Linux specific TCP-MD5 handling moved to sysdep/linux/sysio.h

FreeBSD coded added. BSD cannot set BGP passwords itself.
This has to be done by external command.

diff --git a/sysdep/bsd/sysio.h b/sysdep/bsd/sysio.h
index b2dc3a28a5ff1ea4881b1b1f6356edfe0a5e309d..b0ec456e8b4ad02eb3909d206d48f341fcd55cd4 100644 (file)
--- a/sysdep/bsd/sysio.h
+++ b/sysdep/bsd/sysio.h
@@ -74,3 +74,48 @@ sysio_mcast_join(sock * s)
 }
 
 #endif
+
+
+#include <netinet/tcp.h>
+#ifndef TCP_KEYLEN_MAX
+#define TCP_KEYLEN_MAX 80
+#endif
+#ifndef TCP_SIG_SPI
+#define TCP_SIG_SPI 0x1000
+#endif
+
+/* 
+ * FIXME: Passwords has to be set by setkey(8) command. This is the same
+ * behaviour like Quagga. We need to add code for SA/SP entries
+ * management.
+ */
+
+static int
+sk_set_md5_auth_int(sock *s, sockaddr *sa, char *passwd)
+{
+  int enable = 0;
+  if (passwd)
+    {
+      int len = strlen(passwd);
+
+      enable = len ? TCP_SIG_SPI : 0;
+
+      if (len > TCP_KEYLEN_MAX)
+       {
+         log(L_ERR "MD5 password too long");
+         return -1;
+       }
+    }
+
+  int rv = setsockopt(s->fd, IPPROTO_TCP, TCP_MD5SIG, &enable, sizeof(enable));
+
+  if (rv < 0) 
+    {
+      if (errno == ENOPROTOOPT)
+       log(L_ERR "Kernel does not support TCP MD5 signatures");
+      else
+       log(L_ERR "sk_set_md5_auth_int: setsockopt: %m");
+    }
+
+  return rv;
+}

diff --git a/sysdep/linux/sysio.h b/sysdep/linux/sysio.h
index 6e5411091f186483c15aa58151e208b8e5c9f6cd..2fa5f0a9e893738170561113eb95676ea02e28df 100644 (file)
--- a/sysdep/linux/sysio.h
+++ b/sysdep/linux/sysio.h
@@ -160,3 +160,38 @@ struct tcp_md5sig {
 };
 
 #endif
+
+static int
+sk_set_md5_auth_int(sock *s, sockaddr *sa, char *passwd)
+{
+  struct tcp_md5sig md5;
+
+  memset(&md5, 0, sizeof(md5));
+  memcpy(&md5.tcpm_addr, (struct sockaddr *) sa, sizeof(*sa));
+
+  if (passwd)
+    {
+      int len = strlen(passwd);
+
+      if (len > TCP_MD5SIG_MAXKEYLEN)
+       {
+         log(L_ERR "MD5 password too long");
+         return -1;
+       }
+
+      md5.tcpm_keylen = len;
+      memcpy(&md5.tcpm_key, passwd, len);
+    }
+
+  int rv = setsockopt(s->fd, IPPROTO_TCP, TCP_MD5SIG, &md5, sizeof(md5));
+
+  if (rv < 0) 
+    {
+      if (errno == ENOPROTOOPT)
+       log(L_ERR "Kernel does not support TCP MD5 signatures");
+      else
+       log(L_ERR "sk_set_md5_auth_int: setsockopt: %m");
+    }
+
+  return rv;
+}

diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index b6c7f8468d580fa50838cc73e41b732fa701de1c..50992fb408fb2b5a253b034d201c685564303a2b 100644 (file)
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -738,43 +738,6 @@ sk_set_ttl(sock *s, int ttl)
 }
 
 
-/* FIXME: check portability  */
-
-static int
-sk_set_md5_auth_int(sock *s, sockaddr *sa, char *passwd)
-{
-  struct tcp_md5sig md5;
-
-  memset(&md5, 0, sizeof(md5));
-  memcpy(&md5.tcpm_addr, (struct sockaddr *) sa, sizeof(*sa));
-
-  if (passwd)
-    {
-      int len = strlen(passwd);
-
-      if (len > TCP_MD5SIG_MAXKEYLEN)
-       {
-         log(L_ERR "MD5 password too long");
-         return -1;
-       }
-
-      md5.tcpm_keylen = len;
-      memcpy(&md5.tcpm_key, passwd, len);
-    }
-
-  int rv = setsockopt(s->fd, IPPROTO_TCP, TCP_MD5SIG, &md5, sizeof(md5));
-
-  if (rv < 0) 
-    {
-      if (errno == ENOPROTOOPT)
-       log(L_ERR "Kernel does not support TCP MD5 signatures");
-      else
-       log(L_ERR "sk_set_md5_auth_int: setsockopt: %m");
-    }
-
-  return rv;
-}
-
 /**
  * sk_set_md5_auth - add / remove MD5 security association for given socket.
  * @s: socket