1 /*
2 * Copyright 2011 Daniel Drown
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * ipv4.c - takes ipv4 packets, finds their headers, and then calls translation functions on them
17 */
18 #include <string.h>
19
20 #include "netutils/checksum.h"
21
22 #include "debug.h"
23 #include "dump.h"
24 #include "logging.h"
25 #include "translate.h"
26
27 /* function: icmp_packet
28 * translates an icmp packet
29 * out - output packet
30 * icmp - pointer to icmp header in packet
31 * checksum - pseudo-header checksum
32 * len - size of ip payload
33 * returns: the highest position in the output clat_packet that's filled in
34 */
icmp_packet(clat_packet out,clat_packet_index pos,const struct icmphdr * icmp,uint32_t checksum,size_t len)35 int icmp_packet(clat_packet out, clat_packet_index pos, const struct icmphdr *icmp,
36 uint32_t checksum, size_t len) {
37 const uint8_t *payload;
38 size_t payload_size;
39
40 if (len < sizeof(struct icmphdr)) {
41 logmsg_dbg(ANDROID_LOG_ERROR, "icmp_packet/(too small)");
42 return 0;
43 }
44
45 payload = (const uint8_t *)(icmp + 1);
46 payload_size = len - sizeof(struct icmphdr);
47
48 return icmp_to_icmp6(out, pos, icmp, checksum, payload, payload_size);
49 }
50
51 /* function: ipv4_packet
52 * translates an ipv4 packet
53 * out - output packet
54 * packet - packet data
55 * len - size of packet
56 * returns: the highest position in the output clat_packet that's filled in
57 */
ipv4_packet(clat_packet out,clat_packet_index pos,const uint8_t * packet,size_t len)58 int ipv4_packet(clat_packet out, clat_packet_index pos, const uint8_t *packet, size_t len) {
59 const struct iphdr *header = (struct iphdr *)packet;
60 struct ip6_hdr *ip6_targ = (struct ip6_hdr *)out[pos].iov_base;
61 struct ip6_frag *frag_hdr;
62 size_t frag_hdr_len;
63 uint8_t nxthdr;
64 const uint8_t *next_header;
65 size_t len_left;
66 uint32_t old_sum, new_sum;
67 int iov_len;
68
69 if (len < sizeof(struct iphdr)) {
70 logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/too short for an ip header");
71 return 0;
72 }
73
74 if (header->ihl < 5) {
75 logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set to less than 5: %x", header->ihl);
76 return 0;
77 }
78
79 if ((size_t)header->ihl * 4 > len) { // ip header length larger than entire packet
80 logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set too large: %x", header->ihl);
81 return 0;
82 }
83
84 if (header->version != 4) {
85 logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header version not 4: %x", header->version);
86 return 0;
87 }
88
89 /* rfc6145 - If any IPv4 options are present in the IPv4 packet, they MUST be
90 * ignored and the packet translated normally; there is no attempt to
91 * translate the options.
92 */
93
94 next_header = packet + header->ihl * 4;
95 len_left = len - header->ihl * 4;
96
97 nxthdr = header->protocol;
98 if (nxthdr == IPPROTO_ICMP) {
99 // ICMP and ICMPv6 have different protocol numbers.
100 nxthdr = IPPROTO_ICMPV6;
101 }
102
103 /* Fill in the IPv6 header. We need to do this before we translate the packet because TCP and
104 * UDP include parts of the IP header in the checksum. Set the length to zero because we don't
105 * know it yet.
106 */
107 fill_ip6_header(ip6_targ, 0, nxthdr, header);
108 out[pos].iov_len = sizeof(struct ip6_hdr);
109
110 /* Calculate the pseudo-header checksum.
111 * Technically, the length that is used in the pseudo-header checksum is the transport layer
112 * length, which is not the same as len_left in the case of fragmented packets. But since
113 * translation does not change the transport layer length, the checksum is unaffected.
114 */
115 old_sum = ipv4_pseudo_header_checksum(header, len_left);
116 new_sum = ipv6_pseudo_header_checksum(ip6_targ, len_left, nxthdr);
117
118 // If the IPv4 packet is fragmented, add a Fragment header.
119 frag_hdr = (struct ip6_frag *)out[pos + 1].iov_base;
120 frag_hdr_len = maybe_fill_frag_header(frag_hdr, ip6_targ, header);
121 out[pos + 1].iov_len = frag_hdr_len;
122
123 if (frag_hdr_len && frag_hdr->ip6f_offlg & IP6F_OFF_MASK) {
124 // Non-first fragment. Copy the rest of the packet as is.
125 iov_len = generic_packet(out, pos + 2, next_header, len_left);
126 } else if (nxthdr == IPPROTO_ICMPV6) {
127 iov_len = icmp_packet(out, pos + 2, (const struct icmphdr *)next_header, new_sum, len_left);
128 } else if (nxthdr == IPPROTO_TCP) {
129 iov_len =
130 tcp_packet(out, pos + 2, (const struct tcphdr *)next_header, old_sum, new_sum, len_left);
131 } else if (nxthdr == IPPROTO_UDP) {
132 iov_len =
133 udp_packet(out, pos + 2, (const struct udphdr *)next_header, old_sum, new_sum, len_left);
134 } else if (nxthdr == IPPROTO_GRE) {
135 iov_len = generic_packet(out, pos + 2, next_header, len_left);
136 } else {
137 #if CLAT_DEBUG
138 logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/unknown protocol: %x", header->protocol);
139 logcat_hexdump("ipv4/protocol", packet, len);
140 #endif
141 return 0;
142 }
143
144 // Set the length.
145 ip6_targ->ip6_plen = htons(packet_length(out, pos));
146 return iov_len;
147 }
148