1 /*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <map>
18 #include <string>
19
20 #include <arpa/inet.h>
21 #include <errno.h>
22 #include <linux/if_arp.h>
23 #include <linux/if_tun.h>
24 #include <linux/ioctl.h>
25 #include <net/if.h>
26 #include <netinet/in.h>
27 #include <spawn.h>
28 #include <sys/types.h>
29 #include <sys/wait.h>
30 #include <unistd.h>
31
32 #define LOG_TAG "ClatdController"
33 #include <log/log.h>
34
35 #include "ClatdController.h"
36
37 #include "android-base/properties.h"
38 #include "android-base/scopeguard.h"
39 #include "android-base/stringprintf.h"
40 #include "android-base/unique_fd.h"
41 #include "bpf/BpfMap.h"
42 #include "netdbpf/bpf_shared.h"
43 #include "netdutils/DumpWriter.h"
44
45 extern "C" {
46 #include "netutils/checksum.h"
47 }
48
49 #include "ClatUtils.h"
50 #include "Fwmark.h"
51 #include "NetdConstants.h"
52 #include "NetworkController.h"
53 #include "netid_client.h"
54
55 static const char* kClatdPath = "/system/bin/clatd";
56
57 // For historical reasons, start with 192.0.0.4, and after that, use all subsequent addresses in
58 // 192.0.0.0/29 (RFC 7335).
59 static const char* kV4AddrString = "192.0.0.4";
60 static const in_addr kV4Addr = {inet_addr(kV4AddrString)};
61 static const int kV4AddrLen = 29;
62
63 using android::base::StringPrintf;
64 using android::base::unique_fd;
65 using android::bpf::BpfMap;
66 using android::netdutils::DumpWriter;
67 using android::netdutils::ScopedIndent;
68
69 namespace android {
70 namespace net {
71
init(void)72 void ClatdController::init(void) {
73 std::lock_guard guard(mutex);
74
75 // TODO: should refactor into separate function for testability
76 if (bpf::getBpfSupportLevel() == bpf::BpfLevel::NONE) {
77 ALOGI("Pre-4.9 kernel or pre-P api shipping level - disabling clat ebpf.");
78 mClatEbpfMode = ClatEbpfDisabled;
79 return;
80 }
81
82 // We know the device initially shipped with at least P...,
83 // but did it ship with at least Q?
84
85 uint64_t api_level = base::GetUintProperty<uint64_t>("ro.product.first_api_level", 0);
86 if (api_level == 0) {
87 ALOGE("Cannot determine initial API level of the device.");
88 api_level = base::GetUintProperty<uint64_t>("ro.build.version.sdk", 0);
89 }
90
91 // Note: MINIMUM_API_REQUIRED is for eBPF as a whole and is thus P
92 if (api_level > bpf::MINIMUM_API_REQUIRED) {
93 ALOGI("4.9+ kernel and device shipped with Q+ - clat ebpf should work.");
94 mClatEbpfMode = ClatEbpfEnabled;
95 } else {
96 // We cannot guarantee that 4.9-P kernels will include NET_CLS_BPF support.
97 ALOGI("4.9+ kernel and device shipped with P - clat ebpf might work.");
98 mClatEbpfMode = ClatEbpfMaybe;
99 }
100
101 int rv = openNetlinkSocket();
102 if (rv < 0) {
103 ALOGE("openNetlinkSocket() failure: %s", strerror(-rv));
104 mClatEbpfMode = ClatEbpfDisabled;
105 return;
106 }
107 mNetlinkFd.reset(rv);
108
109 rv = getClatIngressMapFd();
110 if (rv < 0) {
111 ALOGE("getClatIngressMapFd() failure: %s", strerror(-rv));
112 mClatEbpfMode = ClatEbpfDisabled;
113 mNetlinkFd.reset(-1);
114 return;
115 }
116 mClatIngressMap.reset(rv);
117
118 int netlinkFd = mNetlinkFd.get();
119
120 // TODO: perhaps this initial cleanup should be in its own function?
121 const auto del = [&netlinkFd](const ClatIngressKey& key,
122 const BpfMap<ClatIngressKey, ClatIngressValue>&) {
123 ALOGW("Removing stale clat config on interface %d.", key.iif);
124 int rv = tcQdiscDelDevClsact(netlinkFd, key.iif);
125 if (rv < 0) ALOGE("tcQdiscDelDevClsact() failure: %s", strerror(-rv));
126 return netdutils::status::ok; // keep on going regardless
127 };
128 auto ret = mClatIngressMap.iterate(del);
129 if (!isOk(ret)) ALOGE("mClatIngressMap.iterate() failure: %s", strerror(ret.code()));
130 ret = mClatIngressMap.clear();
131 if (!isOk(ret)) ALOGE("mClatIngressMap.clear() failure: %s", strerror(ret.code()));
132 }
133
isIpv4AddressFree(in_addr_t addr)134 bool ClatdController::isIpv4AddressFree(in_addr_t addr) {
135 int s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
136 if (s == -1) {
137 return 0;
138 }
139
140 // Attempt to connect to the address. If the connection succeeds and getsockname returns the
141 // same then the address is already assigned to the system and we can't use it.
142 struct sockaddr_in sin = {.sin_family = AF_INET, .sin_addr = {addr}, .sin_port = 53};
143 socklen_t len = sizeof(sin);
144 bool inuse = connect(s, (struct sockaddr*)&sin, sizeof(sin)) == 0 &&
145 getsockname(s, (struct sockaddr*)&sin, &len) == 0 && (size_t)len >= sizeof(sin) &&
146 sin.sin_addr.s_addr == addr;
147
148 close(s);
149 return !inuse;
150 }
151
152 // Picks a free IPv4 address, starting from ip and trying all addresses in the prefix in order.
153 // ip - the IP address from the configuration file
154 // prefixlen - the length of the prefix from which addresses may be selected.
155 // returns: the IPv4 address, or INADDR_NONE if no addresses were available
selectIpv4Address(const in_addr ip,int16_t prefixlen)156 in_addr_t ClatdController::selectIpv4Address(const in_addr ip, int16_t prefixlen) {
157 // Don't accept prefixes that are too large because we scan addresses one by one.
158 if (prefixlen < 16 || prefixlen > 32) {
159 return INADDR_NONE;
160 }
161
162 // All these are in host byte order.
163 in_addr_t mask = 0xffffffff >> (32 - prefixlen) << (32 - prefixlen);
164 in_addr_t ipv4 = ntohl(ip.s_addr);
165 in_addr_t first_ipv4 = ipv4;
166 in_addr_t prefix = ipv4 & mask;
167
168 // Pick the first IPv4 address in the pool, wrapping around if necessary.
169 // So, for example, 192.0.0.4 -> 192.0.0.5 -> 192.0.0.6 -> 192.0.0.7 -> 192.0.0.0.
170 do {
171 if (isIpv4AddressFreeFunc(htonl(ipv4))) {
172 return htonl(ipv4);
173 }
174 ipv4 = prefix | ((ipv4 + 1) & ~mask);
175 } while (ipv4 != first_ipv4);
176
177 return INADDR_NONE;
178 }
179
180 // Alters the bits in the IPv6 address to make them checksum neutral with v4 and nat64Prefix.
makeChecksumNeutral(in6_addr * v6,const in_addr v4,const in6_addr & nat64Prefix)181 void ClatdController::makeChecksumNeutral(in6_addr* v6, const in_addr v4,
182 const in6_addr& nat64Prefix) {
183 // Fill last 8 bytes of IPv6 address with random bits.
184 arc4random_buf(&v6->s6_addr[8], 8);
185
186 // Make the IID checksum-neutral. That is, make it so that:
187 // checksum(Local IPv4 | Remote IPv4) = checksum(Local IPv6 | Remote IPv6)
188 // in other words (because remote IPv6 = NAT64 prefix | Remote IPv4):
189 // checksum(Local IPv4) = checksum(Local IPv6 | NAT64 prefix)
190 // Do this by adjusting the two bytes in the middle of the IID.
191
192 uint16_t middlebytes = (v6->s6_addr[11] << 8) + v6->s6_addr[12];
193
194 uint32_t c1 = ip_checksum_add(0, &v4, sizeof(v4));
195 uint32_t c2 = ip_checksum_add(0, &nat64Prefix, sizeof(nat64Prefix)) +
196 ip_checksum_add(0, v6, sizeof(*v6));
197
198 uint16_t delta = ip_checksum_adjust(middlebytes, c1, c2);
199 v6->s6_addr[11] = delta >> 8;
200 v6->s6_addr[12] = delta & 0xff;
201 }
202
203 // Picks a random interface ID that is checksum neutral with the IPv4 address and the NAT64 prefix.
generateIpv6Address(const char * iface,const in_addr v4,const in6_addr & nat64Prefix,in6_addr * v6)204 int ClatdController::generateIpv6Address(const char* iface, const in_addr v4,
205 const in6_addr& nat64Prefix, in6_addr* v6) {
206 unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
207 if (s == -1) return -errno;
208
209 if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1) == -1) {
210 return -errno;
211 }
212
213 sockaddr_in6 sin6 = {.sin6_family = AF_INET6, .sin6_addr = nat64Prefix};
214 if (connect(s, reinterpret_cast<struct sockaddr*>(&sin6), sizeof(sin6)) == -1) {
215 return -errno;
216 }
217
218 socklen_t len = sizeof(sin6);
219 if (getsockname(s, reinterpret_cast<struct sockaddr*>(&sin6), &len) == -1) {
220 return -errno;
221 }
222
223 *v6 = sin6.sin6_addr;
224
225 if (IN6_IS_ADDR_UNSPECIFIED(v6) || IN6_IS_ADDR_LOOPBACK(v6) || IN6_IS_ADDR_LINKLOCAL(v6) ||
226 IN6_IS_ADDR_SITELOCAL(v6) || IN6_IS_ADDR_ULA(v6)) {
227 return -ENETUNREACH;
228 }
229
230 makeChecksumNeutral(v6, v4, nat64Prefix);
231
232 return 0;
233 }
234
maybeStartBpf(const ClatdTracker & tracker)235 void ClatdController::maybeStartBpf(const ClatdTracker& tracker) {
236 if (mClatEbpfMode == ClatEbpfDisabled) return;
237
238 int rv = hardwareAddressType(tracker.iface);
239 if (rv < 0) {
240 ALOGE("hardwareAddressType(%s[%d]) failure: %s", tracker.iface, tracker.ifIndex,
241 strerror(-rv));
242 return;
243 }
244
245 bool isEthernet;
246 switch (rv) {
247 case ARPHRD_ETHER:
248 isEthernet = true;
249 break;
250 case ARPHRD_RAWIP: // in Linux 4.14+ rmnet support was upstreamed and this is 519
251 case 530: // this is ARPHRD_RAWIP on some Android 4.9 kernels with rmnet
252 isEthernet = false;
253 break;
254 default:
255 ALOGE("hardwareAddressType(%s[%d]) returned unknown type %d.", tracker.iface,
256 tracker.ifIndex, rv);
257 return;
258 }
259
260 rv = getClatIngressProgFd(isEthernet);
261 if (rv < 0) {
262 ALOGE("getClatIngressProgFd(%d) failure: %s", isEthernet, strerror(-rv));
263 return;
264 }
265 unique_fd progFd(rv);
266
267 ClatIngressKey key = {
268 .iif = tracker.ifIndex,
269 .pfx96 = tracker.pfx96,
270 .local6 = tracker.v6,
271 };
272 ClatIngressValue value = {
273 // TODO: move all the clat code to eBPF and remove the tun interface entirely.
274 .oif = tracker.v4ifIndex,
275 .local4 = tracker.v4,
276 };
277
278 auto ret = mClatIngressMap.writeValue(key, value, BPF_ANY);
279 if (!isOk(ret)) {
280 ALOGE("mClatIngress.Map.writeValue failure: %s", strerror(ret.code()));
281 return;
282 }
283
284 // We do tc setup *after* populating map, so scanning through map
285 // can always be used to tell us what needs cleanup.
286
287 rv = tcQdiscAddDevClsact(mNetlinkFd, tracker.ifIndex);
288 if (rv) {
289 ALOGE("tcQdiscAddDevClsact(%d[%s]) failure: %s", tracker.ifIndex, tracker.iface,
290 strerror(-rv));
291 ret = mClatIngressMap.deleteValue(key);
292 if (!isOk(ret)) ALOGE("mClatIngressMap.deleteValue failure: %s", strerror(ret.code()));
293 return;
294 }
295
296 rv = tcFilterAddDevBpf(mNetlinkFd, tracker.ifIndex, progFd, isEthernet);
297 if (rv) {
298 if ((rv == -ENOENT) && (mClatEbpfMode == ClatEbpfMaybe)) {
299 ALOGI("tcFilterAddDevBpf(%d[%s], %d): %s", tracker.ifIndex, tracker.iface, isEthernet,
300 strerror(-rv));
301 } else {
302 ALOGE("tcFilterAddDevBpf(%d[%s], %d) failure: %s", tracker.ifIndex, tracker.iface,
303 isEthernet, strerror(-rv));
304 }
305 rv = tcQdiscDelDevClsact(mNetlinkFd, tracker.ifIndex);
306 if (rv)
307 ALOGE("tcQdiscDelDevClsact(%d[%s]) failure: %s", tracker.ifIndex, tracker.iface,
308 strerror(-rv));
309 ret = mClatIngressMap.deleteValue(key);
310 if (!isOk(ret)) ALOGE("mClatIngressMap.deleteValue failure: %s", strerror(ret.code()));
311 return;
312 }
313
314 // success
315 }
316
maybeSetIptablesDropRule(bool add,const char * pfx96Str,const char * v6Str)317 void ClatdController::maybeSetIptablesDropRule(bool add, const char* pfx96Str, const char* v6Str) {
318 if (mClatEbpfMode == ClatEbpfDisabled) return;
319
320 std::string cmd = StringPrintf(
321 "*raw\n"
322 "%s %s -s %s/96 -d %s -j DROP\n"
323 "COMMIT\n",
324 (add ? "-A" : "-D"), LOCAL_RAW_PREROUTING, pfx96Str, v6Str);
325
326 iptablesRestoreFunction(V6, cmd);
327 }
328
maybeStopBpf(const ClatdTracker & tracker)329 void ClatdController::maybeStopBpf(const ClatdTracker& tracker) {
330 if (mClatEbpfMode == ClatEbpfDisabled) return;
331
332 // No need to remove filter, since we remove qdisc it is attached to,
333 // which automatically removes everything attached to the qdisc.
334 int rv = tcQdiscDelDevClsact(mNetlinkFd, tracker.ifIndex);
335 if (rv < 0)
336 ALOGE("tcQdiscDelDevClsact(%d[%s]) failure: %s", tracker.ifIndex, tracker.iface,
337 strerror(-rv));
338
339 // We cleanup map last, so scanning through map can be used to
340 // determine what still needs cleanup.
341
342 ClatIngressKey key = {
343 .iif = tracker.ifIndex,
344 .pfx96 = tracker.pfx96,
345 .local6 = tracker.v6,
346 };
347
348 auto ret = mClatIngressMap.deleteValue(key);
349 if (!isOk(ret)) ALOGE("mClatIngressMap.deleteValue failure: %s", strerror(ret.code()));
350 }
351
352 // Finds the tracker of the clatd running on interface |interface|, or nullptr if clatd has not been
353 // started on |interface|.
getClatdTracker(const std::string & interface)354 ClatdController::ClatdTracker* ClatdController::getClatdTracker(const std::string& interface) {
355 auto it = mClatdTrackers.find(interface);
356 return (it == mClatdTrackers.end() ? nullptr : &it->second);
357 }
358
359 // Initializes a ClatdTracker for the specified interface.
init(unsigned networkId,const std::string & interface,const std::string & v4interface,const std::string & nat64Prefix)360 int ClatdController::ClatdTracker::init(unsigned networkId, const std::string& interface,
361 const std::string& v4interface,
362 const std::string& nat64Prefix) {
363 netId = networkId;
364
365 fwmark.netId = netId;
366 fwmark.explicitlySelected = true;
367 fwmark.protectedFromVpn = true;
368 fwmark.permission = PERMISSION_SYSTEM;
369
370 snprintf(fwmarkString, sizeof(fwmarkString), "0x%x", fwmark.intValue);
371 snprintf(netIdString, sizeof(netIdString), "%u", netId);
372 strlcpy(iface, interface.c_str(), sizeof(iface));
373 ifIndex = if_nametoindex(iface);
374 strlcpy(v4iface, v4interface.c_str(), sizeof(v4iface));
375 v4ifIndex = if_nametoindex(v4iface);
376
377 // Pass in everything that clatd needs: interface, a netid to use for DNS lookups, a fwmark for
378 // outgoing packets, the NAT64 prefix, and the IPv4 and IPv6 addresses.
379 // Validate the prefix and strip off the prefix length.
380 uint8_t family;
381 uint8_t prefixLen;
382 int res = parsePrefix(nat64Prefix.c_str(), &family, &pfx96, sizeof(pfx96), &prefixLen);
383 // clatd only supports /96 prefixes.
384 if (res != sizeof(pfx96)) return res;
385 if (family != AF_INET6) return -EAFNOSUPPORT;
386 if (prefixLen != 96) return -EINVAL;
387 if (!inet_ntop(AF_INET6, &pfx96, pfx96String, sizeof(pfx96String))) return -errno;
388
389 // Pick an IPv4 address.
390 // TODO: this picks the address based on other addresses that are assigned to interfaces, but
391 // the address is only actually assigned to an interface once clatd starts up. So we could end
392 // up with two clatd instances with the same IPv4 address.
393 // Stop doing this and instead pick a free one from the kV4Addr pool.
394 v4 = {selectIpv4Address(kV4Addr, kV4AddrLen)};
395 if (v4.s_addr == INADDR_NONE) {
396 ALOGE("No free IPv4 address in %s/%d", kV4AddrString, kV4AddrLen);
397 return -EADDRNOTAVAIL;
398 }
399 if (!inet_ntop(AF_INET, &v4, v4Str, sizeof(v4Str))) return -errno;
400
401 // Generate a checksum-neutral IID.
402 if (generateIpv6Address(iface, v4, pfx96, &v6)) {
403 ALOGE("Unable to find global source address on %s for %s", iface, pfx96String);
404 return -EADDRNOTAVAIL;
405 }
406 if (!inet_ntop(AF_INET6, &v6, v6Str, sizeof(v6Str))) return -errno;
407
408 ALOGD("starting clatd on %s v4=%s v6=%s pfx96=%s", iface, v4Str, v6Str, pfx96String);
409 return 0;
410 }
411
startClatd(const std::string & interface,const std::string & nat64Prefix,std::string * v6Str)412 int ClatdController::startClatd(const std::string& interface, const std::string& nat64Prefix,
413 std::string* v6Str) {
414 std::lock_guard guard(mutex);
415
416 // 1. fail if pre-existing tracker already exists
417 ClatdTracker* existing = getClatdTracker(interface);
418 if (existing != nullptr) {
419 ALOGE("clatd pid=%d already started on %s", existing->pid, interface.c_str());
420 return -EBUSY;
421 }
422
423 // 2. get network id associated with this external interface
424 unsigned networkId = mNetCtrl->getNetworkForInterface(interface.c_str());
425 if (networkId == NETID_UNSET) {
426 ALOGE("Interface %s not assigned to any netId", interface.c_str());
427 return -ENODEV;
428 }
429
430 // 3. open the tun device in non blocking mode as required by clatd
431 int res = open("/dev/tun", O_RDWR | O_NONBLOCK | O_CLOEXEC);
432 if (res == -1) {
433 res = errno;
434 ALOGE("open of tun device failed (%s)", strerror(res));
435 return -res;
436 }
437 unique_fd tmpTunFd(res);
438
439 // 4. create the v4-... tun interface
440 std::string v4interface("v4-");
441 v4interface += interface;
442
443 struct ifreq ifr = {
444 .ifr_flags = IFF_TUN,
445 };
446 strlcpy(ifr.ifr_name, v4interface.c_str(), sizeof(ifr.ifr_name));
447
448 res = ioctl(tmpTunFd, TUNSETIFF, &ifr, sizeof(ifr));
449 if (res == -1) {
450 res = errno;
451 ALOGE("ioctl(TUNSETIFF) failed (%s)", strerror(res));
452 return -res;
453 }
454
455 // 5. initialize tracker object
456 ClatdTracker tracker;
457 int ret = tracker.init(networkId, interface, v4interface, nat64Prefix);
458 if (ret) return ret;
459
460 // 6. create a throwaway socket to reserve a file descriptor number
461 res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
462 if (res == -1) {
463 res = errno;
464 ALOGE("socket(ipv6/udp) failed (%s)", strerror(res));
465 return -res;
466 }
467 unique_fd passedTunFd(res);
468
469 // 7. this is the FD we'll pass to clatd on the cli, so need it as a string
470 char passedTunFdStr[INT32_STRLEN];
471 snprintf(passedTunFdStr, sizeof(passedTunFdStr), "%d", passedTunFd.get());
472
473 // 8. we're going to use this as argv[0] to clatd to make ps output more useful
474 std::string progname("clatd-");
475 progname += tracker.iface;
476
477 // clang-format off
478 const char* args[] = {progname.c_str(),
479 "-i", tracker.iface,
480 "-n", tracker.netIdString,
481 "-m", tracker.fwmarkString,
482 "-p", tracker.pfx96String,
483 "-4", tracker.v4Str,
484 "-6", tracker.v6Str,
485 "-t", passedTunFdStr,
486 nullptr};
487 // clang-format on
488
489 // 9. register vfork requirement
490 posix_spawnattr_t attr;
491 res = posix_spawnattr_init(&attr);
492 if (res) {
493 ALOGE("posix_spawnattr_init failed (%s)", strerror(res));
494 return -res;
495 }
496 const android::base::ScopeGuard attrGuard = [&] { posix_spawnattr_destroy(&attr); };
497 res = posix_spawnattr_setflags(&attr, POSIX_SPAWN_USEVFORK);
498 if (res) {
499 ALOGE("posix_spawnattr_setflags failed (%s)", strerror(res));
500 return -res;
501 }
502
503 // 10. register dup2() action: this is what 'clears' the CLOEXEC flag
504 // on the tun fd that we want the child clatd process to inherit
505 // (this will happen after the vfork, and before the execve)
506 posix_spawn_file_actions_t fa;
507 res = posix_spawn_file_actions_init(&fa);
508 if (res) {
509 ALOGE("posix_spawn_file_actions_init failed (%s)", strerror(res));
510 return -res;
511 }
512 const android::base::ScopeGuard faGuard = [&] { posix_spawn_file_actions_destroy(&fa); };
513 res = posix_spawn_file_actions_adddup2(&fa, tmpTunFd, passedTunFd);
514 if (res) {
515 ALOGE("posix_spawn_file_actions_adddup2 failed (%s)", strerror(res));
516 return -res;
517 }
518
519 // 11. If necessary, add the drop rule for iptables.
520 maybeSetIptablesDropRule(true, tracker.pfx96String, tracker.v6Str);
521
522 // 12. actually perform vfork/dup2/execve
523 res = posix_spawn(&tracker.pid, kClatdPath, &fa, &attr, (char* const*)args, nullptr);
524 if (res) {
525 ALOGE("posix_spawn failed (%s)", strerror(res));
526 return -res;
527 }
528
529 // 13. configure eBPF offload - if possible
530 maybeStartBpf(tracker);
531
532 mClatdTrackers[interface] = tracker;
533 ALOGD("clatd started on %s", interface.c_str());
534
535 *v6Str = tracker.v6Str;
536 return 0;
537 }
538
stopClatd(const std::string & interface)539 int ClatdController::stopClatd(const std::string& interface) {
540 std::lock_guard guard(mutex);
541 ClatdTracker* tracker = getClatdTracker(interface);
542
543 if (tracker == nullptr) {
544 ALOGE("clatd already stopped");
545 return -ENODEV;
546 }
547
548 ALOGD("Stopping clatd pid=%d on %s", tracker->pid, interface.c_str());
549
550 maybeStopBpf(*tracker);
551
552 kill(tracker->pid, SIGTERM);
553 waitpid(tracker->pid, nullptr, 0);
554
555 maybeSetIptablesDropRule(false, tracker->pfx96String, tracker->v6Str);
556 mClatdTrackers.erase(interface);
557
558 ALOGD("clatd on %s stopped", interface.c_str());
559
560 return 0;
561 }
562
dump(DumpWriter & dw)563 void ClatdController::dump(DumpWriter& dw) {
564 std::lock_guard guard(mutex);
565
566 ScopedIndent clatdIndent(dw);
567 dw.println("ClatdController");
568
569 {
570 ScopedIndent trackerIndent(dw);
571 dw.println("Trackers: iif[iface] nat64Prefix v6Addr -> v4Addr v4iif[v4iface] [netId]");
572
573 ScopedIndent trackerDetailIndent(dw);
574 for (const auto& pair : mClatdTrackers) {
575 const ClatdTracker& tracker = pair.second;
576 dw.println("%u[%s] %s/96 %s -> %s %u[%s] [%u]", tracker.ifIndex, tracker.iface,
577 tracker.pfx96String, tracker.v6Str, tracker.v4Str, tracker.v4ifIndex,
578 tracker.v4iface, tracker.netId);
579 }
580 }
581
582 int mapFd = getClatIngressMapFd();
583 if (mapFd < 0) return; // if unsupported just don't dump anything
584 BpfMap<ClatIngressKey, ClatIngressValue> configMap(mapFd);
585
586 ScopedIndent bpfIndent(dw);
587 dw.println("BPF ingress map: iif(iface) nat64Prefix v6Addr -> v4Addr oif(iface)");
588
589 ScopedIndent bpfDetailIndent(dw);
590 const auto printClatMap = [&dw](const ClatIngressKey& key, const ClatIngressValue& value,
591 const BpfMap<ClatIngressKey, ClatIngressValue>&) {
592 char iifStr[IFNAMSIZ] = "?";
593 char pfx96Str[INET6_ADDRSTRLEN] = "?";
594 char local6Str[INET6_ADDRSTRLEN] = "?";
595 char local4Str[INET_ADDRSTRLEN] = "?";
596 char oifStr[IFNAMSIZ] = "?";
597
598 if_indextoname(key.iif, iifStr);
599 inet_ntop(AF_INET6, &key.pfx96, pfx96Str, sizeof(pfx96Str));
600 inet_ntop(AF_INET6, &key.local6, local6Str, sizeof(local6Str));
601 inet_ntop(AF_INET, &value.local4, local4Str, sizeof(local4Str));
602 if_indextoname(value.oif, oifStr);
603
604 dw.println("%u(%s) %s/96 %s -> %s %u(%s)", key.iif, iifStr, pfx96Str, local6Str, local4Str,
605 value.oif, oifStr);
606 return netdutils::status::ok;
607 };
608 auto res = configMap.iterateWithValue(printClatMap);
609 if (!isOk(res)) {
610 dw.println("Error printing BPF map: %s", res.msg().c_str());
611 }
612 }
613
614 auto ClatdController::isIpv4AddressFreeFunc = isIpv4AddressFree;
615 auto ClatdController::iptablesRestoreFunction = execIptablesRestore;
616
617 } // namespace net
618 } // namespace android
619