From 1ef00571f89f0899c88f63aa7350b90913e42bb3 Mon Sep 17 00:00:00 2001 From: Rafael Zalamena Date: Fri, 21 Dec 2018 12:27:44 -0200 Subject: [PATCH 1/3] ldpd: add support for FreeBSD IP_BINDANY Add yet another way to setsockopt a socket to listen to a foreign address. Signed-off-by: Rafael Zalamena --- ldpd/socket.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/ldpd/socket.c b/ldpd/socket.c index bebd7a7d61..78a07b1ed4 100644 --- a/ldpd/socket.c +++ b/ldpd/socket.c @@ -268,9 +268,18 @@ sock_set_bindany(int fd, int enable) return (-1); } return (0); +#elif defined(IP_BINDANY) + frr_elevate_privs(&ldpd_privs) { + if (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &enable, sizeof(int)) + < 0) { + log_warn("%s: error setting IP_BINDANY", __func__); + return (-1); + } + } #else - log_warnx("%s: missing SO_BINDANY and IP_FREEBIND, unable to bind " - "to a nonlocal IP address", __func__); + log_warnx( + "%s: missing SO_BINDANY, IP_FREEBIND and IP_BINDANY, unable to bind to a nonlocal IP address", + __func__); return (-1); #endif /* HAVE_SO_BINDANY */ } From 7f7651eba7b4db4bf4f17a5157b2001912dad9e4 Mon Sep 17 00:00:00 2001 From: Rafael Zalamena Date: Fri, 21 Dec 2018 17:03:05 -0200 Subject: [PATCH 2/3] zebra: fix compilation on OpenBSD OpenBSD doesn't define RTM_LOCK anymore: https://marc.info/?l=openbsd-tech&m=153018811429193&w=2 Signed-off-by: Rafael Zalamena --- zebra/kernel_socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/zebra/kernel_socket.c b/zebra/kernel_socket.c index 4f89d53e39..3e46a79e96 100644 --- a/zebra/kernel_socket.c +++ b/zebra/kernel_socket.c @@ -139,7 +139,9 @@ const struct message rtm_type_str[] = {{RTM_ADD, "RTM_ADD"}, {RTM_LOSING, "RTM_LOSING"}, {RTM_REDIRECT, "RTM_REDIRECT"}, {RTM_MISS, "RTM_MISS"}, +#ifdef RTM_LOCK {RTM_LOCK, "RTM_LOCK"}, +#endif /* RTM_LOCK */ #ifdef OLDADD {RTM_OLDADD, "RTM_OLDADD"}, #endif /* RTM_OLDADD */ From f43be00b6aa130e515479a95f89f0d103a9b0614 Mon Sep 17 00:00:00 2001 From: Rafael Zalamena Date: Fri, 21 Dec 2018 20:59:18 -0200 Subject: [PATCH 3/3] ldpd: fix startup on OpenBSD We must open the PF_KEY socket before dropping privileges, otherwise the socket creation will fail with permission problems. Signed-off-by: Rafael Zalamena --- ldpd/ldpe.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/ldpd/ldpe.c b/ldpd/ldpe.c index 56af76d94e..c16d92f28b 100644 --- a/ldpd/ldpe.c +++ b/ldpd/ldpe.c @@ -139,6 +139,16 @@ ldpe(void) void ldpe_init(struct ldpd_init *init) { +#ifdef __OpenBSD__ + /* This socket must be open before dropping privileges. */ + global.pfkeysock = pfkey_init(); + if (sysdep.no_pfkey == 0) { + pfkey_ev = NULL; + thread_add_read(master, ldpe_dispatch_pfkey, NULL, global.pfkeysock, + &pfkey_ev); + } +#endif + /* drop privileges */ ldpe_privs.user = init->user; ldpe_privs.group = init->group; @@ -159,14 +169,6 @@ ldpe_init(struct ldpd_init *init) fatal("inet_pton"); if (inet_pton(AF_INET6, AllRouters_v6, &global.mcast_addr_v6) != 1) fatal("inet_pton"); -#ifdef __OpenBSD__ - global.pfkeysock = pfkey_init(); - if (sysdep.no_pfkey == 0) { - pfkey_ev = NULL; - thread_add_read(master, ldpe_dispatch_pfkey, NULL, global.pfkeysock, - &pfkey_ev); - } -#endif /* mark sockets as closed */ global.ipv4.ldp_disc_socket = -1;