lib/sockopt.c

   1 /* setsockopt functions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #ifdef SUNOS_5
  24 #include <ifaddrs.h>
  25 #endif
  26
  27 #include "log.h"
  28 #include "sockopt.h"
  29 #include "sockunion.h"
  30
  31 void
  32 setsockopt_so_recvbuf (int sock, int size)
  33 {
  34   int orig_req = size;
  35
  36   while (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &size, sizeof (size)) == -1)
  37     size /= 2;
  38
  39   if (size != orig_req)
  40     zlog_warn ("%s: fd %d: SO_RCVBUF set to %d (requested %d)", __func__, sock,
  41                size, orig_req);
  42 }
  43
  44 void
  45 setsockopt_so_sendbuf (const int sock, int size)
  46 {
  47   int orig_req = size;
  48
  49   while (setsockopt(sock, SOL_SOCKET, SO_SNDBUF, &size, sizeof (size)) == -1)
  50     size /= 2;
  51
  52   if (size != orig_req)
  53     zlog_warn ("%s: fd %d: SO_SNDBUF set to %d (requested %d)", __func__, sock,
  54                size, orig_req);
  55 }
  56
  57 int
  58 getsockopt_so_sendbuf (const int sock)
  59 {
  60   u_int32_t optval;
  61   socklen_t optlen = sizeof (optval);
  62   int ret = getsockopt (sock, SOL_SOCKET, SO_SNDBUF,
  63     (char *)&optval, &optlen);
  64   if (ret < 0)
  65   {
  66     zlog_err ("fd %d: can't getsockopt SO_SNDBUF: %d (%s)",
  67       sock, errno, safe_strerror (errno));
  68     return ret;
  69   }
  70   return optval;
  71 }
  72
  73 static void *
  74 getsockopt_cmsg_data (struct msghdr *msgh, int level, int type)
  75 {
  76   struct cmsghdr *cmsg;
  77   void *ptr = NULL;
  78
  79   for (cmsg = ZCMSG_FIRSTHDR(msgh);
  80        cmsg != NULL;
  81        cmsg = CMSG_NXTHDR(msgh, cmsg))
  82     if (cmsg->cmsg_level == level && cmsg->cmsg_type)
  83       return (ptr = CMSG_DATA(cmsg));
  84
  85   return NULL;
  86 }
  87
  88 /* Set IPv6 packet info to the socket. */
  89 int
  90 setsockopt_ipv6_pktinfo (int sock, int val)
  91 {
  92   int ret;
  93
  94 #ifdef IPV6_RECVPKTINFO         /*2292bis-01*/
  95   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &val, sizeof(val));
  96   if (ret < 0)
  97     zlog_warn ("can't setsockopt IPV6_RECVPKTINFO : %s", safe_strerror (errno));
  98 #else   /*RFC2292*/
  99   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_PKTINFO, &val, sizeof(val));
 100   if (ret < 0)
 101     zlog_warn ("can't setsockopt IPV6_PKTINFO : %s", safe_strerror (errno));
 102 #endif /* INIA_IPV6 */
 103   return ret;
 104 }
 105
 106 /* Set multicast hops val to the socket. */
 107 int
 108 setsockopt_ipv6_checksum (int sock, int val)
 109 {
 110   int ret;
 111
 112 #ifdef GNU_LINUX
 113   ret = setsockopt(sock, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
 114 #else
 115   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_CHECKSUM, &val, sizeof(val));
 116 #endif /* GNU_LINUX */
 117   if (ret < 0)
 118     zlog_warn ("can't setsockopt IPV6_CHECKSUM");
 119   return ret;
 120 }
 121
 122 /* Set multicast hops val to the socket. */
 123 int
 124 setsockopt_ipv6_multicast_hops (int sock, int val)
 125 {
 126   int ret;
 127
 128   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
 129   if (ret < 0)
 130     zlog_warn ("can't setsockopt IPV6_MULTICAST_HOPS");
 131   return ret;
 132 }
 133
 134 /* Set multicast hops val to the socket. */
 135 int
 136 setsockopt_ipv6_unicast_hops (int sock, int val)
 137 {
 138   int ret;
 139
 140   ret = setsockopt(sock, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
 141   if (ret < 0)
 142     zlog_warn ("can't setsockopt IPV6_UNICAST_HOPS");
 143   return ret;
 144 }
 145
 146 int
 147 setsockopt_ipv6_hoplimit (int sock, int val)
 148 {
 149   int ret;
 150
 151 #ifdef IPV6_RECVHOPLIMIT        /*2292bis-01*/
 152   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &val, sizeof(val));
 153   if (ret < 0)
 154     zlog_warn ("can't setsockopt IPV6_RECVHOPLIMIT");
 155 #else   /*RFC2292*/
 156   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_HOPLIMIT, &val, sizeof(val));
 157   if (ret < 0)
 158     zlog_warn ("can't setsockopt IPV6_HOPLIMIT");
 159 #endif
 160   return ret;
 161 }
 162
 163 /* Set multicast loop zero to the socket. */
 164 int
 165 setsockopt_ipv6_multicast_loop (int sock, int val)
 166 {
 167   int ret;
 168
 169   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &val,
 170                     sizeof (val));
 171   if (ret < 0)
 172     zlog_warn ("can't setsockopt IPV6_MULTICAST_LOOP");
 173   return ret;
 174 }
 175
 176 static int
 177 getsockopt_ipv6_ifindex (struct msghdr *msgh)
 178 {
 179   struct in6_pktinfo *pktinfo;
 180
 181   pktinfo = getsockopt_cmsg_data (msgh, IPPROTO_IPV6, IPV6_PKTINFO);
 182
 183   return pktinfo->ipi6_ifindex;
 184 }
 185
 186 int
 187 setsockopt_ipv6_tclass(int sock, int tclass)
 188 {
 189   int ret = 0;
 190
 191 #ifdef IPV6_TCLASS /* RFC3542 */
 192   ret = setsockopt (sock, IPPROTO_IPV6, IPV6_TCLASS, &tclass, sizeof (tclass));
 193   if (ret < 0)
 194     zlog_warn ("Can't set IPV6_TCLASS option for fd %d to %#x: %s",
 195                sock, tclass, safe_strerror(errno));
 196 #endif
 197   return ret;
 198 }
 199
 200 /*
 201  * Process multicast socket options for IPv4 in an OS-dependent manner.
 202  * Supported options are IP_{ADD,DROP}_MEMBERSHIP.
 203  *
 204  * Many operating systems have a limit on the number of groups that
 205  * can be joined per socket (where each group and local address
 206  * counts).  This impacts OSPF, which joins groups on each interface
 207  * using a single socket.  The limit is typically 20, derived from the
 208  * original BSD multicast implementation.  Some systems have
 209  * mechanisms for increasing this limit.
 210  *
 211  * In many 4.4BSD-derived systems, multicast group operations are not
 212  * allowed on interfaces that are not UP.  Thus, a previous attempt to
 213  * leave the group may have failed, leaving it still joined, and we
 214  * drop/join quietly to recover.  This may not be necessary, but aims to
 215  * defend against unknown behavior in that we will still return an error
 216  * if the second join fails.  It is not clear how other systems
 217  * (e.g. Linux, Solaris) behave when leaving groups on down interfaces,
 218  * but this behavior should not be harmful if they behave the same way,
 219  * allow leaves, or implicitly leave all groups joined to down interfaces.
 220  */
 221 int
 222 setsockopt_ipv4_multicast(int sock,
 223                         int optname,
 224                         struct in_addr if_addr,
 225                         unsigned int mcast_addr,
 226                         ifindex_t ifindex)
 227 {
 228 #ifdef HAVE_RFC3678
 229   struct group_req gr;
 230   struct sockaddr_in *si;
 231   int ret;
 232   memset (&gr, 0, sizeof(gr));
 233   si = (struct sockaddr_in *)&gr.gr_group;
 234   gr.gr_interface = ifindex;
 235   si->sin_family = AF_INET;
 236 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
 237   si->sin_len = sizeof(struct sockaddr_in);
 238 #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
 239   si->sin_addr.s_addr = mcast_addr;
 240   ret = setsockopt(sock, IPPROTO_IP, (optname == IP_ADD_MEMBERSHIP) ?
 241     MCAST_JOIN_GROUP : MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 242   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 243     {
 244       setsockopt(sock, IPPROTO_IP, MCAST_LEAVE_GROUP, (void *)&gr, sizeof(gr));
 245       ret = setsockopt(sock, IPPROTO_IP, MCAST_JOIN_GROUP, (void *)&gr, sizeof(gr));
 246     }
 247   return ret;
 248
 249 #elif defined(HAVE_STRUCT_IP_MREQN_IMR_IFINDEX) && !defined(__FreeBSD__)
 250   struct ip_mreqn mreqn;
 251   int ret;
 252
 253   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 254   memset (&mreqn, 0, sizeof(mreqn));
 255
 256   mreqn.imr_multiaddr.s_addr = mcast_addr;
 257   mreqn.imr_ifindex = ifindex;
 258
 259   ret = setsockopt(sock, IPPROTO_IP, optname,
 260                    (void *)&mreqn, sizeof(mreqn));
 261   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 262     {
 263       /* see above: handle possible problem when interface comes back up */
 264       char buf[1][INET_ADDRSTRLEN];
 265       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 266                 "re-add (fd %d, mcast %s, ifindex %u)",
 267                 sock,
 268                 inet_ntop(AF_INET, &mreqn.imr_multiaddr,
 269                           buf[0], sizeof(buf[0])), ifindex);
 270       setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 271                  (void *)&mreqn, sizeof(mreqn));
 272       ret = setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 273                        (void *)&mreqn, sizeof(mreqn));
 274     }
 275   return ret;
 276
 277   /* Example defines for another OS, boilerplate off other code in this
 278      function, AND handle optname as per other sections for consistency !! */
 279   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 280   /* Add your favourite OS here! */
 281
 282 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK) /* #if OS_TYPE */
 283   /* standard BSD API */
 284
 285   struct ip_mreq mreq;
 286   int ret;
 287
 288   assert(optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP);
 289
 290
 291   memset (&mreq, 0, sizeof(mreq));
 292   mreq.imr_multiaddr.s_addr = mcast_addr;
 293 #if !defined __OpenBSD__
 294   mreq.imr_interface.s_addr = htonl (ifindex);
 295 #else
 296   mreq.imr_interface.s_addr = if_addr.s_addr;
 297 #endif
 298
 299   ret = setsockopt (sock, IPPROTO_IP, optname, (void *)&mreq, sizeof(mreq));
 300   if ((ret < 0) && (optname == IP_ADD_MEMBERSHIP) && (errno == EADDRINUSE))
 301     {
 302       /* see above: handle possible problem when interface comes back up */
 303       char buf[1][INET_ADDRSTRLEN];
 304       zlog_info("setsockopt_ipv4_multicast attempting to drop and "
 305                 "re-add (fd %d, mcast %s, ifindex %u)",
 306                 sock,
 307                 inet_ntop(AF_INET, &mreq.imr_multiaddr,
 308                           buf[0], sizeof(buf[0])), ifindex);
 309       setsockopt (sock, IPPROTO_IP, IP_DROP_MEMBERSHIP,
 310                   (void *)&mreq, sizeof(mreq));
 311       ret = setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 312                         (void *)&mreq, sizeof(mreq));
 313     }
 314   return ret;
 315
 316 #else
 317   #error "Unsupported multicast API"
 318 #endif /* #if OS_TYPE */
 319
 320 }
 321
 322 /*
 323  * Set IP_MULTICAST_IF socket option in an OS-dependent manner.
 324  */
 325 int
 326 setsockopt_ipv4_multicast_if(int sock, struct in_addr if_addr,
 327                              ifindex_t ifindex)
 328 {
 329
 330 #ifdef HAVE_STRUCT_IP_MREQN_IMR_IFINDEX
 331   struct ip_mreqn mreqn;
 332   memset (&mreqn, 0, sizeof(mreqn));
 333
 334   mreqn.imr_ifindex = ifindex;
 335   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&mreqn, sizeof(mreqn));
 336
 337   /* Example defines for another OS, boilerplate off other code in this
 338      function */
 339   /* #elif  defined(BOGON_NIX) && EXAMPLE_VERSION_CODE > -100000 */
 340   /* Add your favourite OS here! */
 341 #elif defined(HAVE_BSD_STRUCT_IP_MREQ_HACK)
 342   struct in_addr m;
 343
 344 #if !defined __OpenBSD__
 345   m.s_addr = htonl (ifindex);
 346 #else
 347   m.s_addr = if_addr.s_addr;
 348 #endif
 349
 350   return setsockopt (sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&m, sizeof(m));
 351 #elif defined(SUNOS_5)
 352   char ifname[IF_NAMESIZE];
 353   struct ifaddrs *ifa, *ifap;
 354   struct in_addr ifaddr;
 355
 356   if (if_indextoname(ifindex, ifname) == NULL)
 357     return -1;
 358
 359   if (getifaddrs(&ifa) != 0)
 360     return -1;
 361
 362   for (ifap = ifa; ifap != NULL; ifap = ifap->ifa_next)
 363     {
 364       struct sockaddr_in *sa;
 365
 366       if (strcmp(ifap->ifa_name, ifname) != 0)
 367         continue;
 368       if (ifap->ifa_addr->sa_family != AF_INET)
 369         continue;
 370       sa = (struct sockaddr_in*)ifap->ifa_addr;
 371       memcpy(&ifaddr, &sa->sin_addr, sizeof(ifaddr));
 372       break;
 373     }
 374
 375   freeifaddrs(ifa);
 376   if (!ifap) /* This means we did not find an IP */
 377     return -1;
 378
 379   return setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, (void *)&ifaddr, sizeof(ifaddr));
 380 #else
 381   #error "Unsupported multicast API"
 382 #endif
 383 }
 384
 385 int
 386 setsockopt_ipv4_multicast_loop (int sock, u_char val)
 387 {
 388   int ret;
 389
 390   ret = setsockopt (sock, IPPROTO_IP, IP_MULTICAST_LOOP, (void *) &val,
 391                     sizeof (val));
 392   if (ret < 0)
 393     zlog_warn ("can't setsockopt IP_MULTICAST_LOOP");
 394
 395   return ret;
 396 }
 397
 398 static int
 399 setsockopt_ipv4_ifindex (int sock, ifindex_t val)
 400 {
 401   int ret;
 402
 403 #if defined (IP_PKTINFO)
 404   if ((ret = setsockopt (sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof (val))) < 0)
 405     zlog_warn ("Can't set IP_PKTINFO option for fd %d to %d: %s",
 406                sock,val,safe_strerror(errno));
 407 #elif defined (IP_RECVIF)
 408   if ((ret = setsockopt (sock, IPPROTO_IP, IP_RECVIF, &val, sizeof (val))) < 0)
 409     zlog_warn ("Can't set IP_RECVIF option for fd %d to %d: %s",
 410                sock,val,safe_strerror(errno));
 411 #else
 412 #warning "Neither IP_PKTINFO nor IP_RECVIF is available."
 413 #warning "Will not be able to receive link info."
 414 #warning "Things might be seriously broken.."
 415   /* XXX Does this ever happen?  Should there be a zlog_warn message here? */
 416   ret = -1;
 417 #endif
 418   return ret;
 419 }
 420
 421 int
 422 setsockopt_ipv4_tos(int sock, int tos)
 423 {
 424   int ret;
 425
 426   ret = setsockopt (sock, IPPROTO_IP, IP_TOS, &tos, sizeof (tos));
 427   if (ret < 0)
 428     zlog_warn ("Can't set IP_TOS option for fd %d to %#x: %s",
 429                sock, tos, safe_strerror(errno));
 430   return ret;
 431 }
 432
 433
 434 int
 435 setsockopt_ifindex (int af, int sock, ifindex_t val)
 436 {
 437   int ret = -1;
 438
 439   switch (af)
 440     {
 441       case AF_INET:
 442         ret = setsockopt_ipv4_ifindex (sock, val);
 443         break;
 444       case AF_INET6:
 445         ret = setsockopt_ipv6_pktinfo (sock, val);
 446         break;
 447       default:
 448         zlog_warn ("setsockopt_ifindex: unknown address family %d", af);
 449     }
 450   return ret;
 451 }
 452
 453 /*
 454  * Requires: msgh is not NULL and points to a valid struct msghdr, which
 455  * may or may not have control data about the incoming interface.
 456  *
 457  * Returns the interface index (small integer >= 1) if it can be
 458  * determined, or else 0.
 459  */
 460 static ifindex_t
 461 getsockopt_ipv4_ifindex (struct msghdr *msgh)
 462 {
 463   /* XXX: initialize to zero?  (Always overwritten, so just cosmetic.) */
 464   ifindex_t ifindex = -1;
 465
 466 #if defined(IP_PKTINFO)
 467 /* Linux pktinfo based ifindex retrieval */
 468   struct in_pktinfo *pktinfo;
 469
 470   pktinfo =
 471     (struct in_pktinfo *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_PKTINFO);
 472   /* XXX Can pktinfo be NULL?  Clean up post 0.98. */
 473   ifindex = pktinfo->ipi_ifindex;
 474
 475 #elif defined(IP_RECVIF)
 476
 477   /* retrieval based on IP_RECVIF */
 478
 479 #ifndef SUNOS_5
 480   /* BSD systems use a sockaddr_dl as the control message payload. */
 481   struct sockaddr_dl *sdl;
 482 #else
 483   /* SUNOS_5 uses an integer with the index. */
 484   ifindex_t *ifindex_p;
 485 #endif /* SUNOS_5 */
 486
 487 #ifndef SUNOS_5
 488   /* BSD */
 489   sdl =
 490     (struct sockaddr_dl *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 491   if (sdl != NULL)
 492     ifindex = sdl->sdl_index;
 493   else
 494     ifindex = 0;
 495 #else
 496   /*
 497    * Solaris.  On Solaris 8, IP_RECVIF is defined, but the call to
 498    * enable it fails with errno=99, and the struct msghdr has
 499    * controllen 0.
 500    */
 501   ifindex_p = (uint_t *)getsockopt_cmsg_data (msgh, IPPROTO_IP, IP_RECVIF);
 502   if (ifindex_p != NULL)
 503     ifindex = *ifindex_p;
 504   else
 505     ifindex = 0;
 506 #endif /* SUNOS_5 */
 507
 508 #else
 509   /*
 510    * Neither IP_PKTINFO nor IP_RECVIF defined - warn at compile time.
 511    * XXX Decide if this is a core service, or if daemons have to cope.
 512    * Since Solaris 8 and OpenBSD seem not to provide it, it seems that
 513    * daemons have to cope.
 514    */
 515 #warning "getsockopt_ipv4_ifindex: Neither IP_PKTINFO nor IP_RECVIF defined."
 516 #warning "Some daemons may fail to operate correctly!"
 517   ifindex = 0;
 518
 519 #endif /* IP_PKTINFO */
 520
 521   return ifindex;
 522 }
 523
 524 /* return ifindex, 0 if none found */
 525 ifindex_t
 526 getsockopt_ifindex (int af, struct msghdr *msgh)
 527 {
 528   switch (af)
 529     {
 530       case AF_INET:
 531         return (getsockopt_ipv4_ifindex (msgh));
 532         break;
 533       case AF_INET6:
 534         return (getsockopt_ipv6_ifindex (msgh));
 535         break;
 536       default:
 537         zlog_warn ("getsockopt_ifindex: unknown address family %d", af);
 538         return 0;
 539     }
 540 }
 541
 542 /* swab iph between order system uses for IP_HDRINCL and host order */
 543 void
 544 sockopt_iphdrincl_swab_htosys (struct ip *iph)
 545 {
 546   /* BSD and derived take iph in network order, except for
 547    * ip_len and ip_off
 548    */
 549 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 550   iph->ip_len = htons(iph->ip_len);
 551   iph->ip_off = htons(iph->ip_off);
 552 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 553
 554   iph->ip_id = htons(iph->ip_id);
 555 }
 556
 557 void
 558 sockopt_iphdrincl_swab_systoh (struct ip *iph)
 559 {
 560 #ifndef HAVE_IP_HDRINCL_BSD_ORDER
 561   iph->ip_len = ntohs(iph->ip_len);
 562   iph->ip_off = ntohs(iph->ip_off);
 563 #endif /* HAVE_IP_HDRINCL_BSD_ORDER */
 564
 565   iph->ip_id = ntohs(iph->ip_id);
 566 }
 567
 568 int
 569 sockopt_tcp_rtt (int sock)
 570 {
 571 #ifdef TCP_INFO
 572   struct tcp_info ti;
 573   socklen_t len = sizeof(ti);
 574
 575   if (getsockopt (sock, IPPROTO_TCP, TCP_INFO, &ti, &len) != 0)
 576     return 0;
 577
 578   return ti.tcpi_rtt / 1000;
 579 #else
 580   return 0;
 581 #endif
 582 }
 583
 584 int
 585 sockopt_tcp_signature (int sock, union sockunion *su, const char *password)
 586 {
 587 #if defined(HAVE_TCP_MD5_LINUX24) && defined(GNU_LINUX)
 588   /* Support for the old Linux 2.4 TCP-MD5 patch, taken from Hasso Tepper's
 589    * version of the Quagga patch (based on work by Rick Payne, and Bruce
 590    * Simpson)
 591    */
 592 #define TCP_MD5_AUTH 13
 593 #define TCP_MD5_AUTH_ADD 1
 594 #define TCP_MD5_AUTH_DEL 2
 595   struct tcp_rfc2385_cmd {
 596     u_int8_t     command;    /* Command - Add/Delete */
 597     u_int32_t    address;    /* IPV4 address associated */
 598     u_int8_t     keylen;     /* MD5 Key len (do NOT assume 0 terminated ascii) */
 599     void         *key;       /* MD5 Key */
 600   } cmd;
 601   struct in_addr *addr = &su->sin.sin_addr;
 602
 603   cmd.command = (password != NULL ? TCP_MD5_AUTH_ADD : TCP_MD5_AUTH_DEL);
 604   cmd.address = addr->s_addr;
 605   cmd.keylen = (password != NULL ? strlen (password) : 0);
 606   cmd.key = password;
 607
 608   return setsockopt (sock, IPPROTO_TCP, TCP_MD5_AUTH, &cmd, sizeof cmd);
 609
 610 #elif HAVE_DECL_TCP_MD5SIG
 611   int ret;
 612 #ifndef GNU_LINUX
 613   /*
 614    * XXX Need to do PF_KEY operation here to add/remove an SA entry,
 615    * and add/remove an SP entry for this peer's packet flows also.
 616    */
 617   int md5sig = password && *password ? 1 : 0;
 618 #else
 619   int keylen = password ? strlen (password) : 0;
 620   struct tcp_md5sig md5sig;
 621   union sockunion *su2, *susock;
 622
 623   /* Figure out whether the socket and the sockunion are the same family..
 624    * adding AF_INET to AF_INET6 needs to be v4 mapped, you'd think..
 625    */
 626   if (!(susock = sockunion_getsockname (sock)))
 627     return -1;
 628
 629   if (susock->sa.sa_family == su->sa.sa_family)
 630     su2 = su;
 631   else
 632     {
 633       /* oops.. */
 634       su2 = susock;
 635
 636       if (su2->sa.sa_family == AF_INET)
 637         {
 638           sockunion_free (susock);
 639           return 0;
 640         }
 641
 642       /* If this does not work, then all users of this sockopt will need to
 643        * differentiate between IPv4 and IPv6, and keep seperate sockets for
 644        * each.
 645        *
 646        * Sadly, it doesn't seem to work at present. It's unknown whether
 647        * this is a bug or not.
 648        */
 649       if (su2->sa.sa_family == AF_INET6
 650           && su->sa.sa_family == AF_INET)
 651         {
 652            su2->sin6.sin6_family = AF_INET6;
 653            /* V4Map the address */
 654            memset (&su2->sin6.sin6_addr, 0, sizeof (struct in6_addr));
 655            su2->sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
 656            memcpy (&su2->sin6.sin6_addr.s6_addr32[3], &su->sin.sin_addr, 4);
 657         }
 658     }
 659
 660   memset (&md5sig, 0, sizeof (md5sig));
 661   memcpy (&md5sig.tcpm_addr, su2, sizeof (*su2));
 662   md5sig.tcpm_keylen = keylen;
 663   if (keylen)
 664     memcpy (md5sig.tcpm_key, password, keylen);
 665   sockunion_free (susock);
 666 #endif /* GNU_LINUX */
 667   if ((ret = setsockopt (sock, IPPROTO_TCP, TCP_MD5SIG, &md5sig, sizeof md5sig)) < 0)
 668     {
 669       /* ENOENT is harmless.  It is returned when we clear a password for which
 670          one was not previously set. */
 671       if (ENOENT == errno)
 672         ret = 0;
 673       else
 674         zlog_err ("sockopt_tcp_signature: setsockopt(%d): %s",
 675                   sock, safe_strerror(errno));
 676     }
 677   return ret;
 678 #else /* HAVE_TCP_MD5SIG */
 679   return -2;
 680 #endif /* !HAVE_TCP_MD5SIG */
 681 }