1 /*
2 * Copyright 2012 Daniel Drown
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * clatd.c - tun interface setup and main event loop
17 */
18 #include <arpa/inet.h>
19 #include <errno.h>
20 #include <fcntl.h>
21 #include <poll.h>
22 #include <signal.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <sys/ioctl.h>
27 #include <sys/prctl.h>
28 #include <sys/stat.h>
29 #include <sys/types.h>
30 #include <time.h>
31 #include <unistd.h>
32
33 #include <linux/filter.h>
34 #include <linux/if.h>
35 #include <linux/if_ether.h>
36 #include <linux/if_packet.h>
37 #include <linux/if_tun.h>
38 #include <net/if.h>
39 #include <sys/capability.h>
40 #include <sys/uio.h>
41
42 #include <netid_client.h> // For MARK_UNSET.
43 #include <private/android_filesystem_config.h> // For AID_CLAT.
44
45 #include "clatd.h"
46 #include "config.h"
47 #include "dump.h"
48 #include "getaddr.h"
49 #include "logging.h"
50 #include "ring.h"
51 #include "setif.h"
52 #include "translate.h"
53
54 struct clat_config Global_Clatd_Config;
55
56 /* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */
57 #define MTU_DELTA 28
58
59 volatile sig_atomic_t running = 1;
60
61 /* function: stop_loop
62 * signal handler: stop the event loop
63 */
stop_loop()64 void stop_loop() { running = 0; }
65
66 /* function: configure_packet_socket
67 * Binds the packet socket and attaches the receive filter to it.
68 * sock - the socket to configure
69 */
configure_packet_socket(int sock)70 int configure_packet_socket(int sock) {
71 uint32_t *ipv6 = Global_Clatd_Config.ipv6_local_subnet.s6_addr32;
72
73 // clang-format off
74 struct sock_filter filter_code[] = {
75 // Load the first four bytes of the IPv6 destination address (starts 24 bytes in).
76 // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads
77 // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it
78 // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other
79 // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet).
80 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24),
81 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7),
82 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28),
83 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5),
84 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32),
85 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3),
86 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36),
87 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1),
88 BPF_STMT(BPF_RET | BPF_K, PACKETLEN),
89 BPF_STMT(BPF_RET | BPF_K, 0),
90 };
91 // clang-format on
92 struct sock_fprog filter = { sizeof(filter_code) / sizeof(filter_code[0]), filter_code };
93
94 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) {
95 logmsg(ANDROID_LOG_FATAL, "attach packet filter failed: %s", strerror(errno));
96 return 0;
97 }
98
99 struct sockaddr_ll sll = {
100 .sll_family = AF_PACKET,
101 .sll_protocol = htons(ETH_P_IPV6),
102 .sll_ifindex = if_nametoindex(Global_Clatd_Config.native_ipv6_interface),
103 .sll_pkttype = PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel.
104 };
105 if (bind(sock, (struct sockaddr *)&sll, sizeof(sll))) {
106 logmsg(ANDROID_LOG_FATAL, "binding packet socket: %s", strerror(errno));
107 return 0;
108 }
109
110 return 1;
111 }
112
113 /* function: configure_tun_ip
114 * configures the ipv4 and ipv6 addresses on the tunnel interface
115 * tunnel - tun device data
116 * mtu - mtu of tun device
117 */
configure_tun_ip(const struct tun_data * tunnel,const char * v4_addr,int mtu)118 void configure_tun_ip(const struct tun_data *tunnel, const char *v4_addr, int mtu) {
119 if (!v4_addr || !inet_pton(AF_INET, v4_addr, &Global_Clatd_Config.ipv4_local_subnet.s_addr)) {
120 logmsg(ANDROID_LOG_FATAL, "Invalid IPv4 address %s", v4_addr);
121 exit(1);
122 }
123
124 char addrstr[INET_ADDRSTRLEN];
125 inet_ntop(AF_INET, &Global_Clatd_Config.ipv4_local_subnet, addrstr, sizeof(addrstr));
126 logmsg(ANDROID_LOG_INFO, "Using IPv4 address %s on %s", addrstr, tunnel->device4);
127
128 // Configure the interface before bringing it up. As soon as we bring the interface up, the
129 // framework will be notified and will assume the interface's configuration has been finalized.
130 int status = add_address(tunnel->device4, AF_INET, &Global_Clatd_Config.ipv4_local_subnet, 32,
131 &Global_Clatd_Config.ipv4_local_subnet);
132 if (status < 0) {
133 logmsg(ANDROID_LOG_FATAL, "configure_tun_ip/if_address(4) failed: %s", strerror(-status));
134 exit(1);
135 }
136
137 status = if_up(tunnel->device4, mtu);
138 if (status < 0) {
139 logmsg(ANDROID_LOG_FATAL, "configure_tun_ip/if_up(4) failed: %s", strerror(-status));
140 exit(1);
141 }
142 }
143
144 /* function: set_capability
145 * set the permitted, effective and inheritable capabilities of the current
146 * thread
147 */
set_capability(uint64_t target_cap)148 void set_capability(uint64_t target_cap) {
149 struct __user_cap_header_struct header = {
150 .version = _LINUX_CAPABILITY_VERSION_3,
151 .pid = 0 // 0 = change myself
152 };
153 struct __user_cap_data_struct cap[_LINUX_CAPABILITY_U32S_3] = {};
154
155 cap[0].permitted = cap[0].effective = cap[0].inheritable = target_cap;
156 cap[1].permitted = cap[1].effective = cap[1].inheritable = target_cap >> 32;
157
158 if (capset(&header, cap) < 0) {
159 logmsg(ANDROID_LOG_FATAL, "capset failed: %s", strerror(errno));
160 exit(1);
161 }
162 }
163
164 /* function: drop_root_but_keep_caps
165 * drops root privs but keeps the needed capabilities
166 */
drop_root_but_keep_caps()167 void drop_root_but_keep_caps() {
168 gid_t groups[] = { AID_INET, AID_VPN };
169 if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) < 0) {
170 logmsg(ANDROID_LOG_FATAL, "setgroups failed: %s", strerror(errno));
171 exit(1);
172 }
173
174 prctl(PR_SET_KEEPCAPS, 1);
175
176 if (setresgid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
177 logmsg(ANDROID_LOG_FATAL, "setresgid failed: %s", strerror(errno));
178 exit(1);
179 }
180 if (setresuid(AID_CLAT, AID_CLAT, AID_CLAT) < 0) {
181 logmsg(ANDROID_LOG_FATAL, "setresuid failed: %s", strerror(errno));
182 exit(1);
183 }
184
185 // keep CAP_NET_RAW capability to open raw socket, and CAP_IPC_LOCK for mmap
186 // to lock memory.
187 set_capability((1 << CAP_NET_ADMIN) |
188 (1 << CAP_NET_RAW) |
189 (1 << CAP_IPC_LOCK));
190 }
191
192 /* function: open_sockets
193 * opens a packet socket to receive IPv6 packets and a raw socket to send them
194 * tunnel - tun device data
195 * mark - the socket mark to use for the sending raw socket
196 */
open_sockets(struct tun_data * tunnel,uint32_t mark)197 void open_sockets(struct tun_data *tunnel, uint32_t mark) {
198 int rawsock = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW);
199 if (rawsock < 0) {
200 logmsg(ANDROID_LOG_FATAL, "raw socket failed: %s", strerror(errno));
201 exit(1);
202 }
203
204 if (mark != MARK_UNSET && setsockopt(rawsock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
205 logmsg(ANDROID_LOG_ERROR, "could not set mark on raw socket: %s", strerror(errno));
206 }
207
208 tunnel->write_fd6 = rawsock;
209
210 tunnel->read_fd6 = ring_create(tunnel);
211 if (tunnel->read_fd6 < 0) {
212 exit(1);
213 }
214 }
215
ipv6_address_changed(const char * interface)216 int ipv6_address_changed(const char *interface) {
217 union anyip *interface_ip;
218
219 interface_ip = getinterface_ip(interface, AF_INET6);
220 if (!interface_ip) {
221 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface);
222 return 1;
223 }
224
225 if (!ipv6_prefix_equal(&interface_ip->ip6, &Global_Clatd_Config.ipv6_local_subnet)) {
226 char oldstr[INET6_ADDRSTRLEN];
227 char newstr[INET6_ADDRSTRLEN];
228 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, oldstr, sizeof(oldstr));
229 inet_ntop(AF_INET6, &interface_ip->ip6, newstr, sizeof(newstr));
230 logmsg(ANDROID_LOG_INFO, "IPv6 prefix on %s changed: %s -> %s", interface, oldstr, newstr);
231 free(interface_ip);
232 return 1;
233 } else {
234 free(interface_ip);
235 return 0;
236 }
237 }
238
239 /* function: configure_clat_ipv6_address
240 * picks the clat IPv6 address and configures packet translation to use it.
241 * tunnel - tun device data
242 * interface - uplink interface name
243 * returns: 1 on success, 0 on failure
244 */
configure_clat_ipv6_address(const struct tun_data * tunnel,const char * interface,const char * v6_addr)245 int configure_clat_ipv6_address(const struct tun_data *tunnel, const char *interface,
246 const char *v6_addr) {
247 if (!v6_addr || !inet_pton(AF_INET6, v6_addr, &Global_Clatd_Config.ipv6_local_subnet)) {
248 logmsg(ANDROID_LOG_FATAL, "Invalid source address %s", v6_addr);
249 return 0;
250 }
251
252 char addrstr[INET6_ADDRSTRLEN];
253 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, addrstr, sizeof(addrstr));
254 logmsg(ANDROID_LOG_INFO, "Using IPv6 address %s on %s", addrstr, interface);
255
256 // Start translating packets to the new prefix.
257 add_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet, interface);
258
259 // Update our packet socket filter to reflect the new 464xlat IP address.
260 if (!configure_packet_socket(tunnel->read_fd6)) {
261 // Things aren't going to work. Bail out and hope we have better luck next time.
262 // We don't log an error here because configure_packet_socket has already done so.
263 return 0;
264 }
265
266 return 1;
267 }
268
detect_mtu(const struct in6_addr * plat_subnet,uint32_t plat_suffix,uint32_t mark)269 int detect_mtu(const struct in6_addr *plat_subnet, uint32_t plat_suffix, uint32_t mark) {
270 // Create an IPv6 UDP socket.
271 int s = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
272 if (s < 0) {
273 logmsg(ANDROID_LOG_FATAL, "socket(AF_INET6, SOCK_DGRAM, 0) failed");
274 exit(1);
275 }
276
277 // Socket's mark affects routing decisions (network selection)
278 if ((mark != MARK_UNSET) && setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) {
279 logmsg(ANDROID_LOG_FATAL, "setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(errno));
280 exit(1);
281 }
282
283 // Try to connect udp socket to plat_subnet(96 bits):plat_suffix(32 bits)
284 struct sockaddr_in6 dst = {
285 .sin6_family = AF_INET6,
286 .sin6_addr = *plat_subnet,
287 };
288 dst.sin6_addr.s6_addr32[3] = plat_suffix;
289 if (connect(s, (struct sockaddr *)&dst, sizeof(dst))) {
290 logmsg(ANDROID_LOG_FATAL, "connect() failed: %s", strerror(errno));
291 exit(1);
292 }
293
294 // Fetch the socket's IPv6 mtu - this is effectively fetching mtu from routing table
295 int mtu;
296 socklen_t sz_mtu = sizeof(mtu);
297 if (getsockopt(s, SOL_IPV6, IPV6_MTU, &mtu, &sz_mtu)) {
298 logmsg(ANDROID_LOG_FATAL, "getsockopt(SOL_IPV6, IPV6_MTU) failed: %s", strerror(errno));
299 exit(1);
300 }
301 if (sz_mtu != sizeof(mtu)) {
302 logmsg(ANDROID_LOG_FATAL, "getsockopt(SOL_IPV6, IPV6_MTU) returned unexpected size: %d",
303 sz_mtu);
304 exit(1);
305 }
306 close(s);
307
308 return mtu;
309 }
310
311 /* function: configure_interface
312 * reads the configuration and applies it to the interface
313 * uplink_interface - network interface to use to reach the ipv6 internet
314 * plat_prefix - PLAT prefix to use
315 * v4_addr - the v4 address to use on the tunnel interface
316 * v6_addr - the v6 address to use on the native interface
317 * tunnel - tun device data
318 * mark - the socket mark to use for the sending raw socket
319 */
configure_interface(const char * uplink_interface,const char * plat_prefix,const char * v4_addr,const char * v6_addr,struct tun_data * tunnel,uint32_t mark)320 void configure_interface(const char *uplink_interface, const char *plat_prefix, const char *v4_addr,
321 const char *v6_addr, struct tun_data *tunnel, uint32_t mark) {
322 Global_Clatd_Config.native_ipv6_interface = uplink_interface;
323 if (!plat_prefix || inet_pton(AF_INET6, plat_prefix, &Global_Clatd_Config.plat_subnet) <= 0) {
324 logmsg(ANDROID_LOG_FATAL, "invalid IPv6 address specified for plat prefix: %s", plat_prefix);
325 exit(1);
326 }
327
328 int mtu = detect_mtu(&Global_Clatd_Config.plat_subnet, htonl(0x08080808), mark);
329 // clamp to minimum ipv6 mtu - this probably cannot ever trigger
330 if (mtu < 1280) mtu = 1280;
331 // clamp to buffer size
332 if (mtu > MAXMTU) mtu = MAXMTU;
333 // decrease by ipv6(40) + ipv6 fragmentation header(8) vs ipv4(20) overhead of 28 bytes
334 mtu -= MTU_DELTA;
335 logmsg(ANDROID_LOG_WARN, "ipv4 mtu is %d", mtu);
336
337 configure_tun_ip(tunnel, v4_addr, mtu);
338
339 if (!configure_clat_ipv6_address(tunnel, uplink_interface, v6_addr)) {
340 exit(1);
341 }
342 }
343
344 /* function: read_packet
345 * reads a packet from the tunnel fd and translates it
346 * read_fd - file descriptor to read original packet from
347 * write_fd - file descriptor to write translated packet to
348 * to_ipv6 - whether the packet is to be translated to ipv6 or ipv4
349 */
read_packet(int read_fd,int write_fd,int to_ipv6)350 void read_packet(int read_fd, int write_fd, int to_ipv6) {
351 ssize_t readlen;
352 uint8_t buf[PACKETLEN], *packet;
353
354 readlen = read(read_fd, buf, PACKETLEN);
355
356 if (readlen < 0) {
357 if (errno != EAGAIN) {
358 logmsg(ANDROID_LOG_WARN, "read_packet/read error: %s", strerror(errno));
359 }
360 return;
361 } else if (readlen == 0) {
362 logmsg(ANDROID_LOG_WARN, "read_packet/tun interface removed");
363 running = 0;
364 return;
365 }
366
367 struct tun_pi *tun_header = (struct tun_pi *)buf;
368 if (readlen < (ssize_t)sizeof(*tun_header)) {
369 logmsg(ANDROID_LOG_WARN, "read_packet/short read: got %ld bytes", readlen);
370 return;
371 }
372
373 uint16_t proto = ntohs(tun_header->proto);
374 if (proto != ETH_P_IP) {
375 logmsg(ANDROID_LOG_WARN, "%s: unknown packet type = 0x%x", __func__, proto);
376 return;
377 }
378
379 if (tun_header->flags != 0) {
380 logmsg(ANDROID_LOG_WARN, "%s: unexpected flags = %d", __func__, tun_header->flags);
381 }
382
383 packet = (uint8_t *)(tun_header + 1);
384 readlen -= sizeof(*tun_header);
385 translate_packet(write_fd, to_ipv6, packet, readlen);
386 }
387
388 /* function: event_loop
389 * reads packets from the tun network interface and passes them down the stack
390 * tunnel - tun device data
391 */
event_loop(struct tun_data * tunnel)392 void event_loop(struct tun_data *tunnel) {
393 time_t last_interface_poll;
394 struct pollfd wait_fd[] = {
395 { tunnel->read_fd6, POLLIN, 0 },
396 { tunnel->fd4, POLLIN, 0 },
397 };
398
399 // start the poll timer
400 last_interface_poll = time(NULL);
401
402 while (running) {
403 if (poll(wait_fd, ARRAY_SIZE(wait_fd), NO_TRAFFIC_INTERFACE_POLL_FREQUENCY * 1000) == -1) {
404 if (errno != EINTR) {
405 logmsg(ANDROID_LOG_WARN, "event_loop/poll returned an error: %s", strerror(errno));
406 }
407 } else {
408 if (wait_fd[0].revents & POLLIN) {
409 ring_read(&tunnel->ring, tunnel->fd4, 0 /* to_ipv6 */);
410 }
411 // If any other bit is set, assume it's due to an error (i.e. POLLERR).
412 if (wait_fd[0].revents & ~POLLIN) {
413 // ring_read doesn't clear the error indication on the socket.
414 recv(tunnel->read_fd6, NULL, 0, MSG_PEEK);
415 logmsg(ANDROID_LOG_WARN, "event_loop: clearing error on read_fd6: %s", strerror(errno));
416 }
417
418 // Call read_packet if the socket has data to be read, but also if an
419 // error is waiting. If we don't call read() after getting POLLERR, a
420 // subsequent poll() will return immediately with POLLERR again,
421 // causing this code to spin in a loop. Calling read() will clear the
422 // socket error flag instead.
423 if (wait_fd[1].revents) {
424 read_packet(tunnel->fd4, tunnel->write_fd6, 1 /* to_ipv6 */);
425 }
426 }
427
428 time_t now = time(NULL);
429 if (now >= (last_interface_poll + INTERFACE_POLL_FREQUENCY)) {
430 last_interface_poll = now;
431 if (ipv6_address_changed(Global_Clatd_Config.native_ipv6_interface)) {
432 break;
433 }
434 }
435 }
436 }
437