[monitoring-plugins] check_icmp: Fix setsockopt(2) calls for IPv6

[Alvar Penning]

 Module: monitoring-plugins
 Branch: master
 Commit: d8c79faa3a3a3ae1dcb55d0fdb177521197b5804
 Author: Alvar Penning <post at 0x21.biz>
   Date: Wed Sep  9 10:22:25 2026 +0200
    URL: https://www.monitoring-plugins.org/repositories/monitoring-plugins/commit/?id=d8c79faa

check_icmp: Fix setsockopt(2) calls for IPv6

The same IP_TTL option was set for both IPv4 and IPv6 sockets in the
setsockopt(2) call. While this is valid for IPv4, there is no TTL in
IPv6, but a hop limit - which is also reflected in the options. So, this
call has never worked.

Because the error was hidden behind the debug log level, the failure was
not detected so far. This has changed on OpenBSD -current, where a
strict setsockopt(2) parameter check was added for programs under a
pledge(2) promise[^0]. Now, check_icmp gets aborted.

> $ /usr/local/libexec/nagios/check_icmp -6 -H localhost
> check_icmp[10540]: pledge "inet", syscall 105
> Abort trap

Under ktrace(1)/kdump(1) inspection, the faulty setsockopt(2) system
call is shown.

> 47094 check_icmp CALL  setsockopt(3,0<ip>,4,0x7bacef492d88,8)
> 47094 check_icmp PLDG  setsockopt, "inet", errno 1 Operation not permitted
> 47094 check_icmp PSIG  SIGABRT SIG_DFL
> 47094 check_icmp NAMI  "check_icmp.core"

Furthermore, SOL_IP was exchanged by IPPROTO_IP and IPPROTO_IPV6. The
SOL_* socket options are nonportable Linux-variables[^1].

[^0]: https://cvsweb.openbsd.org/log/src/sys/kern/kern_pledge.c?sort=File#rev1.363
[^1]: https://www.man7.org/linux/man-pages/man7/ipv6.7.html#NOTES

---

 plugins-root/check_icmp.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index bbc10819..60863266 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -90,10 +90,6 @@ const char *email = "devel at monitoring-plugins.org";
 #	define INADDR_NONE (in_addr_t)(-1)
 #endif
 
-#ifndef SOL_IP
-#	define SOL_IP 0
-#endif
-
 /* we bundle these in one #ifndef, since they're all from BSD
  * Put individual #ifndef's around those that bother you */
 #ifndef ICMP_UNREACH_NET_UNKNOWN
@@ -922,7 +918,7 @@ int main(int argc, char **argv) {
 #endif // __OpenBSD__
 
 	if (sockset.socket4 != -1) {
-		int result = setsockopt(sockset.socket4, SOL_IP, IP_TTL, &config.ttl, sizeof(config.ttl));
+		int result = setsockopt(sockset.socket4, IPPROTO_IP, IP_TTL, &config.ttl, sizeof(config.ttl));
 		if (debug) {
 			if (result == -1) {
 				printf("setsockopt failed\n");
@@ -933,7 +929,7 @@ int main(int argc, char **argv) {
 	}
 
 	if (sockset.socket6 != -1) {
-		int result = setsockopt(sockset.socket6, SOL_IP, IP_TTL, &config.ttl, sizeof(config.ttl));
+		int result = setsockopt(sockset.socket6, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &config.ttl, sizeof(config.ttl));
 		if (debug) {
 			if (result == -1) {
 				printf("setsockopt failed\n");