bgp_network.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549
  1. /* BGP network related fucntions
  2. Copyright (C) 1999 Kunihiro Ishiguro
  3. This file is part of GNU Zebra.
  4. GNU Zebra is free software; you can redistribute it and/or modify it
  5. under the terms of the GNU General Public License as published by the
  6. Free Software Foundation; either version 2, or (at your option) any
  7. later version.
  8. GNU Zebra is distributed in the hope that it will be useful, but
  9. WITHOUT ANY WARRANTY; without even the implied warranty of
  10. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. General Public License for more details.
  12. You should have received a copy of the GNU General Public License
  13. along with GNU Zebra; see the file COPYING. If not, write to the Free
  14. Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  15. 02111-1307, USA. */
  16. #include <zebra.h>
  17. #include "thread.h"
  18. #include "sockunion.h"
  19. #include "sockopt.h"
  20. #include "memory.h"
  21. #include "log.h"
  22. #include "if.h"
  23. #include "prefix.h"
  24. #include "command.h"
  25. #include "privs.h"
  26. #include "linklist.h"
  27. #include "network.h"
  28. #include "bgpd/bgpd.h"
  29. #include "bgpd/bgp_fsm.h"
  30. #include "bgpd/bgp_attr.h"
  31. #include "bgpd/bgp_debug.h"
  32. #include "bgpd/bgp_network.h"
  33. extern struct zebra_privs_t bgpd_privs;
  34. /* BGP listening socket. */
  35. struct bgp_listener
  36. {
  37. int fd;
  38. union sockunion su;
  39. struct thread *thread;
  40. };
  41. /*
  42. * Set MD5 key for the socket, for the given IPv4 peer address.
  43. * If the password is NULL or zero-length, the option will be disabled.
  44. */
  45. static int
  46. bgp_md5_set_socket (int socket, union sockunion *su, const char *password)
  47. {
  48. int ret = -1;
  49. int en = ENOSYS;
  50. assert (socket >= 0);
  51. #if HAVE_DECL_TCP_MD5SIG
  52. ret = sockopt_tcp_signature (socket, su, password);
  53. en = errno;
  54. #endif /* HAVE_TCP_MD5SIG */
  55. if (ret < 0)
  56. zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s",
  57. socket, safe_strerror (en));
  58. return ret;
  59. }
  60. /* Helper for bgp_connect */
  61. static int
  62. bgp_md5_set_connect (int socket, union sockunion *su, const char *password)
  63. {
  64. int ret = -1;
  65. #if HAVE_DECL_TCP_MD5SIG
  66. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  67. {
  68. zlog_err ("%s: could not raise privs", __func__);
  69. return ret;
  70. }
  71. ret = bgp_md5_set_socket (socket, su, password);
  72. if (bgpd_privs.change (ZPRIVS_LOWER) )
  73. zlog_err ("%s: could not lower privs", __func__);
  74. #endif /* HAVE_TCP_MD5SIG */
  75. return ret;
  76. }
  77. int
  78. bgp_md5_set (struct peer *peer)
  79. {
  80. struct listnode *node;
  81. int ret = 0;
  82. struct bgp_listener *listener;
  83. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  84. {
  85. zlog_err ("%s: could not raise privs", __func__);
  86. return -1;
  87. }
  88. /* Just set the password on the listen socket(s). Outbound connections
  89. * are taken care of in bgp_connect() below.
  90. */
  91. for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
  92. if (listener->su.sa.sa_family == peer->su.sa.sa_family)
  93. {
  94. ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password);
  95. break;
  96. }
  97. if (bgpd_privs.change (ZPRIVS_LOWER) )
  98. zlog_err ("%s: could not lower privs", __func__);
  99. return ret;
  100. }
  101. /* Accept bgp connection. */
  102. static int
  103. bgp_accept (struct thread *thread)
  104. {
  105. int bgp_sock;
  106. int accept_sock;
  107. union sockunion su;
  108. struct bgp_listener *listener = THREAD_ARG(thread);
  109. struct peer *peer;
  110. struct peer *peer1;
  111. char buf[SU_ADDRSTRLEN];
  112. /* Register accept thread. */
  113. accept_sock = THREAD_FD (thread);
  114. if (accept_sock < 0)
  115. {
  116. zlog_err ("accept_sock is nevative value %d", accept_sock);
  117. return -1;
  118. }
  119. listener->thread = thread_add_read (master, bgp_accept, listener, accept_sock);
  120. /* Accept client connection. */
  121. bgp_sock = sockunion_accept (accept_sock, &su);
  122. if (bgp_sock < 0)
  123. {
  124. zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno));
  125. return -1;
  126. }
  127. set_nonblocking (bgp_sock);
  128. if (BGP_DEBUG (events, EVENTS))
  129. zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf));
  130. /* Check remote IP address */
  131. peer1 = peer_lookup (NULL, &su);
  132. if (! peer1 || peer1->status == Idle)
  133. {
  134. if (BGP_DEBUG (events, EVENTS))
  135. {
  136. if (! peer1)
  137. zlog_debug ("[Event] BGP connection IP address %s is not configured",
  138. inet_sutop (&su, buf));
  139. else
  140. zlog_debug ("[Event] BGP connection IP address %s is Idle state",
  141. inet_sutop (&su, buf));
  142. }
  143. close (bgp_sock);
  144. return -1;
  145. }
  146. /* In case of peer is EBGP, we should set TTL for this connection. */
  147. if (peer_sort (peer1) == BGP_PEER_EBGP) {
  148. sockopt_ttl (peer1->su.sa.sa_family, bgp_sock, peer1->ttl);
  149. if (peer1->gtsm_hops)
  150. sockopt_minttl (peer1->su.sa.sa_family, bgp_sock, MAXTTL + 1 - peer1->gtsm_hops);
  151. }
  152. /* Make dummy peer until read Open packet. */
  153. if (BGP_DEBUG (events, EVENTS))
  154. zlog_debug ("[Event] Make dummy peer structure until read Open packet");
  155. {
  156. char buf[SU_ADDRSTRLEN + 1];
  157. peer = peer_create_accept (peer1->bgp);
  158. SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER);
  159. peer->su = su;
  160. peer->fd = bgp_sock;
  161. peer->status = Active;
  162. peer->local_id = peer1->local_id;
  163. peer->v_holdtime = peer1->v_holdtime;
  164. peer->v_keepalive = peer1->v_keepalive;
  165. /* Make peer's address string. */
  166. sockunion2str (&su, buf, SU_ADDRSTRLEN);
  167. peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf);
  168. }
  169. BGP_EVENT_ADD (peer, TCP_connection_open);
  170. return 0;
  171. }
  172. /* BGP socket bind. */
  173. static int
  174. bgp_bind (struct peer *peer)
  175. {
  176. #ifdef SO_BINDTODEVICE
  177. int ret;
  178. struct ifreq ifreq;
  179. if (! peer->ifname)
  180. return 0;
  181. strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name));
  182. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  183. zlog_err ("bgp_bind: could not raise privs");
  184. ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE,
  185. &ifreq, sizeof (ifreq));
  186. if (bgpd_privs.change (ZPRIVS_LOWER) )
  187. zlog_err ("bgp_bind: could not lower privs");
  188. if (ret < 0)
  189. {
  190. zlog (peer->log, LOG_INFO, "bind to interface %s failed", peer->ifname);
  191. return ret;
  192. }
  193. #endif /* SO_BINDTODEVICE */
  194. return 0;
  195. }
  196. static int
  197. bgp_bind_address (int sock, struct in_addr *addr)
  198. {
  199. int ret;
  200. struct sockaddr_in local;
  201. memset (&local, 0, sizeof (struct sockaddr_in));
  202. local.sin_family = AF_INET;
  203. #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
  204. local.sin_len = sizeof(struct sockaddr_in);
  205. #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
  206. memcpy (&local.sin_addr, addr, sizeof (struct in_addr));
  207. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  208. zlog_err ("bgp_bind_address: could not raise privs");
  209. ret = bind (sock, (struct sockaddr *)&local, sizeof (struct sockaddr_in));
  210. if (ret < 0)
  211. ;
  212. if (bgpd_privs.change (ZPRIVS_LOWER) )
  213. zlog_err ("bgp_bind_address: could not lower privs");
  214. return 0;
  215. }
  216. static struct in_addr *
  217. bgp_update_address (struct interface *ifp)
  218. {
  219. struct prefix_ipv4 *p;
  220. struct connected *connected;
  221. struct listnode *node;
  222. for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected))
  223. {
  224. p = (struct prefix_ipv4 *) connected->address;
  225. if (p->family == AF_INET)
  226. return &p->prefix;
  227. }
  228. return NULL;
  229. }
  230. /* Update source selection. */
  231. static void
  232. bgp_update_source (struct peer *peer)
  233. {
  234. struct interface *ifp;
  235. struct in_addr *addr;
  236. /* Source is specified with interface name. */
  237. if (peer->update_if)
  238. {
  239. ifp = if_lookup_by_name (peer->update_if);
  240. if (! ifp)
  241. return;
  242. addr = bgp_update_address (ifp);
  243. if (! addr)
  244. return;
  245. bgp_bind_address (peer->fd, addr);
  246. }
  247. /* Source is specified with IP address. */
  248. if (peer->update_source)
  249. sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source);
  250. }
  251. /* BGP try to connect to the peer. */
  252. int
  253. bgp_connect (struct peer *peer)
  254. {
  255. unsigned int ifindex = 0;
  256. /* Make socket for the peer. */
  257. peer->fd = sockunion_socket (&peer->su);
  258. if (peer->fd < 0)
  259. return -1;
  260. /* If we can get socket for the peer, adjest TTL and make connection. */
  261. if (peer_sort (peer) == BGP_PEER_EBGP) {
  262. sockopt_ttl (peer->su.sa.sa_family, peer->fd, peer->ttl);
  263. if (peer->gtsm_hops)
  264. sockopt_minttl (peer->su.sa.sa_family, peer->fd, MAXTTL + 1 - peer->gtsm_hops);
  265. }
  266. sockopt_reuseaddr (peer->fd);
  267. sockopt_reuseport (peer->fd);
  268. #ifdef IPTOS_PREC_INTERNETCONTROL
  269. if (sockunion_family (&peer->su) == AF_INET)
  270. setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
  271. #endif
  272. if (peer->password)
  273. bgp_md5_set_connect (peer->fd, &peer->su, peer->password);
  274. /* Bind socket. */
  275. bgp_bind (peer);
  276. /* Update source bind. */
  277. bgp_update_source (peer);
  278. #ifdef HAVE_IPV6
  279. if (peer->ifname)
  280. ifindex = if_nametoindex (peer->ifname);
  281. #endif /* HAVE_IPV6 */
  282. if (BGP_DEBUG (events, EVENTS))
  283. plog_debug (peer->log, "%s [Event] Connect start to %s fd %d",
  284. peer->host, peer->host, peer->fd);
  285. /* Connect to the remote peer. */
  286. return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex);
  287. }
  288. /* After TCP connection is established. Get local address and port. */
  289. void
  290. bgp_getsockname (struct peer *peer)
  291. {
  292. if (peer->su_local)
  293. {
  294. sockunion_free (peer->su_local);
  295. peer->su_local = NULL;
  296. }
  297. if (peer->su_remote)
  298. {
  299. sockunion_free (peer->su_remote);
  300. peer->su_remote = NULL;
  301. }
  302. peer->su_local = sockunion_getsockname (peer->fd);
  303. peer->su_remote = sockunion_getpeername (peer->fd);
  304. bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer);
  305. }
  306. static int
  307. bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
  308. {
  309. struct bgp_listener *listener;
  310. int ret, en;
  311. sockopt_reuseaddr (sock);
  312. sockopt_reuseport (sock);
  313. #ifdef IPTOS_PREC_INTERNETCONTROL
  314. if (sa->sa_family == AF_INET)
  315. setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
  316. #endif
  317. #ifdef IPV6_V6ONLY
  318. /* Want only IPV6 on ipv6 socket (not mapped addresses) */
  319. if (sa->sa_family == AF_INET6) {
  320. int on = 1;
  321. setsockopt (sock, IPPROTO_IPV6, IPV6_V6ONLY,
  322. (void *) &on, sizeof (on));
  323. }
  324. #endif
  325. if (bgpd_privs.change (ZPRIVS_RAISE) )
  326. zlog_err ("bgp_socket: could not raise privs");
  327. ret = bind (sock, sa, salen);
  328. en = errno;
  329. if (bgpd_privs.change (ZPRIVS_LOWER) )
  330. zlog_err ("bgp_bind_address: could not lower privs");
  331. if (ret < 0)
  332. {
  333. zlog_err ("bind: %s", safe_strerror (en));
  334. return ret;
  335. }
  336. ret = listen (sock, 3);
  337. if (ret < 0)
  338. {
  339. zlog_err ("listen: %s", safe_strerror (errno));
  340. return ret;
  341. }
  342. listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener));
  343. listener->fd = sock;
  344. memcpy(&listener->su, sa, salen);
  345. listener->thread = thread_add_read (master, bgp_accept, listener, sock);
  346. listnode_add (bm->listen_sockets, listener);
  347. return 0;
  348. }
  349. /* IPv6 supported version of BGP server socket setup. */
  350. #if defined (HAVE_IPV6) && ! defined (NRL)
  351. int
  352. bgp_socket (unsigned short port, const char *address)
  353. {
  354. struct addrinfo *ainfo;
  355. struct addrinfo *ainfo_save;
  356. static const struct addrinfo req = {
  357. .ai_family = AF_UNSPEC,
  358. .ai_flags = AI_PASSIVE,
  359. .ai_socktype = SOCK_STREAM,
  360. };
  361. int ret, count;
  362. char port_str[BUFSIZ];
  363. snprintf (port_str, sizeof(port_str), "%d", port);
  364. port_str[sizeof (port_str) - 1] = '\0';
  365. ret = getaddrinfo (address, port_str, &req, &ainfo_save);
  366. if (ret != 0)
  367. {
  368. zlog_err ("getaddrinfo: %s", gai_strerror (ret));
  369. return -1;
  370. }
  371. count = 0;
  372. for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next)
  373. {
  374. int sock;
  375. if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
  376. continue;
  377. sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol);
  378. if (sock < 0)
  379. {
  380. zlog_err ("socket: %s", safe_strerror (errno));
  381. continue;
  382. }
  383. /* if we intend to implement ttl-security, this socket needs ttl=255 */
  384. sockopt_ttl (ainfo->ai_family, sock, MAXTTL);
  385. ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen);
  386. if (ret == 0)
  387. ++count;
  388. else
  389. close(sock);
  390. }
  391. freeaddrinfo (ainfo_save);
  392. if (count == 0)
  393. {
  394. zlog_err ("%s: no usable addresses", __func__);
  395. return -1;
  396. }
  397. return 0;
  398. }
  399. #else
  400. /* Traditional IPv4 only version. */
  401. int
  402. bgp_socket (unsigned short port, const char *address)
  403. {
  404. int sock;
  405. int socklen;
  406. struct sockaddr_in sin;
  407. int ret, en;
  408. sock = socket (AF_INET, SOCK_STREAM, 0);
  409. if (sock < 0)
  410. {
  411. zlog_err ("socket: %s", safe_strerror (errno));
  412. return sock;
  413. }
  414. /* if we intend to implement ttl-security, this socket needs ttl=255 */
  415. sockopt_ttl (AF_INET, sock, MAXTTL);
  416. memset (&sin, 0, sizeof (struct sockaddr_in));
  417. sin.sin_family = AF_INET;
  418. sin.sin_port = htons (port);
  419. socklen = sizeof (struct sockaddr_in);
  420. if (address && ((ret = inet_aton(address, &sin.sin_addr)) < 1))
  421. {
  422. zlog_err("bgp_socket: could not parse ip address %s: %s",
  423. address, safe_strerror (errno));
  424. return ret;
  425. }
  426. #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
  427. sin.sin_len = socklen;
  428. #endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */
  429. ret = bgp_listener (sock, (struct sockaddr *) &sin, socklen);
  430. if (ret < 0)
  431. {
  432. close (sock);
  433. return ret;
  434. }
  435. return sock;
  436. }
  437. #endif /* HAVE_IPV6 && !NRL */
  438. void
  439. bgp_close (void)
  440. {
  441. struct listnode *node, *next;
  442. struct bgp_listener *listener;
  443. for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener))
  444. {
  445. thread_cancel (listener->thread);
  446. close (listener->fd);
  447. listnode_delete (bm->listen_sockets, listener);
  448. XFREE (MTYPE_BGP_LISTENER, listener);
  449. }
  450. }