lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #ifdef SUNOS_5
  24 #include <ifaddrs.h>
  25 #endif
  26
  27 #include "log.h"
  28 #include "sockopt.h"
  29 #include "sockunion.h"
  30 #include "lib_errors.h"
  31
  32 void setsockopt_so_recvbuf(int sock, int size)
  33 {
  34         int orig_req = size;
  35
  36         while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof(size))
  37                == -1)
  38                 size /= 2;
  39
  40         if (size != orig_req)
  41                 flog_err(EC_LIB_SOCKET,
  42                          "%s: fd %d: SO_RCVBUF set to %d (requested %d)",
  43                          __func__, sock, size, orig_req);
  44 }
  45
  46 void setsockopt_so_sendbuf(const int sock, int size)
  47 {
  48         int orig_req = size;
  49
  50         while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size))
  51                == -1)
  52                 size /= 2;
  53
  54         if (size != orig_req)
  55                 flog_err(EC_LIB_SOCKET,
  56                          "%s: fd %d: SO_SNDBUF set to %d (requested %d)",
  57                          __func__, sock, size, orig_req);
  58 }
  59
  60 int getsockopt_so_sendbuf(const int sock)
  61 {
  62         uint32_t optval;
  63         socklen_t optlen = sizeof(optval);
  64         int ret = getsockopt(sock, SOL_SOCKET, SO_SNDBUF, (char *)&optval,
  65                              &optlen);
  66         if (ret < 0) {
  67                 flog_err_sys(EC_LIB_SYSTEM_CALL,
  68                              "fd %d: can't getsockopt SO_SNDBUF: %d (%s)", sock,
  69                              errno, safe_strerror(errno));
  70                 return ret;
  71         }
  72         return optval;
  73 }
  74
  75 int getsockopt_so_recvbuf(const int sock)
  76 {
  77         uint32_t optval;
  78         socklen_t optlen = sizeof(optval);
  79         int ret = getsockopt(sock, SOL_SOCKET, SO_RCVBUF, (char *)&optval,
  80                              &optlen);
  81         if (ret < 0) {
  82                 flog_err_sys(EC_LIB_SYSTEM_CALL,
  83                              "fd %d: can't getsockopt SO_RCVBUF: %d (%s)", sock,
  84                              errno, safe_strerror(errno));
  85                 return ret;
  86         }
  87         return optval;
  88 }
  89
  90 static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
  91 {
  92         struct cmsghdr *cmsg;
  93
  94         for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL;
  95              cmsg = CMSG_NXTHDR(msgh, cmsg))
  96                 if (cmsg->cmsg_level == level && cmsg->cmsg_type == type)
  97                         return CMSG_DATA(cmsg);
  98
  99         return NULL;
 100 }
 101
 102 /* Set IPv6 packet info to the socket. */
 103 int setsockopt_ipv6_pktinfo(int sock, int val)
 104 {
 105         int ret;
 106
 107 #ifdef IPV6_RECVPKTINFO /*2292bis-01*/
 108         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val,
 109                          sizeof(val));
 110         if (ret < 0)
 111                 flog_err(EC_LIB_SOCKET,
 112                          "can't setsockopt IPV6_RECVPKTINFO : %s",
 113                          safe_strerror(errno));
 114 #else  /*RFC2292*/
 115         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
 116         if (ret < 0)
 117                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_PKTINFO : %s",
 118                          safe_strerror(errno));
 119 #endif /* INIA_IPV6 */
 120         return ret;
 121 }
 122
 123 /* Set multicast hops val to the socket. */
 124 int setsockopt_ipv6_multicast_hops(int sock, int val)
 125 {
 126         int ret;
 127
 128         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val,
 129                          sizeof(val));
 130         if (ret < 0)
 131                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_HOPS");
 132         return ret;
 133 }
 134
 135 /* Set multicast hops val to the socket. */
 136 int setsockopt_ipv6_unicast_hops(int sock, int val)
 137 {
 138         int ret;
 139
 140         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val,
 141                          sizeof(val));
 142         if (ret < 0)
 143                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_UNICAST_HOPS");
 144         return ret;
 145 }
 146
 147 int setsockopt_ipv6_hoplimit(int sock, int val)
 148 {
 149         int ret;
 150
 151 #ifdef IPV6_RECVHOPLIMIT /*2292bis-01*/
 152         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val,
 153                          sizeof(val));
 154         if (ret < 0)
 155                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_RECVHOPLIMIT");
 156 #else /*RFC2292*/
 157         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 158         if (ret < 0)
 159                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_HOPLIMIT");
 160 #endif
 161         return ret;
 162 }
 163
 164 /* Set multicast loop zero to the socket. */
 165 int setsockopt_ipv6_multicast_loop(int sock, int val)
 166 {
 167         int ret;
 168
 169         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 170                          sizeof(val));
 171         if (ret < 0)
 172                 flog_err(EC_LIB_SOCKET, "can't setsockopt IPV6_MULTICAST_LOOP");
 173         return ret;
 174 }
 175
 176 static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
 177 {
 178         struct in6_pktinfo *pktinfo;
 179
 180         pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 181
 182         return pktinfo->ipi6_ifindex;
 183 }
 184
 185 int setsockopt_ipv6_tclass(int sock, int tclass)
 186 {
 187         int ret = 0;
 188
 189 #ifdef IPV6_TCLASS /* RFC3542 */
 190         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass,
 191                          sizeof(tclass));
 192         if (ret < 0)
 193                 flog_err(EC_LIB_SOCKET,
 194                          "Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 195                          sock, tclass, safe_strerror(errno));
 196 #endif
 197         return ret;
 198 }
 199
 200 /*
 201  * Process multicast socket options for IPv4 in an OS-dependent manner.
 202  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 203  *
 204  * Many operating systems have a limit on the number of groups that
 205  * can be joined per socket (where each group and local address
 206  * counts).  This impacts OSPF, which joins groups on each interface
 207  * using a single socket.  The limit is typically 20, derived from the
 208  * original BSD multicast implementation.  Some systems have
 209  * mechanisms for increasing this limit.
 210  *
 211  * In many 4.4BSD-derived systems, multicast group operations are not
 212  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 213  * leave the group may have failed, leaving it still joined, and we
 214  * drop/join quietly to recover.  This may not be necessary, but aims to
 215  * defend against unknown behavior in that we will still return an error
 216  * if the second join fails.  It is not clear how other systems
 217  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 218  * but this behavior should not be harmful if they behave the same way,
 219  * allow leaves, or implicitly leave all groups joined to down interfaces.
 220  */
 221 int setsockopt_ipv4_multicast(int sock, int optname, struct in_addr if_addr,
 222                               unsigned int mcast_addr, ifindex_t ifindex)
 223 {
 224 #ifdef HAVE_RFC3678
 225         struct group_req gr;
 226         struct sockaddr_in *si;
 227         int ret;
 228         memset(&gr, 0, sizeof(gr));
 229         si = (struct sockaddr_in *)&gr.gr_group;
 230         gr.gr_interface = ifindex;
 231         si->sin_family = AF_INET;
 232 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 233         si->sin_len = sizeof(struct sockaddr_in);
 234 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 235         si->sin_addr.s_addr = mcast_addr;
 236         ret = setsockopt(sock, IPPROTO_IP,
 237                          (optname == IP_ADD_MEMBERSHIP) ? MCAST_JOIN_GROUP
 238                                                         : MCAST_LEAVE_GROUP,
 239                          (void *)&gr, sizeof(gr));
 240         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 241             && (errno == EADDRINUSE)) {
 242                 setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr,
 243                            sizeof(gr));
 244                 ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP,
 245                                  (void *)&gr, sizeof(gr));
 246         }
 247         return ret;
 248
 249 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 250         struct ip_mreqn mreqn;
 251         int ret;
 252
 253         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 254         memset(&mreqn, 0, sizeof(mreqn));
 255
 256         mreqn.imr_multiaddr.s_addr = mcast_addr;
 257         mreqn.imr_ifindex = ifindex;
 258
 259         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreqn,
 260                          sizeof(mreqn));
 261         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 262             && (errno == EADDRINUSE)) {
 263                 /* see above: handle possible problem when interface comes back
 264                  * up */
 265                 char buf[1][INET_ADDRSTRLEN];
 266                 zlog_info(
 267                         "setsockopt_ipv4_multicast attempting to drop and "
 268                         "re-add (fd %d, mcast %s, ifindex %u)",
 269                         sock, inet_ntop(AF_INET, &mreqn.imr_multiaddr, buf[0],
 270                                         sizeof(buf[0])),
 271                         ifindex);
 272                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreqn,
 273                            sizeof(mreqn));
 274                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 275                                  (void *)&mreqn, sizeof(mreqn));
 276         }
 277         return ret;
 278
 279 /* Example defines for another OS, boilerplate off other code in this
 280    function, AND handle optname as per other sections for consistency !! */
 281 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 282 /* Add your favourite OS here! */
 283
 284 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 285         /* standard BSD API */
 286
 287         struct ip_mreq mreq;
 288         int ret;
 289
 290         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 291
 292
 293         memset(&mreq, 0, sizeof(mreq));
 294         mreq.imr_multiaddr.s_addr = mcast_addr;
 295 #if !defined __OpenBSD__
 296         mreq.imr_interface.s_addr = htonl(ifindex);
 297 #else
 298         mreq.imr_interface.s_addr = if_addr.s_addr;
 299 #endif
 300
 301         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreq,
 302                          sizeof(mreq));
 303         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 304             && (errno == EADDRINUSE)) {
 305                 /* see above: handle possible problem when interface comes back
 306                  * up */
 307                 char buf[1][INET_ADDRSTRLEN];
 308                 zlog_info(
 309                         "setsockopt_ipv4_multicast attempting to drop and "
 310                         "re-add (fd %d, mcast %s, ifindex %u)",
 311                         sock, inet_ntop(AF_INET, &mreq.imr_multiaddr, buf[0],
 312                                         sizeof(buf[0])),
 313                         ifindex);
 314                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreq,
 315                            sizeof(mreq));
 316                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 317                                  (void *)&mreq, sizeof(mreq));
 318         }
 319         return ret;
 320
 321 #else
 322 #error "Unsupported multicast API"
 323 #endif /* #if OS_TYPE */
 324 }
 325
 326 /*
 327  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 328  */
 329 int setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 330                                  ifindex_t ifindex)
 331 {
 332
 333 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 334         struct ip_mreqn mreqn;
 335         memset(&mreqn, 0, sizeof(mreqn));
 336
 337         mreqn.imr_ifindex = ifindex;
 338         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn,
 339                           sizeof(mreqn));
 340
 341 /* Example defines for another OS, boilerplate off other code in this
 342    function */
 343 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 344 /* Add your favourite OS here! */
 345 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 346         struct in_addr m;
 347
 348 #if !defined __OpenBSD__
 349         m.s_addr = htonl(ifindex);
 350 #else
 351         m.s_addr = if_addr.s_addr;
 352 #endif
 353
 354         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m,
 355                           sizeof(m));
 356 #elif defined(SUNOS_5)
 357         char ifname[IF_NAMESIZE];
 358         struct ifaddrs *ifa, *ifap;
 359         struct in_addr ifaddr;
 360
 361         if (if_indextoname(ifindex, ifname) == NULL)
 362                 return -1;
 363
 364         if (getifaddrs(&ifa) != 0)
 365                 return -1;
 366
 367         for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next) {
 368                 struct sockaddr_in *sa;
 369
 370                 if (strcmp(ifap->ifa_name, ifname) != 0)
 371                         continue;
 372                 if (ifap->ifa_addr->sa_family != AF_INET)
 373                         continue;
 374                 sa = (struct sockaddr_in *)ifap->ifa_addr;
 375                 memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 376                 break;
 377         }
 378
 379         freeifaddrs(ifa);
 380         if (!ifap) /* This means we did not find an IP */
 381                 return -1;
 382
 383         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr,
 384                           sizeof(ifaddr));
 385 #else
 386 #error "Unsupported multicast API"
 387 #endif
 388 }
 389
 390 int setsockopt_ipv4_multicast_loop(int sock, uint8_t val)
 391 {
 392         int ret;
 393
 394         ret = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *)&val,
 395                          sizeof(val));
 396         if (ret < 0)
 397                 flog_err(EC_LIB_SOCKET, "can't setsockopt IP_MULTICAST_LOOP");
 398
 399         return ret;
 400 }
 401
 402 static int setsockopt_ipv4_ifindex(int sock, ifindex_t val)
 403 {
 404         int ret;
 405
 406 #if defined(IP_PKTINFO)
 407         if ((ret = setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val)))
 408             < 0)
 409                 flog_err(EC_LIB_SOCKET,
 410                          "Can't set IP_PKTINFO option for fd %d to %d: %s",
 411                          sock, val, safe_strerror(errno));
 412 #elif defined(IP_RECVIF)
 413         if ((ret = setsockopt(sock, IPPROTO_IP, IP_RECVIF, &val, sizeof(val)))
 414             < 0)
 415                 flog_err(EC_LIB_SOCKET,
 416                          "Can't set IP_RECVIF option for fd %d to %d: %s", sock,
 417                          val, safe_strerror(errno));
 418 #else
 419 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 420 #warning "Will not be able to receive link info."
 421 #warning "Things might be seriously broken.."
 422         /* XXX Does this ever happen?  Should there be a zlog_warn message here?
 423          */
 424         ret = -1;
 425 #endif
 426         return ret;
 427 }
 428
 429 int setsockopt_ipv4_tos(int sock, int tos)
 430 {
 431         int ret;
 432
 433         ret = setsockopt(sock, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
 434         if (ret < 0)
 435                 flog_err(EC_LIB_SOCKET,
 436                          "Can't set IP_TOS option for fd %d to %#x: %s", sock,
 437                          tos, safe_strerror(errno));
 438         return ret;
 439 }
 440
 441
 442 int setsockopt_ifindex(int af, int sock, ifindex_t val)
 443 {
 444         int ret = -1;
 445
 446         switch (af) {
 447         case AF_INET:
 448                 ret = setsockopt_ipv4_ifindex(sock, val);
 449                 break;
 450         case AF_INET6:
 451                 ret = setsockopt_ipv6_pktinfo(sock, val);
 452                 break;
 453         default:
 454                 flog_err(EC_LIB_DEVELOPMENT,
 455                          "setsockopt_ifindex: unknown address family %d", af);
 456         }
 457         return ret;
 458 }
 459
 460 /*
 461  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 462  * may or may not have control data about the incoming interface.
 463  *
 464  * Returns the interface index (small integer >= 1) if it can be
 465  * determined, or else 0.
 466  */
 467 static ifindex_t getsockopt_ipv4_ifindex(struct msghdr *msgh)
 468 {
 469         ifindex_t ifindex;
 470
 471 #if defined(IP_PKTINFO)
 472         /* Linux pktinfo based ifindex retrieval */
 473         struct in_pktinfo *pktinfo;
 474
 475         pktinfo = (struct in_pktinfo *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 476                                                             IP_PKTINFO);
 477
 478         /* getsockopt_ifindex() will forward this, being 0 "not found" */
 479         if (pktinfo == NULL)
 480                 return 0;
 481
 482         ifindex = pktinfo->ipi_ifindex;
 483
 484 #elif defined(IP_RECVIF)
 485
 486 /* retrieval based on IP_RECVIF */
 487
 488 #ifndef SUNOS_5
 489         /* BSD systems use a sockaddr_dl as the control message payload. */
 490         struct sockaddr_dl *sdl;
 491 #else
 492         /* SUNOS_5 uses an integer with the index. */
 493         ifindex_t *ifindex_p;
 494 #endif /* SUNOS_5 */
 495
 496 #ifndef SUNOS_5
 497         /* BSD */
 498         sdl = (struct sockaddr_dl *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 499                                                          IP_RECVIF);
 500         if (sdl != NULL)
 501                 ifindex = sdl->sdl_index;
 502         else
 503                 ifindex = 0;
 504 #else
 505         /*
 506          * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 507          * enable it fails with errno=99, and the struct msghdr has
 508          * controllen 0.
 509          */
 510         ifindex_p = (uint_t *)getsockopt_cmsg_data(msgh, IPPROTO_IP, IP_RECVIF);
 511         if (ifindex_p != NULL)
 512                 ifindex = *ifindex_p;
 513         else
 514                 ifindex = 0;
 515 #endif /* SUNOS_5 */
 516
 517 #else
 518 /*
 519  * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 520  * XXX Decide if this is a core service, or if daemons have to cope.
 521  * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 522  * daemons have to cope.
 523  */
 524 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 525 #warning "Some daemons may fail to operate correctly!"
 526         ifindex = 0;
 527
 528 #endif /* IP_PKTINFO */
 529
 530         return ifindex;
 531 }
 532
 533 /* return ifindex, 0 if none found */
 534 ifindex_t getsockopt_ifindex(int af, struct msghdr *msgh)
 535 {
 536         switch (af) {
 537         case AF_INET:
 538                 return (getsockopt_ipv4_ifindex(msgh));
 539         case AF_INET6:
 540                 return (getsockopt_ipv6_ifindex(msgh));
 541         default:
 542                 flog_err(EC_LIB_DEVELOPMENT,
 543                          "getsockopt_ifindex: unknown address family %d", af);
 544                 return 0;
 545         }
 546 }
 547
 548 /* swab iph between order system uses for IP_HDRINCL and host order */
 549 void sockopt_iphdrincl_swab_htosys(struct ip *iph)
 550 {
 551 /* BSD and derived take iph in network order, except for
 552  * ip_len and ip_off
 553  */
 554 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 555         iph->ip_len = htons(iph->ip_len);
 556         iph->ip_off = htons(iph->ip_off);
 557 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 558
 559         iph->ip_id = htons(iph->ip_id);
 560 }
 561
 562 void sockopt_iphdrincl_swab_systoh(struct ip *iph)
 563 {
 564 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 565         iph->ip_len = ntohs(iph->ip_len);
 566         iph->ip_off = ntohs(iph->ip_off);
 567 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 568
 569         iph->ip_id = ntohs(iph->ip_id);
 570 }
 571
 572 int sockopt_tcp_rtt(int sock)
 573 {
 574 #ifdef TCP_INFO
 575         struct tcp_info ti;
 576         socklen_t len = sizeof(ti);
 577
 578         if (getsockopt(sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 579                 return 0;
 580
 581         return ti.tcpi_rtt / 1000;
 582 #else
 583         return 0;
 584 #endif
 585 }
 586
 587 int sockopt_tcp_signature_ext(int sock, union sockunion *su, uint16_t prefixlen,
 588                               const char *password)
 589 {
 590 #ifndef HAVE_DECL_TCP_MD5SIG
 591         /*
 592          * We have been asked to enable MD5 auth for an address, but our
 593          * platform doesn't support that
 594          */
 595         return -2;
 596 #endif
 597
 598 #ifndef TCP_MD5SIG_EXT
 599         /*
 600          * We have been asked to enable MD5 auth for a prefix, but our platform
 601          * doesn't support that
 602          */
 603         if (prefixlen > 0)
 604                 return -2;
 605 #endif
 606
 607 #if HAVE_DECL_TCP_MD5SIG
 608         int ret;
 609
 610         int optname = TCP_MD5SIG;
 611 #ifndef GNU_LINUX
 612         /*
 613          * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 614          * and add/remove an SP entry for this peer's packet flows also.
 615          */
 616         int md5sig = password && *password ? 1 : 0;
 617 #else
 618         int keylen = password ? strlen(password) : 0;
 619         struct tcp_md5sig md5sig;
 620         union sockunion *su2, *susock;
 621
 622         /* Figure out whether the socket and the sockunion are the same family..
 623          * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 624          */
 625         if (!(susock = sockunion_getsockname(sock)))
 626                 return -1;
 627
 628         if (susock->sa.sa_family == su->sa.sa_family)
 629                 su2 = su;
 630         else {
 631                 /* oops.. */
 632                 su2 = susock;
 633
 634                 if (su2->sa.sa_family == AF_INET) {
 635                         sockunion_free(susock);
 636                         return 0;
 637                 }
 638
 639                 /* If this does not work, then all users of this sockopt will
 640                  * need to
 641                  * differentiate between IPv4 and IPv6, and keep seperate
 642                  * sockets for
 643                  * each.
 644                  *
 645                  * Sadly, it doesn't seem to work at present. It's unknown
 646                  * whether
 647                  * this is a bug or not.
 648                  */
 649                 if (su2->sa.sa_family == AF_INET6
 650                     && su->sa.sa_family == AF_INET) {
 651                         su2->sin6.sin6_family = AF_INET6;
 652                         /* V4Map the address */
 653                         memset(&su2->sin6.sin6_addr, 0,
 654                                sizeof(struct in6_addr));
 655                         su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 656                         memcpy(&su2->sin6.sin6_addr.s6_addr32[3],
 657                                &su->sin.sin_addr, 4);
 658                 }
 659         }
 660
 661         memset(&md5sig, 0, sizeof(md5sig));
 662         memcpy(&md5sig.tcpm_addr, su2, sizeof(*su2));
 663
 664         md5sig.tcpm_keylen = keylen;
 665         if (keylen)
 666                 memcpy(md5sig.tcpm_key, password, keylen);
 667         sockunion_free(susock);
 668
 669         /*
 670          * Handle support for MD5 signatures on prefixes, if available and
 671          * requested. Technically the #ifdef check below is not needed because
 672          * if prefixlen > 0 and we don't have support for this feature we would
 673          * have already returned by now, but leaving it there to be explicit.
 674          */
 675 #ifdef TCP_MD5SIG_EXT
 676         if (prefixlen > 0) {
 677                 md5sig.tcpm_prefixlen = prefixlen;
 678                 md5sig.tcpm_flags = TCP_MD5SIG_FLAG_PREFIX;
 679                 optname = TCP_MD5SIG_EXT;
 680         }
 681 #endif /* TCP_MD5SIG_EXT */
 682
 683 #endif /* GNU_LINUX */
 684
 685         if ((ret = setsockopt(sock, IPPROTO_TCP, optname, &md5sig,
 686                               sizeof(md5sig)))
 687             < 0) {
 688                 /* ENOENT is harmless.  It is returned when we clear a password
 689                    for which
 690                    one was not previously set. */
 691                 if (ENOENT == errno)
 692                         ret = 0;
 693                 else
 694                         flog_err_sys(
 695                                 EC_LIB_SYSTEM_CALL,
 696                                 "sockopt_tcp_signature: setsockopt(%d): %s",
 697                                 sock, safe_strerror(errno));
 698         }
 699         return ret;
 700 #endif /* HAVE_TCP_MD5SIG */
 701
 702         /*
 703          * Making compiler happy.  If we get to this point we probably
 704          * have done something really really wrong.
 705          */
 706         return -2;
 707 }
 708
 709 int sockopt_tcp_signature(int sock, union sockunion *su, const char *password)
 710 {
 711         return sockopt_tcp_signature_ext(sock, su, 0, password);
 712 }