1 /*
2 * Copyright 2012 Daniel Drown
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 * clatd.c - tun interface setup and main event loop
17 */
18 #include <poll.h>
19 #include <signal.h>
20 #include <time.h>
21 #include <stdio.h>
22 #include <sys/types.h>
23 #include <sys/ioctl.h>
24 #include <sys/prctl.h>
25 #include <sys/stat.h>
26 #include <string.h>
27 #include <errno.h>
28 #include <stdlib.h>
29 #include <unistd.h>
30 #include <arpa/inet.h>
31 #include <fcntl.h>
32
33 #include <sys/capability.h>
34 #include <sys/uio.h>
35 #include <linux/filter.h>
36 #include <linux/if.h>
37 #include <linux/if_tun.h>
38 #include <linux/if_ether.h>
39 #include <linux/if_packet.h>
40 #include <net/if.h>
41
42 #include <private/android_filesystem_config.h>
43
44 #include "translate.h"
45 #include "clatd.h"
46 #include "config.h"
47 #include "logging.h"
48 #include "resolv_netid.h"
49 #include "setif.h"
50 #include "mtu.h"
51 #include "getaddr.h"
52 #include "dump.h"
53 #include "tun.h"
54 #include "ring.h"
55
56 #define DEVICEPREFIX "v4-"
57
58 /* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */
59 #define MTU_DELTA 28
60
61 volatile sig_atomic_t running = 1;
62
63 /* function: stop_loop
64 * signal handler: stop the event loop
65 */
stop_loop()66 void stop_loop() {
67 running = 0;
68 }
69
70 /* function: configure_packet_socket
71 * Binds the packet socket and attaches the receive filter to it.
72 * sock - the socket to configure
73 */
configure_packet_socket(int sock)74 int configure_packet_socket(int sock) {
75 struct sockaddr_ll sll = {
76 .sll_family = AF_PACKET,
77 .sll_protocol = htons(ETH_P_IPV6),
78 .sll_ifindex = if_nametoindex(Global_Clatd_Config.default_pdp_interface),
79 .sll_pkttype = PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel.
80 };
81 if (bind(sock, (struct sockaddr *) &sll, sizeof(sll))) {
82 logmsg(ANDROID_LOG_FATAL, "binding packet socket: %s", strerror(errno));
83 return 0;
84 }
85
86 uint32_t *ipv6 = Global_Clatd_Config.ipv6_local_subnet.s6_addr32;
87 struct sock_filter filter_code[] = {
88 // Load the first four bytes of the IPv6 destination address (starts 24 bytes in).
89 // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads
90 // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it
91 // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other
92 // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet).
93 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24),
94 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7),
95 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28),
96 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5),
97 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32),
98 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3),
99 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36),
100 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1),
101 BPF_STMT(BPF_RET | BPF_K, PACKETLEN),
102 BPF_STMT(BPF_RET | BPF_K, 0)
103 };
104 struct sock_fprog filter = {
105 sizeof(filter_code) / sizeof(filter_code[0]),
106 filter_code
107 };
108
109 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) {
110 logmsg(ANDROID_LOG_FATAL, "attach packet filter failed: %s", strerror(errno));
111 return 0;
112 }
113
114 return 1;
115 }
116
117 /* function: configure_tun_ip
118 * configures the ipv4 and ipv6 addresses on the tunnel interface
119 * tunnel - tun device data
120 */
configure_tun_ip(const struct tun_data * tunnel)121 void configure_tun_ip(const struct tun_data *tunnel) {
122 int status;
123
124 // Pick an IPv4 address to use by finding a free address in the configured prefix. Technically,
125 // there is a race here - if another clatd calls config_select_ipv4_address after we do, but
126 // before we call add_address, it can end up having the same IP address as we do. But the time
127 // window in which this can happen is extremely small, and even if we end up with a duplicate
128 // address, the only damage is that IPv4 TCP connections won't be reset until both interfaces go
129 // down.
130 in_addr_t localaddr = config_select_ipv4_address(&Global_Clatd_Config.ipv4_local_subnet,
131 Global_Clatd_Config.ipv4_local_prefixlen);
132 if (localaddr == INADDR_NONE) {
133 logmsg(ANDROID_LOG_FATAL,"No free IPv4 address in %s/%d",
134 inet_ntoa(Global_Clatd_Config.ipv4_local_subnet),
135 Global_Clatd_Config.ipv4_local_prefixlen);
136 exit(1);
137 }
138 Global_Clatd_Config.ipv4_local_subnet.s_addr = localaddr;
139
140 // Configure the interface before bringing it up. As soon as we bring the interface up, the
141 // framework will be notified and will assume the interface's configuration has been finalized.
142 status = add_address(tunnel->device4, AF_INET, &Global_Clatd_Config.ipv4_local_subnet,
143 32, &Global_Clatd_Config.ipv4_local_subnet);
144 if(status < 0) {
145 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_address(4) failed: %s",strerror(-status));
146 exit(1);
147 }
148
149 char addrstr[INET_ADDRSTRLEN];
150 inet_ntop(AF_INET, &Global_Clatd_Config.ipv4_local_subnet, addrstr, sizeof(addrstr));
151 logmsg(ANDROID_LOG_INFO, "Using IPv4 address %s on %s", addrstr, tunnel->device4);
152
153 if((status = if_up(tunnel->device4, Global_Clatd_Config.ipv4mtu)) < 0) {
154 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_up(4) failed: %s",strerror(-status));
155 exit(1);
156 }
157 }
158
159 /* function: drop_root
160 * drops root privs but keeps the needed capability
161 */
drop_root()162 void drop_root() {
163 gid_t groups[] = { AID_INET, AID_VPN };
164 if(setgroups(sizeof(groups)/sizeof(groups[0]), groups) < 0) {
165 logmsg(ANDROID_LOG_FATAL,"drop_root/setgroups failed: %s",strerror(errno));
166 exit(1);
167 }
168
169 prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
170
171 if(setgid(AID_CLAT) < 0) {
172 logmsg(ANDROID_LOG_FATAL,"drop_root/setgid failed: %s",strerror(errno));
173 exit(1);
174 }
175 if(setuid(AID_CLAT) < 0) {
176 logmsg(ANDROID_LOG_FATAL,"drop_root/setuid failed: %s",strerror(errno));
177 exit(1);
178 }
179
180 struct __user_cap_header_struct header;
181 struct __user_cap_data_struct cap;
182 memset(&header, 0, sizeof(header));
183 memset(&cap, 0, sizeof(cap));
184
185 header.version = _LINUX_CAPABILITY_VERSION;
186 header.pid = 0; // 0 = change myself
187 cap.effective = cap.permitted = (1 << CAP_NET_ADMIN);
188
189 if(capset(&header, &cap) < 0) {
190 logmsg(ANDROID_LOG_FATAL,"drop_root/capset failed: %s",strerror(errno));
191 exit(1);
192 }
193 }
194
195 /* function: open_sockets
196 * opens a packet socket to receive IPv6 packets and a raw socket to send them
197 * tunnel - tun device data
198 * mark - the socket mark to use for the sending raw socket
199 */
open_sockets(struct tun_data * tunnel,uint32_t mark)200 void open_sockets(struct tun_data *tunnel, uint32_t mark) {
201 int rawsock = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK, IPPROTO_RAW);
202 if (rawsock < 0) {
203 logmsg(ANDROID_LOG_FATAL, "raw socket failed: %s", strerror(errno));
204 exit(1);
205 }
206
207 int off = 0;
208 if (setsockopt(rawsock, SOL_IPV6, IPV6_CHECKSUM, &off, sizeof(off)) < 0) {
209 logmsg(ANDROID_LOG_WARN, "could not disable checksum on raw socket: %s", strerror(errno));
210 }
211 if (mark != MARK_UNSET && setsockopt(rawsock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
212 logmsg(ANDROID_LOG_ERROR, "could not set mark on raw socket: %s", strerror(errno));
213 }
214
215 tunnel->write_fd6 = rawsock;
216
217 tunnel->read_fd6 = ring_create(tunnel);
218 if (tunnel->read_fd6 < 0) {
219 exit(1);
220 }
221 }
222
223 /* function: update_clat_ipv6_address
224 * picks the clat IPv6 address and configures packet translation to use it.
225 * tunnel - tun device data
226 * interface - uplink interface name
227 * returns: 1 on success, 0 on failure
228 */
update_clat_ipv6_address(const struct tun_data * tunnel,const char * interface)229 int update_clat_ipv6_address(const struct tun_data *tunnel, const char *interface) {
230 union anyip *interface_ip;
231 char addrstr[INET6_ADDRSTRLEN];
232
233 // TODO: check that the prefix length is /64.
234 interface_ip = getinterface_ip(interface, AF_INET6);
235 if (!interface_ip) {
236 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface);
237 return 0;
238 }
239
240 // If our prefix hasn't changed, do nothing. (If this is the first time we configure an IPv6
241 // address, Global_Clatd_Config.ipv6_local_subnet will be ::, which won't match our new prefix.)
242 if (ipv6_prefix_equal(&interface_ip->ip6, &Global_Clatd_Config.ipv6_local_subnet)) {
243 free(interface_ip);
244 return 1;
245 }
246
247 // Generate an interface ID.
248 config_generate_local_ipv6_subnet(&interface_ip->ip6);
249 inet_ntop(AF_INET6, &interface_ip->ip6, addrstr, sizeof(addrstr));
250
251 if (IN6_IS_ADDR_UNSPECIFIED(&Global_Clatd_Config.ipv6_local_subnet)) {
252 // Startup.
253 logmsg(ANDROID_LOG_INFO, "Using IPv6 address %s on %s", addrstr, interface);
254 } else {
255 // Prefix change.
256 char from_addr[INET6_ADDRSTRLEN];
257 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, from_addr, sizeof(from_addr));
258 logmsg(ANDROID_LOG_INFO, "clat IPv6 address changed from %s to %s", from_addr, addrstr);
259 del_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet);
260 }
261
262 // Start translating packets to the new prefix.
263 Global_Clatd_Config.ipv6_local_subnet = interface_ip->ip6;
264 add_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet, interface);
265 free(interface_ip);
266
267 // Update our packet socket filter to reflect the new 464xlat IP address.
268 if (!configure_packet_socket(tunnel->read_fd6)) {
269 // Things aren't going to work. Bail out and hope we have better luck next time.
270 // We don't log an error here because configure_packet_socket has already done so.
271 exit(1);
272 }
273
274 return 1;
275 }
276
277 /* function: configure_interface
278 * reads the configuration and applies it to the interface
279 * uplink_interface - network interface to use to reach the ipv6 internet
280 * plat_prefix - PLAT prefix to use
281 * tunnel - tun device data
282 * net_id - NetID to use, NETID_UNSET indicates use of default network
283 */
configure_interface(const char * uplink_interface,const char * plat_prefix,struct tun_data * tunnel,unsigned net_id)284 void configure_interface(const char *uplink_interface, const char *plat_prefix, struct tun_data *tunnel, unsigned net_id) {
285 int error;
286
287 if(!read_config("/system/etc/clatd.conf", uplink_interface, plat_prefix, net_id)) {
288 logmsg(ANDROID_LOG_FATAL,"read_config failed");
289 exit(1);
290 }
291
292 if(Global_Clatd_Config.mtu > MAXMTU) {
293 logmsg(ANDROID_LOG_WARN,"Max MTU is %d, requested %d", MAXMTU, Global_Clatd_Config.mtu);
294 Global_Clatd_Config.mtu = MAXMTU;
295 }
296 if(Global_Clatd_Config.mtu <= 0) {
297 Global_Clatd_Config.mtu = getifmtu(Global_Clatd_Config.default_pdp_interface);
298 logmsg(ANDROID_LOG_WARN,"ifmtu=%d",Global_Clatd_Config.mtu);
299 }
300 if(Global_Clatd_Config.mtu < 1280) {
301 logmsg(ANDROID_LOG_WARN,"mtu too small = %d", Global_Clatd_Config.mtu);
302 Global_Clatd_Config.mtu = 1280;
303 }
304
305 if(Global_Clatd_Config.ipv4mtu <= 0 ||
306 Global_Clatd_Config.ipv4mtu > Global_Clatd_Config.mtu - MTU_DELTA) {
307 Global_Clatd_Config.ipv4mtu = Global_Clatd_Config.mtu - MTU_DELTA;
308 logmsg(ANDROID_LOG_WARN,"ipv4mtu now set to = %d",Global_Clatd_Config.ipv4mtu);
309 }
310
311 error = tun_alloc(tunnel->device4, tunnel->fd4);
312 if(error < 0) {
313 logmsg(ANDROID_LOG_FATAL,"tun_alloc/4 failed: %s",strerror(errno));
314 exit(1);
315 }
316
317 error = set_nonblocking(tunnel->fd4);
318 if (error < 0) {
319 logmsg(ANDROID_LOG_FATAL, "set_nonblocking failed: %s", strerror(errno));
320 exit(1);
321 }
322
323 configure_tun_ip(tunnel);
324 }
325
326 /* function: read_packet
327 * reads a packet from the tunnel fd and translates it
328 * read_fd - file descriptor to read original packet from
329 * write_fd - file descriptor to write translated packet to
330 * to_ipv6 - whether the packet is to be translated to ipv6 or ipv4
331 */
read_packet(int read_fd,int write_fd,int to_ipv6)332 void read_packet(int read_fd, int write_fd, int to_ipv6) {
333 ssize_t readlen;
334 uint8_t buf[PACKETLEN], *packet;
335
336 readlen = read(read_fd, buf, PACKETLEN);
337
338 if(readlen < 0) {
339 if (errno != EAGAIN) {
340 logmsg(ANDROID_LOG_WARN,"read_packet/read error: %s", strerror(errno));
341 }
342 return;
343 } else if(readlen == 0) {
344 logmsg(ANDROID_LOG_WARN,"read_packet/tun interface removed");
345 running = 0;
346 return;
347 }
348
349 struct tun_pi *tun_header = (struct tun_pi *) buf;
350 if (readlen < (ssize_t) sizeof(*tun_header)) {
351 logmsg(ANDROID_LOG_WARN,"read_packet/short read: got %ld bytes", readlen);
352 return;
353 }
354
355 uint16_t proto = ntohs(tun_header->proto);
356 if (proto != ETH_P_IP) {
357 logmsg(ANDROID_LOG_WARN, "%s: unknown packet type = 0x%x", __func__, proto);
358 return;
359 }
360
361 if(tun_header->flags != 0) {
362 logmsg(ANDROID_LOG_WARN, "%s: unexpected flags = %d", __func__, tun_header->flags);
363 }
364
365 packet = (uint8_t *) (tun_header + 1);
366 readlen -= sizeof(*tun_header);
367 translate_packet(write_fd, to_ipv6, packet, readlen);
368 }
369
370 /* function: event_loop
371 * reads packets from the tun network interface and passes them down the stack
372 * tunnel - tun device data
373 */
event_loop(struct tun_data * tunnel)374 void event_loop(struct tun_data *tunnel) {
375 time_t last_interface_poll;
376 struct pollfd wait_fd[] = {
377 { tunnel->read_fd6, POLLIN, 0 },
378 { tunnel->fd4, POLLIN, 0 },
379 };
380
381 // start the poll timer
382 last_interface_poll = time(NULL);
383
384 while(running) {
385 if(poll(wait_fd, 2, NO_TRAFFIC_INTERFACE_POLL_FREQUENCY*1000) == -1) {
386 if(errno != EINTR) {
387 logmsg(ANDROID_LOG_WARN,"event_loop/poll returned an error: %s",strerror(errno));
388 }
389 } else {
390 // Call read_packet if the socket has data to be read, but also if an
391 // error is waiting. If we don't call read() after getting POLLERR, a
392 // subsequent poll() will return immediately with POLLERR again,
393 // causing this code to spin in a loop. Calling read() will clear the
394 // socket error flag instead.
395 if (wait_fd[0].revents) {
396 ring_read(&tunnel->ring, tunnel->fd4, 0 /* to_ipv6 */);
397 }
398 if (wait_fd[1].revents) {
399 read_packet(tunnel->fd4, tunnel->write_fd6, 1 /* to_ipv6 */);
400 }
401 }
402
403 time_t now = time(NULL);
404 if(last_interface_poll < (now - INTERFACE_POLL_FREQUENCY)) {
405 update_clat_ipv6_address(tunnel, Global_Clatd_Config.default_pdp_interface);
406 last_interface_poll = now;
407 }
408 }
409 }
410
411 /* function: print_help
412 * in case the user is running this on the command line
413 */
print_help()414 void print_help() {
415 printf("android-clat arguments:\n");
416 printf("-i [uplink interface]\n");
417 printf("-p [plat prefix]\n");
418 printf("-n [NetId]\n");
419 printf("-m [socket mark]\n");
420 }
421
422 /* function: parse_unsigned
423 * parses a string as a decimal/hex/octal unsigned integer
424 * str - the string to parse
425 * out - the unsigned integer to write to, gets clobbered on failure
426 */
parse_unsigned(const char * str,unsigned * out)427 int parse_unsigned(const char *str, unsigned *out) {
428 char *end_ptr;
429 *out = strtoul(str, &end_ptr, 0);
430 return *str && !*end_ptr;
431 }
432
433 /* function: main
434 * allocate and setup the tun device, then run the event loop
435 */
main(int argc,char ** argv)436 int main(int argc, char **argv) {
437 struct tun_data tunnel;
438 int opt;
439 char *uplink_interface = NULL, *plat_prefix = NULL, *net_id_str = NULL, *mark_str = NULL;
440 unsigned net_id = NETID_UNSET;
441 uint32_t mark = MARK_UNSET;
442 unsigned len;
443
444 while((opt = getopt(argc, argv, "i:p:n:m:h")) != -1) {
445 switch(opt) {
446 case 'i':
447 uplink_interface = optarg;
448 break;
449 case 'p':
450 plat_prefix = optarg;
451 break;
452 case 'n':
453 net_id_str = optarg;
454 break;
455 case 'm':
456 mark_str = optarg;
457 break;
458 case 'h':
459 print_help();
460 exit(0);
461 default:
462 logmsg(ANDROID_LOG_FATAL, "Unknown option -%c. Exiting.", (char) optopt);
463 exit(1);
464 }
465 }
466
467 if(uplink_interface == NULL) {
468 logmsg(ANDROID_LOG_FATAL, "clatd called without an interface");
469 exit(1);
470 }
471
472 if (net_id_str != NULL && !parse_unsigned(net_id_str, &net_id)) {
473 logmsg(ANDROID_LOG_FATAL, "invalid NetID %s", net_id_str);
474 exit(1);
475 }
476
477 if (mark_str != NULL && !parse_unsigned(mark_str, &mark)) {
478 logmsg(ANDROID_LOG_FATAL, "invalid mark %s", mark_str);
479 exit(1);
480 }
481
482 len = snprintf(tunnel.device4, sizeof(tunnel.device4), "%s%s", DEVICEPREFIX, uplink_interface);
483 if (len >= sizeof(tunnel.device4)) {
484 logmsg(ANDROID_LOG_FATAL, "interface name too long '%s'", tunnel.device4);
485 exit(1);
486 }
487
488 logmsg(ANDROID_LOG_INFO, "Starting clat version %s on %s netid=%s mark=%s",
489 CLATD_VERSION, uplink_interface,
490 net_id_str ? net_id_str : "(none)",
491 mark_str ? mark_str : "(none)");
492
493 // open our raw sockets before dropping privs
494 open_sockets(&tunnel, mark);
495
496 // run under a regular user
497 drop_root();
498
499 // we can create tun devices as non-root because we're in the VPN group.
500 tunnel.fd4 = tun_open();
501 if(tunnel.fd4 < 0) {
502 logmsg(ANDROID_LOG_FATAL, "tun_open4 failed: %s", strerror(errno));
503 exit(1);
504 }
505
506 // When run from netd, the environment variable ANDROID_DNS_MODE is set to
507 // "local", but that only works for the netd process itself.
508 unsetenv("ANDROID_DNS_MODE");
509
510 configure_interface(uplink_interface, plat_prefix, &tunnel, net_id);
511
512 update_clat_ipv6_address(&tunnel, uplink_interface);
513
514 // Loop until someone sends us a signal or brings down the tun interface.
515 if(signal(SIGTERM, stop_loop) == SIG_ERR) {
516 logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno));
517 exit(1);
518 }
519
520 event_loop(&tunnel);
521
522 logmsg(ANDROID_LOG_INFO,"Shutting down clat on %s", uplink_interface);
523 del_anycast_address(tunnel.write_fd6, &Global_Clatd_Config.ipv6_local_subnet);
524
525 return 0;
526 }
527