--- embedaddon/quagga/bgpd/bgp_network.c 2012/02/21 17:26:12 1.1.1.1 +++ embedaddon/quagga/bgpd/bgp_network.c 2016/11/02 10:09:10 1.1.1.4 @@ -31,6 +31,7 @@ Software Foundation, Inc., 59 Temple Place - Suite 330 #include "privs.h" #include "linklist.h" #include "network.h" +#include "filter.h" #include "bgpd/bgpd.h" #include "bgpd/bgp_fsm.h" @@ -47,7 +48,7 @@ struct bgp_listener union sockunion su; struct thread *thread; }; - + /* * Set MD5 key for the socket, for the given IPv4 peer address. * If the password is NULL or zero-length, the option will be disabled. @@ -122,7 +123,72 @@ bgp_md5_set (struct peer *peer) return ret; } - + +/* Update BGP socket send buffer size */ +static void +bgp_update_sock_send_buffer_size (int fd) +{ + int size = BGP_SOCKET_SNDBUF_SIZE; + int optval; + socklen_t optlen = sizeof(optval); + + if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &optval, &optlen) < 0) + { + zlog_err("getsockopt of SO_SNDBUF failed %s\n", safe_strerror(errno)); + return; + } + if (optval < size) + { + if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0) + { + zlog_err("Couldn't increase send buffer: %s\n", safe_strerror(errno)); + } + } +} + +static void +bgp_set_socket_ttl (struct peer *peer, int bgp_sock) +{ + char buf[INET_ADDRSTRLEN]; + int ret; + + /* In case of peer is EBGP, we should set TTL for this connection. */ + if (!peer->gtsm_hops && (peer_sort (peer) == BGP_PEER_EBGP)) + { + ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, peer->ttl); + if (ret) + { + zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d", + __func__, + inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), + errno); + } + } + else if (peer->gtsm_hops) + { + /* On Linux, setting minttl without setting ttl seems to mess with the + outgoing ttl. Therefore setting both. + */ + ret = sockopt_ttl (peer->su.sa.sa_family, bgp_sock, MAXTTL); + if (ret) + { + zlog_err ("%s: Can't set TxTTL on peer (rtrid %s) socket, err = %d", + __func__, + inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), + errno); + } + ret = sockopt_minttl (peer->su.sa.sa_family, bgp_sock, + MAXTTL + 1 - peer->gtsm_hops); + if (ret) + { + zlog_err ("%s: Can't set MinTTL on peer (rtrid %s) socket, err = %d", + __func__, + inet_ntop (AF_INET, &peer->remote_id, buf, sizeof(buf)), + errno); + } + } +} + /* Accept bgp connection. */ static int bgp_accept (struct thread *thread) @@ -142,7 +208,7 @@ bgp_accept (struct thread *thread) zlog_err ("accept_sock is nevative value %d", accept_sock); return -1; } - listener->thread = thread_add_read (master, bgp_accept, listener, accept_sock); + listener->thread = thread_add_read (bm->master, bgp_accept, listener, accept_sock); /* Accept client connection. */ bgp_sock = sockunion_accept (accept_sock, &su); @@ -153,6 +219,9 @@ bgp_accept (struct thread *thread) } set_nonblocking (bgp_sock); + /* Set socket send buffer size */ + bgp_update_sock_send_buffer_size(bgp_sock); + if (BGP_DEBUG (events, EVENTS)) zlog_debug ("[Event] BGP connection from host %s", inet_sutop (&su, buf)); @@ -173,19 +242,14 @@ bgp_accept (struct thread *thread) return -1; } - /* In case of peer is EBGP, we should set TTL for this connection. */ - if (peer_sort (peer1) == BGP_PEER_EBGP) { - sockopt_ttl (peer1->su.sa.sa_family, bgp_sock, peer1->ttl); - if (peer1->gtsm_hops) - sockopt_minttl (peer1->su.sa.sa_family, bgp_sock, MAXTTL + 1 - peer1->gtsm_hops); - } + bgp_set_socket_ttl (peer1, bgp_sock); /* Make dummy peer until read Open packet. */ if (BGP_DEBUG (events, EVENTS)) zlog_debug ("[Event] Make dummy peer structure until read Open packet"); { - char buf[SU_ADDRSTRLEN + 1]; + char buf[SU_ADDRSTRLEN]; peer = peer_create_accept (peer1->bgp); SET_FLAG (peer->sflags, PEER_STATUS_ACCEPT_PEER); @@ -213,6 +277,7 @@ bgp_bind (struct peer *peer) #ifdef SO_BINDTODEVICE int ret; struct ifreq ifreq; + int myerrno; if (! peer->ifname) return 0; @@ -224,13 +289,15 @@ bgp_bind (struct peer *peer) ret = setsockopt (peer->fd, SOL_SOCKET, SO_BINDTODEVICE, &ifreq, sizeof (ifreq)); - + myerrno = errno; + if (bgpd_privs.change (ZPRIVS_LOWER) ) zlog_err ("bgp_bind: could not lower privs"); if (ret < 0) { - zlog (peer->log, LOG_INFO, "bind to interface %s failed", peer->ifname); + zlog (peer->log, LOG_INFO, "bind to interface %s failed, errno=%d", + peer->ifname, myerrno); return ret; } #endif /* SO_BINDTODEVICE */ @@ -238,46 +305,35 @@ bgp_bind (struct peer *peer) } static int -bgp_bind_address (int sock, struct in_addr *addr) +bgp_update_address (struct interface *ifp, const union sockunion *dst, + union sockunion *addr) { - int ret; - struct sockaddr_in local; - - memset (&local, 0, sizeof (struct sockaddr_in)); - local.sin_family = AF_INET; -#ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN - local.sin_len = sizeof(struct sockaddr_in); -#endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */ - memcpy (&local.sin_addr, addr, sizeof (struct in_addr)); - - if ( bgpd_privs.change (ZPRIVS_RAISE) ) - zlog_err ("bgp_bind_address: could not raise privs"); - - ret = bind (sock, (struct sockaddr *)&local, sizeof (struct sockaddr_in)); - if (ret < 0) - ; - - if (bgpd_privs.change (ZPRIVS_LOWER) ) - zlog_err ("bgp_bind_address: could not lower privs"); - - return 0; -} - -static struct in_addr * -bgp_update_address (struct interface *ifp) -{ - struct prefix_ipv4 *p; + struct prefix *p, *sel, d; struct connected *connected; struct listnode *node; + int common; + sockunion2hostprefix (dst, &d); + sel = NULL; + common = -1; + for (ALL_LIST_ELEMENTS_RO (ifp->connected, node, connected)) { - p = (struct prefix_ipv4 *) connected->address; - - if (p->family == AF_INET) - return &p->prefix; + p = connected->address; + if (p->family != d.family) + continue; + if (prefix_common_bits (p, &d) > common) + { + sel = p; + common = prefix_common_bits (sel, &d); + } } - return NULL; + + if (!sel) + return 1; + + prefix2sockunion (sel, addr); + return 0; } /* Update source selection. */ @@ -285,7 +341,7 @@ static void bgp_update_source (struct peer *peer) { struct interface *ifp; - struct in_addr *addr; + union sockunion addr; /* Source is specified with interface name. */ if (peer->update_if) @@ -294,11 +350,10 @@ bgp_update_source (struct peer *peer) if (! ifp) return; - addr = bgp_update_address (ifp); - if (! addr) + if (bgp_update_address (ifp, &peer->su, &addr)) return; - bgp_bind_address (peer->fd, addr); + sockunion_bind (peer->fd, &addr, 0, &addr); } /* Source is specified with IP address. */ @@ -310,26 +365,32 @@ bgp_update_source (struct peer *peer) int bgp_connect (struct peer *peer) { - unsigned int ifindex = 0; + ifindex_t ifindex = 0; /* Make socket for the peer. */ peer->fd = sockunion_socket (&peer->su); if (peer->fd < 0) return -1; - /* If we can get socket for the peer, adjest TTL and make connection. */ - if (peer_sort (peer) == BGP_PEER_EBGP) { - sockopt_ttl (peer->su.sa.sa_family, peer->fd, peer->ttl); - if (peer->gtsm_hops) - sockopt_minttl (peer->su.sa.sa_family, peer->fd, MAXTTL + 1 - peer->gtsm_hops); - } + set_nonblocking (peer->fd); + /* Set socket send buffer size */ + bgp_update_sock_send_buffer_size(peer->fd); + + bgp_set_socket_ttl (peer, peer->fd); + sockopt_reuseaddr (peer->fd); sockopt_reuseport (peer->fd); #ifdef IPTOS_PREC_INTERNETCONTROL + if (bgpd_privs.change (ZPRIVS_RAISE)) + zlog_err ("%s: could not raise privs", __func__); if (sockunion_family (&peer->su) == AF_INET) setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL); + else if (sockunion_family (&peer->su) == AF_INET6) + setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL); + if (bgpd_privs.change (ZPRIVS_LOWER)) + zlog_err ("%s: could not lower privs", __func__); #endif if (peer->password) @@ -341,10 +402,8 @@ bgp_connect (struct peer *peer) /* Update source bind. */ bgp_update_source (peer); -#ifdef HAVE_IPV6 if (peer->ifname) - ifindex = if_nametoindex (peer->ifname); -#endif /* HAVE_IPV6 */ + ifindex = ifname2ifindex (peer->ifname); if (BGP_DEBUG (events, EVENTS)) plog_debug (peer->log, "%s [Event] Connect start to %s fd %d", @@ -386,27 +445,22 @@ bgp_listener (int sock, struct sockaddr *sa, socklen_t sockopt_reuseaddr (sock); sockopt_reuseport (sock); + if (bgpd_privs.change (ZPRIVS_RAISE)) + zlog_err ("%s: could not raise privs", __func__); + #ifdef IPTOS_PREC_INTERNETCONTROL if (sa->sa_family == AF_INET) setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL); + else if (sa->sa_family == AF_INET6) + setsockopt_ipv6_tclass (sock, IPTOS_PREC_INTERNETCONTROL); #endif -#ifdef IPV6_V6ONLY - /* Want only IPV6 on ipv6 socket (not mapped addresses) */ - if (sa->sa_family == AF_INET6) { - int on = 1; - setsockopt (sock, IPPROTO_IPV6, IPV6_V6ONLY, - (void *) &on, sizeof (on)); - } -#endif + sockopt_v6only (sa->sa_family, sock); - if (bgpd_privs.change (ZPRIVS_RAISE) ) - zlog_err ("bgp_socket: could not raise privs"); - ret = bind (sock, sa, salen); en = errno; - if (bgpd_privs.change (ZPRIVS_LOWER) ) - zlog_err ("bgp_bind_address: could not lower privs"); + if (bgpd_privs.change (ZPRIVS_LOWER)) + zlog_err ("%s: could not lower privs", __func__); if (ret < 0) { @@ -424,14 +478,13 @@ bgp_listener (int sock, struct sockaddr *sa, socklen_t listener = XMALLOC (MTYPE_BGP_LISTENER, sizeof(*listener)); listener->fd = sock; memcpy(&listener->su, sa, salen); - listener->thread = thread_add_read (master, bgp_accept, listener, sock); + listener->thread = thread_add_read (bm->master, bgp_accept, listener, sock); listnode_add (bm->listen_sockets, listener); return 0; } /* IPv6 supported version of BGP server socket setup. */ -#if defined (HAVE_IPV6) && ! defined (NRL) int bgp_socket (unsigned short port, const char *address) { @@ -488,50 +541,6 @@ bgp_socket (unsigned short port, const char *address) return 0; } -#else -/* Traditional IPv4 only version. */ -int -bgp_socket (unsigned short port, const char *address) -{ - int sock; - int socklen; - struct sockaddr_in sin; - int ret, en; - - sock = socket (AF_INET, SOCK_STREAM, 0); - if (sock < 0) - { - zlog_err ("socket: %s", safe_strerror (errno)); - return sock; - } - - /* if we intend to implement ttl-security, this socket needs ttl=255 */ - sockopt_ttl (AF_INET, sock, MAXTTL); - - memset (&sin, 0, sizeof (struct sockaddr_in)); - sin.sin_family = AF_INET; - sin.sin_port = htons (port); - socklen = sizeof (struct sockaddr_in); - - if (address && ((ret = inet_aton(address, &sin.sin_addr)) < 1)) - { - zlog_err("bgp_socket: could not parse ip address %s: %s", - address, safe_strerror (errno)); - return ret; - } -#ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN - sin.sin_len = socklen; -#endif /* HAVE_STRUCT_SOCKADDR_IN_SIN_LEN */ - - ret = bgp_listener (sock, (struct sockaddr *) &sin, socklen); - if (ret < 0) - { - close (sock); - return ret; - } - return sock; -} -#endif /* HAVE_IPV6 && !NRL */ void bgp_close (void)