focl 0.1.0

focl/focld - lightweight Rust BGP speaker
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

use std::net::SocketAddr;
use std::os::unix::io::AsRawFd;

use anyhow::Result;

/// Set TCP-MD5 signature on a socket for BGP authentication (RFC 2385)
///
/// # Safety
/// This uses libc directly and is marked unsafe due to raw pointer operations.
#[cfg(target_os = "linux")]
pub fn set_tcp_md5_signature(socket_fd: i32, peer_addr: &SocketAddr, password: &str) -> Result<()> {
    use libc::{setsockopt, socklen_t, AF_INET, AF_INET6, IPPROTO_TCP, TCP_MD5SIG};
    use std::os::raw::c_void;

    // TCP_MD5SIG requires a tcp_md5sig struct
    // struct tcp_md5sig {
    //     struct sockaddr_storage tcpm_addr;
    //     __u8 tcpm_flags;
    //     __u8 tcpm_prefixlen;
    //     __u16 tcpm_keylen;
    //     __u32 tcpm_ifindex;
    //     __u8 tcpm_key[TCP_MD5SIG_MAXKEYLEN];
    // };

    const TCP_MD5SIG_MAXKEYLEN: usize = 80;

    #[repr(C)]
    struct TcpMd5Sig {
        tcpm_addr: libc::sockaddr_storage,
        tcpm_flags: u8,
        tcpm_prefixlen: u8,
        tcpm_keylen: u16,
        tcpm_ifindex: u32,
        tcpm_key: [u8; TCP_MD5SIG_MAXKEYLEN],
    }

    let mut md5sig = TcpMd5Sig {
        tcpm_addr: unsafe { std::mem::zeroed() },
        tcpm_flags: 0,
        tcpm_prefixlen: 0,
        tcpm_keylen: 0,
        tcpm_ifindex: 0,
        tcpm_key: [0; TCP_MD5SIG_MAXKEYLEN],
    };

    // Set up address
    match peer_addr {
        SocketAddr::V4(addr) => {
            let sin = libc::sockaddr_in {
                sin_family: AF_INET as u16,
                sin_port: addr.port().to_be(),
                sin_addr: libc::in_addr {
                    s_addr: u32::from(*addr.ip()).to_be(),
                },
                sin_zero: [0; 8],
            };
            unsafe {
                std::ptr::copy_nonoverlapping(
                    &sin as *const _ as *const u8,
                    &mut md5sig.tcpm_addr as *mut _ as *mut u8,
                    std::mem::size_of::<libc::sockaddr_in>(),
                );
            }
            md5sig.tcpm_addr.ss_family = AF_INET as u16;
        }
        SocketAddr::V6(addr) => {
            let sin6 = libc::sockaddr_in6 {
                sin6_family: AF_INET6 as u16,
                sin6_port: addr.port().to_be(),
                sin6_flowinfo: 0,
                sin6_addr: libc::in6_addr {
                    s6_addr: addr.ip().octets(),
                },
                sin6_scope_id: 0,
            };
            unsafe {
                std::ptr::copy_nonoverlapping(
                    &sin6 as *const _ as *const u8,
                    &mut md5sig.tcpm_addr as *mut _ as *mut u8,
                    std::mem::size_of::<libc::sockaddr_in6>(),
                );
            }
            md5sig.tcpm_addr.ss_family = AF_INET6 as u16;
        }
    }

    // Set the password
    let password_bytes = password.as_bytes();
    if password_bytes.len() > TCP_MD5SIG_MAXKEYLEN {
        anyhow::bail!("password too long (max {} bytes)", TCP_MD5SIG_MAXKEYLEN);
    }
    md5sig.tcpm_keylen = password_bytes.len() as u16;
    md5sig.tcpm_key[..password_bytes.len()].copy_from_slice(password_bytes);

    let ret = unsafe {
        setsockopt(
            socket_fd,
            IPPROTO_TCP,
            TCP_MD5SIG,
            &md5sig as *const _ as *const c_void,
            std::mem::size_of::<TcpMd5Sig>() as socklen_t,
        )
    };

    if ret < 0 {
        let err = std::io::Error::last_os_error();
        anyhow::bail!("failed to set TCP_MD5SIG: {}", err);
    }

    Ok(())
}

/// Stub implementation for non-Linux platforms
#[cfg(not(target_os = "linux"))]
pub fn set_tcp_md5_signature(
    _socket_fd: i32,
    _peer_addr: &SocketAddr,
    _password: &str,
) -> Result<()> {
    anyhow::bail!("TCP-MD5 authentication is only supported on Linux (RFC 2385)")
}

/// Extension trait to set TCP-MD5 on tokio TcpSocket
pub trait TcpSocketExt {
    fn set_md5_signature(&self, peer_addr: &SocketAddr, password: &str) -> Result<()>;
}

impl TcpSocketExt for tokio::net::TcpSocket {
    fn set_md5_signature(&self, peer_addr: &SocketAddr, password: &str) -> Result<()> {
        let fd = self.as_raw_fd();
        set_tcp_md5_signature(fd, peer_addr, password)
    }
}

/// Extension trait to set TCP-MD5 on tokio TcpStream  
pub trait TcpStreamExt {
    fn set_md5_signature(&self, peer_addr: &SocketAddr, password: &str) -> Result<()>;
}

impl TcpStreamExt for tokio::net::TcpStream {
    fn set_md5_signature(&self, peer_addr: &SocketAddr, password: &str) -> Result<()> {
        let fd = self.as_raw_fd();
        set_tcp_md5_signature(fd, peer_addr, password)
    }
}