lib: thoroughly disable tcp-zebra

Disable this in the code to make it hard for people to shoot themselves
in the foot.  It's only left as a remnant for development use.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>

diff --git a/doc/zebra.8.in b/doc/zebra.8.in
index 333e66fcf684f882bdfe98ba99fd6045f845431e..7f4a81b1a0b2c55d86b54fc8edbc6c29340e99c8 100644 (file)
--- a/doc/zebra.8.in
+++ b/doc/zebra.8.in
@@ -104,14 +104,6 @@ It should thus be loaded with \fB-M fpm:netlink\fR or \fB-M fpm:protobuf\fR.
 Use the specified path to open the zebra API socket on.
 The default is \fB\fI@CFG_STATE@/zserv.api\fR.  This option must be given with
 the same value to all FRR protocol daemons.
-
-For debugging purposes (using tcpdump or wireshark to trace cross-daemon
-communication), a TCP socket can be used by specifying \fI@tcp[46][:port]\fR.
-It is intentionally not possible to bind this to anything other than localhost
-since zebra and the other daemons need to be running on the same host.  Using
-this feature \fBCREATES A SECURITY ISSUE\fR since nothing prevents other users
-on the local system from connecting to zebra and injecting bogus routing
-information.
 .TP
 \fB\-v\fR, \fB\-\-version\fR
 Print the version and exit.

diff --git a/lib/libfrr.c b/lib/libfrr.c
index e92456cf775a0eaf611a3a648ada32c117a781f0..c901dcc22956cb3dcd9e13c90fbef5311680c8c8 100644 (file)
--- a/lib/libfrr.c
+++ b/lib/libfrr.c
@@ -138,6 +138,7 @@ bool frr_zclient_addr(struct sockaddr_storage *sa, socklen_t *sa_len,
                path = ZEBRA_SERV_PATH;
 
        if (!strncmp(path, ZAPI_TCP_PATHNAME, strlen(ZAPI_TCP_PATHNAME))) {
+               /* note: this functionality is disabled at bottom */
                int af;
                int port = ZEBRA_PORT;
                char *err = NULL;
@@ -193,6 +194,21 @@ bool frr_zclient_addr(struct sockaddr_storage *sa, socklen_t *sa_len,
 #endif
                        break;
                }
+
+#if 1
+               /* force-disable this path, because tcp-zebra is a
+                * SECURITY ISSUE.  there are no checks at all against
+                * untrusted users on the local system connecting on TCP
+                * and injecting bogus routing data into the entire routing
+                * domain.
+                *
+                * The functionality is only left here because it may be
+                * useful during development, in order to be able to get
+                * tcpdump or wireshark watching ZAPI as TCP.  If you want
+                * to do that, flip the #if 1 above to #if 0. */
+               memset(sa, 0, sizeof(*sa));
+               return false;
+#endif
        } else {
                /* "sun" is a #define on solaris */
                struct sockaddr_un *suna = (struct sockaddr_un *)sa;