bgpd: justify capabilities for TOS setting

To set the TOS bits on TCP connections, platforms that restrict
capabilities need the priv level to be raised before the sockopt
is set, and this requires the ZCAP_NET_ADMIN priv.

* bgp_main.c: update _caps_p to include ZCAP_NET_ADMIN
* bgp_network.c
  * bgp_connect(): request ZPRIVS_RAISE/ZPRIVS_LOWER
  * bgp_listener(): request ZPRIVS_RAISE earlier

diff --git a/bgpd/bgp_main.c b/bgpd/bgp_main.c
index 1a460c6bbecd7d6814e27c91851df6967de354e3..0e85d57e538ece35e55cdf6092a4ebaf7fcf7725 100644 (file)
--- a/bgpd/bgp_main.c
+++ b/bgpd/bgp_main.c
@@ -119,6 +119,7 @@ static zebra_capabilities_t _caps_p [] =
 {
     ZCAP_BIND, 
     ZCAP_NET_RAW,
+    ZCAP_NET_ADMIN,
 };
 
 struct zebra_privs_t bgpd_privs =

diff --git a/bgpd/bgp_network.c b/bgpd/bgp_network.c
index c8ff87a68c5513e91fffc74f00d985d99bd53103..52c72b67670c4acf4786c6ed4bfccf5101178246 100644 (file)
--- a/bgpd/bgp_network.c
+++ b/bgpd/bgp_network.c
@@ -328,12 +328,16 @@ bgp_connect (struct peer *peer)
   sockopt_reuseport (peer->fd);
   
 #ifdef IPTOS_PREC_INTERNETCONTROL
+  if (bgpd_privs.change (ZPRIVS_RAISE))
+    zlog_err ("%s: could not raise privs", __func__);
   if (sockunion_family (&peer->su) == AF_INET)
     setsockopt_ipv4_tos (peer->fd, IPTOS_PREC_INTERNETCONTROL);
 # ifdef HAVE_IPV6
   else if (sockunion_family (&peer->su) == AF_INET6)
     setsockopt_ipv6_tclass (peer->fd, IPTOS_PREC_INTERNETCONTROL);
 # endif
+  if (bgpd_privs.change (ZPRIVS_LOWER))
+    zlog_err ("%s: could not lower privs", __func__);
 #endif
 
   if (peer->password)
@@ -390,6 +394,9 @@ bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
   sockopt_reuseaddr (sock);
   sockopt_reuseport (sock);
 
+  if (bgpd_privs.change (ZPRIVS_RAISE))
+    zlog_err ("%s: could not raise privs", __func__);
+
 #ifdef IPTOS_PREC_INTERNETCONTROL
   if (sa->sa_family == AF_INET)
     setsockopt_ipv4_tos (sock, IPTOS_PREC_INTERNETCONTROL);
@@ -408,13 +415,10 @@ bgp_listener (int sock, struct sockaddr *sa, socklen_t salen)
   }
 #endif
 
-  if (bgpd_privs.change (ZPRIVS_RAISE) )
-    zlog_err ("bgp_socket: could not raise privs");
-
   ret = bind (sock, sa, salen);
   en = errno;
-  if (bgpd_privs.change (ZPRIVS_LOWER) )
-    zlog_err ("bgp_bind_address: could not lower privs");
+  if (bgpd_privs.change (ZPRIVS_LOWER))
+    zlog_err ("%s: could not lower privs", __func__);
 
   if (ret < 0)
     {