1/* BGP network related fucntions 2 Copyright (C) 1999 Kunihiro Ishiguro 3 4This file is part of GNU Zebra. 5 6GNU Zebra is free software; you can redistribute it and/or modify it 7under the terms of the GNU General Public License as published by the 8Free Software Foundation; either version 2, or (at your option) any 9later version. 10 11GNU Zebra is distributed in the hope that it will be useful, but 12WITHOUT ANY WARRANTY; without even the implied warranty of 13MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14General Public License for more details. 15 16You should have received a copy of the GNU General Public License 17along with GNU Zebra; see the file COPYING. If not, write to the Free 18Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 1902111-1307, USA. */ 20 21#include <zebra.h> 22 23#include "thread.h" 24#include "sockunion.h" 25#include "sockopt.h" 26#include "memory.h" 27#include "log.h" 28#include "if.h" 29#include "prefix.h" 30#include "command.h" 31#include "privs.h" 32#include "linklist.h" 33#include "network.h" 34 35#include "bgpd/bgpd.h" 36#include "bgpd/bgp_fsm.h" 37#include "bgpd/bgp_attr.h" 38#include "bgpd/bgp_debug.h" 39#include "bgpd/bgp_network.h" 40 41extern struct zebra_privs_t bgpd_privs; 42 43/* BGP listening socket. */ 44struct bgp_listener 45{ 46 int fd; 47 union sockunion su; 48 struct thread *thread; 49}; 50 51/* 52 * Set MD5 key for the socket, for the given IPv4 peer address. 53 * If the password is NULL or zero-length, the option will be disabled. 54 */ 55static int 56bgp_md5_set_socket (int socket, union sockunion *su, const char *password) 57{ 58 int ret = -1; 59 int en = ENOSYS; 60 61 assert (socket >= 0); 62 63#if HAVE_DECL_TCP_MD5SIG 64 ret = sockopt_tcp_signature (socket, su, password); 65 en = errno; 66#endif /* HAVE_TCP_MD5SIG */ 67 68 if (ret < 0) 69 zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s", 70 socket, safe_strerror (en)); 71 72 return ret; 73} 74 75/* Helper for bgp_connect */ 76static int 77bgp_md5_set_connect (int socket, union sockunion *su, const char *password) 78{ 79 int ret = -1; 80 81#if HAVE_DECL_TCP_MD5SIG 82 if ( bgpd_privs.change (ZPRIVS_RAISE) ) 83 { 84 zlog_err ("%s: could not raise privs", __func__); 85 return ret; 86 } 87 88 ret = bgp_md5_set_socket (socket, su, password); 89 90 if (bgpd_privs.change (ZPRIVS_LOWER) ) 91 zlog_err ("%s: could not lower privs", __func__); 92#endif /* HAVE_TCP_MD5SIG */ 93 94 return ret; 95} 96 97int 98bgp_md5_set (struct peer *peer) 99{ 100 struct listnode *node; 101 int ret = 0; 102 struct bgp_listener *listener; 103 104 if ( bgpd_privs.change (ZPRIVS_RAISE) ) 105 { 106 zlog_err ("%s: could not raise privs", __func__); 107 return -1; 108 } 109 110 /* Just set the password on the listen socket(s). Outbound connections 111 * are taken care of in bgp_connect() below. 112 */ 113 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) 114 if (listener->su.sa.sa_family == peer->su.sa.sa_family) 115 { 116 ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password); 117 break; 118 } 119 120 if (bgpd_privs.change (ZPRIVS_LOWER) ) 121 zlog_err ("%s: could not lower privs", __func__); 122 123 return ret; 124} 125 126/* Update BGP socket send buffer size */ 127static void 128bgp_update_sock_send_buffer_size (int fd) 129{ 130 int size = BGP_SOCKET_SNDBUF_SIZE; 131 int optval; 132 socklen_t optlen = sizeof(optval); 133 134 if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &optval, &optlen) < 0) 135 { 136 zlog_err("getsockopt of SO_SNDBUF failed %s\n", safe_strerror(errno)); 137 return; 138 } 139 if (optval < size) 140 { 141 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0) 142 { 143 zlog_err("Couldn't increase send buffer: %s\n", safe_strerror(errno)); 144 } 145 } 146} 147 148static void 149bgp_set_socket_ttl (struct peer *peer, int bgp_sock) 150{ 151 char buf[INET_ADDRSTRLEN]; 152 int ret; 153 154 /* In case of peer is EBGP, we should set TTL for this connection. */ 155 if (!peer->gtsm_hops && (peer_sort (peer) == BGP_PEER_EBGP)) 156 { 157 ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, peer->ttl); 158 if (ret) 159 { 160 zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d", 161 __func__, 162 inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), 163 errno); 164 } 165 } 166 else if (peer->gtsm_hops) 167 { 168 /* On Linux, setting minttl without setting ttl seems to mess with the 169 outgoing ttl. Therefore setting both. 170 */ 171 ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, MAXTTL); 172 if (ret) 173 { 174 zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d", 175 __func__, 176 inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), 177 errno); 178 } 179 ret = sockopt_minttl (peer->su.sa.sa_family, bgp_sock, 180 MAXTTL + 1 - peer->gtsm_hops); 181 if (ret) 182 { 183 zlog_err ("%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d", 184 __func__, 185 inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), 186 errno); 187 } 188 } 189} 190 191/* Accept bgp connection. */ 192static int 193bgp_accept (struct thread *thread) 194{ 195 int bgp_sock; 196 int accept_sock; 197 union sockunion su; 198 struct bgp_listener *listener = THREAD_ARG(thread); 199 struct peer *peer; 200 struct peer *peer1; 201 char buf[SU_ADDRSTRLEN]; 202 203 /* Register accept thread. */ 204 accept_sock = THREAD_FD (thread); 205 if (accept_sock < 0) 206 { 207 zlog_err ("accept_sock is nevative value %d", accept_sock); 208 return -1; 209 } 210 listener->thread = thread_add_read (master, bgp_accept, listener, accept_sock); 211 212 /* Accept client connection. */ 213 bgp_sock = sockunion_accept (accept_sock, &su); 214 if (bgp_sock < 0) 215 { 216 zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno)); 217 return -1; 218 } 219 set_nonblocking (bgp_sock); 220 221 /* Set socket send buffer size */ 222 bgp_update_sock_send_buffer_size(bgp_sock); 223 224 if (BGP_DEBUG (events, EVENTS)) 225 zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf)); 226 227 /* Check remote IP address */ 228 peer1 = peer_lookup (NULL, &su); 229 if (! peer1 || peer1->status == Idle) 230 { 231 if (BGP_DEBUG (events, EVENTS)) 232 { 233 if (! peer1) 234 zlog_debug ("[Event] BGP connection IP address %s is not configured", 235 inet_sutop (&su, buf)); 236 else 237 zlog_debug ("[Event] BGP connection IP address %s is Idle state", 238 inet_sutop (&su, buf)); 239 } 240 close (bgp_sock); 241 return -1; 242 } 243 244 bgp_set_socket_ttl (peer1, bgp_sock); 245 246 /* Make dummy peer until read Open packet. */ 247 if (BGP_DEBUG (events, EVENTS)) 248 zlog_debug ("[Event] Make dummy peer structure until read Open packet"); 249 250 { 251 char buf[SU_ADDRSTRLEN]; 252 253 peer = peer_create_accept (peer1->bgp); 254 SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER); 255 peer->su = su; 256 peer->fd = bgp_sock; 257 peer->status = Active; 258 peer->local_id = peer1->local_id; 259 peer->v_holdtime = peer1->v_holdtime; 260 peer->v_keepalive = peer1->v_keepalive; 261 262 /* Make peer's address string. */ 263 sockunion2str (&su, buf, SU_ADDRSTRLEN); 264 peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf); 265 } 266 267 BGP_EVENT_ADD (peer, TCP_connection_open); 268 269 return 0; 270} 271 272/* BGP socket bind. */ 273static int 274bgp_bind (struct peer *peer) 275{ 276#ifdef SO_BINDTODEVICE 277 int ret; 278 struct ifreq ifreq; 279 280 if (! peer->ifname) 281 return 0; 282 283 strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name)); 284 285 if ( bgpd_privs.change (ZPRIVS_RAISE) ) 286 zlog_err ("bgp_bind: could not raise privs"); 287 288 ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE, 289 &ifreq, sizeof (ifreq)); 290 291 if (bgpd_privs.change (ZPRIVS_LOWER) ) 292 zlog_err ("bgp_bind: could not lower privs"); 293 294 if (ret < 0) 295 { 296 zlog (peer->log, LOG_INFO, "bind to interface %s failed", peer->ifname); 297 return ret; 298 } 299#endif /* SO_BINDTODEVICE */ 300 return 0; 301} 302 303static int 304bgp_update_address (struct interface *ifp, const union sockunion *dst, 305 union sockunion *addr) 306{ 307 struct prefix *p, *sel, *d; 308 struct connected *connected; 309 struct listnode *node; 310 int common; 311 312 d = sockunion2hostprefix (dst); 313 sel = NULL; 314 common = -1; 315 316 for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected)) 317 { 318 p = connected->address; 319 if (p->family != d->family) 320 continue; 321 if (prefix_common_bits (p, d) > common) 322 { 323 sel = p; 324 common = prefix_common_bits (sel, d); 325 } 326 } 327 328 prefix_free (d); 329 if (!sel) 330 return 1; 331 332 prefix2sockunion (sel, addr); 333 return 0; 334} 335 336/* Update source selection. */ 337static void 338bgp_update_source (struct peer *peer) 339{ 340 struct interface *ifp; 341 union sockunion addr; 342 343 /* Source is specified with interface name. */ 344 if (peer->update_if) 345 { 346 ifp = if_lookup_by_name (peer->update_if); 347 if (! ifp) 348 return; 349 350 if (bgp_update_address (ifp, &peer->su, &addr)) 351 return; 352 353 sockunion_bind (peer->fd, &addr, 0, &addr); 354 } 355 356 /* Source is specified with IP address. */ 357 if (peer->update_source) 358 sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source); 359} 360 361/* BGP try to connect to the peer. */ 362int 363bgp_connect (struct peer *peer) 364{ 365 unsigned int ifindex = 0; 366 367 /* Make socket for the peer. */ 368 peer->fd = sockunion_socket (&peer->su); 369 if (peer->fd < 0) 370 return -1; 371 372 set_nonblocking (peer->fd); 373 374 /* Set socket send buffer size */ 375 bgp_update_sock_send_buffer_size(peer->fd); 376 377 bgp_set_socket_ttl (peer, peer->fd); 378 379 sockopt_reuseaddr (peer->fd); 380 sockopt_reuseport (peer->fd); 381 382#ifdef IPTOS_PREC_INTERNETCONTROL 383 if (bgpd_privs.change (ZPRIVS_RAISE)) 384 zlog_err ("%s: could not raise privs", __func__); 385 if (sockunion_family (&peer->su) == AF_INET) 386 setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL); 387# ifdef HAVE_IPV6 388 else if (sockunion_family (&peer->su) == AF_INET6) 389 setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL); 390# endif 391 if (bgpd_privs.change (ZPRIVS_LOWER)) 392 zlog_err ("%s: could not lower privs", __func__); 393#endif 394 395 if (peer->password) 396 bgp_md5_set_connect (peer->fd, &peer->su, peer->password); 397 398 /* Bind socket. */ 399 bgp_bind (peer); 400 401 /* Update source bind. */ 402 bgp_update_source (peer); 403 404#ifdef HAVE_IPV6 405 if (peer->ifname) 406 ifindex = if_nametoindex (peer->ifname); 407#endif /* HAVE_IPV6 */ 408 409 if (BGP_DEBUG (events, EVENTS)) 410 plog_debug (peer->log, "%s [Event] Connect start to %s fd %d", 411 peer->host, peer->host, peer->fd); 412 413 /* Connect to the remote peer. */ 414 return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex); 415} 416 417/* After TCP connection is established. Get local address and port. */ 418void 419bgp_getsockname (struct peer *peer) 420{ 421 if (peer->su_local) 422 { 423 sockunion_free (peer->su_local); 424 peer->su_local = NULL; 425 } 426 427 if (peer->su_remote) 428 { 429 sockunion_free (peer->su_remote); 430 peer->su_remote = NULL; 431 } 432 433 peer->su_local = sockunion_getsockname (peer->fd); 434 peer->su_remote = sockunion_getpeername (peer->fd); 435 436 bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer); 437} 438 439 440static int 441bgp_listener (int sock, struct sockaddr *sa, socklen_t salen) 442{ 443 struct bgp_listener *listener; 444 int ret, en; 445 446 sockopt_reuseaddr (sock); 447 sockopt_reuseport (sock); 448 449 if (bgpd_privs.change (ZPRIVS_RAISE)) 450 zlog_err ("%s: could not raise privs", __func__); 451 452#ifdef IPTOS_PREC_INTERNETCONTROL 453 if (sa->sa_family == AF_INET) 454 setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL); 455# ifdef HAVE_IPV6 456 else if (sa->sa_family == AF_INET6) 457 setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL); 458# endif 459#endif 460 461 sockopt_v6only (sa->sa_family, sock); 462 463 ret = bind (sock, sa, salen); 464 en = errno; 465 if (bgpd_privs.change (ZPRIVS_LOWER)) 466 zlog_err ("%s: could not lower privs", __func__); 467 468 if (ret < 0) 469 { 470 zlog_err ("bind: %s", safe_strerror (en)); 471 return ret; 472 } 473 474 ret = listen (sock, 3); 475 if (ret < 0) 476 { 477 zlog_err ("listen: %s", safe_strerror (errno)); 478 return ret; 479 } 480 481 listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener)); 482 listener->fd = sock; 483 memcpy(&listener->su, sa, salen); 484 listener->thread = thread_add_read (master, bgp_accept, listener, sock); 485 listnode_add (bm->listen_sockets, listener); 486 487 return 0; 488} 489 490/* IPv6 supported version of BGP server socket setup. */ 491#ifdef HAVE_IPV6 492int 493bgp_socket (unsigned short port, const char *address) 494{ 495 struct addrinfo *ainfo; 496 struct addrinfo *ainfo_save; 497 static const struct addrinfo req = { 498 .ai_family = AF_UNSPEC, 499 .ai_flags = AI_PASSIVE, 500 .ai_socktype = SOCK_STREAM, 501 }; 502 int ret, count; 503 char port_str[BUFSIZ]; 504 505 snprintf (port_str, sizeof(port_str), "%d", port); 506 port_str[sizeof (port_str) - 1] = '\0'; 507 508 ret = getaddrinfo (address, port_str, &req, &ainfo_save); 509 if (ret != 0) 510 { 511 zlog_err ("getaddrinfo: %s", gai_strerror (ret)); 512 return -1; 513 } 514 515 count = 0; 516 for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) 517 { 518 int sock; 519 520 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6) 521 continue; 522 523 sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol); 524 if (sock < 0) 525 { 526 zlog_err ("socket: %s", safe_strerror (errno)); 527 continue; 528 } 529 530 /* if we intend to implement ttl-security, this socket needs ttl=255 */ 531 sockopt_ttl (ainfo->ai_family, sock, MAXTTL); 532 533 ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen); 534 if (ret == 0) 535 ++count; 536 else 537 close(sock); 538 } 539 freeaddrinfo (ainfo_save); 540 if (count == 0) 541 { 542 zlog_err ("%s: no usable addresses", __func__); 543 return -1; 544 } 545 546 return 0; 547} 548#else 549/* Traditional IPv4 only version. */ 550int 551bgp_socket (unsigned short port, const char *address) 552{ 553 int sock; 554 int socklen; 555 struct sockaddr_in sin; 556 int ret, en; 557 558 sock = socket (AF_INET, SOCK_STREAM, 0); 559 if (sock < 0) 560 { 561 zlog_err ("socket: %s", safe_strerror (errno)); 562 return sock; 563 } 564 565 /* if we intend to implement ttl-security, this socket needs ttl=255 */ 566 sockopt_ttl (AF_INET, sock, MAXTTL); 567 568 memset (&sin, 0, sizeof (struct sockaddr_in)); 569 sin.sin_family = AF_INET; 570 sin.sin_port = htons (port); 571 socklen = sizeof (struct sockaddr_in); 572 573 if (address && ((ret = inet_aton(address, &sin.sin_addr)) < 1)) 574 { 575 zlog_err("bgp_socket: could not parse ip address %s: %s", 576 address, safe_strerror (errno)); 577 return ret; 578 } 579#ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN 580 sin.sin_len = socklen; 581#endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */ 582 583 ret = bgp_listener (sock, (struct sockaddr *) &sin, socklen); 584 if (ret < 0) 585 { 586 close (sock); 587 return ret; 588 } 589 return sock; 590} 591#endif /* HAVE_IPV6 */ 592 593void 594bgp_close (void) 595{ 596 struct listnode *node, *next; 597 struct bgp_listener *listener; 598 599 for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener)) 600 { 601 thread_cancel (listener->thread); 602 close (listener->fd); 603 listnode_delete (bm->listen_sockets, listener); 604 XFREE (MTYPE_BGP_LISTENER, listener); 605 } 606} 607