bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49 #include "bgpd/bgp_nht.h"
  50
  51 extern struct zebra_privs_t bgpd_privs;
  52
  53 static char *bgp_get_bound_name(struct peer *peer);
  54
  55 void bgp_dump_listener_info(struct vty *vty)
  56 {
  57         struct listnode *node;
  58         struct bgp_listener *listener;
  59
  60         vty_out(vty, "Name             fd Address\n");
  61         vty_out(vty, "---------------------------\n");
  62         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
  63                 vty_out(vty, "%-16s %d %pSU\n",
  64                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  65                         listener->fd, &listener->su);
  66 }
  67
  68 /*
  69  * Set MD5 key for the socket, for the given IPv4 peer address.
  70  * If the password is NULL or zero-length, the option will be disabled.
  71  */
  72 static int bgp_md5_set_socket(int socket, union sockunion *su,
  73                               uint16_t prefixlen, const char *password)
  74 {
  75         int ret = -1;
  76         int en = ENOSYS;
  77 #if HAVE_DECL_TCP_MD5SIG
  78         union sockunion su2;
  79 #endif /* HAVE_TCP_MD5SIG */
  80
  81         assert(socket >= 0);
  82
  83 #if HAVE_DECL_TCP_MD5SIG
  84         /* Ensure there is no extraneous port information. */
  85         memcpy(&su2, su, sizeof(union sockunion));
  86         if (su2.sa.sa_family == AF_INET)
  87                 su2.sin.sin_port = 0;
  88         else
  89                 su2.sin6.sin6_port = 0;
  90
  91         /* For addresses, use the non-extended signature functionality */
  92         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_BITLEN)
  93             || (su2.sa.sa_family == AF_INET6 && prefixlen == IPV6_MAX_BITLEN))
  94                 ret = sockopt_tcp_signature(socket, &su2, password);
  95         else
  96                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
  97                                                 password);
  98         en = errno;
  99 #endif /* HAVE_TCP_MD5SIG */
 100
 101         if (ret < 0) {
 102                 switch (ret) {
 103                 case -2:
 104                         flog_warn(
 105                                 EC_BGP_NO_TCP_MD5,
 106                                 "Unable to set TCP MD5 option on socket for peer %pSU (sock=%d): This platform does not support MD5 auth for prefixes",
 107                                 su, socket);
 108                         break;
 109                 default:
 110                         flog_warn(
 111                                 EC_BGP_NO_TCP_MD5,
 112                                 "Unable to set TCP MD5 option on socket for peer %pSU (sock=%d): %s",
 113                                 su, socket, safe_strerror(en));
 114                 }
 115         }
 116
 117         return ret;
 118 }
 119
 120 /* Helper for bgp_connect */
 121 static int bgp_md5_set_connect(int socket, union sockunion *su,
 122                                uint16_t prefixlen, const char *password)
 123 {
 124         int ret = -1;
 125
 126 #if HAVE_DECL_TCP_MD5SIG
 127         frr_with_privs(&bgpd_privs) {
 128                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 129         }
 130 #endif /* HAVE_TCP_MD5SIG */
 131
 132         return ret;
 133 }
 134
 135 static int bgp_md5_set_password(struct peer *peer, const char *password)
 136 {
 137         struct listnode *node;
 138         int ret = 0;
 139         struct bgp_listener *listener;
 140
 141         /*
 142          * Set or unset the password on the listen socket(s). Outbound
 143          * connections are taken care of in bgp_connect() below.
 144          */
 145         frr_with_privs(&bgpd_privs) {
 146                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 147                         if (listener->su.sa.sa_family ==
 148                             peer->su.sa.sa_family) {
 149                                 uint16_t prefixlen =
 150                                         peer->su.sa.sa_family == AF_INET
 151                                                 ? IPV4_MAX_BITLEN
 152                                                 : IPV6_MAX_BITLEN;
 153
 154                                 /*
 155                                  * if we have stored a BGP vrf instance in the
 156                                  * listener it must match the bgp instance in
 157                                  * the peer otherwise the peer bgp instance
 158                                  * must be the default vrf or a view instance
 159                                  */
 160                                 if (!listener->bgp) {
 161                                         if (peer->bgp->vrf_id != VRF_DEFAULT)
 162                                                 continue;
 163                                 } else if (listener->bgp != peer->bgp)
 164                                         continue;
 165
 166                                 ret = bgp_md5_set_socket(listener->fd,
 167                                                          &peer->su, prefixlen,
 168                                                          password);
 169                                 break;
 170                         }
 171         }
 172         return ret;
 173 }
 174
 175 int bgp_md5_set_prefix(struct bgp *bgp, struct prefix *p, const char *password)
 176 {
 177         int ret = 0;
 178         union sockunion su;
 179         struct listnode *node;
 180         struct bgp_listener *listener;
 181
 182         /* Set or unset the password on the listen socket(s). */
 183         frr_with_privs(&bgpd_privs) {
 184                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 185                         if (listener->su.sa.sa_family == p->family
 186                             && ((bgp->vrf_id == VRF_DEFAULT)
 187                                 || (listener->bgp == bgp))) {
 188                                 prefix2sockunion(p, &su);
 189                                 ret = bgp_md5_set_socket(listener->fd, &su,
 190                                                          p->prefixlen,
 191                                                          password);
 192                                 break;
 193                         }
 194         }
 195
 196         return ret;
 197 }
 198
 199 int bgp_md5_unset_prefix(struct bgp *bgp, struct prefix *p)
 200 {
 201         return bgp_md5_set_prefix(bgp, p, NULL);
 202 }
 203
 204 int bgp_md5_set(struct peer *peer)
 205 {
 206         /* Set the password from listen socket. */
 207         return bgp_md5_set_password(peer, peer->password);
 208 }
 209
 210 static void bgp_update_setsockopt_tcp_keepalive(struct bgp *bgp, int fd)
 211 {
 212         if (!bgp)
 213                 return;
 214         if (bgp->tcp_keepalive_idle != 0) {
 215                 int ret;
 216
 217                 ret = setsockopt_tcp_keepalive(fd, bgp->tcp_keepalive_idle,
 218                                                bgp->tcp_keepalive_intvl,
 219                                                bgp->tcp_keepalive_probes);
 220                 if (ret < 0)
 221                         zlog_err(
 222                                 "Can't set TCP keepalive on socket %d, idle %u intvl %u probes %u",
 223                                 fd, bgp->tcp_keepalive_idle,
 224                                 bgp->tcp_keepalive_intvl,
 225                                 bgp->tcp_keepalive_probes);
 226         }
 227 }
 228
 229 int bgp_md5_unset(struct peer *peer)
 230 {
 231         /* Unset the password from listen socket. */
 232         return bgp_md5_set_password(peer, NULL);
 233 }
 234
 235 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 236 {
 237         int ret = 0;
 238
 239         if (!peer->gtsm_hops) {
 240                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 241                 if (ret) {
 242                         flog_err(
 243                                 EC_LIB_SOCKET,
 244                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 245                                 __func__, &peer->remote_id, errno);
 246                         return ret;
 247                 }
 248         } else {
 249                 /* On Linux, setting minttl without setting ttl seems to mess
 250                    with the
 251                    outgoing ttl. Therefore setting both.
 252                 */
 253                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 254                 if (ret) {
 255                         flog_err(
 256                                 EC_LIB_SOCKET,
 257                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 258                                 __func__, &peer->remote_id, errno);
 259                         return ret;
 260                 }
 261                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 262                                      MAXTTL + 1 - peer->gtsm_hops);
 263                 if (ret) {
 264                         flog_err(
 265                                 EC_LIB_SOCKET,
 266                                 "%s: Can't set MinTTL on peer (rtrid %pI4) socket, err = %d",
 267                                 __func__, &peer->remote_id, errno);
 268                         return ret;
 269                 }
 270         }
 271
 272         return ret;
 273 }
 274
 275 /*
 276  * Obtain the BGP instance that the incoming connection should be processed
 277  * against. This is important because more than one VRF could be using the
 278  * same IP address space. The instance is got by obtaining the device to
 279  * which the incoming connection is bound to. This could either be a VRF
 280  * or it could be an interface, which in turn determines the VRF.
 281  */
 282 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 283 {
 284 #ifndef SO_BINDTODEVICE
 285         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 286          * anyway since the assumption is that the interface name returned by
 287          * getsockopt() is useful in identifying the VRF, particularly with
 288          * Linux's
 289          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 290          * when other platforms add VRF support, this will need handling here as
 291          * well.  (or, some restructuring) */
 292         *bgp_inst = bgp_get_default();
 293         return !*bgp_inst;
 294
 295 #else
 296         char name[VRF_NAMSIZ + 1];
 297         socklen_t name_len = VRF_NAMSIZ;
 298         struct bgp *bgp;
 299         int rc;
 300         struct listnode *node, *nnode;
 301
 302         *bgp_inst = NULL;
 303         name[0] = '\0';
 304         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 305         if (rc != 0) {
 306 #if defined(HAVE_CUMULUS)
 307                 flog_err(EC_LIB_SOCKET,
 308                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 309                          safe_strerror(errno), sock);
 310                 return -1;
 311 #endif
 312         }
 313
 314         if (!strlen(name)) {
 315                 *bgp_inst = bgp_get_default();
 316                 return 0; /* default instance. */
 317         }
 318
 319         /* First try match to instance; if that fails, check for interfaces. */
 320         bgp = bgp_lookup_by_name(name);
 321         if (bgp) {
 322                 if (!bgp->vrf_id) // unexpected
 323                         return -1;
 324                 *bgp_inst = bgp;
 325                 return 0;
 326         }
 327
 328         /* TODO - This will be optimized once interfaces move into the NS */
 329         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 330                 struct interface *ifp;
 331
 332                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 333                         continue;
 334
 335                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 336                 if (ifp) {
 337                         *bgp_inst = bgp;
 338                         return 0;
 339                 }
 340         }
 341
 342         /* We didn't match to either an instance or an interface. */
 343         return -1;
 344 #endif
 345 }
 346
 347 static void bgp_socket_set_buffer_size(const int fd)
 348 {
 349         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 350                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 351         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 352                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 353 }
 354
 355 /* Accept bgp connection. */
 356 static void bgp_accept(struct thread *thread)
 357 {
 358         int bgp_sock;
 359         int accept_sock;
 360         union sockunion su;
 361         struct bgp_listener *listener = THREAD_ARG(thread);
 362         struct peer *peer;
 363         struct peer *peer1;
 364         char buf[SU_ADDRSTRLEN];
 365         struct bgp *bgp = NULL;
 366
 367         sockunion_init(&su);
 368
 369         bgp = bgp_lookup_by_name(listener->name);
 370
 371         /* Register accept thread. */
 372         accept_sock = THREAD_FD(thread);
 373         if (accept_sock < 0) {
 374                 flog_err_sys(EC_LIB_SOCKET,
 375                              "[Error] BGP accept socket fd is negative: %d",
 376                              accept_sock);
 377                 return;
 378         }
 379
 380         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 381                         &listener->thread);
 382
 383         /* Accept client connection. */
 384         bgp_sock = sockunion_accept(accept_sock, &su);
 385         int save_errno = errno;
 386         if (bgp_sock < 0) {
 387                 if (save_errno == EINVAL) {
 388                         struct vrf *vrf =
 389                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 390
 391                         /*
 392                          * It appears that sometimes, when VRFs are deleted on
 393                          * the system, it takes a little while for us to get
 394                          * notified about that. In the meantime we endlessly
 395                          * loop on accept(), because the socket, having been
 396                          * bound to a now-deleted VRF device, is in some weird
 397                          * state which causes accept() to fail.
 398                          *
 399                          * To avoid this, if we see accept() fail with EINVAL,
 400                          * we cancel ourselves and trust that when the VRF
 401                          * deletion notification comes in the event handler for
 402                          * that will take care of cleaning us up.
 403                          */
 404                         flog_err_sys(
 405                                 EC_LIB_SOCKET,
 406                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 407                                 safe_strerror(save_errno), accept_sock,
 408                                 VRF_LOGNAME(vrf));
 409                         THREAD_OFF(listener->thread);
 410                 } else {
 411                         flog_err_sys(
 412                                 EC_LIB_SOCKET,
 413                                 "[Error] BGP socket accept failed (%s); retrying",
 414                                 safe_strerror(save_errno));
 415                 }
 416                 return;
 417         }
 418         set_nonblocking(bgp_sock);
 419
 420         /* Obtain BGP instance this connection is meant for.
 421          * - if it is a VRF netns sock, then BGP is in listener structure
 422          * - otherwise, the bgp instance need to be demultiplexed
 423          */
 424         if (listener->bgp)
 425                 bgp = listener->bgp;
 426         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 427                 if (bgp_debug_neighbor_events(NULL))
 428                         zlog_debug(
 429                                 "[Event] Could not get instance for incoming conn from %s",
 430                                 inet_sutop(&su, buf));
 431                 close(bgp_sock);
 432                 return;
 433         }
 434
 435         bgp_socket_set_buffer_size(bgp_sock);
 436
 437         /* Set TCP keepalive when TCP keepalive is enabled */
 438         bgp_update_setsockopt_tcp_keepalive(bgp, bgp_sock);
 439
 440         /* Check remote IP address */
 441         peer1 = peer_lookup(bgp, &su);
 442
 443         if (!peer1) {
 444                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 445                 if (peer1) {
 446                         /* Dynamic neighbor has been created, let it proceed */
 447                         peer1->fd = bgp_sock;
 448
 449                         /* Set the user configured MSS to TCP socket */
 450                         if (CHECK_FLAG(peer1->flags, PEER_FLAG_TCP_MSS))
 451                                 sockopt_tcp_mss_set(bgp_sock, peer1->tcp_mss);
 452
 453                         bgp_fsm_change_status(peer1, Active);
 454                         THREAD_OFF(
 455                                 peer1->t_start); /* created in peer_create() */
 456
 457                         if (peer_active(peer1)) {
 458                                 if (CHECK_FLAG(peer1->flags,
 459                                                PEER_FLAG_TIMER_DELAYOPEN))
 460                                         BGP_EVENT_ADD(
 461                                                 peer1,
 462                                                 TCP_connection_open_w_delay);
 463                                 else
 464                                         BGP_EVENT_ADD(peer1,
 465                                                       TCP_connection_open);
 466                         }
 467
 468                         return;
 469                 }
 470         }
 471
 472         if (!peer1) {
 473                 if (bgp_debug_neighbor_events(NULL)) {
 474                         zlog_debug(
 475                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 476                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 477                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 478                 }
 479                 close(bgp_sock);
 480                 return;
 481         }
 482
 483         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)
 484             || CHECK_FLAG(peer1->bgp->flags, BGP_FLAG_SHUTDOWN)) {
 485                 if (bgp_debug_neighbor_events(peer1))
 486                         zlog_debug(
 487                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 488                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 489                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 490                 close(bgp_sock);
 491                 return;
 492         }
 493
 494         /*
 495          * Do not accept incoming connections in Clearing state. This can result
 496          * in incorect state transitions - e.g., the connection goes back to
 497          * Established and then the Clearing_Completed event is generated. Also,
 498          * block incoming connection in Deleted state.
 499          */
 500         if (peer1->status == Clearing || peer1->status == Deleted) {
 501                 if (bgp_debug_neighbor_events(peer1))
 502                         zlog_debug(
 503                                 "[Event] Closing incoming conn for %s (%p) state %d",
 504                                 peer1->host, peer1, peer1->status);
 505                 close(bgp_sock);
 506                 return;
 507         }
 508
 509         /* Check that at least one AF is activated for the peer. */
 510         if (!peer_active(peer1)) {
 511                 if (bgp_debug_neighbor_events(peer1))
 512                         zlog_debug(
 513                                 "%s - incoming conn rejected - no AF activated for peer",
 514                                 peer1->host);
 515                 close(bgp_sock);
 516                 return;
 517         }
 518
 519         /* Do not try to reconnect if the peer reached maximum
 520          * prefixes, restart timer is still running or the peer
 521          * is shutdown.
 522          */
 523         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 524                 if (bgp_debug_neighbor_events(peer1))
 525                         zlog_debug(
 526                                 "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 527                                 peer1->host);
 528                 close(bgp_sock);
 529                 return;
 530         }
 531
 532         if (bgp_debug_neighbor_events(peer1))
 533                 zlog_debug(
 534                         "[Event] connection from %s fd %d, active peer status %d fd %d",
 535                         inet_sutop(&su, buf), bgp_sock, peer1->status,
 536                         peer1->fd);
 537
 538         if (peer1->doppelganger) {
 539                 /* We have an existing connection. Kill the existing one and run
 540                    with this one.
 541                 */
 542                 if (bgp_debug_neighbor_events(peer1))
 543                         zlog_debug(
 544                                 "[Event] New active connection from peer %s, Killing previous active connection",
 545                                 peer1->host);
 546                 peer_delete(peer1->doppelganger);
 547         }
 548
 549         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 550                 if (bgp_debug_neighbor_events(peer1))
 551                         zlog_debug(
 552                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 553                                 peer1->host);
 554
 555         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 556                            peer1->as, peer1->as_type, NULL);
 557         hash_release(peer->bgp->peerhash, peer);
 558         (void)hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 559
 560         peer_xfer_config(peer, peer1);
 561         bgp_peer_gr_flags_update(peer);
 562
 563         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 564                                                           peer->bgp->peer);
 565
 566         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 567
 568                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 569
 570                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 571                         peer_nsf_stop(peer);
 572                 }
 573         }
 574
 575         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 576
 577         peer->doppelganger = peer1;
 578         peer1->doppelganger = peer;
 579         peer->fd = bgp_sock;
 580         frr_with_privs(&bgpd_privs) {
 581                 vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 582         }
 583         bgp_peer_reg_with_nht(peer);
 584         bgp_fsm_change_status(peer, Active);
 585         THREAD_OFF(peer->t_start); /* created in peer_create() */
 586
 587         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 588         /* Make dummy peer until read Open packet. */
 589         if (peer_established(peer1)
 590             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 591                 /* If we have an existing established connection with graceful
 592                  * restart
 593                  * capability announced with one or more address families, then
 594                  * drop
 595                  * existing established connection and move state to connect.
 596                  */
 597                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 598
 599                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 600                     || CHECK_FLAG(peer1->flags,
 601                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 602                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 603
 604                 bgp_event_update(peer1, TCP_connection_closed);
 605         }
 606
 607         if (peer_active(peer)) {
 608                 if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER_DELAYOPEN))
 609                         BGP_EVENT_ADD(peer, TCP_connection_open_w_delay);
 610                 else
 611                         BGP_EVENT_ADD(peer, TCP_connection_open);
 612         }
 613
 614         /*
 615          * If we are doing nht for a peer that is v6 LL based
 616          * massage the event system to make things happy
 617          */
 618         bgp_nht_interface_events(peer);
 619 }
 620
 621 /* BGP socket bind. */
 622 static char *bgp_get_bound_name(struct peer *peer)
 623 {
 624         if (!peer)
 625                 return NULL;
 626
 627         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 628             && !peer->conf_if)
 629                 return NULL;
 630
 631         if (peer->su.sa.sa_family != AF_INET
 632             && peer->su.sa.sa_family != AF_INET6)
 633                 return NULL; // unexpected
 634
 635         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 636          * takes precedence over VRF. For IPv4 peering, explicit interface or
 637          * VRF are the situations to bind.
 638          */
 639         if (peer->su.sa.sa_family == AF_INET6 && peer->conf_if)
 640                 return peer->conf_if;
 641
 642         if (peer->ifname)
 643                 return peer->ifname;
 644
 645         if (peer->bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 646                 return NULL;
 647
 648         return peer->bgp->name;
 649 }
 650
 651 int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 652                               union sockunion *addr)
 653 {
 654         struct prefix *p, *sel, d;
 655         struct connected *connected;
 656         struct listnode *node;
 657         int common;
 658
 659         if (!sockunion2hostprefix(dst, &d))
 660                 return 1;
 661
 662         sel = NULL;
 663         common = -1;
 664
 665         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 666                 p = connected->address;
 667                 if (p->family != d.family)
 668                         continue;
 669                 if (prefix_common_bits(p, &d) > common) {
 670                         sel = p;
 671                         common = prefix_common_bits(sel, &d);
 672                 }
 673         }
 674
 675         if (!sel)
 676                 return 1;
 677
 678         prefix2sockunion(sel, addr);
 679         return 0;
 680 }
 681
 682 /* Update source selection.  */
 683 static int bgp_update_source(struct peer *peer)
 684 {
 685         struct interface *ifp;
 686         union sockunion addr;
 687         int ret = 0;
 688
 689         sockunion_init(&addr);
 690
 691         /* Source is specified with interface name.  */
 692         if (peer->update_if) {
 693                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 694                 if (!ifp)
 695                         return -1;
 696
 697                 if (bgp_update_address(ifp, &peer->su, &addr))
 698                         return -1;
 699
 700                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 701         }
 702
 703         /* Source is specified with IP address.  */
 704         if (peer->update_source)
 705                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 706                                      peer->update_source);
 707
 708         return ret;
 709 }
 710
 711 /* BGP try to connect to the peer.  */
 712 int bgp_connect(struct peer *peer)
 713 {
 714         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 715         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 716         ifindex_t ifindex = 0;
 717
 718         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 719                 if (bgp_debug_neighbor_events(peer))
 720                         zlog_debug("Peer address not learnt: Returning from connect");
 721                 return 0;
 722         }
 723         frr_with_privs(&bgpd_privs) {
 724         /* Make socket for the peer. */
 725                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 726                                                 bgp_get_bound_name(peer));
 727         }
 728         if (peer->fd < 0) {
 729                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 730                 if (bgp_debug_neighbor_events(peer))
 731                         zlog_debug("%s: Failure to create socket for connection to %s, error received: %s(%d)",
 732                                    __func__, peer->host, safe_strerror(errno),
 733                                    errno);
 734                 return -1;
 735         }
 736
 737         set_nonblocking(peer->fd);
 738
 739         /* Set the user configured MSS to TCP socket */
 740         if (CHECK_FLAG(peer->flags, PEER_FLAG_TCP_MSS))
 741                 sockopt_tcp_mss_set(peer->fd, peer->tcp_mss);
 742
 743         bgp_socket_set_buffer_size(peer->fd);
 744
 745         /* Set TCP keepalive when TCP keepalive is enabled */
 746         bgp_update_setsockopt_tcp_keepalive(peer->bgp, peer->fd);
 747
 748         if (bgp_set_socket_ttl(peer, peer->fd) < 0) {
 749                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 750                 if (bgp_debug_neighbor_events(peer))
 751                         zlog_debug("%s: Failure to set socket ttl for connection to %s, error received: %s(%d)",
 752                                    __func__, peer->host, safe_strerror(errno),
 753                                    errno);
 754
 755                 return -1;
 756         }
 757
 758         sockopt_reuseaddr(peer->fd);
 759         sockopt_reuseport(peer->fd);
 760
 761 #ifdef IPTOS_PREC_INTERNETCONTROL
 762         frr_with_privs(&bgpd_privs) {
 763                 if (sockunion_family(&peer->su) == AF_INET)
 764                         setsockopt_ipv4_tos(peer->fd, bm->tcp_dscp);
 765                 else if (sockunion_family(&peer->su) == AF_INET6)
 766                         setsockopt_ipv6_tclass(peer->fd, bm->tcp_dscp);
 767         }
 768 #endif
 769
 770         if (peer->password) {
 771                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 772                                              ? IPV4_MAX_BITLEN
 773                                              : IPV6_MAX_BITLEN;
 774
 775                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 776                                     peer->password);
 777         }
 778
 779         /* Update source bind. */
 780         if (bgp_update_source(peer) < 0) {
 781                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 782                 return connect_error;
 783         }
 784
 785         if (peer->conf_if || peer->ifname)
 786                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 787                                                        : peer->ifname,
 788                                          peer->bgp->vrf_id);
 789
 790         if (bgp_debug_neighbor_events(peer))
 791                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 792                            peer->host, peer->fd);
 793
 794         /* Connect to the remote peer. */
 795         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 796                                  ifindex);
 797 }
 798
 799 /* After TCP connection is established.  Get local address and port. */
 800 int bgp_getsockname(struct peer *peer)
 801 {
 802         if (peer->su_local) {
 803                 sockunion_free(peer->su_local);
 804                 peer->su_local = NULL;
 805         }
 806
 807         if (peer->su_remote) {
 808                 sockunion_free(peer->su_remote);
 809                 peer->su_remote = NULL;
 810         }
 811
 812         peer->su_local = sockunion_getsockname(peer->fd);
 813         if (!peer->su_local)
 814                 return -1;
 815         peer->su_remote = sockunion_getpeername(peer->fd);
 816         if (!peer->su_remote)
 817                 return -1;
 818
 819         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 820                                    &peer->nexthop, peer)) {
 821                 flog_err(EC_BGP_NH_UPD,
 822                          "%s: nexthop_set failed, resetting connection - intf %p",
 823                          peer->host, peer->nexthop.ifp);
 824                 return -1;
 825         }
 826         return 0;
 827 }
 828
 829
 830 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 831                         struct bgp *bgp)
 832 {
 833         struct bgp_listener *listener;
 834         int ret, en;
 835
 836         sockopt_reuseaddr(sock);
 837         sockopt_reuseport(sock);
 838
 839         frr_with_privs(&bgpd_privs) {
 840
 841 #ifdef IPTOS_PREC_INTERNETCONTROL
 842                 if (sa->sa_family == AF_INET)
 843                         setsockopt_ipv4_tos(sock, bm->tcp_dscp);
 844                 else if (sa->sa_family == AF_INET6)
 845                         setsockopt_ipv6_tclass(sock, bm->tcp_dscp);
 846 #endif
 847
 848                 sockopt_v6only(sa->sa_family, sock);
 849
 850                 ret = bind(sock, sa, salen);
 851                 en = errno;
 852         }
 853
 854         if (ret < 0) {
 855                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 856                 return ret;
 857         }
 858
 859         ret = listen(sock, SOMAXCONN);
 860         if (ret < 0) {
 861                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 862                 return ret;
 863         }
 864
 865         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 866         listener->fd = sock;
 867         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 868
 869         /* this socket is in a vrf record bgp back pointer */
 870         if (bgp->vrf_id != VRF_DEFAULT)
 871                 listener->bgp = bgp;
 872
 873         memcpy(&listener->su, sa, salen);
 874         thread_add_read(bm->master, bgp_accept, listener, sock,
 875                         &listener->thread);
 876         listnode_add(bm->listen_sockets, listener);
 877
 878         return 0;
 879 }
 880
 881 /* IPv6 supported version of BGP server socket setup.  */
 882 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 883 {
 884         struct addrinfo *ainfo;
 885         struct addrinfo *ainfo_save;
 886         static const struct addrinfo req = {
 887                 .ai_family = AF_UNSPEC,
 888                 .ai_flags = AI_PASSIVE,
 889                 .ai_socktype = SOCK_STREAM,
 890         };
 891         int ret, count;
 892         char port_str[BUFSIZ];
 893
 894         snprintf(port_str, sizeof(port_str), "%d", port);
 895         port_str[sizeof(port_str) - 1] = '\0';
 896
 897         frr_with_privs(&bgpd_privs) {
 898                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 899                                       bgp->vrf_id);
 900         }
 901         if (ret != 0) {
 902                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 903                              gai_strerror(ret));
 904                 return -1;
 905         }
 906         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 907             bgp->vrf_id != VRF_DEFAULT) {
 908                 freeaddrinfo(ainfo_save);
 909                 return -1;
 910         }
 911         count = 0;
 912         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 913                 int sock;
 914
 915                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 916                         continue;
 917
 918                 frr_with_privs(&bgpd_privs) {
 919                         sock = vrf_socket(ainfo->ai_family,
 920                                           ainfo->ai_socktype,
 921                                           ainfo->ai_protocol,
 922                                           bgp->vrf_id,
 923                                           (bgp->inst_type
 924                                            == BGP_INSTANCE_TYPE_VRF
 925                                            ? bgp->name : NULL));
 926                 }
 927                 if (sock < 0) {
 928                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 929                                      safe_strerror(errno));
 930                         continue;
 931                 }
 932
 933                 /* if we intend to implement ttl-security, this socket needs
 934                  * ttl=255 */
 935                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 936
 937                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 938                                    bgp);
 939                 if (ret == 0)
 940                         ++count;
 941                 else
 942                         close(sock);
 943         }
 944         freeaddrinfo(ainfo_save);
 945         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 946                 flog_err(
 947                         EC_LIB_SOCKET,
 948                         "%s: no usable addresses please check other programs usage of specified port %d",
 949                         __func__, port);
 950                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 951                              __func__);
 952                 exit(-1);
 953         }
 954
 955         return 0;
 956 }
 957
 958 /* this function closes vrf socket
 959  * this should be called only for vrf socket with netns backend
 960  */
 961 void bgp_close_vrf_socket(struct bgp *bgp)
 962 {
 963         struct listnode *node, *next;
 964         struct bgp_listener *listener;
 965
 966         if (!bgp)
 967                 return;
 968
 969         if (bm->listen_sockets == NULL)
 970                 return;
 971
 972         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 973                 if (listener->bgp == bgp) {
 974                         THREAD_OFF(listener->thread);
 975                         close(listener->fd);
 976                         listnode_delete(bm->listen_sockets, listener);
 977                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 978                         XFREE(MTYPE_BGP_LISTENER, listener);
 979                 }
 980         }
 981 }
 982
 983 /* this function closes main socket
 984  */
 985 void bgp_close(void)
 986 {
 987         struct listnode *node, *next;
 988         struct bgp_listener *listener;
 989
 990         if (bm->listen_sockets == NULL)
 991                 return;
 992
 993         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 994                 if (listener->bgp)
 995                         continue;
 996                 THREAD_OFF(listener->thread);
 997                 close(listener->fd);
 998                 listnode_delete(bm->listen_sockets, listener);
 999                 XFREE(MTYPE_BGP_LISTENER, listener->name);
1000                 XFREE(MTYPE_BGP_LISTENER, listener);
1001         }
1002 }