ldpd/socket.c

   1 /*      $OpenBSD$ */
   2
   3 /*
   4  * Copyright (c) 2016 Renato Westphal <renato@openbsd.org>
   5  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
   6  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
   7  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
   8  *
   9  * Permission to use, copy, modify, and distribute this software for any
  10  * purpose with or without fee is hereby granted, provided that the above
  11  * copyright notice and this permission notice appear in all copies.
  12  *
  13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20  */
  21
  22 #include <zebra.h>
  23
  24 #include "ldpd.h"
  25 #include "ldpe.h"
  26 #include "log.h"
  27
  28 #include "lib/log.h"
  29 #include "privs.h"
  30 #include "sockopt.h"
  31
  32 extern struct zebra_privs_t      ldpd_privs;
  33 extern struct zebra_privs_t      ldpe_privs;
  34
  35 int
  36 ldp_create_socket(int af, enum socket_type type)
  37 {
  38         int                      fd, domain, proto;
  39         union ldpd_addr          addr;
  40         union sockunion          local_su;
  41 #ifdef __OpenBSD__
  42         int                      opt;
  43 #endif
  44
  45         /* create socket */
  46         switch (type) {
  47         case LDP_SOCKET_DISC:
  48         case LDP_SOCKET_EDISC:
  49                 domain = SOCK_DGRAM;
  50                 proto = IPPROTO_UDP;
  51                 break;
  52         case LDP_SOCKET_SESSION:
  53                 domain = SOCK_STREAM;
  54                 proto = IPPROTO_TCP;
  55                 break;
  56         default:
  57                 fatalx("ldp_create_socket: unknown socket type");
  58         }
  59         fd = socket(af, domain, proto);
  60         if (fd == -1) {
  61                 log_warn("%s: error creating socket", __func__);
  62                 return (-1);
  63         }
  64         sock_set_nonblock(fd);
  65         sockopt_v6only(af, fd);
  66
  67         /* bind to a local address/port */
  68         switch (type) {
  69         case LDP_SOCKET_DISC:
  70                 /* listen on all addresses */
  71                 memset(&addr, 0, sizeof(addr));
  72                 addr2sa(af, &addr, LDP_PORT, &local_su);
  73                 break;
  74         case LDP_SOCKET_EDISC:
  75         case LDP_SOCKET_SESSION:
  76                 addr = (ldp_af_conf_get(ldpd_conf, af))->trans_addr;
  77                 addr2sa(af, &addr, LDP_PORT, &local_su);
  78                 /* ignore any possible error */
  79                 sock_set_bindany(fd, 1);
  80                 break;
  81         }
  82         frr_elevate_privs(&ldpd_privs) {
  83                 if (sock_set_reuse(fd, 1) == -1) {
  84                         close(fd);
  85                         return (-1);
  86                 }
  87                 if (bind(fd, &local_su.sa, sockaddr_len(&local_su.sa)) == -1) {
  88                         log_warnx("%s: error binding socket: %s", __func__,
  89                             safe_strerror(errno));
  90                         close(fd);
  91                         return (-1);
  92                 }
  93         }
  94
  95         /* set options */
  96         switch (af) {
  97         case AF_INET:
  98                 if (sock_set_ipv4_tos(fd, IPTOS_PREC_INTERNETCONTROL) == -1) {
  99                         close(fd);
 100                         return (-1);
 101                 }
 102                 if (type == LDP_SOCKET_DISC) {
 103                         if (sock_set_ipv4_mcast_ttl(fd,
 104                             IP_DEFAULT_MULTICAST_TTL) == -1) {
 105                                 close(fd);
 106                                 return (-1);
 107                         }
 108                         if (sock_set_ipv4_mcast_loop(fd) == -1) {
 109                                 close(fd);
 110                                 return (-1);
 111                         }
 112                 }
 113                 if (type == LDP_SOCKET_DISC || type == LDP_SOCKET_EDISC) {
 114                         if (sock_set_ipv4_recvif(fd, 1) == -1) {
 115                                 close(fd);
 116                                 return (-1);
 117                         }
 118 #ifndef MSG_MCAST
 119 #if defined(HAVE_IP_PKTINFO)
 120                         if (sock_set_ipv4_pktinfo(fd, 1) == -1) {
 121                                 close(fd);
 122                                 return (-1);
 123                         }
 124 #elif defined(HAVE_IP_RECVDSTADDR)
 125                         if (sock_set_ipv4_recvdstaddr(fd, 1) == -1) {
 126                                 close(fd);
 127                                 return (-1);
 128                         }
 129 #else
 130 #error "Unsupported socket API"
 131 #endif
 132 #endif /* MSG_MCAST */
 133                 }
 134                 if (type == LDP_SOCKET_SESSION) {
 135                         if (sock_set_ipv4_ucast_ttl(fd, 255) == -1) {
 136                                 close(fd);
 137                                 return (-1);
 138                         }
 139                 }
 140                 break;
 141         case AF_INET6:
 142                 if (sock_set_ipv6_dscp(fd, IPTOS_PREC_INTERNETCONTROL) == -1) {
 143                         close(fd);
 144                         return (-1);
 145                 }
 146                 if (type == LDP_SOCKET_DISC) {
 147                         if (sock_set_ipv6_mcast_loop(fd) == -1) {
 148                                 close(fd);
 149                                 return (-1);
 150                         }
 151                         if (sock_set_ipv6_mcast_hops(fd, 255) == -1) {
 152                                 close(fd);
 153                                 return (-1);
 154                         }
 155                         if (!(ldpd_conf->ipv6.flags & F_LDPD_AF_NO_GTSM)) {
 156                                 /* ignore any possible error */
 157                                 sock_set_ipv6_minhopcount(fd, 255);
 158                         }
 159                 }
 160                 if (type == LDP_SOCKET_DISC || type == LDP_SOCKET_EDISC) {
 161                         if (sock_set_ipv6_pktinfo(fd, 1) == -1) {
 162                                 close(fd);
 163                                 return (-1);
 164                         }
 165                 }
 166                 if (type == LDP_SOCKET_SESSION) {
 167                         if (sock_set_ipv6_ucast_hops(fd, 255) == -1) {
 168                                 close(fd);
 169                                 return (-1);
 170                         }
 171                 }
 172                 break;
 173         }
 174         switch (type) {
 175         case LDP_SOCKET_DISC:
 176         case LDP_SOCKET_EDISC:
 177                 sock_set_recvbuf(fd);
 178                 break;
 179         case LDP_SOCKET_SESSION:
 180                 if (listen(fd, LDP_BACKLOG) == -1)
 181                         log_warn("%s: error listening on socket", __func__);
 182
 183 #ifdef __OpenBSD__
 184                 opt = 1;
 185                 if (setsockopt(fd, IPPROTO_TCP, TCP_MD5SIG, &opt,
 186                     sizeof(opt)) == -1) {
 187                         if (errno == ENOPROTOOPT) {     /* system w/o md5sig */
 188                                 log_warnx("md5sig not available, disabling");
 189                                 sysdep.no_md5sig = 1;
 190                         } else {
 191                                 close(fd);
 192                                 return (-1);
 193                         }
 194                 }
 195 #endif
 196                 break;
 197         }
 198
 199         return (fd);
 200 }
 201
 202 void
 203 sock_set_nonblock(int fd)
 204 {
 205         int     flags;
 206
 207         if ((flags = fcntl(fd, F_GETFL, 0)) == -1)
 208                 fatal("fcntl F_GETFL");
 209
 210         flags |= O_NONBLOCK;
 211
 212         if ((flags = fcntl(fd, F_SETFL, flags)) == -1)
 213                 fatal("fcntl F_SETFL");
 214 }
 215
 216 void
 217 sock_set_cloexec(int fd)
 218 {
 219         int     flags;
 220
 221         if ((flags = fcntl(fd, F_GETFD, 0)) == -1)
 222                 fatal("fcntl F_GETFD");
 223
 224         flags |= FD_CLOEXEC;
 225
 226         if ((flags = fcntl(fd, F_SETFD, flags)) == -1)
 227                 fatal("fcntl F_SETFD");
 228 }
 229
 230 void
 231 sock_set_recvbuf(int fd)
 232 {
 233         int     bsize;
 234
 235         bsize = 65535;
 236         while (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &bsize,
 237             sizeof(bsize)) == -1)
 238                 bsize /= 2;
 239 }
 240
 241 int
 242 sock_set_reuse(int fd, int enable)
 243 {
 244         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &enable,
 245             sizeof(int)) < 0) {
 246                 log_warn("%s: error setting SO_REUSEADDR", __func__);
 247                 return (-1);
 248         }
 249
 250         return (0);
 251 }
 252
 253 int
 254 sock_set_bindany(int fd, int enable)
 255 {
 256 #ifdef HAVE_SO_BINDANY
 257         frr_elevate_privs(&ldpd_privs) {
 258                 if (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &enable,
 259                                sizeof(int)) < 0) {
 260                         log_warn("%s: error setting SO_BINDANY", __func__);
 261                         return (-1);
 262                 }
 263         }
 264         return (0);
 265 #elif defined(HAVE_IP_FREEBIND)
 266         if (setsockopt(fd, IPPROTO_IP, IP_FREEBIND, &enable, sizeof(int)) < 0) {
 267                 log_warn("%s: error setting IP_FREEBIND", __func__);
 268                 return (-1);
 269         }
 270         return (0);
 271 #elif defined(IP_BINDANY)
 272         frr_elevate_privs(&ldpd_privs) {
 273                 if (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &enable, sizeof(int))
 274                     < 0) {
 275                         log_warn("%s: error setting IP_BINDANY", __func__);
 276                         return (-1);
 277                 }
 278         }
 279 #else
 280         log_warnx(
 281                 "%s: missing SO_BINDANY, IP_FREEBIND and IP_BINDANY, unable to bind to a nonlocal IP address",
 282                 __func__);
 283         return (-1);
 284 #endif /* HAVE_SO_BINDANY */
 285 }
 286
 287 #ifndef __OpenBSD__
 288 /*
 289  * Set MD5 key for the socket, for the given peer address. If the password
 290  * is NULL or zero-length, the option will be disabled.
 291  */
 292 int
 293 sock_set_md5sig(int fd, int af, union ldpd_addr *addr, const char *password)
 294 {
 295         int              ret = -1;
 296         int              save_errno = ENOSYS;
 297 #if HAVE_DECL_TCP_MD5SIG
 298         union sockunion  su;
 299 #endif
 300
 301         if (fd == -1)
 302                 return (0);
 303 #if HAVE_DECL_TCP_MD5SIG
 304         addr2sa(af, addr, 0, &su);
 305
 306         frr_elevate_privs(&ldpe_privs) {
 307                 ret = sockopt_tcp_signature(fd, &su, password);
 308                 save_errno = errno;
 309         }
 310 #endif /* HAVE_TCP_MD5SIG */
 311         if (ret < 0)
 312                 log_warnx("%s: can't set TCP_MD5SIG option on fd %d: %s",
 313                     __func__, fd, safe_strerror(save_errno));
 314
 315         return (ret);
 316 }
 317 #endif
 318
 319 int
 320 sock_set_ipv4_tos(int fd, int tos)
 321 {
 322         if (setsockopt(fd, IPPROTO_IP, IP_TOS, (int *)&tos, sizeof(tos)) < 0) {
 323                 log_warn("%s: error setting IP_TOS to 0x%x", __func__, tos);
 324                 return (-1);
 325         }
 326
 327         return (0);
 328 }
 329
 330 int
 331 sock_set_ipv4_recvif(int fd, int enable)
 332 {
 333         return (setsockopt_ifindex(AF_INET, fd, enable));
 334 }
 335
 336 int
 337 sock_set_ipv4_minttl(int fd, int ttl)
 338 {
 339         return (sockopt_minttl(AF_INET, fd, ttl));
 340 }
 341
 342 int
 343 sock_set_ipv4_ucast_ttl(int fd, int ttl)
 344 {
 345         if (setsockopt(fd, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl)) < 0) {
 346                 log_warn("%s: error setting IP_TTL", __func__);
 347                 return (-1);
 348         }
 349
 350         return (0);
 351 }
 352
 353 int
 354 sock_set_ipv4_mcast_ttl(int fd, uint8_t ttl)
 355 {
 356         if (setsockopt(fd, IPPROTO_IP, IP_MULTICAST_TTL,
 357             (char *)&ttl, sizeof(ttl)) < 0) {
 358                 log_warn("%s: error setting IP_MULTICAST_TTL to %d",
 359                     __func__, ttl);
 360                 return (-1);
 361         }
 362
 363         return (0);
 364 }
 365
 366 #ifndef MSG_MCAST
 367 #if defined(HAVE_IP_PKTINFO)
 368 int
 369 sock_set_ipv4_pktinfo(int fd, int enable)
 370 {
 371         if (setsockopt(fd, IPPROTO_IP, IP_PKTINFO, &enable,
 372             sizeof(enable)) < 0) {
 373                 log_warn("%s: error setting IP_PKTINFO", __func__);
 374                 return (-1);
 375         }
 376
 377         return (0);
 378 }
 379 #elif defined(HAVE_IP_RECVDSTADDR)
 380 int
 381 sock_set_ipv4_recvdstaddr(int fd, int enable)
 382 {
 383         if (setsockopt(fd, IPPROTO_IP, IP_RECVDSTADDR, &enable,
 384             sizeof(enable)) < 0) {
 385                 log_warn("%s: error setting IP_RECVDSTADDR", __func__);
 386                 return (-1);
 387         }
 388
 389         return (0);
 390 }
 391 #else
 392 #error "Unsupported socket API"
 393 #endif
 394 #endif /* MSG_MCAST */
 395
 396 int
 397 sock_set_ipv4_mcast(struct iface *iface)
 398 {
 399         struct in_addr           if_addr;
 400
 401         if_addr.s_addr = if_get_ipv4_addr(iface);
 402
 403         if (setsockopt_ipv4_multicast_if(global.ipv4.ldp_disc_socket,
 404             if_addr, iface->ifindex) < 0) {
 405                 log_warn("%s: error setting IP_MULTICAST_IF, interface %s",
 406                     __func__, iface->name);
 407                 return (-1);
 408         }
 409
 410         return (0);
 411 }
 412
 413 int
 414 sock_set_ipv4_mcast_loop(int fd)
 415 {
 416         return (setsockopt_ipv4_multicast_loop(fd, 0));
 417 }
 418
 419 int
 420 sock_set_ipv6_dscp(int fd, int dscp)
 421 {
 422         if (setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &dscp,
 423             sizeof(dscp)) < 0) {
 424                 log_warn("%s: error setting IPV6_TCLASS", __func__);
 425                 return (-1);
 426         }
 427
 428         return (0);
 429 }
 430
 431 int
 432 sock_set_ipv6_pktinfo(int fd, int enable)
 433 {
 434         if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &enable,
 435             sizeof(enable)) < 0) {
 436                 log_warn("%s: error setting IPV6_RECVPKTINFO", __func__);
 437                 return (-1);
 438         }
 439
 440         return (0);
 441 }
 442
 443 int
 444 sock_set_ipv6_minhopcount(int fd, int hoplimit)
 445 {
 446         return (sockopt_minttl(AF_INET6, fd, hoplimit));
 447 }
 448
 449 int
 450 sock_set_ipv6_ucast_hops(int fd, int hoplimit)
 451 {
 452         if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
 453             &hoplimit, sizeof(hoplimit)) < 0) {
 454                 log_warn("%s: error setting IPV6_UNICAST_HOPS", __func__);
 455                 return (-1);
 456         }
 457
 458         return (0);
 459 }
 460
 461 int
 462 sock_set_ipv6_mcast_hops(int fd, int hoplimit)
 463 {
 464         if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
 465             &hoplimit, sizeof(hoplimit)) < 0) {
 466                 log_warn("%s: error setting IPV6_MULTICAST_HOPS", __func__);
 467                 return (-1);
 468         }
 469
 470         return (0);
 471 }
 472
 473 int
 474 sock_set_ipv6_mcast(struct iface *iface)
 475 {
 476         if (setsockopt(global.ipv6.ldp_disc_socket, IPPROTO_IPV6,
 477             IPV6_MULTICAST_IF, &iface->ifindex, sizeof(iface->ifindex)) < 0) {
 478                 log_warn("%s: error setting IPV6_MULTICAST_IF, interface %s",
 479                     __func__, iface->name);
 480                 return (-1);
 481         }
 482
 483         return (0);
 484 }
 485
 486 int
 487 sock_set_ipv6_mcast_loop(int fd)
 488 {
 489         unsigned int    loop = 0;
 490
 491         if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP,
 492             &loop, sizeof(loop)) < 0) {
 493                 log_warn("%s: error setting IPV6_MULTICAST_LOOP", __func__);
 494                 return (-1);
 495         }
 496
 497         return (0);
 498 }