]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/socket.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #28870 from ssahani/rto-min-network
[thirdparty/systemd.git] / src / core / socket.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
a7334b09 2
e8da24a6 3#include <arpa/inet.h>
83c60c9f
LP		 4#include <errno.h>
5#include <fcntl.h>
916abb21 6#include <mqueue.h>
e8da24a6 7#include <netinet/tcp.h>
e8da24a6
LP		 8#include <sys/epoll.h>
9#include <sys/stat.h>
10#include <unistd.h>
62bc4efc 11#include <linux/sctp.h>
83c60c9f 12
b5efdb8a 13#include "alloc-util.h"
a79279c7 14#include "bpf-firewall.h"
e8da24a6
LP		 15#include "bus-error.h"
16#include "bus-util.h"
f461a28d 17#include "chase.h"
28db6fbf 18#include "constants.h"
e8da24a6
LP		 19#include "copy.h"
20#include "dbus-socket.h"
6fcbec6f 21#include "dbus-unit.h"
86e045ec 22#include "errno-list.h"
e8da24a6 23#include "exit-status.h"
3ffd4af2 24#include "fd-util.h"
f97b34a6 25#include "format-util.h"
a79279c7 26#include "in-addr-util.h"
60d9771c 27#include "io-util.h"
da96ad5a 28#include "ip-protocol-list.h"
0690160e 29#include "label-util.h"
83c60c9f 30#include "log.h"
35cd0ba5 31#include "mkdir-label.h"
6bedfcbb 32#include "parse-util.h"
9eb977db 33#include "path-util.h"
7b3e062c 34#include "process-util.h"
d7b8eec7 35#include "selinux-util.h"
d68c645b 36#include "serialize.h"
a243128d 37#include "service.h"
24882e06 38#include "signal-util.h"
e8da24a6 39#include "smack-util.h"
d68c645b 40#include "socket.h"
5c3fa98d 41#include "socket-netlink.h"
e8da24a6 42#include "special.h"
8b43440b 43#include "string-table.h"
07630cea 44#include "string-util.h"
e8da24a6
LP		 45#include "strv.h"
46#include "unit-name.h"
e8da24a6 47#include "unit.h"
b1d4f8e1 48#include "user-util.h"
83c60c9f 49
166cf510
ZJS		 50struct SocketPeer {
51 unsigned n_ref;
52
53 Socket *socket;
54 union sockaddr_union peer;
41733ae1 55 socklen_t peer_salen;
166cf510
ZJS		 56};
57
acbb0225 58static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
87f0e418
LP		 59 [SOCKET_DEAD] = UNIT_INACTIVE,
60 [SOCKET_START_PRE] = UNIT_ACTIVATING,
3900e5fd 61 [SOCKET_START_CHOWN] = UNIT_ACTIVATING,
87f0e418
LP		 62 [SOCKET_START_POST] = UNIT_ACTIVATING,
63 [SOCKET_LISTENING] = UNIT_ACTIVE,
64 [SOCKET_RUNNING] = UNIT_ACTIVE,
65 [SOCKET_STOP_PRE] = UNIT_DEACTIVATING,
66 [SOCKET_STOP_PRE_SIGTERM] = UNIT_DEACTIVATING,
67 [SOCKET_STOP_PRE_SIGKILL] = UNIT_DEACTIVATING,
68 [SOCKET_STOP_POST] = UNIT_DEACTIVATING,
80876c20
LP		 69 [SOCKET_FINAL_SIGTERM] = UNIT_DEACTIVATING,
70 [SOCKET_FINAL_SIGKILL] = UNIT_DEACTIVATING,
c968d76a
YW		 71 [SOCKET_FAILED] = UNIT_FAILED,
72 [SOCKET_CLEANING] = UNIT_MAINTENANCE,
83c60c9f 73};
5cb5a6ff 74
718db961
LP		 75static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata);
76static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata);
3e5f04bf 77static void flush_ports(Socket *s);
718db961 78
a16e1123
LP		 79static void socket_init(Unit *u) {
80 Socket *s = SOCKET(u);
81
82 assert(u);
ac155bb8 83 assert(u->load_state == UNIT_STUB);
a16e1123 84
768fcd77 85 s->backlog = SOMAXCONN_DELUXE;
1f19a534 86 s->timeout_usec = u->manager->default_timeout_start_usec;
a16e1123 87 s->directory_mode = 0755;
9131f660 88 s->socket_mode = 0666;
a16e1123 89
6cf6bbc2
LP		 90 s->max_connections = 64;
91
4fd5948e 92 s->priority = -1;
4fd5948e
LP		 93 s->ip_tos = -1;
94 s->ip_ttl = -1;
4fd5948e 95 s->mark = -1;
4fd5948e 96
ac155bb8
MS		 97 s->exec_context.std_output = u->manager->default_std_output;
98 s->exec_context.std_error = u->manager->default_std_error;
085afe36 99
a16e1123 100 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
8b26cdbd 101
1f15ce28 102 s->trigger_limit.interval = USEC_INFINITY;
f5fbe71d 103 s->trigger_limit.burst = UINT_MAX;
a16e1123 104}
acbb0225 105
5e94833f
LP		 106static void socket_unwatch_control_pid(Socket *s) {
107 assert(s);
108
109 if (s->control_pid <= 0)
110 return;
111
8f03de53 112 unit_unwatch_pid(UNIT(s), TAKE_PID(s->control_pid));
5e94833f
LP		 113}
114
15087cdb 115static void socket_cleanup_fd_list(SocketPort *p) {
3ffd4af2 116 assert(p);
15087cdb 117
3ffd4af2 118 close_many(p->auxiliary_fds, p->n_auxiliary_fds);
15087cdb
PS		 119 p->auxiliary_fds = mfree(p->auxiliary_fds);
120 p->n_auxiliary_fds = 0;
121}
122
f8b21a08
FS		 123SocketPort *socket_port_free(SocketPort *p) {
124 if (!p)
125 return NULL;
126
127 sd_event_source_unref(p->event_source);
128
129 socket_cleanup_fd_list(p);
130 safe_close(p->fd);
131 free(p->path);
132
133 return mfree(p);
134}
135
74051b9b 136void socket_free_ports(Socket *s) {
034c6ed7
LP		 137 assert(s);
138
9aad490e 139 LIST_CLEAR(port, s->ports, socket_port_free);
74051b9b
LP		 140}
141
142static void socket_done(Unit *u) {
143 Socket *s = SOCKET(u);
9d565427 144 SocketPeer *p;
74051b9b
LP		 145
146 assert(s);
147
148 socket_free_ports(s);
034c6ed7 149
9a73653c 150 while ((p = set_steal_first(s->peers_by_address)))
9d565427
SS		 151 p->socket = NULL;
152
9a73653c 153 s->peers_by_address = set_free(s->peers_by_address);
9d565427 154
28135da3 155 s->exec_runtime = exec_runtime_free(s->exec_runtime);
e537352b 156 exec_command_free_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
034c6ed7
LP		 157 s->control_command = NULL;
158
5e94833f 159 socket_unwatch_control_pid(s);
034c6ed7 160
57020a3a 161 unit_ref_unset(&s->service);
034c6ed7 162
a1e58e8e
LP		 163 s->tcp_congestion = mfree(s->tcp_congestion);
164 s->bind_to_device = mfree(s->bind_to_device);
acbb0225 165
0a78712e
DM		 166 s->smack = mfree(s->smack);
167 s->smack_ip_in = mfree(s->smack_ip_in);
168 s->smack_ip_out = mfree(s->smack_ip_out);
0eb59ccf 169
811ba7a0
LP		 170 strv_free(s->symlinks);
171
0a78712e
DM		 172 s->user = mfree(s->user);
173 s->group = mfree(s->group);
3900e5fd 174
a97b23d6
DM		 175 s->fdname = mfree(s->fdname);
176
5dcadb4c 177 s->timer_event_source = sd_event_source_disable_unref(s->timer_event_source);
718db961
LP		 178}
179
36c16a7c 180static int socket_arm_timer(Socket *s, usec_t usec) {
718db961
LP		 181 int r;
182
183 assert(s);
184
718db961 185 if (s->timer_event_source) {
36c16a7c 186 r = sd_event_source_set_time(s->timer_event_source, usec);
718db961
LP		 187 if (r < 0)
188 return r;
189
190 return sd_event_source_set_enabled(s->timer_event_source, SD_EVENT_ONESHOT);
191 }
192
36c16a7c
LP		 193 if (usec == USEC_INFINITY)
194 return 0;
195
7dfbe2e3 196 r = sd_event_add_time(
6a0f1f6d
LP		 197 UNIT(s)->manager->event,
198 &s->timer_event_source,
199 CLOCK_MONOTONIC,
36c16a7c 200 usec, 0,
6a0f1f6d 201 socket_dispatch_timer, s);
7dfbe2e3
TG		 202 if (r < 0)
203 return r;
204
205 (void) sd_event_source_set_description(s->timer_event_source, "socket-timer");
206
207 return 0;
5cb5a6ff
LP		 208}
209
4f2d528d 210static bool have_non_accept_socket(Socket *s) {
4f2d528d
LP		 211 assert(s);
212
213 if (!s->accept)
214 return true;
215
dd5ad9d4
LP		 216 LIST_FOREACH(port, p, s->ports) {
217
218 if (p->type != SOCKET_SOCKET)
219 return true;
220
4f2d528d
LP		 221 if (!socket_address_can_accept(&p->address))
222 return true;
dd5ad9d4 223 }
4f2d528d
LP		 224
225 return false;
226}
227
eef85c4a 228static int socket_add_mount_dependencies(Socket *s) {
6e2ef85b
LP		 229 int r;
230
231 assert(s);
6e2ef85b 232
a57f7e2c
LP		 233 LIST_FOREACH(port, p, s->ports) {
234 const char *path = NULL;
6e2ef85b 235
a57f7e2c
LP		 236 if (p->type == SOCKET_SOCKET)
237 path = socket_address_get_path(&p->address);
60252446 238 else if (IN_SET(p->type, SOCKET_FIFO, SOCKET_SPECIAL, SOCKET_USB_FUNCTION))
a57f7e2c 239 path = p->path;
6e2ef85b 240
a57f7e2c
LP		 241 if (!path)
242 continue;
6e2ef85b 243
eef85c4a 244 r = unit_require_mounts_for(UNIT(s), path, UNIT_DEPENDENCY_FILE);
b87705cd 245 if (r < 0)
6e2ef85b 246 return r;
b87705cd 247 }
6e2ef85b
LP		 248
249 return 0;
250}
251
eef85c4a 252static int socket_add_device_dependencies(Socket *s) {
6e2ef85b 253 char *t;
6e2ef85b
LP		 254
255 assert(s);
256
7d0c710d 257 if (!s->bind_to_device || streq(s->bind_to_device, "lo"))
6e2ef85b
LP		 258 return 0;
259
63c372cb 260 t = strjoina("/sys/subsystem/net/devices/", s->bind_to_device);
d336ba9f 261 return unit_add_node_dependency(UNIT(s), t, UNIT_BINDS_TO, UNIT_DEPENDENCY_FILE);
6e2ef85b
LP		 262}
263
a40eb732
LP		 264static int socket_add_default_dependencies(Socket *s) {
265 int r;
266 assert(s);
267
4c9ea260
LP		 268 if (!UNIT(s)->default_dependencies)
269 return 0;
270
35d8c19a 271 r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, true, UNIT_DEPENDENCY_DEFAULT);
e3d84721
LP		 272 if (r < 0)
273 return r;
2a77d31d 274
463d0d15 275 if (MANAGER_IS_SYSTEM(UNIT(s)->manager)) {
3835b9aa 276 r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, true, UNIT_DEPENDENCY_DEFAULT);
e3d84721 277 if (r < 0)
a40eb732 278 return r;
2a77d31d 279 }
a40eb732 280
3835b9aa 281 return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, true, UNIT_DEPENDENCY_DEFAULT);
a40eb732
LP		 282}
283
d1e8e8b5 284static bool socket_has_exec(Socket *s) {
4cfc6dbe
LP		 285 unsigned i;
286 assert(s);
287
288 for (i = 0; i < _SOCKET_EXEC_COMMAND_MAX; i++)
289 if (s->exec_command[i])
290 return true;
291
292 return false;
293}
294
e821075a
LP		 295static int socket_add_extras(Socket *s) {
296 Unit *u = UNIT(s);
e537352b 297 int r;
44d8db9e 298
e821075a 299 assert(s);
57020a3a 300
1f15ce28
LP		 301 /* Pick defaults for the trigger limit, if nothing was explicitly configured. We pick a relatively high limit
302 * in Accept=yes mode, and a lower limit for Accept=no. Reason: in Accept=yes mode we are invoking accept()
303 * ourselves before the trigger limit can hit, thus incoming connections are taken off the socket queue quickly
304 * and reliably. This is different for Accept=no, where the spawned service has to take the incoming traffic
305 * off the queues, which it might not necessarily do. Moreover, while Accept=no services are supposed to
306 * process whatever is queued in one go, and thus should normally never have to be started frequently. This is
307 * different for Accept=yes where each connection is processed by a new service instance, and thus frequent
308 * service starts are typical. */
309
310 if (s->trigger_limit.interval == USEC_INFINITY)
311 s->trigger_limit.interval = 2 * USEC_PER_SEC;
312
f5fbe71d 313 if (s->trigger_limit.burst == UINT_MAX) {
1f15ce28
LP		 314 if (s->accept)
315 s->trigger_limit.burst = 200;
316 else
317 s->trigger_limit.burst = 20;
318 }
319
e821075a 320 if (have_non_accept_socket(s)) {
23a177ef 321
e821075a
LP		 322 if (!UNIT_DEREF(s->service)) {
323 Unit *x;
57020a3a 324
e821075a 325 r = unit_load_related_unit(u, ".service", &x);
57020a3a 326 if (r < 0)
4f2d528d 327 return r;
e821075a 328
7f7d01ed 329 unit_ref_set(&s->service, u, x);
4f2d528d 330 }
44d8db9e 331
eef85c4a 332 r = unit_add_two_dependencies(u, UNIT_BEFORE, UNIT_TRIGGERS, UNIT_DEREF(s->service), true, UNIT_DEPENDENCY_IMPLICIT);
e821075a 333 if (r < 0)
6e2ef85b 334 return r;
e821075a 335 }
6e2ef85b 336
eef85c4a 337 r = socket_add_mount_dependencies(s);
e821075a
LP		 338 if (r < 0)
339 return r;
6e2ef85b 340
eef85c4a 341 r = socket_add_device_dependencies(s);
e821075a
LP		 342 if (r < 0)
343 return r;
344
598459ce 345 r = unit_patch_contexts(u);
e821075a
LP		 346 if (r < 0)
347 return r;
348
349 if (socket_has_exec(s)) {
350 r = unit_add_exec_dependencies(u, &s->exec_context);
351 if (r < 0)
352 return r;
e821075a 353 }
a016b922 354
88af31f9
LP		 355 r = unit_set_default_slice(u);
356 if (r < 0)
357 return r;
358
4c9ea260
LP		 359 r = socket_add_default_dependencies(s);
360 if (r < 0)
361 return r;
e821075a
LP		 362
363 return 0;
364}
365
811ba7a0
LP		 366static const char *socket_find_symlink_target(Socket *s) {
367 const char *found = NULL;
811ba7a0
LP		 368
369 LIST_FOREACH(port, p, s->ports) {
370 const char *f = NULL;
371
372 switch (p->type) {
373
374 case SOCKET_FIFO:
375 f = p->path;
376 break;
377
378 case SOCKET_SOCKET:
b9495e8d 379 f = socket_address_get_path(&p->address);
811ba7a0
LP		 380 break;
381
382 default:
383 break;
384 }
385
386 if (f) {
387 if (found)
388 return NULL;
389
390 found = f;
391 }
392 }
393
394 return found;
395}
396
e821075a
LP		 397static int socket_verify(Socket *s) {
398 assert(s);
75193d41 399 assert(UNIT(s)->load_state == UNIT_LOADED);
e821075a 400
d85ff944
YW		 401 if (!s->ports)
402 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Unit has no Listen setting (ListenStream=, ListenDatagram=, ListenFIFO=, ...). Refusing.");
e821075a 403
d85ff944
YW		 404 if (s->accept && have_non_accept_socket(s))
405 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Unit configured for accepting sockets, but sockets are non-accepting. Refusing.");
e821075a 406
d85ff944
YW		 407 if (s->accept && s->max_connections <= 0)
408 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "MaxConnection= setting too small. Refusing.");
e06c73cc 409
d85ff944
YW		 410 if (s->accept && UNIT_DEREF(s->service))
411 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Explicit service configuration for accepting socket units not supported. Refusing.");
e821075a 412
d85ff944
YW		 413 if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP)
414 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Unit has PAM enabled. Kill mode must be set to 'control-group'. Refusing.");
e821075a 415
d85ff944
YW		 416 if (!strv_isempty(s->symlinks) && !socket_find_symlink_target(s))
417 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Unit has symlinks set but none or more than one node in the file system. Refusing.");
811ba7a0 418
e821075a
LP		 419 return 0;
420}
421
7a08d314 422static void peer_address_hash_func(const SocketPeer *s, struct siphash *state) {
9d565427
SS		 423 assert(s);
424
425 if (s->peer.sa.sa_family == AF_INET)
426 siphash24_compress(&s->peer.in.sin_addr, sizeof(s->peer.in.sin_addr), state);
41733ae1 427 else if (s->peer.sa.sa_family == AF_INET6)
9d565427 428 siphash24_compress(&s->peer.in6.sin6_addr, sizeof(s->peer.in6.sin6_addr), state);
359a5bcf
SH		 429 else if (s->peer.sa.sa_family == AF_VSOCK)
430 siphash24_compress(&s->peer.vm.svm_cid, sizeof(s->peer.vm.svm_cid), state);
41733ae1 431 else
04499a70 432 assert_not_reached();
9d565427
SS		 433}
434
7a08d314 435static int peer_address_compare_func(const SocketPeer *x, const SocketPeer *y) {
a0edd02e 436 int r;
9d565427 437
a0edd02e
FB		 438 r = CMP(x->peer.sa.sa_family, y->peer.sa.sa_family);
439 if (r != 0)
440 return r;
9d565427 441
79893116 442 switch (x->peer.sa.sa_family) {
9d565427
SS		 443 case AF_INET:
444 return memcmp(&x->peer.in.sin_addr, &y->peer.in.sin_addr, sizeof(x->peer.in.sin_addr));
445 case AF_INET6:
446 return memcmp(&x->peer.in6.sin6_addr, &y->peer.in6.sin6_addr, sizeof(x->peer.in6.sin6_addr));
359a5bcf 447 case AF_VSOCK:
6dd91b36 448 return CMP(x->peer.vm.svm_cid, y->peer.vm.svm_cid);
9d565427 449 }
04499a70 450 assert_not_reached();
9d565427
SS		 451}
452
7a08d314 453DEFINE_PRIVATE_HASH_OPS(peer_address_hash_ops, SocketPeer, peer_address_hash_func, peer_address_compare_func);
9d565427 454
e821075a
LP		 455static int socket_load(Unit *u) {
456 Socket *s = SOCKET(u);
457 int r;
458
459 assert(u);
460 assert(u->load_state == UNIT_STUB);
461
c3620770 462 r = unit_load_fragment_and_dropin(u, true);
e821075a
LP		 463 if (r < 0)
464 return r;
465
75193d41
ZJS		 466 if (u->load_state != UNIT_LOADED)
467 return 0;
468
469 /* This is a new unit? Then let's add in some extras */
470 r = socket_add_extras(s);
471 if (r < 0)
472 return r;
23a177ef 473
4f2d528d 474 return socket_verify(s);
44d8db9e
LP		 475}
476
166cf510
ZJS		 477static SocketPeer *socket_peer_new(void) {
478 SocketPeer *p;
479
000b61b9 480 p = new(SocketPeer, 1);
166cf510
ZJS		 481 if (!p)
482 return NULL;
483
000b61b9
LP		 484 *p = (SocketPeer) {
485 .n_ref = 1,
486 };
166cf510
ZJS		 487 return p;
488}
489
8301aa0b
YW		 490static SocketPeer *socket_peer_free(SocketPeer *p) {
491 assert(p);
166cf510
ZJS		 492
493 if (p->socket)
494 set_remove(p->socket->peers_by_address, p);
495
496 return mfree(p);
497}
498
8301aa0b
YW		 499DEFINE_TRIVIAL_REF_UNREF_FUNC(SocketPeer, socket_peer, socket_peer_free);
500
3ebcd323 501int socket_acquire_peer(Socket *s, int fd, SocketPeer **p) {
166cf510 502 _cleanup_(socket_peer_unrefp) SocketPeer *remote = NULL;
000b61b9
LP		 503 SocketPeer sa = {
504 .peer_salen = sizeof(union sockaddr_union),
505 }, *i;
166cf510
ZJS		 506 int r;
507
508 assert(fd >= 0);
509 assert(s);
510
000b61b9 511 if (getpeername(fd, &sa.peer.sa, &sa.peer_salen) < 0)
fc2d74ab 512 return log_unit_error_errno(UNIT(s), errno, "getpeername failed: %m");
166cf510 513
359a5bcf 514 if (!IN_SET(sa.peer.sa.sa_family, AF_INET, AF_INET6, AF_VSOCK)) {
166cf510
ZJS		 515 *p = NULL;
516 return 0;
517 }
518
000b61b9
LP		 519 r = set_ensure_allocated(&s->peers_by_address, &peer_address_hash_ops);
520 if (r < 0)
521 return r;
522
166cf510
ZJS		 523 i = set_get(s->peers_by_address, &sa);
524 if (i) {
525 *p = socket_peer_ref(i);
526 return 1;
527 }
528
529 remote = socket_peer_new();
530 if (!remote)
531 return log_oom();
532
533 remote->peer = sa.peer;
000b61b9 534 remote->peer_salen = sa.peer_salen;
166cf510
ZJS		 535
536 r = set_put(s->peers_by_address, remote);
537 if (r < 0)
538 return r;
539
540 remote->socket = s;
541
1cc6c93a 542 *p = TAKE_PTR(remote);
166cf510
ZJS		 543 return 1;
544}
545
d1e8e8b5 546static const char* listen_lookup(int family, int type) {
7a22745a
LP		 547
548 if (family == AF_NETLINK)
549 return "ListenNetlink";
542563ba
LP		 550
551 if (type == SOCK_STREAM)
552 return "ListenStream";
553 else if (type == SOCK_DGRAM)
554 return "ListenDatagram";
555 else if (type == SOCK_SEQPACKET)
556 return "ListenSequentialPacket";
557
04499a70 558 assert_not_reached();
542563ba
LP		 559 return NULL;
560}
561
87f0e418 562static void socket_dump(Unit *u, FILE *f, const char *prefix) {
87f0e418 563 Socket *s = SOCKET(u);
827d9bf2 564 const char *prefix2, *str;
5cb5a6ff
LP		 565
566 assert(s);
fa068367 567 assert(f);
5cb5a6ff 568
4c940960 569 prefix = strempty(prefix);
63c372cb 570 prefix2 = strjoina(prefix, "\t");
c43d20a0 571
5cb5a6ff
LP		 572 fprintf(f,
573 "%sSocket State: %s\n"
81a5c6d0 574 "%sResult: %s\n"
c968d76a 575 "%sClean Result: %s\n"
542563ba 576 "%sBindIPv6Only: %s\n"
b5a0699f
LP		 577 "%sBacklog: %u\n"
578 "%sSocketMode: %04o\n"
4fd5948e
LP		 579 "%sDirectoryMode: %04o\n"
580 "%sKeepAlive: %s\n"
4427c3f4 581 "%sNoDelay: %s\n"
cebf8b20 582 "%sFreeBind: %s\n"
6b6d2dee 583 "%sTransparent: %s\n"
ec6370a2 584 "%sBroadcast: %s\n"
ede3deb4 585 "%sPassCredentials: %s\n"
54ecda32 586 "%sPassSecurity: %s\n"
a3d19f5d 587 "%sPassPacketInfo: %s\n"
bd1fe7c7 588 "%sTCPCongestion: %s\n"
16115b0a 589 "%sRemoveOnStop: %s\n"
55301ec0 590 "%sWritable: %s\n"
827d9bf2 591 "%sFileDescriptorName: %s\n"
16115b0a 592 "%sSELinuxContextFromNet: %s\n",
a16e1123 593 prefix, socket_state_to_string(s->state),
81a5c6d0 594 prefix, socket_result_to_string(s->result),
c968d76a 595 prefix, socket_result_to_string(s->clean_result),
c0120d99 596 prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
b5a0699f
LP		 597 prefix, s->backlog,
598 prefix, s->socket_mode,
4fd5948e
LP		 599 prefix, s->directory_mode,
600 prefix, yes_no(s->keep_alive),
4427c3f4 601 prefix, yes_no(s->no_delay),
cebf8b20 602 prefix, yes_no(s->free_bind),
6b6d2dee 603 prefix, yes_no(s->transparent),
ec6370a2 604 prefix, yes_no(s->broadcast),
d68af586 605 prefix, yes_no(s->pass_cred),
54ecda32 606 prefix, yes_no(s->pass_sec),
a3d19f5d 607 prefix, yes_no(s->pass_pktinfo),
bd1fe7c7 608 prefix, strna(s->tcp_congestion),
16115b0a 609 prefix, yes_no(s->remove_on_stop),
55301ec0 610 prefix, yes_no(s->writable),
8dd4c05b 611 prefix, socket_fdname(s),
16115b0a 612 prefix, yes_no(s->selinux_context_from_net));
542563ba 613
9b191525
LP		 614 if (s->timestamping != SOCKET_TIMESTAMPING_OFF)
615 fprintf(f,
616 "%sTimestamping: %s\n",
617 prefix, socket_timestamping_to_string(s->timestamping));
618
70123e68
LP		 619 if (s->control_pid > 0)
620 fprintf(f,
de0671ee
ZJS		 621 "%sControl PID: "PID_FMT"\n",
622 prefix, s->control_pid);
70123e68 623
acbb0225
LP		 624 if (s->bind_to_device)
625 fprintf(f,
626 "%sBindToDevice: %s\n",
627 prefix, s->bind_to_device);
628
4f2d528d
LP		 629 if (s->accept)
630 fprintf(f,
6cf6bbc2
LP		 631 "%sAccepted: %u\n"
632 "%sNConnections: %u\n"
827d9bf2
YW		 633 "%sMaxConnections: %u\n"
634 "%sMaxConnectionsPerSource: %u\n",
6cf6bbc2
LP		 635 prefix, s->n_accepted,
636 prefix, s->n_connections,
827d9bf2
YW		 637 prefix, s->max_connections,
638 prefix, s->max_connections_per_source);
3e5f04bf
RM		 639 else
640 fprintf(f,
641 "%sFlushPending: %s\n",
642 prefix, yes_no(s->flush_pending));
643
4f2d528d 644
4fd5948e
LP		 645 if (s->priority >= 0)
646 fprintf(f,
647 "%sPriority: %i\n",
648 prefix, s->priority);
649
650 if (s->receive_buffer > 0)
651 fprintf(f,
652 "%sReceiveBuffer: %zu\n",
653 prefix, s->receive_buffer);
654
655 if (s->send_buffer > 0)
656 fprintf(f,
657 "%sSendBuffer: %zu\n",
658 prefix, s->send_buffer);
659
660 if (s->ip_tos >= 0)
661 fprintf(f,
662 "%sIPTOS: %i\n",
663 prefix, s->ip_tos);
664
665 if (s->ip_ttl >= 0)
666 fprintf(f,
667 "%sIPTTL: %i\n",
668 prefix, s->ip_ttl);
669
670 if (s->pipe_size > 0)
671 fprintf(f,
672 "%sPipeSize: %zu\n",
673 prefix, s->pipe_size);
674
675 if (s->mark >= 0)
676 fprintf(f,
677 "%sMark: %i\n",
678 prefix, s->mark);
679
916abb21
LP		 680 if (s->mq_maxmsg > 0)
681 fprintf(f,
682 "%sMessageQueueMaxMessages: %li\n",
683 prefix, s->mq_maxmsg);
684
685 if (s->mq_msgsize > 0)
686 fprintf(f,
687 "%sMessageQueueMessageSize: %li\n",
688 prefix, s->mq_msgsize);
689
718db961 690 if (s->reuse_port)
f7db7a69
SL		 691 fprintf(f,
692 "%sReusePort: %s\n",
718db961 693 prefix, yes_no(s->reuse_port));
f7db7a69 694
0eb59ccf
AK		 695 if (s->smack)
696 fprintf(f,
697 "%sSmackLabel: %s\n",
698 prefix, s->smack);
699
700 if (s->smack_ip_in)
701 fprintf(f,
702 "%sSmackLabelIPIn: %s\n",
703 prefix, s->smack_ip_in);
704
705 if (s->smack_ip_out)
706 fprintf(f,
707 "%sSmackLabelIPOut: %s\n",
708 prefix, s->smack_ip_out);
709
3900e5fd
LP		 710 if (!isempty(s->user) || !isempty(s->group))
711 fprintf(f,
d2a50e3b
LP		 712 "%sSocketUser: %s\n"
713 "%sSocketGroup: %s\n",
3900e5fd
LP		 714 prefix, strna(s->user),
715 prefix, strna(s->group));
716
7bbfcf64 717 if (timestamp_is_set(s->keep_alive_time))
209e9dcd 718 fprintf(f,
3cd761e4 719 "%sKeepAliveTimeSec: %s\n",
5291f26d 720 prefix, FORMAT_TIMESPAN(s->keep_alive_time, USEC_PER_SEC));
209e9dcd 721
7be9df7d 722 if (s->keep_alive_interval > 0)
209e9dcd 723 fprintf(f,
3cd761e4 724 "%sKeepAliveIntervalSec: %s\n",
5291f26d 725 prefix, FORMAT_TIMESPAN(s->keep_alive_interval, USEC_PER_SEC));
209e9dcd 726
7be9df7d 727 if (s->keep_alive_cnt > 0)
209e9dcd
SS		 728 fprintf(f,
729 "%sKeepAliveProbes: %u\n",
730 prefix, s->keep_alive_cnt);
731
7be9df7d 732 if (s->defer_accept > 0)
cc567c9b 733 fprintf(f,
3cd761e4 734 "%sDeferAcceptSec: %s\n",
5291f26d 735 prefix, FORMAT_TIMESPAN(s->defer_accept, USEC_PER_SEC));
cc567c9b 736
034c6ed7 737 LIST_FOREACH(port, p, s->ports) {
5cb5a6ff 738
7be9df7d
YW		 739 switch (p->type) {
740 case SOCKET_SOCKET: {
741 _cleanup_free_ char *k = NULL;
542563ba 742 int r;
542563ba 743
e53fc357 744 r = socket_address_print(&p->address, &k);
38553034
ZJS		 745 if (r < 0) {
746 errno = -r;
747 fprintf(f, "%s%s: %m\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type));
748 } else
749 fprintf(f, "%s%s: %s\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type), k);
7be9df7d
YW		 750 break;
751 }
752 case SOCKET_SPECIAL:
b0a3f2bc 753 fprintf(f, "%sListenSpecial: %s\n", prefix, p->path);
7be9df7d
YW		 754 break;
755 case SOCKET_USB_FUNCTION:
60252446 756 fprintf(f, "%sListenUSBFunction: %s\n", prefix, p->path);
7be9df7d
YW		 757 break;
758 case SOCKET_MQUEUE:
916abb21 759 fprintf(f, "%sListenMessageQueue: %s\n", prefix, p->path);
7be9df7d
YW		 760 break;
761 default:
542563ba 762 fprintf(f, "%sListenFIFO: %s\n", prefix, p->path);
7be9df7d 763 }
542563ba 764 }
5cb5a6ff 765
1745fa70
EV		 766 fprintf(f,
767 "%sTriggerLimitIntervalSec: %s\n"
768 "%sTriggerLimitBurst: %u\n",
5291f26d 769 prefix, FORMAT_TIMESPAN(s->trigger_limit.interval, USEC_PER_SEC),
1745fa70
EV		 770 prefix, s->trigger_limit.burst);
771
da96ad5a 772 str = ip_protocol_to_name(s->socket_protocol);
827d9bf2
YW		 773 if (str)
774 fprintf(f, "%sSocketProtocol: %s\n", prefix, str);
775
776 if (!strv_isempty(s->symlinks)) {
827d9bf2
YW		 777 fprintf(f, "%sSymlinks:", prefix);
778 STRV_FOREACH(q, s->symlinks)
779 fprintf(f, " %s", *q);
780
781 fprintf(f, "\n");
782 }
783
784 fprintf(f,
785 "%sTimeoutSec: %s\n",
5291f26d 786 prefix, FORMAT_TIMESPAN(s->timeout_usec, USEC_PER_SEC));
827d9bf2 787
5cb5a6ff 788 exec_context_dump(&s->exec_context, f, prefix);
4819ff03 789 kill_context_dump(&s->kill_context, f, prefix);
5cb5a6ff 790
6c1abe88 791 for (SocketExecCommand c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
c43d20a0
LP		 792 if (!s->exec_command[c])
793 continue;
5cb5a6ff 794
40d50879 795 fprintf(f, "%s-> %s:\n",
a16e1123 796 prefix, socket_exec_command_to_string(c));
c43d20a0
LP		 797
798 exec_command_dump_list(s->exec_command[c], f, prefix2);
5cb5a6ff 799 }
18f573aa 800
bc0623df 801 cgroup_context_dump(UNIT(s), f, prefix);
5cb5a6ff
LP		 802}
803
4f2d528d
LP		 804static int instance_from_socket(int fd, unsigned nr, char **instance) {
805 socklen_t l;
806 char *r;
9d16d0c7 807 union sockaddr_union local, remote;
4f2d528d
LP		 808
809 assert(fd >= 0);
810 assert(instance);
811
812 l = sizeof(local);
813 if (getsockname(fd, &local.sa, &l) < 0)
814 return -errno;
815
816 l = sizeof(remote);
817 if (getpeername(fd, &remote.sa, &l) < 0)
818 return -errno;
819
820 switch (local.sa.sa_family) {
821
822 case AF_INET: {
823 uint32_t
8e38570e
LP		 824 a = be32toh(local.in.sin_addr.s_addr),
825 b = be32toh(remote.in.sin_addr.s_addr);
4f2d528d
LP		 826
827 if (asprintf(&r,
77b088c2
LP		 828 "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
829 nr,
4f2d528d 830 a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
8e38570e 831 be16toh(local.in.sin_port),
4f2d528d 832 b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
8e38570e 833 be16toh(remote.in.sin_port)) < 0)
4f2d528d
LP		 834 return -ENOMEM;
835
836 break;
837 }
838
839 case AF_INET6: {
c65a0b14 840 static const unsigned char ipv4_prefix[] = {
2b061f5a
LP		 841 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
842 };
843
844 if (memcmp(&local.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0 &&
845 memcmp(&remote.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
846 const uint8_t
847 *a = local.in6.sin6_addr.s6_addr+12,
848 *b = remote.in6.sin6_addr.s6_addr+12;
849
850 if (asprintf(&r,
77b088c2
LP		 851 "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
852 nr,
2b061f5a 853 a[0], a[1], a[2], a[3],
8e38570e 854 be16toh(local.in6.sin6_port),
2b061f5a 855 b[0], b[1], b[2], b[3],
8e38570e 856 be16toh(remote.in6.sin6_port)) < 0)
2b061f5a
LP		 857 return -ENOMEM;
858 } else {
2b061f5a 859 if (asprintf(&r,
77b088c2
LP		 860 "%u-%s:%u-%s:%u",
861 nr,
071e522e 862 IN6_ADDR_TO_STRING(&local.in6.sin6_addr),
8e38570e 863 be16toh(local.in6.sin6_port),
071e522e 864 IN6_ADDR_TO_STRING(&remote.in6.sin6_addr),
8e38570e 865 be16toh(remote.in6.sin6_port)) < 0)
2b061f5a
LP		 866 return -ENOMEM;
867 }
4f2d528d
LP		 868
869 break;
870 }
871
872 case AF_UNIX: {
873 struct ucred ucred;
eff05270 874 int k;
4f2d528d 875
eff05270 876 k = getpeercred(fd, &ucred);
d38f6e34
ZJS		 877 if (k >= 0) {
878 if (asprintf(&r,
879 "%u-"PID_FMT"-"UID_FMT,
880 nr, ucred.pid, ucred.uid) < 0)
881 return -ENOMEM;
882 } else if (k == -ENODATA) {
883 /* This handles the case where somebody is
884 * connecting from another pid/uid namespace
885 * (e.g. from outside of our container). */
886 if (asprintf(&r,
887 "%u-unknown",
888 nr) < 0)
889 return -ENOMEM;
890 } else
eff05270 891 return k;
2f20a8eb 892
2f20a8eb 893 break;
4f2d528d
LP		 894 }
895
359a5bcf
SH		 896 case AF_VSOCK:
897 if (asprintf(&r,
898 "%u-%u:%u-%u:%u",
899 nr,
900 local.vm.svm_cid, local.vm.svm_port,
901 remote.vm.svm_cid, remote.vm.svm_port) < 0)
902 return -ENOMEM;
903
904 break;
905
4f2d528d 906 default:
04499a70 907 assert_not_reached();
4f2d528d
LP		 908 }
909
910 *instance = r;
911 return 0;
912}
913
034c6ed7 914static void socket_close_fds(Socket *s) {
83c60c9f
LP		 915 assert(s);
916
034c6ed7 917 LIST_FOREACH(port, p, s->ports) {
18e854f8 918 bool was_open;
718db961 919
18e854f8 920 was_open = p->fd >= 0;
83c60c9f 921
5dcadb4c 922 p->event_source = sd_event_source_disable_unref(p->event_source);
03e334a1 923 p->fd = safe_close(p->fd);
15087cdb 924 socket_cleanup_fd_list(p);
a16e1123 925
18e854f8
LP		 926 /* One little note: we should normally not delete any sockets in the file system here! After all some
927 * other process we spawned might still have a reference of this fd and wants to continue to use
928 * it. Therefore we normally delete sockets in the file system before we create a new one, not after we
929 * stopped using one! That all said, if the user explicitly requested this, we'll delete them here
930 * anyway, but only then. */
bd1fe7c7 931
18e854f8
LP		 932 if (!was_open || !s->remove_on_stop)
933 continue;
934
935 switch (p->type) {
bd1fe7c7 936
18e854f8
LP		 937 case SOCKET_FIFO:
938 (void) unlink(p->path);
939 break;
bd1fe7c7 940
18e854f8
LP		 941 case SOCKET_MQUEUE:
942 (void) mq_unlink(p->path);
943 break;
bd1fe7c7 944
18e854f8
LP		 945 case SOCKET_SOCKET:
946 (void) socket_address_unlink(&p->address);
947 break;
bd1fe7c7 948
18e854f8
LP		 949 default:
950 break;
bd1fe7c7 951 }
83c60c9f 952 }
811ba7a0
LP		 953
954 if (s->remove_on_stop)
955 STRV_FOREACH(i, s->symlinks)
18e854f8 956 (void) unlink(*i);
75db809a
ZJS		 957
958 /* Note that we don't return NULL here, since s has not been freed. */
83c60c9f
LP		 959}
960
5d0fe423 961static void socket_apply_socket_options(Socket *s, SocketPort *p, int fd) {
d53e386d
LP		 962 int r;
963
4fd5948e 964 assert(s);
5d0fe423 965 assert(p);
4fd5948e
LP		 966 assert(fd >= 0);
967
968 if (s->keep_alive) {
2ff48e98
LP		 969 r = setsockopt_int(fd, SOL_SOCKET, SO_KEEPALIVE, true);
970 if (r < 0)
971 log_unit_warning_errno(UNIT(s), r, "SO_KEEPALIVE failed: %m");
4fd5948e
LP		 972 }
973
7bbfcf64 974 if (timestamp_is_set(s->keep_alive_time)) {
9e5b6496
YW		 975 r = setsockopt_int(fd, SOL_TCP, TCP_KEEPIDLE, s->keep_alive_time / USEC_PER_SEC);
976 if (r < 0)
977 log_unit_warning_errno(UNIT(s), r, "TCP_KEEPIDLE failed: %m");
209e9dcd
SS		 978 }
979
7be9df7d 980 if (s->keep_alive_interval > 0) {
9e5b6496
YW		 981 r = setsockopt_int(fd, SOL_TCP, TCP_KEEPINTVL, s->keep_alive_interval / USEC_PER_SEC);
982 if (r < 0)
983 log_unit_warning_errno(UNIT(s), r, "TCP_KEEPINTVL failed: %m");
209e9dcd
SS		 984 }
985
7be9df7d 986 if (s->keep_alive_cnt > 0) {
9e5b6496
YW		 987 r = setsockopt_int(fd, SOL_TCP, TCP_KEEPCNT, s->keep_alive_cnt);
988 if (r < 0)
989 log_unit_warning_errno(UNIT(s), r, "TCP_KEEPCNT failed: %m");
209e9dcd
SS		 990 }
991
7be9df7d 992 if (s->defer_accept > 0) {
9e5b6496
YW		 993 r = setsockopt_int(fd, SOL_TCP, TCP_DEFER_ACCEPT, s->defer_accept / USEC_PER_SEC);
994 if (r < 0)
995 log_unit_warning_errno(UNIT(s), r, "TCP_DEFER_ACCEPT failed: %m");
cc567c9b
SS		 996 }
997
4427c3f4 998 if (s->no_delay) {
62bc4efc 999 if (s->socket_protocol == IPPROTO_SCTP) {
2ff48e98
LP		 1000 r = setsockopt_int(fd, SOL_SCTP, SCTP_NODELAY, true);
1001 if (r < 0)
1002 log_unit_warning_errno(UNIT(s), r, "SCTP_NODELAY failed: %m");
62bc4efc 1003 } else {
2ff48e98
LP		 1004 r = setsockopt_int(fd, SOL_TCP, TCP_NODELAY, true);
1005 if (r < 0)
1006 log_unit_warning_errno(UNIT(s), r, "TCP_NODELAY failed: %m");
62bc4efc 1007 }
4427c3f4
SS		 1008 }
1009
ec6370a2 1010 if (s->broadcast) {
2ff48e98
LP		 1011 r = setsockopt_int(fd, SOL_SOCKET, SO_BROADCAST, true);
1012 if (r < 0)
1013 log_unit_warning_errno(UNIT(s), r, "SO_BROADCAST failed: %m");
ec6370a2
LP		 1014 }
1015
d68af586 1016 if (s->pass_cred) {
2ff48e98
LP		 1017 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
1018 if (r < 0)
1019 log_unit_warning_errno(UNIT(s), r, "SO_PASSCRED failed: %m");
d68af586
MS		 1020 }
1021
54ecda32 1022 if (s->pass_sec) {
2ff48e98
LP		 1023 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSSEC, true);
1024 if (r < 0)
1025 log_unit_warning_errno(UNIT(s), r, "SO_PASSSEC failed: %m");
54ecda32
LP		 1026 }
1027
a3d19f5d 1028 if (s->pass_pktinfo) {
5d0fe423 1029 r = socket_set_recvpktinfo(fd, socket_address_family(&p->address), true);
a3d19f5d
LP		 1030 if (r < 0)
1031 log_unit_warning_errno(UNIT(s), r, "Failed to enable packet info socket option: %m");
1032 }
1033
9b191525
LP		 1034 if (s->timestamping != SOCKET_TIMESTAMPING_OFF) {
1035 r = setsockopt_int(fd, SOL_SOCKET,
1036 s->timestamping == SOCKET_TIMESTAMPING_NS ? SO_TIMESTAMPNS : SO_TIMESTAMP,
1037 true);
1038 if (r < 0)
1039 log_unit_warning_errno(UNIT(s), r, "Failed to enable timestamping socket option, ignoring: %m");
1040 }
1041
9e5b6496
YW		 1042 if (s->priority >= 0) {
1043 r = setsockopt_int(fd, SOL_SOCKET, SO_PRIORITY, s->priority);
1044 if (r < 0)
1045 log_unit_warning_errno(UNIT(s), r, "SO_PRIORITY failed: %m");
1046 }
4fd5948e
LP		 1047
1048 if (s->receive_buffer > 0) {
ded71ab3
YW		 1049 r = fd_set_rcvbuf(fd, s->receive_buffer, false);
1050 if (r < 0)
35b4e3c1
LP		 1051 log_unit_full_errno(UNIT(s), ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r,
1052 "SO_RCVBUF/SO_RCVBUFFORCE failed: %m");
4fd5948e
LP		 1053 }
1054
1055 if (s->send_buffer > 0) {
4934ba21 1056 r = fd_set_sndbuf(fd, s->send_buffer, false);
ded71ab3 1057 if (r < 0)
35b4e3c1
LP		 1058 log_unit_full_errno(UNIT(s), ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r,
1059 "SO_SNDBUF/SO_SNDBUFFORCE failed: %m");
4fd5948e
LP		 1060 }
1061
9e5b6496
YW		 1062 if (s->mark >= 0) {
1063 r = setsockopt_int(fd, SOL_SOCKET, SO_MARK, s->mark);
1064 if (r < 0)
1065 log_unit_warning_errno(UNIT(s), r, "SO_MARK failed: %m");
1066 }
4fd5948e 1067
9e5b6496
YW		 1068 if (s->ip_tos >= 0) {
1069 r = setsockopt_int(fd, IPPROTO_IP, IP_TOS, s->ip_tos);
1070 if (r < 0)
1071 log_unit_warning_errno(UNIT(s), r, "IP_TOS failed: %m");
1072 }
4fd5948e 1073
46925ac5 1074 if (s->ip_ttl >= 0) {
5d0fe423
LP		 1075 r = socket_set_ttl(fd, socket_address_family(&p->address), s->ip_ttl);
1076 if (r < 0)
9e5b6496 1077 log_unit_warning_errno(UNIT(s), r, "IP_TTL/IPV6_UNICAST_HOPS failed: %m");
46925ac5 1078 }
cebf8b20
TT		 1079
1080 if (s->tcp_congestion)
1081 if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
f2341e0a 1082 log_unit_warning_errno(UNIT(s), errno, "TCP_CONGESTION failed: %m");
0eb59ccf 1083
d53e386d 1084 if (s->smack_ip_in) {
5ab58c20 1085 r = mac_smack_apply_fd(fd, SMACK_ATTR_IPIN, s->smack_ip_in);
d53e386d 1086 if (r < 0)
f2341e0a 1087 log_unit_error_errno(UNIT(s), r, "mac_smack_apply_ip_in_fd: %m");
d53e386d 1088 }
9a4e038c 1089
d53e386d 1090 if (s->smack_ip_out) {
5ab58c20 1091 r = mac_smack_apply_fd(fd, SMACK_ATTR_IPOUT, s->smack_ip_out);
d53e386d 1092 if (r < 0)
f2341e0a 1093 log_unit_error_errno(UNIT(s), r, "mac_smack_apply_ip_out_fd: %m");
d53e386d 1094 }
4fd5948e
LP		 1095}
1096
b15bdda8 1097static void socket_apply_fifo_options(Socket *s, int fd) {
d53e386d
LP		 1098 int r;
1099
4fd5948e
LP		 1100 assert(s);
1101 assert(fd >= 0);
1102
1103 if (s->pipe_size > 0)
1104 if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
ed460b07 1105 log_unit_warning_errno(UNIT(s), errno, "Setting pipe size failed, ignoring: %m");
0eb59ccf 1106
d53e386d 1107 if (s->smack) {
5ab58c20 1108 r = mac_smack_apply_fd(fd, SMACK_ATTR_ACCESS, s->smack);
d53e386d 1109 if (r < 0)
ed460b07 1110 log_unit_error_errno(UNIT(s), r, "SMACK relabelling failed, ignoring: %m");
d53e386d 1111 }
4fd5948e
LP		 1112}
1113
b15bdda8
LP		 1114static int fifo_address_create(
1115 const char *path,
1116 mode_t directory_mode,
e8da24a6 1117 mode_t socket_mode) {
b15bdda8 1118
254d1313 1119 _cleanup_close_ int fd = -EBADF;
b15bdda8 1120 mode_t old_mask;
e8da24a6
LP		 1121 struct stat st;
1122 int r;
b15bdda8
LP		 1123
1124 assert(path);
b15bdda8 1125
1af87ab7 1126 (void) mkdir_parents_label(path, directory_mode);
b15bdda8 1127
ecabcf8b 1128 r = mac_selinux_create_file_prepare(path, S_IFIFO);
e9a5ef7c 1129 if (r < 0)
e8da24a6 1130 return r;
b15bdda8
LP		 1131
1132 /* Enforce the right access mode for the fifo */
7be9df7d 1133 old_mask = umask(~socket_mode);
b15bdda8
LP		 1134
1135 /* Include the original umask in our mask */
e8da24a6 1136 (void) umask(~socket_mode | old_mask);
b15bdda8
LP		 1137
1138 r = mkfifo(path, socket_mode);
e8da24a6 1139 (void) umask(old_mask);
b15bdda8 1140
94bc2731 1141 if (r < 0 && errno != EEXIST) {
b15bdda8
LP		 1142 r = -errno;
1143 goto fail;
1144 }
1145
e8da24a6 1146 fd = open(path, O_RDWR | O_CLOEXEC | O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
3cc2aff1 1147 if (fd < 0) {
b15bdda8
LP		 1148 r = -errno;
1149 goto fail;
1150 }
1151
ecabcf8b 1152 mac_selinux_create_file_clear();
7a58bfa4 1153
b15bdda8
LP		 1154 if (fstat(fd, &st) < 0) {
1155 r = -errno;
1156 goto fail;
1157 }
1158
1159 if (!S_ISFIFO(st.st_mode) ||
de0200fc 1160 (st.st_mode & 0777) != (socket_mode & ~old_mask) ||
e4f44e73
DR		 1161 st.st_uid != getuid() ||
1162 st.st_gid != getgid()) {
b15bdda8
LP		 1163 r = -EEXIST;
1164 goto fail;
1165 }
1166
c10d6bdb 1167 return TAKE_FD(fd);
b15bdda8
LP		 1168
1169fail:
ecabcf8b 1170 mac_selinux_create_file_clear();
b15bdda8
LP		 1171 return r;
1172}
1173
55301ec0 1174static int special_address_create(const char *path, bool writable) {
254d1313 1175 _cleanup_close_ int fd = -EBADF;
b0a3f2bc
LP		 1176 struct stat st;
1177
1178 assert(path);
b0a3f2bc 1179
55301ec0 1180 fd = open(path, (writable ? O_RDWR : O_RDONLY)|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
e8da24a6
LP		 1181 if (fd < 0)
1182 return -errno;
b0a3f2bc 1183
e8da24a6
LP		 1184 if (fstat(fd, &st) < 0)
1185 return -errno;
b0a3f2bc
LP		 1186
1187 /* Check whether this is a /proc, /sys or /dev file or char device */
e8da24a6
LP		 1188 if (!S_ISREG(st.st_mode) && !S_ISCHR(st.st_mode))
1189 return -EEXIST;
b0a3f2bc 1190
c10d6bdb 1191 return TAKE_FD(fd);
b0a3f2bc
LP		 1192}
1193
36078102 1194static int usbffs_address_create(const char *path) {
254d1313 1195 _cleanup_close_ int fd = -EBADF;
60252446
PS		 1196 struct stat st;
1197
1198 assert(path);
60252446
PS		 1199
1200 fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1201 if (fd < 0)
1202 return -errno;
1203
1204 if (fstat(fd, &st) < 0)
1205 return -errno;
1206
13e785f7 1207 /* Check whether this is a regular file (ffs endpoint) */
60252446
PS		 1208 if (!S_ISREG(st.st_mode))
1209 return -EEXIST;
1210
c10d6bdb 1211 return TAKE_FD(fd);
60252446
PS		 1212}
1213
916abb21
LP		 1214static int mq_address_create(
1215 const char *path,
1216 mode_t mq_mode,
1217 long maxmsg,
e8da24a6 1218 long msgsize) {
916abb21 1219
254d1313 1220 _cleanup_close_ int fd = -EBADF;
916abb21
LP		 1221 struct stat st;
1222 mode_t old_mask;
1223 struct mq_attr _attr, *attr = NULL;
1224
1225 assert(path);
916abb21
LP		 1226
1227 if (maxmsg > 0 && msgsize > 0) {
e8da24a6
LP		 1228 _attr = (struct mq_attr) {
1229 .mq_flags = O_NONBLOCK,
1230 .mq_maxmsg = maxmsg,
1231 .mq_msgsize = msgsize,
1232 };
916abb21
LP		 1233 attr = &_attr;
1234 }
1235
1236 /* Enforce the right access mode for the mq */
7be9df7d 1237 old_mask = umask(~mq_mode);
916abb21
LP		 1238
1239 /* Include the original umask in our mask */
e8da24a6 1240 (void) umask(~mq_mode | old_mask);
916abb21 1241 fd = mq_open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_CREAT, mq_mode, attr);
e8da24a6 1242 (void) umask(old_mask);
916abb21 1243
e8da24a6
LP		 1244 if (fd < 0)
1245 return -errno;
916abb21 1246
e8da24a6
LP		 1247 if (fstat(fd, &st) < 0)
1248 return -errno;
916abb21
LP		 1249
1250 if ((st.st_mode & 0777) != (mq_mode & ~old_mask) ||
1251 st.st_uid != getuid() ||
e8da24a6
LP		 1252 st.st_gid != getgid())
1253 return -EEXIST;
916abb21 1254
c10d6bdb 1255 return TAKE_FD(fd);
916abb21
LP		 1256}
1257
811ba7a0
LP		 1258static int socket_symlink(Socket *s) {
1259 const char *p;
95f7fbbf 1260 int r;
811ba7a0
LP		 1261
1262 assert(s);
1263
1264 p = socket_find_symlink_target(s);
1265 if (!p)
1266 return 0;
1267
95f7fbbf 1268 STRV_FOREACH(i, s->symlinks) {
1af87ab7
LP		 1269 (void) mkdir_parents_label(*i, s->directory_mode);
1270
6c9c51e5 1271 r = symlink_idempotent(p, *i, false);
22b20752
LP		 1272
1273 if (r == -EEXIST && s->remove_on_stop) {
1274 /* If there's already something where we want to create the symlink, and the destructive
1275 * RemoveOnStop= mode is set, then we might as well try to remove what already exists and try
1276 * again. */
1277
1278 if (unlink(*i) >= 0)
6c9c51e5 1279 r = symlink_idempotent(p, *i, false);
22b20752
LP		 1280 }
1281
95f7fbbf 1282 if (r < 0)
e2341b6b
DT		 1283 log_unit_warning_errno(UNIT(s), r, "Failed to create symlink %s %s %s, ignoring: %m",
1284 p, special_glyph(SPECIAL_GLYPH_ARROW_RIGHT), *i);
95f7fbbf 1285 }
811ba7a0
LP		 1286
1287 return 0;
1288}
1289
36078102 1290static int usbffs_write_descs(int fd, Service *s) {
6b7e5923
PS		 1291 int r;
1292
1293 if (!s->usb_function_descriptors || !s->usb_function_strings)
1294 return -EINVAL;
1295
1c876927 1296 r = copy_file_fd(s->usb_function_descriptors, fd, 0);
6b7e5923 1297 if (r < 0)
e8da24a6 1298 return r;
6b7e5923 1299
1c876927 1300 return copy_file_fd(s->usb_function_strings, fd, 0);
6b7e5923
PS		 1301}
1302
36078102 1303static int usbffs_select_ep(const struct dirent *d) {
60252446
PS		 1304 return d->d_name[0] != '.' && !streq(d->d_name, "ep0");
1305}
1306
36078102 1307static int usbffs_dispatch_eps(SocketPort *p) {
60252446 1308 _cleanup_free_ struct dirent **ent = NULL;
fe96c0f8 1309 size_t n, k;
da6053d0 1310 int r;
60252446 1311
00bb64ec 1312 r = scandir(p->path, &ent, usbffs_select_ep, alphasort);
60252446
PS		 1313 if (r < 0)
1314 return -errno;
1315
da6053d0 1316 n = (size_t) r;
60252446 1317 p->auxiliary_fds = new(int, n);
0de48764
YW		 1318 if (!p->auxiliary_fds) {
1319 r = -ENOMEM;
1320 goto clear;
1321 }
60252446
PS		 1322
1323 p->n_auxiliary_fds = n;
1324
1325 k = 0;
fe96c0f8 1326 for (size_t i = 0; i < n; ++i) {
60252446
PS		 1327 _cleanup_free_ char *ep = NULL;
1328
00bb64ec 1329 ep = path_make_absolute(ent[i]->d_name, p->path);
0de48764
YW		 1330 if (!ep) {
1331 r = -ENOMEM;
1332 goto fail;
1333 }
60252446 1334
4ff361cc 1335 path_simplify(ep);
60252446 1336
36078102 1337 r = usbffs_address_create(ep);
60252446
PS		 1338 if (r < 0)
1339 goto fail;
1340
da6053d0 1341 p->auxiliary_fds[k++] = r;
60252446
PS		 1342 }
1343
0de48764
YW		 1344 r = 0;
1345 goto clear;
60252446
PS		 1346
1347fail:
e8da24a6 1348 close_many(p->auxiliary_fds, k);
60252446
PS		 1349 p->auxiliary_fds = mfree(p->auxiliary_fds);
1350 p->n_auxiliary_fds = 0;
1351
0de48764 1352clear:
fe96c0f8 1353 for (size_t i = 0; i < n; ++i)
0de48764
YW		 1354 free(ent[i]);
1355
60252446
PS		 1356 return r;
1357}
1358
934ef6a5
ZJS		 1359int socket_load_service_unit(Socket *s, int cfd, Unit **ret) {
1360 /* Figure out what the unit that will be used to handle the connections on the socket looks like.
1361 *
1362 * If cfd < 0, then we don't have a connection yet. In case of Accept=yes sockets, use a fake
1363 * instance name.
1364 */
1365
1366 if (UNIT_ISSET(s->service)) {
1367 *ret = UNIT_DEREF(s->service);
1368 return 0;
1369 }
1370
1371 if (!s->accept)
1372 return -ENODATA;
1373
1374 /* Build the instance name and load the unit */
1375 _cleanup_free_ char *prefix = NULL, *instance = NULL, *name = NULL;
1376 int r;
1377
1378 r = unit_name_to_prefix(UNIT(s)->id, &prefix);
1379 if (r < 0)
1380 return r;
1381
1382 if (cfd >= 0) {
1383 r = instance_from_socket(cfd, s->n_accepted, &instance);
8dfb0ef1
DL		 1384 if (r < 0) {
1385 if (ERRNO_IS_DISCONNECT(r))
1386 /* ENOTCONN is legitimate if TCP RST was received. Other socket families might return
1387 * different errors. This connection is over, but the socket unit lives on. */
1388 return log_unit_debug_errno(UNIT(s), r,
1389 "Got %s on incoming socket, assuming aborted connection attempt, ignoring.",
1390 errno_to_name(r));
934ef6a5 1391 return r;
8dfb0ef1 1392 }
934ef6a5
ZJS		 1393 }
1394
1395 /* For accepting sockets, we don't know how the instance will be called until we get a connection and
1396 * can figure out what the peer name is. So let's use "internal" as the instance to make it clear
1397 * that this is not an actual peer name. We use "unknown" when we cannot figure out the peer. */
1398 r = unit_name_build(prefix, instance ?: "internal", ".service", &name);
1399 if (r < 0)
1400 return r;
1401
1402 return manager_load_unit(UNIT(s)->manager, name, NULL, NULL, ret);
1403}
1404
d24e561d 1405static int socket_determine_selinux_label(Socket *s, char **ret) {
d24e561d
LP		 1406 int r;
1407
1408 assert(s);
1409 assert(ret);
1410
29dbc62d
TT		 1411 Unit *service;
1412 ExecCommand *c;
1413 const char *exec_context;
1414 _cleanup_free_ char *path = NULL;
1415
1416 r = socket_load_service_unit(s, -1, &service);
1417 if (r == -ENODATA)
1418 goto no_label;
1419 if (r < 0)
1420 return r;
d24e561d 1421
29dbc62d
TT		 1422 exec_context = SERVICE(service)->exec_context.selinux_context;
1423 if (exec_context) {
1424 char *con;
599b3849 1425
29dbc62d
TT		 1426 con = strdup(exec_context);
1427 if (!con)
1428 return -ENOMEM;
599b3849 1429
29dbc62d
TT		 1430 *ret = TAKE_PTR(con);
1431 return 0;
1432 }
d24e561d 1433
29dbc62d
TT		 1434 c = SERVICE(service)->exec_command[SERVICE_EXEC_START];
1435 if (!c)
1436 goto no_label;
2ef044ea 1437
f461a28d 1438 r = chase(c->path, SERVICE(service)->exec_context.root_directory, CHASE_PREFIX_ROOT, &path, NULL);
29dbc62d
TT		 1439 if (r < 0)
1440 goto no_label;
d24e561d 1441
29dbc62d
TT		 1442 r = mac_selinux_get_create_label_from_exe(path, ret);
1443 if (IN_SET(r, -EPERM, -EOPNOTSUPP))
1444 goto no_label;
d24e561d
LP		 1445 return r;
1446
1447no_label:
1448 *ret = NULL;
1449 return 0;
1450}
1451
a79279c7
LP		 1452static int socket_address_listen_do(
1453 Socket *s,
1454 const SocketAddress *address,
1455 const char *label) {
1456
1457 assert(s);
1458 assert(address);
1459
1460 return socket_address_listen(
1461 address,
1462 SOCK_CLOEXEC|SOCK_NONBLOCK,
1463 s->backlog,
1464 s->bind_ipv6_only,
1465 s->bind_to_device,
1466 s->reuse_port,
1467 s->free_bind,
1468 s->transparent,
1469 s->directory_mode,
1470 s->socket_mode,
1471 label);
1472}
1473
65486032
YW		 1474#define log_address_error_errno(u, address, error, fmt) \
1475 ({ \
1476 _cleanup_free_ char *_t = NULL; \
1477 \
1478 (void) socket_address_print(address, &_t); \
1479 log_unit_error_errno(u, error, fmt, strna(_t)); \
1480 })
ae05e1b6 1481
7619cb32
LP		 1482static int fork_needed(const SocketAddress *address, const ExecContext *context) {
1483 int r;
1484
1485 assert(address);
1486 assert(context);
1487
1488 /* Check if we need to do the cgroup or netns stuff. If not we can do things much simpler. */
1489
1490 if (IN_SET(address->sockaddr.sa.sa_family, AF_INET, AF_INET6)) {
1491 r = bpf_firewall_supported();
1492 if (r < 0)
1493 return r;
1494 if (r != BPF_FIREWALL_UNSUPPORTED) /* If BPF firewalling isn't supported anyway — there's no point in this forking complexity */
1495 return true;
1496 }
1497
fbbb9697 1498 return exec_needs_network_namespace(context);
7619cb32
LP		 1499}
1500
a79279c7
LP		 1501static int socket_address_listen_in_cgroup(
1502 Socket *s,
1503 const SocketAddress *address,
1504 const char *label) {
1505
19ee48a6 1506 _cleanup_close_pair_ int pair[2] = PIPE_EBADF;
a79279c7
LP		 1507 int fd, r;
1508 pid_t pid;
1509
1510 assert(s);
1511 assert(address);
1512
7619cb32
LP		 1513 /* This is a wrapper around socket_address_listen(), that forks off a helper process inside the
1514 * socket's cgroup and network namespace in which the socket is actually created. This way we ensure
1515 * the socket is actually properly attached to the unit's cgroup for the purpose of BPF filtering and
1516 * such. */
a79279c7 1517
7619cb32 1518 r = fork_needed(address, &s->exec_context);
a79279c7
LP		 1519 if (r < 0)
1520 return r;
7619cb32
LP		 1521 if (r == 0) {
1522 /* Shortcut things... */
1523 fd = socket_address_listen_do(s, address, label);
1524 if (fd < 0)
1525 return log_address_error_errno(UNIT(s), address, fd, "Failed to create listening socket (%s): %m");
1526
1527 return fd;
1528 }
1529
1530 r = unit_setup_exec_runtime(UNIT(s));
1531 if (r < 0)
1532 return log_unit_error_errno(UNIT(s), r, "Failed acquire runtime: %m");
1533
1534 if (s->exec_context.network_namespace_path &&
1535 s->exec_runtime &&
28135da3
DDM		 1536 s->exec_runtime->shared &&
1537 s->exec_runtime->shared->netns_storage_socket[0] >= 0) {
1538 r = open_shareable_ns_path(s->exec_runtime->shared->netns_storage_socket, s->exec_context.network_namespace_path, CLONE_NEWNET);
7619cb32
LP		 1539 if (r < 0)
1540 return log_unit_error_errno(UNIT(s), r, "Failed to open network namespace path %s: %m", s->exec_context.network_namespace_path);
1541 }
a79279c7 1542
a70581ff
XR		 1543 if (s->exec_context.ipc_namespace_path &&
1544 s->exec_runtime &&
28135da3
DDM		 1545 s->exec_runtime->shared &&
1546 s->exec_runtime->shared->ipcns_storage_socket[0] >= 0) {
1547 r = open_shareable_ns_path(s->exec_runtime->shared->ipcns_storage_socket, s->exec_context.ipc_namespace_path, CLONE_NEWIPC);
a70581ff
XR		 1548 if (r < 0)
1549 return log_unit_error_errno(UNIT(s), r, "Failed to open IPC namespace path %s: %m", s->exec_context.ipc_namespace_path);
1550 }
1551
a79279c7
LP		 1552 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pair) < 0)
1553 return log_unit_error_errno(UNIT(s), errno, "Failed to create communication channel: %m");
1554
4c253ed1 1555 r = unit_fork_helper_process(UNIT(s), "(sd-listen)", &pid);
a79279c7
LP		 1556 if (r < 0)
1557 return log_unit_error_errno(UNIT(s), r, "Failed to fork off listener stub process: %m");
1558 if (r == 0) {
1559 /* Child */
1560
1561 pair[0] = safe_close(pair[0]);
1562
fbbb9697 1563 if (exec_needs_network_namespace(&s->exec_context) &&
7619cb32 1564 s->exec_runtime &&
28135da3
DDM		 1565 s->exec_runtime->shared &&
1566 s->exec_runtime->shared->netns_storage_socket[0] >= 0) {
7619cb32
LP		 1567
1568 if (ns_type_supported(NAMESPACE_NET)) {
28135da3 1569 r = setup_shareable_ns(s->exec_runtime->shared->netns_storage_socket, CLONE_NEWNET);
7619cb32
LP		 1570 if (r < 0) {
1571 log_unit_error_errno(UNIT(s), r, "Failed to join network namespace: %m");
1572 _exit(EXIT_NETWORK);
1573 }
1574 } else if (s->exec_context.network_namespace_path) {
1575 log_unit_error(UNIT(s), "Network namespace path configured but network namespaces not supported.");
1576 _exit(EXIT_NETWORK);
1577 } else
1578 log_unit_warning(UNIT(s), "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
1579 }
1580
a79279c7
LP		 1581 fd = socket_address_listen_do(s, address, label);
1582 if (fd < 0) {
ae05e1b6 1583 log_address_error_errno(UNIT(s), address, fd, "Failed to create listening socket (%s): %m");
a79279c7
LP		 1584 _exit(EXIT_FAILURE);
1585 }
1586
1587 r = send_one_fd(pair[1], fd, 0);
1588 if (r < 0) {
ae05e1b6 1589 log_address_error_errno(UNIT(s), address, r, "Failed to send listening socket (%s) to parent: %m");
a79279c7
LP		 1590 _exit(EXIT_FAILURE);
1591 }
1592
1593 _exit(EXIT_SUCCESS);
1594 }
1595
1596 pair[1] = safe_close(pair[1]);
1597 fd = receive_one_fd(pair[0], 0);
1598
1599 /* We synchronously wait for the helper, as it shouldn't be slow */
d2e0ac3d 1600 r = wait_for_terminate_and_check("(sd-listen)", pid, WAIT_LOG_ABNORMAL);
a79279c7
LP		 1601 if (r < 0) {
1602 safe_close(fd);
1603 return r;
1604 }
1605
1606 if (fd < 0)
ae05e1b6 1607 return log_address_error_errno(UNIT(s), address, fd, "Failed to receive listening socket (%s): %m");
a79279c7
LP		 1608
1609 return fd;
a79279c7
LP		 1610}
1611
fd421c4a 1612DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(Socket *, socket_close_fds, NULL);
e5417345 1613
75db809a
ZJS		 1614static int socket_open_fds(Socket *orig_s) {
1615 _cleanup_(socket_close_fdsp) Socket *s = orig_s;
710a6b50
LP		 1616 _cleanup_(mac_selinux_freep) char *label = NULL;
1617 bool know_label = false;
83c60c9f
LP		 1618 int r;
1619
1620 assert(s);
1621
034c6ed7 1622 LIST_FOREACH(port, p, s->ports) {
83c60c9f 1623
034c6ed7
LP		 1624 if (p->fd >= 0)
1625 continue;
83c60c9f 1626
00411a13
LP		 1627 switch (p->type) {
1628
1629 case SOCKET_SOCKET:
049f8642 1630
7f416dae 1631 if (!know_label) {
934ef6a5
ZJS		 1632 /* Figure out the label, if we don't it know yet. We do it once for the first
1633 * socket where we need this and remember it for the rest. */
7f416dae 1634
d24e561d
LP		 1635 r = socket_determine_selinux_label(s, &label);
1636 if (r < 0)
ae05e1b6 1637 return log_unit_error_errno(UNIT(s), r, "Failed to determine SELinux label: %m");
049f8642
LP		 1638
1639 know_label = true;
1640 }
1641
74bb646e 1642 /* Apply the socket protocol */
d24e561d 1643 switch (p->address.type) {
d2a50e3b 1644
74bb646e
SS		 1645 case SOCK_STREAM:
1646 case SOCK_SEQPACKET:
d24e561d
LP		 1647 if (s->socket_protocol == IPPROTO_SCTP)
1648 p->address.protocol = s->socket_protocol;
74bb646e 1649 break;
d2a50e3b 1650
74bb646e 1651 case SOCK_DGRAM:
d24e561d
LP		 1652 if (s->socket_protocol == IPPROTO_UDPLITE)
1653 p->address.protocol = s->socket_protocol;
74bb646e
SS		 1654 break;
1655 }
1656
d501e52b
YW		 1657 p->fd = socket_address_listen_in_cgroup(s, &p->address, label);
1658 if (p->fd < 0)
1659 return p->fd;
83c60c9f 1660
5d0fe423 1661 socket_apply_socket_options(s, p, p->fd);
811ba7a0 1662 socket_symlink(s);
00411a13 1663 break;
4fd5948e 1664
00411a13 1665 case SOCKET_SPECIAL:
b0a3f2bc 1666
d501e52b
YW		 1667 p->fd = special_address_create(p->path, s->writable);
1668 if (p->fd < 0)
1669 return log_unit_error_errno(UNIT(s), p->fd, "Failed to open special file %s: %m", p->path);
00411a13 1670 break;
b0a3f2bc 1671
00411a13 1672 case SOCKET_FIFO:
83c60c9f 1673
d501e52b 1674 p->fd = fifo_address_create(
175a3d25
LP		 1675 p->path,
1676 s->directory_mode,
e8da24a6 1677 s->socket_mode);
d501e52b
YW		 1678 if (p->fd < 0)
1679 return log_unit_error_errno(UNIT(s), p->fd, "Failed to open FIFO %s: %m", p->path);
83c60c9f 1680
b15bdda8 1681 socket_apply_fifo_options(s, p->fd);
811ba7a0 1682 socket_symlink(s);
00411a13 1683 break;
811ba7a0 1684
00411a13 1685 case SOCKET_MQUEUE:
83c60c9f 1686
d501e52b 1687 p->fd = mq_address_create(
175a3d25
LP		 1688 p->path,
1689 s->socket_mode,
1690 s->mq_maxmsg,
e8da24a6 1691 s->mq_msgsize);
d501e52b
YW		 1692 if (p->fd < 0)
1693 return log_unit_error_errno(UNIT(s), p->fd, "Failed to open message queue %s: %m", p->path);
00411a13 1694 break;
e8da24a6 1695
d2a50e3b 1696 case SOCKET_USB_FUNCTION: {
27a6ea91 1697 _cleanup_free_ char *ep = NULL;
60252446 1698
27a6ea91 1699 ep = path_make_absolute("ep0", p->path);
72585a58
YW		 1700 if (!ep)
1701 return -ENOMEM;
27a6ea91 1702
d501e52b
YW		 1703 p->fd = usbffs_address_create(ep);
1704 if (p->fd < 0)
1705 return p->fd;
60252446 1706
36078102 1707 r = usbffs_write_descs(p->fd, SERVICE(UNIT_DEREF(s->service)));
6b7e5923 1708 if (r < 0)
e5417345 1709 return r;
6b7e5923 1710
36078102 1711 r = usbffs_dispatch_eps(p);
60252446 1712 if (r < 0)
e5417345 1713 return r;
00411a13
LP		 1714
1715 break;
27a6ea91 1716 }
00411a13 1717 default:
04499a70 1718 assert_not_reached();
00411a13 1719 }
034c6ed7
LP		 1720 }
1721
e5417345 1722 s = NULL;
034c6ed7 1723 return 0;
034c6ed7
LP		 1724}
1725
1726static void socket_unwatch_fds(Socket *s) {
718db961 1727 int r;
9152c765 1728
034c6ed7
LP		 1729 assert(s);
1730
1731 LIST_FOREACH(port, p, s->ports) {
1732 if (p->fd < 0)
1733 continue;
1734
a4152e3f
LP		 1735 if (!p->event_source)
1736 continue;
1737
1738 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_OFF);
1739 if (r < 0)
f2341e0a 1740 log_unit_debug_errno(UNIT(s), r, "Failed to disable event source: %m");
83c60c9f 1741 }
034c6ed7
LP		 1742}
1743
1744static int socket_watch_fds(Socket *s) {
034c6ed7
LP		 1745 int r;
1746
1747 assert(s);
83c60c9f 1748
034c6ed7
LP		 1749 LIST_FOREACH(port, p, s->ports) {
1750 if (p->fd < 0)
1751 continue;
1752
cbf60d0a 1753 if (p->event_source) {
718db961 1754 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_ON);
cbf60d0a
LP		 1755 if (r < 0)
1756 goto fail;
1757 } else {
151b9b96 1758 r = sd_event_add_io(UNIT(s)->manager->event, &p->event_source, p->fd, EPOLLIN, socket_dispatch_io, p);
cbf60d0a
LP		 1759 if (r < 0)
1760 goto fail;
4f2d528d 1761
cbf60d0a 1762 (void) sd_event_source_set_description(p->event_source, "socket-port-io");
718db961 1763 }
034c6ed7 1764 }
83c60c9f 1765
542563ba 1766 return 0;
83c60c9f 1767
034c6ed7 1768fail:
cbf60d0a 1769 log_unit_warning_errno(UNIT(s), r, "Failed to watch listening fds: %m");
034c6ed7
LP		 1770 socket_unwatch_fds(s);
1771 return r;
1772}
1773
01a8b467
LP		 1774enum {
1775 SOCKET_OPEN_NONE,
1776 SOCKET_OPEN_SOME,
1777 SOCKET_OPEN_ALL,
1778};
1779
1780static int socket_check_open(Socket *s) {
1781 bool have_open = false, have_closed = false;
01a8b467
LP		 1782
1783 assert(s);
1784
1785 LIST_FOREACH(port, p, s->ports) {
1786 if (p->fd < 0)
1787 have_closed = true;
1788 else
1789 have_open = true;
1790
1791 if (have_open && have_closed)
1792 return SOCKET_OPEN_SOME;
1793 }
1794
1795 if (have_open)
1796 return SOCKET_OPEN_ALL;
1797
1798 return SOCKET_OPEN_NONE;
1799}
1800
034c6ed7
LP		 1801static void socket_set_state(Socket *s, SocketState state) {
1802 SocketState old_state;
1803 assert(s);
1804
6fcbec6f
LP		 1805 if (s->state != state)
1806 bus_unit_send_pending_change_signal(UNIT(s), false);
1807
034c6ed7
LP		 1808 old_state = s->state;
1809 s->state = state;
1810
bd1fe7c7
LP		 1811 if (!IN_SET(state,
1812 SOCKET_START_PRE,
3900e5fd 1813 SOCKET_START_CHOWN,
bd1fe7c7
LP		 1814 SOCKET_START_POST,
1815 SOCKET_STOP_PRE,
1816 SOCKET_STOP_PRE_SIGTERM,
1817 SOCKET_STOP_PRE_SIGKILL,
1818 SOCKET_STOP_POST,
1819 SOCKET_FINAL_SIGTERM,
c968d76a
YW		 1820 SOCKET_FINAL_SIGKILL,
1821 SOCKET_CLEANING)) {
718db961 1822
5dcadb4c 1823 s->timer_event_source = sd_event_source_disable_unref(s->timer_event_source);
5e94833f 1824 socket_unwatch_control_pid(s);
034c6ed7 1825 s->control_command = NULL;
a16e1123 1826 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
e537352b 1827 }
034c6ed7 1828
a16e1123
LP		 1829 if (state != SOCKET_LISTENING)
1830 socket_unwatch_fds(s);
1831
bd1fe7c7 1832 if (!IN_SET(state,
3900e5fd 1833 SOCKET_START_CHOWN,
bd1fe7c7
LP		 1834 SOCKET_START_POST,
1835 SOCKET_LISTENING,
1836 SOCKET_RUNNING,
1837 SOCKET_STOP_PRE,
1838 SOCKET_STOP_PRE_SIGTERM,
c968d76a
YW		 1839 SOCKET_STOP_PRE_SIGKILL,
1840 SOCKET_CLEANING))
034c6ed7
LP		 1841 socket_close_fds(s);
1842
e537352b 1843 if (state != old_state)
f2341e0a 1844 log_unit_debug(UNIT(s), "Changed %s -> %s", socket_state_to_string(old_state), socket_state_to_string(state));
acbb0225 1845
96b09de5 1846 unit_notify(UNIT(s), state_translation_table[old_state], state_translation_table[state], /* reload_success = */ true);
034c6ed7
LP		 1847}
1848
be847e82 1849static int socket_coldplug(Unit *u) {
a16e1123
LP		 1850 Socket *s = SOCKET(u);
1851 int r;
1852
1853 assert(s);
1854 assert(s->state == SOCKET_DEAD);
1855
e821075a
LP		 1856 if (s->deserialized_state == s->state)
1857 return 0;
a16e1123 1858
c386f588
LP		 1859 if (s->control_pid > 0 &&
1860 pid_is_unwaited(s->control_pid) &&
1861 IN_SET(s->deserialized_state,
3900e5fd
LP		 1862 SOCKET_START_PRE,
1863 SOCKET_START_CHOWN,
1864 SOCKET_START_POST,
1865 SOCKET_STOP_PRE,
1866 SOCKET_STOP_PRE_SIGTERM,
1867 SOCKET_STOP_PRE_SIGKILL,
1868 SOCKET_STOP_POST,
1869 SOCKET_FINAL_SIGTERM,
c968d76a
YW		 1870 SOCKET_FINAL_SIGKILL,
1871 SOCKET_CLEANING)) {
a16e1123 1872
f75f613d 1873 r = unit_watch_pid(UNIT(s), s->control_pid, false);
e821075a
LP		 1874 if (r < 0)
1875 return r;
a16e1123 1876
36c16a7c 1877 r = socket_arm_timer(s, usec_add(u->state_change_timestamp.monotonic, s->timeout_usec));
e821075a
LP		 1878 if (r < 0)
1879 return r;
1880 }
a16e1123 1881
3900e5fd
LP		 1882 if (IN_SET(s->deserialized_state,
1883 SOCKET_START_CHOWN,
1884 SOCKET_START_POST,
1885 SOCKET_LISTENING,
01a8b467
LP		 1886 SOCKET_RUNNING)) {
1887
1888 /* Originally, we used to simply reopen all sockets here that we didn't have file descriptors
5238e957 1889 * for. However, this is problematic, as we won't traverse through the SOCKET_START_CHOWN state for
01a8b467
LP		 1890 * them, and thus the UID/GID wouldn't be right. Hence, instead simply check if we have all fds open,
1891 * and if there's a mismatch, warn loudly. */
1892
1893 r = socket_check_open(s);
1894 if (r == SOCKET_OPEN_NONE)
1895 log_unit_warning(UNIT(s),
1896 "Socket unit configuration has changed while unit has been running, "
1897 "no open socket file descriptor left. "
1898 "The socket unit is not functional until restarted.");
1899 else if (r == SOCKET_OPEN_SOME)
1900 log_unit_warning(UNIT(s),
1901 "Socket unit configuration has changed while unit has been running, "
1902 "and some socket file descriptors have not been opened yet. "
1903 "The socket unit is not fully functional until restarted.");
e821075a 1904 }
a16e1123 1905
e821075a
LP		 1906 if (s->deserialized_state == SOCKET_LISTENING) {
1907 r = socket_watch_fds(s);
1908 if (r < 0)
1909 return r;
a16e1123
LP		 1910 }
1911
15220772 1912 if (!IN_SET(s->deserialized_state, SOCKET_DEAD, SOCKET_FAILED, SOCKET_CLEANING))
e8a565cb 1913 (void) unit_setup_exec_runtime(u);
29206d46 1914
e821075a 1915 socket_set_state(s, s->deserialized_state);
a16e1123
LP		 1916 return 0;
1917}
1918
e537352b 1919static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
3c7416b6 1920
b9c04eaf 1921 _cleanup_(exec_params_clear) ExecParameters exec_params = {
5686391b 1922 .flags = EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN,
254d1313
ZJS		 1923 .stdin_fd = -EBADF,
1924 .stdout_fd = -EBADF,
1925 .stderr_fd = -EBADF,
1926 .exec_fd = -EBADF,
9fa95f85 1927 };
3c7416b6
LP		 1928 pid_t pid;
1929 int r;
034c6ed7
LP		 1930
1931 assert(s);
1932 assert(c);
1933 assert(_pid);
1934
3c7416b6 1935 r = unit_prepare_exec(UNIT(s));
29206d46
LP		 1936 if (r < 0)
1937 return r;
1938
36c16a7c 1939 r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
36697dc0 1940 if (r < 0)
36c16a7c 1941 return r;
034c6ed7 1942
1ad6e8b3
LP		 1943 r = unit_set_exec_params(UNIT(s), &exec_params);
1944 if (r < 0)
1945 return r;
3536f49e 1946
f2341e0a
LP		 1947 r = exec_spawn(UNIT(s),
1948 c,
9e2f7c11 1949 &s->exec_context,
9fa95f85 1950 &exec_params,
613b411c 1951 s->exec_runtime,
6bb00842 1952 &s->cgroup_context,
9e2f7c11 1953 &pid);
cee288ad 1954 if (r < 0)
36c16a7c 1955 return r;
9e2f7c11 1956
f75f613d 1957 r = unit_watch_pid(UNIT(s), pid, true);
9e2f7c11 1958 if (r < 0)
36c16a7c 1959 return r;
034c6ed7 1960
3900e5fd 1961 *_pid = pid;
3536f49e 1962
3900e5fd 1963 return 0;
3900e5fd
LP		 1964}
1965
1966static int socket_chown(Socket *s, pid_t *_pid) {
1967 pid_t pid;
1968 int r;
1969
36c16a7c 1970 r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
3900e5fd
LP		 1971 if (r < 0)
1972 goto fail;
1973
1974 /* We have to resolve the user names out-of-process, hence
1975 * let's fork here. It's messy, but well, what can we do? */
1976
4c253ed1 1977 r = unit_fork_helper_process(UNIT(s), "(sd-chown)", &pid);
a79279c7
LP		 1978 if (r < 0)
1979 return r;
1980 if (r == 0) {
fed1e721
LP		 1981 uid_t uid = UID_INVALID;
1982 gid_t gid = GID_INVALID;
3900e5fd 1983
a79279c7 1984 /* Child */
3900e5fd
LP		 1985
1986 if (!isempty(s->user)) {
1987 const char *user = s->user;
1988
fafff8f1 1989 r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0);
3900e5fd 1990 if (r < 0) {
a79279c7
LP		 1991 log_unit_error_errno(UNIT(s), r, "Failed to resolve user %s: %m", user);
1992 _exit(EXIT_USER);
3900e5fd
LP		 1993 }
1994 }
1995
1996 if (!isempty(s->group)) {
1997 const char *group = s->group;
1998
fafff8f1 1999 r = get_group_creds(&group, &gid, 0);
3900e5fd 2000 if (r < 0) {
a79279c7
LP		 2001 log_unit_error_errno(UNIT(s), r, "Failed to resolve group %s: %m", group);
2002 _exit(EXIT_GROUP);
3900e5fd
LP		 2003 }
2004 }
2005
2006 LIST_FOREACH(port, p, s->ports) {
e5a1c18d 2007 const char *path = NULL;
3900e5fd
LP		 2008
2009 if (p->type == SOCKET_SOCKET)
2010 path = socket_address_get_path(&p->address);
2011 else if (p->type == SOCKET_FIFO)
2012 path = p->path;
2013
2014 if (!path)
2015 continue;
2016
2017 if (chown(path, uid, gid) < 0) {
a79279c7
LP		 2018 log_unit_error_errno(UNIT(s), errno, "Failed to chown(): %m");
2019 _exit(EXIT_CHOWN);
3900e5fd
LP		 2020 }
2021 }
2022
a79279c7 2023 _exit(EXIT_SUCCESS);
3900e5fd
LP		 2024 }
2025
f75f613d 2026 r = unit_watch_pid(UNIT(s), pid, true);
718db961 2027 if (r < 0)
034c6ed7 2028 goto fail;
83c60c9f 2029
034c6ed7 2030 *_pid = pid;
034c6ed7
LP		 2031 return 0;
2032
2033fail:
5dcadb4c 2034 s->timer_event_source = sd_event_source_disable_unref(s->timer_event_source);
83c60c9f 2035 return r;
542563ba
LP		 2036}
2037
cfc4eb4c 2038static void socket_enter_dead(Socket *s, SocketResult f) {
034c6ed7
LP		 2039 assert(s);
2040
a0fef983 2041 if (s->result == SOCKET_SUCCESS)
cfc4eb4c 2042 s->result = f;
034c6ed7 2043
523ee2d4
LP		 2044 if (s->result == SOCKET_SUCCESS)
2045 unit_log_success(UNIT(s));
2046 else
7c047d74 2047 unit_log_failure(UNIT(s), socket_result_to_string(s->result));
ed77d407 2048
4c425434
LP		 2049 unit_warn_leftover_processes(UNIT(s), unit_log_leftover_process_stop);
2050
29206d46
LP		 2051 socket_set_state(s, s->result != SOCKET_SUCCESS ? SOCKET_FAILED : SOCKET_DEAD);
2052
28135da3 2053 s->exec_runtime = exec_runtime_destroy(s->exec_runtime);
613b411c 2054
bb0c0d6f 2055 unit_destroy_runtime_data(UNIT(s), &s->exec_context);
e66cf1a3 2056
00d9ef85 2057 unit_unref_uid_gid(UNIT(s), true);
034c6ed7
LP		 2058}
2059
cfc4eb4c 2060static void socket_enter_signal(Socket *s, SocketState state, SocketResult f);
80876c20 2061
cfc4eb4c 2062static void socket_enter_stop_post(Socket *s, SocketResult f) {
034c6ed7
LP		 2063 int r;
2064 assert(s);
2065
a0fef983 2066 if (s->result == SOCKET_SUCCESS)
cfc4eb4c 2067 s->result = f;
034c6ed7 2068
5e94833f 2069 socket_unwatch_control_pid(s);
a16e1123 2070 s->control_command_id = SOCKET_EXEC_STOP_POST;
3900e5fd 2071 s->control_command = s->exec_command[SOCKET_EXEC_STOP_POST];
a16e1123 2072
3900e5fd
LP		 2073 if (s->control_command) {
2074 r = socket_spawn(s, s->control_command, &s->control_pid);
2075 if (r < 0)
034c6ed7
LP		 2076 goto fail;
2077
80876c20
LP		 2078 socket_set_state(s, SOCKET_STOP_POST);
2079 } else
cfc4eb4c 2080 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_SUCCESS);
034c6ed7
LP		 2081
2082 return;
2083
2084fail:
f2341e0a 2085 log_unit_warning_errno(UNIT(s), r, "Failed to run 'stop-post' task: %m");
cfc4eb4c 2086 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2087}
2088
a232ebcc
ZJS		 2089static int state_to_kill_operation(Socket *s, SocketState state) {
2090 if (state == SOCKET_STOP_PRE_SIGTERM && unit_has_job_type(UNIT(s), JOB_RESTART))
2091 return KILL_RESTART;
2092
2093 if (state == SOCKET_FINAL_SIGTERM)
2094 return KILL_TERMINATE;
2095
2096 return KILL_KILL;
2097}
2098
cfc4eb4c 2099static void socket_enter_signal(Socket *s, SocketState state, SocketResult f) {
034c6ed7
LP		 2100 int r;
2101
2102 assert(s);
2103
a0fef983 2104 if (s->result == SOCKET_SUCCESS)
cfc4eb4c 2105 s->result = f;
034c6ed7 2106
cd2086fe
LP		 2107 r = unit_kill_context(
2108 UNIT(s),
2109 &s->kill_context,
a232ebcc 2110 state_to_kill_operation(s, state),
cd2086fe
LP		 2111 -1,
2112 s->control_pid,
2113 false);
2114 if (r < 0)
2115 goto fail;
034c6ed7 2116
cd2086fe 2117 if (r > 0) {
36c16a7c 2118 r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
36697dc0 2119 if (r < 0)
80876c20 2120 goto fail;
d6ea93e3 2121
80876c20 2122 socket_set_state(s, state);
ac84d1fb
LP		 2123 } else if (state == SOCKET_STOP_PRE_SIGTERM)
2124 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_SUCCESS);
2125 else if (state == SOCKET_STOP_PRE_SIGKILL)
cfc4eb4c 2126 socket_enter_stop_post(s, SOCKET_SUCCESS);
ac84d1fb
LP		 2127 else if (state == SOCKET_FINAL_SIGTERM)
2128 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
80876c20 2129 else
cfc4eb4c 2130 socket_enter_dead(s, SOCKET_SUCCESS);
034c6ed7
LP		 2131
2132 return;
2133
2134fail:
f2341e0a 2135 log_unit_warning_errno(UNIT(s), r, "Failed to kill processes: %m");
034c6ed7 2136
3742095b 2137 if (IN_SET(state, SOCKET_STOP_PRE_SIGTERM, SOCKET_STOP_PRE_SIGKILL))
cfc4eb4c 2138 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
034c6ed7 2139 else
cfc4eb4c 2140 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2141}
2142
cfc4eb4c 2143static void socket_enter_stop_pre(Socket *s, SocketResult f) {
034c6ed7
LP		 2144 int r;
2145 assert(s);
2146
a0fef983 2147 if (s->result == SOCKET_SUCCESS)
cfc4eb4c 2148 s->result = f;
034c6ed7 2149
5e94833f 2150 socket_unwatch_control_pid(s);
a16e1123 2151 s->control_command_id = SOCKET_EXEC_STOP_PRE;
3900e5fd 2152 s->control_command = s->exec_command[SOCKET_EXEC_STOP_PRE];
a16e1123 2153
3900e5fd
LP		 2154 if (s->control_command) {
2155 r = socket_spawn(s, s->control_command, &s->control_pid);
2156 if (r < 0)
034c6ed7
LP		 2157 goto fail;
2158
80876c20
LP		 2159 socket_set_state(s, SOCKET_STOP_PRE);
2160 } else
cfc4eb4c 2161 socket_enter_stop_post(s, SOCKET_SUCCESS);
034c6ed7
LP		 2162
2163 return;
2164
2165fail:
f2341e0a 2166 log_unit_warning_errno(UNIT(s), r, "Failed to run 'stop-pre' task: %m");
cfc4eb4c 2167 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2168}
2169
e9af15c3
LP		 2170static void socket_enter_listening(Socket *s) {
2171 int r;
2172 assert(s);
2173
3e5f04bf
RM		 2174 if (!s->accept && s->flush_pending) {
2175 log_unit_debug(UNIT(s), "Flushing socket before listening.");
2176 flush_ports(s);
2177 }
2178
cfc4eb4c
LP		 2179 r = socket_watch_fds(s);
2180 if (r < 0) {
f2341e0a 2181 log_unit_warning_errno(UNIT(s), r, "Failed to watch sockets: %m");
e9af15c3
LP		 2182 goto fail;
2183 }
2184
2185 socket_set_state(s, SOCKET_LISTENING);
2186 return;
2187
2188fail:
cfc4eb4c 2189 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
e9af15c3
LP		 2190}
2191
034c6ed7
LP		 2192static void socket_enter_start_post(Socket *s) {
2193 int r;
2194 assert(s);
2195
3900e5fd
LP		 2196 socket_unwatch_control_pid(s);
2197 s->control_command_id = SOCKET_EXEC_START_POST;
2198 s->control_command = s->exec_command[SOCKET_EXEC_START_POST];
2199
2200 if (s->control_command) {
2201 r = socket_spawn(s, s->control_command, &s->control_pid);
2202 if (r < 0) {
f2341e0a 2203 log_unit_warning_errno(UNIT(s), r, "Failed to run 'start-post' task: %m");
3900e5fd
LP		 2204 goto fail;
2205 }
2206
2207 socket_set_state(s, SOCKET_START_POST);
2208 } else
2209 socket_enter_listening(s);
2210
2211 return;
2212
2213fail:
2214 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2215}
2216
2217static void socket_enter_start_chown(Socket *s) {
2218 int r;
2219
2220 assert(s);
2221
cfc4eb4c
LP		 2222 r = socket_open_fds(s);
2223 if (r < 0) {
f2341e0a 2224 log_unit_warning_errno(UNIT(s), r, "Failed to listen on sockets: %m");
034c6ed7
LP		 2225 goto fail;
2226 }
2227
3900e5fd 2228 if (!isempty(s->user) || !isempty(s->group)) {
5e94833f 2229
3900e5fd
LP		 2230 socket_unwatch_control_pid(s);
2231 s->control_command_id = SOCKET_EXEC_START_CHOWN;
2232 s->control_command = NULL;
a16e1123 2233
3900e5fd 2234 r = socket_chown(s, &s->control_pid);
cfc4eb4c 2235 if (r < 0) {
f2341e0a 2236 log_unit_warning_errno(UNIT(s), r, "Failed to fork 'start-chown' task: %m");
034c6ed7
LP		 2237 goto fail;
2238 }
2239
3900e5fd 2240 socket_set_state(s, SOCKET_START_CHOWN);
80876c20 2241 } else
3900e5fd 2242 socket_enter_start_post(s);
034c6ed7
LP		 2243
2244 return;
2245
2246fail:
cfc4eb4c 2247 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2248}
2249
2250static void socket_enter_start_pre(Socket *s) {
2251 int r;
2252 assert(s);
2253
5e94833f 2254 socket_unwatch_control_pid(s);
a4634b21 2255
4c425434 2256 unit_warn_leftover_processes(UNIT(s), unit_log_leftover_process_start);
a4634b21 2257
a16e1123 2258 s->control_command_id = SOCKET_EXEC_START_PRE;
3900e5fd 2259 s->control_command = s->exec_command[SOCKET_EXEC_START_PRE];
a16e1123 2260
3900e5fd 2261 if (s->control_command) {
e821075a 2262 r = socket_spawn(s, s->control_command, &s->control_pid);
3900e5fd 2263 if (r < 0) {
f2341e0a 2264 log_unit_warning_errno(UNIT(s), r, "Failed to run 'start-pre' task: %m");
034c6ed7 2265 goto fail;
3900e5fd 2266 }
034c6ed7 2267
80876c20
LP		 2268 socket_set_state(s, SOCKET_START_PRE);
2269 } else
3900e5fd 2270 socket_enter_start_chown(s);
034c6ed7
LP		 2271
2272 return;
2273
2274fail:
cfc4eb4c 2275 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2276}
2277
60d9771c 2278static void flush_ports(Socket *s) {
03677889 2279 assert(s);
60d9771c
LP		 2280
2281 /* Flush all incoming traffic, regardless if actual bytes or new connections, so that this socket isn't busy
2282 * anymore */
2283
2284 LIST_FOREACH(port, p, s->ports) {
2285 if (p->fd < 0)
2286 continue;
2287
2288 (void) flush_accept(p->fd);
2289 (void) flush_fd(p->fd);
2290 }
2291}
2292
5cf09553
ZJS		 2293static void socket_enter_running(Socket *s, int cfd_in) {
2294 /* Note that this call takes possession of the connection fd passed. It either has to assign it
2295 * somewhere or close it. */
2296 _cleanup_close_ int cfd = cfd_in;
2297
4afd3348 2298 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
034c6ed7
LP		 2299 int r;
2300
2301 assert(s);
2302
60d9771c 2303 /* We don't take connections anymore if we are supposed to shut down anyway */
31afa0a4 2304 if (unit_stop_pending(UNIT(s))) {
e821075a 2305
f2341e0a 2306 log_unit_debug(UNIT(s), "Suppressing connection request since unit stop is scheduled.");
5d909e3e 2307
7c610628 2308 if (cfd >= 0)
a98f7575 2309 goto refuse;
7c610628 2310
5cf09553 2311 flush_ports(s);
ba3e67a7
LP		 2312 return;
2313 }
2314
7994ac1d 2315 if (!ratelimit_below(&s->trigger_limit)) {
8b26cdbd
LP		 2316 log_unit_warning(UNIT(s), "Trigger limit hit, refusing further activation.");
2317 socket_enter_stop_pre(s, SOCKET_FAILURE_TRIGGER_LIMIT_HIT);
a98f7575 2318 goto refuse;
8b26cdbd
LP		 2319 }
2320
4f2d528d 2321 if (cfd < 0) {
f976f3f6 2322 bool pending = false;
eef85c4a 2323 Unit *other;
f976f3f6 2324
15ed3c3a
LP		 2325 /* If there's already a start pending don't bother to do anything */
2326 UNIT_FOREACH_DEPENDENCY(other, UNIT(s), UNIT_ATOM_TRIGGERS)
e821075a 2327 if (unit_active_or_pending(other)) {
57020a3a
LP		 2328 pending = true;
2329 break;
2330 }
f976f3f6 2331
1a710b43 2332 if (!pending) {
640ace4a 2333 if (!UNIT_ISSET(s->service)) {
86e045ec
ZJS		 2334 r = log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOENT),
2335 "Service to activate vanished, refusing activation.");
640ace4a
LP		 2336 goto fail;
2337 }
2338
50cbaba4 2339 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, NULL, &error, NULL);
1a710b43 2340 if (r < 0)
f976f3f6 2341 goto fail;
1a710b43 2342 }
4f2d528d
LP		 2343
2344 socket_set_state(s, SOCKET_RUNNING);
2345 } else {
9d565427 2346 _cleanup_(socket_peer_unrefp) SocketPeer *p = NULL;
b669c20f 2347 Unit *service;
4f2d528d 2348
6cf6bbc2 2349 if (s->n_connections >= s->max_connections) {
ea8f50f8 2350 log_unit_warning(UNIT(s), "Too many incoming connections (%u), dropping connection.",
166cf510 2351 s->n_connections);
a98f7575 2352 goto refuse;
6cf6bbc2
LP		 2353 }
2354
9d565427 2355 if (s->max_connections_per_source > 0) {
166cf510 2356 r = socket_acquire_peer(s, cfd, &p);
d5f8890b
DL		 2357 if (r < 0) {
2358 if (ERRNO_IS_DISCONNECT(r))
2359 return;
2360 /* We didn't have enough resources to acquire peer information, let's fail. */
86e045ec 2361 goto fail;
d5f8890b 2362 }
934ef6a5 2363 if (r > 0 && p->n_ref > s->max_connections_per_source) {
ea8f50f8
ZJS		 2364 _cleanup_free_ char *t = NULL;
2365
41733ae1 2366 (void) sockaddr_pretty(&p->peer.sa, p->peer_salen, true, false, &t);
ea8f50f8 2367
166cf510 2368 log_unit_warning(UNIT(s),
ea8f50f8
ZJS		 2369 "Too many incoming connections (%u) from source %s, dropping connection.",
2370 p->n_ref, strnull(t));
a98f7575 2371 goto refuse;
9d565427
SS		 2372 }
2373 }
2374
b669c20f 2375 r = socket_load_service_unit(s, cfd, &service);
8dfb0ef1
DL		 2376 if (r < 0) {
2377 if (ERRNO_IS_DISCONNECT(r))
2378 return;
4f2d528d 2379 goto fail;
8dfb0ef1 2380 }
b15bdda8 2381
b669c20f
ZJS		 2382 r = unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, service,
2383 false, UNIT_DEPENDENCY_IMPLICIT);
2384 if (r < 0)
2385 goto fail;
6c073082 2386
e4f67317 2387 s->n_accepted++;
b15bdda8 2388
3fabebf4 2389 r = service_set_socket_fd(SERVICE(service), cfd, s, p, s->selinux_context_from_net);
8dfb0ef1
DL		 2390 if (r < 0) {
2391 if (ERRNO_IS_DISCONNECT(r))
2392 return;
4f2d528d 2393 goto fail;
8dfb0ef1 2394 }
4f2d528d 2395
934ef6a5 2396 TAKE_FD(cfd); /* We passed ownership of the fd to the service now. Forget it here. */
313cefa1 2397 s->n_connections++;
6cf6bbc2 2398
b669c20f 2399 r = manager_add_job(UNIT(s)->manager, JOB_START, service, JOB_REPLACE, NULL, &error, NULL);
3e7a1f50 2400 if (r < 0) {
934ef6a5
ZJS		 2401 /* We failed to activate the new service, but it still exists. Let's make sure the
2402 * service closes and forgets the connection fd again, immediately. */
81a1d6d6 2403 service_release_socket_fd(SERVICE(service));
4f2d528d 2404 goto fail;
3e7a1f50 2405 }
c4e2ceae
LP		 2406
2407 /* Notify clients about changed counters */
2408 unit_add_to_dbus_queue(UNIT(s));
4f2d528d 2409 }
034c6ed7 2410
5cf09553 2411 TAKE_FD(cfd);
034c6ed7
LP		 2412 return;
2413
a98f7575
MM		 2414refuse:
2415 s->n_refused++;
a98f7575
MM		 2416 return;
2417
034c6ed7 2418fail:
86e045ec
ZJS		 2419 if (ERRNO_IS_RESOURCE(r))
2420 log_unit_warning(UNIT(s), "Failed to queue service startup job: %s",
2421 bus_error_message(&error, r));
2422 else
2423 log_unit_warning(UNIT(s), "Failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",
2424 cfd >= 0 ? "template" : "non-template",
2425 bus_error_message(&error, r));
e821075a 2426
60089004 2427 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2428}
2429
cfc4eb4c 2430static void socket_run_next(Socket *s) {
034c6ed7
LP		 2431 int r;
2432
2433 assert(s);
2434 assert(s->control_command);
2435 assert(s->control_command->command_next);
2436
5e94833f
LP		 2437 socket_unwatch_control_pid(s);
2438
034c6ed7
LP		 2439 s->control_command = s->control_command->command_next;
2440
e821075a
LP		 2441 r = socket_spawn(s, s->control_command, &s->control_pid);
2442 if (r < 0)
034c6ed7
LP		 2443 goto fail;
2444
2445 return;
2446
2447fail:
f2341e0a 2448 log_unit_warning_errno(UNIT(s), r, "Failed to run next task: %m");
80876c20
LP		 2449
2450 if (s->state == SOCKET_START_POST)
cfc4eb4c 2451 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
034c6ed7 2452 else if (s->state == SOCKET_STOP_POST)
cfc4eb4c 2453 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
034c6ed7 2454 else
cfc4eb4c 2455 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
034c6ed7
LP		 2456}
2457
87f0e418
LP		 2458static int socket_start(Unit *u) {
2459 Socket *s = SOCKET(u);
07299350 2460 int r;
83c60c9f
LP		 2461
2462 assert(s);
2463
034c6ed7
LP		 2464 /* We cannot fulfill this request right now, try again later
2465 * please! */
3900e5fd
LP		 2466 if (IN_SET(s->state,
2467 SOCKET_STOP_PRE,
2468 SOCKET_STOP_PRE_SIGKILL,
2469 SOCKET_STOP_PRE_SIGTERM,
2470 SOCKET_STOP_POST,
2471 SOCKET_FINAL_SIGTERM,
c968d76a
YW		 2472 SOCKET_FINAL_SIGKILL,
2473 SOCKET_CLEANING))
034c6ed7
LP		 2474 return -EAGAIN;
2475
a4152e3f 2476 /* Already on it! */
3900e5fd
LP		 2477 if (IN_SET(s->state,
2478 SOCKET_START_PRE,
2479 SOCKET_START_CHOWN,
2480 SOCKET_START_POST))
034c6ed7 2481 return 0;
83c60c9f 2482
034c6ed7 2483 /* Cannot run this without the service being around */
9444b1f2 2484 if (UNIT_ISSET(s->service)) {
57020a3a
LP		 2485 Service *service;
2486
2487 service = SERVICE(UNIT_DEREF(s->service));
2488
d85ff944
YW		 2489 if (UNIT(service)->load_state != UNIT_LOADED)
2490 return log_unit_error_errno(u, SYNTHETIC_ERRNO(ENOENT), "Socket service %s not loaded, refusing.", UNIT(service)->id);
4f2d528d 2491
35b8ca3a 2492 /* If the service is already active we cannot start the
4f2d528d 2493 * socket */
a1d31573 2494 if (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED, SERVICE_DEAD_BEFORE_AUTO_RESTART, SERVICE_FAILED_BEFORE_AUTO_RESTART, SERVICE_AUTO_RESTART))
d85ff944 2495 return log_unit_error_errno(u, SYNTHETIC_ERRNO(EBUSY), "Socket service %s already active, refusing.", UNIT(service)->id);
4f2d528d 2496 }
e537352b 2497
3742095b 2498 assert(IN_SET(s->state, SOCKET_DEAD, SOCKET_FAILED));
83c60c9f 2499
4b58153d
LP		 2500 r = unit_acquire_invocation_id(u);
2501 if (r < 0)
2502 return r;
2503
cfc4eb4c 2504 s->result = SOCKET_SUCCESS;
6a1d4d9f 2505 exec_command_reset_status_list_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
3c7416b6
LP		 2506
2507 u->reset_accounting = true;
5ad096b3 2508
034c6ed7 2509 socket_enter_start_pre(s);
82a2b6bb 2510 return 1;
034c6ed7 2511}
83c60c9f 2512
87f0e418
LP		 2513static int socket_stop(Unit *u) {
2514 Socket *s = SOCKET(u);
034c6ed7
LP		 2515
2516 assert(s);
2517
e537352b 2518 /* Already on it */
3900e5fd
LP		 2519 if (IN_SET(s->state,
2520 SOCKET_STOP_PRE,
2521 SOCKET_STOP_PRE_SIGTERM,
2522 SOCKET_STOP_PRE_SIGKILL,
2523 SOCKET_STOP_POST,
2524 SOCKET_FINAL_SIGTERM,
2525 SOCKET_FINAL_SIGKILL))
e537352b
LP		 2526 return 0;
2527
3f6c78dc
LP		 2528 /* If there's already something running we go directly into
2529 * kill mode. */
3900e5fd
LP		 2530 if (IN_SET(s->state,
2531 SOCKET_START_PRE,
2532 SOCKET_START_CHOWN,
2533 SOCKET_START_POST)) {
cfc4eb4c 2534 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_SUCCESS);
3f6c78dc
LP		 2535 return -EAGAIN;
2536 }
2537
c968d76a
YW		 2538 /* If we are currently cleaning, then abort it, brutally. */
2539 if (s->state == SOCKET_CLEANING) {
2540 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
2541 return 0;
2542 }
2543
3742095b 2544 assert(IN_SET(s->state, SOCKET_LISTENING, SOCKET_RUNNING));
83c60c9f 2545
cfc4eb4c 2546 socket_enter_stop_pre(s, SOCKET_SUCCESS);
82a2b6bb 2547 return 1;
542563ba
LP		 2548}
2549
a16e1123
LP		 2550static int socket_serialize(Unit *u, FILE *f, FDSet *fds) {
2551 Socket *s = SOCKET(u);
a16e1123
LP		 2552 int r;
2553
2554 assert(u);
2555 assert(f);
2556 assert(fds);
2557
d68c645b
LP		 2558 (void) serialize_item(f, "state", socket_state_to_string(s->state));
2559 (void) serialize_item(f, "result", socket_result_to_string(s->result));
2560 (void) serialize_item_format(f, "n-accepted", "%u", s->n_accepted);
2561 (void) serialize_item_format(f, "n-refused", "%u", s->n_refused);
a16e1123
LP		 2562
2563 if (s->control_pid > 0)
d68c645b 2564 (void) serialize_item_format(f, "control-pid", PID_FMT, s->control_pid);
a16e1123
LP		 2565
2566 if (s->control_command_id >= 0)
d68c645b 2567 (void) serialize_item(f, "control-command", socket_exec_command_to_string(s->control_command_id));
a16e1123
LP		 2568
2569 LIST_FOREACH(port, p, s->ports) {
2570 int copy;
2571
2572 if (p->fd < 0)
2573 continue;
2574
613b411c
LP		 2575 copy = fdset_put_dup(fds, p->fd);
2576 if (copy < 0)
fc2d74ab 2577 return log_unit_warning_errno(u, copy, "Failed to serialize socket fd: %m");
a16e1123
LP		 2578
2579 if (p->type == SOCKET_SOCKET) {
613b411c 2580 _cleanup_free_ char *t = NULL;
a16e1123 2581
ee092817
LP		 2582 r = socket_address_print(&p->address, &t);
2583 if (r < 0)
fc2d74ab 2584 return log_unit_error_errno(u, r, "Failed to format socket address: %m");
a16e1123 2585
7a22745a 2586 if (socket_address_family(&p->address) == AF_NETLINK)
d68c645b 2587 (void) serialize_item_format(f, "netlink", "%i %s", copy, t);
7a22745a 2588 else
d68c645b 2589 (void) serialize_item_format(f, "socket", "%i %i %s", copy, p->address.type, t);
b0a3f2bc 2590 } else if (p->type == SOCKET_SPECIAL)
d68c645b 2591 (void) serialize_item_format(f, "special", "%i %s", copy, p->path);
ee092817 2592 else if (p->type == SOCKET_MQUEUE)
d68c645b 2593 (void) serialize_item_format(f, "mqueue", "%i %s", copy, p->path);
60252446 2594 else if (p->type == SOCKET_USB_FUNCTION)
d68c645b 2595 (void) serialize_item_format(f, "ffs", "%i %s", copy, p->path);
b0a3f2bc 2596 else {
a16e1123 2597 assert(p->type == SOCKET_FIFO);
d68c645b 2598 (void) serialize_item_format(f, "fifo", "%i %s", copy, p->path);
a16e1123
LP		 2599 }
2600 }
2601
2602 return 0;
2603}
2604
2605static int socket_deserialize_item(Unit *u, const char *key, const char *value, FDSet *fds) {
2606 Socket *s = SOCKET(u);
77be02ad 2607 int r;
a16e1123
LP		 2608
2609 assert(u);
2610 assert(key);
2611 assert(value);
a16e1123
LP		 2612
2613 if (streq(key, "state")) {
2614 SocketState state;
2615
ee092817
LP		 2616 state = socket_state_from_string(value);
2617 if (state < 0)
f2341e0a 2618 log_unit_debug(u, "Failed to parse state value: %s", value);
a16e1123
LP		 2619 else
2620 s->deserialized_state = state;
cfc4eb4c
LP		 2621 } else if (streq(key, "result")) {
2622 SocketResult f;
a16e1123 2623
cfc4eb4c
LP		 2624 f = socket_result_from_string(value);
2625 if (f < 0)
f2341e0a 2626 log_unit_debug(u, "Failed to parse result value: %s", value);
cfc4eb4c
LP		 2627 else if (f != SOCKET_SUCCESS)
2628 s->result = f;
a16e1123
LP		 2629
2630 } else if (streq(key, "n-accepted")) {
2631 unsigned k;
2632
e364ad06 2633 if (safe_atou(value, &k) < 0)
f2341e0a 2634 log_unit_debug(u, "Failed to parse n-accepted value: %s", value);
a16e1123
LP		 2635 else
2636 s->n_accepted += k;
a98f7575
MM		 2637 } else if (streq(key, "n-refused")) {
2638 unsigned k;
2639
2640 if (safe_atou(value, &k) < 0)
2641 log_unit_debug(u, "Failed to parse n-refused value: %s", value);
2642 else
2643 s->n_refused += k;
a16e1123 2644 } else if (streq(key, "control-pid")) {
5925dd3c 2645 pid_t pid;
a16e1123 2646
e364ad06 2647 if (parse_pid(value, &pid) < 0)
f2341e0a 2648 log_unit_debug(u, "Failed to parse control-pid value: %s", value);
a16e1123 2649 else
5925dd3c 2650 s->control_pid = pid;
a16e1123
LP		 2651 } else if (streq(key, "control-command")) {
2652 SocketExecCommand id;
2653
66870f90
ZJS		 2654 id = socket_exec_command_from_string(value);
2655 if (id < 0)
f2341e0a 2656 log_unit_debug(u, "Failed to parse exec-command value: %s", value);
a16e1123
LP		 2657 else {
2658 s->control_command_id = id;
2659 s->control_command = s->exec_command[id];
2660 }
2661 } else if (streq(key, "fifo")) {
77be02ad
FS		 2662 _cleanup_free_ char *fdv = NULL;
2663 bool found = false;
2664 int fd;
a16e1123 2665
77be02ad
FS		 2666 r = extract_first_word(&value, &fdv, NULL, 0);
2667 if (r <= 0) {
f2341e0a 2668 log_unit_debug(u, "Failed to parse fifo value: %s", value);
77be02ad 2669 return 0;
3da0caf5 2670 }
b0a3f2bc 2671
77be02ad
FS		 2672 fd = parse_fd(fdv);
2673 if (fd < 0 || !fdset_contains(fds, fd)) {
2674 log_unit_debug(u, "Invalid fifo value: %s", fdv);
2675 return 0;
2676 }
2677
2678 LIST_FOREACH(port, p, s->ports)
2679 if (p->fd < 0 &&
2680 p->type == SOCKET_FIFO &&
563e6846 2681 path_equal_or_inode_same(p->path, value, 0)) {
77be02ad
FS		 2682 p->fd = fdset_remove(fds, fd);
2683 found = true;
2684 break;
2685 }
2686 if (!found)
2687 log_unit_debug(u, "No matching fifo socket found: %s", value);
2688
b0a3f2bc 2689 } else if (streq(key, "special")) {
77be02ad
FS		 2690 _cleanup_free_ char *fdv = NULL;
2691 bool found = false;
2692 int fd;
b0a3f2bc 2693
77be02ad
FS		 2694 r = extract_first_word(&value, &fdv, NULL, 0);
2695 if (r <= 0) {
f2341e0a 2696 log_unit_debug(u, "Failed to parse special value: %s", value);
77be02ad
FS		 2697 return 0;
2698 }
2699
2700 fd = parse_fd(fdv);
2701 if (fd < 0 || !fdset_contains(fds, fd)) {
2702 log_unit_debug(u, "Invalid special value: %s", fdv);
2703 return 0;
3da0caf5 2704 }
a16e1123 2705
77be02ad
FS		 2706 LIST_FOREACH(port, p, s->ports)
2707 if (p->fd < 0 &&
2708 p->type == SOCKET_SPECIAL &&
563e6846 2709 path_equal_or_inode_same(p->path, value, 0)) {
77be02ad
FS		 2710 p->fd = fdset_remove(fds, fd);
2711 found = true;
2712 break;
2713 }
2714 if (!found)
2715 log_unit_debug(u, "No matching special socket found: %s", value);
2716
ee092817 2717 } else if (streq(key, "mqueue")) {
77be02ad
FS		 2718 _cleanup_free_ char *fdv = NULL;
2719 bool found = false;
2720 int fd;
ee092817 2721
77be02ad
FS		 2722 r = extract_first_word(&value, &fdv, NULL, 0);
2723 if (r <= 0) {
f2341e0a 2724 log_unit_debug(u, "Failed to parse mqueue value: %s", value);
77be02ad 2725 return 0;
3da0caf5 2726 }
ee092817 2727
77be02ad
FS		 2728 fd = parse_fd(fdv);
2729 if (fd < 0 || !fdset_contains(fds, fd)) {
2730 log_unit_debug(u, "Invalid mqueue value: %s", fdv);
2731 return 0;
2732 }
2733
2734 LIST_FOREACH(port, p, s->ports)
2735 if (p->fd < 0 &&
2736 p->type == SOCKET_MQUEUE &&
2737 streq(p->path, value)) {
2738 p->fd = fdset_remove(fds, fd);
2739 found = true;
2740 break;
2741 }
2742 if (!found)
2743 log_unit_debug(u, "No matching mqueue socket found: %s", value);
2744
a16e1123 2745 } else if (streq(key, "socket")) {
77be02ad
FS		 2746 _cleanup_free_ char *fdv = NULL, *typev = NULL;
2747 bool found = false;
2748 int fd, type;
2749
2750 r = extract_first_word(&value, &fdv, NULL, 0);
2751 if (r <= 0) {
2752 log_unit_debug(u, "Failed to parse socket fd from value: %s", value);
2753 return 0;
2754 }
a16e1123 2755
77be02ad
FS		 2756 fd = parse_fd(fdv);
2757 if (fd < 0 || !fdset_contains(fds, fd)) {
2758 log_unit_debug(u, "Invalid socket fd: %s", fdv);
2759 return 0;
2760 }
2761
2762 r = extract_first_word(&value, &typev, NULL, 0);
2763 if (r <= 0) {
2764 log_unit_debug(u, "Failed to parse socket type from value: %s", value);
2765 return 0;
2766 }
2767
2768 if (safe_atoi(typev, &type) < 0 || type < 0) {
2769 log_unit_debug(u, "Invalid socket type: %s", typev);
2770 return 0;
3da0caf5 2771 }
a16e1123 2772
77be02ad
FS		 2773 LIST_FOREACH(port, p, s->ports)
2774 if (p->fd < 0 &&
2775 socket_address_is(&p->address, value, type)) {
2776 p->fd = fdset_remove(fds, fd);
2777 found = true;
2778 break;
2779 }
2780 if (!found)
2781 log_unit_debug(u, "No matching %s socket found: %s",
2782 socket_address_type_to_string(type), value);
2783
7a22745a 2784 } else if (streq(key, "netlink")) {
77be02ad
FS		 2785 _cleanup_free_ char *fdv = NULL;
2786 bool found = false;
2787 int fd;
7a22745a 2788
77be02ad
FS		 2789 r = extract_first_word(&value, &fdv, NULL, 0);
2790 if (r <= 0) {
f2341e0a 2791 log_unit_debug(u, "Failed to parse socket value: %s", value);
77be02ad 2792 return 0;
3da0caf5 2793 }
60252446 2794
77be02ad
FS		 2795 fd = parse_fd(fdv);
2796 if (fd < 0 || !fdset_contains(fds, fd)) {
2797 log_unit_debug(u, "Invalid socket value: %s", fdv);
2798 return 0;
2799 }
2800
2801 LIST_FOREACH(port, p, s->ports)
2802 if (p->fd < 0 &&
2803 socket_address_is_netlink(&p->address, value)) {
2804 p->fd = fdset_remove(fds, fd);
2805 found = true;
2806 break;
2807 }
2808 if (!found)
2809 log_unit_debug(u, "No matching netlink socket found: %s", value);
2810
60252446 2811 } else if (streq(key, "ffs")) {
77be02ad
FS		 2812 _cleanup_free_ char *fdv = NULL;
2813 bool found = false;
2814 int fd;
60252446 2815
77be02ad
FS		 2816 r = extract_first_word(&value, &fdv, NULL, 0);
2817 if (r <= 0) {
60252446 2818 log_unit_debug(u, "Failed to parse ffs value: %s", value);
77be02ad
FS		 2819 return 0;
2820 }
2821
2822 fd = parse_fd(fdv);
2823 if (fd < 0 || !fdset_contains(fds, fd)) {
2824 log_unit_debug(u, "Invalid ffs value: %s", fdv);
2825 return 0;
3da0caf5 2826 }
60252446 2827
77be02ad
FS		 2828 LIST_FOREACH(port, p, s->ports)
2829 if (p->fd < 0 &&
2830 p->type == SOCKET_USB_FUNCTION &&
563e6846 2831 path_equal_or_inode_same(p->path, value, 0)) {
77be02ad
FS		 2832 p->fd = fdset_remove(fds, fd);
2833 found = true;
2834 break;
2835 }
2836 if (!found)
2837 log_unit_debug(u, "No matching ffs socket found: %s", value);
2838
a16e1123 2839 } else
f2341e0a 2840 log_unit_debug(UNIT(s), "Unknown serialization key: %s", key);
a16e1123
LP		 2841
2842 return 0;
2843}
2844
9ff1a6f1 2845static void socket_distribute_fds(Unit *u, FDSet *fds) {
01e10de3 2846 Socket *s = SOCKET(u);
01e10de3
LP		 2847
2848 assert(u);
2849
2850 LIST_FOREACH(port, p, s->ports) {
01e10de3
LP		 2851 int fd;
2852
2853 if (p->type != SOCKET_SOCKET)
2854 continue;
2855
2856 if (p->fd >= 0)
2857 continue;
2858
90e74a66 2859 FDSET_FOREACH(fd, fds) {
01e10de3
LP		 2860 if (socket_address_matches_fd(&p->address, fd)) {
2861 p->fd = fdset_remove(fds, fd);
2862 s->deserialized_state = SOCKET_LISTENING;
2863 break;
2864 }
2865 }
2866 }
01e10de3
LP		 2867}
2868
d1e8e8b5 2869static UnitActiveState socket_active_state(Unit *u) {
87f0e418 2870 assert(u);
5cb5a6ff 2871
acbb0225 2872 return state_translation_table[SOCKET(u)->state];
5cb5a6ff
LP		 2873}
2874
d1e8e8b5 2875static const char *socket_sub_state_to_string(Unit *u) {
10a94420
LP		 2876 assert(u);
2877
a16e1123 2878 return socket_state_to_string(SOCKET(u)->state);
10a94420
LP		 2879}
2880
67419600
OS		 2881const char* socket_port_type_to_string(SocketPort *p) {
2882
2883 assert(p);
2884
2885 switch (p->type) {
718db961
LP		 2886
2887 case SOCKET_SOCKET:
2888
2889 switch (p->address.type) {
2890
2891 case SOCK_STREAM:
2892 return "Stream";
2893
2894 case SOCK_DGRAM:
2895 return "Datagram";
2896
2897 case SOCK_SEQPACKET:
2898 return "SequentialPacket";
2899
2900 case SOCK_RAW:
2901 if (socket_address_family(&p->address) == AF_NETLINK)
2902 return "Netlink";
2903
4831981d 2904 _fallthrough_;
718db961
LP		 2905 default:
2906 return NULL;
2907 }
2908
2909 case SOCKET_SPECIAL:
2910 return "Special";
2911
2912 case SOCKET_MQUEUE:
2913 return "MessageQueue";
2914
2915 case SOCKET_FIFO:
2916 return "FIFO";
2917
60252446
PS		 2918 case SOCKET_USB_FUNCTION:
2919 return "USBFunction";
2920
718db961
LP		 2921 default:
2922 return NULL;
67419600
OS		 2923 }
2924}
2925
038ed5a4
YW		 2926SocketType socket_port_type_from_string(const char *s) {
2927 assert(s);
2928
e045e325
YW		 2929 if (STR_IN_SET(s, "Stream", "Datagram", "SequentialPacket", "Netlink"))
2930 return SOCKET_SOCKET;
2931 else if (streq(s, "Special"))
2932 return SOCKET_SPECIAL;
2933 else if (streq(s, "MessageQueue"))
2934 return SOCKET_MQUEUE;
2935 else if (streq(s, "FIFO"))
2936 return SOCKET_FIFO;
2937 else if (streq(s, "USBFunction"))
2938 return SOCKET_USB_FUNCTION;
038ed5a4
YW		 2939 else
2940 return _SOCKET_TYPE_INVALID;
2941}
2942
d1e8e8b5 2943static bool socket_may_gc(Unit *u) {
6cf6bbc2
LP		 2944 Socket *s = SOCKET(u);
2945
2946 assert(u);
2947
f2f725e5 2948 return s->n_connections == 0;
6cf6bbc2
LP		 2949}
2950
a79279c7
LP		 2951static int socket_accept_do(Socket *s, int fd) {
2952 int cfd;
2953
2954 assert(s);
2955 assert(fd >= 0);
2956
4ff9bc2e
LP		 2957 cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
2958 if (cfd < 0)
2959 /* Convert transient network errors into clean and well-defined EAGAIN */
2960 return ERRNO_IS_ACCEPT_AGAIN(errno) ? -EAGAIN : -errno;
a79279c7
LP		 2961
2962 return cfd;
2963}
2964
2965static int socket_accept_in_cgroup(Socket *s, SocketPort *p, int fd) {
19ee48a6 2966 _cleanup_close_pair_ int pair[2] = PIPE_EBADF;
a79279c7
LP		 2967 int cfd, r;
2968 pid_t pid;
2969
2970 assert(s);
2971 assert(p);
2972 assert(fd >= 0);
2973
5238e957 2974 /* Similar to socket_address_listen_in_cgroup(), but for accept() rather than socket(): make sure that any
a79279c7
LP		 2975 * connection socket is also properly associated with the cgroup. */
2976
2977 if (!IN_SET(p->address.sockaddr.sa.sa_family, AF_INET, AF_INET6))
2978 goto shortcut;
2979
2980 r = bpf_firewall_supported();
2981 if (r < 0)
2982 return r;
2ae7ee58 2983 if (r == BPF_FIREWALL_UNSUPPORTED)
a79279c7
LP		 2984 goto shortcut;
2985
2986 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pair) < 0)
2987 return log_unit_error_errno(UNIT(s), errno, "Failed to create communication channel: %m");
2988
4c253ed1 2989 r = unit_fork_helper_process(UNIT(s), "(sd-accept)", &pid);
a79279c7
LP		 2990 if (r < 0)
2991 return log_unit_error_errno(UNIT(s), r, "Failed to fork off accept stub process: %m");
2992 if (r == 0) {
2993 /* Child */
2994
2995 pair[0] = safe_close(pair[0]);
2996
2997 cfd = socket_accept_do(s, fd);
4ff9bc2e
LP		 2998 if (cfd == -EAGAIN) /* spurious accept() */
2999 _exit(EXIT_SUCCESS);
a79279c7
LP		 3000 if (cfd < 0) {
3001 log_unit_error_errno(UNIT(s), cfd, "Failed to accept connection socket: %m");
3002 _exit(EXIT_FAILURE);
3003 }
3004
3005 r = send_one_fd(pair[1], cfd, 0);
3006 if (r < 0) {
3007 log_unit_error_errno(UNIT(s), r, "Failed to send connection socket to parent: %m");
3008 _exit(EXIT_FAILURE);
3009 }
3010
3011 _exit(EXIT_SUCCESS);
3012 }
3013
3014 pair[1] = safe_close(pair[1]);
3015 cfd = receive_one_fd(pair[0], 0);
3016
3017 /* We synchronously wait for the helper, as it shouldn't be slow */
d2e0ac3d 3018 r = wait_for_terminate_and_check("(sd-accept)", pid, WAIT_LOG_ABNORMAL);
a79279c7
LP		 3019 if (r < 0) {
3020 safe_close(cfd);
3021 return r;
3022 }
3023
4ff9bc2e
LP		 3024 /* If we received no fd, we got EIO here. If this happens with a process exit code of EXIT_SUCCESS
3025 * this is a spurious accept(), let's convert that back to EAGAIN here. */
3026 if (cfd == -EIO)
3027 return -EAGAIN;
a79279c7
LP		 3028 if (cfd < 0)
3029 return log_unit_error_errno(UNIT(s), cfd, "Failed to receive connection socket: %m");
3030
3031 return cfd;
3032
3033shortcut:
3034 cfd = socket_accept_do(s, fd);
4ff9bc2e
LP		 3035 if (cfd == -EAGAIN) /* spurious accept(), skip it silently */
3036 return -EAGAIN;
a79279c7
LP		 3037 if (cfd < 0)
3038 return log_unit_error_errno(UNIT(s), cfd, "Failed to accept connection socket: %m");
3039
3040 return cfd;
3041}
3042
718db961 3043static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
99534007 3044 SocketPort *p = ASSERT_PTR(userdata);
254d1313 3045 int cfd = -EBADF;
9152c765 3046
8d567588 3047 assert(fd >= 0);
9152c765 3048
718db961
LP		 3049 if (p->socket->state != SOCKET_LISTENING)
3050 return 0;
871d7de4 3051
f2341e0a 3052 log_unit_debug(UNIT(p->socket), "Incoming traffic");
9152c765 3053
718db961 3054 if (revents != EPOLLIN) {
718db961 3055 if (revents & EPOLLHUP)
f2341e0a 3056 log_unit_error(UNIT(p->socket), "Got POLLHUP on a listening socket. The service probably invoked shutdown() on it, and should better not do that.");
641e01dc 3057 else
f2341e0a 3058 log_unit_error(UNIT(p->socket), "Got unexpected poll event (0x%x) on socket.", revents);
8d567588 3059 goto fail;
4f2d528d
LP		 3060 }
3061
718db961
LP		 3062 if (p->socket->accept &&
3063 p->type == SOCKET_SOCKET &&
3064 socket_address_can_accept(&p->address)) {
3065
a79279c7 3066 cfd = socket_accept_in_cgroup(p->socket, p, fd);
4ff9bc2e
LP		 3067 if (cfd == -EAGAIN) /* Spurious accept() */
3068 return 0;
a79279c7
LP		 3069 if (cfd < 0)
3070 goto fail;
4fd5948e 3071
5d0fe423 3072 socket_apply_socket_options(p->socket, p, cfd);
4f2d528d 3073 }
9152c765 3074
718db961
LP		 3075 socket_enter_running(p->socket, cfd);
3076 return 0;
8d567588
LP		 3077
3078fail:
718db961
LP		 3079 socket_enter_stop_pre(p->socket, SOCKET_FAILURE_RESOURCES);
3080 return 0;
9152c765
LP		 3081}
3082
87f0e418
LP		 3083static void socket_sigchld_event(Unit *u, pid_t pid, int code, int status) {
3084 Socket *s = SOCKET(u);
cfc4eb4c 3085 SocketResult f;
5cb5a6ff
LP		 3086
3087 assert(s);
034c6ed7 3088 assert(pid >= 0);
5cb5a6ff 3089
8c47c732
LP		 3090 if (pid != s->control_pid)
3091 return;
542563ba 3092
034c6ed7
LP		 3093 s->control_pid = 0;
3094
1f0958f6 3095 if (is_clean_exit(code, status, EXIT_CLEAN_COMMAND, NULL))
cfc4eb4c
LP		 3096 f = SOCKET_SUCCESS;
3097 else if (code == CLD_EXITED)
3098 f = SOCKET_FAILURE_EXIT_CODE;
3099 else if (code == CLD_KILLED)
3100 f = SOCKET_FAILURE_SIGNAL;
3101 else if (code == CLD_DUMPED)
3102 f = SOCKET_FAILURE_CORE_DUMP;
3103 else
04499a70 3104 assert_not_reached();
8c47c732 3105
b708e7ce 3106 if (s->control_command) {
6ea832a2 3107 exec_status_exit(&s->control_command->exec_status, &s->exec_context, pid, code, status);
a16e1123 3108
3ed0cd26 3109 if (s->control_command->flags & EXEC_COMMAND_IGNORE_FAILURE)
cfc4eb4c 3110 f = SOCKET_SUCCESS;
b708e7ce
LP		 3111 }
3112
91bbd9b7 3113 unit_log_process_exit(
5cc2cd1c 3114 u,
91bbd9b7
LP		 3115 "Control process",
3116 socket_exec_command_to_string(s->control_command_id),
5cc2cd1c 3117 f == SOCKET_SUCCESS,
91bbd9b7 3118 code, status);
034c6ed7 3119
a0fef983 3120 if (s->result == SOCKET_SUCCESS)
cfc4eb4c
LP		 3121 s->result = f;
3122
3123 if (s->control_command &&
3124 s->control_command->command_next &&
3125 f == SOCKET_SUCCESS) {
3126
f2341e0a 3127 log_unit_debug(u, "Running next command for state %s", socket_state_to_string(s->state));
cfc4eb4c 3128 socket_run_next(s);
acbb0225 3129 } else {
a16e1123
LP		 3130 s->control_command = NULL;
3131 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
3132
034c6ed7
LP		 3133 /* No further commands for this step, so let's figure
3134 * out what to do next */
5cb5a6ff 3135
f2341e0a 3136 log_unit_debug(u, "Got final SIGCHLD for state %s", socket_state_to_string(s->state));
acbb0225 3137
034c6ed7
LP		 3138 switch (s->state) {
3139
3140 case SOCKET_START_PRE:
cfc4eb4c 3141 if (f == SOCKET_SUCCESS)
3900e5fd 3142 socket_enter_start_chown(s);
034c6ed7 3143 else
cfc4eb4c 3144 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, f);
034c6ed7
LP		 3145 break;
3146
3900e5fd
LP		 3147 case SOCKET_START_CHOWN:
3148 if (f == SOCKET_SUCCESS)
3149 socket_enter_start_post(s);
3150 else
3151 socket_enter_stop_pre(s, f);
3152 break;
3153
034c6ed7 3154 case SOCKET_START_POST:
cfc4eb4c 3155 if (f == SOCKET_SUCCESS)
e9af15c3 3156 socket_enter_listening(s);
034c6ed7 3157 else
cfc4eb4c 3158 socket_enter_stop_pre(s, f);
034c6ed7
LP		 3159 break;
3160
3161 case SOCKET_STOP_PRE:
3162 case SOCKET_STOP_PRE_SIGTERM:
3163 case SOCKET_STOP_PRE_SIGKILL:
cfc4eb4c 3164 socket_enter_stop_post(s, f);
034c6ed7
LP		 3165 break;
3166
3167 case SOCKET_STOP_POST:
80876c20
LP		 3168 case SOCKET_FINAL_SIGTERM:
3169 case SOCKET_FINAL_SIGKILL:
cfc4eb4c 3170 socket_enter_dead(s, f);
034c6ed7
LP		 3171 break;
3172
c968d76a
YW		 3173 case SOCKET_CLEANING:
3174
3175 if (s->clean_result == SOCKET_SUCCESS)
3176 s->clean_result = f;
3177
3178 socket_enter_dead(s, SOCKET_SUCCESS);
3179 break;
3180
034c6ed7 3181 default:
04499a70 3182 assert_not_reached();
034c6ed7
LP		 3183 }
3184 }
c4e2ceae
LP		 3185
3186 /* Notify clients about changed exit status */
3187 unit_add_to_dbus_queue(u);
034c6ed7 3188}
5cb5a6ff 3189
718db961
LP		 3190static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata) {
3191 Socket *s = SOCKET(userdata);
5cb5a6ff 3192
034c6ed7 3193 assert(s);
718db961 3194 assert(s->timer_event_source == source);
034c6ed7
LP		 3195
3196 switch (s->state) {
3197
3198 case SOCKET_START_PRE:
f2341e0a 3199 log_unit_warning(UNIT(s), "Starting timed out. Terminating.");
cfc4eb4c 3200 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
da19d5c1 3201 break;
80876c20 3202
3900e5fd 3203 case SOCKET_START_CHOWN:
034c6ed7 3204 case SOCKET_START_POST:
f2341e0a 3205 log_unit_warning(UNIT(s), "Starting timed out. Stopping.");
cfc4eb4c 3206 socket_enter_stop_pre(s, SOCKET_FAILURE_TIMEOUT);
034c6ed7
LP		 3207 break;
3208
3209 case SOCKET_STOP_PRE:
f2341e0a 3210 log_unit_warning(UNIT(s), "Stopping timed out. Terminating.");
cfc4eb4c 3211 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_FAILURE_TIMEOUT);
034c6ed7
LP		 3212 break;
3213
3214 case SOCKET_STOP_PRE_SIGTERM:
4819ff03 3215 if (s->kill_context.send_sigkill) {
f2341e0a 3216 log_unit_warning(UNIT(s), "Stopping timed out. Killing.");
cfc4eb4c 3217 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
ba035df2 3218 } else {
f2341e0a 3219 log_unit_warning(UNIT(s), "Stopping timed out. Skipping SIGKILL. Ignoring.");
cfc4eb4c 3220 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
ba035df2 3221 }
034c6ed7
LP		 3222 break;
3223
3224 case SOCKET_STOP_PRE_SIGKILL:
f2341e0a 3225 log_unit_warning(UNIT(s), "Processes still around after SIGKILL. Ignoring.");
cfc4eb4c 3226 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
034c6ed7
LP		 3227 break;
3228
3229 case SOCKET_STOP_POST:
f2341e0a 3230 log_unit_warning(UNIT(s), "Stopping timed out (2). Terminating.");
cfc4eb4c 3231 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
034c6ed7
LP		 3232 break;
3233
80876c20 3234 case SOCKET_FINAL_SIGTERM:
4819ff03 3235 if (s->kill_context.send_sigkill) {
f2341e0a 3236 log_unit_warning(UNIT(s), "Stopping timed out (2). Killing.");
cfc4eb4c 3237 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
ba035df2 3238 } else {
f2341e0a 3239 log_unit_warning(UNIT(s), "Stopping timed out (2). Skipping SIGKILL. Ignoring.");
cfc4eb4c 3240 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
ba035df2 3241 }
034c6ed7
LP		 3242 break;
3243
80876c20 3244 case SOCKET_FINAL_SIGKILL:
f2341e0a 3245 log_unit_warning(UNIT(s), "Still around after SIGKILL (2). Entering failed mode.");
cfc4eb4c 3246 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
034c6ed7
LP		 3247 break;
3248
c968d76a
YW		 3249 case SOCKET_CLEANING:
3250 log_unit_warning(UNIT(s), "Cleaning timed out. killing.");
3251
3252 if (s->clean_result == SOCKET_SUCCESS)
3253 s->clean_result = SOCKET_FAILURE_TIMEOUT;
3254
3255 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, 0);
3256 break;
3257
034c6ed7 3258 default:
04499a70 3259 assert_not_reached();
034c6ed7 3260 }
718db961
LP		 3261
3262 return 0;
5cb5a6ff
LP		 3263}
3264
79c7626d 3265int socket_collect_fds(Socket *s, int **fds) {
da6053d0 3266 size_t k = 0, n = 0;
da6053d0 3267 int *rfds;
44d8db9e
LP		 3268
3269 assert(s);
3270 assert(fds);
44d8db9e
LP		 3271
3272 /* Called from the service code for requesting our fds */
3273
15087cdb 3274 LIST_FOREACH(port, p, s->ports) {
44d8db9e 3275 if (p->fd >= 0)
79c7626d
LP		 3276 n++;
3277 n += p->n_auxiliary_fds;
15087cdb 3278 }
44d8db9e 3279
79c7626d 3280 if (n <= 0) {
de3756ab 3281 *fds = NULL;
de3756ab
LP		 3282 return 0;
3283 }
3284
79c7626d 3285 rfds = new(int, n);
e5403f09 3286 if (!rfds)
44d8db9e
LP		 3287 return -ENOMEM;
3288
15087cdb 3289 LIST_FOREACH(port, p, s->ports) {
44d8db9e
LP		 3290 if (p->fd >= 0)
3291 rfds[k++] = p->fd;
6c1abe88 3292 for (size_t i = 0; i < p->n_auxiliary_fds; ++i)
15087cdb
PS		 3293 rfds[k++] = p->auxiliary_fds[i];
3294 }
44d8db9e 3295
79c7626d 3296 assert(k == n);
44d8db9e
LP		 3297
3298 *fds = rfds;
da6053d0 3299 return (int) n;
44d8db9e
LP		 3300}
3301
e821075a
LP		 3302static void socket_reset_failed(Unit *u) {
3303 Socket *s = SOCKET(u);
3304
3305 assert(s);
3306
3307 if (s->state == SOCKET_FAILED)
3308 socket_set_state(s, SOCKET_DEAD);
3309
3310 s->result = SOCKET_SUCCESS;
c968d76a 3311 s->clean_result = SOCKET_SUCCESS;
e821075a
LP		 3312}
3313
6cf6bbc2
LP		 3314void socket_connection_unref(Socket *s) {
3315 assert(s);
3316
3317 /* The service is dead. Yay!
3318 *
35b8ca3a 3319 * This is strictly for one-instance-per-connection
6cf6bbc2
LP		 3320 * services. */
3321
3322 assert(s->n_connections > 0);
3323 s->n_connections--;
3324
f2341e0a 3325 log_unit_debug(UNIT(s), "One connection closed, %u left.", s->n_connections);
5632e374
LP		 3326}
3327
d137a488
UTL		 3328static void socket_trigger_notify(Unit *u, Unit *other) {
3329 Socket *s = SOCKET(u);
d137a488
UTL		 3330
3331 assert(u);
3332 assert(other);
3333
d14e3a0d 3334 /* Filter out invocations with bogus state */
0377cd29
LP		 3335 assert(UNIT_IS_LOAD_COMPLETE(other->load_state));
3336 assert(other->type == UNIT_SERVICE);
d14e3a0d
LP		 3337
3338 /* Don't propagate state changes from the service if we are already down */
3339 if (!IN_SET(s->state, SOCKET_RUNNING, SOCKET_LISTENING))
d137a488
UTL		 3340 return;
3341
d14e3a0d
LP		 3342 /* We don't care for the service state if we are in Accept=yes mode */
3343 if (s->accept)
3344 return;
3345
3346 /* Propagate start limit hit state */
6bf0f408
LP		 3347 if (other->start_limit_hit) {
3348 socket_enter_stop_pre(s, SOCKET_FAILURE_SERVICE_START_LIMIT_HIT);
d137a488 3349 return;
6bf0f408 3350 }
d137a488 3351
d14e3a0d
LP		 3352 /* Don't propagate anything if there's still a job queued */
3353 if (other->job)
6bf0f408 3354 return;
d137a488 3355
6bf0f408 3356 if (IN_SET(SERVICE(other)->state,
a1d31573 3357 SERVICE_DEAD, SERVICE_DEAD_BEFORE_AUTO_RESTART, SERVICE_FAILED, SERVICE_FAILED_BEFORE_AUTO_RESTART,
6bf0f408
LP		 3358 SERVICE_FINAL_SIGTERM, SERVICE_FINAL_SIGKILL,
3359 SERVICE_AUTO_RESTART))
3360 socket_enter_listening(s);
d137a488 3361
6bf0f408 3362 if (SERVICE(other)->state == SERVICE_RUNNING)
d137a488
UTL		 3363 socket_set_state(s, SOCKET_RUNNING);
3364}
3365
a721cd00
LP		 3366static int socket_kill(Unit *u, KillWho who, int signo, int code, int value, sd_bus_error *error) {
3367 return unit_kill_common(u, who, signo, code, value, -1, SOCKET(u)->control_pid, error);
8a0867d6
LP		 3368}
3369
7a7821c8 3370static int socket_get_timeout(Unit *u, usec_t *timeout) {
68db7a3b 3371 Socket *s = SOCKET(u);
7a7821c8 3372 usec_t t;
68db7a3b
ZJS		 3373 int r;
3374
3375 if (!s->timer_event_source)
3376 return 0;
3377
7a7821c8 3378 r = sd_event_source_get_time(s->timer_event_source, &t);
68db7a3b
ZJS		 3379 if (r < 0)
3380 return r;
7a7821c8
LP		 3381 if (t == USEC_INFINITY)
3382 return 0;
68db7a3b 3383
7a7821c8 3384 *timeout = t;
68db7a3b
ZJS		 3385 return 1;
3386}
3387
8dd4c05b
LP		 3388char *socket_fdname(Socket *s) {
3389 assert(s);
3390
3391 /* Returns the name to use for $LISTEN_NAMES. If the user
3392 * didn't specify anything specifically, use the socket unit's
3393 * name as fallback. */
3394
84500122 3395 return s->fdname ?: UNIT(s)->id;
8dd4c05b
LP		 3396}
3397
291d565a
LP		 3398static int socket_control_pid(Unit *u) {
3399 Socket *s = SOCKET(u);
3400
3401 assert(s);
3402
3403 return s->control_pid;
3404}
3405
c968d76a
YW		 3406static int socket_clean(Unit *u, ExecCleanMask mask) {
3407 _cleanup_strv_free_ char **l = NULL;
3408 Socket *s = SOCKET(u);
3409 int r;
3410
3411 assert(s);
3412 assert(mask != 0);
3413
3414 if (s->state != SOCKET_DEAD)
3415 return -EBUSY;
3416
3417 r = exec_context_get_clean_directories(&s->exec_context, u->manager->prefix, mask, &l);
3418 if (r < 0)
3419 return r;
3420
3421 if (strv_isempty(l))
3422 return -EUNATCH;
3423
3424 socket_unwatch_control_pid(s);
3425 s->clean_result = SOCKET_SUCCESS;
3426 s->control_command = NULL;
3427 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
3428
3429 r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->exec_context.timeout_clean_usec));
3430 if (r < 0)
3431 goto fail;
3432
3433 r = unit_fork_and_watch_rm_rf(u, l, &s->control_pid);
3434 if (r < 0)
3435 goto fail;
3436
3437 socket_set_state(s, SOCKET_CLEANING);
3438
3439 return 0;
3440
3441fail:
3442 log_unit_warning_errno(u, r, "Failed to initiate cleaning: %m");
3443 s->clean_result = SOCKET_FAILURE_RESOURCES;
5dcadb4c 3444 s->timer_event_source = sd_event_source_disable_unref(s->timer_event_source);
c968d76a
YW		 3445 return r;
3446}
3447
3448static int socket_can_clean(Unit *u, ExecCleanMask *ret) {
3449 Socket *s = SOCKET(u);
3450
3451 assert(s);
3452
3453 return exec_context_get_clean_mask(&s->exec_context, ret);
3454}
3455
705578c3 3456static int socket_can_start(Unit *u) {
9727f242
DDM		 3457 Socket *s = SOCKET(u);
3458 int r;
3459
3460 assert(s);
3461
3462 r = unit_test_start_limit(u);
3463 if (r < 0) {
3464 socket_enter_dead(s, SOCKET_FAILURE_START_LIMIT_HIT);
3465 return r;
3466 }
3467
705578c3 3468 return 1;
9727f242
DDM		 3469}
3470
a16e1123 3471static const char* const socket_exec_command_table[_SOCKET_EXEC_COMMAND_MAX] = {
48d83e33 3472 [SOCKET_EXEC_START_PRE] = "ExecStartPre",
836bb1cd 3473 [SOCKET_EXEC_START_CHOWN] = "ExecStartChown",
48d83e33
ZJS		 3474 [SOCKET_EXEC_START_POST] = "ExecStartPost",
3475 [SOCKET_EXEC_STOP_PRE] = "ExecStopPre",
3476 [SOCKET_EXEC_STOP_POST] = "ExecStopPost"
a16e1123
LP		 3477};
3478
3479DEFINE_STRING_TABLE_LOOKUP(socket_exec_command, SocketExecCommand);
3480
cfc4eb4c 3481static const char* const socket_result_table[_SOCKET_RESULT_MAX] = {
40f41f34
DDM		 3482 [SOCKET_SUCCESS] = "success",
3483 [SOCKET_FAILURE_RESOURCES] = "resources",
3484 [SOCKET_FAILURE_TIMEOUT] = "timeout",
3485 [SOCKET_FAILURE_EXIT_CODE] = "exit-code",
3486 [SOCKET_FAILURE_SIGNAL] = "signal",
3487 [SOCKET_FAILURE_CORE_DUMP] = "core-dump",
3488 [SOCKET_FAILURE_START_LIMIT_HIT] = "start-limit-hit",
3489 [SOCKET_FAILURE_TRIGGER_LIMIT_HIT] = "trigger-limit-hit",
3490 [SOCKET_FAILURE_SERVICE_START_LIMIT_HIT] = "service-start-limit-hit"
cfc4eb4c
LP		 3491};
3492
3493DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
3494
9b191525
LP		 3495static const char* const socket_timestamping_table[_SOCKET_TIMESTAMPING_MAX] = {
3496 [SOCKET_TIMESTAMPING_OFF] = "off",
48d83e33
ZJS		 3497 [SOCKET_TIMESTAMPING_US] = "us",
3498 [SOCKET_TIMESTAMPING_NS] = "ns",
9b191525
LP		 3499};
3500
3501DEFINE_STRING_TABLE_LOOKUP(socket_timestamping, SocketTimestamping);
3502
3503SocketTimestamping socket_timestamping_from_string_harder(const char *p) {
3504 SocketTimestamping t;
3505 int r;
3506
3507 if (!p)
3508 return _SOCKET_TIMESTAMPING_INVALID;
3509
3510 t = socket_timestamping_from_string(p);
3511 if (t >= 0)
3512 return t;
3513
3514 /* Let's alternatively support the various other aliases parse_time() accepts for ns and µs here,
3515 * too. */
3516 if (streq(p, "nsec"))
3517 return SOCKET_TIMESTAMPING_NS;
d0a6d7c4 3518 if (STR_IN_SET(p, "usec", "µs", "μs")) /* Accept both small greek letter mu + micro sign unicode codepoints */
9b191525
LP		 3519 return SOCKET_TIMESTAMPING_US;
3520
3521 r = parse_boolean(p);
3522 if (r < 0)
3523 return _SOCKET_TIMESTAMPING_INVALID;
3524
3525 return r ? SOCKET_TIMESTAMPING_NS : SOCKET_TIMESTAMPING_OFF; /* If boolean yes, default to ns accuracy */
3526}
3527
87f0e418 3528const UnitVTable socket_vtable = {
7d17cfbc 3529 .object_size = sizeof(Socket),
718db961
LP		 3530 .exec_context_offset = offsetof(Socket, exec_context),
3531 .cgroup_context_offset = offsetof(Socket, cgroup_context),
3532 .kill_context_offset = offsetof(Socket, kill_context),
613b411c 3533 .exec_runtime_offset = offsetof(Socket, exec_runtime),
3ef63c31 3534
f975e971
LP		 3535 .sections =
3536 "Unit\0"
3537 "Socket\0"
3538 "Install\0",
4ad49000 3539 .private_section = "Socket",
71645aca 3540
9c0320e7 3541 .can_transient = true,
c80a9a33
LP		 3542 .can_trigger = true,
3543 .can_fail = true,
9c0320e7 3544
034c6ed7
LP		 3545 .init = socket_init,
3546 .done = socket_done,
a16e1123
LP		 3547 .load = socket_load,
3548
3549 .coldplug = socket_coldplug,
034c6ed7 3550
5cb5a6ff
LP		 3551 .dump = socket_dump,
3552
542563ba
LP		 3553 .start = socket_start,
3554 .stop = socket_stop,
5cb5a6ff 3555
718db961 3556 .kill = socket_kill,
c968d76a
YW		 3557 .clean = socket_clean,
3558 .can_clean = socket_can_clean,
718db961 3559
68db7a3b
ZJS		 3560 .get_timeout = socket_get_timeout,
3561
a16e1123
LP		 3562 .serialize = socket_serialize,
3563 .deserialize_item = socket_deserialize_item,
01e10de3 3564 .distribute_fds = socket_distribute_fds,
a16e1123 3565
5cb5a6ff 3566 .active_state = socket_active_state,
10a94420 3567 .sub_state_to_string = socket_sub_state_to_string,
5cb5a6ff 3568
52a12341
YW		 3569 .will_restart = unit_will_restart_default,
3570
f2f725e5 3571 .may_gc = socket_may_gc,
6cf6bbc2 3572
034c6ed7 3573 .sigchld_event = socket_sigchld_event,
4139c1b2 3574
d137a488
UTL		 3575 .trigger_notify = socket_trigger_notify,
3576
fdf20a31 3577 .reset_failed = socket_reset_failed,
5632e374 3578
291d565a
LP		 3579 .control_pid = socket_control_pid,
3580
74c964d3
LP		 3581 .bus_set_property = bus_socket_set_property,
3582 .bus_commit_properties = bus_socket_commit_properties,
c6918296
MS		 3583
3584 .status_message_formats = {
c6918296
MS		 3585 .finished_start_job = {
3586 [JOB_DONE] = "Listening on %s.",
3587 [JOB_FAILED] = "Failed to listen on %s.",
c6918296
MS		 3588 [JOB_TIMEOUT] = "Timed out starting %s.",
3589 },
3590 .finished_stop_job = {
3591 [JOB_DONE] = "Closed %s.",
3592 [JOB_FAILED] = "Failed stopping %s.",
3593 [JOB_TIMEOUT] = "Timed out stopping %s.",
3594 },
3595 },
9727f242 3596
705578c3 3597 .can_start = socket_can_start,
5cb5a6ff 3598};
Unnamed repository; edit this file 'description' to name the repository.