bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49
  50 extern struct zebra_privs_t bgpd_privs;
  51
  52 static char *bgp_get_bound_name(struct peer *peer);
  53
  54 /* BGP listening socket. */
  55 struct bgp_listener {
  56         int fd;
  57         union sockunion su;
  58         struct thread *thread;
  59         struct bgp *bgp;
  60         char *name;
  61 };
  62
  63 void bgp_dump_listener_info(struct vty *vty)
  64 {
  65         struct listnode *node;
  66         struct bgp_listener *listener;
  67
  68         vty_out(vty, "Name             fd Address\n");
  69         vty_out(vty, "---------------------------\n");
  70         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) {
  71                 char buf[SU_ADDRSTRLEN];
  72
  73                 vty_out(vty, "%-16s %d %s\n",
  74                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  75                         listener->fd,
  76                         sockunion2str(&listener->su, buf, sizeof(buf)));
  77         }
  78 }
  79
  80 /*
  81  * Set MD5 key for the socket, for the given IPv4 peer address.
  82  * If the password is NULL or zero-length, the option will be disabled.
  83  */
  84 static int bgp_md5_set_socket(int socket, union sockunion *su,
  85                               uint16_t prefixlen, const char *password)
  86 {
  87         int ret = -1;
  88         int en = ENOSYS;
  89 #if HAVE_DECL_TCP_MD5SIG
  90         union sockunion su2;
  91 #endif /* HAVE_TCP_MD5SIG */
  92
  93         assert(socket >= 0);
  94
  95 #if HAVE_DECL_TCP_MD5SIG
  96         /* Ensure there is no extraneous port information. */
  97         memcpy(&su2, su, sizeof(union sockunion));
  98         if (su2.sa.sa_family == AF_INET)
  99                 su2.sin.sin_port = 0;
 100         else
 101                 su2.sin6.sin6_port = 0;
 102
 103         /* For addresses, use the non-extended signature functionality */
 104         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_PREFIXLEN)
 105             || (su2.sa.sa_family == AF_INET6
 106                 && prefixlen == IPV6_MAX_PREFIXLEN))
 107                 ret = sockopt_tcp_signature(socket, &su2, password);
 108         else
 109                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
 110                                                 password);
 111         en = errno;
 112 #endif /* HAVE_TCP_MD5SIG */
 113
 114         if (ret < 0) {
 115                 char sabuf[SU_ADDRSTRLEN];
 116                 sockunion2str(su, sabuf, sizeof(sabuf));
 117
 118                 switch (ret) {
 119                 case -2:
 120                         flog_warn(
 121                                 EC_BGP_NO_TCP_MD5,
 122                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): This platform does not support MD5 auth for prefixes",
 123                                 sabuf, socket);
 124                         break;
 125                 default:
 126                         flog_warn(
 127                                 EC_BGP_NO_TCP_MD5,
 128                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): %s",
 129                                 sabuf, socket, safe_strerror(en));
 130                 }
 131         }
 132
 133         return ret;
 134 }
 135
 136 /* Helper for bgp_connect */
 137 static int bgp_md5_set_connect(int socket, union sockunion *su,
 138                                uint16_t prefixlen, const char *password)
 139 {
 140         int ret = -1;
 141
 142 #if HAVE_DECL_TCP_MD5SIG
 143         frr_with_privs(&bgpd_privs) {
 144                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 145         }
 146 #endif /* HAVE_TCP_MD5SIG */
 147
 148         return ret;
 149 }
 150
 151 static int bgp_md5_set_password(struct peer *peer, const char *password)
 152 {
 153         struct listnode *node;
 154         int ret = 0;
 155         struct bgp_listener *listener;
 156
 157         /*
 158          * Set or unset the password on the listen socket(s). Outbound
 159          * connections are taken care of in bgp_connect() below.
 160          */
 161         frr_with_privs(&bgpd_privs) {
 162                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 163                         if (listener->su.sa.sa_family
 164                             == peer->su.sa.sa_family) {
 165                                 uint16_t prefixlen =
 166                                         peer->su.sa.sa_family == AF_INET
 167                                                 ? IPV4_MAX_PREFIXLEN
 168                                                 : IPV6_MAX_PREFIXLEN;
 169
 170                                 ret = bgp_md5_set_socket(listener->fd,
 171                                                          &peer->su, prefixlen,
 172                                                          password);
 173                                 break;
 174                         }
 175         }
 176         return ret;
 177 }
 178
 179 int bgp_md5_set_prefix(struct prefix *p, const char *password)
 180 {
 181         int ret = 0;
 182         union sockunion su;
 183         struct listnode *node;
 184         struct bgp_listener *listener;
 185
 186         /* Set or unset the password on the listen socket(s). */
 187         frr_with_privs(&bgpd_privs) {
 188                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 189                         if (listener->su.sa.sa_family == p->family) {
 190                                 prefix2sockunion(p, &su);
 191                                 ret = bgp_md5_set_socket(listener->fd, &su,
 192                                                          p->prefixlen,
 193                                                          password);
 194                                 break;
 195                         }
 196         }
 197
 198         return ret;
 199 }
 200
 201 int bgp_md5_unset_prefix(struct prefix *p)
 202 {
 203         return bgp_md5_set_prefix(p, NULL);
 204 }
 205
 206 int bgp_md5_set(struct peer *peer)
 207 {
 208         /* Set the password from listen socket. */
 209         return bgp_md5_set_password(peer, peer->password);
 210 }
 211
 212 int bgp_md5_unset(struct peer *peer)
 213 {
 214         /* Unset the password from listen socket. */
 215         return bgp_md5_set_password(peer, NULL);
 216 }
 217
 218 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 219 {
 220         char buf[INET_ADDRSTRLEN];
 221         int ret = 0;
 222
 223         /* In case of peer is EBGP, we should set TTL for this connection.  */
 224         if (!peer->gtsm_hops && (peer_sort_lookup(peer) == BGP_PEER_EBGP)) {
 225                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 226                 if (ret) {
 227                         flog_err(
 228                                 EC_LIB_SOCKET,
 229                                 "%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
 230                                 __func__,
 231                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 232                                           sizeof(buf)),
 233                                 errno);
 234                         return ret;
 235                 }
 236         } else if (peer->gtsm_hops) {
 237                 /* On Linux, setting minttl without setting ttl seems to mess
 238                    with the
 239                    outgoing ttl. Therefore setting both.
 240                 */
 241                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 242                 if (ret) {
 243                         flog_err(
 244                                 EC_LIB_SOCKET,
 245                                 "%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
 246                                 __func__,
 247                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 248                                           sizeof(buf)),
 249                                 errno);
 250                         return ret;
 251                 }
 252                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 253                                      MAXTTL + 1 - peer->gtsm_hops);
 254                 if (ret) {
 255                         flog_err(
 256                                 EC_LIB_SOCKET,
 257                                 "%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d",
 258                                 __func__,
 259                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 260                                           sizeof(buf)),
 261                                 errno);
 262                         return ret;
 263                 }
 264         }
 265
 266         return ret;
 267 }
 268
 269 /*
 270  * Obtain the BGP instance that the incoming connection should be processed
 271  * against. This is important because more than one VRF could be using the
 272  * same IP address space. The instance is got by obtaining the device to
 273  * which the incoming connection is bound to. This could either be a VRF
 274  * or it could be an interface, which in turn determines the VRF.
 275  */
 276 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 277 {
 278 #ifndef SO_BINDTODEVICE
 279         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 280          * anyway since the assumption is that the interface name returned by
 281          * getsockopt() is useful in identifying the VRF, particularly with
 282          * Linux's
 283          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 284          * when other platforms add VRF support, this will need handling here as
 285          * well.  (or, some restructuring) */
 286         *bgp_inst = bgp_get_default();
 287         return !*bgp_inst;
 288
 289 #else
 290         char name[VRF_NAMSIZ + 1];
 291         socklen_t name_len = VRF_NAMSIZ;
 292         struct bgp *bgp;
 293         int rc;
 294         struct listnode *node, *nnode;
 295
 296         *bgp_inst = NULL;
 297         name[0] = '\0';
 298         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 299         if (rc != 0) {
 300 #if defined(HAVE_CUMULUS)
 301                 flog_err(EC_LIB_SOCKET,
 302                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 303                          safe_strerror(errno), sock);
 304                 return -1;
 305 #endif
 306         }
 307
 308         if (!strlen(name)) {
 309                 *bgp_inst = bgp_get_default();
 310                 return 0; /* default instance. */
 311         }
 312
 313         /* First try match to instance; if that fails, check for interfaces. */
 314         bgp = bgp_lookup_by_name(name);
 315         if (bgp) {
 316                 if (!bgp->vrf_id) // unexpected
 317                         return -1;
 318                 *bgp_inst = bgp;
 319                 return 0;
 320         }
 321
 322         /* TODO - This will be optimized once interfaces move into the NS */
 323         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 324                 struct interface *ifp;
 325
 326                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 327                         continue;
 328
 329                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 330                 if (ifp) {
 331                         *bgp_inst = bgp;
 332                         return 0;
 333                 }
 334         }
 335
 336         /* We didn't match to either an instance or an interface. */
 337         return -1;
 338 #endif
 339 }
 340
 341 static void bgp_socket_set_buffer_size(const int fd)
 342 {
 343         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 344                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 345         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 346                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 347 }
 348
 349 /* Accept bgp connection. */
 350 static int bgp_accept(struct thread *thread)
 351 {
 352         int bgp_sock;
 353         int accept_sock;
 354         union sockunion su;
 355         struct bgp_listener *listener = THREAD_ARG(thread);
 356         struct peer *peer;
 357         struct peer *peer1;
 358         char buf[SU_ADDRSTRLEN];
 359         struct bgp *bgp = NULL;
 360
 361         sockunion_init(&su);
 362
 363         bgp = bgp_lookup_by_name(listener->name);
 364
 365         /* Register accept thread. */
 366         accept_sock = THREAD_FD(thread);
 367         if (accept_sock < 0) {
 368                 flog_err_sys(EC_LIB_SOCKET,
 369                              "[Error] BGP accept socket fd is negative: %d",
 370                              accept_sock);
 371                 return -1;
 372         }
 373         listener->thread = NULL;
 374
 375         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 376                         &listener->thread);
 377
 378         /* Accept client connection. */
 379         bgp_sock = sockunion_accept(accept_sock, &su);
 380         int save_errno = errno;
 381         if (bgp_sock < 0) {
 382                 if (save_errno == EINVAL) {
 383                         struct vrf *vrf =
 384                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 385
 386                         /*
 387                          * It appears that sometimes, when VRFs are deleted on
 388                          * the system, it takes a little while for us to get
 389                          * notified about that. In the meantime we endlessly
 390                          * loop on accept(), because the socket, having been
 391                          * bound to a now-deleted VRF device, is in some weird
 392                          * state which causes accept() to fail.
 393                          *
 394                          * To avoid this, if we see accept() fail with EINVAL,
 395                          * we cancel ourselves and trust that when the VRF
 396                          * deletion notification comes in the event handler for
 397                          * that will take care of cleaning us up.
 398                          */
 399                         flog_err_sys(
 400                                 EC_LIB_SOCKET,
 401                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 402                                 safe_strerror(save_errno), accept_sock,
 403                                 VRF_LOGNAME(vrf));
 404                         THREAD_OFF(listener->thread);
 405                 } else {
 406                         flog_err_sys(
 407                                 EC_LIB_SOCKET,
 408                                 "[Error] BGP socket accept failed (%s); retrying",
 409                                 safe_strerror(save_errno));
 410                 }
 411                 return -1;
 412         }
 413         set_nonblocking(bgp_sock);
 414
 415         /* Obtain BGP instance this connection is meant for.
 416          * - if it is a VRF netns sock, then BGP is in listener structure
 417          * - otherwise, the bgp instance need to be demultiplexed
 418          */
 419         if (listener->bgp)
 420                 bgp = listener->bgp;
 421         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 422                 if (bgp_debug_neighbor_events(NULL))
 423                         zlog_debug(
 424                                 "[Event] Could not get instance for incoming conn from %s",
 425                                 inet_sutop(&su, buf));
 426                 close(bgp_sock);
 427                 return -1;
 428         }
 429
 430         bgp_socket_set_buffer_size(bgp_sock);
 431
 432         /* Check remote IP address */
 433         peer1 = peer_lookup(bgp, &su);
 434
 435         if (!peer1) {
 436                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 437                 if (peer1) {
 438                         /* Dynamic neighbor has been created, let it proceed */
 439                         peer1->fd = bgp_sock;
 440                         bgp_fsm_change_status(peer1, Active);
 441                         BGP_TIMER_OFF(
 442                                 peer1->t_start); /* created in peer_create() */
 443
 444                         if (peer_active(peer1))
 445                                 BGP_EVENT_ADD(peer1, TCP_connection_open);
 446
 447                         return 0;
 448                 }
 449         }
 450
 451         if (!peer1) {
 452                 if (bgp_debug_neighbor_events(NULL)) {
 453                         zlog_debug(
 454                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 455                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 456                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 457                 }
 458                 close(bgp_sock);
 459                 return -1;
 460         }
 461
 462         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)) {
 463                 if (bgp_debug_neighbor_events(peer1))
 464                         zlog_debug(
 465                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 466                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 467                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 468                 close(bgp_sock);
 469                 return -1;
 470         }
 471
 472         /*
 473          * Do not accept incoming connections in Clearing state. This can result
 474          * in incorect state transitions - e.g., the connection goes back to
 475          * Established and then the Clearing_Completed event is generated. Also,
 476          * block incoming connection in Deleted state.
 477          */
 478         if (peer1->status == Clearing || peer1->status == Deleted) {
 479                 if (bgp_debug_neighbor_events(peer1))
 480                         zlog_debug(
 481                                 "[Event] Closing incoming conn for %s (%p) state %d",
 482                                 peer1->host, peer1, peer1->status);
 483                 close(bgp_sock);
 484                 return -1;
 485         }
 486
 487         /* Check that at least one AF is activated for the peer. */
 488         if (!peer_active(peer1)) {
 489                 if (bgp_debug_neighbor_events(peer1))
 490                         zlog_debug(
 491                                 "%s - incoming conn rejected - no AF activated for peer",
 492                                 peer1->host);
 493                 close(bgp_sock);
 494                 return -1;
 495         }
 496
 497         /* Do not try to reconnect if the peer reached maximum
 498          * prefixes, restart timer is still running or the peer
 499          * is shutdown.
 500          */
 501         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 502                 if (bgp_debug_neighbor_events(peer1))
 503                         zlog_debug(
 504                                 "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 505                                 peer1->host);
 506                 close(bgp_sock);
 507                 return -1;
 508         }
 509
 510         if (bgp_debug_neighbor_events(peer1))
 511                 zlog_debug("[Event] BGP connection from host %s fd %d",
 512                            inet_sutop(&su, buf), bgp_sock);
 513
 514         if (peer1->doppelganger) {
 515                 /* We have an existing connection. Kill the existing one and run
 516                    with this one.
 517                 */
 518                 if (bgp_debug_neighbor_events(peer1))
 519                         zlog_debug(
 520                                 "[Event] New active connection from peer %s, Killing previous active connection",
 521                                 peer1->host);
 522                 peer_delete(peer1->doppelganger);
 523         }
 524
 525         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 526                 if (bgp_debug_neighbor_events(peer1))
 527                         zlog_debug(
 528                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 529                                 peer1->host);
 530
 531         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 532                            peer1->as, peer1->as_type, 0, 0, NULL);
 533         hash_release(peer->bgp->peerhash, peer);
 534         hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 535
 536         peer_xfer_config(peer, peer1);
 537         bgp_peer_gr_flags_update(peer);
 538
 539         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 540                                                           peer->bgp->peer);
 541
 542         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 543
 544                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 545
 546                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 547                         peer_nsf_stop(peer);
 548                 }
 549         }
 550
 551         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 552
 553         peer->doppelganger = peer1;
 554         peer1->doppelganger = peer;
 555         peer->fd = bgp_sock;
 556         vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 557         bgp_fsm_change_status(peer, Active);
 558         BGP_TIMER_OFF(peer->t_start); /* created in peer_create() */
 559
 560         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 561         /* Make dummy peer until read Open packet. */
 562         if (peer1->status == Established
 563             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 564                 /* If we have an existing established connection with graceful
 565                  * restart
 566                  * capability announced with one or more address families, then
 567                  * drop
 568                  * existing established connection and move state to connect.
 569                  */
 570                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 571
 572                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 573                     || CHECK_FLAG(peer1->flags,
 574                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 575                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 576
 577                 bgp_event_update(peer1, TCP_connection_closed);
 578         }
 579
 580         if (peer_active(peer)) {
 581                 BGP_EVENT_ADD(peer, TCP_connection_open);
 582         }
 583
 584         return 0;
 585 }
 586
 587 /* BGP socket bind. */
 588 static char *bgp_get_bound_name(struct peer *peer)
 589 {
 590         char *name = NULL;
 591
 592         if (!peer)
 593                 return NULL;
 594
 595         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 596             && !peer->conf_if)
 597                 return NULL;
 598
 599         if (peer->su.sa.sa_family != AF_INET
 600             && peer->su.sa.sa_family != AF_INET6)
 601                 return NULL; // unexpected
 602
 603         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 604          * takes precedence over VRF. For IPv4 peering, explicit interface or
 605          * VRF are the situations to bind.
 606          */
 607         if (peer->su.sa.sa_family == AF_INET6)
 608                 name = (peer->conf_if ? peer->conf_if
 609                                       : (peer->ifname ? peer->ifname
 610                                                       : peer->bgp->name));
 611         else
 612                 name = peer->ifname ? peer->ifname : peer->bgp->name;
 613
 614         return name;
 615 }
 616
 617 static int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 618                               union sockunion *addr)
 619 {
 620         struct prefix *p, *sel, d;
 621         struct connected *connected;
 622         struct listnode *node;
 623         int common;
 624
 625         sockunion2hostprefix(dst, &d);
 626         sel = NULL;
 627         common = -1;
 628
 629         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 630                 p = connected->address;
 631                 if (p->family != d.family)
 632                         continue;
 633                 if (prefix_common_bits(p, &d) > common) {
 634                         sel = p;
 635                         common = prefix_common_bits(sel, &d);
 636                 }
 637         }
 638
 639         if (!sel)
 640                 return 1;
 641
 642         prefix2sockunion(sel, addr);
 643         return 0;
 644 }
 645
 646 /* Update source selection.  */
 647 static int bgp_update_source(struct peer *peer)
 648 {
 649         struct interface *ifp;
 650         union sockunion addr;
 651         int ret = 0;
 652
 653         sockunion_init(&addr);
 654
 655         /* Source is specified with interface name.  */
 656         if (peer->update_if) {
 657                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 658                 if (!ifp)
 659                         return -1;
 660
 661                 if (bgp_update_address(ifp, &peer->su, &addr))
 662                         return -1;
 663
 664                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 665         }
 666
 667         /* Source is specified with IP address.  */
 668         if (peer->update_source)
 669                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 670                                      peer->update_source);
 671
 672         return ret;
 673 }
 674
 675 /* BGP try to connect to the peer.  */
 676 int bgp_connect(struct peer *peer)
 677 {
 678         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 679         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 680         ifindex_t ifindex = 0;
 681
 682         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 683                 zlog_debug("Peer address not learnt: Returning from connect");
 684                 return 0;
 685         }
 686         frr_with_privs(&bgpd_privs) {
 687         /* Make socket for the peer. */
 688                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 689                                                 bgp_get_bound_name(peer));
 690         }
 691         if (peer->fd < 0)
 692                 return -1;
 693
 694         set_nonblocking(peer->fd);
 695
 696         bgp_socket_set_buffer_size(peer->fd);
 697
 698         if (bgp_set_socket_ttl(peer, peer->fd) < 0)
 699                 return -1;
 700
 701         sockopt_reuseaddr(peer->fd);
 702         sockopt_reuseport(peer->fd);
 703
 704 #ifdef IPTOS_PREC_INTERNETCONTROL
 705         frr_with_privs(&bgpd_privs) {
 706                 if (sockunion_family(&peer->su) == AF_INET)
 707                         setsockopt_ipv4_tos(peer->fd,
 708                                             IPTOS_PREC_INTERNETCONTROL);
 709                 else if (sockunion_family(&peer->su) == AF_INET6)
 710                         setsockopt_ipv6_tclass(peer->fd,
 711                                                IPTOS_PREC_INTERNETCONTROL);
 712         }
 713 #endif
 714
 715         if (peer->password) {
 716                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 717                                              ? IPV4_MAX_PREFIXLEN
 718                                              : IPV6_MAX_PREFIXLEN;
 719
 720                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 721                                     peer->password);
 722         }
 723
 724         /* Update source bind. */
 725         if (bgp_update_source(peer) < 0) {
 726                 return connect_error;
 727         }
 728
 729         if (peer->conf_if || peer->ifname)
 730                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 731                                                        : peer->ifname,
 732                                          peer->bgp->vrf_id);
 733
 734         if (bgp_debug_neighbor_events(peer))
 735                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 736                            peer->host, peer->fd);
 737
 738         /* Connect to the remote peer. */
 739         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 740                                  ifindex);
 741 }
 742
 743 /* After TCP connection is established.  Get local address and port. */
 744 int bgp_getsockname(struct peer *peer)
 745 {
 746         if (peer->su_local) {
 747                 sockunion_free(peer->su_local);
 748                 peer->su_local = NULL;
 749         }
 750
 751         if (peer->su_remote) {
 752                 sockunion_free(peer->su_remote);
 753                 peer->su_remote = NULL;
 754         }
 755
 756         peer->su_local = sockunion_getsockname(peer->fd);
 757         if (!peer->su_local)
 758                 return -1;
 759         peer->su_remote = sockunion_getpeername(peer->fd);
 760         if (!peer->su_remote)
 761                 return -1;
 762
 763         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 764                                    &peer->nexthop, peer)) {
 765                 flog_err(EC_BGP_NH_UPD,
 766                          "%s: nexthop_set failed, resetting connection - intf %p",
 767                          peer->host, peer->nexthop.ifp);
 768                 return -1;
 769         }
 770         return 0;
 771 }
 772
 773
 774 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 775                         struct bgp *bgp)
 776 {
 777         struct bgp_listener *listener;
 778         int ret, en;
 779
 780         sockopt_reuseaddr(sock);
 781         sockopt_reuseport(sock);
 782
 783         frr_with_privs(&bgpd_privs) {
 784
 785 #ifdef IPTOS_PREC_INTERNETCONTROL
 786                 if (sa->sa_family == AF_INET)
 787                         setsockopt_ipv4_tos(sock, IPTOS_PREC_INTERNETCONTROL);
 788                 else if (sa->sa_family == AF_INET6)
 789                         setsockopt_ipv6_tclass(sock,
 790                                                IPTOS_PREC_INTERNETCONTROL);
 791 #endif
 792
 793                 sockopt_v6only(sa->sa_family, sock);
 794
 795                 ret = bind(sock, sa, salen);
 796                 en = errno;
 797         }
 798
 799         if (ret < 0) {
 800                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 801                 return ret;
 802         }
 803
 804         ret = listen(sock, SOMAXCONN);
 805         if (ret < 0) {
 806                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 807                 return ret;
 808         }
 809
 810         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 811         listener->fd = sock;
 812         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 813
 814         /* this socket needs a change of ns. record bgp back pointer */
 815         if (bgp->vrf_id != VRF_DEFAULT && vrf_is_backend_netns())
 816                 listener->bgp = bgp;
 817
 818         memcpy(&listener->su, sa, salen);
 819         listener->thread = NULL;
 820         thread_add_read(bm->master, bgp_accept, listener, sock,
 821                         &listener->thread);
 822         listnode_add(bm->listen_sockets, listener);
 823
 824         return 0;
 825 }
 826
 827 /* IPv6 supported version of BGP server socket setup.  */
 828 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 829 {
 830         struct addrinfo *ainfo;
 831         struct addrinfo *ainfo_save;
 832         static const struct addrinfo req = {
 833                 .ai_family = AF_UNSPEC,
 834                 .ai_flags = AI_PASSIVE,
 835                 .ai_socktype = SOCK_STREAM,
 836         };
 837         int ret, count;
 838         char port_str[BUFSIZ];
 839
 840         snprintf(port_str, sizeof(port_str), "%d", port);
 841         port_str[sizeof(port_str) - 1] = '\0';
 842
 843         frr_with_privs(&bgpd_privs) {
 844                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 845                                       bgp->vrf_id);
 846         }
 847         if (ret != 0) {
 848                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 849                              gai_strerror(ret));
 850                 return -1;
 851         }
 852         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 853             bgp->vrf_id != VRF_DEFAULT) {
 854                 freeaddrinfo(ainfo_save);
 855                 return -1;
 856         }
 857         count = 0;
 858         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 859                 int sock;
 860
 861                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 862                         continue;
 863
 864                 frr_with_privs(&bgpd_privs) {
 865                         sock = vrf_socket(ainfo->ai_family,
 866                                           ainfo->ai_socktype,
 867                                           ainfo->ai_protocol, bgp->vrf_id,
 868                                           (bgp->inst_type
 869                                            == BGP_INSTANCE_TYPE_VRF
 870                                            ? bgp->name : NULL));
 871                 }
 872                 if (sock < 0) {
 873                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 874                                      safe_strerror(errno));
 875                         continue;
 876                 }
 877
 878                 /* if we intend to implement ttl-security, this socket needs
 879                  * ttl=255 */
 880                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 881
 882                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 883                                    bgp);
 884                 if (ret == 0)
 885                         ++count;
 886                 else
 887                         close(sock);
 888         }
 889         freeaddrinfo(ainfo_save);
 890         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 891                 flog_err(
 892                         EC_LIB_SOCKET,
 893                         "%s: no usable addresses please check other programs usage of specified port %d",
 894                         __func__, port);
 895                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 896                              __func__);
 897                 exit(-1);
 898         }
 899
 900         return 0;
 901 }
 902
 903 /* this function closes vrf socket
 904  * this should be called only for vrf socket with netns backend
 905  */
 906 void bgp_close_vrf_socket(struct bgp *bgp)
 907 {
 908         struct listnode *node, *next;
 909         struct bgp_listener *listener;
 910
 911         if (!bgp)
 912                 return;
 913
 914         if (bm->listen_sockets == NULL)
 915                 return;
 916
 917         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 918                 if (listener->bgp == bgp) {
 919                         THREAD_OFF(listener->thread);
 920                         close(listener->fd);
 921                         listnode_delete(bm->listen_sockets, listener);
 922                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 923                         XFREE(MTYPE_BGP_LISTENER, listener);
 924                 }
 925         }
 926 }
 927
 928 /* this function closes main socket
 929  */
 930 void bgp_close(void)
 931 {
 932         struct listnode *node, *next;
 933         struct bgp_listener *listener;
 934
 935         if (bm->listen_sockets == NULL)
 936                 return;
 937
 938         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 939                 if (listener->bgp)
 940                         continue;
 941                 THREAD_OFF(listener->thread);
 942                 close(listener->fd);
 943                 listnode_delete(bm->listen_sockets, listener);
 944                 XFREE(MTYPE_BGP_LISTENER, listener->name);
 945                 XFREE(MTYPE_BGP_LISTENER, listener);
 946         }
 947 }