1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <arpa/inet.h>
4 #include <errno.h>
5 #include <limits.h>
6 #include <net/if.h>
7 #include <netdb.h>
8 #include <netinet/ip.h>
9 #include <poll.h>
10 #include <stddef.h>
11 #include <stdint.h>
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <sys/ioctl.h>
15 #include <unistd.h>
16 #include <linux/if.h>
17
18 #include "alloc-util.h"
19 #include "errno-util.h"
20 #include "escape.h"
21 #include "fd-util.h"
22 #include "fileio.h"
23 #include "format-util.h"
24 #include "io-util.h"
25 #include "log.h"
26 #include "memory-util.h"
27 #include "parse-util.h"
28 #include "path-util.h"
29 #include "process-util.h"
30 #include "socket-util.h"
31 #include "string-table.h"
32 #include "string-util.h"
33 #include "strv.h"
34 #include "sysctl-util.h"
35 #include "user-util.h"
36 #include "utf8.h"
37
38 #if ENABLE_IDN
39 # define IDN_FLAGS NI_IDN
40 #else
41 # define IDN_FLAGS 0
42 #endif
43
44 static const char* const socket_address_type_table[] = {
45 [SOCK_STREAM] = "Stream",
46 [SOCK_DGRAM] = "Datagram",
47 [SOCK_RAW] = "Raw",
48 [SOCK_RDM] = "ReliableDatagram",
49 [SOCK_SEQPACKET] = "SequentialPacket",
50 [SOCK_DCCP] = "DatagramCongestionControl",
51 };
52
53 DEFINE_STRING_TABLE_LOOKUP(socket_address_type, int);
54
socket_address_verify(const SocketAddress * a,bool strict)55 int socket_address_verify(const SocketAddress *a, bool strict) {
56 assert(a);
57
58 /* With 'strict' we enforce additional sanity constraints which are not set by the standard,
59 * but should only apply to sockets we create ourselves. */
60
61 switch (socket_address_family(a)) {
62
63 case AF_INET:
64 if (a->size != sizeof(struct sockaddr_in))
65 return -EINVAL;
66
67 if (a->sockaddr.in.sin_port == 0)
68 return -EINVAL;
69
70 if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM))
71 return -EINVAL;
72
73 return 0;
74
75 case AF_INET6:
76 if (a->size != sizeof(struct sockaddr_in6))
77 return -EINVAL;
78
79 if (a->sockaddr.in6.sin6_port == 0)
80 return -EINVAL;
81
82 if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM))
83 return -EINVAL;
84
85 return 0;
86
87 case AF_UNIX:
88 if (a->size < offsetof(struct sockaddr_un, sun_path))
89 return -EINVAL;
90 if (a->size > sizeof(struct sockaddr_un) + !strict)
91 /* If !strict, allow one extra byte, since getsockname() on Linux will append
92 * a NUL byte if we have path sockets that are above sun_path's full size. */
93 return -EINVAL;
94
95 if (a->size > offsetof(struct sockaddr_un, sun_path) &&
96 a->sockaddr.un.sun_path[0] != 0 &&
97 strict) {
98 /* Only validate file system sockets here, and only in strict mode */
99 const char *e;
100
101 e = memchr(a->sockaddr.un.sun_path, 0, sizeof(a->sockaddr.un.sun_path));
102 if (e) {
103 /* If there's an embedded NUL byte, make sure the size of the socket address matches it */
104 if (a->size != offsetof(struct sockaddr_un, sun_path) + (e - a->sockaddr.un.sun_path) + 1)
105 return -EINVAL;
106 } else {
107 /* If there's no embedded NUL byte, then the size needs to match the whole
108 * structure or the structure with one extra NUL byte suffixed. (Yeah, Linux is awful,
109 * and considers both equivalent: getsockname() even extends sockaddr_un beyond its
110 * size if the path is non NUL terminated.) */
111 if (!IN_SET(a->size, sizeof(a->sockaddr.un.sun_path), sizeof(a->sockaddr.un.sun_path)+1))
112 return -EINVAL;
113 }
114 }
115
116 if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM, SOCK_SEQPACKET))
117 return -EINVAL;
118
119 return 0;
120
121 case AF_NETLINK:
122
123 if (a->size != sizeof(struct sockaddr_nl))
124 return -EINVAL;
125
126 if (!IN_SET(a->type, 0, SOCK_RAW, SOCK_DGRAM))
127 return -EINVAL;
128
129 return 0;
130
131 case AF_VSOCK:
132 if (a->size != sizeof(struct sockaddr_vm))
133 return -EINVAL;
134
135 if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM))
136 return -EINVAL;
137
138 return 0;
139
140 default:
141 return -EAFNOSUPPORT;
142 }
143 }
144
socket_address_print(const SocketAddress * a,char ** ret)145 int socket_address_print(const SocketAddress *a, char **ret) {
146 int r;
147
148 assert(a);
149 assert(ret);
150
151 r = socket_address_verify(a, false); /* We do non-strict validation, because we want to be
152 * able to pretty-print any socket the kernel considers
153 * valid. We still need to do validation to know if we
154 * can meaningfully print the address. */
155 if (r < 0)
156 return r;
157
158 if (socket_address_family(a) == AF_NETLINK) {
159 _cleanup_free_ char *sfamily = NULL;
160
161 r = netlink_family_to_string_alloc(a->protocol, &sfamily);
162 if (r < 0)
163 return r;
164
165 r = asprintf(ret, "%s %u", sfamily, a->sockaddr.nl.nl_groups);
166 if (r < 0)
167 return -ENOMEM;
168
169 return 0;
170 }
171
172 return sockaddr_pretty(&a->sockaddr.sa, a->size, false, true, ret);
173 }
174
socket_address_can_accept(const SocketAddress * a)175 bool socket_address_can_accept(const SocketAddress *a) {
176 assert(a);
177
178 return
179 IN_SET(a->type, SOCK_STREAM, SOCK_SEQPACKET);
180 }
181
socket_address_equal(const SocketAddress * a,const SocketAddress * b)182 bool socket_address_equal(const SocketAddress *a, const SocketAddress *b) {
183 assert(a);
184 assert(b);
185
186 /* Invalid addresses are unequal to all */
187 if (socket_address_verify(a, false) < 0 ||
188 socket_address_verify(b, false) < 0)
189 return false;
190
191 if (a->type != b->type)
192 return false;
193
194 if (socket_address_family(a) != socket_address_family(b))
195 return false;
196
197 switch (socket_address_family(a)) {
198
199 case AF_INET:
200 if (a->sockaddr.in.sin_addr.s_addr != b->sockaddr.in.sin_addr.s_addr)
201 return false;
202
203 if (a->sockaddr.in.sin_port != b->sockaddr.in.sin_port)
204 return false;
205
206 break;
207
208 case AF_INET6:
209 if (memcmp(&a->sockaddr.in6.sin6_addr, &b->sockaddr.in6.sin6_addr, sizeof(a->sockaddr.in6.sin6_addr)) != 0)
210 return false;
211
212 if (a->sockaddr.in6.sin6_port != b->sockaddr.in6.sin6_port)
213 return false;
214
215 break;
216
217 case AF_UNIX:
218 if (a->size <= offsetof(struct sockaddr_un, sun_path) ||
219 b->size <= offsetof(struct sockaddr_un, sun_path))
220 return false;
221
222 if ((a->sockaddr.un.sun_path[0] == 0) != (b->sockaddr.un.sun_path[0] == 0))
223 return false;
224
225 if (a->sockaddr.un.sun_path[0]) {
226 if (!path_equal_or_files_same(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, 0))
227 return false;
228 } else {
229 if (a->size != b->size)
230 return false;
231
232 if (memcmp(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, a->size) != 0)
233 return false;
234 }
235
236 break;
237
238 case AF_NETLINK:
239 if (a->protocol != b->protocol)
240 return false;
241
242 if (a->sockaddr.nl.nl_groups != b->sockaddr.nl.nl_groups)
243 return false;
244
245 break;
246
247 case AF_VSOCK:
248 if (a->sockaddr.vm.svm_cid != b->sockaddr.vm.svm_cid)
249 return false;
250
251 if (a->sockaddr.vm.svm_port != b->sockaddr.vm.svm_port)
252 return false;
253
254 break;
255
256 default:
257 /* Cannot compare, so we assume the addresses are different */
258 return false;
259 }
260
261 return true;
262 }
263
socket_address_get_path(const SocketAddress * a)264 const char* socket_address_get_path(const SocketAddress *a) {
265 assert(a);
266
267 if (socket_address_family(a) != AF_UNIX)
268 return NULL;
269
270 if (a->sockaddr.un.sun_path[0] == 0)
271 return NULL;
272
273 /* Note that this is only safe because we know that there's an extra NUL byte after the sockaddr_un
274 * structure. On Linux AF_UNIX file system socket addresses don't have to be NUL terminated if they take up the
275 * full sun_path space. */
276 assert_cc(sizeof(union sockaddr_union) >= sizeof(struct sockaddr_un)+1);
277 return a->sockaddr.un.sun_path;
278 }
279
socket_ipv6_is_supported(void)280 bool socket_ipv6_is_supported(void) {
281 static int cached = -1;
282
283 if (cached < 0) {
284
285 if (access("/proc/net/if_inet6", F_OK) < 0) {
286
287 if (errno != ENOENT) {
288 log_debug_errno(errno, "Unexpected error when checking whether /proc/net/if_inet6 exists: %m");
289 return false;
290 }
291
292 cached = false;
293 } else
294 cached = true;
295 }
296
297 return cached;
298 }
299
socket_ipv6_is_enabled(void)300 bool socket_ipv6_is_enabled(void) {
301 _cleanup_free_ char *v = NULL;
302 int r;
303
304 /* Much like socket_ipv6_is_supported(), but also checks that the sysctl that disables IPv6 on all
305 * interfaces isn't turned on */
306
307 if (!socket_ipv6_is_supported())
308 return false;
309
310 r = sysctl_read_ip_property(AF_INET6, "all", "disable_ipv6", &v);
311 if (r < 0) {
312 log_debug_errno(r, "Unexpected error reading 'net.ipv6.conf.all.disable_ipv6' sysctl: %m");
313 return true;
314 }
315
316 r = parse_boolean(v);
317 if (r < 0) {
318 log_debug_errno(r, "Failed to pare 'net.ipv6.conf.all.disable_ipv6' sysctl: %m");
319 return true;
320 }
321
322 return !r;
323 }
324
socket_address_matches_fd(const SocketAddress * a,int fd)325 bool socket_address_matches_fd(const SocketAddress *a, int fd) {
326 SocketAddress b;
327 socklen_t solen;
328
329 assert(a);
330 assert(fd >= 0);
331
332 b.size = sizeof(b.sockaddr);
333 if (getsockname(fd, &b.sockaddr.sa, &b.size) < 0)
334 return false;
335
336 if (b.sockaddr.sa.sa_family != a->sockaddr.sa.sa_family)
337 return false;
338
339 solen = sizeof(b.type);
340 if (getsockopt(fd, SOL_SOCKET, SO_TYPE, &b.type, &solen) < 0)
341 return false;
342
343 if (b.type != a->type)
344 return false;
345
346 if (a->protocol != 0) {
347 solen = sizeof(b.protocol);
348 if (getsockopt(fd, SOL_SOCKET, SO_PROTOCOL, &b.protocol, &solen) < 0)
349 return false;
350
351 if (b.protocol != a->protocol)
352 return false;
353 }
354
355 return socket_address_equal(a, &b);
356 }
357
sockaddr_port(const struct sockaddr * _sa,unsigned * ret_port)358 int sockaddr_port(const struct sockaddr *_sa, unsigned *ret_port) {
359 const union sockaddr_union *sa = (const union sockaddr_union*) _sa;
360
361 /* Note, this returns the port as 'unsigned' rather than 'uint16_t', as AF_VSOCK knows larger ports */
362
363 assert(sa);
364
365 switch (sa->sa.sa_family) {
366
367 case AF_INET:
368 *ret_port = be16toh(sa->in.sin_port);
369 return 0;
370
371 case AF_INET6:
372 *ret_port = be16toh(sa->in6.sin6_port);
373 return 0;
374
375 case AF_VSOCK:
376 *ret_port = sa->vm.svm_port;
377 return 0;
378
379 default:
380 return -EAFNOSUPPORT;
381 }
382 }
383
sockaddr_in_addr(const struct sockaddr * _sa)384 const union in_addr_union *sockaddr_in_addr(const struct sockaddr *_sa) {
385 const union sockaddr_union *sa = (const union sockaddr_union*) _sa;
386
387 if (!sa)
388 return NULL;
389
390 switch (sa->sa.sa_family) {
391
392 case AF_INET:
393 return (const union in_addr_union*) &sa->in.sin_addr;
394
395 case AF_INET6:
396 return (const union in_addr_union*) &sa->in6.sin6_addr;
397
398 default:
399 return NULL;
400 }
401 }
402
sockaddr_set_in_addr(union sockaddr_union * u,int family,const union in_addr_union * a,uint16_t port)403 int sockaddr_set_in_addr(
404 union sockaddr_union *u,
405 int family,
406 const union in_addr_union *a,
407 uint16_t port) {
408
409 assert(u);
410 assert(a);
411
412 switch (family) {
413
414 case AF_INET:
415 u->in = (struct sockaddr_in) {
416 .sin_family = AF_INET,
417 .sin_addr = a->in,
418 .sin_port = htobe16(port),
419 };
420
421 return 0;
422
423 case AF_INET6:
424 u->in6 = (struct sockaddr_in6) {
425 .sin6_family = AF_INET6,
426 .sin6_addr = a->in6,
427 .sin6_port = htobe16(port),
428 };
429
430 return 0;
431
432 default:
433 return -EAFNOSUPPORT;
434
435 }
436 }
437
sockaddr_pretty(const struct sockaddr * _sa,socklen_t salen,bool translate_ipv6,bool include_port,char ** ret)438 int sockaddr_pretty(
439 const struct sockaddr *_sa,
440 socklen_t salen,
441 bool translate_ipv6,
442 bool include_port,
443 char **ret) {
444
445 union sockaddr_union *sa = (union sockaddr_union*) _sa;
446 char *p;
447 int r;
448
449 assert(sa);
450 assert(salen >= sizeof(sa->sa.sa_family));
451
452 switch (sa->sa.sa_family) {
453
454 case AF_INET: {
455 uint32_t a;
456
457 a = be32toh(sa->in.sin_addr.s_addr);
458
459 if (include_port)
460 r = asprintf(&p,
461 "%u.%u.%u.%u:%u",
462 a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
463 be16toh(sa->in.sin_port));
464 else
465 r = asprintf(&p,
466 "%u.%u.%u.%u",
467 a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF);
468 if (r < 0)
469 return -ENOMEM;
470 break;
471 }
472
473 case AF_INET6: {
474 static const unsigned char ipv4_prefix[] = {
475 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
476 };
477
478 if (translate_ipv6 &&
479 memcmp(&sa->in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
480 const uint8_t *a = sa->in6.sin6_addr.s6_addr+12;
481 if (include_port)
482 r = asprintf(&p,
483 "%u.%u.%u.%u:%u",
484 a[0], a[1], a[2], a[3],
485 be16toh(sa->in6.sin6_port));
486 else
487 r = asprintf(&p,
488 "%u.%u.%u.%u",
489 a[0], a[1], a[2], a[3]);
490 if (r < 0)
491 return -ENOMEM;
492 } else {
493 char a[INET6_ADDRSTRLEN];
494
495 inet_ntop(AF_INET6, &sa->in6.sin6_addr, a, sizeof(a));
496
497 if (include_port) {
498 if (asprintf(&p,
499 "[%s]:%u%s%s",
500 a,
501 be16toh(sa->in6.sin6_port),
502 sa->in6.sin6_scope_id != 0 ? "%" : "",
503 FORMAT_IFNAME_FULL(sa->in6.sin6_scope_id, FORMAT_IFNAME_IFINDEX)) < 0)
504 return -ENOMEM;
505 } else {
506 if (sa->in6.sin6_scope_id != 0)
507 p = strjoin(a, "%", FORMAT_IFNAME_FULL(sa->in6.sin6_scope_id, FORMAT_IFNAME_IFINDEX));
508 else
509 p = strdup(a);
510 if (!p)
511 return -ENOMEM;
512 }
513 }
514
515 break;
516 }
517
518 case AF_UNIX:
519 if (salen <= offsetof(struct sockaddr_un, sun_path) ||
520 (sa->un.sun_path[0] == 0 && salen == offsetof(struct sockaddr_un, sun_path) + 1))
521 /* The name must have at least one character (and the leading NUL does not count) */
522 p = strdup("<unnamed>");
523 else {
524 /* Note that we calculate the path pointer here through the .un_buffer[] field, in order to
525 * outtrick bounds checking tools such as ubsan, which are too smart for their own good: on
526 * Linux the kernel may return sun_path[] data one byte longer than the declared size of the
527 * field. */
528 char *path = (char*) sa->un_buffer + offsetof(struct sockaddr_un, sun_path);
529 size_t path_len = salen - offsetof(struct sockaddr_un, sun_path);
530
531 if (path[0] == 0) {
532 /* Abstract socket. When parsing address information from, we
533 * explicitly reject overly long paths and paths with embedded NULs.
534 * But we might get such a socket from the outside. Let's return
535 * something meaningful and printable in this case. */
536
537 _cleanup_free_ char *e = NULL;
538
539 e = cescape_length(path + 1, path_len - 1);
540 if (!e)
541 return -ENOMEM;
542
543 p = strjoin("@", e);
544 } else {
545 if (path[path_len - 1] == '\0')
546 /* We expect a terminating NUL and don't print it */
547 path_len --;
548
549 p = cescape_length(path, path_len);
550 }
551 }
552 if (!p)
553 return -ENOMEM;
554
555 break;
556
557 case AF_VSOCK:
558 if (include_port) {
559 if (sa->vm.svm_cid == VMADDR_CID_ANY)
560 r = asprintf(&p, "vsock::%u", sa->vm.svm_port);
561 else
562 r = asprintf(&p, "vsock:%u:%u", sa->vm.svm_cid, sa->vm.svm_port);
563 } else
564 r = asprintf(&p, "vsock:%u", sa->vm.svm_cid);
565 if (r < 0)
566 return -ENOMEM;
567 break;
568
569 default:
570 return -EOPNOTSUPP;
571 }
572
573 *ret = p;
574 return 0;
575 }
576
getpeername_pretty(int fd,bool include_port,char ** ret)577 int getpeername_pretty(int fd, bool include_port, char **ret) {
578 union sockaddr_union sa;
579 socklen_t salen = sizeof(sa);
580 int r;
581
582 assert(fd >= 0);
583 assert(ret);
584
585 if (getpeername(fd, &sa.sa, &salen) < 0)
586 return -errno;
587
588 if (sa.sa.sa_family == AF_UNIX) {
589 struct ucred ucred = UCRED_INVALID;
590
591 /* UNIX connection sockets are anonymous, so let's use
592 * PID/UID as pretty credentials instead */
593
594 r = getpeercred(fd, &ucred);
595 if (r < 0)
596 return r;
597
598 if (asprintf(ret, "PID "PID_FMT"/UID "UID_FMT, ucred.pid, ucred.uid) < 0)
599 return -ENOMEM;
600
601 return 0;
602 }
603
604 /* For remote sockets we translate IPv6 addresses back to IPv4
605 * if applicable, since that's nicer. */
606
607 return sockaddr_pretty(&sa.sa, salen, true, include_port, ret);
608 }
609
getsockname_pretty(int fd,char ** ret)610 int getsockname_pretty(int fd, char **ret) {
611 union sockaddr_union sa;
612 socklen_t salen = sizeof(sa);
613
614 assert(fd >= 0);
615 assert(ret);
616
617 if (getsockname(fd, &sa.sa, &salen) < 0)
618 return -errno;
619
620 /* For local sockets we do not translate IPv6 addresses back
621 * to IPv6 if applicable, since this is usually used for
622 * listening sockets where the difference between IPv4 and
623 * IPv6 matters. */
624
625 return sockaddr_pretty(&sa.sa, salen, false, true, ret);
626 }
627
socknameinfo_pretty(union sockaddr_union * sa,socklen_t salen,char ** _ret)628 int socknameinfo_pretty(union sockaddr_union *sa, socklen_t salen, char **_ret) {
629 int r;
630 char host[NI_MAXHOST], *ret;
631
632 assert(_ret);
633
634 r = getnameinfo(&sa->sa, salen, host, sizeof(host), NULL, 0, IDN_FLAGS);
635 if (r != 0) {
636 int saved_errno = errno;
637
638 r = sockaddr_pretty(&sa->sa, salen, true, true, &ret);
639 if (r < 0)
640 return r;
641
642 log_debug_errno(saved_errno, "getnameinfo(%s) failed: %m", ret);
643 } else {
644 ret = strdup(host);
645 if (!ret)
646 return -ENOMEM;
647 }
648
649 *_ret = ret;
650 return 0;
651 }
652
653 static const char* const netlink_family_table[] = {
654 [NETLINK_ROUTE] = "route",
655 [NETLINK_FIREWALL] = "firewall",
656 [NETLINK_INET_DIAG] = "inet-diag",
657 [NETLINK_NFLOG] = "nflog",
658 [NETLINK_XFRM] = "xfrm",
659 [NETLINK_SELINUX] = "selinux",
660 [NETLINK_ISCSI] = "iscsi",
661 [NETLINK_AUDIT] = "audit",
662 [NETLINK_FIB_LOOKUP] = "fib-lookup",
663 [NETLINK_CONNECTOR] = "connector",
664 [NETLINK_NETFILTER] = "netfilter",
665 [NETLINK_IP6_FW] = "ip6-fw",
666 [NETLINK_DNRTMSG] = "dnrtmsg",
667 [NETLINK_KOBJECT_UEVENT] = "kobject-uevent",
668 [NETLINK_GENERIC] = "generic",
669 [NETLINK_SCSITRANSPORT] = "scsitransport",
670 [NETLINK_ECRYPTFS] = "ecryptfs",
671 [NETLINK_RDMA] = "rdma",
672 };
673
674 DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(netlink_family, int, INT_MAX);
675
676 static const char* const socket_address_bind_ipv6_only_table[_SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX] = {
677 [SOCKET_ADDRESS_DEFAULT] = "default",
678 [SOCKET_ADDRESS_BOTH] = "both",
679 [SOCKET_ADDRESS_IPV6_ONLY] = "ipv6-only"
680 };
681
682 DEFINE_STRING_TABLE_LOOKUP(socket_address_bind_ipv6_only, SocketAddressBindIPv6Only);
683
socket_address_bind_ipv6_only_or_bool_from_string(const char * n)684 SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *n) {
685 int r;
686
687 r = parse_boolean(n);
688 if (r > 0)
689 return SOCKET_ADDRESS_IPV6_ONLY;
690 if (r == 0)
691 return SOCKET_ADDRESS_BOTH;
692
693 return socket_address_bind_ipv6_only_from_string(n);
694 }
695
sockaddr_equal(const union sockaddr_union * a,const union sockaddr_union * b)696 bool sockaddr_equal(const union sockaddr_union *a, const union sockaddr_union *b) {
697 assert(a);
698 assert(b);
699
700 if (a->sa.sa_family != b->sa.sa_family)
701 return false;
702
703 if (a->sa.sa_family == AF_INET)
704 return a->in.sin_addr.s_addr == b->in.sin_addr.s_addr;
705
706 if (a->sa.sa_family == AF_INET6)
707 return memcmp(&a->in6.sin6_addr, &b->in6.sin6_addr, sizeof(a->in6.sin6_addr)) == 0;
708
709 if (a->sa.sa_family == AF_VSOCK)
710 return a->vm.svm_cid == b->vm.svm_cid;
711
712 return false;
713 }
714
fd_set_sndbuf(int fd,size_t n,bool increase)715 int fd_set_sndbuf(int fd, size_t n, bool increase) {
716 int r, value;
717 socklen_t l = sizeof(value);
718
719 if (n > INT_MAX)
720 return -ERANGE;
721
722 r = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l);
723 if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2)
724 return 0;
725
726 /* First, try to set the buffer size with SO_SNDBUF. */
727 r = setsockopt_int(fd, SOL_SOCKET, SO_SNDBUF, n);
728 if (r < 0)
729 return r;
730
731 /* SO_SNDBUF above may set to the kernel limit, instead of the requested size.
732 * So, we need to check the actual buffer size here. */
733 l = sizeof(value);
734 r = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l);
735 if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2)
736 return 1;
737
738 /* If we have the privileges we will ignore the kernel limit. */
739 r = setsockopt_int(fd, SOL_SOCKET, SO_SNDBUFFORCE, n);
740 if (r < 0)
741 return r;
742
743 return 1;
744 }
745
fd_set_rcvbuf(int fd,size_t n,bool increase)746 int fd_set_rcvbuf(int fd, size_t n, bool increase) {
747 int r, value;
748 socklen_t l = sizeof(value);
749
750 if (n > INT_MAX)
751 return -ERANGE;
752
753 r = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, &l);
754 if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2)
755 return 0;
756
757 /* First, try to set the buffer size with SO_RCVBUF. */
758 r = setsockopt_int(fd, SOL_SOCKET, SO_RCVBUF, n);
759 if (r < 0)
760 return r;
761
762 /* SO_RCVBUF above may set to the kernel limit, instead of the requested size.
763 * So, we need to check the actual buffer size here. */
764 l = sizeof(value);
765 r = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, &l);
766 if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2)
767 return 1;
768
769 /* If we have the privileges we will ignore the kernel limit. */
770 r = setsockopt_int(fd, SOL_SOCKET, SO_RCVBUFFORCE, n);
771 if (r < 0)
772 return r;
773
774 return 1;
775 }
776
777 static const char* const ip_tos_table[] = {
778 [IPTOS_LOWDELAY] = "low-delay",
779 [IPTOS_THROUGHPUT] = "throughput",
780 [IPTOS_RELIABILITY] = "reliability",
781 [IPTOS_LOWCOST] = "low-cost",
782 };
783
784 DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(ip_tos, int, 0xff);
785
ifname_valid_char(char a)786 bool ifname_valid_char(char a) {
787 if ((unsigned char) a >= 127U)
788 return false;
789
790 if ((unsigned char) a <= 32U)
791 return false;
792
793 if (IN_SET(a,
794 ':', /* colons are used by the legacy "alias" interface logic */
795 '/', /* slashes cannot work, since we need to use network interfaces in sysfs paths, and in paths slashes are separators */
796 '%')) /* %d is used in the kernel's weird foo%d format string naming feature which we really really don't want to ever run into by accident */
797 return false;
798
799 return true;
800 }
801
ifname_valid_full(const char * p,IfnameValidFlags flags)802 bool ifname_valid_full(const char *p, IfnameValidFlags flags) {
803 bool numeric = true;
804
805 /* Checks whether a network interface name is valid. This is inspired by dev_valid_name() in the kernel sources
806 * but slightly stricter, as we only allow non-control, non-space ASCII characters in the interface name. We
807 * also don't permit names that only container numbers, to avoid confusion with numeric interface indexes. */
808
809 assert(!(flags & ~_IFNAME_VALID_ALL));
810
811 if (isempty(p))
812 return false;
813
814 /* A valid ifindex? If so, it's valid iff IFNAME_VALID_NUMERIC is set */
815 if (parse_ifindex(p) >= 0)
816 return flags & IFNAME_VALID_NUMERIC;
817
818 if (flags & IFNAME_VALID_ALTERNATIVE) {
819 if (strlen(p) >= ALTIFNAMSIZ)
820 return false;
821 } else {
822 if (strlen(p) >= IFNAMSIZ)
823 return false;
824 }
825
826 if (dot_or_dot_dot(p))
827 return false;
828
829 /* Let's refuse "all" and "default" as interface name, to avoid collisions with the special sysctl
830 * directories /proc/sys/net/{ipv4,ipv6}/conf/{all,default} */
831 if (!FLAGS_SET(flags, IFNAME_VALID_SPECIAL) && STR_IN_SET(p, "all", "default"))
832 return false;
833
834 for (const char *t = p; *t; t++) {
835 if (!ifname_valid_char(*t))
836 return false;
837
838 numeric = numeric && (*t >= '0' && *t <= '9');
839 }
840
841 /* It's fully numeric but didn't parse as valid ifindex above? if so, it must be too large or zero or
842 * so, let's refuse that. */
843 if (numeric)
844 return false;
845
846 return true;
847 }
848
address_label_valid(const char * p)849 bool address_label_valid(const char *p) {
850
851 if (isempty(p))
852 return false;
853
854 if (strlen(p) >= IFNAMSIZ)
855 return false;
856
857 while (*p) {
858 if ((uint8_t) *p >= 127U)
859 return false;
860
861 if ((uint8_t) *p <= 31U)
862 return false;
863 p++;
864 }
865
866 return true;
867 }
868
getpeercred(int fd,struct ucred * ucred)869 int getpeercred(int fd, struct ucred *ucred) {
870 socklen_t n = sizeof(struct ucred);
871 struct ucred u;
872 int r;
873
874 assert(fd >= 0);
875 assert(ucred);
876
877 r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &u, &n);
878 if (r < 0)
879 return -errno;
880
881 if (n != sizeof(struct ucred))
882 return -EIO;
883
884 /* Check if the data is actually useful and not suppressed due to namespacing issues */
885 if (!pid_is_valid(u.pid))
886 return -ENODATA;
887
888 /* Note that we don't check UID/GID here, as namespace translation works differently there: instead of
889 * receiving in "invalid" user/group we get the overflow UID/GID. */
890
891 *ucred = u;
892 return 0;
893 }
894
getpeersec(int fd,char ** ret)895 int getpeersec(int fd, char **ret) {
896 _cleanup_free_ char *s = NULL;
897 socklen_t n = 64;
898
899 assert(fd >= 0);
900 assert(ret);
901
902 for (;;) {
903 s = new0(char, n+1);
904 if (!s)
905 return -ENOMEM;
906
907 if (getsockopt(fd, SOL_SOCKET, SO_PEERSEC, s, &n) >= 0)
908 break;
909
910 if (errno != ERANGE)
911 return -errno;
912
913 s = mfree(s);
914 }
915
916 if (isempty(s))
917 return -EOPNOTSUPP;
918
919 *ret = TAKE_PTR(s);
920
921 return 0;
922 }
923
getpeergroups(int fd,gid_t ** ret)924 int getpeergroups(int fd, gid_t **ret) {
925 socklen_t n = sizeof(gid_t) * 64;
926 _cleanup_free_ gid_t *d = NULL;
927
928 assert(fd >= 0);
929 assert(ret);
930
931 for (;;) {
932 d = malloc(n);
933 if (!d)
934 return -ENOMEM;
935
936 if (getsockopt(fd, SOL_SOCKET, SO_PEERGROUPS, d, &n) >= 0)
937 break;
938
939 if (errno != ERANGE)
940 return -errno;
941
942 d = mfree(d);
943 }
944
945 assert_se(n % sizeof(gid_t) == 0);
946 n /= sizeof(gid_t);
947
948 if ((socklen_t) (int) n != n)
949 return -E2BIG;
950
951 *ret = TAKE_PTR(d);
952
953 return (int) n;
954 }
955
send_one_fd_iov_sa(int transport_fd,int fd,const struct iovec * iov,size_t iovlen,const struct sockaddr * sa,socklen_t len,int flags)956 ssize_t send_one_fd_iov_sa(
957 int transport_fd,
958 int fd,
959 const struct iovec *iov, size_t iovlen,
960 const struct sockaddr *sa, socklen_t len,
961 int flags) {
962
963 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int))) control = {};
964 struct msghdr mh = {
965 .msg_name = (struct sockaddr*) sa,
966 .msg_namelen = len,
967 .msg_iov = (struct iovec *)iov,
968 .msg_iovlen = iovlen,
969 };
970 ssize_t k;
971
972 assert(transport_fd >= 0);
973
974 /*
975 * We need either an FD or data to send.
976 * If there's nothing, return an error.
977 */
978 if (fd < 0 && !iov)
979 return -EINVAL;
980
981 if (fd >= 0) {
982 struct cmsghdr *cmsg;
983
984 mh.msg_control = &control;
985 mh.msg_controllen = sizeof(control);
986
987 cmsg = CMSG_FIRSTHDR(&mh);
988 cmsg->cmsg_level = SOL_SOCKET;
989 cmsg->cmsg_type = SCM_RIGHTS;
990 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
991 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
992 }
993 k = sendmsg(transport_fd, &mh, MSG_NOSIGNAL | flags);
994 if (k < 0)
995 return (ssize_t) -errno;
996
997 return k;
998 }
999
send_one_fd_sa(int transport_fd,int fd,const struct sockaddr * sa,socklen_t len,int flags)1000 int send_one_fd_sa(
1001 int transport_fd,
1002 int fd,
1003 const struct sockaddr *sa, socklen_t len,
1004 int flags) {
1005
1006 assert(fd >= 0);
1007
1008 return (int) send_one_fd_iov_sa(transport_fd, fd, NULL, 0, sa, len, flags);
1009 }
1010
receive_one_fd_iov(int transport_fd,struct iovec * iov,size_t iovlen,int flags,int * ret_fd)1011 ssize_t receive_one_fd_iov(
1012 int transport_fd,
1013 struct iovec *iov, size_t iovlen,
1014 int flags,
1015 int *ret_fd) {
1016
1017 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int))) control;
1018 struct msghdr mh = {
1019 .msg_control = &control,
1020 .msg_controllen = sizeof(control),
1021 .msg_iov = iov,
1022 .msg_iovlen = iovlen,
1023 };
1024 struct cmsghdr *found;
1025 ssize_t k;
1026
1027 assert(transport_fd >= 0);
1028 assert(ret_fd);
1029
1030 /*
1031 * Receive a single FD via @transport_fd. We don't care for
1032 * the transport-type. We retrieve a single FD at most, so for
1033 * packet-based transports, the caller must ensure to send
1034 * only a single FD per packet. This is best used in
1035 * combination with send_one_fd().
1036 */
1037
1038 k = recvmsg_safe(transport_fd, &mh, MSG_CMSG_CLOEXEC | flags);
1039 if (k < 0)
1040 return k;
1041
1042 found = cmsg_find(&mh, SOL_SOCKET, SCM_RIGHTS, CMSG_LEN(sizeof(int)));
1043 if (!found) {
1044 cmsg_close_all(&mh);
1045
1046 /* If didn't receive an FD or any data, return an error. */
1047 if (k == 0)
1048 return -EIO;
1049 }
1050
1051 if (found)
1052 *ret_fd = *(int*) CMSG_DATA(found);
1053 else
1054 *ret_fd = -1;
1055
1056 return k;
1057 }
1058
receive_one_fd(int transport_fd,int flags)1059 int receive_one_fd(int transport_fd, int flags) {
1060 int fd;
1061 ssize_t k;
1062
1063 k = receive_one_fd_iov(transport_fd, NULL, 0, flags, &fd);
1064 if (k == 0)
1065 return fd;
1066
1067 /* k must be negative, since receive_one_fd_iov() only returns
1068 * a positive value if data was received through the iov. */
1069 assert(k < 0);
1070 return (int) k;
1071 }
1072
next_datagram_size_fd(int fd)1073 ssize_t next_datagram_size_fd(int fd) {
1074 ssize_t l;
1075 int k;
1076
1077 /* This is a bit like FIONREAD/SIOCINQ, however a bit more powerful. The difference being: recv(MSG_PEEK) will
1078 * actually cause the next datagram in the queue to be validated regarding checksums, which FIONREAD doesn't
1079 * do. This difference is actually of major importance as we need to be sure that the size returned here
1080 * actually matches what we will read with recvmsg() next, as otherwise we might end up allocating a buffer of
1081 * the wrong size. */
1082
1083 l = recv(fd, NULL, 0, MSG_PEEK|MSG_TRUNC);
1084 if (l < 0) {
1085 if (IN_SET(errno, EOPNOTSUPP, EFAULT))
1086 goto fallback;
1087
1088 return -errno;
1089 }
1090 if (l == 0)
1091 goto fallback;
1092
1093 return l;
1094
1095 fallback:
1096 k = 0;
1097
1098 /* Some sockets (AF_PACKET) do not support null-sized recv() with MSG_TRUNC set, let's fall back to FIONREAD
1099 * for them. Checksums don't matter for raw sockets anyway, hence this should be fine. */
1100
1101 if (ioctl(fd, FIONREAD, &k) < 0)
1102 return -errno;
1103
1104 return (ssize_t) k;
1105 }
1106
1107 /* Put a limit on how many times will attempt to call accept4(). We loop
1108 * only on "transient" errors, but let's make sure we don't loop forever. */
1109 #define MAX_FLUSH_ITERATIONS 1024
1110
flush_accept(int fd)1111 int flush_accept(int fd) {
1112
1113 int r, b;
1114 socklen_t l = sizeof(b);
1115
1116 /* Similar to flush_fd() but flushes all incoming connections by accepting and immediately closing
1117 * them. */
1118
1119 if (getsockopt(fd, SOL_SOCKET, SO_ACCEPTCONN, &b, &l) < 0)
1120 return -errno;
1121
1122 assert(l == sizeof(b));
1123 if (!b) /* Let's check if this socket accepts connections before calling accept(). accept4() can
1124 * return EOPNOTSUPP if the fd is not a listening socket, which we should treat as a fatal
1125 * error, or in case the incoming TCP connection triggered a network issue, which we want to
1126 * treat as a transient error. Thus, let's rule out the first reason for EOPNOTSUPP early, so
1127 * we can loop safely on transient errors below. */
1128 return -ENOTTY;
1129
1130 for (unsigned iteration = 0;; iteration++) {
1131 int cfd;
1132
1133 r = fd_wait_for_event(fd, POLLIN, 0);
1134 if (r < 0) {
1135 if (r == -EINTR)
1136 continue;
1137
1138 return r;
1139 }
1140 if (r == 0)
1141 return 0;
1142
1143 if (iteration >= MAX_FLUSH_ITERATIONS)
1144 return log_debug_errno(SYNTHETIC_ERRNO(EBUSY),
1145 "Failed to flush connections within " STRINGIFY(MAX_FLUSH_ITERATIONS) " iterations.");
1146
1147 cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
1148 if (cfd < 0) {
1149 if (errno == EAGAIN)
1150 return 0;
1151
1152 if (ERRNO_IS_ACCEPT_AGAIN(errno))
1153 continue;
1154
1155 return -errno;
1156 }
1157
1158 safe_close(cfd);
1159 }
1160 }
1161
cmsg_find(struct msghdr * mh,int level,int type,socklen_t length)1162 struct cmsghdr* cmsg_find(struct msghdr *mh, int level, int type, socklen_t length) {
1163 struct cmsghdr *cmsg;
1164
1165 assert(mh);
1166
1167 CMSG_FOREACH(cmsg, mh)
1168 if (cmsg->cmsg_level == level &&
1169 cmsg->cmsg_type == type &&
1170 (length == (socklen_t) -1 || length == cmsg->cmsg_len))
1171 return cmsg;
1172
1173 return NULL;
1174 }
1175
socket_ioctl_fd(void)1176 int socket_ioctl_fd(void) {
1177 int fd;
1178
1179 /* Create a socket to invoke the various network interface ioctl()s on. Traditionally only AF_INET was good for
1180 * that. Since kernel 4.6 AF_NETLINK works for this too. We first try to use AF_INET hence, but if that's not
1181 * available (for example, because it is made unavailable via SECCOMP or such), we'll fall back to the more
1182 * generic AF_NETLINK. */
1183
1184 fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, 0);
1185 if (fd < 0)
1186 fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_GENERIC);
1187 if (fd < 0)
1188 return -errno;
1189
1190 return fd;
1191 }
1192
sockaddr_un_unlink(const struct sockaddr_un * sa)1193 int sockaddr_un_unlink(const struct sockaddr_un *sa) {
1194 const char *p, * nul;
1195
1196 assert(sa);
1197
1198 if (sa->sun_family != AF_UNIX)
1199 return -EPROTOTYPE;
1200
1201 if (sa->sun_path[0] == 0) /* Nothing to do for abstract sockets */
1202 return 0;
1203
1204 /* The path in .sun_path is not necessarily NUL terminated. Let's fix that. */
1205 nul = memchr(sa->sun_path, 0, sizeof(sa->sun_path));
1206 if (nul)
1207 p = sa->sun_path;
1208 else
1209 p = memdupa_suffix0(sa->sun_path, sizeof(sa->sun_path));
1210
1211 if (unlink(p) < 0)
1212 return -errno;
1213
1214 return 1;
1215 }
1216
sockaddr_un_set_path(struct sockaddr_un * ret,const char * path)1217 int sockaddr_un_set_path(struct sockaddr_un *ret, const char *path) {
1218 size_t l;
1219
1220 assert(ret);
1221 assert(path);
1222
1223 /* Initialize ret->sun_path from the specified argument. This will interpret paths starting with '@' as
1224 * abstract namespace sockets, and those starting with '/' as regular filesystem sockets. It won't accept
1225 * anything else (i.e. no relative paths), to avoid ambiguities. Note that this function cannot be used to
1226 * reference paths in the abstract namespace that include NUL bytes in the name. */
1227
1228 l = strlen(path);
1229 if (l < 2)
1230 return -EINVAL;
1231 if (!IN_SET(path[0], '/', '@'))
1232 return -EINVAL;
1233
1234 /* Don't allow paths larger than the space in sockaddr_un. Note that we are a tiny bit more restrictive than
1235 * the kernel is: we insist on NUL termination (both for abstract namespace and regular file system socket
1236 * addresses!), which the kernel doesn't. We do this to reduce chance of incompatibility with other apps that
1237 * do not expect non-NUL terminated file system path. */
1238 if (l+1 > sizeof(ret->sun_path))
1239 return path[0] == '@' ? -EINVAL : -ENAMETOOLONG; /* return a recognizable error if this is
1240 * too long to fit into a sockaddr_un, but
1241 * is a file system path, and thus might be
1242 * connectible via O_PATH indirection. */
1243
1244 *ret = (struct sockaddr_un) {
1245 .sun_family = AF_UNIX,
1246 };
1247
1248 if (path[0] == '@') {
1249 /* Abstract namespace socket */
1250 memcpy(ret->sun_path + 1, path + 1, l); /* copy *with* trailing NUL byte */
1251 return (int) (offsetof(struct sockaddr_un, sun_path) + l); /* �� *don't* �� include trailing NUL in size */
1252
1253 } else {
1254 assert(path[0] == '/');
1255
1256 /* File system socket */
1257 memcpy(ret->sun_path, path, l + 1); /* copy *with* trailing NUL byte */
1258 return (int) (offsetof(struct sockaddr_un, sun_path) + l + 1); /* include trailing NUL in size */
1259 }
1260 }
1261
socket_bind_to_ifname(int fd,const char * ifname)1262 int socket_bind_to_ifname(int fd, const char *ifname) {
1263 assert(fd >= 0);
1264
1265 /* Call with NULL to drop binding */
1266
1267 return RET_NERRNO(setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, ifname, strlen_ptr(ifname)));
1268 }
1269
socket_bind_to_ifindex(int fd,int ifindex)1270 int socket_bind_to_ifindex(int fd, int ifindex) {
1271 char ifname[IF_NAMESIZE];
1272 int r;
1273
1274 assert(fd >= 0);
1275
1276 if (ifindex <= 0)
1277 /* Drop binding */
1278 return RET_NERRNO(setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, NULL, 0));
1279
1280 r = setsockopt_int(fd, SOL_SOCKET, SO_BINDTOIFINDEX, ifindex);
1281 if (r != -ENOPROTOOPT)
1282 return r;
1283
1284 /* Fall back to SO_BINDTODEVICE on kernels < 5.0 which didn't have SO_BINDTOIFINDEX */
1285 r = format_ifname(ifindex, ifname);
1286 if (r < 0)
1287 return r;
1288
1289 return socket_bind_to_ifname(fd, ifname);
1290 }
1291
recvmsg_safe(int sockfd,struct msghdr * msg,int flags)1292 ssize_t recvmsg_safe(int sockfd, struct msghdr *msg, int flags) {
1293 ssize_t n;
1294
1295 /* A wrapper around recvmsg() that checks for MSG_CTRUNC, and turns it into an error, in a reasonably
1296 * safe way, closing any SCM_RIGHTS fds in the error path.
1297 *
1298 * Note that unlike our usual coding style this might modify *msg on failure. */
1299
1300 n = recvmsg(sockfd, msg, flags);
1301 if (n < 0)
1302 return -errno;
1303
1304 if (FLAGS_SET(msg->msg_flags, MSG_CTRUNC)) {
1305 cmsg_close_all(msg);
1306 return -EXFULL; /* a recognizable error code */
1307 }
1308
1309 return n;
1310 }
1311
socket_get_family(int fd,int * ret)1312 int socket_get_family(int fd, int *ret) {
1313 int af;
1314 socklen_t sl = sizeof(af);
1315
1316 if (getsockopt(fd, SOL_SOCKET, SO_DOMAIN, &af, &sl) < 0)
1317 return -errno;
1318
1319 if (sl != sizeof(af))
1320 return -EINVAL;
1321
1322 return af;
1323 }
1324
socket_set_recvpktinfo(int fd,int af,bool b)1325 int socket_set_recvpktinfo(int fd, int af, bool b) {
1326 int r;
1327
1328 if (af == AF_UNSPEC) {
1329 r = socket_get_family(fd, &af);
1330 if (r < 0)
1331 return r;
1332 }
1333
1334 switch (af) {
1335
1336 case AF_INET:
1337 return setsockopt_int(fd, IPPROTO_IP, IP_PKTINFO, b);
1338
1339 case AF_INET6:
1340 return setsockopt_int(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, b);
1341
1342 case AF_NETLINK:
1343 return setsockopt_int(fd, SOL_NETLINK, NETLINK_PKTINFO, b);
1344
1345 case AF_PACKET:
1346 return setsockopt_int(fd, SOL_PACKET, PACKET_AUXDATA, b);
1347
1348 default:
1349 return -EAFNOSUPPORT;
1350 }
1351 }
1352
socket_set_unicast_if(int fd,int af,int ifi)1353 int socket_set_unicast_if(int fd, int af, int ifi) {
1354 be32_t ifindex_be = htobe32(ifi);
1355 int r;
1356
1357 if (af == AF_UNSPEC) {
1358 r = socket_get_family(fd, &af);
1359 if (r < 0)
1360 return r;
1361 }
1362
1363 switch (af) {
1364
1365 case AF_INET:
1366 return RET_NERRNO(setsockopt(fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex_be, sizeof(ifindex_be)));
1367
1368 case AF_INET6:
1369 return RET_NERRNO(setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex_be, sizeof(ifindex_be)));
1370
1371 default:
1372 return -EAFNOSUPPORT;
1373 }
1374 }
1375
socket_set_option(int fd,int af,int opt_ipv4,int opt_ipv6,int val)1376 int socket_set_option(int fd, int af, int opt_ipv4, int opt_ipv6, int val) {
1377 int r;
1378
1379 if (af == AF_UNSPEC) {
1380 r = socket_get_family(fd, &af);
1381 if (r < 0)
1382 return r;
1383 }
1384
1385 switch (af) {
1386
1387 case AF_INET:
1388 return setsockopt_int(fd, IPPROTO_IP, opt_ipv4, val);
1389
1390 case AF_INET6:
1391 return setsockopt_int(fd, IPPROTO_IPV6, opt_ipv6, val);
1392
1393 default:
1394 return -EAFNOSUPPORT;
1395 }
1396 }
1397
socket_get_mtu(int fd,int af,size_t * ret)1398 int socket_get_mtu(int fd, int af, size_t *ret) {
1399 int mtu, r;
1400
1401 if (af == AF_UNSPEC) {
1402 r = socket_get_family(fd, &af);
1403 if (r < 0)
1404 return r;
1405 }
1406
1407 switch (af) {
1408
1409 case AF_INET:
1410 r = getsockopt_int(fd, IPPROTO_IP, IP_MTU, &mtu);
1411 break;
1412
1413 case AF_INET6:
1414 r = getsockopt_int(fd, IPPROTO_IPV6, IPV6_MTU, &mtu);
1415 break;
1416
1417 default:
1418 return -EAFNOSUPPORT;
1419 }
1420
1421 if (r < 0)
1422 return r;
1423 if (mtu <= 0)
1424 return -EINVAL;
1425
1426 *ret = (size_t) mtu;
1427 return 0;
1428 }
1429