src/basic/socket-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6 ***/
   7
   8 #include <arpa/inet.h>
   9 #include <errno.h>
  10 #include <limits.h>
  11 #include <net/if.h>
  12 #include <netdb.h>
  13 #include <netinet/ip.h>
  14 #include <poll.h>
  15 #include <stddef.h>
  16 #include <stdint.h>
  17 #include <stdio.h>
  18 #include <stdlib.h>
  19 #include <string.h>
  20 #include <unistd.h>
  21
  22 #include "alloc-util.h"
  23 #include "fd-util.h"
  24 #include "fileio.h"
  25 #include "format-util.h"
  26 #include "log.h"
  27 #include "macro.h"
  28 #include "missing.h"
  29 #include "parse-util.h"
  30 #include "path-util.h"
  31 #include "process-util.h"
  32 #include "socket-util.h"
  33 #include "string-table.h"
  34 #include "string-util.h"
  35 #include "strv.h"
  36 #include "user-util.h"
  37 #include "utf8.h"
  38 #include "util.h"
  39
  40 #if ENABLE_IDN
  41 #  define IDN_FLAGS NI_IDN
  42 #else
  43 #  define IDN_FLAGS 0
  44 #endif
  45
  46 static const char* const socket_address_type_table[] = {
  47         [SOCK_STREAM] = "Stream",
  48         [SOCK_DGRAM] = "Datagram",
  49         [SOCK_RAW] = "Raw",
  50         [SOCK_RDM] = "ReliableDatagram",
  51         [SOCK_SEQPACKET] = "SequentialPacket",
  52         [SOCK_DCCP] = "DatagramCongestionControl",
  53 };
  54
  55 DEFINE_STRING_TABLE_LOOKUP(socket_address_type, int);
  56
  57 int socket_address_parse(SocketAddress *a, const char *s) {
  58         char *e, *n;
  59         int r;
  60
  61         assert(a);
  62         assert(s);
  63
  64         zero(*a);
  65         a->type = SOCK_STREAM;
  66
  67         if (*s == '[') {
  68                 uint16_t port;
  69
  70                 /* IPv6 in [x:.....:z]:p notation */
  71
  72                 e = strchr(s+1, ']');
  73                 if (!e)
  74                         return -EINVAL;
  75
  76                 n = strndupa(s+1, e-s-1);
  77
  78                 errno = 0;
  79                 if (inet_pton(AF_INET6, n, &a->sockaddr.in6.sin6_addr) <= 0)
  80                         return errno > 0 ? -errno : -EINVAL;
  81
  82                 e++;
  83                 if (*e != ':')
  84                         return -EINVAL;
  85
  86                 e++;
  87                 r = parse_ip_port(e, &port);
  88                 if (r < 0)
  89                         return r;
  90
  91                 a->sockaddr.in6.sin6_family = AF_INET6;
  92                 a->sockaddr.in6.sin6_port = htobe16(port);
  93                 a->size = sizeof(struct sockaddr_in6);
  94
  95         } else if (*s == '/') {
  96                 /* AF_UNIX socket */
  97
  98                 size_t l;
  99
 100                 l = strlen(s);
 101                 if (l >= sizeof(a->sockaddr.un.sun_path))
 102                         return -EINVAL;
 103
 104                 a->sockaddr.un.sun_family = AF_UNIX;
 105                 memcpy(a->sockaddr.un.sun_path, s, l);
 106                 a->size = offsetof(struct sockaddr_un, sun_path) + l + 1;
 107
 108         } else if (*s == '@') {
 109                 /* Abstract AF_UNIX socket */
 110                 size_t l;
 111
 112                 l = strlen(s+1);
 113                 if (l >= sizeof(a->sockaddr.un.sun_path) - 1)
 114                         return -EINVAL;
 115
 116                 a->sockaddr.un.sun_family = AF_UNIX;
 117                 memcpy(a->sockaddr.un.sun_path+1, s+1, l);
 118                 a->size = offsetof(struct sockaddr_un, sun_path) + 1 + l;
 119
 120         } else if (startswith(s, "vsock:")) {
 121                 /* AF_VSOCK socket in vsock:cid:port notation */
 122                 const char *cid_start = s + STRLEN("vsock:");
 123                 unsigned port;
 124
 125                 e = strchr(cid_start, ':');
 126                 if (!e)
 127                         return -EINVAL;
 128
 129                 r = safe_atou(e+1, &port);
 130                 if (r < 0)
 131                         return r;
 132
 133                 n = strndupa(cid_start, e - cid_start);
 134                 if (!isempty(n)) {
 135                         r = safe_atou(n, &a->sockaddr.vm.svm_cid);
 136                         if (r < 0)
 137                                 return r;
 138                 } else
 139                         a->sockaddr.vm.svm_cid = VMADDR_CID_ANY;
 140
 141                 a->sockaddr.vm.svm_family = AF_VSOCK;
 142                 a->sockaddr.vm.svm_port = port;
 143                 a->size = sizeof(struct sockaddr_vm);
 144
 145         } else {
 146                 uint16_t port;
 147
 148                 e = strchr(s, ':');
 149                 if (e) {
 150                         r = parse_ip_port(e + 1, &port);
 151                         if (r < 0)
 152                                 return r;
 153
 154                         n = strndupa(s, e-s);
 155
 156                         /* IPv4 in w.x.y.z:p notation? */
 157                         r = inet_pton(AF_INET, n, &a->sockaddr.in.sin_addr);
 158                         if (r < 0)
 159                                 return -errno;
 160
 161                         if (r > 0) {
 162                                 /* Gotcha, it's a traditional IPv4 address */
 163                                 a->sockaddr.in.sin_family = AF_INET;
 164                                 a->sockaddr.in.sin_port = htobe16(port);
 165                                 a->size = sizeof(struct sockaddr_in);
 166                         } else {
 167                                 unsigned idx;
 168
 169                                 if (strlen(n) > IF_NAMESIZE-1)
 170                                         return -EINVAL;
 171
 172                                 /* Uh, our last resort, an interface name */
 173                                 idx = if_nametoindex(n);
 174                                 if (idx == 0)
 175                                         return -EINVAL;
 176
 177                                 a->sockaddr.in6.sin6_family = AF_INET6;
 178                                 a->sockaddr.in6.sin6_port = htobe16(port);
 179                                 a->sockaddr.in6.sin6_scope_id = idx;
 180                                 a->sockaddr.in6.sin6_addr = in6addr_any;
 181                                 a->size = sizeof(struct sockaddr_in6);
 182                         }
 183                 } else {
 184
 185                         /* Just a port */
 186                         r = parse_ip_port(s, &port);
 187                         if (r < 0)
 188                                 return r;
 189
 190                         if (socket_ipv6_is_supported()) {
 191                                 a->sockaddr.in6.sin6_family = AF_INET6;
 192                                 a->sockaddr.in6.sin6_port = htobe16(port);
 193                                 a->sockaddr.in6.sin6_addr = in6addr_any;
 194                                 a->size = sizeof(struct sockaddr_in6);
 195                         } else {
 196                                 a->sockaddr.in.sin_family = AF_INET;
 197                                 a->sockaddr.in.sin_port = htobe16(port);
 198                                 a->sockaddr.in.sin_addr.s_addr = INADDR_ANY;
 199                                 a->size = sizeof(struct sockaddr_in);
 200                         }
 201                 }
 202         }
 203
 204         return 0;
 205 }
 206
 207 int socket_address_parse_and_warn(SocketAddress *a, const char *s) {
 208         SocketAddress b;
 209         int r;
 210
 211         /* Similar to socket_address_parse() but warns for IPv6 sockets when we don't support them. */
 212
 213         r = socket_address_parse(&b, s);
 214         if (r < 0)
 215                 return r;
 216
 217         if (!socket_ipv6_is_supported() && b.sockaddr.sa.sa_family == AF_INET6) {
 218                 log_warning("Binding to IPv6 address not available since kernel does not support IPv6.");
 219                 return -EAFNOSUPPORT;
 220         }
 221
 222         *a = b;
 223         return 0;
 224 }
 225
 226 int socket_address_parse_netlink(SocketAddress *a, const char *s) {
 227         int family;
 228         unsigned group = 0;
 229         _cleanup_free_ char *sfamily = NULL;
 230         assert(a);
 231         assert(s);
 232
 233         zero(*a);
 234         a->type = SOCK_RAW;
 235
 236         errno = 0;
 237         if (sscanf(s, "%ms %u", &sfamily, &group) < 1)
 238                 return errno > 0 ? -errno : -EINVAL;
 239
 240         family = netlink_family_from_string(sfamily);
 241         if (family < 0)
 242                 return -EINVAL;
 243
 244         a->sockaddr.nl.nl_family = AF_NETLINK;
 245         a->sockaddr.nl.nl_groups = group;
 246
 247         a->type = SOCK_RAW;
 248         a->size = sizeof(struct sockaddr_nl);
 249         a->protocol = family;
 250
 251         return 0;
 252 }
 253
 254 int socket_address_verify(const SocketAddress *a) {
 255         assert(a);
 256
 257         switch (socket_address_family(a)) {
 258
 259         case AF_INET:
 260                 if (a->size != sizeof(struct sockaddr_in))
 261                         return -EINVAL;
 262
 263                 if (a->sockaddr.in.sin_port == 0)
 264                         return -EINVAL;
 265
 266                 if (!IN_SET(a->type, SOCK_STREAM, SOCK_DGRAM))
 267                         return -EINVAL;
 268
 269                 return 0;
 270
 271         case AF_INET6:
 272                 if (a->size != sizeof(struct sockaddr_in6))
 273                         return -EINVAL;
 274
 275                 if (a->sockaddr.in6.sin6_port == 0)
 276                         return -EINVAL;
 277
 278                 if (!IN_SET(a->type, SOCK_STREAM, SOCK_DGRAM))
 279                         return -EINVAL;
 280
 281                 return 0;
 282
 283         case AF_UNIX:
 284                 if (a->size < offsetof(struct sockaddr_un, sun_path))
 285                         return -EINVAL;
 286
 287                 if (a->size > offsetof(struct sockaddr_un, sun_path)) {
 288
 289                         if (a->sockaddr.un.sun_path[0] != 0) {
 290                                 char *e;
 291
 292                                 /* path */
 293                                 e = memchr(a->sockaddr.un.sun_path, 0, sizeof(a->sockaddr.un.sun_path));
 294                                 if (!e)
 295                                         return -EINVAL;
 296
 297                                 if (a->size != offsetof(struct sockaddr_un, sun_path) + (e - a->sockaddr.un.sun_path) + 1)
 298                                         return -EINVAL;
 299                         }
 300                 }
 301
 302                 if (!IN_SET(a->type, SOCK_STREAM, SOCK_DGRAM, SOCK_SEQPACKET))
 303                         return -EINVAL;
 304
 305                 return 0;
 306
 307         case AF_NETLINK:
 308
 309                 if (a->size != sizeof(struct sockaddr_nl))
 310                         return -EINVAL;
 311
 312                 if (!IN_SET(a->type, SOCK_RAW, SOCK_DGRAM))
 313                         return -EINVAL;
 314
 315                 return 0;
 316
 317         case AF_VSOCK:
 318                 if (a->size != sizeof(struct sockaddr_vm))
 319                         return -EINVAL;
 320
 321                 if (!IN_SET(a->type, SOCK_STREAM, SOCK_DGRAM))
 322                         return -EINVAL;
 323
 324                 return 0;
 325
 326         default:
 327                 return -EAFNOSUPPORT;
 328         }
 329 }
 330
 331 int socket_address_print(const SocketAddress *a, char **ret) {
 332         int r;
 333
 334         assert(a);
 335         assert(ret);
 336
 337         r = socket_address_verify(a);
 338         if (r < 0)
 339                 return r;
 340
 341         if (socket_address_family(a) == AF_NETLINK) {
 342                 _cleanup_free_ char *sfamily = NULL;
 343
 344                 r = netlink_family_to_string_alloc(a->protocol, &sfamily);
 345                 if (r < 0)
 346                         return r;
 347
 348                 r = asprintf(ret, "%s %u", sfamily, a->sockaddr.nl.nl_groups);
 349                 if (r < 0)
 350                         return -ENOMEM;
 351
 352                 return 0;
 353         }
 354
 355         return sockaddr_pretty(&a->sockaddr.sa, a->size, false, true, ret);
 356 }
 357
 358 bool socket_address_can_accept(const SocketAddress *a) {
 359         assert(a);
 360
 361         return
 362                 IN_SET(a->type, SOCK_STREAM, SOCK_SEQPACKET);
 363 }
 364
 365 bool socket_address_equal(const SocketAddress *a, const SocketAddress *b) {
 366         assert(a);
 367         assert(b);
 368
 369         /* Invalid addresses are unequal to all */
 370         if (socket_address_verify(a) < 0 ||
 371             socket_address_verify(b) < 0)
 372                 return false;
 373
 374         if (a->type != b->type)
 375                 return false;
 376
 377         if (socket_address_family(a) != socket_address_family(b))
 378                 return false;
 379
 380         switch (socket_address_family(a)) {
 381
 382         case AF_INET:
 383                 if (a->sockaddr.in.sin_addr.s_addr != b->sockaddr.in.sin_addr.s_addr)
 384                         return false;
 385
 386                 if (a->sockaddr.in.sin_port != b->sockaddr.in.sin_port)
 387                         return false;
 388
 389                 break;
 390
 391         case AF_INET6:
 392                 if (memcmp(&a->sockaddr.in6.sin6_addr, &b->sockaddr.in6.sin6_addr, sizeof(a->sockaddr.in6.sin6_addr)) != 0)
 393                         return false;
 394
 395                 if (a->sockaddr.in6.sin6_port != b->sockaddr.in6.sin6_port)
 396                         return false;
 397
 398                 break;
 399
 400         case AF_UNIX:
 401                 if (a->size <= offsetof(struct sockaddr_un, sun_path) ||
 402                     b->size <= offsetof(struct sockaddr_un, sun_path))
 403                         return false;
 404
 405                 if ((a->sockaddr.un.sun_path[0] == 0) != (b->sockaddr.un.sun_path[0] == 0))
 406                         return false;
 407
 408                 if (a->sockaddr.un.sun_path[0]) {
 409                         if (!path_equal_or_files_same(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, 0))
 410                                 return false;
 411                 } else {
 412                         if (a->size != b->size)
 413                                 return false;
 414
 415                         if (memcmp(a->sockaddr.un.sun_path, b->sockaddr.un.sun_path, a->size) != 0)
 416                                 return false;
 417                 }
 418
 419                 break;
 420
 421         case AF_NETLINK:
 422                 if (a->protocol != b->protocol)
 423                         return false;
 424
 425                 if (a->sockaddr.nl.nl_groups != b->sockaddr.nl.nl_groups)
 426                         return false;
 427
 428                 break;
 429
 430         case AF_VSOCK:
 431                 if (a->sockaddr.vm.svm_cid != b->sockaddr.vm.svm_cid)
 432                         return false;
 433
 434                 if (a->sockaddr.vm.svm_port != b->sockaddr.vm.svm_port)
 435                         return false;
 436
 437                 break;
 438
 439         default:
 440                 /* Cannot compare, so we assume the addresses are different */
 441                 return false;
 442         }
 443
 444         return true;
 445 }
 446
 447 bool socket_address_is(const SocketAddress *a, const char *s, int type) {
 448         struct SocketAddress b;
 449
 450         assert(a);
 451         assert(s);
 452
 453         if (socket_address_parse(&b, s) < 0)
 454                 return false;
 455
 456         b.type = type;
 457
 458         return socket_address_equal(a, &b);
 459 }
 460
 461 bool socket_address_is_netlink(const SocketAddress *a, const char *s) {
 462         struct SocketAddress b;
 463
 464         assert(a);
 465         assert(s);
 466
 467         if (socket_address_parse_netlink(&b, s) < 0)
 468                 return false;
 469
 470         return socket_address_equal(a, &b);
 471 }
 472
 473 const char* socket_address_get_path(const SocketAddress *a) {
 474         assert(a);
 475
 476         if (socket_address_family(a) != AF_UNIX)
 477                 return NULL;
 478
 479         if (a->sockaddr.un.sun_path[0] == 0)
 480                 return NULL;
 481
 482         return a->sockaddr.un.sun_path;
 483 }
 484
 485 bool socket_ipv6_is_supported(void) {
 486         if (access("/proc/net/if_inet6", F_OK) != 0)
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 bool socket_address_matches_fd(const SocketAddress *a, int fd) {
 493         SocketAddress b;
 494         socklen_t solen;
 495
 496         assert(a);
 497         assert(fd >= 0);
 498
 499         b.size = sizeof(b.sockaddr);
 500         if (getsockname(fd, &b.sockaddr.sa, &b.size) < 0)
 501                 return false;
 502
 503         if (b.sockaddr.sa.sa_family != a->sockaddr.sa.sa_family)
 504                 return false;
 505
 506         solen = sizeof(b.type);
 507         if (getsockopt(fd, SOL_SOCKET, SO_TYPE, &b.type, &solen) < 0)
 508                 return false;
 509
 510         if (b.type != a->type)
 511                 return false;
 512
 513         if (a->protocol != 0)  {
 514                 solen = sizeof(b.protocol);
 515                 if (getsockopt(fd, SOL_SOCKET, SO_PROTOCOL, &b.protocol, &solen) < 0)
 516                         return false;
 517
 518                 if (b.protocol != a->protocol)
 519                         return false;
 520         }
 521
 522         return socket_address_equal(a, &b);
 523 }
 524
 525 int sockaddr_port(const struct sockaddr *_sa, unsigned *ret_port) {
 526         union sockaddr_union *sa = (union sockaddr_union*) _sa;
 527
 528         /* Note, this returns the port as 'unsigned' rather than 'uint16_t', as AF_VSOCK knows larger ports */
 529
 530         assert(sa);
 531
 532         switch (sa->sa.sa_family) {
 533
 534         case AF_INET:
 535                 *ret_port = be16toh(sa->in.sin_port);
 536                 return 0;
 537
 538         case AF_INET6:
 539                 *ret_port = be16toh(sa->in6.sin6_port);
 540                 return 0;
 541
 542         case AF_VSOCK:
 543                 *ret_port = sa->vm.svm_port;
 544                 return 0;
 545
 546         default:
 547                 return -EAFNOSUPPORT;
 548         }
 549 }
 550
 551 int sockaddr_pretty(const struct sockaddr *_sa, socklen_t salen, bool translate_ipv6, bool include_port, char **ret) {
 552         union sockaddr_union *sa = (union sockaddr_union*) _sa;
 553         char *p;
 554         int r;
 555
 556         assert(sa);
 557         assert(salen >= sizeof(sa->sa.sa_family));
 558
 559         switch (sa->sa.sa_family) {
 560
 561         case AF_INET: {
 562                 uint32_t a;
 563
 564                 a = be32toh(sa->in.sin_addr.s_addr);
 565
 566                 if (include_port)
 567                         r = asprintf(&p,
 568                                      "%u.%u.%u.%u:%u",
 569                                      a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
 570                                      be16toh(sa->in.sin_port));
 571                 else
 572                         r = asprintf(&p,
 573                                      "%u.%u.%u.%u",
 574                                      a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF);
 575                 if (r < 0)
 576                         return -ENOMEM;
 577                 break;
 578         }
 579
 580         case AF_INET6: {
 581                 static const unsigned char ipv4_prefix[] = {
 582                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
 583                 };
 584
 585                 if (translate_ipv6 &&
 586                     memcmp(&sa->in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
 587                         const uint8_t *a = sa->in6.sin6_addr.s6_addr+12;
 588                         if (include_port)
 589                                 r = asprintf(&p,
 590                                              "%u.%u.%u.%u:%u",
 591                                              a[0], a[1], a[2], a[3],
 592                                              be16toh(sa->in6.sin6_port));
 593                         else
 594                                 r = asprintf(&p,
 595                                              "%u.%u.%u.%u",
 596                                              a[0], a[1], a[2], a[3]);
 597                         if (r < 0)
 598                                 return -ENOMEM;
 599                 } else {
 600                         char a[INET6_ADDRSTRLEN];
 601
 602                         inet_ntop(AF_INET6, &sa->in6.sin6_addr, a, sizeof(a));
 603
 604                         if (include_port) {
 605                                 r = asprintf(&p,
 606                                              "[%s]:%u",
 607                                              a,
 608                                              be16toh(sa->in6.sin6_port));
 609                                 if (r < 0)
 610                                         return -ENOMEM;
 611                         } else {
 612                                 p = strdup(a);
 613                                 if (!p)
 614                                         return -ENOMEM;
 615                         }
 616                 }
 617
 618                 break;
 619         }
 620
 621         case AF_UNIX:
 622                 if (salen <= offsetof(struct sockaddr_un, sun_path)) {
 623                         p = strdup("<unnamed>");
 624                         if (!p)
 625                                 return -ENOMEM;
 626
 627                 } else if (sa->un.sun_path[0] == 0) {
 628                         /* abstract */
 629
 630                         /* FIXME: We assume we can print the
 631                          * socket path here and that it hasn't
 632                          * more than one NUL byte. That is
 633                          * actually an invalid assumption */
 634
 635                         p = new(char, sizeof(sa->un.sun_path)+1);
 636                         if (!p)
 637                                 return -ENOMEM;
 638
 639                         p[0] = '@';
 640                         memcpy(p+1, sa->un.sun_path+1, sizeof(sa->un.sun_path)-1);
 641                         p[sizeof(sa->un.sun_path)] = 0;
 642
 643                 } else {
 644                         p = strndup(sa->un.sun_path, sizeof(sa->un.sun_path));
 645                         if (!p)
 646                                 return -ENOMEM;
 647                 }
 648
 649                 break;
 650
 651         case AF_VSOCK:
 652                 if (include_port)
 653                         r = asprintf(&p,
 654                                      "vsock:%u:%u",
 655                                      sa->vm.svm_cid,
 656                                      sa->vm.svm_port);
 657                 else
 658                         r = asprintf(&p, "vsock:%u", sa->vm.svm_cid);
 659                 if (r < 0)
 660                         return -ENOMEM;
 661                 break;
 662
 663         default:
 664                 return -EOPNOTSUPP;
 665         }
 666
 667
 668         *ret = p;
 669         return 0;
 670 }
 671
 672 int getpeername_pretty(int fd, bool include_port, char **ret) {
 673         union sockaddr_union sa;
 674         socklen_t salen = sizeof(sa);
 675         int r;
 676
 677         assert(fd >= 0);
 678         assert(ret);
 679
 680         if (getpeername(fd, &sa.sa, &salen) < 0)
 681                 return -errno;
 682
 683         if (sa.sa.sa_family == AF_UNIX) {
 684                 struct ucred ucred = {};
 685
 686                 /* UNIX connection sockets are anonymous, so let's use
 687                  * PID/UID as pretty credentials instead */
 688
 689                 r = getpeercred(fd, &ucred);
 690                 if (r < 0)
 691                         return r;
 692
 693                 if (asprintf(ret, "PID "PID_FMT"/UID "UID_FMT, ucred.pid, ucred.uid) < 0)
 694                         return -ENOMEM;
 695
 696                 return 0;
 697         }
 698
 699         /* For remote sockets we translate IPv6 addresses back to IPv4
 700          * if applicable, since that's nicer. */
 701
 702         return sockaddr_pretty(&sa.sa, salen, true, include_port, ret);
 703 }
 704
 705 int getsockname_pretty(int fd, char **ret) {
 706         union sockaddr_union sa;
 707         socklen_t salen = sizeof(sa);
 708
 709         assert(fd >= 0);
 710         assert(ret);
 711
 712         if (getsockname(fd, &sa.sa, &salen) < 0)
 713                 return -errno;
 714
 715         /* For local sockets we do not translate IPv6 addresses back
 716          * to IPv6 if applicable, since this is usually used for
 717          * listening sockets where the difference between IPv4 and
 718          * IPv6 matters. */
 719
 720         return sockaddr_pretty(&sa.sa, salen, false, true, ret);
 721 }
 722
 723 int socknameinfo_pretty(union sockaddr_union *sa, socklen_t salen, char **_ret) {
 724         int r;
 725         char host[NI_MAXHOST], *ret;
 726
 727         assert(_ret);
 728
 729         r = getnameinfo(&sa->sa, salen, host, sizeof(host), NULL, 0, IDN_FLAGS);
 730         if (r != 0) {
 731                 int saved_errno = errno;
 732
 733                 r = sockaddr_pretty(&sa->sa, salen, true, true, &ret);
 734                 if (r < 0)
 735                         return r;
 736
 737                 log_debug_errno(saved_errno, "getnameinfo(%s) failed: %m", ret);
 738         } else {
 739                 ret = strdup(host);
 740                 if (!ret)
 741                         return -ENOMEM;
 742         }
 743
 744         *_ret = ret;
 745         return 0;
 746 }
 747
 748 int socket_address_unlink(SocketAddress *a) {
 749         assert(a);
 750
 751         if (socket_address_family(a) != AF_UNIX)
 752                 return 0;
 753
 754         if (a->sockaddr.un.sun_path[0] == 0)
 755                 return 0;
 756
 757         if (unlink(a->sockaddr.un.sun_path) < 0)
 758                 return -errno;
 759
 760         return 1;
 761 }
 762
 763 static const char* const netlink_family_table[] = {
 764         [NETLINK_ROUTE] = "route",
 765         [NETLINK_FIREWALL] = "firewall",
 766         [NETLINK_INET_DIAG] = "inet-diag",
 767         [NETLINK_NFLOG] = "nflog",
 768         [NETLINK_XFRM] = "xfrm",
 769         [NETLINK_SELINUX] = "selinux",
 770         [NETLINK_ISCSI] = "iscsi",
 771         [NETLINK_AUDIT] = "audit",
 772         [NETLINK_FIB_LOOKUP] = "fib-lookup",
 773         [NETLINK_CONNECTOR] = "connector",
 774         [NETLINK_NETFILTER] = "netfilter",
 775         [NETLINK_IP6_FW] = "ip6-fw",
 776         [NETLINK_DNRTMSG] = "dnrtmsg",
 777         [NETLINK_KOBJECT_UEVENT] = "kobject-uevent",
 778         [NETLINK_GENERIC] = "generic",
 779         [NETLINK_SCSITRANSPORT] = "scsitransport",
 780         [NETLINK_ECRYPTFS] = "ecryptfs",
 781         [NETLINK_RDMA] = "rdma",
 782 };
 783
 784 DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(netlink_family, int, INT_MAX);
 785
 786 static const char* const socket_address_bind_ipv6_only_table[_SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX] = {
 787         [SOCKET_ADDRESS_DEFAULT] = "default",
 788         [SOCKET_ADDRESS_BOTH] = "both",
 789         [SOCKET_ADDRESS_IPV6_ONLY] = "ipv6-only"
 790 };
 791
 792 DEFINE_STRING_TABLE_LOOKUP(socket_address_bind_ipv6_only, SocketAddressBindIPv6Only);
 793
 794 SocketAddressBindIPv6Only parse_socket_address_bind_ipv6_only_or_bool(const char *n) {
 795         int r;
 796
 797         r = parse_boolean(n);
 798         if (r > 0)
 799                 return SOCKET_ADDRESS_IPV6_ONLY;
 800         if (r == 0)
 801                 return SOCKET_ADDRESS_BOTH;
 802
 803         return socket_address_bind_ipv6_only_from_string(n);
 804 }
 805
 806 bool sockaddr_equal(const union sockaddr_union *a, const union sockaddr_union *b) {
 807         assert(a);
 808         assert(b);
 809
 810         if (a->sa.sa_family != b->sa.sa_family)
 811                 return false;
 812
 813         if (a->sa.sa_family == AF_INET)
 814                 return a->in.sin_addr.s_addr == b->in.sin_addr.s_addr;
 815
 816         if (a->sa.sa_family == AF_INET6)
 817                 return memcmp(&a->in6.sin6_addr, &b->in6.sin6_addr, sizeof(a->in6.sin6_addr)) == 0;
 818
 819         if (a->sa.sa_family == AF_VSOCK)
 820                 return a->vm.svm_cid == b->vm.svm_cid;
 821
 822         return false;
 823 }
 824
 825 int fd_inc_sndbuf(int fd, size_t n) {
 826         int r, value;
 827         socklen_t l = sizeof(value);
 828
 829         r = getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, &l);
 830         if (r >= 0 && l == sizeof(value) && (size_t) value >= n*2)
 831                 return 0;
 832
 833         /* If we have the privileges we will ignore the kernel limit. */
 834
 835         value = (int) n;
 836         if (setsockopt(fd, SOL_SOCKET, SO_SNDBUFFORCE, &value, sizeof(value)) < 0)
 837                 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, sizeof(value)) < 0)
 838                         return -errno;
 839
 840         return 1;
 841 }
 842
 843 int fd_inc_rcvbuf(int fd, size_t n) {
 844         int r, value;
 845         socklen_t l = sizeof(value);
 846
 847         r = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, &l);
 848         if (r >= 0 && l == sizeof(value) && (size_t) value >= n*2)
 849                 return 0;
 850
 851         /* If we have the privileges we will ignore the kernel limit. */
 852
 853         value = (int) n;
 854         if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &value, sizeof(value)) < 0)
 855                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, sizeof(value)) < 0)
 856                         return -errno;
 857         return 1;
 858 }
 859
 860 static const char* const ip_tos_table[] = {
 861         [IPTOS_LOWDELAY] = "low-delay",
 862         [IPTOS_THROUGHPUT] = "throughput",
 863         [IPTOS_RELIABILITY] = "reliability",
 864         [IPTOS_LOWCOST] = "low-cost",
 865 };
 866
 867 DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(ip_tos, int, 0xff);
 868
 869 bool ifname_valid(const char *p) {
 870         bool numeric = true;
 871
 872         /* Checks whether a network interface name is valid. This is inspired by dev_valid_name() in the kernel sources
 873          * but slightly stricter, as we only allow non-control, non-space ASCII characters in the interface name. We
 874          * also don't permit names that only container numbers, to avoid confusion with numeric interface indexes. */
 875
 876         if (isempty(p))
 877                 return false;
 878
 879         if (strlen(p) >= IFNAMSIZ)
 880                 return false;
 881
 882         if (dot_or_dot_dot(p))
 883                 return false;
 884
 885         while (*p) {
 886                 if ((unsigned char) *p >= 127U)
 887                         return false;
 888
 889                 if ((unsigned char) *p <= 32U)
 890                         return false;
 891
 892                 if (IN_SET(*p, ':', '/'))
 893                         return false;
 894
 895                 numeric = numeric && (*p >= '0' && *p <= '9');
 896                 p++;
 897         }
 898
 899         if (numeric)
 900                 return false;
 901
 902         return true;
 903 }
 904
 905 bool address_label_valid(const char *p) {
 906
 907         if (isempty(p))
 908                 return false;
 909
 910         if (strlen(p) >= IFNAMSIZ)
 911                 return false;
 912
 913         while (*p) {
 914                 if ((uint8_t) *p >= 127U)
 915                         return false;
 916
 917                 if ((uint8_t) *p <= 31U)
 918                         return false;
 919                 p++;
 920         }
 921
 922         return true;
 923 }
 924
 925 int getpeercred(int fd, struct ucred *ucred) {
 926         socklen_t n = sizeof(struct ucred);
 927         struct ucred u;
 928         int r;
 929
 930         assert(fd >= 0);
 931         assert(ucred);
 932
 933         r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &u, &n);
 934         if (r < 0)
 935                 return -errno;
 936
 937         if (n != sizeof(struct ucred))
 938                 return -EIO;
 939
 940         /* Check if the data is actually useful and not suppressed due to namespacing issues */
 941         if (!pid_is_valid(u.pid))
 942                 return -ENODATA;
 943
 944         /* Note that we don't check UID/GID here, as namespace translation works differently there: instead of
 945          * receiving in "invalid" user/group we get the overflow UID/GID. */
 946
 947         *ucred = u;
 948         return 0;
 949 }
 950
 951 int getpeersec(int fd, char **ret) {
 952         _cleanup_free_ char *s = NULL;
 953         socklen_t n = 64;
 954
 955         assert(fd >= 0);
 956         assert(ret);
 957
 958         for (;;) {
 959                 s = new0(char, n+1);
 960                 if (!s)
 961                         return -ENOMEM;
 962
 963                 if (getsockopt(fd, SOL_SOCKET, SO_PEERSEC, s, &n) >= 0)
 964                         break;
 965
 966                 if (errno != ERANGE)
 967                         return -errno;
 968
 969                 s = mfree(s);
 970         }
 971
 972         if (isempty(s))
 973                 return -EOPNOTSUPP;
 974
 975         *ret = TAKE_PTR(s);
 976
 977         return 0;
 978 }
 979
 980 int getpeergroups(int fd, gid_t **ret) {
 981         socklen_t n = sizeof(gid_t) * 64;
 982         _cleanup_free_ gid_t *d = NULL;
 983
 984         assert(fd >= 0);
 985         assert(ret);
 986
 987         for (;;) {
 988                 d = malloc(n);
 989                 if (!d)
 990                         return -ENOMEM;
 991
 992                 if (getsockopt(fd, SOL_SOCKET, SO_PEERGROUPS, d, &n) >= 0)
 993                         break;
 994
 995                 if (errno != ERANGE)
 996                         return -errno;
 997
 998                 d = mfree(d);
 999         }
1000
1001         assert_se(n % sizeof(gid_t) == 0);
1002         n /= sizeof(gid_t);
1003
1004         if ((socklen_t) (int) n != n)
1005                 return -E2BIG;
1006
1007         *ret = TAKE_PTR(d);
1008
1009         return (int) n;
1010 }
1011
1012 int send_one_fd_sa(
1013                 int transport_fd,
1014                 int fd,
1015                 const struct sockaddr *sa, socklen_t len,
1016                 int flags) {
1017
1018         union {
1019                 struct cmsghdr cmsghdr;
1020                 uint8_t buf[CMSG_SPACE(sizeof(int))];
1021         } control = {};
1022         struct msghdr mh = {
1023                 .msg_name = (struct sockaddr*) sa,
1024                 .msg_namelen = len,
1025                 .msg_control = &control,
1026                 .msg_controllen = sizeof(control),
1027         };
1028         struct cmsghdr *cmsg;
1029
1030         assert(transport_fd >= 0);
1031         assert(fd >= 0);
1032
1033         cmsg = CMSG_FIRSTHDR(&mh);
1034         cmsg->cmsg_level = SOL_SOCKET;
1035         cmsg->cmsg_type = SCM_RIGHTS;
1036         cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1037         memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1038
1039         mh.msg_controllen = CMSG_SPACE(sizeof(int));
1040         if (sendmsg(transport_fd, &mh, MSG_NOSIGNAL | flags) < 0)
1041                 return -errno;
1042
1043         return 0;
1044 }
1045
1046 int receive_one_fd(int transport_fd, int flags) {
1047         union {
1048                 struct cmsghdr cmsghdr;
1049                 uint8_t buf[CMSG_SPACE(sizeof(int))];
1050         } control = {};
1051         struct msghdr mh = {
1052                 .msg_control = &control,
1053                 .msg_controllen = sizeof(control),
1054         };
1055         struct cmsghdr *cmsg, *found = NULL;
1056
1057         assert(transport_fd >= 0);
1058
1059         /*
1060          * Receive a single FD via @transport_fd. We don't care for
1061          * the transport-type. We retrieve a single FD at most, so for
1062          * packet-based transports, the caller must ensure to send
1063          * only a single FD per packet.  This is best used in
1064          * combination with send_one_fd().
1065          */
1066
1067         if (recvmsg(transport_fd, &mh, MSG_NOSIGNAL | MSG_CMSG_CLOEXEC | flags) < 0)
1068                 return -errno;
1069
1070         CMSG_FOREACH(cmsg, &mh) {
1071                 if (cmsg->cmsg_level == SOL_SOCKET &&
1072                     cmsg->cmsg_type == SCM_RIGHTS &&
1073                     cmsg->cmsg_len == CMSG_LEN(sizeof(int))) {
1074                         assert(!found);
1075                         found = cmsg;
1076                         break;
1077                 }
1078         }
1079
1080         if (!found) {
1081                 cmsg_close_all(&mh);
1082                 return -EIO;
1083         }
1084
1085         return *(int*) CMSG_DATA(found);
1086 }
1087
1088 ssize_t next_datagram_size_fd(int fd) {
1089         ssize_t l;
1090         int k;
1091
1092         /* This is a bit like FIONREAD/SIOCINQ, however a bit more powerful. The difference being: recv(MSG_PEEK) will
1093          * actually cause the next datagram in the queue to be validated regarding checksums, which FIONREAD doesn't
1094          * do. This difference is actually of major importance as we need to be sure that the size returned here
1095          * actually matches what we will read with recvmsg() next, as otherwise we might end up allocating a buffer of
1096          * the wrong size. */
1097
1098         l = recv(fd, NULL, 0, MSG_PEEK|MSG_TRUNC);
1099         if (l < 0) {
1100                 if (IN_SET(errno, EOPNOTSUPP, EFAULT))
1101                         goto fallback;
1102
1103                 return -errno;
1104         }
1105         if (l == 0)
1106                 goto fallback;
1107
1108         return l;
1109
1110 fallback:
1111         k = 0;
1112
1113         /* Some sockets (AF_PACKET) do not support null-sized recv() with MSG_TRUNC set, let's fall back to FIONREAD
1114          * for them. Checksums don't matter for raw sockets anyway, hence this should be fine. */
1115
1116         if (ioctl(fd, FIONREAD, &k) < 0)
1117                 return -errno;
1118
1119         return (ssize_t) k;
1120 }
1121
1122 int flush_accept(int fd) {
1123
1124         struct pollfd pollfd = {
1125                 .fd = fd,
1126                 .events = POLLIN,
1127         };
1128         int r;
1129
1130
1131         /* Similar to flush_fd() but flushes all incoming connection by accepting them and immediately closing them. */
1132
1133         for (;;) {
1134                 int cfd;
1135
1136                 r = poll(&pollfd, 1, 0);
1137                 if (r < 0) {
1138                         if (errno == EINTR)
1139                                 continue;
1140
1141                         return -errno;
1142
1143                 } else if (r == 0)
1144                         return 0;
1145
1146                 cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
1147                 if (cfd < 0) {
1148                         if (errno == EINTR)
1149                                 continue;
1150
1151                         if (errno == EAGAIN)
1152                                 return 0;
1153
1154                         return -errno;
1155                 }
1156
1157                 close(cfd);
1158         }
1159 }
1160
1161 struct cmsghdr* cmsg_find(struct msghdr *mh, int level, int type, socklen_t length) {
1162         struct cmsghdr *cmsg;
1163
1164         assert(mh);
1165
1166         CMSG_FOREACH(cmsg, mh)
1167                 if (cmsg->cmsg_level == level &&
1168                     cmsg->cmsg_type == type &&
1169                     (length == (socklen_t) -1 || length == cmsg->cmsg_len))
1170                         return cmsg;
1171
1172         return NULL;
1173 }
1174
1175 int socket_ioctl_fd(void) {
1176         int fd;
1177
1178         /* Create a socket to invoke the various network interface ioctl()s on. Traditionally only AF_INET was good for
1179          * that. Since kernel 4.6 AF_NETLINK works for this too. We first try to use AF_INET hence, but if that's not
1180          * available (for example, because it is made unavailable via SECCOMP or such), we'll fall back to the more
1181          * generic AF_NETLINK. */
1182
1183         fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, 0);
1184         if (fd < 0)
1185                 fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_GENERIC);
1186         if (fd < 0)
1187                 return -errno;
1188
1189         return fd;
1190 }