src/core/socket.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <arpa/inet.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <mqueue.h>
  24 #include <netinet/tcp.h>
  25 #include <signal.h>
  26 #include <sys/epoll.h>
  27 #include <sys/stat.h>
  28 #include <unistd.h>
  29 #include <linux/sctp.h>
  30
  31 #include "alloc-util.h"
  32 #include "bus-error.h"
  33 #include "bus-util.h"
  34 #include "copy.h"
  35 #include "dbus-socket.h"
  36 #include "def.h"
  37 #include "exit-status.h"
  38 #include "fd-util.h"
  39 #include "format-util.h"
  40 #include "io-util.h"
  41 #include "label.h"
  42 #include "log.h"
  43 #include "missing.h"
  44 #include "mkdir.h"
  45 #include "parse-util.h"
  46 #include "path-util.h"
  47 #include "process-util.h"
  48 #include "selinux-util.h"
  49 #include "signal-util.h"
  50 #include "smack-util.h"
  51 #include "socket.h"
  52 #include "special.h"
  53 #include "string-table.h"
  54 #include "string-util.h"
  55 #include "strv.h"
  56 #include "unit-name.h"
  57 #include "unit.h"
  58 #include "user-util.h"
  59 #include "in-addr-util.h"
  60
  61 struct SocketPeer {
  62         unsigned n_ref;
  63
  64         Socket *socket;
  65         union sockaddr_union peer;
  66         socklen_t peer_salen;
  67 };
  68
  69 static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
  70         [SOCKET_DEAD] = UNIT_INACTIVE,
  71         [SOCKET_START_PRE] = UNIT_ACTIVATING,
  72         [SOCKET_START_CHOWN] = UNIT_ACTIVATING,
  73         [SOCKET_START_POST] = UNIT_ACTIVATING,
  74         [SOCKET_LISTENING] = UNIT_ACTIVE,
  75         [SOCKET_RUNNING] = UNIT_ACTIVE,
  76         [SOCKET_STOP_PRE] = UNIT_DEACTIVATING,
  77         [SOCKET_STOP_PRE_SIGTERM] = UNIT_DEACTIVATING,
  78         [SOCKET_STOP_PRE_SIGKILL] = UNIT_DEACTIVATING,
  79         [SOCKET_STOP_POST] = UNIT_DEACTIVATING,
  80         [SOCKET_FINAL_SIGTERM] = UNIT_DEACTIVATING,
  81         [SOCKET_FINAL_SIGKILL] = UNIT_DEACTIVATING,
  82         [SOCKET_FAILED] = UNIT_FAILED
  83 };
  84
  85 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata);
  86 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata);
  87
  88 static void socket_init(Unit *u) {
  89         Socket *s = SOCKET(u);
  90
  91         assert(u);
  92         assert(u->load_state == UNIT_STUB);
  93
  94         s->backlog = SOMAXCONN;
  95         s->timeout_usec = u->manager->default_timeout_start_usec;
  96         s->directory_mode = 0755;
  97         s->socket_mode = 0666;
  98
  99         s->max_connections = 64;
 100
 101         s->priority = -1;
 102         s->ip_tos = -1;
 103         s->ip_ttl = -1;
 104         s->mark = -1;
 105
 106         s->exec_context.std_output = u->manager->default_std_output;
 107         s->exec_context.std_error = u->manager->default_std_error;
 108
 109         s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
 110
 111         s->trigger_limit.interval = USEC_INFINITY;
 112         s->trigger_limit.burst = (unsigned) -1;
 113 }
 114
 115 static void socket_unwatch_control_pid(Socket *s) {
 116         assert(s);
 117
 118         if (s->control_pid <= 0)
 119                 return;
 120
 121         unit_unwatch_pid(UNIT(s), s->control_pid);
 122         s->control_pid = 0;
 123 }
 124
 125 static void socket_cleanup_fd_list(SocketPort *p) {
 126         assert(p);
 127
 128         close_many(p->auxiliary_fds, p->n_auxiliary_fds);
 129         p->auxiliary_fds = mfree(p->auxiliary_fds);
 130         p->n_auxiliary_fds = 0;
 131 }
 132
 133 void socket_free_ports(Socket *s) {
 134         SocketPort *p;
 135
 136         assert(s);
 137
 138         while ((p = s->ports)) {
 139                 LIST_REMOVE(port, s->ports, p);
 140
 141                 sd_event_source_unref(p->event_source);
 142
 143                 socket_cleanup_fd_list(p);
 144                 safe_close(p->fd);
 145                 free(p->path);
 146                 free(p);
 147         }
 148 }
 149
 150 static void socket_done(Unit *u) {
 151         Socket *s = SOCKET(u);
 152         SocketPeer *p;
 153
 154         assert(s);
 155
 156         socket_free_ports(s);
 157
 158         while ((p = set_steal_first(s->peers_by_address)))
 159                 p->socket = NULL;
 160
 161         s->peers_by_address = set_free(s->peers_by_address);
 162
 163         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
 164         exec_command_free_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
 165         s->control_command = NULL;
 166
 167         dynamic_creds_unref(&s->dynamic_creds);
 168
 169         socket_unwatch_control_pid(s);
 170
 171         unit_ref_unset(&s->service);
 172
 173         s->tcp_congestion = mfree(s->tcp_congestion);
 174         s->bind_to_device = mfree(s->bind_to_device);
 175
 176         s->smack = mfree(s->smack);
 177         s->smack_ip_in = mfree(s->smack_ip_in);
 178         s->smack_ip_out = mfree(s->smack_ip_out);
 179
 180         strv_free(s->symlinks);
 181
 182         s->user = mfree(s->user);
 183         s->group = mfree(s->group);
 184
 185         s->fdname = mfree(s->fdname);
 186
 187         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 188 }
 189
 190 static int socket_arm_timer(Socket *s, usec_t usec) {
 191         int r;
 192
 193         assert(s);
 194
 195         if (s->timer_event_source) {
 196                 r = sd_event_source_set_time(s->timer_event_source, usec);
 197                 if (r < 0)
 198                         return r;
 199
 200                 return sd_event_source_set_enabled(s->timer_event_source, SD_EVENT_ONESHOT);
 201         }
 202
 203         if (usec == USEC_INFINITY)
 204                 return 0;
 205
 206         r = sd_event_add_time(
 207                         UNIT(s)->manager->event,
 208                         &s->timer_event_source,
 209                         CLOCK_MONOTONIC,
 210                         usec, 0,
 211                         socket_dispatch_timer, s);
 212         if (r < 0)
 213                 return r;
 214
 215         (void) sd_event_source_set_description(s->timer_event_source, "socket-timer");
 216
 217         return 0;
 218 }
 219
 220 int socket_instantiate_service(Socket *s) {
 221         _cleanup_free_ char *prefix = NULL, *name = NULL;
 222         int r;
 223         Unit *u;
 224
 225         assert(s);
 226
 227         /* This fills in s->service if it isn't filled in yet. For
 228          * Accept=yes sockets we create the next connection service
 229          * here. For Accept=no this is mostly a NOP since the service
 230          * is figured out at load time anyway. */
 231
 232         if (UNIT_DEREF(s->service))
 233                 return 0;
 234
 235         if (!s->accept)
 236                 return 0;
 237
 238         r = unit_name_to_prefix(UNIT(s)->id, &prefix);
 239         if (r < 0)
 240                 return r;
 241
 242         if (asprintf(&name, "%s@%u.service", prefix, s->n_accepted) < 0)
 243                 return -ENOMEM;
 244
 245         r = manager_load_unit(UNIT(s)->manager, name, NULL, NULL, &u);
 246         if (r < 0)
 247                 return r;
 248
 249         unit_ref_set(&s->service, u);
 250
 251         return unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, u, false);
 252 }
 253
 254 static bool have_non_accept_socket(Socket *s) {
 255         SocketPort *p;
 256
 257         assert(s);
 258
 259         if (!s->accept)
 260                 return true;
 261
 262         LIST_FOREACH(port, p, s->ports) {
 263
 264                 if (p->type != SOCKET_SOCKET)
 265                         return true;
 266
 267                 if (!socket_address_can_accept(&p->address))
 268                         return true;
 269         }
 270
 271         return false;
 272 }
 273
 274 static int socket_add_mount_links(Socket *s) {
 275         SocketPort *p;
 276         int r;
 277
 278         assert(s);
 279
 280         LIST_FOREACH(port, p, s->ports) {
 281                 const char *path = NULL;
 282
 283                 if (p->type == SOCKET_SOCKET)
 284                         path = socket_address_get_path(&p->address);
 285                 else if (IN_SET(p->type, SOCKET_FIFO, SOCKET_SPECIAL, SOCKET_USB_FUNCTION))
 286                         path = p->path;
 287
 288                 if (!path)
 289                         continue;
 290
 291                 r = unit_require_mounts_for(UNIT(s), path);
 292                 if (r < 0)
 293                         return r;
 294         }
 295
 296         return 0;
 297 }
 298
 299 static int socket_add_device_link(Socket *s) {
 300         char *t;
 301
 302         assert(s);
 303
 304         if (!s->bind_to_device || streq(s->bind_to_device, "lo"))
 305                 return 0;
 306
 307         t = strjoina("/sys/subsystem/net/devices/", s->bind_to_device);
 308         return unit_add_node_link(UNIT(s), t, false, UNIT_BINDS_TO);
 309 }
 310
 311 static int socket_add_default_dependencies(Socket *s) {
 312         int r;
 313         assert(s);
 314
 315         if (!UNIT(s)->default_dependencies)
 316                 return 0;
 317
 318         r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, NULL, true);
 319         if (r < 0)
 320                 return r;
 321
 322         if (MANAGER_IS_SYSTEM(UNIT(s)->manager)) {
 323                 r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true);
 324                 if (r < 0)
 325                         return r;
 326         }
 327
 328         return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
 329 }
 330
 331 _pure_ static bool socket_has_exec(Socket *s) {
 332         unsigned i;
 333         assert(s);
 334
 335         for (i = 0; i < _SOCKET_EXEC_COMMAND_MAX; i++)
 336                 if (s->exec_command[i])
 337                         return true;
 338
 339         return false;
 340 }
 341
 342 static int socket_add_extras(Socket *s) {
 343         Unit *u = UNIT(s);
 344         int r;
 345
 346         assert(s);
 347
 348         /* Pick defaults for the trigger limit, if nothing was explicitly configured. We pick a relatively high limit
 349          * in Accept=yes mode, and a lower limit for Accept=no. Reason: in Accept=yes mode we are invoking accept()
 350          * ourselves before the trigger limit can hit, thus incoming connections are taken off the socket queue quickly
 351          * and reliably. This is different for Accept=no, where the spawned service has to take the incoming traffic
 352          * off the queues, which it might not necessarily do. Moreover, while Accept=no services are supposed to
 353          * process whatever is queued in one go, and thus should normally never have to be started frequently. This is
 354          * different for Accept=yes where each connection is processed by a new service instance, and thus frequent
 355          * service starts are typical. */
 356
 357         if (s->trigger_limit.interval == USEC_INFINITY)
 358                 s->trigger_limit.interval = 2 * USEC_PER_SEC;
 359
 360         if (s->trigger_limit.burst == (unsigned) -1) {
 361                 if (s->accept)
 362                         s->trigger_limit.burst = 200;
 363                 else
 364                         s->trigger_limit.burst = 20;
 365         }
 366
 367         if (have_non_accept_socket(s)) {
 368
 369                 if (!UNIT_DEREF(s->service)) {
 370                         Unit *x;
 371
 372                         r = unit_load_related_unit(u, ".service", &x);
 373                         if (r < 0)
 374                                 return r;
 375
 376                         unit_ref_set(&s->service, x);
 377                 }
 378
 379                 r = unit_add_two_dependencies(u, UNIT_BEFORE, UNIT_TRIGGERS, UNIT_DEREF(s->service), true);
 380                 if (r < 0)
 381                         return r;
 382         }
 383
 384         r = socket_add_mount_links(s);
 385         if (r < 0)
 386                 return r;
 387
 388         r = socket_add_device_link(s);
 389         if (r < 0)
 390                 return r;
 391
 392         r = unit_patch_contexts(u);
 393         if (r < 0)
 394                 return r;
 395
 396         if (socket_has_exec(s)) {
 397                 r = unit_add_exec_dependencies(u, &s->exec_context);
 398                 if (r < 0)
 399                         return r;
 400
 401                 r = unit_set_default_slice(u);
 402                 if (r < 0)
 403                         return r;
 404         }
 405
 406         r = socket_add_default_dependencies(s);
 407         if (r < 0)
 408                 return r;
 409
 410         return 0;
 411 }
 412
 413 static const char *socket_find_symlink_target(Socket *s) {
 414         const char *found = NULL;
 415         SocketPort *p;
 416
 417         LIST_FOREACH(port, p, s->ports) {
 418                 const char *f = NULL;
 419
 420                 switch (p->type) {
 421
 422                 case SOCKET_FIFO:
 423                         f = p->path;
 424                         break;
 425
 426                 case SOCKET_SOCKET:
 427                         f = socket_address_get_path(&p->address);
 428                         break;
 429
 430                 default:
 431                         break;
 432                 }
 433
 434                 if (f) {
 435                         if (found)
 436                                 return NULL;
 437
 438                         found = f;
 439                 }
 440         }
 441
 442         return found;
 443 }
 444
 445 static int socket_verify(Socket *s) {
 446         assert(s);
 447
 448         if (UNIT(s)->load_state != UNIT_LOADED)
 449                 return 0;
 450
 451         if (!s->ports) {
 452                 log_unit_error(UNIT(s), "Unit has no Listen setting (ListenStream=, ListenDatagram=, ListenFIFO=, ...). Refusing.");
 453                 return -EINVAL;
 454         }
 455
 456         if (s->accept && have_non_accept_socket(s)) {
 457                 log_unit_error(UNIT(s), "Unit configured for accepting sockets, but sockets are non-accepting. Refusing.");
 458                 return -EINVAL;
 459         }
 460
 461         if (s->accept && s->max_connections <= 0) {
 462                 log_unit_error(UNIT(s), "MaxConnection= setting too small. Refusing.");
 463                 return -EINVAL;
 464         }
 465
 466         if (s->accept && UNIT_DEREF(s->service)) {
 467                 log_unit_error(UNIT(s), "Explicit service configuration for accepting socket units not supported. Refusing.");
 468                 return -EINVAL;
 469         }
 470
 471         if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP) {
 472                 log_unit_error(UNIT(s), "Unit has PAM enabled. Kill mode must be set to 'control-group'. Refusing.");
 473                 return -EINVAL;
 474         }
 475
 476         if (!strv_isempty(s->symlinks) && !socket_find_symlink_target(s)) {
 477                 log_unit_error(UNIT(s), "Unit has symlinks set but none or more than one node in the file system. Refusing.");
 478                 return -EINVAL;
 479         }
 480
 481         return 0;
 482 }
 483
 484 static void peer_address_hash_func(const void *p, struct siphash *state) {
 485         const SocketPeer *s = p;
 486
 487         assert(s);
 488
 489         if (s->peer.sa.sa_family == AF_INET)
 490                 siphash24_compress(&s->peer.in.sin_addr, sizeof(s->peer.in.sin_addr), state);
 491         else if (s->peer.sa.sa_family == AF_INET6)
 492                 siphash24_compress(&s->peer.in6.sin6_addr, sizeof(s->peer.in6.sin6_addr), state);
 493         else if (s->peer.sa.sa_family == AF_VSOCK)
 494                 siphash24_compress(&s->peer.vm.svm_cid, sizeof(s->peer.vm.svm_cid), state);
 495         else
 496                 assert_not_reached("Unknown address family.");
 497 }
 498
 499 static int peer_address_compare_func(const void *a, const void *b) {
 500         const SocketPeer *x = a, *y = b;
 501
 502         if (x->peer.sa.sa_family < y->peer.sa.sa_family)
 503                 return -1;
 504         if (x->peer.sa.sa_family > y->peer.sa.sa_family)
 505                 return 1;
 506
 507         switch(x->peer.sa.sa_family) {
 508         case AF_INET:
 509                 return memcmp(&x->peer.in.sin_addr, &y->peer.in.sin_addr, sizeof(x->peer.in.sin_addr));
 510         case AF_INET6:
 511                 return memcmp(&x->peer.in6.sin6_addr, &y->peer.in6.sin6_addr, sizeof(x->peer.in6.sin6_addr));
 512         case AF_VSOCK:
 513                 if (x->peer.vm.svm_cid < y->peer.vm.svm_cid)
 514                         return -1;
 515                 if (x->peer.vm.svm_cid > y->peer.vm.svm_cid)
 516                         return 1;
 517                 return 0;
 518         }
 519         assert_not_reached("Black sheep in the family!");
 520 }
 521
 522 const struct hash_ops peer_address_hash_ops = {
 523         .hash = peer_address_hash_func,
 524         .compare = peer_address_compare_func
 525 };
 526
 527 static int socket_load(Unit *u) {
 528         Socket *s = SOCKET(u);
 529         int r;
 530
 531         assert(u);
 532         assert(u->load_state == UNIT_STUB);
 533
 534         r = set_ensure_allocated(&s->peers_by_address, &peer_address_hash_ops);
 535         if (r < 0)
 536                 return r;
 537
 538         r = unit_load_fragment_and_dropin(u);
 539         if (r < 0)
 540                 return r;
 541
 542         if (u->load_state == UNIT_LOADED) {
 543                 /* This is a new unit? Then let's add in some extras */
 544                 r = socket_add_extras(s);
 545                 if (r < 0)
 546                         return r;
 547         }
 548
 549         return socket_verify(s);
 550 }
 551
 552 static SocketPeer *socket_peer_new(void) {
 553         SocketPeer *p;
 554
 555         p = new0(SocketPeer, 1);
 556         if (!p)
 557                 return NULL;
 558
 559         p->n_ref = 1;
 560
 561         return p;
 562 }
 563
 564 SocketPeer *socket_peer_ref(SocketPeer *p) {
 565         if (!p)
 566                 return NULL;
 567
 568         assert(p->n_ref > 0);
 569         p->n_ref++;
 570
 571         return p;
 572 }
 573
 574 SocketPeer *socket_peer_unref(SocketPeer *p) {
 575         if (!p)
 576                 return NULL;
 577
 578         assert(p->n_ref > 0);
 579
 580         p->n_ref--;
 581
 582         if (p->n_ref > 0)
 583                 return NULL;
 584
 585         if (p->socket)
 586                 set_remove(p->socket->peers_by_address, p);
 587
 588         return mfree(p);
 589 }
 590
 591 int socket_acquire_peer(Socket *s, int fd, SocketPeer **p) {
 592         _cleanup_(socket_peer_unrefp) SocketPeer *remote = NULL;
 593         SocketPeer sa = {}, *i;
 594         socklen_t salen = sizeof(sa.peer);
 595         int r;
 596
 597         assert(fd >= 0);
 598         assert(s);
 599
 600         r = getpeername(fd, &sa.peer.sa, &salen);
 601         if (r < 0)
 602                 return log_error_errno(errno, "getpeername failed: %m");
 603
 604         if (!IN_SET(sa.peer.sa.sa_family, AF_INET, AF_INET6, AF_VSOCK)) {
 605                 *p = NULL;
 606                 return 0;
 607         }
 608
 609         i = set_get(s->peers_by_address, &sa);
 610         if (i) {
 611                 *p = socket_peer_ref(i);
 612                 return 1;
 613         }
 614
 615         remote = socket_peer_new();
 616         if (!remote)
 617                 return log_oom();
 618
 619         remote->peer = sa.peer;
 620         remote->peer_salen = salen;
 621
 622         r = set_put(s->peers_by_address, remote);
 623         if (r < 0)
 624                 return r;
 625
 626         remote->socket = s;
 627
 628         *p = remote;
 629         remote = NULL;
 630
 631         return 1;
 632 }
 633
 634 _const_ static const char* listen_lookup(int family, int type) {
 635
 636         if (family == AF_NETLINK)
 637                 return "ListenNetlink";
 638
 639         if (type == SOCK_STREAM)
 640                 return "ListenStream";
 641         else if (type == SOCK_DGRAM)
 642                 return "ListenDatagram";
 643         else if (type == SOCK_SEQPACKET)
 644                 return "ListenSequentialPacket";
 645
 646         assert_not_reached("Unknown socket type");
 647         return NULL;
 648 }
 649
 650 static void socket_dump(Unit *u, FILE *f, const char *prefix) {
 651         char time_string[FORMAT_TIMESPAN_MAX];
 652         SocketExecCommand c;
 653         Socket *s = SOCKET(u);
 654         SocketPort *p;
 655         const char *prefix2;
 656
 657         assert(s);
 658         assert(f);
 659
 660         prefix = strempty(prefix);
 661         prefix2 = strjoina(prefix, "\t");
 662
 663         fprintf(f,
 664                 "%sSocket State: %s\n"
 665                 "%sResult: %s\n"
 666                 "%sBindIPv6Only: %s\n"
 667                 "%sBacklog: %u\n"
 668                 "%sSocketMode: %04o\n"
 669                 "%sDirectoryMode: %04o\n"
 670                 "%sKeepAlive: %s\n"
 671                 "%sNoDelay: %s\n"
 672                 "%sFreeBind: %s\n"
 673                 "%sTransparent: %s\n"
 674                 "%sBroadcast: %s\n"
 675                 "%sPassCredentials: %s\n"
 676                 "%sPassSecurity: %s\n"
 677                 "%sTCPCongestion: %s\n"
 678                 "%sRemoveOnStop: %s\n"
 679                 "%sWritable: %s\n"
 680                 "%sFDName: %s\n"
 681                 "%sSELinuxContextFromNet: %s\n",
 682                 prefix, socket_state_to_string(s->state),
 683                 prefix, socket_result_to_string(s->result),
 684                 prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
 685                 prefix, s->backlog,
 686                 prefix, s->socket_mode,
 687                 prefix, s->directory_mode,
 688                 prefix, yes_no(s->keep_alive),
 689                 prefix, yes_no(s->no_delay),
 690                 prefix, yes_no(s->free_bind),
 691                 prefix, yes_no(s->transparent),
 692                 prefix, yes_no(s->broadcast),
 693                 prefix, yes_no(s->pass_cred),
 694                 prefix, yes_no(s->pass_sec),
 695                 prefix, strna(s->tcp_congestion),
 696                 prefix, yes_no(s->remove_on_stop),
 697                 prefix, yes_no(s->writable),
 698                 prefix, socket_fdname(s),
 699                 prefix, yes_no(s->selinux_context_from_net));
 700
 701         if (s->control_pid > 0)
 702                 fprintf(f,
 703                         "%sControl PID: "PID_FMT"\n",
 704                         prefix, s->control_pid);
 705
 706         if (s->bind_to_device)
 707                 fprintf(f,
 708                         "%sBindToDevice: %s\n",
 709                         prefix, s->bind_to_device);
 710
 711         if (s->accept)
 712                 fprintf(f,
 713                         "%sAccepted: %u\n"
 714                         "%sNConnections: %u\n"
 715                         "%sMaxConnections: %u\n",
 716                         prefix, s->n_accepted,
 717                         prefix, s->n_connections,
 718                         prefix, s->max_connections);
 719
 720         if (s->priority >= 0)
 721                 fprintf(f,
 722                         "%sPriority: %i\n",
 723                         prefix, s->priority);
 724
 725         if (s->receive_buffer > 0)
 726                 fprintf(f,
 727                         "%sReceiveBuffer: %zu\n",
 728                         prefix, s->receive_buffer);
 729
 730         if (s->send_buffer > 0)
 731                 fprintf(f,
 732                         "%sSendBuffer: %zu\n",
 733                         prefix, s->send_buffer);
 734
 735         if (s->ip_tos >= 0)
 736                 fprintf(f,
 737                         "%sIPTOS: %i\n",
 738                         prefix, s->ip_tos);
 739
 740         if (s->ip_ttl >= 0)
 741                 fprintf(f,
 742                         "%sIPTTL: %i\n",
 743                         prefix, s->ip_ttl);
 744
 745         if (s->pipe_size > 0)
 746                 fprintf(f,
 747                         "%sPipeSize: %zu\n",
 748                         prefix, s->pipe_size);
 749
 750         if (s->mark >= 0)
 751                 fprintf(f,
 752                         "%sMark: %i\n",
 753                         prefix, s->mark);
 754
 755         if (s->mq_maxmsg > 0)
 756                 fprintf(f,
 757                         "%sMessageQueueMaxMessages: %li\n",
 758                         prefix, s->mq_maxmsg);
 759
 760         if (s->mq_msgsize > 0)
 761                 fprintf(f,
 762                         "%sMessageQueueMessageSize: %li\n",
 763                         prefix, s->mq_msgsize);
 764
 765         if (s->reuse_port)
 766                 fprintf(f,
 767                         "%sReusePort: %s\n",
 768                          prefix, yes_no(s->reuse_port));
 769
 770         if (s->smack)
 771                 fprintf(f,
 772                         "%sSmackLabel: %s\n",
 773                         prefix, s->smack);
 774
 775         if (s->smack_ip_in)
 776                 fprintf(f,
 777                         "%sSmackLabelIPIn: %s\n",
 778                         prefix, s->smack_ip_in);
 779
 780         if (s->smack_ip_out)
 781                 fprintf(f,
 782                         "%sSmackLabelIPOut: %s\n",
 783                         prefix, s->smack_ip_out);
 784
 785         if (!isempty(s->user) || !isempty(s->group))
 786                 fprintf(f,
 787                         "%sSocketUser: %s\n"
 788                         "%sSocketGroup: %s\n",
 789                         prefix, strna(s->user),
 790                         prefix, strna(s->group));
 791
 792         if (s->keep_alive_time > 0)
 793                 fprintf(f,
 794                         "%sKeepAliveTimeSec: %s\n",
 795                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_time, USEC_PER_SEC));
 796
 797         if (s->keep_alive_interval)
 798                 fprintf(f,
 799                         "%sKeepAliveIntervalSec: %s\n",
 800                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_interval, USEC_PER_SEC));
 801
 802         if (s->keep_alive_cnt)
 803                 fprintf(f,
 804                         "%sKeepAliveProbes: %u\n",
 805                         prefix, s->keep_alive_cnt);
 806
 807         if (s->defer_accept)
 808                 fprintf(f,
 809                         "%sDeferAcceptSec: %s\n",
 810                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->defer_accept, USEC_PER_SEC));
 811
 812         LIST_FOREACH(port, p, s->ports) {
 813
 814                 if (p->type == SOCKET_SOCKET) {
 815                         const char *t;
 816                         int r;
 817                         char *k = NULL;
 818
 819                         r = socket_address_print(&p->address, &k);
 820                         if (r < 0)
 821                                 t = strerror(-r);
 822                         else
 823                                 t = k;
 824
 825                         fprintf(f, "%s%s: %s\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type), t);
 826                         free(k);
 827                 } else if (p->type == SOCKET_SPECIAL)
 828                         fprintf(f, "%sListenSpecial: %s\n", prefix, p->path);
 829                 else if (p->type == SOCKET_USB_FUNCTION)
 830                         fprintf(f, "%sListenUSBFunction: %s\n", prefix, p->path);
 831                 else if (p->type == SOCKET_MQUEUE)
 832                         fprintf(f, "%sListenMessageQueue: %s\n", prefix, p->path);
 833                 else
 834                         fprintf(f, "%sListenFIFO: %s\n", prefix, p->path);
 835         }
 836
 837         fprintf(f,
 838                 "%sTriggerLimitIntervalSec: %s\n"
 839                 "%sTriggerLimitBurst: %u\n",
 840                 prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->trigger_limit.interval, USEC_PER_SEC),
 841                 prefix, s->trigger_limit.burst);
 842
 843         exec_context_dump(&s->exec_context, f, prefix);
 844         kill_context_dump(&s->kill_context, f, prefix);
 845
 846         for (c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
 847                 if (!s->exec_command[c])
 848                         continue;
 849
 850                 fprintf(f, "%s-> %s:\n",
 851                         prefix, socket_exec_command_to_string(c));
 852
 853                 exec_command_dump_list(s->exec_command[c], f, prefix2);
 854         }
 855 }
 856
 857 static int instance_from_socket(int fd, unsigned nr, char **instance) {
 858         socklen_t l;
 859         char *r;
 860         union sockaddr_union local, remote;
 861
 862         assert(fd >= 0);
 863         assert(instance);
 864
 865         l = sizeof(local);
 866         if (getsockname(fd, &local.sa, &l) < 0)
 867                 return -errno;
 868
 869         l = sizeof(remote);
 870         if (getpeername(fd, &remote.sa, &l) < 0)
 871                 return -errno;
 872
 873         switch (local.sa.sa_family) {
 874
 875         case AF_INET: {
 876                 uint32_t
 877                         a = be32toh(local.in.sin_addr.s_addr),
 878                         b = be32toh(remote.in.sin_addr.s_addr);
 879
 880                 if (asprintf(&r,
 881                              "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 882                              nr,
 883                              a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
 884                              be16toh(local.in.sin_port),
 885                              b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
 886                              be16toh(remote.in.sin_port)) < 0)
 887                         return -ENOMEM;
 888
 889                 break;
 890         }
 891
 892         case AF_INET6: {
 893                 static const unsigned char ipv4_prefix[] = {
 894                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
 895                 };
 896
 897                 if (memcmp(&local.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0 &&
 898                     memcmp(&remote.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
 899                         const uint8_t
 900                                 *a = local.in6.sin6_addr.s6_addr+12,
 901                                 *b = remote.in6.sin6_addr.s6_addr+12;
 902
 903                         if (asprintf(&r,
 904                                      "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 905                                      nr,
 906                                      a[0], a[1], a[2], a[3],
 907                                      be16toh(local.in6.sin6_port),
 908                                      b[0], b[1], b[2], b[3],
 909                                      be16toh(remote.in6.sin6_port)) < 0)
 910                                 return -ENOMEM;
 911                 } else {
 912                         char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
 913
 914                         if (asprintf(&r,
 915                                      "%u-%s:%u-%s:%u",
 916                                      nr,
 917                                      inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
 918                                      be16toh(local.in6.sin6_port),
 919                                      inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
 920                                      be16toh(remote.in6.sin6_port)) < 0)
 921                                 return -ENOMEM;
 922                 }
 923
 924                 break;
 925         }
 926
 927         case AF_UNIX: {
 928                 struct ucred ucred;
 929                 int k;
 930
 931                 k = getpeercred(fd, &ucred);
 932                 if (k >= 0) {
 933                         if (asprintf(&r,
 934                                      "%u-"PID_FMT"-"UID_FMT,
 935                                      nr, ucred.pid, ucred.uid) < 0)
 936                                 return -ENOMEM;
 937                 } else if (k == -ENODATA) {
 938                         /* This handles the case where somebody is
 939                          * connecting from another pid/uid namespace
 940                          * (e.g. from outside of our container). */
 941                         if (asprintf(&r,
 942                                      "%u-unknown",
 943                                      nr) < 0)
 944                                 return -ENOMEM;
 945                 } else
 946                         return k;
 947
 948                 break;
 949         }
 950
 951         case AF_VSOCK:
 952                 if (asprintf(&r,
 953                              "%u-%u:%u-%u:%u",
 954                              nr,
 955                              local.vm.svm_cid, local.vm.svm_port,
 956                              remote.vm.svm_cid, remote.vm.svm_port) < 0)
 957                         return -ENOMEM;
 958
 959                 break;
 960
 961         default:
 962                 assert_not_reached("Unhandled socket type.");
 963         }
 964
 965         *instance = r;
 966         return 0;
 967 }
 968
 969 static void socket_close_fds(Socket *s) {
 970         SocketPort *p;
 971         char **i;
 972
 973         assert(s);
 974
 975         LIST_FOREACH(port, p, s->ports) {
 976                 bool was_open;
 977
 978                 was_open = p->fd >= 0;
 979
 980                 p->event_source = sd_event_source_unref(p->event_source);
 981                 p->fd = safe_close(p->fd);
 982                 socket_cleanup_fd_list(p);
 983
 984                 /* One little note: we should normally not delete any sockets in the file system here! After all some
 985                  * other process we spawned might still have a reference of this fd and wants to continue to use
 986                  * it. Therefore we normally delete sockets in the file system before we create a new one, not after we
 987                  * stopped using one! That all said, if the user explicitly requested this, we'll delete them here
 988                  * anyway, but only then. */
 989
 990                 if (!was_open || !s->remove_on_stop)
 991                         continue;
 992
 993                 switch (p->type) {
 994
 995                 case SOCKET_FIFO:
 996                         (void) unlink(p->path);
 997                         break;
 998
 999                 case SOCKET_MQUEUE:
1000                         (void) mq_unlink(p->path);
1001                         break;
1002
1003                 case SOCKET_SOCKET:
1004                         (void) socket_address_unlink(&p->address);
1005                         break;
1006
1007                 default:
1008                         break;
1009                 }
1010         }
1011
1012         if (s->remove_on_stop)
1013                 STRV_FOREACH(i, s->symlinks)
1014                         (void) unlink(*i);
1015 }
1016
1017 static void socket_apply_socket_options(Socket *s, int fd) {
1018         int r;
1019
1020         assert(s);
1021         assert(fd >= 0);
1022
1023         if (s->keep_alive) {
1024                 int b = s->keep_alive;
1025                 if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &b, sizeof(b)) < 0)
1026                         log_unit_warning_errno(UNIT(s), errno, "SO_KEEPALIVE failed: %m");
1027         }
1028
1029         if (s->keep_alive_time) {
1030                 int value = s->keep_alive_time / USEC_PER_SEC;
1031                 if (setsockopt(fd, SOL_TCP, TCP_KEEPIDLE, &value, sizeof(value)) < 0)
1032                         log_unit_warning_errno(UNIT(s), errno, "TCP_KEEPIDLE failed: %m");
1033         }
1034
1035         if (s->keep_alive_interval) {
1036                 int value = s->keep_alive_interval / USEC_PER_SEC;
1037                 if (setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &value, sizeof(value)) < 0)
1038                         log_unit_warning_errno(UNIT(s), errno, "TCP_KEEPINTVL failed: %m");
1039         }
1040
1041         if (s->keep_alive_cnt) {
1042                 int value = s->keep_alive_cnt;
1043                 if (setsockopt(fd, SOL_TCP, TCP_KEEPCNT, &value, sizeof(value)) < 0)
1044                         log_unit_warning_errno(UNIT(s), errno, "TCP_KEEPCNT failed: %m");
1045         }
1046
1047         if (s->defer_accept) {
1048                 int value = s->defer_accept / USEC_PER_SEC;
1049                 if (setsockopt(fd, SOL_TCP, TCP_DEFER_ACCEPT, &value, sizeof(value)) < 0)
1050                         log_unit_warning_errno(UNIT(s), errno, "TCP_DEFER_ACCEPT failed: %m");
1051         }
1052
1053         if (s->no_delay) {
1054                 int b = s->no_delay;
1055
1056                 if (s->socket_protocol == IPPROTO_SCTP) {
1057                         if (setsockopt(fd, SOL_SCTP, SCTP_NODELAY, &b, sizeof(b)) < 0)
1058                                 log_unit_warning_errno(UNIT(s), errno, "SCTP_NODELAY failed: %m");
1059                 } else {
1060                         if (setsockopt(fd, SOL_TCP, TCP_NODELAY, &b, sizeof(b)) < 0)
1061                                 log_unit_warning_errno(UNIT(s), errno, "TCP_NODELAY failed: %m");
1062                 }
1063         }
1064
1065         if (s->broadcast) {
1066                 int one = 1;
1067                 if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &one, sizeof(one)) < 0)
1068                         log_unit_warning_errno(UNIT(s), errno, "SO_BROADCAST failed: %m");
1069         }
1070
1071         if (s->pass_cred) {
1072                 int one = 1;
1073                 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
1074                         log_unit_warning_errno(UNIT(s), errno, "SO_PASSCRED failed: %m");
1075         }
1076
1077         if (s->pass_sec) {
1078                 int one = 1;
1079                 if (setsockopt(fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)) < 0)
1080                         log_unit_warning_errno(UNIT(s), errno, "SO_PASSSEC failed: %m");
1081         }
1082
1083         if (s->priority >= 0)
1084                 if (setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &s->priority, sizeof(s->priority)) < 0)
1085                         log_unit_warning_errno(UNIT(s), errno, "SO_PRIORITY failed: %m");
1086
1087         if (s->receive_buffer > 0) {
1088                 int value = (int) s->receive_buffer;
1089
1090                 /* We first try with SO_RCVBUFFORCE, in case we have the perms for that */
1091
1092                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &value, sizeof(value)) < 0)
1093                         if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, sizeof(value)) < 0)
1094                                 log_unit_warning_errno(UNIT(s), errno, "SO_RCVBUF failed: %m");
1095         }
1096
1097         if (s->send_buffer > 0) {
1098                 int value = (int) s->send_buffer;
1099                 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUFFORCE, &value, sizeof(value)) < 0)
1100                         if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, sizeof(value)) < 0)
1101                                 log_unit_warning_errno(UNIT(s), errno, "SO_SNDBUF failed: %m");
1102         }
1103
1104         if (s->mark >= 0)
1105                 if (setsockopt(fd, SOL_SOCKET, SO_MARK, &s->mark, sizeof(s->mark)) < 0)
1106                         log_unit_warning_errno(UNIT(s), errno, "SO_MARK failed: %m");
1107
1108         if (s->ip_tos >= 0)
1109                 if (setsockopt(fd, IPPROTO_IP, IP_TOS, &s->ip_tos, sizeof(s->ip_tos)) < 0)
1110                         log_unit_warning_errno(UNIT(s), errno, "IP_TOS failed: %m");
1111
1112         if (s->ip_ttl >= 0) {
1113                 int x;
1114
1115                 r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl));
1116
1117                 if (socket_ipv6_is_supported())
1118                         x = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &s->ip_ttl, sizeof(s->ip_ttl));
1119                 else {
1120                         x = -1;
1121                         errno = EAFNOSUPPORT;
1122                 }
1123
1124                 if (r < 0 && x < 0)
1125                         log_unit_warning_errno(UNIT(s), errno, "IP_TTL/IPV6_UNICAST_HOPS failed: %m");
1126         }
1127
1128         if (s->tcp_congestion)
1129                 if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
1130                         log_unit_warning_errno(UNIT(s), errno, "TCP_CONGESTION failed: %m");
1131
1132         if (s->smack_ip_in) {
1133                 r = mac_smack_apply_fd(fd, SMACK_ATTR_IPIN, s->smack_ip_in);
1134                 if (r < 0)
1135                         log_unit_error_errno(UNIT(s), r, "mac_smack_apply_ip_in_fd: %m");
1136         }
1137
1138         if (s->smack_ip_out) {
1139                 r = mac_smack_apply_fd(fd, SMACK_ATTR_IPOUT, s->smack_ip_out);
1140                 if (r < 0)
1141                         log_unit_error_errno(UNIT(s), r, "mac_smack_apply_ip_out_fd: %m");
1142         }
1143 }
1144
1145 static void socket_apply_fifo_options(Socket *s, int fd) {
1146         int r;
1147
1148         assert(s);
1149         assert(fd >= 0);
1150
1151         if (s->pipe_size > 0)
1152                 if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
1153                         log_unit_warning_errno(UNIT(s), errno, "Setting pipe size failed, ignoring: %m");
1154
1155         if (s->smack) {
1156                 r = mac_smack_apply_fd(fd, SMACK_ATTR_ACCESS, s->smack);
1157                 if (r < 0)
1158                         log_unit_error_errno(UNIT(s), r, "SMACK relabelling failed, ignoring: %m");
1159         }
1160 }
1161
1162 static int fifo_address_create(
1163                 const char *path,
1164                 mode_t directory_mode,
1165                 mode_t socket_mode) {
1166
1167         _cleanup_close_ int fd = -1;
1168         mode_t old_mask;
1169         struct stat st;
1170         int r;
1171
1172         assert(path);
1173
1174         mkdir_parents_label(path, directory_mode);
1175
1176         r = mac_selinux_create_file_prepare(path, S_IFIFO);
1177         if (r < 0)
1178                 return r;
1179
1180         /* Enforce the right access mode for the fifo */
1181         old_mask = umask(~ socket_mode);
1182
1183         /* Include the original umask in our mask */
1184         (void) umask(~socket_mode | old_mask);
1185
1186         r = mkfifo(path, socket_mode);
1187         (void) umask(old_mask);
1188
1189         if (r < 0 && errno != EEXIST) {
1190                 r = -errno;
1191                 goto fail;
1192         }
1193
1194         fd = open(path, O_RDWR | O_CLOEXEC | O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
1195         if (fd < 0) {
1196                 r = -errno;
1197                 goto fail;
1198         }
1199
1200         mac_selinux_create_file_clear();
1201
1202         if (fstat(fd, &st) < 0) {
1203                 r = -errno;
1204                 goto fail;
1205         }
1206
1207         if (!S_ISFIFO(st.st_mode) ||
1208             (st.st_mode & 0777) != (socket_mode & ~old_mask) ||
1209             st.st_uid != getuid() ||
1210             st.st_gid != getgid()) {
1211                 r = -EEXIST;
1212                 goto fail;
1213         }
1214
1215         r = fd;
1216         fd = -1;
1217
1218         return r;
1219
1220 fail:
1221         mac_selinux_create_file_clear();
1222         return r;
1223 }
1224
1225 static int special_address_create(const char *path, bool writable) {
1226         _cleanup_close_ int fd = -1;
1227         struct stat st;
1228         int r;
1229
1230         assert(path);
1231
1232         fd = open(path, (writable ? O_RDWR : O_RDONLY)|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1233         if (fd < 0)
1234                 return -errno;
1235
1236         if (fstat(fd, &st) < 0)
1237                 return -errno;
1238
1239         /* Check whether this is a /proc, /sys or /dev file or char device */
1240         if (!S_ISREG(st.st_mode) && !S_ISCHR(st.st_mode))
1241                 return -EEXIST;
1242
1243         r = fd;
1244         fd = -1;
1245
1246         return r;
1247 }
1248
1249 static int usbffs_address_create(const char *path) {
1250         _cleanup_close_ int fd = -1;
1251         struct stat st;
1252         int r;
1253
1254         assert(path);
1255
1256         fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1257         if (fd < 0)
1258                 return -errno;
1259
1260         if (fstat(fd, &st) < 0)
1261                 return -errno;
1262
1263         /* Check whether this is a regular file (ffs endpoint) */
1264         if (!S_ISREG(st.st_mode))
1265                 return -EEXIST;
1266
1267         r = fd;
1268         fd = -1;
1269
1270         return r;
1271 }
1272
1273 static int mq_address_create(
1274                 const char *path,
1275                 mode_t mq_mode,
1276                 long maxmsg,
1277                 long msgsize) {
1278
1279         _cleanup_close_ int fd = -1;
1280         struct stat st;
1281         mode_t old_mask;
1282         struct mq_attr _attr, *attr = NULL;
1283         int r;
1284
1285         assert(path);
1286
1287         if (maxmsg > 0 && msgsize > 0) {
1288                 _attr = (struct mq_attr) {
1289                         .mq_flags = O_NONBLOCK,
1290                         .mq_maxmsg = maxmsg,
1291                         .mq_msgsize = msgsize,
1292                 };
1293                 attr = &_attr;
1294         }
1295
1296         /* Enforce the right access mode for the mq */
1297         old_mask = umask(~ mq_mode);
1298
1299         /* Include the original umask in our mask */
1300         (void) umask(~mq_mode | old_mask);
1301         fd = mq_open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_CREAT, mq_mode, attr);
1302         (void) umask(old_mask);
1303
1304         if (fd < 0)
1305                 return -errno;
1306
1307         if (fstat(fd, &st) < 0)
1308                 return -errno;
1309
1310         if ((st.st_mode & 0777) != (mq_mode & ~old_mask) ||
1311             st.st_uid != getuid() ||
1312             st.st_gid != getgid())
1313                 return -EEXIST;
1314
1315         r = fd;
1316         fd = -1;
1317
1318         return r;
1319 }
1320
1321 static int socket_symlink(Socket *s) {
1322         const char *p;
1323         char **i;
1324
1325         assert(s);
1326
1327         p = socket_find_symlink_target(s);
1328         if (!p)
1329                 return 0;
1330
1331         STRV_FOREACH(i, s->symlinks)
1332                 symlink_label(p, *i);
1333
1334         return 0;
1335 }
1336
1337 static int usbffs_write_descs(int fd, Service *s) {
1338         int r;
1339
1340         if (!s->usb_function_descriptors || !s->usb_function_strings)
1341                 return -EINVAL;
1342
1343         r = copy_file_fd(s->usb_function_descriptors, fd, 0);
1344         if (r < 0)
1345                 return r;
1346
1347         return copy_file_fd(s->usb_function_strings, fd, 0);
1348 }
1349
1350 static int usbffs_select_ep(const struct dirent *d) {
1351         return d->d_name[0] != '.' && !streq(d->d_name, "ep0");
1352 }
1353
1354 static int usbffs_dispatch_eps(SocketPort *p) {
1355         _cleanup_free_ struct dirent **ent = NULL;
1356         int r, i, n, k;
1357
1358         r = scandir(p->path, &ent, usbffs_select_ep, alphasort);
1359         if (r < 0)
1360                 return -errno;
1361
1362         n = r;
1363         p->auxiliary_fds = new(int, n);
1364         if (!p->auxiliary_fds)
1365                 return -ENOMEM;
1366
1367         p->n_auxiliary_fds = n;
1368
1369         k = 0;
1370         for (i = 0; i < n; ++i) {
1371                 _cleanup_free_ char *ep = NULL;
1372
1373                 ep = path_make_absolute(ent[i]->d_name, p->path);
1374                 if (!ep)
1375                         return -ENOMEM;
1376
1377                 path_kill_slashes(ep);
1378
1379                 r = usbffs_address_create(ep);
1380                 if (r < 0)
1381                         goto fail;
1382
1383                 p->auxiliary_fds[k] = r;
1384
1385                 ++k;
1386                 free(ent[i]);
1387         }
1388
1389         return r;
1390
1391 fail:
1392         close_many(p->auxiliary_fds, k);
1393         p->auxiliary_fds = mfree(p->auxiliary_fds);
1394         p->n_auxiliary_fds = 0;
1395
1396         return r;
1397 }
1398
1399 static int socket_determine_selinux_label(Socket *s, char **ret) {
1400         ExecCommand *c;
1401         int r;
1402
1403         assert(s);
1404         assert(ret);
1405
1406         if (s->selinux_context_from_net) {
1407                 /* If this is requested, get label from the network label */
1408
1409                 r = mac_selinux_get_our_label(ret);
1410                 if (r == -EOPNOTSUPP)
1411                         goto no_label;
1412
1413         } else {
1414                 /* Otherwise, get it from the executable we are about to start */
1415                 r = socket_instantiate_service(s);
1416                 if (r < 0)
1417                         return r;
1418
1419                 if (!UNIT_ISSET(s->service))
1420                         goto no_label;
1421
1422                 c = SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START];
1423                 if (!c)
1424                         goto no_label;
1425
1426                 r = mac_selinux_get_create_label_from_exe(c->path, ret);
1427                 if (r == -EPERM || r == -EOPNOTSUPP)
1428                         goto no_label;
1429         }
1430
1431         return r;
1432
1433 no_label:
1434         *ret = NULL;
1435         return 0;
1436 }
1437
1438 static int socket_open_fds(Socket *s) {
1439         _cleanup_(mac_selinux_freep) char *label = NULL;
1440         bool know_label = false;
1441         SocketPort *p;
1442         int r;
1443
1444         assert(s);
1445
1446         LIST_FOREACH(port, p, s->ports) {
1447
1448                 if (p->fd >= 0)
1449                         continue;
1450
1451                 switch (p->type) {
1452
1453                 case SOCKET_SOCKET:
1454
1455                         if (!know_label) {
1456                                 /* Figure out label, if we don't it know yet. We do it once, for the first socket where
1457                                  * we need this and remember it for the rest. */
1458
1459                                 r = socket_determine_selinux_label(s, &label);
1460                                 if (r < 0)
1461                                         goto rollback;
1462
1463                                 know_label = true;
1464                         }
1465
1466                         /* Apply the socket protocol */
1467                         switch (p->address.type) {
1468
1469                         case SOCK_STREAM:
1470                         case SOCK_SEQPACKET:
1471                                 if (s->socket_protocol == IPPROTO_SCTP)
1472                                         p->address.protocol = s->socket_protocol;
1473                                 break;
1474
1475                         case SOCK_DGRAM:
1476                                 if (s->socket_protocol == IPPROTO_UDPLITE)
1477                                         p->address.protocol = s->socket_protocol;
1478                                 break;
1479                         }
1480
1481                         r = socket_address_listen(
1482                                         &p->address,
1483                                         SOCK_CLOEXEC|SOCK_NONBLOCK,
1484                                         s->backlog,
1485                                         s->bind_ipv6_only,
1486                                         s->bind_to_device,
1487                                         s->reuse_port,
1488                                         s->free_bind,
1489                                         s->transparent,
1490                                         s->directory_mode,
1491                                         s->socket_mode,
1492                                         label);
1493                         if (r < 0)
1494                                 goto rollback;
1495
1496                         p->fd = r;
1497                         socket_apply_socket_options(s, p->fd);
1498                         socket_symlink(s);
1499                         break;
1500
1501                 case SOCKET_SPECIAL:
1502
1503                         p->fd = special_address_create(p->path, s->writable);
1504                         if (p->fd < 0) {
1505                                 r = p->fd;
1506                                 goto rollback;
1507                         }
1508                         break;
1509
1510                 case SOCKET_FIFO:
1511
1512                         p->fd = fifo_address_create(
1513                                         p->path,
1514                                         s->directory_mode,
1515                                         s->socket_mode);
1516                         if (p->fd < 0) {
1517                                 r = p->fd;
1518                                 goto rollback;
1519                         }
1520
1521                         socket_apply_fifo_options(s, p->fd);
1522                         socket_symlink(s);
1523                         break;
1524
1525                 case SOCKET_MQUEUE:
1526
1527                         p->fd = mq_address_create(
1528                                         p->path,
1529                                         s->socket_mode,
1530                                         s->mq_maxmsg,
1531                                         s->mq_msgsize);
1532                         if (p->fd < 0) {
1533                                 r = p->fd;
1534                                 goto rollback;
1535                         }
1536                         break;
1537
1538                 case SOCKET_USB_FUNCTION: {
1539                         _cleanup_free_ char *ep = NULL;
1540
1541                         ep = path_make_absolute("ep0", p->path);
1542
1543                         p->fd = usbffs_address_create(ep);
1544                         if (p->fd < 0) {
1545                                 r = p->fd;
1546                                 goto rollback;
1547                         }
1548
1549                         r = usbffs_write_descs(p->fd, SERVICE(UNIT_DEREF(s->service)));
1550                         if (r < 0)
1551                                 goto rollback;
1552
1553                         r = usbffs_dispatch_eps(p);
1554                         if (r < 0)
1555                                 goto rollback;
1556
1557                         break;
1558                 }
1559                 default:
1560                         assert_not_reached("Unknown port type");
1561                 }
1562         }
1563
1564         return 0;
1565
1566 rollback:
1567         socket_close_fds(s);
1568         return r;
1569 }
1570
1571 static void socket_unwatch_fds(Socket *s) {
1572         SocketPort *p;
1573         int r;
1574
1575         assert(s);
1576
1577         LIST_FOREACH(port, p, s->ports) {
1578                 if (p->fd < 0)
1579                         continue;
1580
1581                 if (!p->event_source)
1582                         continue;
1583
1584                 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_OFF);
1585                 if (r < 0)
1586                         log_unit_debug_errno(UNIT(s), r, "Failed to disable event source: %m");
1587         }
1588 }
1589
1590 static int socket_watch_fds(Socket *s) {
1591         SocketPort *p;
1592         int r;
1593
1594         assert(s);
1595
1596         LIST_FOREACH(port, p, s->ports) {
1597                 if (p->fd < 0)
1598                         continue;
1599
1600                 if (p->event_source) {
1601                         r = sd_event_source_set_enabled(p->event_source, SD_EVENT_ON);
1602                         if (r < 0)
1603                                 goto fail;
1604                 } else {
1605                         r = sd_event_add_io(UNIT(s)->manager->event, &p->event_source, p->fd, EPOLLIN, socket_dispatch_io, p);
1606                         if (r < 0)
1607                                 goto fail;
1608
1609                         (void) sd_event_source_set_description(p->event_source, "socket-port-io");
1610                 }
1611         }
1612
1613         return 0;
1614
1615 fail:
1616         log_unit_warning_errno(UNIT(s), r, "Failed to watch listening fds: %m");
1617         socket_unwatch_fds(s);
1618         return r;
1619 }
1620
1621 enum {
1622         SOCKET_OPEN_NONE,
1623         SOCKET_OPEN_SOME,
1624         SOCKET_OPEN_ALL,
1625 };
1626
1627 static int socket_check_open(Socket *s) {
1628         bool have_open = false, have_closed = false;
1629         SocketPort *p;
1630
1631         assert(s);
1632
1633         LIST_FOREACH(port, p, s->ports) {
1634                 if (p->fd < 0)
1635                         have_closed = true;
1636                 else
1637                         have_open = true;
1638
1639                 if (have_open && have_closed)
1640                         return SOCKET_OPEN_SOME;
1641         }
1642
1643         if (have_open)
1644                 return SOCKET_OPEN_ALL;
1645
1646         return SOCKET_OPEN_NONE;
1647 }
1648
1649 static void socket_set_state(Socket *s, SocketState state) {
1650         SocketState old_state;
1651         assert(s);
1652
1653         old_state = s->state;
1654         s->state = state;
1655
1656         if (!IN_SET(state,
1657                     SOCKET_START_PRE,
1658                     SOCKET_START_CHOWN,
1659                     SOCKET_START_POST,
1660                     SOCKET_STOP_PRE,
1661                     SOCKET_STOP_PRE_SIGTERM,
1662                     SOCKET_STOP_PRE_SIGKILL,
1663                     SOCKET_STOP_POST,
1664                     SOCKET_FINAL_SIGTERM,
1665                     SOCKET_FINAL_SIGKILL)) {
1666
1667                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1668                 socket_unwatch_control_pid(s);
1669                 s->control_command = NULL;
1670                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
1671         }
1672
1673         if (state != SOCKET_LISTENING)
1674                 socket_unwatch_fds(s);
1675
1676         if (!IN_SET(state,
1677                     SOCKET_START_CHOWN,
1678                     SOCKET_START_POST,
1679                     SOCKET_LISTENING,
1680                     SOCKET_RUNNING,
1681                     SOCKET_STOP_PRE,
1682                     SOCKET_STOP_PRE_SIGTERM,
1683                     SOCKET_STOP_PRE_SIGKILL))
1684                 socket_close_fds(s);
1685
1686         if (state != old_state)
1687                 log_unit_debug(UNIT(s), "Changed %s -> %s", socket_state_to_string(old_state), socket_state_to_string(state));
1688
1689         unit_notify(UNIT(s), state_translation_table[old_state], state_translation_table[state], true);
1690 }
1691
1692 static int socket_coldplug(Unit *u) {
1693         Socket *s = SOCKET(u);
1694         int r;
1695
1696         assert(s);
1697         assert(s->state == SOCKET_DEAD);
1698
1699         if (s->deserialized_state == s->state)
1700                 return 0;
1701
1702         if (s->control_pid > 0 &&
1703             pid_is_unwaited(s->control_pid) &&
1704             IN_SET(s->deserialized_state,
1705                    SOCKET_START_PRE,
1706                    SOCKET_START_CHOWN,
1707                    SOCKET_START_POST,
1708                    SOCKET_STOP_PRE,
1709                    SOCKET_STOP_PRE_SIGTERM,
1710                    SOCKET_STOP_PRE_SIGKILL,
1711                    SOCKET_STOP_POST,
1712                    SOCKET_FINAL_SIGTERM,
1713                    SOCKET_FINAL_SIGKILL)) {
1714
1715                 r = unit_watch_pid(UNIT(s), s->control_pid);
1716                 if (r < 0)
1717                         return r;
1718
1719                 r = socket_arm_timer(s, usec_add(u->state_change_timestamp.monotonic, s->timeout_usec));
1720                 if (r < 0)
1721                         return r;
1722         }
1723
1724         if (IN_SET(s->deserialized_state,
1725                    SOCKET_START_CHOWN,
1726                    SOCKET_START_POST,
1727                    SOCKET_LISTENING,
1728                    SOCKET_RUNNING)) {
1729
1730                 /* Originally, we used to simply reopen all sockets here that we didn't have file descriptors
1731                  * for. However, this is problematic, as we won't traverse throught the SOCKET_START_CHOWN state for
1732                  * them, and thus the UID/GID wouldn't be right. Hence, instead simply check if we have all fds open,
1733                  * and if there's a mismatch, warn loudly. */
1734
1735                 r = socket_check_open(s);
1736                 if (r == SOCKET_OPEN_NONE)
1737                         log_unit_warning(UNIT(s),
1738                                          "Socket unit configuration has changed while unit has been running, "
1739                                          "no open socket file descriptor left. "
1740                                          "The socket unit is not functional until restarted.");
1741                 else if (r == SOCKET_OPEN_SOME)
1742                         log_unit_warning(UNIT(s),
1743                                          "Socket unit configuration has changed while unit has been running, "
1744                                          "and some socket file descriptors have not been opened yet. "
1745                                          "The socket unit is not fully functional until restarted.");
1746         }
1747
1748         if (s->deserialized_state == SOCKET_LISTENING) {
1749                 r = socket_watch_fds(s);
1750                 if (r < 0)
1751                         return r;
1752         }
1753
1754         if (!IN_SET(s->deserialized_state, SOCKET_DEAD, SOCKET_FAILED))
1755                 (void) unit_setup_dynamic_creds(u);
1756
1757         socket_set_state(s, s->deserialized_state);
1758         return 0;
1759 }
1760
1761 static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
1762         pid_t pid;
1763         int r;
1764         ExecParameters exec_params = {
1765                 .flags      = EXEC_APPLY_PERMISSIONS|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN,
1766                 .stdin_fd   = -1,
1767                 .stdout_fd  = -1,
1768                 .stderr_fd  = -1,
1769         };
1770
1771         assert(s);
1772         assert(c);
1773         assert(_pid);
1774
1775         (void) unit_realize_cgroup(UNIT(s));
1776         if (s->reset_cpu_usage) {
1777                 (void) unit_reset_cpu_usage(UNIT(s));
1778                 s->reset_cpu_usage = false;
1779         }
1780
1781         r = unit_setup_exec_runtime(UNIT(s));
1782         if (r < 0)
1783                 return r;
1784
1785         r = unit_setup_dynamic_creds(UNIT(s));
1786         if (r < 0)
1787                 return r;
1788
1789         r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
1790         if (r < 0)
1791                 return r;
1792
1793         exec_params.argv = c->argv;
1794         exec_params.environment = UNIT(s)->manager->environment;
1795         exec_params.confirm_spawn = manager_get_confirm_spawn(UNIT(s)->manager);
1796         exec_params.cgroup_supported = UNIT(s)->manager->cgroup_supported;
1797         exec_params.cgroup_path = UNIT(s)->cgroup_path;
1798         exec_params.cgroup_delegate = s->cgroup_context.delegate;
1799         exec_params.runtime_prefix = manager_get_runtime_prefix(UNIT(s)->manager);
1800
1801         r = exec_spawn(UNIT(s),
1802                        c,
1803                        &s->exec_context,
1804                        &exec_params,
1805                        s->exec_runtime,
1806                        &s->dynamic_creds,
1807                        &pid);
1808         if (r < 0)
1809                 return r;
1810
1811         r = unit_watch_pid(UNIT(s), pid);
1812         if (r < 0)
1813                 /* FIXME: we need to do something here */
1814                 return r;
1815
1816         *_pid = pid;
1817         return 0;
1818 }
1819
1820 static int socket_chown(Socket *s, pid_t *_pid) {
1821         pid_t pid;
1822         int r;
1823
1824         r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
1825         if (r < 0)
1826                 goto fail;
1827
1828         /* We have to resolve the user names out-of-process, hence
1829          * let's fork here. It's messy, but well, what can we do? */
1830
1831         pid = fork();
1832         if (pid < 0)
1833                 return -errno;
1834
1835         if (pid == 0) {
1836                 SocketPort *p;
1837                 uid_t uid = UID_INVALID;
1838                 gid_t gid = GID_INVALID;
1839                 int ret;
1840
1841                 (void) default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
1842                 (void) ignore_signals(SIGPIPE, -1);
1843                 log_forget_fds();
1844
1845                 if (!isempty(s->user)) {
1846                         const char *user = s->user;
1847
1848                         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
1849                         if (r < 0) {
1850                                 ret = EXIT_USER;
1851                                 goto fail_child;
1852                         }
1853                 }
1854
1855                 if (!isempty(s->group)) {
1856                         const char *group = s->group;
1857
1858                         r = get_group_creds(&group, &gid);
1859                         if (r < 0) {
1860                                 ret = EXIT_GROUP;
1861                                 goto fail_child;
1862                         }
1863                 }
1864
1865                 LIST_FOREACH(port, p, s->ports) {
1866                         const char *path = NULL;
1867
1868                         if (p->type == SOCKET_SOCKET)
1869                                 path = socket_address_get_path(&p->address);
1870                         else if (p->type == SOCKET_FIFO)
1871                                 path = p->path;
1872
1873                         if (!path)
1874                                 continue;
1875
1876                         if (chown(path, uid, gid) < 0) {
1877                                 r = -errno;
1878                                 ret = EXIT_CHOWN;
1879                                 goto fail_child;
1880                         }
1881                 }
1882
1883                 _exit(0);
1884
1885         fail_child:
1886                 log_open();
1887                 log_error_errno(r, "Failed to chown socket at step %s: %m", exit_status_to_string(ret, EXIT_STATUS_SYSTEMD));
1888
1889                 _exit(ret);
1890         }
1891
1892         r = unit_watch_pid(UNIT(s), pid);
1893         if (r < 0)
1894                 goto fail;
1895
1896         *_pid = pid;
1897         return 0;
1898
1899 fail:
1900         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1901         return r;
1902 }
1903
1904 static void socket_enter_dead(Socket *s, SocketResult f) {
1905         assert(s);
1906
1907         if (s->result == SOCKET_SUCCESS)
1908                 s->result = f;
1909
1910         socket_set_state(s, s->result != SOCKET_SUCCESS ? SOCKET_FAILED : SOCKET_DEAD);
1911
1912         exec_runtime_destroy(s->exec_runtime);
1913         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
1914
1915         exec_context_destroy_runtime_directory(&s->exec_context, manager_get_runtime_prefix(UNIT(s)->manager));
1916
1917         unit_unref_uid_gid(UNIT(s), true);
1918
1919         dynamic_creds_destroy(&s->dynamic_creds);
1920 }
1921
1922 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f);
1923
1924 static void socket_enter_stop_post(Socket *s, SocketResult f) {
1925         int r;
1926         assert(s);
1927
1928         if (s->result == SOCKET_SUCCESS)
1929                 s->result = f;
1930
1931         socket_unwatch_control_pid(s);
1932         s->control_command_id = SOCKET_EXEC_STOP_POST;
1933         s->control_command = s->exec_command[SOCKET_EXEC_STOP_POST];
1934
1935         if (s->control_command) {
1936                 r = socket_spawn(s, s->control_command, &s->control_pid);
1937                 if (r < 0)
1938                         goto fail;
1939
1940                 socket_set_state(s, SOCKET_STOP_POST);
1941         } else
1942                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_SUCCESS);
1943
1944         return;
1945
1946 fail:
1947         log_unit_warning_errno(UNIT(s), r, "Failed to run 'stop-post' task: %m");
1948         socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1949 }
1950
1951 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f) {
1952         int r;
1953
1954         assert(s);
1955
1956         if (s->result == SOCKET_SUCCESS)
1957                 s->result = f;
1958
1959         r = unit_kill_context(
1960                         UNIT(s),
1961                         &s->kill_context,
1962                         (state != SOCKET_STOP_PRE_SIGTERM && state != SOCKET_FINAL_SIGTERM) ?
1963                         KILL_KILL : KILL_TERMINATE,
1964                         -1,
1965                         s->control_pid,
1966                         false);
1967         if (r < 0)
1968                 goto fail;
1969
1970         if (r > 0) {
1971                 r = socket_arm_timer(s, usec_add(now(CLOCK_MONOTONIC), s->timeout_usec));
1972                 if (r < 0)
1973                         goto fail;
1974
1975                 socket_set_state(s, state);
1976         } else if (state == SOCKET_STOP_PRE_SIGTERM)
1977                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_SUCCESS);
1978         else if (state == SOCKET_STOP_PRE_SIGKILL)
1979                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1980         else if (state == SOCKET_FINAL_SIGTERM)
1981                 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
1982         else
1983                 socket_enter_dead(s, SOCKET_SUCCESS);
1984
1985         return;
1986
1987 fail:
1988         log_unit_warning_errno(UNIT(s), r, "Failed to kill processes: %m");
1989
1990         if (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_STOP_PRE_SIGKILL)
1991                 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1992         else
1993                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1994 }
1995
1996 static void socket_enter_stop_pre(Socket *s, SocketResult f) {
1997         int r;
1998         assert(s);
1999
2000         if (s->result == SOCKET_SUCCESS)
2001                 s->result = f;
2002
2003         socket_unwatch_control_pid(s);
2004         s->control_command_id = SOCKET_EXEC_STOP_PRE;
2005         s->control_command = s->exec_command[SOCKET_EXEC_STOP_PRE];
2006
2007         if (s->control_command) {
2008                 r = socket_spawn(s, s->control_command, &s->control_pid);
2009                 if (r < 0)
2010                         goto fail;
2011
2012                 socket_set_state(s, SOCKET_STOP_PRE);
2013         } else
2014                 socket_enter_stop_post(s, SOCKET_SUCCESS);
2015
2016         return;
2017
2018 fail:
2019         log_unit_warning_errno(UNIT(s), r, "Failed to run 'stop-pre' task: %m");
2020         socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
2021 }
2022
2023 static void socket_enter_listening(Socket *s) {
2024         int r;
2025         assert(s);
2026
2027         r = socket_watch_fds(s);
2028         if (r < 0) {
2029                 log_unit_warning_errno(UNIT(s), r, "Failed to watch sockets: %m");
2030                 goto fail;
2031         }
2032
2033         socket_set_state(s, SOCKET_LISTENING);
2034         return;
2035
2036 fail:
2037         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2038 }
2039
2040 static void socket_enter_start_post(Socket *s) {
2041         int r;
2042         assert(s);
2043
2044         socket_unwatch_control_pid(s);
2045         s->control_command_id = SOCKET_EXEC_START_POST;
2046         s->control_command = s->exec_command[SOCKET_EXEC_START_POST];
2047
2048         if (s->control_command) {
2049                 r = socket_spawn(s, s->control_command, &s->control_pid);
2050                 if (r < 0) {
2051                         log_unit_warning_errno(UNIT(s), r, "Failed to run 'start-post' task: %m");
2052                         goto fail;
2053                 }
2054
2055                 socket_set_state(s, SOCKET_START_POST);
2056         } else
2057                 socket_enter_listening(s);
2058
2059         return;
2060
2061 fail:
2062         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2063 }
2064
2065 static void socket_enter_start_chown(Socket *s) {
2066         int r;
2067
2068         assert(s);
2069
2070         r = socket_open_fds(s);
2071         if (r < 0) {
2072                 log_unit_warning_errno(UNIT(s), r, "Failed to listen on sockets: %m");
2073                 goto fail;
2074         }
2075
2076         if (!isempty(s->user) || !isempty(s->group)) {
2077
2078                 socket_unwatch_control_pid(s);
2079                 s->control_command_id = SOCKET_EXEC_START_CHOWN;
2080                 s->control_command = NULL;
2081
2082                 r = socket_chown(s, &s->control_pid);
2083                 if (r < 0) {
2084                         log_unit_warning_errno(UNIT(s), r, "Failed to fork 'start-chown' task: %m");
2085                         goto fail;
2086                 }
2087
2088                 socket_set_state(s, SOCKET_START_CHOWN);
2089         } else
2090                 socket_enter_start_post(s);
2091
2092         return;
2093
2094 fail:
2095         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2096 }
2097
2098 static void socket_enter_start_pre(Socket *s) {
2099         int r;
2100         assert(s);
2101
2102         socket_unwatch_control_pid(s);
2103         s->control_command_id = SOCKET_EXEC_START_PRE;
2104         s->control_command = s->exec_command[SOCKET_EXEC_START_PRE];
2105
2106         if (s->control_command) {
2107                 r = socket_spawn(s, s->control_command, &s->control_pid);
2108                 if (r < 0) {
2109                         log_unit_warning_errno(UNIT(s), r, "Failed to run 'start-pre' task: %m");
2110                         goto fail;
2111                 }
2112
2113                 socket_set_state(s, SOCKET_START_PRE);
2114         } else
2115                 socket_enter_start_chown(s);
2116
2117         return;
2118
2119 fail:
2120         socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
2121 }
2122
2123 static void flush_ports(Socket *s) {
2124         SocketPort *p;
2125
2126         /* Flush all incoming traffic, regardless if actual bytes or new connections, so that this socket isn't busy
2127          * anymore */
2128
2129         LIST_FOREACH(port, p, s->ports) {
2130                 if (p->fd < 0)
2131                         continue;
2132
2133                 (void) flush_accept(p->fd);
2134                 (void) flush_fd(p->fd);
2135         }
2136 }
2137
2138 static void socket_enter_running(Socket *s, int cfd) {
2139         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2140         int r;
2141
2142         /* Note that this call takes possession of the connection fd passed. It either has to assign it somewhere or
2143          * close it. */
2144
2145         assert(s);
2146
2147         /* We don't take connections anymore if we are supposed to shut down anyway */
2148         if (unit_stop_pending(UNIT(s))) {
2149
2150                 log_unit_debug(UNIT(s), "Suppressing connection request since unit stop is scheduled.");
2151
2152                 if (cfd >= 0)
2153                         cfd = safe_close(cfd);
2154                 else
2155                         flush_ports(s);
2156
2157                 return;
2158         }
2159
2160         if (!ratelimit_test(&s->trigger_limit)) {
2161                 safe_close(cfd);
2162                 log_unit_warning(UNIT(s), "Trigger limit hit, refusing further activation.");
2163                 socket_enter_stop_pre(s, SOCKET_FAILURE_TRIGGER_LIMIT_HIT);
2164                 return;
2165         }
2166
2167         if (cfd < 0) {
2168                 Iterator i;
2169                 Unit *other;
2170                 bool pending = false;
2171
2172                 /* If there's already a start pending don't bother to
2173                  * do anything */
2174                 SET_FOREACH(other, UNIT(s)->dependencies[UNIT_TRIGGERS], i)
2175                         if (unit_active_or_pending(other)) {
2176                                 pending = true;
2177                                 break;
2178                         }
2179
2180                 if (!pending) {
2181                         if (!UNIT_ISSET(s->service)) {
2182                                 log_unit_error(UNIT(s), "Service to activate vanished, refusing activation.");
2183                                 r = -ENOENT;
2184                                 goto fail;
2185                         }
2186
2187                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, &error, NULL);
2188                         if (r < 0)
2189                                 goto fail;
2190                 }
2191
2192                 socket_set_state(s, SOCKET_RUNNING);
2193         } else {
2194                 _cleanup_free_ char *prefix = NULL, *instance = NULL, *name = NULL;
2195                 _cleanup_(socket_peer_unrefp) SocketPeer *p = NULL;
2196                 Service *service;
2197
2198                 if (s->n_connections >= s->max_connections) {
2199                         log_unit_warning(UNIT(s), "Too many incoming connections (%u), dropping connection.",
2200                                          s->n_connections);
2201                         safe_close(cfd);
2202                         return;
2203                 }
2204
2205                 if (s->max_connections_per_source > 0) {
2206                         r = socket_acquire_peer(s, cfd, &p);
2207                         if (r < 0) {
2208                                 safe_close(cfd);
2209                                 return;
2210                         } else if (r > 0 && p->n_ref > s->max_connections_per_source) {
2211                                 _cleanup_free_ char *t = NULL;
2212
2213                                 (void) sockaddr_pretty(&p->peer.sa, p->peer_salen, true, false, &t);
2214
2215                                 log_unit_warning(UNIT(s),
2216                                                  "Too many incoming connections (%u) from source %s, dropping connection.",
2217                                                  p->n_ref, strnull(t));
2218                                 safe_close(cfd);
2219                                 return;
2220                         }
2221                 }
2222
2223                 r = socket_instantiate_service(s);
2224                 if (r < 0)
2225                         goto fail;
2226
2227                 r = instance_from_socket(cfd, s->n_accepted, &instance);
2228                 if (r < 0) {
2229                         if (r != -ENOTCONN)
2230                                 goto fail;
2231
2232                         /* ENOTCONN is legitimate if TCP RST was received.
2233                          * This connection is over, but the socket unit lives on. */
2234                         log_unit_debug(UNIT(s), "Got ENOTCONN on incoming socket, assuming aborted connection attempt, ignoring.");
2235                         safe_close(cfd);
2236                         return;
2237                 }
2238
2239                 r = unit_name_to_prefix(UNIT(s)->id, &prefix);
2240                 if (r < 0)
2241                         goto fail;
2242
2243                 r = unit_name_build(prefix, instance, ".service", &name);
2244                 if (r < 0)
2245                         goto fail;
2246
2247                 r = unit_add_name(UNIT_DEREF(s->service), name);
2248                 if (r < 0)
2249                         goto fail;
2250
2251                 service = SERVICE(UNIT_DEREF(s->service));
2252                 unit_ref_unset(&s->service);
2253
2254                 s->n_accepted++;
2255                 unit_choose_id(UNIT(service), name);
2256
2257                 r = service_set_socket_fd(service, cfd, s, s->selinux_context_from_net);
2258                 if (r < 0)
2259                         goto fail;
2260
2261                 cfd = -1; /* We passed ownership of the fd to the service now. Forget it here. */
2262                 s->n_connections++;
2263
2264                 service->peer = p; /* Pass ownership of the peer reference */
2265                 p = NULL;
2266
2267                 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, &error, NULL);
2268                 if (r < 0) {
2269                         /* We failed to activate the new service, but it still exists. Let's make sure the service
2270                          * closes and forgets the connection fd again, immediately. */
2271                         service_close_socket_fd(service);
2272                         goto fail;
2273                 }
2274
2275                 /* Notify clients about changed counters */
2276                 unit_add_to_dbus_queue(UNIT(s));
2277         }
2278
2279         return;
2280
2281 fail:
2282         log_unit_warning(UNIT(s), "Failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",
2283                          cfd >= 0 ? "template" : "non-template",
2284                          bus_error_message(&error, r));
2285
2286         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2287         safe_close(cfd);
2288 }
2289
2290 static void socket_run_next(Socket *s) {
2291         int r;
2292
2293         assert(s);
2294         assert(s->control_command);
2295         assert(s->control_command->command_next);
2296
2297         socket_unwatch_control_pid(s);
2298
2299         s->control_command = s->control_command->command_next;
2300
2301         r = socket_spawn(s, s->control_command, &s->control_pid);
2302         if (r < 0)
2303                 goto fail;
2304
2305         return;
2306
2307 fail:
2308         log_unit_warning_errno(UNIT(s), r, "Failed to run next task: %m");
2309
2310         if (s->state == SOCKET_START_POST)
2311                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
2312         else if (s->state == SOCKET_STOP_POST)
2313                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
2314         else
2315                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
2316 }
2317
2318 static int socket_start(Unit *u) {
2319         Socket *s = SOCKET(u);
2320         int r;
2321
2322         assert(s);
2323
2324         /* We cannot fulfill this request right now, try again later
2325          * please! */
2326         if (IN_SET(s->state,
2327                    SOCKET_STOP_PRE,
2328                    SOCKET_STOP_PRE_SIGKILL,
2329                    SOCKET_STOP_PRE_SIGTERM,
2330                    SOCKET_STOP_POST,
2331                    SOCKET_FINAL_SIGTERM,
2332                    SOCKET_FINAL_SIGKILL))
2333                 return -EAGAIN;
2334
2335         /* Already on it! */
2336         if (IN_SET(s->state,
2337                    SOCKET_START_PRE,
2338                    SOCKET_START_CHOWN,
2339                    SOCKET_START_POST))
2340                 return 0;
2341
2342         /* Cannot run this without the service being around */
2343         if (UNIT_ISSET(s->service)) {
2344                 Service *service;
2345
2346                 service = SERVICE(UNIT_DEREF(s->service));
2347
2348                 if (UNIT(service)->load_state != UNIT_LOADED) {
2349                         log_unit_error(u, "Socket service %s not loaded, refusing.", UNIT(service)->id);
2350                         return -ENOENT;
2351                 }
2352
2353                 /* If the service is already active we cannot start the
2354                  * socket */
2355                 if (service->state != SERVICE_DEAD &&
2356                     service->state != SERVICE_FAILED &&
2357                     service->state != SERVICE_AUTO_RESTART) {
2358                         log_unit_error(u, "Socket service %s already active, refusing.", UNIT(service)->id);
2359                         return -EBUSY;
2360                 }
2361         }
2362
2363         assert(s->state == SOCKET_DEAD || s->state == SOCKET_FAILED);
2364
2365         r = unit_start_limit_test(u);
2366         if (r < 0) {
2367                 socket_enter_dead(s, SOCKET_FAILURE_START_LIMIT_HIT);
2368                 return r;
2369         }
2370
2371         r = unit_acquire_invocation_id(u);
2372         if (r < 0)
2373                 return r;
2374
2375         s->result = SOCKET_SUCCESS;
2376         s->reset_cpu_usage = true;
2377
2378         socket_enter_start_pre(s);
2379         return 1;
2380 }
2381
2382 static int socket_stop(Unit *u) {
2383         Socket *s = SOCKET(u);
2384
2385         assert(s);
2386
2387         /* Already on it */
2388         if (IN_SET(s->state,
2389                    SOCKET_STOP_PRE,
2390                    SOCKET_STOP_PRE_SIGTERM,
2391                    SOCKET_STOP_PRE_SIGKILL,
2392                    SOCKET_STOP_POST,
2393                    SOCKET_FINAL_SIGTERM,
2394                    SOCKET_FINAL_SIGKILL))
2395                 return 0;
2396
2397         /* If there's already something running we go directly into
2398          * kill mode. */
2399         if (IN_SET(s->state,
2400                    SOCKET_START_PRE,
2401                    SOCKET_START_CHOWN,
2402                    SOCKET_START_POST)) {
2403                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_SUCCESS);
2404                 return -EAGAIN;
2405         }
2406
2407         assert(s->state == SOCKET_LISTENING || s->state == SOCKET_RUNNING);
2408
2409         socket_enter_stop_pre(s, SOCKET_SUCCESS);
2410         return 1;
2411 }
2412
2413 static int socket_serialize(Unit *u, FILE *f, FDSet *fds) {
2414         Socket *s = SOCKET(u);
2415         SocketPort *p;
2416         int r;
2417
2418         assert(u);
2419         assert(f);
2420         assert(fds);
2421
2422         unit_serialize_item(u, f, "state", socket_state_to_string(s->state));
2423         unit_serialize_item(u, f, "result", socket_result_to_string(s->result));
2424         unit_serialize_item_format(u, f, "n-accepted", "%u", s->n_accepted);
2425
2426         if (s->control_pid > 0)
2427                 unit_serialize_item_format(u, f, "control-pid", PID_FMT, s->control_pid);
2428
2429         if (s->control_command_id >= 0)
2430                 unit_serialize_item(u, f, "control-command", socket_exec_command_to_string(s->control_command_id));
2431
2432         LIST_FOREACH(port, p, s->ports) {
2433                 int copy;
2434
2435                 if (p->fd < 0)
2436                         continue;
2437
2438                 copy = fdset_put_dup(fds, p->fd);
2439                 if (copy < 0)
2440                         return copy;
2441
2442                 if (p->type == SOCKET_SOCKET) {
2443                         _cleanup_free_ char *t = NULL;
2444
2445                         r = socket_address_print(&p->address, &t);
2446                         if (r < 0)
2447                                 return r;
2448
2449                         if (socket_address_family(&p->address) == AF_NETLINK)
2450                                 unit_serialize_item_format(u, f, "netlink", "%i %s", copy, t);
2451                         else
2452                                 unit_serialize_item_format(u, f, "socket", "%i %i %s", copy, p->address.type, t);
2453
2454                 } else if (p->type == SOCKET_SPECIAL)
2455                         unit_serialize_item_format(u, f, "special", "%i %s", copy, p->path);
2456                 else if (p->type == SOCKET_MQUEUE)
2457                         unit_serialize_item_format(u, f, "mqueue", "%i %s", copy, p->path);
2458                 else if (p->type == SOCKET_USB_FUNCTION)
2459                         unit_serialize_item_format(u, f, "ffs", "%i %s", copy, p->path);
2460                 else {
2461                         assert(p->type == SOCKET_FIFO);
2462                         unit_serialize_item_format(u, f, "fifo", "%i %s", copy, p->path);
2463                 }
2464         }
2465
2466         return 0;
2467 }
2468
2469 static void socket_port_take_fd(SocketPort *p, FDSet *fds, int fd) {
2470         safe_close(p->fd);
2471         p->fd = fdset_remove(fds, fd);
2472 }
2473
2474 static int socket_deserialize_item(Unit *u, const char *key, const char *value, FDSet *fds) {
2475         Socket *s = SOCKET(u);
2476
2477         assert(u);
2478         assert(key);
2479         assert(value);
2480
2481         if (streq(key, "state")) {
2482                 SocketState state;
2483
2484                 state = socket_state_from_string(value);
2485                 if (state < 0)
2486                         log_unit_debug(u, "Failed to parse state value: %s", value);
2487                 else
2488                         s->deserialized_state = state;
2489         } else if (streq(key, "result")) {
2490                 SocketResult f;
2491
2492                 f = socket_result_from_string(value);
2493                 if (f < 0)
2494                         log_unit_debug(u, "Failed to parse result value: %s", value);
2495                 else if (f != SOCKET_SUCCESS)
2496                         s->result = f;
2497
2498         } else if (streq(key, "n-accepted")) {
2499                 unsigned k;
2500
2501                 if (safe_atou(value, &k) < 0)
2502                         log_unit_debug(u, "Failed to parse n-accepted value: %s", value);
2503                 else
2504                         s->n_accepted += k;
2505         } else if (streq(key, "control-pid")) {
2506                 pid_t pid;
2507
2508                 if (parse_pid(value, &pid) < 0)
2509                         log_unit_debug(u, "Failed to parse control-pid value: %s", value);
2510                 else
2511                         s->control_pid = pid;
2512         } else if (streq(key, "control-command")) {
2513                 SocketExecCommand id;
2514
2515                 id = socket_exec_command_from_string(value);
2516                 if (id < 0)
2517                         log_unit_debug(u, "Failed to parse exec-command value: %s", value);
2518                 else {
2519                         s->control_command_id = id;
2520                         s->control_command = s->exec_command[id];
2521                 }
2522         } else if (streq(key, "fifo")) {
2523                 int fd, skip = 0;
2524                 SocketPort *p;
2525
2526                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2527                         log_unit_debug(u, "Failed to parse fifo value: %s", value);
2528                 else
2529                         LIST_FOREACH(port, p, s->ports)
2530                                 if (p->type == SOCKET_FIFO &&
2531                                     path_equal_or_files_same(p->path, value+skip, 0)) {
2532                                         socket_port_take_fd(p, fds, fd);
2533                                         break;
2534                                 }
2535
2536         } else if (streq(key, "special")) {
2537                 int fd, skip = 0;
2538                 SocketPort *p;
2539
2540                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2541                         log_unit_debug(u, "Failed to parse special value: %s", value);
2542                 else
2543                         LIST_FOREACH(port, p, s->ports)
2544                                 if (p->type == SOCKET_SPECIAL &&
2545                                     path_equal_or_files_same(p->path, value+skip, 0)) {
2546                                         socket_port_take_fd(p, fds, fd);
2547                                         break;
2548                                 }
2549
2550         } else if (streq(key, "mqueue")) {
2551                 int fd, skip = 0;
2552                 SocketPort *p;
2553
2554                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2555                         log_unit_debug(u, "Failed to parse mqueue value: %s", value);
2556                 else
2557                         LIST_FOREACH(port, p, s->ports)
2558                                 if (p->type == SOCKET_MQUEUE &&
2559                                     streq(p->path, value+skip)) {
2560                                         socket_port_take_fd(p, fds, fd);
2561                                         break;
2562                                 }
2563
2564         } else if (streq(key, "socket")) {
2565                 int fd, type, skip = 0;
2566                 SocketPort *p;
2567
2568                 if (sscanf(value, "%i %i %n", &fd, &type, &skip) < 2 || fd < 0 || type < 0 || !fdset_contains(fds, fd))
2569                         log_unit_debug(u, "Failed to parse socket value: %s", value);
2570                 else
2571                         LIST_FOREACH(port, p, s->ports)
2572                                 if (socket_address_is(&p->address, value+skip, type)) {
2573                                         socket_port_take_fd(p, fds, fd);
2574                                         break;
2575                                 }
2576
2577         } else if (streq(key, "netlink")) {
2578                 int fd, skip = 0;
2579                 SocketPort *p;
2580
2581                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2582                         log_unit_debug(u, "Failed to parse socket value: %s", value);
2583                 else
2584                         LIST_FOREACH(port, p, s->ports)
2585                                 if (socket_address_is_netlink(&p->address, value+skip)) {
2586                                         socket_port_take_fd(p, fds, fd);
2587                                         break;
2588                                 }
2589
2590         } else if (streq(key, "ffs")) {
2591                 int fd, skip = 0;
2592                 SocketPort *p;
2593
2594                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2595                         log_unit_debug(u, "Failed to parse ffs value: %s", value);
2596                 else
2597                         LIST_FOREACH(port, p, s->ports)
2598                                 if (p->type == SOCKET_USB_FUNCTION &&
2599                                     path_equal_or_files_same(p->path, value+skip, 0)) {
2600                                         socket_port_take_fd(p, fds, fd);
2601                                         break;
2602                                 }
2603
2604         } else
2605                 log_unit_debug(UNIT(s), "Unknown serialization key: %s", key);
2606
2607         return 0;
2608 }
2609
2610 static void socket_distribute_fds(Unit *u, FDSet *fds) {
2611         Socket *s = SOCKET(u);
2612         SocketPort *p;
2613
2614         assert(u);
2615
2616         LIST_FOREACH(port, p, s->ports) {
2617                 Iterator i;
2618                 int fd;
2619
2620                 if (p->type != SOCKET_SOCKET)
2621                         continue;
2622
2623                 if (p->fd >= 0)
2624                         continue;
2625
2626                 FDSET_FOREACH(fd, fds, i) {
2627                         if (socket_address_matches_fd(&p->address, fd)) {
2628                                 p->fd = fdset_remove(fds, fd);
2629                                 s->deserialized_state = SOCKET_LISTENING;
2630                                 break;
2631                         }
2632                 }
2633         }
2634 }
2635
2636 _pure_ static UnitActiveState socket_active_state(Unit *u) {
2637         assert(u);
2638
2639         return state_translation_table[SOCKET(u)->state];
2640 }
2641
2642 _pure_ static const char *socket_sub_state_to_string(Unit *u) {
2643         assert(u);
2644
2645         return socket_state_to_string(SOCKET(u)->state);
2646 }
2647
2648 const char* socket_port_type_to_string(SocketPort *p) {
2649
2650         assert(p);
2651
2652         switch (p->type) {
2653
2654         case SOCKET_SOCKET:
2655
2656                 switch (p->address.type) {
2657
2658                 case SOCK_STREAM:
2659                         return "Stream";
2660
2661                 case SOCK_DGRAM:
2662                         return "Datagram";
2663
2664                 case SOCK_SEQPACKET:
2665                         return "SequentialPacket";
2666
2667                 case SOCK_RAW:
2668                         if (socket_address_family(&p->address) == AF_NETLINK)
2669                                 return "Netlink";
2670
2671                         /* fall through */
2672                 default:
2673                         return NULL;
2674                 }
2675
2676         case SOCKET_SPECIAL:
2677                 return "Special";
2678
2679         case SOCKET_MQUEUE:
2680                 return "MessageQueue";
2681
2682         case SOCKET_FIFO:
2683                 return "FIFO";
2684
2685         case SOCKET_USB_FUNCTION:
2686                 return "USBFunction";
2687
2688         default:
2689                 return NULL;
2690         }
2691 }
2692
2693 _pure_ static bool socket_check_gc(Unit *u) {
2694         Socket *s = SOCKET(u);
2695
2696         assert(u);
2697
2698         return s->n_connections > 0;
2699 }
2700
2701 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
2702         SocketPort *p = userdata;
2703         int cfd = -1;
2704
2705         assert(p);
2706         assert(fd >= 0);
2707
2708         if (p->socket->state != SOCKET_LISTENING)
2709                 return 0;
2710
2711         log_unit_debug(UNIT(p->socket), "Incoming traffic");
2712
2713         if (revents != EPOLLIN) {
2714
2715                 if (revents & EPOLLHUP)
2716                         log_unit_error(UNIT(p->socket), "Got POLLHUP on a listening socket. The service probably invoked shutdown() on it, and should better not do that.");
2717                 else
2718                         log_unit_error(UNIT(p->socket), "Got unexpected poll event (0x%x) on socket.", revents);
2719                 goto fail;
2720         }
2721
2722         if (p->socket->accept &&
2723             p->type == SOCKET_SOCKET &&
2724             socket_address_can_accept(&p->address)) {
2725
2726                 for (;;) {
2727
2728                         cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
2729                         if (cfd < 0) {
2730
2731                                 if (errno == EINTR)
2732                                         continue;
2733
2734                                 log_unit_error_errno(UNIT(p->socket), errno, "Failed to accept socket: %m");
2735                                 goto fail;
2736                         }
2737
2738                         break;
2739                 }
2740
2741                 socket_apply_socket_options(p->socket, cfd);
2742         }
2743
2744         socket_enter_running(p->socket, cfd);
2745         return 0;
2746
2747 fail:
2748         socket_enter_stop_pre(p->socket, SOCKET_FAILURE_RESOURCES);
2749         return 0;
2750 }
2751
2752 static void socket_sigchld_event(Unit *u, pid_t pid, int code, int status) {
2753         Socket *s = SOCKET(u);
2754         SocketResult f;
2755
2756         assert(s);
2757         assert(pid >= 0);
2758
2759         if (pid != s->control_pid)
2760                 return;
2761
2762         s->control_pid = 0;
2763
2764         if (is_clean_exit(code, status, EXIT_CLEAN_COMMAND, NULL))
2765                 f = SOCKET_SUCCESS;
2766         else if (code == CLD_EXITED)
2767                 f = SOCKET_FAILURE_EXIT_CODE;
2768         else if (code == CLD_KILLED)
2769                 f = SOCKET_FAILURE_SIGNAL;
2770         else if (code == CLD_DUMPED)
2771                 f = SOCKET_FAILURE_CORE_DUMP;
2772         else
2773                 assert_not_reached("Unknown sigchld code");
2774
2775         if (s->control_command) {
2776                 exec_status_exit(&s->control_command->exec_status, &s->exec_context, pid, code, status);
2777
2778                 if (s->control_command->ignore)
2779                         f = SOCKET_SUCCESS;
2780         }
2781
2782         log_unit_full(u, f == SOCKET_SUCCESS ? LOG_DEBUG : LOG_NOTICE, 0,
2783                       "Control process exited, code=%s status=%i",
2784                       sigchld_code_to_string(code), status);
2785
2786         if (s->result == SOCKET_SUCCESS)
2787                 s->result = f;
2788
2789         if (s->control_command &&
2790             s->control_command->command_next &&
2791             f == SOCKET_SUCCESS) {
2792
2793                 log_unit_debug(u, "Running next command for state %s", socket_state_to_string(s->state));
2794                 socket_run_next(s);
2795         } else {
2796                 s->control_command = NULL;
2797                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
2798
2799                 /* No further commands for this step, so let's figure
2800                  * out what to do next */
2801
2802                 log_unit_debug(u, "Got final SIGCHLD for state %s", socket_state_to_string(s->state));
2803
2804                 switch (s->state) {
2805
2806                 case SOCKET_START_PRE:
2807                         if (f == SOCKET_SUCCESS)
2808                                 socket_enter_start_chown(s);
2809                         else
2810                                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, f);
2811                         break;
2812
2813                 case SOCKET_START_CHOWN:
2814                         if (f == SOCKET_SUCCESS)
2815                                 socket_enter_start_post(s);
2816                         else
2817                                 socket_enter_stop_pre(s, f);
2818                         break;
2819
2820                 case SOCKET_START_POST:
2821                         if (f == SOCKET_SUCCESS)
2822                                 socket_enter_listening(s);
2823                         else
2824                                 socket_enter_stop_pre(s, f);
2825                         break;
2826
2827                 case SOCKET_STOP_PRE:
2828                 case SOCKET_STOP_PRE_SIGTERM:
2829                 case SOCKET_STOP_PRE_SIGKILL:
2830                         socket_enter_stop_post(s, f);
2831                         break;
2832
2833                 case SOCKET_STOP_POST:
2834                 case SOCKET_FINAL_SIGTERM:
2835                 case SOCKET_FINAL_SIGKILL:
2836                         socket_enter_dead(s, f);
2837                         break;
2838
2839                 default:
2840                         assert_not_reached("Uh, control process died at wrong time.");
2841                 }
2842         }
2843
2844         /* Notify clients about changed exit status */
2845         unit_add_to_dbus_queue(u);
2846 }
2847
2848 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata) {
2849         Socket *s = SOCKET(userdata);
2850
2851         assert(s);
2852         assert(s->timer_event_source == source);
2853
2854         switch (s->state) {
2855
2856         case SOCKET_START_PRE:
2857                 log_unit_warning(UNIT(s), "Starting timed out. Terminating.");
2858                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2859                 break;
2860
2861         case SOCKET_START_CHOWN:
2862         case SOCKET_START_POST:
2863                 log_unit_warning(UNIT(s), "Starting timed out. Stopping.");
2864                 socket_enter_stop_pre(s, SOCKET_FAILURE_TIMEOUT);
2865                 break;
2866
2867         case SOCKET_STOP_PRE:
2868                 log_unit_warning(UNIT(s), "Stopping timed out. Terminating.");
2869                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2870                 break;
2871
2872         case SOCKET_STOP_PRE_SIGTERM:
2873                 if (s->kill_context.send_sigkill) {
2874                         log_unit_warning(UNIT(s), "Stopping timed out. Killing.");
2875                         socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2876                 } else {
2877                         log_unit_warning(UNIT(s), "Stopping timed out. Skipping SIGKILL. Ignoring.");
2878                         socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2879                 }
2880                 break;
2881
2882         case SOCKET_STOP_PRE_SIGKILL:
2883                 log_unit_warning(UNIT(s), "Processes still around after SIGKILL. Ignoring.");
2884                 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2885                 break;
2886
2887         case SOCKET_STOP_POST:
2888                 log_unit_warning(UNIT(s), "Stopping timed out (2). Terminating.");
2889                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2890                 break;
2891
2892         case SOCKET_FINAL_SIGTERM:
2893                 if (s->kill_context.send_sigkill) {
2894                         log_unit_warning(UNIT(s), "Stopping timed out (2). Killing.");
2895                         socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2896                 } else {
2897                         log_unit_warning(UNIT(s), "Stopping timed out (2). Skipping SIGKILL. Ignoring.");
2898                         socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2899                 }
2900                 break;
2901
2902         case SOCKET_FINAL_SIGKILL:
2903                 log_unit_warning(UNIT(s), "Still around after SIGKILL (2). Entering failed mode.");
2904                 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2905                 break;
2906
2907         default:
2908                 assert_not_reached("Timeout at wrong time.");
2909         }
2910
2911         return 0;
2912 }
2913
2914 int socket_collect_fds(Socket *s, int **fds) {
2915         int *rfds, k = 0, n = 0;
2916         SocketPort *p;
2917
2918         assert(s);
2919         assert(fds);
2920
2921         /* Called from the service code for requesting our fds */
2922
2923         LIST_FOREACH(port, p, s->ports) {
2924                 if (p->fd >= 0)
2925                         n++;
2926                 n += p->n_auxiliary_fds;
2927         }
2928
2929         if (n <= 0) {
2930                 *fds = NULL;
2931                 return 0;
2932         }
2933
2934         rfds = new(int, n);
2935         if (!rfds)
2936                 return -ENOMEM;
2937
2938         LIST_FOREACH(port, p, s->ports) {
2939                 int i;
2940
2941                 if (p->fd >= 0)
2942                         rfds[k++] = p->fd;
2943                 for (i = 0; i < p->n_auxiliary_fds; ++i)
2944                         rfds[k++] = p->auxiliary_fds[i];
2945         }
2946
2947         assert(k == n);
2948
2949         *fds = rfds;
2950         return n;
2951 }
2952
2953 static void socket_reset_failed(Unit *u) {
2954         Socket *s = SOCKET(u);
2955
2956         assert(s);
2957
2958         if (s->state == SOCKET_FAILED)
2959                 socket_set_state(s, SOCKET_DEAD);
2960
2961         s->result = SOCKET_SUCCESS;
2962 }
2963
2964 void socket_connection_unref(Socket *s) {
2965         assert(s);
2966
2967         /* The service is dead. Yay!
2968          *
2969          * This is strictly for one-instance-per-connection
2970          * services. */
2971
2972         assert(s->n_connections > 0);
2973         s->n_connections--;
2974
2975         log_unit_debug(UNIT(s), "One connection closed, %u left.", s->n_connections);
2976 }
2977
2978 static void socket_trigger_notify(Unit *u, Unit *other) {
2979         Socket *s = SOCKET(u);
2980
2981         assert(u);
2982         assert(other);
2983
2984         /* Filter out invocations with bogus state */
2985         if (other->load_state != UNIT_LOADED || other->type != UNIT_SERVICE)
2986                 return;
2987
2988         /* Don't propagate state changes from the service if we are already down */
2989         if (!IN_SET(s->state, SOCKET_RUNNING, SOCKET_LISTENING))
2990                 return;
2991
2992         /* We don't care for the service state if we are in Accept=yes mode */
2993         if (s->accept)
2994                 return;
2995
2996         /* Propagate start limit hit state */
2997         if (other->start_limit_hit) {
2998                 socket_enter_stop_pre(s, SOCKET_FAILURE_SERVICE_START_LIMIT_HIT);
2999                 return;
3000         }
3001
3002         /* Don't propagate anything if there's still a job queued */
3003         if (other->job)
3004                 return;
3005
3006         if (IN_SET(SERVICE(other)->state,
3007                    SERVICE_DEAD, SERVICE_FAILED,
3008                    SERVICE_FINAL_SIGTERM, SERVICE_FINAL_SIGKILL,
3009                    SERVICE_AUTO_RESTART))
3010                socket_enter_listening(s);
3011
3012         if (SERVICE(other)->state == SERVICE_RUNNING)
3013                 socket_set_state(s, SOCKET_RUNNING);
3014 }
3015
3016 static int socket_kill(Unit *u, KillWho who, int signo, sd_bus_error *error) {
3017         return unit_kill_common(u, who, signo, -1, SOCKET(u)->control_pid, error);
3018 }
3019
3020 static int socket_get_timeout(Unit *u, usec_t *timeout) {
3021         Socket *s = SOCKET(u);
3022         usec_t t;
3023         int r;
3024
3025         if (!s->timer_event_source)
3026                 return 0;
3027
3028         r = sd_event_source_get_time(s->timer_event_source, &t);
3029         if (r < 0)
3030                 return r;
3031         if (t == USEC_INFINITY)
3032                 return 0;
3033
3034         *timeout = t;
3035         return 1;
3036 }
3037
3038 char *socket_fdname(Socket *s) {
3039         assert(s);
3040
3041         /* Returns the name to use for $LISTEN_NAMES. If the user
3042          * didn't specify anything specifically, use the socket unit's
3043          * name as fallback. */
3044
3045         if (s->fdname)
3046                 return s->fdname;
3047
3048         return UNIT(s)->id;
3049 }
3050
3051 static int socket_control_pid(Unit *u) {
3052         Socket *s = SOCKET(u);
3053
3054         assert(s);
3055
3056         return s->control_pid;
3057 }
3058
3059 static const char* const socket_exec_command_table[_SOCKET_EXEC_COMMAND_MAX] = {
3060         [SOCKET_EXEC_START_PRE] = "StartPre",
3061         [SOCKET_EXEC_START_CHOWN] = "StartChown",
3062         [SOCKET_EXEC_START_POST] = "StartPost",
3063         [SOCKET_EXEC_STOP_PRE] = "StopPre",
3064         [SOCKET_EXEC_STOP_POST] = "StopPost"
3065 };
3066
3067 DEFINE_STRING_TABLE_LOOKUP(socket_exec_command, SocketExecCommand);
3068
3069 static const char* const socket_result_table[_SOCKET_RESULT_MAX] = {
3070         [SOCKET_SUCCESS] = "success",
3071         [SOCKET_FAILURE_RESOURCES] = "resources",
3072         [SOCKET_FAILURE_TIMEOUT] = "timeout",
3073         [SOCKET_FAILURE_EXIT_CODE] = "exit-code",
3074         [SOCKET_FAILURE_SIGNAL] = "signal",
3075         [SOCKET_FAILURE_CORE_DUMP] = "core-dump",
3076         [SOCKET_FAILURE_START_LIMIT_HIT] = "start-limit-hit",
3077         [SOCKET_FAILURE_TRIGGER_LIMIT_HIT] = "trigger-limit-hit",
3078         [SOCKET_FAILURE_SERVICE_START_LIMIT_HIT] = "service-start-limit-hit"
3079 };
3080
3081 DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
3082
3083 const UnitVTable socket_vtable = {
3084         .object_size = sizeof(Socket),
3085         .exec_context_offset = offsetof(Socket, exec_context),
3086         .cgroup_context_offset = offsetof(Socket, cgroup_context),
3087         .kill_context_offset = offsetof(Socket, kill_context),
3088         .exec_runtime_offset = offsetof(Socket, exec_runtime),
3089         .dynamic_creds_offset = offsetof(Socket, dynamic_creds),
3090
3091         .sections =
3092                 "Unit\0"
3093                 "Socket\0"
3094                 "Install\0",
3095         .private_section = "Socket",
3096
3097         .init = socket_init,
3098         .done = socket_done,
3099         .load = socket_load,
3100
3101         .coldplug = socket_coldplug,
3102
3103         .dump = socket_dump,
3104
3105         .start = socket_start,
3106         .stop = socket_stop,
3107
3108         .kill = socket_kill,
3109
3110         .get_timeout = socket_get_timeout,
3111
3112         .serialize = socket_serialize,
3113         .deserialize_item = socket_deserialize_item,
3114         .distribute_fds = socket_distribute_fds,
3115
3116         .active_state = socket_active_state,
3117         .sub_state_to_string = socket_sub_state_to_string,
3118
3119         .check_gc = socket_check_gc,
3120
3121         .sigchld_event = socket_sigchld_event,
3122
3123         .trigger_notify = socket_trigger_notify,
3124
3125         .reset_failed = socket_reset_failed,
3126
3127         .control_pid = socket_control_pid,
3128
3129         .bus_vtable = bus_socket_vtable,
3130         .bus_set_property = bus_socket_set_property,
3131         .bus_commit_properties = bus_socket_commit_properties,
3132
3133         .status_message_formats = {
3134                 /*.starting_stopping = {
3135                         [0] = "Starting socket %s...",
3136                         [1] = "Stopping socket %s...",
3137                 },*/
3138                 .finished_start_job = {
3139                         [JOB_DONE]       = "Listening on %s.",
3140                         [JOB_FAILED]     = "Failed to listen on %s.",
3141                         [JOB_TIMEOUT]    = "Timed out starting %s.",
3142                 },
3143                 .finished_stop_job = {
3144                         [JOB_DONE]       = "Closed %s.",
3145                         [JOB_FAILED]     = "Failed stopping %s.",
3146                         [JOB_TIMEOUT]    = "Timed out stopping %s.",
3147                 },
3148         },
3149 };