]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
a7334b09 | 2 | |
edda10f2 FS |
3 | /* Make sure the net/if.h header is included before any linux/ one */ |
4 | #include <net/if.h> | |
42f4e3c4 | 5 | #include <arpa/inet.h> |
07630cea | 6 | #include <errno.h> |
11c3a366 | 7 | #include <limits.h> |
b31f535c | 8 | #include <netdb.h> |
2583fbea | 9 | #include <netinet/ip.h> |
60d9771c | 10 | #include <poll.h> |
07630cea | 11 | #include <stddef.h> |
11c3a366 | 12 | #include <stdint.h> |
07630cea | 13 | #include <stdio.h> |
11c3a366 | 14 | #include <stdlib.h> |
f5947a5e | 15 | #include <sys/ioctl.h> |
07630cea | 16 | #include <unistd.h> |
4252696a | 17 | #include <linux/if.h> |
42f4e3c4 | 18 | |
b5efdb8a | 19 | #include "alloc-util.h" |
4ff9bc2e | 20 | #include "errno-util.h" |
15dca371 | 21 | #include "escape.h" |
2583fbea | 22 | #include "fd-util.h" |
07630cea | 23 | #include "fileio.h" |
f97b34a6 | 24 | #include "format-util.h" |
0f2d351f | 25 | #include "io-util.h" |
93cc7779 | 26 | #include "log.h" |
0a970718 | 27 | #include "memory-util.h" |
6bedfcbb | 28 | #include "parse-util.h" |
9eb977db | 29 | #include "path-util.h" |
dccca82b | 30 | #include "process-util.h" |
2583fbea | 31 | #include "socket-util.h" |
8b43440b | 32 | #include "string-table.h" |
07630cea | 33 | #include "string-util.h" |
ef76dff2 | 34 | #include "strv.h" |
83e03c4f | 35 | #include "sysctl-util.h" |
ee104e11 | 36 | #include "user-util.h" |
ef76dff2 | 37 | #include "utf8.h" |
42f4e3c4 | 38 | |
349cc4a5 | 39 | #if ENABLE_IDN |
cadc80b8 | 40 | # define IDN_FLAGS NI_IDN |
6326a143 WB |
41 | #else |
42 | # define IDN_FLAGS 0 | |
43 | #endif | |
44 | ||
598d2428 LB |
45 | /* From the kernel's include/net/scm.h */ |
46 | #ifndef SCM_MAX_FD | |
47 | # define SCM_MAX_FD 253 | |
48 | #endif | |
49 | ||
398ce0bc | 50 | static const char* const socket_address_type_table[] = { |
955bb7fa ZJS |
51 | [SOCK_STREAM] = "Stream", |
52 | [SOCK_DGRAM] = "Datagram", | |
53 | [SOCK_RAW] = "Raw", | |
54 | [SOCK_RDM] = "ReliableDatagram", | |
398ce0bc | 55 | [SOCK_SEQPACKET] = "SequentialPacket", |
955bb7fa | 56 | [SOCK_DCCP] = "DatagramCongestionControl", |
398ce0bc YW |
57 | }; |
58 | ||
59 | DEFINE_STRING_TABLE_LOOKUP(socket_address_type, int); | |
60 | ||
15dca371 | 61 | int socket_address_verify(const SocketAddress *a, bool strict) { |
42f4e3c4 LP |
62 | assert(a); |
63 | ||
15dca371 ZJS |
64 | /* With 'strict' we enforce additional sanity constraints which are not set by the standard, |
65 | * but should only apply to sockets we create ourselves. */ | |
66 | ||
542563ba | 67 | switch (socket_address_family(a)) { |
42f4e3c4 | 68 | |
7a22745a LP |
69 | case AF_INET: |
70 | if (a->size != sizeof(struct sockaddr_in)) | |
71 | return -EINVAL; | |
42f4e3c4 | 72 | |
4d49b48c | 73 | if (a->sockaddr.in.sin_port == 0) |
7a22745a | 74 | return -EINVAL; |
42f4e3c4 | 75 | |
44ab2347 | 76 | if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM)) |
7a22745a | 77 | return -EINVAL; |
42f4e3c4 | 78 | |
7a22745a LP |
79 | return 0; |
80 | ||
81 | case AF_INET6: | |
82 | if (a->size != sizeof(struct sockaddr_in6)) | |
83 | return -EINVAL; | |
42f4e3c4 | 84 | |
7a22745a LP |
85 | if (a->sockaddr.in6.sin6_port == 0) |
86 | return -EINVAL; | |
42f4e3c4 | 87 | |
44ab2347 | 88 | if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM)) |
7a22745a | 89 | return -EINVAL; |
42f4e3c4 | 90 | |
7a22745a | 91 | return 0; |
42f4e3c4 | 92 | |
7a22745a LP |
93 | case AF_UNIX: |
94 | if (a->size < offsetof(struct sockaddr_un, sun_path)) | |
95 | return -EINVAL; | |
15dca371 ZJS |
96 | if (a->size > sizeof(struct sockaddr_un) + !strict) |
97 | /* If !strict, allow one extra byte, since getsockname() on Linux will append | |
98 | * a NUL byte if we have path sockets that are above sun_path's full size. */ | |
8e8132c6 | 99 | return -EINVAL; |
42f4e3c4 | 100 | |
8e8132c6 | 101 | if (a->size > offsetof(struct sockaddr_un, sun_path) && |
15dca371 ZJS |
102 | a->sockaddr.un.sun_path[0] != 0 && |
103 | strict) { | |
104 | /* Only validate file system sockets here, and only in strict mode */ | |
8e8132c6 | 105 | const char *e; |
7a22745a | 106 | |
8e8132c6 LP |
107 | e = memchr(a->sockaddr.un.sun_path, 0, sizeof(a->sockaddr.un.sun_path)); |
108 | if (e) { | |
15dca371 | 109 | /* If there's an embedded NUL byte, make sure the size of the socket address matches it */ |
7a22745a LP |
110 | if (a->size != offsetof(struct sockaddr_un, sun_path) + (e - a->sockaddr.un.sun_path) + 1) |
111 | return -EINVAL; | |
8e8132c6 | 112 | } else { |
d7b34e38 | 113 | /* If there's no embedded NUL byte, then the size needs to match the whole |
8e8132c6 LP |
114 | * structure or the structure with one extra NUL byte suffixed. (Yeah, Linux is awful, |
115 | * and considers both equivalent: getsockname() even extends sockaddr_un beyond its | |
7802194a | 116 | * size if the path is non NUL terminated.) */ |
8e8132c6 LP |
117 | if (!IN_SET(a->size, sizeof(a->sockaddr.un.sun_path), sizeof(a->sockaddr.un.sun_path)+1)) |
118 | return -EINVAL; | |
42f4e3c4 | 119 | } |
7a22745a | 120 | } |
42f4e3c4 | 121 | |
44ab2347 | 122 | if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM, SOCK_SEQPACKET)) |
7a22745a | 123 | return -EINVAL; |
42f4e3c4 | 124 | |
7a22745a LP |
125 | return 0; |
126 | ||
127 | case AF_NETLINK: | |
128 | ||
129 | if (a->size != sizeof(struct sockaddr_nl)) | |
130 | return -EINVAL; | |
131 | ||
44ab2347 | 132 | if (!IN_SET(a->type, 0, SOCK_RAW, SOCK_DGRAM)) |
7a22745a LP |
133 | return -EINVAL; |
134 | ||
135 | return 0; | |
136 | ||
0fc0f14b SH |
137 | case AF_VSOCK: |
138 | if (a->size != sizeof(struct sockaddr_vm)) | |
139 | return -EINVAL; | |
140 | ||
44ab2347 | 141 | if (!IN_SET(a->type, 0, SOCK_STREAM, SOCK_DGRAM)) |
0fc0f14b SH |
142 | return -EINVAL; |
143 | ||
144 | return 0; | |
145 | ||
7a22745a LP |
146 | default: |
147 | return -EAFNOSUPPORT; | |
42f4e3c4 LP |
148 | } |
149 | } | |
150 | ||
4d49b48c | 151 | int socket_address_print(const SocketAddress *a, char **ret) { |
42f4e3c4 | 152 | int r; |
4d49b48c | 153 | |
42f4e3c4 | 154 | assert(a); |
4d49b48c | 155 | assert(ret); |
42f4e3c4 | 156 | |
15dca371 ZJS |
157 | r = socket_address_verify(a, false); /* We do non-strict validation, because we want to be |
158 | * able to pretty-print any socket the kernel considers | |
159 | * valid. We still need to do validation to know if we | |
160 | * can meaningfully print the address. */ | |
4d49b48c | 161 | if (r < 0) |
42f4e3c4 LP |
162 | return r; |
163 | ||
4d49b48c | 164 | if (socket_address_family(a) == AF_NETLINK) { |
7fd1b19b | 165 | _cleanup_free_ char *sfamily = NULL; |
7a22745a | 166 | |
f8b69d1d | 167 | r = netlink_family_to_string_alloc(a->protocol, &sfamily); |
7a22745a | 168 | if (r < 0) |
f8b69d1d | 169 | return r; |
4d49b48c LP |
170 | |
171 | r = asprintf(ret, "%s %u", sfamily, a->sockaddr.nl.nl_groups); | |
8520cfa5 MS |
172 | if (r < 0) |
173 | return -ENOMEM; | |
7a22745a LP |
174 | |
175 | return 0; | |
176 | } | |
177 | ||
3b1c5241 | 178 | return sockaddr_pretty(&a->sockaddr.sa, a->size, false, true, ret); |
42f4e3c4 LP |
179 | } |
180 | ||
4f2d528d LP |
181 | bool socket_address_can_accept(const SocketAddress *a) { |
182 | assert(a); | |
183 | ||
184 | return | |
3742095b | 185 | IN_SET(a->type, SOCK_STREAM, SOCK_SEQPACKET); |
4f2d528d | 186 | } |
a16e1123 LP |
187 | |
188 | bool socket_address_equal(const SocketAddress *a, const SocketAddress *b) { | |
189 | assert(a); | |
190 | assert(b); | |
191 | ||
192 | /* Invalid addresses are unequal to all */ | |
15dca371 ZJS |
193 | if (socket_address_verify(a, false) < 0 || |
194 | socket_address_verify(b, false) < 0) | |
a16e1123 LP |
195 | return false; |
196 | ||
197 | if (a->type != b->type) | |
198 | return false; | |
199 | ||
a16e1123 LP |
200 | if (socket_address_family(a) != socket_address_family(b)) |
201 | return false; | |
202 | ||
203 | switch (socket_address_family(a)) { | |
204 | ||
205 | case AF_INET: | |
4d49b48c | 206 | if (a->sockaddr.in.sin_addr.s_addr != b->sockaddr.in.sin_addr.s_addr) |
a16e1123 LP |
207 | return false; |
208 | ||
4d49b48c | 209 | if (a->sockaddr.in.sin_port != b->sockaddr.in.sin_port) |
a16e1123 LP |
210 | return false; |
211 | ||
212 | break; | |
213 | ||
214 | case AF_INET6: | |
215 | if (memcmp(&a->sockaddr.in6.sin6_addr, &b->sockaddr.in6.sin6_addr, sizeof(a->sockaddr.in6.sin6_addr)) != 0) | |
216 | return false; | |
217 | ||
218 | if (a->sockaddr.in6.sin6_port != b->sockaddr.in6.sin6_port) | |
219 | return false; | |
220 | ||
221 | break; | |
222 | ||
223 | case AF_UNIX: | |
710708a5 MS |
224 | if (a->size <= offsetof(struct sockaddr_un, sun_path) || |
225 | b->size <= offsetof(struct sockaddr_un, sun_path)) | |
226 | return false; | |
227 | ||
a16e1123 LP |
228 | if ((a->sockaddr.un.sun_path[0] == 0) != (b->sockaddr.un.sun_path[0] == 0)) |
229 | return false; | |
230 | ||
231 | if (a->sockaddr.un.sun_path[0]) { | |
563e6846 | 232 | if (!path_equal_or_inode_same(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, 0)) |
a16e1123 LP |
233 | return false; |
234 | } else { | |
c78e47a6 MS |
235 | if (a->size != b->size) |
236 | return false; | |
237 | ||
b12c1e7c | 238 | if (memcmp(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, a->size) != 0) |
a16e1123 LP |
239 | return false; |
240 | } | |
241 | ||
242 | break; | |
243 | ||
7a22745a | 244 | case AF_NETLINK: |
7a22745a LP |
245 | if (a->protocol != b->protocol) |
246 | return false; | |
247 | ||
248 | if (a->sockaddr.nl.nl_groups != b->sockaddr.nl.nl_groups) | |
249 | return false; | |
250 | ||
251 | break; | |
252 | ||
0fc0f14b SH |
253 | case AF_VSOCK: |
254 | if (a->sockaddr.vm.svm_cid != b->sockaddr.vm.svm_cid) | |
255 | return false; | |
256 | ||
257 | if (a->sockaddr.vm.svm_port != b->sockaddr.vm.svm_port) | |
258 | return false; | |
259 | ||
260 | break; | |
261 | ||
a16e1123 LP |
262 | default: |
263 | /* Cannot compare, so we assume the addresses are different */ | |
264 | return false; | |
265 | } | |
266 | ||
267 | return true; | |
268 | } | |
269 | ||
a57f7e2c | 270 | const char* socket_address_get_path(const SocketAddress *a) { |
6e2ef85b LP |
271 | assert(a); |
272 | ||
273 | if (socket_address_family(a) != AF_UNIX) | |
a57f7e2c | 274 | return NULL; |
6e2ef85b LP |
275 | |
276 | if (a->sockaddr.un.sun_path[0] == 0) | |
a57f7e2c | 277 | return NULL; |
a16e1123 | 278 | |
48e6a2dc LP |
279 | /* Note that this is only safe because we know that there's an extra NUL byte after the sockaddr_un |
280 | * structure. On Linux AF_UNIX file system socket addresses don't have to be NUL terminated if they take up the | |
281 | * full sun_path space. */ | |
282 | assert_cc(sizeof(union sockaddr_union) >= sizeof(struct sockaddr_un)+1); | |
a57f7e2c | 283 | return a->sockaddr.un.sun_path; |
a16e1123 | 284 | } |
c0120d99 | 285 | |
5bfcc1c6 | 286 | bool socket_ipv6_is_supported(void) { |
571ec995 | 287 | static int cached = -1; |
f89f1e8f | 288 | |
571ec995 LP |
289 | if (cached < 0) { |
290 | ||
291 | if (access("/proc/net/if_inet6", F_OK) < 0) { | |
292 | ||
293 | if (errno != ENOENT) { | |
294 | log_debug_errno(errno, "Unexpected error when checking whether /proc/net/if_inet6 exists: %m"); | |
295 | return false; | |
296 | } | |
297 | ||
298 | cached = false; | |
299 | } else | |
300 | cached = true; | |
301 | } | |
302 | ||
303 | return cached; | |
5bfcc1c6 FF |
304 | } |
305 | ||
83e03c4f | 306 | bool socket_ipv6_is_enabled(void) { |
f96f5d54 | 307 | _cleanup_free_ char *v = NULL; |
83e03c4f LP |
308 | int r; |
309 | ||
310 | /* Much like socket_ipv6_is_supported(), but also checks that the sysctl that disables IPv6 on all | |
311 | * interfaces isn't turned on */ | |
312 | ||
313 | if (!socket_ipv6_is_supported()) | |
90ab5042 | 314 | return false; |
f89f1e8f | 315 | |
83e03c4f LP |
316 | r = sysctl_read_ip_property(AF_INET6, "all", "disable_ipv6", &v); |
317 | if (r < 0) { | |
318 | log_debug_errno(r, "Unexpected error reading 'net.ipv6.conf.all.disable_ipv6' sysctl: %m"); | |
319 | return true; | |
320 | } | |
321 | ||
322 | r = parse_boolean(v); | |
323 | if (r < 0) { | |
324 | log_debug_errno(r, "Failed to pare 'net.ipv6.conf.all.disable_ipv6' sysctl: %m"); | |
325 | return true; | |
326 | } | |
327 | ||
328 | return !r; | |
5bfcc1c6 FF |
329 | } |
330 | ||
01e10de3 | 331 | bool socket_address_matches_fd(const SocketAddress *a, int fd) { |
dbafedac MS |
332 | SocketAddress b; |
333 | socklen_t solen; | |
01e10de3 LP |
334 | |
335 | assert(a); | |
336 | assert(fd >= 0); | |
337 | ||
dbafedac MS |
338 | b.size = sizeof(b.sockaddr); |
339 | if (getsockname(fd, &b.sockaddr.sa, &b.size) < 0) | |
01e10de3 LP |
340 | return false; |
341 | ||
dbafedac | 342 | if (b.sockaddr.sa.sa_family != a->sockaddr.sa.sa_family) |
01e10de3 LP |
343 | return false; |
344 | ||
dbafedac MS |
345 | solen = sizeof(b.type); |
346 | if (getsockopt(fd, SOL_SOCKET, SO_TYPE, &b.type, &solen) < 0) | |
01e10de3 LP |
347 | return false; |
348 | ||
dbafedac | 349 | if (b.type != a->type) |
01e10de3 LP |
350 | return false; |
351 | ||
352 | if (a->protocol != 0) { | |
dbafedac MS |
353 | solen = sizeof(b.protocol); |
354 | if (getsockopt(fd, SOL_SOCKET, SO_PROTOCOL, &b.protocol, &solen) < 0) | |
01e10de3 LP |
355 | return false; |
356 | ||
dbafedac | 357 | if (b.protocol != a->protocol) |
01e10de3 LP |
358 | return false; |
359 | } | |
360 | ||
02233928 | 361 | return socket_address_equal(a, &b); |
01e10de3 LP |
362 | } |
363 | ||
f6aac5bf | 364 | int sockaddr_port(const struct sockaddr *_sa, unsigned *ret_port) { |
31325971 | 365 | const union sockaddr_union *sa = (const union sockaddr_union*) _sa; |
3b1c5241 | 366 | |
f6aac5bf LP |
367 | /* Note, this returns the port as 'unsigned' rather than 'uint16_t', as AF_VSOCK knows larger ports */ |
368 | ||
3b1c5241 SL |
369 | assert(sa); |
370 | ||
0fc0f14b | 371 | switch (sa->sa.sa_family) { |
f6aac5bf | 372 | |
0fc0f14b | 373 | case AF_INET: |
f6aac5bf | 374 | *ret_port = be16toh(sa->in.sin_port); |
0fc0f14b | 375 | return 0; |
3b1c5241 | 376 | |
0fc0f14b | 377 | case AF_INET6: |
f6aac5bf | 378 | *ret_port = be16toh(sa->in6.sin6_port); |
0fc0f14b SH |
379 | return 0; |
380 | ||
381 | case AF_VSOCK: | |
f6aac5bf | 382 | *ret_port = sa->vm.svm_port; |
0fc0f14b SH |
383 | return 0; |
384 | ||
385 | default: | |
386 | return -EAFNOSUPPORT; | |
387 | } | |
3b1c5241 SL |
388 | } |
389 | ||
31325971 LP |
390 | const union in_addr_union *sockaddr_in_addr(const struct sockaddr *_sa) { |
391 | const union sockaddr_union *sa = (const union sockaddr_union*) _sa; | |
392 | ||
393 | if (!sa) | |
394 | return NULL; | |
395 | ||
396 | switch (sa->sa.sa_family) { | |
397 | ||
398 | case AF_INET: | |
399 | return (const union in_addr_union*) &sa->in.sin_addr; | |
400 | ||
401 | case AF_INET6: | |
402 | return (const union in_addr_union*) &sa->in6.sin6_addr; | |
403 | ||
404 | default: | |
405 | return NULL; | |
406 | } | |
407 | } | |
408 | ||
c1b91f06 LP |
409 | int sockaddr_set_in_addr( |
410 | union sockaddr_union *u, | |
411 | int family, | |
412 | const union in_addr_union *a, | |
413 | uint16_t port) { | |
414 | ||
415 | assert(u); | |
416 | assert(a); | |
417 | ||
418 | switch (family) { | |
419 | ||
420 | case AF_INET: | |
421 | u->in = (struct sockaddr_in) { | |
422 | .sin_family = AF_INET, | |
423 | .sin_addr = a->in, | |
424 | .sin_port = htobe16(port), | |
425 | }; | |
426 | ||
427 | return 0; | |
428 | ||
429 | case AF_INET6: | |
430 | u->in6 = (struct sockaddr_in6) { | |
431 | .sin6_family = AF_INET6, | |
432 | .sin6_addr = a->in6, | |
433 | .sin6_port = htobe16(port), | |
434 | }; | |
435 | ||
436 | return 0; | |
437 | ||
438 | default: | |
439 | return -EAFNOSUPPORT; | |
440 | ||
441 | } | |
442 | } | |
443 | ||
836f9cfe LP |
444 | int sockaddr_pretty( |
445 | const struct sockaddr *_sa, | |
446 | socklen_t salen, | |
447 | bool translate_ipv6, | |
448 | bool include_port, | |
449 | char **ret) { | |
450 | ||
4d49b48c | 451 | union sockaddr_union *sa = (union sockaddr_union*) _sa; |
8569a776 | 452 | char *p; |
fc25ad25 | 453 | int r; |
8569a776 | 454 | |
4d49b48c LP |
455 | assert(sa); |
456 | assert(salen >= sizeof(sa->sa.sa_family)); | |
4eb3ec63 | 457 | assert(ret); |
8569a776 | 458 | |
4d49b48c | 459 | switch (sa->sa.sa_family) { |
8569a776 LP |
460 | |
461 | case AF_INET: { | |
462 | uint32_t a; | |
463 | ||
8e38570e | 464 | a = be32toh(sa->in.sin_addr.s_addr); |
8569a776 | 465 | |
fc25ad25 ZJS |
466 | if (include_port) |
467 | r = asprintf(&p, | |
3b1c5241 SL |
468 | "%u.%u.%u.%u:%u", |
469 | a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF, | |
8e38570e | 470 | be16toh(sa->in.sin_port)); |
fc25ad25 ZJS |
471 | else |
472 | r = asprintf(&p, | |
3b1c5241 | 473 | "%u.%u.%u.%u", |
fc25ad25 ZJS |
474 | a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF); |
475 | if (r < 0) | |
476 | return -ENOMEM; | |
8569a776 LP |
477 | break; |
478 | } | |
479 | ||
480 | case AF_INET6: { | |
481 | static const unsigned char ipv4_prefix[] = { | |
482 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF | |
483 | }; | |
484 | ||
fc25ad25 ZJS |
485 | if (translate_ipv6 && |
486 | memcmp(&sa->in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) { | |
4d49b48c | 487 | const uint8_t *a = sa->in6.sin6_addr.s6_addr+12; |
fc25ad25 ZJS |
488 | if (include_port) |
489 | r = asprintf(&p, | |
3b1c5241 SL |
490 | "%u.%u.%u.%u:%u", |
491 | a[0], a[1], a[2], a[3], | |
8e38570e | 492 | be16toh(sa->in6.sin6_port)); |
fc25ad25 ZJS |
493 | else |
494 | r = asprintf(&p, | |
3b1c5241 | 495 | "%u.%u.%u.%u", |
fc25ad25 ZJS |
496 | a[0], a[1], a[2], a[3]); |
497 | if (r < 0) | |
498 | return -ENOMEM; | |
8569a776 | 499 | } else { |
071e522e | 500 | const char *a = IN6_ADDR_TO_STRING(&sa->in6.sin6_addr); |
3b1c5241 SL |
501 | |
502 | if (include_port) { | |
01afd0f7 | 503 | if (asprintf(&p, |
b16d17a6 | 504 | "[%s]:%u%s%s", |
3b1c5241 | 505 | a, |
b16d17a6 ZJS |
506 | be16toh(sa->in6.sin6_port), |
507 | sa->in6.sin6_scope_id != 0 ? "%" : "", | |
01afd0f7 | 508 | FORMAT_IFNAME_FULL(sa->in6.sin6_scope_id, FORMAT_IFNAME_IFINDEX)) < 0) |
3b1c5241 SL |
509 | return -ENOMEM; |
510 | } else { | |
01afd0f7 YW |
511 | if (sa->in6.sin6_scope_id != 0) |
512 | p = strjoin(a, "%", FORMAT_IFNAME_FULL(sa->in6.sin6_scope_id, FORMAT_IFNAME_IFINDEX)); | |
513 | else | |
514 | p = strdup(a); | |
3b1c5241 SL |
515 | if (!p) |
516 | return -ENOMEM; | |
517 | } | |
8569a776 LP |
518 | } |
519 | ||
520 | break; | |
521 | } | |
522 | ||
4d49b48c | 523 | case AF_UNIX: |
15dca371 | 524 | if (salen <= offsetof(struct sockaddr_un, sun_path) || |
994b9d4e | 525 | (sa->un.sun_path[0] == 0 && salen == offsetof(struct sockaddr_un, sun_path) + 1)) |
15dca371 | 526 | /* The name must have at least one character (and the leading NUL does not count) */ |
4d49b48c | 527 | p = strdup("<unnamed>"); |
994b9d4e | 528 | else { |
085b39e9 LP |
529 | /* Note that we calculate the path pointer here through the .un_buffer[] field, in order to |
530 | * outtrick bounds checking tools such as ubsan, which are too smart for their own good: on | |
531 | * Linux the kernel may return sun_path[] data one byte longer than the declared size of the | |
532 | * field. */ | |
533 | char *path = (char*) sa->un_buffer + offsetof(struct sockaddr_un, sun_path); | |
15dca371 | 534 | size_t path_len = salen - offsetof(struct sockaddr_un, sun_path); |
8569a776 | 535 | |
085b39e9 | 536 | if (path[0] == 0) { |
15dca371 ZJS |
537 | /* Abstract socket. When parsing address information from, we |
538 | * explicitly reject overly long paths and paths with embedded NULs. | |
539 | * But we might get such a socket from the outside. Let's return | |
540 | * something meaningful and printable in this case. */ | |
4d49b48c | 541 | |
15dca371 | 542 | _cleanup_free_ char *e = NULL; |
4d49b48c | 543 | |
085b39e9 | 544 | e = cescape_length(path + 1, path_len - 1); |
15dca371 ZJS |
545 | if (!e) |
546 | return -ENOMEM; | |
4d49b48c | 547 | |
15dca371 ZJS |
548 | p = strjoin("@", e); |
549 | } else { | |
085b39e9 | 550 | if (path[path_len - 1] == '\0') |
15dca371 | 551 | /* We expect a terminating NUL and don't print it */ |
b3a9d980 | 552 | path_len--; |
15dca371 | 553 | |
085b39e9 | 554 | p = cescape_length(path, path_len); |
15dca371 | 555 | } |
4d49b48c | 556 | } |
994b9d4e LP |
557 | if (!p) |
558 | return -ENOMEM; | |
8569a776 LP |
559 | |
560 | break; | |
8569a776 | 561 | |
0fc0f14b | 562 | case AF_VSOCK: |
3a484991 ZJS |
563 | if (include_port) { |
564 | if (sa->vm.svm_cid == VMADDR_CID_ANY) | |
565 | r = asprintf(&p, "vsock::%u", sa->vm.svm_port); | |
566 | else | |
567 | r = asprintf(&p, "vsock:%u:%u", sa->vm.svm_cid, sa->vm.svm_port); | |
568 | } else | |
0fc0f14b SH |
569 | r = asprintf(&p, "vsock:%u", sa->vm.svm_cid); |
570 | if (r < 0) | |
571 | return -ENOMEM; | |
572 | break; | |
573 | ||
8569a776 | 574 | default: |
15411c0c | 575 | return -EOPNOTSUPP; |
8569a776 LP |
576 | } |
577 | ||
578 | *ret = p; | |
579 | return 0; | |
580 | } | |
581 | ||
366b7db4 | 582 | int getpeername_pretty(int fd, bool include_port, char **ret) { |
4d49b48c | 583 | union sockaddr_union sa; |
b31f535c | 584 | socklen_t salen = sizeof(sa); |
eff05270 | 585 | int r; |
4d49b48c LP |
586 | |
587 | assert(fd >= 0); | |
588 | assert(ret); | |
589 | ||
4d49b48c LP |
590 | if (getpeername(fd, &sa.sa, &salen) < 0) |
591 | return -errno; | |
592 | ||
593 | if (sa.sa.sa_family == AF_UNIX) { | |
a995ce47 | 594 | struct ucred ucred = UCRED_INVALID; |
4d49b48c LP |
595 | |
596 | /* UNIX connection sockets are anonymous, so let's use | |
597 | * PID/UID as pretty credentials instead */ | |
598 | ||
eff05270 LP |
599 | r = getpeercred(fd, &ucred); |
600 | if (r < 0) | |
601 | return r; | |
4d49b48c | 602 | |
de0671ee | 603 | if (asprintf(ret, "PID "PID_FMT"/UID "UID_FMT, ucred.pid, ucred.uid) < 0) |
4d49b48c LP |
604 | return -ENOMEM; |
605 | ||
606 | return 0; | |
607 | } | |
608 | ||
609 | /* For remote sockets we translate IPv6 addresses back to IPv4 | |
610 | * if applicable, since that's nicer. */ | |
611 | ||
366b7db4 | 612 | return sockaddr_pretty(&sa.sa, salen, true, include_port, ret); |
4d49b48c LP |
613 | } |
614 | ||
615 | int getsockname_pretty(int fd, char **ret) { | |
616 | union sockaddr_union sa; | |
b31f535c | 617 | socklen_t salen = sizeof(sa); |
4d49b48c LP |
618 | |
619 | assert(fd >= 0); | |
620 | assert(ret); | |
621 | ||
4d49b48c LP |
622 | if (getsockname(fd, &sa.sa, &salen) < 0) |
623 | return -errno; | |
624 | ||
625 | /* For local sockets we do not translate IPv6 addresses back | |
626 | * to IPv6 if applicable, since this is usually used for | |
627 | * listening sockets where the difference between IPv4 and | |
628 | * IPv6 matters. */ | |
629 | ||
3b1c5241 | 630 | return sockaddr_pretty(&sa.sa, salen, false, true, ret); |
4d49b48c LP |
631 | } |
632 | ||
fc1f05eb LP |
633 | int socknameinfo_pretty(const struct sockaddr *sa, socklen_t salen, char **ret) { |
634 | char host[NI_MAXHOST]; | |
b31f535c | 635 | int r; |
b31f535c | 636 | |
fc1f05eb | 637 | assert(sa); |
cde08933 | 638 | assert(salen >= sizeof(sa_family_t)); |
4eb3ec63 | 639 | assert(ret); |
b31f535c | 640 | |
fc1f05eb | 641 | r = getnameinfo(sa, salen, host, sizeof(host), /* service= */ NULL, /* service_len= */ 0, IDN_FLAGS); |
b31f535c | 642 | if (r != 0) { |
fc1f05eb LP |
643 | if (r == EAI_MEMORY) |
644 | return log_oom_debug(); | |
645 | if (r == EAI_SYSTEM) | |
646 | log_debug_errno(errno, "getnameinfo() failed, ignoring: %m"); | |
647 | else | |
648 | log_debug("getnameinfo() failed, ignoring: %s", gai_strerror(r)); | |
b31f535c | 649 | |
fc1f05eb LP |
650 | return sockaddr_pretty(sa, salen, /* translate_ipv6= */ true, /* include_port= */ true, ret); |
651 | } | |
b31f535c | 652 | |
4eb3ec63 | 653 | return strdup_to(ret, host); |
b31f535c ZJS |
654 | } |
655 | ||
7a22745a | 656 | static const char* const netlink_family_table[] = { |
0d7e34e3 ZJS |
657 | [NETLINK_ROUTE] = "route", |
658 | [NETLINK_FIREWALL] = "firewall", | |
659 | [NETLINK_INET_DIAG] = "inet-diag", | |
660 | [NETLINK_NFLOG] = "nflog", | |
661 | [NETLINK_XFRM] = "xfrm", | |
662 | [NETLINK_SELINUX] = "selinux", | |
663 | [NETLINK_ISCSI] = "iscsi", | |
664 | [NETLINK_AUDIT] = "audit", | |
665 | [NETLINK_FIB_LOOKUP] = "fib-lookup", | |
666 | [NETLINK_CONNECTOR] = "connector", | |
667 | [NETLINK_NETFILTER] = "netfilter", | |
668 | [NETLINK_IP6_FW] = "ip6-fw", | |
669 | [NETLINK_DNRTMSG] = "dnrtmsg", | |
7a22745a | 670 | [NETLINK_KOBJECT_UEVENT] = "kobject-uevent", |
0d7e34e3 ZJS |
671 | [NETLINK_GENERIC] = "generic", |
672 | [NETLINK_SCSITRANSPORT] = "scsitransport", | |
673 | [NETLINK_ECRYPTFS] = "ecryptfs", | |
674 | [NETLINK_RDMA] = "rdma", | |
7a22745a LP |
675 | }; |
676 | ||
f8b69d1d | 677 | DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(netlink_family, int, INT_MAX); |
7a22745a | 678 | |
c0120d99 LP |
679 | static const char* const socket_address_bind_ipv6_only_table[_SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX] = { |
680 | [SOCKET_ADDRESS_DEFAULT] = "default", | |
681 | [SOCKET_ADDRESS_BOTH] = "both", | |
682 | [SOCKET_ADDRESS_IPV6_ONLY] = "ipv6-only" | |
683 | }; | |
684 | ||
685 | DEFINE_STRING_TABLE_LOOKUP(socket_address_bind_ipv6_only, SocketAddressBindIPv6Only); | |
f01e5736 | 686 | |
b54e98ef | 687 | SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *n) { |
6f90844f YW |
688 | int r; |
689 | ||
690 | r = parse_boolean(n); | |
691 | if (r > 0) | |
692 | return SOCKET_ADDRESS_IPV6_ONLY; | |
693 | if (r == 0) | |
694 | return SOCKET_ADDRESS_BOTH; | |
695 | ||
696 | return socket_address_bind_ipv6_only_from_string(n); | |
697 | } | |
698 | ||
f01e5736 LP |
699 | bool sockaddr_equal(const union sockaddr_union *a, const union sockaddr_union *b) { |
700 | assert(a); | |
701 | assert(b); | |
702 | ||
703 | if (a->sa.sa_family != b->sa.sa_family) | |
704 | return false; | |
705 | ||
706 | if (a->sa.sa_family == AF_INET) | |
707 | return a->in.sin_addr.s_addr == b->in.sin_addr.s_addr; | |
708 | ||
709 | if (a->sa.sa_family == AF_INET6) | |
710 | return memcmp(&a->in6.sin6_addr, &b->in6.sin6_addr, sizeof(a->in6.sin6_addr)) == 0; | |
711 | ||
0fc0f14b SH |
712 | if (a->sa.sa_family == AF_VSOCK) |
713 | return a->vm.svm_cid == b->vm.svm_cid; | |
714 | ||
f01e5736 LP |
715 | return false; |
716 | } | |
2583fbea | 717 | |
d9d9b2a0 | 718 | int fd_set_sndbuf(int fd, size_t n, bool increase) { |
2583fbea LP |
719 | int r, value; |
720 | socklen_t l = sizeof(value); | |
721 | ||
1263c85e YW |
722 | if (n > INT_MAX) |
723 | return -ERANGE; | |
724 | ||
2583fbea | 725 | r = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l); |
d9d9b2a0 | 726 | if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2) |
2583fbea LP |
727 | return 0; |
728 | ||
b92f3507 YW |
729 | /* First, try to set the buffer size with SO_SNDBUF. */ |
730 | r = setsockopt_int(fd, SOL_SOCKET, SO_SNDBUF, n); | |
731 | if (r < 0) | |
732 | return r; | |
2583fbea | 733 | |
b92f3507 YW |
734 | /* SO_SNDBUF above may set to the kernel limit, instead of the requested size. |
735 | * So, we need to check the actual buffer size here. */ | |
67f5ae2d | 736 | l = sizeof(value); |
b92f3507 | 737 | r = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l); |
d9d9b2a0 | 738 | if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2) |
b92f3507 YW |
739 | return 1; |
740 | ||
741 | /* If we have the privileges we will ignore the kernel limit. */ | |
742 | r = setsockopt_int(fd, SOL_SOCKET, SO_SNDBUFFORCE, n); | |
743 | if (r < 0) | |
744 | return r; | |
2583fbea LP |
745 | |
746 | return 1; | |
747 | } | |
748 | ||
d9d9b2a0 | 749 | int fd_set_rcvbuf(int fd, size_t n, bool increase) { |
2583fbea LP |
750 | int r, value; |
751 | socklen_t l = sizeof(value); | |
752 | ||
1263c85e YW |
753 | if (n > INT_MAX) |
754 | return -ERANGE; | |
755 | ||
2583fbea | 756 | r = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, &l); |
d9d9b2a0 | 757 | if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2) |
2583fbea LP |
758 | return 0; |
759 | ||
b92f3507 YW |
760 | /* First, try to set the buffer size with SO_RCVBUF. */ |
761 | r = setsockopt_int(fd, SOL_SOCKET, SO_RCVBUF, n); | |
762 | if (r < 0) | |
763 | return r; | |
2583fbea | 764 | |
b92f3507 YW |
765 | /* SO_RCVBUF above may set to the kernel limit, instead of the requested size. |
766 | * So, we need to check the actual buffer size here. */ | |
67f5ae2d | 767 | l = sizeof(value); |
b92f3507 | 768 | r = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, &l); |
d9d9b2a0 | 769 | if (r >= 0 && l == sizeof(value) && increase ? (size_t) value >= n*2 : (size_t) value == n*2) |
b92f3507 YW |
770 | return 1; |
771 | ||
772 | /* If we have the privileges we will ignore the kernel limit. */ | |
773 | r = setsockopt_int(fd, SOL_SOCKET, SO_RCVBUFFORCE, n); | |
774 | if (r < 0) | |
775 | return r; | |
9e5b6496 | 776 | |
2583fbea LP |
777 | return 1; |
778 | } | |
779 | ||
780 | static const char* const ip_tos_table[] = { | |
0d7e34e3 ZJS |
781 | [IPTOS_LOWDELAY] = "low-delay", |
782 | [IPTOS_THROUGHPUT] = "throughput", | |
2583fbea | 783 | [IPTOS_RELIABILITY] = "reliability", |
0d7e34e3 | 784 | [IPTOS_LOWCOST] = "low-cost", |
2583fbea LP |
785 | }; |
786 | ||
787 | DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(ip_tos, int, 0xff); | |
788 | ||
5a3586db YW |
789 | bool ifname_valid_char(char a) { |
790 | if ((unsigned char) a >= 127U) | |
791 | return false; | |
792 | ||
793 | if ((unsigned char) a <= 32U) | |
794 | return false; | |
795 | ||
796 | if (IN_SET(a, | |
797 | ':', /* colons are used by the legacy "alias" interface logic */ | |
798 | '/', /* slashes cannot work, since we need to use network interfaces in sysfs paths, and in paths slashes are separators */ | |
799 | '%')) /* %d is used in the kernel's weird foo%d format string naming feature which we really really don't want to ever run into by accident */ | |
800 | return false; | |
801 | ||
802 | return true; | |
803 | } | |
804 | ||
2313524a | 805 | bool ifname_valid_full(const char *p, IfnameValidFlags flags) { |
ef76dff2 LP |
806 | bool numeric = true; |
807 | ||
808 | /* Checks whether a network interface name is valid. This is inspired by dev_valid_name() in the kernel sources | |
809 | * but slightly stricter, as we only allow non-control, non-space ASCII characters in the interface name. We | |
810 | * also don't permit names that only container numbers, to avoid confusion with numeric interface indexes. */ | |
811 | ||
2313524a ZJS |
812 | assert(!(flags & ~_IFNAME_VALID_ALL)); |
813 | ||
ef76dff2 LP |
814 | if (isempty(p)) |
815 | return false; | |
816 | ||
ee29bd5d LP |
817 | /* A valid ifindex? If so, it's valid iff IFNAME_VALID_NUMERIC is set */ |
818 | if (parse_ifindex(p) >= 0) | |
819 | return flags & IFNAME_VALID_NUMERIC; | |
820 | ||
2313524a | 821 | if (flags & IFNAME_VALID_ALTERNATIVE) { |
4252696a YW |
822 | if (strlen(p) >= ALTIFNAMSIZ) |
823 | return false; | |
824 | } else { | |
825 | if (strlen(p) >= IFNAMSIZ) | |
826 | return false; | |
827 | } | |
ef76dff2 | 828 | |
49bfc877 | 829 | if (dot_or_dot_dot(p)) |
ef76dff2 LP |
830 | return false; |
831 | ||
07a7441a LP |
832 | /* Let's refuse "all" and "default" as interface name, to avoid collisions with the special sysctl |
833 | * directories /proc/sys/net/{ipv4,ipv6}/conf/{all,default} */ | |
6aebfec3 | 834 | if (!FLAGS_SET(flags, IFNAME_VALID_SPECIAL) && STR_IN_SET(p, "all", "default")) |
07a7441a LP |
835 | return false; |
836 | ||
2313524a | 837 | for (const char *t = p; *t; t++) { |
5a3586db | 838 | if (!ifname_valid_char(*t)) |
ef76dff2 LP |
839 | return false; |
840 | ||
ff25d338 | 841 | numeric = numeric && ascii_isdigit(*t); |
ef76dff2 LP |
842 | } |
843 | ||
ee29bd5d LP |
844 | /* It's fully numeric but didn't parse as valid ifindex above? if so, it must be too large or zero or |
845 | * so, let's refuse that. */ | |
846 | if (numeric) | |
847 | return false; | |
ef76dff2 LP |
848 | |
849 | return true; | |
850 | } | |
851 | ||
26808948 SS |
852 | bool address_label_valid(const char *p) { |
853 | ||
854 | if (isempty(p)) | |
855 | return false; | |
856 | ||
857 | if (strlen(p) >= IFNAMSIZ) | |
858 | return false; | |
859 | ||
860 | while (*p) { | |
861 | if ((uint8_t) *p >= 127U) | |
862 | return false; | |
863 | ||
864 | if ((uint8_t) *p <= 31U) | |
865 | return false; | |
866 | p++; | |
867 | } | |
868 | ||
869 | return true; | |
870 | } | |
871 | ||
2583fbea LP |
872 | int getpeercred(int fd, struct ucred *ucred) { |
873 | socklen_t n = sizeof(struct ucred); | |
874 | struct ucred u; | |
2583fbea LP |
875 | |
876 | assert(fd >= 0); | |
877 | assert(ucred); | |
878 | ||
fccad706 | 879 | if (getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &u, &n) < 0) |
2583fbea LP |
880 | return -errno; |
881 | ||
882 | if (n != sizeof(struct ucred)) | |
883 | return -EIO; | |
884 | ||
bbcc701e LP |
885 | /* Check if the data is actually useful and not suppressed due to namespacing issues */ |
886 | if (!pid_is_valid(u.pid)) | |
2583fbea LP |
887 | return -ENODATA; |
888 | ||
bbcc701e LP |
889 | /* Note that we don't check UID/GID here, as namespace translation works differently there: instead of |
890 | * receiving in "invalid" user/group we get the overflow UID/GID. */ | |
891 | ||
2583fbea LP |
892 | *ucred = u; |
893 | return 0; | |
894 | } | |
895 | ||
896 | int getpeersec(int fd, char **ret) { | |
217d8967 | 897 | _cleanup_free_ char *s = NULL; |
2583fbea | 898 | socklen_t n = 64; |
2583fbea LP |
899 | |
900 | assert(fd >= 0); | |
901 | assert(ret); | |
902 | ||
217d8967 LP |
903 | for (;;) { |
904 | s = new0(char, n+1); | |
905 | if (!s) | |
906 | return -ENOMEM; | |
2583fbea | 907 | |
989740eb LP |
908 | if (getsockopt(fd, SOL_SOCKET, SO_PEERSEC, s, &n) >= 0) { |
909 | s[n] = 0; | |
217d8967 | 910 | break; |
989740eb | 911 | } |
2583fbea LP |
912 | |
913 | if (errno != ERANGE) | |
914 | return -errno; | |
915 | ||
217d8967 | 916 | s = mfree(s); |
2583fbea LP |
917 | } |
918 | ||
217d8967 | 919 | if (isempty(s)) |
2583fbea | 920 | return -EOPNOTSUPP; |
2583fbea | 921 | |
ae2a15bc | 922 | *ret = TAKE_PTR(s); |
217d8967 | 923 | |
2583fbea LP |
924 | return 0; |
925 | } | |
926 | ||
43f2c88d | 927 | int getpeergroups(int fd, gid_t **ret) { |
9c41e4eb | 928 | socklen_t n = sizeof(gid_t) * 64U; |
43f2c88d LP |
929 | _cleanup_free_ gid_t *d = NULL; |
930 | ||
75f40779 | 931 | assert(fd >= 0); |
43f2c88d LP |
932 | assert(ret); |
933 | ||
7e8aa5c2 | 934 | long ngroups_max = sysconf(_SC_NGROUPS_MAX); |
9c41e4eb LB |
935 | if (ngroups_max > 0) |
936 | n = MAX(n, sizeof(gid_t) * (socklen_t) ngroups_max); | |
7e8aa5c2 | 937 | |
43f2c88d LP |
938 | for (;;) { |
939 | d = malloc(n); | |
940 | if (!d) | |
941 | return -ENOMEM; | |
942 | ||
943 | if (getsockopt(fd, SOL_SOCKET, SO_PEERGROUPS, d, &n) >= 0) | |
944 | break; | |
945 | ||
946 | if (errno != ERANGE) | |
947 | return -errno; | |
948 | ||
949 | d = mfree(d); | |
950 | } | |
951 | ||
952 | assert_se(n % sizeof(gid_t) == 0); | |
953 | n /= sizeof(gid_t); | |
954 | ||
7e8aa5c2 | 955 | if (n > INT_MAX) |
43f2c88d LP |
956 | return -E2BIG; |
957 | ||
1cc6c93a | 958 | *ret = TAKE_PTR(d); |
43f2c88d LP |
959 | |
960 | return (int) n; | |
961 | } | |
962 | ||
da5e0c44 LP |
963 | int getpeerpidfd(int fd) { |
964 | socklen_t n = sizeof(int); | |
965 | int pidfd = -EBADF; | |
966 | ||
967 | assert(fd >= 0); | |
968 | ||
969 | if (getsockopt(fd, SOL_SOCKET, SO_PEERPIDFD, &pidfd, &n) < 0) | |
970 | return -errno; | |
971 | ||
972 | if (n != sizeof(int)) | |
973 | return -EIO; | |
974 | ||
975 | return pidfd; | |
976 | } | |
977 | ||
598d2428 LB |
978 | ssize_t send_many_fds_iov_sa( |
979 | int transport_fd, | |
980 | int *fds_array, size_t n_fds_array, | |
981 | const struct iovec *iov, size_t iovlen, | |
982 | const struct sockaddr *sa, socklen_t len, | |
983 | int flags) { | |
984 | ||
985 | _cleanup_free_ struct cmsghdr *cmsg = NULL; | |
986 | struct msghdr mh = { | |
987 | .msg_name = (struct sockaddr*) sa, | |
988 | .msg_namelen = len, | |
989 | .msg_iov = (struct iovec *)iov, | |
990 | .msg_iovlen = iovlen, | |
991 | }; | |
992 | ssize_t k; | |
993 | ||
994 | assert(transport_fd >= 0); | |
995 | assert(fds_array || n_fds_array == 0); | |
996 | ||
997 | /* The kernel will reject sending more than SCM_MAX_FD FDs at once */ | |
998 | if (n_fds_array > SCM_MAX_FD) | |
999 | return -E2BIG; | |
1000 | ||
1001 | /* We need either an FD array or data to send. If there's nothing, return an error. */ | |
1002 | if (n_fds_array == 0 && !iov) | |
1003 | return -EINVAL; | |
1004 | ||
1005 | if (n_fds_array > 0) { | |
1006 | mh.msg_controllen = CMSG_SPACE(sizeof(int) * n_fds_array); | |
1007 | mh.msg_control = cmsg = malloc(mh.msg_controllen); | |
1008 | if (!cmsg) | |
1009 | return -ENOMEM; | |
1010 | ||
1011 | *cmsg = (struct cmsghdr) { | |
1012 | .cmsg_len = CMSG_LEN(sizeof(int) * n_fds_array), | |
1013 | .cmsg_level = SOL_SOCKET, | |
1014 | .cmsg_type = SCM_RIGHTS, | |
1015 | }; | |
1016 | memcpy(CMSG_DATA(cmsg), fds_array, sizeof(int) * n_fds_array); | |
1017 | } | |
1018 | k = sendmsg(transport_fd, &mh, MSG_NOSIGNAL | flags); | |
1019 | if (k < 0) | |
1020 | return (ssize_t) -errno; | |
1021 | ||
1022 | return k; | |
1023 | } | |
1024 | ||
d34673ec | 1025 | ssize_t send_one_fd_iov_sa( |
726f4c47 ZJS |
1026 | int transport_fd, |
1027 | int fd, | |
f621b8d7 | 1028 | const struct iovec *iov, size_t iovlen, |
726f4c47 ZJS |
1029 | const struct sockaddr *sa, socklen_t len, |
1030 | int flags) { | |
1031 | ||
fb29cdbe | 1032 | CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int))) control = {}; |
2583fbea | 1033 | struct msghdr mh = { |
726f4c47 ZJS |
1034 | .msg_name = (struct sockaddr*) sa, |
1035 | .msg_namelen = len, | |
f621b8d7 | 1036 | .msg_iov = (struct iovec *)iov, |
d34673ec | 1037 | .msg_iovlen = iovlen, |
2583fbea | 1038 | }; |
d34673ec | 1039 | ssize_t k; |
2583fbea LP |
1040 | |
1041 | assert(transport_fd >= 0); | |
2583fbea | 1042 | |
d34673ec FB |
1043 | /* |
1044 | * We need either an FD or data to send. | |
1045 | * If there's nothing, return an error. | |
1046 | */ | |
1047 | if (fd < 0 && !iov) | |
1048 | return -EINVAL; | |
2583fbea | 1049 | |
d34673ec FB |
1050 | if (fd >= 0) { |
1051 | struct cmsghdr *cmsg; | |
2583fbea | 1052 | |
d34673ec FB |
1053 | mh.msg_control = &control; |
1054 | mh.msg_controllen = sizeof(control); | |
1055 | ||
1056 | cmsg = CMSG_FIRSTHDR(&mh); | |
1057 | cmsg->cmsg_level = SOL_SOCKET; | |
1058 | cmsg->cmsg_type = SCM_RIGHTS; | |
1059 | cmsg->cmsg_len = CMSG_LEN(sizeof(int)); | |
1060 | memcpy(CMSG_DATA(cmsg), &fd, sizeof(int)); | |
d34673ec FB |
1061 | } |
1062 | k = sendmsg(transport_fd, &mh, MSG_NOSIGNAL | flags); | |
1063 | if (k < 0) | |
1064 | return (ssize_t) -errno; | |
1065 | ||
1066 | return k; | |
2583fbea LP |
1067 | } |
1068 | ||
d34673ec FB |
1069 | int send_one_fd_sa( |
1070 | int transport_fd, | |
1071 | int fd, | |
1072 | const struct sockaddr *sa, socklen_t len, | |
1073 | int flags) { | |
1074 | ||
1075 | assert(fd >= 0); | |
1076 | ||
1077 | return (int) send_one_fd_iov_sa(transport_fd, fd, NULL, 0, sa, len, flags); | |
1078 | } | |
1079 | ||
598d2428 LB |
1080 | ssize_t receive_many_fds_iov( |
1081 | int transport_fd, | |
1082 | struct iovec *iov, size_t iovlen, | |
1083 | int **ret_fds_array, size_t *ret_n_fds_array, | |
1084 | int flags) { | |
1085 | ||
1086 | CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int) * SCM_MAX_FD)) control; | |
1087 | struct msghdr mh = { | |
1088 | .msg_control = &control, | |
1089 | .msg_controllen = sizeof(control), | |
1090 | .msg_iov = iov, | |
1091 | .msg_iovlen = iovlen, | |
1092 | }; | |
1093 | _cleanup_free_ int *fds_array = NULL; | |
1094 | size_t n_fds_array = 0; | |
1095 | struct cmsghdr *cmsg; | |
1096 | ssize_t k; | |
1097 | ||
1098 | assert(transport_fd >= 0); | |
1099 | assert(ret_fds_array); | |
1100 | assert(ret_n_fds_array); | |
1101 | ||
1102 | /* | |
1103 | * Receive many FDs via @transport_fd. We don't care for the transport-type. We retrieve all the FDs | |
1104 | * at once. This is best used in combination with send_many_fds(). | |
1105 | */ | |
1106 | ||
1107 | k = recvmsg_safe(transport_fd, &mh, MSG_CMSG_CLOEXEC | flags); | |
1108 | if (k < 0) | |
1109 | return k; | |
1110 | ||
1111 | CMSG_FOREACH(cmsg, &mh) | |
1112 | if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { | |
1113 | size_t n = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int); | |
1114 | ||
1115 | fds_array = GREEDY_REALLOC(fds_array, n_fds_array + n); | |
1116 | if (!fds_array) { | |
1117 | cmsg_close_all(&mh); | |
1118 | return -ENOMEM; | |
1119 | } | |
1120 | ||
1121 | memcpy(fds_array + n_fds_array, CMSG_TYPED_DATA(cmsg, int), sizeof(int) * n); | |
1122 | n_fds_array += n; | |
1123 | } | |
1124 | ||
1125 | if (n_fds_array == 0) { | |
1126 | cmsg_close_all(&mh); | |
1127 | ||
1128 | /* If didn't receive an FD or any data, return an error. */ | |
1129 | if (k == 0) | |
1130 | return -EIO; | |
1131 | } | |
1132 | ||
1133 | *ret_fds_array = TAKE_PTR(fds_array); | |
1134 | *ret_n_fds_array = n_fds_array; | |
1135 | ||
1136 | return k; | |
1137 | } | |
1138 | ||
1139 | int receive_many_fds(int transport_fd, int **ret_fds_array, size_t *ret_n_fds_array, int flags) { | |
1140 | ssize_t k; | |
1141 | ||
1142 | k = receive_many_fds_iov(transport_fd, NULL, 0, ret_fds_array, ret_n_fds_array, flags); | |
1143 | if (k == 0) | |
1144 | return 0; | |
1145 | ||
1146 | /* k must be negative, since receive_many_fds_iov() only returns a positive value if data was received | |
1147 | * through the iov. */ | |
1148 | assert(k < 0); | |
1149 | return (int) k; | |
1150 | } | |
1151 | ||
d34673ec FB |
1152 | ssize_t receive_one_fd_iov( |
1153 | int transport_fd, | |
1154 | struct iovec *iov, size_t iovlen, | |
1155 | int flags, | |
1156 | int *ret_fd) { | |
1157 | ||
fb29cdbe | 1158 | CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int))) control; |
2583fbea LP |
1159 | struct msghdr mh = { |
1160 | .msg_control = &control, | |
1161 | .msg_controllen = sizeof(control), | |
d34673ec FB |
1162 | .msg_iov = iov, |
1163 | .msg_iovlen = iovlen, | |
2583fbea | 1164 | }; |
dac556fa | 1165 | struct cmsghdr *found; |
d34673ec | 1166 | ssize_t k; |
2583fbea LP |
1167 | |
1168 | assert(transport_fd >= 0); | |
d34673ec | 1169 | assert(ret_fd); |
2583fbea LP |
1170 | |
1171 | /* | |
1172 | * Receive a single FD via @transport_fd. We don't care for | |
1173 | * the transport-type. We retrieve a single FD at most, so for | |
1174 | * packet-based transports, the caller must ensure to send | |
1175 | * only a single FD per packet. This is best used in | |
1176 | * combination with send_one_fd(). | |
1177 | */ | |
1178 | ||
3691bcf3 | 1179 | k = recvmsg_safe(transport_fd, &mh, MSG_CMSG_CLOEXEC | flags); |
d34673ec | 1180 | if (k < 0) |
3691bcf3 | 1181 | return k; |
2583fbea | 1182 | |
dac556fa | 1183 | found = cmsg_find(&mh, SOL_SOCKET, SCM_RIGHTS, CMSG_LEN(sizeof(int))); |
3691bcf3 | 1184 | if (!found) { |
2583fbea | 1185 | cmsg_close_all(&mh); |
d34673ec | 1186 | |
3691bcf3 LP |
1187 | /* If didn't receive an FD or any data, return an error. */ |
1188 | if (k == 0) | |
1189 | return -EIO; | |
1190 | } | |
2583fbea | 1191 | |
d34673ec | 1192 | if (found) |
b1d02191 | 1193 | *ret_fd = *CMSG_TYPED_DATA(found, int); |
d34673ec | 1194 | else |
254d1313 | 1195 | *ret_fd = -EBADF; |
d34673ec FB |
1196 | |
1197 | return k; | |
1198 | } | |
1199 | ||
1200 | int receive_one_fd(int transport_fd, int flags) { | |
1201 | int fd; | |
1202 | ssize_t k; | |
1203 | ||
1204 | k = receive_one_fd_iov(transport_fd, NULL, 0, flags, &fd); | |
1205 | if (k == 0) | |
1206 | return fd; | |
1207 | ||
1208 | /* k must be negative, since receive_one_fd_iov() only returns | |
1209 | * a positive value if data was received through the iov. */ | |
1210 | assert(k < 0); | |
1211 | return (int) k; | |
2583fbea | 1212 | } |
4edc2c9b LP |
1213 | |
1214 | ssize_t next_datagram_size_fd(int fd) { | |
1215 | ssize_t l; | |
1216 | int k; | |
1217 | ||
1218 | /* This is a bit like FIONREAD/SIOCINQ, however a bit more powerful. The difference being: recv(MSG_PEEK) will | |
96d49011 | 1219 | * actually cause the next datagram in the queue to be validated regarding checksums, which FIONREAD doesn't |
4edc2c9b LP |
1220 | * do. This difference is actually of major importance as we need to be sure that the size returned here |
1221 | * actually matches what we will read with recvmsg() next, as otherwise we might end up allocating a buffer of | |
1222 | * the wrong size. */ | |
1223 | ||
1224 | l = recv(fd, NULL, 0, MSG_PEEK|MSG_TRUNC); | |
1225 | if (l < 0) { | |
3742095b | 1226 | if (IN_SET(errno, EOPNOTSUPP, EFAULT)) |
4edc2c9b LP |
1227 | goto fallback; |
1228 | ||
1229 | return -errno; | |
1230 | } | |
1231 | if (l == 0) | |
1232 | goto fallback; | |
1233 | ||
1234 | return l; | |
1235 | ||
1236 | fallback: | |
1237 | k = 0; | |
1238 | ||
1239 | /* Some sockets (AF_PACKET) do not support null-sized recv() with MSG_TRUNC set, let's fall back to FIONREAD | |
1240 | * for them. Checksums don't matter for raw sockets anyway, hence this should be fine. */ | |
1241 | ||
1242 | if (ioctl(fd, FIONREAD, &k) < 0) | |
1243 | return -errno; | |
1244 | ||
1245 | return (ssize_t) k; | |
1246 | } | |
60d9771c | 1247 | |
67962036 ZJS |
1248 | /* Put a limit on how many times will attempt to call accept4(). We loop |
1249 | * only on "transient" errors, but let's make sure we don't loop forever. */ | |
1250 | #define MAX_FLUSH_ITERATIONS 1024 | |
1251 | ||
60d9771c LP |
1252 | int flush_accept(int fd) { |
1253 | ||
f3d75364 LP |
1254 | int r, b; |
1255 | socklen_t l = sizeof(b); | |
1256 | ||
644cb4cc ZJS |
1257 | /* Similar to flush_fd() but flushes all incoming connections by accepting and immediately closing |
1258 | * them. */ | |
f3d75364 LP |
1259 | |
1260 | if (getsockopt(fd, SOL_SOCKET, SO_ACCEPTCONN, &b, &l) < 0) | |
1261 | return -errno; | |
60d9771c | 1262 | |
f3d75364 | 1263 | assert(l == sizeof(b)); |
644cb4cc ZJS |
1264 | if (!b) /* Let's check if this socket accepts connections before calling accept(). accept4() can |
1265 | * return EOPNOTSUPP if the fd is not a listening socket, which we should treat as a fatal | |
1266 | * error, or in case the incoming TCP connection triggered a network issue, which we want to | |
1267 | * treat as a transient error. Thus, let's rule out the first reason for EOPNOTSUPP early, so | |
1268 | * we can loop safely on transient errors below. */ | |
f3d75364 | 1269 | return -ENOTTY; |
60d9771c | 1270 | |
67962036 | 1271 | for (unsigned iteration = 0;; iteration++) { |
60d9771c LP |
1272 | int cfd; |
1273 | ||
0f2d351f | 1274 | r = fd_wait_for_event(fd, POLLIN, 0); |
60d9771c | 1275 | if (r < 0) { |
0f2d351f | 1276 | if (r == -EINTR) |
60d9771c LP |
1277 | continue; |
1278 | ||
0f2d351f | 1279 | return r; |
4ff9bc2e LP |
1280 | } |
1281 | if (r == 0) | |
60d9771c LP |
1282 | return 0; |
1283 | ||
67962036 ZJS |
1284 | if (iteration >= MAX_FLUSH_ITERATIONS) |
1285 | return log_debug_errno(SYNTHETIC_ERRNO(EBUSY), | |
1286 | "Failed to flush connections within " STRINGIFY(MAX_FLUSH_ITERATIONS) " iterations."); | |
1287 | ||
60d9771c LP |
1288 | cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC); |
1289 | if (cfd < 0) { | |
60d9771c LP |
1290 | if (errno == EAGAIN) |
1291 | return 0; | |
1292 | ||
4ff9bc2e LP |
1293 | if (ERRNO_IS_ACCEPT_AGAIN(errno)) |
1294 | continue; | |
1295 | ||
60d9771c LP |
1296 | return -errno; |
1297 | } | |
1298 | ||
4ff9bc2e | 1299 | safe_close(cfd); |
60d9771c LP |
1300 | } |
1301 | } | |
29206d46 LP |
1302 | |
1303 | struct cmsghdr* cmsg_find(struct msghdr *mh, int level, int type, socklen_t length) { | |
1304 | struct cmsghdr *cmsg; | |
1305 | ||
1306 | assert(mh); | |
1307 | ||
1308 | CMSG_FOREACH(cmsg, mh) | |
1309 | if (cmsg->cmsg_level == level && | |
1310 | cmsg->cmsg_type == type && | |
1311 | (length == (socklen_t) -1 || length == cmsg->cmsg_len)) | |
1312 | return cmsg; | |
1313 | ||
1314 | return NULL; | |
1315 | } | |
429b4350 | 1316 | |
4836f4c6 YW |
1317 | void* cmsg_find_and_copy_data(struct msghdr *mh, int level, int type, void *buf, size_t buf_len) { |
1318 | struct cmsghdr *cmsg; | |
1319 | ||
1320 | assert(mh); | |
1321 | assert(buf); | |
1322 | assert(buf_len > 0); | |
1323 | ||
1324 | /* This is similar to cmsg_find_data(), but copy the found data to buf. This should be typically used | |
da890466 | 1325 | * when reading possibly unaligned data such as timestamp, as time_t is 64-bit and size_t is 32-bit on |
4836f4c6 YW |
1326 | * RISCV32. See issue #27241. */ |
1327 | ||
1328 | cmsg = cmsg_find(mh, level, type, CMSG_LEN(buf_len)); | |
1329 | if (!cmsg) | |
1330 | return NULL; | |
1331 | ||
1332 | return memcpy_safe(buf, CMSG_DATA(cmsg), buf_len); | |
1333 | } | |
1334 | ||
429b4350 LP |
1335 | int socket_ioctl_fd(void) { |
1336 | int fd; | |
1337 | ||
1338 | /* Create a socket to invoke the various network interface ioctl()s on. Traditionally only AF_INET was good for | |
1339 | * that. Since kernel 4.6 AF_NETLINK works for this too. We first try to use AF_INET hence, but if that's not | |
1340 | * available (for example, because it is made unavailable via SECCOMP or such), we'll fall back to the more | |
1341 | * generic AF_NETLINK. */ | |
1342 | ||
1343 | fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, 0); | |
1344 | if (fd < 0) | |
1345 | fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_GENERIC); | |
1346 | if (fd < 0) | |
1347 | return -errno; | |
1348 | ||
1349 | return fd; | |
1350 | } | |
9f20fc28 LP |
1351 | |
1352 | int sockaddr_un_unlink(const struct sockaddr_un *sa) { | |
1353 | const char *p, * nul; | |
1354 | ||
1355 | assert(sa); | |
1356 | ||
1357 | if (sa->sun_family != AF_UNIX) | |
1358 | return -EPROTOTYPE; | |
1359 | ||
1360 | if (sa->sun_path[0] == 0) /* Nothing to do for abstract sockets */ | |
1361 | return 0; | |
1362 | ||
1363 | /* The path in .sun_path is not necessarily NUL terminated. Let's fix that. */ | |
1364 | nul = memchr(sa->sun_path, 0, sizeof(sa->sun_path)); | |
1365 | if (nul) | |
1366 | p = sa->sun_path; | |
1367 | else | |
1368 | p = memdupa_suffix0(sa->sun_path, sizeof(sa->sun_path)); | |
1369 | ||
1370 | if (unlink(p) < 0) | |
1371 | return -errno; | |
1372 | ||
1373 | return 1; | |
1374 | } | |
5cf91ea9 LP |
1375 | |
1376 | int sockaddr_un_set_path(struct sockaddr_un *ret, const char *path) { | |
1377 | size_t l; | |
1378 | ||
1379 | assert(ret); | |
1380 | assert(path); | |
1381 | ||
1382 | /* Initialize ret->sun_path from the specified argument. This will interpret paths starting with '@' as | |
1383 | * abstract namespace sockets, and those starting with '/' as regular filesystem sockets. It won't accept | |
1384 | * anything else (i.e. no relative paths), to avoid ambiguities. Note that this function cannot be used to | |
1385 | * reference paths in the abstract namespace that include NUL bytes in the name. */ | |
1386 | ||
1387 | l = strlen(path); | |
c097bf1f | 1388 | if (l < 2) |
5cf91ea9 LP |
1389 | return -EINVAL; |
1390 | if (!IN_SET(path[0], '/', '@')) | |
1391 | return -EINVAL; | |
5cf91ea9 LP |
1392 | |
1393 | /* Don't allow paths larger than the space in sockaddr_un. Note that we are a tiny bit more restrictive than | |
1394 | * the kernel is: we insist on NUL termination (both for abstract namespace and regular file system socket | |
1395 | * addresses!), which the kernel doesn't. We do this to reduce chance of incompatibility with other apps that | |
7802194a | 1396 | * do not expect non-NUL terminated file system path. */ |
5cf91ea9 | 1397 | if (l+1 > sizeof(ret->sun_path)) |
dfa2b389 LP |
1398 | return path[0] == '@' ? -EINVAL : -ENAMETOOLONG; /* return a recognizable error if this is |
1399 | * too long to fit into a sockaddr_un, but | |
1400 | * is a file system path, and thus might be | |
1401 | * connectible via O_PATH indirection. */ | |
5cf91ea9 LP |
1402 | |
1403 | *ret = (struct sockaddr_un) { | |
1404 | .sun_family = AF_UNIX, | |
1405 | }; | |
1406 | ||
1407 | if (path[0] == '@') { | |
1408 | /* Abstract namespace socket */ | |
1409 | memcpy(ret->sun_path + 1, path + 1, l); /* copy *with* trailing NUL byte */ | |
1410 | return (int) (offsetof(struct sockaddr_un, sun_path) + l); /* 🔥 *don't* 🔥 include trailing NUL in size */ | |
1411 | ||
1412 | } else { | |
1413 | assert(path[0] == '/'); | |
1414 | ||
1415 | /* File system socket */ | |
1416 | memcpy(ret->sun_path, path, l + 1); /* copy *with* trailing NUL byte */ | |
1417 | return (int) (offsetof(struct sockaddr_un, sun_path) + l + 1); /* include trailing NUL in size */ | |
1418 | } | |
1419 | } | |
5d594d01 LP |
1420 | |
1421 | int socket_bind_to_ifname(int fd, const char *ifname) { | |
1422 | assert(fd >= 0); | |
1423 | ||
1424 | /* Call with NULL to drop binding */ | |
1425 | ||
7c248223 | 1426 | return RET_NERRNO(setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, ifname, strlen_ptr(ifname))); |
5d594d01 LP |
1427 | } |
1428 | ||
1429 | int socket_bind_to_ifindex(int fd, int ifindex) { | |
01afd0f7 | 1430 | char ifname[IF_NAMESIZE]; |
5e958e1d | 1431 | int r; |
5d594d01 LP |
1432 | |
1433 | assert(fd >= 0); | |
1434 | ||
7c248223 | 1435 | if (ifindex <= 0) |
5d594d01 | 1436 | /* Drop binding */ |
7c248223 | 1437 | return RET_NERRNO(setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, NULL, 0)); |
5d594d01 | 1438 | |
5e958e1d YW |
1439 | r = setsockopt_int(fd, SOL_SOCKET, SO_BINDTOIFINDEX, ifindex); |
1440 | if (r != -ENOPROTOOPT) | |
1441 | return r; | |
5d594d01 LP |
1442 | |
1443 | /* Fall back to SO_BINDTODEVICE on kernels < 5.0 which didn't have SO_BINDTOIFINDEX */ | |
01afd0f7 YW |
1444 | r = format_ifname(ifindex, ifname); |
1445 | if (r < 0) | |
1446 | return r; | |
5d594d01 LP |
1447 | |
1448 | return socket_bind_to_ifname(fd, ifname); | |
1449 | } | |
47eae6ce LP |
1450 | |
1451 | ssize_t recvmsg_safe(int sockfd, struct msghdr *msg, int flags) { | |
1452 | ssize_t n; | |
1453 | ||
1454 | /* A wrapper around recvmsg() that checks for MSG_CTRUNC, and turns it into an error, in a reasonably | |
1455 | * safe way, closing any SCM_RIGHTS fds in the error path. | |
1456 | * | |
1457 | * Note that unlike our usual coding style this might modify *msg on failure. */ | |
1458 | ||
1459 | n = recvmsg(sockfd, msg, flags); | |
1460 | if (n < 0) | |
1461 | return -errno; | |
1462 | ||
1463 | if (FLAGS_SET(msg->msg_flags, MSG_CTRUNC)) { | |
1464 | cmsg_close_all(msg); | |
1465 | return -EXFULL; /* a recognizable error code */ | |
1466 | } | |
1467 | ||
1468 | return n; | |
35a3eb9b LP |
1469 | } |
1470 | ||
5f64d2bf | 1471 | int socket_get_family(int fd) { |
35a3eb9b LP |
1472 | int af; |
1473 | socklen_t sl = sizeof(af); | |
1474 | ||
1475 | if (getsockopt(fd, SOL_SOCKET, SO_DOMAIN, &af, &sl) < 0) | |
1476 | return -errno; | |
1477 | ||
5d0fe423 LP |
1478 | if (sl != sizeof(af)) |
1479 | return -EINVAL; | |
1480 | ||
1481 | return af; | |
1482 | } | |
1483 | ||
1484 | int socket_set_recvpktinfo(int fd, int af, bool b) { | |
5d0fe423 LP |
1485 | |
1486 | if (af == AF_UNSPEC) { | |
5f64d2bf LP |
1487 | af = socket_get_family(fd); |
1488 | if (af < 0) | |
1489 | return af; | |
5d0fe423 LP |
1490 | } |
1491 | ||
35a3eb9b LP |
1492 | switch (af) { |
1493 | ||
1494 | case AF_INET: | |
1495 | return setsockopt_int(fd, IPPROTO_IP, IP_PKTINFO, b); | |
47eae6ce | 1496 | |
35a3eb9b LP |
1497 | case AF_INET6: |
1498 | return setsockopt_int(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, b); | |
1499 | ||
1500 | case AF_NETLINK: | |
1501 | return setsockopt_int(fd, SOL_NETLINK, NETLINK_PKTINFO, b); | |
1502 | ||
2d6d4136 LP |
1503 | case AF_PACKET: |
1504 | return setsockopt_int(fd, SOL_PACKET, PACKET_AUXDATA, b); | |
1505 | ||
35a3eb9b LP |
1506 | default: |
1507 | return -EAFNOSUPPORT; | |
1508 | } | |
47eae6ce | 1509 | } |
5d0fe423 | 1510 | |
5d0fe423 LP |
1511 | int socket_set_unicast_if(int fd, int af, int ifi) { |
1512 | be32_t ifindex_be = htobe32(ifi); | |
5d0fe423 LP |
1513 | |
1514 | if (af == AF_UNSPEC) { | |
5f64d2bf LP |
1515 | af = socket_get_family(fd); |
1516 | if (af < 0) | |
1517 | return af; | |
5d0fe423 LP |
1518 | } |
1519 | ||
1520 | switch (af) { | |
1521 | ||
1522 | case AF_INET: | |
7c248223 | 1523 | return RET_NERRNO(setsockopt(fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex_be, sizeof(ifindex_be))); |
5d0fe423 LP |
1524 | |
1525 | case AF_INET6: | |
7c248223 | 1526 | return RET_NERRNO(setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex_be, sizeof(ifindex_be))); |
5d0fe423 LP |
1527 | |
1528 | default: | |
1529 | return -EAFNOSUPPORT; | |
1530 | } | |
1531 | } | |
1532 | ||
402506ce | 1533 | int socket_set_option(int fd, int af, int opt_ipv4, int opt_ipv6, int val) { |
5d0fe423 | 1534 | if (af == AF_UNSPEC) { |
5f64d2bf LP |
1535 | af = socket_get_family(fd); |
1536 | if (af < 0) | |
1537 | return af; | |
5d0fe423 LP |
1538 | } |
1539 | ||
1540 | switch (af) { | |
1541 | ||
1542 | case AF_INET: | |
402506ce | 1543 | return setsockopt_int(fd, IPPROTO_IP, opt_ipv4, val); |
5d0fe423 LP |
1544 | |
1545 | case AF_INET6: | |
402506ce | 1546 | return setsockopt_int(fd, IPPROTO_IPV6, opt_ipv6, val); |
5d0fe423 LP |
1547 | |
1548 | default: | |
1549 | return -EAFNOSUPPORT; | |
1550 | } | |
1551 | } | |
52975f86 LP |
1552 | |
1553 | int socket_get_mtu(int fd, int af, size_t *ret) { | |
1554 | int mtu, r; | |
1555 | ||
1556 | if (af == AF_UNSPEC) { | |
5f64d2bf LP |
1557 | af = socket_get_family(fd); |
1558 | if (af < 0) | |
1559 | return af; | |
52975f86 LP |
1560 | } |
1561 | ||
1562 | switch (af) { | |
1563 | ||
1564 | case AF_INET: | |
1565 | r = getsockopt_int(fd, IPPROTO_IP, IP_MTU, &mtu); | |
1566 | break; | |
1567 | ||
1568 | case AF_INET6: | |
1569 | r = getsockopt_int(fd, IPPROTO_IPV6, IPV6_MTU, &mtu); | |
1570 | break; | |
1571 | ||
1572 | default: | |
1573 | return -EAFNOSUPPORT; | |
1574 | } | |
1575 | ||
1576 | if (r < 0) | |
1577 | return r; | |
1578 | if (mtu <= 0) | |
1579 | return -EINVAL; | |
1580 | ||
1581 | *ret = (size_t) mtu; | |
1582 | return 0; | |
1583 | } | |
2679aee4 | 1584 | |
9a603dc2 | 1585 | static int connect_unix_path_simple(int fd, const char *path) { |
2679aee4 LP |
1586 | union sockaddr_union sa = { |
1587 | .un.sun_family = AF_UNIX, | |
1588 | }; | |
9a603dc2 | 1589 | size_t l; |
2679aee4 LP |
1590 | |
1591 | assert(fd >= 0); | |
2679aee4 LP |
1592 | assert(path); |
1593 | ||
9a603dc2 LP |
1594 | l = strlen(path); |
1595 | assert(l > 0); | |
1596 | assert(l < sizeof(sa.un.sun_path)); | |
1597 | ||
1598 | memcpy(sa.un.sun_path, path, l + 1); | |
1599 | return RET_NERRNO(connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + l + 1)); | |
1600 | } | |
1601 | ||
1602 | static int connect_unix_inode(int fd, int inode_fd) { | |
1603 | assert(fd >= 0); | |
1604 | assert(inode_fd >= 0); | |
1605 | ||
1606 | return connect_unix_path_simple(fd, FORMAT_PROC_FD_PATH(inode_fd)); | |
1607 | } | |
1608 | ||
1609 | int connect_unix_path(int fd, int dir_fd, const char *path) { | |
1610 | _cleanup_close_ int inode_fd = -EBADF; | |
1611 | ||
1612 | assert(fd >= 0); | |
1613 | assert(dir_fd == AT_FDCWD || dir_fd >= 0); | |
1614 | ||
2679aee4 LP |
1615 | /* Connects to the specified AF_UNIX socket in the file system. Works around the 108 byte size limit |
1616 | * in sockaddr_un, by going via O_PATH if needed. This hence works for any kind of path. */ | |
1617 | ||
9a603dc2 LP |
1618 | if (!path) |
1619 | return connect_unix_inode(fd, dir_fd); /* If no path is specified, then dir_fd refers to the socket inode to connect to. */ | |
2679aee4 LP |
1620 | |
1621 | /* Refuse zero length path early, to make sure AF_UNIX stack won't mistake this for an abstract | |
1622 | * namespace path, since first char is NUL */ | |
9a603dc2 | 1623 | if (isempty(path)) |
2679aee4 LP |
1624 | return -EINVAL; |
1625 | ||
9a603dc2 LP |
1626 | /* Shortcut for the simple case */ |
1627 | if (dir_fd == AT_FDCWD && strlen(path) < sizeof_field(struct sockaddr_un, sun_path)) | |
1628 | return connect_unix_path_simple(fd, path); | |
2679aee4 | 1629 | |
9a603dc2 LP |
1630 | /* If dir_fd is specified, then we need to go the indirect O_PATH route, because connectat() does not |
1631 | * exist. If the path is too long, we also need to take the indirect route, since we can't fit this | |
1632 | * into a sockaddr_un directly. */ | |
2679aee4 | 1633 | |
9a603dc2 LP |
1634 | inode_fd = openat(dir_fd, path, O_PATH|O_CLOEXEC); |
1635 | if (inode_fd < 0) | |
1636 | return -errno; | |
2679aee4 | 1637 | |
9a603dc2 | 1638 | return connect_unix_inode(fd, inode_fd); |
2679aee4 | 1639 | } |
747b5d96 LB |
1640 | |
1641 | int socket_address_parse_unix(SocketAddress *ret_address, const char *s) { | |
1642 | struct sockaddr_un un; | |
1643 | int r; | |
1644 | ||
1645 | assert(ret_address); | |
1646 | assert(s); | |
1647 | ||
1648 | if (!IN_SET(*s, '/', '@')) | |
1649 | return -EPROTO; | |
1650 | ||
1651 | r = sockaddr_un_set_path(&un, s); | |
1652 | if (r < 0) | |
1653 | return r; | |
1654 | ||
1655 | *ret_address = (SocketAddress) { | |
1656 | .sockaddr.un = un, | |
1657 | .size = r, | |
1658 | }; | |
1659 | ||
1660 | return 0; | |
1661 | } | |
1662 | ||
8e471c6a LP |
1663 | int vsock_parse_port(const char *s, unsigned *ret) { |
1664 | int r; | |
1665 | ||
1666 | assert(ret); | |
1667 | ||
1668 | if (!s) | |
1669 | return -EINVAL; | |
1670 | ||
1671 | unsigned u; | |
1672 | r = safe_atou(s, &u); | |
1673 | if (r < 0) | |
1674 | return r; | |
1675 | ||
1676 | /* Port 0 is apparently valid and not special in AF_VSOCK (unlike on IP). But VMADDR_PORT_ANY | |
1677 | * (UINT32_MAX) is. Hence refuse that. */ | |
1678 | ||
1679 | if (u == VMADDR_PORT_ANY) | |
1680 | return -EINVAL; | |
1681 | ||
1682 | *ret = u; | |
1683 | return 0; | |
1684 | } | |
1685 | ||
1686 | int vsock_parse_cid(const char *s, unsigned *ret) { | |
1687 | assert(ret); | |
1688 | ||
1689 | if (!s) | |
1690 | return -EINVAL; | |
1691 | ||
1692 | /* Parsed an AF_VSOCK "CID". This is a 32bit entity, and the usual type is "unsigned". We recognize | |
1693 | * the three special CIDs as strings, and otherwise parse the numeric CIDs. */ | |
1694 | ||
1695 | if (streq(s, "hypervisor")) | |
1696 | *ret = VMADDR_CID_HYPERVISOR; | |
1697 | else if (streq(s, "local")) | |
1698 | *ret = VMADDR_CID_LOCAL; | |
1699 | else if (streq(s, "host")) | |
1700 | *ret = VMADDR_CID_HOST; | |
1701 | else | |
1702 | return safe_atou(s, ret); | |
1703 | ||
1704 | return 0; | |
1705 | } | |
1706 | ||
747b5d96 LB |
1707 | int socket_address_parse_vsock(SocketAddress *ret_address, const char *s) { |
1708 | /* AF_VSOCK socket in vsock:cid:port notation */ | |
1709 | _cleanup_free_ char *n = NULL; | |
1710 | char *e, *cid_start; | |
1711 | unsigned port, cid; | |
c31984e3 | 1712 | int type, r; |
747b5d96 LB |
1713 | |
1714 | assert(ret_address); | |
1715 | assert(s); | |
1716 | ||
c31984e3 DDM |
1717 | if ((cid_start = startswith(s, "vsock:"))) |
1718 | type = 0; | |
1719 | else if ((cid_start = startswith(s, "vsock-dgram:"))) | |
1720 | type = SOCK_DGRAM; | |
1721 | else if ((cid_start = startswith(s, "vsock-seqpacket:"))) | |
1722 | type = SOCK_SEQPACKET; | |
1723 | else if ((cid_start = startswith(s, "vsock-stream:"))) | |
1724 | type = SOCK_STREAM; | |
1725 | else | |
747b5d96 LB |
1726 | return -EPROTO; |
1727 | ||
1728 | e = strchr(cid_start, ':'); | |
1729 | if (!e) | |
1730 | return -EINVAL; | |
1731 | ||
8e471c6a | 1732 | r = vsock_parse_port(e+1, &port); |
747b5d96 LB |
1733 | if (r < 0) |
1734 | return r; | |
1735 | ||
1736 | n = strndup(cid_start, e - cid_start); | |
1737 | if (!n) | |
1738 | return -ENOMEM; | |
1739 | ||
1740 | if (isempty(n)) | |
1741 | cid = VMADDR_CID_ANY; | |
1742 | else { | |
8e471c6a | 1743 | r = vsock_parse_cid(n, &cid); |
747b5d96 LB |
1744 | if (r < 0) |
1745 | return r; | |
1746 | } | |
1747 | ||
1748 | *ret_address = (SocketAddress) { | |
1749 | .sockaddr.vm = { | |
747b5d96 | 1750 | .svm_family = AF_VSOCK, |
8e471c6a | 1751 | .svm_cid = cid, |
747b5d96 LB |
1752 | .svm_port = port, |
1753 | }, | |
c31984e3 | 1754 | .type = type, |
747b5d96 LB |
1755 | .size = sizeof(struct sockaddr_vm), |
1756 | }; | |
1757 | ||
1758 | return 0; | |
1759 | } | |
d3109d8d LP |
1760 | |
1761 | int vsock_get_local_cid(unsigned *ret) { | |
1762 | _cleanup_close_ int vsock_fd = -EBADF; | |
1763 | ||
1764 | assert(ret); | |
1765 | ||
1766 | vsock_fd = open("/dev/vsock", O_RDONLY|O_CLOEXEC); | |
1767 | if (vsock_fd < 0) | |
1768 | return log_debug_errno(errno, "Failed to open /dev/vsock: %m"); | |
1769 | ||
1770 | if (ioctl(vsock_fd, IOCTL_VM_SOCKETS_GET_LOCAL_CID, ret) < 0) | |
1771 | return log_debug_errno(errno, "Failed to query local AF_VSOCK CID: %m"); | |
1772 | ||
1773 | return 0; | |
1774 | } |