lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with GNU Zebra; see the file COPYING.  If not, write to the Free
  18  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  19  * 02111-1307, USA.
  20  */
  21
  22 #include <zebra.h>
  23
  24 #ifdef SUNOS_5
  25 #include <ifaddrs.h>
  26 #endif
  27
  28 #include "log.h"
  29 #include "sockopt.h"
  30 #include "sockunion.h"
  31
  32 void
  33 setsockopt_so_recvbuf (int sock, int size)
  34 {
  35   int orig_req = size;
  36
  37   while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof (size)) == -1)
  38     size /= 2;
  39
  40   if (size != orig_req)
  41     zlog_warn ("%s: fd %d: SO_RCVBUF set to %d (requested %d)", __func__, sock,
  42                size, orig_req);
  43 }
  44
  45 void
  46 setsockopt_so_sendbuf (const int sock, int size)
  47 {
  48   int orig_req = size;
  49
  50   while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof (size)) == -1)
  51     size /= 2;
  52
  53   if (size != orig_req)
  54     zlog_warn ("%s: fd %d: SO_SNDBUF set to %d (requested %d)", __func__, sock,
  55                size, orig_req);
  56 }
  57
  58 int
  59 getsockopt_so_sendbuf (const int sock)
  60 {
  61   u_int32_t optval;
  62   socklen_t optlen = sizeof (optval);
  63   int ret = getsockopt (sock, SOL_SOCKET, SO_SNDBUF,
  64     (char *)&optval, &optlen);
  65   if (ret < 0)
  66   {
  67     zlog_err ("fd %d: can't getsockopt SO_SNDBUF: %d (%s)",
  68       sock, errno, safe_strerror (errno));
  69     return ret;
  70   }
  71   return optval;
  72 }
  73
  74 static void *
  75 getsockopt_cmsg_data (struct msghdr *msgh, int level, int type)
  76 {
  77   struct cmsghdr *cmsg;
  78   void *ptr = NULL;
  79
  80   for (cmsg = ZCMSG_FIRSTHDR(msgh);
  81        cmsg != NULL;
  82        cmsg = CMSG_NXTHDR(msgh, cmsg))
  83     if (cmsg->cmsg_level == level && cmsg->cmsg_type)
  84       return (ptr = CMSG_DATA(cmsg));
  85
  86   return NULL;
  87 }
  88
  89 #ifdef HAVE_IPV6
  90 /* Set IPv6 packet info to the socket. */
  91 int
  92 setsockopt_ipv6_pktinfo (int sock, int val)
  93 {
  94   int ret;
  95
  96 #ifdef IPV6_RECVPKTINFO         /*2292bis-01*/
  97   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val, sizeof(val));
  98   if (ret < 0)
  99     zlog_warn ("can't setsockopt IPV6_RECVPKTINFO : %s", safe_strerror (errno));
 100 #else   /*RFC2292*/
 101   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
 102   if (ret < 0)
 103     zlog_warn ("can't setsockopt IPV6_PKTINFO : %s", safe_strerror (errno));
 104 #endif /* INIA_IPV6 */
 105   return ret;
 106 }
 107
 108 /* Set multicast hops val to the socket. */
 109 int
 110 setsockopt_ipv6_checksum (int sock, int val)
 111 {
 112   int ret;
 113
 114 #ifdef GNU_LINUX
 115   ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
 116 #else
 117   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
 118 #endif /* GNU_LINUX */
 119   if (ret < 0)
 120     zlog_warn ("can't setsockopt IPV6_CHECKSUM");
 121   return ret;
 122 }
 123
 124 /* Set multicast hops val to the socket. */
 125 int
 126 setsockopt_ipv6_multicast_hops (int sock, int val)
 127 {
 128   int ret;
 129
 130   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
 131   if (ret < 0)
 132     zlog_warn ("can't setsockopt IPV6_MULTICAST_HOPS");
 133   return ret;
 134 }
 135
 136 /* Set multicast hops val to the socket. */
 137 int
 138 setsockopt_ipv6_unicast_hops (int sock, int val)
 139 {
 140   int ret;
 141
 142   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
 143   if (ret < 0)
 144     zlog_warn ("can't setsockopt IPV6_UNICAST_HOPS");
 145   return ret;
 146 }
 147
 148 int
 149 setsockopt_ipv6_hoplimit (int sock, int val)
 150 {
 151   int ret;
 152
 153 #ifdef IPV6_RECVHOPLIMIT        /*2292bis-01*/
 154   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val, sizeof(val));
 155   if (ret < 0)
 156     zlog_warn ("can't setsockopt IPV6_RECVHOPLIMIT");
 157 #else   /*RFC2292*/
 158   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 159   if (ret < 0)
 160     zlog_warn ("can't setsockopt IPV6_HOPLIMIT");
 161 #endif
 162   return ret;
 163 }
 164
 165 /* Set multicast loop zero to the socket. */
 166 int
 167 setsockopt_ipv6_multicast_loop (int sock, int val)
 168 {
 169   int ret;
 170
 171   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 172                     sizeof (val));
 173   if (ret < 0)
 174     zlog_warn ("can't setsockopt IPV6_MULTICAST_LOOP");
 175   return ret;
 176 }
 177
 178 static int
 179 getsockopt_ipv6_ifindex (struct msghdr *msgh)
 180 {
 181   struct in6_pktinfo *pktinfo;
 182
 183   pktinfo = getsockopt_cmsg_data (msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 184
 185   return pktinfo->ipi6_ifindex;
 186 }
 187
 188 int
 189 setsockopt_ipv6_tclass(int sock, int tclass)
 190 {
 191   int ret = 0;
 192
 193 #ifdef IPV6_TCLASS /* RFC3542 */
 194   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass, sizeof (tclass));
 195   if (ret < 0)
 196     zlog_warn ("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 197                sock, tclass, safe_strerror(errno));
 198 #endif
 199   return ret;
 200 }
 201 #endif /* HAVE_IPV6 */
 202
 203 /*
 204  * Process multicast socket options for IPv4 in an OS-dependent manner.
 205  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 206  *
 207  * Many operating systems have a limit on the number of groups that
 208  * can be joined per socket (where each group and local address
 209  * counts).  This impacts OSPF, which joins groups on each interface
 210  * using a single socket.  The limit is typically 20, derived from the
 211  * original BSD multicast implementation.  Some systems have
 212  * mechanisms for increasing this limit.
 213  *
 214  * In many 4.4BSD-derived systems, multicast group operations are not
 215  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 216  * leave the group may have failed, leaving it still joined, and we
 217  * drop/join quietly to recover.  This may not be necessary, but aims to
 218  * defend against unknown behavior in that we will still return an error
 219  * if the second join fails.  It is not clear how other systems
 220  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 221  * but this behavior should not be harmful if they behave the same way,
 222  * allow leaves, or implicitly leave all groups joined to down interfaces.
 223  */
 224 int
 225 setsockopt_ipv4_multicast(int sock,
 226                         int optname,
 227                         struct in_addr if_addr,
 228                         unsigned int mcast_addr,
 229                         ifindex_t ifindex)
 230 {
 231 #ifdef HAVE_RFC3678
 232   struct group_req gr;
 233   struct sockaddr_in *si;
 234   int ret;
 235   memset (&gr, 0, sizeof(gr));
 236   si = (struct sockaddr_in *)&gr.gr_group;
 237   gr.gr_interface = ifindex;
 238   si->sin_family = AF_INET;
 239 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 240   si->sin_len = sizeof(struct sockaddr_in);
 241 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 242   si->sin_addr.s_addr = mcast_addr;
 243   ret = setsockopt(sock, IPPROTO_IP, (optname == IP_ADD_MEMBERSHIP) ?
 244     MCAST_JOIN_GROUP : MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 245   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 246     {
 247       setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 248       ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP, (void *)&gr, sizeof(gr));
 249     }
 250   return ret;
 251
 252 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 253   struct ip_mreqn mreqn;
 254   int ret;
 255
 256   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 257   memset (&mreqn, 0, sizeof(mreqn));
 258
 259   mreqn.imr_multiaddr.s_addr = mcast_addr;
 260   mreqn.imr_ifindex = ifindex;
 261
 262   ret = setsockopt(sock, IPPROTO_IP, optname,
 263                    (void *)&mreqn, sizeof(mreqn));
 264   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 265     {
 266       /* see above: handle possible problem when interface comes back up */
 267       char buf[1][INET_ADDRSTRLEN];
 268       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 269                 "re-add (fd %d, mcast %s, ifindex %u)",
 270                 sock,
 271                 inet_ntop(AF_INET, &mreqn.imr_multiaddr,
 272                           buf[0], sizeof(buf[0])), ifindex);
 273       setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 274                  (void *)&mreqn, sizeof(mreqn));
 275       ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 276                        (void *)&mreqn, sizeof(mreqn));
 277     }
 278   return ret;
 279
 280   /* Example defines for another OS, boilerplate off other code in this
 281      function, AND handle optname as per other sections for consistency !! */
 282   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 283   /* Add your favourite OS here! */
 284
 285 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 286   /* standard BSD API */
 287
 288   struct ip_mreq mreq;
 289   int ret;
 290
 291   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 292
 293
 294   memset (&mreq, 0, sizeof(mreq));
 295   mreq.imr_multiaddr.s_addr = mcast_addr;
 296 #if !defined __OpenBSD__
 297   mreq.imr_interface.s_addr = htonl (ifindex);
 298 #else
 299   mreq.imr_interface.s_addr = if_addr.s_addr;
 300 #endif
 301
 302   ret = setsockopt (sock, IPPROTO_IP, optname, (void *)&mreq, sizeof(mreq));
 303   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 304     {
 305       /* see above: handle possible problem when interface comes back up */
 306       char buf[1][INET_ADDRSTRLEN];
 307       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 308                 "re-add (fd %d, mcast %s, ifindex %u)",
 309                 sock,
 310                 inet_ntop(AF_INET, &mreq.imr_multiaddr,
 311                           buf[0], sizeof(buf[0])), ifindex);
 312       setsockopt (sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 313                   (void *)&mreq, sizeof(mreq));
 314       ret = setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 315                         (void *)&mreq, sizeof(mreq));
 316     }
 317   return ret;
 318
 319 #else
 320   #error "Unsupported multicast API"
 321 #endif /* #if OS_TYPE */
 322
 323 }
 324
 325 /*
 326  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 327  */
 328 int
 329 setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 330                              ifindex_t ifindex)
 331 {
 332
 333 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 334   struct ip_mreqn mreqn;
 335   memset (&mreqn, 0, sizeof(mreqn));
 336
 337   mreqn.imr_ifindex = ifindex;
 338   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn, sizeof(mreqn));
 339
 340   /* Example defines for another OS, boilerplate off other code in this
 341      function */
 342   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 343   /* Add your favourite OS here! */
 344 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 345   struct in_addr m;
 346
 347 #if !defined __OpenBSD__
 348   m.s_addr = htonl (ifindex);
 349 #else
 350   m.s_addr = if_addr.s_addr;
 351 #endif
 352
 353   return setsockopt (sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m, sizeof(m));
 354 #elif defined(SUNOS_5)
 355   char ifname[IF_NAMESIZE];
 356   struct ifaddrs *ifa, *ifap;
 357   struct in_addr ifaddr;
 358
 359   if (if_indextoname(ifindex, ifname) == NULL)
 360     return -1;
 361
 362   if (getifaddrs(&ifa) != 0)
 363     return -1;
 364
 365   for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next)
 366     {
 367       struct sockaddr_in *sa;
 368
 369       if (strcmp(ifap->ifa_name, ifname) != 0)
 370         continue;
 371       if (ifap->ifa_addr->sa_family != AF_INET)
 372         continue;
 373       sa = (struct sockaddr_in*)ifap->ifa_addr;
 374       memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 375       break;
 376     }
 377
 378   freeifaddrs(ifa);
 379   if (!ifap) /* This means we did not find an IP */
 380     return -1;
 381
 382   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr, sizeof(ifaddr));
 383 #else
 384   #error "Unsupported multicast API"
 385 #endif
 386 }
 387
 388 int
 389 setsockopt_ipv4_multicast_loop (int sock, u_char val)
 390 {
 391   int ret;
 392
 393   ret = setsockopt (sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *) &val,
 394                     sizeof (val));
 395   if (ret < 0)
 396     zlog_warn ("can't setsockopt IP_MULTICAST_LOOP");
 397
 398   return ret;
 399 }
 400
 401 static int
 402 setsockopt_ipv4_ifindex (int sock, ifindex_t val)
 403 {
 404   int ret;
 405
 406 #if defined (IP_PKTINFO)
 407   if ((ret = setsockopt (sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof (val))) < 0)
 408     zlog_warn ("Can't set IP_PKTINFO option for fd %d to %d: %s",
 409                sock,val,safe_strerror(errno));
 410 #elif defined (IP_RECVIF)
 411   if ((ret = setsockopt (sock, IPPROTO_IP, IP_RECVIF, &val, sizeof (val))) < 0)
 412     zlog_warn ("Can't set IP_RECVIF option for fd %d to %d: %s",
 413                sock,val,safe_strerror(errno));
 414 #else
 415 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 416 #warning "Will not be able to receive link info."
 417 #warning "Things might be seriously broken.."
 418   /* XXX Does this ever happen?  Should there be a zlog_warn message here? */
 419   ret = -1;
 420 #endif
 421   return ret;
 422 }
 423
 424 int
 425 setsockopt_ipv4_tos(int sock, int tos)
 426 {
 427   int ret;
 428
 429   ret = setsockopt (sock, IPPROTO_IP, IP_TOS, &tos, sizeof (tos));
 430   if (ret < 0)
 431     zlog_warn ("Can't set IP_TOS option for fd %d to %#x: %s",
 432                sock, tos, safe_strerror(errno));
 433   return ret;
 434 }
 435
 436
 437 int
 438 setsockopt_ifindex (int af, int sock, ifindex_t val)
 439 {
 440   int ret = -1;
 441
 442   switch (af)
 443     {
 444       case AF_INET:
 445         ret = setsockopt_ipv4_ifindex (sock, val);
 446         break;
 447 #ifdef HAVE_IPV6
 448       case AF_INET6:
 449         ret = setsockopt_ipv6_pktinfo (sock, val);
 450         break;
 451 #endif
 452       default:
 453         zlog_warn ("setsockopt_ifindex: unknown address family %d", af);
 454     }
 455   return ret;
 456 }
 457
 458 /*
 459  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 460  * may or may not have control data about the incoming interface.
 461  *
 462  * Returns the interface index (small integer >= 1) if it can be
 463  * determined, or else 0.
 464  */
 465 static ifindex_t
 466 getsockopt_ipv4_ifindex (struct msghdr *msgh)
 467 {
 468   /* XXX: initialize to zero?  (Always overwritten, so just cosmetic.) */
 469   ifindex_t ifindex = -1;
 470
 471 #if defined(IP_PKTINFO)
 472 /* Linux pktinfo based ifindex retrieval */
 473   struct in_pktinfo *pktinfo;
 474
 475   pktinfo =
 476     (struct in_pktinfo *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_PKTINFO);
 477   /* XXX Can pktinfo be NULL?  Clean up post 0.98. */
 478   ifindex = pktinfo->ipi_ifindex;
 479
 480 #elif defined(IP_RECVIF)
 481
 482   /* retrieval based on IP_RECVIF */
 483
 484 #ifndef SUNOS_5
 485   /* BSD systems use a sockaddr_dl as the control message payload. */
 486   struct sockaddr_dl *sdl;
 487 #else
 488   /* SUNOS_5 uses an integer with the index. */
 489   ifindex_t *ifindex_p;
 490 #endif /* SUNOS_5 */
 491
 492 #ifndef SUNOS_5
 493   /* BSD */
 494   sdl =
 495     (struct sockaddr_dl *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 496   if (sdl != NULL)
 497     ifindex = sdl->sdl_index;
 498   else
 499     ifindex = 0;
 500 #else
 501   /*
 502    * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 503    * enable it fails with errno=99, and the struct msghdr has
 504    * controllen 0.
 505    */
 506   ifindex_p = (uint_t *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 507   if (ifindex_p != NULL)
 508     ifindex = *ifindex_p;
 509   else
 510     ifindex = 0;
 511 #endif /* SUNOS_5 */
 512
 513 #else
 514   /*
 515    * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 516    * XXX Decide if this is a core service, or if daemons have to cope.
 517    * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 518    * daemons have to cope.
 519    */
 520 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 521 #warning "Some daemons may fail to operate correctly!"
 522   ifindex = 0;
 523
 524 #endif /* IP_PKTINFO */
 525
 526   return ifindex;
 527 }
 528
 529 /* return ifindex, 0 if none found */
 530 ifindex_t
 531 getsockopt_ifindex (int af, struct msghdr *msgh)
 532 {
 533   switch (af)
 534     {
 535       case AF_INET:
 536         return (getsockopt_ipv4_ifindex (msgh));
 537         break;
 538 #ifdef HAVE_IPV6
 539       case AF_INET6:
 540         return (getsockopt_ipv6_ifindex (msgh));
 541         break;
 542 #endif
 543       default:
 544         zlog_warn ("getsockopt_ifindex: unknown address family %d", af);
 545         return 0;
 546     }
 547 }
 548
 549 /* swab iph between order system uses for IP_HDRINCL and host order */
 550 void
 551 sockopt_iphdrincl_swab_htosys (struct ip *iph)
 552 {
 553   /* BSD and derived take iph in network order, except for
 554    * ip_len and ip_off
 555    */
 556 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 557   iph->ip_len = htons(iph->ip_len);
 558   iph->ip_off = htons(iph->ip_off);
 559 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 560
 561   iph->ip_id = htons(iph->ip_id);
 562 }
 563
 564 void
 565 sockopt_iphdrincl_swab_systoh (struct ip *iph)
 566 {
 567 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 568   iph->ip_len = ntohs(iph->ip_len);
 569   iph->ip_off = ntohs(iph->ip_off);
 570 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 571
 572   iph->ip_id = ntohs(iph->ip_id);
 573 }
 574
 575 int
 576 sockopt_tcp_rtt (int sock)
 577 {
 578 #ifdef TCP_INFO
 579   struct tcp_info ti;
 580   socklen_t len = sizeof(ti);
 581
 582   if (getsockopt (sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 583     return 0;
 584
 585   return ti.tcpi_rtt / 1000;
 586 #else
 587   return 0;
 588 #endif
 589 }
 590
 591 int
 592 sockopt_tcp_signature (int sock, union sockunion *su, const char *password)
 593 {
 594 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
 595   /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
 596    * version of the Quagga patch (based on work by Rick Payne, and Bruce
 597    * Simpson)
 598    */
 599 #define TCP_MD5_AUTH 13
 600 #define TCP_MD5_AUTH_ADD 1
 601 #define TCP_MD5_AUTH_DEL 2
 602   struct tcp_rfc2385_cmd {
 603     u_int8_t     command;    /* Command - Add/Delete */
 604     u_int32_t    address;    /* IPV4 address associated */
 605     u_int8_t     keylen;     /* MD5 Key len (do NOT assume 0 terminated ascii) */
 606     void         *key;       /* MD5 Key */
 607   } cmd;
 608   struct in_addr *addr = &su->sin.sin_addr;
 609
 610   cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
 611   cmd.address = addr->s_addr;
 612   cmd.keylen = (password != NULL ? strlen (password) : 0);
 613   cmd.key = password;
 614
 615   return setsockopt (sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
 616
 617 #elif HAVE_DECL_TCP_MD5SIG
 618   int ret;
 619 #ifndef GNU_LINUX
 620   /*
 621    * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 622    * and add/remove an SP entry for this peer's packet flows also.
 623    */
 624   int md5sig = password && *password ? 1 : 0;
 625 #else
 626   int keylen = password ? strlen (password) : 0;
 627   struct tcp_md5sig md5sig;
 628   union sockunion *su2, *susock;
 629
 630   /* Figure out whether the socket and the sockunion are the same family..
 631    * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 632    */
 633   if (!(susock = sockunion_getsockname (sock)))
 634     return -1;
 635
 636   if (susock->sa.sa_family == su->sa.sa_family)
 637     su2 = su;
 638   else
 639     {
 640       /* oops.. */
 641       su2 = susock;
 642
 643       if (su2->sa.sa_family == AF_INET)
 644         {
 645           sockunion_free (susock);
 646           return 0;
 647         }
 648
 649 #ifdef HAVE_IPV6
 650       /* If this does not work, then all users of this sockopt will need to
 651        * differentiate between IPv4 and IPv6, and keep seperate sockets for
 652        * each.
 653        *
 654        * Sadly, it doesn't seem to work at present. It's unknown whether
 655        * this is a bug or not.
 656        */
 657       if (su2->sa.sa_family == AF_INET6
 658           && su->sa.sa_family == AF_INET)
 659         {
 660            su2->sin6.sin6_family = AF_INET6;
 661            /* V4Map the address */
 662            memset (&su2->sin6.sin6_addr, 0, sizeof (struct in6_addr));
 663            su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 664            memcpy (&su2->sin6.sin6_addr.s6_addr32[3], &su->sin.sin_addr, 4);
 665         }
 666 #endif
 667     }
 668
 669   memset (&md5sig, 0, sizeof (md5sig));
 670   memcpy (&md5sig.tcpm_addr, su2, sizeof (*su2));
 671   md5sig.tcpm_keylen = keylen;
 672   if (keylen)
 673     memcpy (md5sig.tcpm_key, password, keylen);
 674   sockunion_free (susock);
 675 #endif /* GNU_LINUX */
 676   if ((ret = setsockopt (sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig, sizeof md5sig)) < 0)
 677     {
 678       /* ENOENT is harmless.  It is returned when we clear a password for which
 679          one was not previously set. */
 680       if (ENOENT == errno)
 681         ret = 0;
 682       else
 683         zlog_err ("sockopt_tcp_signature: setsockopt(%d): %s",
 684                   sock, safe_strerror(errno));
 685     }
 686   return ret;
 687 #else /* HAVE_TCP_MD5SIG */
 688   return -2;
 689 #endif /* !HAVE_TCP_MD5SIG */
 690 }