lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #ifdef SUNOS_5
  24 #include <ifaddrs.h>
  25 #endif
  26
  27 #include "log.h"
  28 #include "sockopt.h"
  29 #include "sockunion.h"
  30
  31 void setsockopt_so_recvbuf(int sock, int size)
  32 {
  33         int orig_req = size;
  34
  35         while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof(size))
  36                == -1)
  37                 size /= 2;
  38
  39         if (size != orig_req)
  40                 zlog_warn("%s: fd %d: SO_RCVBUF set to %d (requested %d)",
  41                           __func__, sock, size, orig_req);
  42 }
  43
  44 void setsockopt_so_sendbuf(const int sock, int size)
  45 {
  46         int orig_req = size;
  47
  48         while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size))
  49                == -1)
  50                 size /= 2;
  51
  52         if (size != orig_req)
  53                 zlog_warn("%s: fd %d: SO_SNDBUF set to %d (requested %d)",
  54                           __func__, sock, size, orig_req);
  55 }
  56
  57 int getsockopt_so_sendbuf(const int sock)
  58 {
  59         uint32_t optval;
  60         socklen_t optlen = sizeof(optval);
  61         int ret = getsockopt(sock, SOL_SOCKET, SO_SNDBUF, (char *)&optval,
  62                              &optlen);
  63         if (ret < 0) {
  64                 zlog_err("fd %d: can't getsockopt SO_SNDBUF: %d (%s)", sock,
  65                          errno, safe_strerror(errno));
  66                 return ret;
  67         }
  68         return optval;
  69 }
  70
  71 static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
  72 {
  73         struct cmsghdr *cmsg;
  74         void *ptr = NULL;
  75
  76         for (cmsg = ZCMSG_FIRSTHDR(msgh); cmsg != NULL;
  77              cmsg = CMSG_NXTHDR(msgh, cmsg))
  78                 if (cmsg->cmsg_level == level && cmsg->cmsg_type == type)
  79                         return (ptr = CMSG_DATA(cmsg));
  80
  81         return NULL;
  82 }
  83
  84 /* Set IPv6 packet info to the socket. */
  85 int setsockopt_ipv6_pktinfo(int sock, int val)
  86 {
  87         int ret;
  88
  89 #ifdef IPV6_RECVPKTINFO /*2292bis-01*/
  90         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val,
  91                          sizeof(val));
  92         if (ret < 0)
  93                 zlog_warn("can't setsockopt IPV6_RECVPKTINFO : %s",
  94                           safe_strerror(errno));
  95 #else  /*RFC2292*/
  96         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
  97         if (ret < 0)
  98                 zlog_warn("can't setsockopt IPV6_PKTINFO : %s",
  99                           safe_strerror(errno));
 100 #endif /* INIA_IPV6 */
 101         return ret;
 102 }
 103
 104 /* Set multicast hops val to the socket. */
 105 int setsockopt_ipv6_checksum(int sock, int val)
 106 {
 107         int ret;
 108
 109 #ifdef GNU_LINUX
 110         ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
 111 #else
 112         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
 113 #endif /* GNU_LINUX */
 114         if (ret < 0)
 115                 zlog_warn("can't setsockopt IPV6_CHECKSUM");
 116         return ret;
 117 }
 118
 119 /* Set multicast hops val to the socket. */
 120 int setsockopt_ipv6_multicast_hops(int sock, int val)
 121 {
 122         int ret;
 123
 124         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val,
 125                          sizeof(val));
 126         if (ret < 0)
 127                 zlog_warn("can't setsockopt IPV6_MULTICAST_HOPS");
 128         return ret;
 129 }
 130
 131 /* Set multicast hops val to the socket. */
 132 int setsockopt_ipv6_unicast_hops(int sock, int val)
 133 {
 134         int ret;
 135
 136         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val,
 137                          sizeof(val));
 138         if (ret < 0)
 139                 zlog_warn("can't setsockopt IPV6_UNICAST_HOPS");
 140         return ret;
 141 }
 142
 143 int setsockopt_ipv6_hoplimit(int sock, int val)
 144 {
 145         int ret;
 146
 147 #ifdef IPV6_RECVHOPLIMIT /*2292bis-01*/
 148         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val,
 149                          sizeof(val));
 150         if (ret < 0)
 151                 zlog_warn("can't setsockopt IPV6_RECVHOPLIMIT");
 152 #else /*RFC2292*/
 153         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 154         if (ret < 0)
 155                 zlog_warn("can't setsockopt IPV6_HOPLIMIT");
 156 #endif
 157         return ret;
 158 }
 159
 160 /* Set multicast loop zero to the socket. */
 161 int setsockopt_ipv6_multicast_loop(int sock, int val)
 162 {
 163         int ret;
 164
 165         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 166                          sizeof(val));
 167         if (ret < 0)
 168                 zlog_warn("can't setsockopt IPV6_MULTICAST_LOOP");
 169         return ret;
 170 }
 171
 172 static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
 173 {
 174         struct in6_pktinfo *pktinfo;
 175
 176         pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 177
 178         return pktinfo->ipi6_ifindex;
 179 }
 180
 181 int setsockopt_ipv6_tclass(int sock, int tclass)
 182 {
 183         int ret = 0;
 184
 185 #ifdef IPV6_TCLASS /* RFC3542 */
 186         ret = setsockopt(sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass,
 187                          sizeof(tclass));
 188         if (ret < 0)
 189                 zlog_warn("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 190                           sock, tclass, safe_strerror(errno));
 191 #endif
 192         return ret;
 193 }
 194
 195 /*
 196  * Process multicast socket options for IPv4 in an OS-dependent manner.
 197  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 198  *
 199  * Many operating systems have a limit on the number of groups that
 200  * can be joined per socket (where each group and local address
 201  * counts).  This impacts OSPF, which joins groups on each interface
 202  * using a single socket.  The limit is typically 20, derived from the
 203  * original BSD multicast implementation.  Some systems have
 204  * mechanisms for increasing this limit.
 205  *
 206  * In many 4.4BSD-derived systems, multicast group operations are not
 207  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 208  * leave the group may have failed, leaving it still joined, and we
 209  * drop/join quietly to recover.  This may not be necessary, but aims to
 210  * defend against unknown behavior in that we will still return an error
 211  * if the second join fails.  It is not clear how other systems
 212  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 213  * but this behavior should not be harmful if they behave the same way,
 214  * allow leaves, or implicitly leave all groups joined to down interfaces.
 215  */
 216 int setsockopt_ipv4_multicast(int sock, int optname, struct in_addr if_addr,
 217                               unsigned int mcast_addr, ifindex_t ifindex)
 218 {
 219 #ifdef HAVE_RFC3678
 220         struct group_req gr;
 221         struct sockaddr_in *si;
 222         int ret;
 223         memset(&gr, 0, sizeof(gr));
 224         si = (struct sockaddr_in *)&gr.gr_group;
 225         gr.gr_interface = ifindex;
 226         si->sin_family = AF_INET;
 227 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 228         si->sin_len = sizeof(struct sockaddr_in);
 229 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 230         si->sin_addr.s_addr = mcast_addr;
 231         ret = setsockopt(sock, IPPROTO_IP,
 232                          (optname == IP_ADD_MEMBERSHIP) ? MCAST_JOIN_GROUP
 233                                                         : MCAST_LEAVE_GROUP,
 234                          (void *)&gr, sizeof(gr));
 235         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 236             && (errno == EADDRINUSE)) {
 237                 setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr,
 238                            sizeof(gr));
 239                 ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP,
 240                                  (void *)&gr, sizeof(gr));
 241         }
 242         return ret;
 243
 244 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 245         struct ip_mreqn mreqn;
 246         int ret;
 247
 248         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 249         memset(&mreqn, 0, sizeof(mreqn));
 250
 251         mreqn.imr_multiaddr.s_addr = mcast_addr;
 252         mreqn.imr_ifindex = ifindex;
 253
 254         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreqn,
 255                          sizeof(mreqn));
 256         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 257             && (errno == EADDRINUSE)) {
 258                 /* see above: handle possible problem when interface comes back
 259                  * up */
 260                 char buf[1][INET_ADDRSTRLEN];
 261                 zlog_info(
 262                         "setsockopt_ipv4_multicast attempting to drop and "
 263                         "re-add (fd %d, mcast %s, ifindex %u)",
 264                         sock, inet_ntop(AF_INET, &mreqn.imr_multiaddr, buf[0],
 265                                         sizeof(buf[0])),
 266                         ifindex);
 267                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreqn,
 268                            sizeof(mreqn));
 269                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 270                                  (void *)&mreqn, sizeof(mreqn));
 271         }
 272         return ret;
 273
 274 /* Example defines for another OS, boilerplate off other code in this
 275    function, AND handle optname as per other sections for consistency !! */
 276 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 277 /* Add your favourite OS here! */
 278
 279 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 280         /* standard BSD API */
 281
 282         struct ip_mreq mreq;
 283         int ret;
 284
 285         assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 286
 287
 288         memset(&mreq, 0, sizeof(mreq));
 289         mreq.imr_multiaddr.s_addr = mcast_addr;
 290 #if !defined __OpenBSD__
 291         mreq.imr_interface.s_addr = htonl(ifindex);
 292 #else
 293         mreq.imr_interface.s_addr = if_addr.s_addr;
 294 #endif
 295
 296         ret = setsockopt(sock, IPPROTO_IP, optname, (void *)&mreq,
 297                          sizeof(mreq));
 298         if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP)
 299             && (errno == EADDRINUSE)) {
 300                 /* see above: handle possible problem when interface comes back
 301                  * up */
 302                 char buf[1][INET_ADDRSTRLEN];
 303                 zlog_info(
 304                         "setsockopt_ipv4_multicast attempting to drop and "
 305                         "re-add (fd %d, mcast %s, ifindex %u)",
 306                         sock, inet_ntop(AF_INET, &mreq.imr_multiaddr, buf[0],
 307                                         sizeof(buf[0])),
 308                         ifindex);
 309                 setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (void *)&mreq,
 310                            sizeof(mreq));
 311                 ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 312                                  (void *)&mreq, sizeof(mreq));
 313         }
 314         return ret;
 315
 316 #else
 317 #error "Unsupported multicast API"
 318 #endif /* #if OS_TYPE */
 319 }
 320
 321 /*
 322  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 323  */
 324 int setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 325                                  ifindex_t ifindex)
 326 {
 327
 328 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 329         struct ip_mreqn mreqn;
 330         memset(&mreqn, 0, sizeof(mreqn));
 331
 332         mreqn.imr_ifindex = ifindex;
 333         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn,
 334                           sizeof(mreqn));
 335
 336 /* Example defines for another OS, boilerplate off other code in this
 337    function */
 338 /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 339 /* Add your favourite OS here! */
 340 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 341         struct in_addr m;
 342
 343 #if !defined __OpenBSD__
 344         m.s_addr = htonl(ifindex);
 345 #else
 346         m.s_addr = if_addr.s_addr;
 347 #endif
 348
 349         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m,
 350                           sizeof(m));
 351 #elif defined(SUNOS_5)
 352         char ifname[IF_NAMESIZE];
 353         struct ifaddrs *ifa, *ifap;
 354         struct in_addr ifaddr;
 355
 356         if (if_indextoname(ifindex, ifname) == NULL)
 357                 return -1;
 358
 359         if (getifaddrs(&ifa) != 0)
 360                 return -1;
 361
 362         for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next) {
 363                 struct sockaddr_in *sa;
 364
 365                 if (strcmp(ifap->ifa_name, ifname) != 0)
 366                         continue;
 367                 if (ifap->ifa_addr->sa_family != AF_INET)
 368                         continue;
 369                 sa = (struct sockaddr_in *)ifap->ifa_addr;
 370                 memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 371                 break;
 372         }
 373
 374         freeifaddrs(ifa);
 375         if (!ifap) /* This means we did not find an IP */
 376                 return -1;
 377
 378         return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr,
 379                           sizeof(ifaddr));
 380 #else
 381 #error "Unsupported multicast API"
 382 #endif
 383 }
 384
 385 int setsockopt_ipv4_multicast_loop(int sock, uint8_t val)
 386 {
 387         int ret;
 388
 389         ret = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *)&val,
 390                          sizeof(val));
 391         if (ret < 0)
 392                 zlog_warn("can't setsockopt IP_MULTICAST_LOOP");
 393
 394         return ret;
 395 }
 396
 397 static int setsockopt_ipv4_ifindex(int sock, ifindex_t val)
 398 {
 399         int ret;
 400
 401 #if defined(IP_PKTINFO)
 402         if ((ret = setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val)))
 403             < 0)
 404                 zlog_warn("Can't set IP_PKTINFO option for fd %d to %d: %s",
 405                           sock, val, safe_strerror(errno));
 406 #elif defined(IP_RECVIF)
 407         if ((ret = setsockopt(sock, IPPROTO_IP, IP_RECVIF, &val, sizeof(val)))
 408             < 0)
 409                 zlog_warn("Can't set IP_RECVIF option for fd %d to %d: %s",
 410                           sock, val, safe_strerror(errno));
 411 #else
 412 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 413 #warning "Will not be able to receive link info."
 414 #warning "Things might be seriously broken.."
 415         /* XXX Does this ever happen?  Should there be a zlog_warn message here?
 416          */
 417         ret = -1;
 418 #endif
 419         return ret;
 420 }
 421
 422 int setsockopt_ipv4_tos(int sock, int tos)
 423 {
 424         int ret;
 425
 426         ret = setsockopt(sock, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
 427         if (ret < 0)
 428                 zlog_warn("Can't set IP_TOS option for fd %d to %#x: %s", sock,
 429                           tos, safe_strerror(errno));
 430         return ret;
 431 }
 432
 433
 434 int setsockopt_ifindex(int af, int sock, ifindex_t val)
 435 {
 436         int ret = -1;
 437
 438         switch (af) {
 439         case AF_INET:
 440                 ret = setsockopt_ipv4_ifindex(sock, val);
 441                 break;
 442         case AF_INET6:
 443                 ret = setsockopt_ipv6_pktinfo(sock, val);
 444                 break;
 445         default:
 446                 zlog_warn("setsockopt_ifindex: unknown address family %d", af);
 447         }
 448         return ret;
 449 }
 450
 451 /*
 452  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 453  * may or may not have control data about the incoming interface.
 454  *
 455  * Returns the interface index (small integer >= 1) if it can be
 456  * determined, or else 0.
 457  */
 458 static ifindex_t getsockopt_ipv4_ifindex(struct msghdr *msgh)
 459 {
 460         ifindex_t ifindex;
 461
 462 #if defined(IP_PKTINFO)
 463         /* Linux pktinfo based ifindex retrieval */
 464         struct in_pktinfo *pktinfo;
 465
 466         pktinfo = (struct in_pktinfo *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 467                                                             IP_PKTINFO);
 468
 469         /* getsockopt_ifindex() will forward this, being 0 "not found" */
 470         if (pktinfo == NULL)
 471                 return 0;
 472
 473         ifindex = pktinfo->ipi_ifindex;
 474
 475 #elif defined(IP_RECVIF)
 476
 477 /* retrieval based on IP_RECVIF */
 478
 479 #ifndef SUNOS_5
 480         /* BSD systems use a sockaddr_dl as the control message payload. */
 481         struct sockaddr_dl *sdl;
 482 #else
 483         /* SUNOS_5 uses an integer with the index. */
 484         ifindex_t *ifindex_p;
 485 #endif /* SUNOS_5 */
 486
 487 #ifndef SUNOS_5
 488         /* BSD */
 489         sdl = (struct sockaddr_dl *)getsockopt_cmsg_data(msgh, IPPROTO_IP,
 490                                                          IP_RECVIF);
 491         if (sdl != NULL)
 492                 ifindex = sdl->sdl_index;
 493         else
 494                 ifindex = 0;
 495 #else
 496         /*
 497          * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 498          * enable it fails with errno=99, and the struct msghdr has
 499          * controllen 0.
 500          */
 501         ifindex_p = (uint_t *)getsockopt_cmsg_data(msgh, IPPROTO_IP, IP_RECVIF);
 502         if (ifindex_p != NULL)
 503                 ifindex = *ifindex_p;
 504         else
 505                 ifindex = 0;
 506 #endif /* SUNOS_5 */
 507
 508 #else
 509 /*
 510  * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 511  * XXX Decide if this is a core service, or if daemons have to cope.
 512  * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 513  * daemons have to cope.
 514  */
 515 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 516 #warning "Some daemons may fail to operate correctly!"
 517         ifindex = 0;
 518
 519 #endif /* IP_PKTINFO */
 520
 521         return ifindex;
 522 }
 523
 524 /* return ifindex, 0 if none found */
 525 ifindex_t getsockopt_ifindex(int af, struct msghdr *msgh)
 526 {
 527         switch (af) {
 528         case AF_INET:
 529                 return (getsockopt_ipv4_ifindex(msgh));
 530                 break;
 531         case AF_INET6:
 532                 return (getsockopt_ipv6_ifindex(msgh));
 533                 break;
 534         default:
 535                 zlog_warn("getsockopt_ifindex: unknown address family %d", af);
 536                 return 0;
 537         }
 538 }
 539
 540 /* swab iph between order system uses for IP_HDRINCL and host order */
 541 void sockopt_iphdrincl_swab_htosys(struct ip *iph)
 542 {
 543 /* BSD and derived take iph in network order, except for
 544  * ip_len and ip_off
 545  */
 546 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 547         iph->ip_len = htons(iph->ip_len);
 548         iph->ip_off = htons(iph->ip_off);
 549 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 550
 551         iph->ip_id = htons(iph->ip_id);
 552 }
 553
 554 void sockopt_iphdrincl_swab_systoh(struct ip *iph)
 555 {
 556 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 557         iph->ip_len = ntohs(iph->ip_len);
 558         iph->ip_off = ntohs(iph->ip_off);
 559 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 560
 561         iph->ip_id = ntohs(iph->ip_id);
 562 }
 563
 564 int sockopt_tcp_rtt(int sock)
 565 {
 566 #ifdef TCP_INFO
 567         struct tcp_info ti;
 568         socklen_t len = sizeof(ti);
 569
 570         if (getsockopt(sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 571                 return 0;
 572
 573         return ti.tcpi_rtt / 1000;
 574 #else
 575         return 0;
 576 #endif
 577 }
 578
 579 int sockopt_tcp_signature(int sock, union sockunion *su, const char *password)
 580 {
 581 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
 582 /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
 583  * version of the Quagga patch (based on work by Rick Payne, and Bruce
 584  * Simpson)
 585  */
 586 #define TCP_MD5_AUTH 13
 587 #define TCP_MD5_AUTH_ADD 1
 588 #define TCP_MD5_AUTH_DEL 2
 589         struct tcp_rfc2385_cmd {
 590                 uint8_t command;  /* Command - Add/Delete */
 591                 uint32_t address; /* IPV4 address associated */
 592                 uint8_t keylen;   /* MD5 Key len (do NOT assume 0 terminated
 593                                       ascii) */
 594                 void *key;       /* MD5 Key */
 595         } cmd;
 596         struct in_addr *addr = &su->sin.sin_addr;
 597
 598         cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
 599         cmd.address = addr->s_addr;
 600         cmd.keylen = (password != NULL ? strlen(password) : 0);
 601         cmd.key = password;
 602
 603         return setsockopt(sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
 604
 605 #elif HAVE_DECL_TCP_MD5SIG
 606         int ret;
 607 #ifndef GNU_LINUX
 608         /*
 609          * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 610          * and add/remove an SP entry for this peer's packet flows also.
 611          */
 612         int md5sig = password && *password ? 1 : 0;
 613 #else
 614         int keylen = password ? strlen(password) : 0;
 615         struct tcp_md5sig md5sig;
 616         union sockunion *su2, *susock;
 617
 618         /* Figure out whether the socket and the sockunion are the same family..
 619          * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 620          */
 621         if (!(susock = sockunion_getsockname(sock)))
 622                 return -1;
 623
 624         if (susock->sa.sa_family == su->sa.sa_family)
 625                 su2 = su;
 626         else {
 627                 /* oops.. */
 628                 su2 = susock;
 629
 630                 if (su2->sa.sa_family == AF_INET) {
 631                         sockunion_free(susock);
 632                         return 0;
 633                 }
 634
 635                 /* If this does not work, then all users of this sockopt will
 636                  * need to
 637                  * differentiate between IPv4 and IPv6, and keep seperate
 638                  * sockets for
 639                  * each.
 640                  *
 641                  * Sadly, it doesn't seem to work at present. It's unknown
 642                  * whether
 643                  * this is a bug or not.
 644                  */
 645                 if (su2->sa.sa_family == AF_INET6
 646                     && su->sa.sa_family == AF_INET) {
 647                         su2->sin6.sin6_family = AF_INET6;
 648                         /* V4Map the address */
 649                         memset(&su2->sin6.sin6_addr, 0,
 650                                sizeof(struct in6_addr));
 651                         su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 652                         memcpy(&su2->sin6.sin6_addr.s6_addr32[3],
 653                                &su->sin.sin_addr, 4);
 654                 }
 655         }
 656
 657         memset(&md5sig, 0, sizeof(md5sig));
 658         memcpy(&md5sig.tcpm_addr, su2, sizeof(*su2));
 659         md5sig.tcpm_keylen = keylen;
 660         if (keylen)
 661                 memcpy(md5sig.tcpm_key, password, keylen);
 662         sockunion_free(susock);
 663 #endif /* GNU_LINUX */
 664         if ((ret = setsockopt(sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig,
 665                               sizeof md5sig))
 666             < 0) {
 667                 /* ENOENT is harmless.  It is returned when we clear a password
 668                    for which
 669                    one was not previously set. */
 670                 if (ENOENT == errno)
 671                         ret = 0;
 672                 else
 673                         zlog_err("sockopt_tcp_signature: setsockopt(%d): %s",
 674                                  sock, safe_strerror(errno));
 675         }
 676         return ret;
 677 #else  /* HAVE_TCP_MD5SIG */
 678         return -2;
 679 #endif /* !HAVE_TCP_MD5SIG */
 680 }