bgpd/bgp_network.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /* BGP network related fucntions
   3  * Copyright (C) 1999 Kunihiro Ishiguro
   4  */
   5
   6 #include <zebra.h>
   7
   8 #include "frrevent.h"
   9 #include "sockunion.h"
  10 #include "sockopt.h"
  11 #include "memory.h"
  12 #include "log.h"
  13 #include "if.h"
  14 #include "prefix.h"
  15 #include "command.h"
  16 #include "privs.h"
  17 #include "linklist.h"
  18 #include "network.h"
  19 #include "queue.h"
  20 #include "hash.h"
  21 #include "filter.h"
  22 #include "ns.h"
  23 #include "lib_errors.h"
  24 #include "nexthop.h"
  25
  26 #include "bgpd/bgpd.h"
  27 #include "bgpd/bgp_open.h"
  28 #include "bgpd/bgp_fsm.h"
  29 #include "bgpd/bgp_attr.h"
  30 #include "bgpd/bgp_debug.h"
  31 #include "bgpd/bgp_errors.h"
  32 #include "bgpd/bgp_network.h"
  33 #include "bgpd/bgp_zebra.h"
  34 #include "bgpd/bgp_nht.h"
  35
  36 extern struct zebra_privs_t bgpd_privs;
  37
  38 static char *bgp_get_bound_name(struct peer *peer);
  39
  40 void bgp_dump_listener_info(struct vty *vty)
  41 {
  42         struct listnode *node;
  43         struct bgp_listener *listener;
  44
  45         vty_out(vty, "Name             fd Address\n");
  46         vty_out(vty, "---------------------------\n");
  47         for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
  48                 vty_out(vty, "%-16s %d %pSU\n",
  49                         listener->name ? listener->name : VRF_DEFAULT_NAME,
  50                         listener->fd, &listener->su);
  51 }
  52
  53 /*
  54  * Set MD5 key for the socket, for the given IPv4 peer address.
  55  * If the password is NULL or zero-length, the option will be disabled.
  56  */
  57 static int bgp_md5_set_socket(int socket, union sockunion *su,
  58                               uint16_t prefixlen, const char *password)
  59 {
  60         int ret = -1;
  61         int en = ENOSYS;
  62 #if HAVE_DECL_TCP_MD5SIG
  63         union sockunion su2;
  64 #endif /* HAVE_TCP_MD5SIG */
  65
  66         assert(socket >= 0);
  67
  68 #if HAVE_DECL_TCP_MD5SIG
  69         /* Ensure there is no extraneous port information. */
  70         memcpy(&su2, su, sizeof(union sockunion));
  71         if (su2.sa.sa_family == AF_INET)
  72                 su2.sin.sin_port = 0;
  73         else
  74                 su2.sin6.sin6_port = 0;
  75
  76         /* For addresses, use the non-extended signature functionality */
  77         if ((su2.sa.sa_family == AF_INET && prefixlen == IPV4_MAX_BITLEN)
  78             || (su2.sa.sa_family == AF_INET6 && prefixlen == IPV6_MAX_BITLEN))
  79                 ret = sockopt_tcp_signature(socket, &su2, password);
  80         else
  81                 ret = sockopt_tcp_signature_ext(socket, &su2, prefixlen,
  82                                                 password);
  83         en = errno;
  84 #endif /* HAVE_TCP_MD5SIG */
  85
  86         if (ret < 0) {
  87                 switch (ret) {
  88                 case -2:
  89                         flog_warn(
  90                                 EC_BGP_NO_TCP_MD5,
  91                                 "Unable to set TCP MD5 option on socket for peer %pSU (sock=%d): This platform does not support MD5 auth for prefixes",
  92                                 su, socket);
  93                         break;
  94                 default:
  95                         flog_warn(
  96                                 EC_BGP_NO_TCP_MD5,
  97                                 "Unable to set TCP MD5 option on socket for peer %pSU (sock=%d): %s",
  98                                 su, socket, safe_strerror(en));
  99                 }
 100         }
 101
 102         return ret;
 103 }
 104
 105 /* Helper for bgp_connect */
 106 static int bgp_md5_set_connect(int socket, union sockunion *su,
 107                                uint16_t prefixlen, const char *password)
 108 {
 109         int ret = -1;
 110
 111 #if HAVE_DECL_TCP_MD5SIG
 112         frr_with_privs(&bgpd_privs) {
 113                 ret = bgp_md5_set_socket(socket, su, prefixlen, password);
 114         }
 115 #endif /* HAVE_TCP_MD5SIG */
 116
 117         return ret;
 118 }
 119
 120 static int bgp_md5_set_password(struct peer *peer, const char *password)
 121 {
 122         struct listnode *node;
 123         int ret = 0;
 124         struct bgp_listener *listener;
 125
 126         /*
 127          * Set or unset the password on the listen socket(s). Outbound
 128          * connections are taken care of in bgp_connect() below.
 129          */
 130         frr_with_privs(&bgpd_privs) {
 131                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 132                         if (listener->su.sa.sa_family ==
 133                             peer->su.sa.sa_family) {
 134                                 uint16_t prefixlen =
 135                                         peer->su.sa.sa_family == AF_INET
 136                                                 ? IPV4_MAX_BITLEN
 137                                                 : IPV6_MAX_BITLEN;
 138
 139                                 /*
 140                                  * if we have stored a BGP vrf instance in the
 141                                  * listener it must match the bgp instance in
 142                                  * the peer otherwise the peer bgp instance
 143                                  * must be the default vrf or a view instance
 144                                  */
 145                                 if (!listener->bgp) {
 146                                         if (peer->bgp->vrf_id != VRF_DEFAULT)
 147                                                 continue;
 148                                 } else if (listener->bgp != peer->bgp)
 149                                         continue;
 150
 151                                 ret = bgp_md5_set_socket(listener->fd,
 152                                                          &peer->su, prefixlen,
 153                                                          password);
 154                                 break;
 155                         }
 156         }
 157         return ret;
 158 }
 159
 160 int bgp_md5_set_prefix(struct bgp *bgp, struct prefix *p, const char *password)
 161 {
 162         int ret = 0;
 163         union sockunion su;
 164         struct listnode *node;
 165         struct bgp_listener *listener;
 166
 167         /* Set or unset the password on the listen socket(s). */
 168         frr_with_privs(&bgpd_privs) {
 169                 for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
 170                         if (listener->su.sa.sa_family == p->family
 171                             && ((bgp->vrf_id == VRF_DEFAULT)
 172                                 || (listener->bgp == bgp))) {
 173                                 prefix2sockunion(p, &su);
 174                                 ret = bgp_md5_set_socket(listener->fd, &su,
 175                                                          p->prefixlen,
 176                                                          password);
 177                                 break;
 178                         }
 179         }
 180
 181         return ret;
 182 }
 183
 184 int bgp_md5_unset_prefix(struct bgp *bgp, struct prefix *p)
 185 {
 186         return bgp_md5_set_prefix(bgp, p, NULL);
 187 }
 188
 189 int bgp_md5_set(struct peer *peer)
 190 {
 191         /* Set the password from listen socket. */
 192         return bgp_md5_set_password(peer, peer->password);
 193 }
 194
 195 static void bgp_update_setsockopt_tcp_keepalive(struct bgp *bgp, int fd)
 196 {
 197         if (!bgp)
 198                 return;
 199         if (bgp->tcp_keepalive_idle != 0) {
 200                 int ret;
 201
 202                 ret = setsockopt_tcp_keepalive(fd, bgp->tcp_keepalive_idle,
 203                                                bgp->tcp_keepalive_intvl,
 204                                                bgp->tcp_keepalive_probes);
 205                 if (ret < 0)
 206                         zlog_err(
 207                                 "Can't set TCP keepalive on socket %d, idle %u intvl %u probes %u",
 208                                 fd, bgp->tcp_keepalive_idle,
 209                                 bgp->tcp_keepalive_intvl,
 210                                 bgp->tcp_keepalive_probes);
 211         }
 212 }
 213
 214 int bgp_md5_unset(struct peer *peer)
 215 {
 216         /* Unset the password from listen socket. */
 217         return bgp_md5_set_password(peer, NULL);
 218 }
 219
 220 int bgp_set_socket_ttl(struct peer *peer, int bgp_sock)
 221 {
 222         int ret = 0;
 223
 224         if (!peer->gtsm_hops) {
 225                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, peer->ttl);
 226                 if (ret) {
 227                         flog_err(
 228                                 EC_LIB_SOCKET,
 229                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 230                                 __func__, &peer->remote_id, errno);
 231                         return ret;
 232                 }
 233         } else {
 234                 /* On Linux, setting minttl without setting ttl seems to mess
 235                    with the
 236                    outgoing ttl. Therefore setting both.
 237                 */
 238                 ret = sockopt_ttl(peer->su.sa.sa_family, bgp_sock, MAXTTL);
 239                 if (ret) {
 240                         flog_err(
 241                                 EC_LIB_SOCKET,
 242                                 "%s: Can't set TxTTL on peer (rtrid %pI4) socket, err = %d",
 243                                 __func__, &peer->remote_id, errno);
 244                         return ret;
 245                 }
 246                 ret = sockopt_minttl(peer->su.sa.sa_family, bgp_sock,
 247                                      MAXTTL + 1 - peer->gtsm_hops);
 248                 if (ret) {
 249                         flog_err(
 250                                 EC_LIB_SOCKET,
 251                                 "%s: Can't set MinTTL on peer (rtrid %pI4) socket, err = %d",
 252                                 __func__, &peer->remote_id, errno);
 253                         return ret;
 254                 }
 255         }
 256
 257         return ret;
 258 }
 259
 260 /*
 261  * Obtain the BGP instance that the incoming connection should be processed
 262  * against. This is important because more than one VRF could be using the
 263  * same IP address space. The instance is got by obtaining the device to
 264  * which the incoming connection is bound to. This could either be a VRF
 265  * or it could be an interface, which in turn determines the VRF.
 266  */
 267 static int bgp_get_instance_for_inc_conn(int sock, struct bgp **bgp_inst)
 268 {
 269 #ifndef SO_BINDTODEVICE
 270         /* only Linux has SO_BINDTODEVICE, but we're in Linux-specific code here
 271          * anyway since the assumption is that the interface name returned by
 272          * getsockopt() is useful in identifying the VRF, particularly with
 273          * Linux's
 274          * VRF l3master device.  The whole mechanism is specific to Linux, so...
 275          * when other platforms add VRF support, this will need handling here as
 276          * well.  (or, some restructuring) */
 277         *bgp_inst = bgp_get_default();
 278         return !*bgp_inst;
 279
 280 #else
 281         char name[VRF_NAMSIZ + 1];
 282         socklen_t name_len = VRF_NAMSIZ;
 283         struct bgp *bgp;
 284         int rc;
 285         struct listnode *node, *nnode;
 286
 287         *bgp_inst = NULL;
 288         name[0] = '\0';
 289         rc = getsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, name, &name_len);
 290         if (rc != 0) {
 291 #if defined(HAVE_CUMULUS)
 292                 flog_err(EC_LIB_SOCKET,
 293                          "[Error] BGP SO_BINDTODEVICE get failed (%s), sock %d",
 294                          safe_strerror(errno), sock);
 295                 return -1;
 296 #endif
 297         }
 298
 299         if (!strlen(name)) {
 300                 *bgp_inst = bgp_get_default();
 301                 return 0; /* default instance. */
 302         }
 303
 304         /* First try match to instance; if that fails, check for interfaces. */
 305         bgp = bgp_lookup_by_name(name);
 306         if (bgp) {
 307                 if (!bgp->vrf_id) // unexpected
 308                         return -1;
 309                 *bgp_inst = bgp;
 310                 return 0;
 311         }
 312
 313         /* TODO - This will be optimized once interfaces move into the NS */
 314         for (ALL_LIST_ELEMENTS(bm->bgp, node, nnode, bgp)) {
 315                 struct interface *ifp;
 316
 317                 if (bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 318                         continue;
 319
 320                 ifp = if_lookup_by_name(name, bgp->vrf_id);
 321                 if (ifp) {
 322                         *bgp_inst = bgp;
 323                         return 0;
 324                 }
 325         }
 326
 327         /* We didn't match to either an instance or an interface. */
 328         return -1;
 329 #endif
 330 }
 331
 332 static void bgp_socket_set_buffer_size(const int fd)
 333 {
 334         if (getsockopt_so_sendbuf(fd) < (int)bm->socket_buffer)
 335                 setsockopt_so_sendbuf(fd, bm->socket_buffer);
 336         if (getsockopt_so_recvbuf(fd) < (int)bm->socket_buffer)
 337                 setsockopt_so_recvbuf(fd, bm->socket_buffer);
 338 }
 339
 340 /* Accept bgp connection. */
 341 static void bgp_accept(struct event *thread)
 342 {
 343         int bgp_sock;
 344         int accept_sock;
 345         union sockunion su;
 346         struct bgp_listener *listener = EVENT_ARG(thread);
 347         struct peer *peer;
 348         struct peer *peer1;
 349         char buf[SU_ADDRSTRLEN];
 350         struct bgp *bgp = NULL;
 351
 352         sockunion_init(&su);
 353
 354         bgp = bgp_lookup_by_name(listener->name);
 355
 356         /* Register accept thread. */
 357         accept_sock = EVENT_FD(thread);
 358         if (accept_sock < 0) {
 359                 flog_err_sys(EC_LIB_SOCKET,
 360                              "[Error] BGP accept socket fd is negative: %d",
 361                              accept_sock);
 362                 return;
 363         }
 364
 365         event_add_read(bm->master, bgp_accept, listener, accept_sock,
 366                        &listener->thread);
 367
 368         /* Accept client connection. */
 369         bgp_sock = sockunion_accept(accept_sock, &su);
 370         int save_errno = errno;
 371         if (bgp_sock < 0) {
 372                 if (save_errno == EINVAL) {
 373                         struct vrf *vrf =
 374                                 bgp ? vrf_lookup_by_id(bgp->vrf_id) : NULL;
 375
 376                         /*
 377                          * It appears that sometimes, when VRFs are deleted on
 378                          * the system, it takes a little while for us to get
 379                          * notified about that. In the meantime we endlessly
 380                          * loop on accept(), because the socket, having been
 381                          * bound to a now-deleted VRF device, is in some weird
 382                          * state which causes accept() to fail.
 383                          *
 384                          * To avoid this, if we see accept() fail with EINVAL,
 385                          * we cancel ourselves and trust that when the VRF
 386                          * deletion notification comes in the event handler for
 387                          * that will take care of cleaning us up.
 388                          */
 389                         flog_err_sys(
 390                                 EC_LIB_SOCKET,
 391                                 "[Error] accept() failed with error \"%s\" on BGP listener socket %d for BGP instance in VRF \"%s\"; refreshing socket",
 392                                 safe_strerror(save_errno), accept_sock,
 393                                 VRF_LOGNAME(vrf));
 394                         EVENT_OFF(listener->thread);
 395                 } else {
 396                         flog_err_sys(
 397                                 EC_LIB_SOCKET,
 398                                 "[Error] BGP socket accept failed (%s); retrying",
 399                                 safe_strerror(save_errno));
 400                 }
 401                 return;
 402         }
 403         set_nonblocking(bgp_sock);
 404
 405         /* Obtain BGP instance this connection is meant for.
 406          * - if it is a VRF netns sock, then BGP is in listener structure
 407          * - otherwise, the bgp instance need to be demultiplexed
 408          */
 409         if (listener->bgp)
 410                 bgp = listener->bgp;
 411         else if (bgp_get_instance_for_inc_conn(bgp_sock, &bgp)) {
 412                 if (bgp_debug_neighbor_events(NULL))
 413                         zlog_debug(
 414                                 "[Event] Could not get instance for incoming conn from %s",
 415                                 inet_sutop(&su, buf));
 416                 close(bgp_sock);
 417                 return;
 418         }
 419
 420         bgp_socket_set_buffer_size(bgp_sock);
 421
 422         /* Set TCP keepalive when TCP keepalive is enabled */
 423         bgp_update_setsockopt_tcp_keepalive(bgp, bgp_sock);
 424
 425         /* Check remote IP address */
 426         peer1 = peer_lookup(bgp, &su);
 427
 428         if (!peer1) {
 429                 peer1 = peer_lookup_dynamic_neighbor(bgp, &su);
 430                 if (peer1) {
 431                         /* Dynamic neighbor has been created, let it proceed */
 432                         peer1->fd = bgp_sock;
 433
 434                         /* Set the user configured MSS to TCP socket */
 435                         if (CHECK_FLAG(peer1->flags, PEER_FLAG_TCP_MSS))
 436                                 sockopt_tcp_mss_set(bgp_sock, peer1->tcp_mss);
 437
 438                         bgp_fsm_change_status(peer1, Active);
 439                         EVENT_OFF(
 440                                 peer1->t_start); /* created in peer_create() */
 441
 442                         if (peer_active(peer1)) {
 443                                 if (CHECK_FLAG(peer1->flags,
 444                                                PEER_FLAG_TIMER_DELAYOPEN))
 445                                         BGP_EVENT_ADD(
 446                                                 peer1,
 447                                                 TCP_connection_open_w_delay);
 448                                 else
 449                                         BGP_EVENT_ADD(peer1,
 450                                                       TCP_connection_open);
 451                         }
 452
 453                         return;
 454                 }
 455         }
 456
 457         if (!peer1) {
 458                 if (bgp_debug_neighbor_events(NULL)) {
 459                         zlog_debug(
 460                                 "[Event] %s connection rejected(%s:%u:%s) - not configured and not valid for dynamic",
 461                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 462                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 463                 }
 464                 close(bgp_sock);
 465                 return;
 466         }
 467
 468         if (CHECK_FLAG(peer1->flags, PEER_FLAG_SHUTDOWN)
 469             || CHECK_FLAG(peer1->bgp->flags, BGP_FLAG_SHUTDOWN)) {
 470                 if (bgp_debug_neighbor_events(peer1))
 471                         zlog_debug(
 472                                 "[Event] connection from %s rejected(%s:%u:%s) due to admin shutdown",
 473                                 inet_sutop(&su, buf), bgp->name_pretty, bgp->as,
 474                                 VRF_LOGNAME(vrf_lookup_by_id(bgp->vrf_id)));
 475                 close(bgp_sock);
 476                 return;
 477         }
 478
 479         /*
 480          * Do not accept incoming connections in Clearing state. This can result
 481          * in incorect state transitions - e.g., the connection goes back to
 482          * Established and then the Clearing_Completed event is generated. Also,
 483          * block incoming connection in Deleted state.
 484          */
 485         if (peer1->status == Clearing || peer1->status == Deleted) {
 486                 if (bgp_debug_neighbor_events(peer1))
 487                         zlog_debug(
 488                                 "[Event] Closing incoming conn for %s (%p) state %d",
 489                                 peer1->host, peer1, peer1->status);
 490                 close(bgp_sock);
 491                 return;
 492         }
 493
 494         /* Check that at least one AF is activated for the peer. */
 495         if (!peer_active(peer1)) {
 496                 if (bgp_debug_neighbor_events(peer1))
 497                         zlog_debug(
 498                                 "%s - incoming conn rejected - no AF activated for peer",
 499                                 peer1->host);
 500                 close(bgp_sock);
 501                 return;
 502         }
 503
 504         /* Do not try to reconnect if the peer reached maximum
 505          * prefixes, restart timer is still running or the peer
 506          * is shutdown.
 507          */
 508         if (BGP_PEER_START_SUPPRESSED(peer1)) {
 509                 if (bgp_debug_neighbor_events(peer1)) {
 510                         if (peer1->shut_during_cfg)
 511                                 zlog_debug(
 512                                         "[Event] Incoming BGP connection rejected from %s due to configuration being currently read in",
 513                                         peer1->host);
 514                         else
 515                                 zlog_debug(
 516                                         "[Event] Incoming BGP connection rejected from %s due to maximum-prefix or shutdown",
 517                                         peer1->host);
 518                 }
 519                 close(bgp_sock);
 520                 return;
 521         }
 522
 523         if (bgp_debug_neighbor_events(peer1))
 524                 zlog_debug(
 525                         "[Event] connection from %s fd %d, active peer status %d fd %d",
 526                         inet_sutop(&su, buf), bgp_sock, peer1->status,
 527                         peer1->fd);
 528
 529         if (peer1->doppelganger) {
 530                 /* We have an existing connection. Kill the existing one and run
 531                    with this one.
 532                 */
 533                 if (bgp_debug_neighbor_events(peer1))
 534                         zlog_debug(
 535                                 "[Event] New active connection from peer %s, Killing previous active connection",
 536                                 peer1->host);
 537                 peer_delete(peer1->doppelganger);
 538         }
 539
 540         if (bgp_set_socket_ttl(peer1, bgp_sock) < 0)
 541                 if (bgp_debug_neighbor_events(peer1))
 542                         zlog_debug(
 543                                 "[Event] Unable to set min/max TTL on peer %s, Continuing",
 544                                 peer1->host);
 545
 546         peer = peer_create(&su, peer1->conf_if, peer1->bgp, peer1->local_as,
 547                            peer1->as, peer1->as_type, NULL, false, NULL);
 548
 549         peer_xfer_config(peer, peer1);
 550         bgp_peer_gr_flags_update(peer);
 551
 552         BGP_GR_ROUTER_DETECT_AND_SEND_CAPABILITY_TO_ZEBRA(peer->bgp,
 553                                                           peer->bgp->peer);
 554
 555         if (bgp_peer_gr_mode_get(peer) == PEER_DISABLE) {
 556
 557                 UNSET_FLAG(peer->sflags, PEER_STATUS_NSF_MODE);
 558
 559                 if (CHECK_FLAG(peer->sflags, PEER_STATUS_NSF_WAIT)) {
 560                         peer_nsf_stop(peer);
 561                 }
 562         }
 563
 564         peer->doppelganger = peer1;
 565         peer1->doppelganger = peer;
 566         peer->fd = bgp_sock;
 567         frr_with_privs(&bgpd_privs) {
 568                 vrf_bind(peer->bgp->vrf_id, bgp_sock, bgp_get_bound_name(peer));
 569         }
 570         bgp_peer_reg_with_nht(peer);
 571         bgp_fsm_change_status(peer, Active);
 572         EVENT_OFF(peer->t_start); /* created in peer_create() */
 573
 574         SET_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER);
 575         /* Make dummy peer until read Open packet. */
 576         if (peer_established(peer1)
 577             && CHECK_FLAG(peer1->sflags, PEER_STATUS_NSF_MODE)) {
 578                 /* If we have an existing established connection with graceful
 579                  * restart
 580                  * capability announced with one or more address families, then
 581                  * drop
 582                  * existing established connection and move state to connect.
 583                  */
 584                 peer1->last_reset = PEER_DOWN_NSF_CLOSE_SESSION;
 585
 586                 if (CHECK_FLAG(peer1->flags, PEER_FLAG_GRACEFUL_RESTART)
 587                     || CHECK_FLAG(peer1->flags,
 588                                   PEER_FLAG_GRACEFUL_RESTART_HELPER))
 589                         SET_FLAG(peer1->sflags, PEER_STATUS_NSF_WAIT);
 590
 591                 bgp_event_update(peer1, TCP_connection_closed);
 592         }
 593
 594         if (peer_active(peer)) {
 595                 if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER_DELAYOPEN))
 596                         BGP_EVENT_ADD(peer, TCP_connection_open_w_delay);
 597                 else
 598                         BGP_EVENT_ADD(peer, TCP_connection_open);
 599         }
 600
 601         /*
 602          * If we are doing nht for a peer that is v6 LL based
 603          * massage the event system to make things happy
 604          */
 605         bgp_nht_interface_events(peer);
 606 }
 607
 608 /* BGP socket bind. */
 609 static char *bgp_get_bound_name(struct peer *peer)
 610 {
 611         if (!peer)
 612                 return NULL;
 613
 614         if ((peer->bgp->vrf_id == VRF_DEFAULT) && !peer->ifname
 615             && !peer->conf_if)
 616                 return NULL;
 617
 618         if (peer->su.sa.sa_family != AF_INET
 619             && peer->su.sa.sa_family != AF_INET6)
 620                 return NULL; // unexpected
 621
 622         /* For IPv6 peering, interface (unnumbered or link-local with interface)
 623          * takes precedence over VRF. For IPv4 peering, explicit interface or
 624          * VRF are the situations to bind.
 625          */
 626         if (peer->su.sa.sa_family == AF_INET6 && peer->conf_if)
 627                 return peer->conf_if;
 628
 629         if (peer->ifname)
 630                 return peer->ifname;
 631
 632         if (peer->bgp->inst_type == BGP_INSTANCE_TYPE_VIEW)
 633                 return NULL;
 634
 635         return peer->bgp->name;
 636 }
 637
 638 int bgp_update_address(struct interface *ifp, const union sockunion *dst,
 639                               union sockunion *addr)
 640 {
 641         struct prefix *p, *sel, d;
 642         struct connected *connected;
 643         struct listnode *node;
 644         int common;
 645
 646         if (!sockunion2hostprefix(dst, &d))
 647                 return 1;
 648
 649         sel = NULL;
 650         common = -1;
 651
 652         for (ALL_LIST_ELEMENTS_RO(ifp->connected, node, connected)) {
 653                 p = connected->address;
 654                 if (p->family != d.family)
 655                         continue;
 656                 if (prefix_common_bits(p, &d) > common) {
 657                         sel = p;
 658                         common = prefix_common_bits(sel, &d);
 659                 }
 660         }
 661
 662         if (!sel)
 663                 return 1;
 664
 665         prefix2sockunion(sel, addr);
 666         return 0;
 667 }
 668
 669 /* Update source selection.  */
 670 static int bgp_update_source(struct peer *peer)
 671 {
 672         struct interface *ifp;
 673         union sockunion addr;
 674         int ret = 0;
 675
 676         sockunion_init(&addr);
 677
 678         /* Source is specified with interface name.  */
 679         if (peer->update_if) {
 680                 ifp = if_lookup_by_name(peer->update_if, peer->bgp->vrf_id);
 681                 if (!ifp)
 682                         return -1;
 683
 684                 if (bgp_update_address(ifp, &peer->su, &addr))
 685                         return -1;
 686
 687                 ret = sockunion_bind(peer->fd, &addr, 0, &addr);
 688         }
 689
 690         /* Source is specified with IP address.  */
 691         if (peer->update_source)
 692                 ret = sockunion_bind(peer->fd, peer->update_source, 0,
 693                                      peer->update_source);
 694
 695         return ret;
 696 }
 697
 698 /* BGP try to connect to the peer.  */
 699 int bgp_connect(struct peer *peer)
 700 {
 701         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_WRITES_ON));
 702         assert(!CHECK_FLAG(peer->thread_flags, PEER_THREAD_READS_ON));
 703         ifindex_t ifindex = 0;
 704
 705         if (peer->conf_if && BGP_PEER_SU_UNSPEC(peer)) {
 706                 if (bgp_debug_neighbor_events(peer))
 707                         zlog_debug("Peer address not learnt: Returning from connect");
 708                 return 0;
 709         }
 710         frr_with_privs(&bgpd_privs) {
 711         /* Make socket for the peer. */
 712                 peer->fd = vrf_sockunion_socket(&peer->su, peer->bgp->vrf_id,
 713                                                 bgp_get_bound_name(peer));
 714         }
 715         if (peer->fd < 0) {
 716                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 717                 if (bgp_debug_neighbor_events(peer))
 718                         zlog_debug("%s: Failure to create socket for connection to %s, error received: %s(%d)",
 719                                    __func__, peer->host, safe_strerror(errno),
 720                                    errno);
 721                 return -1;
 722         }
 723
 724         set_nonblocking(peer->fd);
 725
 726         /* Set the user configured MSS to TCP socket */
 727         if (CHECK_FLAG(peer->flags, PEER_FLAG_TCP_MSS))
 728                 sockopt_tcp_mss_set(peer->fd, peer->tcp_mss);
 729
 730         bgp_socket_set_buffer_size(peer->fd);
 731
 732         /* Set TCP keepalive when TCP keepalive is enabled */
 733         bgp_update_setsockopt_tcp_keepalive(peer->bgp, peer->fd);
 734
 735         if (bgp_set_socket_ttl(peer, peer->fd) < 0) {
 736                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 737                 if (bgp_debug_neighbor_events(peer))
 738                         zlog_debug("%s: Failure to set socket ttl for connection to %s, error received: %s(%d)",
 739                                    __func__, peer->host, safe_strerror(errno),
 740                                    errno);
 741
 742                 return -1;
 743         }
 744
 745         sockopt_reuseaddr(peer->fd);
 746         sockopt_reuseport(peer->fd);
 747
 748 #ifdef IPTOS_PREC_INTERNETCONTROL
 749         frr_with_privs(&bgpd_privs) {
 750                 if (sockunion_family(&peer->su) == AF_INET)
 751                         setsockopt_ipv4_tos(peer->fd, bm->tcp_dscp);
 752                 else if (sockunion_family(&peer->su) == AF_INET6)
 753                         setsockopt_ipv6_tclass(peer->fd, bm->tcp_dscp);
 754         }
 755 #endif
 756
 757         if (peer->password) {
 758                 uint16_t prefixlen = peer->su.sa.sa_family == AF_INET
 759                                              ? IPV4_MAX_BITLEN
 760                                              : IPV6_MAX_BITLEN;
 761
 762                 if (!BGP_PEER_SU_UNSPEC(peer))
 763                         bgp_md5_set(peer);
 764
 765                 bgp_md5_set_connect(peer->fd, &peer->su, prefixlen,
 766                                     peer->password);
 767         }
 768
 769         /* Update source bind. */
 770         if (bgp_update_source(peer) < 0) {
 771                 peer->last_reset = PEER_DOWN_SOCKET_ERROR;
 772                 return connect_error;
 773         }
 774
 775         if (peer->conf_if || peer->ifname)
 776                 ifindex = ifname2ifindex(peer->conf_if ? peer->conf_if
 777                                                        : peer->ifname,
 778                                          peer->bgp->vrf_id);
 779
 780         if (bgp_debug_neighbor_events(peer))
 781                 zlog_debug("%s [Event] Connect start to %s fd %d", peer->host,
 782                            peer->host, peer->fd);
 783
 784         /* Connect to the remote peer. */
 785         return sockunion_connect(peer->fd, &peer->su, htons(peer->port),
 786                                  ifindex);
 787 }
 788
 789 /* After TCP connection is established.  Get local address and port. */
 790 int bgp_getsockname(struct peer *peer)
 791 {
 792         if (peer->su_local) {
 793                 sockunion_free(peer->su_local);
 794                 peer->su_local = NULL;
 795         }
 796
 797         if (peer->su_remote) {
 798                 sockunion_free(peer->su_remote);
 799                 peer->su_remote = NULL;
 800         }
 801
 802         peer->su_local = sockunion_getsockname(peer->fd);
 803         if (!peer->su_local)
 804                 return -1;
 805         peer->su_remote = sockunion_getpeername(peer->fd);
 806         if (!peer->su_remote)
 807                 return -1;
 808
 809         if (!bgp_zebra_nexthop_set(peer->su_local, peer->su_remote,
 810                                    &peer->nexthop, peer)) {
 811                 flog_err(
 812                         EC_BGP_NH_UPD,
 813                         "%s: nexthop_set failed, resetting connection - intf %s",
 814                         peer->host,
 815                         peer->nexthop.ifp ? peer->nexthop.ifp->name
 816                                           : "(Unknown)");
 817                 return -1;
 818         }
 819         return 0;
 820 }
 821
 822
 823 static int bgp_listener(int sock, struct sockaddr *sa, socklen_t salen,
 824                         struct bgp *bgp)
 825 {
 826         struct bgp_listener *listener;
 827         int ret, en;
 828
 829         sockopt_reuseaddr(sock);
 830         sockopt_reuseport(sock);
 831
 832         frr_with_privs(&bgpd_privs) {
 833
 834 #ifdef IPTOS_PREC_INTERNETCONTROL
 835                 if (sa->sa_family == AF_INET)
 836                         setsockopt_ipv4_tos(sock, bm->tcp_dscp);
 837                 else if (sa->sa_family == AF_INET6)
 838                         setsockopt_ipv6_tclass(sock, bm->tcp_dscp);
 839 #endif
 840
 841                 sockopt_v6only(sa->sa_family, sock);
 842
 843                 ret = bind(sock, sa, salen);
 844                 en = errno;
 845         }
 846
 847         if (ret < 0) {
 848                 flog_err_sys(EC_LIB_SOCKET, "bind: %s", safe_strerror(en));
 849                 return ret;
 850         }
 851
 852         ret = listen(sock, SOMAXCONN);
 853         if (ret < 0) {
 854                 flog_err_sys(EC_LIB_SOCKET, "listen: %s", safe_strerror(errno));
 855                 return ret;
 856         }
 857
 858         listener = XCALLOC(MTYPE_BGP_LISTENER, sizeof(*listener));
 859         listener->fd = sock;
 860         listener->name = XSTRDUP(MTYPE_BGP_LISTENER, bgp->name);
 861
 862         /* this socket is in a vrf record bgp back pointer */
 863         if (bgp->vrf_id != VRF_DEFAULT)
 864                 listener->bgp = bgp;
 865
 866         memcpy(&listener->su, sa, salen);
 867         event_add_read(bm->master, bgp_accept, listener, sock,
 868                        &listener->thread);
 869         listnode_add(bm->listen_sockets, listener);
 870
 871         return 0;
 872 }
 873
 874 /* IPv6 supported version of BGP server socket setup.  */
 875 int bgp_socket(struct bgp *bgp, unsigned short port, const char *address)
 876 {
 877         struct addrinfo *ainfo;
 878         struct addrinfo *ainfo_save;
 879         static const struct addrinfo req = {
 880                 .ai_family = AF_UNSPEC,
 881                 .ai_flags = AI_PASSIVE,
 882                 .ai_socktype = SOCK_STREAM,
 883         };
 884         int ret, count;
 885         char port_str[BUFSIZ];
 886
 887         snprintf(port_str, sizeof(port_str), "%d", port);
 888         port_str[sizeof(port_str) - 1] = '\0';
 889
 890         frr_with_privs(&bgpd_privs) {
 891                 ret = vrf_getaddrinfo(address, port_str, &req, &ainfo_save,
 892                                       bgp->vrf_id);
 893         }
 894         if (ret != 0) {
 895                 flog_err_sys(EC_LIB_SOCKET, "getaddrinfo: %s",
 896                              gai_strerror(ret));
 897                 return -1;
 898         }
 899         if (bgp_option_check(BGP_OPT_NO_ZEBRA) &&
 900             bgp->vrf_id != VRF_DEFAULT) {
 901                 freeaddrinfo(ainfo_save);
 902                 return -1;
 903         }
 904         count = 0;
 905         for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next) {
 906                 int sock;
 907
 908                 if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
 909                         continue;
 910
 911                 frr_with_privs(&bgpd_privs) {
 912                         sock = vrf_socket(ainfo->ai_family,
 913                                           ainfo->ai_socktype,
 914                                           ainfo->ai_protocol,
 915                                           bgp->vrf_id,
 916                                           (bgp->inst_type
 917                                            == BGP_INSTANCE_TYPE_VRF
 918                                            ? bgp->name : NULL));
 919                 }
 920                 if (sock < 0) {
 921                         flog_err_sys(EC_LIB_SOCKET, "socket: %s",
 922                                      safe_strerror(errno));
 923                         continue;
 924                 }
 925
 926                 /* if we intend to implement ttl-security, this socket needs
 927                  * ttl=255 */
 928                 sockopt_ttl(ainfo->ai_family, sock, MAXTTL);
 929
 930                 ret = bgp_listener(sock, ainfo->ai_addr, ainfo->ai_addrlen,
 931                                    bgp);
 932                 if (ret == 0)
 933                         ++count;
 934                 else
 935                         close(sock);
 936         }
 937         freeaddrinfo(ainfo_save);
 938         if (count == 0 && bgp->inst_type != BGP_INSTANCE_TYPE_VRF) {
 939                 flog_err(
 940                         EC_LIB_SOCKET,
 941                         "%s: no usable addresses please check other programs usage of specified port %d",
 942                         __func__, port);
 943                 flog_err_sys(EC_LIB_SOCKET, "%s: Program cannot continue",
 944                              __func__);
 945                 exit(-1);
 946         }
 947
 948         return 0;
 949 }
 950
 951 /* this function closes vrf socket
 952  * this should be called only for vrf socket with netns backend
 953  */
 954 void bgp_close_vrf_socket(struct bgp *bgp)
 955 {
 956         struct listnode *node, *next;
 957         struct bgp_listener *listener;
 958
 959         if (!bgp)
 960                 return;
 961
 962         if (bm->listen_sockets == NULL)
 963                 return;
 964
 965         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 966                 if (listener->bgp == bgp) {
 967                         EVENT_OFF(listener->thread);
 968                         close(listener->fd);
 969                         listnode_delete(bm->listen_sockets, listener);
 970                         XFREE(MTYPE_BGP_LISTENER, listener->name);
 971                         XFREE(MTYPE_BGP_LISTENER, listener);
 972                 }
 973         }
 974 }
 975
 976 /* this function closes main socket
 977  */
 978 void bgp_close(void)
 979 {
 980         struct listnode *node, *next;
 981         struct bgp_listener *listener;
 982
 983         if (bm->listen_sockets == NULL)
 984                 return;
 985
 986         for (ALL_LIST_ELEMENTS(bm->listen_sockets, node, next, listener)) {
 987                 if (listener->bgp)
 988                         continue;
 989                 EVENT_OFF(listener->thread);
 990                 close(listener->fd);
 991                 listnode_delete(bm->listen_sockets, listener);
 992                 XFREE(MTYPE_BGP_LISTENER, listener->name);
 993                 XFREE(MTYPE_BGP_LISTENER, listener);
 994         }
 995 }