bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49 #include "bgpd/bgp_nht.h"
  50
  51 extern struct zebra_privs_t bgpd_privs;
  52
  53 static char *bgp_get_bound_name(struct peer *peer);
  54
  55 /* BGP listening socket. */
  56 struct bgp_listener {
  57         int fd;
  58         union sockunion su;
  59         struct thread *thread;
  60         struct bgp *bgp;
  61         char *name;
  62 };
  63
  64 void bgp_dump_listener_info(struct vty *vty)
  65 {
  66         struct listnode *node;
  67         struct bgp_listener *listener;
  68
  69         vty_out(vty, "Name             fd Address\n");
  70         vty_out(vty, "---------------------------\n");
  71         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) {
  72                 char buf[SU_ADDRSTRLEN];
  73
  74                 vty_out(vty, "%-16s %d %s\n",
  75                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  76                         listener->fd,
  77                         sockunion2str(&listener->su, buf, sizeof(buf)));
  78         }
  79 }
  80
  81 /*
  82  * Set MD5 key for the socket, for the given IPv4 peer address.
  83  * If the password is NULL or zero-length, the option will be disabled.
  84  */
  85 static int bgp_md5_set_socket(int socket, union sockunion *su,
  86                               uint16_t prefixlen, const char *password)
  87 {
  88         int ret = -1;
  89         int en = ENOSYS;
  90 #if HAVE_DECL_TCP_MD5SIG
  91         union sockunion su2;
  92 #endif /* HAVE_TCP_MD5SIG */
  93
  94         assert(socket >= 0);
  95
  96 #if HAVE_DECL_TCP_MD5SIG
  97         /* Ensure there is no extraneous port information. */
  98         memcpy(&su2, su, sizeof(union sockunion));
  99         if (su2.sa.sa_family == AF_INET)
 100                 su2.sin.sin_port = 0;
 101         else
 102                 su2.sin6.sin6_port = 0;
 103
 104         /* For addresses, use the non-extended signature functionality */
 105         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_BITLEN)
 106             || (su2.sa.sa_family == AF_INET6 && prefixlen == IPV6_MAX_BITLEN))
 107                 ret = sockopt_tcp_signature(socket, &su2, password);
 108         else
 109                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
 110                                                 password);
 111         en = errno;
 112 #endif /* HAVE_TCP_MD5SIG */
 113
 114         if (ret < 0) {
 115                 char sabuf[SU_ADDRSTRLEN];
 116                 sockunion2str(su, sabuf, sizeof(sabuf));
 117
 118                 switch (ret) {
 119                 case -2:
 120                         flog_warn(
 121                                 EC_BGP_NO_TCP_MD5,
 122                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): This platform does not support MD5 auth for prefixes",
 123                                 sabuf, socket);
 124                         break;
 125                 default:
 126                         flog_warn(
 127                                 EC_BGP_NO_TCP_MD5,
 128                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): %s",
 129                                 sabuf, socket, safe_strerror(en));
 130                 }
 131         }
 132
 133         return ret;
 134 }
 135
 136 /* Helper for bgp_connect */
 137 static int bgp_md5_set_connect(int socket, union sockunion *su,
 138                                uint16_t prefixlen, const char *password)
 139 {
 140         int ret = -1;
 141
 142 #if HAVE_DECL_TCP_MD5SIG
 143         frr_with_privs(&bgpd_privs) {
 144                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 145         }
 146 #endif /* HAVE_TCP_MD5SIG */
 147
 148         return ret;
 149 }
 150
 151 static int bgp_md5_set_password(struct peer *peer, const char *password)
 152 {
 153         struct listnode *node;
 154         int ret = 0;
 155         struct bgp_listener *listener;
 156
 157         /*
 158          * Set or unset the password on the listen socket(s). Outbound
 159          * connections are taken care of in bgp_connect() below.
 160          */
 161         frr_with_privs(&bgpd_privs) {
 162                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 163                         if (listener->su.sa.sa_family ==
 164                             peer->su.sa.sa_family) {
 165                                 uint16_t prefixlen =
 166                                         peer->su.sa.sa_family == AF_INET
 167                                                 ? IPV4_MAX_BITLEN
 168                                                 : IPV6_MAX_BITLEN;
 169
 170                                 /*
 171                                  * if we have stored a BGP vrf instance in the
 172                                  * listener it must match the bgp instance in
 173                                  * the peer otherwise the peer bgp instance
 174                                  * must be the default vrf or a view instance
 175                                  */
 176                                 if (!listener->bgp) {
 177                                         if (peer->bgp->vrf_id != VRF_DEFAULT)
 178                                                 continue;
 179                                 } else if (listener->bgp != peer->bgp)
 180                                         continue;
 181
 182                                 ret = bgp_md5_set_socket(listener->fd,
 183                                                          &peer->su, prefixlen,
 184                                                          password);
 185                                 break;
 186                         }
 187         }
 188         return ret;
 189 }
 190
 191 int bgp_md5_set_prefix(struct bgp *bgp, struct prefix *p, const char *password)
 192 {
 193         int ret = 0;
 194         union sockunion su;
 195         struct listnode *node;
 196         struct bgp_listener *listener;
 197
 198         /* Set or unset the password on the listen socket(s). */
 199         frr_with_privs(&bgpd_privs) {
 200                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 201                         if (listener->su.sa.sa_family == p->family
 202                             && ((bgp->vrf_id == VRF_DEFAULT)
 203                                 || (listener->bgp == bgp))) {
 204                                 prefix2sockunion(p, &su);
 205                                 ret = bgp_md5_set_socket(listener->fd, &su,
 206                                                          p->prefixlen,
 207                                                          password);
 208                                 break;
 209                         }
 210         }
 211
 212         return ret;
 213 }
 214
 215 int bgp_md5_unset_prefix(struct bgp *bgp, struct prefix *p)
 216 {
 217         return bgp_md5_set_prefix(bgp, p, NULL);
 218 }
 219
 220 int bgp_md5_set(struct peer *peer)
 221 {
 222         /* Set the password from listen socket. */
 223         return bgp_md5_set_password(peer, peer->password);
 224 }
 225
 226 int bgp_md5_unset(struct peer *peer)
 227 {
 228         /* Unset the password from listen socket. */
 229         return bgp_md5_set_password(peer, NULL);
 230 }
 231
 232 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 233 {
 234         int ret = 0;
 235
 236         /* In case of peer is EBGP, we should set TTL for this connection.  */
 237         if (!peer->gtsm_hops && (peer_sort_lookup(peer) == BGP_PEER_EBGP)) {
 238                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 239                 if (ret) {
 240                         flog_err(
 241                                 EC_LIB_SOCKET,
 242                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 243                                 __func__, &peer->remote_id, errno);
 244                         return ret;
 245                 }
 246         } else if (peer->gtsm_hops) {
 247                 /* On Linux, setting minttl without setting ttl seems to mess
 248                    with the
 249                    outgoing ttl. Therefore setting both.
 250                 */
 251                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 252                 if (ret) {
 253                         flog_err(
 254                                 EC_LIB_SOCKET,
 255                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 256                                 __func__, &peer->remote_id, errno);
 257                         return ret;
 258                 }
 259                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 260                                      MAXTTL + 1 - peer->gtsm_hops);
 261                 if (ret) {
 262                         flog_err(
 263                                 EC_LIB_SOCKET,
 264                                 "%s: Can't set MinTTL on peer (rtrid %pI4) socket, err = %d",
 265                                 __func__, &peer->remote_id, errno);
 266                         return ret;
 267                 }
 268         }
 269
 270         return ret;
 271 }
 272
 273 /*
 274  * Obtain the BGP instance that the incoming connection should be processed
 275  * against. This is important because more than one VRF could be using the
 276  * same IP address space. The instance is got by obtaining the device to
 277  * which the incoming connection is bound to. This could either be a VRF
 278  * or it could be an interface, which in turn determines the VRF.
 279  */
 280 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 281 {
 282 #ifndef SO_BINDTODEVICE
 283         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 284          * anyway since the assumption is that the interface name returned by
 285          * getsockopt() is useful in identifying the VRF, particularly with
 286          * Linux's
 287          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 288          * when other platforms add VRF support, this will need handling here as
 289          * well.  (or, some restructuring) */
 290         *bgp_inst = bgp_get_default();
 291         return !*bgp_inst;
 292
 293 #else
 294         char name[VRF_NAMSIZ + 1];
 295         socklen_t name_len = VRF_NAMSIZ;
 296         struct bgp *bgp;
 297         int rc;
 298         struct listnode *node, *nnode;
 299
 300         *bgp_inst = NULL;
 301         name[0] = '\0';
 302         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 303         if (rc != 0) {
 304 #if defined(HAVE_CUMULUS)
 305                 flog_err(EC_LIB_SOCKET,
 306                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 307                          safe_strerror(errno), sock);
 308                 return -1;
 309 #endif
 310         }
 311
 312         if (!strlen(name)) {
 313                 *bgp_inst = bgp_get_default();
 314                 return 0; /* default instance. */
 315         }
 316
 317         /* First try match to instance; if that fails, check for interfaces. */
 318         bgp = bgp_lookup_by_name(name);
 319         if (bgp) {
 320                 if (!bgp->vrf_id) // unexpected
 321                         return -1;
 322                 *bgp_inst = bgp;
 323                 return 0;
 324         }
 325
 326         /* TODO - This will be optimized once interfaces move into the NS */
 327         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 328                 struct interface *ifp;
 329
 330                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 331                         continue;
 332
 333                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 334                 if (ifp) {
 335                         *bgp_inst = bgp;
 336                         return 0;
 337                 }
 338         }
 339
 340         /* We didn't match to either an instance or an interface. */
 341         return -1;
 342 #endif
 343 }
 344
 345 static void bgp_socket_set_buffer_size(const int fd)
 346 {
 347         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 348                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 349         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 350                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 351 }
 352
 353 /* Accept bgp connection. */
 354 static int bgp_accept(struct thread *thread)
 355 {
 356         int bgp_sock;
 357         int accept_sock;
 358         union sockunion su;
 359         struct bgp_listener *listener = THREAD_ARG(thread);
 360         struct peer *peer;
 361         struct peer *peer1;
 362         char buf[SU_ADDRSTRLEN];
 363         struct bgp *bgp = NULL;
 364
 365         sockunion_init(&su);
 366
 367         bgp = bgp_lookup_by_name(listener->name);
 368
 369         /* Register accept thread. */
 370         accept_sock = THREAD_FD(thread);
 371         if (accept_sock < 0) {
 372                 flog_err_sys(EC_LIB_SOCKET,
 373                              "[Error] BGP accept socket fd is negative: %d",
 374                              accept_sock);
 375                 return -1;
 376         }
 377
 378         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 379                         &listener->thread);
 380
 381         /* Accept client connection. */
 382         bgp_sock = sockunion_accept(accept_sock, &su);
 383         int save_errno = errno;
 384         if (bgp_sock < 0) {
 385                 if (save_errno == EINVAL) {
 386                         struct vrf *vrf =
 387                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 388
 389                         /*
 390                          * It appears that sometimes, when VRFs are deleted on
 391                          * the system, it takes a little while for us to get
 392                          * notified about that. In the meantime we endlessly
 393                          * loop on accept(), because the socket, having been
 394                          * bound to a now-deleted VRF device, is in some weird
 395                          * state which causes accept() to fail.
 396                          *
 397                          * To avoid this, if we see accept() fail with EINVAL,
 398                          * we cancel ourselves and trust that when the VRF
 399                          * deletion notification comes in the event handler for
 400                          * that will take care of cleaning us up.
 401                          */
 402                         flog_err_sys(
 403                                 EC_LIB_SOCKET,
 404                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 405                                 safe_strerror(save_errno), accept_sock,
 406                                 VRF_LOGNAME(vrf));
 407                         THREAD_OFF(listener->thread);
 408                 } else {
 409                         flog_err_sys(
 410                                 EC_LIB_SOCKET,
 411                                 "[Error] BGP socket accept failed (%s); retrying",
 412                                 safe_strerror(save_errno));
 413                 }
 414                 return -1;
 415         }
 416         set_nonblocking(bgp_sock);
 417
 418         /* Obtain BGP instance this connection is meant for.
 419          * - if it is a VRF netns sock, then BGP is in listener structure
 420          * - otherwise, the bgp instance need to be demultiplexed
 421          */
 422         if (listener->bgp)
 423                 bgp = listener->bgp;
 424         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 425                 if (bgp_debug_neighbor_events(NULL))
 426                         zlog_debug(
 427                                 "[Event] Could not get instance for incoming conn from %s",
 428                                 inet_sutop(&su, buf));
 429                 close(bgp_sock);
 430                 return -1;
 431         }
 432
 433         bgp_socket_set_buffer_size(bgp_sock);
 434
 435         /* Check remote IP address */
 436         peer1 = peer_lookup(bgp, &su);
 437
 438         if (!peer1) {
 439                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 440                 if (peer1) {
 441                         /* Dynamic neighbor has been created, let it proceed */
 442                         peer1->fd = bgp_sock;
 443
 444                         /* Set the user configured MSS to TCP socket */
 445                         if (CHECK_FLAG(peer1->flags, PEER_FLAG_TCP_MSS))
 446                                 sockopt_tcp_mss_set(bgp_sock, peer1->tcp_mss);
 447
 448                         bgp_fsm_change_status(peer1, Active);
 449                         BGP_TIMER_OFF(
 450                                 peer1->t_start); /* created in peer_create() */
 451
 452                         if (peer_active(peer1)) {
 453                                 if (CHECK_FLAG(peer1->flags,
 454                                                PEER_FLAG_TIMER_DELAYOPEN))
 455                                         BGP_EVENT_ADD(
 456                                                 peer1,
 457                                                 TCP_connection_open_w_delay);
 458                                 else
 459                                         BGP_EVENT_ADD(peer1,
 460                                                       TCP_connection_open);
 461                         }
 462
 463                         return 0;
 464                 }
 465         }
 466
 467         if (!peer1) {
 468                 if (bgp_debug_neighbor_events(NULL)) {
 469                         zlog_debug(
 470                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 471                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 472                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 473                 }
 474                 close(bgp_sock);
 475                 return -1;
 476         }
 477
 478         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)
 479             || CHECK_FLAG(peer1->bgp->flags, BGP_FLAG_SHUTDOWN)) {
 480                 if (bgp_debug_neighbor_events(peer1))
 481                         zlog_debug(
 482                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 483                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 484                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 485                 close(bgp_sock);
 486                 return -1;
 487         }
 488
 489         /*
 490          * Do not accept incoming connections in Clearing state. This can result
 491          * in incorect state transitions - e.g., the connection goes back to
 492          * Established and then the Clearing_Completed event is generated. Also,
 493          * block incoming connection in Deleted state.
 494          */
 495         if (peer1->status == Clearing || peer1->status == Deleted) {
 496                 if (bgp_debug_neighbor_events(peer1))
 497                         zlog_debug(
 498                                 "[Event] Closing incoming conn for %s (%p) state %d",
 499                                 peer1->host, peer1, peer1->status);
 500                 close(bgp_sock);
 501                 return -1;
 502         }
 503
 504         /* Check that at least one AF is activated for the peer. */
 505         if (!peer_active(peer1)) {
 506                 if (bgp_debug_neighbor_events(peer1))
 507                         zlog_debug(
 508                                 "%s - incoming conn rejected - no AF activated for peer",
 509                                 peer1->host);
 510                 close(bgp_sock);
 511                 return -1;
 512         }
 513
 514         /* Do not try to reconnect if the peer reached maximum
 515          * prefixes, restart timer is still running or the peer
 516          * is shutdown.
 517          */
 518         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 519                 if (bgp_debug_neighbor_events(peer1))
 520                         zlog_debug(
 521                                 "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 522                                 peer1->host);
 523                 close(bgp_sock);
 524                 return -1;
 525         }
 526
 527         if (bgp_debug_neighbor_events(peer1))
 528                 zlog_debug("[Event] BGP connection from host %s fd %d",
 529                            inet_sutop(&su, buf), bgp_sock);
 530
 531         if (peer1->doppelganger) {
 532                 /* We have an existing connection. Kill the existing one and run
 533                    with this one.
 534                 */
 535                 if (bgp_debug_neighbor_events(peer1))
 536                         zlog_debug(
 537                                 "[Event] New active connection from peer %s, Killing previous active connection",
 538                                 peer1->host);
 539                 peer_delete(peer1->doppelganger);
 540         }
 541
 542         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 543                 if (bgp_debug_neighbor_events(peer1))
 544                         zlog_debug(
 545                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 546                                 peer1->host);
 547
 548         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 549                            peer1->as, peer1->as_type, NULL);
 550         hash_release(peer->bgp->peerhash, peer);
 551         hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 552
 553         peer_xfer_config(peer, peer1);
 554         bgp_peer_gr_flags_update(peer);
 555
 556         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 557                                                           peer->bgp->peer);
 558
 559         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 560
 561                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 562
 563                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 564                         peer_nsf_stop(peer);
 565                 }
 566         }
 567
 568         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 569
 570         peer->doppelganger = peer1;
 571         peer1->doppelganger = peer;
 572         peer->fd = bgp_sock;
 573         frr_with_privs(&bgpd_privs) {
 574                 vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 575         }
 576         bgp_peer_reg_with_nht(peer);
 577         bgp_fsm_change_status(peer, Active);
 578         BGP_TIMER_OFF(peer->t_start); /* created in peer_create() */
 579
 580         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 581         /* Make dummy peer until read Open packet. */
 582         if (peer_established(peer1)
 583             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 584                 /* If we have an existing established connection with graceful
 585                  * restart
 586                  * capability announced with one or more address families, then
 587                  * drop
 588                  * existing established connection and move state to connect.
 589                  */
 590                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 591
 592                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 593                     || CHECK_FLAG(peer1->flags,
 594                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 595                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 596
 597                 bgp_event_update(peer1, TCP_connection_closed);
 598         }
 599
 600         if (peer_active(peer)) {
 601                 if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER_DELAYOPEN))
 602                         BGP_EVENT_ADD(peer, TCP_connection_open_w_delay);
 603                 else
 604                         BGP_EVENT_ADD(peer, TCP_connection_open);
 605         }
 606
 607         /*
 608          * If we are doing nht for a peer that is v6 LL based
 609          * massage the event system to make things happy
 610          */
 611         bgp_nht_interface_events(peer);
 612
 613         return 0;
 614 }
 615
 616 /* BGP socket bind. */
 617 static char *bgp_get_bound_name(struct peer *peer)
 618 {
 619         if (!peer)
 620                 return NULL;
 621
 622         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 623             && !peer->conf_if)
 624                 return NULL;
 625
 626         if (peer->su.sa.sa_family != AF_INET
 627             && peer->su.sa.sa_family != AF_INET6)
 628                 return NULL; // unexpected
 629
 630         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 631          * takes precedence over VRF. For IPv4 peering, explicit interface or
 632          * VRF are the situations to bind.
 633          */
 634         if (peer->su.sa.sa_family == AF_INET6 && peer->conf_if)
 635                 return peer->conf_if;
 636
 637         if (peer->ifname)
 638                 return peer->ifname;
 639
 640         if (peer->bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 641                 return NULL;
 642
 643         return peer->bgp->name;
 644 }
 645
 646 static int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 647                               union sockunion *addr)
 648 {
 649         struct prefix *p, *sel, d;
 650         struct connected *connected;
 651         struct listnode *node;
 652         int common;
 653
 654         if (!sockunion2hostprefix(dst, &d))
 655                 return 1;
 656
 657         sel = NULL;
 658         common = -1;
 659
 660         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 661                 p = connected->address;
 662                 if (p->family != d.family)
 663                         continue;
 664                 if (prefix_common_bits(p, &d) > common) {
 665                         sel = p;
 666                         common = prefix_common_bits(sel, &d);
 667                 }
 668         }
 669
 670         if (!sel)
 671                 return 1;
 672
 673         prefix2sockunion(sel, addr);
 674         return 0;
 675 }
 676
 677 /* Update source selection.  */
 678 static int bgp_update_source(struct peer *peer)
 679 {
 680         struct interface *ifp;
 681         union sockunion addr;
 682         int ret = 0;
 683
 684         sockunion_init(&addr);
 685
 686         /* Source is specified with interface name.  */
 687         if (peer->update_if) {
 688                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 689                 if (!ifp)
 690                         return -1;
 691
 692                 if (bgp_update_address(ifp, &peer->su, &addr))
 693                         return -1;
 694
 695                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 696         }
 697
 698         /* Source is specified with IP address.  */
 699         if (peer->update_source)
 700                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 701                                      peer->update_source);
 702
 703         return ret;
 704 }
 705
 706 /* BGP try to connect to the peer.  */
 707 int bgp_connect(struct peer *peer)
 708 {
 709         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 710         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 711         ifindex_t ifindex = 0;
 712
 713         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 714                 if (bgp_debug_neighbor_events(peer))
 715                         zlog_debug("Peer address not learnt: Returning from connect");
 716                 return 0;
 717         }
 718         frr_with_privs(&bgpd_privs) {
 719         /* Make socket for the peer. */
 720                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 721                                                 bgp_get_bound_name(peer));
 722         }
 723         if (peer->fd < 0) {
 724                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 725                 if (bgp_debug_neighbor_events(peer))
 726                         zlog_debug("%s: Failure to create socket for connection to %s, error received: %s(%d)",
 727                                    __func__, peer->host, safe_strerror(errno),
 728                                    errno);
 729                 return -1;
 730         }
 731
 732         set_nonblocking(peer->fd);
 733
 734         /* Set the user configured MSS to TCP socket */
 735         if (CHECK_FLAG(peer->flags, PEER_FLAG_TCP_MSS))
 736                 sockopt_tcp_mss_set(peer->fd, peer->tcp_mss);
 737
 738         bgp_socket_set_buffer_size(peer->fd);
 739
 740         if (bgp_set_socket_ttl(peer, peer->fd) < 0) {
 741                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 742                 if (bgp_debug_neighbor_events(peer))
 743                         zlog_debug("%s: Failure to set socket ttl for connection to %s, error received: %s(%d)",
 744                                    __func__, peer->host, safe_strerror(errno),
 745                                    errno);
 746                 return -1;
 747         }
 748
 749         sockopt_reuseaddr(peer->fd);
 750         sockopt_reuseport(peer->fd);
 751
 752 #ifdef IPTOS_PREC_INTERNETCONTROL
 753         frr_with_privs(&bgpd_privs) {
 754                 if (sockunion_family(&peer->su) == AF_INET)
 755                         setsockopt_ipv4_tos(peer->fd,
 756                                             IPTOS_PREC_INTERNETCONTROL);
 757                 else if (sockunion_family(&peer->su) == AF_INET6)
 758                         setsockopt_ipv6_tclass(peer->fd,
 759                                                IPTOS_PREC_INTERNETCONTROL);
 760         }
 761 #endif
 762
 763         if (peer->password) {
 764                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 765                                              ? IPV4_MAX_BITLEN
 766                                              : IPV6_MAX_BITLEN;
 767
 768                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 769                                     peer->password);
 770         }
 771
 772         /* Update source bind. */
 773         if (bgp_update_source(peer) < 0) {
 774                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 775                 return connect_error;
 776         }
 777
 778         if (peer->conf_if || peer->ifname)
 779                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 780                                                        : peer->ifname,
 781                                          peer->bgp->vrf_id);
 782
 783         if (bgp_debug_neighbor_events(peer))
 784                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 785                            peer->host, peer->fd);
 786
 787         /* Connect to the remote peer. */
 788         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 789                                  ifindex);
 790 }
 791
 792 /* After TCP connection is established.  Get local address and port. */
 793 int bgp_getsockname(struct peer *peer)
 794 {
 795         if (peer->su_local) {
 796                 sockunion_free(peer->su_local);
 797                 peer->su_local = NULL;
 798         }
 799
 800         if (peer->su_remote) {
 801                 sockunion_free(peer->su_remote);
 802                 peer->su_remote = NULL;
 803         }
 804
 805         peer->su_local = sockunion_getsockname(peer->fd);
 806         if (!peer->su_local)
 807                 return -1;
 808         peer->su_remote = sockunion_getpeername(peer->fd);
 809         if (!peer->su_remote)
 810                 return -1;
 811
 812         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 813                                    &peer->nexthop, peer)) {
 814                 flog_err(EC_BGP_NH_UPD,
 815                          "%s: nexthop_set failed, resetting connection - intf %p",
 816                          peer->host, peer->nexthop.ifp);
 817                 return -1;
 818         }
 819         return 0;
 820 }
 821
 822
 823 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 824                         struct bgp *bgp)
 825 {
 826         struct bgp_listener *listener;
 827         int ret, en;
 828
 829         sockopt_reuseaddr(sock);
 830         sockopt_reuseport(sock);
 831
 832         frr_with_privs(&bgpd_privs) {
 833
 834 #ifdef IPTOS_PREC_INTERNETCONTROL
 835                 if (sa->sa_family == AF_INET)
 836                         setsockopt_ipv4_tos(sock, IPTOS_PREC_INTERNETCONTROL);
 837                 else if (sa->sa_family == AF_INET6)
 838                         setsockopt_ipv6_tclass(sock,
 839                                                IPTOS_PREC_INTERNETCONTROL);
 840 #endif
 841
 842                 sockopt_v6only(sa->sa_family, sock);
 843
 844                 ret = bind(sock, sa, salen);
 845                 en = errno;
 846         }
 847
 848         if (ret < 0) {
 849                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 850                 return ret;
 851         }
 852
 853         ret = listen(sock, SOMAXCONN);
 854         if (ret < 0) {
 855                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 856                 return ret;
 857         }
 858
 859         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 860         listener->fd = sock;
 861         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 862
 863         /* this socket is in a vrf record bgp back pointer */
 864         if (bgp->vrf_id != VRF_DEFAULT)
 865                 listener->bgp = bgp;
 866
 867         memcpy(&listener->su, sa, salen);
 868         thread_add_read(bm->master, bgp_accept, listener, sock,
 869                         &listener->thread);
 870         listnode_add(bm->listen_sockets, listener);
 871
 872         return 0;
 873 }
 874
 875 /* IPv6 supported version of BGP server socket setup.  */
 876 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 877 {
 878         struct addrinfo *ainfo;
 879         struct addrinfo *ainfo_save;
 880         static const struct addrinfo req = {
 881                 .ai_family = AF_UNSPEC,
 882                 .ai_flags = AI_PASSIVE,
 883                 .ai_socktype = SOCK_STREAM,
 884         };
 885         int ret, count;
 886         char port_str[BUFSIZ];
 887
 888         snprintf(port_str, sizeof(port_str), "%d", port);
 889         port_str[sizeof(port_str) - 1] = '\0';
 890
 891         frr_with_privs(&bgpd_privs) {
 892                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 893                                       bgp->vrf_id);
 894         }
 895         if (ret != 0) {
 896                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 897                              gai_strerror(ret));
 898                 return -1;
 899         }
 900         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 901             bgp->vrf_id != VRF_DEFAULT) {
 902                 freeaddrinfo(ainfo_save);
 903                 return -1;
 904         }
 905         count = 0;
 906         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 907                 int sock;
 908
 909                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 910                         continue;
 911
 912                 frr_with_privs(&bgpd_privs) {
 913                         sock = vrf_socket(ainfo->ai_family,
 914                                           ainfo->ai_socktype,
 915                                           ainfo->ai_protocol,
 916                                           bgp->vrf_id,
 917                                           (bgp->inst_type
 918                                            == BGP_INSTANCE_TYPE_VRF
 919                                            ? bgp->name : NULL));
 920                 }
 921                 if (sock < 0) {
 922                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 923                                      safe_strerror(errno));
 924                         continue;
 925                 }
 926
 927                 /* if we intend to implement ttl-security, this socket needs
 928                  * ttl=255 */
 929                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 930
 931                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 932                                    bgp);
 933                 if (ret == 0)
 934                         ++count;
 935                 else
 936                         close(sock);
 937         }
 938         freeaddrinfo(ainfo_save);
 939         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 940                 flog_err(
 941                         EC_LIB_SOCKET,
 942                         "%s: no usable addresses please check other programs usage of specified port %d",
 943                         __func__, port);
 944                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 945                              __func__);
 946                 exit(-1);
 947         }
 948
 949         return 0;
 950 }
 951
 952 /* this function closes vrf socket
 953  * this should be called only for vrf socket with netns backend
 954  */
 955 void bgp_close_vrf_socket(struct bgp *bgp)
 956 {
 957         struct listnode *node, *next;
 958         struct bgp_listener *listener;
 959
 960         if (!bgp)
 961                 return;
 962
 963         if (bm->listen_sockets == NULL)
 964                 return;
 965
 966         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 967                 if (listener->bgp == bgp) {
 968                         THREAD_OFF(listener->thread);
 969                         close(listener->fd);
 970                         listnode_delete(bm->listen_sockets, listener);
 971                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 972                         XFREE(MTYPE_BGP_LISTENER, listener);
 973                 }
 974         }
 975 }
 976
 977 /* this function closes main socket
 978  */
 979 void bgp_close(void)
 980 {
 981         struct listnode *node, *next;
 982         struct bgp_listener *listener;
 983
 984         if (bm->listen_sockets == NULL)
 985                 return;
 986
 987         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 988                 if (listener->bgp)
 989                         continue;
 990                 THREAD_OFF(listener->thread);
 991                 close(listener->fd);
 992                 listnode_delete(bm->listen_sockets, listener);
 993                 XFREE(MTYPE_BGP_LISTENER, listener->name);
 994                 XFREE(MTYPE_BGP_LISTENER, listener);
 995         }
 996 }