bgp_network.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567
  1. /* BGP network related fucntions
  2. Copyright (C) 1999 Kunihiro Ishiguro
  3. This file is part of GNU Zebra.
  4. GNU Zebra is free software; you can redistribute it and/or modify it
  5. under the terms of the GNU General Public License as published by the
  6. Free Software Foundation; either version 2, or (at your option) any
  7. later version.
  8. GNU Zebra is distributed in the hope that it will be useful, but
  9. WITHOUT ANY WARRANTY; without even the implied warranty of
  10. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. General Public License for more details.
  12. You should have received a copy of the GNU General Public License
  13. along with GNU Zebra; see the file COPYING. If not, write to the Free
  14. Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  15. 02111-1307, USA. */
  16. #include <zebra.h>
  17. #include "thread.h"
  18. #include "sockunion.h"
  19. #include "sockopt.h"
  20. #include "memory.h"
  21. #include "log.h"
  22. #include "if.h"
  23. #include "prefix.h"
  24. #include "command.h"
  25. #include "privs.h"
  26. #include "linklist.h"
  27. #include "network.h"
  28. #include "filter.h"
  29. #include "bgpd/bgpd.h"
  30. #include "bgpd/bgp_fsm.h"
  31. #include "bgpd/bgp_attr.h"
  32. #include "bgpd/bgp_debug.h"
  33. #include "bgpd/bgp_network.h"
  34. extern struct zebra_privs_t bgpd_privs;
  35. /* BGP listening socket. */
  36. struct bgp_listener
  37. {
  38. int fd;
  39. union sockunion su;
  40. struct thread *thread;
  41. };
  42. /*
  43. * Set MD5 key for the socket, for the given IPv4 peer address.
  44. * If the password is NULL or zero-length, the option will be disabled.
  45. */
  46. static int
  47. bgp_md5_set_socket (int socket, union sockunion *su, const char *password)
  48. {
  49. int ret = -1;
  50. int en = ENOSYS;
  51. assert (socket >= 0);
  52. #if HAVE_DECL_TCP_MD5SIG
  53. ret = sockopt_tcp_signature (socket, su, password);
  54. en = errno;
  55. #endif /* HAVE_TCP_MD5SIG */
  56. if (ret < 0)
  57. zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s",
  58. socket, safe_strerror (en));
  59. return ret;
  60. }
  61. /* Helper for bgp_connect */
  62. static int
  63. bgp_md5_set_connect (int socket, union sockunion *su, const char *password)
  64. {
  65. int ret = -1;
  66. #if HAVE_DECL_TCP_MD5SIG
  67. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  68. {
  69. zlog_err ("%s: could not raise privs", __func__);
  70. return ret;
  71. }
  72. ret = bgp_md5_set_socket (socket, su, password);
  73. if (bgpd_privs.change (ZPRIVS_LOWER) )
  74. zlog_err ("%s: could not lower privs", __func__);
  75. #endif /* HAVE_TCP_MD5SIG */
  76. return ret;
  77. }
  78. int
  79. bgp_md5_set (struct peer *peer)
  80. {
  81. struct listnode *node;
  82. int ret = 0;
  83. struct bgp_listener *listener;
  84. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  85. {
  86. zlog_err ("%s: could not raise privs", __func__);
  87. return -1;
  88. }
  89. /* Just set the password on the listen socket(s). Outbound connections
  90. * are taken care of in bgp_connect() below.
  91. */
  92. for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
  93. if (listener->su.sa.sa_family == peer->su.sa.sa_family)
  94. {
  95. ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password);
  96. break;
  97. }
  98. if (bgpd_privs.change (ZPRIVS_LOWER) )
  99. zlog_err ("%s: could not lower privs", __func__);
  100. return ret;
  101. }
  102. /* Update BGP socket send buffer size */
  103. static void
  104. bgp_update_sock_send_buffer_size (int fd)
  105. {
  106. int size = BGP_SOCKET_SNDBUF_SIZE;
  107. int optval;
  108. socklen_t optlen = sizeof(optval);
  109. if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &optval, &optlen) < 0)
  110. {
  111. zlog_err("getsockopt of SO_SNDBUF failed %s\n", safe_strerror(errno));
  112. return;
  113. }
  114. if (optval < size)
  115. {
  116. if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0)
  117. {
  118. zlog_err("Couldn't increase send buffer: %s\n", safe_strerror(errno));
  119. }
  120. }
  121. }
  122. void
  123. bgp_set_socket_ttl (struct peer *peer, int bgp_sock)
  124. {
  125. char buf[INET_ADDRSTRLEN];
  126. int ret, ttl, minttl;
  127. if (bgp_sock < 0)
  128. return;
  129. if (peer->gtsm_hops)
  130. {
  131. ttl = 255;
  132. minttl = 256 - peer->gtsm_hops;
  133. }
  134. else
  135. {
  136. ttl = peer_ttl (peer);
  137. minttl = 0;
  138. }
  139. ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, ttl);
  140. if (ret)
  141. zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
  142. __func__,
  143. inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
  144. errno);
  145. ret = sockopt_minttl (peer->su.sa.sa_family, bgp_sock, minttl);
  146. if (ret && (errno != ENOTSUP || minttl))
  147. zlog_err ("%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d",
  148. __func__,
  149. inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
  150. errno);
  151. }
  152. /* Accept bgp connection. */
  153. static int
  154. bgp_accept (struct thread *thread)
  155. {
  156. int bgp_sock;
  157. int accept_sock;
  158. union sockunion su;
  159. struct bgp_listener *listener = THREAD_ARG(thread);
  160. struct peer *peer;
  161. struct peer *peer1;
  162. char buf[SU_ADDRSTRLEN];
  163. /* Register accept thread. */
  164. accept_sock = THREAD_FD (thread);
  165. if (accept_sock < 0)
  166. {
  167. zlog_err ("accept_sock is nevative value %d", accept_sock);
  168. return -1;
  169. }
  170. listener->thread = thread_add_read (bm->master, bgp_accept, listener, accept_sock);
  171. /* Accept client connection. */
  172. bgp_sock = sockunion_accept (accept_sock, &su);
  173. if (bgp_sock < 0)
  174. {
  175. zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno));
  176. return -1;
  177. }
  178. set_nonblocking (bgp_sock);
  179. /* Set socket send buffer size */
  180. bgp_update_sock_send_buffer_size(bgp_sock);
  181. if (BGP_DEBUG (events, EVENTS))
  182. zlog_debug ("[Event] BGP connection from host %s:%d",
  183. inet_sutop (&su, buf), sockunion_get_port (&su));
  184. /* Check remote IP address */
  185. peer1 = peer_lookup (NULL, &su);
  186. /* We could perhaps just drop new connections from already Established
  187. * peers here.
  188. */
  189. if (! peer1 || peer1->status == Idle || peer1->status > Established)
  190. {
  191. if (BGP_DEBUG (events, EVENTS))
  192. {
  193. if (! peer1)
  194. zlog_debug ("[Event] BGP connection IP address %s is not configured",
  195. inet_sutop (&su, buf));
  196. else
  197. zlog_debug ("[Event] BGP connection IP address %s is %s state",
  198. inet_sutop (&su, buf),
  199. LOOKUP (bgp_status_msg, peer1->status));
  200. }
  201. close (bgp_sock);
  202. return -1;
  203. }
  204. bgp_set_socket_ttl (peer1, bgp_sock);
  205. /* Make dummy peer until read Open packet. */
  206. if (BGP_DEBUG (events, EVENTS))
  207. zlog_debug ("[Event] Make dummy peer structure until read Open packet");
  208. {
  209. char buf[SU_ADDRSTRLEN];
  210. peer = peer_create_accept (peer1->bgp);
  211. peer->su = su;
  212. peer->fd = bgp_sock;
  213. peer->status = Active;
  214. /* Config state that should affect OPEN packet must be copied over */
  215. peer->local_id = peer1->local_id;
  216. peer->v_holdtime = peer1->v_holdtime;
  217. peer->v_keepalive = peer1->v_keepalive;
  218. peer->local_as = peer1->local_as;
  219. peer->change_local_as = peer1->change_local_as;
  220. peer->flags = peer1->flags;
  221. peer->sflags = peer1->sflags;
  222. #define PEER_ARRAY_COPY(D,S,A) \
  223. memcpy ((D)->A, (S)->A, sizeof (((D)->A)[0][0])*AFI_MAX*SAFI_MAX);
  224. PEER_ARRAY_COPY(peer, peer1, afc);
  225. PEER_ARRAY_COPY(peer, peer1, af_flags);
  226. #undef PEER_ARRAY_COPY
  227. /* Make peer's address string. */
  228. sockunion2str (&su, buf, SU_ADDRSTRLEN);
  229. peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf);
  230. SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER);
  231. }
  232. BGP_EVENT_ADD (peer, TCP_connection_open);
  233. return 0;
  234. }
  235. /* BGP socket bind. */
  236. static int
  237. bgp_bind (struct peer *peer)
  238. {
  239. #ifdef SO_BINDTODEVICE
  240. int ret;
  241. struct ifreq ifreq;
  242. int myerrno;
  243. if (! peer->ifname)
  244. return 0;
  245. strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name));
  246. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  247. zlog_err ("bgp_bind: could not raise privs");
  248. ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE,
  249. &ifreq, sizeof (ifreq));
  250. myerrno = errno;
  251. if (bgpd_privs.change (ZPRIVS_LOWER) )
  252. zlog_err ("bgp_bind: could not lower privs");
  253. if (ret < 0)
  254. {
  255. zlog (peer->log, LOG_INFO, "bind to interface %s failed, errno=%d",
  256. peer->ifname, myerrno);
  257. return ret;
  258. }
  259. #endif /* SO_BINDTODEVICE */
  260. return 0;
  261. }
  262. static int
  263. bgp_update_address (struct interface *ifp, const union sockunion *dst,
  264. union sockunion *addr)
  265. {
  266. struct prefix *p, *sel, d;
  267. struct connected *connected;
  268. struct listnode *node;
  269. int common;
  270. sockunion2hostprefix (dst, &d);
  271. sel = NULL;
  272. common = -1;
  273. for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected))
  274. {
  275. p = connected->address;
  276. if (p->family != d.family)
  277. continue;
  278. if (prefix_common_bits (p, &d) > common)
  279. {
  280. sel = p;
  281. common = prefix_common_bits (sel, &d);
  282. }
  283. }
  284. if (!sel)
  285. return 1;
  286. prefix2sockunion (sel, addr);
  287. return 0;
  288. }
  289. /* Update source selection. */
  290. static void
  291. bgp_update_source (struct peer *peer)
  292. {
  293. struct interface *ifp;
  294. union sockunion addr;
  295. /* Source is specified with interface name. */
  296. if (peer->update_if)
  297. {
  298. ifp = if_lookup_by_name (peer->update_if);
  299. if (! ifp)
  300. return;
  301. if (bgp_update_address (ifp, &peer->su, &addr))
  302. return;
  303. sockunion_bind (peer->fd, &addr, 0, &addr);
  304. }
  305. /* Source is specified with IP address. */
  306. if (peer->update_source)
  307. sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source);
  308. }
  309. /* BGP try to connect to the peer. */
  310. int
  311. bgp_connect (struct peer *peer)
  312. {
  313. ifindex_t ifindex = 0;
  314. /* Make socket for the peer. */
  315. peer->fd = sockunion_socket (&peer->su);
  316. if (peer->fd < 0)
  317. return -1;
  318. set_nonblocking (peer->fd);
  319. /* Set socket send buffer size */
  320. bgp_update_sock_send_buffer_size(peer->fd);
  321. bgp_set_socket_ttl (peer, peer->fd);
  322. sockopt_reuseaddr (peer->fd);
  323. sockopt_reuseport (peer->fd);
  324. #ifdef IPTOS_PREC_INTERNETCONTROL
  325. if (bgpd_privs.change (ZPRIVS_RAISE))
  326. zlog_err ("%s: could not raise privs", __func__);
  327. if (sockunion_family (&peer->su) == AF_INET)
  328. setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
  329. else if (sockunion_family (&peer->su) == AF_INET6)
  330. setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL);
  331. if (bgpd_privs.change (ZPRIVS_LOWER))
  332. zlog_err ("%s: could not lower privs", __func__);
  333. #endif
  334. if (peer->password)
  335. bgp_md5_set_connect (peer->fd, &peer->su, peer->password);
  336. /* Bind socket. */
  337. bgp_bind (peer);
  338. /* Update source bind. */
  339. bgp_update_source (peer);
  340. if (peer->ifname)
  341. ifindex = ifname2ifindex (peer->ifname);
  342. if (BGP_DEBUG (events, EVENTS))
  343. plog_debug (peer->log, "%s [Event] Connect start to %s fd %d",
  344. peer->host, peer->host, peer->fd);
  345. /* Connect to the remote peer. */
  346. return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex);
  347. }
  348. /* After TCP connection is established. Get local address and port. */
  349. void
  350. bgp_getsockname (struct peer *peer)
  351. {
  352. if (peer->su_local)
  353. {
  354. sockunion_free (peer->su_local);
  355. peer->su_local = NULL;
  356. }
  357. if (peer->su_remote)
  358. {
  359. sockunion_free (peer->su_remote);
  360. peer->su_remote = NULL;
  361. }
  362. peer->su_local = sockunion_getsockname (peer->fd);
  363. peer->su_remote = sockunion_getpeername (peer->fd);
  364. bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer);
  365. }
  366. static int
  367. bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
  368. {
  369. struct bgp_listener *listener;
  370. int ret, en;
  371. sockopt_reuseaddr (sock);
  372. sockopt_reuseport (sock);
  373. if (bgpd_privs.change (ZPRIVS_RAISE))
  374. zlog_err ("%s: could not raise privs", __func__);
  375. #ifdef IPTOS_PREC_INTERNETCONTROL
  376. if (sa->sa_family == AF_INET)
  377. setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
  378. else if (sa->sa_family == AF_INET6)
  379. setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL);
  380. #endif
  381. sockopt_v6only (sa->sa_family, sock);
  382. ret = bind (sock, sa, salen);
  383. en = errno;
  384. if (bgpd_privs.change (ZPRIVS_LOWER))
  385. zlog_err ("%s: could not lower privs", __func__);
  386. if (ret < 0)
  387. {
  388. zlog_err ("bind: %s", safe_strerror (en));
  389. return ret;
  390. }
  391. ret = listen (sock, 3);
  392. if (ret < 0)
  393. {
  394. zlog_err ("listen: %s", safe_strerror (errno));
  395. return ret;
  396. }
  397. listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener));
  398. listener->fd = sock;
  399. memcpy(&listener->su, sa, salen);
  400. listener->thread = thread_add_read (bm->master, bgp_accept, listener, sock);
  401. listnode_add (bm->listen_sockets, listener);
  402. return 0;
  403. }
  404. /* IPv6 supported version of BGP server socket setup. */
  405. int
  406. bgp_socket (unsigned short port, const char *address)
  407. {
  408. struct addrinfo *ainfo;
  409. struct addrinfo *ainfo_save;
  410. static const struct addrinfo req = {
  411. .ai_family = AF_UNSPEC,
  412. .ai_flags = AI_PASSIVE,
  413. .ai_socktype = SOCK_STREAM,
  414. };
  415. int ret, count;
  416. char port_str[BUFSIZ];
  417. snprintf (port_str, sizeof(port_str), "%d", port);
  418. port_str[sizeof (port_str) - 1] = '\0';
  419. ret = getaddrinfo (address, port_str, &req, &ainfo_save);
  420. if (ret != 0)
  421. {
  422. zlog_err ("getaddrinfo: %s", gai_strerror (ret));
  423. return -1;
  424. }
  425. count = 0;
  426. for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next)
  427. {
  428. int sock;
  429. if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
  430. continue;
  431. sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol);
  432. if (sock < 0)
  433. {
  434. zlog_err ("socket: %s", safe_strerror (errno));
  435. continue;
  436. }
  437. /* if we intend to implement ttl-security, this socket needs ttl=255 */
  438. sockopt_ttl (ainfo->ai_family, sock, MAXTTL);
  439. ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen);
  440. if (ret == 0)
  441. ++count;
  442. else
  443. close(sock);
  444. }
  445. freeaddrinfo (ainfo_save);
  446. if (count == 0)
  447. {
  448. zlog_err ("%s: no usable addresses", __func__);
  449. return -1;
  450. }
  451. return 0;
  452. }
  453. void
  454. bgp_close (void)
  455. {
  456. struct listnode *node, *next;
  457. struct bgp_listener *listener;
  458. for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener))
  459. {
  460. thread_cancel (listener->thread);
  461. close (listener->fd);
  462. listnode_delete (bm->listen_sockets, listener);
  463. XFREE (MTYPE_BGP_LISTENER, listener);
  464. }
  465. }