572 #ifdef TCP_INFO
573 struct tcp_info ti;
574 socklen_t len = sizeof(ti);
575
576 if (getsockopt(sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
577 return 0;
578
579 return ti.tcpi_rtt / 1000;
580 #else
581 return 0;
582 #endif
583 }
584
sockopt_tcp_signature_ext(int sock,union sockunion * su,uint16_t prefixlen,const char * password)585 int sockopt_tcp_signature_ext(int sock, union sockunion *su, uint16_t prefixlen,
586 const char *password)
587 {
588 #ifndef HAVE_DECL_TCP_MD5SIG
589 /*
590 * We have been asked to enable MD5 auth for an address, but our
591 * platform doesn't support that
592 */
593 return -2;
594 #endif
595
596 #ifndef TCP_MD5SIG_EXT
597 /*
598 * We have been asked to enable MD5 auth for a prefix, but our platform
599 * doesn't support that
600 */
601 if (prefixlen > 0)
602 return -2;
603 #endif
604
605 #if HAVE_DECL_TCP_MD5SIG
606 int ret;
607
608 int optname = TCP_MD5SIG;
609 #ifndef GNU_LINUX
610 /*
611 * XXX Need to do PF_KEY operation here to add/remove an SA entry,
612 * and add/remove an SP entry for this peer's packet flows also.
613 */
614 int md5sig = password && *password ? 1 : 0;
615 #else
616 int keylen = password ? strlen(password) : 0;
617 struct tcp_md5sig md5sig;
618 union sockunion *su2, *susock;
619
620 /* Figure out whether the socket and the sockunion are the same family..
621 * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
622 */
623 if (!(susock = sockunion_getsockname(sock)))
624 return -1;
625
626 if (susock->sa.sa_family == su->sa.sa_family)
627 su2 = su;
628 else {
629 /* oops.. */
630 su2 = susock;
631
632 if (su2->sa.sa_family == AF_INET) {
633 sockunion_free(susock);
634 return 0;
635 }
636
637 /* If this does not work, then all users of this sockopt will
638 * need to
639 * differentiate between IPv4 and IPv6, and keep seperate
640 * sockets for
641 * each.
642 *
643 * Sadly, it doesn't seem to work at present. It's unknown
644 * whether
645 * this is a bug or not.
646 */
647 if (su2->sa.sa_family == AF_INET6
648 && su->sa.sa_family == AF_INET) {
649 su2->sin6.sin6_family = AF_INET6;
650 /* V4Map the address */
651 memset(&su2->sin6.sin6_addr, 0,
652 sizeof(struct in6_addr));
653 su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
654 memcpy(&su2->sin6.sin6_addr.s6_addr32[3],
655 &su->sin.sin_addr, 4);
656 }
657 }
658
659 memset(&md5sig, 0, sizeof(md5sig));
660 memcpy(&md5sig.tcpm_addr, su2, sizeof(*su2));
661
662 md5sig.tcpm_keylen = keylen;
663 if (keylen)
664 memcpy(md5sig.tcpm_key, password, keylen);
665 sockunion_free(susock);
666
667 /*
668 * Handle support for MD5 signatures on prefixes, if available and
669 * requested. Technically the #ifdef check below is not needed because
670 * if prefixlen > 0 and we don't have support for this feature we would
671 * have already returned by now, but leaving it there to be explicit.
672 */
673 #ifdef TCP_MD5SIG_EXT
674 if (prefixlen > 0) {
675 md5sig.tcpm_prefixlen = prefixlen;
676 md5sig.tcpm_flags = TCP_MD5SIG_FLAG_PREFIX;
677 optname = TCP_MD5SIG_EXT;
678 }
679 #endif /* TCP_MD5SIG_EXT */
680
681 #endif /* GNU_LINUX */
682
683 if ((ret = setsockopt(sock, IPPROTO_TCP, optname, &md5sig,
684 sizeof(md5sig)))
685 < 0) {
686 /* ENOENT is harmless. It is returned when we clear a password
687 for which
688 one was not previously set. */
689 if (ENOENT == errno)
690 ret = 0;
691 else
692 flog_err_sys(
693 EC_LIB_SYSTEM_CALL,
694 "sockopt_tcp_signature: setsockopt(%d): %s",
695 sock, safe_strerror(errno));
696 }
697 return ret;
698 #endif /* HAVE_TCP_MD5SIG */
699
700 /*
701 * Making compiler happy. If we get to this point we probably
702 * have done something really really wrong.
703 */
704 return -2;
705 }
706
sockopt_tcp_signature(int sock,union sockunion * su,const char * password)707 int sockopt_tcp_signature(int sock, union sockunion *su, const char *password)
708 {
709 return sockopt_tcp_signature_ext(sock, su, 0, password);
710 }
711