commit 90d181bd1a7e03d41df3cb2f51530ab47d818caa
author Chris Luke <chrisy@flirble.org> Tue Oct 18 17:26:51 2011 +0400
committer Denis Ovsienko <infrastation@yandex.ru> Tue Nov 15 21:26:07 2011 +0400
tree 56b456db3e8f9f23a34433c2515ddf962e33ded2
parent 70e3ca2ccedca2cae58bd91c968714cad0f9d5d6

bgpd: justify capabilities for TOS setting

To set the TOS bits on TCP connections, platforms that restrict
capabilities need the priv level to be raised before the sockopt
is set, and this requires the ZCAP_NET_ADMIN priv.

* bgp_main.c: update _caps_p to include ZCAP_NET_ADMIN
* bgp_network.c
  * bgp_connect(): request ZPRIVS_RAISE/ZPRIVS_LOWER
  * bgp_listener(): request ZPRIVS_RAISE earlier

bgpd/bgp_main.c

diff --git a/bgpd/bgp_main.c b/bgpd/bgp_main.c
index 9d14683..4a38c15 100644
--- a/bgpd/bgp_main.c
+++ b/bgpd/bgp_main.c
@@ -119,6 +119,7 @@
 {
     ZCAP_BIND, 
     ZCAP_NET_RAW,
+    ZCAP_NET_ADMIN,
 };
 
 struct zebra_privs_t bgpd_privs =

bgpd/bgp_network.c

diff --git a/bgpd/bgp_network.c b/bgpd/bgp_network.c
index b5fa948..3355316 100644
--- a/bgpd/bgp_network.c
+++ b/bgpd/bgp_network.c
@@ -320,12 +320,16 @@
   sockopt_reuseport (peer->fd);
   
 #ifdef IPTOS_PREC_INTERNETCONTROL
+  if (bgpd_privs.change (ZPRIVS_RAISE))
+    zlog_err ("%s: could not raise privs", __func__);
   if (sockunion_family (&peer->su) == AF_INET)
     setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
 # ifdef HAVE_IPV6
   else if (sockunion_family (&peer->su) == AF_INET6)
     setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL);
 # endif
+  if (bgpd_privs.change (ZPRIVS_LOWER))
+    zlog_err ("%s: could not lower privs", __func__);
 #endif
 
   if (peer->password)
@@ -382,6 +386,9 @@
   sockopt_reuseaddr (sock);
   sockopt_reuseport (sock);
 
+  if (bgpd_privs.change (ZPRIVS_RAISE))
+    zlog_err ("%s: could not raise privs", __func__);
+
 #ifdef IPTOS_PREC_INTERNETCONTROL
   if (sa->sa_family == AF_INET)
     setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
@@ -400,13 +407,10 @@
   }
 #endif
 
-  if (bgpd_privs.change (ZPRIVS_RAISE) )
-    zlog_err ("bgp_socket: could not raise privs");
-
   ret = bind (sock, sa, salen);
   en = errno;
-  if (bgpd_privs.change (ZPRIVS_LOWER) )
-    zlog_err ("bgp_bind_address: could not lower privs");
+  if (bgpd_privs.change (ZPRIVS_LOWER))
+    zlog_err ("%s: could not lower privs", __func__);
 
   if (ret < 0)
     {