/usr/src/usr.sbin/bgpd/session.c

Bug Summary

File:	src/usr.sbin/bgpd/session.c
Warning:	line 338, column 25 Dereference of null pointer
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name session.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/bgpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.sbin/bgpd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/bgpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/bgpd/session.c
1/*	$OpenBSD: session.c,v 1.457 2024/01/10 11:08:04 claudio Exp $ */

3/*
* Copyright (c) 2003, 2004, 2005 Henning Brauer <henning@openbsd.org>
* Copyright (c) 2017 Peter van Dijk <peter.van.dijk@powerdns.com>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20#include <sys/types.h>

22#include <sys/mman.h>
23#include <sys/socket.h>
24#include <sys/time.h>
25#include <sys/resource.h>
26#include <sys/un.h>
27#include <netinet/in.h>
28#include <netinet/ip.h>
29#include <netinet/tcp.h>
30#include <arpa/inet.h>
31#include <limits.h>

33#include <err.h>
34#include <errno(*__errno()).h>
35#include <fcntl.h>
36#include <ifaddrs.h>
37#include <poll.h>
38#include <pwd.h>
39#include <signal.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>
43#include <syslog.h>
44#include <unistd.h>

46#include "bgpd.h"
47#include "session.h"
48#include "log.h"

50#define PFD_PIPE_MAIN0		0
51#define PFD_PIPE_ROUTE1		1
52#define PFD_PIPE_ROUTE_CTL2	2
53#define PFD_SOCK_CTL3		3
54#define PFD_SOCK_RCTL4		4
55#define PFD_LISTENERS_START5	5

57void	session_sighdlr(int);
58int	setup_listeners(u_int *);
59void	init_peer(struct peer *);
60void	start_timer_holdtime(struct peer *);
61void	start_timer_keepalive(struct peer *);
62void	session_close_connection(struct peer *);
63void	change_state(struct peer *, enum session_state, enum session_events);
64int	session_setup_socket(struct peer *);
65void	session_accept(int);
66int	session_connect(struct peer *);
67void	session_tcp_established(struct peer *);
68void	session_capa_ann_none(struct peer *);
69int	session_capa_add(struct ibuf *, uint8_t, uint8_t);
70int	session_capa_add_mp(struct ibuf *, uint8_t);
71int	session_capa_add_afi(struct peer *, struct ibuf *, uint8_t, uint8_t);
72struct bgp_msg	*session_newmsg(enum msg_type, uint16_t);
73int	session_sendmsg(struct bgp_msg *, struct peer *);
74void	session_open(struct peer *);
75void	session_keepalive(struct peer *);
76void	session_update(uint32_t, void *, size_t);
77void	session_notification(struct peer *, uint8_t, uint8_t, void *,
   ssize_t);
79void	session_rrefresh(struct peer *, uint8_t, uint8_t);
80int	session_graceful_restart(struct peer *);
81int	session_graceful_stop(struct peer *);
82int	session_dispatch_msg(struct pollfd *, struct peer *);
83void	session_process_msg(struct peer *);
84int	parse_header(struct peer *, u_char *, uint16_t *, uint8_t *);
85int	parse_open(struct peer *);
86int	parse_update(struct peer *);
87int	parse_rrefresh(struct peer *);
88int	parse_notification(struct peer *);
89int	parse_capabilities(struct peer *, u_char *, uint16_t, uint32_t *);
90int	capa_neg_calc(struct peer *, uint8_t *);
91void	session_dispatch_imsg(struct imsgbuf *, int, u_int *);
92void	session_up(struct peer *);
93void	session_down(struct peer *);
94int	imsg_rde(int, uint32_t, void *, uint16_t);
95void	session_demote(struct peer *, int);
96void	merge_peers(struct bgpd_config *, struct bgpd_config *);

98int		 la_cmp(struct listen_addr *, struct listen_addr *);
99void		 session_template_clone(struct peer *, struct sockaddr *,
    uint32_t, uint32_t);
101int		 session_match_mask(struct peer *, struct bgpd_addr *);

103static struct bgpd_config	*conf, *nconf;
104static struct imsgbuf		*ibuf_rde;
105static struct imsgbuf		*ibuf_rde_ctl;
106static struct imsgbuf		*ibuf_main;

108struct bgpd_sysdep	 sysdep;
109volatile sig_atomic_t	 session_quit;
110int			 pending_reconf;
111int			 csock = -1, rcsock = -1;
112u_int			 peer_cnt;

114struct mrt_head		 mrthead;
115time_t			 pauseaccept;

117static inline int
118peer_compare(const struct peer *a, const struct peer *b)
119{
return a->conf.id - b->conf.id;
121}

123RB_GENERATE(peer_head, peer, entry, peer_compare)void peer_head_RB_INSERT_COLOR(struct peer_head *head, struct
 peer *elm) { struct peer *parent, *gparent, *tmp; while ((parent
 = (elm)->entry.rbe_parent) && (parent)->entry.
rbe_color == 1) { gparent = (parent)->entry.rbe_parent; if
 (parent == (gparent)->entry.rbe_left) { tmp = (gparent)->
entry.rbe_right; if (tmp && (tmp)->entry.rbe_color
 == 1) { (tmp)->entry.rbe_color = 0; do { (parent)->entry
.rbe_color = 0; (gparent)->entry.rbe_color = 1; } while (0
); elm = gparent; continue; } if ((parent)->entry.rbe_right
 == elm) { do { (tmp) = (parent)->entry.rbe_right; if (((parent
)->entry.rbe_right = (tmp)->entry.rbe_left)) { ((tmp)->
entry.rbe_left)->entry.rbe_parent = (parent); } do {} while
 (0); if (((tmp)->entry.rbe_parent = (parent)->entry.rbe_parent
)) { if ((parent) == ((parent)->entry.rbe_parent)->entry
.rbe_left) ((parent)->entry.rbe_parent)->entry.rbe_left
 = (tmp); else ((parent)->entry.rbe_parent)->entry.rbe_right
 = (tmp); } else (head)->rbh_root = (tmp); (tmp)->entry
.rbe_left = (parent); (parent)->entry.rbe_parent = (tmp); do
 {} while (0); if (((tmp)->entry.rbe_parent)) do {} while (
0); } while (0); tmp = parent; parent = elm; elm = tmp; } do {
 (parent)->entry.rbe_color = 0; (gparent)->entry.rbe_color
 = 1; } while (0); do { (tmp) = (gparent)->entry.rbe_left;
 if (((gparent)->entry.rbe_left = (tmp)->entry.rbe_right
)) { ((tmp)->entry.rbe_right)->entry.rbe_parent = (gparent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (gparent
)->entry.rbe_parent)) { if ((gparent) == ((gparent)->entry
.rbe_parent)->entry.rbe_left) ((gparent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((gparent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_right = (gparent); (gparent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); } else { tmp = (gparent)->
entry.rbe_left; if (tmp && (tmp)->entry.rbe_color ==
 1) { (tmp)->entry.rbe_color = 0; do { (parent)->entry.
rbe_color = 0; (gparent)->entry.rbe_color = 1; } while (0)
; elm = gparent; continue; } if ((parent)->entry.rbe_left ==
 elm) { do { (tmp) = (parent)->entry.rbe_left; if (((parent
)->entry.rbe_left = (tmp)->entry.rbe_right)) { ((tmp)->
entry.rbe_right)->entry.rbe_parent = (parent); } do {} while
 (0); if (((tmp)->entry.rbe_parent = (parent)->entry.rbe_parent
)) { if ((parent) == ((parent)->entry.rbe_parent)->entry
.rbe_left) ((parent)->entry.rbe_parent)->entry.rbe_left
 = (tmp); else ((parent)->entry.rbe_parent)->entry.rbe_right
 = (tmp); } else (head)->rbh_root = (tmp); (tmp)->entry
.rbe_right = (parent); (parent)->entry.rbe_parent = (tmp);
 do {} while (0); if (((tmp)->entry.rbe_parent)) do {} while
 (0); } while (0); tmp = parent; parent = elm; elm = tmp; } do
 { (parent)->entry.rbe_color = 0; (gparent)->entry.rbe_color
 = 1; } while (0); do { (tmp) = (gparent)->entry.rbe_right
; if (((gparent)->entry.rbe_right = (tmp)->entry.rbe_left
)) { ((tmp)->entry.rbe_left)->entry.rbe_parent = (gparent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (gparent
)->entry.rbe_parent)) { if ((gparent) == ((gparent)->entry
.rbe_parent)->entry.rbe_left) ((gparent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((gparent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_left = (gparent); (gparent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); } } (head->rbh_root)->
entry.rbe_color = 0; } void peer_head_RB_REMOVE_COLOR(struct peer_head
 *head, struct peer *parent, struct peer *elm) { struct peer *
tmp; while ((elm == ((void *)0) || (elm)->entry.rbe_color ==
 0) && elm != (head)->rbh_root) { if ((parent)->
entry.rbe_left == elm) { tmp = (parent)->entry.rbe_right; if
 ((tmp)->entry.rbe_color == 1) { do { (tmp)->entry.rbe_color
 = 0; (parent)->entry.rbe_color = 1; } while (0); do { (tmp
) = (parent)->entry.rbe_right; if (((parent)->entry.rbe_right
 = (tmp)->entry.rbe_left)) { ((tmp)->entry.rbe_left)->
entry.rbe_parent = (parent); } do {} while (0); if (((tmp)->
entry.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent
) == ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_left = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 tmp = (parent)->entry.rbe_right; } if (((tmp)->entry.rbe_left
 == ((void *)0) || ((tmp)->entry.rbe_left)->entry.rbe_color
 == 0) && ((tmp)->entry.rbe_right == ((void *)0) ||
 ((tmp)->entry.rbe_right)->entry.rbe_color == 0)) { (tmp
)->entry.rbe_color = 1; elm = parent; parent = (elm)->entry
.rbe_parent; } else { if ((tmp)->entry.rbe_right == ((void
 *)0) || ((tmp)->entry.rbe_right)->entry.rbe_color == 0
) { struct peer *oleft; if ((oleft = (tmp)->entry.rbe_left
)) (oleft)->entry.rbe_color = 0; (tmp)->entry.rbe_color
 = 1; do { (oleft) = (tmp)->entry.rbe_left; if (((tmp)->
entry.rbe_left = (oleft)->entry.rbe_right)) { ((oleft)->
entry.rbe_right)->entry.rbe_parent = (tmp); } do {} while (
0); if (((oleft)->entry.rbe_parent = (tmp)->entry.rbe_parent
)) { if ((tmp) == ((tmp)->entry.rbe_parent)->entry.rbe_left
) ((tmp)->entry.rbe_parent)->entry.rbe_left = (oleft); else
 ((tmp)->entry.rbe_parent)->entry.rbe_right = (oleft); }
 else (head)->rbh_root = (oleft); (oleft)->entry.rbe_right
 = (tmp); (tmp)->entry.rbe_parent = (oleft); do {} while (
0); if (((oleft)->entry.rbe_parent)) do {} while (0); } while
 (0); tmp = (parent)->entry.rbe_right; } (tmp)->entry.rbe_color
 = (parent)->entry.rbe_color; (parent)->entry.rbe_color
 = 0; if ((tmp)->entry.rbe_right) ((tmp)->entry.rbe_right
)->entry.rbe_color = 0; do { (tmp) = (parent)->entry.rbe_right
; if (((parent)->entry.rbe_right = (tmp)->entry.rbe_left
)) { ((tmp)->entry.rbe_left)->entry.rbe_parent = (parent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (parent
)->entry.rbe_parent)) { if ((parent) == ((parent)->entry
.rbe_parent)->entry.rbe_left) ((parent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((parent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_left = (parent); (parent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); elm = (head)->rbh_root; break
; } } else { tmp = (parent)->entry.rbe_left; if ((tmp)->
entry.rbe_color == 1) { do { (tmp)->entry.rbe_color = 0; (
parent)->entry.rbe_color = 1; } while (0); do { (tmp) = (parent
)->entry.rbe_left; if (((parent)->entry.rbe_left = (tmp
)->entry.rbe_right)) { ((tmp)->entry.rbe_right)->entry
.rbe_parent = (parent); } do {} while (0); if (((tmp)->entry
.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent) ==
 ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_right = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 tmp = (parent)->entry.rbe_left; } if (((tmp)->entry.rbe_left
 == ((void *)0) || ((tmp)->entry.rbe_left)->entry.rbe_color
 == 0) && ((tmp)->entry.rbe_right == ((void *)0) ||
 ((tmp)->entry.rbe_right)->entry.rbe_color == 0)) { (tmp
)->entry.rbe_color = 1; elm = parent; parent = (elm)->entry
.rbe_parent; } else { if ((tmp)->entry.rbe_left == ((void *
)0) || ((tmp)->entry.rbe_left)->entry.rbe_color == 0) {
 struct peer *oright; if ((oright = (tmp)->entry.rbe_right
)) (oright)->entry.rbe_color = 0; (tmp)->entry.rbe_color
 = 1; do { (oright) = (tmp)->entry.rbe_right; if (((tmp)->
entry.rbe_right = (oright)->entry.rbe_left)) { ((oright)->
entry.rbe_left)->entry.rbe_parent = (tmp); } do {} while (
0); if (((oright)->entry.rbe_parent = (tmp)->entry.rbe_parent
)) { if ((tmp) == ((tmp)->entry.rbe_parent)->entry.rbe_left
) ((tmp)->entry.rbe_parent)->entry.rbe_left = (oright);
 else ((tmp)->entry.rbe_parent)->entry.rbe_right = (oright
); } else (head)->rbh_root = (oright); (oright)->entry.
rbe_left = (tmp); (tmp)->entry.rbe_parent = (oright); do {
} while (0); if (((oright)->entry.rbe_parent)) do {} while
 (0); } while (0); tmp = (parent)->entry.rbe_left; } (tmp)
->entry.rbe_color = (parent)->entry.rbe_color; (parent)
->entry.rbe_color = 0; if ((tmp)->entry.rbe_left) ((tmp
)->entry.rbe_left)->entry.rbe_color = 0; do { (tmp) = (
parent)->entry.rbe_left; if (((parent)->entry.rbe_left =
 (tmp)->entry.rbe_right)) { ((tmp)->entry.rbe_right)->
entry.rbe_parent = (parent); } do {} while (0); if (((tmp)->
entry.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent
) == ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_right = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 elm = (head)->rbh_root; break; } } } if (elm) (elm)->entry
.rbe_color = 0; } struct peer * peer_head_RB_REMOVE(struct peer_head
 *head, struct peer *elm) { struct peer *child, *parent, *old
 = elm; int color; if ((elm)->entry.rbe_left == ((void *)0
)) child = (elm)->entry.rbe_right; else if ((elm)->entry
.rbe_right == ((void *)0)) child = (elm)->entry.rbe_left; else
 { struct peer *left; elm = (elm)->entry.rbe_right; while (
(left = (elm)->entry.rbe_left)) elm = left; child = (elm)->
entry.rbe_right; parent = (elm)->entry.rbe_parent; color =
 (elm)->entry.rbe_color; if (child) (child)->entry.rbe_parent
 = parent; if (parent) { if ((parent)->entry.rbe_left == elm
) (parent)->entry.rbe_left = child; else (parent)->entry
.rbe_right = child; do {} while (0); } else (head)->rbh_root
 = child; if ((elm)->entry.rbe_parent == old) parent = elm
; (elm)->entry = (old)->entry; if ((old)->entry.rbe_parent
) { if (((old)->entry.rbe_parent)->entry.rbe_left == old
) ((old)->entry.rbe_parent)->entry.rbe_left = elm; else
 ((old)->entry.rbe_parent)->entry.rbe_right = elm; do {
} while (0); } else (head)->rbh_root = elm; ((old)->entry
.rbe_left)->entry.rbe_parent = elm; if ((old)->entry.rbe_right
) ((old)->entry.rbe_right)->entry.rbe_parent = elm; if (
parent) { left = parent; do { do {} while (0); } while ((left
 = (left)->entry.rbe_parent)); } goto color; } parent = (elm
)->entry.rbe_parent; color = (elm)->entry.rbe_color; if
 (child) (child)->entry.rbe_parent = parent; if (parent) {
 if ((parent)->entry.rbe_left == elm) (parent)->entry.rbe_left
 = child; else (parent)->entry.rbe_right = child; do {} while
 (0); } else (head)->rbh_root = child; color: if (color ==
 0) peer_head_RB_REMOVE_COLOR(head, parent, child); return (old
); } struct peer * peer_head_RB_INSERT(struct peer_head *head
, struct peer *elm) { struct peer *tmp; struct peer *parent =
 ((void *)0); int comp = 0; tmp = (head)->rbh_root; while (
tmp) { parent = tmp; comp = (peer_compare)(elm, parent); if (
comp < 0) tmp = (tmp)->entry.rbe_left; else if (comp >
 0) tmp = (tmp)->entry.rbe_right; else return (tmp); } do {
 (elm)->entry.rbe_parent = parent; (elm)->entry.rbe_left
 = (elm)->entry.rbe_right = ((void *)0); (elm)->entry.rbe_color
 = 1; } while (0); if (parent != ((void *)0)) { if (comp <
 0) (parent)->entry.rbe_left = elm; else (parent)->entry
.rbe_right = elm; do {} while (0); } else (head)->rbh_root
 = elm; peer_head_RB_INSERT_COLOR(head, elm); return (((void *
)0)); } struct peer * peer_head_RB_FIND(struct peer_head *head
, struct peer *elm) { struct peer *tmp = (head)->rbh_root;
 int comp; while (tmp) { comp = peer_compare(elm, tmp); if (comp
 < 0) tmp = (tmp)->entry.rbe_left; else if (comp > 0
) tmp = (tmp)->entry.rbe_right; else return (tmp); } return
 (((void *)0)); } struct peer * peer_head_RB_NFIND(struct peer_head
 *head, struct peer *elm) { struct peer *tmp = (head)->rbh_root
; struct peer *res = ((void *)0); int comp; while (tmp) { comp
 = peer_compare(elm, tmp); if (comp < 0) { res = tmp; tmp =
 (tmp)->entry.rbe_left; } else if (comp > 0) tmp = (tmp
)->entry.rbe_right; else return (tmp); } return (res); } struct
 peer * peer_head_RB_NEXT(struct peer *elm) { if ((elm)->entry
.rbe_right) { elm = (elm)->entry.rbe_right; while ((elm)->
entry.rbe_left) elm = (elm)->entry.rbe_left; } else { if (
(elm)->entry.rbe_parent && (elm == ((elm)->entry
.rbe_parent)->entry.rbe_left)) elm = (elm)->entry.rbe_parent
; else { while ((elm)->entry.rbe_parent && (elm ==
 ((elm)->entry.rbe_parent)->entry.rbe_right)) elm = (elm
)->entry.rbe_parent; elm = (elm)->entry.rbe_parent; } }
 return (elm); } struct peer * peer_head_RB_PREV(struct peer *
elm) { if ((elm)->entry.rbe_left) { elm = (elm)->entry.
rbe_left; while ((elm)->entry.rbe_right) elm = (elm)->entry
.rbe_right; } else { if ((elm)->entry.rbe_parent &&
 (elm == ((elm)->entry.rbe_parent)->entry.rbe_right)) elm
 = (elm)->entry.rbe_parent; else { while ((elm)->entry.
rbe_parent && (elm == ((elm)->entry.rbe_parent)->
entry.rbe_left)) elm = (elm)->entry.rbe_parent; elm = (elm
)->entry.rbe_parent; } } return (elm); } struct peer * peer_head_RB_MINMAX
(struct peer_head *head, int val) { struct peer *tmp = (head)
->rbh_root; struct peer *parent = ((void *)0); while (tmp)
 { parent = tmp; if (val < 0) tmp = (tmp)->entry.rbe_left
; else tmp = (tmp)->entry.rbe_right; } return (parent); };

125void
126session_sighdlr(int sig)
127{
switch (sig) {
case SIGINT2:
case SIGTERM15:
session_quit = 1;
break;
}
134}

136int
137setup_listeners(u_int *la_cnt)
138{
int			 ttl = 255;
struct listen_addr	*la;
u_int			 cnt = 0;

TAILQ_FOREACH(la, conf->listen_addrs, entry)for((la) = ((conf->listen_addrs)->tqh_first); (la) != (
(void *)0); (la) = ((la)->entry.tqe_next)) {
la->reconf = RECONF_NONE;
cnt++;

if (la->flags & LISTENER_LISTENING0x02)
	continue;

if (la->fd == -1) {
	log_warn("cannot establish listener on %s: invalid fd",
	    log_sockaddr((struct sockaddr *)&la->sa,
	    la->sa_len));
	continue;
}

if (tcp_md5_prep_listener(la, &conf->peers) == -1)
	fatal("tcp_md5_prep_listener");

/* set ttl to 255 so that ttl-security works */
if (la->sa.ss_family == AF_INET2 && setsockopt(la->fd,
    IPPROTO_IP0, IP_TTL4, &ttl, sizeof(ttl)) == -1) {
	log_warn("setup_listeners setsockopt TTL");
	continue;
}
if (la->sa.ss_family == AF_INET624 && setsockopt(la->fd,
    IPPROTO_IPV641, IPV6_UNICAST_HOPS4, &ttl, sizeof(ttl)) == -1) {
	log_warn("setup_listeners setsockopt hoplimit");
	continue;
}

if (listen(la->fd, MAX_BACKLOG5)) {
	close(la->fd);
	fatal("listen");
}

la->flags |= LISTENER_LISTENING0x02;

log_info("listening on %s",
    log_sockaddr((struct sockaddr *)&la->sa, la->sa_len));
}

*la_cnt = cnt;

return (0);
186}

188void
189session_main(int debug, int verbose)
190{
int			 timeout;
unsigned int		 i, j, idx_peers, idx_listeners, idx_mrts;
u_int			 pfd_elms = 0, peer_l_elms = 0, mrt_l_elms = 0;
u_int			 listener_cnt, ctl_cnt, mrt_cnt;
u_int			 new_cnt;
struct passwd		*pw;
struct peer		*p, **peer_l = NULL((void *)0), *next;
struct mrt		*m, *xm, **mrt_l = NULL((void *)0);
struct pollfd		*pfd = NULL((void *)0);
1
'pfd' initialized to a null pointer value→
struct listen_addr	*la;
void			*newp;
time_t			 now;
short			 events;

log_init(debug, LOG_DAEMON(3<<3));
log_setverbose(verbose);

log_procinit(log_procnames[PROC_SE]);

if ((pw = getpwnam(BGPD_USER"_bgpd")) == NULL((void *)0))
2
←
Assuming the condition is false→
3
←
Taking false branch→
fatal(NULL((void *)0));

if (chroot(pw->pw_dir) == -1)
4
←
Assuming the condition is false→
5
←
Taking false branch→
fatal("chroot");
if (chdir("/") == -1)
6
←
Assuming the condition is false→
7
←
Taking false branch→
fatal("chdir(\"/\")");

setproctitle("session engine");

if (setgroups(1, &pw->pw_gid) ||
8
←
Assuming the condition is false→
11
←
Taking false branch→
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
9
←
Assuming the condition is false→
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
10
←
Assuming the condition is false→
fatal("can't drop privileges");

if (pledge("stdio inet recvfd", NULL((void *)0)) == -1)
12
←
Assuming the condition is false→
13
←
Taking false branch→
fatal("pledge");

signal(SIGTERM15, session_sighdlr);
signal(SIGINT2, session_sighdlr);
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);
signal(SIGHUP1, SIG_IGN(void (*)(int))1);
signal(SIGALRM14, SIG_IGN(void (*)(int))1);
signal(SIGUSR130, SIG_IGN(void (*)(int))1);

if ((ibuf_main = malloc(sizeof(struct imsgbuf))) == NULL((void *)0))
14
←
Assuming the condition is false→
15
←
Taking false branch→
fatal(NULL((void *)0));
imsg_init(ibuf_main, 3);

LIST_INIT(&mrthead)do { ((&mrthead)->lh_first) = ((void *)0); } while (0);
16
←
Loop condition is false.  Exiting loop→
listener_cnt = 0;
peer_cnt = 0;
ctl_cnt = 0;

conf = new_config();
log_info("session engine ready");

while (session_quit == 0) {
17
←
Assuming 'session_quit' is equal to 0→
18
←
Loop condition is true.  Entering loop body→
/* check for peers to be initialized or deleted */
if (!pending_reconf) {
19
←
Assuming 'pending_reconf' is not equal to 0→
20
←
Taking false branch→
	RB_FOREACH_SAFE(p, peer_head, &conf->peers, next)for ((p) = peer_head_RB_MINMAX(&conf->peers, -1); ((p)
 != ((void *)0)) && ((next) = peer_head_RB_NEXT(p), 1
); (p) = (next)) {
		/* cloned peer that idled out? */
		if (p->template && (p->state == STATE_IDLE ||
		    p->state == STATE_ACTIVE) &&
		    getmonotime() - p->stats.last_updown >=
		    INTERVAL_HOLD_CLONED3600)
			p->reconf_action = RECONF_DELETE;

		/* new peer that needs init? */
		if (p->state == STATE_NONE)
			init_peer(p);

		/* deletion due? */
		if (p->reconf_action == RECONF_DELETE) {
			if (p->demoted)
				session_demote(p, -1);
			p->conf.demote_group[0] = 0;
			session_stop(p, ERR_CEASE_PEER_UNCONF);
			timer_remove_all(&p->timers);
			tcp_md5_del_listener(conf, p);
			log_peer_warnx(&p->conf, "removed");
			RB_REMOVE(peer_head, &conf->peers, p)peer_head_RB_REMOVE(&conf->peers, p);
			free(p);
			peer_cnt--;
			continue;
		}
		p->reconf_action = RECONF_NONE;
	}
}

if (peer_cnt > peer_l_elms) {
21
←
Assuming 'peer_cnt' is > 'peer_l_elms'→
22
←
Taking true branch→
	if ((newp = reallocarray(peer_l, peer_cnt,
23
←
Assuming the condition is false→
24
←
Taking false branch→
	    sizeof(struct peer *))) == NULL((void *)0)) {
		/* panic for now */
		log_warn("could not resize peer_l from %u -> %u"
		    " entries", peer_l_elms, peer_cnt);
		fatalx("exiting");
	}
	peer_l = newp;
	peer_l_elms = peer_cnt;
}

mrt_cnt = 0;
for (m = LIST_FIRST(&mrthead)((&mrthead)->lh_first); m != NULL((void *)0); m = xm) {
25
←
Assuming 'm' is equal to NULL→
26
←
Loop condition is false. Execution continues on line 305→
	xm = LIST_NEXT(m, entry)((m)->entry.le_next);
	if (m->state == MRT_STATE_REMOVE) {
		mrt_clean(m);
		LIST_REMOVE(m, entry)do { if ((m)->entry.le_next != ((void *)0)) (m)->entry.
le_next->entry.le_prev = (m)->entry.le_prev; *(m)->entry
.le_prev = (m)->entry.le_next; ; ; } while (0);
		free(m);
		continue;
	}
	if (m->wbuf.queued)
		mrt_cnt++;
}

if (mrt_cnt26.1
'mrt_cnt' is <= 'mrt_l_elms'
 > mrt_l_elms) {
27
←
Taking false branch→
	if ((newp = reallocarray(mrt_l, mrt_cnt,
	    sizeof(struct mrt *))) == NULL((void *)0)) {
		/* panic for now */
		log_warn("could not resize mrt_l from %u -> %u"
		    " entries", mrt_l_elms, mrt_cnt);
		fatalx("exiting");
	}
	mrt_l = newp;
	mrt_l_elms = mrt_cnt;
}

new_cnt = PFD_LISTENERS_START5 + listener_cnt + peer_cnt +
    ctl_cnt + mrt_cnt;
if (new_cnt > pfd_elms) {
28
←
Assuming 'new_cnt' is <= 'pfd_elms'→
29
←
Taking false branch→
	if ((newp = reallocarray(pfd, new_cnt,
	    sizeof(struct pollfd))) == NULL((void *)0)) {
		/* panic for now */
		log_warn("could not resize pfd from %u -> %u"
		    " entries", pfd_elms, new_cnt);
		fatalx("exiting");
	}
	pfd = newp;
	pfd_elms = new_cnt;
}

memset(pfd, 0, sizeof(struct pollfd) * pfd_elms);

set_pollfd(&pfd[PFD_PIPE_MAIN0], ibuf_main);
set_pollfd(&pfd[PFD_PIPE_ROUTE1], ibuf_rde);
set_pollfd(&pfd[PFD_PIPE_ROUTE_CTL2], ibuf_rde_ctl);

if (pauseaccept == 0) {
30
←
Assuming 'pauseaccept' is equal to 0→
31
←
Taking true branch→
	pfd[PFD_SOCK_CTL3].fd = csock;
32
←
Dereference of null pointer
	pfd[PFD_SOCK_CTL3].events = POLLIN0x0001;
	pfd[PFD_SOCK_RCTL4].fd = rcsock;
	pfd[PFD_SOCK_RCTL4].events = POLLIN0x0001;
} else {
	pfd[PFD_SOCK_CTL3].fd = -1;
	pfd[PFD_SOCK_RCTL4].fd = -1;
}

i = PFD_LISTENERS_START5;
TAILQ_FOREACH(la, conf->listen_addrs, entry)for((la) = ((conf->listen_addrs)->tqh_first); (la) != (
(void *)0); (la) = ((la)->entry.tqe_next)) {
	if (pauseaccept == 0) {
		pfd[i].fd = la->fd;
		pfd[i].events = POLLIN0x0001;
	} else
		pfd[i].fd = -1;
	i++;
}
idx_listeners = i;
timeout = 240;	/* loop every 240s at least */

now = getmonotime();
RB_FOREACH(p, peer_head, &conf->peers)for ((p) = peer_head_RB_MINMAX(&conf->peers, -1); (p) !=
 ((void *)0); (p) = peer_head_RB_NEXT(p)) {
	time_t	nextaction;
	struct timer *pt;

	/* check timers */
	if ((pt = timer_nextisdue(&p->timers, now)) != NULL((void *)0)) {
		switch (pt->type) {
		case Timer_Hold:
			bgp_fsm(p, EVNT_TIMER_HOLDTIME);
			break;
		case Timer_SendHold:
			bgp_fsm(p, EVNT_TIMER_SENDHOLD);
			break;
		case Timer_ConnectRetry:
			bgp_fsm(p, EVNT_TIMER_CONNRETRY);
			break;
		case Timer_Keepalive:
			bgp_fsm(p, EVNT_TIMER_KEEPALIVE);
			break;
		case Timer_IdleHold:
			bgp_fsm(p, EVNT_START);
			break;
		case Timer_IdleHoldReset:
			p->IdleHoldTime =
			    INTERVAL_IDLE_HOLD_INITIAL30;
			p->errcnt = 0;
			timer_stop(&p->timers,
			    Timer_IdleHoldReset);
			break;
		case Timer_CarpUndemote:
			timer_stop(&p->timers,
			    Timer_CarpUndemote);
			if (p->demoted &&
			    p->state == STATE_ESTABLISHED)
				session_demote(p, -1);
			break;
		case Timer_RestartTimeout:
			timer_stop(&p->timers,
			    Timer_RestartTimeout);
			session_graceful_stop(p);
			break;
		default:
			fatalx("King Bula lost in time");
		}
	}
	if ((nextaction = timer_nextduein(&p->timers,
	    now)) != -1 && nextaction < timeout)
		timeout = nextaction;

	/* are we waiting for a write? */
	events = POLLIN0x0001;
	if (p->wbuf.queued > 0 || p->state == STATE_CONNECT)
		events |= POLLOUT0x0004;
	/* is there still work to do? */
	if (p->rpending && p->rbuf && p->rbuf->wpos)
		timeout = 0;

	/* poll events */
	if (p->fd != -1 && events != 0) {
		pfd[i].fd = p->fd;
		pfd[i].events = events;
		peer_l[i - idx_listeners] = p;
		i++;
	}
}

idx_peers = i;

LIST_FOREACH(m, &mrthead, entry)for((m) = ((&mrthead)->lh_first); (m)!= ((void *)0); (
m) = ((m)->entry.le_next))
	if (m->wbuf.queued) {
		pfd[i].fd = m->wbuf.fd;
		pfd[i].events = POLLOUT0x0004;
		mrt_l[i - idx_peers] = m;
		i++;
	}

idx_mrts = i;

i += control_fill_pfds(pfd + i, pfd_elms -i);

if (i > pfd_elms)
	fatalx("poll pfd overflow");

if (pauseaccept && timeout > 1)
	timeout = 1;
if (timeout < 0)
	timeout = 0;
if (poll(pfd, i, timeout * 1000) == -1) {
	if (errno(*__errno()) == EINTR4)
		continue;
	fatal("poll error");
}

/*
 * If we previously saw fd exhaustion, we stop accept()
 * for 1 second to throttle the accept() loop.
 */
if (pauseaccept && getmonotime() > pauseaccept + 1)
	pauseaccept = 0;

if (handle_pollfd(&pfd[PFD_PIPE_MAIN0], ibuf_main) == -1) {
	log_warnx("SE: Lost connection to parent");
	session_quit = 1;
	continue;
} else
	session_dispatch_imsg(ibuf_main, PFD_PIPE_MAIN0,
	    &listener_cnt);

if (handle_pollfd(&pfd[PFD_PIPE_ROUTE1], ibuf_rde) == -1) {
	log_warnx("SE: Lost connection to RDE");
	msgbuf_clear(&ibuf_rde->w);
	free(ibuf_rde);
	ibuf_rde = NULL((void *)0);
} else
	session_dispatch_imsg(ibuf_rde, PFD_PIPE_ROUTE1,
	    &listener_cnt);

if (handle_pollfd(&pfd[PFD_PIPE_ROUTE_CTL2], ibuf_rde_ctl) ==
    -1) {
	log_warnx("SE: Lost connection to RDE control");
	msgbuf_clear(&ibuf_rde_ctl->w);
	free(ibuf_rde_ctl);
	ibuf_rde_ctl = NULL((void *)0);
} else
	session_dispatch_imsg(ibuf_rde_ctl, PFD_PIPE_ROUTE_CTL2,
	    &listener_cnt);

if (pfd[PFD_SOCK_CTL3].revents & POLLIN0x0001)
	ctl_cnt += control_accept(csock, 0);

if (pfd[PFD_SOCK_RCTL4].revents & POLLIN0x0001)
	ctl_cnt += control_accept(rcsock, 1);

for (j = PFD_LISTENERS_START5; j < idx_listeners; j++)
	if (pfd[j].revents & POLLIN0x0001)
		session_accept(pfd[j].fd);

for (; j < idx_peers; j++)
	session_dispatch_msg(&pfd[j],
	    peer_l[j - idx_listeners]);

RB_FOREACH(p, peer_head, &conf->peers)for ((p) = peer_head_RB_MINMAX(&conf->peers, -1); (p) !=
 ((void *)0); (p) = peer_head_RB_NEXT(p))
	if (p->rbuf && p->rbuf->wpos)
		session_process_msg(p);

for (; j < idx_mrts; j++)
	if (pfd[j].revents & POLLOUT0x0004)
		mrt_write(mrt_l[j - idx_peers]);

for (; j < i; j++)
	ctl_cnt -= control_dispatch_msg(&pfd[j], &conf->peers);
}

RB_FOREACH_SAFE(p, peer_head, &conf->peers, next)for ((p) = peer_head_RB_MINMAX(&conf->peers, -1); ((p)
 != ((void *)0)) && ((next) = peer_head_RB_NEXT(p), 1
); (p) = (next)) {
RB_REMOVE(peer_head, &conf->peers, p)peer_head_RB_REMOVE(&conf->peers, p);
strlcpy(p->conf.reason,
    "bgpd shutting down",
    sizeof(p->conf.reason));
session_stop(p, ERR_CEASE_ADMIN_DOWN);
timer_remove_all(&p->timers);
free(p);
}

while ((m = LIST_FIRST(&mrthead)((&mrthead)->lh_first)) != NULL((void *)0)) {
mrt_clean(m);
LIST_REMOVE(m, entry)do { if ((m)->entry.le_next != ((void *)0)) (m)->entry.
le_next->entry.le_prev = (m)->entry.le_prev; *(m)->entry
.le_prev = (m)->entry.le_next; ; ; } while (0);
free(m);
}

free_config(conf);
free(peer_l);
free(mrt_l);
free(pfd);

/* close pipes */
if (ibuf_rde) {
msgbuf_write(&ibuf_rde->w);
msgbuf_clear(&ibuf_rde->w);
close(ibuf_rde->fd);
free(ibuf_rde);
}
if (ibuf_rde_ctl) {
msgbuf_clear(&ibuf_rde_ctl->w);
close(ibuf_rde_ctl->fd);
free(ibuf_rde_ctl);
}
msgbuf_write(&ibuf_main->w);
msgbuf_clear(&ibuf_main->w);
close(ibuf_main->fd);
free(ibuf_main);

control_shutdown(csock);
control_shutdown(rcsock);
log_info("session engine exiting");
exit(0);
555}

557void
558init_peer(struct peer *p)
559{
TAILQ_INIT(&p->timers)do { (&p->timers)->tqh_first = ((void *)0); (&p
->timers)->tqh_last = &(&p->timers)->tqh_first
; } while (0);
p->fd = p->wbuf.fd = -1;

if (p->conf.if_depend[0])
imsg_compose(ibuf_main, IMSG_SESSION_DEPENDON, 0, 0, -1,
    p->conf.if_depend, sizeof(p->conf.if_depend));
else
p->depend_ok = 1;

peer_cnt++;

change_state(p, STATE_IDLE, EVNT_NONE);
if (p->conf.down)
timer_stop(&p->timers, Timer_IdleHold); /* no autostart */
else
timer_set(&p->timers, Timer_IdleHold, SESSION_CLEAR_DELAY5);

p->stats.last_updown = getmonotime();

/*
* on startup, demote if requested.
* do not handle new peers. they must reach ESTABLISHED beforehand.
* peers added at runtime have reconf_action set to RECONF_REINIT.
*/
if (p->reconf_action != RECONF_REINIT && p->conf.demote_group[0])
session_demote(p, +1);
586}

588void
589bgp_fsm(struct peer *peer, enum session_events event)
590{
switch (peer->state) {
case STATE_NONE:
/* nothing */
break;
case STATE_IDLE:
switch (event) {
case EVNT_START:
	timer_stop(&peer->timers, Timer_Hold);
	timer_stop(&peer->timers, Timer_SendHold);
	timer_stop(&peer->timers, Timer_Keepalive);
	timer_stop(&peer->timers, Timer_IdleHold);

	/* allocate read buffer */
	peer->rbuf = calloc(1, sizeof(struct ibuf_read));
	if (peer->rbuf == NULL((void *)0))
		fatal(NULL((void *)0));

	/* init write buffer */
	msgbuf_init(&peer->wbuf);

	peer->stats.last_sent_errcode = 0;
	peer->stats.last_sent_suberr = 0;
	peer->stats.last_rcvd_errcode = 0;
	peer->stats.last_rcvd_suberr = 0;

	if (!peer->depend_ok)
		timer_stop(&peer->timers, Timer_ConnectRetry);
	else if (peer->passive || peer->conf.passive ||
	    peer->conf.template) {
		change_state(peer, STATE_ACTIVE, event);
		timer_stop(&peer->timers, Timer_ConnectRetry);
	} else {
		change_state(peer, STATE_CONNECT, event);
		timer_set(&peer->timers, Timer_ConnectRetry,
		    conf->connectretry);
		session_connect(peer);
	}
	peer->passive = 0;
	break;
default:
	/* ignore */
	break;
}
break;
case STATE_CONNECT:
switch (event) {
case EVNT_START:
	/* ignore */
	break;
case EVNT_CON_OPEN:
	session_tcp_established(peer);
	session_open(peer);
	timer_stop(&peer->timers, Timer_ConnectRetry);
	peer->holdtime = INTERVAL_HOLD_INITIAL240;
	start_timer_holdtime(peer);
	change_state(peer, STATE_OPENSENT, event);
	break;
case EVNT_CON_OPENFAIL:
	timer_set(&peer->timers, Timer_ConnectRetry,
	    conf->connectretry);
	session_close_connection(peer);
	change_state(peer, STATE_ACTIVE, event);
	break;
case EVNT_TIMER_CONNRETRY:
	timer_set(&peer->timers, Timer_ConnectRetry,
	    conf->connectretry);
	session_connect(peer);
	break;
default:
	change_state(peer, STATE_IDLE, event);
	break;
}
break;
case STATE_ACTIVE:
switch (event) {
case EVNT_START:
	/* ignore */
	break;
case EVNT_CON_OPEN:
	session_tcp_established(peer);
	session_open(peer);
	timer_stop(&peer->timers, Timer_ConnectRetry);
	peer->holdtime = INTERVAL_HOLD_INITIAL240;
	start_timer_holdtime(peer);
	change_state(peer, STATE_OPENSENT, event);
	break;
case EVNT_CON_OPENFAIL:
	timer_set(&peer->timers, Timer_ConnectRetry,
	    conf->connectretry);
	session_close_connection(peer);
	change_state(peer, STATE_ACTIVE, event);
	break;
case EVNT_TIMER_CONNRETRY:
	timer_set(&peer->timers, Timer_ConnectRetry,
	    peer->holdtime);
	change_state(peer, STATE_CONNECT, event);
	session_connect(peer);
	break;
default:
	change_state(peer, STATE_IDLE, event);
	break;
}
break;
case STATE_OPENSENT:
switch (event) {
case EVNT_START:
	/* ignore */
	break;
case EVNT_STOP:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_CON_CLOSED:
	session_close_connection(peer);
	timer_set(&peer->timers, Timer_ConnectRetry,
	    conf->connectretry);
	change_state(peer, STATE_ACTIVE, event);
	break;
case EVNT_CON_FATAL:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_TIMER_HOLDTIME:
case EVNT_TIMER_SENDHOLD:
	session_notification(peer, ERR_HOLDTIMEREXPIRED,
	    0, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_RCVD_OPEN:
	/* parse_open calls change_state itself on failure */
	if (parse_open(peer))
		break;
	session_keepalive(peer);
	change_state(peer, STATE_OPENCONFIRM, event);
	break;
case EVNT_RCVD_NOTIFICATION:
	if (parse_notification(peer)) {
		change_state(peer, STATE_IDLE, event);
		/* don't punish, capa negotiation */
		timer_set(&peer->timers, Timer_IdleHold, 0);
		peer->IdleHoldTime /= 2;
	} else
		change_state(peer, STATE_IDLE, event);
	break;
default:
	session_notification(peer,
	    ERR_FSM, ERR_FSM_UNEX_OPENSENT, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
}
break;
case STATE_OPENCONFIRM:
switch (event) {
case EVNT_START:
	/* ignore */
	break;
case EVNT_STOP:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_CON_CLOSED:
case EVNT_CON_FATAL:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_TIMER_HOLDTIME:
case EVNT_TIMER_SENDHOLD:
	session_notification(peer, ERR_HOLDTIMEREXPIRED,
	    0, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_TIMER_KEEPALIVE:
	session_keepalive(peer);
	break;
case EVNT_RCVD_KEEPALIVE:
	start_timer_holdtime(peer);
	change_state(peer, STATE_ESTABLISHED, event);
	break;
case EVNT_RCVD_NOTIFICATION:
	parse_notification(peer);
	change_state(peer, STATE_IDLE, event);
	break;
default:
	session_notification(peer,
	    ERR_FSM, ERR_FSM_UNEX_OPENCONFIRM, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
}
break;
case STATE_ESTABLISHED:
switch (event) {
case EVNT_START:
	/* ignore */
	break;
case EVNT_STOP:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_CON_CLOSED:
case EVNT_CON_FATAL:
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_TIMER_HOLDTIME:
case EVNT_TIMER_SENDHOLD:
	session_notification(peer, ERR_HOLDTIMEREXPIRED,
	    0, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
case EVNT_TIMER_KEEPALIVE:
	session_keepalive(peer);
	break;
case EVNT_RCVD_KEEPALIVE:
	start_timer_holdtime(peer);
	break;
case EVNT_RCVD_UPDATE:
	start_timer_holdtime(peer);
	if (parse_update(peer))
		change_state(peer, STATE_IDLE, event);
	else
		start_timer_holdtime(peer);
	break;
case EVNT_RCVD_NOTIFICATION:
	parse_notification(peer);
	change_state(peer, STATE_IDLE, event);
	break;
default:
	session_notification(peer,
	    ERR_FSM, ERR_FSM_UNEX_ESTABLISHED, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, event);
	break;
}
break;
}
819}

821void
822start_timer_holdtime(struct peer *peer)
823{
if (peer->holdtime > 0)
timer_set(&peer->timers, Timer_Hold, peer->holdtime);
else
timer_stop(&peer->timers, Timer_Hold);
828}

830void
831start_timer_keepalive(struct peer *peer)
832{
if (peer->holdtime > 0)
timer_set(&peer->timers, Timer_Keepalive, peer->holdtime / 3);
else
timer_stop(&peer->timers, Timer_Keepalive);
837}

839void
840session_close_connection(struct peer *peer)
841{
if (peer->fd != -1) {
close(peer->fd);
pauseaccept = 0;
}
peer->fd = peer->wbuf.fd = -1;
847}

849void
850change_state(struct peer *peer, enum session_state state,
  enum session_events event)
852{
struct mrt	*mrt;

switch (state) {
case STATE_IDLE:
/* carp demotion first. new peers handled in init_peer */
if (peer->state == STATE_ESTABLISHED &&
    peer->conf.demote_group[0] && !peer->demoted)
	session_demote(peer, +1);

/*
 * try to write out what's buffered (maybe a notification),
 * don't bother if it fails
 */
if (peer->state >= STATE_OPENSENT && peer->wbuf.queued)
	msgbuf_write(&peer->wbuf);

/*
 * we must start the timer for the next EVNT_START
 * if we are coming here due to an error and the
 * session was not established successfully before, the
 * starttimerinterval needs to be exponentially increased
 */
if (peer->IdleHoldTime == 0)
	peer->IdleHoldTime = INTERVAL_IDLE_HOLD_INITIAL30;
peer->holdtime = INTERVAL_HOLD_INITIAL240;
timer_stop(&peer->timers, Timer_ConnectRetry);
timer_stop(&peer->timers, Timer_Keepalive);
timer_stop(&peer->timers, Timer_Hold);
timer_stop(&peer->timers, Timer_SendHold);
timer_stop(&peer->timers, Timer_IdleHold);
timer_stop(&peer->timers, Timer_IdleHoldReset);
session_close_connection(peer);
msgbuf_clear(&peer->wbuf);
free(peer->rbuf);
peer->rbuf = NULL((void *)0);
peer->rpending = 0;
memset(&peer->capa.peer, 0, sizeof(peer->capa.peer));
if (!peer->template)
	imsg_compose(ibuf_main, IMSG_PFKEY_RELOAD,
	    peer->conf.id, 0, -1, NULL((void *)0), 0);

if (event != EVNT_STOP) {
	timer_set(&peer->timers, Timer_IdleHold,
	    peer->IdleHoldTime);
	if (event != EVNT_NONE &&
	    peer->IdleHoldTime < MAX_IDLE_HOLD3600/2)
		peer->IdleHoldTime *= 2;
}
if (peer->state == STATE_ESTABLISHED) {
	if (peer->capa.neg.grestart.restart == 2 &&
	    (event == EVNT_CON_CLOSED ||
	    event == EVNT_CON_FATAL)) {
		/* don't punish graceful restart */
		timer_set(&peer->timers, Timer_IdleHold, 0);
		peer->IdleHoldTime /= 2;
		session_graceful_restart(peer);
	} else
		session_down(peer);
}
if (peer->state == STATE_NONE ||
    peer->state == STATE_ESTABLISHED) {
	/* initialize capability negotiation structures */
	memcpy(&peer->capa.ann, &peer->conf.capabilities,
	    sizeof(peer->capa.ann));
	if (!peer->conf.announce_capa)
		session_capa_ann_none(peer);
}
break;
case STATE_CONNECT:
if (peer->state == STATE_ESTABLISHED &&
    peer->capa.neg.grestart.restart == 2) {
	/* do the graceful restart dance */
	session_graceful_restart(peer);
	peer->holdtime = INTERVAL_HOLD_INITIAL240;
	timer_stop(&peer->timers, Timer_ConnectRetry);
	timer_stop(&peer->timers, Timer_Keepalive);
	timer_stop(&peer->timers, Timer_Hold);
	timer_stop(&peer->timers, Timer_SendHold);
	timer_stop(&peer->timers, Timer_IdleHold);
	timer_stop(&peer->timers, Timer_IdleHoldReset);
	session_close_connection(peer);
	msgbuf_clear(&peer->wbuf);
	memset(&peer->capa.peer, 0, sizeof(peer->capa.peer));
}
break;
case STATE_ACTIVE:
if (!peer->template)
	imsg_compose(ibuf_main, IMSG_PFKEY_RELOAD,
	    peer->conf.id, 0, -1, NULL((void *)0), 0);
break;
case STATE_OPENSENT:
break;
case STATE_OPENCONFIRM:
break;
case STATE_ESTABLISHED:
timer_set(&peer->timers, Timer_IdleHoldReset,
    peer->IdleHoldTime);
if (peer->demoted)
	timer_set(&peer->timers, Timer_CarpUndemote,
	    INTERVAL_HOLD_DEMOTED60);
session_up(peer);
break;
default:		/* something seriously fucked */
break;
}

log_statechange(peer, state, event);
LIST_FOREACH(mrt, &mrthead, entry)for((mrt) = ((&mrthead)->lh_first); (mrt)!= ((void *)0
); (mrt) = ((mrt)->entry.le_next)) {
if (!(mrt->type == MRT_ALL_IN || mrt->type == MRT_ALL_OUT))
	continue;
if ((mrt->peer_id == 0 && mrt->group_id == 0) ||
    mrt->peer_id == peer->conf.id || (mrt->group_id != 0 &&
    mrt->group_id == peer->conf.groupid))
	mrt_dump_state(mrt, peer->state, state, peer);
}
peer->prev_state = peer->state;
peer->state = state;
970}

972void
973session_accept(int listenfd)
974{
int			 connfd;
socklen_t		 len;
struct sockaddr_storage	 cliaddr;
struct peer		*p = NULL((void *)0);

len = sizeof(cliaddr);
if ((connfd = accept4(listenfd,
   (struct sockaddr *)&cliaddr, &len,
   SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000)) == -1) {
if (errno(*__errno()) == ENFILE23 || errno(*__errno()) == EMFILE24)
	pauseaccept = getmonotime();
else if (errno(*__errno()) != EWOULDBLOCK35 && errno(*__errno()) != EINTR4 &&
    errno(*__errno()) != ECONNABORTED53)
	log_warn("accept");
return;
}

p = getpeerbyip(conf, (struct sockaddr *)&cliaddr);

if (p != NULL((void *)0) && p->state == STATE_IDLE && p->errcnt < 2) {
if (timer_running(&p->timers, Timer_IdleHold, NULL((void *)0))) {
	/* fast reconnect after clear */
	p->passive = 1;
	bgp_fsm(p, EVNT_START);
}
}

if (p != NULL((void *)0) &&
   (p->state == STATE_CONNECT || p->state == STATE_ACTIVE)) {
if (p->fd != -1) {
	if (p->state == STATE_CONNECT)
		session_close_connection(p);
	else {
		close(connfd);
		return;
	}
}

1013open:
if (p->conf.auth.method != AUTH_NONE && sysdep.no_pfkey) {
	log_peer_warnx(&p->conf,
	    "ipsec or md5sig configured but not available");
	close(connfd);
	return;
}

if (tcp_md5_check(connfd, p) == -1) {
	close(connfd);
	return;
}
p->fd = p->wbuf.fd = connfd;
if (session_setup_socket(p)) {
	close(connfd);
	return;
}
bgp_fsm(p, EVNT_CON_OPEN);
return;
} else if (p != NULL((void *)0) && p->state == STATE_ESTABLISHED &&
   p->capa.neg.grestart.restart == 2) {
/* first do the graceful restart dance */
change_state(p, STATE_CONNECT, EVNT_CON_CLOSED);
/* then do part of the open dance */
goto open;
} else {
log_conn_attempt(p, (struct sockaddr *)&cliaddr, len);
close(connfd);
}
1042}

1044int
1045session_connect(struct peer *peer)
1046{
struct sockaddr		*sa;
struct bgpd_addr	*bind_addr = NULL((void *)0);
socklen_t		 sa_len;

/*
* we do not need the overcomplicated collision detection RFC 1771
* describes; we simply make sure there is only ever one concurrent
* tcp connection per peer.
*/
if (peer->fd != -1)
return (-1);

if ((peer->fd = socket(aid2af(peer->conf.remote_addr.aid),
   SOCK_STREAM1 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000, IPPROTO_TCP6)) == -1) {
log_peer_warn(&peer->conf, "session_connect socket");
bgp_fsm(peer, EVNT_CON_OPENFAIL);
return (-1);
}

if (peer->conf.auth.method != AUTH_NONE && sysdep.no_pfkey) {
log_peer_warnx(&peer->conf,
    "ipsec or md5sig configured but not available");
bgp_fsm(peer, EVNT_CON_OPENFAIL);
return (-1);
}

tcp_md5_set(peer->fd, peer);
peer->wbuf.fd = peer->fd;

/* if local-address is set we need to bind() */
switch (peer->conf.remote_addr.aid) {
case AID_INET1:
bind_addr = &peer->conf.local_addr_v4;
break;
case AID_INET62:
bind_addr = &peer->conf.local_addr_v6;
break;
}
if ((sa = addr2sa(bind_addr, 0, &sa_len)) != NULL((void *)0)) {
if (bind(peer->fd, sa, sa_len) == -1) {
	log_peer_warn(&peer->conf, "session_connect bind");
	bgp_fsm(peer, EVNT_CON_OPENFAIL);
	return (-1);
}
}

if (session_setup_socket(peer)) {
bgp_fsm(peer, EVNT_CON_OPENFAIL);
return (-1);
}

sa = addr2sa(&peer->conf.remote_addr, peer->conf.remote_port, &sa_len);
if (connect(peer->fd, sa, sa_len) == -1) {
if (errno(*__errno()) != EINPROGRESS36) {
	if (errno(*__errno()) != peer->lasterr)
		log_peer_warn(&peer->conf, "connect");
	peer->lasterr = errno(*__errno());
	bgp_fsm(peer, EVNT_CON_OPENFAIL);
	return (-1);
}
} else
bgp_fsm(peer, EVNT_CON_OPEN);

return (0);
1111}

1113int
1114session_setup_socket(struct peer *p)
1115{
int	ttl = p->conf.distance;
int	pre = IPTOS_PREC_INTERNETCONTROL0xc0;
int	nodelay = 1;
int	bsize;

switch (p->conf.remote_addr.aid) {
case AID_INET1:
/* set precedence, see RFC 1771 appendix 5 */
if (setsockopt(p->fd, IPPROTO_IP0, IP_TOS3, &pre, sizeof(pre)) ==
    -1) {
	log_peer_warn(&p->conf,
	    "session_setup_socket setsockopt TOS");
	return (-1);
}

if (p->conf.ebgp) {
	/*
	 * set TTL to foreign router's distance
	 * 1=direct n=multihop with ttlsec, we always use 255
	 */
	if (p->conf.ttlsec) {
		ttl = 256 - p->conf.distance;
		if (setsockopt(p->fd, IPPROTO_IP0, IP_MINTTL32,
		    &ttl, sizeof(ttl)) == -1) {
			log_peer_warn(&p->conf,
			    "session_setup_socket: "
			    "setsockopt MINTTL");
			return (-1);
		}
		ttl = 255;
	}

	if (setsockopt(p->fd, IPPROTO_IP0, IP_TTL4, &ttl,
	    sizeof(ttl)) == -1) {
		log_peer_warn(&p->conf,
		    "session_setup_socket setsockopt TTL");
		return (-1);
	}
}
break;
case AID_INET62:
if (p->conf.ebgp) {
	/*
	 * set hoplimit to foreign router's distance
	 * 1=direct n=multihop with ttlsec, we always use 255
	 */
	if (p->conf.ttlsec) {
		ttl = 256 - p->conf.distance;
		if (setsockopt(p->fd, IPPROTO_IPV641,
		    IPV6_MINHOPCOUNT65, &ttl, sizeof(ttl))
		    == -1) {
			log_peer_warn(&p->conf,
			    "session_setup_socket: "
			    "setsockopt MINHOPCOUNT");
			return (-1);
		}
		ttl = 255;
	}
	if (setsockopt(p->fd, IPPROTO_IPV641, IPV6_UNICAST_HOPS4,
	    &ttl, sizeof(ttl)) == -1) {
		log_peer_warn(&p->conf,
		    "session_setup_socket setsockopt hoplimit");
		return (-1);
	}
}
break;
}

/* set TCP_NODELAY */
if (setsockopt(p->fd, IPPROTO_TCP6, TCP_NODELAY0x01, &nodelay,
   sizeof(nodelay)) == -1) {
log_peer_warn(&p->conf,
    "session_setup_socket setsockopt TCP_NODELAY");
return (-1);
}

/* limit bufsize. no biggie if it fails */
bsize = 65535;
while (bsize > 8192 && setsockopt(p->fd, SOL_SOCKET0xffff, SO_RCVBUF0x1002,
   &bsize, sizeof(bsize)) == -1 && errno(*__errno()) != EINVAL22)
bsize /= 2;
bsize = 65535;
while (bsize > 8192 && setsockopt(p->fd, SOL_SOCKET0xffff, SO_SNDBUF0x1001,
   &bsize, sizeof(bsize)) == -1 && errno(*__errno()) != EINVAL22)
bsize /= 2;

return (0);
1203}

1205/*
* compare the bgpd_addr with the sockaddr by converting the latter into
* a bgpd_addr. Return true if the two are equal, including any scope
*/
1209static int
1210sa_equal(struct bgpd_addr *ba, struct sockaddr *b)
1211{
struct bgpd_addr bb;

sa2addr(b, &bb, NULL((void *)0));
return (memcmp(ba, &bb, sizeof(*ba)) == 0);
1216}

1218static void
1219get_alternate_addr(struct bgpd_addr *local, struct bgpd_addr *remote,
  struct bgpd_addr *alt, unsigned int *scope)
1221{
struct ifaddrs	*ifap, *ifa, *match;
int connected = 0;
u_int8_t plen;

if (getifaddrs(&ifap) == -1)
fatal("getifaddrs");

for (match = ifap; match != NULL((void *)0); match = match->ifa_next) {
if (match->ifa_addr == NULL((void *)0))
	continue;
if (match->ifa_addr->sa_family != AF_INET2 &&
    match->ifa_addr->sa_family != AF_INET624)
	continue;
if (sa_equal(local, match->ifa_addr)) {
	if (match->ifa_flags & IFF_POINTOPOINT0x10 &&
	    match->ifa_dstaddr) {
		if (sa_equal(remote, match->ifa_dstaddr))
			connected = 1;
	} else if (match->ifa_netmask) {
		plen = mask2prefixlen(
		    match->ifa_addr->sa_family,
		    match->ifa_netmask);
		if (prefix_compare(local, remote, plen) == 0)
			connected = 1;
	}
	break;
}
}

if (match == NULL((void *)0)) {
log_warnx("%s: local address not found", __func__);
return;
}
if (connected)
*scope = if_nametoindex(match->ifa_name);
else
*scope = 0;

switch (local->aid) {
case AID_INET62:
for (ifa = ifap; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
	if (ifa->ifa_addr != NULL((void *)0) &&
	    ifa->ifa_addr->sa_family == AF_INET2 &&
	    strcmp(ifa->ifa_name, match->ifa_name) == 0) {
		sa2addr(ifa->ifa_addr, alt, NULL((void *)0));
		break;
	}
}
break;
case AID_INET1:
for (ifa = ifap; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
	if (ifa->ifa_addr != NULL((void *)0) &&
	    ifa->ifa_addr->sa_family == AF_INET624 &&
	    strcmp(ifa->ifa_name, match->ifa_name) == 0) {
		struct sockaddr_in6 *s =
		    (struct sockaddr_in6 *)ifa->ifa_addr;

		/* only accept global scope addresses */
		if (IN6_IS_ADDR_LINKLOCAL(&s->sin6_addr)(((&s->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe)
 && (((&s->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)) ||
		    IN6_IS_ADDR_SITELOCAL(&s->sin6_addr)(((&s->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe)
 && (((&s->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0xc0)))
			continue;
		sa2addr(ifa->ifa_addr, alt, NULL((void *)0));
		break;
	}
}
break;
default:
log_warnx("%s: unsupported address family %s", __func__,
    aid2str(local->aid));
break;
}

freeifaddrs(ifap);
1295}

1297void
1298session_tcp_established(struct peer *peer)
1299{
struct sockaddr_storage	ss;
socklen_t		len;

len = sizeof(ss);
if (getsockname(peer->fd, (struct sockaddr *)&ss, &len) == -1)
log_warn("getsockname");
sa2addr((struct sockaddr *)&ss, &peer->local, &peer->local_port);
len = sizeof(ss);
if (getpeername(peer->fd, (struct sockaddr *)&ss, &len) == -1)
log_warn("getpeername");
sa2addr((struct sockaddr *)&ss, &peer->remote, &peer->remote_port);

get_alternate_addr(&peer->local, &peer->remote, &peer->local_alt,
   &peer->if_scope);
1314}

1316void
1317session_capa_ann_none(struct peer *peer)
1318{
memset(&peer->capa.ann, 0, sizeof(peer->capa.ann));
1320}

1322int
1323session_capa_add(struct ibuf *opb, uint8_t capa_code, uint8_t capa_len)
1324{
int errs = 0;

errs += ibuf_add_n8(opb, capa_code);
errs += ibuf_add_n8(opb, capa_len);
return (errs);
1330}

1332int
1333session_capa_add_mp(struct ibuf *buf, uint8_t aid)
1334{
uint16_t		 afi;
uint8_t			 safi;
int			 errs = 0;

if (aid2afi(aid, &afi, &safi) == -1) {
log_warn("%s: bad AID", __func__);
return (-1);
}

errs += ibuf_add_n16(buf, afi);
errs += ibuf_add_zero(buf, 1);
errs += ibuf_add_n8(buf, safi);

return (errs);
1349}

1351int
1352session_capa_add_afi(struct peer *p, struct ibuf *b, uint8_t aid,
  uint8_t flags)
1354{
u_int		errs = 0;
uint16_t	afi;
uint8_t		safi;

if (aid2afi(aid, &afi, &safi)) {
log_warn("%s: bad AID", __func__);
return (-1);
}

errs += ibuf_add_n16(b, afi);
errs += ibuf_add_n8(b, safi);
errs += ibuf_add_n8(b, flags);

return (errs);
1369}

1371struct bgp_msg *
1372session_newmsg(enum msg_type msgtype, uint16_t len)
1373{
u_char			 marker[MSGSIZE_HEADER_MARKER16];
struct bgp_msg		*msg;
struct ibuf		*buf;
int			 errs = 0;

memset(marker, 0xff, sizeof(marker));

if ((buf = ibuf_open(len)) == NULL((void *)0))
return (NULL((void *)0));

errs += ibuf_add(buf, marker, sizeof(marker));
errs += ibuf_add_n16(buf, len);
errs += ibuf_add_n8(buf, msgtype);

if (errs || (msg = calloc(1, sizeof(*msg))) == NULL((void *)0)) {
ibuf_free(buf);
return (NULL((void *)0));
}

msg->buf = buf;
msg->type = msgtype;
msg->len = len;

return (msg);
1398}

1400int
1401session_sendmsg(struct bgp_msg *msg, struct peer *p)
1402{
struct mrt		*mrt;

LIST_FOREACH(mrt, &mrthead, entry)for((mrt) = ((&mrthead)->lh_first); (mrt)!= ((void *)0
); (mrt) = ((mrt)->entry.le_next)) {
if (!(mrt->type == MRT_ALL_OUT || (msg->type == UPDATE &&
    mrt->type == MRT_UPDATE_OUT)))
	continue;
if ((mrt->peer_id == 0 && mrt->group_id == 0) ||
    mrt->peer_id == p->conf.id || (mrt->group_id != 0 &&
    mrt->group_id == p->conf.groupid))
	mrt_dump_bgp_msg(mrt, ibuf_data(msg->buf), msg->len, p,
	    msg->type);
}

ibuf_close(&p->wbuf, msg->buf);
if (!p->throttled && p->wbuf.queued > SESS_MSG_HIGH_MARK2000) {
if (imsg_rde(IMSG_XOFF, p->conf.id, NULL((void *)0), 0) == -1)
	log_peer_warn(&p->conf, "imsg_compose XOFF");
else
	p->throttled = 1;
}

free(msg);
return (0);
1426}

1428/*
* Translate between internal roles and the value expected by RFC 9234.
*/
1431static uint8_t
1432role2capa(enum role role)
1433{
switch (role) {
case ROLE_CUSTOMER:
return CAPA_ROLE_CUSTOMER0x03;
case ROLE_PROVIDER:
return CAPA_ROLE_PROVIDER0x00;
case ROLE_RS:
return CAPA_ROLE_RS0x01;
case ROLE_RS_CLIENT:
return CAPA_ROLE_RS_CLIENT0x02;
case ROLE_PEER:
return CAPA_ROLE_PEER0x04;
default:
fatalx("Unsupported role for role capability");
}
1448}

1450static enum role
1451capa2role(uint8_t val)
1452{
switch (val) {
case CAPA_ROLE_PROVIDER0x00:
return ROLE_PROVIDER;
case CAPA_ROLE_RS0x01:
return ROLE_RS;
case CAPA_ROLE_RS_CLIENT0x02:
return ROLE_RS_CLIENT;
case CAPA_ROLE_CUSTOMER0x03:
return ROLE_CUSTOMER;
case CAPA_ROLE_PEER0x04:
return ROLE_PEER;
default:
return ROLE_NONE;
}
1467}

1469void
1470session_open(struct peer *p)
1471{
struct bgp_msg		*buf;
struct ibuf		*opb;
size_t			 len, optparamlen;
uint16_t		 holdtime;
uint8_t			 i;
int			 errs = 0, extlen = 0;
int			 mpcapa = 0;


if ((opb = ibuf_dynamic(0, UINT16_MAX0xffff - 3)) == NULL((void *)0)) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

/* multiprotocol extensions, RFC 4760 */
for (i = 0; i < AID_MAX7; i++)
if (p->capa.ann.mp[i]) {	/* 4 bytes data */
	errs += session_capa_add(opb, CAPA_MP, 4);
	errs += session_capa_add_mp(opb, i);
	mpcapa++;
}

/* route refresh, RFC 2918 */
if (p->capa.ann.refresh)	/* no data */
errs += session_capa_add(opb, CAPA_REFRESH, 0);

/* BGP open policy, RFC 9234, only for ebgp sessions */
if (p->conf.ebgp && p->capa.ann.policy &&
   p->conf.role != ROLE_NONE &&
   (p->capa.ann.mp[AID_INET1] || p->capa.ann.mp[AID_INET62] ||
   mpcapa == 0)) {
errs += session_capa_add(opb, CAPA_ROLE, 1);
errs += ibuf_add_n8(opb, role2capa(p->conf.role));
}

/* graceful restart and End-of-RIB marker, RFC 4724 */
if (p->capa.ann.grestart.restart) {
int		rst = 0;
uint16_t	hdr = 0;

for (i = 0; i < AID_MAX7; i++) {
	if (p->capa.neg.grestart.flags[i] & CAPA_GR_RESTARTING0x08)
		rst++;
}

/* Only set the R-flag if no graceful restart is ongoing */
if (!rst)
	hdr |= CAPA_GR_R_FLAG0x8000;
errs += session_capa_add(opb, CAPA_RESTART, sizeof(hdr));
errs += ibuf_add_n16(opb, hdr);
}

/* 4-bytes AS numbers, RFC6793 */
if (p->capa.ann.as4byte) {	/* 4 bytes data */
errs += session_capa_add(opb, CAPA_AS4BYTE, sizeof(uint32_t));
errs += ibuf_add_n32(opb, p->conf.local_as);
}

/* advertisement of multiple paths, RFC7911 */
if (p->capa.ann.add_path[0]) {	/* variable */
uint8_t	aplen;

if (mpcapa)
	aplen = 4 * mpcapa;
else	/* AID_INET */
	aplen = 4;
errs += session_capa_add(opb, CAPA_ADD_PATH, aplen);
if (mpcapa) {
	for (i = AID_MIN1; i < AID_MAX7; i++) {
		if (p->capa.ann.mp[i]) {
			errs += session_capa_add_afi(p, opb,
			    i, p->capa.ann.add_path[i]);
		}
	}
} else {	/* AID_INET */
	errs += session_capa_add_afi(p, opb, AID_INET1,
	    p->capa.ann.add_path[AID_INET1]);
}
}

/* enhanced route-refresh, RFC7313 */
if (p->capa.ann.enhanced_rr)	/* no data */
errs += session_capa_add(opb, CAPA_ENHANCED_RR, 0);

if (errs) {
ibuf_free(opb);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

optparamlen = ibuf_size(opb);
len = MSGSIZE_OPEN_MIN29 + optparamlen;
if (optparamlen == 0) {
/* nothing */
} else if (optparamlen + 2 >= 255) {
/* RFC9072: use 255 as magic size and request extra header */
optparamlen = 255;
extlen = 1;
/* 3 byte OPT_PARAM_EXT_LEN and OPT_PARAM_CAPABILITIES */
len += 2 * 3;
} else {
/* regular capabilities header */
optparamlen += 2;
len += 2;
}

if ((buf = session_newmsg(OPEN, len)) == NULL((void *)0)) {
ibuf_free(opb);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (p->conf.holdtime)
holdtime = p->conf.holdtime;
else
holdtime = conf->holdtime;

errs += ibuf_add_n8(buf->buf, 4);
errs += ibuf_add_n16(buf->buf, p->conf.local_short_as);
errs += ibuf_add_n16(buf->buf, holdtime);
/* is already in network byte order */
errs += ibuf_add(buf->buf, &conf->bgpid, sizeof(conf->bgpid));
errs += ibuf_add_n8(buf->buf, optparamlen);

if (extlen) {
/* RFC9072 extra header which spans over the capabilities hdr */
errs += ibuf_add_n8(buf->buf, OPT_PARAM_EXT_LEN);
errs += ibuf_add_n16(buf->buf, ibuf_size(opb) + 1 + 2);
}

if (optparamlen) {
errs += ibuf_add_n8(buf->buf, OPT_PARAM_CAPABILITIES);

if (extlen) {
	/* RFC9072: 2-byte extended length */
	errs += ibuf_add_n16(buf->buf, ibuf_size(opb));
} else {
	errs += ibuf_add_n8(buf->buf, ibuf_size(opb));
}
errs += ibuf_add_buf(buf->buf, opb);
}

ibuf_free(opb);

if (errs) {
ibuf_free(buf->buf);
free(buf);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (session_sendmsg(buf, p) == -1) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

p->stats.msg_sent_open++;
1629}

1631void
1632session_keepalive(struct peer *p)
1633{
struct bgp_msg		*buf;

if ((buf = session_newmsg(KEEPALIVE, MSGSIZE_KEEPALIVE19)) == NULL((void *)0) ||
   session_sendmsg(buf, p) == -1) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

start_timer_keepalive(p);
p->stats.msg_sent_keepalive++;
1644}

1646void
1647session_update(uint32_t peerid, void *data, size_t datalen)
1648{
struct peer		*p;
struct bgp_msg		*buf;

if ((p = getpeerbyid(conf, peerid)) == NULL((void *)0)) {
log_warnx("no such peer: id=%u", peerid);
return;
}

if (p->state != STATE_ESTABLISHED)
return;

if ((buf = session_newmsg(UPDATE, MSGSIZE_HEADER19 + datalen)) == NULL((void *)0)) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (ibuf_add(buf->buf, data, datalen)) {
ibuf_free(buf->buf);
free(buf);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (session_sendmsg(buf, p) == -1) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

start_timer_keepalive(p);
p->stats.msg_sent_update++;
1679}

1681void
1682session_notification(struct peer *p, uint8_t errcode, uint8_t subcode,
  void *data, ssize_t datalen)
1684{
struct bgp_msg		*buf;
int			 errs = 0;

if (p->stats.last_sent_errcode)	/* some notification already sent */
return;

log_notification(p, errcode, subcode, data, datalen, "sending");

/* cap to maximum size */
if (datalen > MAX_PKTSIZE4096 - MSGSIZE_NOTIFICATION_MIN21) {
log_peer_warnx(&p->conf,
    "oversized notification, data trunkated");
datalen = MAX_PKTSIZE4096 - MSGSIZE_NOTIFICATION_MIN21;
}

if ((buf = session_newmsg(NOTIFICATION,
   MSGSIZE_NOTIFICATION_MIN21 + datalen)) == NULL((void *)0)) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

errs += ibuf_add_n8(buf->buf, errcode);
errs += ibuf_add_n8(buf->buf, subcode);

if (datalen > 0)
errs += ibuf_add(buf->buf, data, datalen);

if (errs) {
ibuf_free(buf->buf);
free(buf);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (session_sendmsg(buf, p) == -1) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

p->stats.msg_sent_notification++;
p->stats.last_sent_errcode = errcode;
p->stats.last_sent_suberr = subcode;
1727}

1729int
1730session_neighbor_rrefresh(struct peer *p)
1731{
uint8_t	i;

if (!(p->capa.neg.refresh || p->capa.neg.enhanced_rr))
return (-1);

for (i = 0; i < AID_MAX7; i++) {
if (p->capa.neg.mp[i] != 0)
	session_rrefresh(p, i, ROUTE_REFRESH_REQUEST0);
}

return (0);
1743}

1745void
1746session_rrefresh(struct peer *p, uint8_t aid, uint8_t subtype)
1747{
struct bgp_msg		*buf;
int			 errs = 0;
uint16_t		 afi;
uint8_t			 safi;

switch (subtype) {
case ROUTE_REFRESH_REQUEST0:
p->stats.refresh_sent_req++;
break;
case ROUTE_REFRESH_BEGIN_RR1:
case ROUTE_REFRESH_END_RR2:
/* requires enhanced route refresh */
if (!p->capa.neg.enhanced_rr)
	return;
if (subtype == ROUTE_REFRESH_BEGIN_RR1)
	p->stats.refresh_sent_borr++;
else
	p->stats.refresh_sent_eorr++;
break;
default:
fatalx("session_rrefresh: bad subtype %d", subtype);
}

if (aid2afi(aid, &afi, &safi) == -1)
fatalx("session_rrefresh: bad afi/safi pair");

if ((buf = session_newmsg(RREFRESH, MSGSIZE_RREFRESH(19 + 4))) == NULL((void *)0)) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

errs += ibuf_add_n16(buf->buf, afi);
errs += ibuf_add_n8(buf->buf, subtype);
errs += ibuf_add_n8(buf->buf, safi);

if (errs) {
ibuf_free(buf->buf);
free(buf);
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

if (session_sendmsg(buf, p) == -1) {
bgp_fsm(p, EVNT_CON_FATAL);
return;
}

p->stats.msg_sent_rrefresh++;
1796}

1798int
1799session_graceful_restart(struct peer *p)
1800{
uint8_t	i;

timer_set(&p->timers, Timer_RestartTimeout,
   p->capa.neg.grestart.timeout);

for (i = 0; i < AID_MAX7; i++) {
if (p->capa.neg.grestart.flags[i] & CAPA_GR_PRESENT0x01) {
	if (imsg_rde(IMSG_SESSION_STALE, p->conf.id,
	    &i, sizeof(i)) == -1)
		return (-1);
	log_peer_warnx(&p->conf,
	    "graceful restart of %s, keeping routes",
	    aid2str(i));
	p->capa.neg.grestart.flags[i] |= CAPA_GR_RESTARTING0x08;
} else if (p->capa.neg.mp[i]) {
	if (imsg_rde(IMSG_SESSION_NOGRACE, p->conf.id,
	    &i, sizeof(i)) == -1)
		return (-1);
	log_peer_warnx(&p->conf,
	    "graceful restart of %s, flushing routes",
	    aid2str(i));
}
}
return (0);
1825}

1827int
1828session_graceful_stop(struct peer *p)
1829{
uint8_t	i;

for (i = 0; i < AID_MAX7; i++) {
/*
 * Only flush if the peer is restarting and the timeout fired.
 * In all other cases the session was already flushed when the
 * session went down or when the new open message was parsed.
 */
if (p->capa.neg.grestart.flags[i] & CAPA_GR_RESTARTING0x08) {
	log_peer_warnx(&p->conf, "graceful restart of %s, "
	    "time-out, flushing", aid2str(i));
	if (imsg_rde(IMSG_SESSION_FLUSH, p->conf.id,
	    &i, sizeof(i)) == -1)
		return (-1);
}
p->capa.neg.grestart.flags[i] &= ~CAPA_GR_RESTARTING0x08;
}
return (0);
1848}

1850int
1851session_dispatch_msg(struct pollfd *pfd, struct peer *p)
1852{
ssize_t		n;
socklen_t	len;
int		error;

if (p->state == STATE_CONNECT) {
if (pfd->revents & POLLOUT0x0004) {
	if (pfd->revents & POLLIN0x0001) {
		/* error occurred */
		len = sizeof(error);
		if (getsockopt(pfd->fd, SOL_SOCKET0xffff, SO_ERROR0x1007,
		    &error, &len) == -1 || error) {
			if (error)
				errno(*__errno()) = error;
			if (errno(*__errno()) != p->lasterr) {
				log_peer_warn(&p->conf,
				    "socket error");
				p->lasterr = errno(*__errno());
			}
			bgp_fsm(p, EVNT_CON_OPENFAIL);
			return (1);
		}
	}
	bgp_fsm(p, EVNT_CON_OPEN);
	return (1);
}
if (pfd->revents & POLLHUP0x0010) {
	bgp_fsm(p, EVNT_CON_OPENFAIL);
	return (1);
}
if (pfd->revents & (POLLERR0x0008|POLLNVAL0x0020)) {
	bgp_fsm(p, EVNT_CON_FATAL);
	return (1);
}
return (0);
}

if (pfd->revents & POLLHUP0x0010) {
bgp_fsm(p, EVNT_CON_CLOSED);
return (1);
}
if (pfd->revents & (POLLERR0x0008|POLLNVAL0x0020)) {
bgp_fsm(p, EVNT_CON_FATAL);
return (1);
}

if (pfd->revents & POLLOUT0x0004 && p->wbuf.queued) {
if ((error = msgbuf_write(&p->wbuf)) <= 0 && errno(*__errno()) != EAGAIN35) {
	if (error == 0)
		log_peer_warnx(&p->conf, "Connection closed");
	else if (error == -1)
		log_peer_warn(&p->conf, "write error");
	bgp_fsm(p, EVNT_CON_FATAL);
	return (1);
}
p->stats.last_write = getmonotime();
if (p->holdtime > 0)
	timer_set(&p->timers, Timer_SendHold,
	    p->holdtime < INTERVAL_HOLD90 ? INTERVAL_HOLD90 :
	    p->holdtime);
if (p->throttled && p->wbuf.queued < SESS_MSG_LOW_MARK500) {
	if (imsg_rde(IMSG_XON, p->conf.id, NULL((void *)0), 0) == -1)
		log_peer_warn(&p->conf, "imsg_compose XON");
	else
		p->throttled = 0;
}
if (!(pfd->revents & POLLIN0x0001))
	return (1);
}

if (p->rbuf && pfd->revents & POLLIN0x0001) {
if ((n = read(p->fd, p->rbuf->buf + p->rbuf->wpos,
    sizeof(p->rbuf->buf) - p->rbuf->wpos)) == -1) {
	if (errno(*__errno()) != EINTR4 && errno(*__errno()) != EAGAIN35) {
		log_peer_warn(&p->conf, "read error");
		bgp_fsm(p, EVNT_CON_FATAL);
	}
	return (1);
}
if (n == 0) {	/* connection closed */
	bgp_fsm(p, EVNT_CON_CLOSED);
	return (1);
}

p->rbuf->wpos += n;
p->stats.last_read = getmonotime();
return (1);
}
return (0);
1941}

1943void
1944session_process_msg(struct peer *p)
1945{
struct mrt	*mrt;
ssize_t		rpos, av, left;
int		processed = 0;
uint16_t	msglen;
uint8_t		msgtype;

rpos = 0;
av = p->rbuf->wpos;
p->rpending = 0;

/*
* session might drop to IDLE -> buffers deallocated
* we MUST check rbuf != NULL before use
*/
for (;;) {
if (p->rbuf == NULL((void *)0))
	return;
if (rpos + MSGSIZE_HEADER19 > av)
	break;
if (parse_header(p, p->rbuf->buf + rpos, &msglen,
    &msgtype) == -1)
	return;
if (rpos + msglen > av)
	break;
p->rbuf->rptr = p->rbuf->buf + rpos;

/* dump to MRT as soon as we have a full packet */
LIST_FOREACH(mrt, &mrthead, entry)for((mrt) = ((&mrthead)->lh_first); (mrt)!= ((void *)0
); (mrt) = ((mrt)->entry.le_next)) {
	if (!(mrt->type == MRT_ALL_IN || (msgtype == UPDATE &&
	    mrt->type == MRT_UPDATE_IN)))
		continue;
	if ((mrt->peer_id == 0 && mrt->group_id == 0) ||
	    mrt->peer_id == p->conf.id || (mrt->group_id != 0 &&
	    mrt->group_id == p->conf.groupid))
		mrt_dump_bgp_msg(mrt, p->rbuf->rptr, msglen, p,
		    msgtype);
}

switch (msgtype) {
case OPEN:
	bgp_fsm(p, EVNT_RCVD_OPEN);
	p->stats.msg_rcvd_open++;
	break;
case UPDATE:
	bgp_fsm(p, EVNT_RCVD_UPDATE);
	p->stats.msg_rcvd_update++;
	break;
case NOTIFICATION:
	bgp_fsm(p, EVNT_RCVD_NOTIFICATION);
	p->stats.msg_rcvd_notification++;
	break;
case KEEPALIVE:
	bgp_fsm(p, EVNT_RCVD_KEEPALIVE);
	p->stats.msg_rcvd_keepalive++;
	break;
case RREFRESH:
	parse_rrefresh(p);
	p->stats.msg_rcvd_rrefresh++;
	break;
default:	/* cannot happen */
	session_notification(p, ERR_HEADER, ERR_HDR_TYPE,
	    &msgtype, 1);
	log_warnx("received message with unknown type %u",
	    msgtype);
	bgp_fsm(p, EVNT_CON_FATAL);
}
rpos += msglen;
if (++processed > MSG_PROCESS_LIMIT25) {
	p->rpending = 1;
	break;
}
}

if (p->rbuf == NULL((void *)0))
return;
if (rpos < av) {
left = av - rpos;
memmove(&p->rbuf->buf, p->rbuf->buf + rpos, left);
p->rbuf->wpos = left;
} else
p->rbuf->wpos = 0;
2027}

2029int
2030parse_header(struct peer *peer, u_char *data, uint16_t *len, uint8_t *type)
2031{
u_char			*p;
uint16_t		 olen;
static const uint8_t	 marker[MSGSIZE_HEADER_MARKER16] = { 0xff, 0xff,
		    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };

/* caller MUST make sure we are getting 19 bytes! */
p = data;
if (memcmp(p, marker, sizeof(marker))) {
log_peer_warnx(&peer->conf, "sync error");
session_notification(peer, ERR_HEADER, ERR_HDR_SYNC, NULL((void *)0), 0);
bgp_fsm(peer, EVNT_CON_FATAL);
return (-1);
}
p += MSGSIZE_HEADER_MARKER16;

memcpy(&olen, p, 2);
*len = ntohs(olen)(__uint16_t)(__builtin_constant_p(olen) ? (__uint16_t)(((__uint16_t
)(olen) & 0xffU) << 8 | ((__uint16_t)(olen) & 0xff00U
) >> 8) : __swap16md(olen));
p += 2;
memcpy(type, p, 1);

if (*len < MSGSIZE_HEADER19 || *len > MAX_PKTSIZE4096) {
log_peer_warnx(&peer->conf,
    "received message: illegal length: %u byte", *len);
session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
    &olen, sizeof(olen));
bgp_fsm(peer, EVNT_CON_FATAL);
return (-1);
}

switch (*type) {
case OPEN:
if (*len < MSGSIZE_OPEN_MIN29) {
	log_peer_warnx(&peer->conf,
	    "received OPEN: illegal len: %u byte", *len);
	session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
	    &olen, sizeof(olen));
	bgp_fsm(peer, EVNT_CON_FATAL);
	return (-1);
}
break;
case NOTIFICATION:
if (*len < MSGSIZE_NOTIFICATION_MIN21) {
	log_peer_warnx(&peer->conf,
	    "received NOTIFICATION: illegal len: %u byte",
	    *len);
	session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
	    &olen, sizeof(olen));
	bgp_fsm(peer, EVNT_CON_FATAL);
	return (-1);
}
break;
case UPDATE:
if (*len < MSGSIZE_UPDATE_MIN23) {
	log_peer_warnx(&peer->conf,
	    "received UPDATE: illegal len: %u byte", *len);
	session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
	    &olen, sizeof(olen));
	bgp_fsm(peer, EVNT_CON_FATAL);
	return (-1);
}
break;
case KEEPALIVE:
if (*len != MSGSIZE_KEEPALIVE19) {
	log_peer_warnx(&peer->conf,
	    "received KEEPALIVE: illegal len: %u byte", *len);
	session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
	    &olen, sizeof(olen));
	bgp_fsm(peer, EVNT_CON_FATAL);
	return (-1);
}
break;
case RREFRESH:
if (*len < MSGSIZE_RREFRESH_MIN(19 + 4)) {
	log_peer_warnx(&peer->conf,
	    "received RREFRESH: illegal len: %u byte", *len);
	session_notification(peer, ERR_HEADER, ERR_HDR_LEN,
	    &olen, sizeof(olen));
	bgp_fsm(peer, EVNT_CON_FATAL);
	return (-1);
}
break;
default:
log_peer_warnx(&peer->conf,
    "received msg with unknown type %u", *type);
session_notification(peer, ERR_HEADER, ERR_HDR_TYPE,
    type, 1);
bgp_fsm(peer, EVNT_CON_FATAL);
return (-1);
}
return (0);
2123}

2125int
2126parse_open(struct peer *peer)
2127{
u_char		*p, *op_val;
uint8_t		 version, rversion;
uint16_t	 short_as, msglen;
uint16_t	 holdtime, oholdtime, myholdtime;
uint32_t	 as, bgpid;
uint16_t	 optparamlen, extlen, plen, op_len;
uint8_t		 op_type, suberr = 0;

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER_MARKER16;
memcpy(&msglen, p, sizeof(msglen));
msglen = ntohs(msglen)(__uint16_t)(__builtin_constant_p(msglen) ? (__uint16_t)(((__uint16_t
)(msglen) & 0xffU) << 8 | ((__uint16_t)(msglen) &
 0xff00U) >> 8) : __swap16md(msglen));

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER19;	/* header is already checked */

memcpy(&version, p, sizeof(version));
p += sizeof(version);

if (version != BGP_VERSION4) {
log_peer_warnx(&peer->conf,
    "peer wants unrecognized version %u", version);
if (version > BGP_VERSION4)
	rversion = version - BGP_VERSION4;
else
	rversion = BGP_VERSION4;
session_notification(peer, ERR_OPEN, ERR_OPEN_VERSION,
    &rversion, sizeof(rversion));
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

memcpy(&short_as, p, sizeof(short_as));
p += sizeof(short_as);
as = peer->short_as = ntohs(short_as)(__uint16_t)(__builtin_constant_p(short_as) ? (__uint16_t)(((
__uint16_t)(short_as) & 0xffU) << 8 | ((__uint16_t)
(short_as) & 0xff00U) >> 8) : __swap16md(short_as));
if (as == 0) {
log_peer_warnx(&peer->conf,
    "peer requests unacceptable AS %u", as);
session_notification(peer, ERR_OPEN, ERR_OPEN_AS,
    NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

memcpy(&oholdtime, p, sizeof(oholdtime));
p += sizeof(oholdtime);

holdtime = ntohs(oholdtime)(__uint16_t)(__builtin_constant_p(oholdtime) ? (__uint16_t)((
(__uint16_t)(oholdtime) & 0xffU) << 8 | ((__uint16_t
)(oholdtime) & 0xff00U) >> 8) : __swap16md(oholdtime
));
if (holdtime && holdtime < peer->conf.min_holdtime) {
log_peer_warnx(&peer->conf,
    "peer requests unacceptable holdtime %u", holdtime);
session_notification(peer, ERR_OPEN, ERR_OPEN_HOLDTIME,
    NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

myholdtime = peer->conf.holdtime;
if (!myholdtime)
myholdtime = conf->holdtime;
if (holdtime < myholdtime)
peer->holdtime = holdtime;
else
peer->holdtime = myholdtime;

memcpy(&bgpid, p, sizeof(bgpid));
p += sizeof(bgpid);

/* check bgpid for validity - just disallow 0 */
if (ntohl(bgpid)(__uint32_t)(__builtin_constant_p(bgpid) ? (__uint32_t)(((__uint32_t
)(bgpid) & 0xff) << 24 | ((__uint32_t)(bgpid) &
 0xff00) << 8 | ((__uint32_t)(bgpid) & 0xff0000) >>
| ((__uint32_t)(bgpid) & 0xff000000) >> 24) : __swap32md
(bgpid)) == 0) {
log_peer_warnx(&peer->conf, "peer BGPID %u unacceptable",
    ntohl(bgpid)(__uint32_t)(__builtin_constant_p(bgpid) ? (__uint32_t)(((__uint32_t
)(bgpid) & 0xff) << 24 | ((__uint32_t)(bgpid) &
 0xff00) << 8 | ((__uint32_t)(bgpid) & 0xff0000) >>
| ((__uint32_t)(bgpid) & 0xff000000) >> 24) : __swap32md
(bgpid)));
session_notification(peer, ERR_OPEN, ERR_OPEN_BGPID,
    NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}
peer->remote_bgpid = bgpid;

extlen = 0;
optparamlen = *p++;

if (optparamlen == 0) {
if (msglen != MSGSIZE_OPEN_MIN29) {
2212bad_len:
	log_peer_warnx(&peer->conf,
	    "corrupt OPEN message received: length mismatch");
	session_notification(peer, ERR_OPEN, 0, NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
	return (-1);
}
} else {
if (msglen < MSGSIZE_OPEN_MIN29 + 1)
	goto bad_len;

op_type = *p;
if (op_type == OPT_PARAM_EXT_LEN) {
	p++;
	memcpy(&optparamlen, p, sizeof(optparamlen));
	optparamlen = ntohs(optparamlen)(__uint16_t)(__builtin_constant_p(optparamlen) ? (__uint16_t)
(((__uint16_t)(optparamlen) & 0xffU) << 8 | ((__uint16_t
)(optparamlen) & 0xff00U) >> 8) : __swap16md(optparamlen
));
	p += sizeof(optparamlen);
	extlen = 1;
}

/* RFC9020 encoding has 3 extra bytes */
if (optparamlen + 3 * extlen != msglen - MSGSIZE_OPEN_MIN29)
	goto bad_len;
}

plen = optparamlen;
while (plen > 0) {
if (plen < 2 + extlen)
	goto bad_len;

memcpy(&op_type, p, sizeof(op_type));
p += sizeof(op_type);
plen -= sizeof(op_type);
if (!extlen) {
	op_len = *p++;
	plen--;
} else {
	memcpy(&op_len, p, sizeof(op_len));
	op_len = ntohs(op_len)(__uint16_t)(__builtin_constant_p(op_len) ? (__uint16_t)(((__uint16_t
)(op_len) & 0xffU) << 8 | ((__uint16_t)(op_len) &
 0xff00U) >> 8) : __swap16md(op_len));
	p += sizeof(op_len);
	plen -= sizeof(op_len);
}
if (op_len > 0) {
	if (plen < op_len)
		goto bad_len;
	op_val = p;
	p += op_len;
	plen -= op_len;
} else
	op_val = NULL((void *)0);

switch (op_type) {
case OPT_PARAM_CAPABILITIES:		/* RFC 3392 */
	if (parse_capabilities(peer, op_val, op_len,
	    &as) == -1) {
		session_notification(peer, ERR_OPEN, 0,
		    NULL((void *)0), 0);
		change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
		return (-1);
	}
	break;
case OPT_PARAM_AUTH:			/* deprecated */
default:
	/*
	 * unsupported type
	 * the RFCs tell us to leave the data section empty
	 * and notify the peer with ERR_OPEN, ERR_OPEN_OPT.
	 * How the peer should know _which_ optional parameter
	 * we don't support is beyond me.
	 */
	log_peer_warnx(&peer->conf,
	    "received OPEN message with unsupported optional "
	    "parameter: type %u", op_type);
	session_notification(peer, ERR_OPEN, ERR_OPEN_OPT,
		NULL((void *)0), 0);
	change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
	/* no punish */
	timer_set(&peer->timers, Timer_IdleHold, 0);
	peer->IdleHoldTime /= 2;
	return (-1);
}
}

/* if remote-as is zero and it's a cloned neighbor, accept any */
if (peer->template && !peer->conf.remote_as && as != AS_TRANS23456) {
peer->conf.remote_as = as;
peer->conf.ebgp = (peer->conf.remote_as != peer->conf.local_as);
if (!peer->conf.ebgp)
	/* force enforce_as off for iBGP sessions */
	peer->conf.enforce_as = ENFORCE_AS_OFF;
}

if (peer->conf.remote_as != as) {
log_peer_warnx(&peer->conf, "peer sent wrong AS %s",
    log_as(as));
session_notification(peer, ERR_OPEN, ERR_OPEN_AS, NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

/* on iBGP sessions check for bgpid collision */
if (!peer->conf.ebgp && peer->remote_bgpid == conf->bgpid) {
log_peer_warnx(&peer->conf, "peer BGPID %u conflicts with ours",
    ntohl(bgpid)(__uint32_t)(__builtin_constant_p(bgpid) ? (__uint32_t)(((__uint32_t
)(bgpid) & 0xff) << 24 | ((__uint32_t)(bgpid) &
 0xff00) << 8 | ((__uint32_t)(bgpid) & 0xff0000) >>
| ((__uint32_t)(bgpid) & 0xff000000) >> 24) : __swap32md
(bgpid)));
session_notification(peer, ERR_OPEN, ERR_OPEN_BGPID,
    NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

if (capa_neg_calc(peer, &suberr) == -1) {
session_notification(peer, ERR_OPEN, suberr, NULL((void *)0), 0);
change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
return (-1);
}

return (0);
2329}

2331int
2332parse_update(struct peer *peer)
2333{
u_char		*p;
uint16_t	 datalen;

/*
* we pass the message verbatim to the rde.
* in case of errors the whole session is reset with a
* notification anyway, we only need to know the peer
*/
p = peer->rbuf->rptr;
p += MSGSIZE_HEADER_MARKER16;
memcpy(&datalen, p, sizeof(datalen));
datalen = ntohs(datalen)(__uint16_t)(__builtin_constant_p(datalen) ? (__uint16_t)(((__uint16_t
)(datalen) & 0xffU) << 8 | ((__uint16_t)(datalen) &
 0xff00U) >> 8) : __swap16md(datalen));

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER19;	/* header is already checked */
datalen -= MSGSIZE_HEADER19;

if (imsg_rde(IMSG_UPDATE, peer->conf.id, p, datalen) == -1)
return (-1);

return (0);
2355}

2357int
2358parse_rrefresh(struct peer *peer)
2359{
struct route_refresh rr;
uint16_t afi, datalen;
uint8_t aid, safi, subtype;
u_char *p;

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER_MARKER16;
memcpy(&datalen, p, sizeof(datalen));
datalen = ntohs(datalen)(__uint16_t)(__builtin_constant_p(datalen) ? (__uint16_t)(((__uint16_t
)(datalen) & 0xffU) << 8 | ((__uint16_t)(datalen) &
 0xff00U) >> 8) : __swap16md(datalen));

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER19;	/* header is already checked */

/*
* We could check if we actually announced the capability but
* as long as the message is correctly encoded we don't care.
*/

/* afi, 2 byte */
memcpy(&afi, p, sizeof(afi));
afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));
p += 2;
/* subtype, 1 byte */
subtype = *p;
p += 1;
/* safi, 1 byte */
safi = *p;

/* check subtype if peer announced enhanced route refresh */
if (peer->capa.neg.enhanced_rr) {
switch (subtype) {
case ROUTE_REFRESH_REQUEST0:
	/* no ORF support, so no oversized RREFRESH msgs */
	if (datalen != MSGSIZE_RREFRESH(19 + 4)) {
		log_peer_warnx(&peer->conf,
		    "received RREFRESH: illegal len: %u byte",
		    datalen);
		datalen = htons(datalen)(__uint16_t)(__builtin_constant_p(datalen) ? (__uint16_t)(((__uint16_t
)(datalen) & 0xffU) << 8 | ((__uint16_t)(datalen) &
 0xff00U) >> 8) : __swap16md(datalen));
		session_notification(peer, ERR_HEADER,
		    ERR_HDR_LEN, &datalen, sizeof(datalen));
		bgp_fsm(peer, EVNT_CON_FATAL);
		return (-1);
	}
	peer->stats.refresh_rcvd_req++;
	break;
case ROUTE_REFRESH_BEGIN_RR1:
case ROUTE_REFRESH_END_RR2:
	/* special handling for RFC7313 */
	if (datalen != MSGSIZE_RREFRESH(19 + 4)) {
		log_peer_warnx(&peer->conf,
		    "received RREFRESH: illegal len: %u byte",
		    datalen);
		p = peer->rbuf->rptr;
		p += MSGSIZE_HEADER19;
		datalen -= MSGSIZE_HEADER19;
		session_notification(peer, ERR_RREFRESH,
		    ERR_RR_INV_LEN, p, datalen);
		bgp_fsm(peer, EVNT_CON_FATAL);
		return (-1);
	}
	if (subtype == ROUTE_REFRESH_BEGIN_RR1)
		peer->stats.refresh_rcvd_borr++;
	else
		peer->stats.refresh_rcvd_eorr++;
	break;
default:
	log_peer_warnx(&peer->conf, "peer sent bad refresh, "
	    "bad subtype %d", subtype);
	return (0);
}
} else {
/* force subtype to default */
subtype = ROUTE_REFRESH_REQUEST0;
peer->stats.refresh_rcvd_req++;
}

/* afi/safi unchecked -	unrecognized values will be ignored anyway */
if (afi2aid(afi, safi, &aid) == -1) {
log_peer_warnx(&peer->conf, "peer sent bad refresh, "
    "invalid afi/safi pair");
return (0);
}

if (!peer->capa.neg.refresh && !peer->capa.neg.enhanced_rr) {
log_peer_warnx(&peer->conf, "peer sent unexpected refresh");
return (0);
}

rr.aid = aid;
rr.subtype = subtype;

if (imsg_rde(IMSG_REFRESH, peer->conf.id, &rr, sizeof(rr)) == -1)
return (-1);

return (0);
2455}

2457int
2458parse_notification(struct peer *peer)
2459{
u_char		*p;
uint16_t	 datalen;
uint8_t		 errcode;
uint8_t		 subcode;
uint8_t		 capa_code;
uint8_t		 capa_len;
size_t		 reason_len;
uint8_t		 i;

/* just log */
p = peer->rbuf->rptr;
p += MSGSIZE_HEADER_MARKER16;
memcpy(&datalen, p, sizeof(datalen));
datalen = ntohs(datalen)(__uint16_t)(__builtin_constant_p(datalen) ? (__uint16_t)(((__uint16_t
)(datalen) & 0xffU) << 8 | ((__uint16_t)(datalen) &
 0xff00U) >> 8) : __swap16md(datalen));

p = peer->rbuf->rptr;
p += MSGSIZE_HEADER19;	/* header is already checked */
datalen -= MSGSIZE_HEADER19;

memcpy(&errcode, p, sizeof(errcode));
p += sizeof(errcode);
datalen -= sizeof(errcode);

memcpy(&subcode, p, sizeof(subcode));
p += sizeof(subcode);
datalen -= sizeof(subcode);

log_notification(peer, errcode, subcode, p, datalen, "received");
peer->errcnt++;
peer->stats.last_rcvd_errcode = errcode;
peer->stats.last_rcvd_suberr = subcode;

if (errcode == ERR_OPEN && subcode == ERR_OPEN_CAPA) {
if (datalen == 0) {	/* zebra likes to send those.. humbug */
	log_peer_warnx(&peer->conf, "received \"unsupported "
	    "capability\" notification without data part, "
	    "disabling capability announcements altogether");
	session_capa_ann_none(peer);
}

while (datalen > 0) {
	if (datalen < 2) {
		log_peer_warnx(&peer->conf,
		    "parse_notification: "
		    "expect len >= 2, len is %u", datalen);
		return (-1);
	}
	memcpy(&capa_code, p, sizeof(capa_code));
	p += sizeof(capa_code);
	datalen -= sizeof(capa_code);
	memcpy(&capa_len, p, sizeof(capa_len));
	p += sizeof(capa_len);
	datalen -= sizeof(capa_len);
	if (datalen < capa_len) {
		log_peer_warnx(&peer->conf,
		    "parse_notification: capa_len %u exceeds "
		    "remaining msg length %u", capa_len,
		    datalen);
		return (-1);
	}
	p += capa_len;
	datalen -= capa_len;
	switch (capa_code) {
	case CAPA_MP:
		for (i = 0; i < AID_MAX7; i++)
			peer->capa.ann.mp[i] = 0;
		log_peer_warnx(&peer->conf,
		    "disabling multiprotocol capability");
		break;
	case CAPA_REFRESH:
		peer->capa.ann.refresh = 0;
		log_peer_warnx(&peer->conf,
		    "disabling route refresh capability");
		break;
	case CAPA_ROLE:
		if (peer->capa.ann.policy == 1) {
			peer->capa.ann.policy = 0;
			log_peer_warnx(&peer->conf,
			    "disabling role capability");
		} else {
			log_peer_warnx(&peer->conf,
			    "role capability enforced, "
			    "not disabling");
		}
		break;
	case CAPA_RESTART:
		peer->capa.ann.grestart.restart = 0;
		log_peer_warnx(&peer->conf,
		    "disabling restart capability");
		break;
	case CAPA_AS4BYTE:
		peer->capa.ann.as4byte = 0;
		log_peer_warnx(&peer->conf,
		    "disabling 4-byte AS num capability");
		break;
	case CAPA_ADD_PATH:
		memset(peer->capa.ann.add_path, 0,
		    sizeof(peer->capa.ann.add_path));
		log_peer_warnx(&peer->conf,
		    "disabling ADD-PATH capability");
		break;
	case CAPA_ENHANCED_RR:
		peer->capa.ann.enhanced_rr = 0;
		log_peer_warnx(&peer->conf,
		    "disabling enhanced route refresh "
		    "capability");
		break;
	default:	/* should not happen... */
		log_peer_warnx(&peer->conf, "received "
		    "\"unsupported capability\" notification "
		    "for unknown capability %u, disabling "
		    "capability announcements altogether",
		    capa_code);
		session_capa_ann_none(peer);
		break;
	}
}

return (1);
}

if (errcode == ERR_OPEN && subcode == ERR_OPEN_OPT) {
session_capa_ann_none(peer);
return (1);
}

if (errcode == ERR_CEASE &&
   (subcode == ERR_CEASE_ADMIN_DOWN ||
    subcode == ERR_CEASE_ADMIN_RESET)) {
if (datalen > 1) {
	reason_len = *p++;
	datalen--;
	if (datalen < reason_len) {
		log_peer_warnx(&peer->conf,
		    "received truncated shutdown reason");
		return (0);
	}
	if (reason_len > REASON_LEN256 - 1) {
		log_peer_warnx(&peer->conf,
		    "received overly long shutdown reason");
		return (0);
	}
	memcpy(peer->stats.last_reason, p, reason_len);
	peer->stats.last_reason[reason_len] = '\0';
	log_peer_warnx(&peer->conf,
	    "received shutdown reason: \"%s\"",
	    log_reason(peer->stats.last_reason));
	p += reason_len;
	datalen -= reason_len;
}
}

return (0);
2613}

2615int
2616parse_capabilities(struct peer *peer, u_char *d, uint16_t dlen, uint32_t *as)
2617{
u_char		*capa_val;
uint32_t	 remote_as;
uint16_t	 len;
uint16_t	 afi;
uint16_t	 gr_header;
uint8_t		 safi;
uint8_t		 aid;
uint8_t		 flags;
uint8_t		 capa_code;
uint8_t		 capa_len;
uint8_t		 i;

len = dlen;
while (len > 0) {
if (len < 2) {
	log_peer_warnx(&peer->conf, "Bad capabilities attr "
	    "length: %u, too short", len);
	return (-1);
}
memcpy(&capa_code, d, sizeof(capa_code));
d += sizeof(capa_code);
len -= sizeof(capa_code);
memcpy(&capa_len, d, sizeof(capa_len));
d += sizeof(capa_len);
len -= sizeof(capa_len);
if (capa_len > 0) {
	if (len < capa_len) {
		log_peer_warnx(&peer->conf,
		    "Bad capabilities attr length: "
		    "len %u smaller than capa_len %u",
		    len, capa_len);
		return (-1);
	}
	capa_val = d;
	d += capa_len;
	len -= capa_len;
} else
	capa_val = NULL((void *)0);

switch (capa_code) {
case CAPA_MP:			/* RFC 4760 */
	if (capa_len != 4) {
		log_peer_warnx(&peer->conf,
		    "Bad multi protocol capability length: "
		    "%u", capa_len);
		break;
	}
	memcpy(&afi, capa_val, sizeof(afi));
	afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));
	memcpy(&safi, capa_val + 3, sizeof(safi));
	if (afi2aid(afi, safi, &aid) == -1) {
		log_peer_warnx(&peer->conf,
		    "Received multi protocol capability: "
		    " unknown AFI %u, safi %u pair",
		    afi, safi);
		break;
	}
	peer->capa.peer.mp[aid] = 1;
	break;
case CAPA_REFRESH:
	peer->capa.peer.refresh = 1;
	break;
case CAPA_ROLE:
	if (capa_len != 1) {
		log_peer_warnx(&peer->conf,
		    "Bad role capability length: %u", capa_len);
		break;
	}
	if (!peer->conf.ebgp) {
		log_peer_warnx(&peer->conf,
		    "Received role capability on iBGP session");
		break;
	}
	peer->capa.peer.policy = 1;
	peer->remote_role = capa2role(*capa_val);
	break;
case CAPA_RESTART:
	if (capa_len == 2) {
		/* peer only supports EoR marker */
		peer->capa.peer.grestart.restart = 1;
		peer->capa.peer.grestart.timeout = 0;
		break;
	} else if (capa_len % 4 != 2) {
		log_peer_warnx(&peer->conf,
		    "Bad graceful restart capability length: "
		    "%u", capa_len);
		peer->capa.peer.grestart.restart = 0;
		peer->capa.peer.grestart.timeout = 0;
		break;
	}

	memcpy(&gr_header, capa_val, sizeof(gr_header));
	gr_header = ntohs(gr_header)(__uint16_t)(__builtin_constant_p(gr_header) ? (__uint16_t)((
(__uint16_t)(gr_header) & 0xffU) << 8 | ((__uint16_t
)(gr_header) & 0xff00U) >> 8) : __swap16md(gr_header
));
	peer->capa.peer.grestart.timeout =
	    gr_header & CAPA_GR_TIMEMASK0x0fff;
	if (peer->capa.peer.grestart.timeout == 0) {
		log_peer_warnx(&peer->conf, "Received "
		    "graceful restart timeout is zero");
		peer->capa.peer.grestart.restart = 0;
		break;
	}

	for (i = 2; i <= capa_len - 4; i += 4) {
		memcpy(&afi, capa_val + i, sizeof(afi));
		afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));
		safi = capa_val[i + 2];
		flags = capa_val[i + 3];
		if (afi2aid(afi, safi, &aid) == -1) {
			log_peer_warnx(&peer->conf,
			    "Received graceful restart capa: "
			    " unknown AFI %u, safi %u pair",
			    afi, safi);
			continue;
		}
		peer->capa.peer.grestart.flags[aid] |=
		    CAPA_GR_PRESENT0x01;
		if (flags & CAPA_GR_F_FLAG0x80)
			peer->capa.peer.grestart.flags[aid] |=
			    CAPA_GR_FORWARD0x04;
		if (gr_header & CAPA_GR_R_FLAG0x8000)
			peer->capa.peer.grestart.flags[aid] |=
			    CAPA_GR_RESTART0x02;
		peer->capa.peer.grestart.restart = 2;
	}
	break;
case CAPA_AS4BYTE:
	if (capa_len != 4) {
		log_peer_warnx(&peer->conf,
		    "Bad AS4BYTE capability length: "
		    "%u", capa_len);
		peer->capa.peer.as4byte = 0;
		break;
	}
	memcpy(&remote_as, capa_val, sizeof(remote_as));
	*as = ntohl(remote_as)(__uint32_t)(__builtin_constant_p(remote_as) ? (__uint32_t)((
(__uint32_t)(remote_as) & 0xff) << 24 | ((__uint32_t
)(remote_as) & 0xff00) << 8 | ((__uint32_t)(remote_as
) & 0xff0000) >> 8 | ((__uint32_t)(remote_as) &
 0xff000000) >> 24) : __swap32md(remote_as));
	if (*as == 0) {
		log_peer_warnx(&peer->conf,
		    "peer requests unacceptable AS %u", *as);
		session_notification(peer, ERR_OPEN,
		    ERR_OPEN_AS, NULL((void *)0), 0);
		change_state(peer, STATE_IDLE, EVNT_RCVD_OPEN);
		return (-1);
	}
	peer->capa.peer.as4byte = 1;
	break;
case CAPA_ADD_PATH:
	if (capa_len % 4 != 0) {
		log_peer_warnx(&peer->conf,
		    "Bad ADD-PATH capability length: "
		    "%u", capa_len);
		memset(peer->capa.peer.add_path, 0,
		    sizeof(peer->capa.peer.add_path));
		break;
	}
	for (i = 0; i <= capa_len - 4; i += 4) {
		memcpy(&afi, capa_val + i, sizeof(afi));
		afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));
		safi = capa_val[i + 2];
		flags = capa_val[i + 3];
		if (afi2aid(afi, safi, &aid) == -1) {
			log_peer_warnx(&peer->conf,
			    "Received ADD-PATH capa: "
			    " unknown AFI %u, safi %u pair",
			    afi, safi);
			memset(peer->capa.peer.add_path, 0,
			    sizeof(peer->capa.peer.add_path));
			break;
		}
		if (flags & ~CAPA_AP_BIDIR0x03) {
			log_peer_warnx(&peer->conf,
			    "Received ADD-PATH capa: "
			    " bad flags %x", flags);
			memset(peer->capa.peer.add_path, 0,
			    sizeof(peer->capa.peer.add_path));
			break;
		}
		peer->capa.peer.add_path[aid] = flags;
	}
	break;
case CAPA_ENHANCED_RR:
	peer->capa.peer.enhanced_rr = 1;
	break;
default:
	break;
}
}

return (0);
2806}

2808int
2809capa_neg_calc(struct peer *p, uint8_t *suberr)
2810{
uint8_t	i, hasmp = 0;

/* a capability is accepted only if both sides announced it */

p->capa.neg.refresh =
   (p->capa.ann.refresh && p->capa.peer.refresh) != 0;
p->capa.neg.enhanced_rr =
   (p->capa.ann.enhanced_rr && p->capa.peer.enhanced_rr) != 0;

p->capa.neg.as4byte =
   (p->capa.ann.as4byte && p->capa.peer.as4byte) != 0;

/* MP: both side must agree on the AFI,SAFI pair */
for (i = 0; i < AID_MAX7; i++) {
if (p->capa.ann.mp[i] && p->capa.peer.mp[i])
	p->capa.neg.mp[i] = 1;
else
	p->capa.neg.mp[i] = 0;
if (p->capa.ann.mp[i])
	hasmp = 1;
}
/* if no MP capability present default to IPv4 unicast mode */
if (!hasmp)
p->capa.neg.mp[AID_INET1] = 1;

/*
* graceful restart: the peer capabilities are of interest here.
* It is necessary to compare the new values with the previous ones
* and act accordingly. AFI/SAFI that are not part in the MP capability
* are treated as not being present.
* Also make sure that a flush happens if the session stopped
* supporting graceful restart.
*/

for (i = 0; i < AID_MAX7; i++) {
int8_t	negflags;

/* disable GR if the AFI/SAFI is not present */
if ((p->capa.peer.grestart.flags[i] & CAPA_GR_PRESENT0x01 &&
    p->capa.neg.mp[i] == 0))
	p->capa.peer.grestart.flags[i] = 0;	/* disable */
/* look at current GR state and decide what to do */
negflags = p->capa.neg.grestart.flags[i];
p->capa.neg.grestart.flags[i] = p->capa.peer.grestart.flags[i];
if (negflags & CAPA_GR_RESTARTING0x08) {
	if (p->capa.ann.grestart.restart != 0 &&
	    p->capa.peer.grestart.flags[i] & CAPA_GR_FORWARD0x04) {
		p->capa.neg.grestart.flags[i] |=
		    CAPA_GR_RESTARTING0x08;
	} else {
		if (imsg_rde(IMSG_SESSION_FLUSH, p->conf.id,
		    &i, sizeof(i)) == -1) {
			log_peer_warnx(&p->conf,
			    "imsg send failed");
			return (-1);
		}
		log_peer_warnx(&p->conf, "graceful restart of "
		    "%s, not restarted, flushing", aid2str(i));
	}
}
}
p->capa.neg.grestart.timeout = p->capa.peer.grestart.timeout;
p->capa.neg.grestart.restart = p->capa.peer.grestart.restart;
if (p->capa.ann.grestart.restart == 0)
p->capa.neg.grestart.restart = 0;


/*
* ADD-PATH: set only those bits where both sides agree.
* For this compare our send bit with the recv bit from the peer
* and vice versa.
* The flags are stored from this systems view point.
*/
memset(p->capa.neg.add_path, 0, sizeof(p->capa.neg.add_path));
if (p->capa.ann.add_path[0]) {
for (i = AID_MIN1; i < AID_MAX7; i++) {
	if ((p->capa.ann.add_path[i] & CAPA_AP_RECV0x01) &&
	    (p->capa.peer.add_path[i] & CAPA_AP_SEND0x02)) {
		p->capa.neg.add_path[i] |= CAPA_AP_RECV0x01;
		p->capa.neg.add_path[0] |= CAPA_AP_RECV0x01;
	}
	if ((p->capa.ann.add_path[i] & CAPA_AP_SEND0x02) &&
	    (p->capa.peer.add_path[i] & CAPA_AP_RECV0x01)) {
		p->capa.neg.add_path[i] |= CAPA_AP_SEND0x02;
		p->capa.neg.add_path[0] |= CAPA_AP_SEND0x02;
	}
}
}

/*
* Open policy: check that the policy is sensible.
*
* Make sure that the roles match and set the negotiated capability
* to the role of the peer. So the RDE can inject the OTC attribute.
* See RFC 9234, section 4.2.
* These checks should only happen on ebgp sessions.
*/
if (p->capa.ann.policy != 0 && p->capa.peer.policy != 0 &&
   p->conf.ebgp) {
switch (p->conf.role) {
case ROLE_PROVIDER:
	if (p->remote_role != ROLE_CUSTOMER)
		goto fail;
	break;
case ROLE_RS:
	if (p->remote_role != ROLE_RS_CLIENT)
		goto fail;
	break;
case ROLE_RS_CLIENT:
	if (p->remote_role != ROLE_RS)
		goto fail;
	break;
case ROLE_CUSTOMER:
	if (p->remote_role != ROLE_PROVIDER)
		goto fail;
	break;
case ROLE_PEER:
	if (p->remote_role != ROLE_PEER)
		goto fail;
	break;
default:
fail:
	log_peer_warnx(&p->conf, "open policy role mismatch: "
	    "our role %s, their role %s",
	    log_policy(p->conf.role),
	    log_policy(p->remote_role));
	*suberr = ERR_OPEN_ROLE;
	return (-1);
}
p->capa.neg.policy = 1;
} else if (p->capa.ann.policy == 2 && p->conf.ebgp) {
/* enforce presence of open policy role capability */
log_peer_warnx(&p->conf, "open policy role enforced but "
    "not present");
*suberr = ERR_OPEN_ROLE;
return (-1);
}

return (0);
2950}

2952void
2953session_dispatch_imsg(struct imsgbuf *imsgbuf, int idx, u_int *listener_cnt)
2954{
struct imsg		 imsg;
struct mrt		 xmrt;
struct route_refresh	 rr;
struct mrt		*mrt;
struct imsgbuf		*i;
struct peer		*p;
struct listen_addr	*la, *nla;
struct session_dependon	*sdon;
u_char			*data;
int			 n, fd, depend_ok, restricted;
uint16_t		 t;
uint8_t			 aid, errcode, subcode;

while (imsgbuf) {
if ((n = imsg_get(imsgbuf, &imsg)) == -1)
	fatal("session_dispatch_imsg: imsg_get error");

if (n == 0)
	break;

switch (imsg.hdr.type) {
case IMSG_SOCKET_CONN:
case IMSG_SOCKET_CONN_CTL:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	if ((fd = imsg_get_fd(&imsg)) == -1) {
		log_warnx("expected to receive imsg fd to "
		    "RDE but didn't receive any");
		break;
	}
	if ((i = malloc(sizeof(struct imsgbuf))) == NULL((void *)0))
		fatal(NULL((void *)0));
	imsg_init(i, fd);
	if (imsg.hdr.type == IMSG_SOCKET_CONN) {
		if (ibuf_rde) {
			log_warnx("Unexpected imsg connection "
			    "to RDE received");
			msgbuf_clear(&ibuf_rde->w);
			free(ibuf_rde);
		}
		ibuf_rde = i;
	} else {
		if (ibuf_rde_ctl) {
			log_warnx("Unexpected imsg ctl "
			    "connection to RDE received");
			msgbuf_clear(&ibuf_rde_ctl->w);
			free(ibuf_rde_ctl);
		}
		ibuf_rde_ctl = i;
	}
	break;
case IMSG_RECONF_CONF:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	nconf = new_config();

	copy_config(nconf, imsg.data);
	pending_reconf = 1;
	break;
case IMSG_RECONF_PEER:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	if ((p = calloc(1, sizeof(struct peer))) == NULL((void *)0))
		fatal("new_peer");
	memcpy(&p->conf, imsg.data, sizeof(struct peer_config));
	p->state = p->prev_state = STATE_NONE;
	p->reconf_action = RECONF_REINIT;
	if (RB_INSERT(peer_head, &nconf->peers, p)peer_head_RB_INSERT(&nconf->peers, p) != NULL((void *)0))
		fatalx("%s: peer tree is corrupt", __func__);
	break;
case IMSG_RECONF_LISTENER:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	if (nconf == NULL((void *)0))
		fatalx("IMSG_RECONF_LISTENER but no config");
	nla = imsg.data;
	TAILQ_FOREACH(la, conf->listen_addrs, entry)for((la) = ((conf->listen_addrs)->tqh_first); (la) != (
(void *)0); (la) = ((la)->entry.tqe_next))
		if (!la_cmp(la, nla))
			break;

	if (la == NULL((void *)0)) {
		if (nla->reconf != RECONF_REINIT)
			fatalx("king bula sez: "
			    "expected REINIT");

		if ((nla->fd = imsg_get_fd(&imsg)) == -1)
			log_warnx("expected to receive fd for "
			    "%s but didn't receive any",
			    log_sockaddr((struct sockaddr *)
			    &nla->sa, nla->sa_len));

		la = calloc(1, sizeof(struct listen_addr));
		if (la == NULL((void *)0))
			fatal(NULL((void *)0));
		memcpy(&la->sa, &nla->sa, sizeof(la->sa));
		la->flags = nla->flags;
		la->fd = nla->fd;
		la->reconf = RECONF_REINIT;
		TAILQ_INSERT_TAIL(nconf->listen_addrs, la,do { (la)->entry.tqe_next = ((void *)0); (la)->entry.tqe_prev
 = (nconf->listen_addrs)->tqh_last; *(nconf->listen_addrs
)->tqh_last = (la); (nconf->listen_addrs)->tqh_last =
 &(la)->entry.tqe_next; } while (0)
		    entry)do { (la)->entry.tqe_next = ((void *)0); (la)->entry.tqe_prev
 = (nconf->listen_addrs)->tqh_last; *(nconf->listen_addrs
)->tqh_last = (la); (nconf->listen_addrs)->tqh_last =
 &(la)->entry.tqe_next; } while (0);
	} else {
		if (nla->reconf != RECONF_KEEP)
			fatalx("king bula sez: expected KEEP");
		la->reconf = RECONF_KEEP;
	}

	break;
case IMSG_RECONF_CTRL:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	if (imsg.hdr.len != IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    sizeof(restricted))
		fatalx("RECONF_CTRL imsg with wrong len");
	memcpy(&restricted, imsg.data, sizeof(restricted));
	if ((fd = imsg_get_fd(&imsg)) == -1) {
		log_warnx("expected to receive fd for control "
		    "socket but didn't receive any");
		break;
	}
	if (restricted) {
		control_shutdown(rcsock);
		rcsock = fd;
	} else {
		control_shutdown(csock);
		csock = fd;
	}
	break;
case IMSG_RECONF_DRAIN:
	switch (idx) {
	case PFD_PIPE_ROUTE1:
		if (nconf != NULL((void *)0))
			fatalx("got unexpected %s from RDE",
			    "IMSG_RECONF_DONE");
		imsg_compose(ibuf_main, IMSG_RECONF_DONE, 0, 0,
		    -1, NULL((void *)0), 0);
		break;
	case PFD_PIPE_MAIN0:
		if (nconf == NULL((void *)0))
			fatalx("got unexpected %s from parent",
			    "IMSG_RECONF_DONE");
		imsg_compose(ibuf_main, IMSG_RECONF_DRAIN, 0, 0,
		    -1, NULL((void *)0), 0);
		break;
	default:
		fatalx("reconf request not from parent or RDE");
	}
	break;
case IMSG_RECONF_DONE:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("reconf request not from parent");
	if (nconf == NULL((void *)0))
		fatalx("got IMSG_RECONF_DONE but no config");
	copy_config(conf, nconf);
	merge_peers(conf, nconf);

	/* delete old listeners */
	for (la = TAILQ_FIRST(conf->listen_addrs)((conf->listen_addrs)->tqh_first); la != NULL((void *)0);
	    la = nla) {
		nla = TAILQ_NEXT(la, entry)((la)->entry.tqe_next);
		if (la->reconf == RECONF_NONE) {
			log_info("not listening on %s any more",
			    log_sockaddr((struct sockaddr *)
			    &la->sa, la->sa_len));
			TAILQ_REMOVE(conf->listen_addrs, la,do { if (((la)->entry.tqe_next) != ((void *)0)) (la)->entry
.tqe_next->entry.tqe_prev = (la)->entry.tqe_prev; else (
conf->listen_addrs)->tqh_last = (la)->entry.tqe_prev
; *(la)->entry.tqe_prev = (la)->entry.tqe_next; ; ; } while
 (0)
			    entry)do { if (((la)->entry.tqe_next) != ((void *)0)) (la)->entry
.tqe_next->entry.tqe_prev = (la)->entry.tqe_prev; else (
conf->listen_addrs)->tqh_last = (la)->entry.tqe_prev
; *(la)->entry.tqe_prev = (la)->entry.tqe_next; ; ; } while
 (0);
			close(la->fd);
			free(la);
		}
	}

	/* add new listeners */
	TAILQ_CONCAT(conf->listen_addrs, nconf->listen_addrs,do { if (!(((nconf->listen_addrs)->tqh_first) == ((void
 *)0))) { *(conf->listen_addrs)->tqh_last = (nconf->
listen_addrs)->tqh_first; (nconf->listen_addrs)->tqh_first
->entry.tqe_prev = (conf->listen_addrs)->tqh_last; (
conf->listen_addrs)->tqh_last = (nconf->listen_addrs
)->tqh_last; do { ((nconf->listen_addrs))->tqh_first
 = ((void *)0); ((nconf->listen_addrs))->tqh_last = &
((nconf->listen_addrs))->tqh_first; } while (0); } } while
 (0)
	    entry)do { if (!(((nconf->listen_addrs)->tqh_first) == ((void
 *)0))) { *(conf->listen_addrs)->tqh_last = (nconf->
listen_addrs)->tqh_first; (nconf->listen_addrs)->tqh_first
->entry.tqe_prev = (conf->listen_addrs)->tqh_last; (
conf->listen_addrs)->tqh_last = (nconf->listen_addrs
)->tqh_last; do { ((nconf->listen_addrs))->tqh_first
 = ((void *)0); ((nconf->listen_addrs))->tqh_last = &
((nconf->listen_addrs))->tqh_first; } while (0); } } while
 (0);

	setup_listeners(listener_cnt);
	free_config(nconf);
	nconf = NULL((void *)0);
	pending_reconf = 0;
	log_info("SE reconfigured");
	/*
	 * IMSG_RECONF_DONE is sent when the RDE drained
	 * the peer config sent in merge_peers().
	 */
	break;
case IMSG_SESSION_DEPENDON:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("IFINFO message not from parent");
	if (imsg.hdr.len != IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    sizeof(struct session_dependon))
		fatalx("DEPENDON imsg with wrong len");
	sdon = imsg.data;
	depend_ok = sdon->depend_state;

	RB_FOREACH(p, peer_head, &conf->peers)for ((p) = peer_head_RB_MINMAX(&conf->peers, -1); (p) !=
 ((void *)0); (p) = peer_head_RB_NEXT(p))
		if (!strcmp(p->conf.if_depend, sdon->ifname)) {
			if (depend_ok && !p->depend_ok) {
				p->depend_ok = depend_ok;
				bgp_fsm(p, EVNT_START);
			} else if (!depend_ok && p->depend_ok) {
				p->depend_ok = depend_ok;
				session_stop(p,
				    ERR_CEASE_OTHER_CHANGE);
			}
		}
	break;
case IMSG_MRT_OPEN:
case IMSG_MRT_REOPEN:
	if (imsg.hdr.len > IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    sizeof(struct mrt)) {
		log_warnx("wrong imsg len");
		break;
	}

	memcpy(&xmrt, imsg.data, sizeof(struct mrt));
	if ((xmrt.wbuf.fd = imsg_get_fd(&imsg)) == -1)
		log_warnx("expected to receive fd for mrt dump "
		    "but didn't receive any");

	mrt = mrt_get(&mrthead, &xmrt);
	if (mrt == NULL((void *)0)) {
		/* new dump */
		mrt = calloc(1, sizeof(struct mrt));
		if (mrt == NULL((void *)0))
			fatal("session_dispatch_imsg");
		memcpy(mrt, &xmrt, sizeof(struct mrt));
		TAILQ_INIT(&mrt->wbuf.bufs)do { (&mrt->wbuf.bufs)->tqh_first = ((void *)0); (&
mrt->wbuf.bufs)->tqh_last = &(&mrt->wbuf.bufs
)->tqh_first; } while (0);
		LIST_INSERT_HEAD(&mrthead, mrt, entry)do { if (((mrt)->entry.le_next = (&mrthead)->lh_first
) != ((void *)0)) (&mrthead)->lh_first->entry.le_prev
 = &(mrt)->entry.le_next; (&mrthead)->lh_first =
 (mrt); (mrt)->entry.le_prev = &(&mrthead)->lh_first
; } while (0);
	} else {
		/* old dump reopened */
		close(mrt->wbuf.fd);
		mrt->wbuf.fd = xmrt.wbuf.fd;
	}
	break;
case IMSG_MRT_CLOSE:
	if (imsg.hdr.len > IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    sizeof(struct mrt)) {
		log_warnx("wrong imsg len");
		break;
	}

	memcpy(&xmrt, imsg.data, sizeof(struct mrt));
	mrt = mrt_get(&mrthead, &xmrt);
	if (mrt != NULL((void *)0))
		mrt_done(mrt);
	break;
case IMSG_CTL_KROUTE:
case IMSG_CTL_KROUTE_ADDR:
case IMSG_CTL_SHOW_NEXTHOP:
case IMSG_CTL_SHOW_INTERFACE:
case IMSG_CTL_SHOW_FIB_TABLES:
case IMSG_CTL_SHOW_RTR:
case IMSG_CTL_SHOW_TIMER:
	if (idx != PFD_PIPE_MAIN0)
		fatalx("ctl kroute request not from parent");
	control_imsg_relay(&imsg, NULL((void *)0));
	break;
case IMSG_CTL_SHOW_NEIGHBOR:
	if (idx != PFD_PIPE_ROUTE_CTL2)
		fatalx("ctl rib request not from RDE");
	p = getpeerbyid(conf, imsg.hdr.peerid);
	control_imsg_relay(&imsg, p);
	break;
case IMSG_CTL_SHOW_RIB:
case IMSG_CTL_SHOW_RIB_PREFIX:
case IMSG_CTL_SHOW_RIB_COMMUNITIES:
case IMSG_CTL_SHOW_RIB_ATTR:
case IMSG_CTL_SHOW_RIB_MEM:
case IMSG_CTL_SHOW_NETWORK:
case IMSG_CTL_SHOW_FLOWSPEC:
case IMSG_CTL_SHOW_SET:
	if (idx != PFD_PIPE_ROUTE_CTL2)
		fatalx("ctl rib request not from RDE");
	control_imsg_relay(&imsg, NULL((void *)0));
	break;
case IMSG_CTL_END:
case IMSG_CTL_RESULT:
	control_imsg_relay(&imsg, NULL((void *)0));
	break;
case IMSG_UPDATE:
	if (idx != PFD_PIPE_ROUTE1)
		fatalx("update request not from RDE");
	if (imsg.hdr.len > IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    MAX_PKTSIZE4096 - MSGSIZE_HEADER19 ||
	    imsg.hdr.len < IMSG_HEADER_SIZEsizeof(struct imsg_hdr) +
	    MSGSIZE_UPDATE_MIN23 - MSGSIZE_HEADER19)
		log_warnx("RDE sent invalid update");
	else
		session_update(imsg.hdr.peerid, imsg.data,
		    imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr));
	break;
case IMSG_UPDATE_ERR:
	if (idx != PFD_PIPE_ROUTE1)
		fatalx("update request not from RDE");
	if (imsg.hdr.len < IMSG_HEADER_SIZEsizeof(struct imsg_hdr) + 2) {
		log_warnx("RDE sent invalid notification");
		break;
	}
	if ((p = getpeerbyid(conf, imsg.hdr.peerid)) == NULL((void *)0)) {
		log_warnx("no such peer: id=%u",
		    imsg.hdr.peerid);
		break;
	}
	data = imsg.data;
	errcode = *data++;
	subcode = *data++;

	if (imsg.hdr.len == IMSG_HEADER_SIZEsizeof(struct imsg_hdr) + 2)
		data = NULL((void *)0);

	session_notification(p, errcode, subcode,
	    data, imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) - 2);
	switch (errcode) {
	case ERR_CEASE:
		switch (subcode) {
		case ERR_CEASE_MAX_PREFIX:
		case ERR_CEASE_MAX_SENT_PREFIX:
			t = p->conf.max_out_prefix_restart;
			if (subcode == ERR_CEASE_MAX_PREFIX)
				t = p->conf.max_prefix_restart;

			bgp_fsm(p, EVNT_STOP);
			if (t)
				timer_set(&p->timers,
				    Timer_IdleHold, 60 * t);
			break;
		default:
			bgp_fsm(p, EVNT_CON_FATAL);
			break;
		}
		break;
	default:
		bgp_fsm(p, EVNT_CON_FATAL);
		break;
	}
	break;
case IMSG_REFRESH:
	if (idx != PFD_PIPE_ROUTE1)
		fatalx("route refresh request not from RDE");
	if (imsg.hdr.len < IMSG_HEADER_SIZEsizeof(struct imsg_hdr) + sizeof(rr)) {
		log_warnx("RDE sent invalid refresh msg");
		break;
	}
	if ((p = getpeerbyid(conf, imsg.hdr.peerid)) == NULL((void *)0)) {
		log_warnx("no such peer: id=%u",
		    imsg.hdr.peerid);
		break;
	}
	memcpy(&rr, imsg.data, sizeof(rr));
	if (rr.aid >= AID_MAX7)
		fatalx("IMSG_REFRESH: bad AID");
	session_rrefresh(p, rr.aid, rr.subtype);
	break;
case IMSG_SESSION_RESTARTED:
	if (idx != PFD_PIPE_ROUTE1)
		fatalx("update request not from RDE");
	if (imsg.hdr.len < IMSG_HEADER_SIZEsizeof(struct imsg_hdr) + sizeof(aid)) {
		log_warnx("RDE sent invalid restart msg");
		break;
	}
	if ((p = getpeerbyid(conf, imsg.hdr.peerid)) == NULL((void *)0)) {
		log_warnx("no such peer: id=%u",
		    imsg.hdr.peerid);
		break;
	}
	memcpy(&aid, imsg.data, sizeof(aid));
	if (aid >= AID_MAX7)
		fatalx("IMSG_SESSION_RESTARTED: bad AID");
	if (p->capa.neg.grestart.flags[aid] &
	    CAPA_GR_RESTARTING0x08) {
		log_peer_warnx(&p->conf,
		    "graceful restart of %s finished",
		    aid2str(aid));
		p->capa.neg.grestart.flags[aid] &=
		    ~CAPA_GR_RESTARTING0x08;
		timer_stop(&p->timers, Timer_RestartTimeout);

		/* signal back to RDE to cleanup stale routes */
		if (imsg_rde(IMSG_SESSION_RESTARTED,
		    imsg.hdr.peerid, &aid, sizeof(aid)) == -1)
			fatal("imsg_compose: "
			    "IMSG_SESSION_RESTARTED");
	}
	break;
case IMSG_SESSION_DOWN:
	if (idx != PFD_PIPE_ROUTE1)
		fatalx("update request not from RDE");
	if ((p = getpeerbyid(conf, imsg.hdr.peerid)) == NULL((void *)0)) {
		log_warnx("no such peer: id=%u",
		    imsg.hdr.peerid);
		break;
	}
	session_stop(p, ERR_CEASE_ADMIN_DOWN);
	break;
default:
	break;
}
imsg_free(&imsg);
}
3353}

3355int
3356la_cmp(struct listen_addr *a, struct listen_addr *b)
3357{
struct sockaddr_in	*in_a, *in_b;
struct sockaddr_in6	*in6_a, *in6_b;

if (a->sa.ss_family != b->sa.ss_family)
return (1);

switch (a->sa.ss_family) {
case AF_INET2:
in_a = (struct sockaddr_in *)&a->sa;
in_b = (struct sockaddr_in *)&b->sa;
if (in_a->sin_addr.s_addr != in_b->sin_addr.s_addr)
	return (1);
if (in_a->sin_port != in_b->sin_port)
	return (1);
break;
case AF_INET624:
in6_a = (struct sockaddr_in6 *)&a->sa;
in6_b = (struct sockaddr_in6 *)&b->sa;
if (memcmp(&in6_a->sin6_addr, &in6_b->sin6_addr,
    sizeof(struct in6_addr)))
	return (1);
if (in6_a->sin6_port != in6_b->sin6_port)
	return (1);
break;
default:
fatal("king bula sez: unknown address family");
/* NOTREACHED */
}

return (0);
3388}

3390struct peer *
3391getpeerbydesc(struct bgpd_config *c, const char *descr)
3392{
struct peer	*p, *res = NULL((void *)0);
int		 match = 0;

RB_FOREACH(p, peer_head, &c->peers)for ((p) = peer_head_RB_MINMAX(&c->peers, -1); (p) != (
(void *)0); (p) = peer_head_RB_NEXT(p))
if (!strcmp(p->conf.descr, descr)) {
	res = p;
	match++;
}

if (match > 1)
log_info("neighbor description \"%s\" not unique, request "
    "aborted", descr);

if (match == 1)
return (res);
else
return (NULL((void *)0));
3410}

3412struct peer *
3413getpeerbyip(struct bgpd_config *c, struct sockaddr *ip)
3414{
struct bgpd_addr addr;
struct peer	*p, *newpeer, *loose = NULL((void *)0);
uint32_t	 id;

sa2addr(ip, &addr, NULL((void *)0));

/* we might want a more effective way to find peers by IP */
RB_FOREACH(p, peer_head, &c->peers)for ((p) = peer_head_RB_MINMAX(&c->peers, -1); (p) != (
(void *)0); (p) = peer_head_RB_NEXT(p))
if (!p->conf.template &&
    !memcmp(&addr, &p->conf.remote_addr, sizeof(addr)))
	return (p);

/* try template matching */
RB_FOREACH(p, peer_head, &c->peers)for ((p) = peer_head_RB_MINMAX(&c->peers, -1); (p) != (
(void *)0); (p) = peer_head_RB_NEXT(p))
if (p->conf.template &&
    p->conf.remote_addr.aid == addr.aid &&
    session_match_mask(p, &addr))
	if (loose == NULL((void *)0) || loose->conf.remote_masklen <
	    p->conf.remote_masklen)
		loose = p;

if (loose != NULL((void *)0)) {
/* clone */
if ((newpeer = malloc(sizeof(struct peer))) == NULL((void *)0))
	fatal(NULL((void *)0));
memcpy(newpeer, loose, sizeof(struct peer));
for (id = PEER_ID_DYN_MAX0xffffffffU; id > PEER_ID_STATIC_MAX(0xffffffffU / 2); id--) {
	if (getpeerbyid(c, id) == NULL((void *)0))	/* we found a free id */
		break;
}
newpeer->template = loose;
session_template_clone(newpeer, ip, id, 0);
newpeer->state = newpeer->prev_state = STATE_NONE;
newpeer->reconf_action = RECONF_KEEP;
newpeer->rbuf = NULL((void *)0);
newpeer->rpending = 0;
init_peer(newpeer);
bgp_fsm(newpeer, EVNT_START);
if (RB_INSERT(peer_head, &c->peers, newpeer)peer_head_RB_INSERT(&c->peers, newpeer) != NULL((void *)0))
	fatalx("%s: peer tree is corrupt", __func__);
return (newpeer);
}

return (NULL((void *)0));
3459}

3461struct peer *
3462getpeerbyid(struct bgpd_config *c, uint32_t peerid)
3463{
static struct peer lookup;

lookup.conf.id = peerid;

return RB_FIND(peer_head, &c->peers, &lookup)peer_head_RB_FIND(&c->peers, &lookup);
3469}

3471int
3472peer_matched(struct peer *p, struct ctl_neighbor *n)
3473{
char *s;

if (n && n->addr.aid) {
if (memcmp(&p->conf.remote_addr, &n->addr,
    sizeof(p->conf.remote_addr)))
	return 0;
} else if (n && n->descr[0]) {
s = n->is_group ? p->conf.group : p->conf.descr;
/* cannot trust n->descr to be properly terminated */
if (strncmp(s, n->descr, sizeof(n->descr)))
	return 0;
}
return 1;
3487}

3489void
3490session_template_clone(struct peer *p, struct sockaddr *ip, uint32_t id,
  uint32_t as)
3492{
struct bgpd_addr	remote_addr;

if (ip)
sa2addr(ip, &remote_addr, NULL((void *)0));
else
memcpy(&remote_addr, &p->conf.remote_addr, sizeof(remote_addr));

memcpy(&p->conf, &p->template->conf, sizeof(struct peer_config));

p->conf.id = id;

if (as) {
p->conf.remote_as = as;
p->conf.ebgp = (p->conf.remote_as != p->conf.local_as);
if (!p->conf.ebgp)
	/* force enforce_as off for iBGP sessions */
	p->conf.enforce_as = ENFORCE_AS_OFF;
}

memcpy(&p->conf.remote_addr, &remote_addr, sizeof(remote_addr));
switch (p->conf.remote_addr.aid) {
case AID_INET1:
p->conf.remote_masklen = 32;
break;
case AID_INET62:
p->conf.remote_masklen = 128;
break;
}
p->conf.template = 0;
3522}

3524int
3525session_match_mask(struct peer *p, struct bgpd_addr *a)
3526{
struct bgpd_addr masked;

applymask(&masked, a, p->conf.remote_masklen);
if (memcmp(&masked, &p->conf.remote_addr, sizeof(masked)) == 0)
return (1);
return (0);
3533}

3535void
3536session_down(struct peer *peer)
3537{
memset(&peer->capa.neg, 0, sizeof(peer->capa.neg));
peer->stats.last_updown = getmonotime();
/*
* session_down is called in the exit code path so check
* if the RDE is still around, if not there is no need to
* send the message.
*/
if (ibuf_rde == NULL((void *)0))
return;
if (imsg_rde(IMSG_SESSION_DOWN, peer->conf.id, NULL((void *)0), 0) == -1)
fatalx("imsg_compose error");
3549}

3551void
3552session_up(struct peer *p)
3553{
struct session_up	 sup;

if (imsg_rde(IMSG_SESSION_ADD, p->conf.id,
   &p->conf, sizeof(p->conf)) == -1)
fatalx("imsg_compose error");

if (p->local.aid == AID_INET1) {
sup.local_v4_addr = p->local;
sup.local_v6_addr = p->local_alt;
} else {
sup.local_v6_addr = p->local;
sup.local_v4_addr = p->local_alt;
}
sup.remote_addr = p->remote;
sup.if_scope = p->if_scope;

sup.remote_bgpid = p->remote_bgpid;
sup.short_as = p->short_as;
memcpy(&sup.capa, &p->capa.neg, sizeof(sup.capa));
p->stats.last_updown = getmonotime();
if (imsg_rde(IMSG_SESSION_UP, p->conf.id, &sup, sizeof(sup)) == -1)
fatalx("imsg_compose error");
3576}

3578int
3579imsg_ctl_parent(struct imsg *imsg)
3580{
return imsg_forward(ibuf_main, imsg);
3582}

3584int
3585imsg_ctl_rde(struct imsg *imsg)
3586{
if (ibuf_rde_ctl == NULL((void *)0))
return (0);
/*
* Use control socket to talk to RDE to bypass the queue of the
* regular imsg socket.
*/
return imsg_forward(ibuf_rde_ctl, imsg);
3594}

3596int
3597imsg_ctl_rde_msg(int type, uint32_t peerid, pid_t pid)
3598{
if (ibuf_rde_ctl == NULL((void *)0))
return (0);

/*
* Use control socket to talk to RDE to bypass the queue of the
* regular imsg socket.
*/
return imsg_compose(ibuf_rde_ctl, type, peerid, pid, -1, NULL((void *)0), 0);
3607}

3609int
3610imsg_rde(int type, uint32_t peerid, void *data, uint16_t datalen)
3611{
if (ibuf_rde == NULL((void *)0))
return (0);

return imsg_compose(ibuf_rde, type, peerid, 0, -1, data, datalen);
3616}

3618void
3619session_demote(struct peer *p, int level)
3620{
struct demote_msg	msg;

strlcpy(msg.demote_group, p->conf.demote_group,
   sizeof(msg.demote_group));
msg.level = level;
if (imsg_compose(ibuf_main, IMSG_DEMOTE, p->conf.id, 0, -1,
   &msg, sizeof(msg)) == -1)
fatalx("imsg_compose error");

p->demoted += level;
3631}

3633void
3634session_stop(struct peer *peer, uint8_t subcode)
3635{
char data[REASON_LEN256];
size_t datalen;
size_t reason_len;
char *communication;

datalen = 0;
communication = peer->conf.reason;

if ((subcode == ERR_CEASE_ADMIN_DOWN ||
   subcode == ERR_CEASE_ADMIN_RESET)
   && communication && *communication) {
reason_len = strlen(communication);
if (reason_len > REASON_LEN256 - 1) {
    log_peer_warnx(&peer->conf,
	"trying to send overly long shutdown reason");
} else {
	data[0] = reason_len;
	datalen = reason_len + sizeof(data[0]);
	memcpy(data + 1, communication, reason_len);
}
}
switch (peer->state) {
case STATE_OPENSENT:
case STATE_OPENCONFIRM:
case STATE_ESTABLISHED:
session_notification(peer, ERR_CEASE, subcode, data, datalen);
break;
default:
/* session not open, no need to send notification */
break;
}
bgp_fsm(peer, EVNT_STOP);
3668}

3670void
3671merge_peers(struct bgpd_config *c, struct bgpd_config *nc)
3672{
struct peer *p, *np, *next;

RB_FOREACH(p, peer_head, &c->peers)for ((p) = peer_head_RB_MINMAX(&c->peers, -1); (p) != (
(void *)0); (p) = peer_head_RB_NEXT(p)) {
/* templates are handled specially */
if (p->template != NULL((void *)0))
	continue;
np = getpeerbyid(nc, p->conf.id);
if (np == NULL((void *)0)) {
	p->reconf_action = RECONF_DELETE;
	continue;
}

/* peer no longer uses TCP MD5SIG so deconfigure */
if (p->conf.auth.method == AUTH_MD5SIG &&
    np->conf.auth.method != AUTH_MD5SIG)
	tcp_md5_del_listener(c, p);
else if (np->conf.auth.method == AUTH_MD5SIG)
	tcp_md5_add_listener(c, np);

memcpy(&p->conf, &np->conf, sizeof(p->conf));
RB_REMOVE(peer_head, &nc->peers, np)peer_head_RB_REMOVE(&nc->peers, np);
free(np);

p->reconf_action = RECONF_KEEP;

/* had demotion, is demoted, demote removed? */
if (p->demoted && !p->conf.demote_group[0])
	session_demote(p, -1);

/* if session is not open then refresh pfkey data */
if (p->state < STATE_OPENSENT && !p->template)
	imsg_compose(ibuf_main, IMSG_PFKEY_RELOAD,
	    p->conf.id, 0, -1, NULL((void *)0), 0);

/* sync the RDE in case we keep the peer */
if (imsg_rde(IMSG_SESSION_ADD, p->conf.id,
    &p->conf, sizeof(struct peer_config)) == -1)
	fatalx("imsg_compose error");

/* apply the config to all clones of a template */
if (p->conf.template) {
	struct peer *xp;
	RB_FOREACH(xp, peer_head, &c->peers)for ((xp) = peer_head_RB_MINMAX(&c->peers, -1); (xp) !=
 ((void *)0); (xp) = peer_head_RB_NEXT(xp)) {
		if (xp->template != p)
			continue;
		session_template_clone(xp, NULL((void *)0), xp->conf.id,
		    xp->conf.remote_as);
		if (imsg_rde(IMSG_SESSION_ADD, xp->conf.id,
		    &xp->conf, sizeof(xp->conf)) == -1)
			fatalx("imsg_compose error");
	}
}
}

if (imsg_rde(IMSG_RECONF_DRAIN, 0, NULL((void *)0), 0) == -1)
fatalx("imsg_compose error");

/* pfkeys of new peers already loaded by the parent process */
RB_FOREACH_SAFE(np, peer_head, &nc->peers, next)for ((np) = peer_head_RB_MINMAX(&nc->peers, -1); ((np)
 != ((void *)0)) && ((next) = peer_head_RB_NEXT(np), 1
); (np) = (next)) {
RB_REMOVE(peer_head, &nc->peers, np)peer_head_RB_REMOVE(&nc->peers, np);
if (RB_INSERT(peer_head, &c->peers, np)peer_head_RB_INSERT(&c->peers, np) != NULL((void *)0))
	fatalx("%s: peer tree is corrupt", __func__);
if (np->conf.auth.method == AUTH_MD5SIG)
	tcp_md5_add_listener(c, np);
}
3738}