src/core/socket.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/types.h>
  23 #include <sys/stat.h>
  24 #include <unistd.h>
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <sys/epoll.h>
  28 #include <signal.h>
  29 #include <arpa/inet.h>
  30 #include <netinet/tcp.h>
  31 #include <mqueue.h>
  32 #include <sys/xattr.h>
  33
  34 #include "sd-event.h"
  35 #include "log.h"
  36 #include "load-dropin.h"
  37 #include "load-fragment.h"
  38 #include "strv.h"
  39 #include "mkdir.h"
  40 #include "path-util.h"
  41 #include "unit-name.h"
  42 #include "unit-printf.h"
  43 #include "missing.h"
  44 #include "special.h"
  45 #include "label.h"
  46 #include "exit-status.h"
  47 #include "def.h"
  48 #include "smack-util.h"
  49 #include "bus-util.h"
  50 #include "bus-error.h"
  51 #include "dbus-socket.h"
  52 #include "unit.h"
  53 #include "socket.h"
  54
  55 static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
  56         [SOCKET_DEAD] = UNIT_INACTIVE,
  57         [SOCKET_START_PRE] = UNIT_ACTIVATING,
  58         [SOCKET_START_CHOWN] = UNIT_ACTIVATING,
  59         [SOCKET_START_POST] = UNIT_ACTIVATING,
  60         [SOCKET_LISTENING] = UNIT_ACTIVE,
  61         [SOCKET_RUNNING] = UNIT_ACTIVE,
  62         [SOCKET_STOP_PRE] = UNIT_DEACTIVATING,
  63         [SOCKET_STOP_PRE_SIGTERM] = UNIT_DEACTIVATING,
  64         [SOCKET_STOP_PRE_SIGKILL] = UNIT_DEACTIVATING,
  65         [SOCKET_STOP_POST] = UNIT_DEACTIVATING,
  66         [SOCKET_FINAL_SIGTERM] = UNIT_DEACTIVATING,
  67         [SOCKET_FINAL_SIGKILL] = UNIT_DEACTIVATING,
  68         [SOCKET_FAILED] = UNIT_FAILED
  69 };
  70
  71 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata);
  72 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata);
  73
  74 static void socket_init(Unit *u) {
  75         Socket *s = SOCKET(u);
  76
  77         assert(u);
  78         assert(u->load_state == UNIT_STUB);
  79
  80         s->backlog = SOMAXCONN;
  81         s->timeout_usec = u->manager->default_timeout_start_usec;
  82         s->directory_mode = 0755;
  83         s->socket_mode = 0666;
  84
  85         s->max_connections = 64;
  86
  87         s->priority = -1;
  88         s->ip_tos = -1;
  89         s->ip_ttl = -1;
  90         s->mark = -1;
  91
  92         s->exec_context.std_output = u->manager->default_std_output;
  93         s->exec_context.std_error = u->manager->default_std_error;
  94
  95         s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
  96 }
  97
  98 static void socket_unwatch_control_pid(Socket *s) {
  99         assert(s);
 100
 101         if (s->control_pid <= 0)
 102                 return;
 103
 104         unit_unwatch_pid(UNIT(s), s->control_pid);
 105         s->control_pid = 0;
 106 }
 107
 108 void socket_free_ports(Socket *s) {
 109         SocketPort *p;
 110
 111         assert(s);
 112
 113         while ((p = s->ports)) {
 114                 LIST_REMOVE(port, s->ports, p);
 115
 116                 sd_event_source_unref(p->event_source);
 117
 118                 safe_close(p->fd);
 119                 free(p->path);
 120                 free(p);
 121         }
 122 }
 123
 124 static void socket_done(Unit *u) {
 125         Socket *s = SOCKET(u);
 126
 127         assert(s);
 128
 129         socket_free_ports(s);
 130
 131         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
 132         exec_command_free_array(s->exec_command, _SOCKET_EXEC_COMMAND_MAX);
 133         s->control_command = NULL;
 134
 135         socket_unwatch_control_pid(s);
 136
 137         unit_ref_unset(&s->service);
 138
 139         free(s->tcp_congestion);
 140         s->tcp_congestion = NULL;
 141
 142         free(s->bind_to_device);
 143         s->bind_to_device = NULL;
 144
 145         free(s->smack);
 146         free(s->smack_ip_in);
 147         free(s->smack_ip_out);
 148
 149         strv_free(s->symlinks);
 150
 151         free(s->user);
 152         free(s->group);
 153
 154         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 155 }
 156
 157 static int socket_arm_timer(Socket *s) {
 158         int r;
 159
 160         assert(s);
 161
 162         if (s->timeout_usec <= 0) {
 163                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
 164                 return 0;
 165         }
 166
 167         if (s->timer_event_source) {
 168                 r = sd_event_source_set_time(s->timer_event_source, now(CLOCK_MONOTONIC) + s->timeout_usec);
 169                 if (r < 0)
 170                         return r;
 171
 172                 return sd_event_source_set_enabled(s->timer_event_source, SD_EVENT_ONESHOT);
 173         }
 174
 175         return sd_event_add_time(
 176                         UNIT(s)->manager->event,
 177                         &s->timer_event_source,
 178                         CLOCK_MONOTONIC,
 179                         now(CLOCK_MONOTONIC) + s->timeout_usec, 0,
 180                         socket_dispatch_timer, s);
 181 }
 182
 183 int socket_instantiate_service(Socket *s) {
 184         _cleanup_free_ char *prefix = NULL, *name = NULL;
 185         int r;
 186         Unit *u;
 187
 188         assert(s);
 189
 190         /* This fills in s->service if it isn't filled in yet. For
 191          * Accept=yes sockets we create the next connection service
 192          * here. For Accept=no this is mostly a NOP since the service
 193          * is figured out at load time anyway. */
 194
 195         if (UNIT_DEREF(s->service) || !s->accept)
 196                 return 0;
 197
 198         prefix = unit_name_to_prefix(UNIT(s)->id);
 199         if (!prefix)
 200                 return -ENOMEM;
 201
 202         if (asprintf(&name, "%s@%u.service", prefix, s->n_accepted) < 0)
 203                 return -ENOMEM;
 204
 205         r = manager_load_unit(UNIT(s)->manager, name, NULL, NULL, &u);
 206         if (r < 0)
 207                 return r;
 208
 209         u->no_gc = true;
 210         unit_ref_set(&s->service, u);
 211
 212         return unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, u, false);
 213 }
 214
 215 static bool have_non_accept_socket(Socket *s) {
 216         SocketPort *p;
 217
 218         assert(s);
 219
 220         if (!s->accept)
 221                 return true;
 222
 223         LIST_FOREACH(port, p, s->ports) {
 224
 225                 if (p->type != SOCKET_SOCKET)
 226                         return true;
 227
 228                 if (!socket_address_can_accept(&p->address))
 229                         return true;
 230         }
 231
 232         return false;
 233 }
 234
 235 static int socket_add_mount_links(Socket *s) {
 236         SocketPort *p;
 237         int r;
 238
 239         assert(s);
 240
 241         LIST_FOREACH(port, p, s->ports) {
 242                 const char *path = NULL;
 243
 244                 if (p->type == SOCKET_SOCKET)
 245                         path = socket_address_get_path(&p->address);
 246                 else if (p->type == SOCKET_FIFO || p->type == SOCKET_SPECIAL)
 247                         path = p->path;
 248
 249                 if (!path)
 250                         continue;
 251
 252                 r = unit_require_mounts_for(UNIT(s), path);
 253                 if (r < 0)
 254                         return r;
 255         }
 256
 257         return 0;
 258 }
 259
 260 static int socket_add_device_link(Socket *s) {
 261         char *t;
 262
 263         assert(s);
 264
 265         if (!s->bind_to_device || streq(s->bind_to_device, "lo"))
 266                 return 0;
 267
 268         t = strappenda("/sys/subsystem/net/devices/", s->bind_to_device);
 269         return unit_add_node_link(UNIT(s), t, false);
 270 }
 271
 272 static int socket_add_default_dependencies(Socket *s) {
 273         int r;
 274         assert(s);
 275
 276         r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, NULL, true);
 277         if (r < 0)
 278                 return r;
 279
 280         if (UNIT(s)->manager->running_as == SYSTEMD_SYSTEM) {
 281                 r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true);
 282                 if (r < 0)
 283                         return r;
 284         }
 285
 286         return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
 287 }
 288
 289 _pure_ static bool socket_has_exec(Socket *s) {
 290         unsigned i;
 291         assert(s);
 292
 293         for (i = 0; i < _SOCKET_EXEC_COMMAND_MAX; i++)
 294                 if (s->exec_command[i])
 295                         return true;
 296
 297         return false;
 298 }
 299
 300 static int socket_add_extras(Socket *s) {
 301         Unit *u = UNIT(s);
 302         int r;
 303
 304         assert(s);
 305
 306         if (have_non_accept_socket(s)) {
 307
 308                 if (!UNIT_DEREF(s->service)) {
 309                         Unit *x;
 310
 311                         r = unit_load_related_unit(u, ".service", &x);
 312                         if (r < 0)
 313                                 return r;
 314
 315                         unit_ref_set(&s->service, x);
 316                 }
 317
 318                 r = unit_add_two_dependencies(u, UNIT_BEFORE, UNIT_TRIGGERS, UNIT_DEREF(s->service), true);
 319                 if (r < 0)
 320                         return r;
 321         }
 322
 323         r = socket_add_mount_links(s);
 324         if (r < 0)
 325                 return r;
 326
 327         r = socket_add_device_link(s);
 328         if (r < 0)
 329                 return r;
 330
 331         r = unit_patch_contexts(u);
 332         if (r < 0)
 333                 return r;
 334
 335         if (socket_has_exec(s)) {
 336                 r = unit_add_exec_dependencies(u, &s->exec_context);
 337                 if (r < 0)
 338                         return r;
 339
 340                 r = unit_add_default_slice(u, &s->cgroup_context);
 341                 if (r < 0)
 342                         return r;
 343         }
 344
 345         if (u->default_dependencies) {
 346                 r = socket_add_default_dependencies(s);
 347                 if (r < 0)
 348                         return r;
 349         }
 350
 351         return 0;
 352 }
 353
 354 static const char *socket_find_symlink_target(Socket *s) {
 355         const char *found = NULL;
 356         SocketPort *p;
 357
 358         LIST_FOREACH(port, p, s->ports) {
 359                 const char *f = NULL;
 360
 361                 switch (p->type) {
 362
 363                 case SOCKET_FIFO:
 364                         f = p->path;
 365                         break;
 366
 367                 case SOCKET_SOCKET:
 368                         if (p->address.sockaddr.un.sun_path[0] != 0)
 369                                 f = p->address.sockaddr.un.sun_path;
 370                         break;
 371
 372                 default:
 373                         break;
 374                 }
 375
 376                 if (f) {
 377                         if (found)
 378                                 return NULL;
 379
 380                         found = f;
 381                 }
 382         }
 383
 384         return found;
 385 }
 386
 387 static int socket_verify(Socket *s) {
 388         assert(s);
 389
 390         if (UNIT(s)->load_state != UNIT_LOADED)
 391                 return 0;
 392
 393         if (!s->ports) {
 394                 log_error_unit(UNIT(s)->id, "%s lacks Listen setting. Refusing.", UNIT(s)->id);
 395                 return -EINVAL;
 396         }
 397
 398         if (s->accept && have_non_accept_socket(s)) {
 399                 log_error_unit(UNIT(s)->id, "%s configured for accepting sockets, but sockets are non-accepting. Refusing.",
 400                                UNIT(s)->id);
 401                 return -EINVAL;
 402         }
 403
 404         if (s->accept && s->max_connections <= 0) {
 405                 log_error_unit(UNIT(s)->id, "%s's MaxConnection setting too small. Refusing.", UNIT(s)->id);
 406                 return -EINVAL;
 407         }
 408
 409         if (s->accept && UNIT_DEREF(s->service)) {
 410                 log_error_unit(UNIT(s)->id, "Explicit service configuration for accepting sockets not supported on %s. Refusing.", UNIT(s)->id);
 411                 return -EINVAL;
 412         }
 413
 414         if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP) {
 415                 log_error_unit(UNIT(s)->id, "%s has PAM enabled. Kill mode must be set to 'control-group'. Refusing.", UNIT(s)->id);
 416                 return -EINVAL;
 417         }
 418
 419         if (!strv_isempty(s->symlinks) && !socket_find_symlink_target(s)) {
 420                 log_error_unit(UNIT(s)->id, "%s has symlinks set but none or more than one node in the file system. Refusing.", UNIT(s)->id);
 421                 return -EINVAL;
 422         }
 423
 424         return 0;
 425 }
 426
 427 static int socket_load(Unit *u) {
 428         Socket *s = SOCKET(u);
 429         int r;
 430
 431         assert(u);
 432         assert(u->load_state == UNIT_STUB);
 433
 434         r = unit_load_fragment_and_dropin(u);
 435         if (r < 0)
 436                 return r;
 437
 438         if (u->load_state == UNIT_LOADED) {
 439                 /* This is a new unit? Then let's add in some extras */
 440                 r = socket_add_extras(s);
 441                 if (r < 0)
 442                         return r;
 443         }
 444
 445         return socket_verify(s);
 446 }
 447
 448 _const_ static const char* listen_lookup(int family, int type) {
 449
 450         if (family == AF_NETLINK)
 451                 return "ListenNetlink";
 452
 453         if (type == SOCK_STREAM)
 454                 return "ListenStream";
 455         else if (type == SOCK_DGRAM)
 456                 return "ListenDatagram";
 457         else if (type == SOCK_SEQPACKET)
 458                 return "ListenSequentialPacket";
 459
 460         assert_not_reached("Unknown socket type");
 461         return NULL;
 462 }
 463
 464 static void socket_dump(Unit *u, FILE *f, const char *prefix) {
 465         char time_string[FORMAT_TIMESPAN_MAX];
 466         SocketExecCommand c;
 467         Socket *s = SOCKET(u);
 468         SocketPort *p;
 469         const char *prefix2;
 470
 471         assert(s);
 472         assert(f);
 473
 474         prefix = strempty(prefix);
 475         prefix2 = strappenda(prefix, "\t");
 476
 477         fprintf(f,
 478                 "%sSocket State: %s\n"
 479                 "%sResult: %s\n"
 480                 "%sBindIPv6Only: %s\n"
 481                 "%sBacklog: %u\n"
 482                 "%sSocketMode: %04o\n"
 483                 "%sDirectoryMode: %04o\n"
 484                 "%sKeepAlive: %s\n"
 485                 "%sNoDelay: %s\n"
 486                 "%sFreeBind: %s\n"
 487                 "%sTransparent: %s\n"
 488                 "%sBroadcast: %s\n"
 489                 "%sPassCredentials: %s\n"
 490                 "%sPassSecurity: %s\n"
 491                 "%sTCPCongestion: %s\n"
 492                 "%sRemoveOnStop: %s\n",
 493                 prefix, socket_state_to_string(s->state),
 494                 prefix, socket_result_to_string(s->result),
 495                 prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
 496                 prefix, s->backlog,
 497                 prefix, s->socket_mode,
 498                 prefix, s->directory_mode,
 499                 prefix, yes_no(s->keep_alive),
 500                 prefix, yes_no(s->no_delay),
 501                 prefix, yes_no(s->free_bind),
 502                 prefix, yes_no(s->transparent),
 503                 prefix, yes_no(s->broadcast),
 504                 prefix, yes_no(s->pass_cred),
 505                 prefix, yes_no(s->pass_sec),
 506                 prefix, strna(s->tcp_congestion),
 507                 prefix, yes_no(s->remove_on_stop));
 508
 509         if (s->control_pid > 0)
 510                 fprintf(f,
 511                         "%sControl PID: "PID_FMT"\n",
 512                         prefix, s->control_pid);
 513
 514         if (s->bind_to_device)
 515                 fprintf(f,
 516                         "%sBindToDevice: %s\n",
 517                         prefix, s->bind_to_device);
 518
 519         if (s->accept)
 520                 fprintf(f,
 521                         "%sAccepted: %u\n"
 522                         "%sNConnections: %u\n"
 523                         "%sMaxConnections: %u\n",
 524                         prefix, s->n_accepted,
 525                         prefix, s->n_connections,
 526                         prefix, s->max_connections);
 527
 528         if (s->priority >= 0)
 529                 fprintf(f,
 530                         "%sPriority: %i\n",
 531                         prefix, s->priority);
 532
 533         if (s->receive_buffer > 0)
 534                 fprintf(f,
 535                         "%sReceiveBuffer: %zu\n",
 536                         prefix, s->receive_buffer);
 537
 538         if (s->send_buffer > 0)
 539                 fprintf(f,
 540                         "%sSendBuffer: %zu\n",
 541                         prefix, s->send_buffer);
 542
 543         if (s->ip_tos >= 0)
 544                 fprintf(f,
 545                         "%sIPTOS: %i\n",
 546                         prefix, s->ip_tos);
 547
 548         if (s->ip_ttl >= 0)
 549                 fprintf(f,
 550                         "%sIPTTL: %i\n",
 551                         prefix, s->ip_ttl);
 552
 553         if (s->pipe_size > 0)
 554                 fprintf(f,
 555                         "%sPipeSize: %zu\n",
 556                         prefix, s->pipe_size);
 557
 558         if (s->mark >= 0)
 559                 fprintf(f,
 560                         "%sMark: %i\n",
 561                         prefix, s->mark);
 562
 563         if (s->mq_maxmsg > 0)
 564                 fprintf(f,
 565                         "%sMessageQueueMaxMessages: %li\n",
 566                         prefix, s->mq_maxmsg);
 567
 568         if (s->mq_msgsize > 0)
 569                 fprintf(f,
 570                         "%sMessageQueueMessageSize: %li\n",
 571                         prefix, s->mq_msgsize);
 572
 573         if (s->reuse_port)
 574                 fprintf(f,
 575                         "%sReusePort: %s\n",
 576                          prefix, yes_no(s->reuse_port));
 577
 578         if (s->smack)
 579                 fprintf(f,
 580                         "%sSmackLabel: %s\n",
 581                         prefix, s->smack);
 582
 583         if (s->smack_ip_in)
 584                 fprintf(f,
 585                         "%sSmackLabelIPIn: %s\n",
 586                         prefix, s->smack_ip_in);
 587
 588         if (s->smack_ip_out)
 589                 fprintf(f,
 590                         "%sSmackLabelIPOut: %s\n",
 591                         prefix, s->smack_ip_out);
 592
 593         if (!isempty(s->user) || !isempty(s->group))
 594                 fprintf(f,
 595                         "%sOwnerUser: %s\n"
 596                         "%sOwnerGroup: %s\n",
 597                         prefix, strna(s->user),
 598                         prefix, strna(s->group));
 599
 600         if (s->keep_alive_time > 0)
 601                 fprintf(f,
 602                         "%sKeepAliveTimeSec: %s\n",
 603                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_time, USEC_PER_SEC));
 604
 605         if (s->keep_alive_interval)
 606                 fprintf(f,
 607                         "%sKeepAliveIntervalSec: %s\n",
 608                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->keep_alive_interval, USEC_PER_SEC));
 609
 610         if (s->keep_alive_cnt)
 611                 fprintf(f,
 612                         "%sKeepAliveProbes: %u\n",
 613                         prefix, s->keep_alive_cnt);
 614
 615         if (s->defer_accept)
 616                 fprintf(f,
 617                         "%sDeferAcceptSec: %s\n",
 618                         prefix, format_timespan(time_string, FORMAT_TIMESPAN_MAX, s->defer_accept, USEC_PER_SEC));
 619
 620         LIST_FOREACH(port, p, s->ports) {
 621
 622                 if (p->type == SOCKET_SOCKET) {
 623                         const char *t;
 624                         int r;
 625                         char *k = NULL;
 626
 627                         if ((r = socket_address_print(&p->address, &k)) < 0)
 628                                 t = strerror(-r);
 629                         else
 630                                 t = k;
 631
 632                         fprintf(f, "%s%s: %s\n", prefix, listen_lookup(socket_address_family(&p->address), p->address.type), t);
 633                         free(k);
 634                 } else if (p->type == SOCKET_SPECIAL)
 635                         fprintf(f, "%sListenSpecial: %s\n", prefix, p->path);
 636                 else if (p->type == SOCKET_MQUEUE)
 637                         fprintf(f, "%sListenMessageQueue: %s\n", prefix, p->path);
 638                 else
 639                         fprintf(f, "%sListenFIFO: %s\n", prefix, p->path);
 640         }
 641
 642         exec_context_dump(&s->exec_context, f, prefix);
 643         kill_context_dump(&s->kill_context, f, prefix);
 644
 645         for (c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
 646                 if (!s->exec_command[c])
 647                         continue;
 648
 649                 fprintf(f, "%s-> %s:\n",
 650                         prefix, socket_exec_command_to_string(c));
 651
 652                 exec_command_dump_list(s->exec_command[c], f, prefix2);
 653         }
 654 }
 655
 656 static int instance_from_socket(int fd, unsigned nr, char **instance) {
 657         socklen_t l;
 658         char *r;
 659         union sockaddr_union local, remote;
 660
 661         assert(fd >= 0);
 662         assert(instance);
 663
 664         l = sizeof(local);
 665         if (getsockname(fd, &local.sa, &l) < 0)
 666                 return -errno;
 667
 668         l = sizeof(remote);
 669         if (getpeername(fd, &remote.sa, &l) < 0)
 670                 return -errno;
 671
 672         switch (local.sa.sa_family) {
 673
 674         case AF_INET: {
 675                 uint32_t
 676                         a = ntohl(local.in.sin_addr.s_addr),
 677                         b = ntohl(remote.in.sin_addr.s_addr);
 678
 679                 if (asprintf(&r,
 680                              "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 681                              nr,
 682                              a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
 683                              ntohs(local.in.sin_port),
 684                              b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
 685                              ntohs(remote.in.sin_port)) < 0)
 686                         return -ENOMEM;
 687
 688                 break;
 689         }
 690
 691         case AF_INET6: {
 692                 static const unsigned char ipv4_prefix[] = {
 693                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
 694                 };
 695
 696                 if (memcmp(&local.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0 &&
 697                     memcmp(&remote.in6.sin6_addr, ipv4_prefix, sizeof(ipv4_prefix)) == 0) {
 698                         const uint8_t
 699                                 *a = local.in6.sin6_addr.s6_addr+12,
 700                                 *b = remote.in6.sin6_addr.s6_addr+12;
 701
 702                         if (asprintf(&r,
 703                                      "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
 704                                      nr,
 705                                      a[0], a[1], a[2], a[3],
 706                                      ntohs(local.in6.sin6_port),
 707                                      b[0], b[1], b[2], b[3],
 708                                      ntohs(remote.in6.sin6_port)) < 0)
 709                                 return -ENOMEM;
 710                 } else {
 711                         char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
 712
 713                         if (asprintf(&r,
 714                                      "%u-%s:%u-%s:%u",
 715                                      nr,
 716                                      inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
 717                                      ntohs(local.in6.sin6_port),
 718                                      inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
 719                                      ntohs(remote.in6.sin6_port)) < 0)
 720                                 return -ENOMEM;
 721                 }
 722
 723                 break;
 724         }
 725
 726         case AF_UNIX: {
 727                 struct ucred ucred;
 728                 int k;
 729
 730                 k = getpeercred(fd, &ucred);
 731                 if (k >= 0) {
 732                         if (asprintf(&r,
 733                                      "%u-"PID_FMT"-"UID_FMT,
 734                                      nr, ucred.pid, ucred.uid) < 0)
 735                                 return -ENOMEM;
 736                 } else if (k == -ENODATA) {
 737                         /* This handles the case where somebody is
 738                          * connecting from another pid/uid namespace
 739                          * (e.g. from outside of our container). */
 740                         if (asprintf(&r,
 741                                      "%u-unknown",
 742                                      nr) < 0)
 743                                 return -ENOMEM;
 744                 } else
 745                         return k;
 746
 747                 break;
 748         }
 749
 750         default:
 751                 assert_not_reached("Unhandled socket type.");
 752         }
 753
 754         *instance = r;
 755         return 0;
 756 }
 757
 758 static void socket_close_fds(Socket *s) {
 759         SocketPort *p;
 760         char **i;
 761
 762         assert(s);
 763
 764         LIST_FOREACH(port, p, s->ports) {
 765
 766                 p->event_source = sd_event_source_unref(p->event_source);
 767
 768                 if (p->fd < 0)
 769                         continue;
 770
 771                 p->fd = safe_close(p->fd);
 772
 773                 /* One little note: we should normally not delete any
 774                  * sockets in the file system here! After all some
 775                  * other process we spawned might still have a
 776                  * reference of this fd and wants to continue to use
 777                  * it. Therefore we delete sockets in the file system
 778                  * before we create a new one, not after we stopped
 779                  * using one! */
 780
 781                 if (s->remove_on_stop) {
 782                         switch (p->type) {
 783
 784                         case SOCKET_FIFO:
 785                                 unlink(p->path);
 786                                 break;
 787
 788                         case SOCKET_MQUEUE:
 789                                 mq_unlink(p->path);
 790                                 break;
 791
 792                         case SOCKET_SOCKET:
 793                                 socket_address_unlink(&p->address);
 794                                 break;
 795
 796                         default:
 797                                 break;
 798                         }
 799                 }
 800         }
 801
 802         if (s->remove_on_stop)
 803                 STRV_FOREACH(i, s->symlinks)
 804                         unlink(*i);
 805 }
 806
 807 static void socket_apply_socket_options(Socket *s, int fd) {
 808         assert(s);
 809         assert(fd >= 0);
 810
 811         if (s->keep_alive) {
 812                 int b = s->keep_alive;
 813                 if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &b, sizeof(b)) < 0)
 814                         log_warning_unit(UNIT(s)->id, "SO_KEEPALIVE failed: %m");
 815         }
 816
 817         if (s->keep_alive_time) {
 818                 int value = s->keep_alive_time / USEC_PER_SEC;
 819                 if (setsockopt(fd, SOL_TCP, TCP_KEEPIDLE, &value, sizeof(value)) < 0)
 820                         log_warning_unit(UNIT(s)->id, "TCP_KEEPIDLE failed: %m");
 821         }
 822
 823         if (s->keep_alive_interval) {
 824                 int value =  s->keep_alive_interval / USEC_PER_SEC;
 825                 if (setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &value, sizeof(value)) < 0)
 826                         log_warning_unit(UNIT(s)->id, "TCP_KEEPINTVL failed: %m");
 827         }
 828
 829         if (s->keep_alive_cnt) {
 830                 int value = s->keep_alive_cnt;
 831                 if (setsockopt(fd, SOL_SOCKET, TCP_KEEPCNT, &value, sizeof(value)) < 0)
 832                         log_warning_unit(UNIT(s)->id, "TCP_KEEPCNT failed: %m");
 833         }
 834
 835         if (s->defer_accept) {
 836                 int value = s->defer_accept / USEC_PER_SEC;
 837                 if (setsockopt(fd, SOL_TCP, TCP_DEFER_ACCEPT, &value, sizeof(value)) < 0)
 838                         log_warning_unit(UNIT(s)->id, "TCP_DEFER_ACCEPT failed: %m");
 839         }
 840
 841         if (s->no_delay) {
 842                 int b = s->no_delay;
 843                 if (setsockopt(fd, SOL_TCP, TCP_NODELAY, &b, sizeof(b)) < 0)
 844                         log_warning_unit(UNIT(s)->id, "TCP_NODELAY failed: %m");
 845         }
 846
 847         if (s->broadcast) {
 848                 int one = 1;
 849                 if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &one, sizeof(one)) < 0)
 850                         log_warning_unit(UNIT(s)->id, "SO_BROADCAST failed: %m");
 851         }
 852
 853         if (s->pass_cred) {
 854                 int one = 1;
 855                 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
 856                         log_warning_unit(UNIT(s)->id, "SO_PASSCRED failed: %m");
 857         }
 858
 859         if (s->pass_sec) {
 860                 int one = 1;
 861                 if (setsockopt(fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)) < 0)
 862                         log_warning_unit(UNIT(s)->id, "SO_PASSSEC failed: %m");
 863         }
 864
 865         if (s->priority >= 0)
 866                 if (setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &s->priority, sizeof(s->priority)) < 0)
 867                         log_warning_unit(UNIT(s)->id, "SO_PRIORITY failed: %m");
 868
 869         if (s->receive_buffer > 0) {
 870                 int value = (int) s->receive_buffer;
 871
 872                 /* We first try with SO_RCVBUFFORCE, in case we have the perms for that */
 873
 874                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &value, sizeof(value)) < 0)
 875                         if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &value, sizeof(value)) < 0)
 876                                 log_warning_unit(UNIT(s)->id, "SO_RCVBUF failed: %m");
 877         }
 878
 879         if (s->send_buffer > 0) {
 880                 int value = (int) s->send_buffer;
 881                 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUFFORCE, &value, sizeof(value)) < 0)
 882                         if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &value, sizeof(value)) < 0)
 883                                 log_warning_unit(UNIT(s)->id, "SO_SNDBUF failed: %m");
 884         }
 885
 886         if (s->mark >= 0)
 887                 if (setsockopt(fd, SOL_SOCKET, SO_MARK, &s->mark, sizeof(s->mark)) < 0)
 888                         log_warning_unit(UNIT(s)->id, "SO_MARK failed: %m");
 889
 890         if (s->ip_tos >= 0)
 891                 if (setsockopt(fd, IPPROTO_IP, IP_TOS, &s->ip_tos, sizeof(s->ip_tos)) < 0)
 892                         log_warning_unit(UNIT(s)->id, "IP_TOS failed: %m");
 893
 894         if (s->ip_ttl >= 0) {
 895                 int r, x;
 896
 897                 r = setsockopt(fd, IPPROTO_IP, IP_TTL, &s->ip_ttl, sizeof(s->ip_ttl));
 898
 899                 if (socket_ipv6_is_supported())
 900                         x = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &s->ip_ttl, sizeof(s->ip_ttl));
 901                 else {
 902                         x = -1;
 903                         errno = EAFNOSUPPORT;
 904                 }
 905
 906                 if (r < 0 && x < 0)
 907                         log_warning_unit(UNIT(s)->id,
 908                                          "IP_TTL/IPV6_UNICAST_HOPS failed: %m");
 909         }
 910
 911         if (s->tcp_congestion)
 912                 if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
 913                         log_warning_unit(UNIT(s)->id, "TCP_CONGESTION failed: %m");
 914
 915         if (s->reuse_port) {
 916                 int b = s->reuse_port;
 917                 if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &b, sizeof(b)) < 0)
 918                         log_warning_unit(UNIT(s)->id, "SO_REUSEPORT failed: %m");
 919         }
 920
 921         if (s->smack_ip_in)
 922                 if (smack_label_ip_in_fd(fd, s->smack_ip_in) < 0)
 923                         log_error_unit(UNIT(s)->id, "smack_label_ip_in_fd: %m");
 924
 925         if (s->smack_ip_out)
 926                 if (smack_label_ip_out_fd(fd, s->smack_ip_out) < 0)
 927                         log_error_unit(UNIT(s)->id, "smack_label_ip_out_fd: %m");
 928 }
 929
 930 static void socket_apply_fifo_options(Socket *s, int fd) {
 931         assert(s);
 932         assert(fd >= 0);
 933
 934         if (s->pipe_size > 0)
 935                 if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
 936                         log_warning_unit(UNIT(s)->id,
 937                                          "F_SETPIPE_SZ: %m");
 938
 939         if (s->smack)
 940                 if (smack_label_fd(fd, s->smack) < 0)
 941                         log_error_unit(UNIT(s)->id, "smack_label_fd: %m");
 942 }
 943
 944 static int fifo_address_create(
 945                 const char *path,
 946                 mode_t directory_mode,
 947                 mode_t socket_mode,
 948                 int *_fd) {
 949
 950         int fd = -1, r = 0;
 951         struct stat st;
 952         mode_t old_mask;
 953
 954         assert(path);
 955         assert(_fd);
 956
 957         mkdir_parents_label(path, directory_mode);
 958
 959         r = label_context_set(path, S_IFIFO);
 960         if (r < 0)
 961                 goto fail;
 962
 963         /* Enforce the right access mode for the fifo */
 964         old_mask = umask(~ socket_mode);
 965
 966         /* Include the original umask in our mask */
 967         umask(~socket_mode | old_mask);
 968
 969         r = mkfifo(path, socket_mode);
 970         umask(old_mask);
 971
 972         if (r < 0 && errno != EEXIST) {
 973                 r = -errno;
 974                 goto fail;
 975         }
 976
 977         if ((fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
 978                 r = -errno;
 979                 goto fail;
 980         }
 981
 982         label_context_clear();
 983
 984         if (fstat(fd, &st) < 0) {
 985                 r = -errno;
 986                 goto fail;
 987         }
 988
 989         if (!S_ISFIFO(st.st_mode) ||
 990             (st.st_mode & 0777) != (socket_mode & ~old_mask) ||
 991             st.st_uid != getuid() ||
 992             st.st_gid != getgid()) {
 993
 994                 r = -EEXIST;
 995                 goto fail;
 996         }
 997
 998         *_fd = fd;
 999         return 0;
1000
1001 fail:
1002         label_context_clear();
1003         safe_close(fd);
1004
1005         return r;
1006 }
1007
1008 static int special_address_create(
1009                 const char *path,
1010                 int *_fd) {
1011
1012         int fd = -1, r = 0;
1013         struct stat st;
1014
1015         assert(path);
1016         assert(_fd);
1017
1018         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW);
1019         if (fd < 0) {
1020                 r = -errno;
1021                 goto fail;
1022         }
1023
1024         if (fstat(fd, &st) < 0) {
1025                 r = -errno;
1026                 goto fail;
1027         }
1028
1029         /* Check whether this is a /proc, /sys or /dev file or char device */
1030         if (!S_ISREG(st.st_mode) && !S_ISCHR(st.st_mode)) {
1031                 r = -EEXIST;
1032                 goto fail;
1033         }
1034
1035         *_fd = fd;
1036         return 0;
1037
1038 fail:
1039         safe_close(fd);
1040
1041         return r;
1042 }
1043
1044 static int mq_address_create(
1045                 const char *path,
1046                 mode_t mq_mode,
1047                 long maxmsg,
1048                 long msgsize,
1049                 int *_fd) {
1050
1051         int fd = -1, r = 0;
1052         struct stat st;
1053         mode_t old_mask;
1054         struct mq_attr _attr, *attr = NULL;
1055
1056         assert(path);
1057         assert(_fd);
1058
1059         if (maxmsg > 0 && msgsize > 0) {
1060                 zero(_attr);
1061                 _attr.mq_flags = O_NONBLOCK;
1062                 _attr.mq_maxmsg = maxmsg;
1063                 _attr.mq_msgsize = msgsize;
1064                 attr = &_attr;
1065         }
1066
1067         /* Enforce the right access mode for the mq */
1068         old_mask = umask(~ mq_mode);
1069
1070         /* Include the original umask in our mask */
1071         umask(~mq_mode | old_mask);
1072         fd = mq_open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_CREAT, mq_mode, attr);
1073         umask(old_mask);
1074
1075         if (fd < 0) {
1076                 r = -errno;
1077                 goto fail;
1078         }
1079
1080         if (fstat(fd, &st) < 0) {
1081                 r = -errno;
1082                 goto fail;
1083         }
1084
1085         if ((st.st_mode & 0777) != (mq_mode & ~old_mask) ||
1086             st.st_uid != getuid() ||
1087             st.st_gid != getgid()) {
1088
1089                 r = -EEXIST;
1090                 goto fail;
1091         }
1092
1093         *_fd = fd;
1094         return 0;
1095
1096 fail:
1097         safe_close(fd);
1098         return r;
1099 }
1100
1101 static int socket_symlink(Socket *s) {
1102         const char *p;
1103         char **i;
1104
1105         assert(s);
1106
1107         p = socket_find_symlink_target(s);
1108         if (!p)
1109                 return 0;
1110
1111         STRV_FOREACH(i, s->symlinks)
1112                 symlink(p, *i);
1113
1114         return 0;
1115 }
1116
1117 static int socket_open_fds(Socket *s) {
1118         SocketPort *p;
1119         int r;
1120         char *label = NULL;
1121         bool know_label = false;
1122
1123         assert(s);
1124
1125         LIST_FOREACH(port, p, s->ports) {
1126
1127                 if (p->fd >= 0)
1128                         continue;
1129
1130                 if (p->type == SOCKET_SOCKET) {
1131
1132                         if (!know_label) {
1133
1134                                 r = socket_instantiate_service(s);
1135                                 if (r < 0)
1136                                         return r;
1137
1138                                 if (UNIT_ISSET(s->service) &&
1139                                     SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]) {
1140                                         r = label_get_create_label_from_exe(SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]->path, &label);
1141                                         if (r < 0 && r != -EPERM)
1142                                                 return r;
1143                                 }
1144
1145                                 know_label = true;
1146                         }
1147
1148                         r = socket_address_listen(
1149                                         &p->address,
1150                                         SOCK_CLOEXEC|SOCK_NONBLOCK,
1151                                         s->backlog,
1152                                         s->bind_ipv6_only,
1153                                         s->bind_to_device,
1154                                         s->free_bind,
1155                                         s->transparent,
1156                                         s->directory_mode,
1157                                         s->socket_mode,
1158                                         label);
1159                         if (r < 0)
1160                                 goto rollback;
1161
1162                         p->fd = r;
1163                         socket_apply_socket_options(s, p->fd);
1164                         socket_symlink(s);
1165
1166                 } else  if (p->type == SOCKET_SPECIAL) {
1167
1168                         r = special_address_create(
1169                                         p->path,
1170                                         &p->fd);
1171                         if (r < 0)
1172                                 goto rollback;
1173
1174                 } else  if (p->type == SOCKET_FIFO) {
1175
1176                         r = fifo_address_create(
1177                                         p->path,
1178                                         s->directory_mode,
1179                                         s->socket_mode,
1180                                         &p->fd);
1181                         if (r < 0)
1182                                 goto rollback;
1183
1184                         socket_apply_fifo_options(s, p->fd);
1185                         socket_symlink(s);
1186
1187                 } else if (p->type == SOCKET_MQUEUE) {
1188
1189                         r = mq_address_create(
1190                                         p->path,
1191                                         s->socket_mode,
1192                                         s->mq_maxmsg,
1193                                         s->mq_msgsize,
1194                                         &p->fd);
1195                         if (r < 0)
1196                                 goto rollback;
1197                 } else
1198                         assert_not_reached("Unknown port type");
1199         }
1200
1201         label_free(label);
1202         return 0;
1203
1204 rollback:
1205         socket_close_fds(s);
1206         label_free(label);
1207         return r;
1208 }
1209
1210 static void socket_unwatch_fds(Socket *s) {
1211         SocketPort *p;
1212         int r;
1213
1214         assert(s);
1215
1216         LIST_FOREACH(port, p, s->ports) {
1217                 if (p->fd < 0)
1218                         continue;
1219
1220                 if (!p->event_source)
1221                         continue;
1222
1223                 r = sd_event_source_set_enabled(p->event_source, SD_EVENT_OFF);
1224                 if (r < 0)
1225                         log_debug_unit(UNIT(s)->id, "Failed to disable event source.");
1226         }
1227 }
1228
1229 static int socket_watch_fds(Socket *s) {
1230         SocketPort *p;
1231         int r;
1232
1233         assert(s);
1234
1235         LIST_FOREACH(port, p, s->ports) {
1236                 if (p->fd < 0)
1237                         continue;
1238
1239                 if (p->event_source)
1240                         r = sd_event_source_set_enabled(p->event_source, SD_EVENT_ON);
1241                 else
1242                         r = sd_event_add_io(UNIT(s)->manager->event, &p->event_source, p->fd, EPOLLIN, socket_dispatch_io, p);
1243
1244                 if (r < 0) {
1245                         log_warning_unit(UNIT(s)->id, "Failed to watch listening fds: %s", strerror(-r));
1246                         goto fail;
1247                 }
1248         }
1249
1250         return 0;
1251
1252 fail:
1253         socket_unwatch_fds(s);
1254         return r;
1255 }
1256
1257 static void socket_set_state(Socket *s, SocketState state) {
1258         SocketState old_state;
1259         assert(s);
1260
1261         old_state = s->state;
1262         s->state = state;
1263
1264         if (!IN_SET(state,
1265                     SOCKET_START_PRE,
1266                     SOCKET_START_CHOWN,
1267                     SOCKET_START_POST,
1268                     SOCKET_STOP_PRE,
1269                     SOCKET_STOP_PRE_SIGTERM,
1270                     SOCKET_STOP_PRE_SIGKILL,
1271                     SOCKET_STOP_POST,
1272                     SOCKET_FINAL_SIGTERM,
1273                     SOCKET_FINAL_SIGKILL)) {
1274
1275                 s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1276                 socket_unwatch_control_pid(s);
1277                 s->control_command = NULL;
1278                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
1279         }
1280
1281         if (state != SOCKET_LISTENING)
1282                 socket_unwatch_fds(s);
1283
1284         if (!IN_SET(state,
1285                     SOCKET_START_CHOWN,
1286                     SOCKET_START_POST,
1287                     SOCKET_LISTENING,
1288                     SOCKET_RUNNING,
1289                     SOCKET_STOP_PRE,
1290                     SOCKET_STOP_PRE_SIGTERM,
1291                     SOCKET_STOP_PRE_SIGKILL))
1292                 socket_close_fds(s);
1293
1294         if (state != old_state)
1295                 log_debug_unit(UNIT(s)->id, "%s changed %s -> %s",
1296                                UNIT(s)->id, socket_state_to_string(old_state), socket_state_to_string(state));
1297
1298         unit_notify(UNIT(s), state_translation_table[old_state], state_translation_table[state], true);
1299 }
1300
1301 static int socket_coldplug(Unit *u) {
1302         Socket *s = SOCKET(u);
1303         int r;
1304
1305         assert(s);
1306         assert(s->state == SOCKET_DEAD);
1307
1308         if (s->deserialized_state == s->state)
1309                 return 0;
1310
1311         if (IN_SET(s->deserialized_state,
1312                    SOCKET_START_PRE,
1313                    SOCKET_START_CHOWN,
1314                    SOCKET_START_POST,
1315                    SOCKET_STOP_PRE,
1316                    SOCKET_STOP_PRE_SIGTERM,
1317                    SOCKET_STOP_PRE_SIGKILL,
1318                    SOCKET_STOP_POST,
1319                    SOCKET_FINAL_SIGTERM,
1320                    SOCKET_FINAL_SIGKILL)) {
1321
1322                 if (s->control_pid <= 0)
1323                         return -EBADMSG;
1324
1325                 r = unit_watch_pid(UNIT(s), s->control_pid);
1326                 if (r < 0)
1327                         return r;
1328
1329                 r = socket_arm_timer(s);
1330                 if (r < 0)
1331                         return r;
1332         }
1333
1334         if (IN_SET(s->deserialized_state,
1335                    SOCKET_START_CHOWN,
1336                    SOCKET_START_POST,
1337                    SOCKET_LISTENING,
1338                    SOCKET_RUNNING,
1339                    SOCKET_STOP_PRE,
1340                    SOCKET_STOP_PRE_SIGTERM,
1341                    SOCKET_STOP_PRE_SIGKILL)) {
1342                 r = socket_open_fds(s);
1343                 if (r < 0)
1344                         return r;
1345         }
1346
1347         if (s->deserialized_state == SOCKET_LISTENING) {
1348                 r = socket_watch_fds(s);
1349                 if (r < 0)
1350                         return r;
1351         }
1352
1353         socket_set_state(s, s->deserialized_state);
1354         return 0;
1355 }
1356
1357 static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
1358         _cleanup_free_ char **argv = NULL;
1359         pid_t pid;
1360         int r;
1361         ExecParameters exec_params = {
1362                 .apply_permissions = true,
1363                 .apply_chroot      = true,
1364                 .apply_tty_stdin   = true,
1365         };
1366
1367         assert(s);
1368         assert(c);
1369         assert(_pid);
1370
1371         unit_realize_cgroup(UNIT(s));
1372
1373         r = unit_setup_exec_runtime(UNIT(s));
1374         if (r < 0)
1375                 goto fail;
1376
1377         r = socket_arm_timer(s);
1378         if (r < 0)
1379                 goto fail;
1380
1381         r = unit_full_printf_strv(UNIT(s), c->argv, &argv);
1382         if (r < 0)
1383                 goto fail;
1384
1385         exec_params.argv = argv;
1386         exec_params.environment = UNIT(s)->manager->environment;
1387         exec_params.confirm_spawn = UNIT(s)->manager->confirm_spawn;
1388         exec_params.cgroup_supported = UNIT(s)->manager->cgroup_supported;
1389         exec_params.cgroup_path = UNIT(s)->cgroup_path;
1390         exec_params.runtime_prefix = manager_get_runtime_prefix(UNIT(s)->manager);
1391         exec_params.unit_id = UNIT(s)->id;
1392
1393         r = exec_spawn(c,
1394                        &s->exec_context,
1395                        &exec_params,
1396                        s->exec_runtime,
1397                        &pid);
1398         if (r < 0)
1399                 goto fail;
1400
1401         r = unit_watch_pid(UNIT(s), pid);
1402         if (r < 0)
1403                 /* FIXME: we need to do something here */
1404                 goto fail;
1405
1406         *_pid = pid;
1407         return 0;
1408
1409 fail:
1410         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1411         return r;
1412 }
1413
1414 static int socket_chown(Socket *s, pid_t *_pid) {
1415         pid_t pid;
1416         int r;
1417
1418         r = socket_arm_timer(s);
1419         if (r < 0)
1420                 goto fail;
1421
1422         /* We have to resolve the user names out-of-process, hence
1423          * let's fork here. It's messy, but well, what can we do? */
1424
1425         pid = fork();
1426         if (pid < 0)
1427                 return -errno;
1428
1429         if (pid == 0) {
1430                 SocketPort *p;
1431                 uid_t uid = (uid_t) -1;
1432                 gid_t gid = (gid_t) -1;
1433                 int ret;
1434
1435                 default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
1436                 ignore_signals(SIGPIPE, -1);
1437                 log_forget_fds();
1438
1439                 if (!isempty(s->user)) {
1440                         const char *user = s->user;
1441
1442                         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
1443                         if (r < 0) {
1444                                 ret = EXIT_USER;
1445                                 goto fail_child;
1446                         }
1447                 }
1448
1449                 if (!isempty(s->group)) {
1450                         const char *group = s->group;
1451
1452                         r = get_group_creds(&group, &gid);
1453                         if (r < 0) {
1454                                 ret = EXIT_GROUP;
1455                                 goto fail_child;
1456                         }
1457                 }
1458
1459                 LIST_FOREACH(port, p, s->ports) {
1460                         const char *path = NULL;
1461
1462                         if (p->type == SOCKET_SOCKET)
1463                                 path = socket_address_get_path(&p->address);
1464                         else if (p->type == SOCKET_FIFO)
1465                                 path = p->path;
1466
1467                         if (!path)
1468                                 continue;
1469
1470                         if (chown(path, uid, gid) < 0) {
1471                                 r = -errno;
1472                                 ret = EXIT_CHOWN;
1473                                 goto fail_child;
1474                         }
1475                 }
1476
1477                 _exit(0);
1478
1479         fail_child:
1480                 log_open();
1481                 log_error("Failed to chown socket at step %s: %s", exit_status_to_string(ret, EXIT_STATUS_SYSTEMD), strerror(-r));
1482
1483                 _exit(ret);
1484         }
1485
1486         r = unit_watch_pid(UNIT(s), pid);
1487         if (r < 0)
1488                 goto fail;
1489
1490         *_pid = pid;
1491         return 0;
1492
1493 fail:
1494         s->timer_event_source = sd_event_source_unref(s->timer_event_source);
1495         return r;
1496 }
1497
1498 static void socket_enter_dead(Socket *s, SocketResult f) {
1499         assert(s);
1500
1501         if (f != SOCKET_SUCCESS)
1502                 s->result = f;
1503
1504         exec_runtime_destroy(s->exec_runtime);
1505         s->exec_runtime = exec_runtime_unref(s->exec_runtime);
1506
1507         exec_context_destroy_runtime_directory(&s->exec_context, manager_get_runtime_prefix(UNIT(s)->manager));
1508
1509         socket_set_state(s, s->result != SOCKET_SUCCESS ? SOCKET_FAILED : SOCKET_DEAD);
1510 }
1511
1512 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f);
1513
1514 static void socket_enter_stop_post(Socket *s, SocketResult f) {
1515         int r;
1516         assert(s);
1517
1518         if (f != SOCKET_SUCCESS)
1519                 s->result = f;
1520
1521         socket_unwatch_control_pid(s);
1522         s->control_command_id = SOCKET_EXEC_STOP_POST;
1523         s->control_command = s->exec_command[SOCKET_EXEC_STOP_POST];
1524
1525         if (s->control_command) {
1526                 r = socket_spawn(s, s->control_command, &s->control_pid);
1527                 if (r < 0)
1528                         goto fail;
1529
1530                 socket_set_state(s, SOCKET_STOP_POST);
1531         } else
1532                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_SUCCESS);
1533
1534         return;
1535
1536 fail:
1537         log_warning_unit(UNIT(s)->id,
1538                          "%s failed to run 'stop-post' task: %s",
1539                          UNIT(s)->id, strerror(-r));
1540         socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1541 }
1542
1543 static void socket_enter_signal(Socket *s, SocketState state, SocketResult f) {
1544         int r;
1545
1546         assert(s);
1547
1548         if (f != SOCKET_SUCCESS)
1549                 s->result = f;
1550
1551         r = unit_kill_context(
1552                         UNIT(s),
1553                         &s->kill_context,
1554                         state != SOCKET_STOP_PRE_SIGTERM && state != SOCKET_FINAL_SIGTERM,
1555                         -1,
1556                         s->control_pid,
1557                         false);
1558         if (r < 0)
1559                 goto fail;
1560
1561         if (r > 0) {
1562                 r = socket_arm_timer(s);
1563                 if (r < 0)
1564                         goto fail;
1565
1566                 socket_set_state(s, state);
1567         } else if (state == SOCKET_STOP_PRE_SIGTERM)
1568                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_SUCCESS);
1569         else if (state == SOCKET_STOP_PRE_SIGKILL)
1570                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1571         else if (state == SOCKET_FINAL_SIGTERM)
1572                 socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_SUCCESS);
1573         else
1574                 socket_enter_dead(s, SOCKET_SUCCESS);
1575
1576         return;
1577
1578 fail:
1579         log_warning_unit(UNIT(s)->id, "%s failed to kill processes: %s", UNIT(s)->id, strerror(-r));
1580
1581         if (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_STOP_PRE_SIGKILL)
1582                 socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1583         else
1584                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1585 }
1586
1587 static void socket_enter_stop_pre(Socket *s, SocketResult f) {
1588         int r;
1589         assert(s);
1590
1591         if (f != SOCKET_SUCCESS)
1592                 s->result = f;
1593
1594         socket_unwatch_control_pid(s);
1595         s->control_command_id = SOCKET_EXEC_STOP_PRE;
1596         s->control_command = s->exec_command[SOCKET_EXEC_STOP_PRE];
1597
1598         if (s->control_command) {
1599                 r = socket_spawn(s, s->control_command, &s->control_pid);
1600                 if (r < 0)
1601                         goto fail;
1602
1603                 socket_set_state(s, SOCKET_STOP_PRE);
1604         } else
1605                 socket_enter_stop_post(s, SOCKET_SUCCESS);
1606
1607         return;
1608
1609 fail:
1610         log_warning_unit(UNIT(s)->id, "%s failed to run 'stop-pre' task: %s", UNIT(s)->id, strerror(-r));
1611         socket_enter_stop_post(s, SOCKET_FAILURE_RESOURCES);
1612 }
1613
1614 static void socket_enter_listening(Socket *s) {
1615         int r;
1616         assert(s);
1617
1618         r = socket_watch_fds(s);
1619         if (r < 0) {
1620                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1621                 goto fail;
1622         }
1623
1624         socket_set_state(s, SOCKET_LISTENING);
1625         return;
1626
1627 fail:
1628         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1629 }
1630
1631 static void socket_enter_start_post(Socket *s) {
1632         int r;
1633         assert(s);
1634
1635         socket_unwatch_control_pid(s);
1636         s->control_command_id = SOCKET_EXEC_START_POST;
1637         s->control_command = s->exec_command[SOCKET_EXEC_START_POST];
1638
1639         if (s->control_command) {
1640                 r = socket_spawn(s, s->control_command, &s->control_pid);
1641                 if (r < 0) {
1642                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-post' task: %s", UNIT(s)->id, strerror(-r));
1643                         goto fail;
1644                 }
1645
1646                 socket_set_state(s, SOCKET_START_POST);
1647         } else
1648                 socket_enter_listening(s);
1649
1650         return;
1651
1652 fail:
1653         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1654 }
1655
1656 static void socket_enter_start_chown(Socket *s) {
1657         int r;
1658
1659         assert(s);
1660
1661         r = socket_open_fds(s);
1662         if (r < 0) {
1663                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1664                 goto fail;
1665         }
1666
1667         if (!isempty(s->user) || !isempty(s->group)) {
1668
1669                 socket_unwatch_control_pid(s);
1670                 s->control_command_id = SOCKET_EXEC_START_CHOWN;
1671                 s->control_command = NULL;
1672
1673                 r = socket_chown(s, &s->control_pid);
1674                 if (r < 0) {
1675                         log_warning_unit(UNIT(s)->id, "%s failed to fork 'start-chown' task: %s", UNIT(s)->id, strerror(-r));
1676                         goto fail;
1677                 }
1678
1679                 socket_set_state(s, SOCKET_START_CHOWN);
1680         } else
1681                 socket_enter_start_post(s);
1682
1683         return;
1684
1685 fail:
1686         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1687 }
1688
1689 static void socket_enter_start_pre(Socket *s) {
1690         int r;
1691         assert(s);
1692
1693         socket_unwatch_control_pid(s);
1694         s->control_command_id = SOCKET_EXEC_START_PRE;
1695         s->control_command = s->exec_command[SOCKET_EXEC_START_PRE];
1696
1697         if (s->control_command) {
1698                 r = socket_spawn(s, s->control_command, &s->control_pid);
1699                 if (r < 0) {
1700                         log_warning_unit(UNIT(s)->id, "%s failed to run 'start-pre' task: %s", UNIT(s)->id, strerror(-r));
1701                         goto fail;
1702                 }
1703
1704                 socket_set_state(s, SOCKET_START_PRE);
1705         } else
1706                 socket_enter_start_chown(s);
1707
1708         return;
1709
1710 fail:
1711         socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1712 }
1713
1714 static void socket_enter_running(Socket *s, int cfd) {
1715         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1716         int r;
1717
1718         assert(s);
1719
1720         /* We don't take connections anymore if we are supposed to
1721          * shut down anyway */
1722         if (unit_stop_pending(UNIT(s))) {
1723
1724                 log_debug_unit(UNIT(s)->id, "Suppressing connection request on %s since unit stop is scheduled.", UNIT(s)->id);
1725
1726                 if (cfd >= 0)
1727                         safe_close(cfd);
1728                 else  {
1729                         /* Flush all sockets by closing and reopening them */
1730                         socket_close_fds(s);
1731
1732                         r = socket_open_fds(s);
1733                         if (r < 0) {
1734                                 log_warning_unit(UNIT(s)->id, "%s failed to listen on sockets: %s", UNIT(s)->id, strerror(-r));
1735                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1736                                 return;
1737                         }
1738
1739                         r = socket_watch_fds(s);
1740                         if (r < 0) {
1741                                 log_warning_unit(UNIT(s)->id, "%s failed to watch sockets: %s", UNIT(s)->id, strerror(-r));
1742                                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1743                         }
1744                 }
1745
1746                 return;
1747         }
1748
1749         if (cfd < 0) {
1750                 Iterator i;
1751                 Unit *other;
1752                 bool pending = false;
1753
1754                 /* If there's already a start pending don't bother to
1755                  * do anything */
1756                 SET_FOREACH(other, UNIT(s)->dependencies[UNIT_TRIGGERS], i)
1757                         if (unit_active_or_pending(other)) {
1758                                 pending = true;
1759                                 break;
1760                         }
1761
1762                 if (!pending) {
1763                         if (!UNIT_ISSET(s->service)) {
1764                                 log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
1765                                 r = -ENOENT;
1766                                 goto fail;
1767                         }
1768
1769                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
1770                         if (r < 0)
1771                                 goto fail;
1772                 }
1773
1774                 socket_set_state(s, SOCKET_RUNNING);
1775         } else {
1776                 _cleanup_free_ char *prefix = NULL, *instance = NULL, *name = NULL;
1777                 Service *service;
1778
1779                 if (s->n_connections >= s->max_connections) {
1780                         log_warning_unit(UNIT(s)->id, "%s: Too many incoming connections (%u)", UNIT(s)->id, s->n_connections);
1781                         safe_close(cfd);
1782                         return;
1783                 }
1784
1785                 r = socket_instantiate_service(s);
1786                 if (r < 0)
1787                         goto fail;
1788
1789                 r = instance_from_socket(cfd, s->n_accepted, &instance);
1790                 if (r < 0) {
1791                         if (r != -ENOTCONN)
1792                                 goto fail;
1793
1794                         /* ENOTCONN is legitimate if TCP RST was received.
1795                          * This connection is over, but the socket unit lives on. */
1796                         safe_close(cfd);
1797                         return;
1798                 }
1799
1800                 prefix = unit_name_to_prefix(UNIT(s)->id);
1801                 if (!prefix) {
1802                         r = -ENOMEM;
1803                         goto fail;
1804                 }
1805
1806                 name = unit_name_build(prefix, instance, ".service");
1807                 if (!name) {
1808                         r = -ENOMEM;
1809                         goto fail;
1810                 }
1811
1812                 r = unit_add_name(UNIT_DEREF(s->service), name);
1813                 if (r < 0)
1814                         goto fail;
1815
1816                 service = SERVICE(UNIT_DEREF(s->service));
1817                 unit_ref_unset(&s->service);
1818                 s->n_accepted ++;
1819
1820                 UNIT(service)->no_gc = false;
1821
1822                 unit_choose_id(UNIT(service), name);
1823
1824                 r = service_set_socket_fd(service, cfd, s);
1825                 if (r < 0)
1826                         goto fail;
1827
1828                 cfd = -1;
1829                 s->n_connections ++;
1830
1831                 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, true, &error, NULL);
1832                 if (r < 0)
1833                         goto fail;
1834
1835                 /* Notify clients about changed counters */
1836                 unit_add_to_dbus_queue(UNIT(s));
1837         }
1838
1839         return;
1840
1841 fail:
1842         log_warning_unit(UNIT(s)->id, "%s failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",
1843                          UNIT(s)->id, cfd >= 0 ? "template" : "non-template",
1844                          bus_error_message(&error, r));
1845
1846         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1847         safe_close(cfd);
1848 }
1849
1850 static void socket_run_next(Socket *s) {
1851         int r;
1852
1853         assert(s);
1854         assert(s->control_command);
1855         assert(s->control_command->command_next);
1856
1857         socket_unwatch_control_pid(s);
1858
1859         s->control_command = s->control_command->command_next;
1860
1861         r = socket_spawn(s, s->control_command, &s->control_pid);
1862         if (r < 0)
1863                 goto fail;
1864
1865         return;
1866
1867 fail:
1868         log_warning_unit(UNIT(s)->id, "%s failed to run next task: %s", UNIT(s)->id, strerror(-r));
1869
1870         if (s->state == SOCKET_START_POST)
1871                 socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);
1872         else if (s->state == SOCKET_STOP_POST)
1873                 socket_enter_dead(s, SOCKET_FAILURE_RESOURCES);
1874         else
1875                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_RESOURCES);
1876 }
1877
1878 static int socket_start(Unit *u) {
1879         Socket *s = SOCKET(u);
1880
1881         assert(s);
1882
1883         /* We cannot fulfill this request right now, try again later
1884          * please! */
1885         if (IN_SET(s->state,
1886                    SOCKET_STOP_PRE,
1887                    SOCKET_STOP_PRE_SIGKILL,
1888                    SOCKET_STOP_PRE_SIGTERM,
1889                    SOCKET_STOP_POST,
1890                    SOCKET_FINAL_SIGTERM,
1891                    SOCKET_FINAL_SIGKILL))
1892                 return -EAGAIN;
1893
1894         /* Already on it! */
1895         if (IN_SET(s->state,
1896                    SOCKET_START_PRE,
1897                    SOCKET_START_CHOWN,
1898                    SOCKET_START_POST))
1899                 return 0;
1900
1901         /* Cannot run this without the service being around */
1902         if (UNIT_ISSET(s->service)) {
1903                 Service *service;
1904
1905                 service = SERVICE(UNIT_DEREF(s->service));
1906
1907                 if (UNIT(service)->load_state != UNIT_LOADED) {
1908                         log_error_unit(u->id, "Socket service %s not loaded, refusing.", UNIT(service)->id);
1909                         return -ENOENT;
1910                 }
1911
1912                 /* If the service is already active we cannot start the
1913                  * socket */
1914                 if (service->state != SERVICE_DEAD &&
1915                     service->state != SERVICE_FAILED &&
1916                     service->state != SERVICE_AUTO_RESTART) {
1917                         log_error_unit(u->id, "Socket service %s already active, refusing.", UNIT(service)->id);
1918                         return -EBUSY;
1919                 }
1920         }
1921
1922         assert(s->state == SOCKET_DEAD || s->state == SOCKET_FAILED);
1923
1924         s->result = SOCKET_SUCCESS;
1925         socket_enter_start_pre(s);
1926
1927         return 0;
1928 }
1929
1930 static int socket_stop(Unit *u) {
1931         Socket *s = SOCKET(u);
1932
1933         assert(s);
1934
1935         /* Already on it */
1936         if (IN_SET(s->state,
1937                    SOCKET_STOP_PRE,
1938                    SOCKET_STOP_PRE_SIGTERM,
1939                    SOCKET_STOP_PRE_SIGKILL,
1940                    SOCKET_STOP_POST,
1941                    SOCKET_FINAL_SIGTERM,
1942                    SOCKET_FINAL_SIGKILL))
1943                 return 0;
1944
1945         /* If there's already something running we go directly into
1946          * kill mode. */
1947         if (IN_SET(s->state,
1948                    SOCKET_START_PRE,
1949                    SOCKET_START_CHOWN,
1950                    SOCKET_START_POST)) {
1951                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_SUCCESS);
1952                 return -EAGAIN;
1953         }
1954
1955         assert(s->state == SOCKET_LISTENING || s->state == SOCKET_RUNNING);
1956
1957         socket_enter_stop_pre(s, SOCKET_SUCCESS);
1958         return 0;
1959 }
1960
1961 static int socket_serialize(Unit *u, FILE *f, FDSet *fds) {
1962         Socket *s = SOCKET(u);
1963         SocketPort *p;
1964         int r;
1965
1966         assert(u);
1967         assert(f);
1968         assert(fds);
1969
1970         unit_serialize_item(u, f, "state", socket_state_to_string(s->state));
1971         unit_serialize_item(u, f, "result", socket_result_to_string(s->result));
1972         unit_serialize_item_format(u, f, "n-accepted", "%u", s->n_accepted);
1973
1974         if (s->control_pid > 0)
1975                 unit_serialize_item_format(u, f, "control-pid", PID_FMT, s->control_pid);
1976
1977         if (s->control_command_id >= 0)
1978                 unit_serialize_item(u, f, "control-command", socket_exec_command_to_string(s->control_command_id));
1979
1980         LIST_FOREACH(port, p, s->ports) {
1981                 int copy;
1982
1983                 if (p->fd < 0)
1984                         continue;
1985
1986                 copy = fdset_put_dup(fds, p->fd);
1987                 if (copy < 0)
1988                         return copy;
1989
1990                 if (p->type == SOCKET_SOCKET) {
1991                         _cleanup_free_ char *t = NULL;
1992
1993                         r = socket_address_print(&p->address, &t);
1994                         if (r < 0)
1995                                 return r;
1996
1997                         if (socket_address_family(&p->address) == AF_NETLINK)
1998                                 unit_serialize_item_format(u, f, "netlink", "%i %s", copy, t);
1999                         else
2000                                 unit_serialize_item_format(u, f, "socket", "%i %i %s", copy, p->address.type, t);
2001
2002                 } else if (p->type == SOCKET_SPECIAL)
2003                         unit_serialize_item_format(u, f, "special", "%i %s", copy, p->path);
2004                 else if (p->type == SOCKET_MQUEUE)
2005                         unit_serialize_item_format(u, f, "mqueue", "%i %s", copy, p->path);
2006                 else {
2007                         assert(p->type == SOCKET_FIFO);
2008                         unit_serialize_item_format(u, f, "fifo", "%i %s", copy, p->path);
2009                 }
2010         }
2011
2012         return 0;
2013 }
2014
2015 static int socket_deserialize_item(Unit *u, const char *key, const char *value, FDSet *fds) {
2016         Socket *s = SOCKET(u);
2017
2018         assert(u);
2019         assert(key);
2020         assert(value);
2021
2022         if (streq(key, "state")) {
2023                 SocketState state;
2024
2025                 state = socket_state_from_string(value);
2026                 if (state < 0)
2027                         log_debug_unit(u->id, "Failed to parse state value %s", value);
2028                 else
2029                         s->deserialized_state = state;
2030         } else if (streq(key, "result")) {
2031                 SocketResult f;
2032
2033                 f = socket_result_from_string(value);
2034                 if (f < 0)
2035                         log_debug_unit(u->id, "Failed to parse result value %s", value);
2036                 else if (f != SOCKET_SUCCESS)
2037                         s->result = f;
2038
2039         } else if (streq(key, "n-accepted")) {
2040                 unsigned k;
2041
2042                 if (safe_atou(value, &k) < 0)
2043                         log_debug_unit(u->id, "Failed to parse n-accepted value %s", value);
2044                 else
2045                         s->n_accepted += k;
2046         } else if (streq(key, "control-pid")) {
2047                 pid_t pid;
2048
2049                 if (parse_pid(value, &pid) < 0)
2050                         log_debug_unit(u->id, "Failed to parse control-pid value %s", value);
2051                 else
2052                         s->control_pid = pid;
2053         } else if (streq(key, "control-command")) {
2054                 SocketExecCommand id;
2055
2056                 id = socket_exec_command_from_string(value);
2057                 if (id < 0)
2058                         log_debug_unit(u->id, "Failed to parse exec-command value %s", value);
2059                 else {
2060                         s->control_command_id = id;
2061                         s->control_command = s->exec_command[id];
2062                 }
2063         } else if (streq(key, "fifo")) {
2064                 int fd, skip = 0;
2065                 SocketPort *p;
2066
2067                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2068                         log_debug_unit(u->id, "Failed to parse fifo value %s", value);
2069                 else {
2070
2071                         LIST_FOREACH(port, p, s->ports)
2072                                 if (p->type == SOCKET_FIFO &&
2073                                     streq_ptr(p->path, value+skip))
2074                                         break;
2075
2076                         if (p) {
2077                                 safe_close(p->fd);
2078                                 p->fd = fdset_remove(fds, fd);
2079                         }
2080                 }
2081
2082         } else if (streq(key, "special")) {
2083                 int fd, skip = 0;
2084                 SocketPort *p;
2085
2086                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2087                         log_debug_unit(u->id, "Failed to parse special value %s", value);
2088                 else {
2089
2090                         LIST_FOREACH(port, p, s->ports)
2091                                 if (p->type == SOCKET_SPECIAL &&
2092                                     streq_ptr(p->path, value+skip))
2093                                         break;
2094
2095                         if (p) {
2096                                 safe_close(p->fd);
2097                                 p->fd = fdset_remove(fds, fd);
2098                         }
2099                 }
2100
2101         } else if (streq(key, "mqueue")) {
2102                 int fd, skip = 0;
2103                 SocketPort *p;
2104
2105                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2106                         log_debug_unit(u->id, "Failed to parse mqueue value %s", value);
2107                 else {
2108
2109                         LIST_FOREACH(port, p, s->ports)
2110                                 if (p->type == SOCKET_MQUEUE &&
2111                                     streq_ptr(p->path, value+skip))
2112                                         break;
2113
2114                         if (p) {
2115                                 safe_close(p->fd);
2116                                 p->fd = fdset_remove(fds, fd);
2117                         }
2118                 }
2119
2120         } else if (streq(key, "socket")) {
2121                 int fd, type, skip = 0;
2122                 SocketPort *p;
2123
2124                 if (sscanf(value, "%i %i %n", &fd, &type, &skip) < 2 || fd < 0 || type < 0 || !fdset_contains(fds, fd))
2125                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2126                 else {
2127
2128                         LIST_FOREACH(port, p, s->ports)
2129                                 if (socket_address_is(&p->address, value+skip, type))
2130                                         break;
2131
2132                         if (p) {
2133                                 safe_close(p->fd);
2134                                 p->fd = fdset_remove(fds, fd);
2135                         }
2136                 }
2137
2138         } else if (streq(key, "netlink")) {
2139                 int fd, skip = 0;
2140                 SocketPort *p;
2141
2142                 if (sscanf(value, "%i %n", &fd, &skip) < 1 || fd < 0 || !fdset_contains(fds, fd))
2143                         log_debug_unit(u->id, "Failed to parse socket value %s", value);
2144                 else {
2145
2146                         LIST_FOREACH(port, p, s->ports)
2147                                 if (socket_address_is_netlink(&p->address, value+skip))
2148                                         break;
2149
2150                         if (p) {
2151                                 safe_close(p->fd);
2152                                 p->fd = fdset_remove(fds, fd);
2153                         }
2154                 }
2155         } else
2156                 log_debug_unit(UNIT(s)->id, "Unknown serialization key '%s'", key);
2157
2158         return 0;
2159 }
2160
2161 static int socket_distribute_fds(Unit *u, FDSet *fds) {
2162         Socket *s = SOCKET(u);
2163         SocketPort *p;
2164
2165         assert(u);
2166
2167         LIST_FOREACH(port, p, s->ports) {
2168                 Iterator i;
2169                 int fd;
2170
2171                 if (p->type != SOCKET_SOCKET)
2172                         continue;
2173
2174                 if (p->fd >= 0)
2175                         continue;
2176
2177                 FDSET_FOREACH(fd, fds, i) {
2178                         if (socket_address_matches_fd(&p->address, fd)) {
2179                                 p->fd = fdset_remove(fds, fd);
2180                                 s->deserialized_state = SOCKET_LISTENING;
2181                                 break;
2182                         }
2183                 }
2184         }
2185
2186         return 0;
2187 }
2188
2189 _pure_ static UnitActiveState socket_active_state(Unit *u) {
2190         assert(u);
2191
2192         return state_translation_table[SOCKET(u)->state];
2193 }
2194
2195 _pure_ static const char *socket_sub_state_to_string(Unit *u) {
2196         assert(u);
2197
2198         return socket_state_to_string(SOCKET(u)->state);
2199 }
2200
2201 const char* socket_port_type_to_string(SocketPort *p) {
2202
2203         assert(p);
2204
2205         switch (p->type) {
2206
2207         case SOCKET_SOCKET:
2208
2209                 switch (p->address.type) {
2210
2211                 case SOCK_STREAM:
2212                         return "Stream";
2213
2214                 case SOCK_DGRAM:
2215                         return "Datagram";
2216
2217                 case SOCK_SEQPACKET:
2218                         return "SequentialPacket";
2219
2220                 case SOCK_RAW:
2221                         if (socket_address_family(&p->address) == AF_NETLINK)
2222                                 return "Netlink";
2223
2224                 default:
2225                         return NULL;
2226                 }
2227
2228         case SOCKET_SPECIAL:
2229                 return "Special";
2230
2231         case SOCKET_MQUEUE:
2232                 return "MessageQueue";
2233
2234         case SOCKET_FIFO:
2235                 return "FIFO";
2236
2237         default:
2238                 return NULL;
2239         }
2240 }
2241
2242 _pure_ static bool socket_check_gc(Unit *u) {
2243         Socket *s = SOCKET(u);
2244
2245         assert(u);
2246
2247         return s->n_connections > 0;
2248 }
2249
2250 static int socket_dispatch_io(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
2251         SocketPort *p = userdata;
2252         int cfd = -1;
2253
2254         assert(p);
2255         assert(fd >= 0);
2256
2257         if (p->socket->state != SOCKET_LISTENING)
2258                 return 0;
2259
2260         log_debug_unit(UNIT(p->socket)->id, "Incoming traffic on %s", UNIT(p->socket)->id);
2261
2262         if (revents != EPOLLIN) {
2263
2264                 if (revents & EPOLLHUP)
2265                         log_error_unit(UNIT(p->socket)->id, "%s: Got POLLHUP on a listening socket. The service probably invoked shutdown() on it, and should better not do that.",
2266                                        UNIT(p->socket)->id);
2267                 else
2268                         log_error_unit(UNIT(p->socket)->id, "%s: Got unexpected poll event (0x%x) on socket.",
2269                                        UNIT(p->socket)->id, revents);
2270
2271                 goto fail;
2272         }
2273
2274         if (p->socket->accept &&
2275             p->type == SOCKET_SOCKET &&
2276             socket_address_can_accept(&p->address)) {
2277
2278                 for (;;) {
2279
2280                         cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
2281                         if (cfd < 0) {
2282
2283                                 if (errno == EINTR)
2284                                         continue;
2285
2286                                 log_error_unit(UNIT(p->socket)->id,
2287                                                "Failed to accept socket: %m");
2288                                 goto fail;
2289                         }
2290
2291                         break;
2292                 }
2293
2294                 socket_apply_socket_options(p->socket, cfd);
2295         }
2296
2297         socket_enter_running(p->socket, cfd);
2298         return 0;
2299
2300 fail:
2301         socket_enter_stop_pre(p->socket, SOCKET_FAILURE_RESOURCES);
2302         return 0;
2303 }
2304
2305 static void socket_sigchld_event(Unit *u, pid_t pid, int code, int status) {
2306         Socket *s = SOCKET(u);
2307         SocketResult f;
2308
2309         assert(s);
2310         assert(pid >= 0);
2311
2312         if (pid != s->control_pid)
2313                 return;
2314
2315         s->control_pid = 0;
2316
2317         if (is_clean_exit(code, status, NULL))
2318                 f = SOCKET_SUCCESS;
2319         else if (code == CLD_EXITED)
2320                 f = SOCKET_FAILURE_EXIT_CODE;
2321         else if (code == CLD_KILLED)
2322                 f = SOCKET_FAILURE_SIGNAL;
2323         else if (code == CLD_DUMPED)
2324                 f = SOCKET_FAILURE_CORE_DUMP;
2325         else
2326                 assert_not_reached("Unknown sigchld code");
2327
2328         if (s->control_command) {
2329                 exec_status_exit(&s->control_command->exec_status, &s->exec_context, pid, code, status);
2330
2331                 if (s->control_command->ignore)
2332                         f = SOCKET_SUCCESS;
2333         }
2334
2335         log_full_unit(f == SOCKET_SUCCESS ? LOG_DEBUG : LOG_NOTICE,
2336                       u->id,
2337                       "%s control process exited, code=%s status=%i",
2338                       u->id, sigchld_code_to_string(code), status);
2339
2340         if (f != SOCKET_SUCCESS)
2341                 s->result = f;
2342
2343         if (s->control_command &&
2344             s->control_command->command_next &&
2345             f == SOCKET_SUCCESS) {
2346
2347                 log_debug_unit(u->id,
2348                                "%s running next command for state %s",
2349                                u->id, socket_state_to_string(s->state));
2350                 socket_run_next(s);
2351         } else {
2352                 s->control_command = NULL;
2353                 s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
2354
2355                 /* No further commands for this step, so let's figure
2356                  * out what to do next */
2357
2358                 log_debug_unit(u->id,
2359                                "%s got final SIGCHLD for state %s",
2360                                u->id, socket_state_to_string(s->state));
2361
2362                 switch (s->state) {
2363
2364                 case SOCKET_START_PRE:
2365                         if (f == SOCKET_SUCCESS)
2366                                 socket_enter_start_chown(s);
2367                         else
2368                                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, f);
2369                         break;
2370
2371                 case SOCKET_START_CHOWN:
2372                         if (f == SOCKET_SUCCESS)
2373                                 socket_enter_start_post(s);
2374                         else
2375                                 socket_enter_stop_pre(s, f);
2376                         break;
2377
2378                 case SOCKET_START_POST:
2379                         if (f == SOCKET_SUCCESS)
2380                                 socket_enter_listening(s);
2381                         else
2382                                 socket_enter_stop_pre(s, f);
2383                         break;
2384
2385                 case SOCKET_STOP_PRE:
2386                 case SOCKET_STOP_PRE_SIGTERM:
2387                 case SOCKET_STOP_PRE_SIGKILL:
2388                         socket_enter_stop_post(s, f);
2389                         break;
2390
2391                 case SOCKET_STOP_POST:
2392                 case SOCKET_FINAL_SIGTERM:
2393                 case SOCKET_FINAL_SIGKILL:
2394                         socket_enter_dead(s, f);
2395                         break;
2396
2397                 default:
2398                         assert_not_reached("Uh, control process died at wrong time.");
2399                 }
2400         }
2401
2402         /* Notify clients about changed exit status */
2403         unit_add_to_dbus_queue(u);
2404 }
2405
2406 static int socket_dispatch_timer(sd_event_source *source, usec_t usec, void *userdata) {
2407         Socket *s = SOCKET(userdata);
2408
2409         assert(s);
2410         assert(s->timer_event_source == source);
2411
2412         switch (s->state) {
2413
2414         case SOCKET_START_PRE:
2415                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Terminating.", UNIT(s)->id);
2416                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2417                 break;
2418
2419         case SOCKET_START_CHOWN:
2420         case SOCKET_START_POST:
2421                 log_warning_unit(UNIT(s)->id, "%s starting timed out. Stopping.", UNIT(s)->id);
2422                 socket_enter_stop_pre(s, SOCKET_FAILURE_TIMEOUT);
2423                 break;
2424
2425         case SOCKET_STOP_PRE:
2426                 log_warning_unit(UNIT(s)->id, "%s stopping timed out. Terminating.", UNIT(s)->id);
2427                 socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2428                 break;
2429
2430         case SOCKET_STOP_PRE_SIGTERM:
2431                 if (s->kill_context.send_sigkill) {
2432                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Killing.", UNIT(s)->id);
2433                         socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2434                 } else {
2435                         log_warning_unit(UNIT(s)->id, "%s stopping timed out. Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2436                         socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2437                 }
2438                 break;
2439
2440         case SOCKET_STOP_PRE_SIGKILL:
2441                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL. Ignoring.", UNIT(s)->id);
2442                 socket_enter_stop_post(s, SOCKET_FAILURE_TIMEOUT);
2443                 break;
2444
2445         case SOCKET_STOP_POST:
2446                 log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Terminating.", UNIT(s)->id);
2447                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, SOCKET_FAILURE_TIMEOUT);
2448                 break;
2449
2450         case SOCKET_FINAL_SIGTERM:
2451                 if (s->kill_context.send_sigkill) {
2452                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Killing.", UNIT(s)->id);
2453                         socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
2454                 } else {
2455                         log_warning_unit(UNIT(s)->id, "%s stopping timed out (2). Skipping SIGKILL. Ignoring.", UNIT(s)->id);
2456                         socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2457                 }
2458                 break;
2459
2460         case SOCKET_FINAL_SIGKILL:
2461                 log_warning_unit(UNIT(s)->id, "%s still around after SIGKILL (2). Entering failed mode.", UNIT(s)->id);
2462                 socket_enter_dead(s, SOCKET_FAILURE_TIMEOUT);
2463                 break;
2464
2465         default:
2466                 assert_not_reached("Timeout at wrong time.");
2467         }
2468
2469         return 0;
2470 }
2471
2472 int socket_collect_fds(Socket *s, int **fds, unsigned *n_fds) {
2473         int *rfds;
2474         unsigned rn_fds, k;
2475         SocketPort *p;
2476
2477         assert(s);
2478         assert(fds);
2479         assert(n_fds);
2480
2481         /* Called from the service code for requesting our fds */
2482
2483         rn_fds = 0;
2484         LIST_FOREACH(port, p, s->ports)
2485                 if (p->fd >= 0)
2486                         rn_fds++;
2487
2488         if (rn_fds <= 0) {
2489                 *fds = NULL;
2490                 *n_fds = 0;
2491                 return 0;
2492         }
2493
2494         if (!(rfds = new(int, rn_fds)))
2495                 return -ENOMEM;
2496
2497         k = 0;
2498         LIST_FOREACH(port, p, s->ports)
2499                 if (p->fd >= 0)
2500                         rfds[k++] = p->fd;
2501
2502         assert(k == rn_fds);
2503
2504         *fds = rfds;
2505         *n_fds = rn_fds;
2506
2507         return 0;
2508 }
2509
2510 static void socket_reset_failed(Unit *u) {
2511         Socket *s = SOCKET(u);
2512
2513         assert(s);
2514
2515         if (s->state == SOCKET_FAILED)
2516                 socket_set_state(s, SOCKET_DEAD);
2517
2518         s->result = SOCKET_SUCCESS;
2519 }
2520
2521 static void socket_notify_service_dead(Socket *s, bool failed_permanent) {
2522         assert(s);
2523
2524         /* The service is dead. Dang!
2525          *
2526          * This is strictly for one-instance-for-all-connections
2527          * services. */
2528
2529         if (s->state == SOCKET_RUNNING) {
2530                 log_debug_unit(UNIT(s)->id, "%s got notified about service death (failed permanently: %s)", UNIT(s)->id, yes_no(failed_permanent));
2531                 if (failed_permanent)
2532                         socket_enter_stop_pre(s, SOCKET_FAILURE_SERVICE_FAILED_PERMANENT);
2533                 else
2534                         socket_enter_listening(s);
2535         }
2536 }
2537
2538 void socket_connection_unref(Socket *s) {
2539         assert(s);
2540
2541         /* The service is dead. Yay!
2542          *
2543          * This is strictly for one-instance-per-connection
2544          * services. */
2545
2546         assert(s->n_connections > 0);
2547         s->n_connections--;
2548
2549         log_debug_unit(UNIT(s)->id, "%s: One connection closed, %u left.", UNIT(s)->id, s->n_connections);
2550 }
2551
2552 static void socket_trigger_notify(Unit *u, Unit *other) {
2553         Socket *s = SOCKET(u);
2554         Service *se;
2555
2556         assert(u);
2557         assert(other);
2558
2559         /* Don't propagate state changes from the service if we are
2560            already down or accepting connections */
2561         if ((s->state !=  SOCKET_RUNNING &&
2562             s->state != SOCKET_LISTENING) ||
2563             s->accept)
2564                 return;
2565
2566         if (other->load_state != UNIT_LOADED ||
2567             other->type != UNIT_SERVICE)
2568                 return;
2569
2570         se = SERVICE(other);
2571
2572         if (se->state == SERVICE_FAILED)
2573                 socket_notify_service_dead(s, se->result == SERVICE_FAILURE_START_LIMIT);
2574
2575         if (se->state == SERVICE_DEAD ||
2576             se->state == SERVICE_STOP ||
2577             se->state == SERVICE_STOP_SIGTERM ||
2578             se->state == SERVICE_STOP_SIGKILL ||
2579             se->state == SERVICE_STOP_POST ||
2580             se->state == SERVICE_FINAL_SIGTERM ||
2581             se->state == SERVICE_FINAL_SIGKILL ||
2582             se->state == SERVICE_AUTO_RESTART)
2583                 socket_notify_service_dead(s, false);
2584
2585         if (se->state == SERVICE_RUNNING)
2586                 socket_set_state(s, SOCKET_RUNNING);
2587 }
2588
2589 static int socket_kill(Unit *u, KillWho who, int signo, sd_bus_error *error) {
2590         return unit_kill_common(u, who, signo, -1, SOCKET(u)->control_pid, error);
2591 }
2592
2593 static int socket_get_timeout(Unit *u, uint64_t *timeout) {
2594         Socket *s = SOCKET(u);
2595         int r;
2596
2597         if (!s->timer_event_source)
2598                 return 0;
2599
2600         r = sd_event_source_get_time(s->timer_event_source, timeout);
2601         if (r < 0)
2602                 return r;
2603
2604         return 1;
2605 }
2606
2607 static const char* const socket_state_table[_SOCKET_STATE_MAX] = {
2608         [SOCKET_DEAD] = "dead",
2609         [SOCKET_START_PRE] = "start-pre",
2610         [SOCKET_START_CHOWN] = "start-chown",
2611         [SOCKET_START_POST] = "start-post",
2612         [SOCKET_LISTENING] = "listening",
2613         [SOCKET_RUNNING] = "running",
2614         [SOCKET_STOP_PRE] = "stop-pre",
2615         [SOCKET_STOP_PRE_SIGTERM] = "stop-pre-sigterm",
2616         [SOCKET_STOP_PRE_SIGKILL] = "stop-pre-sigkill",
2617         [SOCKET_STOP_POST] = "stop-post",
2618         [SOCKET_FINAL_SIGTERM] = "final-sigterm",
2619         [SOCKET_FINAL_SIGKILL] = "final-sigkill",
2620         [SOCKET_FAILED] = "failed"
2621 };
2622
2623 DEFINE_STRING_TABLE_LOOKUP(socket_state, SocketState);
2624
2625 static const char* const socket_exec_command_table[_SOCKET_EXEC_COMMAND_MAX] = {
2626         [SOCKET_EXEC_START_PRE] = "StartPre",
2627         [SOCKET_EXEC_START_CHOWN] = "StartChown",
2628         [SOCKET_EXEC_START_POST] = "StartPost",
2629         [SOCKET_EXEC_STOP_PRE] = "StopPre",
2630         [SOCKET_EXEC_STOP_POST] = "StopPost"
2631 };
2632
2633 DEFINE_STRING_TABLE_LOOKUP(socket_exec_command, SocketExecCommand);
2634
2635 static const char* const socket_result_table[_SOCKET_RESULT_MAX] = {
2636         [SOCKET_SUCCESS] = "success",
2637         [SOCKET_FAILURE_RESOURCES] = "resources",
2638         [SOCKET_FAILURE_TIMEOUT] = "timeout",
2639         [SOCKET_FAILURE_EXIT_CODE] = "exit-code",
2640         [SOCKET_FAILURE_SIGNAL] = "signal",
2641         [SOCKET_FAILURE_CORE_DUMP] = "core-dump",
2642         [SOCKET_FAILURE_SERVICE_FAILED_PERMANENT] = "service-failed-permanent"
2643 };
2644
2645 DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
2646
2647 const UnitVTable socket_vtable = {
2648         .object_size = sizeof(Socket),
2649         .exec_context_offset = offsetof(Socket, exec_context),
2650         .cgroup_context_offset = offsetof(Socket, cgroup_context),
2651         .kill_context_offset = offsetof(Socket, kill_context),
2652         .exec_runtime_offset = offsetof(Socket, exec_runtime),
2653
2654         .sections =
2655                 "Unit\0"
2656                 "Socket\0"
2657                 "Install\0",
2658         .private_section = "Socket",
2659
2660         .init = socket_init,
2661         .done = socket_done,
2662         .load = socket_load,
2663
2664         .coldplug = socket_coldplug,
2665
2666         .dump = socket_dump,
2667
2668         .start = socket_start,
2669         .stop = socket_stop,
2670
2671         .kill = socket_kill,
2672
2673         .get_timeout = socket_get_timeout,
2674
2675         .serialize = socket_serialize,
2676         .deserialize_item = socket_deserialize_item,
2677         .distribute_fds = socket_distribute_fds,
2678
2679         .active_state = socket_active_state,
2680         .sub_state_to_string = socket_sub_state_to_string,
2681
2682         .check_gc = socket_check_gc,
2683
2684         .sigchld_event = socket_sigchld_event,
2685
2686         .trigger_notify = socket_trigger_notify,
2687
2688         .reset_failed = socket_reset_failed,
2689
2690         .bus_interface = "org.freedesktop.systemd1.Socket",
2691         .bus_vtable = bus_socket_vtable,
2692         .bus_set_property = bus_socket_set_property,
2693         .bus_commit_properties = bus_socket_commit_properties,
2694
2695         .status_message_formats = {
2696                 /*.starting_stopping = {
2697                         [0] = "Starting socket %s...",
2698                         [1] = "Stopping socket %s...",
2699                 },*/
2700                 .finished_start_job = {
2701                         [JOB_DONE]       = "Listening on %s.",
2702                         [JOB_FAILED]     = "Failed to listen on %s.",
2703                         [JOB_DEPENDENCY] = "Dependency failed for %s.",
2704                         [JOB_TIMEOUT]    = "Timed out starting %s.",
2705                 },
2706                 .finished_stop_job = {
2707                         [JOB_DONE]       = "Closed %s.",
2708                         [JOB_FAILED]     = "Failed stopping %s.",
2709                         [JOB_TIMEOUT]    = "Timed out stopping %s.",
2710                 },
2711         },
2712 };