commit 7640e72a319905446456ed4892e25989da72c263
author Lukas Tribus <luky-37@hotmail.com> Mon Mar 03 21:10:51 2014 +0100
committer Willy Tarreau <w@1wt.eu> Mon Mar 03 21:31:10 2014 +0100
tree cbebfb192cf8ca6151a266ed3f50e3b2499938a6
parent 583021306b34b9860e61b60d4e026b563a04a019

MINOR: set IP_FREEBIND on IPv6 sockets in transparent mode

Lets set IP_FREEBIND on IPv6 sockets as well, this works since Linux 3.3
and doesn't require CAP_NET_ADMIN privileges (IPV6_TRANSPARENT does).

This allows unprivileged users to bind to non-local IPv6 addresses, which
can be useful when setting up the listening sockets or when connecting
to backend servers with a specific, non-local source IPv6 address (at that
point we usually dropped root privileges already).

src/proto_tcp.c

diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 11f6331..2b12ef8 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -160,6 +160,9 @@
 #if defined(IPV6_TRANSPARENT)
 			    || (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
 #endif
+#if defined(IP_FREEBIND)
+			    || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
+#endif
 #if defined(IPV6_BINDANY)
 			    || (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == 0)
 #endif
@@ -787,6 +790,9 @@
 #if defined(IPV6_TRANSPARENT)
 			    && (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1)
 #endif
+#if defined(IP_FREEBIND)
+			    && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
+#endif
 #if defined(IPV6_BINDANY)
 			    && (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == -1)
 #endif