bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49
  50 extern struct zebra_privs_t bgpd_privs;
  51
  52 static char *bgp_get_bound_name(struct peer *peer);
  53
  54 /* BGP listening socket. */
  55 struct bgp_listener {
  56         int fd;
  57         union sockunion su;
  58         struct thread *thread;
  59         struct bgp *bgp;
  60 };
  61
  62 /*
  63  * Set MD5 key for the socket, for the given IPv4 peer address.
  64  * If the password is NULL or zero-length, the option will be disabled.
  65  */
  66 static int bgp_md5_set_socket(int socket, union sockunion *su,
  67                               uint16_t prefixlen, const char *password)
  68 {
  69         int ret = -1;
  70         int en = ENOSYS;
  71 #if HAVE_DECL_TCP_MD5SIG
  72         union sockunion su2;
  73 #endif /* HAVE_TCP_MD5SIG */
  74
  75         assert(socket >= 0);
  76
  77 #if HAVE_DECL_TCP_MD5SIG
  78         /* Ensure there is no extraneous port information. */
  79         memcpy(&su2, su, sizeof(union sockunion));
  80         if (su2.sa.sa_family == AF_INET)
  81                 su2.sin.sin_port = 0;
  82         else
  83                 su2.sin6.sin6_port = 0;
  84
  85         /* For addresses, use the non-extended signature functionality */
  86         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_PREFIXLEN)
  87             || (su2.sa.sa_family == AF_INET6
  88                 && prefixlen == IPV6_MAX_PREFIXLEN))
  89                 ret = sockopt_tcp_signature(socket, &su2, password);
  90         else
  91                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
  92                                                 password);
  93         en = errno;
  94 #endif /* HAVE_TCP_MD5SIG */
  95
  96         if (ret < 0) {
  97                 char sabuf[SU_ADDRSTRLEN];
  98                 sockunion2str(su, sabuf, sizeof(sabuf));
  99
 100                 switch (ret) {
 101                 case -2:
 102                         flog_warn(
 103                                 EC_BGP_NO_TCP_MD5,
 104                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): This platform does not support MD5 auth for prefixes",
 105                                 sabuf, socket);
 106                         break;
 107                 default:
 108                         flog_warn(
 109                                 EC_BGP_NO_TCP_MD5,
 110                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): %s",
 111                                 sabuf, socket, safe_strerror(en));
 112                 }
 113         }
 114
 115         return ret;
 116 }
 117
 118 /* Helper for bgp_connect */
 119 static int bgp_md5_set_connect(int socket, union sockunion *su,
 120                                uint16_t prefixlen, const char *password)
 121 {
 122         int ret = -1;
 123
 124 #if HAVE_DECL_TCP_MD5SIG
 125         frr_with_privs(&bgpd_privs) {
 126                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 127         }
 128 #endif /* HAVE_TCP_MD5SIG */
 129
 130         return ret;
 131 }
 132
 133 static int bgp_md5_set_password(struct peer *peer, const char *password)
 134 {
 135         struct listnode *node;
 136         int ret = 0;
 137         struct bgp_listener *listener;
 138
 139         /*
 140          * Set or unset the password on the listen socket(s). Outbound
 141          * connections are taken care of in bgp_connect() below.
 142          */
 143         frr_with_privs(&bgpd_privs) {
 144                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 145                         if (listener->su.sa.sa_family
 146                             == peer->su.sa.sa_family) {
 147                                 uint16_t prefixlen =
 148                                         peer->su.sa.sa_family == AF_INET
 149                                                 ? IPV4_MAX_PREFIXLEN
 150                                                 : IPV6_MAX_PREFIXLEN;
 151
 152                                 ret = bgp_md5_set_socket(listener->fd,
 153                                                          &peer->su, prefixlen,
 154                                                          password);
 155                                 break;
 156                         }
 157         }
 158         return ret;
 159 }
 160
 161 int bgp_md5_set_prefix(struct prefix *p, const char *password)
 162 {
 163         int ret = 0;
 164         union sockunion su;
 165         struct listnode *node;
 166         struct bgp_listener *listener;
 167
 168         /* Set or unset the password on the listen socket(s). */
 169         frr_with_privs(&bgpd_privs) {
 170                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 171                         if (listener->su.sa.sa_family == p->family) {
 172                                 prefix2sockunion(p, &su);
 173                                 ret = bgp_md5_set_socket(listener->fd, &su,
 174                                                          p->prefixlen,
 175                                                          password);
 176                                 break;
 177                         }
 178         }
 179
 180         return ret;
 181 }
 182
 183 int bgp_md5_unset_prefix(struct prefix *p)
 184 {
 185         return bgp_md5_set_prefix(p, NULL);
 186 }
 187
 188 int bgp_md5_set(struct peer *peer)
 189 {
 190         /* Set the password from listen socket. */
 191         return bgp_md5_set_password(peer, peer->password);
 192 }
 193
 194 int bgp_md5_unset(struct peer *peer)
 195 {
 196         /* Unset the password from listen socket. */
 197         return bgp_md5_set_password(peer, NULL);
 198 }
 199
 200 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 201 {
 202         char buf[INET_ADDRSTRLEN];
 203         int ret = 0;
 204
 205         /* In case of peer is EBGP, we should set TTL for this connection.  */
 206         if (!peer->gtsm_hops && (peer_sort(peer) == BGP_PEER_EBGP)) {
 207                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 208                 if (ret) {
 209                         flog_err(
 210                                 EC_LIB_SOCKET,
 211                                 "%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
 212                                 __func__,
 213                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 214                                           sizeof(buf)),
 215                                 errno);
 216                         return ret;
 217                 }
 218         } else if (peer->gtsm_hops) {
 219                 /* On Linux, setting minttl without setting ttl seems to mess
 220                    with the
 221                    outgoing ttl. Therefore setting both.
 222                 */
 223                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 224                 if (ret) {
 225                         flog_err(
 226                                 EC_LIB_SOCKET,
 227                                 "%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
 228                                 __func__,
 229                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 230                                           sizeof(buf)),
 231                                 errno);
 232                         return ret;
 233                 }
 234                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 235                                      MAXTTL + 1 - peer->gtsm_hops);
 236                 if (ret) {
 237                         flog_err(
 238                                 EC_LIB_SOCKET,
 239                                 "%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d",
 240                                 __func__,
 241                                 inet_ntop(AF_INET, &peer->remote_id, buf,
 242                                           sizeof(buf)),
 243                                 errno);
 244                         return ret;
 245                 }
 246         }
 247
 248         return ret;
 249 }
 250
 251 /*
 252  * Obtain the BGP instance that the incoming connection should be processed
 253  * against. This is important because more than one VRF could be using the
 254  * same IP address space. The instance is got by obtaining the device to
 255  * which the incoming connection is bound to. This could either be a VRF
 256  * or it could be an interface, which in turn determines the VRF.
 257  */
 258 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 259 {
 260 #ifndef SO_BINDTODEVICE
 261         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 262          * anyway since the assumption is that the interface name returned by
 263          * getsockopt() is useful in identifying the VRF, particularly with
 264          * Linux's
 265          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 266          * when other platforms add VRF support, this will need handling here as
 267          * well.  (or, some restructuring) */
 268         *bgp_inst = bgp_get_default();
 269         return !*bgp_inst;
 270
 271 #else
 272         char name[VRF_NAMSIZ + 1];
 273         socklen_t name_len = VRF_NAMSIZ;
 274         struct bgp *bgp;
 275         int rc;
 276         struct listnode *node, *nnode;
 277
 278         *bgp_inst = NULL;
 279         name[0] = '\0';
 280         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 281         if (rc != 0) {
 282 #if defined(HAVE_CUMULUS)
 283                 flog_err(EC_LIB_SOCKET,
 284                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 285                          safe_strerror(errno), sock);
 286                 return -1;
 287 #endif
 288         }
 289
 290         if (!strlen(name)) {
 291                 *bgp_inst = bgp_get_default();
 292                 return 0; /* default instance. */
 293         }
 294
 295         /* First try match to instance; if that fails, check for interfaces. */
 296         bgp = bgp_lookup_by_name(name);
 297         if (bgp) {
 298                 if (!bgp->vrf_id) // unexpected
 299                         return -1;
 300                 *bgp_inst = bgp;
 301                 return 0;
 302         }
 303
 304         /* TODO - This will be optimized once interfaces move into the NS */
 305         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 306                 struct interface *ifp;
 307
 308                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 309                         continue;
 310
 311                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 312                 if (ifp) {
 313                         *bgp_inst = bgp;
 314                         return 0;
 315                 }
 316         }
 317
 318         /* We didn't match to either an instance or an interface. */
 319         return -1;
 320 #endif
 321 }
 322
 323 static void bgp_socket_set_buffer_size(const int fd)
 324 {
 325         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 326                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 327         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 328                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 329 }
 330
 331 /* Accept bgp connection. */
 332 static int bgp_accept(struct thread *thread)
 333 {
 334         int bgp_sock;
 335         int accept_sock;
 336         union sockunion su;
 337         struct bgp_listener *listener = THREAD_ARG(thread);
 338         struct peer *peer;
 339         struct peer *peer1;
 340         char buf[SU_ADDRSTRLEN];
 341         struct bgp *bgp = NULL;
 342
 343         sockunion_init(&su);
 344
 345         /* Register accept thread. */
 346         accept_sock = THREAD_FD(thread);
 347         if (accept_sock < 0) {
 348                 flog_err_sys(EC_LIB_SOCKET, "accept_sock is nevative value %d",
 349                              accept_sock);
 350                 return -1;
 351         }
 352         listener->thread = NULL;
 353
 354         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 355                         &listener->thread);
 356
 357         /* Accept client connection. */
 358         bgp_sock = sockunion_accept(accept_sock, &su);
 359         if (bgp_sock < 0) {
 360                 flog_err_sys(EC_LIB_SOCKET,
 361                              "[Error] BGP socket accept failed (%s)",
 362                              safe_strerror(errno));
 363                 return -1;
 364         }
 365         set_nonblocking(bgp_sock);
 366
 367         /* Obtain BGP instance this connection is meant for.
 368          * - if it is a VRF netns sock, then BGP is in listener structure
 369          * - otherwise, the bgp instance need to be demultiplexed
 370          */
 371         if (listener->bgp)
 372                 bgp = listener->bgp;
 373         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 374                 if (bgp_debug_neighbor_events(NULL))
 375                         zlog_debug(
 376                                 "[Event] Could not get instance for incoming conn from %s",
 377                                 inet_sutop(&su, buf));
 378                 close(bgp_sock);
 379                 return -1;
 380         }
 381
 382         bgp_socket_set_buffer_size(bgp_sock);
 383
 384         /* Check remote IP address */
 385         peer1 = peer_lookup(bgp, &su);
 386
 387         if (!peer1) {
 388                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 389                 if (peer1) {
 390                         /* Dynamic neighbor has been created, let it proceed */
 391                         peer1->fd = bgp_sock;
 392                         bgp_fsm_change_status(peer1, Active);
 393                         BGP_TIMER_OFF(
 394                                 peer1->t_start); /* created in peer_create() */
 395
 396                         if (peer_active(peer1))
 397                                 BGP_EVENT_ADD(peer1, TCP_connection_open);
 398
 399                         return 0;
 400                 }
 401         }
 402
 403         if (!peer1) {
 404                 if (bgp_debug_neighbor_events(NULL)) {
 405                         zlog_debug(
 406                                 "[Event] %s connection rejected - not configured"
 407                                 " and not valid for dynamic",
 408                                 inet_sutop(&su, buf));
 409                 }
 410                 close(bgp_sock);
 411                 return -1;
 412         }
 413
 414         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)) {
 415                 if (bgp_debug_neighbor_events(peer1))
 416                         zlog_debug(
 417                                 "[Event] connection from %s rejected due to admin shutdown",
 418                                 inet_sutop(&su, buf));
 419                 close(bgp_sock);
 420                 return -1;
 421         }
 422
 423         /*
 424          * Do not accept incoming connections in Clearing state. This can result
 425          * in incorect state transitions - e.g., the connection goes back to
 426          * Established and then the Clearing_Completed event is generated. Also,
 427          * block incoming connection in Deleted state.
 428          */
 429         if (peer1->status == Clearing || peer1->status == Deleted) {
 430                 if (bgp_debug_neighbor_events(peer1))
 431                         zlog_debug(
 432                                 "[Event] Closing incoming conn for %s (%p) state %d",
 433                                 peer1->host, peer1, peer1->status);
 434                 close(bgp_sock);
 435                 return -1;
 436         }
 437
 438         /* Check that at least one AF is activated for the peer. */
 439         if (!peer_active(peer1)) {
 440                 if (bgp_debug_neighbor_events(peer1))
 441                         zlog_debug(
 442                                 "%s - incoming conn rejected - no AF activated for peer",
 443                                 peer1->host);
 444                 close(bgp_sock);
 445                 return -1;
 446         }
 447
 448         /* Do not try to reconnect if the peer reached maximum
 449          * prefixes, restart timer is still running or the peer
 450          * is shutdown.
 451          */
 452         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 453                 if (bgp_debug_neighbor_events(peer1))
 454                         zlog_debug(
 455                                 "[Event] Incoming BGP connection rejected from %s "
 456                                 "due to maximum-prefix or shutdown",
 457                                 peer1->host);
 458                 close(bgp_sock);
 459                 return -1;
 460         }
 461
 462         if (bgp_debug_neighbor_events(peer1))
 463                 zlog_debug("[Event] BGP connection from host %s fd %d",
 464                            inet_sutop(&su, buf), bgp_sock);
 465
 466         if (peer1->doppelganger) {
 467                 /* We have an existing connection. Kill the existing one and run
 468                    with this one.
 469                 */
 470                 if (bgp_debug_neighbor_events(peer1))
 471                         zlog_debug(
 472                                 "[Event] New active connection from peer %s, Killing"
 473                                 " previous active connection",
 474                                 peer1->host);
 475                 peer_delete(peer1->doppelganger);
 476         }
 477
 478         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 479                 if (bgp_debug_neighbor_events(peer1))
 480                         zlog_debug(
 481                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 482                                 peer1->host);
 483
 484         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 485                            peer1->as, peer1->as_type, 0, 0, NULL);
 486         hash_release(peer->bgp->peerhash, peer);
 487         hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 488
 489         peer_xfer_config(peer, peer1);
 490         bgp_peer_gr_flags_update(peer);
 491
 492         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(
 493                         peer->bgp,
 494                         peer->bgp->peer);
 495
 496         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 497
 498                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 499
 500                 if (CHECK_FLAG(peer->sflags,
 501                                 PEER_STATUS_NSF_WAIT)) {
 502                         peer_nsf_stop(peer);
 503                 }
 504         }
 505
 506         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 507
 508         peer->doppelganger = peer1;
 509         peer1->doppelganger = peer;
 510         peer->fd = bgp_sock;
 511         vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 512         bgp_fsm_change_status(peer, Active);
 513         BGP_TIMER_OFF(peer->t_start); /* created in peer_create() */
 514
 515         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 516         /* Make dummy peer until read Open packet. */
 517         if (peer1->status == Established
 518                 && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 519                 /* If we have an existing established connection with graceful
 520                  * restart
 521                  * capability announced with one or more address families, then
 522                  * drop
 523                  * existing established connection and move state to connect.
 524                  */
 525                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 526
 527                 if (CHECK_FLAG(peer1->flags,
 528                         PEER_FLAG_GRACEFUL_RESTART) ||
 529                         CHECK_FLAG(peer1->flags,
 530                         PEER_FLAG_GRACEFUL_RESTART_HELPER))
 531                         SET_FLAG(peer1->sflags,
 532                                 PEER_STATUS_NSF_WAIT);
 533
 534                 bgp_event_update(peer1, TCP_connection_closed);
 535         }
 536
 537         if (peer_active(peer)) {
 538                 BGP_EVENT_ADD(peer, TCP_connection_open);
 539         }
 540
 541         return 0;
 542 }
 543
 544 /* BGP socket bind. */
 545 static char *bgp_get_bound_name(struct peer *peer)
 546 {
 547         char *name = NULL;
 548
 549         if (!peer)
 550                 return NULL;
 551
 552         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 553             && !peer->conf_if)
 554                 return NULL;
 555
 556         if (peer->su.sa.sa_family != AF_INET
 557             && peer->su.sa.sa_family != AF_INET6)
 558                 return NULL; // unexpected
 559
 560         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 561          * takes precedence over VRF. For IPv4 peering, explicit interface or
 562          * VRF are the situations to bind.
 563          */
 564         if (peer->su.sa.sa_family == AF_INET6)
 565                 name = (peer->conf_if ? peer->conf_if
 566                                       : (peer->ifname ? peer->ifname
 567                                                       : peer->bgp->name));
 568         else
 569                 name = peer->ifname ? peer->ifname : peer->bgp->name;
 570
 571         return name;
 572 }
 573
 574 static int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 575                               union sockunion *addr)
 576 {
 577         struct prefix *p, *sel, d;
 578         struct connected *connected;
 579         struct listnode *node;
 580         int common;
 581
 582         sockunion2hostprefix(dst, &d);
 583         sel = NULL;
 584         common = -1;
 585
 586         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 587                 p = connected->address;
 588                 if (p->family != d.family)
 589                         continue;
 590                 if (prefix_common_bits(p, &d) > common) {
 591                         sel = p;
 592                         common = prefix_common_bits(sel, &d);
 593                 }
 594         }
 595
 596         if (!sel)
 597                 return 1;
 598
 599         prefix2sockunion(sel, addr);
 600         return 0;
 601 }
 602
 603 /* Update source selection.  */
 604 static int bgp_update_source(struct peer *peer)
 605 {
 606         struct interface *ifp;
 607         union sockunion addr;
 608         int ret = 0;
 609
 610         sockunion_init(&addr);
 611
 612         /* Source is specified with interface name.  */
 613         if (peer->update_if) {
 614                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 615                 if (!ifp)
 616                         return -1;
 617
 618                 if (bgp_update_address(ifp, &peer->su, &addr))
 619                         return -1;
 620
 621                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 622         }
 623
 624         /* Source is specified with IP address.  */
 625         if (peer->update_source)
 626                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 627                                      peer->update_source);
 628
 629         return ret;
 630 }
 631
 632 /* BGP try to connect to the peer.  */
 633 int bgp_connect(struct peer *peer)
 634 {
 635         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 636         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 637         ifindex_t ifindex = 0;
 638
 639         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 640                 zlog_debug("Peer address not learnt: Returning from connect");
 641                 return 0;
 642         }
 643         frr_with_privs(&bgpd_privs) {
 644         /* Make socket for the peer. */
 645                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 646                                                 bgp_get_bound_name(peer));
 647         }
 648         if (peer->fd < 0)
 649                 return -1;
 650
 651         set_nonblocking(peer->fd);
 652
 653         bgp_socket_set_buffer_size(peer->fd);
 654
 655         if (bgp_set_socket_ttl(peer, peer->fd) < 0)
 656                 return -1;
 657
 658         sockopt_reuseaddr(peer->fd);
 659         sockopt_reuseport(peer->fd);
 660
 661 #ifdef IPTOS_PREC_INTERNETCONTROL
 662         frr_with_privs(&bgpd_privs) {
 663                 if (sockunion_family(&peer->su) == AF_INET)
 664                         setsockopt_ipv4_tos(peer->fd,
 665                                             IPTOS_PREC_INTERNETCONTROL);
 666                 else if (sockunion_family(&peer->su) == AF_INET6)
 667                         setsockopt_ipv6_tclass(peer->fd,
 668                                                IPTOS_PREC_INTERNETCONTROL);
 669         }
 670 #endif
 671
 672         if (peer->password) {
 673                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 674                                              ? IPV4_MAX_PREFIXLEN
 675                                              : IPV6_MAX_PREFIXLEN;
 676
 677                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 678                                     peer->password);
 679         }
 680
 681         /* Update source bind. */
 682         if (bgp_update_source(peer) < 0) {
 683                 return connect_error;
 684         }
 685
 686         if (peer->conf_if || peer->ifname)
 687                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 688                                                        : peer->ifname,
 689                                          peer->bgp->vrf_id);
 690
 691         if (bgp_debug_neighbor_events(peer))
 692                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 693                            peer->host, peer->fd);
 694
 695         /* Connect to the remote peer. */
 696         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 697                                  ifindex);
 698 }
 699
 700 /* After TCP connection is established.  Get local address and port. */
 701 int bgp_getsockname(struct peer *peer)
 702 {
 703         if (peer->su_local) {
 704                 sockunion_free(peer->su_local);
 705                 peer->su_local = NULL;
 706         }
 707
 708         if (peer->su_remote) {
 709                 sockunion_free(peer->su_remote);
 710                 peer->su_remote = NULL;
 711         }
 712
 713         peer->su_local = sockunion_getsockname(peer->fd);
 714         if (!peer->su_local)
 715                 return -1;
 716         peer->su_remote = sockunion_getpeername(peer->fd);
 717         if (!peer->su_remote)
 718                 return -1;
 719
 720         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 721                                    &peer->nexthop, peer)) {
 722                 flog_err(EC_BGP_NH_UPD,
 723                          "%s: nexthop_set failed, resetting connection - intf %p",
 724                          peer->host, peer->nexthop.ifp);
 725                 return -1;
 726         }
 727         return 0;
 728 }
 729
 730
 731 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 732                         struct bgp *bgp)
 733 {
 734         struct bgp_listener *listener;
 735         int ret, en;
 736
 737         sockopt_reuseaddr(sock);
 738         sockopt_reuseport(sock);
 739
 740         frr_with_privs(&bgpd_privs) {
 741
 742 #ifdef IPTOS_PREC_INTERNETCONTROL
 743                 if (sa->sa_family == AF_INET)
 744                         setsockopt_ipv4_tos(sock, IPTOS_PREC_INTERNETCONTROL);
 745                 else if (sa->sa_family == AF_INET6)
 746                         setsockopt_ipv6_tclass(sock,
 747                                                IPTOS_PREC_INTERNETCONTROL);
 748 #endif
 749
 750                 sockopt_v6only(sa->sa_family, sock);
 751
 752                 ret = bind(sock, sa, salen);
 753                 en = errno;
 754         }
 755
 756         if (ret < 0) {
 757                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 758                 return ret;
 759         }
 760
 761         ret = listen(sock, SOMAXCONN);
 762         if (ret < 0) {
 763                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 764                 return ret;
 765         }
 766
 767         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 768         listener->fd = sock;
 769
 770         /* this socket needs a change of ns. record bgp back pointer */
 771         if (bgp->vrf_id != VRF_DEFAULT && vrf_is_backend_netns())
 772                 listener->bgp = bgp;
 773
 774         memcpy(&listener->su, sa, salen);
 775         listener->thread = NULL;
 776         thread_add_read(bm->master, bgp_accept, listener, sock,
 777                         &listener->thread);
 778         listnode_add(bm->listen_sockets, listener);
 779
 780         return 0;
 781 }
 782
 783 /* IPv6 supported version of BGP server socket setup.  */
 784 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 785 {
 786         struct addrinfo *ainfo;
 787         struct addrinfo *ainfo_save;
 788         static const struct addrinfo req = {
 789                 .ai_family = AF_UNSPEC,
 790                 .ai_flags = AI_PASSIVE,
 791                 .ai_socktype = SOCK_STREAM,
 792         };
 793         int ret, count;
 794         char port_str[BUFSIZ];
 795
 796         snprintf(port_str, sizeof(port_str), "%d", port);
 797         port_str[sizeof(port_str) - 1] = '\0';
 798
 799         frr_with_privs(&bgpd_privs) {
 800                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 801                                       bgp->vrf_id);
 802         }
 803         if (ret != 0) {
 804                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 805                              gai_strerror(ret));
 806                 return -1;
 807         }
 808         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 809             bgp->vrf_id != VRF_DEFAULT) {
 810                 freeaddrinfo(ainfo_save);
 811                 return -1;
 812         }
 813         count = 0;
 814         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 815                 int sock;
 816
 817                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 818                         continue;
 819
 820                 frr_with_privs(&bgpd_privs) {
 821                         sock = vrf_socket(ainfo->ai_family,
 822                                           ainfo->ai_socktype,
 823                                           ainfo->ai_protocol, bgp->vrf_id,
 824                                           (bgp->inst_type
 825                                            == BGP_INSTANCE_TYPE_VRF
 826                                            ? bgp->name : NULL));
 827                 }
 828                 if (sock < 0) {
 829                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 830                                      safe_strerror(errno));
 831                         continue;
 832                 }
 833
 834                 /* if we intend to implement ttl-security, this socket needs
 835                  * ttl=255 */
 836                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 837
 838                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 839                                    bgp);
 840                 if (ret == 0)
 841                         ++count;
 842                 else
 843                         close(sock);
 844         }
 845         freeaddrinfo(ainfo_save);
 846         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 847                 flog_err(
 848                         EC_LIB_SOCKET,
 849                         "%s: no usable addresses please check other programs usage of specified port %d",
 850                         __func__, port);
 851                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 852                              __func__);
 853                 exit(-1);
 854         }
 855
 856         return 0;
 857 }
 858
 859 /* this function closes vrf socket
 860  * this should be called only for vrf socket with netns backend
 861  */
 862 void bgp_close_vrf_socket(struct bgp *bgp)
 863 {
 864         struct listnode *node, *next;
 865         struct bgp_listener *listener;
 866
 867         if (!bgp)
 868                 return;
 869
 870         if (bm->listen_sockets == NULL)
 871                 return;
 872
 873         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 874                 if (listener->bgp == bgp) {
 875                         thread_cancel(listener->thread);
 876                         close(listener->fd);
 877                         listnode_delete(bm->listen_sockets, listener);
 878                         XFREE(MTYPE_BGP_LISTENER, listener);
 879                 }
 880         }
 881 }
 882
 883 /* this function closes main socket
 884  */
 885 void bgp_close(void)
 886 {
 887         struct listnode *node, *next;
 888         struct bgp_listener *listener;
 889
 890         if (bm->listen_sockets == NULL)
 891                 return;
 892
 893         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 894                 if (listener->bgp)
 895                         continue;
 896                 thread_cancel(listener->thread);
 897                 close(listener->fd);
 898                 listnode_delete(bm->listen_sockets, listener);
 899                 XFREE(MTYPE_BGP_LISTENER, listener);
 900         }
 901 }