lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with GNU Zebra; see the file COPYING.  If not, write to the Free
  18  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  19  * 02111-1307, USA.
  20  */
  21
  22 #include <zebra.h>
  23
  24 #ifdef SUNOS_5
  25 #include <ifaddrs.h>
  26 #endif
  27
  28 #include "log.h"
  29 #include "sockopt.h"
  30 #include "sockunion.h"
  31
  32 void setsockopt_so_recvbuf(int sock, int size)
  33 {
  34         int orig_req = size;
  35
  36         while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof(size))
  37                == -1)
  38                 size /= 2;
  39
  40         if (size != orig_req)
  41                 zlog_warn("%s: fd %d: SO_RCVBUF set to %d (requested %d)",
  42                           __func__, sock, size, orig_req);
  43 }
  44
  45 void setsockopt_so_sendbuf(const int sock, int size)
  46 {
  47         int orig_req = size;
  48
  49         while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size))
  50                == -1)
  51                 size /= 2;
  52
  53         if (size != orig_req)
  54                 zlog_warn("%s: fd %d: SO_SNDBUF set to %d (requested %d)",
  55                           __func__, sock, size, orig_req);
  56 }
  57
  58 int getsockopt_so_sendbuf(const int sock)
  59 {
  60         u_int32_t optval;
  61         socklen_t optlen = sizeof(optval);
  62         int ret = getsockopt(sock, SOL_SOCKET, SO_SNDBUF, (char *)&optval,
  63                              &optlen);
  64         if (ret < 0) {
  65                 zlog_err("fd %d: can't getsockopt SO_SNDBUF: %d (%s)", sock,
  66                          errno, safe_strerror(errno));
  67                 return ret;
  68         }
  69         return optval;
  70 }
  71
  72 static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
  73 {
  74         struct cmsghdr *cmsg;
  75         void *ptr = NULL;
  76
  77         for (cmsg = ZCMSG_FIRSTHDR(msgh); cmsg != NULL;
  78              cmsg = CMSG_NXTHDR(msgh, cmsg))
  79                 if (cmsg->cmsg_level == level && cmsg->cmsg_type)
  80                         return (ptr = CMSG_DATA(cmsg));
  81
  82         return NULL;
  83 }
  84
  85 /* Set IPv6 packet info to the socket. */
  86 int setsockopt_ipv6_pktinfo(int sock, int val)
  87 {
  88         int ret;
  89
  90 #ifdef IPV6_RECVPKTINFO /*2292bis-01*/
  91         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val,
  92                          sizeof(val));
  93         if (ret < 0)
  94                 zlog_warn("can't setsockopt IPV6_RECVPKTINFO : %s",
  95                           safe_strerror(errno));
  96 #else  /*RFC2292*/
  97         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
  98         if (ret < 0)
  99                 zlog_warn("can't setsockopt IPV6_PKTINFO : %s",
 100                           safe_strerror(errno));
 101 #endif /* INIA_IPV6 */
 102         return ret;
 103 }
 104
 105 /* Set multicast hops val to the socket. */
 106 int setsockopt_ipv6_checksum(int sock, int val)
 107 {
 108         int ret;
 109
 110 #ifdef GNU_LINUX
 111         ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
 112 #else
 113         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
 114 #endif /* GNU_LINUX */
 115         if (ret < 0)
 116                 zlog_warn("can't setsockopt IPV6_CHECKSUM");
 117         return ret;
 118 }
 119
 120 /* Set multicast hops val to the socket. */
 121 int setsockopt_ipv6_multicast_hops(int sock, int val)
 122 {
 123         int ret;
 124
 125         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val,
 126                          sizeof(val));
 127         if (ret < 0)
 128                 zlog_warn("can't setsockopt IPV6_MULTICAST_HOPS");
 129         return ret;
 130 }
 131
 132 /* Set multicast hops val to the socket. */
 133 int setsockopt_ipv6_unicast_hops(int sock, int val)
 134 {
 135         int ret;
 136
 137         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val,
 138                          sizeof(val));
 139         if (ret < 0)
 140                 zlog_warn("can't setsockopt IPV6_UNICAST_HOPS");
 141         return ret;
 142 }
 143
 144 int setsockopt_ipv6_hoplimit(int sock, int val)
 145 {
 146         int ret;
 147
 148 #ifdef IPV6_RECVHOPLIMIT /*2292bis-01*/
 149         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val,
 150                          sizeof(val));
 151         if (ret < 0)
 152                 zlog_warn("can't setsockopt IPV6_RECVHOPLIMIT");
 153 #else /*RFC2292*/
 154         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 155         if (ret < 0)
 156                 zlog_warn("can't setsockopt IPV6_HOPLIMIT");
 157 #endif
 158         return ret;
 159 }
 160
 161 /* Set multicast loop zero to the socket. */
 162 int setsockopt_ipv6_multicast_loop(int sock, int val)
 163 {
 164         int ret;
 165
 166         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 167                          sizeof(val));
 168         if (ret < 0)
 169                 zlog_warn("can't setsockopt IPV6_MULTICAST_LOOP");
 170         return ret;
 171 }
 172
 173 static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
 174 {
 175         struct in6_pktinfo *pktinfo;
 176
 177         pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 178
 179         return pktinfo->ipi6_ifindex;
 180 }
 181
 182 int setsockopt_ipv6_tclass(int sock, int tclass)
 183 {
 184         int ret = 0;
 185
 186 #ifdef IPV6_TCLASS /* RFC3542 */
 187         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass,
 188                          sizeof(tclass));
 189         if (ret < 0)
 190                 zlog_warn("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 191                           sock, tclass, safe_strerror(errno));
 192 #endif
 193         return ret;
 194 }
 195
 196 /*
 197  * Process multicast socket options for IPv4 in an OS-dependent manner.
 198  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 199  *
 200  * Many operating systems have a limit on the number of groups that
 201  * can be joined per socket (where each group and local address
 202  * counts).  This impacts OSPF, which joins groups on each interface
 203  * using a single socket.  The limit is typically 20, derived from the
 204  * original BSD multicast implementation.  Some systems have
 205  * mechanisms for increasing this limit.
 206  *
 207  * In many 4.4BSD-derived systems, multicast group operations are not
 208  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 209  * leave the group may have failed, leaving it still joined, and we
 210  * drop/join quietly to recover.  This may not be necessary, but aims to
 211  * defend against unknown behavior in that we will still return an error
 212  * if the second join fails.  It is not clear how other systems
 213  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 214  * but this behavior should not be harmful if they behave the same way,
 215  * allow leaves, or implicitly leave all groups joined to down interfaces.
 216  */
 217 int setsockopt_ipv4_multicast(int sock, int optname, struct in_addr if_addr,
 218                               unsigned int mcast_addr, ifindex_t ifindex)
 219 {
 220 #ifdef HAVE_RFC3678
 221         struct group_req gr;
 222         struct sockaddr_in *si;
 223         int ret;
 224         memset(&gr, 0, sizeof(gr));
 225         si = (struct sockaddr_in *)&gr.gr_group;
 226         gr.gr_interface = ifindex;
 227         si->sin_family = AF_INET;
 228 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 229         si->sin_len = sizeof(struct sockaddr_in);
 230 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 231         si->sin_addr.s_addr = mcast_addr;
 232         ret = setsockopt(sock, IPPROTO_IP,
 233                          (optname == IP_ADD_MEMBERSHIP) ? MCAST_JOIN_GROUP
 234                                                         : MCAST_LEAVE_GROUP,
 235                          (void *)&gr, sizeof(gr));
 236         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 237             && (errno == EADDRINUSE)) {
 238                 setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr,
 239                            sizeof(gr));
 240                 ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP,
 241                                  (void *)&gr, sizeof(gr));
 242         }
 243         return ret;
 244
 245 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 246         struct ip_mreqn mreqn;
 247         int ret;
 248
 249         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 250         memset(&mreqn, 0, sizeof(mreqn));
 251
 252         mreqn.imr_multiaddr.s_addr = mcast_addr;
 253         mreqn.imr_ifindex = ifindex;
 254
 255         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreqn,
 256                          sizeof(mreqn));
 257         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 258             && (errno == EADDRINUSE)) {
 259                 /* see above: handle possible problem when interface comes back
 260                  * up */
 261                 char buf[1][INET_ADDRSTRLEN];
 262                 zlog_info(
 263                         "setsockopt_ipv4_multicast attempting to drop and "
 264                         "re-add (fd %d, mcast %s, ifindex %u)",
 265                         sock, inet_ntop(AF_INET, &mreqn.imr_multiaddr, buf[0],
 266                                         sizeof(buf[0])),
 267                         ifindex);
 268                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreqn,
 269                            sizeof(mreqn));
 270                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 271                                  (void *)&mreqn, sizeof(mreqn));
 272         }
 273         return ret;
 274
 275 /* Example defines for another OS, boilerplate off other code in this
 276    function, AND handle optname as per other sections for consistency !! */
 277 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 278 /* Add your favourite OS here! */
 279
 280 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 281         /* standard BSD API */
 282
 283         struct ip_mreq mreq;
 284         int ret;
 285
 286         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 287
 288
 289         memset(&mreq, 0, sizeof(mreq));
 290         mreq.imr_multiaddr.s_addr = mcast_addr;
 291 #if !defined __OpenBSD__
 292         mreq.imr_interface.s_addr = htonl(ifindex);
 293 #else
 294         mreq.imr_interface.s_addr = if_addr.s_addr;
 295 #endif
 296
 297         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreq,
 298                          sizeof(mreq));
 299         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 300             && (errno == EADDRINUSE)) {
 301                 /* see above: handle possible problem when interface comes back
 302                  * up */
 303                 char buf[1][INET_ADDRSTRLEN];
 304                 zlog_info(
 305                         "setsockopt_ipv4_multicast attempting to drop and "
 306                         "re-add (fd %d, mcast %s, ifindex %u)",
 307                         sock, inet_ntop(AF_INET, &mreq.imr_multiaddr, buf[0],
 308                                         sizeof(buf[0])),
 309                         ifindex);
 310                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreq,
 311                            sizeof(mreq));
 312                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 313                                  (void *)&mreq, sizeof(mreq));
 314         }
 315         return ret;
 316
 317 #else
 318 #error "Unsupported multicast API"
 319 #endif /* #if OS_TYPE */
 320 }
 321
 322 /*
 323  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 324  */
 325 int setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 326                                  ifindex_t ifindex)
 327 {
 328
 329 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 330         struct ip_mreqn mreqn;
 331         memset(&mreqn, 0, sizeof(mreqn));
 332
 333         mreqn.imr_ifindex = ifindex;
 334         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn,
 335                           sizeof(mreqn));
 336
 337 /* Example defines for another OS, boilerplate off other code in this
 338    function */
 339 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 340 /* Add your favourite OS here! */
 341 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 342         struct in_addr m;
 343
 344 #if !defined __OpenBSD__
 345         m.s_addr = htonl(ifindex);
 346 #else
 347         m.s_addr = if_addr.s_addr;
 348 #endif
 349
 350         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m,
 351                           sizeof(m));
 352 #elif defined(SUNOS_5)
 353         char ifname[IF_NAMESIZE];
 354         struct ifaddrs *ifa, *ifap;
 355         struct in_addr ifaddr;
 356
 357         if (if_indextoname(ifindex, ifname) == NULL)
 358                 return -1;
 359
 360         if (getifaddrs(&ifa) != 0)
 361                 return -1;
 362
 363         for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next) {
 364                 struct sockaddr_in *sa;
 365
 366                 if (strcmp(ifap->ifa_name, ifname) != 0)
 367                         continue;
 368                 if (ifap->ifa_addr->sa_family != AF_INET)
 369                         continue;
 370                 sa = (struct sockaddr_in *)ifap->ifa_addr;
 371                 memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 372                 break;
 373         }
 374
 375         freeifaddrs(ifa);
 376         if (!ifap) /* This means we did not find an IP */
 377                 return -1;
 378
 379         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr,
 380                           sizeof(ifaddr));
 381 #else
 382 #error "Unsupported multicast API"
 383 #endif
 384 }
 385
 386 int setsockopt_ipv4_multicast_loop(int sock, u_char val)
 387 {
 388         int ret;
 389
 390         ret = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *)&val,
 391                          sizeof(val));
 392         if (ret < 0)
 393                 zlog_warn("can't setsockopt IP_MULTICAST_LOOP");
 394
 395         return ret;
 396 }
 397
 398 static int setsockopt_ipv4_ifindex(int sock, ifindex_t val)
 399 {
 400         int ret;
 401
 402 #if defined(IP_PKTINFO)
 403         if ((ret = setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val)))
 404             < 0)
 405                 zlog_warn("Can't set IP_PKTINFO option for fd %d to %d: %s",
 406                           sock, val, safe_strerror(errno));
 407 #elif defined(IP_RECVIF)
 408         if ((ret = setsockopt(sock, IPPROTO_IP, IP_RECVIF, &val, sizeof(val)))
 409             < 0)
 410                 zlog_warn("Can't set IP_RECVIF option for fd %d to %d: %s",
 411                           sock, val, safe_strerror(errno));
 412 #else
 413 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 414 #warning "Will not be able to receive link info."
 415 #warning "Things might be seriously broken.."
 416         /* XXX Does this ever happen?  Should there be a zlog_warn message here?
 417          */
 418         ret = -1;
 419 #endif
 420         return ret;
 421 }
 422
 423 int setsockopt_ipv4_tos(int sock, int tos)
 424 {
 425         int ret;
 426
 427         ret = setsockopt(sock, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
 428         if (ret < 0)
 429                 zlog_warn("Can't set IP_TOS option for fd %d to %#x: %s", sock,
 430                           tos, safe_strerror(errno));
 431         return ret;
 432 }
 433
 434
 435 int setsockopt_ifindex(int af, int sock, ifindex_t val)
 436 {
 437         int ret = -1;
 438
 439         switch (af) {
 440         case AF_INET:
 441                 ret = setsockopt_ipv4_ifindex(sock, val);
 442                 break;
 443         case AF_INET6:
 444                 ret = setsockopt_ipv6_pktinfo(sock, val);
 445                 break;
 446         default:
 447                 zlog_warn("setsockopt_ifindex: unknown address family %d", af);
 448         }
 449         return ret;
 450 }
 451
 452 /*
 453  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 454  * may or may not have control data about the incoming interface.
 455  *
 456  * Returns the interface index (small integer >= 1) if it can be
 457  * determined, or else 0.
 458  */
 459 static ifindex_t getsockopt_ipv4_ifindex(struct msghdr *msgh)
 460 {
 461         /* XXX: initialize to zero?  (Always overwritten, so just cosmetic.) */
 462         ifindex_t ifindex = -1;
 463
 464 #if defined(IP_PKTINFO)
 465         /* Linux pktinfo based ifindex retrieval */
 466         struct in_pktinfo *pktinfo;
 467
 468         pktinfo = (struct in_pktinfo *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 469                                                             IP_PKTINFO);
 470         /* XXX Can pktinfo be NULL?  Clean up post 0.98. */
 471         ifindex = pktinfo->ipi_ifindex;
 472
 473 #elif defined(IP_RECVIF)
 474
 475 /* retrieval based on IP_RECVIF */
 476
 477 #ifndef SUNOS_5
 478         /* BSD systems use a sockaddr_dl as the control message payload. */
 479         struct sockaddr_dl *sdl;
 480 #else
 481         /* SUNOS_5 uses an integer with the index. */
 482         ifindex_t *ifindex_p;
 483 #endif /* SUNOS_5 */
 484
 485 #ifndef SUNOS_5
 486         /* BSD */
 487         sdl = (struct sockaddr_dl *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 488                                                          IP_RECVIF);
 489         if (sdl != NULL)
 490                 ifindex = sdl->sdl_index;
 491         else
 492                 ifindex = 0;
 493 #else
 494         /*
 495          * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 496          * enable it fails with errno=99, and the struct msghdr has
 497          * controllen 0.
 498          */
 499         ifindex_p = (uint_t *)getsockopt_cmsg_data(msgh, IPPROTO_IP, IP_RECVIF);
 500         if (ifindex_p != NULL)
 501                 ifindex = *ifindex_p;
 502         else
 503                 ifindex = 0;
 504 #endif /* SUNOS_5 */
 505
 506 #else
 507 /*
 508  * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 509  * XXX Decide if this is a core service, or if daemons have to cope.
 510  * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 511  * daemons have to cope.
 512  */
 513 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 514 #warning "Some daemons may fail to operate correctly!"
 515         ifindex = 0;
 516
 517 #endif /* IP_PKTINFO */
 518
 519         return ifindex;
 520 }
 521
 522 /* return ifindex, 0 if none found */
 523 ifindex_t getsockopt_ifindex(int af, struct msghdr *msgh)
 524 {
 525         switch (af) {
 526         case AF_INET:
 527                 return (getsockopt_ipv4_ifindex(msgh));
 528                 break;
 529         case AF_INET6:
 530                 return (getsockopt_ipv6_ifindex(msgh));
 531                 break;
 532         default:
 533                 zlog_warn("getsockopt_ifindex: unknown address family %d", af);
 534                 return 0;
 535         }
 536 }
 537
 538 /* swab iph between order system uses for IP_HDRINCL and host order */
 539 void sockopt_iphdrincl_swab_htosys(struct ip *iph)
 540 {
 541 /* BSD and derived take iph in network order, except for
 542  * ip_len and ip_off
 543  */
 544 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 545         iph->ip_len = htons(iph->ip_len);
 546         iph->ip_off = htons(iph->ip_off);
 547 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 548
 549         iph->ip_id = htons(iph->ip_id);
 550 }
 551
 552 void sockopt_iphdrincl_swab_systoh(struct ip *iph)
 553 {
 554 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 555         iph->ip_len = ntohs(iph->ip_len);
 556         iph->ip_off = ntohs(iph->ip_off);
 557 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 558
 559         iph->ip_id = ntohs(iph->ip_id);
 560 }
 561
 562 int sockopt_tcp_rtt(int sock)
 563 {
 564 #ifdef TCP_INFO
 565         struct tcp_info ti;
 566         socklen_t len = sizeof(ti);
 567
 568         if (getsockopt(sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 569                 return 0;
 570
 571         return ti.tcpi_rtt / 1000;
 572 #else
 573         return 0;
 574 #endif
 575 }
 576
 577 int sockopt_tcp_signature(int sock, union sockunion *su, const char *password)
 578 {
 579 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
 580 /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
 581  * version of the Quagga patch (based on work by Rick Payne, and Bruce
 582  * Simpson)
 583  */
 584 #define TCP_MD5_AUTH 13
 585 #define TCP_MD5_AUTH_ADD 1
 586 #define TCP_MD5_AUTH_DEL 2
 587         struct tcp_rfc2385_cmd {
 588                 u_int8_t command;  /* Command - Add/Delete */
 589                 u_int32_t address; /* IPV4 address associated */
 590                 u_int8_t keylen;   /* MD5 Key len (do NOT assume 0 terminated
 591                                       ascii) */
 592                 void *key;       /* MD5 Key */
 593         } cmd;
 594         struct in_addr *addr = &su->sin.sin_addr;
 595
 596         cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
 597         cmd.address = addr->s_addr;
 598         cmd.keylen = (password != NULL ? strlen(password) : 0);
 599         cmd.key = password;
 600
 601         return setsockopt(sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
 602
 603 #elif HAVE_DECL_TCP_MD5SIG
 604         int ret;
 605 #ifndef GNU_LINUX
 606         /*
 607          * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 608          * and add/remove an SP entry for this peer's packet flows also.
 609          */
 610         int md5sig = password && *password ? 1 : 0;
 611 #else
 612         int keylen = password ? strlen(password) : 0;
 613         struct tcp_md5sig md5sig;
 614         union sockunion *su2, *susock;
 615
 616         /* Figure out whether the socket and the sockunion are the same family..
 617          * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 618          */
 619         if (!(susock = sockunion_getsockname(sock)))
 620                 return -1;
 621
 622         if (susock->sa.sa_family == su->sa.sa_family)
 623                 su2 = su;
 624         else {
 625                 /* oops.. */
 626                 su2 = susock;
 627
 628                 if (su2->sa.sa_family == AF_INET) {
 629                         sockunion_free(susock);
 630                         return 0;
 631                 }
 632
 633                 /* If this does not work, then all users of this sockopt will
 634                  * need to
 635                  * differentiate between IPv4 and IPv6, and keep seperate
 636                  * sockets for
 637                  * each.
 638                  *
 639                  * Sadly, it doesn't seem to work at present. It's unknown
 640                  * whether
 641                  * this is a bug or not.
 642                  */
 643                 if (su2->sa.sa_family == AF_INET6
 644                     && su->sa.sa_family == AF_INET) {
 645                         su2->sin6.sin6_family = AF_INET6;
 646                         /* V4Map the address */
 647                         memset(&su2->sin6.sin6_addr, 0,
 648                                sizeof(struct in6_addr));
 649                         su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 650                         memcpy(&su2->sin6.sin6_addr.s6_addr32[3],
 651                                &su->sin.sin_addr, 4);
 652                 }
 653         }
 654
 655         memset(&md5sig, 0, sizeof(md5sig));
 656         memcpy(&md5sig.tcpm_addr, su2, sizeof(*su2));
 657         md5sig.tcpm_keylen = keylen;
 658         if (keylen)
 659                 memcpy(md5sig.tcpm_key, password, keylen);
 660         sockunion_free(susock);
 661 #endif /* GNU_LINUX */
 662         if ((ret = setsockopt(sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig,
 663                               sizeof md5sig))
 664             < 0) {
 665                 /* ENOENT is harmless.  It is returned when we clear a password
 666                    for which
 667                    one was not previously set. */
 668                 if (ENOENT == errno)
 669                         ret = 0;
 670                 else
 671                         zlog_err("sockopt_tcp_signature: setsockopt(%d): %s",
 672                                  sock, safe_strerror(errno));
 673         }
 674         return ret;
 675 #else  /* HAVE_TCP_MD5SIG */
 676         return -2;
 677 #endif /* !HAVE_TCP_MD5SIG */
 678 }