bgpd/bgp_network.c

   1 /* BGP network related fucntions
   2  * Copyright (C) 1999 Kunihiro Ishiguro
   3  *
   4  * This file is part of GNU Zebra.
   5  *
   6  * GNU Zebra is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * GNU Zebra is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "thread.h"
  24 #include "sockunion.h"
  25 #include "sockopt.h"
  26 #include "memory.h"
  27 #include "log.h"
  28 #include "if.h"
  29 #include "prefix.h"
  30 #include "command.h"
  31 #include "privs.h"
  32 #include "linklist.h"
  33 #include "network.h"
  34 #include "queue.h"
  35 #include "hash.h"
  36 #include "filter.h"
  37 #include "ns.h"
  38 #include "lib_errors.h"
  39 #include "nexthop.h"
  40
  41 #include "bgpd/bgpd.h"
  42 #include "bgpd/bgp_open.h"
  43 #include "bgpd/bgp_fsm.h"
  44 #include "bgpd/bgp_attr.h"
  45 #include "bgpd/bgp_debug.h"
  46 #include "bgpd/bgp_errors.h"
  47 #include "bgpd/bgp_network.h"
  48 #include "bgpd/bgp_zebra.h"
  49 #include "bgpd/bgp_nht.h"
  50
  51 extern struct zebra_privs_t bgpd_privs;
  52
  53 static char *bgp_get_bound_name(struct peer *peer);
  54
  55 void bgp_dump_listener_info(struct vty *vty)
  56 {
  57         struct listnode *node;
  58         struct bgp_listener *listener;
  59
  60         vty_out(vty, "Name             fd Address\n");
  61         vty_out(vty, "---------------------------\n");
  62         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener)) {
  63                 char buf[SU_ADDRSTRLEN];
  64
  65                 vty_out(vty, "%-16s %d %s\n",
  66                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  67                         listener->fd,
  68                         sockunion2str(&listener->su, buf, sizeof(buf)));
  69         }
  70 }
  71
  72 /*
  73  * Set MD5 key for the socket, for the given IPv4 peer address.
  74  * If the password is NULL or zero-length, the option will be disabled.
  75  */
  76 static int bgp_md5_set_socket(int socket, union sockunion *su,
  77                               uint16_t prefixlen, const char *password)
  78 {
  79         int ret = -1;
  80         int en = ENOSYS;
  81 #if HAVE_DECL_TCP_MD5SIG
  82         union sockunion su2;
  83 #endif /* HAVE_TCP_MD5SIG */
  84
  85         assert(socket >= 0);
  86
  87 #if HAVE_DECL_TCP_MD5SIG
  88         /* Ensure there is no extraneous port information. */
  89         memcpy(&su2, su, sizeof(union sockunion));
  90         if (su2.sa.sa_family == AF_INET)
  91                 su2.sin.sin_port = 0;
  92         else
  93                 su2.sin6.sin6_port = 0;
  94
  95         /* For addresses, use the non-extended signature functionality */
  96         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_BITLEN)
  97             || (su2.sa.sa_family == AF_INET6 && prefixlen == IPV6_MAX_BITLEN))
  98                 ret = sockopt_tcp_signature(socket, &su2, password);
  99         else
 100                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
 101                                                 password);
 102         en = errno;
 103 #endif /* HAVE_TCP_MD5SIG */
 104
 105         if (ret < 0) {
 106                 char sabuf[SU_ADDRSTRLEN];
 107                 sockunion2str(su, sabuf, sizeof(sabuf));
 108
 109                 switch (ret) {
 110                 case -2:
 111                         flog_warn(
 112                                 EC_BGP_NO_TCP_MD5,
 113                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): This platform does not support MD5 auth for prefixes",
 114                                 sabuf, socket);
 115                         break;
 116                 default:
 117                         flog_warn(
 118                                 EC_BGP_NO_TCP_MD5,
 119                                 "Unable to set TCP MD5 option on socket for peer %s (sock=%d): %s",
 120                                 sabuf, socket, safe_strerror(en));
 121                 }
 122         }
 123
 124         return ret;
 125 }
 126
 127 /* Helper for bgp_connect */
 128 static int bgp_md5_set_connect(int socket, union sockunion *su,
 129                                uint16_t prefixlen, const char *password)
 130 {
 131         int ret = -1;
 132
 133 #if HAVE_DECL_TCP_MD5SIG
 134         frr_with_privs(&bgpd_privs) {
 135                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 136         }
 137 #endif /* HAVE_TCP_MD5SIG */
 138
 139         return ret;
 140 }
 141
 142 static int bgp_md5_set_password(struct peer *peer, const char *password)
 143 {
 144         struct listnode *node;
 145         int ret = 0;
 146         struct bgp_listener *listener;
 147
 148         /*
 149          * Set or unset the password on the listen socket(s). Outbound
 150          * connections are taken care of in bgp_connect() below.
 151          */
 152         frr_with_privs(&bgpd_privs) {
 153                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 154                         if (listener->su.sa.sa_family ==
 155                             peer->su.sa.sa_family) {
 156                                 uint16_t prefixlen =
 157                                         peer->su.sa.sa_family == AF_INET
 158                                                 ? IPV4_MAX_BITLEN
 159                                                 : IPV6_MAX_BITLEN;
 160
 161                                 /*
 162                                  * if we have stored a BGP vrf instance in the
 163                                  * listener it must match the bgp instance in
 164                                  * the peer otherwise the peer bgp instance
 165                                  * must be the default vrf or a view instance
 166                                  */
 167                                 if (!listener->bgp) {
 168                                         if (peer->bgp->vrf_id != VRF_DEFAULT)
 169                                                 continue;
 170                                 } else if (listener->bgp != peer->bgp)
 171                                         continue;
 172
 173                                 ret = bgp_md5_set_socket(listener->fd,
 174                                                          &peer->su, prefixlen,
 175                                                          password);
 176                                 break;
 177                         }
 178         }
 179         return ret;
 180 }
 181
 182 int bgp_md5_set_prefix(struct bgp *bgp, struct prefix *p, const char *password)
 183 {
 184         int ret = 0;
 185         union sockunion su;
 186         struct listnode *node;
 187         struct bgp_listener *listener;
 188
 189         /* Set or unset the password on the listen socket(s). */
 190         frr_with_privs(&bgpd_privs) {
 191                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 192                         if (listener->su.sa.sa_family == p->family
 193                             && ((bgp->vrf_id == VRF_DEFAULT)
 194                                 || (listener->bgp == bgp))) {
 195                                 prefix2sockunion(p, &su);
 196                                 ret = bgp_md5_set_socket(listener->fd, &su,
 197                                                          p->prefixlen,
 198                                                          password);
 199                                 break;
 200                         }
 201         }
 202
 203         return ret;
 204 }
 205
 206 int bgp_md5_unset_prefix(struct bgp *bgp, struct prefix *p)
 207 {
 208         return bgp_md5_set_prefix(bgp, p, NULL);
 209 }
 210
 211 int bgp_md5_set(struct peer *peer)
 212 {
 213         /* Set the password from listen socket. */
 214         return bgp_md5_set_password(peer, peer->password);
 215 }
 216
 217 int bgp_md5_unset(struct peer *peer)
 218 {
 219         /* Unset the password from listen socket. */
 220         return bgp_md5_set_password(peer, NULL);
 221 }
 222
 223 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 224 {
 225         int ret = 0;
 226
 227         /* In case of peer is EBGP, we should set TTL for this connection.  */
 228         if (!peer->gtsm_hops && (peer_sort_lookup(peer) == BGP_PEER_EBGP)) {
 229                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 230                 if (ret) {
 231                         flog_err(
 232                                 EC_LIB_SOCKET,
 233                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 234                                 __func__, &peer->remote_id, errno);
 235                         return ret;
 236                 }
 237         } else if (peer->gtsm_hops) {
 238                 /* On Linux, setting minttl without setting ttl seems to mess
 239                    with the
 240                    outgoing ttl. Therefore setting both.
 241                 */
 242                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 243                 if (ret) {
 244                         flog_err(
 245                                 EC_LIB_SOCKET,
 246                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 247                                 __func__, &peer->remote_id, errno);
 248                         return ret;
 249                 }
 250                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 251                                      MAXTTL + 1 - peer->gtsm_hops);
 252                 if (ret) {
 253                         flog_err(
 254                                 EC_LIB_SOCKET,
 255                                 "%s: Can't set MinTTL on peer (rtrid %pI4) socket, err = %d",
 256                                 __func__, &peer->remote_id, errno);
 257                         return ret;
 258                 }
 259         }
 260
 261         return ret;
 262 }
 263
 264 /*
 265  * Obtain the BGP instance that the incoming connection should be processed
 266  * against. This is important because more than one VRF could be using the
 267  * same IP address space. The instance is got by obtaining the device to
 268  * which the incoming connection is bound to. This could either be a VRF
 269  * or it could be an interface, which in turn determines the VRF.
 270  */
 271 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 272 {
 273 #ifndef SO_BINDTODEVICE
 274         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 275          * anyway since the assumption is that the interface name returned by
 276          * getsockopt() is useful in identifying the VRF, particularly with
 277          * Linux's
 278          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 279          * when other platforms add VRF support, this will need handling here as
 280          * well.  (or, some restructuring) */
 281         *bgp_inst = bgp_get_default();
 282         return !*bgp_inst;
 283
 284 #else
 285         char name[VRF_NAMSIZ + 1];
 286         socklen_t name_len = VRF_NAMSIZ;
 287         struct bgp *bgp;
 288         int rc;
 289         struct listnode *node, *nnode;
 290
 291         *bgp_inst = NULL;
 292         name[0] = '\0';
 293         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 294         if (rc != 0) {
 295 #if defined(HAVE_CUMULUS)
 296                 flog_err(EC_LIB_SOCKET,
 297                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 298                          safe_strerror(errno), sock);
 299                 return -1;
 300 #endif
 301         }
 302
 303         if (!strlen(name)) {
 304                 *bgp_inst = bgp_get_default();
 305                 return 0; /* default instance. */
 306         }
 307
 308         /* First try match to instance; if that fails, check for interfaces. */
 309         bgp = bgp_lookup_by_name(name);
 310         if (bgp) {
 311                 if (!bgp->vrf_id) // unexpected
 312                         return -1;
 313                 *bgp_inst = bgp;
 314                 return 0;
 315         }
 316
 317         /* TODO - This will be optimized once interfaces move into the NS */
 318         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 319                 struct interface *ifp;
 320
 321                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 322                         continue;
 323
 324                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 325                 if (ifp) {
 326                         *bgp_inst = bgp;
 327                         return 0;
 328                 }
 329         }
 330
 331         /* We didn't match to either an instance or an interface. */
 332         return -1;
 333 #endif
 334 }
 335
 336 static void bgp_socket_set_buffer_size(const int fd)
 337 {
 338         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 339                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 340         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 341                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 342 }
 343
 344 /* Accept bgp connection. */
 345 static int bgp_accept(struct thread *thread)
 346 {
 347         int bgp_sock;
 348         int accept_sock;
 349         union sockunion su;
 350         struct bgp_listener *listener = THREAD_ARG(thread);
 351         struct peer *peer;
 352         struct peer *peer1;
 353         char buf[SU_ADDRSTRLEN];
 354         struct bgp *bgp = NULL;
 355
 356         sockunion_init(&su);
 357
 358         bgp = bgp_lookup_by_name(listener->name);
 359
 360         /* Register accept thread. */
 361         accept_sock = THREAD_FD(thread);
 362         if (accept_sock < 0) {
 363                 flog_err_sys(EC_LIB_SOCKET,
 364                              "[Error] BGP accept socket fd is negative: %d",
 365                              accept_sock);
 366                 return -1;
 367         }
 368
 369         thread_add_read(bm->master, bgp_accept, listener, accept_sock,
 370                         &listener->thread);
 371
 372         /* Accept client connection. */
 373         bgp_sock = sockunion_accept(accept_sock, &su);
 374         int save_errno = errno;
 375         if (bgp_sock < 0) {
 376                 if (save_errno == EINVAL) {
 377                         struct vrf *vrf =
 378                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 379
 380                         /*
 381                          * It appears that sometimes, when VRFs are deleted on
 382                          * the system, it takes a little while for us to get
 383                          * notified about that. In the meantime we endlessly
 384                          * loop on accept(), because the socket, having been
 385                          * bound to a now-deleted VRF device, is in some weird
 386                          * state which causes accept() to fail.
 387                          *
 388                          * To avoid this, if we see accept() fail with EINVAL,
 389                          * we cancel ourselves and trust that when the VRF
 390                          * deletion notification comes in the event handler for
 391                          * that will take care of cleaning us up.
 392                          */
 393                         flog_err_sys(
 394                                 EC_LIB_SOCKET,
 395                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 396                                 safe_strerror(save_errno), accept_sock,
 397                                 VRF_LOGNAME(vrf));
 398                         THREAD_OFF(listener->thread);
 399                 } else {
 400                         flog_err_sys(
 401                                 EC_LIB_SOCKET,
 402                                 "[Error] BGP socket accept failed (%s); retrying",
 403                                 safe_strerror(save_errno));
 404                 }
 405                 return -1;
 406         }
 407         set_nonblocking(bgp_sock);
 408
 409         /* Obtain BGP instance this connection is meant for.
 410          * - if it is a VRF netns sock, then BGP is in listener structure
 411          * - otherwise, the bgp instance need to be demultiplexed
 412          */
 413         if (listener->bgp)
 414                 bgp = listener->bgp;
 415         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 416                 if (bgp_debug_neighbor_events(NULL))
 417                         zlog_debug(
 418                                 "[Event] Could not get instance for incoming conn from %s",
 419                                 inet_sutop(&su, buf));
 420                 close(bgp_sock);
 421                 return -1;
 422         }
 423
 424         bgp_socket_set_buffer_size(bgp_sock);
 425
 426         /* Check remote IP address */
 427         peer1 = peer_lookup(bgp, &su);
 428
 429         if (!peer1) {
 430                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 431                 if (peer1) {
 432                         /* Dynamic neighbor has been created, let it proceed */
 433                         peer1->fd = bgp_sock;
 434
 435                         /* Set the user configured MSS to TCP socket */
 436                         if (CHECK_FLAG(peer1->flags, PEER_FLAG_TCP_MSS))
 437                                 sockopt_tcp_mss_set(bgp_sock, peer1->tcp_mss);
 438
 439                         bgp_fsm_change_status(peer1, Active);
 440                         BGP_TIMER_OFF(
 441                                 peer1->t_start); /* created in peer_create() */
 442
 443                         if (peer_active(peer1)) {
 444                                 if (CHECK_FLAG(peer1->flags,
 445                                                PEER_FLAG_TIMER_DELAYOPEN))
 446                                         BGP_EVENT_ADD(
 447                                                 peer1,
 448                                                 TCP_connection_open_w_delay);
 449                                 else
 450                                         BGP_EVENT_ADD(peer1,
 451                                                       TCP_connection_open);
 452                         }
 453
 454                         return 0;
 455                 }
 456         }
 457
 458         if (!peer1) {
 459                 if (bgp_debug_neighbor_events(NULL)) {
 460                         zlog_debug(
 461                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 462                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 463                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 464                 }
 465                 close(bgp_sock);
 466                 return -1;
 467         }
 468
 469         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)
 470             || CHECK_FLAG(peer1->bgp->flags, BGP_FLAG_SHUTDOWN)) {
 471                 if (bgp_debug_neighbor_events(peer1))
 472                         zlog_debug(
 473                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 474                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 475                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 476                 close(bgp_sock);
 477                 return -1;
 478         }
 479
 480         /*
 481          * Do not accept incoming connections in Clearing state. This can result
 482          * in incorect state transitions - e.g., the connection goes back to
 483          * Established and then the Clearing_Completed event is generated. Also,
 484          * block incoming connection in Deleted state.
 485          */
 486         if (peer1->status == Clearing || peer1->status == Deleted) {
 487                 if (bgp_debug_neighbor_events(peer1))
 488                         zlog_debug(
 489                                 "[Event] Closing incoming conn for %s (%p) state %d",
 490                                 peer1->host, peer1, peer1->status);
 491                 close(bgp_sock);
 492                 return -1;
 493         }
 494
 495         /* Check that at least one AF is activated for the peer. */
 496         if (!peer_active(peer1)) {
 497                 if (bgp_debug_neighbor_events(peer1))
 498                         zlog_debug(
 499                                 "%s - incoming conn rejected - no AF activated for peer",
 500                                 peer1->host);
 501                 close(bgp_sock);
 502                 return -1;
 503         }
 504
 505         /* Do not try to reconnect if the peer reached maximum
 506          * prefixes, restart timer is still running or the peer
 507          * is shutdown.
 508          */
 509         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 510                 if (bgp_debug_neighbor_events(peer1))
 511                         zlog_debug(
 512                                 "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 513                                 peer1->host);
 514                 close(bgp_sock);
 515                 return -1;
 516         }
 517
 518         if (bgp_debug_neighbor_events(peer1))
 519                 zlog_debug("[Event] BGP connection from host %s fd %d",
 520                            inet_sutop(&su, buf), bgp_sock);
 521
 522         if (peer1->doppelganger) {
 523                 /* We have an existing connection. Kill the existing one and run
 524                    with this one.
 525                 */
 526                 if (bgp_debug_neighbor_events(peer1))
 527                         zlog_debug(
 528                                 "[Event] New active connection from peer %s, Killing previous active connection",
 529                                 peer1->host);
 530                 peer_delete(peer1->doppelganger);
 531         }
 532
 533         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 534                 if (bgp_debug_neighbor_events(peer1))
 535                         zlog_debug(
 536                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 537                                 peer1->host);
 538
 539         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 540                            peer1->as, peer1->as_type, NULL);
 541         hash_release(peer->bgp->peerhash, peer);
 542         hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
 543
 544         peer_xfer_config(peer, peer1);
 545         bgp_peer_gr_flags_update(peer);
 546
 547         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 548                                                           peer->bgp->peer);
 549
 550         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 551
 552                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 553
 554                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 555                         peer_nsf_stop(peer);
 556                 }
 557         }
 558
 559         UNSET_FLAG(peer->flags, PEER_FLAG_CONFIG_NODE);
 560
 561         peer->doppelganger = peer1;
 562         peer1->doppelganger = peer;
 563         peer->fd = bgp_sock;
 564         frr_with_privs(&bgpd_privs) {
 565                 vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 566         }
 567         bgp_peer_reg_with_nht(peer);
 568         bgp_fsm_change_status(peer, Active);
 569         BGP_TIMER_OFF(peer->t_start); /* created in peer_create() */
 570
 571         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 572         /* Make dummy peer until read Open packet. */
 573         if (peer_established(peer1)
 574             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 575                 /* If we have an existing established connection with graceful
 576                  * restart
 577                  * capability announced with one or more address families, then
 578                  * drop
 579                  * existing established connection and move state to connect.
 580                  */
 581                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 582
 583                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 584                     || CHECK_FLAG(peer1->flags,
 585                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 586                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 587
 588                 bgp_event_update(peer1, TCP_connection_closed);
 589         }
 590
 591         if (peer_active(peer)) {
 592                 if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER_DELAYOPEN))
 593                         BGP_EVENT_ADD(peer, TCP_connection_open_w_delay);
 594                 else
 595                         BGP_EVENT_ADD(peer, TCP_connection_open);
 596         }
 597
 598         /*
 599          * If we are doing nht for a peer that is v6 LL based
 600          * massage the event system to make things happy
 601          */
 602         bgp_nht_interface_events(peer);
 603
 604         return 0;
 605 }
 606
 607 /* BGP socket bind. */
 608 static char *bgp_get_bound_name(struct peer *peer)
 609 {
 610         if (!peer)
 611                 return NULL;
 612
 613         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 614             && !peer->conf_if)
 615                 return NULL;
 616
 617         if (peer->su.sa.sa_family != AF_INET
 618             && peer->su.sa.sa_family != AF_INET6)
 619                 return NULL; // unexpected
 620
 621         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 622          * takes precedence over VRF. For IPv4 peering, explicit interface or
 623          * VRF are the situations to bind.
 624          */
 625         if (peer->su.sa.sa_family == AF_INET6 && peer->conf_if)
 626                 return peer->conf_if;
 627
 628         if (peer->ifname)
 629                 return peer->ifname;
 630
 631         if (peer->bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 632                 return NULL;
 633
 634         return peer->bgp->name;
 635 }
 636
 637 static int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 638                               union sockunion *addr)
 639 {
 640         struct prefix *p, *sel, d;
 641         struct connected *connected;
 642         struct listnode *node;
 643         int common;
 644
 645         if (!sockunion2hostprefix(dst, &d))
 646                 return 1;
 647
 648         sel = NULL;
 649         common = -1;
 650
 651         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 652                 p = connected->address;
 653                 if (p->family != d.family)
 654                         continue;
 655                 if (prefix_common_bits(p, &d) > common) {
 656                         sel = p;
 657                         common = prefix_common_bits(sel, &d);
 658                 }
 659         }
 660
 661         if (!sel)
 662                 return 1;
 663
 664         prefix2sockunion(sel, addr);
 665         return 0;
 666 }
 667
 668 /* Update source selection.  */
 669 static int bgp_update_source(struct peer *peer)
 670 {
 671         struct interface *ifp;
 672         union sockunion addr;
 673         int ret = 0;
 674
 675         sockunion_init(&addr);
 676
 677         /* Source is specified with interface name.  */
 678         if (peer->update_if) {
 679                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 680                 if (!ifp)
 681                         return -1;
 682
 683                 if (bgp_update_address(ifp, &peer->su, &addr))
 684                         return -1;
 685
 686                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 687         }
 688
 689         /* Source is specified with IP address.  */
 690         if (peer->update_source)
 691                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 692                                      peer->update_source);
 693
 694         return ret;
 695 }
 696
 697 /* BGP try to connect to the peer.  */
 698 int bgp_connect(struct peer *peer)
 699 {
 700         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 701         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 702         ifindex_t ifindex = 0;
 703
 704         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 705                 if (bgp_debug_neighbor_events(peer))
 706                         zlog_debug("Peer address not learnt: Returning from connect");
 707                 return 0;
 708         }
 709         frr_with_privs(&bgpd_privs) {
 710         /* Make socket for the peer. */
 711                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 712                                                 bgp_get_bound_name(peer));
 713         }
 714         if (peer->fd < 0) {
 715                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 716                 if (bgp_debug_neighbor_events(peer))
 717                         zlog_debug("%s: Failure to create socket for connection to %s, error received: %s(%d)",
 718                                    __func__, peer->host, safe_strerror(errno),
 719                                    errno);
 720                 return -1;
 721         }
 722
 723         set_nonblocking(peer->fd);
 724
 725         /* Set the user configured MSS to TCP socket */
 726         if (CHECK_FLAG(peer->flags, PEER_FLAG_TCP_MSS))
 727                 sockopt_tcp_mss_set(peer->fd, peer->tcp_mss);
 728
 729         bgp_socket_set_buffer_size(peer->fd);
 730
 731         if (bgp_set_socket_ttl(peer, peer->fd) < 0) {
 732                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 733                 if (bgp_debug_neighbor_events(peer))
 734                         zlog_debug("%s: Failure to set socket ttl for connection to %s, error received: %s(%d)",
 735                                    __func__, peer->host, safe_strerror(errno),
 736                                    errno);
 737                 return -1;
 738         }
 739
 740         sockopt_reuseaddr(peer->fd);
 741         sockopt_reuseport(peer->fd);
 742
 743 #ifdef IPTOS_PREC_INTERNETCONTROL
 744         frr_with_privs(&bgpd_privs) {
 745                 if (sockunion_family(&peer->su) == AF_INET)
 746                         setsockopt_ipv4_tos(peer->fd,
 747                                             IPTOS_PREC_INTERNETCONTROL);
 748                 else if (sockunion_family(&peer->su) == AF_INET6)
 749                         setsockopt_ipv6_tclass(peer->fd,
 750                                                IPTOS_PREC_INTERNETCONTROL);
 751         }
 752 #endif
 753
 754         if (peer->password) {
 755                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 756                                              ? IPV4_MAX_BITLEN
 757                                              : IPV6_MAX_BITLEN;
 758
 759                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 760                                     peer->password);
 761         }
 762
 763         /* Update source bind. */
 764         if (bgp_update_source(peer) < 0) {
 765                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 766                 return connect_error;
 767         }
 768
 769         if (peer->conf_if || peer->ifname)
 770                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 771                                                        : peer->ifname,
 772                                          peer->bgp->vrf_id);
 773
 774         if (bgp_debug_neighbor_events(peer))
 775                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 776                            peer->host, peer->fd);
 777
 778         /* Connect to the remote peer. */
 779         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 780                                  ifindex);
 781 }
 782
 783 /* After TCP connection is established.  Get local address and port. */
 784 int bgp_getsockname(struct peer *peer)
 785 {
 786         if (peer->su_local) {
 787                 sockunion_free(peer->su_local);
 788                 peer->su_local = NULL;
 789         }
 790
 791         if (peer->su_remote) {
 792                 sockunion_free(peer->su_remote);
 793                 peer->su_remote = NULL;
 794         }
 795
 796         peer->su_local = sockunion_getsockname(peer->fd);
 797         if (!peer->su_local)
 798                 return -1;
 799         peer->su_remote = sockunion_getpeername(peer->fd);
 800         if (!peer->su_remote)
 801                 return -1;
 802
 803         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 804                                    &peer->nexthop, peer)) {
 805                 flog_err(EC_BGP_NH_UPD,
 806                          "%s: nexthop_set failed, resetting connection - intf %p",
 807                          peer->host, peer->nexthop.ifp);
 808                 return -1;
 809         }
 810         return 0;
 811 }
 812
 813
 814 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 815                         struct bgp *bgp)
 816 {
 817         struct bgp_listener *listener;
 818         int ret, en;
 819
 820         sockopt_reuseaddr(sock);
 821         sockopt_reuseport(sock);
 822
 823         frr_with_privs(&bgpd_privs) {
 824
 825 #ifdef IPTOS_PREC_INTERNETCONTROL
 826                 if (sa->sa_family == AF_INET)
 827                         setsockopt_ipv4_tos(sock, IPTOS_PREC_INTERNETCONTROL);
 828                 else if (sa->sa_family == AF_INET6)
 829                         setsockopt_ipv6_tclass(sock,
 830                                                IPTOS_PREC_INTERNETCONTROL);
 831 #endif
 832
 833                 sockopt_v6only(sa->sa_family, sock);
 834
 835                 ret = bind(sock, sa, salen);
 836                 en = errno;
 837         }
 838
 839         if (ret < 0) {
 840                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 841                 return ret;
 842         }
 843
 844         ret = listen(sock, SOMAXCONN);
 845         if (ret < 0) {
 846                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 847                 return ret;
 848         }
 849
 850         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 851         listener->fd = sock;
 852         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 853
 854         /* this socket is in a vrf record bgp back pointer */
 855         if (bgp->vrf_id != VRF_DEFAULT)
 856                 listener->bgp = bgp;
 857
 858         memcpy(&listener->su, sa, salen);
 859         thread_add_read(bm->master, bgp_accept, listener, sock,
 860                         &listener->thread);
 861         listnode_add(bm->listen_sockets, listener);
 862
 863         return 0;
 864 }
 865
 866 /* IPv6 supported version of BGP server socket setup.  */
 867 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 868 {
 869         struct addrinfo *ainfo;
 870         struct addrinfo *ainfo_save;
 871         static const struct addrinfo req = {
 872                 .ai_family = AF_UNSPEC,
 873                 .ai_flags = AI_PASSIVE,
 874                 .ai_socktype = SOCK_STREAM,
 875         };
 876         int ret, count;
 877         char port_str[BUFSIZ];
 878
 879         snprintf(port_str, sizeof(port_str), "%d", port);
 880         port_str[sizeof(port_str) - 1] = '\0';
 881
 882         frr_with_privs(&bgpd_privs) {
 883                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 884                                       bgp->vrf_id);
 885         }
 886         if (ret != 0) {
 887                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 888                              gai_strerror(ret));
 889                 return -1;
 890         }
 891         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 892             bgp->vrf_id != VRF_DEFAULT) {
 893                 freeaddrinfo(ainfo_save);
 894                 return -1;
 895         }
 896         count = 0;
 897         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 898                 int sock;
 899
 900                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 901                         continue;
 902
 903                 frr_with_privs(&bgpd_privs) {
 904                         sock = vrf_socket(ainfo->ai_family,
 905                                           ainfo->ai_socktype,
 906                                           ainfo->ai_protocol,
 907                                           bgp->vrf_id,
 908                                           (bgp->inst_type
 909                                            == BGP_INSTANCE_TYPE_VRF
 910                                            ? bgp->name : NULL));
 911                 }
 912                 if (sock < 0) {
 913                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 914                                      safe_strerror(errno));
 915                         continue;
 916                 }
 917
 918                 /* if we intend to implement ttl-security, this socket needs
 919                  * ttl=255 */
 920                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 921
 922                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 923                                    bgp);
 924                 if (ret == 0)
 925                         ++count;
 926                 else
 927                         close(sock);
 928         }
 929         freeaddrinfo(ainfo_save);
 930         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 931                 flog_err(
 932                         EC_LIB_SOCKET,
 933                         "%s: no usable addresses please check other programs usage of specified port %d",
 934                         __func__, port);
 935                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 936                              __func__);
 937                 exit(-1);
 938         }
 939
 940         return 0;
 941 }
 942
 943 /* this function closes vrf socket
 944  * this should be called only for vrf socket with netns backend
 945  */
 946 void bgp_close_vrf_socket(struct bgp *bgp)
 947 {
 948         struct listnode *node, *next;
 949         struct bgp_listener *listener;
 950
 951         if (!bgp)
 952                 return;
 953
 954         if (bm->listen_sockets == NULL)
 955                 return;
 956
 957         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 958                 if (listener->bgp == bgp) {
 959                         THREAD_OFF(listener->thread);
 960                         close(listener->fd);
 961                         listnode_delete(bm->listen_sockets, listener);
 962                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 963                         XFREE(MTYPE_BGP_LISTENER, listener);
 964                 }
 965         }
 966 }
 967
 968 /* this function closes main socket
 969  */
 970 void bgp_close(void)
 971 {
 972         struct listnode *node, *next;
 973         struct bgp_listener *listener;
 974
 975         if (bm->listen_sockets == NULL)
 976                 return;
 977
 978         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 979                 if (listener->bgp)
 980                         continue;
 981                 THREAD_OFF(listener->thread);
 982                 close(listener->fd);
 983                 listnode_delete(bm->listen_sockets, listener);
 984                 XFREE(MTYPE_BGP_LISTENER, listener->name);
 985                 XFREE(MTYPE_BGP_LISTENER, listener);
 986         }
 987 }