src/core/socket.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/types.h>
  23 #include <sys/stat.h>
  24 #include <unistd.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <sys/epoll.h>
  28 #include <signal.h>
  29 #include <arpa/inet.h>
  30 #include <netinet/tcp.h>
  31 #include <mqueue.h>
  32 #include <sys/xattr.h>
  33
  34 #include "sd-event.h"
  35 #include "log.h"
  36 #include "load-dropin.h"
  37 #include "load-fragment.h"
  38 #include "strv.h"
  39 #include "mkdir.h"
  40 #include "path-util.h"
  41 #include "unit-name.h"
  42 #include "unit-printf.h"
  43 #include "missing.h"
  44 #include "special.h"
  45 #include "label.h"
  46 #include "exit-status.h"
  47 #include "def.h"
  48 #include "smack-util.h"
  49 #include "bus-util.h"
  50 #include "bus-error.h"
  51 #include "dbus-socket.h"
  52 #include "unit.h"
  53 #include "socket.h"
  54
  55 static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
  56         [SOCKET_DEAD] = UNIT_INACTIVE,
  57         [SOCKET_START_PRE] = UNIT_ACTIVATING,
  58         [SOCKET_START_CHOWN] = UNIT_ACTIVATING,
  59         [SOCKET_START_POST] = UNIT_ACTIVATING,
  60         [SOCKET_LISTENING] = UNIT_ACTIVE,
  61         [SOCKET_RUNNING] = UNIT_ACTIVE,
  62         [SOCKET_STOP_PRE] = UNIT_DEACTIVATING,
  63         [SOCKET_STOP_PRE_SIGTERM] = UNIT_DEACTIVATING,
  64         [SOCKET_STOP_PRE_SIGKILL] = UNIT_DEACTIVATING,
  65         [SOCKET_STOP_POST] = UNIT_DEACTIVATING,
  66         [SOCKET_FINAL_SIGTERM] = UNIT_DEACTIVATING,
  67         [SOCKET_FINAL_SIGKILL] = UNIT_DEACTIVATING,
  68         [SOCKET_FAILED] = UNIT_FAILED
  69 };
  70
  71 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata);
  72 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata);
  73
  74 static void socket_init(Unit *u) {
  75         Socket *s = SOCKET(u);
  76
  77         assert(u);
  78         assert(u->load_state == UNIT_STUB);
  79
  80         s->backlog = SOMAXCONN;
  81         s->timeout_usec = u->manager->default_timeout_start_usec;
  82         s->directory_mode = 0755;
  83         s->socket_mode = 0666;
  84
  85         s->max_connections = 64;
  86
  87         s->priority = -1;
  88         s->ip_tos = -1;
  89         s->ip_ttl = -1;
  90         s->mark = -1;
  91
  92         s->exec_context.std_output = u->manager->default_std_output;
  93         s->exec_context.std_error = u->manager->default_std_error;
  94
  95         s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
  96 }
  97
  98 static void socket_unwatch_control_pid(Socket *s) {
  99         assert(s);
 100
 101         if (s->control_pid <= 0)
 102                 return;
 103
 104         unit_unwatch_pid(UNIT(s), s->control_pid);
 105         s->control_pid = 0;
 106 }
 107
 108 void socket_free_ports(Socket *s) {
 109         SocketPort *p;
 110
 111         assert(s);
 112
 113         while ((p = s->ports)) {
 114                 LIST_REMOVE(port, s->ports, p);
 115
 116                 sd_event_source_unref(p->event_source);
 117
 118                 safe_close(p->fd);
 119                 free(p->path);
 120                 free(p);
 121         }
 122 }
 123
 124 static void socket_done(Unit *u) {
 125         Socket *s = SOCKET(u);
 126
 127         assert(s);
 128
 129         socket_free_ports(s);
 130
 131         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
 132         exec_command_free_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
 133         s->control_command = NULL;
 134
 135         socket_unwatch_control_pid(s);
 136
 137         unit_ref_unset(&s->service);
 138
 139         free(s->tcp_congestion);
 140         s->tcp_congestion = NULL;
 141
 142         free(s->bind_to_device);
 143         s->bind_to_device = NULL;
 144
 145         free(s->smack);
 146         free(s->smack_ip_in);
 147         free(s->smack_ip_out);
 148
 149         strv_free(s->symlinks);
 150
 151         free(s->user);
 152         free(s->group);
 153
 154         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 155 }
 156
 157 static int socket_arm_timer(Socket *s) {
 158         int r;
 159
 160         assert(s);
 161
 162         if (s->timeout_usec <= 0) {
 163                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 164                 return 0;
 165         }
 166
 167         if (s->timer_event_source) {
 168                 r = sd_event_source_set_time(s->timer_event_source, now(CLOCK_MONOTONIC) + s->timeout_usec);
 169                 if (r < 0)
 170                         return r;
 171
 172                 return sd_event_source_set_enabled(s->timer_event_source, SD_EVENT_ONESHOT);
 173         }
 174
 175         return sd_event_add_time(
 176                         UNIT(s)->manager->event,
 177                         &s->timer_event_source,
 178                         CLOCK_MONOTONIC,
 179                         now(CLOCK_MONOTONIC) + s->timeout_usec, 0,
 180                         socket_dispatch_timer, s);
 181 }
 182
 183 int socket_instantiate_service(Socket *s) {
 184         _cleanup_free_ char *prefix = NULL, *name = NULL;
 185         int r;
 186         Unit *u;
 187
 188         assert(s);
 189
 190         /* This fills in s->service if it isn't filled in yet. For
 191          * Accept=yes sockets we create the next connection service
 192          * here. For Accept=no this is mostly a NOP since the service
 193          * is figured out at load time anyway. */
 194
 195         if (UNIT_DEREF(s->service) || !s->accept)
 196                 return 0;
 197
 198         prefix = unit_name_to_prefix(UNIT(s)->id);
 199         if (!prefix)
 200                 return -ENOMEM;
 201
 202         if (asprintf(&name, "%s@%u.service", prefix, s->n_accepted) < 0)
 203                 return -ENOMEM;
 204
 205         r = manager_load_unit(UNIT(s)->manager, name, NULL, NULL, &u);
 206         if (r < 0)
 207                 return r;
 208
 209         u->no_gc = true;
 210         unit_ref_set(&s->service, u);
 211
 212         return unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, u, false);
 213 }
 214
 215 static bool have_non_accept_socket(Socket *s) {
 216         SocketPort *p;
 217
 218         assert(s);
 219
 220         if (!s->accept)
 221                 return true;
 222
 223         LIST_FOREACH(port, p, s->ports) {
 224
 225                 if (p->type != SOCKET_SOCKET)
 226                         return true;
 227
 228                 if (!socket_address_can_accept(&p->address))
 229                         return true;
 230         }
 231
 232         return false;
 233 }
 234
 235 static int socket_add_mount_links(Socket *s) {
 236         SocketPort *p;
 237         int r;
 238
 239         assert(s);
 240
 241         LIST_FOREACH(port, p, s->ports) {
 242                 const char *path = NULL;
 243
 244                 if (p->type == SOCKET_SOCKET)
 245                         path = socket_address_get_path(&p->address);
 246                 else if (p->type == SOCKET_FIFO || p->type == SOCKET_SPECIAL)
 247                         path = p->path;
 248
 249                 if (!path)
 250                         continue;
 251
 252                 r = unit_require_mounts_for(UNIT(s), path);
 253                 if (r < 0)
 254                         return r;
 255         }
 256
 257         return 0;
 258 }
 259
 260 static int socket_add_device_link(Socket *s) {
 261         char *t;
 262
 263         assert(s);
 264
 265         if (!s->bind_to_device || streq(s->bind_to_device, "lo"))
 266                 return 0;
 267
 268         t = strappenda("/sys/subsystem/net/devices/", s->bind_to_device);
 269         return unit_add_node_link(UNIT(s), t, false);
 270 }
 271
 272 static int socket_add_default_dependencies(Socket *s) {
 273         int r;
 274         assert(s);
 275
 276         r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, NULL, true);
 277         if (r < 0)
 278                 return r;
 279
 280         if (UNIT(s)->manager->running_as == SYSTEMD_SYSTEM) {
 281                 r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true);
 282                 if (r < 0)
 283                         return r;
 284         }
 285
 286         return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
 287 }
 288
 289 _pure_ static bool socket_has_exec(Socket *s) {
 290         unsigned i;
 291         assert(s);
 292
 293         for (i = 0; i < _SOCKET_EXEC_COMMAND_MAX; i++)
 294                 if (s->exec_command[i])
 295                         return true;
 296
 297         return false;
 298 }
 299
 300 static int socket_add_extras(Socket *s) {
 301         Unit *u = UNIT(s);
 302         int r;
 303
 304         assert(s);
 305
 306         if (have_non_accept_socket(s)) {
 307
 308                 if (!UNIT_DEREF(s->service)) {
 309                         Unit *x;
 310
 311                         r = unit_load_related_unit(u, ".service", &x);
 312                         if (r < 0)
 313                                 return r;
 314
 315                         unit_ref_set(&s->service, x);
 316                 }
 317
 318                 r = unit_add_two_dependencies(u, UNIT_BEFORE, UNIT_TRIGGERS, UNIT_DEREF(s->service), true);
 319                 if (r < 0)
 320                         return r;
 321         }
 322
 323         r = socket_add_mount_links(s);
 324         if (r < 0)
 325                 return r;
 326
 327         r = socket_add_device_link(s);
 328         if (r < 0)
 329                 return r;
 330
 331         r = unit_patch_contexts(u);
 332         if (r < 0)
 333                 return r;
 334
 335         if (socket_has_exec(s)) {
 336                 r = unit_add_exec_dependencies(u, &s->exec_context);
 337                 if (r < 0)
 338                         return r;
 339
 340                 r = unit_add_default_slice(u, &s->cgroup_context);
 341                 if (r < 0)
 342                         return r;
 343         }
 344
 345         if (u->default_dependencies) {
 346                 r = socket_add_default_dependencies(s);
 347                 if (r < 0)
 348                         return r;
 349         }
 350
 351         return 0;
 352 }
 353
 354 static const char *socket_find_symlink_target(Socket *s) {
 355         const char *found = NULL;
 356         SocketPort *p;
 357
 358         LIST_FOREACH(port, p, s->ports) {
 359                 const char *f = NULL;
 360
 361                 switch (p->type) {
 362
 363                 case SOCKET_FIFO:
 364                         f = p->path;
 365                         break;
 366
 367                 case SOCKET_SOCKET:
 368                         if (p->address.sockaddr.un.sun_path[0] != 0)
 369                                 f = p->address.sockaddr.un.sun_path;
 370                         break;
 371
 372                 default:
 373                         break;
 374                 }
 375
 376                 if (f) {
 377                         if (found)
 378                                 return NULL;
 379
 380                         found = f;
 381                 }
 382         }
 383
 384         return found;
 385 }
 386
 387 static int socket_verify(Socket *s) {
 388         assert(s);
 389
 390         if (UNIT(s)->load_state != UNIT_LOADED)
 391                 return 0;
 392
 393         if (!s->ports) {
 394                 log_error_unit(UNIT(s)->id, "%s lacks Listen setting. Refusing.", UNIT(s)->id);
 395                 return -EINVAL;
 396         }
 397
 398         if (s->accept && have_non_accept_socket(s)) {
 399                 log_error_unit(UNIT(s)->id, "%s configured for accepting sockets, but sockets are non-accepting. Refusing.",
 400                                UNIT(s)->id);
 401                 return -EINVAL;
 402         }
 403
 404         if (s->accept && s->max_connections <= 0) {
 405                 log_error_unit(UNIT(s)->id, "%s's MaxConnection setting too small. Refusing.", UNIT(s)->id);
 406                 return -EINVAL;
 407         }
 408
 409         if (s->accept && UNIT_DEREF(s->service)) {
 410                 log_error_unit(UNIT(s)->id, "Explicit service configuration for accepting sockets not supported on %s. Refusing.", UNIT(s)->id);
 411                 return -EINVAL;
 412         }
 413
 414         if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP) {
 415                 log_error_unit(UNIT(s)->id, "%s has PAM enabled. Kill mode must be set to 'control-group'. Refusing.", UNIT(s)->id);
 416                 return -EINVAL;
 417         }
 418
 419         if (!strv_isempty(s->symlinks) && !socket_find_symlink_target(s)) {
 420                 log_error_unit(UNIT(s)->id, "%s has symlinks set but none or more than one node in the file system. Refusing.", UNIT(s)->id);
 421                 return -EINVAL;
 422         }
 423
 424         return 0;
 425 }
 426
 427 static int socket_load(Unit *u) {
 428         Socket *s = SOCKET(u);
 429         int r;
 430
 431         assert(u);
 432         assert(u->load_state == UNIT_STUB);
 433
 434         r = unit_load_fragment_and_dropin(u);
 435         if (r < 0)
 436                 return r;
 437
 438         if (u->load_state == UNIT_LOADED) {
 439                 /* This is a new unit? Then let's add in some extras */
 440                 r = socket_add_extras(s);
 441                 if (r < 0)
 442                         return r;
 443         }
 444
 445         return socket_verify(s);
 446 }
 447
 448 _const_ static const char* listen_lookup(int family, int type) {
 449
 450         if (family == AF_NETLINK)
 451                 return "ListenNetlink";
 452
 453         if (type == SOCK_STREAM)
 454                 return "ListenStream";
 455         else if (type == SOCK_DGRAM)
 456                 return "ListenDatagram";
 457         else if (type == SOCK_SEQPACKET)
 458                 return "ListenSequentialPacket";
 459
 460         assert_not_reached("Unknown socket type");
 461         return NULL;
 462 }
 463
 464 static void socket_dump(Unit *u, FILE *f, const char *prefix) {
 465         char time_string[FORMAT_TIMESPAN_MAX];
 466         SocketExecCommand c;
 467         Socket *s = SOCKET(u);
 468         SocketPort *p;
 469         const char *prefix2;
 470
 471         assert(s);
 472         assert(f);
 473
 474         prefix = strempty(prefix);
 475         prefix2 = strappenda(prefix, "\t");
 476
 477         fprintf(f,
 478                 "%sSocket State: %s\n"
 479                 "%sResult: %s\n"
 480                 "%sBindIPv6Only: %s\n"
 481                 "%sBacklog: %u\n"
 482                 "%sSocketMode: %04o\n"
 483                 "%sDirectoryMode: %04o\n"
 484                 "%sKeepAlive: %s\n"
 485                 "%sNoDelay: %s\n"
 486                 "%sFreeBind: %s\n"
 487                 "%sTransparent: %s\n"
 488                 "%sBroadcast: %s\n"
 489                 "%sPassCredentials: %s\n"
 490                 "%sPassSecurity: %s\n"
 491                 "%sTCPCongestion: %s\n"
 492                 "%sRemoveOnStop: %s\n",
 493                 prefix, socket_state_to_string(s->state),
 494                 prefix, socket_result_to_string(s->result),
 495                 prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
 496                 prefix, s->backlog,
 497                 prefix, s->socket_mode,
 498                 prefix, s->directory_mode,
 499                 prefix, yes_no(s->keep_alive),
 500                 prefix, yes_no(s->no_delay),
 501                 prefix, yes_no(s->free_bind),
 502                 prefix, yes_no(s->transparent),
 503                 prefix, yes_no(s->broadcast),
 504                 prefix, yes_no(s->pass_cred),
 505                 prefix, yes_no(s->pass_sec),
 506                 prefix, strna(s->tcp_congestion),
 507                 prefix, yes_no(s->remove_on_stop));
 508
 509         if (s->control_pid > 0)
 510                 fprintf(f,
 511                         "%sControl PID: "PID_FMT"\n",
 512                         prefix, s->control_pid);
 513
 514         if (s->bind_to_device)
 515                 fprintf(f,
 516                         "%sBindToDevice: %s\n",
 517                         prefix, s->bind_to_device);
 518
 519         if (s->accept)
 520                 fprintf(f,
 521                         "%sAccepted: %u\n"
 522                         "%sNConnections: %u\n"
 523                         "%sMaxConnections: %u\n",
 524                         prefix, s->n_accepted,
 525                         prefix, s->n_connections,
 526                         prefix, s->max_connections);
 527
 528         if (s->priority >= 0)
 529                 fprintf(f,
 530                         "%sPriority: %i\n",
 531                         prefix, s->priority);
 532
 533         if (s->receive_buffer > 0)
 534                 fprintf(f,
 535                         "%sReceiveBuffer: %zu\n",
 536                         prefix, s->receive_buffer);
 537
 538         if (s->send_buffer > 0)
 539                 fprintf(f,
 540                         "%sSendBuffer: %zu\n",
 541                         prefix, s->send_buffer);
 542
 543         if (s->ip_tos >= 0)
 544                 fprintf(f,
 545                         "%sIPTOS: %i\n",
 546                         prefix, s->ip_tos);
 547
 548         if (s->ip_ttl >= 0)
 549                 fprintf(f,
 550                         "%sIPTTL: %i\n",
 551                         prefix, s->ip_ttl);
 552
 553         if (s->pipe_size > 0)
 554                 fprintf(f,
 555                         "%sPipeSize: %zu\n",
 556                         prefix, s->pipe_size);
 557
 558         if (s->mark >= 0)
 559                 fprintf(f,
 560                         "%sMark: %i\n",
 561                         prefix, s->mark);
 562
 563         if (s->mq_maxmsg > 0)
 564                 fprintf(f,
 565                         "%sMessageQueueMaxMessages: %li\n",
 566                         prefix, s->mq_maxmsg);
 567
 568         if (s->mq_msgsize > 0)
 569                 fprintf(f,
 570                         "%sMessageQueueMessageSize: %li\n",
 571                         prefix, s->mq_msgsize);
 572
 573         if (s->reuse_port)
 574                 fprintf(f,
 575                         "%sReusePort: %s\n",
 576                          prefix, yes_no(s->reuse_port));
 577
 578         if (s->smack)
 579                 fprintf(f,
 580                         "%sSmackLabel: %s\n",
 581                         prefix, s->smack);
 582
 583         if (s->smack_ip_in)
 584                 fprintf(f,
 585                         "%sSmackLabelIPIn: %s\n",
 586                         prefix, s->smack_ip_in);
 587
 588         if (s->smack_ip_out)
 589                 fprintf(f,
 590                         "%sSmackLabelIPOut: %s\n",
 591                         prefix, s->smack_ip_out);
 592
 593         if (!isempty(s->user) || !isempty(s->group))
 594                 fprintf(f,
 595                         "%sOwnerUser: %s\n"
 596                         "%sOwnerGroup: %s\n",
 597                         prefix, strna(s->user),
 598                         prefix, strna(s->group));
 599
 600         if (s->keep_alive_time > 0)
 601                 fprintf(f,
 602                         "%sKeepAliveTimeSec: %s\n",
 603                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_time, USEC_PER_SEC));
 604
 605         if (s->keep_alive_interval)
 606                 fprintf(f,
 607                         "%sKeepAliveIntervalSec: %s\n",
 608                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_interval, USEC_PER_SEC));
 609
 610         if (s->keep_alive_cnt)
 611                 fprintf(f,
 612                         "%sKeepAliveProbes: %u\n",
 613                         prefix, s->keep_alive_cnt);
 614
 615         if (s->defer_accept)
 616                 fprintf(f,
 617                         "%sDeferAcceptSec: %s\n",
 618                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->defer_accept, USEC_PER_SEC));
 619
 620         LIST_FOREACH(port, p, s->ports) {
 621
 622                 if (p->type == SOCKET_SOCKET) {
 623                         const char *t;
 624                         int r;
 625                         char *k = NULL;
 626
 627                         if ((r = socket_address_print(&p->address, &k)) < 0)
 628                                 t = strerror(-r);
 629                         else
 630                                 t = k;
 631
 632                         fprintf(f, "%s%s: %s\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type), t);
 633                         free(k);
 634                 } else if (p->type == SOCKET_SPECIAL)
 635                         fprintf(f, "%sListenSpecial: %s\n", prefix, p->path);
 636                 else if (p->type == SOCKET_MQUEUE)
 637                         fprintf(f, "%sListenMessageQueue: %s\n", prefix, p->path);
 638                 else
 639                         fprintf(f, "%sListenFIFO: %s\n", prefix, p->path);
 640         }
 641
 642         exec_context_dump(&s->exec_context, f, prefix);
 643         kill_context_dump(&s->kill_context, f, prefix);
 644
 645         for (c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
 646                 if (!s->exec_command[c])
 647                         continue;
 648
 649                 fprintf(f, "%s-> %s:\n",
 650                         prefix, socket_exec_command_to_string(c));
 651
 652                 exec_command_dump_list(s->exec_command[c], f, prefix2);
 653         }
 654 }
 655
 656 static int instance_from_socket(int fd, unsigned nr, char **instance) {
 657         socklen_t l;
 658         char *r;
 659         union sockaddr_union local, remote;
 660
 661         assert(fd >= 0);
 662         assert(instance);
 663
 664         l = sizeof(local);
 665         if (getsockname(fd, &local.sa, &l) < 0)
 666                 return -errno;
 667
 668         l = sizeof(remote);
 669         if (getpeername(fd, &remote.sa, &l) < 0)
 670                 return -errno;
 671
 672         switch (local.sa.sa_family) {
 673
 674         case AF_INET: {
 675                 uint32_t
 676                         a = ntohl(local.in.sin_addr.s_addr),
 677                         b = ntohl(remote.in.sin_addr.s_addr);
 678
 679                 if (asprintf(&r,
 680                              "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 681                              nr,
 682                              a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
 683                              ntohs(local.in.sin_port),
 684                              b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
 685                              ntohs(remote.in.sin_port)) < 0)
 686                         return -ENOMEM;
 687
 688                 break;
 689         }
 690
 691         case AF_INET6: {
 692                 static const unsigned char ipv4_prefix[] = {
 693                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
 694                 };
 695
 696                 if (memcmp(&local.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0 &&
 697                     memcmp(&remote.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
 698                         const uint8_t
 699                                 *a = local.in6.sin6_addr.s6_addr+12,
 700                                 *b = remote.in6.sin6_addr.s6_addr+12;
 701
 702                         if (asprintf(&r,
 703                                      "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 704                                      nr,
 705                                      a[0], a[1], a[2], a[3],
 706                                      ntohs(local.in6.sin6_port),
 707                                      b[0], b[1], b[2], b[3],
 708                                      ntohs(remote.in6.sin6_port)) < 0)
 709                                 return -ENOMEM;
 710                 } else {
 711                         char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
 712
 713                         if (asprintf(&r,
 714                                      "%u-%s:%u-%s:%u",
 715                                      nr,
 716                                      inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
 717                                      ntohs(local.in6.sin6_port),
 718                                      inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
 719                                      ntohs(remote.in6.sin6_port)) < 0)
 720                                 return -ENOMEM;
 721                 }
 722
 723                 break;
 724         }
 725
 726         case AF_UNIX: {
 727                 struct ucred ucred;
 728                 int k;
 729
 730                 k = getpeercred(fd, &ucred);
 731                 if (k >= 0) {
 732                         if (asprintf(&r,
 733                                      "%u-"PID_FMT"-"UID_FMT,
 734                                      nr, ucred.pid, ucred.uid) < 0)
 735                                 return -ENOMEM;
 736                 } else if (k == -ENODATA) {
 737                         /* This handles the case where somebody is
 738                          * connecting from another pid/uid namespace
 739                          * (e.g. from outside of our container). */
 740                         if (asprintf(&r,
 741                                      "%u-unknown",
 742                                      nr) < 0)
 743                                 return -ENOMEM;
 744                 } else
 745                         return k;
 746
 747                 break;
 748         }
 749
 750         default:
 751                 assert_not_reached("Unhandled socket type.");
 752         }
 753
 754         *instance = r;
 755         return 0;
 756 }
 757
 758 static void socket_close_fds(Socket *s) {
 759         SocketPort *p;
 760         char **i;
 761
 762         assert(s);
 763
 764         LIST_FOREACH(port, p, s->ports) {
 765
 766                 p->event_source = sd_event_source_unref(p->event_source);
 767
 768                 if (p->fd < 0)
 769                         continue;
 770
 771                 p->fd = safe_close(p->fd);
 772
 773                 /* One little note: we should normally not delete any
 774                  * sockets in the file system here! After all some
 775                  * other process we spawned might still have a
 776                  * reference of this fd and wants to continue to use
 777                  * it. Therefore we delete sockets in the file system
 778                  * before we create a new one, not after we stopped
 779                  * using one! */
 780
 781                 if (s->remove_on_stop) {
 782                         switch (p->type) {
 783
 784                         case SOCKET_FIFO:
 785                                 unlink(p->path);
 786                                 break;
 787
 788                         case SOCKET_MQUEUE:
 789                                 mq_unlink(p->path);
 790                                 break;
 791
 792                         case SOCKET_SOCKET:
 793                                 socket_address_unlink(&p->address);
 794                                 break;
 795
 796                         default:
 797                                 break;
 798                         }
 799                 }
 800         }
 801
 802         if (s->remove_on_stop)
 803                 STRV_FOREACH(i, s->symlinks)
 804                         unlink(*i);
 805 }
 806
 807 static void socket_apply_socket_options(Socket *s, int fd) {
 808         assert(s);
 809         assert(fd >= 0);
 810
 811         if (s->keep_alive) {
 812                 int b = s->keep_alive;
 813                 if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &b, sizeof(b)) < 0)
 814                         log_warning_unit(UNIT(s)->id, "SO_KEEPALIVE failed: %m");
 815         }
 816
 817         if (s->keep_alive_time) {
 818                 int value = s->keep_alive_time / USEC_PER_SEC;
 819                 if (setsockopt(fd, SOL_TCP, TCP_KEEPIDLE, &value, sizeof(value)) < 0)
 820                         log_warning_unit(UNIT(s)->id, "TCP_KEEPIDLE failed: %m");
 821         }
 822
 823         if (s->keep_alive_interval) {
 824                 int value =  s->keep_alive_interval / USEC_PER_SEC;
 825                 if (setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &value, sizeof(value)) < 0)
 826                         log_warning_unit(UNIT(s)->id, "TCP_KEEPINTVL failed: %m");
 827         }
 828
 829         if (s->keep_alive_cnt) {
 830                 int value = s->keep_alive_cnt;
 831                 if (setsockopt(fd, SOL_SOCKET, TCP_KEEPCNT, &value, sizeof(value)) < 0)
 832                         log_warning_unit(UNIT(s)->id, "TCP_KEEPCNT failed: %m");
 833         }
 834
 835         if (s->defer_accept) {
 836                 int value = s->defer_accept / USEC_PER_SEC;
 837                 if (setsockopt(fd, SOL_TCP, TCP_DEFER_ACCEPT, &value, sizeof(value)) < 0)
 838                         log_warning_unit(UNIT(s)->id, "TCP_DEFER_ACCEPT failed: %m");
 839         }
 840
 841         if (s->no_delay) {
 842                 int b = s->no_delay;
 843                 if (setsockopt(fd, SOL_TCP, TCP_NODELAY, &b, sizeof(b)) < 0)
 844                         log_warning_unit(UNIT(s)->id, "TCP_NODELAY failed: %m");
 845         }
 846
 847         if (s->broadcast) {
 848                 int one = 1;
 849                 if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &one, sizeof(one)) < 0)
 850                         log_warning_unit(UNIT(s)->id, "SO_BROADCAST failed: %m");
 851         }
 852
 853         if (s->pass_cred) {
 854                 int one = 1;
 855                 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
 856                         log_warning_unit(UNIT(s)->id, "SO_PASSCRED failed: %m");
 857         }
 858
 859         if (s->pass_sec) {
 860                 int one = 1;
 861                 if (setsockopt(fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)) < 0)
 862                         log_warning_unit(UNIT(s)->id, "SO_PASSSEC failed: %m");
 863         }
 864
 865         if (s->priority >= 0)
 866                 if (setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &s->priority, sizeof(s->priority)) < 0)
 867                         log_warning_unit(UNIT(s)->id, "SO_PRIORITY failed: %m");
 868
 869         if (s->receive_buffer > 0) {
 870                 int value = (int) s->receive_buffer;
 871
 872                 /* We first try with SO_RCVBUFFORCE, in case we have the perms for that */
 873
 874                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &value, sizeof(value)) < 0)
 875                         if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, sizeof(value)) < 0)
 876                                 log_warning_unit(UNIT(s)->id, "SO_RCVBUF failed: %m");
 877         }
 878
 879         if (s->send_buffer > 0) {
 880                 int value = (int) s->send_buffer;
 881                 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUFFORCE, &value, sizeof(value)) < 0)
 882                         if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, sizeof(value)) < 0)
 883                                 log_warning_unit(UNIT(s)->id, "SO_SNDBUF failed: %m");
 884         }
 885
 886         if (s->mark >= 0)
 887                 if (setsockopt(fd, SOL_SOCKET, SO_MARK, &s->mark, sizeof(s->mark)) < 0)
 888                         log_warning_unit(UNIT(s)->id, "SO_MARK failed: %m");
 889
 890         if (s->ip_tos >= 0)
 891                 if (setsockopt(fd, IPPROTO_IP, IP_TOS, &s->ip_tos, sizeof(s->ip_tos)) < 0)
 892                         log_warning_unit(UNIT(s)->id, "IP_TOS failed: %m");
 893
 894         if (s->ip_ttl >= 0) {
 895                 int r, x;
 896
 897                 r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl));
 898
 899                 if (socket_ipv6_is_supported())
 900                         x = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &s->ip_ttl, sizeof(s->ip_ttl));
 901                 else {
 902                         x = -1;
 903                         errno = EAFNOSUPPORT;
 904                 }
 905
 906                 if (r < 0 && x < 0)
 907                         log_warning_unit(UNIT(s)->id,
 908                                          "IP_TTL/IPV6_UNICAST_HOPS failed: %m");
 909         }
 910
 911         if (s->tcp_congestion)
 912                 if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
 913                         log_warning_unit(UNIT(s)->id, "TCP_CONGESTION failed: %m");
 914
 915         if (s->reuse_port) {
 916                 int b = s->reuse_port;
 917                 if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &b, sizeof(b)) < 0)
 918                         log_warning_unit(UNIT(s)->id, "SO_REUSEPORT failed: %m");
 919         }
 920
 921         if (s->smack_ip_in)
 922                 if (smack_label_ip_in_fd(fd, s->smack_ip_in) < 0)
 923                         log_error_unit(UNIT(s)->id, "smack_label_ip_in_fd: %m");
 924
 925         if (s->smack_ip_out)
 926                 if (smack_label_ip_out_fd(fd, s->smack_ip_out) < 0)
 927                         log_error_unit(UNIT(s)->id, "smack_label_ip_out_fd: %m");
 928 }
 929
 930 static void socket_apply_fifo_options(Socket *s, int fd) {
 931         assert(s);
 932         assert(fd >= 0);
 933
 934         if (s->pipe_size > 0)
 935                 if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
 936                         log_warning_unit(UNIT(s)->id,
 937                                          "F_SETPIPE_SZ: %m");
 938
 939         if (s->smack)
 940                 if (smack_label_fd(fd, s->smack) < 0)
 941                         log_error_unit(UNIT(s)->id, "smack_label_fd: %m");
 942 }
 943
 944 static int fifo_address_create(
 945                 const char *path,
 946                 mode_t directory_mode,
 947                 mode_t socket_mode,
 948                 int *_fd) {
 949
 950         int fd = -1, r = 0;
 951         struct stat st;
 952         mode_t old_mask;
 953
 954         assert(path);
 955         assert(_fd);
 956
 957         mkdir_parents_label(path, directory_mode);
 958
 959         r = label_context_set(path, S_IFIFO);
 960         if (r < 0)
 961                 goto fail;
 962
 963         /* Enforce the right access mode for the fifo */
 964         old_mask = umask(~ socket_mode);
 965
 966         /* Include the original umask in our mask */
 967         umask(~socket_mode | old_mask);
 968
 969         r = mkfifo(path, socket_mode);
 970         umask(old_mask);
 971
 972         if (r < 0 && errno != EEXIST) {
 973                 r = -errno;
 974                 goto fail;
 975         }
 976
 977         if ((fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
 978                 r = -errno;
 979                 goto fail;
 980         }
 981
 982         label_context_clear();
 983
 984         if (fstat(fd, &st) < 0) {
 985                 r = -errno;
 986                 goto fail;
 987         }
 988
 989         if (!S_ISFIFO(st.st_mode) ||
 990             (st.st_mode & 0777) != (socket_mode & ~old_mask) ||
 991             st.st_uid != getuid() ||
 992             st.st_gid != getgid()) {
 993
 994                 r = -EEXIST;
 995                 goto fail;
 996         }
 997
 998         *_fd = fd;
 999         return 0;
1000
1001 fail:
1002         label_context_clear();
1003         safe_close(fd);
1004
1005         return r;
1006 }
1007
1008 static int special_address_create(
1009                 const char *path,
1010                 int *_fd) {
1011
1012         int fd = -1, r = 0;
1013         struct stat st;
1014
1015         assert(path);
1016         assert(_fd);
1017
1018         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1019         if (fd < 0) {
1020                 r = -errno;
1021                 goto fail;
1022         }
1023
1024         if (fstat(fd, &st) < 0) {
1025                 r = -errno;
1026                 goto fail;
1027         }
1028
1029         /* Check whether this is a /proc, /sys or /dev file or char device */
1030         if (!S_ISREG(st.st_mode) && !S_ISCHR(st.st_mode)) {
1031                 r = -EEXIST;
1032                 goto fail;
1033         }
1034
1035         *_fd = fd;
1036         return 0;
1037
1038 fail:
1039         safe_close(fd);
1040
1041         return r;
1042 }
1043
1044 static int mq_address_create(
1045                 const char *path,
1046                 mode_t mq_mode,
1047                 long maxmsg,
1048                 long msgsize,
1049                 int *_fd) {
1050
1051         int fd = -1, r = 0;
1052         struct stat st;
1053         mode_t old_mask;
1054         struct mq_attr _attr, *attr = NULL;
1055
1056         assert(path);
1057         assert(_fd);
1058
1059         if (maxmsg > 0 && msgsize > 0) {
1060                 zero(_attr);
1061                 _attr.mq_flags = O_NONBLOCK;
1062                 _attr.mq_maxmsg = maxmsg;
1063                 _attr.mq_msgsize = msgsize;
1064                 attr = &_attr;
1065         }
1066
1067         /* Enforce the right access mode for the mq */
1068         old_mask = umask(~ mq_mode);
1069
1070         /* Include the original umask in our mask */
1071         umask(~mq_mode | old_mask);
1072         fd = mq_open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_CREAT, mq_mode, attr);
1073         umask(old_mask);
1074
1075         if (fd < 0) {
1076                 r = -errno;
1077                 goto fail;
1078         }
1079
1080         if (fstat(fd, &st) < 0) {
1081                 r = -errno;
1082                 goto fail;
1083         }
1084
1085         if ((st.st_mode & 0777) != (mq_mode & ~old_mask) ||
1086             st.st_uid != getuid() ||
1087             st.st_gid != getgid()) {
1088
1089                 r = -EEXIST;
1090                 goto fail;
1091         }
1092
1093         *_fd = fd;
1094         return 0;
1095
1096 fail:
1097         safe_close(fd);
1098         return r;
1099 }
1100
1101 static int socket_symlink(Socket *s) {
1102         const char *p;
1103         char **i;
1104
1105         assert(s);
1106
1107         p = socket_find_symlink_target(s);
1108         if (!p)
1109                 return 0;
1110
1111         STRV_FOREACH(i, s->symlinks)
1112                 symlink(p, *i);
1113
1114         return 0;
1115 }
1116
1117 static int socket_open_fds(Socket *s) {
1118         SocketPort *p;
1119         int r;
1120         char *label = NULL;
1121         bool know_label = false;
1122
1123         assert(s);
1124
1125         LIST_FOREACH(port, p, s->ports) {
1126
1127                 if (p->fd >= 0)
1128                         continue;
1129
1130                 if (p->type == SOCKET_SOCKET) {
1131
1132                         if (!know_label) {
1133
1134                                 r = socket_instantiate_service(s);
1135                                 if (r < 0)
1136                                         return r;
1137
1138                                 if (UNIT_ISSET(s->service) &&
1139                                     SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]) {
1140                                         r = label_get_create_label_from_exe(SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]->path, &label);
1141                                         if (r < 0 && r != -EPERM)
1142                                                 return r;
1143                                 }
1144
1145                                 know_label = true;
1146                         }
1147
1148                         r = socket_address_listen(
1149                                         &p->address,
1150                                         SOCK_CLOEXEC|SOCK_NONBLOCK,
1151                                         s->backlog,
1152                                         s->bind_ipv6_only,
1153                                         s->bind_to_device,
1154                                         s->free_bind,
1155                                         s->transparent,
1156                                         s->directory_mode,
1157                                         s->socket_mode,
1158                                         label);
1159                         if (r < 0)
1160                                 goto rollback;
1161
1162                         p->fd = r;
1163                         socket_apply_socket_options(s, p->fd);
1164                         socket_symlink(s);
1165
1166                 } else  if (p->type == SOCKET_SPECIAL) {
1167
1168                         r = special_address_create(
1169                                         p->path,
1170                                         &p->fd);
1171                         if (r < 0)
1172                                 goto rollback;
1173
1174                 } else  if (p->type == SOCKET_FIFO) {
1175
1176                         r = fifo_address_create(
1177                                         p->path,
1178                                         s->directory_mode,
1179                                         s->socket_mode,
1180                                         &p->fd);
1181                         if (r < 0)
1182                                 goto rollback;
1183
1184                         socket_apply_fifo_options(s, p->fd);
1185                         socket_symlink(s);
1186
1187                 } else if (p->type == SOCKET_MQUEUE) {
1188
1189                         r = mq_address_create(
1190                                         p->path,
1191                                         s->socket_mode,
1192                                         s->mq_maxmsg,
1193                                         s->mq_msgsize,
1194                                         &p->fd);
1195                         if (r < 0)
1196                                 goto rollback;
1197                 } else
1198                         assert_not_reached("Unknown port type");
1199         }
1200
1201         label_free(label);
1202         return 0;
1203
1204 rollback:
1205         socket_close_fds(s);
1206         label_free(label);
1207         return r;
1208 }
1209
1210 static void socket_unwatch_fds(Socket *s) {
1211         SocketPort *p;
1212         int r;
1213
1214         assert(s);
1215
1216         LIST_FOREACH(port, p, s->ports) {
1217                 if (p->fd < 0)
1218                         continue;
1219
1220                 if (!p->event_source)
1221                         continue;
1222
1223                 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_OFF);
1224                 if (r < 0)
1225                         log_debug_unit(UNIT(s)->id, "Failed to disable event source.");
1226         }
1227 }
1228
1229 static int socket_watch_fds(Socket *s) {
1230         SocketPort *p;
1231         int r;
1232
1233         assert(s);
1234
1235         LIST_FOREACH(port, p, s->ports) {
1236                 if (p->fd < 0)
1237                         continue;
1238
1239                 if (p->event_source)
1240                         r = sd_event_source_set_enabled(p->event_source, SD_EVENT_ON);
1241                 else
1242                         r = sd_event_add_io(UNIT(s)->manager->event, &p->event_source, p->fd, EPOLLIN, socket_dispatch_io, p);
1243
1244                 if (r < 0) {
1245                         log_warning_unit(UNIT(s)->id, "Failed to watch listening fds: %s", strerror(-r));
1246                         goto fail;
1247                 }
1248         }
1249
1250         return 0;
1251
1252 fail:
1253         socket_unwatch_fds(s);
1254         return r;
1255 }
1256
1257 static void socket_set_state(Socket *s, SocketState state) {
1258         SocketState old_state;
1259         assert(s);
1260
1261         old_state = s->state;
1262         s->state = state;
1263
1264         if (!IN_SET(state,
1265                     SOCKET_START_PRE,
1266                     SOCKET_START_CHOWN,
1267                     SOCKET_START_POST,
1268                     SOCKET_STOP_PRE,
1269                     SOCKET_STOP_PRE_SIGTERM,
1270                     SOCKET_STOP_PRE_SIGKILL,
1271                     SOCKET_STOP_POST,
1272                     SOCKET_FINAL_SIGTERM,
1273                     SOCKET_FINAL_SIGKILL)) {
1274
1275                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1276                 socket_unwatch_control_pid(s);
1277                 s->control_command = NULL;
1278                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
1279         }
1280
1281         if (state != SOCKET_LISTENING)
1282                 socket_unwatch_fds(s);
1283
1284         if (!IN_SET(state,
1285                     SOCKET_START_CHOWN,
1286                     SOCKET_START_POST,
1287                     SOCKET_LISTENING,
1288                     SOCKET_RUNNING,
1289                     SOCKET_STOP_PRE,
1290                     SOCKET_STOP_PRE_SIGTERM,
1291                     SOCKET_STOP_PRE_SIGKILL))
1292                 socket_close_fds(s);
1293
1294         if (state != old_state)
1295                 log_debug_unit(UNIT(s)->id, "%s changed %s -> %s",
1296                                UNIT(s)->id, socket_state_to_string(old_state), socket_state_to_string(state));
1297
1298         unit_notify(UNIT(s), state_translation_table[old_state], state_translation_table[state], true);
1299 }
1300
1301 static int socket_coldplug(Unit *u) {
1302         Socket *s = SOCKET(u);
1303         int r;
1304
1305         assert(s);
1306         assert(s->state == SOCKET_DEAD);
1307
1308         if (s->deserialized_state == s->state)
1309                 return 0;
1310
1311         if (IN_SET(s->deserialized_state,
1312                    SOCKET_START_PRE,
1313                    SOCKET_START_CHOWN,
1314                    SOCKET_START_POST,
1315                    SOCKET_STOP_PRE,
1316                    SOCKET_STOP_PRE_SIGTERM,
1317                    SOCKET_STOP_PRE_SIGKILL,
1318                    SOCKET_STOP_POST,
1319                    SOCKET_FINAL_SIGTERM,
1320                    SOCKET_FINAL_SIGKILL)) {
1321
1322                 if (s->control_pid <= 0)
1323                         return -EBADMSG;
1324
1325                 r = unit_watch_pid(UNIT(s), s->control_pid);
1326                 if (r < 0)
1327                         return r;
1328
1329                 r = socket_arm_timer(s);
1330                 if (r < 0)
1331                         return r;
1332         }
1333
1334         if (IN_SET(s->deserialized_state,
1335                    SOCKET_START_CHOWN,
1336                    SOCKET_START_POST,
1337                    SOCKET_LISTENING,
1338                    SOCKET_RUNNING,
1339                    SOCKET_STOP_PRE,
1340                    SOCKET_STOP_PRE_SIGTERM,
1341                    SOCKET_STOP_PRE_SIGKILL)) {
1342                 r = socket_open_fds(s);
1343                 if (r < 0)
1344                         return r;
1345         }
1346
1347         if (s->deserialized_state == SOCKET_LISTENING) {
1348                 r = socket_watch_fds(s);
1349                 if (r < 0)
1350                         return r;
1351         }
1352
1353         socket_set_state(s, s->deserialized_state);
1354         return 0;
1355 }
1356
1357 static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
1358         _cleanup_free_ char **argv = NULL;
1359         pid_t pid;
1360         int r;
1361
1362         assert(s);
1363         assert(c);
1364         assert(_pid);
1365
1366         unit_realize_cgroup(UNIT(s));
1367
1368         r = unit_setup_exec_runtime(UNIT(s));
1369         if (r < 0)
1370                 goto fail;
1371
1372         r = socket_arm_timer(s);
1373         if (r < 0)
1374                 goto fail;
1375
1376         r = unit_full_printf_strv(UNIT(s), c->argv, &argv);
1377         if (r < 0)
1378                 goto fail;
1379
1380         r = exec_spawn(c,
1381                        argv,
1382                        &s->exec_context,
1383                        NULL, 0,
1384                        UNIT(s)->manager->environment,
1385                        true,
1386                        true,
1387                        true,
1388                        UNIT(s)->manager->confirm_spawn,
1389                        UNIT(s)->manager->cgroup_supported,
1390                        UNIT(s)->cgroup_path,
1391                        manager_get_runtime_prefix(UNIT(s)->manager),
1392                        UNIT(s)->id,
1393                        0,
1394                        NULL,
1395                        s->exec_runtime,
1396                        &pid);
1397         if (r < 0)
1398                 goto fail;
1399
1400         r = unit_watch_pid(UNIT(s), pid);
1401         if (r < 0)
1402                 /* FIXME: we need to do something here */
1403                 goto fail;
1404
1405         *_pid = pid;
1406         return 0;
1407
1408 fail:
1409         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1410         return r;
1411 }
1412
1413 static int socket_chown(Socket *s, pid_t *_pid) {
1414         pid_t pid;
1415         int r;
1416
1417         r = socket_arm_timer(s);
1418         if (r < 0)
1419                 goto fail;
1420
1421         /* We have to resolve the user names out-of-process, hence
1422          * let's fork here. It's messy, but well, what can we do? */
1423
1424         pid = fork();
1425         if (pid < 0)
1426                 return -errno;
1427
1428         if (pid == 0) {
1429                 SocketPort *p;
1430                 uid_t uid = (uid_t) -1;
1431                 gid_t gid = (gid_t) -1;
1432                 int ret;
1433
1434                 default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
1435                 ignore_signals(SIGPIPE, -1);
1436                 log_forget_fds();
1437
1438                 if (!isempty(s->user)) {
1439                         const char *user = s->user;
1440
1441                         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
1442                         if (r < 0) {
1443                                 ret = EXIT_USER;
1444                                 goto fail_child;
1445                         }
1446                 }
1447
1448                 if (!isempty(s->group)) {
1449                         const char *group = s->group;
1450
1451                         r = get_group_creds(&group, &gid);
1452                         if (r < 0) {
1453                                 ret = EXIT_GROUP;
1454                                 goto fail_child;
1455                         }
1456                 }
1457
1458                 LIST_FOREACH(port, p, s->ports) {
1459                         const char *path = NULL;
1460
1461                         if (p->type == SOCKET_SOCKET)
1462                                 path = socket_address_get_path(&p->address);
1463                         else if (p->type == SOCKET_FIFO)
1464                                 path = p->path;
1465
1466                         if (!path)
1467                                 continue;
1468
1469                         if (chown(path, uid, gid) < 0) {
1470                                 r = -errno;
1471                                 ret = EXIT_CHOWN;
1472                                 goto fail_child;
1473                         }
1474                 }
1475
1476                 _exit(0);
1477
1478         fail_child:
1479                 log_open();
1480                 log_error("Failed to chown socket at step %s: %s", exit_status_to_string(ret, EXIT_STATUS_SYSTEMD), strerror(-r));
1481
1482                 _exit(ret);
1483         }
1484
1485         r = unit_watch_pid(UNIT(s), pid);
1486         if (r < 0)
1487                 goto fail;
1488
1489         *_pid = pid;
1490         return 0;
1491
1492 fail:
1493         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1494         return r;
1495 }
1496
1497 static void socket_enter_dead(Socket *s, SocketResult f) {
1498         assert(s);
1499
1500         if (f != SOCKET_SUCCESS)
1501                 s->result = f;
1502
1503         exec_runtime_destroy(s->exec_runtime);
1504         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
1505
1506         exec_context_destroy_runtime_directory(&s->exec_context, manager_get_runtime_prefix(UNIT(s)->manager));
1507
1508         socket_set_state(s, s->result != SOCKET_SUCCESS ? SOCKET_FAILED : SOCKET_DEAD);
1509 }
1510
1511 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f);
1512
1513 static void socket_enter_stop_post(Socket *s, SocketResult f) {
1514         int r;
1515         assert(s);
1516
1517         if (f != SOCKET_SUCCESS)
1518                 s->result = f;
1519
1520         socket_unwatch_control_pid(s);
1521         s->control_command_id = SOCKET_EXEC_STOP_POST;
1522         s->control_command = s->exec_command[SOCKET_EXEC_STOP_POST];
1523
1524         if (s->control_command) {
1525                 r = socket_spawn(s, s->control_command, &s->control_pid);
1526                 if (r < 0)
1527                         goto fail;
1528
1529                 socket_set_state(s, SOCKET_STOP_POST);
1530         } else
1531                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_SUCCESS);
1532
1533         return;
1534
1535 fail:
1536         log_warning_unit(UNIT(s)->id,
1537                          "%s failed to run 'stop-post' task: %s",
1538                          UNIT(s)->id, strerror(-r));
1539         socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1540 }
1541
1542 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f) {
1543         int r;
1544
1545         assert(s);
1546
1547         if (f != SOCKET_SUCCESS)
1548                 s->result = f;
1549
1550         r = unit_kill_context(
1551                         UNIT(s),
1552                         &s->kill_context,
1553                         state != SOCKET_STOP_PRE_SIGTERM && state != SOCKET_FINAL_SIGTERM,
1554                         -1,
1555                         s->control_pid,
1556                         false);
1557         if (r < 0)
1558                 goto fail;
1559
1560         if (r > 0) {
1561                 r = socket_arm_timer(s);
1562                 if (r < 0)
1563                         goto fail;
1564
1565                 socket_set_state(s, state);
1566         } else if (state == SOCKET_STOP_PRE_SIGTERM)
1567                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_SUCCESS);
1568         else if (state == SOCKET_STOP_PRE_SIGKILL)
1569                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1570         else if (state == SOCKET_FINAL_SIGTERM)
1571                 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
1572         else
1573                 socket_enter_dead(s, SOCKET_SUCCESS);
1574
1575         return;
1576
1577 fail:
1578         log_warning_unit(UNIT(s)->id, "%s failed to kill processes: %s", UNIT(s)->id, strerror(-r));
1579
1580         if (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_STOP_PRE_SIGKILL)
1581                 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1582         else
1583                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1584 }
1585
1586 static void socket_enter_stop_pre(Socket *s, SocketResult f) {
1587         int r;
1588         assert(s);
1589
1590         if (f != SOCKET_SUCCESS)
1591                 s->result = f;
1592
1593         socket_unwatch_control_pid(s);
1594         s->control_command_id = SOCKET_EXEC_STOP_PRE;
1595         s->control_command = s->exec_command[SOCKET_EXEC_STOP_PRE];
1596
1597         if (s->control_command) {
1598                 r = socket_spawn(s, s->control_command, &s->control_pid);
1599                 if (r < 0)
1600                         goto fail;
1601
1602                 socket_set_state(s, SOCKET_STOP_PRE);
1603         } else
1604                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1605
1606         return;
1607
1608 fail:
1609         log_warning_unit(UNIT(s)->id, "%s failed to run 'stop-pre' task: %s", UNIT(s)->id, strerror(-r));
1610         socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1611 }
1612
1613 static void socket_enter_listening(Socket *s) {
1614         int r;
1615         assert(s);
1616
1617         r = socket_watch_fds(s);
1618         if (r < 0) {
1619                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1620                 goto fail;
1621         }
1622
1623         socket_set_state(s, SOCKET_LISTENING);
1624         return;
1625
1626 fail:
1627         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1628 }
1629
1630 static void socket_enter_start_post(Socket *s) {
1631         int r;
1632         assert(s);
1633
1634         socket_unwatch_control_pid(s);
1635         s->control_command_id = SOCKET_EXEC_START_POST;
1636         s->control_command = s->exec_command[SOCKET_EXEC_START_POST];
1637
1638         if (s->control_command) {
1639                 r = socket_spawn(s, s->control_command, &s->control_pid);
1640                 if (r < 0) {
1641                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-post' task: %s", UNIT(s)->id, strerror(-r));
1642                         goto fail;
1643                 }
1644
1645                 socket_set_state(s, SOCKET_START_POST);
1646         } else
1647                 socket_enter_listening(s);
1648
1649         return;
1650
1651 fail:
1652         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1653 }
1654
1655 static void socket_enter_start_chown(Socket *s) {
1656         int r;
1657
1658         assert(s);
1659
1660         r = socket_open_fds(s);
1661         if (r < 0) {
1662                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1663                 goto fail;
1664         }
1665
1666         if (!isempty(s->user) || !isempty(s->group)) {
1667
1668                 socket_unwatch_control_pid(s);
1669                 s->control_command_id = SOCKET_EXEC_START_CHOWN;
1670                 s->control_command = NULL;
1671
1672                 r = socket_chown(s, &s->control_pid);
1673                 if (r < 0) {
1674                         log_warning_unit(UNIT(s)->id, "%s failed to fork 'start-chown' task: %s", UNIT(s)->id, strerror(-r));
1675                         goto fail;
1676                 }
1677
1678                 socket_set_state(s, SOCKET_START_CHOWN);
1679         } else
1680                 socket_enter_start_post(s);
1681
1682         return;
1683
1684 fail:
1685         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1686 }
1687
1688 static void socket_enter_start_pre(Socket *s) {
1689         int r;
1690         assert(s);
1691
1692         socket_unwatch_control_pid(s);
1693         s->control_command_id = SOCKET_EXEC_START_PRE;
1694         s->control_command = s->exec_command[SOCKET_EXEC_START_PRE];
1695
1696         if (s->control_command) {
1697                 r = socket_spawn(s, s->control_command, &s->control_pid);
1698                 if (r < 0) {
1699                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-pre' task: %s", UNIT(s)->id, strerror(-r));
1700                         goto fail;
1701                 }
1702
1703                 socket_set_state(s, SOCKET_START_PRE);
1704         } else
1705                 socket_enter_start_chown(s);
1706
1707         return;
1708
1709 fail:
1710         socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1711 }
1712
1713 static void socket_enter_running(Socket *s, int cfd) {
1714         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1715         int r;
1716
1717         assert(s);
1718
1719         /* We don't take connections anymore if we are supposed to
1720          * shut down anyway */
1721         if (unit_stop_pending(UNIT(s))) {
1722
1723                 log_debug_unit(UNIT(s)->id, "Suppressing connection request on %s since unit stop is scheduled.", UNIT(s)->id);
1724
1725                 if (cfd >= 0)
1726                         safe_close(cfd);
1727                 else  {
1728                         /* Flush all sockets by closing and reopening them */
1729                         socket_close_fds(s);
1730
1731                         r = socket_open_fds(s);
1732                         if (r < 0) {
1733                                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1734                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1735                                 return;
1736                         }
1737
1738                         r = socket_watch_fds(s);
1739                         if (r < 0) {
1740                                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1741                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1742                         }
1743                 }
1744
1745                 return;
1746         }
1747
1748         if (cfd < 0) {
1749                 Iterator i;
1750                 Unit *other;
1751                 bool pending = false;
1752
1753                 /* If there's already a start pending don't bother to
1754                  * do anything */
1755                 SET_FOREACH(other, UNIT(s)->dependencies[UNIT_TRIGGERS], i)
1756                         if (unit_active_or_pending(other)) {
1757                                 pending = true;
1758                                 break;
1759                         }
1760
1761                 if (!pending) {
1762                         if (!UNIT_ISSET(s->service)) {
1763                                 log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
1764                                 r = -ENOENT;
1765                                 goto fail;
1766                         }
1767
1768                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
1769                         if (r < 0)
1770                                 goto fail;
1771                 }
1772
1773                 socket_set_state(s, SOCKET_RUNNING);
1774         } else {
1775                 _cleanup_free_ char *prefix = NULL, *instance = NULL, *name = NULL;
1776                 Service *service;
1777
1778                 if (s->n_connections >= s->max_connections) {
1779                         log_warning_unit(UNIT(s)->id, "%s: Too many incoming connections (%u)", UNIT(s)->id, s->n_connections);
1780                         safe_close(cfd);
1781                         return;
1782                 }
1783
1784                 r = socket_instantiate_service(s);
1785                 if (r < 0)
1786                         goto fail;
1787
1788                 r = instance_from_socket(cfd, s->n_accepted, &instance);
1789                 if (r < 0) {
1790                         if (r != -ENOTCONN)
1791                                 goto fail;
1792
1793                         /* ENOTCONN is legitimate if TCP RST was received.
1794                          * This connection is over, but the socket unit lives on. */
1795                         safe_close(cfd);
1796                         return;
1797                 }
1798
1799                 prefix = unit_name_to_prefix(UNIT(s)->id);
1800                 if (!prefix) {
1801                         r = -ENOMEM;
1802                         goto fail;
1803                 }
1804
1805                 name = unit_name_build(prefix, instance, ".service");
1806                 if (!name) {
1807                         r = -ENOMEM;
1808                         goto fail;
1809                 }
1810
1811                 r = unit_add_name(UNIT_DEREF(s->service), name);
1812                 if (r < 0)
1813                         goto fail;
1814
1815                 service = SERVICE(UNIT_DEREF(s->service));
1816                 unit_ref_unset(&s->service);
1817                 s->n_accepted ++;
1818
1819                 UNIT(service)->no_gc = false;
1820
1821                 unit_choose_id(UNIT(service), name);
1822
1823                 r = service_set_socket_fd(service, cfd, s);
1824                 if (r < 0)
1825                         goto fail;
1826
1827                 cfd = -1;
1828                 s->n_connections ++;
1829
1830                 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, true, &error, NULL);
1831                 if (r < 0)
1832                         goto fail;
1833
1834                 /* Notify clients about changed counters */
1835                 unit_add_to_dbus_queue(UNIT(s));
1836         }
1837
1838         return;
1839
1840 fail:
1841         log_warning_unit(UNIT(s)->id, "%s failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",
1842                          UNIT(s)->id, cfd >= 0 ? "template" : "non-template",
1843                          bus_error_message(&error, r));
1844
1845         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1846         safe_close(cfd);
1847 }
1848
1849 static void socket_run_next(Socket *s) {
1850         int r;
1851
1852         assert(s);
1853         assert(s->control_command);
1854         assert(s->control_command->command_next);
1855
1856         socket_unwatch_control_pid(s);
1857
1858         s->control_command = s->control_command->command_next;
1859
1860         r = socket_spawn(s, s->control_command, &s->control_pid);
1861         if (r < 0)
1862                 goto fail;
1863
1864         return;
1865
1866 fail:
1867         log_warning_unit(UNIT(s)->id, "%s failed to run next task: %s", UNIT(s)->id, strerror(-r));
1868
1869         if (s->state == SOCKET_START_POST)
1870                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1871         else if (s->state == SOCKET_STOP_POST)
1872                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1873         else
1874                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1875 }
1876
1877 static int socket_start(Unit *u) {
1878         Socket *s = SOCKET(u);
1879
1880         assert(s);
1881
1882         /* We cannot fulfill this request right now, try again later
1883          * please! */
1884         if (IN_SET(s->state,
1885                    SOCKET_STOP_PRE,
1886                    SOCKET_STOP_PRE_SIGKILL,
1887                    SOCKET_STOP_PRE_SIGTERM,
1888                    SOCKET_STOP_POST,
1889                    SOCKET_FINAL_SIGTERM,
1890                    SOCKET_FINAL_SIGKILL))
1891                 return -EAGAIN;
1892
1893         /* Already on it! */
1894         if (IN_SET(s->state,
1895                    SOCKET_START_PRE,
1896                    SOCKET_START_CHOWN,
1897                    SOCKET_START_POST))
1898                 return 0;
1899
1900         /* Cannot run this without the service being around */
1901         if (UNIT_ISSET(s->service)) {
1902                 Service *service;
1903
1904                 service = SERVICE(UNIT_DEREF(s->service));
1905
1906                 if (UNIT(service)->load_state != UNIT_LOADED) {
1907                         log_error_unit(u->id, "Socket service %s not loaded, refusing.", UNIT(service)->id);
1908                         return -ENOENT;
1909                 }
1910
1911                 /* If the service is already active we cannot start the
1912                  * socket */
1913                 if (service->state != SERVICE_DEAD &&
1914                     service->state != SERVICE_FAILED &&
1915                     service->state != SERVICE_AUTO_RESTART) {
1916                         log_error_unit(u->id, "Socket service %s already active, refusing.", UNIT(service)->id);
1917                         return -EBUSY;
1918                 }
1919         }
1920
1921         assert(s->state == SOCKET_DEAD || s->state == SOCKET_FAILED);
1922
1923         s->result = SOCKET_SUCCESS;
1924         socket_enter_start_pre(s);
1925
1926         return 0;
1927 }
1928
1929 static int socket_stop(Unit *u) {
1930         Socket *s = SOCKET(u);
1931
1932         assert(s);
1933
1934         /* Already on it */
1935         if (IN_SET(s->state,
1936                    SOCKET_STOP_PRE,
1937                    SOCKET_STOP_PRE_SIGTERM,
1938                    SOCKET_STOP_PRE_SIGKILL,
1939                    SOCKET_STOP_POST,
1940                    SOCKET_FINAL_SIGTERM,
1941                    SOCKET_FINAL_SIGKILL))
1942                 return 0;
1943
1944         /* If there's already something running we go directly into
1945          * kill mode. */
1946         if (IN_SET(s->state,
1947                    SOCKET_START_PRE,
1948                    SOCKET_START_CHOWN,
1949                    SOCKET_START_POST)) {
1950                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_SUCCESS);
1951                 return -EAGAIN;
1952         }
1953
1954         assert(s->state == SOCKET_LISTENING || s->state == SOCKET_RUNNING);
1955
1956         socket_enter_stop_pre(s, SOCKET_SUCCESS);
1957         return 0;
1958 }
1959
1960 static int socket_serialize(Unit *u, FILE *f, FDSet *fds) {
1961         Socket *s = SOCKET(u);
1962         SocketPort *p;
1963         int r;
1964
1965         assert(u);
1966         assert(f);
1967         assert(fds);
1968
1969         unit_serialize_item(u, f, "state", socket_state_to_string(s->state));
1970         unit_serialize_item(u, f, "result", socket_result_to_string(s->result));
1971         unit_serialize_item_format(u, f, "n-accepted", "%u", s->n_accepted);
1972
1973         if (s->control_pid > 0)
1974                 unit_serialize_item_format(u, f, "control-pid", PID_FMT, s->control_pid);
1975
1976         if (s->control_command_id >= 0)
1977                 unit_serialize_item(u, f, "control-command", socket_exec_command_to_string(s->control_command_id));
1978
1979         LIST_FOREACH(port, p, s->ports) {
1980                 int copy;
1981
1982                 if (p->fd < 0)
1983                         continue;
1984
1985                 copy = fdset_put_dup(fds, p->fd);
1986                 if (copy < 0)
1987                         return copy;
1988
1989                 if (p->type == SOCKET_SOCKET) {
1990                         _cleanup_free_ char *t = NULL;
1991
1992                         r = socket_address_print(&p->address, &t);
1993                         if (r < 0)
1994                                 return r;
1995
1996                         if (socket_address_family(&p->address) == AF_NETLINK)
1997                                 unit_serialize_item_format(u, f, "netlink", "%i %s", copy, t);
1998                         else
1999                                 unit_serialize_item_format(u, f, "socket", "%i %i %s", copy, p->address.type, t);
2000
2001                 } else if (p->type == SOCKET_SPECIAL)
2002                         unit_serialize_item_format(u, f, "special", "%i %s", copy, p->path);
2003                 else if (p->type == SOCKET_MQUEUE)
2004                         unit_serialize_item_format(u, f, "mqueue", "%i %s", copy, p->path);
2005                 else {
2006                         assert(p->type == SOCKET_FIFO);
2007                         unit_serialize_item_format(u, f, "fifo", "%i %s", copy, p->path);
2008                 }
2009         }
2010
2011         return 0;
2012 }
2013
2014 static int socket_deserialize_item(Unit *u, const char *key, const char *value, FDSet *fds) {
2015         Socket *s = SOCKET(u);
2016
2017         assert(u);
2018         assert(key);
2019         assert(value);
2020
2021         if (streq(key, "state")) {
2022                 SocketState state;
2023
2024                 state = socket_state_from_string(value);
2025                 if (state < 0)
2026                         log_debug_unit(u->id, "Failed to parse state value %s", value);
2027                 else
2028                         s->deserialized_state = state;
2029         } else if (streq(key, "result")) {
2030                 SocketResult f;
2031
2032                 f = socket_result_from_string(value);
2033                 if (f < 0)
2034                         log_debug_unit(u->id, "Failed to parse result value %s", value);
2035                 else if (f != SOCKET_SUCCESS)
2036                         s->result = f;
2037
2038         } else if (streq(key, "n-accepted")) {
2039                 unsigned k;
2040
2041                 if (safe_atou(value, &k) < 0)
2042                         log_debug_unit(u->id, "Failed to parse n-accepted value %s", value);
2043                 else
2044                         s->n_accepted += k;
2045         } else if (streq(key, "control-pid")) {
2046                 pid_t pid;
2047
2048                 if (parse_pid(value, &pid) < 0)
2049                         log_debug_unit(u->id, "Failed to parse control-pid value %s", value);
2050                 else
2051                         s->control_pid = pid;
2052         } else if (streq(key, "control-command")) {
2053                 SocketExecCommand id;
2054
2055                 id = socket_exec_command_from_string(value);
2056                 if (id < 0)
2057                         log_debug_unit(u->id, "Failed to parse exec-command value %s", value);
2058                 else {
2059                         s->control_command_id = id;
2060                         s->control_command = s->exec_command[id];
2061                 }
2062         } else if (streq(key, "fifo")) {
2063                 int fd, skip = 0;
2064                 SocketPort *p;
2065
2066                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2067                         log_debug_unit(u->id, "Failed to parse fifo value %s", value);
2068                 else {
2069
2070                         LIST_FOREACH(port, p, s->ports)
2071                                 if (p->type == SOCKET_FIFO &&
2072                                     streq_ptr(p->path, value+skip))
2073                                         break;
2074
2075                         if (p) {
2076                                 safe_close(p->fd);
2077                                 p->fd = fdset_remove(fds, fd);
2078                         }
2079                 }
2080
2081         } else if (streq(key, "special")) {
2082                 int fd, skip = 0;
2083                 SocketPort *p;
2084
2085                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2086                         log_debug_unit(u->id, "Failed to parse special value %s", value);
2087                 else {
2088
2089                         LIST_FOREACH(port, p, s->ports)
2090                                 if (p->type == SOCKET_SPECIAL &&
2091                                     streq_ptr(p->path, value+skip))
2092                                         break;
2093
2094                         if (p) {
2095                                 safe_close(p->fd);
2096                                 p->fd = fdset_remove(fds, fd);
2097                         }
2098                 }
2099
2100         } else if (streq(key, "mqueue")) {
2101                 int fd, skip = 0;
2102                 SocketPort *p;
2103
2104                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2105                         log_debug_unit(u->id, "Failed to parse mqueue value %s", value);
2106                 else {
2107
2108                         LIST_FOREACH(port, p, s->ports)
2109                                 if (p->type == SOCKET_MQUEUE &&
2110                                     streq_ptr(p->path, value+skip))
2111                                         break;
2112
2113                         if (p) {
2114                                 safe_close(p->fd);
2115                                 p->fd = fdset_remove(fds, fd);
2116                         }
2117                 }
2118
2119         } else if (streq(key, "socket")) {
2120                 int fd, type, skip = 0;
2121                 SocketPort *p;
2122
2123                 if (sscanf(value, "%i %i %n", &fd, &type, &skip) < 2 || fd < 0 || type < 0 || !fdset_contains(fds, fd))
2124                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2125                 else {
2126
2127                         LIST_FOREACH(port, p, s->ports)
2128                                 if (socket_address_is(&p->address, value+skip, type))
2129                                         break;
2130
2131                         if (p) {
2132                                 safe_close(p->fd);
2133                                 p->fd = fdset_remove(fds, fd);
2134                         }
2135                 }
2136
2137         } else if (streq(key, "netlink")) {
2138                 int fd, skip = 0;
2139                 SocketPort *p;
2140
2141                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2142                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2143                 else {
2144
2145                         LIST_FOREACH(port, p, s->ports)
2146                                 if (socket_address_is_netlink(&p->address, value+skip))
2147                                         break;
2148
2149                         if (p) {
2150                                 safe_close(p->fd);
2151                                 p->fd = fdset_remove(fds, fd);
2152                         }
2153                 }
2154         } else
2155                 log_debug_unit(UNIT(s)->id, "Unknown serialization key '%s'", key);
2156
2157         return 0;
2158 }
2159
2160 static int socket_distribute_fds(Unit *u, FDSet *fds) {
2161         Socket *s = SOCKET(u);
2162         SocketPort *p;
2163
2164         assert(u);
2165
2166         LIST_FOREACH(port, p, s->ports) {
2167                 Iterator i;
2168                 int fd;
2169
2170                 if (p->type != SOCKET_SOCKET)
2171                         continue;
2172
2173                 if (p->fd >= 0)
2174                         continue;
2175
2176                 FDSET_FOREACH(fd, fds, i) {
2177                         if (socket_address_matches_fd(&p->address, fd)) {
2178                                 p->fd = fdset_remove(fds, fd);
2179                                 s->deserialized_state = SOCKET_LISTENING;
2180                                 break;
2181                         }
2182                 }
2183         }
2184
2185         return 0;
2186 }
2187
2188 _pure_ static UnitActiveState socket_active_state(Unit *u) {
2189         assert(u);
2190
2191         return state_translation_table[SOCKET(u)->state];
2192 }
2193
2194 _pure_ static const char *socket_sub_state_to_string(Unit *u) {
2195         assert(u);
2196
2197         return socket_state_to_string(SOCKET(u)->state);
2198 }
2199
2200 const char* socket_port_type_to_string(SocketPort *p) {
2201
2202         assert(p);
2203
2204         switch (p->type) {
2205
2206         case SOCKET_SOCKET:
2207
2208                 switch (p->address.type) {
2209
2210                 case SOCK_STREAM:
2211                         return "Stream";
2212
2213                 case SOCK_DGRAM:
2214                         return "Datagram";
2215
2216                 case SOCK_SEQPACKET:
2217                         return "SequentialPacket";
2218
2219                 case SOCK_RAW:
2220                         if (socket_address_family(&p->address) == AF_NETLINK)
2221                                 return "Netlink";
2222
2223                 default:
2224                         return NULL;
2225                 }
2226
2227         case SOCKET_SPECIAL:
2228                 return "Special";
2229
2230         case SOCKET_MQUEUE:
2231                 return "MessageQueue";
2232
2233         case SOCKET_FIFO:
2234                 return "FIFO";
2235
2236         default:
2237                 return NULL;
2238         }
2239 }
2240
2241 _pure_ static bool socket_check_gc(Unit *u) {
2242         Socket *s = SOCKET(u);
2243
2244         assert(u);
2245
2246         return s->n_connections > 0;
2247 }
2248
2249 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
2250         SocketPort *p = userdata;
2251         int cfd = -1;
2252
2253         assert(p);
2254         assert(fd >= 0);
2255
2256         if (p->socket->state != SOCKET_LISTENING)
2257                 return 0;
2258
2259         log_debug_unit(UNIT(p->socket)->id, "Incoming traffic on %s", UNIT(p->socket)->id);
2260
2261         if (revents != EPOLLIN) {
2262
2263                 if (revents & EPOLLHUP)
2264                         log_error_unit(UNIT(p->socket)->id, "%s: Got POLLHUP on a listening socket. The service probably invoked shutdown() on it, and should better not do that.",
2265                                        UNIT(p->socket)->id);
2266                 else
2267                         log_error_unit(UNIT(p->socket)->id, "%s: Got unexpected poll event (0x%x) on socket.",
2268                                        UNIT(p->socket)->id, revents);
2269
2270                 goto fail;
2271         }
2272
2273         if (p->socket->accept &&
2274             p->type == SOCKET_SOCKET &&
2275             socket_address_can_accept(&p->address)) {
2276
2277                 for (;;) {
2278
2279                         cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
2280                         if (cfd < 0) {
2281
2282                                 if (errno == EINTR)
2283                                         continue;
2284
2285                                 log_error_unit(UNIT(p->socket)->id,
2286                                                "Failed to accept socket: %m");
2287                                 goto fail;
2288                         }
2289
2290                         break;
2291                 }
2292
2293                 socket_apply_socket_options(p->socket, cfd);
2294         }
2295
2296         socket_enter_running(p->socket, cfd);
2297         return 0;
2298
2299 fail:
2300         socket_enter_stop_pre(p->socket, SOCKET_FAILURE_RESOURCES);
2301         return 0;
2302 }
2303
2304 static void socket_sigchld_event(Unit *u, pid_t pid, int code, int status) {
2305         Socket *s = SOCKET(u);
2306         SocketResult f;
2307
2308         assert(s);
2309         assert(pid >= 0);
2310
2311         if (pid != s->control_pid)
2312                 return;
2313
2314         s->control_pid = 0;
2315
2316         if (is_clean_exit(code, status, NULL))
2317                 f = SOCKET_SUCCESS;
2318         else if (code == CLD_EXITED)
2319                 f = SOCKET_FAILURE_EXIT_CODE;
2320         else if (code == CLD_KILLED)
2321                 f = SOCKET_FAILURE_SIGNAL;
2322         else if (code == CLD_DUMPED)
2323                 f = SOCKET_FAILURE_CORE_DUMP;
2324         else
2325                 assert_not_reached("Unknown sigchld code");
2326
2327         if (s->control_command) {
2328                 exec_status_exit(&s->control_command->exec_status, &s->exec_context, pid, code, status);
2329
2330                 if (s->control_command->ignore)
2331                         f = SOCKET_SUCCESS;
2332         }
2333
2334         log_full_unit(f == SOCKET_SUCCESS ? LOG_DEBUG : LOG_NOTICE,
2335                       u->id,
2336                       "%s control process exited, code=%s status=%i",
2337                       u->id, sigchld_code_to_string(code), status);
2338
2339         if (f != SOCKET_SUCCESS)
2340                 s->result = f;
2341
2342         if (s->control_command &&
2343             s->control_command->command_next &&
2344             f == SOCKET_SUCCESS) {
2345
2346                 log_debug_unit(u->id,
2347                                "%s running next command for state %s",
2348                                u->id, socket_state_to_string(s->state));
2349                 socket_run_next(s);
2350         } else {
2351                 s->control_command = NULL;
2352                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
2353
2354                 /* No further commands for this step, so let's figure
2355                  * out what to do next */
2356
2357                 log_debug_unit(u->id,
2358                                "%s got final SIGCHLD for state %s",
2359                                u->id, socket_state_to_string(s->state));
2360
2361                 switch (s->state) {
2362
2363                 case SOCKET_START_PRE:
2364                         if (f == SOCKET_SUCCESS)
2365                                 socket_enter_start_chown(s);
2366                         else
2367                                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, f);
2368                         break;
2369
2370                 case SOCKET_START_CHOWN:
2371                         if (f == SOCKET_SUCCESS)
2372                                 socket_enter_start_post(s);
2373                         else
2374                                 socket_enter_stop_pre(s, f);
2375                         break;
2376
2377                 case SOCKET_START_POST:
2378                         if (f == SOCKET_SUCCESS)
2379                                 socket_enter_listening(s);
2380                         else
2381                                 socket_enter_stop_pre(s, f);
2382                         break;
2383
2384                 case SOCKET_STOP_PRE:
2385                 case SOCKET_STOP_PRE_SIGTERM:
2386                 case SOCKET_STOP_PRE_SIGKILL:
2387                         socket_enter_stop_post(s, f);
2388                         break;
2389
2390                 case SOCKET_STOP_POST:
2391                 case SOCKET_FINAL_SIGTERM:
2392                 case SOCKET_FINAL_SIGKILL:
2393                         socket_enter_dead(s, f);
2394                         break;
2395
2396                 default:
2397                         assert_not_reached("Uh, control process died at wrong time.");
2398                 }
2399         }
2400
2401         /* Notify clients about changed exit status */
2402         unit_add_to_dbus_queue(u);
2403 }
2404
2405 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata) {
2406         Socket *s = SOCKET(userdata);
2407
2408         assert(s);
2409         assert(s->timer_event_source == source);
2410
2411         switch (s->state) {
2412
2413         case SOCKET_START_PRE:
2414                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Terminating.", UNIT(s)->id);
2415                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2416                 break;
2417
2418         case SOCKET_START_CHOWN:
2419         case SOCKET_START_POST:
2420                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Stopping.", UNIT(s)->id);
2421                 socket_enter_stop_pre(s, SOCKET_FAILURE_TIMEOUT);
2422                 break;
2423
2424         case SOCKET_STOP_PRE:
2425                 log_warning_unit(UNIT(s)->id, "%s stopping timed out. Terminating.", UNIT(s)->id);
2426                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2427                 break;
2428
2429         case SOCKET_STOP_PRE_SIGTERM:
2430                 if (s->kill_context.send_sigkill) {
2431                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Killing.", UNIT(s)->id);
2432                         socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2433                 } else {
2434                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2435                         socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2436                 }
2437                 break;
2438
2439         case SOCKET_STOP_PRE_SIGKILL:
2440                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL. Ignoring.", UNIT(s)->id);
2441                 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2442                 break;
2443
2444         case SOCKET_STOP_POST:
2445                 log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Terminating.", UNIT(s)->id);
2446                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2447                 break;
2448
2449         case SOCKET_FINAL_SIGTERM:
2450                 if (s->kill_context.send_sigkill) {
2451                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Killing.", UNIT(s)->id);
2452                         socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2453                 } else {
2454                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2455                         socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2456                 }
2457                 break;
2458
2459         case SOCKET_FINAL_SIGKILL:
2460                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL (2). Entering failed mode.", UNIT(s)->id);
2461                 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2462                 break;
2463
2464         default:
2465                 assert_not_reached("Timeout at wrong time.");
2466         }
2467
2468         return 0;
2469 }
2470
2471 int socket_collect_fds(Socket *s, int **fds, unsigned *n_fds) {
2472         int *rfds;
2473         unsigned rn_fds, k;
2474         SocketPort *p;
2475
2476         assert(s);
2477         assert(fds);
2478         assert(n_fds);
2479
2480         /* Called from the service code for requesting our fds */
2481
2482         rn_fds = 0;
2483         LIST_FOREACH(port, p, s->ports)
2484                 if (p->fd >= 0)
2485                         rn_fds++;
2486
2487         if (rn_fds <= 0) {
2488                 *fds = NULL;
2489                 *n_fds = 0;
2490                 return 0;
2491         }
2492
2493         if (!(rfds = new(int, rn_fds)))
2494                 return -ENOMEM;
2495
2496         k = 0;
2497         LIST_FOREACH(port, p, s->ports)
2498                 if (p->fd >= 0)
2499                         rfds[k++] = p->fd;
2500
2501         assert(k == rn_fds);
2502
2503         *fds = rfds;
2504         *n_fds = rn_fds;
2505
2506         return 0;
2507 }
2508
2509 static void socket_reset_failed(Unit *u) {
2510         Socket *s = SOCKET(u);
2511
2512         assert(s);
2513
2514         if (s->state == SOCKET_FAILED)
2515                 socket_set_state(s, SOCKET_DEAD);
2516
2517         s->result = SOCKET_SUCCESS;
2518 }
2519
2520 static void socket_notify_service_dead(Socket *s, bool failed_permanent) {
2521         assert(s);
2522
2523         /* The service is dead. Dang!
2524          *
2525          * This is strictly for one-instance-for-all-connections
2526          * services. */
2527
2528         if (s->state == SOCKET_RUNNING) {
2529                 log_debug_unit(UNIT(s)->id, "%s got notified about service death (failed permanently: %s)", UNIT(s)->id, yes_no(failed_permanent));
2530                 if (failed_permanent)
2531                         socket_enter_stop_pre(s, SOCKET_FAILURE_SERVICE_FAILED_PERMANENT);
2532                 else
2533                         socket_enter_listening(s);
2534         }
2535 }
2536
2537 void socket_connection_unref(Socket *s) {
2538         assert(s);
2539
2540         /* The service is dead. Yay!
2541          *
2542          * This is strictly for one-instance-per-connection
2543          * services. */
2544
2545         assert(s->n_connections > 0);
2546         s->n_connections--;
2547
2548         log_debug_unit(UNIT(s)->id, "%s: One connection closed, %u left.", UNIT(s)->id, s->n_connections);
2549 }
2550
2551 static void socket_trigger_notify(Unit *u, Unit *other) {
2552         Socket *s = SOCKET(u);
2553         Service *se;
2554
2555         assert(u);
2556         assert(other);
2557
2558         /* Don't propagate state changes from the service if we are
2559            already down or accepting connections */
2560         if ((s->state !=  SOCKET_RUNNING &&
2561             s->state != SOCKET_LISTENING) ||
2562             s->accept)
2563                 return;
2564
2565         if (other->load_state != UNIT_LOADED ||
2566             other->type != UNIT_SERVICE)
2567                 return;
2568
2569         se = SERVICE(other);
2570
2571         if (se->state == SERVICE_FAILED)
2572                 socket_notify_service_dead(s, se->result == SERVICE_FAILURE_START_LIMIT);
2573
2574         if (se->state == SERVICE_DEAD ||
2575             se->state == SERVICE_STOP ||
2576             se->state == SERVICE_STOP_SIGTERM ||
2577             se->state == SERVICE_STOP_SIGKILL ||
2578             se->state == SERVICE_STOP_POST ||
2579             se->state == SERVICE_FINAL_SIGTERM ||
2580             se->state == SERVICE_FINAL_SIGKILL ||
2581             se->state == SERVICE_AUTO_RESTART)
2582                 socket_notify_service_dead(s, false);
2583
2584         if (se->state == SERVICE_RUNNING)
2585                 socket_set_state(s, SOCKET_RUNNING);
2586 }
2587
2588 static int socket_kill(Unit *u, KillWho who, int signo, sd_bus_error *error) {
2589         return unit_kill_common(u, who, signo, -1, SOCKET(u)->control_pid, error);
2590 }
2591
2592 static int socket_get_timeout(Unit *u, uint64_t *timeout) {
2593         Socket *s = SOCKET(u);
2594         int r;
2595
2596         if (!s->timer_event_source)
2597                 return 0;
2598
2599         r = sd_event_source_get_time(s->timer_event_source, timeout);
2600         if (r < 0)
2601                 return r;
2602
2603         return 1;
2604 }
2605
2606 static const char* const socket_state_table[_SOCKET_STATE_MAX] = {
2607         [SOCKET_DEAD] = "dead",
2608         [SOCKET_START_PRE] = "start-pre",
2609         [SOCKET_START_CHOWN] = "start-chown",
2610         [SOCKET_START_POST] = "start-post",
2611         [SOCKET_LISTENING] = "listening",
2612         [SOCKET_RUNNING] = "running",
2613         [SOCKET_STOP_PRE] = "stop-pre",
2614         [SOCKET_STOP_PRE_SIGTERM] = "stop-pre-sigterm",
2615         [SOCKET_STOP_PRE_SIGKILL] = "stop-pre-sigkill",
2616         [SOCKET_STOP_POST] = "stop-post",
2617         [SOCKET_FINAL_SIGTERM] = "final-sigterm",
2618         [SOCKET_FINAL_SIGKILL] = "final-sigkill",
2619         [SOCKET_FAILED] = "failed"
2620 };
2621
2622 DEFINE_STRING_TABLE_LOOKUP(socket_state, SocketState);
2623
2624 static const char* const socket_exec_command_table[_SOCKET_EXEC_COMMAND_MAX] = {
2625         [SOCKET_EXEC_START_PRE] = "StartPre",
2626         [SOCKET_EXEC_START_CHOWN] = "StartChown",
2627         [SOCKET_EXEC_START_POST] = "StartPost",
2628         [SOCKET_EXEC_STOP_PRE] = "StopPre",
2629         [SOCKET_EXEC_STOP_POST] = "StopPost"
2630 };
2631
2632 DEFINE_STRING_TABLE_LOOKUP(socket_exec_command, SocketExecCommand);
2633
2634 static const char* const socket_result_table[_SOCKET_RESULT_MAX] = {
2635         [SOCKET_SUCCESS] = "success",
2636         [SOCKET_FAILURE_RESOURCES] = "resources",
2637         [SOCKET_FAILURE_TIMEOUT] = "timeout",
2638         [SOCKET_FAILURE_EXIT_CODE] = "exit-code",
2639         [SOCKET_FAILURE_SIGNAL] = "signal",
2640         [SOCKET_FAILURE_CORE_DUMP] = "core-dump",
2641         [SOCKET_FAILURE_SERVICE_FAILED_PERMANENT] = "service-failed-permanent"
2642 };
2643
2644 DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
2645
2646 const UnitVTable socket_vtable = {
2647         .object_size = sizeof(Socket),
2648         .exec_context_offset = offsetof(Socket, exec_context),
2649         .cgroup_context_offset = offsetof(Socket, cgroup_context),
2650         .kill_context_offset = offsetof(Socket, kill_context),
2651         .exec_runtime_offset = offsetof(Socket, exec_runtime),
2652
2653         .sections =
2654                 "Unit\0"
2655                 "Socket\0"
2656                 "Install\0",
2657         .private_section = "Socket",
2658
2659         .init = socket_init,
2660         .done = socket_done,
2661         .load = socket_load,
2662
2663         .coldplug = socket_coldplug,
2664
2665         .dump = socket_dump,
2666
2667         .start = socket_start,
2668         .stop = socket_stop,
2669
2670         .kill = socket_kill,
2671
2672         .get_timeout = socket_get_timeout,
2673
2674         .serialize = socket_serialize,
2675         .deserialize_item = socket_deserialize_item,
2676         .distribute_fds = socket_distribute_fds,
2677
2678         .active_state = socket_active_state,
2679         .sub_state_to_string = socket_sub_state_to_string,
2680
2681         .check_gc = socket_check_gc,
2682
2683         .sigchld_event = socket_sigchld_event,
2684
2685         .trigger_notify = socket_trigger_notify,
2686
2687         .reset_failed = socket_reset_failed,
2688
2689         .bus_interface = "org.freedesktop.systemd1.Socket",
2690         .bus_vtable = bus_socket_vtable,
2691         .bus_set_property = bus_socket_set_property,
2692         .bus_commit_properties = bus_socket_commit_properties,
2693
2694         .status_message_formats = {
2695                 /*.starting_stopping = {
2696                         [0] = "Starting socket %s...",
2697                         [1] = "Stopping socket %s...",
2698                 },*/
2699                 .finished_start_job = {
2700                         [JOB_DONE]       = "Listening on %s.",
2701                         [JOB_FAILED]     = "Failed to listen on %s.",
2702                         [JOB_DEPENDENCY] = "Dependency failed for %s.",
2703                         [JOB_TIMEOUT]    = "Timed out starting %s.",
2704                 },
2705                 .finished_stop_job = {
2706                         [JOB_DONE]       = "Closed %s.",
2707                         [JOB_FAILED]     = "Failed stopping %s.",
2708                         [JOB_TIMEOUT]    = "Timed out stopping %s.",
2709                 },
2710         },
2711 };