src/core/socket.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/types.h>
  23 #include <sys/stat.h>
  24 #include <unistd.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <sys/epoll.h>
  28 #include <signal.h>
  29 #include <arpa/inet.h>
  30 #include <netinet/tcp.h>
  31 #include <mqueue.h>
  32 #include <sys/xattr.h>
  33
  34 #ifdef HAVE_SELINUX
  35 #include <selinux/selinux.h>
  36 #endif
  37
  38 #include "sd-event.h"
  39 #include "log.h"
  40 #include "load-dropin.h"
  41 #include "load-fragment.h"
  42 #include "strv.h"
  43 #include "mkdir.h"
  44 #include "path-util.h"
  45 #include "unit-name.h"
  46 #include "unit-printf.h"
  47 #include "missing.h"
  48 #include "special.h"
  49 #include "label.h"
  50 #include "exit-status.h"
  51 #include "def.h"
  52 #include "smack-util.h"
  53 #include "bus-util.h"
  54 #include "bus-error.h"
  55 #include "dbus-socket.h"
  56 #include "unit.h"
  57 #include "socket.h"
  58
  59 static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
  60         [SOCKET_DEAD] = UNIT_INACTIVE,
  61         [SOCKET_START_PRE] = UNIT_ACTIVATING,
  62         [SOCKET_START_CHOWN] = UNIT_ACTIVATING,
  63         [SOCKET_START_POST] = UNIT_ACTIVATING,
  64         [SOCKET_LISTENING] = UNIT_ACTIVE,
  65         [SOCKET_RUNNING] = UNIT_ACTIVE,
  66         [SOCKET_STOP_PRE] = UNIT_DEACTIVATING,
  67         [SOCKET_STOP_PRE_SIGTERM] = UNIT_DEACTIVATING,
  68         [SOCKET_STOP_PRE_SIGKILL] = UNIT_DEACTIVATING,
  69         [SOCKET_STOP_POST] = UNIT_DEACTIVATING,
  70         [SOCKET_FINAL_SIGTERM] = UNIT_DEACTIVATING,
  71         [SOCKET_FINAL_SIGKILL] = UNIT_DEACTIVATING,
  72         [SOCKET_FAILED] = UNIT_FAILED
  73 };
  74
  75 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata);
  76 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata);
  77
  78 static void socket_init(Unit *u) {
  79         Socket *s = SOCKET(u);
  80
  81         assert(u);
  82         assert(u->load_state == UNIT_STUB);
  83
  84         s->backlog = SOMAXCONN;
  85         s->timeout_usec = u->manager->default_timeout_start_usec;
  86         s->directory_mode = 0755;
  87         s->socket_mode = 0666;
  88
  89         s->max_connections = 64;
  90
  91         s->priority = -1;
  92         s->ip_tos = -1;
  93         s->ip_ttl = -1;
  94         s->mark = -1;
  95
  96         s->exec_context.std_output = u->manager->default_std_output;
  97         s->exec_context.std_error = u->manager->default_std_error;
  98
  99         s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
 100 }
 101
 102 static void socket_unwatch_control_pid(Socket *s) {
 103         assert(s);
 104
 105         if (s->control_pid <= 0)
 106                 return;
 107
 108         unit_unwatch_pid(UNIT(s), s->control_pid);
 109         s->control_pid = 0;
 110 }
 111
 112 void socket_free_ports(Socket *s) {
 113         SocketPort *p;
 114
 115         assert(s);
 116
 117         while ((p = s->ports)) {
 118                 LIST_REMOVE(port, s->ports, p);
 119
 120                 sd_event_source_unref(p->event_source);
 121
 122                 safe_close(p->fd);
 123                 free(p->path);
 124                 free(p);
 125         }
 126 }
 127
 128 static void socket_done(Unit *u) {
 129         Socket *s = SOCKET(u);
 130
 131         assert(s);
 132
 133         socket_free_ports(s);
 134
 135         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
 136         exec_command_free_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
 137         s->control_command = NULL;
 138
 139         socket_unwatch_control_pid(s);
 140
 141         unit_ref_unset(&s->service);
 142
 143         free(s->tcp_congestion);
 144         s->tcp_congestion = NULL;
 145
 146         free(s->bind_to_device);
 147         s->bind_to_device = NULL;
 148
 149         free(s->smack);
 150         free(s->smack_ip_in);
 151         free(s->smack_ip_out);
 152
 153         strv_free(s->symlinks);
 154
 155         free(s->user);
 156         free(s->group);
 157
 158         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 159 }
 160
 161 static int socket_arm_timer(Socket *s) {
 162         int r;
 163
 164         assert(s);
 165
 166         if (s->timeout_usec <= 0) {
 167                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 168                 return 0;
 169         }
 170
 171         if (s->timer_event_source) {
 172                 r = sd_event_source_set_time(s->timer_event_source, now(CLOCK_MONOTONIC) + s->timeout_usec);
 173                 if (r < 0)
 174                         return r;
 175
 176                 return sd_event_source_set_enabled(s->timer_event_source, SD_EVENT_ONESHOT);
 177         }
 178
 179         return sd_event_add_time(
 180                         UNIT(s)->manager->event,
 181                         &s->timer_event_source,
 182                         CLOCK_MONOTONIC,
 183                         now(CLOCK_MONOTONIC) + s->timeout_usec, 0,
 184                         socket_dispatch_timer, s);
 185 }
 186
 187 int socket_instantiate_service(Socket *s) {
 188         _cleanup_free_ char *prefix = NULL, *name = NULL;
 189         int r;
 190         Unit *u;
 191
 192         assert(s);
 193
 194         /* This fills in s->service if it isn't filled in yet. For
 195          * Accept=yes sockets we create the next connection service
 196          * here. For Accept=no this is mostly a NOP since the service
 197          * is figured out at load time anyway. */
 198
 199         if (UNIT_DEREF(s->service) || !s->accept)
 200                 return 0;
 201
 202         prefix = unit_name_to_prefix(UNIT(s)->id);
 203         if (!prefix)
 204                 return -ENOMEM;
 205
 206         if (asprintf(&name, "%s@%u.service", prefix, s->n_accepted) < 0)
 207                 return -ENOMEM;
 208
 209         r = manager_load_unit(UNIT(s)->manager, name, NULL, NULL, &u);
 210         if (r < 0)
 211                 return r;
 212
 213         u->no_gc = true;
 214         unit_ref_set(&s->service, u);
 215
 216         return unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, u, false);
 217 }
 218
 219 static bool have_non_accept_socket(Socket *s) {
 220         SocketPort *p;
 221
 222         assert(s);
 223
 224         if (!s->accept)
 225                 return true;
 226
 227         LIST_FOREACH(port, p, s->ports) {
 228
 229                 if (p->type != SOCKET_SOCKET)
 230                         return true;
 231
 232                 if (!socket_address_can_accept(&p->address))
 233                         return true;
 234         }
 235
 236         return false;
 237 }
 238
 239 static int socket_add_mount_links(Socket *s) {
 240         SocketPort *p;
 241         int r;
 242
 243         assert(s);
 244
 245         LIST_FOREACH(port, p, s->ports) {
 246                 const char *path = NULL;
 247
 248                 if (p->type == SOCKET_SOCKET)
 249                         path = socket_address_get_path(&p->address);
 250                 else if (p->type == SOCKET_FIFO || p->type == SOCKET_SPECIAL)
 251                         path = p->path;
 252
 253                 if (!path)
 254                         continue;
 255
 256                 r = unit_require_mounts_for(UNIT(s), path);
 257                 if (r < 0)
 258                         return r;
 259         }
 260
 261         return 0;
 262 }
 263
 264 static int socket_add_device_link(Socket *s) {
 265         char *t;
 266
 267         assert(s);
 268
 269         if (!s->bind_to_device || streq(s->bind_to_device, "lo"))
 270                 return 0;
 271
 272         t = strappenda("/sys/subsystem/net/devices/", s->bind_to_device);
 273         return unit_add_node_link(UNIT(s), t, false);
 274 }
 275
 276 static int socket_add_default_dependencies(Socket *s) {
 277         int r;
 278         assert(s);
 279
 280         r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, NULL, true);
 281         if (r < 0)
 282                 return r;
 283
 284         if (UNIT(s)->manager->running_as == SYSTEMD_SYSTEM) {
 285                 r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true);
 286                 if (r < 0)
 287                         return r;
 288         }
 289
 290         return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
 291 }
 292
 293 _pure_ static bool socket_has_exec(Socket *s) {
 294         unsigned i;
 295         assert(s);
 296
 297         for (i = 0; i < _SOCKET_EXEC_COMMAND_MAX; i++)
 298                 if (s->exec_command[i])
 299                         return true;
 300
 301         return false;
 302 }
 303
 304 static int socket_add_extras(Socket *s) {
 305         Unit *u = UNIT(s);
 306         int r;
 307
 308         assert(s);
 309
 310         if (have_non_accept_socket(s)) {
 311
 312                 if (!UNIT_DEREF(s->service)) {
 313                         Unit *x;
 314
 315                         r = unit_load_related_unit(u, ".service", &x);
 316                         if (r < 0)
 317                                 return r;
 318
 319                         unit_ref_set(&s->service, x);
 320                 }
 321
 322                 r = unit_add_two_dependencies(u, UNIT_BEFORE, UNIT_TRIGGERS, UNIT_DEREF(s->service), true);
 323                 if (r < 0)
 324                         return r;
 325         }
 326
 327         r = socket_add_mount_links(s);
 328         if (r < 0)
 329                 return r;
 330
 331         r = socket_add_device_link(s);
 332         if (r < 0)
 333                 return r;
 334
 335         r = unit_patch_contexts(u);
 336         if (r < 0)
 337                 return r;
 338
 339         if (socket_has_exec(s)) {
 340                 r = unit_add_exec_dependencies(u, &s->exec_context);
 341                 if (r < 0)
 342                         return r;
 343
 344                 r = unit_add_default_slice(u, &s->cgroup_context);
 345                 if (r < 0)
 346                         return r;
 347         }
 348
 349         if (u->default_dependencies) {
 350                 r = socket_add_default_dependencies(s);
 351                 if (r < 0)
 352                         return r;
 353         }
 354
 355         return 0;
 356 }
 357
 358 static const char *socket_find_symlink_target(Socket *s) {
 359         const char *found = NULL;
 360         SocketPort *p;
 361
 362         LIST_FOREACH(port, p, s->ports) {
 363                 const char *f = NULL;
 364
 365                 switch (p->type) {
 366
 367                 case SOCKET_FIFO:
 368                         f = p->path;
 369                         break;
 370
 371                 case SOCKET_SOCKET:
 372                         if (p->address.sockaddr.un.sun_path[0] != 0)
 373                                 f = p->address.sockaddr.un.sun_path;
 374                         break;
 375
 376                 default:
 377                         break;
 378                 }
 379
 380                 if (f) {
 381                         if (found)
 382                                 return NULL;
 383
 384                         found = f;
 385                 }
 386         }
 387
 388         return found;
 389 }
 390
 391 static int socket_verify(Socket *s) {
 392         assert(s);
 393
 394         if (UNIT(s)->load_state != UNIT_LOADED)
 395                 return 0;
 396
 397         if (!s->ports) {
 398                 log_error_unit(UNIT(s)->id, "%s lacks Listen setting. Refusing.", UNIT(s)->id);
 399                 return -EINVAL;
 400         }
 401
 402         if (s->accept && have_non_accept_socket(s)) {
 403                 log_error_unit(UNIT(s)->id, "%s configured for accepting sockets, but sockets are non-accepting. Refusing.",
 404                                UNIT(s)->id);
 405                 return -EINVAL;
 406         }
 407
 408         if (s->accept && s->max_connections <= 0) {
 409                 log_error_unit(UNIT(s)->id, "%s's MaxConnection setting too small. Refusing.", UNIT(s)->id);
 410                 return -EINVAL;
 411         }
 412
 413         if (s->accept && UNIT_DEREF(s->service)) {
 414                 log_error_unit(UNIT(s)->id, "Explicit service configuration for accepting sockets not supported on %s. Refusing.", UNIT(s)->id);
 415                 return -EINVAL;
 416         }
 417
 418         if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP) {
 419                 log_error_unit(UNIT(s)->id, "%s has PAM enabled. Kill mode must be set to 'control-group'. Refusing.", UNIT(s)->id);
 420                 return -EINVAL;
 421         }
 422
 423         if (!strv_isempty(s->symlinks) && !socket_find_symlink_target(s)) {
 424                 log_error_unit(UNIT(s)->id, "%s has symlinks set but none or more than one node in the file system. Refusing.", UNIT(s)->id);
 425                 return -EINVAL;
 426         }
 427
 428         return 0;
 429 }
 430
 431 static int socket_load(Unit *u) {
 432         Socket *s = SOCKET(u);
 433         int r;
 434
 435         assert(u);
 436         assert(u->load_state == UNIT_STUB);
 437
 438         r = unit_load_fragment_and_dropin(u);
 439         if (r < 0)
 440                 return r;
 441
 442         if (u->load_state == UNIT_LOADED) {
 443                 /* This is a new unit? Then let's add in some extras */
 444                 r = socket_add_extras(s);
 445                 if (r < 0)
 446                         return r;
 447         }
 448
 449         return socket_verify(s);
 450 }
 451
 452 _const_ static const char* listen_lookup(int family, int type) {
 453
 454         if (family == AF_NETLINK)
 455                 return "ListenNetlink";
 456
 457         if (type == SOCK_STREAM)
 458                 return "ListenStream";
 459         else if (type == SOCK_DGRAM)
 460                 return "ListenDatagram";
 461         else if (type == SOCK_SEQPACKET)
 462                 return "ListenSequentialPacket";
 463
 464         assert_not_reached("Unknown socket type");
 465         return NULL;
 466 }
 467
 468 static void socket_dump(Unit *u, FILE *f, const char *prefix) {
 469         char time_string[FORMAT_TIMESPAN_MAX];
 470         SocketExecCommand c;
 471         Socket *s = SOCKET(u);
 472         SocketPort *p;
 473         const char *prefix2;
 474
 475         assert(s);
 476         assert(f);
 477
 478         prefix2 = strappenda(prefix, "\t");
 479
 480         fprintf(f,
 481                 "%sSocket State: %s\n"
 482                 "%sResult: %s\n"
 483                 "%sBindIPv6Only: %s\n"
 484                 "%sBacklog: %u\n"
 485                 "%sSocketMode: %04o\n"
 486                 "%sDirectoryMode: %04o\n"
 487                 "%sKeepAlive: %s\n"
 488                 "%sNoDelay: %s\n"
 489                 "%sFreeBind: %s\n"
 490                 "%sTransparent: %s\n"
 491                 "%sBroadcast: %s\n"
 492                 "%sPassCredentials: %s\n"
 493                 "%sPassSecurity: %s\n"
 494                 "%sTCPCongestion: %s\n"
 495                 "%sRemoveOnStop: %s\n"
 496                 "%sSELinuxLabelViaNet: %s\n",
 497                 prefix, socket_state_to_string(s->state),
 498                 prefix, socket_result_to_string(s->result),
 499                 prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
 500                 prefix, s->backlog,
 501                 prefix, s->socket_mode,
 502                 prefix, s->directory_mode,
 503                 prefix, yes_no(s->keep_alive),
 504                 prefix, yes_no(s->no_delay),
 505                 prefix, yes_no(s->free_bind),
 506                 prefix, yes_no(s->transparent),
 507                 prefix, yes_no(s->broadcast),
 508                 prefix, yes_no(s->pass_cred),
 509                 prefix, yes_no(s->pass_sec),
 510                 prefix, strna(s->tcp_congestion),
 511                 prefix, yes_no(s->remove_on_stop),
 512                 prefix, yes_no(s->selinux_label_via_net));
 513
 514         if (s->control_pid > 0)
 515                 fprintf(f,
 516                         "%sControl PID: "PID_FMT"\n",
 517                         prefix, s->control_pid);
 518
 519         if (s->bind_to_device)
 520                 fprintf(f,
 521                         "%sBindToDevice: %s\n",
 522                         prefix, s->bind_to_device);
 523
 524         if (s->accept)
 525                 fprintf(f,
 526                         "%sAccepted: %u\n"
 527                         "%sNConnections: %u\n"
 528                         "%sMaxConnections: %u\n",
 529                         prefix, s->n_accepted,
 530                         prefix, s->n_connections,
 531                         prefix, s->max_connections);
 532
 533         if (s->priority >= 0)
 534                 fprintf(f,
 535                         "%sPriority: %i\n",
 536                         prefix, s->priority);
 537
 538         if (s->receive_buffer > 0)
 539                 fprintf(f,
 540                         "%sReceiveBuffer: %zu\n",
 541                         prefix, s->receive_buffer);
 542
 543         if (s->send_buffer > 0)
 544                 fprintf(f,
 545                         "%sSendBuffer: %zu\n",
 546                         prefix, s->send_buffer);
 547
 548         if (s->ip_tos >= 0)
 549                 fprintf(f,
 550                         "%sIPTOS: %i\n",
 551                         prefix, s->ip_tos);
 552
 553         if (s->ip_ttl >= 0)
 554                 fprintf(f,
 555                         "%sIPTTL: %i\n",
 556                         prefix, s->ip_ttl);
 557
 558         if (s->pipe_size > 0)
 559                 fprintf(f,
 560                         "%sPipeSize: %zu\n",
 561                         prefix, s->pipe_size);
 562
 563         if (s->mark >= 0)
 564                 fprintf(f,
 565                         "%sMark: %i\n",
 566                         prefix, s->mark);
 567
 568         if (s->mq_maxmsg > 0)
 569                 fprintf(f,
 570                         "%sMessageQueueMaxMessages: %li\n",
 571                         prefix, s->mq_maxmsg);
 572
 573         if (s->mq_msgsize > 0)
 574                 fprintf(f,
 575                         "%sMessageQueueMessageSize: %li\n",
 576                         prefix, s->mq_msgsize);
 577
 578         if (s->reuse_port)
 579                 fprintf(f,
 580                         "%sReusePort: %s\n",
 581                          prefix, yes_no(s->reuse_port));
 582
 583         if (s->smack)
 584                 fprintf(f,
 585                         "%sSmackLabel: %s\n",
 586                         prefix, s->smack);
 587
 588         if (s->smack_ip_in)
 589                 fprintf(f,
 590                         "%sSmackLabelIPIn: %s\n",
 591                         prefix, s->smack_ip_in);
 592
 593         if (s->smack_ip_out)
 594                 fprintf(f,
 595                         "%sSmackLabelIPOut: %s\n",
 596                         prefix, s->smack_ip_out);
 597
 598         if (!isempty(s->user) || !isempty(s->group))
 599                 fprintf(f,
 600                         "%sOwnerUser: %s\n"
 601                         "%sOwnerGroup: %s\n",
 602                         prefix, strna(s->user),
 603                         prefix, strna(s->group));
 604
 605         if(s->keep_alive_time)
 606                 fprintf(f,
 607                         "%sKeepAliveTime: %s\n",
 608                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX,
 609                                                 s->keep_alive_time, USEC_PER_SEC));
 610
 611         if(s->keep_alive_interval)
 612                 fprintf(f,
 613                         "%sKeepAliveInterval: %s\n",
 614                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX,
 615                                                 s->keep_alive_interval, USEC_PER_SEC));
 616
 617         if(s->keep_alive_cnt)
 618                 fprintf(f,
 619                         "%sKeepAliveProbes: %u\n",
 620                         prefix, s->keep_alive_cnt);
 621
 622         if(s->defer_accept)
 623                 fprintf(f,
 624                         "%sDeferAccept: %s\n",
 625                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX,
 626                                                 s->defer_accept, USEC_PER_SEC));
 627
 628         LIST_FOREACH(port, p, s->ports) {
 629
 630                 if (p->type == SOCKET_SOCKET) {
 631                         const char *t;
 632                         int r;
 633                         char *k = NULL;
 634
 635                         if ((r = socket_address_print(&p->address, &k)) < 0)
 636                                 t = strerror(-r);
 637                         else
 638                                 t = k;
 639
 640                         fprintf(f, "%s%s: %s\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type), t);
 641                         free(k);
 642                 } else if (p->type == SOCKET_SPECIAL)
 643                         fprintf(f, "%sListenSpecial: %s\n", prefix, p->path);
 644                 else if (p->type == SOCKET_MQUEUE)
 645                         fprintf(f, "%sListenMessageQueue: %s\n", prefix, p->path);
 646                 else
 647                         fprintf(f, "%sListenFIFO: %s\n", prefix, p->path);
 648         }
 649
 650         exec_context_dump(&s->exec_context, f, prefix);
 651         kill_context_dump(&s->kill_context, f, prefix);
 652
 653         for (c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
 654                 if (!s->exec_command[c])
 655                         continue;
 656
 657                 fprintf(f, "%s-> %s:\n",
 658                         prefix, socket_exec_command_to_string(c));
 659
 660                 exec_command_dump_list(s->exec_command[c], f, prefix2);
 661         }
 662 }
 663
 664 static int instance_from_socket(int fd, unsigned nr, char **instance) {
 665         socklen_t l;
 666         char *r;
 667         union sockaddr_union local, remote;
 668
 669         assert(fd >= 0);
 670         assert(instance);
 671
 672         l = sizeof(local);
 673         if (getsockname(fd, &local.sa, &l) < 0)
 674                 return -errno;
 675
 676         l = sizeof(remote);
 677         if (getpeername(fd, &remote.sa, &l) < 0)
 678                 return -errno;
 679
 680         switch (local.sa.sa_family) {
 681
 682         case AF_INET: {
 683                 uint32_t
 684                         a = ntohl(local.in.sin_addr.s_addr),
 685                         b = ntohl(remote.in.sin_addr.s_addr);
 686
 687                 if (asprintf(&r,
 688                              "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 689                              nr,
 690                              a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
 691                              ntohs(local.in.sin_port),
 692                              b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
 693                              ntohs(remote.in.sin_port)) < 0)
 694                         return -ENOMEM;
 695
 696                 break;
 697         }
 698
 699         case AF_INET6: {
 700                 static const unsigned char ipv4_prefix[] = {
 701                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
 702                 };
 703
 704                 if (memcmp(&local.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0 &&
 705                     memcmp(&remote.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
 706                         const uint8_t
 707                                 *a = local.in6.sin6_addr.s6_addr+12,
 708                                 *b = remote.in6.sin6_addr.s6_addr+12;
 709
 710                         if (asprintf(&r,
 711                                      "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 712                                      nr,
 713                                      a[0], a[1], a[2], a[3],
 714                                      ntohs(local.in6.sin6_port),
 715                                      b[0], b[1], b[2], b[3],
 716                                      ntohs(remote.in6.sin6_port)) < 0)
 717                                 return -ENOMEM;
 718                 } else {
 719                         char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
 720
 721                         if (asprintf(&r,
 722                                      "%u-%s:%u-%s:%u",
 723                                      nr,
 724                                      inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
 725                                      ntohs(local.in6.sin6_port),
 726                                      inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
 727                                      ntohs(remote.in6.sin6_port)) < 0)
 728                                 return -ENOMEM;
 729                 }
 730
 731                 break;
 732         }
 733
 734         case AF_UNIX: {
 735                 struct ucred ucred;
 736                 int k;
 737
 738                 k = getpeercred(fd, &ucred);
 739                 if (k >= 0) {
 740                         if (asprintf(&r,
 741                                      "%u-"PID_FMT"-"UID_FMT,
 742                                      nr, ucred.pid, ucred.uid) < 0)
 743                                 return -ENOMEM;
 744                 } else if (k == -ENODATA) {
 745                         /* This handles the case where somebody is
 746                          * connecting from another pid/uid namespace
 747                          * (e.g. from outside of our container). */
 748                         if (asprintf(&r,
 749                                      "%u-unknown",
 750                                      nr) < 0)
 751                                 return -ENOMEM;
 752                 } else
 753                         return k;
 754
 755                 break;
 756         }
 757
 758         default:
 759                 assert_not_reached("Unhandled socket type.");
 760         }
 761
 762         *instance = r;
 763         return 0;
 764 }
 765
 766 static void socket_close_fds(Socket *s) {
 767         SocketPort *p;
 768         char **i;
 769
 770         assert(s);
 771
 772         LIST_FOREACH(port, p, s->ports) {
 773
 774                 p->event_source = sd_event_source_unref(p->event_source);
 775
 776                 if (p->fd < 0)
 777                         continue;
 778
 779                 p->fd = safe_close(p->fd);
 780
 781                 /* One little note: we should normally not delete any
 782                  * sockets in the file system here! After all some
 783                  * other process we spawned might still have a
 784                  * reference of this fd and wants to continue to use
 785                  * it. Therefore we delete sockets in the file system
 786                  * before we create a new one, not after we stopped
 787                  * using one! */
 788
 789                 if (s->remove_on_stop) {
 790                         switch (p->type) {
 791
 792                         case SOCKET_FIFO:
 793                                 unlink(p->path);
 794                                 break;
 795
 796                         case SOCKET_MQUEUE:
 797                                 mq_unlink(p->path);
 798                                 break;
 799
 800                         case SOCKET_SOCKET:
 801                                 socket_address_unlink(&p->address);
 802                                 break;
 803
 804                         default:
 805                                 break;
 806                         }
 807                 }
 808         }
 809
 810         if (s->remove_on_stop)
 811                 STRV_FOREACH(i, s->symlinks)
 812                         unlink(*i);
 813 }
 814
 815 static void socket_apply_socket_options(Socket *s, int fd) {
 816         assert(s);
 817         assert(fd >= 0);
 818
 819         if (s->keep_alive) {
 820                 int b = s->keep_alive;
 821                 if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &b, sizeof(b)) < 0)
 822                         log_warning_unit(UNIT(s)->id, "SO_KEEPALIVE failed: %m");
 823         }
 824
 825         if (s->keep_alive_time) {
 826                 int value = s->keep_alive_time / USEC_PER_SEC;
 827                 if (setsockopt(fd, SOL_TCP, TCP_KEEPIDLE, &value, sizeof(value)) < 0)
 828                         log_warning_unit(UNIT(s)->id, "TCP_KEEPIDLE failed: %m");
 829         }
 830
 831         if (s->keep_alive_interval) {
 832                 int value =  s->keep_alive_interval / USEC_PER_SEC;
 833                 if (setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &value, sizeof(value)) < 0)
 834                         log_warning_unit(UNIT(s)->id, "TCP_KEEPINTVL failed: %m");
 835         }
 836
 837         if (s->keep_alive_cnt) {
 838                 int value = s->keep_alive_cnt;
 839                 if (setsockopt(fd, SOL_SOCKET, TCP_KEEPCNT, &value, sizeof(value)) < 0)
 840                         log_warning_unit(UNIT(s)->id, "TCP_KEEPCNT failed: %m");
 841         }
 842
 843         if (s->defer_accept) {
 844                 int value = s->defer_accept / USEC_PER_SEC;
 845                 if (setsockopt(fd, SOL_TCP, TCP_DEFER_ACCEPT, &value, sizeof(value)) < 0)
 846                         log_warning_unit(UNIT(s)->id, "TCP_DEFER_ACCEPT failed: %m");
 847         }
 848
 849         if (s->no_delay) {
 850                 int b = s->no_delay;
 851                 if (setsockopt(fd, SOL_TCP, TCP_NODELAY, &b, sizeof(b)) < 0)
 852                         log_warning_unit(UNIT(s)->id, "TCP_NODELAY failed: %m");
 853         }
 854
 855         if (s->broadcast) {
 856                 int one = 1;
 857                 if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &one, sizeof(one)) < 0)
 858                         log_warning_unit(UNIT(s)->id, "SO_BROADCAST failed: %m");
 859         }
 860
 861         if (s->pass_cred) {
 862                 int one = 1;
 863                 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
 864                         log_warning_unit(UNIT(s)->id, "SO_PASSCRED failed: %m");
 865         }
 866
 867         if (s->pass_sec) {
 868                 int one = 1;
 869                 if (setsockopt(fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)) < 0)
 870                         log_warning_unit(UNIT(s)->id, "SO_PASSSEC failed: %m");
 871         }
 872
 873         if (s->priority >= 0)
 874                 if (setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &s->priority, sizeof(s->priority)) < 0)
 875                         log_warning_unit(UNIT(s)->id, "SO_PRIORITY failed: %m");
 876
 877         if (s->receive_buffer > 0) {
 878                 int value = (int) s->receive_buffer;
 879
 880                 /* We first try with SO_RCVBUFFORCE, in case we have the perms for that */
 881
 882                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &value, sizeof(value)) < 0)
 883                         if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, sizeof(value)) < 0)
 884                                 log_warning_unit(UNIT(s)->id, "SO_RCVBUF failed: %m");
 885         }
 886
 887         if (s->send_buffer > 0) {
 888                 int value = (int) s->send_buffer;
 889                 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUFFORCE, &value, sizeof(value)) < 0)
 890                         if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, sizeof(value)) < 0)
 891                                 log_warning_unit(UNIT(s)->id, "SO_SNDBUF failed: %m");
 892         }
 893
 894         if (s->mark >= 0)
 895                 if (setsockopt(fd, SOL_SOCKET, SO_MARK, &s->mark, sizeof(s->mark)) < 0)
 896                         log_warning_unit(UNIT(s)->id, "SO_MARK failed: %m");
 897
 898         if (s->ip_tos >= 0)
 899                 if (setsockopt(fd, IPPROTO_IP, IP_TOS, &s->ip_tos, sizeof(s->ip_tos)) < 0)
 900                         log_warning_unit(UNIT(s)->id, "IP_TOS failed: %m");
 901
 902         if (s->ip_ttl >= 0) {
 903                 int r, x;
 904
 905                 r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl));
 906
 907                 if (socket_ipv6_is_supported())
 908                         x = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &s->ip_ttl, sizeof(s->ip_ttl));
 909                 else {
 910                         x = -1;
 911                         errno = EAFNOSUPPORT;
 912                 }
 913
 914                 if (r < 0 && x < 0)
 915                         log_warning_unit(UNIT(s)->id,
 916                                          "IP_TTL/IPV6_UNICAST_HOPS failed: %m");
 917         }
 918
 919         if (s->tcp_congestion)
 920                 if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
 921                         log_warning_unit(UNIT(s)->id, "TCP_CONGESTION failed: %m");
 922
 923         if (s->reuse_port) {
 924                 int b = s->reuse_port;
 925                 if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &b, sizeof(b)) < 0)
 926                         log_warning_unit(UNIT(s)->id, "SO_REUSEPORT failed: %m");
 927         }
 928
 929         if (s->smack_ip_in)
 930                 if (smack_label_ip_in_fd(fd, s->smack_ip_in) < 0)
 931                         log_error_unit(UNIT(s)->id, "smack_label_ip_in_fd: %m");
 932
 933         if (s->smack_ip_out)
 934                 if (smack_label_ip_out_fd(fd, s->smack_ip_out) < 0)
 935                         log_error_unit(UNIT(s)->id, "smack_label_ip_out_fd: %m");
 936 }
 937
 938 static void socket_apply_fifo_options(Socket *s, int fd) {
 939         assert(s);
 940         assert(fd >= 0);
 941
 942         if (s->pipe_size > 0)
 943                 if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
 944                         log_warning_unit(UNIT(s)->id,
 945                                          "F_SETPIPE_SZ: %m");
 946
 947         if (s->smack)
 948                 if (smack_label_fd(fd, s->smack) < 0)
 949                         log_error_unit(UNIT(s)->id, "smack_label_fd: %m");
 950 }
 951
 952 static int fifo_address_create(
 953                 const char *path,
 954                 mode_t directory_mode,
 955                 mode_t socket_mode,
 956                 int *_fd) {
 957
 958         int fd = -1, r = 0;
 959         struct stat st;
 960         mode_t old_mask;
 961
 962         assert(path);
 963         assert(_fd);
 964
 965         mkdir_parents_label(path, directory_mode);
 966
 967         r = label_context_set(path, S_IFIFO);
 968         if (r < 0)
 969                 goto fail;
 970
 971         /* Enforce the right access mode for the fifo */
 972         old_mask = umask(~ socket_mode);
 973
 974         /* Include the original umask in our mask */
 975         umask(~socket_mode | old_mask);
 976
 977         r = mkfifo(path, socket_mode);
 978         umask(old_mask);
 979
 980         if (r < 0 && errno != EEXIST) {
 981                 r = -errno;
 982                 goto fail;
 983         }
 984
 985         if ((fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
 986                 r = -errno;
 987                 goto fail;
 988         }
 989
 990         label_context_clear();
 991
 992         if (fstat(fd, &st) < 0) {
 993                 r = -errno;
 994                 goto fail;
 995         }
 996
 997         if (!S_ISFIFO(st.st_mode) ||
 998             (st.st_mode & 0777) != (socket_mode & ~old_mask) ||
 999             st.st_uid != getuid() ||
1000             st.st_gid != getgid()) {
1001
1002                 r = -EEXIST;
1003                 goto fail;
1004         }
1005
1006         *_fd = fd;
1007         return 0;
1008
1009 fail:
1010         label_context_clear();
1011         safe_close(fd);
1012
1013         return r;
1014 }
1015
1016 static int special_address_create(
1017                 const char *path,
1018                 int *_fd) {
1019
1020         int fd = -1, r = 0;
1021         struct stat st;
1022
1023         assert(path);
1024         assert(_fd);
1025
1026         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1027         if (fd < 0) {
1028                 r = -errno;
1029                 goto fail;
1030         }
1031
1032         if (fstat(fd, &st) < 0) {
1033                 r = -errno;
1034                 goto fail;
1035         }
1036
1037         /* Check whether this is a /proc, /sys or /dev file or char device */
1038         if (!S_ISREG(st.st_mode) && !S_ISCHR(st.st_mode)) {
1039                 r = -EEXIST;
1040                 goto fail;
1041         }
1042
1043         *_fd = fd;
1044         return 0;
1045
1046 fail:
1047         safe_close(fd);
1048
1049         return r;
1050 }
1051
1052 static int mq_address_create(
1053                 const char *path,
1054                 mode_t mq_mode,
1055                 long maxmsg,
1056                 long msgsize,
1057                 int *_fd) {
1058
1059         int fd = -1, r = 0;
1060         struct stat st;
1061         mode_t old_mask;
1062         struct mq_attr _attr, *attr = NULL;
1063
1064         assert(path);
1065         assert(_fd);
1066
1067         if (maxmsg > 0 && msgsize > 0) {
1068                 zero(_attr);
1069                 _attr.mq_flags = O_NONBLOCK;
1070                 _attr.mq_maxmsg = maxmsg;
1071                 _attr.mq_msgsize = msgsize;
1072                 attr = &_attr;
1073         }
1074
1075         /* Enforce the right access mode for the mq */
1076         old_mask = umask(~ mq_mode);
1077
1078         /* Include the original umask in our mask */
1079         umask(~mq_mode | old_mask);
1080         fd = mq_open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_CREAT, mq_mode, attr);
1081         umask(old_mask);
1082
1083         if (fd < 0) {
1084                 r = -errno;
1085                 goto fail;
1086         }
1087
1088         if (fstat(fd, &st) < 0) {
1089                 r = -errno;
1090                 goto fail;
1091         }
1092
1093         if ((st.st_mode & 0777) != (mq_mode & ~old_mask) ||
1094             st.st_uid != getuid() ||
1095             st.st_gid != getgid()) {
1096
1097                 r = -EEXIST;
1098                 goto fail;
1099         }
1100
1101         *_fd = fd;
1102         return 0;
1103
1104 fail:
1105         safe_close(fd);
1106         return r;
1107 }
1108
1109 static int socket_symlink(Socket *s) {
1110         const char *p;
1111         char **i;
1112
1113         assert(s);
1114
1115         p = socket_find_symlink_target(s);
1116         if (!p)
1117                 return 0;
1118
1119         STRV_FOREACH(i, s->symlinks)
1120                 symlink(p, *i);
1121
1122         return 0;
1123 }
1124
1125 static int socket_open_fds(Socket *s) {
1126         SocketPort *p;
1127         int r;
1128         char *label = NULL;
1129         bool know_label = false;
1130
1131         assert(s);
1132
1133         LIST_FOREACH(port, p, s->ports) {
1134
1135                 if (p->fd >= 0)
1136                         continue;
1137
1138                 if (p->type == SOCKET_SOCKET) {
1139 #ifdef HAVE_SELINUX
1140                         if (!know_label && s->selinux_label_via_net) {
1141                                 r = getcon(&label);
1142                                 if (r < 0)
1143                                         return r;
1144                                 know_label = true;
1145                         }
1146 #endif
1147                         if (!know_label) {
1148
1149                                 r = socket_instantiate_service(s);
1150                                 if (r < 0)
1151                                         return r;
1152
1153                                 if (UNIT_ISSET(s->service) &&
1154                                     SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]) {
1155                                         r = label_get_create_label_from_exe(SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]->path, &label);
1156                                         if (r < 0 && r != -EPERM)
1157                                                 return r;
1158                                 }
1159
1160                                 know_label = true;
1161                         }
1162
1163                         r = socket_address_listen(
1164                                         &p->address,
1165                                         SOCK_CLOEXEC|SOCK_NONBLOCK,
1166                                         s->backlog,
1167                                         s->bind_ipv6_only,
1168                                         s->bind_to_device,
1169                                         s->free_bind,
1170                                         s->transparent,
1171                                         s->directory_mode,
1172                                         s->socket_mode,
1173                                         label);
1174                         if (r < 0)
1175                                 goto rollback;
1176
1177                         p->fd = r;
1178                         socket_apply_socket_options(s, p->fd);
1179                         socket_symlink(s);
1180
1181                 } else  if (p->type == SOCKET_SPECIAL) {
1182
1183                         r = special_address_create(
1184                                         p->path,
1185                                         &p->fd);
1186                         if (r < 0)
1187                                 goto rollback;
1188
1189                 } else  if (p->type == SOCKET_FIFO) {
1190
1191                         r = fifo_address_create(
1192                                         p->path,
1193                                         s->directory_mode,
1194                                         s->socket_mode,
1195                                         &p->fd);
1196                         if (r < 0)
1197                                 goto rollback;
1198
1199                         socket_apply_fifo_options(s, p->fd);
1200                         socket_symlink(s);
1201
1202                 } else if (p->type == SOCKET_MQUEUE) {
1203
1204                         r = mq_address_create(
1205                                         p->path,
1206                                         s->socket_mode,
1207                                         s->mq_maxmsg,
1208                                         s->mq_msgsize,
1209                                         &p->fd);
1210                         if (r < 0)
1211                                 goto rollback;
1212                 } else
1213                         assert_not_reached("Unknown port type");
1214         }
1215
1216         label_free(label);
1217         return 0;
1218
1219 rollback:
1220         socket_close_fds(s);
1221         label_free(label);
1222         return r;
1223 }
1224
1225 static void socket_unwatch_fds(Socket *s) {
1226         SocketPort *p;
1227         int r;
1228
1229         assert(s);
1230
1231         LIST_FOREACH(port, p, s->ports) {
1232                 if (p->fd < 0)
1233                         continue;
1234
1235                 if (!p->event_source)
1236                         continue;
1237
1238                 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_OFF);
1239                 if (r < 0)
1240                         log_debug_unit(UNIT(s)->id, "Failed to disable event source.");
1241         }
1242 }
1243
1244 static int socket_watch_fds(Socket *s) {
1245         SocketPort *p;
1246         int r;
1247
1248         assert(s);
1249
1250         LIST_FOREACH(port, p, s->ports) {
1251                 if (p->fd < 0)
1252                         continue;
1253
1254                 if (p->event_source)
1255                         r = sd_event_source_set_enabled(p->event_source, SD_EVENT_ON);
1256                 else
1257                         r = sd_event_add_io(UNIT(s)->manager->event, &p->event_source, p->fd, EPOLLIN, socket_dispatch_io, p);
1258
1259                 if (r < 0) {
1260                         log_warning_unit(UNIT(s)->id, "Failed to watch listening fds: %s", strerror(-r));
1261                         goto fail;
1262                 }
1263         }
1264
1265         return 0;
1266
1267 fail:
1268         socket_unwatch_fds(s);
1269         return r;
1270 }
1271
1272 static void socket_set_state(Socket *s, SocketState state) {
1273         SocketState old_state;
1274         assert(s);
1275
1276         old_state = s->state;
1277         s->state = state;
1278
1279         if (!IN_SET(state,
1280                     SOCKET_START_PRE,
1281                     SOCKET_START_CHOWN,
1282                     SOCKET_START_POST,
1283                     SOCKET_STOP_PRE,
1284                     SOCKET_STOP_PRE_SIGTERM,
1285                     SOCKET_STOP_PRE_SIGKILL,
1286                     SOCKET_STOP_POST,
1287                     SOCKET_FINAL_SIGTERM,
1288                     SOCKET_FINAL_SIGKILL)) {
1289
1290                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1291                 socket_unwatch_control_pid(s);
1292                 s->control_command = NULL;
1293                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
1294         }
1295
1296         if (state != SOCKET_LISTENING)
1297                 socket_unwatch_fds(s);
1298
1299         if (!IN_SET(state,
1300                     SOCKET_START_CHOWN,
1301                     SOCKET_START_POST,
1302                     SOCKET_LISTENING,
1303                     SOCKET_RUNNING,
1304                     SOCKET_STOP_PRE,
1305                     SOCKET_STOP_PRE_SIGTERM,
1306                     SOCKET_STOP_PRE_SIGKILL))
1307                 socket_close_fds(s);
1308
1309         if (state != old_state)
1310                 log_debug_unit(UNIT(s)->id, "%s changed %s -> %s",
1311                                UNIT(s)->id, socket_state_to_string(old_state), socket_state_to_string(state));
1312
1313         unit_notify(UNIT(s), state_translation_table[old_state], state_translation_table[state], true);
1314 }
1315
1316 static int socket_coldplug(Unit *u) {
1317         Socket *s = SOCKET(u);
1318         int r;
1319
1320         assert(s);
1321         assert(s->state == SOCKET_DEAD);
1322
1323         if (s->deserialized_state == s->state)
1324                 return 0;
1325
1326         if (IN_SET(s->deserialized_state,
1327                    SOCKET_START_PRE,
1328                    SOCKET_START_CHOWN,
1329                    SOCKET_START_POST,
1330                    SOCKET_STOP_PRE,
1331                    SOCKET_STOP_PRE_SIGTERM,
1332                    SOCKET_STOP_PRE_SIGKILL,
1333                    SOCKET_STOP_POST,
1334                    SOCKET_FINAL_SIGTERM,
1335                    SOCKET_FINAL_SIGKILL)) {
1336
1337                 if (s->control_pid <= 0)
1338                         return -EBADMSG;
1339
1340                 r = unit_watch_pid(UNIT(s), s->control_pid);
1341                 if (r < 0)
1342                         return r;
1343
1344                 r = socket_arm_timer(s);
1345                 if (r < 0)
1346                         return r;
1347         }
1348
1349         if (IN_SET(s->deserialized_state,
1350                    SOCKET_START_CHOWN,
1351                    SOCKET_START_POST,
1352                    SOCKET_LISTENING,
1353                    SOCKET_RUNNING,
1354                    SOCKET_STOP_PRE,
1355                    SOCKET_STOP_PRE_SIGTERM,
1356                    SOCKET_STOP_PRE_SIGKILL)) {
1357                 r = socket_open_fds(s);
1358                 if (r < 0)
1359                         return r;
1360         }
1361
1362         if (s->deserialized_state == SOCKET_LISTENING) {
1363                 r = socket_watch_fds(s);
1364                 if (r < 0)
1365                         return r;
1366         }
1367
1368         socket_set_state(s, s->deserialized_state);
1369         return 0;
1370 }
1371
1372 static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
1373         _cleanup_free_ char **argv = NULL;
1374         pid_t pid;
1375         int r;
1376
1377         assert(s);
1378         assert(c);
1379         assert(_pid);
1380
1381         unit_realize_cgroup(UNIT(s));
1382
1383         r = unit_setup_exec_runtime(UNIT(s));
1384         if (r < 0)
1385                 goto fail;
1386
1387         r = socket_arm_timer(s);
1388         if (r < 0)
1389                 goto fail;
1390
1391         r = unit_full_printf_strv(UNIT(s), c->argv, &argv);
1392         if (r < 0)
1393                 goto fail;
1394
1395         r = exec_spawn(c,
1396                        argv,
1397                        &s->exec_context,
1398                        NULL, 0,
1399                        UNIT(s)->manager->environment,
1400                        true,
1401                        true,
1402                        true,
1403                        UNIT(s)->manager->confirm_spawn,
1404                        UNIT(s)->manager->cgroup_supported,
1405                        UNIT(s)->cgroup_path,
1406                        manager_get_runtime_prefix(UNIT(s)->manager),
1407                        UNIT(s)->id,
1408                        0,
1409                        NULL,
1410                        s->exec_runtime,
1411                        &pid);
1412         if (r < 0)
1413                 goto fail;
1414
1415         r = unit_watch_pid(UNIT(s), pid);
1416         if (r < 0)
1417                 /* FIXME: we need to do something here */
1418                 goto fail;
1419
1420         *_pid = pid;
1421         return 0;
1422
1423 fail:
1424         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1425         return r;
1426 }
1427
1428 static int socket_chown(Socket *s, pid_t *_pid) {
1429         pid_t pid;
1430         int r;
1431
1432         r = socket_arm_timer(s);
1433         if (r < 0)
1434                 goto fail;
1435
1436         /* We have to resolve the user names out-of-process, hence
1437          * let's fork here. It's messy, but well, what can we do? */
1438
1439         pid = fork();
1440         if (pid < 0)
1441                 return -errno;
1442
1443         if (pid == 0) {
1444                 SocketPort *p;
1445                 uid_t uid = (uid_t) -1;
1446                 gid_t gid = (gid_t) -1;
1447                 int ret;
1448
1449                 default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
1450                 ignore_signals(SIGPIPE, -1);
1451                 log_forget_fds();
1452
1453                 if (!isempty(s->user)) {
1454                         const char *user = s->user;
1455
1456                         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
1457                         if (r < 0) {
1458                                 ret = EXIT_USER;
1459                                 goto fail_child;
1460                         }
1461                 }
1462
1463                 if (!isempty(s->group)) {
1464                         const char *group = s->group;
1465
1466                         r = get_group_creds(&group, &gid);
1467                         if (r < 0) {
1468                                 ret = EXIT_GROUP;
1469                                 goto fail_child;
1470                         }
1471                 }
1472
1473                 LIST_FOREACH(port, p, s->ports) {
1474                         const char *path = NULL;
1475
1476                         if (p->type == SOCKET_SOCKET)
1477                                 path = socket_address_get_path(&p->address);
1478                         else if (p->type == SOCKET_FIFO)
1479                                 path = p->path;
1480
1481                         if (!path)
1482                                 continue;
1483
1484                         if (chown(path, uid, gid) < 0) {
1485                                 r = -errno;
1486                                 ret = EXIT_CHOWN;
1487                                 goto fail_child;
1488                         }
1489                 }
1490
1491                 _exit(0);
1492
1493         fail_child:
1494                 log_open();
1495                 log_error("Failed to chown socket at step %s: %s", exit_status_to_string(ret, EXIT_STATUS_SYSTEMD), strerror(-r));
1496
1497                 _exit(ret);
1498         }
1499
1500         r = unit_watch_pid(UNIT(s), pid);
1501         if (r < 0)
1502                 goto fail;
1503
1504         *_pid = pid;
1505         return 0;
1506
1507 fail:
1508         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1509         return r;
1510 }
1511
1512 static void socket_enter_dead(Socket *s, SocketResult f) {
1513         assert(s);
1514
1515         if (f != SOCKET_SUCCESS)
1516                 s->result = f;
1517
1518         exec_runtime_destroy(s->exec_runtime);
1519         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
1520
1521         exec_context_destroy_runtime_directory(&s->exec_context, manager_get_runtime_prefix(UNIT(s)->manager));
1522
1523         socket_set_state(s, s->result != SOCKET_SUCCESS ? SOCKET_FAILED : SOCKET_DEAD);
1524 }
1525
1526 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f);
1527
1528 static void socket_enter_stop_post(Socket *s, SocketResult f) {
1529         int r;
1530         assert(s);
1531
1532         if (f != SOCKET_SUCCESS)
1533                 s->result = f;
1534
1535         socket_unwatch_control_pid(s);
1536         s->control_command_id = SOCKET_EXEC_STOP_POST;
1537         s->control_command = s->exec_command[SOCKET_EXEC_STOP_POST];
1538
1539         if (s->control_command) {
1540                 r = socket_spawn(s, s->control_command, &s->control_pid);
1541                 if (r < 0)
1542                         goto fail;
1543
1544                 socket_set_state(s, SOCKET_STOP_POST);
1545         } else
1546                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_SUCCESS);
1547
1548         return;
1549
1550 fail:
1551         log_warning_unit(UNIT(s)->id,
1552                          "%s failed to run 'stop-post' task: %s",
1553                          UNIT(s)->id, strerror(-r));
1554         socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1555 }
1556
1557 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f) {
1558         int r;
1559
1560         assert(s);
1561
1562         if (f != SOCKET_SUCCESS)
1563                 s->result = f;
1564
1565         r = unit_kill_context(
1566                         UNIT(s),
1567                         &s->kill_context,
1568                         state != SOCKET_STOP_PRE_SIGTERM && state != SOCKET_FINAL_SIGTERM,
1569                         -1,
1570                         s->control_pid,
1571                         false);
1572         if (r < 0)
1573                 goto fail;
1574
1575         if (r > 0) {
1576                 r = socket_arm_timer(s);
1577                 if (r < 0)
1578                         goto fail;
1579
1580                 socket_set_state(s, state);
1581         } else if (state == SOCKET_STOP_PRE_SIGTERM)
1582                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_SUCCESS);
1583         else if (state == SOCKET_STOP_PRE_SIGKILL)
1584                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1585         else if (state == SOCKET_FINAL_SIGTERM)
1586                 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
1587         else
1588                 socket_enter_dead(s, SOCKET_SUCCESS);
1589
1590         return;
1591
1592 fail:
1593         log_warning_unit(UNIT(s)->id, "%s failed to kill processes: %s", UNIT(s)->id, strerror(-r));
1594
1595         if (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_STOP_PRE_SIGKILL)
1596                 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1597         else
1598                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1599 }
1600
1601 static void socket_enter_stop_pre(Socket *s, SocketResult f) {
1602         int r;
1603         assert(s);
1604
1605         if (f != SOCKET_SUCCESS)
1606                 s->result = f;
1607
1608         socket_unwatch_control_pid(s);
1609         s->control_command_id = SOCKET_EXEC_STOP_PRE;
1610         s->control_command = s->exec_command[SOCKET_EXEC_STOP_PRE];
1611
1612         if (s->control_command) {
1613                 r = socket_spawn(s, s->control_command, &s->control_pid);
1614                 if (r < 0)
1615                         goto fail;
1616
1617                 socket_set_state(s, SOCKET_STOP_PRE);
1618         } else
1619                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1620
1621         return;
1622
1623 fail:
1624         log_warning_unit(UNIT(s)->id, "%s failed to run 'stop-pre' task: %s", UNIT(s)->id, strerror(-r));
1625         socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1626 }
1627
1628 static void socket_enter_listening(Socket *s) {
1629         int r;
1630         assert(s);
1631
1632         r = socket_watch_fds(s);
1633         if (r < 0) {
1634                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1635                 goto fail;
1636         }
1637
1638         socket_set_state(s, SOCKET_LISTENING);
1639         return;
1640
1641 fail:
1642         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1643 }
1644
1645 static void socket_enter_start_post(Socket *s) {
1646         int r;
1647         assert(s);
1648
1649         socket_unwatch_control_pid(s);
1650         s->control_command_id = SOCKET_EXEC_START_POST;
1651         s->control_command = s->exec_command[SOCKET_EXEC_START_POST];
1652
1653         if (s->control_command) {
1654                 r = socket_spawn(s, s->control_command, &s->control_pid);
1655                 if (r < 0) {
1656                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-post' task: %s", UNIT(s)->id, strerror(-r));
1657                         goto fail;
1658                 }
1659
1660                 socket_set_state(s, SOCKET_START_POST);
1661         } else
1662                 socket_enter_listening(s);
1663
1664         return;
1665
1666 fail:
1667         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1668 }
1669
1670 static void socket_enter_start_chown(Socket *s) {
1671         int r;
1672
1673         assert(s);
1674
1675         r = socket_open_fds(s);
1676         if (r < 0) {
1677                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1678                 goto fail;
1679         }
1680
1681         if (!isempty(s->user) || !isempty(s->group)) {
1682
1683                 socket_unwatch_control_pid(s);
1684                 s->control_command_id = SOCKET_EXEC_START_CHOWN;
1685                 s->control_command = NULL;
1686
1687                 r = socket_chown(s, &s->control_pid);
1688                 if (r < 0) {
1689                         log_warning_unit(UNIT(s)->id, "%s failed to fork 'start-chown' task: %s", UNIT(s)->id, strerror(-r));
1690                         goto fail;
1691                 }
1692
1693                 socket_set_state(s, SOCKET_START_CHOWN);
1694         } else
1695                 socket_enter_start_post(s);
1696
1697         return;
1698
1699 fail:
1700         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1701 }
1702
1703 static void socket_enter_start_pre(Socket *s) {
1704         int r;
1705         assert(s);
1706
1707         socket_unwatch_control_pid(s);
1708         s->control_command_id = SOCKET_EXEC_START_PRE;
1709         s->control_command = s->exec_command[SOCKET_EXEC_START_PRE];
1710
1711         if (s->control_command) {
1712                 r = socket_spawn(s, s->control_command, &s->control_pid);
1713                 if (r < 0) {
1714                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-pre' task: %s", UNIT(s)->id, strerror(-r));
1715                         goto fail;
1716                 }
1717
1718                 socket_set_state(s, SOCKET_START_PRE);
1719         } else
1720                 socket_enter_start_chown(s);
1721
1722         return;
1723
1724 fail:
1725         socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1726 }
1727
1728 static void socket_enter_running(Socket *s, int cfd) {
1729         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1730         int r;
1731
1732         assert(s);
1733
1734         /* We don't take connections anymore if we are supposed to
1735          * shut down anyway */
1736         if (unit_stop_pending(UNIT(s))) {
1737
1738                 log_debug_unit(UNIT(s)->id, "Suppressing connection request on %s since unit stop is scheduled.", UNIT(s)->id);
1739
1740                 if (cfd >= 0)
1741                         safe_close(cfd);
1742                 else  {
1743                         /* Flush all sockets by closing and reopening them */
1744                         socket_close_fds(s);
1745
1746                         r = socket_open_fds(s);
1747                         if (r < 0) {
1748                                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1749                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1750                                 return;
1751                         }
1752
1753                         r = socket_watch_fds(s);
1754                         if (r < 0) {
1755                                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1756                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1757                         }
1758                 }
1759
1760                 return;
1761         }
1762
1763         if (cfd < 0) {
1764                 Iterator i;
1765                 Unit *other;
1766                 bool pending = false;
1767
1768                 /* If there's already a start pending don't bother to
1769                  * do anything */
1770                 SET_FOREACH(other, UNIT(s)->dependencies[UNIT_TRIGGERS], i)
1771                         if (unit_active_or_pending(other)) {
1772                                 pending = true;
1773                                 break;
1774                         }
1775
1776                 if (!pending) {
1777                         if (!UNIT_ISSET(s->service)) {
1778                                 log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
1779                                 r = -ENOENT;
1780                                 goto fail;
1781                         }
1782
1783                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
1784                         if (r < 0)
1785                                 goto fail;
1786                 }
1787
1788                 socket_set_state(s, SOCKET_RUNNING);
1789         } else {
1790                 _cleanup_free_ char *prefix = NULL, *instance = NULL, *name = NULL;
1791                 Service *service;
1792
1793                 if (s->n_connections >= s->max_connections) {
1794                         log_warning_unit(UNIT(s)->id, "%s: Too many incoming connections (%u)", UNIT(s)->id, s->n_connections);
1795                         safe_close(cfd);
1796                         return;
1797                 }
1798
1799                 r = socket_instantiate_service(s);
1800                 if (r < 0)
1801                         goto fail;
1802
1803                 r = instance_from_socket(cfd, s->n_accepted, &instance);
1804                 if (r < 0) {
1805                         if (r != -ENOTCONN)
1806                                 goto fail;
1807
1808                         /* ENOTCONN is legitimate if TCP RST was received.
1809                          * This connection is over, but the socket unit lives on. */
1810                         safe_close(cfd);
1811                         return;
1812                 }
1813
1814                 prefix = unit_name_to_prefix(UNIT(s)->id);
1815                 if (!prefix) {
1816                         r = -ENOMEM;
1817                         goto fail;
1818                 }
1819
1820                 name = unit_name_build(prefix, instance, ".service");
1821                 if (!name) {
1822                         r = -ENOMEM;
1823                         goto fail;
1824                 }
1825
1826                 r = unit_add_name(UNIT_DEREF(s->service), name);
1827                 if (r < 0)
1828                         goto fail;
1829
1830                 service = SERVICE(UNIT_DEREF(s->service));
1831                 unit_ref_unset(&s->service);
1832                 s->n_accepted ++;
1833
1834                 UNIT(service)->no_gc = false;
1835
1836                 unit_choose_id(UNIT(service), name);
1837
1838                 r = service_set_socket_fd(service, cfd, s);
1839                 if (r < 0)
1840                         goto fail;
1841
1842                 cfd = -1;
1843                 s->n_connections ++;
1844
1845                 if (s->selinux_label_via_net)
1846                         service->exec_context.selinux_label_via_net = true;
1847
1848                 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, true, &error, NULL);
1849                 if (r < 0)
1850                         goto fail;
1851
1852                 /* Notify clients about changed counters */
1853                 unit_add_to_dbus_queue(UNIT(s));
1854         }
1855
1856         return;
1857
1858 fail:
1859         log_warning_unit(UNIT(s)->id, "%s failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",
1860                          UNIT(s)->id, cfd >= 0 ? "template" : "non-template",
1861                          bus_error_message(&error, r));
1862
1863         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1864         safe_close(cfd);
1865 }
1866
1867 static void socket_run_next(Socket *s) {
1868         int r;
1869
1870         assert(s);
1871         assert(s->control_command);
1872         assert(s->control_command->command_next);
1873
1874         socket_unwatch_control_pid(s);
1875
1876         s->control_command = s->control_command->command_next;
1877
1878         r = socket_spawn(s, s->control_command, &s->control_pid);
1879         if (r < 0)
1880                 goto fail;
1881
1882         return;
1883
1884 fail:
1885         log_warning_unit(UNIT(s)->id, "%s failed to run next task: %s", UNIT(s)->id, strerror(-r));
1886
1887         if (s->state == SOCKET_START_POST)
1888                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1889         else if (s->state == SOCKET_STOP_POST)
1890                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1891         else
1892                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1893 }
1894
1895 static int socket_start(Unit *u) {
1896         Socket *s = SOCKET(u);
1897
1898         assert(s);
1899
1900         /* We cannot fulfill this request right now, try again later
1901          * please! */
1902         if (IN_SET(s->state,
1903                    SOCKET_STOP_PRE,
1904                    SOCKET_STOP_PRE_SIGKILL,
1905                    SOCKET_STOP_PRE_SIGTERM,
1906                    SOCKET_STOP_POST,
1907                    SOCKET_FINAL_SIGTERM,
1908                    SOCKET_FINAL_SIGKILL))
1909                 return -EAGAIN;
1910
1911         /* Already on it! */
1912         if (IN_SET(s->state,
1913                    SOCKET_START_PRE,
1914                    SOCKET_START_CHOWN,
1915                    SOCKET_START_POST))
1916                 return 0;
1917
1918         /* Cannot run this without the service being around */
1919         if (UNIT_ISSET(s->service)) {
1920                 Service *service;
1921
1922                 service = SERVICE(UNIT_DEREF(s->service));
1923
1924                 if (UNIT(service)->load_state != UNIT_LOADED) {
1925                         log_error_unit(u->id, "Socket service %s not loaded, refusing.", UNIT(service)->id);
1926                         return -ENOENT;
1927                 }
1928
1929                 /* If the service is already active we cannot start the
1930                  * socket */
1931                 if (service->state != SERVICE_DEAD &&
1932                     service->state != SERVICE_FAILED &&
1933                     service->state != SERVICE_AUTO_RESTART) {
1934                         log_error_unit(u->id, "Socket service %s already active, refusing.", UNIT(service)->id);
1935                         return -EBUSY;
1936                 }
1937         }
1938
1939         assert(s->state == SOCKET_DEAD || s->state == SOCKET_FAILED);
1940
1941         s->result = SOCKET_SUCCESS;
1942         socket_enter_start_pre(s);
1943
1944         return 0;
1945 }
1946
1947 static int socket_stop(Unit *u) {
1948         Socket *s = SOCKET(u);
1949
1950         assert(s);
1951
1952         /* Already on it */
1953         if (IN_SET(s->state,
1954                    SOCKET_STOP_PRE,
1955                    SOCKET_STOP_PRE_SIGTERM,
1956                    SOCKET_STOP_PRE_SIGKILL,
1957                    SOCKET_STOP_POST,
1958                    SOCKET_FINAL_SIGTERM,
1959                    SOCKET_FINAL_SIGKILL))
1960                 return 0;
1961
1962         /* If there's already something running we go directly into
1963          * kill mode. */
1964         if (IN_SET(s->state,
1965                    SOCKET_START_PRE,
1966                    SOCKET_START_CHOWN,
1967                    SOCKET_START_POST)) {
1968                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_SUCCESS);
1969                 return -EAGAIN;
1970         }
1971
1972         assert(s->state == SOCKET_LISTENING || s->state == SOCKET_RUNNING);
1973
1974         socket_enter_stop_pre(s, SOCKET_SUCCESS);
1975         return 0;
1976 }
1977
1978 static int socket_serialize(Unit *u, FILE *f, FDSet *fds) {
1979         Socket *s = SOCKET(u);
1980         SocketPort *p;
1981         int r;
1982
1983         assert(u);
1984         assert(f);
1985         assert(fds);
1986
1987         unit_serialize_item(u, f, "state", socket_state_to_string(s->state));
1988         unit_serialize_item(u, f, "result", socket_result_to_string(s->result));
1989         unit_serialize_item_format(u, f, "n-accepted", "%u", s->n_accepted);
1990
1991         if (s->control_pid > 0)
1992                 unit_serialize_item_format(u, f, "control-pid", PID_FMT, s->control_pid);
1993
1994         if (s->control_command_id >= 0)
1995                 unit_serialize_item(u, f, "control-command", socket_exec_command_to_string(s->control_command_id));
1996
1997         LIST_FOREACH(port, p, s->ports) {
1998                 int copy;
1999
2000                 if (p->fd < 0)
2001                         continue;
2002
2003                 copy = fdset_put_dup(fds, p->fd);
2004                 if (copy < 0)
2005                         return copy;
2006
2007                 if (p->type == SOCKET_SOCKET) {
2008                         _cleanup_free_ char *t = NULL;
2009
2010                         r = socket_address_print(&p->address, &t);
2011                         if (r < 0)
2012                                 return r;
2013
2014                         if (socket_address_family(&p->address) == AF_NETLINK)
2015                                 unit_serialize_item_format(u, f, "netlink", "%i %s", copy, t);
2016                         else
2017                                 unit_serialize_item_format(u, f, "socket", "%i %i %s", copy, p->address.type, t);
2018
2019                 } else if (p->type == SOCKET_SPECIAL)
2020                         unit_serialize_item_format(u, f, "special", "%i %s", copy, p->path);
2021                 else if (p->type == SOCKET_MQUEUE)
2022                         unit_serialize_item_format(u, f, "mqueue", "%i %s", copy, p->path);
2023                 else {
2024                         assert(p->type == SOCKET_FIFO);
2025                         unit_serialize_item_format(u, f, "fifo", "%i %s", copy, p->path);
2026                 }
2027         }
2028
2029         return 0;
2030 }
2031
2032 static int socket_deserialize_item(Unit *u, const char *key, const char *value, FDSet *fds) {
2033         Socket *s = SOCKET(u);
2034
2035         assert(u);
2036         assert(key);
2037         assert(value);
2038
2039         if (streq(key, "state")) {
2040                 SocketState state;
2041
2042                 state = socket_state_from_string(value);
2043                 if (state < 0)
2044                         log_debug_unit(u->id, "Failed to parse state value %s", value);
2045                 else
2046                         s->deserialized_state = state;
2047         } else if (streq(key, "result")) {
2048                 SocketResult f;
2049
2050                 f = socket_result_from_string(value);
2051                 if (f < 0)
2052                         log_debug_unit(u->id, "Failed to parse result value %s", value);
2053                 else if (f != SOCKET_SUCCESS)
2054                         s->result = f;
2055
2056         } else if (streq(key, "n-accepted")) {
2057                 unsigned k;
2058
2059                 if (safe_atou(value, &k) < 0)
2060                         log_debug_unit(u->id, "Failed to parse n-accepted value %s", value);
2061                 else
2062                         s->n_accepted += k;
2063         } else if (streq(key, "control-pid")) {
2064                 pid_t pid;
2065
2066                 if (parse_pid(value, &pid) < 0)
2067                         log_debug_unit(u->id, "Failed to parse control-pid value %s", value);
2068                 else
2069                         s->control_pid = pid;
2070         } else if (streq(key, "control-command")) {
2071                 SocketExecCommand id;
2072
2073                 id = socket_exec_command_from_string(value);
2074                 if (id < 0)
2075                         log_debug_unit(u->id, "Failed to parse exec-command value %s", value);
2076                 else {
2077                         s->control_command_id = id;
2078                         s->control_command = s->exec_command[id];
2079                 }
2080         } else if (streq(key, "fifo")) {
2081                 int fd, skip = 0;
2082                 SocketPort *p;
2083
2084                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2085                         log_debug_unit(u->id, "Failed to parse fifo value %s", value);
2086                 else {
2087
2088                         LIST_FOREACH(port, p, s->ports)
2089                                 if (p->type == SOCKET_FIFO &&
2090                                     streq_ptr(p->path, value+skip))
2091                                         break;
2092
2093                         if (p) {
2094                                 safe_close(p->fd);
2095                                 p->fd = fdset_remove(fds, fd);
2096                         }
2097                 }
2098
2099         } else if (streq(key, "special")) {
2100                 int fd, skip = 0;
2101                 SocketPort *p;
2102
2103                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2104                         log_debug_unit(u->id, "Failed to parse special value %s", value);
2105                 else {
2106
2107                         LIST_FOREACH(port, p, s->ports)
2108                                 if (p->type == SOCKET_SPECIAL &&
2109                                     streq_ptr(p->path, value+skip))
2110                                         break;
2111
2112                         if (p) {
2113                                 safe_close(p->fd);
2114                                 p->fd = fdset_remove(fds, fd);
2115                         }
2116                 }
2117
2118         } else if (streq(key, "mqueue")) {
2119                 int fd, skip = 0;
2120                 SocketPort *p;
2121
2122                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2123                         log_debug_unit(u->id, "Failed to parse mqueue value %s", value);
2124                 else {
2125
2126                         LIST_FOREACH(port, p, s->ports)
2127                                 if (p->type == SOCKET_MQUEUE &&
2128                                     streq_ptr(p->path, value+skip))
2129                                         break;
2130
2131                         if (p) {
2132                                 safe_close(p->fd);
2133                                 p->fd = fdset_remove(fds, fd);
2134                         }
2135                 }
2136
2137         } else if (streq(key, "socket")) {
2138                 int fd, type, skip = 0;
2139                 SocketPort *p;
2140
2141                 if (sscanf(value, "%i %i %n", &fd, &type, &skip) < 2 || fd < 0 || type < 0 || !fdset_contains(fds, fd))
2142                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2143                 else {
2144
2145                         LIST_FOREACH(port, p, s->ports)
2146                                 if (socket_address_is(&p->address, value+skip, type))
2147                                         break;
2148
2149                         if (p) {
2150                                 safe_close(p->fd);
2151                                 p->fd = fdset_remove(fds, fd);
2152                         }
2153                 }
2154
2155         } else if (streq(key, "netlink")) {
2156                 int fd, skip = 0;
2157                 SocketPort *p;
2158
2159                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2160                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2161                 else {
2162
2163                         LIST_FOREACH(port, p, s->ports)
2164                                 if (socket_address_is_netlink(&p->address, value+skip))
2165                                         break;
2166
2167                         if (p) {
2168                                 safe_close(p->fd);
2169                                 p->fd = fdset_remove(fds, fd);
2170                         }
2171                 }
2172         } else
2173                 log_debug_unit(UNIT(s)->id, "Unknown serialization key '%s'", key);
2174
2175         return 0;
2176 }
2177
2178 static int socket_distribute_fds(Unit *u, FDSet *fds) {
2179         Socket *s = SOCKET(u);
2180         SocketPort *p;
2181
2182         assert(u);
2183
2184         LIST_FOREACH(port, p, s->ports) {
2185                 Iterator i;
2186                 int fd;
2187
2188                 if (p->type != SOCKET_SOCKET)
2189                         continue;
2190
2191                 if (p->fd >= 0)
2192                         continue;
2193
2194                 FDSET_FOREACH(fd, fds, i) {
2195                         if (socket_address_matches_fd(&p->address, fd)) {
2196                                 p->fd = fdset_remove(fds, fd);
2197                                 s->deserialized_state = SOCKET_LISTENING;
2198                                 break;
2199                         }
2200                 }
2201         }
2202
2203         return 0;
2204 }
2205
2206 _pure_ static UnitActiveState socket_active_state(Unit *u) {
2207         assert(u);
2208
2209         return state_translation_table[SOCKET(u)->state];
2210 }
2211
2212 _pure_ static const char *socket_sub_state_to_string(Unit *u) {
2213         assert(u);
2214
2215         return socket_state_to_string(SOCKET(u)->state);
2216 }
2217
2218 const char* socket_port_type_to_string(SocketPort *p) {
2219
2220         assert(p);
2221
2222         switch (p->type) {
2223
2224         case SOCKET_SOCKET:
2225
2226                 switch (p->address.type) {
2227
2228                 case SOCK_STREAM:
2229                         return "Stream";
2230
2231                 case SOCK_DGRAM:
2232                         return "Datagram";
2233
2234                 case SOCK_SEQPACKET:
2235                         return "SequentialPacket";
2236
2237                 case SOCK_RAW:
2238                         if (socket_address_family(&p->address) == AF_NETLINK)
2239                                 return "Netlink";
2240
2241                 default:
2242                         return NULL;
2243                 }
2244
2245         case SOCKET_SPECIAL:
2246                 return "Special";
2247
2248         case SOCKET_MQUEUE:
2249                 return "MessageQueue";
2250
2251         case SOCKET_FIFO:
2252                 return "FIFO";
2253
2254         default:
2255                 return NULL;
2256         }
2257 }
2258
2259 _pure_ static bool socket_check_gc(Unit *u) {
2260         Socket *s = SOCKET(u);
2261
2262         assert(u);
2263
2264         return s->n_connections > 0;
2265 }
2266
2267 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
2268         SocketPort *p = userdata;
2269         int cfd = -1;
2270
2271         assert(p);
2272         assert(fd >= 0);
2273
2274         if (p->socket->state != SOCKET_LISTENING)
2275                 return 0;
2276
2277         log_debug_unit(UNIT(p->socket)->id, "Incoming traffic on %s", UNIT(p->socket)->id);
2278
2279         if (revents != EPOLLIN) {
2280
2281                 if (revents & EPOLLHUP)
2282                         log_error_unit(UNIT(p->socket)->id, "%s: Got POLLHUP on a listening socket. The service probably invoked shutdown() on it, and should better not do that.",
2283                                        UNIT(p->socket)->id);
2284                 else
2285                         log_error_unit(UNIT(p->socket)->id, "%s: Got unexpected poll event (0x%x) on socket.",
2286                                        UNIT(p->socket)->id, revents);
2287
2288                 goto fail;
2289         }
2290
2291         if (p->socket->accept &&
2292             p->type == SOCKET_SOCKET &&
2293             socket_address_can_accept(&p->address)) {
2294
2295                 for (;;) {
2296
2297                         cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
2298                         if (cfd < 0) {
2299
2300                                 if (errno == EINTR)
2301                                         continue;
2302
2303                                 log_error_unit(UNIT(p->socket)->id,
2304                                                "Failed to accept socket: %m");
2305                                 goto fail;
2306                         }
2307
2308                         break;
2309                 }
2310
2311                 socket_apply_socket_options(p->socket, cfd);
2312         }
2313
2314         socket_enter_running(p->socket, cfd);
2315         return 0;
2316
2317 fail:
2318         socket_enter_stop_pre(p->socket, SOCKET_FAILURE_RESOURCES);
2319         return 0;
2320 }
2321
2322 static void socket_sigchld_event(Unit *u, pid_t pid, int code, int status) {
2323         Socket *s = SOCKET(u);
2324         SocketResult f;
2325
2326         assert(s);
2327         assert(pid >= 0);
2328
2329         if (pid != s->control_pid)
2330                 return;
2331
2332         s->control_pid = 0;
2333
2334         if (is_clean_exit(code, status, NULL))
2335                 f = SOCKET_SUCCESS;
2336         else if (code == CLD_EXITED)
2337                 f = SOCKET_FAILURE_EXIT_CODE;
2338         else if (code == CLD_KILLED)
2339                 f = SOCKET_FAILURE_SIGNAL;
2340         else if (code == CLD_DUMPED)
2341                 f = SOCKET_FAILURE_CORE_DUMP;
2342         else
2343                 assert_not_reached("Unknown sigchld code");
2344
2345         if (s->control_command) {
2346                 exec_status_exit(&s->control_command->exec_status, &s->exec_context, pid, code, status);
2347
2348                 if (s->control_command->ignore)
2349                         f = SOCKET_SUCCESS;
2350         }
2351
2352         log_full_unit(f == SOCKET_SUCCESS ? LOG_DEBUG : LOG_NOTICE,
2353                       u->id,
2354                       "%s control process exited, code=%s status=%i",
2355                       u->id, sigchld_code_to_string(code), status);
2356
2357         if (f != SOCKET_SUCCESS)
2358                 s->result = f;
2359
2360         if (s->control_command &&
2361             s->control_command->command_next &&
2362             f == SOCKET_SUCCESS) {
2363
2364                 log_debug_unit(u->id,
2365                                "%s running next command for state %s",
2366                                u->id, socket_state_to_string(s->state));
2367                 socket_run_next(s);
2368         } else {
2369                 s->control_command = NULL;
2370                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
2371
2372                 /* No further commands for this step, so let's figure
2373                  * out what to do next */
2374
2375                 log_debug_unit(u->id,
2376                                "%s got final SIGCHLD for state %s",
2377                                u->id, socket_state_to_string(s->state));
2378
2379                 switch (s->state) {
2380
2381                 case SOCKET_START_PRE:
2382                         if (f == SOCKET_SUCCESS)
2383                                 socket_enter_start_chown(s);
2384                         else
2385                                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, f);
2386                         break;
2387
2388                 case SOCKET_START_CHOWN:
2389                         if (f == SOCKET_SUCCESS)
2390                                 socket_enter_start_post(s);
2391                         else
2392                                 socket_enter_stop_pre(s, f);
2393                         break;
2394
2395                 case SOCKET_START_POST:
2396                         if (f == SOCKET_SUCCESS)
2397                                 socket_enter_listening(s);
2398                         else
2399                                 socket_enter_stop_pre(s, f);
2400                         break;
2401
2402                 case SOCKET_STOP_PRE:
2403                 case SOCKET_STOP_PRE_SIGTERM:
2404                 case SOCKET_STOP_PRE_SIGKILL:
2405                         socket_enter_stop_post(s, f);
2406                         break;
2407
2408                 case SOCKET_STOP_POST:
2409                 case SOCKET_FINAL_SIGTERM:
2410                 case SOCKET_FINAL_SIGKILL:
2411                         socket_enter_dead(s, f);
2412                         break;
2413
2414                 default:
2415                         assert_not_reached("Uh, control process died at wrong time.");
2416                 }
2417         }
2418
2419         /* Notify clients about changed exit status */
2420         unit_add_to_dbus_queue(u);
2421 }
2422
2423 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata) {
2424         Socket *s = SOCKET(userdata);
2425
2426         assert(s);
2427         assert(s->timer_event_source == source);
2428
2429         switch (s->state) {
2430
2431         case SOCKET_START_PRE:
2432                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Terminating.", UNIT(s)->id);
2433                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2434                 break;
2435
2436         case SOCKET_START_CHOWN:
2437         case SOCKET_START_POST:
2438                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Stopping.", UNIT(s)->id);
2439                 socket_enter_stop_pre(s, SOCKET_FAILURE_TIMEOUT);
2440                 break;
2441
2442         case SOCKET_STOP_PRE:
2443                 log_warning_unit(UNIT(s)->id, "%s stopping timed out. Terminating.", UNIT(s)->id);
2444                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2445                 break;
2446
2447         case SOCKET_STOP_PRE_SIGTERM:
2448                 if (s->kill_context.send_sigkill) {
2449                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Killing.", UNIT(s)->id);
2450                         socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2451                 } else {
2452                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2453                         socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2454                 }
2455                 break;
2456
2457         case SOCKET_STOP_PRE_SIGKILL:
2458                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL. Ignoring.", UNIT(s)->id);
2459                 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2460                 break;
2461
2462         case SOCKET_STOP_POST:
2463                 log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Terminating.", UNIT(s)->id);
2464                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2465                 break;
2466
2467         case SOCKET_FINAL_SIGTERM:
2468                 if (s->kill_context.send_sigkill) {
2469                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Killing.", UNIT(s)->id);
2470                         socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2471                 } else {
2472                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2473                         socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2474                 }
2475                 break;
2476
2477         case SOCKET_FINAL_SIGKILL:
2478                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL (2). Entering failed mode.", UNIT(s)->id);
2479                 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2480                 break;
2481
2482         default:
2483                 assert_not_reached("Timeout at wrong time.");
2484         }
2485
2486         return 0;
2487 }
2488
2489 int socket_collect_fds(Socket *s, int **fds, unsigned *n_fds) {
2490         int *rfds;
2491         unsigned rn_fds, k;
2492         SocketPort *p;
2493
2494         assert(s);
2495         assert(fds);
2496         assert(n_fds);
2497
2498         /* Called from the service code for requesting our fds */
2499
2500         rn_fds = 0;
2501         LIST_FOREACH(port, p, s->ports)
2502                 if (p->fd >= 0)
2503                         rn_fds++;
2504
2505         if (rn_fds <= 0) {
2506                 *fds = NULL;
2507                 *n_fds = 0;
2508                 return 0;
2509         }
2510
2511         if (!(rfds = new(int, rn_fds)))
2512                 return -ENOMEM;
2513
2514         k = 0;
2515         LIST_FOREACH(port, p, s->ports)
2516                 if (p->fd >= 0)
2517                         rfds[k++] = p->fd;
2518
2519         assert(k == rn_fds);
2520
2521         *fds = rfds;
2522         *n_fds = rn_fds;
2523
2524         return 0;
2525 }
2526
2527 static void socket_reset_failed(Unit *u) {
2528         Socket *s = SOCKET(u);
2529
2530         assert(s);
2531
2532         if (s->state == SOCKET_FAILED)
2533                 socket_set_state(s, SOCKET_DEAD);
2534
2535         s->result = SOCKET_SUCCESS;
2536 }
2537
2538 static void socket_notify_service_dead(Socket *s, bool failed_permanent) {
2539         assert(s);
2540
2541         /* The service is dead. Dang!
2542          *
2543          * This is strictly for one-instance-for-all-connections
2544          * services. */
2545
2546         if (s->state == SOCKET_RUNNING) {
2547                 log_debug_unit(UNIT(s)->id, "%s got notified about service death (failed permanently: %s)", UNIT(s)->id, yes_no(failed_permanent));
2548                 if (failed_permanent)
2549                         socket_enter_stop_pre(s, SOCKET_FAILURE_SERVICE_FAILED_PERMANENT);
2550                 else
2551                         socket_enter_listening(s);
2552         }
2553 }
2554
2555 void socket_connection_unref(Socket *s) {
2556         assert(s);
2557
2558         /* The service is dead. Yay!
2559          *
2560          * This is strictly for one-instance-per-connection
2561          * services. */
2562
2563         assert(s->n_connections > 0);
2564         s->n_connections--;
2565
2566         log_debug_unit(UNIT(s)->id, "%s: One connection closed, %u left.", UNIT(s)->id, s->n_connections);
2567 }
2568
2569 static void socket_trigger_notify(Unit *u, Unit *other) {
2570         Socket *s = SOCKET(u);
2571         Service *se;
2572
2573         assert(u);
2574         assert(other);
2575
2576         /* Don't propagate state changes from the service if we are
2577            already down or accepting connections */
2578         if ((s->state !=  SOCKET_RUNNING &&
2579             s->state != SOCKET_LISTENING) ||
2580             s->accept)
2581                 return;
2582
2583         if (other->load_state != UNIT_LOADED ||
2584             other->type != UNIT_SERVICE)
2585                 return;
2586
2587         se = SERVICE(other);
2588
2589         if (se->state == SERVICE_FAILED)
2590                 socket_notify_service_dead(s, se->result == SERVICE_FAILURE_START_LIMIT);
2591
2592         if (se->state == SERVICE_DEAD ||
2593             se->state == SERVICE_STOP ||
2594             se->state == SERVICE_STOP_SIGTERM ||
2595             se->state == SERVICE_STOP_SIGKILL ||
2596             se->state == SERVICE_STOP_POST ||
2597             se->state == SERVICE_FINAL_SIGTERM ||
2598             se->state == SERVICE_FINAL_SIGKILL ||
2599             se->state == SERVICE_AUTO_RESTART)
2600                 socket_notify_service_dead(s, false);
2601
2602         if (se->state == SERVICE_RUNNING)
2603                 socket_set_state(s, SOCKET_RUNNING);
2604 }
2605
2606 static int socket_kill(Unit *u, KillWho who, int signo, sd_bus_error *error) {
2607         return unit_kill_common(u, who, signo, -1, SOCKET(u)->control_pid, error);
2608 }
2609
2610 static int socket_get_timeout(Unit *u, uint64_t *timeout) {
2611         Socket *s = SOCKET(u);
2612         int r;
2613
2614         if (!s->timer_event_source)
2615                 return 0;
2616
2617         r = sd_event_source_get_time(s->timer_event_source, timeout);
2618         if (r < 0)
2619                 return r;
2620
2621         return 1;
2622 }
2623
2624 static const char* const socket_state_table[_SOCKET_STATE_MAX] = {
2625         [SOCKET_DEAD] = "dead",
2626         [SOCKET_START_PRE] = "start-pre",
2627         [SOCKET_START_CHOWN] = "start-chown",
2628         [SOCKET_START_POST] = "start-post",
2629         [SOCKET_LISTENING] = "listening",
2630         [SOCKET_RUNNING] = "running",
2631         [SOCKET_STOP_PRE] = "stop-pre",
2632         [SOCKET_STOP_PRE_SIGTERM] = "stop-pre-sigterm",
2633         [SOCKET_STOP_PRE_SIGKILL] = "stop-pre-sigkill",
2634         [SOCKET_STOP_POST] = "stop-post",
2635         [SOCKET_FINAL_SIGTERM] = "final-sigterm",
2636         [SOCKET_FINAL_SIGKILL] = "final-sigkill",
2637         [SOCKET_FAILED] = "failed"
2638 };
2639
2640 DEFINE_STRING_TABLE_LOOKUP(socket_state, SocketState);
2641
2642 static const char* const socket_exec_command_table[_SOCKET_EXEC_COMMAND_MAX] = {
2643         [SOCKET_EXEC_START_PRE] = "StartPre",
2644         [SOCKET_EXEC_START_CHOWN] = "StartChown",
2645         [SOCKET_EXEC_START_POST] = "StartPost",
2646         [SOCKET_EXEC_STOP_PRE] = "StopPre",
2647         [SOCKET_EXEC_STOP_POST] = "StopPost"
2648 };
2649
2650 DEFINE_STRING_TABLE_LOOKUP(socket_exec_command, SocketExecCommand);
2651
2652 static const char* const socket_result_table[_SOCKET_RESULT_MAX] = {
2653         [SOCKET_SUCCESS] = "success",
2654         [SOCKET_FAILURE_RESOURCES] = "resources",
2655         [SOCKET_FAILURE_TIMEOUT] = "timeout",
2656         [SOCKET_FAILURE_EXIT_CODE] = "exit-code",
2657         [SOCKET_FAILURE_SIGNAL] = "signal",
2658         [SOCKET_FAILURE_CORE_DUMP] = "core-dump",
2659         [SOCKET_FAILURE_SERVICE_FAILED_PERMANENT] = "service-failed-permanent"
2660 };
2661
2662 DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
2663
2664 const UnitVTable socket_vtable = {
2665         .object_size = sizeof(Socket),
2666         .exec_context_offset = offsetof(Socket, exec_context),
2667         .cgroup_context_offset = offsetof(Socket, cgroup_context),
2668         .kill_context_offset = offsetof(Socket, kill_context),
2669         .exec_runtime_offset = offsetof(Socket, exec_runtime),
2670
2671         .sections =
2672                 "Unit\0"
2673                 "Socket\0"
2674                 "Install\0",
2675         .private_section = "Socket",
2676
2677         .init = socket_init,
2678         .done = socket_done,
2679         .load = socket_load,
2680
2681         .coldplug = socket_coldplug,
2682
2683         .dump = socket_dump,
2684
2685         .start = socket_start,
2686         .stop = socket_stop,
2687
2688         .kill = socket_kill,
2689
2690         .get_timeout = socket_get_timeout,
2691
2692         .serialize = socket_serialize,
2693         .deserialize_item = socket_deserialize_item,
2694         .distribute_fds = socket_distribute_fds,
2695
2696         .active_state = socket_active_state,
2697         .sub_state_to_string = socket_sub_state_to_string,
2698
2699         .check_gc = socket_check_gc,
2700
2701         .sigchld_event = socket_sigchld_event,
2702
2703         .trigger_notify = socket_trigger_notify,
2704
2705         .reset_failed = socket_reset_failed,
2706
2707         .bus_interface = "org.freedesktop.systemd1.Socket",
2708         .bus_vtable = bus_socket_vtable,
2709         .bus_set_property = bus_socket_set_property,
2710         .bus_commit_properties = bus_socket_commit_properties,
2711
2712         .status_message_formats = {
2713                 /*.starting_stopping = {
2714                         [0] = "Starting socket %s...",
2715                         [1] = "Stopping socket %s...",
2716                 },*/
2717                 .finished_start_job = {
2718                         [JOB_DONE]       = "Listening on %s.",
2719                         [JOB_FAILED]     = "Failed to listen on %s.",
2720                         [JOB_DEPENDENCY] = "Dependency failed for %s.",
2721                         [JOB_TIMEOUT]    = "Timed out starting %s.",
2722                 },
2723                 .finished_stop_job = {
2724                         [JOB_DONE]       = "Closed %s.",
2725                         [JOB_FAILED]     = "Failed stopping %s.",
2726                         [JOB_TIMEOUT]    = "Timed out stopping %s.",
2727                 },
2728         },
2729 };