ldpd/socket.c

   1 /*      $OpenBSD$ */
   2
   3 /*
   4  * Copyright (c) 2016 Renato Westphal <renato@openbsd.org>
   5  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
   6  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
   7  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
   8  *
   9  * Permission to use, copy, modify, and distribute this software for any
  10  * purpose with or without fee is hereby granted, provided that the above
  11  * copyright notice and this permission notice appear in all copies.
  12  *
  13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20  */
  21
  22 #include <zebra.h>
  23
  24 #include "ldpd.h"
  25 #include "ldpe.h"
  26 #include "log.h"
  27
  28 #include "lib/log.h"
  29 #include "privs.h"
  30 #include "sockopt.h"
  31
  32 extern struct zebra_privs_t      ldpd_privs;
  33 extern struct zebra_privs_t      ldpe_privs;
  34
  35 int
  36 ldp_create_socket(int af, enum socket_type type)
  37 {
  38         int                      fd, domain, proto;
  39         union ldpd_addr          addr;
  40         union sockunion          local_su;
  41 #ifdef __OpenBSD__
  42         int                      opt;
  43 #endif
  44
  45         /* create socket */
  46         switch (type) {
  47         case LDP_SOCKET_DISC:
  48         case LDP_SOCKET_EDISC:
  49                 domain = SOCK_DGRAM;
  50                 proto = IPPROTO_UDP;
  51                 break;
  52         case LDP_SOCKET_SESSION:
  53                 domain = SOCK_STREAM;
  54                 proto = IPPROTO_TCP;
  55                 break;
  56         default:
  57                 fatalx("ldp_create_socket: unknown socket type");
  58         }
  59         fd = socket(af, domain, proto);
  60         if (fd == -1) {
  61                 log_warn("%s: error creating socket", __func__);
  62                 return (-1);
  63         }
  64         sock_set_nonblock(fd);
  65         sockopt_v6only(af, fd);
  66
  67         /* bind to a local address/port */
  68         switch (type) {
  69         case LDP_SOCKET_DISC:
  70                 /* listen on all addresses */
  71                 memset(&addr, 0, sizeof(addr));
  72                 addr2sa(af, &addr, LDP_PORT, &local_su);
  73                 break;
  74         case LDP_SOCKET_EDISC:
  75         case LDP_SOCKET_SESSION:
  76                 addr = (ldp_af_conf_get(ldpd_conf, af))->trans_addr;
  77                 addr2sa(af, &addr, LDP_PORT, &local_su);
  78                 /* ignore any possible error */
  79                 sock_set_bindany(fd, 1);
  80                 break;
  81         }
  82         frr_elevate_privs(&ldpd_privs) {
  83                 if (sock_set_reuse(fd, 1) == -1) {
  84                         close(fd);
  85                         return (-1);
  86                 }
  87                 if (bind(fd, &local_su.sa, sockaddr_len(&local_su.sa)) == -1) {
  88                         log_warnx("%s: error binding socket: %s", __func__,
  89                             safe_strerror(errno));
  90                         close(fd);
  91                         return (-1);
  92                 }
  93         }
  94
  95         /* set options */
  96         switch (af) {
  97         case AF_INET:
  98                 if (sock_set_ipv4_tos(fd, IPTOS_PREC_INTERNETCONTROL) == -1) {
  99                         close(fd);
 100                         return (-1);
 101                 }
 102                 if (type == LDP_SOCKET_DISC) {
 103                         if (sock_set_ipv4_mcast_ttl(fd,
 104                             IP_DEFAULT_MULTICAST_TTL) == -1) {
 105                                 close(fd);
 106                                 return (-1);
 107                         }
 108                         if (sock_set_ipv4_mcast_loop(fd) == -1) {
 109                                 close(fd);
 110                                 return (-1);
 111                         }
 112                 }
 113                 if (type == LDP_SOCKET_DISC || type == LDP_SOCKET_EDISC) {
 114                         if (sock_set_ipv4_recvif(fd, 1) == -1) {
 115                                 close(fd);
 116                                 return (-1);
 117                         }
 118 #ifndef MSG_MCAST
 119 #if defined(HAVE_IP_PKTINFO)
 120                         if (sock_set_ipv4_pktinfo(fd, 1) == -1) {
 121                                 close(fd);
 122                                 return (-1);
 123                         }
 124 #elif defined(HAVE_IP_RECVDSTADDR)
 125                         if (sock_set_ipv4_recvdstaddr(fd, 1) == -1) {
 126                                 close(fd);
 127                                 return (-1);
 128                         }
 129 #else
 130 #error "Unsupported socket API"
 131 #endif
 132 #endif /* MSG_MCAST */
 133                 }
 134                 if (type == LDP_SOCKET_SESSION) {
 135                         if (sock_set_ipv4_ucast_ttl(fd, 255) == -1) {
 136                                 close(fd);
 137                                 return (-1);
 138                         }
 139                 }
 140                 break;
 141         case AF_INET6:
 142                 if (sock_set_ipv6_dscp(fd, IPTOS_PREC_INTERNETCONTROL) == -1) {
 143                         close(fd);
 144                         return (-1);
 145                 }
 146                 if (type == LDP_SOCKET_DISC) {
 147                         if (sock_set_ipv6_mcast_loop(fd) == -1) {
 148                                 close(fd);
 149                                 return (-1);
 150                         }
 151                         if (sock_set_ipv6_mcast_hops(fd, 255) == -1) {
 152                                 close(fd);
 153                                 return (-1);
 154                         }
 155                         if (!(ldpd_conf->ipv6.flags & F_LDPD_AF_NO_GTSM)) {
 156                                 /* ignore any possible error */
 157                                 sock_set_ipv6_minhopcount(fd, 255);
 158                         }
 159                 }
 160                 if (type == LDP_SOCKET_DISC || type == LDP_SOCKET_EDISC) {
 161                         if (sock_set_ipv6_pktinfo(fd, 1) == -1) {
 162                                 close(fd);
 163                                 return (-1);
 164                         }
 165                 }
 166                 if (type == LDP_SOCKET_SESSION) {
 167                         if (sock_set_ipv6_ucast_hops(fd, 255) == -1) {
 168                                 close(fd);
 169                                 return (-1);
 170                         }
 171                 }
 172                 break;
 173         }
 174         switch (type) {
 175         case LDP_SOCKET_DISC:
 176         case LDP_SOCKET_EDISC:
 177                 sock_set_recvbuf(fd);
 178                 break;
 179         case LDP_SOCKET_SESSION:
 180                 if (listen(fd, LDP_BACKLOG) == -1)
 181                         log_warn("%s: error listening on socket", __func__);
 182
 183 #ifdef __OpenBSD__
 184                 opt = 1;
 185                 if (setsockopt(fd, IPPROTO_TCP, TCP_MD5SIG, &opt,
 186                     sizeof(opt)) == -1) {
 187                         if (errno == ENOPROTOOPT) {     /* system w/o md5sig */
 188                                 log_warnx("md5sig not available, disabling");
 189                                 sysdep.no_md5sig = 1;
 190                         } else {
 191                                 close(fd);
 192                                 return (-1);
 193                         }
 194                 }
 195 #endif
 196                 break;
 197         }
 198
 199         return (fd);
 200 }
 201
 202 void
 203 sock_set_nonblock(int fd)
 204 {
 205         int     flags;
 206
 207         if ((flags = fcntl(fd, F_GETFL, 0)) == -1)
 208                 fatal("fcntl F_GETFL");
 209
 210         flags |= O_NONBLOCK;
 211
 212         if ((flags = fcntl(fd, F_SETFL, flags)) == -1)
 213                 fatal("fcntl F_SETFL");
 214 }
 215
 216 void
 217 sock_set_cloexec(int fd)
 218 {
 219         int     flags;
 220
 221         if ((flags = fcntl(fd, F_GETFD, 0)) == -1)
 222                 fatal("fcntl F_GETFD");
 223
 224         flags |= FD_CLOEXEC;
 225
 226         if ((flags = fcntl(fd, F_SETFD, flags)) == -1)
 227                 fatal("fcntl F_SETFD");
 228 }
 229
 230 void
 231 sock_set_recvbuf(int fd)
 232 {
 233         int     bsize;
 234
 235         bsize = 65535;
 236         while (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &bsize,
 237             sizeof(bsize)) == -1)
 238                 bsize /= 2;
 239 }
 240
 241 int
 242 sock_set_reuse(int fd, int enable)
 243 {
 244         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &enable,
 245             sizeof(int)) < 0) {
 246                 log_warn("%s: error setting SO_REUSEADDR", __func__);
 247                 return (-1);
 248         }
 249
 250         return (0);
 251 }
 252
 253 int
 254 sock_set_bindany(int fd, int enable)
 255 {
 256 #ifdef HAVE_SO_BINDANY
 257         frr_elevate_privs(&ldpd_privs) {
 258                 if (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &enable,
 259                                sizeof(int)) < 0) {
 260                         log_warn("%s: error setting SO_BINDANY", __func__);
 261                         return (-1);
 262                 }
 263         }
 264         return (0);
 265 #elif defined(HAVE_IP_FREEBIND)
 266         if (setsockopt(fd, IPPROTO_IP, IP_FREEBIND, &enable, sizeof(int)) < 0) {
 267                 log_warn("%s: error setting IP_FREEBIND", __func__);
 268                 return (-1);
 269         }
 270         return (0);
 271 #else
 272         log_warnx("%s: missing SO_BINDANY and IP_FREEBIND, unable to bind "
 273             "to a nonlocal IP address", __func__);
 274         return (-1);
 275 #endif /* HAVE_SO_BINDANY */
 276 }
 277
 278 #ifndef __OpenBSD__
 279 /*
 280  * Set MD5 key for the socket, for the given peer address. If the password
 281  * is NULL or zero-length, the option will be disabled.
 282  */
 283 int
 284 sock_set_md5sig(int fd, int af, union ldpd_addr *addr, const char *password)
 285 {
 286         int              ret = -1;
 287         int              save_errno = ENOSYS;
 288 #if HAVE_DECL_TCP_MD5SIG
 289         union sockunion  su;
 290 #endif
 291
 292         if (fd == -1)
 293                 return (0);
 294 #if HAVE_DECL_TCP_MD5SIG
 295         addr2sa(af, addr, 0, &su);
 296
 297         frr_elevate_privs(&ldpe_privs) {
 298                 ret = sockopt_tcp_signature(fd, &su, password);
 299                 save_errno = errno;
 300         }
 301 #endif /* HAVE_TCP_MD5SIG */
 302         if (ret < 0)
 303                 log_warnx("%s: can't set TCP_MD5SIG option on fd %d: %s",
 304                     __func__, fd, safe_strerror(save_errno));
 305
 306         return (ret);
 307 }
 308 #endif
 309
 310 int
 311 sock_set_ipv4_tos(int fd, int tos)
 312 {
 313         if (setsockopt(fd, IPPROTO_IP, IP_TOS, (int *)&tos, sizeof(tos)) < 0) {
 314                 log_warn("%s: error setting IP_TOS to 0x%x", __func__, tos);
 315                 return (-1);
 316         }
 317
 318         return (0);
 319 }
 320
 321 int
 322 sock_set_ipv4_recvif(int fd, int enable)
 323 {
 324         return (setsockopt_ifindex(AF_INET, fd, enable));
 325 }
 326
 327 int
 328 sock_set_ipv4_minttl(int fd, int ttl)
 329 {
 330         return (sockopt_minttl(AF_INET, fd, ttl));
 331 }
 332
 333 int
 334 sock_set_ipv4_ucast_ttl(int fd, int ttl)
 335 {
 336         if (setsockopt(fd, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl)) < 0) {
 337                 log_warn("%s: error setting IP_TTL", __func__);
 338                 return (-1);
 339         }
 340
 341         return (0);
 342 }
 343
 344 int
 345 sock_set_ipv4_mcast_ttl(int fd, uint8_t ttl)
 346 {
 347         if (setsockopt(fd, IPPROTO_IP, IP_MULTICAST_TTL,
 348             (char *)&ttl, sizeof(ttl)) < 0) {
 349                 log_warn("%s: error setting IP_MULTICAST_TTL to %d",
 350                     __func__, ttl);
 351                 return (-1);
 352         }
 353
 354         return (0);
 355 }
 356
 357 #ifndef MSG_MCAST
 358 #if defined(HAVE_IP_PKTINFO)
 359 int
 360 sock_set_ipv4_pktinfo(int fd, int enable)
 361 {
 362         if (setsockopt(fd, IPPROTO_IP, IP_PKTINFO, &enable,
 363             sizeof(enable)) < 0) {
 364                 log_warn("%s: error setting IP_PKTINFO", __func__);
 365                 return (-1);
 366         }
 367
 368         return (0);
 369 }
 370 #elif defined(HAVE_IP_RECVDSTADDR)
 371 int
 372 sock_set_ipv4_recvdstaddr(int fd, int enable)
 373 {
 374         if (setsockopt(fd, IPPROTO_IP, IP_RECVDSTADDR, &enable,
 375             sizeof(enable)) < 0) {
 376                 log_warn("%s: error setting IP_RECVDSTADDR", __func__);
 377                 return (-1);
 378         }
 379
 380         return (0);
 381 }
 382 #else
 383 #error "Unsupported socket API"
 384 #endif
 385 #endif /* MSG_MCAST */
 386
 387 int
 388 sock_set_ipv4_mcast(struct iface *iface)
 389 {
 390         struct in_addr           if_addr;
 391
 392         if_addr.s_addr = if_get_ipv4_addr(iface);
 393
 394         if (setsockopt_ipv4_multicast_if(global.ipv4.ldp_disc_socket,
 395             if_addr, iface->ifindex) < 0) {
 396                 log_warn("%s: error setting IP_MULTICAST_IF, interface %s",
 397                     __func__, iface->name);
 398                 return (-1);
 399         }
 400
 401         return (0);
 402 }
 403
 404 int
 405 sock_set_ipv4_mcast_loop(int fd)
 406 {
 407         return (setsockopt_ipv4_multicast_loop(fd, 0));
 408 }
 409
 410 int
 411 sock_set_ipv6_dscp(int fd, int dscp)
 412 {
 413         if (setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &dscp,
 414             sizeof(dscp)) < 0) {
 415                 log_warn("%s: error setting IPV6_TCLASS", __func__);
 416                 return (-1);
 417         }
 418
 419         return (0);
 420 }
 421
 422 int
 423 sock_set_ipv6_pktinfo(int fd, int enable)
 424 {
 425         if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &enable,
 426             sizeof(enable)) < 0) {
 427                 log_warn("%s: error setting IPV6_RECVPKTINFO", __func__);
 428                 return (-1);
 429         }
 430
 431         return (0);
 432 }
 433
 434 int
 435 sock_set_ipv6_minhopcount(int fd, int hoplimit)
 436 {
 437         return (sockopt_minttl(AF_INET6, fd, hoplimit));
 438 }
 439
 440 int
 441 sock_set_ipv6_ucast_hops(int fd, int hoplimit)
 442 {
 443         if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
 444             &hoplimit, sizeof(hoplimit)) < 0) {
 445                 log_warn("%s: error setting IPV6_UNICAST_HOPS", __func__);
 446                 return (-1);
 447         }
 448
 449         return (0);
 450 }
 451
 452 int
 453 sock_set_ipv6_mcast_hops(int fd, int hoplimit)
 454 {
 455         if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
 456             &hoplimit, sizeof(hoplimit)) < 0) {
 457                 log_warn("%s: error setting IPV6_MULTICAST_HOPS", __func__);
 458                 return (-1);
 459         }
 460
 461         return (0);
 462 }
 463
 464 int
 465 sock_set_ipv6_mcast(struct iface *iface)
 466 {
 467         if (setsockopt(global.ipv6.ldp_disc_socket, IPPROTO_IPV6,
 468             IPV6_MULTICAST_IF, &iface->ifindex, sizeof(iface->ifindex)) < 0) {
 469                 log_warn("%s: error setting IPV6_MULTICAST_IF, interface %s",
 470                     __func__, iface->name);
 471                 return (-1);
 472         }
 473
 474         return (0);
 475 }
 476
 477 int
 478 sock_set_ipv6_mcast_loop(int fd)
 479 {
 480         unsigned int    loop = 0;
 481
 482         if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP,
 483             &loop, sizeof(loop)) < 0) {
 484                 log_warn("%s: error setting IPV6_MULTICAST_LOOP", __func__);
 485                 return (-1);
 486         }
 487
 488         return (0);
 489 }