1/* BGP network related fucntions
2   Copyright (C) 1999 Kunihiro Ishiguro
3
4This file is part of GNU Zebra.
5
6GNU Zebra is free software; you can redistribute it and/or modify it
7under the terms of the GNU General Public License as published by the
8Free Software Foundation; either version 2, or (at your option) any
9later version.
10
11GNU Zebra is distributed in the hope that it will be useful, but
12WITHOUT ANY WARRANTY; without even the implied warranty of
13MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14General Public License for more details.
15
16You should have received a copy of the GNU General Public License
17along with GNU Zebra; see the file COPYING.  If not, write to the Free
18Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
1902111-1307, USA.  */
20
21#include <zebra.h>
22
23#include "thread.h"
24#include "sockunion.h"
25#include "sockopt.h"
26#include "memory.h"
27#include "log.h"
28#include "if.h"
29#include "prefix.h"
30#include "command.h"
31#include "privs.h"
32#include "linklist.h"
33#include "network.h"
34
35#include "bgpd/bgpd.h"
36#include "bgpd/bgp_fsm.h"
37#include "bgpd/bgp_attr.h"
38#include "bgpd/bgp_debug.h"
39#include "bgpd/bgp_network.h"
40
41extern struct zebra_privs_t bgpd_privs;
42
43/* BGP listening socket. */
44struct bgp_listener
45{
46  int fd;
47  union sockunion su;
48  struct thread *thread;
49};
50
51/*
52 * Set MD5 key for the socket, for the given IPv4 peer address.
53 * If the password is NULL or zero-length, the option will be disabled.
54 */
55static int
56bgp_md5_set_socket (int socket, union sockunion *su, const char *password)
57{
58  int ret = -1;
59  int en = ENOSYS;
60
61  assert (socket >= 0);
62
63#if HAVE_DECL_TCP_MD5SIG
64  ret = sockopt_tcp_signature (socket, su, password);
65  en  = errno;
66#endif /* HAVE_TCP_MD5SIG */
67
68  if (ret < 0)
69    zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s",
70          socket, safe_strerror (en));
71
72  return ret;
73}
74
75/* Helper for bgp_connect */
76static int
77bgp_md5_set_connect (int socket, union sockunion *su, const char *password)
78{
79  int ret = -1;
80
81#if HAVE_DECL_TCP_MD5SIG
82  if ( bgpd_privs.change (ZPRIVS_RAISE) )
83    {
84      zlog_err ("%s: could not raise privs", __func__);
85      return ret;
86    }
87
88  ret = bgp_md5_set_socket (socket, su, password);
89
90  if (bgpd_privs.change (ZPRIVS_LOWER) )
91    zlog_err ("%s: could not lower privs", __func__);
92#endif /* HAVE_TCP_MD5SIG */
93
94  return ret;
95}
96
97int
98bgp_md5_set (struct peer *peer)
99{
100  struct listnode *node;
101  int ret = 0;
102  struct bgp_listener *listener;
103
104  if ( bgpd_privs.change (ZPRIVS_RAISE) )
105    {
106      zlog_err ("%s: could not raise privs", __func__);
107      return -1;
108    }
109
110  /* Just set the password on the listen socket(s). Outbound connections
111   * are taken care of in bgp_connect() below.
112   */
113  for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
114    if (listener->su.sa.sa_family == peer->su.sa.sa_family)
115      {
116	ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password);
117	break;
118      }
119
120  if (bgpd_privs.change (ZPRIVS_LOWER) )
121    zlog_err ("%s: could not lower privs", __func__);
122
123  return ret;
124}
125
126/* Update BGP socket send buffer size */
127static void
128bgp_update_sock_send_buffer_size (int fd)
129{
130  int size = BGP_SOCKET_SNDBUF_SIZE;
131  int optval;
132  socklen_t optlen = sizeof(optval);
133
134  if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &optval, &optlen) < 0)
135    {
136      zlog_err("getsockopt of SO_SNDBUF failed %s\n", safe_strerror(errno));
137      return;
138    }
139  if (optval < size)
140    {
141      if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0)
142        {
143          zlog_err("Couldn't increase send buffer: %s\n", safe_strerror(errno));
144        }
145    }
146}
147
148static void
149bgp_set_socket_ttl (struct peer *peer, int bgp_sock)
150{
151  char buf[INET_ADDRSTRLEN];
152  int ret;
153
154  /* In case of peer is EBGP, we should set TTL for this connection.  */
155  if (!peer->gtsm_hops && (peer_sort (peer) == BGP_PEER_EBGP))
156    {
157      ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, peer->ttl);
158      if (ret)
159	{
160	  zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
161		    __func__,
162		    inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
163		    errno);
164	}
165    }
166  else if (peer->gtsm_hops)
167    {
168      /* On Linux, setting minttl without setting ttl seems to mess with the
169	 outgoing ttl. Therefore setting both.
170      */
171      ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, MAXTTL);
172      if (ret)
173	{
174	  zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
175		    __func__,
176		    inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
177		    errno);
178	}
179      ret = sockopt_minttl (peer->su.sa.sa_family, bgp_sock,
180			    MAXTTL + 1 - peer->gtsm_hops);
181      if (ret)
182	{
183	  zlog_err ("%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d",
184		    __func__,
185		    inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
186		    errno);
187	}
188    }
189}
190
191/* Accept bgp connection. */
192static int
193bgp_accept (struct thread *thread)
194{
195  int bgp_sock;
196  int accept_sock;
197  union sockunion su;
198  struct bgp_listener *listener = THREAD_ARG(thread);
199  struct peer *peer;
200  struct peer *peer1;
201  char buf[SU_ADDRSTRLEN];
202
203  /* Register accept thread. */
204  accept_sock = THREAD_FD (thread);
205  if (accept_sock < 0)
206    {
207      zlog_err ("accept_sock is nevative value %d", accept_sock);
208      return -1;
209    }
210  listener->thread = thread_add_read (master, bgp_accept, listener, accept_sock);
211
212  /* Accept client connection. */
213  bgp_sock = sockunion_accept (accept_sock, &su);
214  if (bgp_sock < 0)
215    {
216      zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno));
217      return -1;
218    }
219  set_nonblocking (bgp_sock);
220
221  /* Set socket send buffer size */
222  bgp_update_sock_send_buffer_size(bgp_sock);
223
224  if (BGP_DEBUG (events, EVENTS))
225    zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf));
226
227  /* Check remote IP address */
228  peer1 = peer_lookup (NULL, &su);
229  if (! peer1 || peer1->status == Idle)
230    {
231      if (BGP_DEBUG (events, EVENTS))
232	{
233	  if (! peer1)
234	    zlog_debug ("[Event] BGP connection IP address %s is not configured",
235		       inet_sutop (&su, buf));
236	  else
237	    zlog_debug ("[Event] BGP connection IP address %s is Idle state",
238		       inet_sutop (&su, buf));
239	}
240      close (bgp_sock);
241      return -1;
242    }
243
244  bgp_set_socket_ttl (peer1, bgp_sock);
245
246  /* Make dummy peer until read Open packet. */
247  if (BGP_DEBUG (events, EVENTS))
248    zlog_debug ("[Event] Make dummy peer structure until read Open packet");
249
250  {
251    char buf[SU_ADDRSTRLEN];
252
253    peer = peer_create_accept (peer1->bgp);
254    SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER);
255    peer->su = su;
256    peer->fd = bgp_sock;
257    peer->status = Active;
258    peer->local_id = peer1->local_id;
259    peer->v_holdtime = peer1->v_holdtime;
260    peer->v_keepalive = peer1->v_keepalive;
261
262    /* Make peer's address string. */
263    sockunion2str (&su, buf, SU_ADDRSTRLEN);
264    peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf);
265  }
266
267  BGP_EVENT_ADD (peer, TCP_connection_open);
268
269  return 0;
270}
271
272/* BGP socket bind. */
273static int
274bgp_bind (struct peer *peer)
275{
276#ifdef SO_BINDTODEVICE
277  int ret;
278  struct ifreq ifreq;
279
280  if (! peer->ifname)
281    return 0;
282
283  strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name));
284
285  if ( bgpd_privs.change (ZPRIVS_RAISE) )
286  	zlog_err ("bgp_bind: could not raise privs");
287
288  ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE,
289		    &ifreq, sizeof (ifreq));
290
291  if (bgpd_privs.change (ZPRIVS_LOWER) )
292    zlog_err ("bgp_bind: could not lower privs");
293
294  if (ret < 0)
295    {
296      zlog (peer->log, LOG_INFO, "bind to interface %s failed", peer->ifname);
297      return ret;
298    }
299#endif /* SO_BINDTODEVICE */
300  return 0;
301}
302
303static int
304bgp_update_address (struct interface *ifp, const union sockunion *dst,
305		    union sockunion *addr)
306{
307  struct prefix *p, *sel, *d;
308  struct connected *connected;
309  struct listnode *node;
310  int common;
311
312  d = sockunion2hostprefix (dst);
313  sel = NULL;
314  common = -1;
315
316  for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected))
317    {
318      p = connected->address;
319      if (p->family != d->family)
320	continue;
321      if (prefix_common_bits (p, d) > common)
322	{
323	  sel = p;
324	  common = prefix_common_bits (sel, d);
325	}
326    }
327
328  prefix_free (d);
329  if (!sel)
330    return 1;
331
332  prefix2sockunion (sel, addr);
333  return 0;
334}
335
336/* Update source selection.  */
337static void
338bgp_update_source (struct peer *peer)
339{
340  struct interface *ifp;
341  union sockunion addr;
342
343  /* Source is specified with interface name.  */
344  if (peer->update_if)
345    {
346      ifp = if_lookup_by_name (peer->update_if);
347      if (! ifp)
348	return;
349
350      if (bgp_update_address (ifp, &peer->su, &addr))
351	return;
352
353      sockunion_bind (peer->fd, &addr, 0, &addr);
354    }
355
356  /* Source is specified with IP address.  */
357  if (peer->update_source)
358    sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source);
359}
360
361/* BGP try to connect to the peer.  */
362int
363bgp_connect (struct peer *peer)
364{
365  unsigned int ifindex = 0;
366
367  /* Make socket for the peer. */
368  peer->fd = sockunion_socket (&peer->su);
369  if (peer->fd < 0)
370    return -1;
371
372  set_nonblocking (peer->fd);
373
374  /* Set socket send buffer size */
375  bgp_update_sock_send_buffer_size(peer->fd);
376
377  bgp_set_socket_ttl (peer, peer->fd);
378
379  sockopt_reuseaddr (peer->fd);
380  sockopt_reuseport (peer->fd);
381
382#ifdef IPTOS_PREC_INTERNETCONTROL
383  if (bgpd_privs.change (ZPRIVS_RAISE))
384    zlog_err ("%s: could not raise privs", __func__);
385  if (sockunion_family (&peer->su) == AF_INET)
386    setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
387# ifdef HAVE_IPV6
388  else if (sockunion_family (&peer->su) == AF_INET6)
389    setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL);
390# endif
391  if (bgpd_privs.change (ZPRIVS_LOWER))
392    zlog_err ("%s: could not lower privs", __func__);
393#endif
394
395  if (peer->password)
396    bgp_md5_set_connect (peer->fd, &peer->su, peer->password);
397
398  /* Bind socket. */
399  bgp_bind (peer);
400
401  /* Update source bind. */
402  bgp_update_source (peer);
403
404#ifdef HAVE_IPV6
405  if (peer->ifname)
406    ifindex = if_nametoindex (peer->ifname);
407#endif /* HAVE_IPV6 */
408
409  if (BGP_DEBUG (events, EVENTS))
410    plog_debug (peer->log, "%s [Event] Connect start to %s fd %d",
411	       peer->host, peer->host, peer->fd);
412
413  /* Connect to the remote peer. */
414  return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex);
415}
416
417/* After TCP connection is established.  Get local address and port. */
418void
419bgp_getsockname (struct peer *peer)
420{
421  if (peer->su_local)
422    {
423      sockunion_free (peer->su_local);
424      peer->su_local = NULL;
425    }
426
427  if (peer->su_remote)
428    {
429      sockunion_free (peer->su_remote);
430      peer->su_remote = NULL;
431    }
432
433  peer->su_local = sockunion_getsockname (peer->fd);
434  peer->su_remote = sockunion_getpeername (peer->fd);
435
436  bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer);
437}
438
439
440static int
441bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
442{
443  struct bgp_listener *listener;
444  int ret, en;
445
446  sockopt_reuseaddr (sock);
447  sockopt_reuseport (sock);
448
449  if (bgpd_privs.change (ZPRIVS_RAISE))
450    zlog_err ("%s: could not raise privs", __func__);
451
452#ifdef IPTOS_PREC_INTERNETCONTROL
453  if (sa->sa_family == AF_INET)
454    setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
455#  ifdef HAVE_IPV6
456  else if (sa->sa_family == AF_INET6)
457    setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL);
458#  endif
459#endif
460
461  sockopt_v6only (sa->sa_family, sock);
462
463  ret = bind (sock, sa, salen);
464  en = errno;
465  if (bgpd_privs.change (ZPRIVS_LOWER))
466    zlog_err ("%s: could not lower privs", __func__);
467
468  if (ret < 0)
469    {
470      zlog_err ("bind: %s", safe_strerror (en));
471      return ret;
472    }
473
474  ret = listen (sock, 3);
475  if (ret < 0)
476    {
477      zlog_err ("listen: %s", safe_strerror (errno));
478      return ret;
479    }
480
481  listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener));
482  listener->fd = sock;
483  memcpy(&listener->su, sa, salen);
484  listener->thread = thread_add_read (master, bgp_accept, listener, sock);
485  listnode_add (bm->listen_sockets, listener);
486
487  return 0;
488}
489
490/* IPv6 supported version of BGP server socket setup.  */
491#ifdef HAVE_IPV6
492int
493bgp_socket (unsigned short port, const char *address)
494{
495  struct addrinfo *ainfo;
496  struct addrinfo *ainfo_save;
497  static const struct addrinfo req = {
498    .ai_family = AF_UNSPEC,
499    .ai_flags = AI_PASSIVE,
500    .ai_socktype = SOCK_STREAM,
501  };
502  int ret, count;
503  char port_str[BUFSIZ];
504
505  snprintf (port_str, sizeof(port_str), "%d", port);
506  port_str[sizeof (port_str) - 1] = '\0';
507
508  ret = getaddrinfo (address, port_str, &req, &ainfo_save);
509  if (ret != 0)
510    {
511      zlog_err ("getaddrinfo: %s", gai_strerror (ret));
512      return -1;
513    }
514
515  count = 0;
516  for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next)
517    {
518      int sock;
519
520      if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
521	continue;
522
523      sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol);
524      if (sock < 0)
525	{
526	  zlog_err ("socket: %s", safe_strerror (errno));
527	  continue;
528	}
529
530      /* if we intend to implement ttl-security, this socket needs ttl=255 */
531      sockopt_ttl (ainfo->ai_family, sock, MAXTTL);
532
533      ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen);
534      if (ret == 0)
535	++count;
536      else
537	close(sock);
538    }
539  freeaddrinfo (ainfo_save);
540  if (count == 0)
541    {
542      zlog_err ("%s: no usable addresses", __func__);
543      return -1;
544    }
545
546  return 0;
547}
548#else
549/* Traditional IPv4 only version.  */
550int
551bgp_socket (unsigned short port, const char *address)
552{
553  int sock;
554  int socklen;
555  struct sockaddr_in sin;
556  int ret, en;
557
558  sock = socket (AF_INET, SOCK_STREAM, 0);
559  if (sock < 0)
560    {
561      zlog_err ("socket: %s", safe_strerror (errno));
562      return sock;
563    }
564
565  /* if we intend to implement ttl-security, this socket needs ttl=255 */
566  sockopt_ttl (AF_INET, sock, MAXTTL);
567
568  memset (&sin, 0, sizeof (struct sockaddr_in));
569  sin.sin_family = AF_INET;
570  sin.sin_port = htons (port);
571  socklen = sizeof (struct sockaddr_in);
572
573  if (address && ((ret = inet_aton(address, &sin.sin_addr)) < 1))
574    {
575      zlog_err("bgp_socket: could not parse ip address %s: %s",
576                address, safe_strerror (errno));
577      return ret;
578    }
579#ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
580  sin.sin_len = socklen;
581#endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
582
583  ret = bgp_listener (sock, (struct sockaddr *) &sin, socklen);
584  if (ret < 0)
585    {
586      close (sock);
587      return ret;
588    }
589  return sock;
590}
591#endif /* HAVE_IPV6 */
592
593void
594bgp_close (void)
595{
596  struct listnode *node, *next;
597  struct bgp_listener *listener;
598
599  for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener))
600    {
601      thread_cancel (listener->thread);
602      close (listener->fd);
603      listnode_delete (bm->listen_sockets, listener);
604      XFREE (MTYPE_BGP_LISTENER, listener);
605    }
606}
607