1 /*
2 * Copyright 2012 Daniel Drown
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * clatd.c - tun interface setup and main event loop
17 */
18 #include <arpa/inet.h>
19 #include <errno.h>
20 #include <fcntl.h>
21 #include <poll.h>
22 #include <signal.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <sys/ioctl.h>
27 #include <sys/prctl.h>
28 #include <sys/stat.h>
29 #include <sys/types.h>
30 #include <time.h>
31 #include <unistd.h>
32
33 #include <linux/filter.h>
34 #include <linux/if.h>
35 #include <linux/if_ether.h>
36 #include <linux/if_packet.h>
37 #include <linux/if_tun.h>
38 #include <net/if.h>
39 #include <sys/capability.h>
40 #include <sys/uio.h>
41
42 #include <private/android_filesystem_config.h>
43
44 #include "clatd.h"
45 #include "config.h"
46 #include "dump.h"
47 #include "getaddr.h"
48 #include "logging.h"
49 #include "mtu.h"
50 #include "resolv_netid.h"
51 #include "ring.h"
52 #include "setif.h"
53 #include "translate.h"
54 #include "tun.h"
55
56 /* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */
57 #define MTU_DELTA 28
58
59 volatile sig_atomic_t running = 1;
60
61 /* function: stop_loop
62 * signal handler: stop the event loop
63 */
stop_loop()64 void stop_loop() { running = 0; }
65
66 /* function: configure_packet_socket
67 * Binds the packet socket and attaches the receive filter to it.
68 * sock - the socket to configure
69 */
configure_packet_socket(int sock)70 int configure_packet_socket(int sock) {
71 struct sockaddr_ll sll = {
72 .sll_family = AF_PACKET,
73 .sll_protocol = htons(ETH_P_IPV6),
74 .sll_ifindex = if_nametoindex(Global_Clatd_Config.default_pdp_interface),
75 .sll_pkttype = PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel.
76 };
77 if (bind(sock, (struct sockaddr *)&sll, sizeof(sll))) {
78 logmsg(ANDROID_LOG_FATAL, "binding packet socket: %s", strerror(errno));
79 return 0;
80 }
81
82 uint32_t *ipv6 = Global_Clatd_Config.ipv6_local_subnet.s6_addr32;
83
84 // clang-format off
85 struct sock_filter filter_code[] = {
86 // Load the first four bytes of the IPv6 destination address (starts 24 bytes in).
87 // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads
88 // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it
89 // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other
90 // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet).
91 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24),
92 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7),
93 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28),
94 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5),
95 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32),
96 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3),
97 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36),
98 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1),
99 BPF_STMT(BPF_RET | BPF_K, PACKETLEN),
100 BPF_STMT(BPF_RET | BPF_K, 0),
101 };
102 // clang-format on
103 struct sock_fprog filter = { sizeof(filter_code) / sizeof(filter_code[0]), filter_code };
104
105 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) {
106 logmsg(ANDROID_LOG_FATAL, "attach packet filter failed: %s", strerror(errno));
107 return 0;
108 }
109
110 return 1;
111 }
112
113 /* function: ipv4_address_generate
114 * picks a free IPv4 address from the local subnet or exits if there are no free addresses
115 * returns: the IPv4 address as an in_addr_t
116 */
ipv4_address_generate()117 static in_addr_t ipv4_address_generate() {
118 // Pick an IPv4 address to use by finding a free address in the configured prefix. Technically,
119 // there is a race here - if another clatd calls config_select_ipv4_address after we do, but
120 // before we call add_address, it can end up having the same IP address as we do. But the time
121 // window in which this can happen is extremely small, and even if we end up with a duplicate
122 // address, the only damage is that IPv4 TCP connections won't be reset until both interfaces go
123 // down.
124 in_addr_t localaddr = config_select_ipv4_address(&Global_Clatd_Config.ipv4_local_subnet,
125 Global_Clatd_Config.ipv4_local_prefixlen);
126 if (localaddr == INADDR_NONE) {
127 logmsg(ANDROID_LOG_FATAL, "No free IPv4 address in %s/%d",
128 inet_ntoa(Global_Clatd_Config.ipv4_local_subnet),
129 Global_Clatd_Config.ipv4_local_prefixlen);
130 exit(1);
131 }
132 return localaddr;
133 }
134
135 /* function: ipv4_address_from_cmdline
136 * configures the IPv4 address specified on the command line, or exits if the address is not valid
137 * v4_addr - a string, the IPv4 address
138 * returns: the IPv4 address as an in_addr_t
139 */
ipv4_address_from_cmdline(const char * v4_addr)140 static in_addr_t ipv4_address_from_cmdline(const char *v4_addr) {
141 in_addr_t localaddr;
142 if (!inet_pton(AF_INET, v4_addr, &localaddr)) {
143 logmsg(ANDROID_LOG_FATAL, "Invalid IPv4 address %s", v4_addr);
144 exit(1);
145 }
146 return localaddr;
147 }
148
149 /* function: configure_tun_ip
150 * configures the ipv4 and ipv6 addresses on the tunnel interface
151 * tunnel - tun device data
152 */
configure_tun_ip(const struct tun_data * tunnel,const char * v4_addr)153 void configure_tun_ip(const struct tun_data *tunnel, const char *v4_addr) {
154 if (v4_addr) {
155 Global_Clatd_Config.ipv4_local_subnet.s_addr = ipv4_address_from_cmdline(v4_addr);
156 } else {
157 Global_Clatd_Config.ipv4_local_subnet.s_addr = ipv4_address_generate();
158 }
159
160 char addrstr[INET_ADDRSTRLEN];
161 inet_ntop(AF_INET, &Global_Clatd_Config.ipv4_local_subnet, addrstr, sizeof(addrstr));
162 logmsg(ANDROID_LOG_INFO, "Using IPv4 address %s on %s", addrstr, tunnel->device4);
163
164 // Configure the interface before bringing it up. As soon as we bring the interface up, the
165 // framework will be notified and will assume the interface's configuration has been finalized.
166 int status = add_address(tunnel->device4, AF_INET, &Global_Clatd_Config.ipv4_local_subnet, 32,
167 &Global_Clatd_Config.ipv4_local_subnet);
168 if (status < 0) {
169 logmsg(ANDROID_LOG_FATAL, "configure_tun_ip/if_address(4) failed: %s", strerror(-status));
170 exit(1);
171 }
172
173 status = if_up(tunnel->device4, Global_Clatd_Config.ipv4mtu);
174 if (status < 0) {
175 logmsg(ANDROID_LOG_FATAL, "configure_tun_ip/if_up(4) failed: %s", strerror(-status));
176 exit(1);
177 }
178 }
179
180 /* function: set_capability
181 * set the permitted, effective and inheritable capabilities of the current
182 * thread
183 */
set_capability(uint64_t target_cap)184 void set_capability(uint64_t target_cap) {
185 struct __user_cap_header_struct header = {
186 .version = _LINUX_CAPABILITY_VERSION_3,
187 .pid = 0 // 0 = change myself
188 };
189 struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3] = {};
190
191 cap[0].permitted = cap[0].effective = cap[0].inheritable = target_cap;
192 cap[1].permitted = cap[1].effective = cap[1].inheritable = target_cap >> 32;
193
194 if (capset(&header, cap) < 0) {
195 logmsg(ANDROID_LOG_FATAL, "capset failed: %s", strerror(errno));
196 exit(1);
197 }
198 }
199
200 /* function: drop_root_but_keep_caps
201 * drops root privs but keeps the needed capabilities
202 */
drop_root_but_keep_caps()203 void drop_root_but_keep_caps() {
204 gid_t groups[] = { AID_INET, AID_VPN };
205 if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) < 0) {
206 logmsg(ANDROID_LOG_FATAL, "setgroups failed: %s", strerror(errno));
207 exit(1);
208 }
209
210 prctl(PR_SET_KEEPCAPS, 1);
211
212 if (setresgid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
213 logmsg(ANDROID_LOG_FATAL, "setresgid failed: %s", strerror(errno));
214 exit(1);
215 }
216 if (setresuid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
217 logmsg(ANDROID_LOG_FATAL, "setresuid failed: %s", strerror(errno));
218 exit(1);
219 }
220
221 // keep CAP_NET_RAW capability to open raw socket, and CAP_IPC_LOCK for mmap
222 // to lock memory.
223 set_capability((1 << CAP_NET_ADMIN) |
224 (1 << CAP_NET_RAW) |
225 (1 << CAP_IPC_LOCK));
226 }
227
228 /* function: open_sockets
229 * opens a packet socket to receive IPv6 packets and a raw socket to send them
230 * tunnel - tun device data
231 * mark - the socket mark to use for the sending raw socket
232 */
open_sockets(struct tun_data * tunnel,uint32_t mark)233 void open_sockets(struct tun_data *tunnel, uint32_t mark) {
234 int rawsock = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW);
235 if (rawsock < 0) {
236 logmsg(ANDROID_LOG_FATAL, "raw socket failed: %s", strerror(errno));
237 exit(1);
238 }
239
240 int off = 0;
241 if (setsockopt(rawsock, SOL_IPV6, IPV6_CHECKSUM, &off, sizeof(off)) < 0) {
242 logmsg(ANDROID_LOG_WARN, "could not disable checksum on raw socket: %s", strerror(errno));
243 }
244 if (mark != MARK_UNSET && setsockopt(rawsock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
245 logmsg(ANDROID_LOG_ERROR, "could not set mark on raw socket: %s", strerror(errno));
246 }
247
248 tunnel->write_fd6 = rawsock;
249
250 tunnel->read_fd6 = ring_create(tunnel);
251 if (tunnel->read_fd6 < 0) {
252 exit(1);
253 }
254 }
255
ipv6_address_changed(const char * interface)256 int ipv6_address_changed(const char *interface) {
257 union anyip *interface_ip;
258
259 interface_ip = getinterface_ip(interface, AF_INET6);
260 if (!interface_ip) {
261 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface);
262 return 1;
263 }
264
265 if (!ipv6_prefix_equal(&interface_ip->ip6, &Global_Clatd_Config.ipv6_local_subnet)) {
266 char oldstr[INET6_ADDRSTRLEN];
267 char newstr[INET6_ADDRSTRLEN];
268 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, oldstr, sizeof(oldstr));
269 inet_ntop(AF_INET6, &interface_ip->ip6, newstr, sizeof(newstr));
270 logmsg(ANDROID_LOG_INFO, "IPv6 prefix on %s changed: %s -> %s", interface, oldstr, newstr);
271 free(interface_ip);
272 return 1;
273 } else {
274 free(interface_ip);
275 return 0;
276 }
277 }
278
279 /* function: clat_ipv6_address_from_interface
280 * picks the clat IPv6 address based on the interface address
281 * interface - uplink interface name
282 * returns: 1 on success, 0 on failure
283 */
clat_ipv6_address_from_interface(const char * interface)284 static int clat_ipv6_address_from_interface(const char *interface) {
285 union anyip *interface_ip;
286
287 // TODO: check that the prefix length is /64.
288 interface_ip = getinterface_ip(interface, AF_INET6);
289 if (!interface_ip) {
290 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface);
291 return 0;
292 }
293
294 // Generate an interface ID.
295 config_generate_local_ipv6_subnet(&interface_ip->ip6);
296
297 Global_Clatd_Config.ipv6_local_subnet = interface_ip->ip6;
298 free(interface_ip);
299 return 1;
300 }
301
302 /* function: clat_ipv6_address_from_cmdline
303 * parses the clat IPv6 address from the command line
304 * v4_addr - a string, the IPv6 address
305 * returns: 1 on success, 0 on failure
306 */
clat_ipv6_address_from_cmdline(const char * v6_addr)307 static int clat_ipv6_address_from_cmdline(const char *v6_addr) {
308 if (!inet_pton(AF_INET6, v6_addr, &Global_Clatd_Config.ipv6_local_subnet)) {
309 logmsg(ANDROID_LOG_FATAL, "Invalid source address %s", v6_addr);
310 return 0;
311 }
312
313 return 1;
314 }
315
316 /* function: configure_clat_ipv6_address
317 * picks the clat IPv6 address and configures packet translation to use it.
318 * tunnel - tun device data
319 * interface - uplink interface name
320 * returns: 1 on success, 0 on failure
321 */
configure_clat_ipv6_address(const struct tun_data * tunnel,const char * interface,const char * v6_addr)322 int configure_clat_ipv6_address(const struct tun_data *tunnel, const char *interface,
323 const char *v6_addr) {
324 int ret;
325 if (v6_addr) {
326 ret = clat_ipv6_address_from_cmdline(v6_addr);
327 } else {
328 ret = clat_ipv6_address_from_interface(interface);
329 }
330 if (!ret) return 0;
331
332 char addrstr[INET6_ADDRSTRLEN];
333 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, addrstr, sizeof(addrstr));
334 logmsg(ANDROID_LOG_INFO, "Using IPv6 address %s on %s", addrstr, interface);
335
336 // Start translating packets to the new prefix.
337 add_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet, interface);
338
339 // Update our packet socket filter to reflect the new 464xlat IP address.
340 if (!configure_packet_socket(tunnel->read_fd6)) {
341 // Things aren't going to work. Bail out and hope we have better luck next time.
342 // We don't log an error here because configure_packet_socket has already done so.
343 return 0;
344 }
345
346 return 1;
347 }
348
349 /* function: configure_interface
350 * reads the configuration and applies it to the interface
351 * uplink_interface - network interface to use to reach the ipv6 internet
352 * plat_prefix - PLAT prefix to use
353 * tunnel - tun device data
354 * net_id - NetID to use, NETID_UNSET indicates use of default network
355 */
configure_interface(const char * uplink_interface,const char * plat_prefix,const char * v4_addr,const char * v6_addr,struct tun_data * tunnel,unsigned net_id)356 void configure_interface(const char *uplink_interface, const char *plat_prefix, const char *v4_addr,
357 const char *v6_addr, struct tun_data *tunnel, unsigned net_id) {
358
359 if (!read_config("/system/etc/clatd.conf", uplink_interface, plat_prefix, net_id)) {
360 logmsg(ANDROID_LOG_FATAL, "read_config failed");
361 exit(1);
362 }
363
364 if (Global_Clatd_Config.mtu > MAXMTU) {
365 logmsg(ANDROID_LOG_WARN, "Max MTU is %d, requested %d", MAXMTU, Global_Clatd_Config.mtu);
366 Global_Clatd_Config.mtu = MAXMTU;
367 }
368 if (Global_Clatd_Config.mtu <= 0) {
369 Global_Clatd_Config.mtu = getifmtu(Global_Clatd_Config.default_pdp_interface);
370 logmsg(ANDROID_LOG_WARN, "ifmtu=%d", Global_Clatd_Config.mtu);
371 }
372 if (Global_Clatd_Config.mtu < 1280) {
373 logmsg(ANDROID_LOG_WARN, "mtu too small = %d", Global_Clatd_Config.mtu);
374 Global_Clatd_Config.mtu = 1280;
375 }
376
377 if (Global_Clatd_Config.ipv4mtu <= 0 ||
378 Global_Clatd_Config.ipv4mtu > Global_Clatd_Config.mtu - MTU_DELTA) {
379 Global_Clatd_Config.ipv4mtu = Global_Clatd_Config.mtu - MTU_DELTA;
380 logmsg(ANDROID_LOG_WARN, "ipv4mtu now set to = %d", Global_Clatd_Config.ipv4mtu);
381 }
382
383 configure_tun_ip(tunnel, v4_addr);
384
385 if (!configure_clat_ipv6_address(tunnel, uplink_interface, v6_addr)) {
386 exit(1);
387 }
388 }
389
390 /* function: read_packet
391 * reads a packet from the tunnel fd and translates it
392 * read_fd - file descriptor to read original packet from
393 * write_fd - file descriptor to write translated packet to
394 * to_ipv6 - whether the packet is to be translated to ipv6 or ipv4
395 */
read_packet(int read_fd,int write_fd,int to_ipv6)396 void read_packet(int read_fd, int write_fd, int to_ipv6) {
397 ssize_t readlen;
398 uint8_t buf[PACKETLEN], *packet;
399
400 readlen = read(read_fd, buf, PACKETLEN);
401
402 if (readlen < 0) {
403 if (errno != EAGAIN) {
404 logmsg(ANDROID_LOG_WARN, "read_packet/read error: %s", strerror(errno));
405 }
406 return;
407 } else if (readlen == 0) {
408 logmsg(ANDROID_LOG_WARN, "read_packet/tun interface removed");
409 running = 0;
410 return;
411 }
412
413 struct tun_pi *tun_header = (struct tun_pi *)buf;
414 if (readlen < (ssize_t)sizeof(*tun_header)) {
415 logmsg(ANDROID_LOG_WARN, "read_packet/short read: got %ld bytes", readlen);
416 return;
417 }
418
419 uint16_t proto = ntohs(tun_header->proto);
420 if (proto == ETH_P_IPV6) {
421 // kernel IPv6 stack spams us with router/neighbour solication,
422 // multicast group joins, etc. which otherwise fills the log...
423 return;
424 }
425 if (proto != ETH_P_IP) {
426 logmsg(ANDROID_LOG_WARN, "%s: unknown packet type = 0x%x", __func__, proto);
427 return;
428 }
429
430 if (tun_header->flags != 0) {
431 logmsg(ANDROID_LOG_WARN, "%s: unexpected flags = %d", __func__, tun_header->flags);
432 }
433
434 packet = (uint8_t *)(tun_header + 1);
435 readlen -= sizeof(*tun_header);
436 translate_packet(write_fd, to_ipv6, packet, readlen);
437 }
438
439 /* function: event_loop
440 * reads packets from the tun network interface and passes them down the stack
441 * tunnel - tun device data
442 */
event_loop(struct tun_data * tunnel)443 void event_loop(struct tun_data *tunnel) {
444 time_t last_interface_poll;
445 struct pollfd wait_fd[] = {
446 { tunnel->read_fd6, POLLIN, 0 },
447 { tunnel->fd4, POLLIN, 0 },
448 };
449
450 // start the poll timer
451 last_interface_poll = time(NULL);
452
453 while (running) {
454 if (poll(wait_fd, ARRAY_SIZE(wait_fd), NO_TRAFFIC_INTERFACE_POLL_FREQUENCY * 1000) == -1) {
455 if (errno != EINTR) {
456 logmsg(ANDROID_LOG_WARN, "event_loop/poll returned an error: %s", strerror(errno));
457 }
458 } else {
459 if (wait_fd[0].revents & POLLIN) {
460 ring_read(&tunnel->ring, tunnel->fd4, 0 /* to_ipv6 */);
461 }
462 // If any other bit is set, assume it's due to an error (i.e. POLLERR).
463 if (wait_fd[0].revents & ~POLLIN) {
464 // ring_read doesn't clear the error indication on the socket.
465 recv(tunnel->read_fd6, NULL, 0, MSG_PEEK);
466 logmsg(ANDROID_LOG_WARN, "event_loop: clearing error on read_fd6: %s", strerror(errno));
467 }
468
469 // Call read_packet if the socket has data to be read, but also if an
470 // error is waiting. If we don't call read() after getting POLLERR, a
471 // subsequent poll() will return immediately with POLLERR again,
472 // causing this code to spin in a loop. Calling read() will clear the
473 // socket error flag instead.
474 if (wait_fd[1].revents) {
475 read_packet(tunnel->fd4, tunnel->write_fd6, 1 /* to_ipv6 */);
476 }
477 }
478
479 time_t now = time(NULL);
480 if (last_interface_poll < (now - INTERFACE_POLL_FREQUENCY)) {
481 if (ipv6_address_changed(Global_Clatd_Config.default_pdp_interface)) {
482 break;
483 }
484 }
485 }
486 }
487