/src/openssl/crypto/bio/bio_sock2.c

Source
/*
 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>

#include "bio_local.h"
#include "internal/ktls.h"
#include "internal/bio_tfo.h"

#include <openssl/err.h>

#ifndef OPENSSL_NO_SOCK
# ifdef SO_MAXCONN
#  define MAX_LISTEN  SO_MAXCONN
# elif defined(SOMAXCONN)
#  define MAX_LISTEN  SOMAXCONN
# else
#  define MAX_LISTEN  32
# endif

/*-
 * BIO_socket - create a socket
 * @domain: the socket domain (AF_INET, AF_INET6, AF_UNIX, ...)
 * @socktype: the socket type (SOCK_STEAM, SOCK_DGRAM)
 * @protocol: the protocol to use (IPPROTO_TCP, IPPROTO_UDP)
 * @options: BIO socket options (currently unused)
 *
 * Creates a socket.  This should be called before calling any
 * of BIO_connect and BIO_listen.
 *
 * Returns the file descriptor on success or INVALID_SOCKET on failure.  On
 * failure errno is set, and a status is added to the OpenSSL error stack.
 */
int BIO_socket(int domain, int socktype, int protocol, int options)
{
    int sock = -1;

    if (BIO_sock_init() != 1)
        return INVALID_SOCKET;

    sock = socket(domain, socktype, protocol);
    if (sock == -1) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling socket()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
        return INVALID_SOCKET;
    }

    return sock;
}

/*-
 * BIO_connect - connect to an address
 * @sock: the socket to connect with
 * @addr: the address to connect to
 * @options: BIO socket options
 *
 * Connects to the address using the given socket and options.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
 * - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
 * - BIO_SOCK_NODELAY: don't delay small messages.
 * - BIO_SOCK_TFO: use TCP Fast Open
 *
 * options holds BIO socket options that can be used
 * You should call this for every address returned by BIO_lookup
 * until the connection is successful.
 *
 * Returns 1 on success or 0 on failure.  On failure errno is set
 * and an error status is added to the OpenSSL error stack.
 */
int BIO_connect(int sock, const BIO_ADDR *addr, int options)
{
    const int on = 1;

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

    if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
        return 0;

    if (options & BIO_SOCK_KEEPALIVE) {
        if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
            return 0;
        }
    }

    if (options & BIO_SOCK_NODELAY) {
        if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
            return 0;
        }
    }
    if (options & BIO_SOCK_TFO) {
# if defined(OSSL_TFO_CLIENT_FLAG)
#  if defined(OSSL_TFO_SYSCTL_CLIENT)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Later FreeBSD */
        if (sysctlbyname(OSSL_TFO_SYSCTL_CLIENT, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for client flag */
        if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#  elif defined(OSSL_TFO_SYSCTL)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* macOS */
        if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for client flag */
        if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#  endif
# endif
# if defined(OSSL_TFO_CONNECTX)
        sa_endpoints_t sae;

        memset(&sae, 0, sizeof(sae));
        sae.sae_dstaddr = BIO_ADDR_sockaddr(addr);
        sae.sae_dstaddrlen = BIO_ADDR_sockaddr_size(addr);
        if (connectx(sock, &sae, SAE_ASSOCID_ANY,
                     CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
                     NULL, 0, NULL, NULL) == -1) {
            if (!BIO_sock_should_retry(-1)) {
                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                               "calling connectx()");
                ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
            }
            return 0;
        }
# endif
# if defined(OSSL_TFO_CLIENT_SOCKOPT)
        if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_CLIENT_SOCKOPT,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
            return 0;
        }
# endif
# if defined(OSSL_TFO_DO_NOT_CONNECT)
        return 1;
# endif
    }

    if (connect(sock, BIO_ADDR_sockaddr(addr),
                BIO_ADDR_sockaddr_size(addr)) == -1) {
        if (!BIO_sock_should_retry(-1)) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling connect()");
            ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
        }
        return 0;
    }
    return 1;
}

/*-
 * BIO_bind - bind socket to address
 * @sock: the socket to set
 * @addr: local address to bind to
 * @options: BIO socket options
 *
 * Binds to the address using the given socket and options.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
 *   for a recently closed port.
 *
 * When restarting the program it could be that the port is still in use.  If
 * you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
 * It's recommended that you use this.
 */
int BIO_bind(int sock, const BIO_ADDR *addr, int options)
{
# ifndef OPENSSL_SYS_WINDOWS
    int on = 1;
# endif

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

# ifndef OPENSSL_SYS_WINDOWS
    /*
     * SO_REUSEADDR has different behavior on Windows than on
     * other operating systems, don't set it there.
     */
    if (options & BIO_SOCK_REUSEADDR) {
        if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR);
            return 0;
        }
    }
# endif

    if (bind(sock, BIO_ADDR_sockaddr(addr), BIO_ADDR_sockaddr_size(addr)) != 0) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error() /* may be 0 */,
                       "calling bind()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET);
        return 0;
    }

    return 1;
}

/*-
 * BIO_listen - Creates a listen socket
 * @sock: the socket to listen with
 * @addr: local address to bind to
 * @options: BIO socket options
 *
 * Binds to the address using the given socket and options, then
 * starts listening for incoming connections.
 *
 * Options can be a combination of the following:
 * - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
 * - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
 * - BIO_SOCK_NODELAY: don't delay small messages.
 * - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
 *   for a recently closed port.
 * - BIO_SOCK_V6_ONLY: When creating an IPv6 socket, make it listen only
 *   for IPv6 addresses and not IPv4 addresses mapped to IPv6.
 * - BIO_SOCK_TFO: accept TCP fast open (set TCP_FASTOPEN)
 *
 * It's recommended that you set up both an IPv6 and IPv4 listen socket, and
 * then check both for new clients that connect to it.  You want to set up
 * the socket as non-blocking in that case since else it could hang.
 *
 * Not all operating systems support IPv4 addresses on an IPv6 socket, and for
 * others it's an option.  If you pass the BIO_LISTEN_V6_ONLY it will try to
 * create the IPv6 sockets to only listen for IPv6 connection.
 *
 * It could be that the first BIO_listen() call will listen to all the IPv6
 * and IPv4 addresses and that then trying to bind to the IPv4 address will
 * fail.  We can't tell the difference between already listening ourself to
 * it and someone else listening to it when failing and errno is EADDRINUSE, so
 * it's recommended to not give an error in that case if the first call was
 * successful.
 *
 * When restarting the program it could be that the port is still in use.  If
 * you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
 * It's recommended that you use this.
 */
int BIO_listen(int sock, const BIO_ADDR *addr, int options)
{
    int on = 1;
    int socktype;
    socklen_t socktype_len = sizeof(socktype);

    if (sock == -1) {
        ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
        return 0;
    }

    if (getsockopt(sock, SOL_SOCKET, SO_TYPE,
                   (void *)&socktype, &socktype_len) != 0
        || socktype_len != sizeof(socktype)) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling getsockopt()");
        ERR_raise(ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE);
        return 0;
    }

    if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
        return 0;

    if (options & BIO_SOCK_KEEPALIVE) {
        if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
            return 0;
        }
    }

    if (options & BIO_SOCK_NODELAY) {
        if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
            return 0;
        }
    }

  /* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
# if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
    if (BIO_ADDR_family(addr) == AF_INET6) {
        /*
         * Note: Windows default of IPV6_V6ONLY is ON, and Linux is OFF.
         * Therefore we always have to use setsockopt here.
         */
        on = options & BIO_SOCK_V6_ONLY ? 1 : 0;
        if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY,
                       (const void *)&on, sizeof(on)) != 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY);
            return 0;
        }
    }
# endif

    if (!BIO_bind(sock, addr, options))
        return 0;

    if (socktype != SOCK_DGRAM && listen(sock, MAX_LISTEN) == -1) {
        ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                       "calling listen()");
        ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET);
        return 0;
    }

# if defined(OSSL_TFO_SERVER_SOCKOPT)
    /*
     * Must do it explicitly after listen() for macOS, still
     * works fine on other OS's
     */
    if ((options & BIO_SOCK_TFO) && socktype != SOCK_DGRAM) {
        int q = OSSL_TFO_SERVER_SOCKOPT_VALUE;
#  if defined(OSSL_TFO_CLIENT_FLAG)
#   if defined(OSSL_TFO_SYSCTL_SERVER)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Later FreeBSD */
        if (sysctlbyname(OSSL_TFO_SYSCTL_SERVER, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for server flag */
        if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#   elif defined(OSSL_TFO_SYSCTL)
        int enabled = 0;
        size_t enabledlen = sizeof(enabled);

        /* Early FreeBSD, macOS */
        if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
            return 0;
        }
        /* Need to check for server flag */
        if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
            ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
            return 0;
        }
#   endif
#  endif
        if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_SERVER_SOCKOPT,
                       (void *)&q, sizeof(q)) < 0) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling setsockopt()");
            ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
            return 0;
        }
    }
# endif

    return 1;
}

/*-
 * BIO_accept_ex - Accept new incoming connections
 * @sock: the listening socket
 * @addr: the BIO_ADDR to store the peer address in
 * @options: BIO socket options, applied on the accepted socket.
 *
 */
int BIO_accept_ex(int accept_sock, BIO_ADDR *addr_, int options)
{
    socklen_t len;
    int accepted_sock;
    BIO_ADDR locaddr;
    BIO_ADDR *addr = addr_ == NULL ? &locaddr : addr_;

    len = sizeof(*addr);
    accepted_sock = accept(accept_sock,
                           BIO_ADDR_sockaddr_noconst(addr), &len);
    if (accepted_sock == -1) {
        if (!BIO_sock_should_retry(accepted_sock)) {
            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
                           "calling accept()");
            ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
        }
        return INVALID_SOCKET;
    }

    if (!BIO_socket_nbio(accepted_sock, (options & BIO_SOCK_NONBLOCK) != 0)) {
        closesocket(accepted_sock);
        return INVALID_SOCKET;
    }

    return accepted_sock;
}

/*-
 * BIO_closesocket - Close a socket
 * @sock: the socket to close
 */
int BIO_closesocket(int sock)
{
    if (sock < 0 || closesocket(sock) < 0)
        return 0;
    return 1;
}
#endif

Coverage Report

Created: 2025-11-07 06:36

Line	Count	Source
1		/*
2		* Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include <stdlib.h>
12		#include <errno.h>
13
14		#include "bio_local.h"
15		#include "internal/ktls.h"
16		#include "internal/bio_tfo.h"
17
18		#include <openssl/err.h>
19
20		#ifndef OPENSSL_NO_SOCK
21		# ifdef SO_MAXCONN
22		# define MAX_LISTEN SO_MAXCONN
23		# elif defined(SOMAXCONN)
24	0	# define MAX_LISTEN SOMAXCONN
25		# else
26		# define MAX_LISTEN 32
27		# endif
28
29		/*-
30		* BIO_socket - create a socket
31		* @domain: the socket domain (AF_INET, AF_INET6, AF_UNIX, ...)
32		* @socktype: the socket type (SOCK_STEAM, SOCK_DGRAM)
33		* @protocol: the protocol to use (IPPROTO_TCP, IPPROTO_UDP)
34		* @options: BIO socket options (currently unused)
35		*
36		* Creates a socket. This should be called before calling any
37		* of BIO_connect and BIO_listen.
38		*
39		* Returns the file descriptor on success or INVALID_SOCKET on failure. On
40		* failure errno is set, and a status is added to the OpenSSL error stack.
41		*/
42		int BIO_socket(int domain, int socktype, int protocol, int options)
43	0	{
44	0	int sock = -1;
45
46	0	if (BIO_sock_init() != 1)
47	0	return INVALID_SOCKET;
48
49	0	sock = socket(domain, socktype, protocol);
50	0	if (sock == -1) {
51	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
52	0	"calling socket()");
53	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
54	0	return INVALID_SOCKET;
55	0	}
56
57	0	return sock;
58	0	}
59
60		/*-
61		* BIO_connect - connect to an address
62		* @sock: the socket to connect with
63		* @addr: the address to connect to
64		* @options: BIO socket options
65		*
66		* Connects to the address using the given socket and options.
67		*
68		* Options can be a combination of the following:
69		* - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
70		* - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
71		* - BIO_SOCK_NODELAY: don't delay small messages.
72		* - BIO_SOCK_TFO: use TCP Fast Open
73		*
74		* options holds BIO socket options that can be used
75		* You should call this for every address returned by BIO_lookup
76		* until the connection is successful.
77		*
78		* Returns 1 on success or 0 on failure. On failure errno is set
79		* and an error status is added to the OpenSSL error stack.
80		*/
81		int BIO_connect(int sock, const BIO_ADDR *addr, int options)
82	0	{
83	0	const int on = 1;
84
85	0	if (sock == -1) {
86	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
87	0	return 0;
88	0	}
89
90	0	if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
91	0	return 0;
92
93	0	if (options & BIO_SOCK_KEEPALIVE) {
94	0	if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
95	0	(const void *)&on, sizeof(on)) != 0) {
96	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
97	0	"calling setsockopt()");
98	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
99	0	return 0;
100	0	}
101	0	}
102
103	0	if (options & BIO_SOCK_NODELAY) {
104	0	if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
105	0	(const void *)&on, sizeof(on)) != 0) {
106	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
107	0	"calling setsockopt()");
108	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
109	0	return 0;
110	0	}
111	0	}
112	0	if (options & BIO_SOCK_TFO) {
113		# if defined(OSSL_TFO_CLIENT_FLAG)
114		# if defined(OSSL_TFO_SYSCTL_CLIENT)
115		int enabled = 0;
116		size_t enabledlen = sizeof(enabled);
117
118		/* Later FreeBSD */
119		if (sysctlbyname(OSSL_TFO_SYSCTL_CLIENT, &enabled, &enabledlen, NULL, 0) < 0) {
120		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
121		return 0;
122		}
123		/* Need to check for client flag */
124		if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
125		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
126		return 0;
127		}
128		# elif defined(OSSL_TFO_SYSCTL)
129		int enabled = 0;
130		size_t enabledlen = sizeof(enabled);
131
132		/* macOS */
133		if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
134		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
135		return 0;
136		}
137		/* Need to check for client flag */
138		if (!(enabled & OSSL_TFO_CLIENT_FLAG)) {
139		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
140		return 0;
141		}
142		# endif
143		# endif
144		# if defined(OSSL_TFO_CONNECTX)
145		sa_endpoints_t sae;
146
147		memset(&sae, 0, sizeof(sae));
148		sae.sae_dstaddr = BIO_ADDR_sockaddr(addr);
149		sae.sae_dstaddrlen = BIO_ADDR_sockaddr_size(addr);
150		if (connectx(sock, &sae, SAE_ASSOCID_ANY,
151		CONNECT_DATA_IDEMPOTENT \| CONNECT_RESUME_ON_READ_WRITE,
152		NULL, 0, NULL, NULL) == -1) {
153		if (!BIO_sock_should_retry(-1)) {
154		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
155		"calling connectx()");
156		ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
157		}
158		return 0;
159		}
160		# endif
161		# if defined(OSSL_TFO_CLIENT_SOCKOPT)
162		if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_CLIENT_SOCKOPT,
163		(const void *)&on, sizeof(on)) != 0) {
164		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
165		"calling setsockopt()");
166		ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
167		return 0;
168		}
169		# endif
170		# if defined(OSSL_TFO_DO_NOT_CONNECT)
171		return 1;
172		# endif
173	0	}
174
175	0	if (connect(sock, BIO_ADDR_sockaddr(addr),
176	0	BIO_ADDR_sockaddr_size(addr)) == -1) {
177	0	if (!BIO_sock_should_retry(-1)) {
178	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
179	0	"calling connect()");
180	0	ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
181	0	}
182	0	return 0;
183	0	}
184	0	return 1;
185	0	}
186
187		/*-
188		* BIO_bind - bind socket to address
189		* @sock: the socket to set
190		* @addr: local address to bind to
191		* @options: BIO socket options
192		*
193		* Binds to the address using the given socket and options.
194		*
195		* Options can be a combination of the following:
196		* - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
197		* for a recently closed port.
198		*
199		* When restarting the program it could be that the port is still in use. If
200		* you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
201		* It's recommended that you use this.
202		*/
203		int BIO_bind(int sock, const BIO_ADDR *addr, int options)
204	0	{
205	0	# ifndef OPENSSL_SYS_WINDOWS
206	0	int on = 1;
207	0	# endif
208
209	0	if (sock == -1) {
210	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
211	0	return 0;
212	0	}
213
214	0	# ifndef OPENSSL_SYS_WINDOWS
215		/*
216		* SO_REUSEADDR has different behavior on Windows than on
217		* other operating systems, don't set it there.
218		*/
219	0	if (options & BIO_SOCK_REUSEADDR) {
220	0	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
221	0	(const void *)&on, sizeof(on)) != 0) {
222	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
223	0	"calling setsockopt()");
224	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR);
225	0	return 0;
226	0	}
227	0	}
228	0	# endif
229
230	0	if (bind(sock, BIO_ADDR_sockaddr(addr), BIO_ADDR_sockaddr_size(addr)) != 0) {
231	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error() /* may be 0 */,
232	0	"calling bind()");
233	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET);
234	0	return 0;
235	0	}
236
237	0	return 1;
238	0	}
239
240		/*-
241		* BIO_listen - Creates a listen socket
242		* @sock: the socket to listen with
243		* @addr: local address to bind to
244		* @options: BIO socket options
245		*
246		* Binds to the address using the given socket and options, then
247		* starts listening for incoming connections.
248		*
249		* Options can be a combination of the following:
250		* - BIO_SOCK_KEEPALIVE: enable regularly sending keep-alive messages.
251		* - BIO_SOCK_NONBLOCK: Make the socket non-blocking.
252		* - BIO_SOCK_NODELAY: don't delay small messages.
253		* - BIO_SOCK_REUSEADDR: Try to reuse the address and port combination
254		* for a recently closed port.
255		* - BIO_SOCK_V6_ONLY: When creating an IPv6 socket, make it listen only
256		* for IPv6 addresses and not IPv4 addresses mapped to IPv6.
257		* - BIO_SOCK_TFO: accept TCP fast open (set TCP_FASTOPEN)
258		*
259		* It's recommended that you set up both an IPv6 and IPv4 listen socket, and
260		* then check both for new clients that connect to it. You want to set up
261		* the socket as non-blocking in that case since else it could hang.
262		*
263		* Not all operating systems support IPv4 addresses on an IPv6 socket, and for
264		* others it's an option. If you pass the BIO_LISTEN_V6_ONLY it will try to
265		* create the IPv6 sockets to only listen for IPv6 connection.
266		*
267		* It could be that the first BIO_listen() call will listen to all the IPv6
268		* and IPv4 addresses and that then trying to bind to the IPv4 address will
269		* fail. We can't tell the difference between already listening ourself to
270		* it and someone else listening to it when failing and errno is EADDRINUSE, so
271		* it's recommended to not give an error in that case if the first call was
272		* successful.
273		*
274		* When restarting the program it could be that the port is still in use. If
275		* you set to BIO_SOCK_REUSEADDR option it will try to reuse the port anyway.
276		* It's recommended that you use this.
277		*/
278		int BIO_listen(int sock, const BIO_ADDR *addr, int options)
279	0	{
280	0	int on = 1;
281	0	int socktype;
282	0	socklen_t socktype_len = sizeof(socktype);
283
284	0	if (sock == -1) {
285	0	ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
286	0	return 0;
287	0	}
288
289	0	if (getsockopt(sock, SOL_SOCKET, SO_TYPE,
290	0	(void *)&socktype, &socktype_len) != 0
291	0	\|\| socktype_len != sizeof(socktype)) {
292	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
293	0	"calling getsockopt()");
294	0	ERR_raise(ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE);
295	0	return 0;
296	0	}
297
298	0	if (!BIO_socket_nbio(sock, (options & BIO_SOCK_NONBLOCK) != 0))
299	0	return 0;
300
301	0	if (options & BIO_SOCK_KEEPALIVE) {
302	0	if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
303	0	(const void *)&on, sizeof(on)) != 0) {
304	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
305	0	"calling setsockopt()");
306	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
307	0	return 0;
308	0	}
309	0	}
310
311	0	if (options & BIO_SOCK_NODELAY) {
312	0	if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
313	0	(const void *)&on, sizeof(on)) != 0) {
314	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
315	0	"calling setsockopt()");
316	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
317	0	return 0;
318	0	}
319	0	}
320
321		/* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
322	0	# if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
323	0	if (BIO_ADDR_family(addr) == AF_INET6) {
324		/*
325		* Note: Windows default of IPV6_V6ONLY is ON, and Linux is OFF.
326		* Therefore we always have to use setsockopt here.
327		*/
328	0	on = options & BIO_SOCK_V6_ONLY ? 1 : 0;
329	0	if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY,
330	0	(const void *)&on, sizeof(on)) != 0) {
331	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
332	0	"calling setsockopt()");
333	0	ERR_raise(ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY);
334	0	return 0;
335	0	}
336	0	}
337	0	# endif
338
339	0	if (!BIO_bind(sock, addr, options))
340	0	return 0;
341
342	0	if (socktype != SOCK_DGRAM && listen(sock, MAX_LISTEN) == -1) {
343	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
344	0	"calling listen()");
345	0	ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET);
346	0	return 0;
347	0	}
348
349		# if defined(OSSL_TFO_SERVER_SOCKOPT)
350		/*
351		* Must do it explicitly after listen() for macOS, still
352		* works fine on other OS's
353		*/
354		if ((options & BIO_SOCK_TFO) && socktype != SOCK_DGRAM) {
355		int q = OSSL_TFO_SERVER_SOCKOPT_VALUE;
356		# if defined(OSSL_TFO_CLIENT_FLAG)
357		# if defined(OSSL_TFO_SYSCTL_SERVER)
358		int enabled = 0;
359		size_t enabledlen = sizeof(enabled);
360
361		/* Later FreeBSD */
362		if (sysctlbyname(OSSL_TFO_SYSCTL_SERVER, &enabled, &enabledlen, NULL, 0) < 0) {
363		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
364		return 0;
365		}
366		/* Need to check for server flag */
367		if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
368		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
369		return 0;
370		}
371		# elif defined(OSSL_TFO_SYSCTL)
372		int enabled = 0;
373		size_t enabledlen = sizeof(enabled);
374
375		/* Early FreeBSD, macOS */
376		if (sysctlbyname(OSSL_TFO_SYSCTL, &enabled, &enabledlen, NULL, 0) < 0) {
377		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_NO_KERNEL_SUPPORT);
378		return 0;
379		}
380		/* Need to check for server flag */
381		if (!(enabled & OSSL_TFO_SERVER_FLAG)) {
382		ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
383		return 0;
384		}
385		# endif
386		# endif
387		if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_SERVER_SOCKOPT,
388		(void *)&q, sizeof(q)) < 0) {
389		ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
390		"calling setsockopt()");
391		ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
392		return 0;
393		}
394		}
395		# endif
396
397	0	return 1;
398	0	}
399
400		/*-
401		* BIO_accept_ex - Accept new incoming connections
402		* @sock: the listening socket
403		* @addr: the BIO_ADDR to store the peer address in
404		* @options: BIO socket options, applied on the accepted socket.
405		*
406		*/
407		int BIO_accept_ex(int accept_sock, BIO_ADDR *addr_, int options)
408	0	{
409	0	socklen_t len;
410	0	int accepted_sock;
411	0	BIO_ADDR locaddr;
412	0	BIO_ADDR *addr = addr_ == NULL ? &locaddr : addr_;
413
414	0	len = sizeof(*addr);
415	0	accepted_sock = accept(accept_sock,
416	0	BIO_ADDR_sockaddr_noconst(addr), &len);
417	0	if (accepted_sock == -1) {
418	0	if (!BIO_sock_should_retry(accepted_sock)) {
419	0	ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
420	0	"calling accept()");
421	0	ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
422	0	}
423	0	return INVALID_SOCKET;
424	0	}
425
426	0	if (!BIO_socket_nbio(accepted_sock, (options & BIO_SOCK_NONBLOCK) != 0)) {
427	0	closesocket(accepted_sock);
428	0	return INVALID_SOCKET;
429	0	}
430
431	0	return accepted_sock;
432	0	}
433
434		/*-
435		* BIO_closesocket - Close a socket
436		* @sock: the socket to close
437		*/
438		int BIO_closesocket(int sock)
439	0	{
440	0	if (sock < 0 \|\| closesocket(sock) < 0)
441	0	return 0;
442	0	return 1;
443	0	}
444		#endif