[monitoring-plugins] check_icmp: Verify setsockopt(2) exit code and fix

[Alvar Penning]

 Module: monitoring-plugins
 Branch: master
 Commit: c5b219138dac574acbbe9051d5f34b18053f726c
 Author: Alvar Penning <post at 0x21.biz>
   Date: Wed Sep  9 13:14:44 2026 +0200
    URL: https://www.monitoring-plugins.org/repositories/monitoring-plugins/commit/?id=c5b21913

check_icmp: Verify setsockopt(2) exit code and fix

Start with actually verifying the setsockopt(2) exit code by crashing if
the system call fails. When verbosity is enforced, log what was done.

This unveiled an error with the IP_TTL/IPV6_UNICAST_HOPS call, which
failed for both versions of the Internet Protocol. After some debugging,
the type of the "ttl" parameter was too large - unsigned long instead of
an int -, resulting in a system call failure. I haven't verified how
this behaves on other platforms, but at least on OpenBSD this must have
always failed.

The SO_TIMESTAMP setsockopt(2) call for IPv6 was never performed, as the
system call, wrapped in a "sockset.socket6" check, was performed before
the socket was created. This was moved up.

Through a bit of reordering, a few checks could have been skipped.

---

 plugins-root/check_icmp.c          | 63 ++++++++++++++++----------------------
 plugins-root/check_icmp.d/config.h |  2 +-
 2 files changed, 27 insertions(+), 38 deletions(-)

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index 60863266..eafae267 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -881,23 +881,19 @@ int main(int argc, char **argv) {
 		}
 
 #ifdef SO_TIMESTAMP
-		if (sockset.socket4 != -1) {
-			int on = 1;
-			if (setsockopt(sockset.socket4, SOL_SOCKET, SO_TIMESTAMP, &on, sizeof(on))) {
-				if (debug) {
-					printf("Warning: no SO_TIMESTAMP support\n");
-				}
-			}
-		}
-		if (sockset.socket6 != -1) {
-			int on = 1;
-			if (setsockopt(sockset.socket6, SOL_SOCKET, SO_TIMESTAMP, &on, sizeof(on))) {
-				if (debug) {
-					printf("Warning: no SO_TIMESTAMP support\n");
-				}
-			}
+		int on = 1;
+		if (setsockopt(sockset.socket4, SOL_SOCKET, SO_TIMESTAMP, &on, sizeof(on))) {
+			crash("setsockopt SO_TIMESTAMP");
+		} else if (debug) {
+			printf("enables reception of timestamp\n");
 		}
 #endif // SO_TIMESTAMP
+
+		if (setsockopt(sockset.socket4, IPPROTO_IP, IP_TTL, &config.ttl, sizeof(config.ttl))) {
+			crash("setsockopt IP_TTL");
+		} else if (debug) {
+			printf("ttl set to %d\n", config.ttl);
+		}
 	}
 
 	if (config.need_v6) {
@@ -905,6 +901,21 @@ int main(int argc, char **argv) {
 		if (sockset.socket6 == -1) {
 			crash("Failed to obtain ICMP v6 socket");
 		}
+
+#ifdef SO_TIMESTAMP
+		int on = 1;
+		if (setsockopt(sockset.socket6, SOL_SOCKET, SO_TIMESTAMP, &on, sizeof(on))) {
+			crash("setsockopt SO_TIMESTAMP");
+		} else if (debug) {
+			printf("enables reception of timestamp\n");
+		}
+#endif // SO_TIMESTAMP
+
+		if (setsockopt(sockset.socket6, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &config.ttl, sizeof(config.ttl))) {
+			crash("setsockopt IPV6_UNICAST_HOPS");
+		} else if (debug) {
+			printf("hop limit set to %d\n", config.ttl);
+		}
 	}
 
 	/* now drop privileges (no effect if not setsuid or geteuid() == 0) */
@@ -917,28 +928,6 @@ int main(int argc, char **argv) {
 	pledge("stdio inet", NULL);
 #endif // __OpenBSD__
 
-	if (sockset.socket4 != -1) {
-		int result = setsockopt(sockset.socket4, IPPROTO_IP, IP_TTL, &config.ttl, sizeof(config.ttl));
-		if (debug) {
-			if (result == -1) {
-				printf("setsockopt failed\n");
-			} else {
-				printf("ttl set to %lu\n", config.ttl);
-			}
-		}
-	}
-
-	if (sockset.socket6 != -1) {
-		int result = setsockopt(sockset.socket6, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &config.ttl, sizeof(config.ttl));
-		if (debug) {
-			if (result == -1) {
-				printf("setsockopt failed\n");
-			} else {
-				printf("ttl set to %lu\n", config.ttl);
-			}
-		}
-	}
-
 	/* make sure we don't wait any longer than necessary */
 	struct timeval prog_start;
 	gettimeofday(&prog_start, NULL);
diff --git a/plugins-root/check_icmp.d/config.h b/plugins-root/check_icmp.d/config.h
index c77b89c9..657cb32e 100644
--- a/plugins-root/check_icmp.d/config.h
+++ b/plugins-root/check_icmp.d/config.h
@@ -59,7 +59,7 @@ typedef struct {
 	check_icmp_threshold crit;
 	check_icmp_threshold warn;
 
-	unsigned long ttl;
+	int ttl;
 	unsigned short icmp_data_size;
 	time_t target_interval;
 	unsigned short number_of_packets;