bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49
  50 extern struct zebra_privs_t bgpd_privs;
  51
  52 static char *bgp_get_bound_name(struct peer *peer);
  53
  54 /* BGP listening socket. */
  55 struct bgp_listener {
  56         int fd;
  57         union sockunion su;
  58         struct thread *thread;
  59         struct bgp *bgp;
  60         char *name;
  61 };
  62
  63 void bgp_dump_listener_info(struct vty *vty)
  64 {
  65         struct listnode *node;
  66         struct bgp_listener *listener;
  67
  68         vty_out(vty, "Name             fd Address\n");
  69         vty_out(vty, "---------------------------\n");
  70         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) {
  71                 char buf[SU_ADDRSTRLEN];
  72
  73                 vty_out(vty, "%-16s %d %s\n",
  74                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  75                         listener->fd,
  76                         sockunion2str(&listener->su, buf, sizeof(buf)));
  77         }
  78 }
  79
  80 /*
  81  * Set MD5 key for the socket, for the given IPv4 peer address.
  82  * If the password is NULL or zero-length, the option will be disabled.
  83  */
  84 static int bgp_md5_set_socket(int socket, union sockunion *su,
  85                               uint16_t prefixlen, const char *password)
  86 {
  87         int ret = -1;
  88         int en = ENOSYS;
  89 #if HAVE_DECL_TCP_MD5SIG
  90         union sockunion su2;
  91 #endif /* HAVE_TCP_MD5SIG */
  92
  93         assert(socket >= 0);
  94
  95 #if HAVE_DECL_TCP_MD5SIG
  96         /* Ensure there is no extraneous port information. */
  97         memcpy(&su2, su, sizeof(union sockunion));
  98         if (su2.sa.sa_family == AF_INET)
  99                 su2.sin.sin_port = 0;
 100         else
 101                 su2.sin6.sin6_port = 0;
 102
 103         /* For addresses, use the non-extended signature functionality */
 104         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_BITLEN)
 105             || (su2.sa.sa_family == AF_INET6 && prefixlen == IPV6_MAX_BITLEN))
 106                 ret = sockopt_tcp_signature(socket, &su2, password);
 107         else
 108                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
 109                                                 password);
 110         en = errno;
 111 #endif /* HAVE_TCP_MD5SIG */
 112
 113         if (ret < 0) {
 114                 char sabuf[SU_ADDRSTRLEN];
 115                 sockunion2str(su, sabuf, sizeof(sabuf));
 116
 117                 switch (ret) {
 118                 case -2:
 119                         flog_warn(
 120                                 EC_BGP_NO_TCP_MD5,
 121                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): This platform does not support MD5 auth for prefixes",
 122                                 sabuf, socket);
 123                         break;
 124                 default:
 125                         flog_warn(
 126                                 EC_BGP_NO_TCP_MD5,
 127                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): %s",
 128                                 sabuf, socket, safe_strerror(en));
 129                 }
 130         }
 131
 132         return ret;
 133 }
 134
 135 /* Helper for bgp_connect */
 136 static int bgp_md5_set_connect(int socket, union sockunion *su,
 137                                uint16_t prefixlen, const char *password)
 138 {
 139         int ret = -1;
 140
 141 #if HAVE_DECL_TCP_MD5SIG
 142         frr_with_privs(&bgpd_privs) {
 143                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 144         }
 145 #endif /* HAVE_TCP_MD5SIG */
 146
 147         return ret;
 148 }
 149
 150 static int bgp_md5_set_password(struct peer *peer, const char *password)
 151 {
 152         struct listnode *node;
 153         int ret = 0;
 154         struct bgp_listener *listener;
 155
 156         /*
 157          * Set or unset the password on the listen socket(s). Outbound
 158          * connections are taken care of in bgp_connect() below.
 159          */
 160         frr_with_privs(&bgpd_privs) {
 161                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 162                         if (listener->su.sa.sa_family ==
 163                             peer->su.sa.sa_family) {
 164                                 uint16_t prefixlen =
 165                                         peer->su.sa.sa_family == AF_INET
 166                                                 ? IPV4_MAX_BITLEN
 167                                                 : IPV6_MAX_BITLEN;
 168
 169                                 /*
 170                                  * if we have stored a BGP vrf instance in the
 171                                  * listener it must match the bgp instance in
 172                                  * the peer otherwise the peer bgp instance
 173                                  * must be the default vrf or a view instance
 174                                  */
 175                                 if (!listener->bgp) {
 176                                         if (peer->bgp->vrf_id != VRF_DEFAULT
 177                                             && peer->bgp->inst_type
 178                                                        != BGP_INSTANCE_TYPE_VIEW)
 179                                                 continue;
 180                                 } else if (listener->bgp != peer->bgp)
 181                                         continue;
 182
 183                                 ret = bgp_md5_set_socket(listener->fd,
 184                                                          &peer->su, prefixlen,
 185                                                          password);
 186                                 break;
 187                         }
 188         }
 189         return ret;
 190 }
 191
 192 int bgp_md5_set_prefix(struct bgp *bgp, struct prefix *p, const char *password)
 193 {
 194         int ret = 0;
 195         union sockunion su;
 196         struct listnode *node;
 197         struct bgp_listener *listener;
 198
 199         /* Set or unset the password on the listen socket(s). */
 200         frr_with_privs(&bgpd_privs) {
 201                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 202                         if (listener->su.sa.sa_family == p->family
 203                             && ((bgp->vrf_id == VRF_DEFAULT)
 204                                 || (listener->bgp == bgp))) {
 205                                 prefix2sockunion(p, &su);
 206                                 ret = bgp_md5_set_socket(listener->fd, &su,
 207                                                          p->prefixlen,
 208                                                          password);
 209                                 break;
 210                         }
 211         }
 212
 213         return ret;
 214 }
 215
 216 int bgp_md5_unset_prefix(struct bgp *bgp, struct prefix *p)
 217 {
 218         return bgp_md5_set_prefix(bgp, p, NULL);
 219 }
 220
 221 int bgp_md5_set(struct peer *peer)
 222 {
 223         /* Set the password from listen socket. */
 224         return bgp_md5_set_password(peer, peer->password);
 225 }
 226
 227 int bgp_md5_unset(struct peer *peer)
 228 {
 229         /* Unset the password from listen socket. */
 230         return bgp_md5_set_password(peer, NULL);
 231 }
 232
 233 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 234 {
 235         int ret = 0;
 236
 237         /* In case of peer is EBGP, we should set TTL for this connection.  */
 238         if (!peer->gtsm_hops && (peer_sort_lookup(peer) == BGP_PEER_EBGP)) {
 239                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 240                 if (ret) {
 241                         flog_err(
 242                                 EC_LIB_SOCKET,
 243                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 244                                 __func__, &peer->remote_id, errno);
 245                         return ret;
 246                 }
 247         } else if (peer->gtsm_hops) {
 248                 /* On Linux, setting minttl without setting ttl seems to mess
 249                    with the
 250                    outgoing ttl. Therefore setting both.
 251                 */
 252                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 253                 if (ret) {
 254                         flog_err(
 255                                 EC_LIB_SOCKET,
 256                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 257                                 __func__, &peer->remote_id, errno);
 258                         return ret;
 259                 }
 260                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 261                                      MAXTTL + 1 - peer->gtsm_hops);
 262                 if (ret) {
 263                         flog_err(
 264                                 EC_LIB_SOCKET,
 265                                 "%s: Can't set MinTTL on peer (rtrid %pI4) socket, err = %d",
 266                                 __func__, &peer->remote_id, errno);
 267                         return ret;
 268                 }
 269         }
 270
 271         return ret;
 272 }
 273
 274 /*
 275  * Obtain the BGP instance that the incoming connection should be processed
 276  * against. This is important because more than one VRF could be using the
 277  * same IP address space. The instance is got by obtaining the device to
 278  * which the incoming connection is bound to. This could either be a VRF
 279  * or it could be an interface, which in turn determines the VRF.
 280  */
 281 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 282 {
 283 #ifndef SO_BINDTODEVICE
 284         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 285          * anyway since the assumption is that the interface name returned by
 286          * getsockopt() is useful in identifying the VRF, particularly with
 287          * Linux's
 288          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 289          * when other platforms add VRF support, this will need handling here as
 290          * well.  (or, some restructuring) */
 291         *bgp_inst = bgp_get_default();
 292         return !*bgp_inst;
 293
 294 #else
 295         char name[VRF_NAMSIZ + 1];
 296         socklen_t name_len = VRF_NAMSIZ;
 297         struct bgp *bgp;
 298         int rc;
 299         struct listnode *node, *nnode;
 300
 301         *bgp_inst = NULL;
 302         name[0] = '\0';
 303         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 304         if (rc != 0) {
 305 #if defined(HAVE_CUMULUS)
 306                 flog_err(EC_LIB_SOCKET,
 307                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 308                          safe_strerror(errno), sock);
 309                 return -1;
 310 #endif
 311         }
 312
 313         if (!strlen(name)) {
 314                 *bgp_inst = bgp_get_default();
 315                 return 0; /* default instance. */
 316         }
 317
 318         /* First try match to instance; if that fails, check for interfaces. */
 319         bgp = bgp_lookup_by_name(name);
 320         if (bgp) {
 321                 if (!bgp->vrf_id) // unexpected
 322                         return -1;
 323                 *bgp_inst = bgp;
 324                 return 0;
 325         }
 326
 327         /* TODO - This will be optimized once interfaces move into the NS */
 328         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 329                 struct interface *ifp;
 330
 331                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 332                         continue;
 333
 334                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 335                 if (ifp) {
 336                         *bgp_inst = bgp;
 337                         return 0;
 338                 }
 339         }
 340
 341         /* We didn't match to either an instance or an interface. */
 342         return -1;
 343 #endif
 344 }
 345
 346 static void bgp_socket_set_buffer_size(const int fd)
 347 {
 348         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 349                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 350         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 351                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 352 }
 353
 354 /* Accept bgp connection. */
 355 static int bgp_accept(struct thread *thread)
 356 {
 357         int bgp_sock;
 358         int accept_sock;
 359         union sockunion su;
 360         struct bgp_listener *listener = THREAD_ARG(thread);
 361         struct peer *peer;
 362         struct peer *peer1;
 363         char buf[SU_ADDRSTRLEN];
 364         struct bgp *bgp = NULL;
 365
 366         sockunion_init(&su);
 367
 368         bgp = bgp_lookup_by_name(listener->name);
 369
 370         /* Register accept thread. */
 371         accept_sock = THREAD_FD(thread);
 372         if (accept_sock < 0) {
 373                 flog_err_sys(EC_LIB_SOCKET,
 374                              "[Error] BGP accept socket fd is negative: %d",
 375                              accept_sock);
 376                 return -1;
 377         }
 378
 379         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 380                         &listener->thread);
 381
 382         /* Accept client connection. */
 383         bgp_sock = sockunion_accept(accept_sock, &su);
 384         int save_errno = errno;
 385         if (bgp_sock < 0) {
 386                 if (save_errno == EINVAL) {
 387                         struct vrf *vrf =
 388                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 389
 390                         /*
 391                          * It appears that sometimes, when VRFs are deleted on
 392                          * the system, it takes a little while for us to get
 393                          * notified about that. In the meantime we endlessly
 394                          * loop on accept(), because the socket, having been
 395                          * bound to a now-deleted VRF device, is in some weird
 396                          * state which causes accept() to fail.
 397                          *
 398                          * To avoid this, if we see accept() fail with EINVAL,
 399                          * we cancel ourselves and trust that when the VRF
 400                          * deletion notification comes in the event handler for
 401                          * that will take care of cleaning us up.
 402                          */
 403                         flog_err_sys(
 404                                 EC_LIB_SOCKET,
 405                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 406                                 safe_strerror(save_errno), accept_sock,
 407                                 VRF_LOGNAME(vrf));
 408                         THREAD_OFF(listener->thread);
 409                 } else {
 410                         flog_err_sys(
 411                                 EC_LIB_SOCKET,
 412                                 "[Error] BGP socket accept failed (%s); retrying",
 413                                 safe_strerror(save_errno));
 414                 }
 415                 return -1;
 416         }
 417         set_nonblocking(bgp_sock);
 418
 419         /* Obtain BGP instance this connection is meant for.
 420          * - if it is a VRF netns sock, then BGP is in listener structure
 421          * - otherwise, the bgp instance need to be demultiplexed
 422          */
 423         if (listener->bgp)
 424                 bgp = listener->bgp;
 425         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 426                 if (bgp_debug_neighbor_events(NULL))
 427                         zlog_debug(
 428                                 "[Event] Could not get instance for incoming conn from %s",
 429                                 inet_sutop(&su, buf));
 430                 close(bgp_sock);
 431                 return -1;
 432         }
 433
 434         bgp_socket_set_buffer_size(bgp_sock);
 435
 436         /* Check remote IP address */
 437         peer1 = peer_lookup(bgp, &su);
 438
 439         if (!peer1) {
 440                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 441                 if (peer1) {
 442                         /* Dynamic neighbor has been created, let it proceed */
 443                         peer1->fd = bgp_sock;
 444
 445                         /* Set the user configured MSS to TCP socket */
 446                         if (CHECK_FLAG(peer1->flags, PEER_FLAG_TCP_MSS))
 447                                 sockopt_tcp_mss_set(bgp_sock, peer1->tcp_mss);
 448
 449                         bgp_fsm_change_status(peer1, Active);
 450                         BGP_TIMER_OFF(
 451                                 peer1->t_start); /* created in peer_create() */
 452
 453                         if (peer_active(peer1)) {
 454                                 if (CHECK_FLAG(peer1->flags,
 455                                                PEER_FLAG_TIMER_DELAYOPEN))
 456                                         BGP_EVENT_ADD(
 457                                                 peer1,
 458                                                 TCP_connection_open_w_delay);
 459                                 else
 460                                         BGP_EVENT_ADD(peer1,
 461                                                       TCP_connection_open);
 462                         }
 463
 464                         return 0;
 465                 }
 466         }
 467
 468         if (!peer1) {
 469                 if (bgp_debug_neighbor_events(NULL)) {
 470                         zlog_debug(
 471                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 472                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 473                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 474                 }
 475                 close(bgp_sock);
 476                 return -1;
 477         }
 478
 479         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)
 480             || CHECK_FLAG(peer1->bgp->flags, BGP_FLAG_SHUTDOWN)) {
 481                 if (bgp_debug_neighbor_events(peer1))
 482                         zlog_debug(
 483                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 484                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 485                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 486                 close(bgp_sock);
 487                 return -1;
 488         }
 489
 490         /*
 491          * Do not accept incoming connections in Clearing state. This can result
 492          * in incorect state transitions - e.g., the connection goes back to
 493          * Established and then the Clearing_Completed event is generated. Also,
 494          * block incoming connection in Deleted state.
 495          */
 496         if (peer1->status == Clearing || peer1->status == Deleted) {
 497                 if (bgp_debug_neighbor_events(peer1))
 498                         zlog_debug(
 499                                 "[Event] Closing incoming conn for %s (%p) state %d",
 500                                 peer1->host, peer1, peer1->status);
 501                 close(bgp_sock);
 502                 return -1;
 503         }
 504
 505         /* Check that at least one AF is activated for the peer. */
 506         if (!peer_active(peer1)) {
 507                 if (bgp_debug_neighbor_events(peer1))
 508                         zlog_debug(
 509                                 "%s - incoming conn rejected - no AF activated for peer",
 510                                 peer1->host);
 511                 close(bgp_sock);
 512                 return -1;
 513         }
 514
 515         /* Do not try to reconnect if the peer reached maximum
 516          * prefixes, restart timer is still running or the peer
 517          * is shutdown.
 518          */
 519         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 520                 if (bgp_debug_neighbor_events(peer1))
 521                         zlog_debug(
 522                                 "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 523                                 peer1->host);
 524                 close(bgp_sock);
 525                 return -1;
 526         }
 527
 528         if (bgp_debug_neighbor_events(peer1))
 529                 zlog_debug("[Event] BGP connection from host %s fd %d",
 530                            inet_sutop(&su, buf), bgp_sock);
 531
 532         if (peer1->doppelganger) {
 533                 /* We have an existing connection. Kill the existing one and run
 534                    with this one.
 535                 */
 536                 if (bgp_debug_neighbor_events(peer1))
 537                         zlog_debug(
 538                                 "[Event] New active connection from peer %s, Killing previous active connection",
 539                                 peer1->host);
 540                 peer_delete(peer1->doppelganger);
 541         }
 542
 543         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 544                 if (bgp_debug_neighbor_events(peer1))
 545                         zlog_debug(
 546                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 547                                 peer1->host);
 548
 549         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 550                            peer1->as, peer1->as_type, NULL);
 551         hash_release(peer->bgp->peerhash, peer);
 552         hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 553
 554         peer_xfer_config(peer, peer1);
 555         bgp_peer_gr_flags_update(peer);
 556
 557         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 558                                                           peer->bgp->peer);
 559
 560         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 561
 562                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 563
 564                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 565                         peer_nsf_stop(peer);
 566                 }
 567         }
 568
 569         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 570
 571         peer->doppelganger = peer1;
 572         peer1->doppelganger = peer;
 573         peer->fd = bgp_sock;
 574         frr_with_privs(&bgpd_privs) {
 575                 vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 576         }
 577         bgp_peer_reg_with_nht(peer);
 578         bgp_fsm_change_status(peer, Active);
 579         BGP_TIMER_OFF(peer->t_start); /* created in peer_create() */
 580
 581         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 582         /* Make dummy peer until read Open packet. */
 583         if (peer_established(peer1)
 584             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 585                 /* If we have an existing established connection with graceful
 586                  * restart
 587                  * capability announced with one or more address families, then
 588                  * drop
 589                  * existing established connection and move state to connect.
 590                  */
 591                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 592
 593                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 594                     || CHECK_FLAG(peer1->flags,
 595                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 596                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 597
 598                 bgp_event_update(peer1, TCP_connection_closed);
 599         }
 600
 601         if (peer_active(peer)) {
 602                 if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER_DELAYOPEN))
 603                         BGP_EVENT_ADD(peer, TCP_connection_open_w_delay);
 604                 else
 605                         BGP_EVENT_ADD(peer, TCP_connection_open);
 606         }
 607
 608         return 0;
 609 }
 610
 611 /* BGP socket bind. */
 612 static char *bgp_get_bound_name(struct peer *peer)
 613 {
 614         char *name = NULL;
 615
 616         if (!peer)
 617                 return NULL;
 618
 619         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 620             && !peer->conf_if)
 621                 return NULL;
 622
 623         if (peer->su.sa.sa_family != AF_INET
 624             && peer->su.sa.sa_family != AF_INET6)
 625                 return NULL; // unexpected
 626
 627         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 628          * takes precedence over VRF. For IPv4 peering, explicit interface or
 629          * VRF are the situations to bind.
 630          */
 631         if (peer->su.sa.sa_family == AF_INET6)
 632                 name = (peer->conf_if ? peer->conf_if
 633                                       : (peer->ifname ? peer->ifname
 634                                                       : peer->bgp->name));
 635         else
 636                 name = peer->ifname ? peer->ifname : peer->bgp->name;
 637
 638         return name;
 639 }
 640
 641 static int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 642                               union sockunion *addr)
 643 {
 644         struct prefix *p, *sel, d;
 645         struct connected *connected;
 646         struct listnode *node;
 647         int common;
 648
 649         if (!sockunion2hostprefix(dst, &d))
 650                 return 1;
 651
 652         sel = NULL;
 653         common = -1;
 654
 655         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 656                 p = connected->address;
 657                 if (p->family != d.family)
 658                         continue;
 659                 if (prefix_common_bits(p, &d) > common) {
 660                         sel = p;
 661                         common = prefix_common_bits(sel, &d);
 662                 }
 663         }
 664
 665         if (!sel)
 666                 return 1;
 667
 668         prefix2sockunion(sel, addr);
 669         return 0;
 670 }
 671
 672 /* Update source selection.  */
 673 static int bgp_update_source(struct peer *peer)
 674 {
 675         struct interface *ifp;
 676         union sockunion addr;
 677         int ret = 0;
 678
 679         sockunion_init(&addr);
 680
 681         /* Source is specified with interface name.  */
 682         if (peer->update_if) {
 683                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 684                 if (!ifp)
 685                         return -1;
 686
 687                 if (bgp_update_address(ifp, &peer->su, &addr))
 688                         return -1;
 689
 690                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 691         }
 692
 693         /* Source is specified with IP address.  */
 694         if (peer->update_source)
 695                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 696                                      peer->update_source);
 697
 698         return ret;
 699 }
 700
 701 /* BGP try to connect to the peer.  */
 702 int bgp_connect(struct peer *peer)
 703 {
 704         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 705         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 706         ifindex_t ifindex = 0;
 707
 708         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 709                 zlog_debug("Peer address not learnt: Returning from connect");
 710                 return 0;
 711         }
 712         frr_with_privs(&bgpd_privs) {
 713         /* Make socket for the peer. */
 714                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 715                                                 bgp_get_bound_name(peer));
 716         }
 717         if (peer->fd < 0)
 718                 return -1;
 719
 720         set_nonblocking(peer->fd);
 721
 722         /* Set the user configured MSS to TCP socket */
 723         if (CHECK_FLAG(peer->flags, PEER_FLAG_TCP_MSS))
 724                 sockopt_tcp_mss_set(peer->fd, peer->tcp_mss);
 725
 726         bgp_socket_set_buffer_size(peer->fd);
 727
 728         if (bgp_set_socket_ttl(peer, peer->fd) < 0)
 729                 return -1;
 730
 731         sockopt_reuseaddr(peer->fd);
 732         sockopt_reuseport(peer->fd);
 733
 734 #ifdef IPTOS_PREC_INTERNETCONTROL
 735         frr_with_privs(&bgpd_privs) {
 736                 if (sockunion_family(&peer->su) == AF_INET)
 737                         setsockopt_ipv4_tos(peer->fd,
 738                                             IPTOS_PREC_INTERNETCONTROL);
 739                 else if (sockunion_family(&peer->su) == AF_INET6)
 740                         setsockopt_ipv6_tclass(peer->fd,
 741                                                IPTOS_PREC_INTERNETCONTROL);
 742         }
 743 #endif
 744
 745         if (peer->password) {
 746                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 747                                              ? IPV4_MAX_BITLEN
 748                                              : IPV6_MAX_BITLEN;
 749
 750                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 751                                     peer->password);
 752         }
 753
 754         /* Update source bind. */
 755         if (bgp_update_source(peer) < 0) {
 756                 return connect_error;
 757         }
 758
 759         if (peer->conf_if || peer->ifname)
 760                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 761                                                        : peer->ifname,
 762                                          peer->bgp->vrf_id);
 763
 764         if (bgp_debug_neighbor_events(peer))
 765                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 766                            peer->host, peer->fd);
 767
 768         /* Connect to the remote peer. */
 769         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 770                                  ifindex);
 771 }
 772
 773 /* After TCP connection is established.  Get local address and port. */
 774 int bgp_getsockname(struct peer *peer)
 775 {
 776         if (peer->su_local) {
 777                 sockunion_free(peer->su_local);
 778                 peer->su_local = NULL;
 779         }
 780
 781         if (peer->su_remote) {
 782                 sockunion_free(peer->su_remote);
 783                 peer->su_remote = NULL;
 784         }
 785
 786         peer->su_local = sockunion_getsockname(peer->fd);
 787         if (!peer->su_local)
 788                 return -1;
 789         peer->su_remote = sockunion_getpeername(peer->fd);
 790         if (!peer->su_remote)
 791                 return -1;
 792
 793         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 794                                    &peer->nexthop, peer)) {
 795                 flog_err(EC_BGP_NH_UPD,
 796                          "%s: nexthop_set failed, resetting connection - intf %p",
 797                          peer->host, peer->nexthop.ifp);
 798                 return -1;
 799         }
 800         return 0;
 801 }
 802
 803
 804 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 805                         struct bgp *bgp)
 806 {
 807         struct bgp_listener *listener;
 808         int ret, en;
 809
 810         sockopt_reuseaddr(sock);
 811         sockopt_reuseport(sock);
 812
 813         frr_with_privs(&bgpd_privs) {
 814
 815 #ifdef IPTOS_PREC_INTERNETCONTROL
 816                 if (sa->sa_family == AF_INET)
 817                         setsockopt_ipv4_tos(sock, IPTOS_PREC_INTERNETCONTROL);
 818                 else if (sa->sa_family == AF_INET6)
 819                         setsockopt_ipv6_tclass(sock,
 820                                                IPTOS_PREC_INTERNETCONTROL);
 821 #endif
 822
 823                 sockopt_v6only(sa->sa_family, sock);
 824
 825                 ret = bind(sock, sa, salen);
 826                 en = errno;
 827         }
 828
 829         if (ret < 0) {
 830                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 831                 return ret;
 832         }
 833
 834         ret = listen(sock, SOMAXCONN);
 835         if (ret < 0) {
 836                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 837                 return ret;
 838         }
 839
 840         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 841         listener->fd = sock;
 842         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 843
 844         /* this socket is in a vrf record bgp back pointer */
 845         if (bgp->vrf_id != VRF_DEFAULT
 846             && bgp->inst_type != BGP_INSTANCE_TYPE_VIEW)
 847                 listener->bgp = bgp;
 848
 849         memcpy(&listener->su, sa, salen);
 850         thread_add_read(bm->master, bgp_accept, listener, sock,
 851                         &listener->thread);
 852         listnode_add(bm->listen_sockets, listener);
 853
 854         return 0;
 855 }
 856
 857 /* IPv6 supported version of BGP server socket setup.  */
 858 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 859 {
 860         struct addrinfo *ainfo;
 861         struct addrinfo *ainfo_save;
 862         static const struct addrinfo req = {
 863                 .ai_family = AF_UNSPEC,
 864                 .ai_flags = AI_PASSIVE,
 865                 .ai_socktype = SOCK_STREAM,
 866         };
 867         int ret, count;
 868         char port_str[BUFSIZ];
 869
 870         snprintf(port_str, sizeof(port_str), "%d", port);
 871         port_str[sizeof(port_str) - 1] = '\0';
 872
 873         frr_with_privs(&bgpd_privs) {
 874                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 875                                       bgp->vrf_id);
 876         }
 877         if (ret != 0) {
 878                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 879                              gai_strerror(ret));
 880                 return -1;
 881         }
 882         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 883             bgp->vrf_id != VRF_DEFAULT) {
 884                 freeaddrinfo(ainfo_save);
 885                 return -1;
 886         }
 887         count = 0;
 888         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 889                 int sock;
 890
 891                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 892                         continue;
 893
 894                 frr_with_privs(&bgpd_privs) {
 895                         sock = vrf_socket(ainfo->ai_family,
 896                                           ainfo->ai_socktype,
 897                                           ainfo->ai_protocol,
 898                                           (bgp->inst_type
 899                                            != BGP_INSTANCE_TYPE_VIEW
 900                                            ? bgp->vrf_id : VRF_DEFAULT),
 901                                           (bgp->inst_type
 902                                            == BGP_INSTANCE_TYPE_VRF
 903                                            ? bgp->name : NULL));
 904                 }
 905                 if (sock < 0) {
 906                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 907                                      safe_strerror(errno));
 908                         continue;
 909                 }
 910
 911                 /* if we intend to implement ttl-security, this socket needs
 912                  * ttl=255 */
 913                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 914
 915                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 916                                    bgp);
 917                 if (ret == 0)
 918                         ++count;
 919                 else
 920                         close(sock);
 921         }
 922         freeaddrinfo(ainfo_save);
 923         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 924                 flog_err(
 925                         EC_LIB_SOCKET,
 926                         "%s: no usable addresses please check other programs usage of specified port %d",
 927                         __func__, port);
 928                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 929                              __func__);
 930                 exit(-1);
 931         }
 932
 933         return 0;
 934 }
 935
 936 /* this function closes vrf socket
 937  * this should be called only for vrf socket with netns backend
 938  */
 939 void bgp_close_vrf_socket(struct bgp *bgp)
 940 {
 941         struct listnode *node, *next;
 942         struct bgp_listener *listener;
 943
 944         if (!bgp)
 945                 return;
 946
 947         if (bm->listen_sockets == NULL)
 948                 return;
 949
 950         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 951                 if (listener->bgp == bgp) {
 952                         THREAD_OFF(listener->thread);
 953                         close(listener->fd);
 954                         listnode_delete(bm->listen_sockets, listener);
 955                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 956                         XFREE(MTYPE_BGP_LISTENER, listener);
 957                 }
 958         }
 959 }
 960
 961 /* this function closes main socket
 962  */
 963 void bgp_close(void)
 964 {
 965         struct listnode *node, *next;
 966         struct bgp_listener *listener;
 967
 968         if (bm->listen_sockets == NULL)
 969                 return;
 970
 971         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 972                 if (listener->bgp)
 973                         continue;
 974                 THREAD_OFF(listener->thread);
 975                 close(listener->fd);
 976                 listnode_delete(bm->listen_sockets, listener);
 977                 XFREE(MTYPE_BGP_LISTENER, listener->name);
 978                 XFREE(MTYPE_BGP_LISTENER, listener);
 979         }
 980 }