| /* BGP network related fucntions |
| Copyright (C) 1999 Kunihiro Ishiguro |
| |
| This file is part of GNU Zebra. |
| |
| GNU Zebra is free software; you can redistribute it and/or modify it |
| under the terms of the GNU General Public License as published by the |
| Free Software Foundation; either version 2, or (at your option) any |
| later version. |
| |
| GNU Zebra is distributed in the hope that it will be useful, but |
| WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| General Public License for more details. |
| |
| You should have received a copy of the GNU General Public License |
| along with GNU Zebra; see the file COPYING. If not, write to the Free |
| Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA |
| 02111-1307, USA. */ |
| |
| #include <zebra.h> |
| |
| #include "thread.h" |
| #include "sockunion.h" |
| #include "sockopt.h" |
| #include "memory.h" |
| #include "log.h" |
| #include "if.h" |
| #include "prefix.h" |
| #include "command.h" |
| #include "privs.h" |
| #include "linklist.h" |
| #include "network.h" |
| |
| #include "bgpd/bgpd.h" |
| #include "bgpd/bgp_fsm.h" |
| #include "bgpd/bgp_attr.h" |
| #include "bgpd/bgp_debug.h" |
| #include "bgpd/bgp_network.h" |
| |
| extern struct zebra_privs_t bgpd_privs; |
| |
| /* BGP listening socket. */ |
| struct bgp_listener |
| { |
| int fd; |
| union sockunion su; |
| struct thread *thread; |
| }; |
| |
| /* |
| * Set MD5 key for the socket, for the given IPv4 peer address. |
| * If the password is NULL or zero-length, the option will be disabled. |
| */ |
| static int |
| bgp_md5_set_socket (int socket, union sockunion *su, const char *password) |
| { |
| int ret = -1; |
| int en = ENOSYS; |
| |
| assert (socket >= 0); |
| |
| #if HAVE_DECL_TCP_MD5SIG |
| ret = sockopt_tcp_signature (socket, su, password); |
| en = errno; |
| #endif /* HAVE_TCP_MD5SIG */ |
| |
| if (ret < 0) |
| zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s", |
| socket, safe_strerror (en)); |
| |
| return ret; |
| } |
| |
| /* Helper for bgp_connect */ |
| static int |
| bgp_md5_set_connect (int socket, union sockunion *su, const char *password) |
| { |
| int ret = -1; |
| |
| #if HAVE_DECL_TCP_MD5SIG |
| if ( bgpd_privs.change (ZPRIVS_RAISE) ) |
| { |
| zlog_err ("%s: could not raise privs", __func__); |
| return ret; |
| } |
| |
| ret = bgp_md5_set_socket (socket, su, password); |
| |
| if (bgpd_privs.change (ZPRIVS_LOWER) ) |
| zlog_err ("%s: could not lower privs", __func__); |
| #endif /* HAVE_TCP_MD5SIG */ |
| |
| return ret; |
| } |
| |
| int |
| bgp_md5_set (struct peer *peer) |
| { |
| struct listnode *node; |
| int ret = 0; |
| struct bgp_listener *listener; |
| |
| if ( bgpd_privs.change (ZPRIVS_RAISE) ) |
| { |
| zlog_err ("%s: could not raise privs", __func__); |
| return -1; |
| } |
| |
| /* Just set the password on the listen socket(s). Outbound connections |
| * are taken care of in bgp_connect() below. |
| */ |
| for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) |
| if (listener->su.sa.sa_family == peer->su.sa.sa_family) |
| { |
| ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password); |
| break; |
| } |
| |
| if (bgpd_privs.change (ZPRIVS_LOWER) ) |
| zlog_err ("%s: could not lower privs", __func__); |
| |
| return ret; |
| } |
| |
| /* Accept bgp connection. */ |
| static int |
| bgp_accept (struct thread *thread) |
| { |
| int bgp_sock; |
| int accept_sock; |
| union sockunion su; |
| struct bgp_listener *listener = THREAD_ARG(thread); |
| struct peer *peer; |
| struct peer *peer1; |
| char buf[SU_ADDRSTRLEN]; |
| |
| /* Register accept thread. */ |
| accept_sock = THREAD_FD (thread); |
| if (accept_sock < 0) |
| { |
| zlog_err ("accept_sock is nevative value %d", accept_sock); |
| return -1; |
| } |
| listener->thread = thread_add_read (master, bgp_accept, listener, accept_sock); |
| |
| /* Accept client connection. */ |
| bgp_sock = sockunion_accept (accept_sock, &su); |
| if (bgp_sock < 0) |
| { |
| zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno)); |
| return -1; |
| } |
| set_nonblocking (bgp_sock); |
| |
| if (BGP_DEBUG (events, EVENTS)) |
| zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf)); |
| |
| /* Check remote IP address */ |
| peer1 = peer_lookup (NULL, &su); |
| if (! peer1 || peer1->status == Idle) |
| { |
| if (BGP_DEBUG (events, EVENTS)) |
| { |
| if (! peer1) |
| zlog_debug ("[Event] BGP connection IP address %s is not configured", |
| inet_sutop (&su, buf)); |
| else |
| zlog_debug ("[Event] BGP connection IP address %s is Idle state", |
| inet_sutop (&su, buf)); |
| } |
| close (bgp_sock); |
| return -1; |
| } |
| |
| /* In case of peer is EBGP, we should set TTL for this connection. */ |
| if (peer1->sort == BGP_PEER_EBGP) { |
| sockopt_ttl (peer1->su.sa.sa_family, bgp_sock, peer1->ttl); |
| if (peer1->gtsm_hops) |
| sockopt_minttl (peer1->su.sa.sa_family, bgp_sock, MAXTTL + 1 - peer1->gtsm_hops); |
| } |
| |
| /* Make dummy peer until read Open packet. */ |
| if (BGP_DEBUG (events, EVENTS)) |
| zlog_debug ("[Event] Make dummy peer structure until read Open packet"); |
| |
| { |
| char buf[SU_ADDRSTRLEN]; |
| |
| peer = peer_create_accept (peer1->bgp); |
| SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER); |
| peer->su = su; |
| peer->fd = bgp_sock; |
| peer->status = Active; |
| peer->local_id = peer1->local_id; |
| peer->v_holdtime = peer1->v_holdtime; |
| peer->v_keepalive = peer1->v_keepalive; |
| |
| /* Make peer's address string. */ |
| sockunion2str (&su, buf, SU_ADDRSTRLEN); |
| peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf); |
| } |
| |
| BGP_EVENT_ADD (peer, TCP_connection_open); |
| |
| return 0; |
| } |
| |
| /* BGP socket bind. */ |
| static int |
| bgp_bind (struct peer *peer) |
| { |
| #ifdef SO_BINDTODEVICE |
| int ret; |
| struct ifreq ifreq; |
| |
| if (! peer->ifname) |
| return 0; |
| |
| strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name)); |
| |
| if ( bgpd_privs.change (ZPRIVS_RAISE) ) |
| zlog_err ("bgp_bind: could not raise privs"); |
| |
| ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE, |
| &ifreq, sizeof (ifreq)); |
| |
| if (bgpd_privs.change (ZPRIVS_LOWER) ) |
| zlog_err ("bgp_bind: could not lower privs"); |
| |
| if (ret < 0) |
| { |
| zlog (peer->log, LOG_INFO, "bind to interface %s failed", peer->ifname); |
| return ret; |
| } |
| #endif /* SO_BINDTODEVICE */ |
| return 0; |
| } |
| |
| static int |
| bgp_update_address (struct interface *ifp, const union sockunion *dst, |
| union sockunion *addr) |
| { |
| struct prefix *p, *sel, *d; |
| struct connected *connected; |
| struct listnode *node; |
| int common; |
| |
| d = sockunion2hostprefix (dst); |
| sel = NULL; |
| common = -1; |
| |
| for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected)) |
| { |
| p = connected->address; |
| if (p->family != d->family) |
| continue; |
| if (prefix_common_bits (p, d) > common) |
| { |
| sel = p; |
| common = prefix_common_bits (sel, d); |
| } |
| } |
| |
| prefix_free (d); |
| if (!sel) |
| return 1; |
| |
| prefix2sockunion (sel, addr); |
| return 0; |
| } |
| |
| /* Update source selection. */ |
| static void |
| bgp_update_source (struct peer *peer) |
| { |
| struct interface *ifp; |
| union sockunion addr; |
| |
| /* Source is specified with interface name. */ |
| if (peer->update_if) |
| { |
| ifp = if_lookup_by_name (peer->update_if); |
| if (! ifp) |
| return; |
| |
| if (bgp_update_address (ifp, &peer->su, &addr)) |
| return; |
| |
| sockunion_bind (peer->fd, &addr, 0, &addr); |
| } |
| |
| /* Source is specified with IP address. */ |
| if (peer->update_source) |
| sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source); |
| } |
| |
| /* BGP try to connect to the peer. */ |
| int |
| bgp_connect (struct peer *peer) |
| { |
| unsigned int ifindex = 0; |
| |
| /* Make socket for the peer. */ |
| peer->fd = sockunion_socket (&peer->su); |
| if (peer->fd < 0) |
| return -1; |
| |
| set_nonblocking (peer->fd); |
| |
| /* If we can get socket for the peer, adjest TTL and make connection. */ |
| if (peer->sort == BGP_PEER_EBGP) { |
| sockopt_ttl (peer->su.sa.sa_family, peer->fd, peer->ttl); |
| if (peer->gtsm_hops) |
| sockopt_minttl (peer->su.sa.sa_family, peer->fd, MAXTTL + 1 - peer->gtsm_hops); |
| } |
| |
| sockopt_reuseaddr (peer->fd); |
| sockopt_reuseport (peer->fd); |
| |
| #ifdef IPTOS_PREC_INTERNETCONTROL |
| if (bgpd_privs.change (ZPRIVS_RAISE)) |
| zlog_err ("%s: could not raise privs", __func__); |
| if (sockunion_family (&peer->su) == AF_INET) |
| setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL); |
| # ifdef HAVE_IPV6 |
| else if (sockunion_family (&peer->su) == AF_INET6) |
| setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL); |
| # endif |
| if (bgpd_privs.change (ZPRIVS_LOWER)) |
| zlog_err ("%s: could not lower privs", __func__); |
| #endif |
| |
| if (peer->password) |
| bgp_md5_set_connect (peer->fd, &peer->su, peer->password); |
| |
| /* Bind socket. */ |
| bgp_bind (peer); |
| |
| /* Update source bind. */ |
| bgp_update_source (peer); |
| |
| #ifdef HAVE_IPV6 |
| if (peer->ifname) |
| ifindex = if_nametoindex (peer->ifname); |
| #endif /* HAVE_IPV6 */ |
| |
| if (BGP_DEBUG (events, EVENTS)) |
| plog_debug (peer->log, "%s [Event] Connect start to %s fd %d", |
| peer->host, peer->host, peer->fd); |
| |
| /* Connect to the remote peer. */ |
| return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex); |
| } |
| |
| /* After TCP connection is established. Get local address and port. */ |
| void |
| bgp_getsockname (struct peer *peer) |
| { |
| if (peer->su_local) |
| { |
| sockunion_free (peer->su_local); |
| peer->su_local = NULL; |
| } |
| |
| if (peer->su_remote) |
| { |
| sockunion_free (peer->su_remote); |
| peer->su_remote = NULL; |
| } |
| |
| peer->su_local = sockunion_getsockname (peer->fd); |
| peer->su_remote = sockunion_getpeername (peer->fd); |
| |
| bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer); |
| } |
| |
| |
| static int |
| bgp_listener (int sock, struct sockaddr *sa, socklen_t salen) |
| { |
| struct bgp_listener *listener; |
| int ret, en; |
| |
| sockopt_reuseaddr (sock); |
| sockopt_reuseport (sock); |
| |
| if (bgpd_privs.change (ZPRIVS_RAISE)) |
| zlog_err ("%s: could not raise privs", __func__); |
| |
| #ifdef IPTOS_PREC_INTERNETCONTROL |
| if (sa->sa_family == AF_INET) |
| setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL); |
| # ifdef HAVE_IPV6 |
| else if (sa->sa_family == AF_INET6) |
| setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL); |
| # endif |
| #endif |
| |
| sockopt_v6only (sa->sa_family, sock); |
| |
| ret = bind (sock, sa, salen); |
| en = errno; |
| if (bgpd_privs.change (ZPRIVS_LOWER)) |
| zlog_err ("%s: could not lower privs", __func__); |
| |
| if (ret < 0) |
| { |
| zlog_err ("bind: %s", safe_strerror (en)); |
| return ret; |
| } |
| |
| ret = listen (sock, 3); |
| if (ret < 0) |
| { |
| zlog_err ("listen: %s", safe_strerror (errno)); |
| return ret; |
| } |
| |
| listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener)); |
| listener->fd = sock; |
| memcpy(&listener->su, sa, salen); |
| listener->thread = thread_add_read (master, bgp_accept, listener, sock); |
| listnode_add (bm->listen_sockets, listener); |
| |
| return 0; |
| } |
| |
| /* IPv6 supported version of BGP server socket setup. */ |
| #if defined (HAVE_IPV6) && ! defined (NRL) |
| int |
| bgp_socket (unsigned short port, const char *address) |
| { |
| struct addrinfo *ainfo; |
| struct addrinfo *ainfo_save; |
| static const struct addrinfo req = { |
| .ai_family = AF_UNSPEC, |
| .ai_flags = AI_PASSIVE, |
| .ai_socktype = SOCK_STREAM, |
| }; |
| int ret, count; |
| char port_str[BUFSIZ]; |
| |
| snprintf (port_str, sizeof(port_str), "%d", port); |
| port_str[sizeof (port_str) - 1] = '\0'; |
| |
| ret = getaddrinfo (address, port_str, &req, &ainfo_save); |
| if (ret != 0) |
| { |
| zlog_err ("getaddrinfo: %s", gai_strerror (ret)); |
| return -1; |
| } |
| |
| count = 0; |
| for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) |
| { |
| int sock; |
| |
| if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6) |
| continue; |
| |
| sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol); |
| if (sock < 0) |
| { |
| zlog_err ("socket: %s", safe_strerror (errno)); |
| continue; |
| } |
| |
| /* if we intend to implement ttl-security, this socket needs ttl=255 */ |
| sockopt_ttl (ainfo->ai_family, sock, MAXTTL); |
| |
| ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen); |
| if (ret == 0) |
| ++count; |
| else |
| close(sock); |
| } |
| freeaddrinfo (ainfo_save); |
| if (count == 0) |
| { |
| zlog_err ("%s: no usable addresses", __func__); |
| return -1; |
| } |
| |
| return 0; |
| } |
| #else |
| /* Traditional IPv4 only version. */ |
| int |
| bgp_socket (unsigned short port, const char *address) |
| { |
| int sock; |
| int socklen; |
| struct sockaddr_in sin; |
| int ret, en; |
| |
| sock = socket (AF_INET, SOCK_STREAM, 0); |
| if (sock < 0) |
| { |
| zlog_err ("socket: %s", safe_strerror (errno)); |
| return sock; |
| } |
| |
| /* if we intend to implement ttl-security, this socket needs ttl=255 */ |
| sockopt_ttl (AF_INET, sock, MAXTTL); |
| |
| memset (&sin, 0, sizeof (struct sockaddr_in)); |
| sin.sin_family = AF_INET; |
| sin.sin_port = htons (port); |
| socklen = sizeof (struct sockaddr_in); |
| |
| if (address && ((ret = inet_aton(address, &sin.sin_addr)) < 1)) |
| { |
| zlog_err("bgp_socket: could not parse ip address %s: %s", |
| address, safe_strerror (errno)); |
| return ret; |
| } |
| #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN |
| sin.sin_len = socklen; |
| #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */ |
| |
| ret = bgp_listener (sock, (struct sockaddr *) &sin, socklen); |
| if (ret < 0) |
| { |
| close (sock); |
| return ret; |
| } |
| return sock; |
| } |
| #endif /* HAVE_IPV6 && !NRL */ |
| |
| void |
| bgp_close (void) |
| { |
| struct listnode *node, *next; |
| struct bgp_listener *listener; |
| |
| for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener)) |
| { |
| thread_cancel (listener->thread); |
| close (listener->fd); |
| listnode_delete (bm->listen_sockets, listener); |
| XFREE (MTYPE_BGP_LISTENER, listener); |
| } |
| } |