bgp_network.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558
  1. /* BGP network related fucntions
  2. Copyright (C) 1999 Kunihiro Ishiguro
  3. This file is part of GNU Zebra.
  4. GNU Zebra is free software; you can redistribute it and/or modify it
  5. under the terms of the GNU General Public License as published by the
  6. Free Software Foundation; either version 2, or (at your option) any
  7. later version.
  8. GNU Zebra is distributed in the hope that it will be useful, but
  9. WITHOUT ANY WARRANTY; without even the implied warranty of
  10. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. General Public License for more details.
  12. You should have received a copy of the GNU General Public License
  13. along with GNU Zebra; see the file COPYING. If not, write to the Free
  14. Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  15. 02111-1307, USA. */
  16. #include <zebra.h>
  17. #include "thread.h"
  18. #include "sockunion.h"
  19. #include "sockopt.h"
  20. #include "memory.h"
  21. #include "log.h"
  22. #include "if.h"
  23. #include "prefix.h"
  24. #include "command.h"
  25. #include "privs.h"
  26. #include "linklist.h"
  27. #include "network.h"
  28. #include "filter.h"
  29. #include "bgpd/bgpd.h"
  30. #include "bgpd/bgp_fsm.h"
  31. #include "bgpd/bgp_attr.h"
  32. #include "bgpd/bgp_debug.h"
  33. #include "bgpd/bgp_network.h"
  34. extern struct zebra_privs_t bgpd_privs;
  35. /* BGP listening socket. */
  36. struct bgp_listener
  37. {
  38. int fd;
  39. union sockunion su;
  40. struct thread *thread;
  41. };
  42. /*
  43. * Set MD5 key for the socket, for the given IPv4 peer address.
  44. * If the password is NULL or zero-length, the option will be disabled.
  45. */
  46. static int
  47. bgp_md5_set_socket (int socket, union sockunion *su, const char *password)
  48. {
  49. int ret = -1;
  50. int en = ENOSYS;
  51. assert (socket >= 0);
  52. #if HAVE_DECL_TCP_MD5SIG
  53. ret = sockopt_tcp_signature (socket, su, password);
  54. en = errno;
  55. #endif /* HAVE_TCP_MD5SIG */
  56. if (ret < 0)
  57. zlog (NULL, LOG_WARNING, "can't set TCP_MD5SIG option on socket %d: %s",
  58. socket, safe_strerror (en));
  59. return ret;
  60. }
  61. /* Helper for bgp_connect */
  62. static int
  63. bgp_md5_set_connect (int socket, union sockunion *su, const char *password)
  64. {
  65. int ret = -1;
  66. #if HAVE_DECL_TCP_MD5SIG
  67. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  68. {
  69. zlog_err ("%s: could not raise privs", __func__);
  70. return ret;
  71. }
  72. ret = bgp_md5_set_socket (socket, su, password);
  73. if (bgpd_privs.change (ZPRIVS_LOWER) )
  74. zlog_err ("%s: could not lower privs", __func__);
  75. #endif /* HAVE_TCP_MD5SIG */
  76. return ret;
  77. }
  78. int
  79. bgp_md5_set (struct peer *peer)
  80. {
  81. struct listnode *node;
  82. int ret = 0;
  83. struct bgp_listener *listener;
  84. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  85. {
  86. zlog_err ("%s: could not raise privs", __func__);
  87. return -1;
  88. }
  89. /* Just set the password on the listen socket(s). Outbound connections
  90. * are taken care of in bgp_connect() below.
  91. */
  92. for (ALL_LIST_ELEMENTS_RO(bm->listen_sockets, node, listener))
  93. if (listener->su.sa.sa_family == peer->su.sa.sa_family)
  94. {
  95. ret = bgp_md5_set_socket (listener->fd, &peer->su, peer->password);
  96. break;
  97. }
  98. if (bgpd_privs.change (ZPRIVS_LOWER) )
  99. zlog_err ("%s: could not lower privs", __func__);
  100. return ret;
  101. }
  102. /* Update BGP socket send buffer size */
  103. static void
  104. bgp_update_sock_send_buffer_size (int fd)
  105. {
  106. int size = BGP_SOCKET_SNDBUF_SIZE;
  107. int optval;
  108. socklen_t optlen = sizeof(optval);
  109. if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &optval, &optlen) < 0)
  110. {
  111. zlog_err("getsockopt of SO_SNDBUF failed %s\n", safe_strerror(errno));
  112. return;
  113. }
  114. if (optval < size)
  115. {
  116. if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0)
  117. {
  118. zlog_err("Couldn't increase send buffer: %s\n", safe_strerror(errno));
  119. }
  120. }
  121. }
  122. static void
  123. bgp_set_socket_ttl (struct peer *peer, int bgp_sock)
  124. {
  125. char buf[INET_ADDRSTRLEN];
  126. int ret;
  127. /* In case of peer is EBGP, we should set TTL for this connection. */
  128. if (!peer->gtsm_hops && (peer_sort (peer) == BGP_PEER_EBGP))
  129. {
  130. ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, peer->ttl);
  131. if (ret)
  132. {
  133. zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
  134. __func__,
  135. inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
  136. errno);
  137. }
  138. }
  139. else if (peer->gtsm_hops)
  140. {
  141. /* On Linux, setting minttl without setting ttl seems to mess with the
  142. outgoing ttl. Therefore setting both.
  143. */
  144. ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, MAXTTL);
  145. if (ret)
  146. {
  147. zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d",
  148. __func__,
  149. inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
  150. errno);
  151. }
  152. ret = sockopt_minttl (peer->su.sa.sa_family, bgp_sock,
  153. MAXTTL + 1 - peer->gtsm_hops);
  154. if (ret)
  155. {
  156. zlog_err ("%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d",
  157. __func__,
  158. inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)),
  159. errno);
  160. }
  161. }
  162. }
  163. /* Accept bgp connection. */
  164. static int
  165. bgp_accept (struct thread *thread)
  166. {
  167. int bgp_sock;
  168. int accept_sock;
  169. union sockunion su;
  170. struct bgp_listener *listener = THREAD_ARG(thread);
  171. struct peer *peer;
  172. struct peer *peer1;
  173. char buf[SU_ADDRSTRLEN];
  174. /* Register accept thread. */
  175. accept_sock = THREAD_FD (thread);
  176. if (accept_sock < 0)
  177. {
  178. zlog_err ("accept_sock is nevative value %d", accept_sock);
  179. return -1;
  180. }
  181. listener->thread = thread_add_read (bm->master, bgp_accept, listener, accept_sock);
  182. /* Accept client connection. */
  183. bgp_sock = sockunion_accept (accept_sock, &su);
  184. if (bgp_sock < 0)
  185. {
  186. zlog_err ("[Error] BGP socket accept failed (%s)", safe_strerror (errno));
  187. return -1;
  188. }
  189. set_nonblocking (bgp_sock);
  190. /* Set socket send buffer size */
  191. bgp_update_sock_send_buffer_size(bgp_sock);
  192. if (BGP_DEBUG (events, EVENTS))
  193. zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf));
  194. /* Check remote IP address */
  195. peer1 = peer_lookup (NULL, &su);
  196. if (! peer1 || peer1->status == Idle)
  197. {
  198. if (BGP_DEBUG (events, EVENTS))
  199. {
  200. if (! peer1)
  201. zlog_debug ("[Event] BGP connection IP address %s is not configured",
  202. inet_sutop (&su, buf));
  203. else
  204. zlog_debug ("[Event] BGP connection IP address %s is Idle state",
  205. inet_sutop (&su, buf));
  206. }
  207. close (bgp_sock);
  208. return -1;
  209. }
  210. bgp_set_socket_ttl (peer1, bgp_sock);
  211. /* Make dummy peer until read Open packet. */
  212. if (BGP_DEBUG (events, EVENTS))
  213. zlog_debug ("[Event] Make dummy peer structure until read Open packet");
  214. {
  215. char buf[SU_ADDRSTRLEN];
  216. peer = peer_create_accept (peer1->bgp);
  217. SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER);
  218. peer->su = su;
  219. peer->fd = bgp_sock;
  220. peer->status = Active;
  221. peer->local_id = peer1->local_id;
  222. peer->v_holdtime = peer1->v_holdtime;
  223. peer->v_keepalive = peer1->v_keepalive;
  224. /* Make peer's address string. */
  225. sockunion2str (&su, buf, SU_ADDRSTRLEN);
  226. peer->host = XSTRDUP (MTYPE_BGP_PEER_HOST, buf);
  227. }
  228. BGP_EVENT_ADD (peer, TCP_connection_open);
  229. return 0;
  230. }
  231. /* BGP socket bind. */
  232. static int
  233. bgp_bind (struct peer *peer)
  234. {
  235. #ifdef SO_BINDTODEVICE
  236. int ret;
  237. struct ifreq ifreq;
  238. int myerrno;
  239. if (! peer->ifname)
  240. return 0;
  241. strncpy ((char *)&ifreq.ifr_name, peer->ifname, sizeof (ifreq.ifr_name));
  242. if ( bgpd_privs.change (ZPRIVS_RAISE) )
  243. zlog_err ("bgp_bind: could not raise privs");
  244. ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE,
  245. &ifreq, sizeof (ifreq));
  246. myerrno = errno;
  247. if (bgpd_privs.change (ZPRIVS_LOWER) )
  248. zlog_err ("bgp_bind: could not lower privs");
  249. if (ret < 0)
  250. {
  251. zlog (peer->log, LOG_INFO, "bind to interface %s failed, errno=%d",
  252. peer->ifname, myerrno);
  253. return ret;
  254. }
  255. #endif /* SO_BINDTODEVICE */
  256. return 0;
  257. }
  258. static int
  259. bgp_update_address (struct interface *ifp, const union sockunion *dst,
  260. union sockunion *addr)
  261. {
  262. struct prefix *p, *sel, d;
  263. struct connected *connected;
  264. struct listnode *node;
  265. int common;
  266. sockunion2hostprefix (dst, &d);
  267. sel = NULL;
  268. common = -1;
  269. for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected))
  270. {
  271. p = connected->address;
  272. if (p->family != d.family)
  273. continue;
  274. if (prefix_common_bits (p, &d) > common)
  275. {
  276. sel = p;
  277. common = prefix_common_bits (sel, &d);
  278. }
  279. }
  280. if (!sel)
  281. return 1;
  282. prefix2sockunion (sel, addr);
  283. return 0;
  284. }
  285. /* Update source selection. */
  286. static void
  287. bgp_update_source (struct peer *peer)
  288. {
  289. struct interface *ifp;
  290. union sockunion addr;
  291. /* Source is specified with interface name. */
  292. if (peer->update_if)
  293. {
  294. ifp = if_lookup_by_name (peer->update_if);
  295. if (! ifp)
  296. return;
  297. if (bgp_update_address (ifp, &peer->su, &addr))
  298. return;
  299. sockunion_bind (peer->fd, &addr, 0, &addr);
  300. }
  301. /* Source is specified with IP address. */
  302. if (peer->update_source)
  303. sockunion_bind (peer->fd, peer->update_source, 0, peer->update_source);
  304. }
  305. /* BGP try to connect to the peer. */
  306. int
  307. bgp_connect (struct peer *peer)
  308. {
  309. ifindex_t ifindex = 0;
  310. /* Make socket for the peer. */
  311. peer->fd = sockunion_socket (&peer->su);
  312. if (peer->fd < 0)
  313. return -1;
  314. set_nonblocking (peer->fd);
  315. /* Set socket send buffer size */
  316. bgp_update_sock_send_buffer_size(peer->fd);
  317. bgp_set_socket_ttl (peer, peer->fd);
  318. sockopt_reuseaddr (peer->fd);
  319. sockopt_reuseport (peer->fd);
  320. #ifdef IPTOS_PREC_INTERNETCONTROL
  321. if (bgpd_privs.change (ZPRIVS_RAISE))
  322. zlog_err ("%s: could not raise privs", __func__);
  323. if (sockunion_family (&peer->su) == AF_INET)
  324. setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
  325. else if (sockunion_family (&peer->su) == AF_INET6)
  326. setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL);
  327. if (bgpd_privs.change (ZPRIVS_LOWER))
  328. zlog_err ("%s: could not lower privs", __func__);
  329. #endif
  330. if (peer->password)
  331. bgp_md5_set_connect (peer->fd, &peer->su, peer->password);
  332. /* Bind socket. */
  333. bgp_bind (peer);
  334. /* Update source bind. */
  335. bgp_update_source (peer);
  336. if (peer->ifname)
  337. ifindex = ifname2ifindex (peer->ifname);
  338. if (BGP_DEBUG (events, EVENTS))
  339. plog_debug (peer->log, "%s [Event] Connect start to %s fd %d",
  340. peer->host, peer->host, peer->fd);
  341. /* Connect to the remote peer. */
  342. return sockunion_connect (peer->fd, &peer->su, htons (peer->port), ifindex);
  343. }
  344. /* After TCP connection is established. Get local address and port. */
  345. void
  346. bgp_getsockname (struct peer *peer)
  347. {
  348. if (peer->su_local)
  349. {
  350. sockunion_free (peer->su_local);
  351. peer->su_local = NULL;
  352. }
  353. if (peer->su_remote)
  354. {
  355. sockunion_free (peer->su_remote);
  356. peer->su_remote = NULL;
  357. }
  358. peer->su_local = sockunion_getsockname (peer->fd);
  359. peer->su_remote = sockunion_getpeername (peer->fd);
  360. bgp_nexthop_set (peer->su_local, peer->su_remote, &peer->nexthop, peer);
  361. }
  362. static int
  363. bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
  364. {
  365. struct bgp_listener *listener;
  366. int ret, en;
  367. sockopt_reuseaddr (sock);
  368. sockopt_reuseport (sock);
  369. if (bgpd_privs.change (ZPRIVS_RAISE))
  370. zlog_err ("%s: could not raise privs", __func__);
  371. #ifdef IPTOS_PREC_INTERNETCONTROL
  372. if (sa->sa_family == AF_INET)
  373. setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
  374. else if (sa->sa_family == AF_INET6)
  375. setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL);
  376. #endif
  377. sockopt_v6only (sa->sa_family, sock);
  378. ret = bind (sock, sa, salen);
  379. en = errno;
  380. if (bgpd_privs.change (ZPRIVS_LOWER))
  381. zlog_err ("%s: could not lower privs", __func__);
  382. if (ret < 0)
  383. {
  384. zlog_err ("bind: %s", safe_strerror (en));
  385. return ret;
  386. }
  387. ret = listen (sock, 3);
  388. if (ret < 0)
  389. {
  390. zlog_err ("listen: %s", safe_strerror (errno));
  391. return ret;
  392. }
  393. listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener));
  394. listener->fd = sock;
  395. memcpy(&listener->su, sa, salen);
  396. listener->thread = thread_add_read (bm->master, bgp_accept, listener, sock);
  397. listnode_add (bm->listen_sockets, listener);
  398. return 0;
  399. }
  400. /* IPv6 supported version of BGP server socket setup. */
  401. int
  402. bgp_socket (unsigned short port, const char *address)
  403. {
  404. struct addrinfo *ainfo;
  405. struct addrinfo *ainfo_save;
  406. static const struct addrinfo req = {
  407. .ai_family = AF_UNSPEC,
  408. .ai_flags = AI_PASSIVE,
  409. .ai_socktype = SOCK_STREAM,
  410. };
  411. int ret, count;
  412. char port_str[BUFSIZ];
  413. snprintf (port_str, sizeof(port_str), "%d", port);
  414. port_str[sizeof (port_str) - 1] = '\0';
  415. ret = getaddrinfo (address, port_str, &req, &ainfo_save);
  416. if (ret != 0)
  417. {
  418. zlog_err ("getaddrinfo: %s", gai_strerror (ret));
  419. return -1;
  420. }
  421. count = 0;
  422. for (ainfo = ainfo_save; ainfo; ainfo = ainfo->ai_next)
  423. {
  424. int sock;
  425. if (ainfo->ai_family != AF_INET && ainfo->ai_family != AF_INET6)
  426. continue;
  427. sock = socket (ainfo->ai_family, ainfo->ai_socktype, ainfo->ai_protocol);
  428. if (sock < 0)
  429. {
  430. zlog_err ("socket: %s", safe_strerror (errno));
  431. continue;
  432. }
  433. /* if we intend to implement ttl-security, this socket needs ttl=255 */
  434. sockopt_ttl (ainfo->ai_family, sock, MAXTTL);
  435. ret = bgp_listener (sock, ainfo->ai_addr, ainfo->ai_addrlen);
  436. if (ret == 0)
  437. ++count;
  438. else
  439. close(sock);
  440. }
  441. freeaddrinfo (ainfo_save);
  442. if (count == 0)
  443. {
  444. zlog_err ("%s: no usable addresses", __func__);
  445. return -1;
  446. }
  447. return 0;
  448. }
  449. void
  450. bgp_close (void)
  451. {
  452. struct listnode *node, *next;
  453. struct bgp_listener *listener;
  454. for (ALL_LIST_ELEMENTS (bm->listen_sockets, node, next, listener))
  455. {
  456. thread_cancel (listener->thread);
  457. close (listener->fd);
  458. listnode_delete (bm->listen_sockets, listener);
  459. XFREE (MTYPE_BGP_LISTENER, listener);
  460. }
  461. }