/src/openssl32/crypto/bio/bio_sock2.c

Source (jump to first uncovered line)
/*
 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>

#include "bio_local.h"
#include "internal/ktls.h"
#include "internal/bio_tfo.h"

#include <openssl/err.h>

#ifndef OPENSSL_NO_SOCK
# ifdef SO_MAXCONN
#  define MAX_LISTEN  SO_MAXCONN
# elif defined(SOMAXCONN)
#  define MAX_LISTEN  SOMAXCONN
# else
#  define MAX_LISTEN  32
# endif

/*-
 * BIO_socket - create a socket
 * @domain: the socket domain (AF_INET, AF_INET6, AF_UNIX, ...)
 * @socktype: the socket type (SOCK_STEAM, SOCK_DGRAM)
 * @protocol: the protocol to use (IPPROTO_TCP, IPPROTO_UDP)
 * @options: BIO socket options (currently unused)
 *
 * Creates a socket.  This should be called before calling any
 * of BIO_connect and BIO_listen.
 *
 * Returns the file descriptor on success or INVALID_SOCKET on failure.  On
 * failure errno is set, and a status is added to the OpenSSL error stack.
 */
int BIO_socket(int domain, int socktype, int protocol, int options)
{
    int sock = -1;

    if (BIO_sock_init() != 1)
        return INVALID_SOCKET;

    sock = socket(domain, socktype, protocol);
    if (sock == -1) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling socket()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
        return INVALID_SOCKET;
    }

    return sock;
}

/*-
 * BIO_connect - connect to an address
 * @sock: the socket to connect with
 * @addr: the address to connect to
 * @options: BIO socket options
 *
 * Connects to the address using the given socket and options.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
 * - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
 * - BIO_SOCK_NODELAY: don't delay small messages.
 * - BIO_SOCK_TFO: use TCP Fast Open
 *
 * options holds BIO socket options that can be used
 * You should call this for every address returned by BIO_lookup
 * until the connection is successful.
 *
 * Returns 1 on success or 0 on failure.  On failure errno is set
 * and an error status is added to the OpenSSL error stack.
 */
int BIO_connect(int sock, const BIO_ADDR *addr, int options)
{
    const int on = 1;

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

    if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
        return 0;

    if (options & BIO_SOCK_KEEPALIVE) {
        if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
            return 0;
        }
    }

    if (options & BIO_SOCK_NODELAY) {
        if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
            return 0;
        }
    }
    if (options & BIO_SOCK_TFO) {
# if defined(OSSL_TFO_CLIENT_FLAG)
#  if defined(OSSL_TFO_SYSCTL_CLIENT)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Later FreeBSD */
        if (sysctlbyname(OSSL_TFO_SYSCTL_CLIENT, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for client flag */
        if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#  elif defined(OSSL_TFO_SYSCTL)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* macOS */
        if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for client flag */
        if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#  endif
# endif
# if defined(OSSL_TFO_CONNECTX)
        sa_endpoints_t sae;

        memset(&sae, 0, sizeof(sae));
        sae.sae_dstaddr = BIO_ADDR_sockaddr(addr);
        sae.sae_dstaddrlen = BIO_ADDR_sockaddr_size(addr);
        if (connectx(sock, &sae, SAE_ASSOCID_ANY,
                     CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
                     NULL, 0, NULL, NULL) == -1) {
            if (!BIO_sock_should_retry(-1)) {
                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                               "calling connectx()");
                ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
            }
            return 0;
        }
# endif
# if defined(OSSL_TFO_CLIENT_SOCKOPT)
        if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_CLIENT_SOCKOPT,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
            return 0;
        }
# endif
# if defined(OSSL_TFO_DO_NOT_CONNECT)
        return 1;
# endif
    }

    if (connect(sock, BIO_ADDR_sockaddr(addr),
                BIO_ADDR_sockaddr_size(addr)) == -1) {
        if (!BIO_sock_should_retry(-1)) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling connect()");
            ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
        }
        return 0;
    }
# ifndef OPENSSL_NO_KTLS
    /*
     * The new socket is created successfully regardless of ktls_enable.
     * ktls_enable doesn't change any functionality of the socket, except
     * changing the setsockopt to enable the processing of ktls_start.
     * Thus, it is not a problem to call it for non-TLS sockets.
     */
    ktls_enable(sock);
# endif
    return 1;
}

/*-
 * BIO_bind - bind socket to address
 * @sock: the socket to set
 * @addr: local address to bind to
 * @options: BIO socket options
 *
 * Binds to the address using the given socket and options.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
 *   for a recently closed port.
 *
 * When restarting the program it could be that the port is still in use.  If
 * you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
 * It's recommended that you use this.
 */
int BIO_bind(int sock, const BIO_ADDR *addr, int options)
{
# ifndef OPENSSL_SYS_WINDOWS
    int on = 1;
# endif

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

# ifndef OPENSSL_SYS_WINDOWS
    /*
     * SO_REUSEADDR has different behavior on Windows than on
     * other operating systems, don't set it there.
     */
    if (options & BIO_SOCK_REUSEADDR) {
        if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR);
            return 0;
        }
    }
# endif

    if (bind(sock, BIO_ADDR_sockaddr(addr), BIO_ADDR_sockaddr_size(addr)) != 0) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error() /* may be 0 */,
                       "calling bind()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET);
        return 0;
    }

    return 1;
}

/*-
 * BIO_listen - Creates a listen socket
 * @sock: the socket to listen with
 * @addr: local address to bind to
 * @options: BIO socket options
 *
 * Binds to the address using the given socket and options, then
 * starts listening for incoming connections.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
 * - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
 * - BIO_SOCK_NODELAY: don't delay small messages.
 * - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
 *   for a recently closed port.
 * - BIO_SOCK_V6_ONLY: When creating an IPv6 socket, make it listen only
 *   for IPv6 addresses and not IPv4 addresses mapped to IPv6.
 * - BIO_SOCK_TFO: accept TCP fast open (set TCP_FASTOPEN)
 *
 * It's recommended that you set up both an IPv6 and IPv4 listen socket, and
 * then check both for new clients that connect to it.  You want to set up
 * the socket as non-blocking in that case since else it could hang.
 *
 * Not all operating systems support IPv4 addresses on an IPv6 socket, and for
 * others it's an option.  If you pass the BIO_LISTEN_V6_ONLY it will try to
 * create the IPv6 sockets to only listen for IPv6 connection.
 *
 * It could be that the first BIO_listen() call will listen to all the IPv6
 * and IPv4 addresses and that then trying to bind to the IPv4 address will
 * fail.  We can't tell the difference between already listening ourself to
 * it and someone else listening to it when failing and errno is EADDRINUSE, so
 * it's recommended to not give an error in that case if the first call was
 * successful.
 *
 * When restarting the program it could be that the port is still in use.  If
 * you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
 * It's recommended that you use this.
 */
int BIO_listen(int sock, const BIO_ADDR *addr, int options)
{
    int on = 1;
    int socktype;
    socklen_t socktype_len = sizeof(socktype);

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

    if (getsockopt(sock, SOL_SOCKET, SO_TYPE,
                   (void *)&socktype, &socktype_len) != 0
        || socktype_len != sizeof(socktype)) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling getsockopt()");
        ERR_raise(ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE);
        return 0;
    }

    if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
        return 0;

    if (options & BIO_SOCK_KEEPALIVE) {
        if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
            return 0;
        }
    }

    if (options & BIO_SOCK_NODELAY) {
        if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
            return 0;
        }
    }

  /* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
# if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
    if (BIO_ADDR_family(addr) == AF_INET6) {
        /*
         * Note: Windows default of IPV6_V6ONLY is ON, and Linux is OFF.
         * Therefore we always have to use setsockopt here.
         */
        on = options & BIO_SOCK_V6_ONLY ? 1 : 0;
        if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY);
            return 0;
        }
    }
# endif

    if (!BIO_bind(sock, addr, options))
        return 0;

    if (socktype != SOCK_DGRAM && listen(sock, MAX_LISTEN) == -1) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling listen()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET);
        return 0;
    }

# if defined(OSSL_TFO_SERVER_SOCKOPT)
    /*
     * Must do it explicitly after listen() for macOS, still
     * works fine on other OS's
     */
    if ((options & BIO_SOCK_TFO) && socktype != SOCK_DGRAM) {
        int q = OSSL_TFO_SERVER_SOCKOPT_VALUE;
#  if defined(OSSL_TFO_CLIENT_FLAG)
#   if defined(OSSL_TFO_SYSCTL_SERVER)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Later FreeBSD */
        if (sysctlbyname(OSSL_TFO_SYSCTL_SERVER, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for server flag */
        if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#   elif defined(OSSL_TFO_SYSCTL)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Early FreeBSD, macOS */
        if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for server flag */
        if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#   endif
#  endif
        if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_SERVER_SOCKOPT,
                       (void *)&q, sizeof(q)) < 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
            return 0;
        }
    }
# endif

    return 1;
}

/*-
 * BIO_accept_ex - Accept new incoming connections
 * @sock: the listening socket
 * @addr: the BIO_ADDR to store the peer address in
 * @options: BIO socket options, applied on the accepted socket.
 *
 */
int BIO_accept_ex(int accept_sock, BIO_ADDR *addr_, int options)
{
    socklen_t len;
    int accepted_sock;
    BIO_ADDR locaddr;
    BIO_ADDR *addr = addr_ == NULL ? &locaddr : addr_;

    len = sizeof(*addr);
    accepted_sock = accept(accept_sock,
                           BIO_ADDR_sockaddr_noconst(addr), &len);
    if (accepted_sock == -1) {
        if (!BIO_sock_should_retry(accepted_sock)) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling accept()");
            ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
        }
        return INVALID_SOCKET;
    }

    if (!BIO_socket_nbio(accepted_sock, (options & BIO_SOCK_NONBLOCK) != 0)) {
        closesocket(accepted_sock);
        return INVALID_SOCKET;
    }

    return accepted_sock;
}

/*-
 * BIO_closesocket - Close a socket
 * @sock: the socket to close
 */
int BIO_closesocket(int sock)
{
    if (sock < 0 || closesocket(sock) < 0)
        return 0;
    return 1;
}
#endif

Coverage Report

Created: 2025-06-13 06:58

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include <stdlib.h>
12		#include <errno.h>
13
14		#include "bio_local.h"
15		#include "internal/ktls.h"
16		#include "internal/bio_tfo.h"
17
18		#include <openssl/err.h>
19
20		#ifndef OPENSSL_NO_SOCK
21		# ifdef SO_MAXCONN
22		# define MAX_LISTEN SO_MAXCONN
23		# elif defined(SOMAXCONN)
24	0	# define MAX_LISTEN SOMAXCONN
25		# else
26		# define MAX_LISTEN 32
27		# endif
28
29		/*-
30		* BIO_socket - create a socket
31		* @domain: the socket domain (AF_INET, AF_INET6, AF_UNIX, ...)
32		* @socktype: the socket type (SOCK_STEAM, SOCK_DGRAM)
33		* @protocol: the protocol to use (IPPROTO_TCP, IPPROTO_UDP)
34		* @options: BIO socket options (currently unused)
35		*
36		* Creates a socket. This should be called before calling any
37		* of BIO_connect and BIO_listen.
38		*
39		* Returns the file descriptor on success or INVALID_SOCKET on failure. On
40		* failure errno is set, and a status is added to the OpenSSL error stack.
41		*/
42		int BIO_socket(int domain, int socktype, int protocol, int options)
43	0	{
44	0	int sock = -1;
45
46	0	if (BIO_sock_init() != 1)
47	0	return INVALID_SOCKET;
48
49	0	sock = socket(domain, socktype, protocol);
50	0	if (sock == -1) {
51	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
52	0	"calling socket()");
53	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
54	0	return INVALID_SOCKET;
55	0	}
56
57	0	return sock;
58	0	}
59
60		/*-
61		* BIO_connect - connect to an address
62		* @sock: the socket to connect with
63		* @addr: the address to connect to
64		* @options: BIO socket options
65		*
66		* Connects to the address using the given socket and options.
67		*
68		* Options can be a combination of the following:
69		* - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
70		* - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
71		* - BIO_SOCK_NODELAY: don't delay small messages.
72		* - BIO_SOCK_TFO: use TCP Fast Open
73		*
74		* options holds BIO socket options that can be used
75		* You should call this for every address returned by BIO_lookup
76		* until the connection is successful.
77		*
78		* Returns 1 on success or 0 on failure. On failure errno is set
79		* and an error status is added to the OpenSSL error stack.
80		*/
81		int BIO_connect(int sock, const BIO_ADDR *addr, int options)
82	0	{
83	0	const int on = 1;
84
85	0	if (sock == -1) {
86	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
87	0	return 0;
88	0	}
89
90	0	if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
91	0	return 0;
92
93	0	if (options & BIO_SOCK_KEEPALIVE) {
94	0	if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
95	0	(const void *)&on, sizeof(on)) != 0) {
96	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
97	0	"calling setsockopt()");
98	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
99	0	return 0;
100	0	}
101	0	}
102
103	0	if (options & BIO_SOCK_NODELAY) {
104	0	if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
105	0	(const void *)&on, sizeof(on)) != 0) {
106	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
107	0	"calling setsockopt()");
108	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
109	0	return 0;
110	0	}
111	0	}
112	0	if (options & BIO_SOCK_TFO) {
113		# if defined(OSSL_TFO_CLIENT_FLAG)
114		# if defined(OSSL_TFO_SYSCTL_CLIENT)
115		int enabled = 0;
116		size_t enabledlen = sizeof(enabled);
117
118		/* Later FreeBSD */
119		if (sysctlbyname(OSSL_TFO_SYSCTL_CLIENT, &enabled, &enabledlen, NULL, 0) < 0) {
120		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
121		return 0;
122		}
123		/* Need to check for client flag */
124		if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
125		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
126		return 0;
127		}
128		# elif defined(OSSL_TFO_SYSCTL)
129		int enabled = 0;
130		size_t enabledlen = sizeof(enabled);
131
132		/* macOS */
133		if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
134		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
135		return 0;
136		}
137		/* Need to check for client flag */
138		if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
139		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
140		return 0;
141		}
142		# endif
143		# endif
144		# if defined(OSSL_TFO_CONNECTX)
145		sa_endpoints_t sae;
146
147		memset(&sae, 0, sizeof(sae));
148		sae.sae_dstaddr = BIO_ADDR_sockaddr(addr);
149		sae.sae_dstaddrlen = BIO_ADDR_sockaddr_size(addr);
150		if (connectx(sock, &sae, SAE_ASSOCID_ANY,
151		CONNECT_DATA_IDEMPOTENT \| CONNECT_RESUME_ON_READ_WRITE,
152		NULL, 0, NULL, NULL) == -1) {
153		if (!BIO_sock_should_retry(-1)) {
154		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
155		"calling connectx()");
156		ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
157		}
158		return 0;
159		}
160		# endif
161		# if defined(OSSL_TFO_CLIENT_SOCKOPT)
162		if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_CLIENT_SOCKOPT,
163		(const void *)&on, sizeof(on)) != 0) {
164		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
165		"calling setsockopt()");
166		ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
167		return 0;
168		}
169		# endif
170		# if defined(OSSL_TFO_DO_NOT_CONNECT)
171		return 1;
172		# endif
173	0	}
174
175	0	if (connect(sock, BIO_ADDR_sockaddr(addr),
176	0	BIO_ADDR_sockaddr_size(addr)) == -1) {
177	0	if (!BIO_sock_should_retry(-1)) {
178	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
179	0	"calling connect()");
180	0	ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
181	0	}
182	0	return 0;
183	0	}
184		# ifndef OPENSSL_NO_KTLS
185		/*
186		* The new socket is created successfully regardless of ktls_enable.
187		* ktls_enable doesn't change any functionality of the socket, except
188		* changing the setsockopt to enable the processing of ktls_start.
189		* Thus, it is not a problem to call it for non-TLS sockets.
190		*/
191		ktls_enable(sock);
192		# endif
193	0	return 1;
194	0	}
195
196		/*-
197		* BIO_bind - bind socket to address
198		* @sock: the socket to set
199		* @addr: local address to bind to
200		* @options: BIO socket options
201		*
202		* Binds to the address using the given socket and options.
203		*
204		* Options can be a combination of the following:
205		* - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
206		* for a recently closed port.
207		*
208		* When restarting the program it could be that the port is still in use. If
209		* you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
210		* It's recommended that you use this.
211		*/
212		int BIO_bind(int sock, const BIO_ADDR *addr, int options)
213	0	{
214	0	# ifndef OPENSSL_SYS_WINDOWS
215	0	int on = 1;
216	0	# endif
217
218	0	if (sock == -1) {
219	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
220	0	return 0;
221	0	}
222
223	0	# ifndef OPENSSL_SYS_WINDOWS
224		/*
225		* SO_REUSEADDR has different behavior on Windows than on
226		* other operating systems, don't set it there.
227		*/
228	0	if (options & BIO_SOCK_REUSEADDR) {
229	0	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
230	0	(const void *)&on, sizeof(on)) != 0) {
231	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
232	0	"calling setsockopt()");
233	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR);
234	0	return 0;
235	0	}
236	0	}
237	0	# endif
238
239	0	if (bind(sock, BIO_ADDR_sockaddr(addr), BIO_ADDR_sockaddr_size(addr)) != 0) {
240	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error() /* may be 0 */,
241	0	"calling bind()");
242	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET);
243	0	return 0;
244	0	}
245
246	0	return 1;
247	0	}
248
249		/*-
250		* BIO_listen - Creates a listen socket
251		* @sock: the socket to listen with
252		* @addr: local address to bind to
253		* @options: BIO socket options
254		*
255		* Binds to the address using the given socket and options, then
256		* starts listening for incoming connections.
257		*
258		* Options can be a combination of the following:
259		* - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
260		* - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
261		* - BIO_SOCK_NODELAY: don't delay small messages.
262		* - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
263		* for a recently closed port.
264		* - BIO_SOCK_V6_ONLY: When creating an IPv6 socket, make it listen only
265		* for IPv6 addresses and not IPv4 addresses mapped to IPv6.
266		* - BIO_SOCK_TFO: accept TCP fast open (set TCP_FASTOPEN)
267		*
268		* It's recommended that you set up both an IPv6 and IPv4 listen socket, and
269		* then check both for new clients that connect to it. You want to set up
270		* the socket as non-blocking in that case since else it could hang.
271		*
272		* Not all operating systems support IPv4 addresses on an IPv6 socket, and for
273		* others it's an option. If you pass the BIO_LISTEN_V6_ONLY it will try to
274		* create the IPv6 sockets to only listen for IPv6 connection.
275		*
276		* It could be that the first BIO_listen() call will listen to all the IPv6
277		* and IPv4 addresses and that then trying to bind to the IPv4 address will
278		* fail. We can't tell the difference between already listening ourself to
279		* it and someone else listening to it when failing and errno is EADDRINUSE, so
280		* it's recommended to not give an error in that case if the first call was
281		* successful.
282		*
283		* When restarting the program it could be that the port is still in use. If
284		* you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
285		* It's recommended that you use this.
286		*/
287		int BIO_listen(int sock, const BIO_ADDR *addr, int options)
288	0	{
289	0	int on = 1;
290	0	int socktype;
291	0	socklen_t socktype_len = sizeof(socktype);
292
293	0	if (sock == -1) {
294	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
295	0	return 0;
296	0	}
297
298	0	if (getsockopt(sock, SOL_SOCKET, SO_TYPE,
299	0	(void *)&socktype, &socktype_len) != 0
300	0	\|\| socktype_len != sizeof(socktype)) {
301	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
302	0	"calling getsockopt()");
303	0	ERR_raise(ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE);
304	0	return 0;
305	0	}
306
307	0	if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
308	0	return 0;
309
310	0	if (options & BIO_SOCK_KEEPALIVE) {
311	0	if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
312	0	(const void *)&on, sizeof(on)) != 0) {
313	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
314	0	"calling setsockopt()");
315	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
316	0	return 0;
317	0	}
318	0	}
319
320	0	if (options & BIO_SOCK_NODELAY) {
321	0	if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
322	0	(const void *)&on, sizeof(on)) != 0) {
323	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
324	0	"calling setsockopt()");
325	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
326	0	return 0;
327	0	}
328	0	}
329
330		/* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
331	0	# if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
332	0	if (BIO_ADDR_family(addr) == AF_INET6) {
333		/*
334		* Note: Windows default of IPV6_V6ONLY is ON, and Linux is OFF.
335		* Therefore we always have to use setsockopt here.
336		*/
337	0	on = options & BIO_SOCK_V6_ONLY ? 1 : 0;
338	0	if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY,
339	0	(const void *)&on, sizeof(on)) != 0) {
340	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
341	0	"calling setsockopt()");
342	0	ERR_raise(ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY);
343	0	return 0;
344	0	}
345	0	}
346	0	# endif
347
348	0	if (!BIO_bind(sock, addr, options))
349	0	return 0;
350
351	0	if (socktype != SOCK_DGRAM && listen(sock, MAX_LISTEN) == -1) {
352	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
353	0	"calling listen()");
354	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET);
355	0	return 0;
356	0	}
357
358		# if defined(OSSL_TFO_SERVER_SOCKOPT)
359		/*
360		* Must do it explicitly after listen() for macOS, still
361		* works fine on other OS's
362		*/
363		if ((options & BIO_SOCK_TFO) && socktype != SOCK_DGRAM) {
364		int q = OSSL_TFO_SERVER_SOCKOPT_VALUE;
365		# if defined(OSSL_TFO_CLIENT_FLAG)
366		# if defined(OSSL_TFO_SYSCTL_SERVER)
367		int enabled = 0;
368		size_t enabledlen = sizeof(enabled);
369
370		/* Later FreeBSD */
371		if (sysctlbyname(OSSL_TFO_SYSCTL_SERVER, &enabled, &enabledlen, NULL, 0) < 0) {
372		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
373		return 0;
374		}
375		/* Need to check for server flag */
376		if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
377		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
378		return 0;
379		}
380		# elif defined(OSSL_TFO_SYSCTL)
381		int enabled = 0;
382		size_t enabledlen = sizeof(enabled);
383
384		/* Early FreeBSD, macOS */
385		if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
386		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
387		return 0;
388		}
389		/* Need to check for server flag */
390		if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
391		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
392		return 0;
393		}
394		# endif
395		# endif
396		if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_SERVER_SOCKOPT,
397		(void *)&q, sizeof(q)) < 0) {
398		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
399		"calling setsockopt()");
400		ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
401		return 0;
402		}
403		}
404		# endif
405
406	0	return 1;
407	0	}
408
409		/*-
410		* BIO_accept_ex - Accept new incoming connections
411		* @sock: the listening socket
412		* @addr: the BIO_ADDR to store the peer address in
413		* @options: BIO socket options, applied on the accepted socket.
414		*
415		*/
416		int BIO_accept_ex(int accept_sock, BIO_ADDR *addr_, int options)
417	0	{
418	0	socklen_t len;
419	0	int accepted_sock;
420	0	BIO_ADDR locaddr;
421	0	BIO_ADDR *addr = addr_ == NULL ? &locaddr : addr_;
422
423	0	len = sizeof(*addr);
424	0	accepted_sock = accept(accept_sock,
425	0	BIO_ADDR_sockaddr_noconst(addr), &len);
426	0	if (accepted_sock == -1) {
427	0	if (!BIO_sock_should_retry(accepted_sock)) {
428	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
429	0	"calling accept()");
430	0	ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
431	0	}
432	0	return INVALID_SOCKET;
433	0	}
434
435	0	if (!BIO_socket_nbio(accepted_sock, (options & BIO_SOCK_NONBLOCK) != 0)) {
436	0	closesocket(accepted_sock);
437	0	return INVALID_SOCKET;
438	0	}
439
440	0	return accepted_sock;
441	0	}
442
443		/*-
444		* BIO_closesocket - Close a socket
445		* @sock: the socket to close
446		*/
447		int BIO_closesocket(int sock)
448	0	{
449	0	if (sock < 0 \|\| closesocket(sock) < 0)
450	0	return 0;
451	0	return 1;
452	0	}
453		#endif