From 52b24ed491ae247bb15a9e8f417934e0c4a1d219 Mon Sep 17 00:00:00 2001 From: Paliak <91493239+Paliak@users.noreply.github.com> Date: Sun, 17 May 2026 20:18:05 +0200 Subject: [PATCH 1/4] MISC: add config options to disable some root only features Signed-off-by: Paliak <91493239+Paliak@users.noreply.github.com> --- configure.ac | 33 +++++++++++++++++++++++++++++++++ src/fping.c | 6 +++--- src/socket4.c | 15 +++++++++++---- src/socket6.c | 28 ++++++++++++++++++---------- 4 files changed, 65 insertions(+), 17 deletions(-) diff --git a/configure.ac b/configure.ac index b17f3bb9..4bfae14a 100644 --- a/configure.ac +++ b/configure.ac @@ -104,6 +104,39 @@ AC_ARG_ENABLE([debug], AS_IF([test "x$enable_debug" = "xyes"], [ AC_DEFINE([DEBUG], [1], [Define if debugging is enabled])]) +AC_ARG_ENABLE([raw-sockets], + AS_HELP_STRING([--disable-raw-sockets], [Disable use of raw sockets]), + [], [enable_raw_sockets=yes]) +AS_IF([test "x$enable_raw_sockets" = "xyes"], [ + AC_DEFINE([USE_RAWSOCKET], [1], [Enable use of raw sockets]) +]) + +dnl Check for SOCK_DGRAM support +AC_CHECK_HEADERS([sys/socket.h]) +AC_CHECK_DECL([SOCK_DGRAM], + [have_sock_dgram=yes], + [have_sock_dgram=no], + [#include ]) + +if test "x$have_sock_dgram" = "xyes"; then + AC_ARG_ENABLE([raw-sockets], + AS_HELP_STRING([--disable-raw-sockets], [Disable use of raw sockets]), + [], [enable_raw_sockets=yes]) + AS_IF([test "x$enable_raw_sockets" = "xyes"], [ + AC_DEFINE([USE_RAWSOCKET], [1], [Enable use of raw sockets]) + ]) +else + AC_DEFINE([USE_RAWSOCKET], [1], [Enable use of raw sockets]) + AC_MSG_NOTICE([SOCK_DGRAM support missing; --disable-raw-sockets ignored]) +fi + +AC_ARG_ENABLE([fwmark], + AS_HELP_STRING([--disable-fwmark], [Disable use of SO_MARK / fwmark]), + [], [enable_fwmark=yes]) +AS_IF([test "x$enable_fwmark" = "xyes"], [ + AC_DEFINE([USE_SO_MARK], [1], [Enable use of fwmark (SO_MARK)]) +]) + AM_INIT_AUTOMAKE([-Wall -Werror foreign]) AM_MAINTAINER_MODE diff --git a/src/fping.c b/src/fping.c index 83c806b9..11545d20 100644 --- a/src/fping.c +++ b/src/fping.c @@ -508,7 +508,7 @@ int main(int argc, char **argv) { "oiface", 0, OPTPARSE_REQUIRED }, { "json", 'J', OPTPARSE_NONE }, { "icmp-timestamp", 0, OPTPARSE_NONE }, -#ifdef SO_MARK +#if defined(SO_MARK) && defined(USE_SO_MARK) { "fwmark", 'k', OPTPARSE_REQUIRED }, #endif { "loop", 'l', OPTPARSE_NONE }, @@ -824,7 +824,7 @@ int main(int argc, char **argv) case 'f': filename = optparse_state.optarg; break; -#ifdef SO_MARK +#if defined(SO_MARK) && defined(USE_SO_MARK) case 'k': fwmark = (unsigned int)strtoul_strict(optparse_state.optarg, 10); if (!fwmark) @@ -3100,7 +3100,7 @@ void usage(int is_error) #ifdef IP_PKTINFO fprintf(out, " --oiface=IFACE send pings via a specific outgoing interface (receive from any)\n"); #endif -#ifdef SO_MARK +#if defined(SO_MARK) && defined(USE_SO_MARK) fprintf(out, " -k, --fwmark=FWMARK set the routing mark\n"); #endif fprintf(out, " -l, --loop loop mode: send pings forever\n"); diff --git a/src/socket4.c b/src/socket4.c index cb986e22..8d522817 100644 --- a/src/socket4.c +++ b/src/socket4.c @@ -66,17 +66,24 @@ int open_ping_socket_ipv4(int *socktype) if ((proto = getprotobyname("icmp")) == NULL) crash_and_burn("icmp: unknown protocol"); +#ifdef USE_RAWSOCKET /* create raw socket for ICMP calls (ping) */ *socktype = SOCK_RAW; - s = socket(AF_INET, *socktype, proto->p_proto); - if (s < 0) { + if ((s = socket(AF_INET, *socktype, proto->p_proto)) < 0) +#endif +#ifdef SOCK_DGRAM + { /* try non-privileged icmp (works on Mac OSX without privileges, for example) */ *socktype = SOCK_DGRAM; - s = socket(AF_INET, *socktype, proto->p_proto); - if (s < 0) { + if ((s = socket(AF_INET, *socktype, proto->p_proto)) < 0) { return -1; } } +#else + { + return -1; + } +#endif /* Make sure that we use non-blocking IO */ { diff --git a/src/socket6.c b/src/socket6.c index ab6e199f..9347b4f3 100644 --- a/src/socket6.c +++ b/src/socket6.c @@ -64,18 +64,12 @@ int open_ping_socket_ipv6(int *socktype) if ((proto = getprotobyname("ipv6-icmp")) == NULL) crash_and_burn("ipv6-icmp: unknown protocol"); +#ifdef USE_RAWSOCKET /* create raw socket for ICMP6 calls (ping) */ *socktype = SOCK_RAW; - s = socket(AF_INET6, *socktype, proto->p_proto); - if (s < 0) { - /* try non-privileged icmp6 (works on Mac OSX without privileges, for example) */ - *socktype = SOCK_DGRAM; - s = socket(AF_INET6, *socktype, proto->p_proto); - if (s < 0) { - return -1; - } - } else { - /* receive only ICMP6 messages relevant for fping on raw socket */ + if ((s = socket(AF_INET6, *socktype, proto->p_proto)) > -1 ) + { + /* receive only ICMP6 messages relevant for fping on raw socket */ struct icmp6_filter recv_filter; ICMP6_FILTER_SETBLOCKALL(&recv_filter); @@ -88,7 +82,21 @@ int open_ping_socket_ipv6(int *socktype) if (setsockopt(s, IPPROTO_ICMPV6, ICMP6_FILTER, &recv_filter, sizeof(recv_filter))) { errno_crash_and_burn("cannot set icmp6 message type filter"); } + } else +#endif +#ifdef SOCK_DGRAM + { + /* try non-privileged icmp6 (works on Mac OSX without privileges, for example) */ + *socktype = SOCK_DGRAM; + if ((s = socket(AF_INET6, *socktype, proto->p_proto)) < 0) { + return -1; + } + } +#else + { + return -1; } +#endif /* Make sure that we use non-blocking IO */ { From 12ad25335b1a3fea0615f1c979a3db9b7349164d Mon Sep 17 00:00:00 2001 From: Paliak <91493239+Paliak@users.noreply.github.com> Date: Sun, 17 May 2026 20:40:00 +0200 Subject: [PATCH 2/4] FIX: duplicate option to disable raw sockets --- configure.ac | 7 ------- 1 file changed, 7 deletions(-) diff --git a/configure.ac b/configure.ac index 4bfae14a..d61df533 100644 --- a/configure.ac +++ b/configure.ac @@ -104,13 +104,6 @@ AC_ARG_ENABLE([debug], AS_IF([test "x$enable_debug" = "xyes"], [ AC_DEFINE([DEBUG], [1], [Define if debugging is enabled])]) -AC_ARG_ENABLE([raw-sockets], - AS_HELP_STRING([--disable-raw-sockets], [Disable use of raw sockets]), - [], [enable_raw_sockets=yes]) -AS_IF([test "x$enable_raw_sockets" = "xyes"], [ - AC_DEFINE([USE_RAWSOCKET], [1], [Enable use of raw sockets]) -]) - dnl Check for SOCK_DGRAM support AC_CHECK_HEADERS([sys/socket.h]) AC_CHECK_DECL([SOCK_DGRAM], From 08d9db0d2d4c13a7e2b4136a88b3f86908d82b55 Mon Sep 17 00:00:00 2001 From: Paliak <91493239+Paliak@users.noreply.github.com> Date: Sun, 17 May 2026 20:43:21 +0200 Subject: [PATCH 3/4] FIX: improve readability --- src/socket4.c | 18 +++++++++--------- src/socket6.c | 22 +++++++++++----------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/src/socket4.c b/src/socket4.c index 8d522817..fe4229d0 100644 --- a/src/socket4.c +++ b/src/socket4.c @@ -60,7 +60,7 @@ static int outgoing_src_addr_set_ipv4 = 0; int open_ping_socket_ipv4(int *socktype) { struct protoent* proto; - int s; + int s = -1; /* confirm that ICMP is available on this machine */ if ((proto = getprotobyname("icmp")) == NULL) @@ -69,21 +69,21 @@ int open_ping_socket_ipv4(int *socktype) #ifdef USE_RAWSOCKET /* create raw socket for ICMP calls (ping) */ *socktype = SOCK_RAW; - if ((s = socket(AF_INET, *socktype, proto->p_proto)) < 0) + s = socket(AF_INET, *socktype, proto->p_proto); #endif + #ifdef SOCK_DGRAM - { + if (s < 0) { /* try non-privileged icmp (works on Mac OSX without privileges, for example) */ *socktype = SOCK_DGRAM; - if ((s = socket(AF_INET, *socktype, proto->p_proto)) < 0) { - return -1; - } + s = socket(AF_INET, *socktype, proto->p_proto); } -#else - { +#endif + + if (s < 0) { return -1; } -#endif + /* Make sure that we use non-blocking IO */ { diff --git a/src/socket6.c b/src/socket6.c index 9347b4f3..5835b8da 100644 --- a/src/socket6.c +++ b/src/socket6.c @@ -58,7 +58,7 @@ static int outgoing_src_addr_set_ipv6 = 0; int open_ping_socket_ipv6(int *socktype) { struct protoent* proto; - int s; + int s = -1; /* confirm that ICMP6 is available on this machine */ if ((proto = getprotobyname("ipv6-icmp")) == NULL) @@ -67,8 +67,8 @@ int open_ping_socket_ipv6(int *socktype) #ifdef USE_RAWSOCKET /* create raw socket for ICMP6 calls (ping) */ *socktype = SOCK_RAW; - if ((s = socket(AF_INET6, *socktype, proto->p_proto)) > -1 ) - { + s = socket(AF_INET6, *socktype, proto->p_proto); + if (s > -1) { /* receive only ICMP6 messages relevant for fping on raw socket */ struct icmp6_filter recv_filter; @@ -82,21 +82,21 @@ int open_ping_socket_ipv6(int *socktype) if (setsockopt(s, IPPROTO_ICMPV6, ICMP6_FILTER, &recv_filter, sizeof(recv_filter))) { errno_crash_and_burn("cannot set icmp6 message type filter"); } - } else + } #endif + #ifdef SOCK_DGRAM - { + if (s < 0) { /* try non-privileged icmp6 (works on Mac OSX without privileges, for example) */ *socktype = SOCK_DGRAM; - if ((s = socket(AF_INET6, *socktype, proto->p_proto)) < 0) { - return -1; - } + s = socket(AF_INET6, *socktype, proto->p_proto); } -#else - { +#endif + + if (s < 0) { return -1; } -#endif + /* Make sure that we use non-blocking IO */ { From 3f1ca313d5e055a619affd3080082fae24962352 Mon Sep 17 00:00:00 2001 From: Paliak <91493239+Paliak@users.noreply.github.com> Date: Sun, 17 May 2026 20:56:10 +0200 Subject: [PATCH 4/4] FIX: formatting and use a more idiomatic socket validity check. Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- src/socket6.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/socket6.c b/src/socket6.c index 5835b8da..cc2e41bf 100644 --- a/src/socket6.c +++ b/src/socket6.c @@ -67,9 +67,9 @@ int open_ping_socket_ipv6(int *socktype) #ifdef USE_RAWSOCKET /* create raw socket for ICMP6 calls (ping) */ *socktype = SOCK_RAW; - s = socket(AF_INET6, *socktype, proto->p_proto); - if (s > -1) { - /* receive only ICMP6 messages relevant for fping on raw socket */ + s = socket(AF_INET6, *socktype, proto->p_proto); + if (s >= 0) { + /* receive only ICMP6 messages relevant for fping on raw socket */ struct icmp6_filter recv_filter; ICMP6_FILTER_SETBLOCKALL(&recv_filter);