lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with GNU Zebra; see the file COPYING.  If not, write to the Free
  18  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  19  * 02111-1307, USA.
  20  */
  21
  22 #include <zebra.h>
  23
  24 #ifdef SUNOS_5
  25 #include <ifaddrs.h>
  26 #endif
  27
  28 #include "log.h"
  29 #include "sockopt.h"
  30 #include "sockunion.h"
  31
  32 void
  33 setsockopt_so_recvbuf (int sock, int size)
  34 {
  35   int orig_req = size;
  36
  37   while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof (size)) == -1)
  38     size /= 2;
  39
  40   if (size != orig_req)
  41     zlog_warn ("%s: fd %d: SO_RCVBUF set to %d (requested %d)", __func__, sock,
  42                size, orig_req);
  43 }
  44
  45 void
  46 setsockopt_so_sendbuf (const int sock, int size)
  47 {
  48   int orig_req = size;
  49
  50   while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof (size)) == -1)
  51     size /= 2;
  52
  53   if (size != orig_req)
  54     zlog_warn ("%s: fd %d: SO_SNDBUF set to %d (requested %d)", __func__, sock,
  55                size, orig_req);
  56 }
  57
  58 int
  59 getsockopt_so_sendbuf (const int sock)
  60 {
  61   u_int32_t optval;
  62   socklen_t optlen = sizeof (optval);
  63   int ret = getsockopt (sock, SOL_SOCKET, SO_SNDBUF,
  64     (char *)&optval, &optlen);
  65   if (ret < 0)
  66   {
  67     zlog_err ("fd %d: can't getsockopt SO_SNDBUF: %d (%s)",
  68       sock, errno, safe_strerror (errno));
  69     return ret;
  70   }
  71   return optval;
  72 }
  73
  74 static void *
  75 getsockopt_cmsg_data (struct msghdr *msgh, int level, int type)
  76 {
  77   struct cmsghdr *cmsg;
  78   void *ptr = NULL;
  79
  80   for (cmsg = ZCMSG_FIRSTHDR(msgh);
  81        cmsg != NULL;
  82        cmsg = CMSG_NXTHDR(msgh, cmsg))
  83     if (cmsg->cmsg_level == level && cmsg->cmsg_type)
  84       return (ptr = CMSG_DATA(cmsg));
  85
  86   return NULL;
  87 }
  88
  89 /* Set IPv6 packet info to the socket. */
  90 int
  91 setsockopt_ipv6_pktinfo (int sock, int val)
  92 {
  93   int ret;
  94
  95 #ifdef IPV6_RECVPKTINFO         /*2292bis-01*/
  96   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val, sizeof(val));
  97   if (ret < 0)
  98     zlog_warn ("can't setsockopt IPV6_RECVPKTINFO : %s", safe_strerror (errno));
  99 #else   /*RFC2292*/
 100   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
 101   if (ret < 0)
 102     zlog_warn ("can't setsockopt IPV6_PKTINFO : %s", safe_strerror (errno));
 103 #endif /* INIA_IPV6 */
 104   return ret;
 105 }
 106
 107 /* Set multicast hops val to the socket. */
 108 int
 109 setsockopt_ipv6_checksum (int sock, int val)
 110 {
 111   int ret;
 112
 113 #ifdef GNU_LINUX
 114   ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
 115 #else
 116   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
 117 #endif /* GNU_LINUX */
 118   if (ret < 0)
 119     zlog_warn ("can't setsockopt IPV6_CHECKSUM");
 120   return ret;
 121 }
 122
 123 /* Set multicast hops val to the socket. */
 124 int
 125 setsockopt_ipv6_multicast_hops (int sock, int val)
 126 {
 127   int ret;
 128
 129   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
 130   if (ret < 0)
 131     zlog_warn ("can't setsockopt IPV6_MULTICAST_HOPS");
 132   return ret;
 133 }
 134
 135 /* Set multicast hops val to the socket. */
 136 int
 137 setsockopt_ipv6_unicast_hops (int sock, int val)
 138 {
 139   int ret;
 140
 141   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
 142   if (ret < 0)
 143     zlog_warn ("can't setsockopt IPV6_UNICAST_HOPS");
 144   return ret;
 145 }
 146
 147 int
 148 setsockopt_ipv6_hoplimit (int sock, int val)
 149 {
 150   int ret;
 151
 152 #ifdef IPV6_RECVHOPLIMIT        /*2292bis-01*/
 153   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val, sizeof(val));
 154   if (ret < 0)
 155     zlog_warn ("can't setsockopt IPV6_RECVHOPLIMIT");
 156 #else   /*RFC2292*/
 157   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 158   if (ret < 0)
 159     zlog_warn ("can't setsockopt IPV6_HOPLIMIT");
 160 #endif
 161   return ret;
 162 }
 163
 164 /* Set multicast loop zero to the socket. */
 165 int
 166 setsockopt_ipv6_multicast_loop (int sock, int val)
 167 {
 168   int ret;
 169
 170   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 171                     sizeof (val));
 172   if (ret < 0)
 173     zlog_warn ("can't setsockopt IPV6_MULTICAST_LOOP");
 174   return ret;
 175 }
 176
 177 static int
 178 getsockopt_ipv6_ifindex (struct msghdr *msgh)
 179 {
 180   struct in6_pktinfo *pktinfo;
 181
 182   pktinfo = getsockopt_cmsg_data (msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 183
 184   return pktinfo->ipi6_ifindex;
 185 }
 186
 187 int
 188 setsockopt_ipv6_tclass(int sock, int tclass)
 189 {
 190   int ret = 0;
 191
 192 #ifdef IPV6_TCLASS /* RFC3542 */
 193   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass, sizeof (tclass));
 194   if (ret < 0)
 195     zlog_warn ("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 196                sock, tclass, safe_strerror(errno));
 197 #endif
 198   return ret;
 199 }
 200
 201 /*
 202  * Process multicast socket options for IPv4 in an OS-dependent manner.
 203  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 204  *
 205  * Many operating systems have a limit on the number of groups that
 206  * can be joined per socket (where each group and local address
 207  * counts).  This impacts OSPF, which joins groups on each interface
 208  * using a single socket.  The limit is typically 20, derived from the
 209  * original BSD multicast implementation.  Some systems have
 210  * mechanisms for increasing this limit.
 211  *
 212  * In many 4.4BSD-derived systems, multicast group operations are not
 213  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 214  * leave the group may have failed, leaving it still joined, and we
 215  * drop/join quietly to recover.  This may not be necessary, but aims to
 216  * defend against unknown behavior in that we will still return an error
 217  * if the second join fails.  It is not clear how other systems
 218  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 219  * but this behavior should not be harmful if they behave the same way,
 220  * allow leaves, or implicitly leave all groups joined to down interfaces.
 221  */
 222 int
 223 setsockopt_ipv4_multicast(int sock,
 224                         int optname,
 225                         struct in_addr if_addr,
 226                         unsigned int mcast_addr,
 227                         ifindex_t ifindex)
 228 {
 229 #ifdef HAVE_RFC3678
 230   struct group_req gr;
 231   struct sockaddr_in *si;
 232   int ret;
 233   memset (&gr, 0, sizeof(gr));
 234   si = (struct sockaddr_in *)&gr.gr_group;
 235   gr.gr_interface = ifindex;
 236   si->sin_family = AF_INET;
 237 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 238   si->sin_len = sizeof(struct sockaddr_in);
 239 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 240   si->sin_addr.s_addr = mcast_addr;
 241   ret = setsockopt(sock, IPPROTO_IP, (optname == IP_ADD_MEMBERSHIP) ?
 242     MCAST_JOIN_GROUP : MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 243   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 244     {
 245       setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 246       ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP, (void *)&gr, sizeof(gr));
 247     }
 248   return ret;
 249
 250 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 251   struct ip_mreqn mreqn;
 252   int ret;
 253
 254   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 255   memset (&mreqn, 0, sizeof(mreqn));
 256
 257   mreqn.imr_multiaddr.s_addr = mcast_addr;
 258   mreqn.imr_ifindex = ifindex;
 259
 260   ret = setsockopt(sock, IPPROTO_IP, optname,
 261                    (void *)&mreqn, sizeof(mreqn));
 262   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 263     {
 264       /* see above: handle possible problem when interface comes back up */
 265       char buf[1][INET_ADDRSTRLEN];
 266       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 267                 "re-add (fd %d, mcast %s, ifindex %u)",
 268                 sock,
 269                 inet_ntop(AF_INET, &mreqn.imr_multiaddr,
 270                           buf[0], sizeof(buf[0])), ifindex);
 271       setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 272                  (void *)&mreqn, sizeof(mreqn));
 273       ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 274                        (void *)&mreqn, sizeof(mreqn));
 275     }
 276   return ret;
 277
 278   /* Example defines for another OS, boilerplate off other code in this
 279      function, AND handle optname as per other sections for consistency !! */
 280   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 281   /* Add your favourite OS here! */
 282
 283 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 284   /* standard BSD API */
 285
 286   struct ip_mreq mreq;
 287   int ret;
 288
 289   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 290
 291
 292   memset (&mreq, 0, sizeof(mreq));
 293   mreq.imr_multiaddr.s_addr = mcast_addr;
 294 #if !defined __OpenBSD__
 295   mreq.imr_interface.s_addr = htonl (ifindex);
 296 #else
 297   mreq.imr_interface.s_addr = if_addr.s_addr;
 298 #endif
 299
 300   ret = setsockopt (sock, IPPROTO_IP, optname, (void *)&mreq, sizeof(mreq));
 301   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 302     {
 303       /* see above: handle possible problem when interface comes back up */
 304       char buf[1][INET_ADDRSTRLEN];
 305       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 306                 "re-add (fd %d, mcast %s, ifindex %u)",
 307                 sock,
 308                 inet_ntop(AF_INET, &mreq.imr_multiaddr,
 309                           buf[0], sizeof(buf[0])), ifindex);
 310       setsockopt (sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 311                   (void *)&mreq, sizeof(mreq));
 312       ret = setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 313                         (void *)&mreq, sizeof(mreq));
 314     }
 315   return ret;
 316
 317 #else
 318   #error "Unsupported multicast API"
 319 #endif /* #if OS_TYPE */
 320
 321 }
 322
 323 /*
 324  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 325  */
 326 int
 327 setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 328                              ifindex_t ifindex)
 329 {
 330
 331 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 332   struct ip_mreqn mreqn;
 333   memset (&mreqn, 0, sizeof(mreqn));
 334
 335   mreqn.imr_ifindex = ifindex;
 336   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn, sizeof(mreqn));
 337
 338   /* Example defines for another OS, boilerplate off other code in this
 339      function */
 340   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 341   /* Add your favourite OS here! */
 342 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 343   struct in_addr m;
 344
 345 #if !defined __OpenBSD__
 346   m.s_addr = htonl (ifindex);
 347 #else
 348   m.s_addr = if_addr.s_addr;
 349 #endif
 350
 351   return setsockopt (sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m, sizeof(m));
 352 #elif defined(SUNOS_5)
 353   char ifname[IF_NAMESIZE];
 354   struct ifaddrs *ifa, *ifap;
 355   struct in_addr ifaddr;
 356
 357   if (if_indextoname(ifindex, ifname) == NULL)
 358     return -1;
 359
 360   if (getifaddrs(&ifa) != 0)
 361     return -1;
 362
 363   for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next)
 364     {
 365       struct sockaddr_in *sa;
 366
 367       if (strcmp(ifap->ifa_name, ifname) != 0)
 368         continue;
 369       if (ifap->ifa_addr->sa_family != AF_INET)
 370         continue;
 371       sa = (struct sockaddr_in*)ifap->ifa_addr;
 372       memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 373       break;
 374     }
 375
 376   freeifaddrs(ifa);
 377   if (!ifap) /* This means we did not find an IP */
 378     return -1;
 379
 380   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr, sizeof(ifaddr));
 381 #else
 382   #error "Unsupported multicast API"
 383 #endif
 384 }
 385
 386 int
 387 setsockopt_ipv4_multicast_loop (int sock, u_char val)
 388 {
 389   int ret;
 390
 391   ret = setsockopt (sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *) &val,
 392                     sizeof (val));
 393   if (ret < 0)
 394     zlog_warn ("can't setsockopt IP_MULTICAST_LOOP");
 395
 396   return ret;
 397 }
 398
 399 static int
 400 setsockopt_ipv4_ifindex (int sock, ifindex_t val)
 401 {
 402   int ret;
 403
 404 #if defined (IP_PKTINFO)
 405   if ((ret = setsockopt (sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof (val))) < 0)
 406     zlog_warn ("Can't set IP_PKTINFO option for fd %d to %d: %s",
 407                sock,val,safe_strerror(errno));
 408 #elif defined (IP_RECVIF)
 409   if ((ret = setsockopt (sock, IPPROTO_IP, IP_RECVIF, &val, sizeof (val))) < 0)
 410     zlog_warn ("Can't set IP_RECVIF option for fd %d to %d: %s",
 411                sock,val,safe_strerror(errno));
 412 #else
 413 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 414 #warning "Will not be able to receive link info."
 415 #warning "Things might be seriously broken.."
 416   /* XXX Does this ever happen?  Should there be a zlog_warn message here? */
 417   ret = -1;
 418 #endif
 419   return ret;
 420 }
 421
 422 int
 423 setsockopt_ipv4_tos(int sock, int tos)
 424 {
 425   int ret;
 426
 427   ret = setsockopt (sock, IPPROTO_IP, IP_TOS, &tos, sizeof (tos));
 428   if (ret < 0)
 429     zlog_warn ("Can't set IP_TOS option for fd %d to %#x: %s",
 430                sock, tos, safe_strerror(errno));
 431   return ret;
 432 }
 433
 434
 435 int
 436 setsockopt_ifindex (int af, int sock, ifindex_t val)
 437 {
 438   int ret = -1;
 439
 440   switch (af)
 441     {
 442       case AF_INET:
 443         ret = setsockopt_ipv4_ifindex (sock, val);
 444         break;
 445       case AF_INET6:
 446         ret = setsockopt_ipv6_pktinfo (sock, val);
 447         break;
 448       default:
 449         zlog_warn ("setsockopt_ifindex: unknown address family %d", af);
 450     }
 451   return ret;
 452 }
 453
 454 /*
 455  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 456  * may or may not have control data about the incoming interface.
 457  *
 458  * Returns the interface index (small integer >= 1) if it can be
 459  * determined, or else 0.
 460  */
 461 static ifindex_t
 462 getsockopt_ipv4_ifindex (struct msghdr *msgh)
 463 {
 464   /* XXX: initialize to zero?  (Always overwritten, so just cosmetic.) */
 465   ifindex_t ifindex = -1;
 466
 467 #if defined(IP_PKTINFO)
 468 /* Linux pktinfo based ifindex retrieval */
 469   struct in_pktinfo *pktinfo;
 470
 471   pktinfo =
 472     (struct in_pktinfo *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_PKTINFO);
 473   /* XXX Can pktinfo be NULL?  Clean up post 0.98. */
 474   ifindex = pktinfo->ipi_ifindex;
 475
 476 #elif defined(IP_RECVIF)
 477
 478   /* retrieval based on IP_RECVIF */
 479
 480 #ifndef SUNOS_5
 481   /* BSD systems use a sockaddr_dl as the control message payload. */
 482   struct sockaddr_dl *sdl;
 483 #else
 484   /* SUNOS_5 uses an integer with the index. */
 485   ifindex_t *ifindex_p;
 486 #endif /* SUNOS_5 */
 487
 488 #ifndef SUNOS_5
 489   /* BSD */
 490   sdl =
 491     (struct sockaddr_dl *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 492   if (sdl != NULL)
 493     ifindex = sdl->sdl_index;
 494   else
 495     ifindex = 0;
 496 #else
 497   /*
 498    * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 499    * enable it fails with errno=99, and the struct msghdr has
 500    * controllen 0.
 501    */
 502   ifindex_p = (uint_t *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 503   if (ifindex_p != NULL)
 504     ifindex = *ifindex_p;
 505   else
 506     ifindex = 0;
 507 #endif /* SUNOS_5 */
 508
 509 #else
 510   /*
 511    * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 512    * XXX Decide if this is a core service, or if daemons have to cope.
 513    * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 514    * daemons have to cope.
 515    */
 516 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 517 #warning "Some daemons may fail to operate correctly!"
 518   ifindex = 0;
 519
 520 #endif /* IP_PKTINFO */
 521
 522   return ifindex;
 523 }
 524
 525 /* return ifindex, 0 if none found */
 526 ifindex_t
 527 getsockopt_ifindex (int af, struct msghdr *msgh)
 528 {
 529   switch (af)
 530     {
 531       case AF_INET:
 532         return (getsockopt_ipv4_ifindex (msgh));
 533         break;
 534       case AF_INET6:
 535         return (getsockopt_ipv6_ifindex (msgh));
 536         break;
 537       default:
 538         zlog_warn ("getsockopt_ifindex: unknown address family %d", af);
 539         return 0;
 540     }
 541 }
 542
 543 /* swab iph between order system uses for IP_HDRINCL and host order */
 544 void
 545 sockopt_iphdrincl_swab_htosys (struct ip *iph)
 546 {
 547   /* BSD and derived take iph in network order, except for
 548    * ip_len and ip_off
 549    */
 550 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 551   iph->ip_len = htons(iph->ip_len);
 552   iph->ip_off = htons(iph->ip_off);
 553 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 554
 555   iph->ip_id = htons(iph->ip_id);
 556 }
 557
 558 void
 559 sockopt_iphdrincl_swab_systoh (struct ip *iph)
 560 {
 561 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 562   iph->ip_len = ntohs(iph->ip_len);
 563   iph->ip_off = ntohs(iph->ip_off);
 564 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 565
 566   iph->ip_id = ntohs(iph->ip_id);
 567 }
 568
 569 int
 570 sockopt_tcp_rtt (int sock)
 571 {
 572 #ifdef TCP_INFO
 573   struct tcp_info ti;
 574   socklen_t len = sizeof(ti);
 575
 576   if (getsockopt (sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 577     return 0;
 578
 579   return ti.tcpi_rtt / 1000;
 580 #else
 581   return 0;
 582 #endif
 583 }
 584
 585 int
 586 sockopt_tcp_signature (int sock, union sockunion *su, const char *password)
 587 {
 588 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
 589   /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
 590    * version of the Quagga patch (based on work by Rick Payne, and Bruce
 591    * Simpson)
 592    */
 593 #define TCP_MD5_AUTH 13
 594 #define TCP_MD5_AUTH_ADD 1
 595 #define TCP_MD5_AUTH_DEL 2
 596   struct tcp_rfc2385_cmd {
 597     u_int8_t     command;    /* Command - Add/Delete */
 598     u_int32_t    address;    /* IPV4 address associated */
 599     u_int8_t     keylen;     /* MD5 Key len (do NOT assume 0 terminated ascii) */
 600     void         *key;       /* MD5 Key */
 601   } cmd;
 602   struct in_addr *addr = &su->sin.sin_addr;
 603
 604   cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
 605   cmd.address = addr->s_addr;
 606   cmd.keylen = (password != NULL ? strlen (password) : 0);
 607   cmd.key = password;
 608
 609   return setsockopt (sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
 610
 611 #elif HAVE_DECL_TCP_MD5SIG
 612   int ret;
 613 #ifndef GNU_LINUX
 614   /*
 615    * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 616    * and add/remove an SP entry for this peer's packet flows also.
 617    */
 618   int md5sig = password && *password ? 1 : 0;
 619 #else
 620   int keylen = password ? strlen (password) : 0;
 621   struct tcp_md5sig md5sig;
 622   union sockunion *su2, *susock;
 623
 624   /* Figure out whether the socket and the sockunion are the same family..
 625    * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 626    */
 627   if (!(susock = sockunion_getsockname (sock)))
 628     return -1;
 629
 630   if (susock->sa.sa_family == su->sa.sa_family)
 631     su2 = su;
 632   else
 633     {
 634       /* oops.. */
 635       su2 = susock;
 636
 637       if (su2->sa.sa_family == AF_INET)
 638         {
 639           sockunion_free (susock);
 640           return 0;
 641         }
 642
 643       /* If this does not work, then all users of this sockopt will need to
 644        * differentiate between IPv4 and IPv6, and keep seperate sockets for
 645        * each.
 646        *
 647        * Sadly, it doesn't seem to work at present. It's unknown whether
 648        * this is a bug or not.
 649        */
 650       if (su2->sa.sa_family == AF_INET6
 651           && su->sa.sa_family == AF_INET)
 652         {
 653            su2->sin6.sin6_family = AF_INET6;
 654            /* V4Map the address */
 655            memset (&su2->sin6.sin6_addr, 0, sizeof (struct in6_addr));
 656            su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 657            memcpy (&su2->sin6.sin6_addr.s6_addr32[3], &su->sin.sin_addr, 4);
 658         }
 659     }
 660
 661   memset (&md5sig, 0, sizeof (md5sig));
 662   memcpy (&md5sig.tcpm_addr, su2, sizeof (*su2));
 663   md5sig.tcpm_keylen = keylen;
 664   if (keylen)
 665     memcpy (md5sig.tcpm_key, password, keylen);
 666   sockunion_free (susock);
 667 #endif /* GNU_LINUX */
 668   if ((ret = setsockopt (sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig, sizeof md5sig)) < 0)
 669     {
 670       /* ENOENT is harmless.  It is returned when we clear a password for which
 671          one was not previously set. */
 672       if (ENOENT == errno)
 673         ret = 0;
 674       else
 675         zlog_err ("sockopt_tcp_signature: setsockopt(%d): %s",
 676                   sock, safe_strerror(errno));
 677     }
 678   return ret;
 679 #else /* HAVE_TCP_MD5SIG */
 680   return -2;
 681 #endif /* !HAVE_TCP_MD5SIG */
 682 }