freebsd-skq/lib/libc/sys/getsockopt.2

513 lines
15 KiB
Groff
Raw Normal View History

1994-05-27 05:00:24 +00:00
.\" Copyright (c) 1983, 1991, 1993
.\" The Regents of the University of California. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 4. Neither the name of the University nor the names of its contributors
.\" may be used to endorse or promote products derived from this software
.\" without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\" @(#)getsockopt.2 8.4 (Berkeley) 5/2/95
1999-08-28 00:22:10 +00:00
.\" $FreeBSD$
1994-05-27 05:00:24 +00:00
.\"
.Dd June 13, 2008
1994-05-27 05:00:24 +00:00
.Dt GETSOCKOPT 2
.Os
1994-05-27 05:00:24 +00:00
.Sh NAME
.Nm getsockopt ,
.Nm setsockopt
.Nd get and set options on sockets
.Sh LIBRARY
.Lb libc
1994-05-27 05:00:24 +00:00
.Sh SYNOPSIS
.In sys/types.h
.In sys/socket.h
1994-05-27 05:00:24 +00:00
.Ft int
.Fn getsockopt "int s" "int level" "int optname" "void * restrict optval" "socklen_t * restrict optlen"
1994-05-27 05:00:24 +00:00
.Ft int
.Fn setsockopt "int s" "int level" "int optname" "const void *optval" "socklen_t optlen"
1994-05-27 05:00:24 +00:00
.Sh DESCRIPTION
The
.Fn getsockopt
1994-05-27 05:00:24 +00:00
and
.Fn setsockopt
system calls
1994-05-27 05:00:24 +00:00
manipulate the
.Em options
associated with a socket.
Options may exist at multiple
1994-05-27 05:00:24 +00:00
protocol levels; they are always present at the uppermost
.Dq socket
level.
.Pp
When manipulating socket options the level at which the
option resides and the name of the option must be specified.
To manipulate options at the socket level,
.Fa level
is specified as
.Dv SOL_SOCKET .
To manipulate options at any
other level the protocol number of the appropriate protocol
controlling the option is supplied.
For example,
1994-05-27 05:00:24 +00:00
to indicate that an option is to be interpreted by the
.Tn TCP
protocol,
.Fa level
should be set to the protocol number of
.Tn TCP ;
see
.Xr getprotoent 3 .
.Pp
2002-12-19 09:40:28 +00:00
The
1994-05-27 05:00:24 +00:00
.Fa optval
and
.Fa optlen
2002-12-19 09:40:28 +00:00
arguments
1994-05-27 05:00:24 +00:00
are used to access option values for
.Fn setsockopt .
For
.Fn getsockopt
they identify a buffer in which the value for the
requested option(s) are to be returned.
For
1994-05-27 05:00:24 +00:00
.Fn getsockopt ,
.Fa optlen
2002-12-19 09:40:28 +00:00
is a value-result argument, initially containing the
1994-05-27 05:00:24 +00:00
size of the buffer pointed to by
.Fa optval ,
and modified on return to indicate the actual size of
the value returned.
If no option value is
1994-05-27 05:00:24 +00:00
to be supplied or returned,
.Fa optval
may be NULL.
.Pp
2002-12-19 09:40:28 +00:00
The
.Fa optname
argument
1994-05-27 05:00:24 +00:00
and any specified options are passed uninterpreted to the appropriate
protocol module for interpretation.
The include file
2003-09-10 19:24:35 +00:00
.In sys/socket.h
1994-05-27 05:00:24 +00:00
contains definitions for
socket level options, described below.
Options at other protocol levels vary in format and
name; consult the appropriate entries in
section
4 of the manual.
.Pp
Most socket-level options utilize an
2002-12-19 09:40:28 +00:00
.Vt int
argument for
1994-05-27 05:00:24 +00:00
.Fa optval .
For
.Fn setsockopt ,
2002-12-19 09:40:28 +00:00
the argument should be non-zero to enable a boolean option,
1994-05-27 05:00:24 +00:00
or zero if the option is to be disabled.
.Dv SO_LINGER
uses a
2002-12-19 09:40:28 +00:00
.Vt "struct linger"
argument, defined in
2003-09-10 19:24:35 +00:00
.In sys/socket.h ,
1994-05-27 05:00:24 +00:00
which specifies the desired state of the option and the
linger interval (see below).
.Dv SO_SNDTIMEO
and
.Dv SO_RCVTIMEO
use a
2002-12-19 09:40:28 +00:00
.Vt "struct timeval"
argument, defined in
2003-09-10 19:24:35 +00:00
.In sys/time.h .
1994-05-27 05:00:24 +00:00
.Pp
The following options are recognized at the socket level.
Except as noted, each may be examined with
.Fn getsockopt
and set with
.Fn setsockopt .
.Bl -column SO_ACCEPTFILTER -offset indent
1994-05-27 05:00:24 +00:00
.It Dv SO_DEBUG Ta "enables recording of debugging information"
.It Dv SO_REUSEADDR Ta "enables local address reuse"
.It Dv SO_REUSEPORT Ta "enables duplicate address and port bindings"
.It Dv SO_KEEPALIVE Ta "enables keep connections alive"
.It Dv SO_DONTROUTE Ta "enables routing bypass for outgoing messages"
.It Dv SO_LINGER Ta "linger on close if data present"
.It Dv SO_BROADCAST Ta "enables permission to transmit broadcast messages"
.It Dv SO_OOBINLINE Ta "enables reception of out-of-band data in band"
.It Dv SO_SNDBUF Ta "set buffer size for output"
.It Dv SO_RCVBUF Ta "set buffer size for input"
.It Dv SO_SNDLOWAT Ta "set minimum count for output"
.It Dv SO_RCVLOWAT Ta "set minimum count for input"
.It Dv SO_SNDTIMEO Ta "set timeout value for output"
.It Dv SO_RCVTIMEO Ta "set timeout value for input"
.It Dv SO_ACCEPTFILTER Ta "set accept filter on listening socket"
2006-09-17 21:27:35 +00:00
.It Dv SO_NOSIGPIPE Ta
controls generation of
.Dv SIGPIPE
for the socket
.It Dv SO_TIMESTAMP Ta "enables reception of a timestamp with datagrams"
.It Dv SO_BINTIME Ta "enables reception of a timestamp with datagrams"
.It Dv SO_ACCEPTCONN Ta "get listening status of the socket (get only)"
1994-05-27 05:00:24 +00:00
.It Dv SO_TYPE Ta "get the type of the socket (get only)"
.It Dv SO_ERROR Ta "get and clear error on the socket (get only)"
Add code to allow the system to handle multiple routing tables. This particular implementation is designed to be fully backwards compatible and to be MFC-able to 7.x (and 6.x) Currently the only protocol that can make use of the multiple tables is IPv4 Similar functionality exists in OpenBSD and Linux. From my notes: ----- One thing where FreeBSD has been falling behind, and which by chance I have some time to work on is "policy based routing", which allows different packet streams to be routed by more than just the destination address. Constraints: ------------ I want to make some form of this available in the 6.x tree (and by extension 7.x) , but FreeBSD in general needs it so I might as well do it in -current and back port the portions I need. One of the ways that this can be done is to have the ability to instantiate multiple kernel routing tables (which I will now refer to as "Forwarding Information Bases" or "FIBs" for political correctness reasons). Which FIB a particular packet uses to make the next hop decision can be decided by a number of mechanisms. The policies these mechanisms implement are the "Policies" referred to in "Policy based routing". One of the constraints I have if I try to back port this work to 6.x is that it must be implemented as a EXTENSION to the existing ABIs in 6.x so that third party applications do not need to be recompiled in timespan of the branch. This first version will not have some of the bells and whistles that will come with later versions. It will, for example, be limited to 16 tables in the first commit. Implementation method, Compatible version. (part 1) ------------------------------- For this reason I have implemented a "sufficient subset" of a multiple routing table solution in Perforce, and back-ported it to 6.x. (also in Perforce though not always caught up with what I have done in -current/P4). The subset allows a number of FIBs to be defined at compile time (8 is sufficient for my purposes in 6.x) and implements the changes needed to allow IPV4 to use them. I have not done the changes for ipv6 simply because I do not need it, and I do not have enough knowledge of ipv6 (e.g. neighbor discovery) needed to do it. Other protocol families are left untouched and should there be users with proprietary protocol families, they should continue to work and be oblivious to the existence of the extra FIBs. To understand how this is done, one must know that the current FIB code starts everything off with a single dimensional array of pointers to FIB head structures (One per protocol family), each of which in turn points to the trie of routes available to that family. The basic change in the ABI compatible version of the change is to extent that array to be a 2 dimensional array, so that instead of protocol family X looking at rt_tables[X] for the table it needs, it looks at rt_tables[Y][X] when for all protocol families except ipv4 Y is always 0. Code that is unaware of the change always just sees the first row of the table, which of course looks just like the one dimensional array that existed before. The entry points rtrequest(), rtalloc(), rtalloc1(), rtalloc_ign() are all maintained, but refer only to the first row of the array, so that existing callers in proprietary protocols can continue to do the "right thing". Some new entry points are added, for the exclusive use of ipv4 code called in_rtrequest(), in_rtalloc(), in_rtalloc1() and in_rtalloc_ign(), which have an extra argument which refers the code to the correct row. In addition, there are some new entry points (currently called rtalloc_fib() and friends) that check the Address family being looked up and call either rtalloc() (and friends) if the protocol is not IPv4 forcing the action to row 0 or to the appropriate row if it IS IPv4 (and that info is available). These are for calling from code that is not specific to any particular protocol. The way these are implemented would change in the non ABI preserving code to be added later. One feature of the first version of the code is that for ipv4, the interface routes show up automatically on all the FIBs, so that no matter what FIB you select you always have the basic direct attached hosts available to you. (rtinit() does this automatically). You CAN delete an interface route from one FIB should you want to but by default it's there. ARP information is also available in each FIB. It's assumed that the same machine would have the same MAC address, regardless of which FIB you are using to get to it. This brings us as to how the correct FIB is selected for an outgoing IPV4 packet. Firstly, all packets have a FIB associated with them. if nothing has been done to change it, it will be FIB 0. The FIB is changed in the following ways. Packets fall into one of a number of classes. 1/ locally generated packets, coming from a socket/PCB. Such packets select a FIB from a number associated with the socket/PCB. This in turn is inherited from the process, but can be changed by a socket option. The process in turn inherits it on fork. I have written a utility call setfib that acts a bit like nice.. setfib -3 ping target.example.com # will use fib 3 for ping. It is an obvious extension to make it a property of a jail but I have not done so. It can be achieved by combining the setfib and jail commands. 2/ packets received on an interface for forwarding. By default these packets would use table 0, (or possibly a number settable in a sysctl(not yet)). but prior to routing the firewall can inspect them (see below). (possibly in the future you may be able to associate a FIB with packets received on an interface.. An ifconfig arg, but not yet.) 3/ packets inspected by a packet classifier, which can arbitrarily associate a fib with it on a packet by packet basis. A fib assigned to a packet by a packet classifier (such as ipfw) would over-ride a fib associated by a more default source. (such as cases 1 or 2). 4/ a tcp listen socket associated with a fib will generate accept sockets that are associated with that same fib. 5/ Packets generated in response to some other packet (e.g. reset or icmp packets). These should use the FIB associated with the packet being reponded to. 6/ Packets generated during encapsulation. gif, tun and other tunnel interfaces will encapsulate using the FIB that was in effect withthe proces that set up the tunnel. thus setfib 1 ifconfig gif0 [tunnel instructions] will set the fib for the tunnel to use to be fib 1. Routing messages would be associated with their process, and thus select one FIB or another. messages from the kernel would be associated with the fib they refer to and would only be received by a routing socket associated with that fib. (not yet implemented) In addition Netstat has been edited to be able to cope with the fact that the array is now 2 dimensional. (It looks in system memory using libkvm (!)). Old versions of netstat see only the first FIB. In addition two sysctls are added to give: a) the number of FIBs compiled in (active) b) the default FIB of the calling process. Early testing experience: ------------------------- Basically our (IronPort's) appliance does this functionality already using ipfw fwd but that method has some drawbacks. For example, It can't fully simulate a routing table because it can't influence the socket's choice of local address when a connect() is done. Testing during the generating of these changes has been remarkably smooth so far. Multiple tables have co-existed with no notable side effects, and packets have been routes accordingly. ipfw has grown 2 new keywords: setfib N ip from anay to any count ip from any to any fib N In pf there seems to be a requirement to be able to give symbolic names to the fibs but I do not have that capacity. I am not sure if it is required. SCTP has interestingly enough built in support for this, called VRFs in Cisco parlance. it will be interesting to see how that handles it when it suddenly actually does something. Where to next: -------------------- After committing the ABI compatible version and MFCing it, I'd like to proceed in a forward direction in -current. this will result in some roto-tilling in the routing code. Firstly: the current code's idea of having a separate tree per protocol family, all of the same format, and pointed to by the 1 dimensional array is a bit silly. Especially when one considers that there is code that makes assumptions about every protocol having the same internal structures there. Some protocols don't WANT that sort of structure. (for example the whole idea of a netmask is foreign to appletalk). This needs to be made opaque to the external code. My suggested first change is to add routing method pointers to the 'domain' structure, along with information pointing the data. instead of having an array of pointers to uniform structures, there would be an array pointing to the 'domain' structures for each protocol address domain (protocol family), and the methods this reached would be called. The methods would have an argument that gives FIB number, but the protocol would be free to ignore it. When the ABI can be changed it raises the possibilty of the addition of a fib entry into the "struct route". Currently, the structure contains the sockaddr of the desination, and the resulting fib entry. To make this work fully, one could add a fib number so that given an address and a fib, one can find the third element, the fib entry. Interaction with the ARP layer/ LL layer would need to be revisited as well. Qing Li has been working on this already. This work was sponsored by Ironport Systems/Cisco PR: Reviewed by: several including rwatson, bz and mlair (parts each) Approved by: Obtained from: Ironport systems/Cisco MFC after: Security: PR: Submitted by: Reviewed by: Approved by: Obtained from: MFC after: Security:
2008-05-09 23:00:21 +00:00
.It Dv SO_SETFIB Ta "set the associated FIB (routing table) for the socket (set only)"
1994-05-27 05:00:24 +00:00
.El
.Pp
The following options are recognized in
.Fx :
.Bl -column SO_LISTENINCQLEN -offset indent
.It Dv SO_LABEL Ta "get MAC label of the socket (get only)"
.It Dv SO_PEERLABEL Ta "get socket's peer's MAC label (get only)"
.It Dv SO_LISTENQLIMIT Ta "get backlog limit of the socket (get only)"
.It Dv SO_LISTENQLEN Ta "get complete queue length of the socket (get only)"
.It Dv SO_LISTENINCQLEN Ta "get incomplete queue length of the socket (get only)"
.El
.Pp
1994-05-27 05:00:24 +00:00
.Dv SO_DEBUG
enables debugging in the underlying protocol modules.
.Dv SO_REUSEADDR
indicates that the rules used in validating addresses supplied
in a
.Xr bind 2
system call should allow reuse of local addresses.
1994-05-27 05:00:24 +00:00
.Dv SO_REUSEPORT
allows completely duplicate bindings by multiple processes
if they all set
.Dv SO_REUSEPORT
before binding the port.
This option permits multiple instances of a program to each
receive UDP/IP multicast or broadcast datagrams destined for the bound port.
.Dv SO_KEEPALIVE
enables the
periodic transmission of messages on a connected socket.
Should the
1994-05-27 05:00:24 +00:00
connected party fail to respond to these messages, the connection is
considered broken and processes using the socket are notified via a
.Dv SIGPIPE
signal when attempting to send data.
.Dv SO_DONTROUTE
indicates that outgoing messages should
bypass the standard routing facilities.
Instead, messages are directed
1994-05-27 05:00:24 +00:00
to the appropriate network interface according to the network portion
of the destination address.
.Pp
.Dv SO_LINGER
controls the action taken when unsent messages
2001-07-15 07:53:42 +00:00
are queued on socket and a
1994-05-27 05:00:24 +00:00
.Xr close 2
is performed.
If the socket promises reliable delivery of data and
.Dv SO_LINGER
is set,
2001-07-15 07:53:42 +00:00
the system will block the process on the
.Xr close 2
1994-05-27 05:00:24 +00:00
attempt until it is able to transmit the data or until it decides it
is unable to deliver the information (a timeout period, termed the
linger interval, is specified in seconds in the
1994-05-27 05:00:24 +00:00
.Fn setsockopt
system call when
1994-05-27 05:00:24 +00:00
.Dv SO_LINGER
2001-07-15 07:53:42 +00:00
is requested).
1994-05-27 05:00:24 +00:00
If
.Dv SO_LINGER
2001-07-15 07:53:42 +00:00
is disabled and a
.Xr close 2
1994-05-27 05:00:24 +00:00
is issued, the system will process the close in a manner that allows
the process to continue as quickly as possible.
.Pp
The option
.Dv SO_BROADCAST
requests permission to send broadcast datagrams
on the socket.
Broadcast was a privileged operation in earlier versions of the system.
With protocols that support out-of-band data, the
.Dv SO_OOBINLINE
option
requests that out-of-band data be placed in the normal data input queue
as received; it will then be accessible with
.Xr recv 2
1994-05-27 05:00:24 +00:00
or
.Xr read 2
1994-05-27 05:00:24 +00:00
calls without the
.Dv MSG_OOB
flag.
Some protocols always behave as if this option is set.
.Dv SO_SNDBUF
and
.Dv SO_RCVBUF
are options to adjust the normal
buffer sizes allocated for output and input buffers, respectively.
The buffer size may be increased for high-volume connections,
or may be decreased to limit the possible backlog of incoming data.
The system places an absolute maximum on these values, which is accessible
through the
.Xr sysctl 3
MIB variable
.Dq Li kern.ipc.maxsockbuf .
1994-05-27 05:00:24 +00:00
.Pp
.Dv SO_SNDLOWAT
is an option to set the minimum count for output operations.
Most output operations process all of the data supplied
by the call, delivering data to the protocol for transmission
and blocking as necessary for flow control.
Nonblocking output operations will process as much data as permitted
subject to flow control without blocking, but will process no data
if flow control does not allow the smaller of the low water mark value
or the entire request to be processed.
A
.Xr select 2
operation testing the ability to write to a socket will return true
only if the low water mark amount could be processed.
The default value for
.Dv SO_SNDLOWAT
is set to a convenient size for network efficiency, often 1024.
.Dv SO_RCVLOWAT
is an option to set the minimum count for input operations.
In general, receive calls will block until any (non-zero) amount of data
is received, then return with the smaller of the amount available or the amount
requested.
The default value for
.Dv SO_RCVLOWAT
is 1.
2001-07-15 07:53:42 +00:00
If
1994-05-27 05:00:24 +00:00
.Dv SO_RCVLOWAT
is set to a larger value, blocking receive calls normally
wait until they have received the smaller of the low water mark value
or the requested amount.
Receive calls may still return less than the low water mark if an error
occurs, a signal is caught, or the type of data next in the receive queue
is different from that which was returned.
1994-05-27 05:00:24 +00:00
.Pp
.Dv SO_SNDTIMEO
is an option to set a timeout value for output operations.
It accepts a
2002-12-19 09:40:28 +00:00
.Vt "struct timeval"
argument with the number of seconds and microseconds
1994-05-27 05:00:24 +00:00
used to limit waits for output operations to complete.
If a send operation has blocked for this much time,
it returns with a partial count
or with the error
.Er EWOULDBLOCK
if no data were sent.
In the current implementation, this timer is restarted each time additional
data are delivered to the protocol,
implying that the limit applies to output portions ranging in size
from the low water mark to the high water mark for output.
.Dv SO_RCVTIMEO
is an option to set a timeout value for input operations.
It accepts a
2002-12-19 09:40:28 +00:00
.Vt "struct timeval"
argument with the number of seconds and microseconds
1994-05-27 05:00:24 +00:00
used to limit waits for input operations to complete.
In the current implementation, this timer is restarted each time additional
data are received by the protocol,
and thus the limit is in effect an inactivity timer.
If a receive operation has been blocked for this much time without
receiving additional data, it returns with a short count
or with the error
.Er EWOULDBLOCK
if no data were received.
.Pp
Add code to allow the system to handle multiple routing tables. This particular implementation is designed to be fully backwards compatible and to be MFC-able to 7.x (and 6.x) Currently the only protocol that can make use of the multiple tables is IPv4 Similar functionality exists in OpenBSD and Linux. From my notes: ----- One thing where FreeBSD has been falling behind, and which by chance I have some time to work on is "policy based routing", which allows different packet streams to be routed by more than just the destination address. Constraints: ------------ I want to make some form of this available in the 6.x tree (and by extension 7.x) , but FreeBSD in general needs it so I might as well do it in -current and back port the portions I need. One of the ways that this can be done is to have the ability to instantiate multiple kernel routing tables (which I will now refer to as "Forwarding Information Bases" or "FIBs" for political correctness reasons). Which FIB a particular packet uses to make the next hop decision can be decided by a number of mechanisms. The policies these mechanisms implement are the "Policies" referred to in "Policy based routing". One of the constraints I have if I try to back port this work to 6.x is that it must be implemented as a EXTENSION to the existing ABIs in 6.x so that third party applications do not need to be recompiled in timespan of the branch. This first version will not have some of the bells and whistles that will come with later versions. It will, for example, be limited to 16 tables in the first commit. Implementation method, Compatible version. (part 1) ------------------------------- For this reason I have implemented a "sufficient subset" of a multiple routing table solution in Perforce, and back-ported it to 6.x. (also in Perforce though not always caught up with what I have done in -current/P4). The subset allows a number of FIBs to be defined at compile time (8 is sufficient for my purposes in 6.x) and implements the changes needed to allow IPV4 to use them. I have not done the changes for ipv6 simply because I do not need it, and I do not have enough knowledge of ipv6 (e.g. neighbor discovery) needed to do it. Other protocol families are left untouched and should there be users with proprietary protocol families, they should continue to work and be oblivious to the existence of the extra FIBs. To understand how this is done, one must know that the current FIB code starts everything off with a single dimensional array of pointers to FIB head structures (One per protocol family), each of which in turn points to the trie of routes available to that family. The basic change in the ABI compatible version of the change is to extent that array to be a 2 dimensional array, so that instead of protocol family X looking at rt_tables[X] for the table it needs, it looks at rt_tables[Y][X] when for all protocol families except ipv4 Y is always 0. Code that is unaware of the change always just sees the first row of the table, which of course looks just like the one dimensional array that existed before. The entry points rtrequest(), rtalloc(), rtalloc1(), rtalloc_ign() are all maintained, but refer only to the first row of the array, so that existing callers in proprietary protocols can continue to do the "right thing". Some new entry points are added, for the exclusive use of ipv4 code called in_rtrequest(), in_rtalloc(), in_rtalloc1() and in_rtalloc_ign(), which have an extra argument which refers the code to the correct row. In addition, there are some new entry points (currently called rtalloc_fib() and friends) that check the Address family being looked up and call either rtalloc() (and friends) if the protocol is not IPv4 forcing the action to row 0 or to the appropriate row if it IS IPv4 (and that info is available). These are for calling from code that is not specific to any particular protocol. The way these are implemented would change in the non ABI preserving code to be added later. One feature of the first version of the code is that for ipv4, the interface routes show up automatically on all the FIBs, so that no matter what FIB you select you always have the basic direct attached hosts available to you. (rtinit() does this automatically). You CAN delete an interface route from one FIB should you want to but by default it's there. ARP information is also available in each FIB. It's assumed that the same machine would have the same MAC address, regardless of which FIB you are using to get to it. This brings us as to how the correct FIB is selected for an outgoing IPV4 packet. Firstly, all packets have a FIB associated with them. if nothing has been done to change it, it will be FIB 0. The FIB is changed in the following ways. Packets fall into one of a number of classes. 1/ locally generated packets, coming from a socket/PCB. Such packets select a FIB from a number associated with the socket/PCB. This in turn is inherited from the process, but can be changed by a socket option. The process in turn inherits it on fork. I have written a utility call setfib that acts a bit like nice.. setfib -3 ping target.example.com # will use fib 3 for ping. It is an obvious extension to make it a property of a jail but I have not done so. It can be achieved by combining the setfib and jail commands. 2/ packets received on an interface for forwarding. By default these packets would use table 0, (or possibly a number settable in a sysctl(not yet)). but prior to routing the firewall can inspect them (see below). (possibly in the future you may be able to associate a FIB with packets received on an interface.. An ifconfig arg, but not yet.) 3/ packets inspected by a packet classifier, which can arbitrarily associate a fib with it on a packet by packet basis. A fib assigned to a packet by a packet classifier (such as ipfw) would over-ride a fib associated by a more default source. (such as cases 1 or 2). 4/ a tcp listen socket associated with a fib will generate accept sockets that are associated with that same fib. 5/ Packets generated in response to some other packet (e.g. reset or icmp packets). These should use the FIB associated with the packet being reponded to. 6/ Packets generated during encapsulation. gif, tun and other tunnel interfaces will encapsulate using the FIB that was in effect withthe proces that set up the tunnel. thus setfib 1 ifconfig gif0 [tunnel instructions] will set the fib for the tunnel to use to be fib 1. Routing messages would be associated with their process, and thus select one FIB or another. messages from the kernel would be associated with the fib they refer to and would only be received by a routing socket associated with that fib. (not yet implemented) In addition Netstat has been edited to be able to cope with the fact that the array is now 2 dimensional. (It looks in system memory using libkvm (!)). Old versions of netstat see only the first FIB. In addition two sysctls are added to give: a) the number of FIBs compiled in (active) b) the default FIB of the calling process. Early testing experience: ------------------------- Basically our (IronPort's) appliance does this functionality already using ipfw fwd but that method has some drawbacks. For example, It can't fully simulate a routing table because it can't influence the socket's choice of local address when a connect() is done. Testing during the generating of these changes has been remarkably smooth so far. Multiple tables have co-existed with no notable side effects, and packets have been routes accordingly. ipfw has grown 2 new keywords: setfib N ip from anay to any count ip from any to any fib N In pf there seems to be a requirement to be able to give symbolic names to the fibs but I do not have that capacity. I am not sure if it is required. SCTP has interestingly enough built in support for this, called VRFs in Cisco parlance. it will be interesting to see how that handles it when it suddenly actually does something. Where to next: -------------------- After committing the ABI compatible version and MFCing it, I'd like to proceed in a forward direction in -current. this will result in some roto-tilling in the routing code. Firstly: the current code's idea of having a separate tree per protocol family, all of the same format, and pointed to by the 1 dimensional array is a bit silly. Especially when one considers that there is code that makes assumptions about every protocol having the same internal structures there. Some protocols don't WANT that sort of structure. (for example the whole idea of a netmask is foreign to appletalk). This needs to be made opaque to the external code. My suggested first change is to add routing method pointers to the 'domain' structure, along with information pointing the data. instead of having an array of pointers to uniform structures, there would be an array pointing to the 'domain' structures for each protocol address domain (protocol family), and the methods this reached would be called. The methods would have an argument that gives FIB number, but the protocol would be free to ignore it. When the ABI can be changed it raises the possibilty of the addition of a fib entry into the "struct route". Currently, the structure contains the sockaddr of the desination, and the resulting fib entry. To make this work fully, one could add a fib number so that given an address and a fib, one can find the third element, the fib entry. Interaction with the ARP layer/ LL layer would need to be revisited as well. Qing Li has been working on this already. This work was sponsored by Ironport Systems/Cisco PR: Reviewed by: several including rwatson, bz and mlair (parts each) Approved by: Obtained from: Ironport systems/Cisco MFC after: Security: PR: Submitted by: Reviewed by: Approved by: Obtained from: MFC after: Security:
2008-05-09 23:00:21 +00:00
.Dv SO_SETFIB
can be used to over-ride the default FIB (routing table) for the given socket.
The value must be from 0 to one less than the number returned from
the sysctl
.Em net.fibs .
.Pp
.Dv SO_ACCEPTFILTER
places an
.Xr accept_filter 9
on the socket,
which will filter incoming connections
on a listening stream socket before being presented for
.Xr accept 2 .
Once more,
.Xr listen 2
must be called on the socket before
trying to install the filter on it,
or else the
.Fn setsockopt
system call will fail.
.Bd -literal
struct accept_filter_arg {
char af_name[16];
char af_arg[256-16];
};
.Ed
.Pp
2002-12-19 09:40:28 +00:00
The
.Fa optval
2002-12-19 09:40:28 +00:00
argument
should point to a
.Fa struct accept_filter_arg
that will select and configure the
.Xr accept_filter 9 .
2002-12-19 09:40:28 +00:00
The
.Fa af_name
2002-12-19 09:40:28 +00:00
argument
should be filled with the name of the accept filter
that the application wishes to place on the listening socket.
2002-12-19 09:40:28 +00:00
The optional argument
.Fa af_arg
2002-12-19 09:40:28 +00:00
can be passed to the accept
filter specified by
.Fa af_name
to provide additional configuration options at attach time.
Passing in an
.Fa optval
of NULL will remove the filter.
.Pp
The
.Dv SO_NOSIGPIPE
2006-09-17 21:27:35 +00:00
option controls generation of the
.Dv SIGPIPE
signal normally sent
when writing to a connected socket where the other end has been
closed returns with the error
.Er EPIPE .
.Pp
If the
.Dv SO_TIMESTAMP
or
.Dv SO_BINTIME
option is enabled on a
.Dv SOCK_DGRAM
socket, the
.Xr recvmsg 2
call will return a timestamp corresponding to when the datagram was received.
The
.Va msg_control
field in the
.Vt msghdr
structure points to a buffer that contains a
.Vt cmsghdr
structure followed by a
.Vt "struct timeval"
for
.Dv SO_TIMESTAMP
and
.Vt "struct bintime"
for
.Dv SO_BINTIME .
The
.Vt cmsghdr
fields have the following values for TIMESTAMP:
.Bd -literal
cmsg_len = sizeof(struct timeval);
cmsg_level = SOL_SOCKET;
cmsg_type = SCM_TIMESTAMP;
.Ed
.Pp
and for
.Dv SO_BINTIME :
.Bd -literal
cmsg_len = sizeof(struct bintime);
cmsg_level = SOL_SOCKET;
cmsg_type = SCM_BINTIME;
.Ed
.Pp
.Dv SO_ACCEPTCONN ,
1994-05-27 05:00:24 +00:00
.Dv SO_TYPE
and
.Dv SO_ERROR
are options used only with
.Fn getsockopt .
.Dv SO_ACCEPTCONN
returns whether the socket is currently accepting connections,
2007-03-09 19:43:42 +00:00
that is, whether or not the
.Xr listen 2
system call was invoked on the socket.
1994-05-27 05:00:24 +00:00
.Dv SO_TYPE
returns the type of the socket, such as
.Dv SOCK_STREAM ;
it is useful for servers that inherit sockets on startup.
.Dv SO_ERROR
returns any pending error on the socket and clears
the error status.
It may be used to check for asynchronous errors on connected
datagram sockets or for other asynchronous errors.
.Pp
Finally,
.Dv SO_LABEL
returns the MAC label of the socket.
.Dv SO_PEERLABEL
returns the MAC label of the socket's peer.
Note that your kernel must be compiled with MAC support.
See
.Xr mac 3
for more information.
.Dv SO_LISTENQLIMIT
returns the maximal number of queued connections, as set by
.Xr listen 2 .
.Dv SO_LISTENQLEN
returns the number of unaccepted complete connections.
.Dv SO_LISTENINCQLEN
returns the number of unaccepted incomplete connections.
1994-05-27 05:00:24 +00:00
.Sh RETURN VALUES
.Rv -std
1994-05-27 05:00:24 +00:00
.Sh ERRORS
The call succeeds unless:
.Bl -tag -width Er
1994-05-27 05:00:24 +00:00
.It Bq Er EBADF
The argument
.Fa s
is not a valid descriptor.
.It Bq Er ENOTSOCK
The argument
.Fa s
is a file, not a socket.
.It Bq Er ENOPROTOOPT
The option is unknown at the level indicated.
.It Bq Er EFAULT
2001-07-15 07:53:42 +00:00
The address pointed to by
1994-05-27 05:00:24 +00:00
.Fa optval
is not in a valid part of the process address space.
For
.Fn getsockopt ,
this error may also be returned if
.Fa optlen
is not in a valid part of the process address space.
.It Bq Er EINVAL
Installing an
.Xr accept_filter 9
on a non-listening socket was attempted.
1994-05-27 05:00:24 +00:00
.El
.Sh SEE ALSO
.Xr ioctl 2 ,
.Xr listen 2 ,
.Xr recvmsg 2 ,
1994-05-27 05:00:24 +00:00
.Xr socket 2 ,
.Xr getprotoent 3 ,
.Xr mac 3 ,
.Xr sysctl 3 ,
.Xr protocols 5 ,
.Xr sysctl 8 ,
.Xr accept_filter 9 ,
.Xr bintime 9
1994-05-27 05:00:24 +00:00
.Sh HISTORY
The
.Fn getsockopt
1994-05-27 05:00:24 +00:00
system call appeared in
.Bx 4.2 .
2005-01-20 09:17:07 +00:00
.Sh BUGS
Several of the socket options should be handled at lower levels of the system.