1 /* setsockopt functions
2  * Copyright (C) 1999 Kunihiro Ishiguro
3  *
4  * This file is part of GNU Zebra.
5  *
6  * GNU Zebra is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License as published by the
8  * Free Software Foundation; either version 2, or (at your option) any
9  * later version.
10  *
11  * GNU Zebra is distributed in the hope that it will be useful, but
12  * WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with GNU Zebra; see the file COPYING.  If not, write to the Free
18  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
19  * 02111-1307, USA.
20  */
21 
22 #include <zebra.h>
23 
24 #ifdef SUNOS_5
25 #include <ifaddrs.h>
26 #endif
27 
28 #include "log.h"
29 #include "sockopt.h"
30 #include "sockunion.h"
31 
32 int
setsockopt_so_recvbuf(int sock,int size)33 setsockopt_so_recvbuf (int sock, int size)
34 {
35   int ret;
36 
37   if ( (ret = setsockopt (sock, SOL_SOCKET, SO_RCVBUF, (char *)
38                           &size, sizeof (int))) < 0)
39     zlog_err ("fd %d: can't setsockopt SO_RCVBUF to %d: %s",
40 	      sock,size,safe_strerror(errno));
41 
42   return ret;
43 }
44 
45 int
setsockopt_so_sendbuf(const int sock,int size)46 setsockopt_so_sendbuf (const int sock, int size)
47 {
48   int ret = setsockopt (sock, SOL_SOCKET, SO_SNDBUF,
49     (char *)&size, sizeof (int));
50 
51   if (ret < 0)
52     zlog_err ("fd %d: can't setsockopt SO_SNDBUF to %d: %s",
53       sock, size, safe_strerror (errno));
54 
55   return ret;
56 }
57 
58 int
getsockopt_so_sendbuf(const int sock)59 getsockopt_so_sendbuf (const int sock)
60 {
61   u_int32_t optval;
62   socklen_t optlen = sizeof (optval);
63   int ret = getsockopt (sock, SOL_SOCKET, SO_SNDBUF,
64     (char *)&optval, &optlen);
65   if (ret < 0)
66   {
67     zlog_err ("fd %d: can't getsockopt SO_SNDBUF: %d (%s)",
68       sock, errno, safe_strerror (errno));
69     return ret;
70   }
71   return optval;
72 }
73 
74 static void *
getsockopt_cmsg_data(struct msghdr * msgh,int level,int type)75 getsockopt_cmsg_data (struct msghdr *msgh, int level, int type)
76 {
77   struct cmsghdr *cmsg;
78   void *ptr = NULL;
79 
80   for (cmsg = ZCMSG_FIRSTHDR(msgh);
81        cmsg != NULL;
82        cmsg = CMSG_NXTHDR(msgh, cmsg))
83     if (cmsg->cmsg_level == level && cmsg->cmsg_type)
84       return (ptr = CMSG_DATA(cmsg));
85 
86   return NULL;
87 }
88 
89 #ifdef HAVE_IPV6
90 /* Set IPv6 packet info to the socket. */
91 int
setsockopt_ipv6_pktinfo(int sock,int val)92 setsockopt_ipv6_pktinfo (int sock, int val)
93 {
94   int ret;
95 
96 #ifdef IPV6_RECVPKTINFO		/*2292bis-01*/
97   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val, sizeof(val));
98   if (ret < 0)
99     zlog_warn ("can't setsockopt IPV6_RECVPKTINFO : %s", safe_strerror (errno));
100 #else	/*RFC2292*/
101   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
102   if (ret < 0)
103     zlog_warn ("can't setsockopt IPV6_PKTINFO : %s", safe_strerror (errno));
104 #endif /* INIA_IPV6 */
105   return ret;
106 }
107 
108 /* Set multicast hops val to the socket. */
109 int
setsockopt_ipv6_checksum(int sock,int val)110 setsockopt_ipv6_checksum (int sock, int val)
111 {
112   int ret;
113 
114 #ifdef GNU_LINUX
115   ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
116 #else
117   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
118 #endif /* GNU_LINUX */
119   if (ret < 0)
120     zlog_warn ("can't setsockopt IPV6_CHECKSUM");
121   return ret;
122 }
123 
124 /* Set multicast hops val to the socket. */
125 int
setsockopt_ipv6_multicast_hops(int sock,int val)126 setsockopt_ipv6_multicast_hops (int sock, int val)
127 {
128   int ret;
129 
130   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
131   if (ret < 0)
132     zlog_warn ("can't setsockopt IPV6_MULTICAST_HOPS");
133   return ret;
134 }
135 
136 /* Set multicast hops val to the socket. */
137 int
setsockopt_ipv6_unicast_hops(int sock,int val)138 setsockopt_ipv6_unicast_hops (int sock, int val)
139 {
140   int ret;
141 
142   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
143   if (ret < 0)
144     zlog_warn ("can't setsockopt IPV6_UNICAST_HOPS");
145   return ret;
146 }
147 
148 int
setsockopt_ipv6_hoplimit(int sock,int val)149 setsockopt_ipv6_hoplimit (int sock, int val)
150 {
151   int ret;
152 
153 #ifdef IPV6_RECVHOPLIMIT	/*2292bis-01*/
154   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val, sizeof(val));
155   if (ret < 0)
156     zlog_warn ("can't setsockopt IPV6_RECVHOPLIMIT");
157 #else	/*RFC2292*/
158   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
159   if (ret < 0)
160     zlog_warn ("can't setsockopt IPV6_HOPLIMIT");
161 #endif
162   return ret;
163 }
164 
165 /* Set multicast loop zero to the socket. */
166 int
setsockopt_ipv6_multicast_loop(int sock,int val)167 setsockopt_ipv6_multicast_loop (int sock, int val)
168 {
169   int ret;
170 
171   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
172 		    sizeof (val));
173   if (ret < 0)
174     zlog_warn ("can't setsockopt IPV6_MULTICAST_LOOP");
175   return ret;
176 }
177 
178 static int
getsockopt_ipv6_ifindex(struct msghdr * msgh)179 getsockopt_ipv6_ifindex (struct msghdr *msgh)
180 {
181   struct in6_pktinfo *pktinfo;
182 
183   pktinfo = getsockopt_cmsg_data (msgh, IPPROTO_IPV6, IPV6_PKTINFO);
184 
185   return pktinfo->ipi6_ifindex;
186 }
187 
188 int
setsockopt_ipv6_tclass(int sock,int tclass)189 setsockopt_ipv6_tclass(int sock, int tclass)
190 {
191   int ret = 0;
192 
193 #ifdef IPV6_TCLASS /* RFC3542 */
194   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass, sizeof (tclass));
195   if (ret < 0)
196     zlog_warn ("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
197 	       sock, tclass, safe_strerror(errno));
198 #endif
199   return ret;
200 }
201 #endif /* HAVE_IPV6 */
202 
203 /*
204  * Process multicast socket options for IPv4 in an OS-dependent manner.
205  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
206  *
207  * Many operating systems have a limit on the number of groups that
208  * can be joined per socket (where each group and local address
209  * counts).  This impacts OSPF, which joins groups on each interface
210  * using a single socket.  The limit is typically 20, derived from the
211  * original BSD multicast implementation.  Some systems have
212  * mechanisms for increasing this limit.
213  *
214  * In many 4.4BSD-derived systems, multicast group operations are not
215  * allowed on interfaces that are not UP.  Thus, a previous attempt to
216  * leave the group may have failed, leaving it still joined, and we
217  * drop/join quietly to recover.  This may not be necessary, but aims to
218  * defend against unknown behavior in that we will still return an error
219  * if the second join fails.  It is not clear how other systems
220  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
221  * but this behavior should not be harmful if they behave the same way,
222  * allow leaves, or implicitly leave all groups joined to down interfaces.
223  */
224 int
setsockopt_ipv4_multicast(int sock,int optname,unsigned int mcast_addr,ifindex_t ifindex)225 setsockopt_ipv4_multicast(int sock,
226 			int optname,
227 			unsigned int mcast_addr,
228 			ifindex_t ifindex)
229 {
230 #ifdef HAVE_RFC3678
231   struct group_req gr;
232   struct sockaddr_in *si;
233   int ret;
234   memset (&gr, 0, sizeof(gr));
235   si = (struct sockaddr_in *)&gr.gr_group;
236   gr.gr_interface = ifindex;
237   si->sin_family = AF_INET;
238 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
239   si->sin_len = sizeof(struct sockaddr_in);
240 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
241   si->sin_addr.s_addr = mcast_addr;
242   ret = setsockopt(sock, IPPROTO_IP, (optname == IP_ADD_MEMBERSHIP) ?
243     MCAST_JOIN_GROUP : MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
244   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
245     {
246       setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
247       ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP, (void *)&gr, sizeof(gr));
248     }
249   return ret;
250 
251 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
252   struct ip_mreqn mreqn;
253   int ret;
254 
255   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
256   memset (&mreqn, 0, sizeof(mreqn));
257 
258   mreqn.imr_multiaddr.s_addr = mcast_addr;
259   mreqn.imr_ifindex = ifindex;
260 
261   ret = setsockopt(sock, IPPROTO_IP, optname,
262                    (void *)&mreqn, sizeof(mreqn));
263   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
264     {
265       /* see above: handle possible problem when interface comes back up */
266       char buf[1][INET_ADDRSTRLEN];
267       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
268                 "re-add (fd %d, mcast %s, ifindex %u)",
269                 sock,
270                 inet_ntop(AF_INET, &mreqn.imr_multiaddr,
271                           buf[0], sizeof(buf[0])), ifindex);
272       setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
273                  (void *)&mreqn, sizeof(mreqn));
274       ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
275                        (void *)&mreqn, sizeof(mreqn));
276     }
277   return ret;
278 
279   /* Example defines for another OS, boilerplate off other code in this
280      function, AND handle optname as per other sections for consistency !! */
281   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
282   /* Add your favourite OS here! */
283 
284 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
285   /* standard BSD API */
286 
287   struct in_addr m;
288   struct ip_mreq mreq;
289   int ret;
290 
291   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
292 
293   m.s_addr = htonl(ifindex);
294 
295   memset (&mreq, 0, sizeof(mreq));
296   mreq.imr_multiaddr.s_addr = mcast_addr;
297   mreq.imr_interface = m;
298 
299   ret = setsockopt (sock, IPPROTO_IP, optname, (void *)&mreq, sizeof(mreq));
300   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
301     {
302       /* see above: handle possible problem when interface comes back up */
303       char buf[1][INET_ADDRSTRLEN];
304       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
305                 "re-add (fd %d, mcast %s, ifindex %u)",
306                 sock,
307                 inet_ntop(AF_INET, &mreq.imr_multiaddr,
308                           buf[0], sizeof(buf[0])), ifindex);
309       setsockopt (sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
310                   (void *)&mreq, sizeof(mreq));
311       ret = setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
312                         (void *)&mreq, sizeof(mreq));
313     }
314   return ret;
315 
316 #else
317   #error "Unsupported multicast API"
318 #endif /* #if OS_TYPE */
319 
320 }
321 
322 /*
323  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
324  */
325 int
setsockopt_ipv4_multicast_if(int sock,ifindex_t ifindex)326 setsockopt_ipv4_multicast_if(int sock, ifindex_t ifindex)
327 {
328 
329 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
330   struct ip_mreqn mreqn;
331   memset (&mreqn, 0, sizeof(mreqn));
332 
333   mreqn.imr_ifindex = ifindex;
334   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn, sizeof(mreqn));
335 
336   /* Example defines for another OS, boilerplate off other code in this
337      function */
338   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
339   /* Add your favourite OS here! */
340 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
341   struct in_addr m;
342 
343   m.s_addr = htonl(ifindex);
344 
345   return setsockopt (sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m, sizeof(m));
346 #elif defined(SUNOS_5)
347   char ifname[IF_NAMESIZE];
348   struct ifaddrs *ifa, *ifap;
349   struct in_addr ifaddr;
350 
351   if (if_indextoname(ifindex, ifname) == NULL)
352     return -1;
353 
354   if (getifaddrs(&ifa) != 0)
355     return -1;
356 
357   for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next)
358     {
359       struct sockaddr_in *sa;
360 
361       if (strcmp(ifap->ifa_name, ifname) != 0)
362         continue;
363       if (ifap->ifa_addr->sa_family != AF_INET)
364         continue;
365       sa = (struct sockaddr_in*)ifap->ifa_addr;
366       memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
367       break;
368     }
369 
370   freeifaddrs(ifa);
371   if (!ifap) /* This means we did not find an IP */
372     return -1;
373 
374   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr, sizeof(ifaddr));
375 #else
376   #error "Unsupported multicast API"
377 #endif
378 }
379 
380 static int
setsockopt_ipv4_ifindex(int sock,ifindex_t val)381 setsockopt_ipv4_ifindex (int sock, ifindex_t val)
382 {
383   int ret;
384 
385 #if defined (IP_PKTINFO)
386   if ((ret = setsockopt (sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof (val))) < 0)
387     zlog_warn ("Can't set IP_PKTINFO option for fd %d to %d: %s",
388 	       sock,val,safe_strerror(errno));
389 #elif defined (IP_RECVIF)
390   if ((ret = setsockopt (sock, IPPROTO_IP, IP_RECVIF, &val, sizeof (val))) < 0)
391     zlog_warn ("Can't set IP_RECVIF option for fd %d to %d: %s",
392 	       sock,val,safe_strerror(errno));
393 #else
394 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
395 #warning "Will not be able to receive link info."
396 #warning "Things might be seriously broken.."
397   /* XXX Does this ever happen?  Should there be a zlog_warn message here? */
398   ret = -1;
399 #endif
400   return ret;
401 }
402 
403 int
setsockopt_ipv4_tos(int sock,int tos)404 setsockopt_ipv4_tos(int sock, int tos)
405 {
406   int ret;
407 
408   ret = setsockopt (sock, IPPROTO_IP, IP_TOS, &tos, sizeof (tos));
409   if (ret < 0)
410     zlog_warn ("Can't set IP_TOS option for fd %d to %#x: %s",
411 	       sock, tos, safe_strerror(errno));
412   return ret;
413 }
414 
415 
416 int
setsockopt_ifindex(int af,int sock,ifindex_t val)417 setsockopt_ifindex (int af, int sock, ifindex_t val)
418 {
419   int ret = -1;
420 
421   switch (af)
422     {
423       case AF_INET:
424         ret = setsockopt_ipv4_ifindex (sock, val);
425         break;
426 #ifdef HAVE_IPV6
427       case AF_INET6:
428         ret = setsockopt_ipv6_pktinfo (sock, val);
429         break;
430 #endif
431       default:
432         zlog_warn ("setsockopt_ifindex: unknown address family %d", af);
433     }
434   return ret;
435 }
436 
437 /*
438  * Requires: msgh is not NULL and points to a valid struct msghdr, which
439  * may or may not have control data about the incoming interface.
440  *
441  * Returns the interface index (small integer >= 1) if it can be
442  * determined, or else 0.
443  */
444 static ifindex_t
getsockopt_ipv4_ifindex(struct msghdr * msgh)445 getsockopt_ipv4_ifindex (struct msghdr *msgh)
446 {
447   /* XXX: initialize to zero?  (Always overwritten, so just cosmetic.) */
448   ifindex_t ifindex = -1;
449 
450 #if defined(IP_PKTINFO)
451 /* Linux pktinfo based ifindex retrieval */
452   struct in_pktinfo *pktinfo;
453 
454   pktinfo =
455     (struct in_pktinfo *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_PKTINFO);
456   /* XXX Can pktinfo be NULL?  Clean up post 0.98. */
457   ifindex = pktinfo->ipi_ifindex;
458 
459 #elif defined(IP_RECVIF)
460 
461   /* retrieval based on IP_RECVIF */
462 
463 #ifndef SUNOS_5
464   /* BSD systems use a sockaddr_dl as the control message payload. */
465   struct sockaddr_dl *sdl;
466 #else
467   /* SUNOS_5 uses an integer with the index. */
468   ifindex_t *ifindex_p;
469 #endif /* SUNOS_5 */
470 
471 #ifndef SUNOS_5
472   /* BSD */
473   sdl =
474     (struct sockaddr_dl *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
475   if (sdl != NULL)
476     ifindex = sdl->sdl_index;
477   else
478     ifindex = 0;
479 #else
480   /*
481    * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
482    * enable it fails with errno=99, and the struct msghdr has
483    * controllen 0.
484    */
485   ifindex_p = (uint_t *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
486   if (ifindex_p != NULL)
487     ifindex = *ifindex_p;
488   else
489     ifindex = 0;
490 #endif /* SUNOS_5 */
491 
492 #else
493   /*
494    * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
495    * XXX Decide if this is a core service, or if daemons have to cope.
496    * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
497    * daemons have to cope.
498    */
499 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
500 #warning "Some daemons may fail to operate correctly!"
501   ifindex = 0;
502 
503 #endif /* IP_PKTINFO */
504 
505   return ifindex;
506 }
507 
508 /* return ifindex, 0 if none found */
509 ifindex_t
getsockopt_ifindex(int af,struct msghdr * msgh)510 getsockopt_ifindex (int af, struct msghdr *msgh)
511 {
512   switch (af)
513     {
514       case AF_INET:
515         return (getsockopt_ipv4_ifindex (msgh));
516         break;
517 #ifdef HAVE_IPV6
518       case AF_INET6:
519         return (getsockopt_ipv6_ifindex (msgh));
520         break;
521 #endif
522       default:
523         zlog_warn ("getsockopt_ifindex: unknown address family %d", af);
524         return 0;
525     }
526 }
527 
528 /* swab iph between order system uses for IP_HDRINCL and host order */
529 void
sockopt_iphdrincl_swab_htosys(struct ip * iph)530 sockopt_iphdrincl_swab_htosys (struct ip *iph)
531 {
532   /* BSD and derived take iph in network order, except for
533    * ip_len and ip_off
534    */
535 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
536   iph->ip_len = htons(iph->ip_len);
537   iph->ip_off = htons(iph->ip_off);
538 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
539 
540   iph->ip_id = htons(iph->ip_id);
541 }
542 
543 void
sockopt_iphdrincl_swab_systoh(struct ip * iph)544 sockopt_iphdrincl_swab_systoh (struct ip *iph)
545 {
546 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
547   iph->ip_len = ntohs(iph->ip_len);
548   iph->ip_off = ntohs(iph->ip_off);
549 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
550 
551   iph->ip_id = ntohs(iph->ip_id);
552 }
553 
554 int
sockopt_tcp_rtt(int sock)555 sockopt_tcp_rtt (int sock)
556 {
557 #ifdef TCP_INFO
558   struct tcp_info ti;
559   socklen_t len = sizeof(ti);
560 
561   if (getsockopt (sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
562     return 0;
563 
564   return ti.tcpi_rtt / 1000;
565 #else
566   return 0;
567 #endif
568 }
569 
570 int
sockopt_tcp_signature(int sock,union sockunion * su,const char * password)571 sockopt_tcp_signature (int sock, union sockunion *su, const char *password)
572 {
573 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
574   /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
575    * version of the Quagga patch (based on work by Rick Payne, and Bruce
576    * Simpson)
577    */
578 #define TCP_MD5_AUTH 13
579 #define TCP_MD5_AUTH_ADD 1
580 #define TCP_MD5_AUTH_DEL 2
581   struct tcp_rfc2385_cmd {
582     u_int8_t     command;    /* Command - Add/Delete */
583     u_int32_t    address;    /* IPV4 address associated */
584     u_int8_t     keylen;     /* MD5 Key len (do NOT assume 0 terminated ascii) */
585     void         *key;       /* MD5 Key */
586   } cmd;
587   struct in_addr *addr = &su->sin.sin_addr;
588 
589   cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
590   cmd.address = addr->s_addr;
591   cmd.keylen = (password != NULL ? strlen (password) : 0);
592   cmd.key = password;
593 
594   return setsockopt (sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
595 
596 #elif HAVE_DECL_TCP_MD5SIG
597   int ret;
598 #ifndef GNU_LINUX
599   /*
600    * XXX Need to do PF_KEY operation here to add/remove an SA entry,
601    * and add/remove an SP entry for this peer's packet flows also.
602    */
603   int md5sig = password && *password ? 1 : 0;
604 #else
605   int keylen = password ? strlen (password) : 0;
606   struct tcp_md5sig md5sig;
607   union sockunion *su2, *susock;
608 
609   /* Figure out whether the socket and the sockunion are the same family..
610    * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
611    */
612   if (!(susock = sockunion_getsockname (sock)))
613     return -1;
614 
615   if (susock->sa.sa_family == su->sa.sa_family)
616     su2 = su;
617   else
618     {
619       /* oops.. */
620       su2 = susock;
621 
622       if (su2->sa.sa_family == AF_INET)
623         {
624           sockunion_free (susock);
625           return 0;
626         }
627 
628 #ifdef HAVE_IPV6
629       /* If this does not work, then all users of this sockopt will need to
630        * differentiate between IPv4 and IPv6, and keep seperate sockets for
631        * each.
632        *
633        * Sadly, it doesn't seem to work at present. It's unknown whether
634        * this is a bug or not.
635        */
636       if (su2->sa.sa_family == AF_INET6
637           && su->sa.sa_family == AF_INET)
638         {
639            su2->sin6.sin6_family = AF_INET6;
640            /* V4Map the address */
641            memset (&su2->sin6.sin6_addr, 0, sizeof (struct in6_addr));
642            su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
643            memcpy (&su2->sin6.sin6_addr.s6_addr32[3], &su->sin.sin_addr, 4);
644         }
645 #endif
646     }
647 
648   memset (&md5sig, 0, sizeof (md5sig));
649   memcpy (&md5sig.tcpm_addr, su2, sizeof (*su2));
650   md5sig.tcpm_keylen = keylen;
651   if (keylen)
652     memcpy (md5sig.tcpm_key, password, keylen);
653   sockunion_free (susock);
654 #endif /* GNU_LINUX */
655   if ((ret = setsockopt (sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig, sizeof md5sig)) < 0)
656     {
657       /* ENOENT is harmless.  It is returned when we clear a password for which
658 	 one was not previously set. */
659       if (ENOENT == errno)
660 	ret = 0;
661       else
662 	zlog_err ("sockopt_tcp_signature: setsockopt(%d): %s",
663 		  sock, safe_strerror(errno));
664     }
665   return ret;
666 #else /* HAVE_TCP_MD5SIG */
667   return -2;
668 #endif /* !HAVE_TCP_MD5SIG */
669 }
670