20 files changed, 721 insertions, 148 deletions

diff --git a/Makefile b/Makefile
index 27d635d..9a09e7b 100644
--- a/Makefile
+++ b/Makefile
@@ -68,36 +68,50 @@ CFLAGS+=-I$(LIBOWFAT_HEADERS) -DGIT_VERSION=$(GIT_VERSION) -Wall -pipe -pthread
 LDFLAGS+=-L$(LIBOWFAT_LIBRARY) -lowfat -pthread
 
 BINARY =opentracker
-HEADERS=trackerlogic.h scan_urlencoded_query.h ot_buf.h ot_hex.h ot_ip.h ot_scan.h ot_mutex.h ot_random.h ot_stats.h ot_vector.h ot_clean.h ot_udp.h ot_iovec.h ot_fullscrape.h ot_accesslist.h ot_http.h ot_livesync.h ot_rijndael.h
-SOURCES=opentracker.c trackerlogic.c scan_urlencoded_query.c ot_buf.c ot_hex.c ot_ip.c ot_scan.c ot_mutex.c ot_random.c ot_stats.c ot_vector.c ot_clean.c ot_udp.c ot_iovec.c ot_fullscrape.c ot_accesslist.c ot_http.c ot_livesync.c ot_rijndael.c
-SOURCES_proxy=proxy.c ot_vector.c ot_mutex.c ot_random.c ot_scan.c ot_ip.c
+HEADERS=trackerlogic.h scan_urlencoded_query.h ot_buf.h ot_hex.h ot_ip.h ot_scan.h ot_socket.h ot_mutex.h ot_random.h ot_stats.h ot_vector.h ot_clean.h ot_udp.h ot_iovec.h ot_fullscrape.h ot_accesslist.h ot_http.h ot_livesync.h ot_rijndael.h
+SOURCES=opentracker.c trackerlogic.c scan_urlencoded_query.c ot_buf.c ot_hex.c ot_ip.c ot_scan.c ot_socket.c ot_mutex.c ot_random.c ot_stats.c ot_vector.c ot_clean.c ot_udp.c ot_iovec.c ot_fullscrape.c ot_accesslist.c ot_http.c ot_livesync.c ot_rijndael.c
+SOURCES_proxy=proxy.c ot_vector.c ot_mutex.c ot_random.c ot_scan.c ot_ip.c ot_socket.c
 
 OBJECTS = $(SOURCES:%.c=%.o)
 OBJECTS_debug = $(SOURCES:%.c=%.debug.o)
-OBJECTS_proxy = $(SOURCES_proxy:%.c=%.o)
-OBJECTS_proxy_debug = $(SOURCES_proxy:%.c=%.debug.o)
+OBJECTS_proxy = $(SOURCES_proxy:%.c=%.proxy.o)
+OBJECTS_proxy_debug = $(SOURCES_proxy:%.c=%.proxy.debug.o)
 
-.SUFFIXES: .debug.o .o .c
+.SUFFIXES: .proxy.debug.o .proxy.o .debug.o .o .c
 
 all: $(BINARY) $(BINARY).debug
 
 CFLAGS_production = $(CFLAGS) $(OPTS_production) $(FEATURES)
 CFLAGS_debug = $(CFLAGS) $(OPTS_debug) $(FEATURES)
 
-$(BINARY): $(OBJECTS) $(HEADERS)
+CFLAGS_proxy = $(CFLAGS_production) -DWANT_SYNC_LIVE
+CFLAGS_proxy_debug = $(CFLAGS_debug) -DWANT_SYNC_LIVE
+
+$(BINARY): $(OBJECTS)
         $(CC) -o $@ $(OBJECTS) $(LDFLAGS)
         $(STRIP) $@
-$(BINARY).debug: $(OBJECTS_debug) $(HEADERS)
+$(BINARY).debug: $(OBJECTS_debug)
         $(CC) -o $@ $(OBJECTS_debug) $(LDFLAGS)
-proxy: $(OBJECTS_proxy) $(HEADERS)
+proxy: $(OBJECTS_proxy)
         $(CC) -o $@ $(OBJECTS_proxy) $(CFLAGS_production) $(LDFLAGS)
-proxy.debug: $(OBJECTS_proxy_debug) $(HEADERS)
+proxy.debug: $(OBJECTS_proxy_debug)
         $(CC) -o $@ $(OBJECTS_proxy_debug) $(LDFLAGS)
 
-.c.debug.o : $(HEADERS)
+$(OBJECTS): $(HEADERS)
+$(OBJECTS_debug): $(HEADERS)
+$(OBJECTS_proxy): $(HEADERS)
+$(OBJECTS_proxy_debug): $(HEADERS)
+
+.c.proxy.debug.o :
+        $(CC) -c -o $@ $(CFLAGS_proxy_debug) $(<:.proxy.debug.o=.c)
+
+.c.proxy.o :
+        $(CC) -c -o $@ $(CFLAGS_proxy) $(<:.proxy.o=.c)
+
+.c.debug.o :
         $(CC) -c -o $@ $(CFLAGS_debug) $(<:.debug.o=.c)
 
-.c.o : $(HEADERS)
+.c.o :
         $(CC) -c -o $@ $(CFLAGS_production) $<
 
 # Unit tests. The modules under test are compiled straight into the test
@@ -105,12 +119,12 @@ proxy.debug: $(OBJECTS_proxy_debug) $(HEADERS)
 # has to. tests/stubs.c supplies the few symbols those modules reference but
 # the tests never reach.
 TESTBIN=tests/runner
-TEST_SOURCES=tests/runner.c tests/test.c tests/stubs.c tests/t_scan_urlencoded_query.c tests/t_iovec.c tests/t_vector.c tests/t_random.c tests/t_hex.c tests/t_accesslist.c tests/t_scan.c tests/t_buf.c tests/t_ip.c
-TEST_UNITS=scan_urlencoded_query.c ot_buf.c ot_ip.c ot_iovec.c ot_vector.c ot_random.c ot_hex.c ot_scan.c ot_accesslist.c
+TEST_SOURCES=tests/runner.c tests/test.c tests/stubs.c tests/t_scan_urlencoded_query.c tests/t_iovec.c tests/t_vector.c tests/t_random.c tests/t_hex.c tests/t_accesslist.c tests/t_scan.c tests/t_buf.c tests/t_ip.c tests/t_socket.c
+TEST_UNITS=scan_urlencoded_query.c ot_buf.c ot_ip.c ot_socket.c ot_iovec.c ot_vector.c ot_random.c ot_hex.c ot_scan.c ot_accesslist.c
 TEST_HEADERS=tests/test.h $(HEADERS)
 # Tests reach code that sits behind feature flags, so the units under test are
 # built with those features enabled. A test binary is not a production binary.
-FEATURES_test=$(FEATURES) -DWANT_ACCESSLIST_BLACK
+FEATURES_test=$(FEATURES) -DWANT_ACCESSLIST_BLACK -DWANT_SYNC_LIVE
 CFLAGS_test = $(CFLAGS) -I. -g -O1 $(FEATURES_test)
 
 $(TESTBIN): $(TEST_SOURCES) $(TEST_UNITS) $(TEST_HEADERS)
@@ -122,7 +136,7 @@ check: $(TESTBIN)
 .PHONY: all check clean install
 
 clean:
-        rm -rf opentracker opentracker.debug $(TESTBIN) *.o *~
+        rm -rf opentracker opentracker.debug proxy proxy.debug $(TESTBIN) *.o *~
 
 install:
         install -m 755 opentracker $(DESTDIR)$(BINDIR)
diff --git a/opentracker.c b/opentracker.c
index af336aa..5b197d1 100644
--- a/opentracker.c
+++ b/opentracker.c
@@ -24,7 +24,6 @@
 /* Libowfat */
 #include "io.h"
 #include "iob.h"
-#include "socket.h"
 
 /* Opentracker */
 #include "ot_accesslist.h"
@@ -35,6 +34,7 @@
 #include "ot_mutex.h"
 #include "ot_random.h"
 #include "ot_scan.h"
+#include "ot_socket.h"
 #include "ot_stats.h"
 #include "ot_udp.h"
 #include "trackerlogic.h"
@@ -254,10 +254,10 @@ static void handle_accept(const int64_t serversocket) {
   struct http_data *cookie;
   int64_t           sock;
   ot_ip6            ip;
-  uint16            port;
+  uint16_t          port;
   tai6464           t;
 
-  while ((sock = socket_accept6(serversocket, ip, &port, NULL)) != -1) {
+  while ((sock = socket_accept(serversocket, ip, &port)) != -1) {
 
     /* Put fd into a non-blocking mode */
     io_nonblock(sock);
@@ -339,7 +339,7 @@ static void *server_mainloop(void *args) {
 }
 
 static int64_t ot_try_bind(ot_ip6 ip, uint16_t port, PROTO_FLAG proto) {
-  int64_t sock = proto == FLAG_TCP ? socket_tcp6() : socket_udp6();
+  int64_t sock;
 
 #ifdef _DEBUG
   {
@@ -352,11 +352,13 @@ static int64_t ot_try_bind(ot_ip6 ip, uint16_t port, PROTO_FLAG proto) {
   }
 #endif
 
-  if (socket_bind6_reuse(sock, ip, port, 0) == -1)
-    panic("socket_bind6_reuse");
-
-  if ((proto == FLAG_TCP) && (socket_listen(sock, SOMAXCONN) == -1))
-    panic("socket_listen");
+  if (proto == FLAG_TCP) {
+    if ((sock = socket_tcp_listen(ip, port)) == -1)
+      panic("socket_tcp_listen");
+  } else {
+    if ((sock = socket_udp_bind(ip, port)) == -1)
+      panic("socket_udp_bind");
+  }
 
   if (!io_fd(sock))
     panic("io_fd");
@@ -450,6 +452,7 @@ typedef enum {
     CONFIG_LISTEN_TCP,
     CONFIG_LISTEN_UDP,
     CONFIG_LISTEN_UDP_WORKERS,
+    CONFIG_LISTEN_REUSEPORT,
     CONFIG_ACCESS_WHITELIST,
     CONFIG_ACCESS_BLACKLIST,
     CONFIG_ACCESS_FIFO_ADD,
@@ -477,6 +480,7 @@ static const config_key config_keys[] = {
     CONFIG_KEY("listen.tcp",               CONFIG_LISTEN_TCP),
     CONFIG_KEY("listen.udp",               CONFIG_LISTEN_UDP),
     CONFIG_KEY("listen.udp.workers",       CONFIG_LISTEN_UDP_WORKERS),
+    CONFIG_KEY("listen.reuseport",         CONFIG_LISTEN_REUSEPORT),
 #ifdef WANT_ACCESSLIST_WHITE
     CONFIG_KEY("access.whitelist",         CONFIG_ACCESS_WHITELIST),
 #elif defined(WANT_ACCESSLIST_BLACK)
@@ -582,6 +586,13 @@ int parse_configfile(char *config_filename) {
         if (scan_udec(p, &value, UINT_MAX))
           g_udp_workers = (unsigned int)value;
         break;
+      case CONFIG_LISTEN_REUSEPORT:
+        /* Like listen.udp.workers this is read when a socket is bound, so it
+           has to come before the listen lines it should apply to. */
+        if (!scan_udec(p, &value, 1))
+          goto parse_error;
+        g_socket_reuseport = (int)value;
+        break;
 #ifdef WANT_ACCESSLIST_WHITE
       case CONFIG_ACCESS_WHITELIST:
         set_config_option(&g_accesslist_filename, p);
diff --git a/ot_clean.h b/ot_clean.h
index e8bcdc1..1484d82 100644
--- a/ot_clean.h
+++ b/ot_clean.h
@@ -6,6 +6,8 @@
 #ifndef OT_CLEAN_H__
 #define OT_CLEAN_H__
 
+#include "trackerlogic.h"
+
 /* The amount of time a clean cycle should take */
 #define OT_CLEAN_INTERVAL_MINUTES 2
 
diff --git a/ot_http.h b/ot_http.h
index 004d710..965820f 100644
--- a/ot_http.h
+++ b/ot_http.h
@@ -6,7 +6,15 @@
 #ifndef OT_HTTP_H__
 #define OT_HTTP_H__
 
+#include <stdint.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+
+/* Libowfat */
+#include "iob.h"
+
 #include "ot_buf.h"
+#include "trackerlogic.h"
 
 typedef enum {
   STRUCT_HTTP_FLAG_WAITINGFORTASK      = 1,
diff --git a/ot_iovec.c b/ot_iovec.c
index bab19e3..cd5b9f9 100644
--- a/ot_iovec.c
+++ b/ot_iovec.c
@@ -20,6 +20,8 @@ void *iovec_increase(size_t *iovec_entries, struct iovec **iovector, size_t new_
   if (!new_vec)
     return NULL;
 
+  *iovector  = new_vec;
+
   /* Only allocate after we have a place to store the pointer */
   new_data = malloc(new_alloc);
   if (!new_data)
@@ -28,7 +30,6 @@ void *iovec_increase(size_t *iovec_entries, struct iovec **iovector, size_t new_
   new_vec[new_entries - 1].iov_base = new_data;
   new_vec[new_entries - 1].iov_len  = new_alloc;
 
-  *iovector                         = new_vec;
   ++*iovec_entries;
   return new_data;
 }
diff --git a/ot_livesync.c b/ot_livesync.c
index 8b2dee6..5a63f3c 100644
--- a/ot_livesync.c
+++ b/ot_livesync.c
@@ -5,19 +5,16 @@
 
 /* System */
 #include <arpa/inet.h>
-#include <fcntl.h>
 #include <pthread.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/types.h>
 #include <unistd.h>
 
-/* Libowfat */
-#include "socket.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_ip.h"
+#include "ot_socket.h"
 #include "ot_livesync.h"
 #include "ot_mutex.h"
 #include "ot_stats.h"
@@ -25,7 +22,7 @@
 
 #ifdef WANT_SYNC_LIVE
 
-char groupip_1[4] = {224, 0, 23, 5};
+ot_ip6 groupip_1 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 224, 0, 23, 5};
 
 #define LIVESYNC_INCOMING_BUFFSIZE        (256 * 256)
 
@@ -39,11 +36,11 @@ enum { OT_SYNC_PEER4, OT_SYNC_PEER6 };
 /* Forward declaration */
 static void           *livesync_worker(void *args);
 
-/* For outgoing packets */
-static int64_t         g_socket_in    = -1;
-
 /* For incoming packets */
-static int64_t         g_socket_out   = -1;
+static int             g_socket_in    = -1;
+
+/* For outgoing packets */
+static int             g_socket_out   = -1;
 
 static pthread_mutex_t g_outbuf_mutex = PTHREAD_MUTEX_INITIALIZER;
 typedef struct {
@@ -89,34 +86,17 @@ void livesync_deinit(void) {
 }
 
 void livesync_bind_mcast(ot_ip6 ip, uint16_t port) {
-  char  tmpip[4] = {0, 0, 0, 0};
-  char *v4ip;
-
   if (!ip_is_v4mapped(ip))
     exerr("v6 mcast support not yet available.");
-  v4ip = ip + 12;
 
   if (g_socket_in != -1)
     exerr("Error: Livesync listen ip specified twice.");
 
-  if ((g_socket_in = socket_udp4()) < 0)
-    exerr("Error: Cant create live sync incoming socket.");
-
-  fcntl(g_socket_in, F_SETFL, fcntl(g_socket_in, F_GETFL, 0) & ~O_NONBLOCK);
-
-  if (socket_bind4_reuse(g_socket_in, tmpip, port) == -1)
+  if ((g_socket_in = socket_mcast_join(groupip_1, ip, port)) == -1)
     exerr("Error: Cant bind live sync incoming socket.");
 
-  if (socket_mcjoin4(g_socket_in, groupip_1, v4ip))
-    exerr("Error: Cant make live sync incoming socket join mcast group.");
-
-  if ((g_socket_out = socket_udp4()) < 0)
-    exerr("Error: Cant create live sync outgoing socket.");
-  if (socket_bind4_reuse(g_socket_out, v4ip, port) == -1)
+  if ((g_socket_out = socket_mcast_bind(ip, port, 0)) == -1)
     exerr("Error: Cant bind live sync outgoing socket.");
-
-  socket_mcttl4(g_socket_out, 1);
-  socket_mcloop4(g_socket_out, 0);
 }
 
 /* Caller MUST hold g_outbuf_mutex. Returns with g_outbuf_mutex unlocked */
@@ -132,7 +112,7 @@ static void livesync_issue_peersync(sync_buffer *buf) {
      has modified the protected element */
   pthread_mutex_unlock(&g_outbuf_mutex);
 
-  socket_send4(g_socket_out, mycopy, fill, groupip_1, LIVESYNC_PORT);
+  socket_mcast_send(g_socket_out, mycopy, fill, groupip_1, LIVESYNC_PORT);
 }
 
 static void livesync_handle_peersync(struct ot_workstruct *ws, size_t peer_size) {
@@ -215,12 +195,10 @@ static void *livesync_worker(void *args) {
   ws.inbuf = ws.request = malloc(LIVESYNC_INCOMING_BUFFSIZE);
   ws.outbuf = ws.reply = 0;
 
-  memcpy(in_ip, ip_v4mapped_prefix, sizeof(ip_v4mapped_prefix));
-
   while (1) {
     uint32_t packet_type;
 
-    ws.request_size = socket_recv4(g_socket_in, (char *)ws.inbuf, LIVESYNC_INCOMING_BUFFSIZE, 12 + (char *)in_ip, &in_port);
+    ws.request_size = socket_recv(g_socket_in, ws.inbuf, LIVESYNC_INCOMING_BUFFSIZE, in_ip, &in_port);
 
     /* Expect at least tracker id and packet type */
     if (ws.request_size <= (ssize_t)(sizeof(g_tracker_id) + sizeof(uint32_t)))
diff --git a/ot_livesync.h b/ot_livesync.h
index 6eca479..5b9fa0e 100644
--- a/ot_livesync.h
+++ b/ot_livesync.h
@@ -51,7 +51,7 @@ void livesync_init(void);
 void livesync_deinit(void);
 
 /* Join multicast group for listening and create sending socket */
-void livesync_bind_mcast(char *ip, uint16_t port);
+void livesync_bind_mcast(ot_ip6 ip, uint16_t port);
 
 /* Inform live sync about whats going on. */
 void livesync_tell(struct ot_workstruct *ws);
diff --git a/ot_socket.c b/ot_socket.c
new file mode 100644
index 0000000..e26ad52
--- /dev/null
+++ b/ot_socket.c
@@ -0,0 +1,256 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+/* Opentracker */
+#include "ot_ip.h"
+#include "ot_socket.h"
+
+int g_socket_reuseport;
+
+static void sockaddr_from_ip(struct sockaddr_in6 *sa, const ot_ip6 ip, uint16_t port) {
+  memset(sa, 0, sizeof(*sa));
+  sa->sin6_family = AF_INET6;
+  sa->sin6_port   = htons(port);
+  memcpy(&sa->sin6_addr, ip, sizeof(ot_ip6));
+}
+
+/* Linux reports an IPv4 peer on a dual stack socket as a v4 mapped
+   sockaddr_in6, the BSDs and macOS hand back a plain sockaddr_in instead, so
+   both forms have to be read. */
+static void ip_from_sockaddr(ot_ip6 ip, uint16_t *port, const struct sockaddr_storage *ss) {
+  if (ss->ss_family == AF_INET) {
+    const struct sockaddr_in *sa = (const struct sockaddr_in *)ss;
+
+    memcpy(ip, ip_v4mapped_prefix, sizeof(ip_v4mapped_prefix));
+    memcpy(ip + sizeof(ip_v4mapped_prefix), &sa->sin_addr, 4);
+    *port = ntohs(sa->sin_port);
+  } else {
+    const struct sockaddr_in6 *sa = (const struct sockaddr_in6 *)ss;
+
+    memcpy(ip, &sa->sin6_addr, sizeof(ot_ip6));
+    *port = ntohs(sa->sin6_port);
+  }
+}
+
+static int set_nonblocking(int s) {
+  int flags = fcntl(s, F_GETFL, 0);
+
+  if (flags == -1)
+    return -1;
+  return fcntl(s, F_SETFL, flags | O_NONBLOCK);
+}
+
+/* Close without letting the failure we are about to report be overwritten */
+static int close_and_fail(int s) {
+  int saved = errno;
+  close(s);
+  errno = saved;
+  return -1;
+}
+
+static int socket_v6(int type) {
+  int s = socket(PF_INET6, type, 0);
+  int zero = 0;
+
+  if (s == -1)
+    return -1;
+
+  /* A tracker that answered only one family would be half a tracker */
+  if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &zero, sizeof(zero)) == -1)
+    return close_and_fail(s);
+
+  if (set_nonblocking(s) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+static int socket_bind_v6(int s, const ot_ip6 ip, uint16_t port) {
+  struct sockaddr_in6 sa;
+  int                 one = 1;
+
+  setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+#ifdef SO_REUSEPORT
+  if (g_socket_reuseport)
+    setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
+#endif
+
+  sockaddr_from_ip(&sa, ip, port);
+  return bind(s, (struct sockaddr *)&sa, sizeof(sa));
+}
+
+int socket_tcp_listen(const ot_ip6 ip, uint16_t port) {
+  int s = socket_v6(SOCK_STREAM);
+
+  if (s == -1)
+    return -1;
+  if (socket_bind_v6(s, ip, port) == -1 || listen(s, SOMAXCONN) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+int socket_udp_bind(const ot_ip6 ip, uint16_t port) {
+  int s = socket_v6(SOCK_DGRAM);
+
+  if (s == -1)
+    return -1;
+  if (socket_bind_v6(s, ip, port) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+int socket_tcp_connect(const ot_ip6 srcip, uint16_t srcport, const ot_ip6 dstip, uint16_t dstport) {
+  struct sockaddr_in6 sa;
+  int                 s = socket_v6(SOCK_STREAM);
+
+  if (s == -1)
+    return -1;
+  if (socket_bind_v6(s, srcip, srcport) == -1)
+    return close_and_fail(s);
+
+  sockaddr_from_ip(&sa, dstip, dstport);
+  if (connect(s, (struct sockaddr *)&sa, sizeof(sa)) == -1 && errno != EINPROGRESS && errno != EWOULDBLOCK)
+    return close_and_fail(s);
+
+  return s;
+}
+
+int socket_is_connected(int s) {
+  int       error = 0;
+  socklen_t len   = sizeof(error);
+
+  if (getsockopt(s, SOL_SOCKET, SO_ERROR, &error, &len) == -1)
+    return 0;
+  if (error) {
+    errno = error;
+    return 0;
+  }
+  return 1;
+}
+
+int socket_accept(int s, ot_ip6 ip, uint16_t *port) {
+  struct sockaddr_storage ss;
+  socklen_t               len = sizeof(ss);
+  int                     fd;
+
+  memset(&ss, 0, sizeof(ss));
+  if ((fd = accept(s, (struct sockaddr *)&ss, &len)) == -1)
+    return -1;
+
+  /* Linux hands over a blocking socket whatever the listening socket was, the
+     BSDs and macOS inherit the listener's flags, so say which one we want. */
+  if (set_nonblocking(fd) == -1)
+    return close_and_fail(fd);
+
+  ip_from_sockaddr(ip, port, &ss);
+  return fd;
+}
+
+ssize_t socket_recv(int s, void *buf, size_t len, ot_ip6 ip, uint16_t *port) {
+  struct sockaddr_storage ss;
+  socklen_t               sslen = sizeof(ss);
+  ssize_t                 received;
+
+  memset(&ss, 0, sizeof(ss));
+  received = recvfrom(s, buf, len, 0, (struct sockaddr *)&ss, &sslen);
+  if (received == -1)
+    return -1;
+
+  ip_from_sockaddr(ip, port, &ss);
+  return received;
+}
+
+ssize_t socket_send(int s, const void *buf, size_t len, const ot_ip6 ip, uint16_t port) {
+  struct sockaddr_in6 sa;
+
+  sockaddr_from_ip(&sa, ip, port);
+  return sendto(s, buf, len, 0, (struct sockaddr *)&sa, sizeof(sa));
+}
+
+#ifdef WANT_SYNC_LIVE
+static void sockaddr4_from_ip(struct sockaddr_in *sa, const ot_ip6 ip, uint16_t port) {
+  memset(sa, 0, sizeof(*sa));
+  sa->sin_family = AF_INET;
+  sa->sin_port   = htons(port);
+  memcpy(&sa->sin_addr, ip + sizeof(ip_v4mapped_prefix), 4);
+}
+
+static int socket_v4_bind(const ot_ip6 ip, uint16_t port) {
+  struct sockaddr_in sa;
+  int                s, one = 1;
+
+  if ((s = socket(PF_INET, SOCK_DGRAM, 0)) == -1)
+    return -1;
+
+  setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+#ifdef SO_REUSEPORT
+  if (g_socket_reuseport)
+    setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
+#endif
+
+  sockaddr4_from_ip(&sa, ip, port);
+  if (bind(s, (struct sockaddr *)&sa, sizeof(sa)) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+int socket_mcast_join(const ot_ip6 group, const ot_ip6 interface, uint16_t port) {
+  struct ip_mreq mreq;
+  ot_ip6         any;
+  int            s;
+
+  /* The group is what is listened to, so the socket takes the wildcard and
+     the join names the interface to receive it on */
+  memcpy(any, ip_v4mapped_prefix, sizeof(ip_v4mapped_prefix));
+  memset(any + sizeof(ip_v4mapped_prefix), 0, 4);
+
+  if ((s = socket_v4_bind(any, port)) == -1)
+    return -1;
+
+  memset(&mreq, 0, sizeof(mreq));
+  memcpy(&mreq.imr_multiaddr, group + sizeof(ip_v4mapped_prefix), 4);
+  memcpy(&mreq.imr_interface, interface + sizeof(ip_v4mapped_prefix), 4);
+  if (setsockopt(s, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+int socket_mcast_bind(const ot_ip6 interface, uint16_t port, int loopback) {
+  /* The BSDs and macOS want a byte for the IPv4 multicast options, Linux
+     accepts either that or an int. */
+  unsigned char ttl = 1, loop = (unsigned char)(loopback != 0);
+  int           s   = socket_v4_bind(interface, port);
+
+  if (s == -1)
+    return -1;
+  if (set_nonblocking(s) == -1)
+    return close_and_fail(s);
+
+  if (setsockopt(s, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, sizeof(ttl)) == -1 ||
+      setsockopt(s, IPPROTO_IP, IP_MULTICAST_LOOP, &loop, sizeof(loop)) == -1)
+    return close_and_fail(s);
+
+  return s;
+}
+
+ssize_t socket_mcast_send(int s, const void *buf, size_t len, const ot_ip6 group, uint16_t port) {
+  struct sockaddr_in sa;
+
+  sockaddr4_from_ip(&sa, group, port);
+  return sendto(s, buf, len, 0, (struct sockaddr *)&sa, sizeof(sa));
+}
+#endif
diff --git a/ot_socket.h b/ot_socket.h
new file mode 100644
index 0000000..20fd839
--- /dev/null
+++ b/ot_socket.h
@@ -0,0 +1,45 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+#ifndef OT_SOCKET_H__
+#define OT_SOCKET_H__
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include "trackerlogic.h"
+
+/* Every socket opentracker opens is an AF_INET6 socket with IPV6_V6ONLY
+   cleared, so one descriptor serves both families and an IPv4 peer arrives
+   as the v4 mapped address */
+
+/* Ask the kernel to let several processes bind the same address */
+extern int g_socket_reuseport;
+
+/* Create, bind and, for TCP, listen. The returned socket is non blocking
+   Returns -1 on failure with errno set */
+int     socket_tcp_listen(const ot_ip6 ip, uint16_t port);
+int     socket_udp_bind(const ot_ip6 ip, uint16_t port);
+
+int     socket_tcp_connect(const ot_ip6 srcip, uint16_t srcport, const ot_ip6 dstip, uint16_t dstport);
+int     socket_is_connected(int s);
+int     socket_accept(int s, ot_ip6 ip, uint16_t *port);
+
+ssize_t socket_recv(int s, void *buf, size_t len, ot_ip6 ip, uint16_t *port);
+ssize_t socket_send(int s, const void *buf, size_t len, const ot_ip6 ip, uint16_t port);
+
+#ifdef WANT_SYNC_LIVE
+/*
+   socket_mcast_join takes the wildcard address and names the interface in the
+   join, and hands back a blocking socket, since the thread that reads it does
+   nothing else. socket_mcast_bind hands back a non blocking one, because the
+   thread that sends from it is also serving clients. Incoming datagrams are
+   read with socket_recv */
+int     socket_mcast_join(const ot_ip6 group, const ot_ip6 interface, uint16_t port);
+int     socket_mcast_bind(const ot_ip6 interface, uint16_t port, int loopback);
+ssize_t socket_mcast_send(int s, const void *buf, size_t len, const ot_ip6 group, uint16_t port);
+#endif
+
+#endif
diff --git a/ot_stats.c b/ot_stats.c
index 7945f4e..f938e91 100644
--- a/ot_stats.c
+++ b/ot_stats.c
@@ -206,10 +206,6 @@ static size_t stats_return_busy_networks(char *reply, stats_network_node *tree,
       r += sprintf(r, "%08zd: ", scores[i - 1]);
       // #ifdef WANT_V6
       r += ip_format(r, networks[i - 1]);
-#if 0
-    // XXX
-      r += fmt_ip4( r, networks[i - 1]);
-#endif
       *r++ = '\n';
     }
   }
@@ -663,10 +659,6 @@ void stats_issue_event(ot_status_event event, PROTO_FLAG proto, uintptr_t event_
       }
 
       ip_readable[ip_format(ip_readable, (char *)&ws->peer)] = 0;
-#if 0
-        /* XXX */
-        ip_readable[ fmt_ip4( ip_readable, (char*)&ws->peer ) ] = 0;
-#endif
       syslog(LOG_INFO, "time=%s event=completed info_hash=%s peer_id=%s ip=%s", timestring, hash_hex, peerid_hex, ip_readable);
     }
 #endif
diff --git a/ot_udp.c b/ot_udp.c
index 8e056db..dc8267c 100644
--- a/ot_udp.c
+++ b/ot_udp.c
@@ -12,19 +12,16 @@
 
 /* Libowfat */
 #include "io.h"
-#include "socket.h"
 
 /* Opentracker */
 #include "ot_ip.h"
 #include "ot_random.h"
 #include "ot_rijndael.h"
+#include "ot_socket.h"
 #include "ot_stats.h"
 #include "ot_udp.h"
 #include "trackerlogic.h"
 
-#if 0
-static const uint8_t g_static_connid[8] = { 0x23, 0x42, 0x05, 0x17, 0xde, 0x41, 0x50, 0xff };
-#endif
 static uint32_t g_rijndael_round_key[44] = {0};
 static volatile uint32_t g_key_of_the_hour[2] = {0};
 static volatile ot_time  g_hour_of_the_key;
@@ -75,15 +72,16 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
   ot_ip6    remoteip;
   uint32_t *inpacket  = (uint32_t *)ws->inbuf;
   uint32_t *outpacket = (uint32_t *)ws->outbuf;
-  uint32_t  left, event, scopeid;
+  uint32_t  left, event;
   uint32_t  connid[2];
   uint32_t  action;
   uint16_t  port, remoteport;
   size_t    byte_count, scrape_count;
 
-  byte_count = socket_recv6(serversocket, ws->inbuf, G_INBUF_SIZE, remoteip, &remoteport, &scopeid);
-  if (!byte_count)
+  ssize_t   result = socket_recv(serversocket, ws->inbuf, G_INBUF_SIZE, remoteip, &remoteport);
+  if (result <= 0)
     return 0;
+  byte_count = (size_t)result;
 
   stats_issue_event(EVENT_ACCEPT, FLAG_UDP, (uintptr_t)remoteip);
   stats_issue_event(EVENT_READ, FLAG_UDP, byte_count);
@@ -117,7 +115,7 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
       outpacket[0]   = htonl(3);
       outpacket[1]   = inpacket[3];
       memcpy(&outpacket[2], "Connection ID missmatch.", s);
-      socket_send6(serversocket, ws->outbuf, 8 + s, remoteip, remoteport, 0);
+      socket_send(serversocket, ws->outbuf, 8 + s, remoteip, remoteport);
       stats_issue_event(EVENT_CONNID_MISSMATCH, FLAG_UDP, 8 + s);
       return 1;
     }
@@ -134,7 +132,7 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
     outpacket[2] = connid[0];
     outpacket[3] = connid[1];
 
-    socket_send6(serversocket, ws->outbuf, 16, remoteip, remoteport, 0);
+    socket_send(serversocket, ws->outbuf, 16, remoteip, remoteport);
     stats_issue_event(EVENT_CONNECT, FLAG_UDP, 16);
     break;
   case 1: /* This is an announce action */
@@ -184,7 +182,7 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
       ws->reply_size = 8 + add_peer_to_torrent_and_return_peers(FLAG_UDP, ws, numwant);
     }
 
-    socket_send6(serversocket, ws->outbuf, ws->reply_size, remoteip, remoteport, 0);
+    socket_send(serversocket, ws->outbuf, ws->reply_size, remoteip, remoteport);
     stats_issue_event(EVENT_ANNOUNCE, FLAG_UDP, ws->reply_size);
     break;
 
@@ -195,7 +193,7 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
     for (scrape_count = 0; (scrape_count * 20 < byte_count - 16) && (scrape_count <= 74); scrape_count++)
       return_udp_scrape_for_torrent(*(ot_hash *)(((char *)inpacket) + 16 + 20 * scrape_count), ((char *)outpacket) + 8 + 12 * scrape_count);
 
-    socket_send6(serversocket, ws->outbuf, 8 + 12 * scrape_count, remoteip, remoteport, 0);
+    socket_send(serversocket, ws->outbuf, 8 + 12 * scrape_count, remoteip, remoteport);
     stats_issue_event(EVENT_SCRAPE, FLAG_UDP, scrape_count);
     break;
   }
diff --git a/ot_udp.h b/ot_udp.h
index c670175..87d99a9 100644
--- a/ot_udp.h
+++ b/ot_udp.h
@@ -8,6 +8,8 @@
 
 #include <stdint.h>
 
+#include "trackerlogic.h"
+
 void udp_init(int64_t sock, unsigned int worker_count);
 void udp_kickoff(void);
 int  handle_udp6(int64_t serversocket, struct ot_workstruct *ws);
diff --git a/ot_vector.h b/ot_vector.h
index 2618363..fbc75f4 100644
--- a/ot_vector.h
+++ b/ot_vector.h
@@ -6,6 +6,8 @@
 #ifndef OT_VECTOR_H__
 #define OT_VECTOR_H__
 
+#include <stddef.h>
+
 /* These defines control vectors behaviour */
 #define OT_VECTOR_MIN_MEMBERS   2
 #define OT_VECTOR_GROW_RATIO    2
@@ -21,6 +23,9 @@ typedef struct {
   size_t space;
 } ot_vector;
 
+/* trackerlogic.h needs ot_vector, break circular dependency here */
+#include "trackerlogic.h"
+
 void    *binary_search(const void *const key, const void *base, const size_t member_count, const size_t member_size, size_t compare_size, int *exactmatch);
 void    *vector_find_or_insert(ot_vector *vector, void *key, size_t member_size, size_t compare_size, int *exactmatch);
 ot_peer *vector_find_or_insert_peer(ot_vector *vector, ot_peer const *peer, size_t peer_size, int *exactmatch);
diff --git a/proxy.c b/proxy.c
index c2dc417..16b8286 100644
--- a/proxy.c
+++ b/proxy.c
@@ -7,38 +7,33 @@
 #include <arpa/inet.h>
 #include <ctype.h>
 #include <errno.h>
-#include <fcntl.h>
 #include <pthread.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/socket.h>
 #include <unistd.h>
 
 /* Libowfat */
 #include "io.h"
 #include "iob.h"
-#include "socket.h"
 
 /* Opentracker */
 #include "ot_ip.h"
 #include "ot_mutex.h"
 #include "ot_random.h"
 #include "ot_scan.h"
+#include "ot_socket.h"
 #include "ot_stats.h"
 #include "ot_vector.h"
 #include "trackerlogic.h"
 
-#ifndef WANT_SYNC_LIVE
-#define WANT_SYNC_LIVE
-#endif
 #include "ot_livesync.h"
 
 ot_ip6   g_serverip;
 uint16_t g_serverport = 9009;
 uint32_t g_tracker_id;
-char     groupip_1[4] = {224, 0, 23, 5};
+ot_ip6     groupip_1 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 224, 0, 23, 5};
 int      g_self_pipe[2];
 
 /* If you have more than 10 peers, don't use this proxy
@@ -63,11 +58,11 @@ enum { OT_SYNC_PEER4, OT_SYNC_PEER6 };
 enum { FLAG_SERVERSOCKET = 1 };
 
 /* For incoming packets */
-static int64_t  g_socket_in = -1;
+static int      g_socket_in = -1;
 static uint8_t  g_inbuffer[LIVESYNC_INCOMING_BUFFSIZE];
 
 /* For outgoing packets */
-static int64_t  g_socket_out = -1;
+static int      g_socket_out = -1;
 static uint8_t  g_peerbuffer_start[LIVESYNC_OUTGOING_BUFFSIZE_PEERS];
 static uint8_t *g_peerbuffer_pos;
 static uint8_t *g_peerbuffer_highwater = g_peerbuffer_start + LIVESYNC_OUTGOING_BUFFSIZE_PEERS - LIVESYNC_OUTGOING_WATERMARK_PEERS;
@@ -89,34 +84,17 @@ void stats_issue_event(ot_status_event event, PROTO_FLAG proto, uintptr_t event_
 }
 
 void livesync_bind_mcast(ot_ip6 ip, uint16_t port) {
-  char  tmpip[4] = {0, 0, 0, 0};
-  char *v4ip;
-
   if (!ip_is_v4mapped(ip))
     exerr("v6 mcast support not yet available.");
-  v4ip = ip + 12;
 
   if (g_socket_in != -1)
     exerr("Error: Livesync listen ip specified twice.");
 
-  if ((g_socket_in = socket_udp4()) < 0)
-    exerr("Error: Cant create live sync incoming socket.");
-
-  fcntl(g_socket_in, F_SETFL, fcntl(g_socket_in, F_GETFL, 0) & ~O_NONBLOCK);
-
-  if (socket_bind4_reuse(g_socket_in, tmpip, port) == -1)
+  if ((g_socket_in = socket_mcast_join(groupip_1, ip, port)) == -1)
     exerr("Error: Cant bind live sync incoming socket.");
 
-  if (socket_mcjoin4(g_socket_in, groupip_1, v4ip))
-    exerr("Error: Cant make live sync incoming socket join mcast group.");
-
-  if ((g_socket_out = socket_udp4()) < 0)
-    exerr("Error: Cant create live sync outgoing socket.");
-  if (socket_bind4_reuse(g_socket_out, v4ip, port) == -1)
+  if ((g_socket_out = socket_mcast_bind(ip, port, 1)) == -1)
     exerr("Error: Cant bind live sync outgoing socket.");
-
-  socket_mcttl4(g_socket_out, 1);
-  socket_mcloop4(g_socket_out, 1);
 }
 
 size_t add_peer_to_torrent_proxy(ot_hash hash, ot_peer *peer, size_t peer_size) {
@@ -283,19 +261,11 @@ static void handle_reconnects(void) {
   size_t i;
   for (i = 0; i < g_connection_count; ++i)
     if (PROXYPEER_NEEDSCONNECT(g_connections[i].state)) {
-      int64_t newfd = socket_tcp6();
+      int64_t newfd = socket_tcp_connect(g_serverip, g_serverport, g_connections[i].ip, g_connections[i].port);
       fprintf(stderr, "(Re)connecting to peer...");
-      if (newfd < 0)
+      if (newfd == -1)
         continue; /* No socket for you */
       io_fd(newfd);
-      if (socket_bind6_reuse(newfd, g_serverip, g_serverport, 0)) {
-        io_close(newfd);
-        continue;
-      }
-      if (socket_connect6(newfd, g_connections[i].ip, g_connections[i].port, 0) == -1 && errno != EINPROGRESS && errno != EWOULDBLOCK) {
-        close(newfd);
-        continue;
-      }
       io_wantwrite(newfd); /* So we will be informed when it is connected */
       io_setcookie(newfd, g_connections + i);
 
@@ -311,9 +281,9 @@ static void handle_reconnects(void) {
 static void handle_accept(int64_t serversocket) {
   int64_t newfd;
   ot_ip6  ip;
-  uint16  port;
+  uint16_t port;
 
-  while ((newfd = socket_accept6(serversocket, ip, &port, NULL)) != -1) {
+  while ((newfd = socket_accept(serversocket, ip, &port)) != -1) {
 
     /* XXX some access control */
 
@@ -436,7 +406,7 @@ static void handle_write(int64_t peersocket) {
     break;
   case FLAG_CONNECTING:
     /* Ensure that the connection is established and handle connection error */
-    if (peer->state & FLAG_OUTGOING && !socket_connected(peersocket)) {
+    if (peer->state & FLAG_OUTGOING && !socket_is_connected(peersocket)) {
       fprintf(stderr, "failed\n");
       reset_info_block(peer);
       io_close(peersocket);
@@ -515,13 +485,10 @@ static void panic(const char *routine) {
 }
 
 static int64_t ot_try_bind(ot_ip6 ip, uint16_t port) {
-  int64_t sock = socket_tcp6();
-
-  if (socket_bind6_reuse(sock, ip, port, 0) == -1)
-    panic("socket_bind6_reuse");
+  int64_t sock = socket_tcp_listen(ip, port);
 
-  if (socket_listen(sock, SOMAXCONN) == -1)
-    panic("socket_listen");
+  if (sock == -1)
+    panic("socket_tcp_listen");
 
   if (!io_fd(sock))
     panic("io_fd");
@@ -776,7 +743,7 @@ static void *streamsync_worker(void *args) {
 }
 
 static void livesync_issue_peersync() {
-  socket_send4(g_socket_out, (char *)g_peerbuffer_start, g_peerbuffer_pos - g_peerbuffer_start, groupip_1, LIVESYNC_PORT);
+  socket_mcast_send(g_socket_out, g_peerbuffer_start, (size_t)(g_peerbuffer_pos - g_peerbuffer_start), groupip_1, LIVESYNC_PORT);
   g_peerbuffer_pos   = g_peerbuffer_start + sizeof(g_tracker_id) + sizeof(uint32_t);
   g_next_packet_time = time(NULL) + LIVESYNC_MAXDELAY;
 }
@@ -871,7 +838,7 @@ static void *livesync_worker(void *args) {
     ot_ip6   in_ip;
     uint16_t in_port;
     uint32_t packet_type;
-    size_t   datalen = socket_recv4(g_socket_in, (char *)g_inbuffer, LIVESYNC_INCOMING_BUFFSIZE, 12 + (char *)in_ip, &in_port);
+    ssize_t  datalen = socket_recv(g_socket_in, g_inbuffer, LIVESYNC_INCOMING_BUFFSIZE, in_ip, &in_port);
 
     /* Expect at least tracker id and packet type */
     if (datalen <= (ssize_t)(sizeof(g_tracker_id) + sizeof(uint32_t)))
diff --git a/scan_urlencoded_query.c b/scan_urlencoded_query.c
index cf0c5b1..4825a4a 100644
--- a/scan_urlencoded_query.c
+++ b/scan_urlencoded_query.c
@@ -170,16 +170,12 @@ size_t fmt_urlencoded(char *dest, const uint8_t *src, size_t len) {
 
     /* strchr would find the terminator, so a zero byte never counts as safe */
     if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || (c && strchr(safe, c))) {
-      if (dest)
-        dest[written] = (char)c;
-      ++written;
+      dest[written++] = (char)c;
     } else {
-      if (dest) {
-        dest[written]     = '%';
-        dest[written + 1] = hexdigit[c >> 4];
-        dest[written + 2] = hexdigit[c & 15];
-      }
-      written += 3;
+      dest[written]     = '%';
+      dest[written + 1] = hexdigit[c >> 4];
+      dest[written + 2] = hexdigit[c & 15];
+      written          += 3;
     }
   }
 
diff --git a/scan_urlencoded_query.h b/scan_urlencoded_query.h
index 6f12c03..d0929cf 100644
--- a/scan_urlencoded_query.h
+++ b/scan_urlencoded_query.h
@@ -55,9 +55,7 @@ void    scan_urlencoded_skipvalue(char **string);
 ssize_t scan_fixed_int(char *data, size_t len, int *number);
 
 /* The other direction: percent encode len bytes from src into dest and return
-   how many characters were written, or how many would be needed when dest is
-   NULL. dest needs room for three times len.
- */
+   how many characters were written. dest needs room for three times len. */
 size_t  fmt_urlencoded(char *dest, const uint8_t *src, size_t len);
 
 #endif
diff --git a/tests/runner.c b/tests/runner.c
index 10b6625..db62246 100644
--- a/tests/runner.c
+++ b/tests/runner.c
@@ -22,6 +22,7 @@ static const struct module modules[] = {{"scan_urlencoded_query", test_scan_urle
                                         {"ot_scan", test_scan},
                                         {"ot_buf", test_buf},
                                         {"ot_ip", test_ip},
+                                        {"ot_socket", test_socket},
                                         {"ot_accesslist", test_accesslist},
                                         {NULL, NULL}};
 
diff --git a/tests/t_scan_urlencoded_query.c b/tests/t_scan_urlencoded_query.c
index 6fa34e0..f660ea3 100644
--- a/tests/t_scan_urlencoded_query.c
+++ b/tests/t_scan_urlencoded_query.c
@@ -295,14 +295,6 @@ static void case_fmt_hex_is_lower_case(void) {
   CHECK_STR(dest, "%00%ab%ff");
 }
 
-static void case_fmt_length_only(void) {
-  const uint8_t src[] = {'a', 0xff, 'b'};
-
-  test_case("a null destination reports the length without writing");
-  CHECK_INT(fmt_urlencoded(NULL, src, sizeof(src)), 5);
-  CHECK_INT(fmt_urlencoded(NULL, src, 0), 0);
-}
-
 static void case_fmt_zero_length(void) {
   char dest[4];
 
@@ -374,7 +366,6 @@ void test_scan_urlencoded_query(void) {
   case_fmt_passes_safe_bytes();
   case_fmt_escapes_the_rest();
   case_fmt_hex_is_lower_case();
-  case_fmt_length_only();
   case_fmt_zero_length();
   case_fmt_worst_case_fits();
   case_fmt_decoder_disagrees_on_dollar();
diff --git a/tests/t_socket.c b/tests/t_socket.c
new file mode 100644
index 0000000..bbc9e5e
--- /dev/null
+++ b/tests/t_socket.c
@@ -0,0 +1,307 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <poll.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+/* Opentracker */
+#include "ot_ip.h"
+#include "ot_socket.h"
+#include "test.h"
+
+/* These cases talk to the loopback interface rather than to a mock, because
+   what is worth pinning down here is the behaviour of the socket options the
+   rest of the tracker relies on, and only the kernel can report that. */
+
+static const char ip_any[16] = {0};
+static const char ip_loopback[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
+static const char ip_v4_loopback[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 127, 0, 0, 1};
+/* RFC 3849 reserves 2001:db8::/32 for documentation, so no host carries it */
+static const char ip_unassigned[16] = {0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
+
+/* What a socket ended up bound to, which is not always what was asked for: a
+   FreeBSD jail, for one, rewrites a loopback bind to the address it was given.
+   A datagram a socket sends to itself must come back carrying this, so the
+   cases below compare against it rather than against the address they passed
+   to the bind. */
+static void bound_address(int s, char ip[16], uint16_t *port) {
+  struct sockaddr_storage ss;
+  socklen_t               len = sizeof(ss);
+
+  memset(&ss, 0, sizeof(ss));
+  memset(ip, 0, 16);
+  *port = 0;
+  if (getsockname(s, (struct sockaddr *)&ss, &len) == -1)
+    return;
+
+  /* Spelled out here rather than borrowed from ot_socket.c, so that a wrong
+     idea about how a kernel reports an address cannot hide in both at once */
+  if (ss.ss_family == AF_INET) {
+    const struct sockaddr_in *sa = (const struct sockaddr_in *)&ss;
+
+    memcpy(ip, ip_v4mapped_prefix, sizeof(ip_v4mapped_prefix));
+    memcpy(ip + sizeof(ip_v4mapped_prefix), &sa->sin_addr, 4);
+    *port = ntohs(sa->sin_port);
+  } else {
+    const struct sockaddr_in6 *sa = (const struct sockaddr_in6 *)&ss;
+
+    memcpy(ip, &sa->sin6_addr, 16);
+    *port = ntohs(sa->sin6_port);
+  }
+}
+
+static int is_nonblocking(int s) {
+  int flags = fcntl(s, F_GETFL, 0);
+  return flags != -1 && (flags & O_NONBLOCK) != 0;
+}
+
+static int sock_flag(int s, int level, int option) {
+  int       value = -1;
+  socklen_t len   = sizeof(value);
+
+  if (getsockopt(s, level, option, &value, &len) == -1)
+    return -1;
+  return value != 0;
+}
+
+/* Wait for one event, so a test never blocks forever on a lost packet */
+static int wait_for(int s, short events) {
+  struct pollfd pfd;
+
+  pfd.fd      = s;
+  pfd.events  = events;
+  pfd.revents = 0;
+  return poll(&pfd, 1, 2000) == 1;
+}
+
+/* ------------------------------------------------------------ invariants */
+
+/* Asked for the wildcard address, because a socket bound to one specific
+   IPv6 address cannot carry IPv4 traffic anyway and Linux turns IPV6_V6ONLY
+   back on in that case. The tracker's own default is the wildcard. */
+static void case_socket_options(void) {
+  int udp, tcp;
+
+  test_case("a bound udp socket is non blocking and serves both families");
+  udp = socket_udp_bind(ip_any, 0);
+  CHECK(udp != -1);
+  CHECK_INT(is_nonblocking(udp), 1);
+  CHECK_INT(sock_flag(udp, IPPROTO_IPV6, IPV6_V6ONLY), 0);
+  close(udp);
+
+  test_case("a listening tcp socket is non blocking and serves both families");
+  tcp = socket_tcp_listen(ip_any, 0);
+  CHECK(tcp != -1);
+  CHECK_INT(is_nonblocking(tcp), 1);
+  CHECK_INT(sock_flag(tcp, IPPROTO_IPV6, IPV6_V6ONLY), 0);
+  close(tcp);
+}
+
+#ifdef SO_REUSEPORT
+static void case_reuseport_is_opt_in(void) {
+  int s;
+
+  test_case("reuseport stays off unless the operator asks for it");
+  g_socket_reuseport = 0;
+  s                  = socket_udp_bind(ip_loopback, 0);
+  CHECK(s != -1);
+  CHECK_INT(sock_flag(s, SOL_SOCKET, SO_REUSEPORT), 0);
+  close(s);
+
+  test_case("reuseport reaches the socket when it is asked for");
+  g_socket_reuseport = 1;
+  s                  = socket_udp_bind(ip_loopback, 0);
+  CHECK(s != -1);
+  CHECK_INT(sock_flag(s, SOL_SOCKET, SO_REUSEPORT), 1);
+  close(s);
+
+  g_socket_reuseport = 0;
+}
+#endif
+
+/* ------------------------------------------------------------------- udp */
+
+static void case_udp_roundtrip(void) {
+  char     buf[32], ip[16], own_ip[16];
+  uint16_t port = 0, own_port = 0;
+  int      s;
+
+  test_case("a datagram comes back with the sender's address and port");
+  s = socket_udp_bind(ip_loopback, 0);
+  CHECK(s != -1);
+  bound_address(s, own_ip, &own_port);
+  CHECK(own_port != 0);
+  CHECK_INT(socket_send(s, "opentracker", 11, own_ip, own_port), 11);
+  CHECK_INT(wait_for(s, POLLIN), 1);
+  CHECK_INT(socket_recv(s, buf, sizeof(buf), ip, &port), 11);
+  CHECK_MEM(buf, "opentracker", 11);
+  CHECK_MEM(ip, own_ip, 16);
+  CHECK_INT(port, own_port);
+  close(s);
+}
+
+/* An IPv4 peer must arrive in the v4 mapped form opentracker stores, however
+   the kernel chose to report it. Linux fills a v4 mapped sockaddr_in6 here
+   and the BSDs fill a plain sockaddr_in, so this is the case that tells the
+   two apart. */
+static void case_udp_v4mapped(void) {
+  char     buf[32], ip[16], receiver_ip[16], sender_ip[16];
+  uint16_t port = 0, receiver_port = 0, sender_port = 0;
+  int      receiver, sender;
+
+  test_case("an IPv4 sender is reported in its v4 mapped form");
+  receiver = socket_udp_bind(ip_v4_loopback, 0);
+  CHECK(receiver != -1);
+  sender = socket_udp_bind(ip_v4_loopback, 0);
+  CHECK(sender != -1);
+  bound_address(receiver, receiver_ip, &receiver_port);
+  bound_address(sender, sender_ip, &sender_port);
+  CHECK_INT(ip_is_v4mapped(sender_ip), 1);
+
+  CHECK_INT(socket_send(sender, "v4", 2, receiver_ip, receiver_port), 2);
+  CHECK_INT(wait_for(receiver, POLLIN), 1);
+  CHECK_INT(socket_recv(receiver, buf, sizeof(buf), ip, &port), 2);
+  CHECK_INT(ip_is_v4mapped(ip), 1);
+  CHECK_MEM(ip, sender_ip, 16);
+  CHECK_INT(port, sender_port);
+  close(sender);
+  close(receiver);
+}
+
+/* ------------------------------------------------------------------- tcp */
+
+static void case_tcp_roundtrip(void) {
+  char     ip[16], listener_ip[16], client_ip[16];
+  uint16_t port = 0, listener_port = 0, client_port = 0;
+  int      listener, client, accepted;
+
+  test_case("a connection is accepted and carries the caller's address");
+  listener = socket_tcp_listen(ip_loopback, 0);
+  CHECK(listener != -1);
+  bound_address(listener, listener_ip, &listener_port);
+  CHECK(listener_port != 0);
+
+  client = socket_tcp_connect(ip_loopback, 0, listener_ip, listener_port);
+  CHECK(client != -1);
+  CHECK_INT(wait_for(client, POLLOUT), 1);
+  CHECK_INT(socket_is_connected(client), 1);
+  bound_address(client, client_ip, &client_port);
+
+  CHECK_INT(wait_for(listener, POLLIN), 1);
+  accepted = socket_accept(listener, ip, &port);
+  CHECK(accepted != -1);
+  CHECK_MEM(ip, client_ip, 16);
+  CHECK_INT(port, client_port);
+
+  test_case("the accepted socket is handed over non blocking");
+  CHECK_INT(is_nonblocking(accepted), 1);
+
+  close(accepted);
+  close(client);
+  close(listener);
+}
+
+static void case_connect_refused(void) {
+  char     listener_ip[16];
+  int      listener, client;
+  uint16_t port;
+
+  test_case("a refused connection is reported by socket_is_connected");
+  /* Take a port, then drop it, so nothing is listening on it any more */
+  listener = socket_tcp_listen(ip_loopback, 0);
+  CHECK(listener != -1);
+  bound_address(listener, listener_ip, &port);
+  close(listener);
+
+  client = socket_tcp_connect(ip_loopback, 0, listener_ip, port);
+  CHECK(client != -1);
+  CHECK_INT(wait_for(client, POLLOUT), 1);
+  CHECK_INT(socket_is_connected(client), 0);
+  CHECK_INT(errno, ECONNREFUSED);
+  close(client);
+}
+
+/* --------------------------------------------------------- failed binds */
+
+/* The lowest free descriptor is handed out first, so a number that stays put
+   across a failing call shows the call did not keep a socket behind. */
+static int next_descriptor(void) {
+  int fd = dup(0);
+
+  if (fd != -1)
+    close(fd);
+  return fd;
+}
+
+static void case_bind_failure(void) {
+  int before;
+
+  test_case("binding an address no interface carries fails");
+  before = next_descriptor();
+  CHECK(before != -1);
+  CHECK_INT(socket_tcp_listen(ip_unassigned, 0), -1);
+  CHECK_INT(socket_udp_bind(ip_unassigned, 0), -1);
+
+  test_case("a failed bind leaves no socket behind");
+  CHECK_INT(next_descriptor(), before);
+}
+
+#ifdef WANT_SYNC_LIVE
+/* Reading an IPv4 multicast option back: Linux answers with an int, the BSDs
+   with a single byte, so ask how much was written. */
+static int mcast_option(int s, int option) {
+  int       value = 0;
+  socklen_t len   = sizeof(value);
+
+  if (getsockopt(s, IPPROTO_IP, option, &value, &len) == -1)
+    return -1;
+  if (len == 1)
+    return *(unsigned char *)&value;
+  return value;
+}
+
+static void case_mcast_sender(void) {
+  int s;
+
+  test_case("the sending socket keeps its traffic on the local network");
+  s = socket_mcast_bind(ip_v4_loopback, 0, 0);
+  CHECK(s != -1);
+  CHECK_INT(mcast_option(s, IP_MULTICAST_TTL), 1);
+
+  test_case("and does not hear itself unless it is asked to");
+  CHECK_INT(mcast_option(s, IP_MULTICAST_LOOP), 0);
+
+  test_case("whoever sends from it is serving clients too, so it cannot block");
+  CHECK_INT(is_nonblocking(s), 1);
+  close(s);
+
+  test_case("the proxy asks to hear itself and gets it");
+  s = socket_mcast_bind(ip_v4_loopback, 0, 1);
+  CHECK(s != -1);
+  CHECK_INT(mcast_option(s, IP_MULTICAST_LOOP), 1);
+  close(s);
+}
+#endif
+
+void test_socket(void) {
+  case_socket_options();
+#ifdef SO_REUSEPORT
+  case_reuseport_is_opt_in();
+#endif
+  case_udp_roundtrip();
+  case_udp_v4mapped();
+  case_tcp_roundtrip();
+  case_connect_refused();
+  case_bind_failure();
+#ifdef WANT_SYNC_LIVE
+  case_mcast_sender();
+#endif
+}
diff --git a/tests/test.h b/tests/test.h
index 7449b73..d79c4d2 100644
--- a/tests/test.h
+++ b/tests/test.h
@@ -85,5 +85,6 @@ void test_accesslist(void);
 void test_scan(void);
 void test_buf(void);
 void test_ip(void);
+void test_socket(void);
 
 #endif