1/* 2 * Copyright 2012 Daniel Drown 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 * 16 * clatd.c - tun interface setup and main event loop 17 */ 18#include <poll.h> 19#include <signal.h> 20#include <time.h> 21#include <stdio.h> 22#include <sys/types.h> 23#include <sys/ioctl.h> 24#include <sys/prctl.h> 25#include <sys/stat.h> 26#include <string.h> 27#include <errno.h> 28#include <stdlib.h> 29#include <unistd.h> 30#include <arpa/inet.h> 31#include <fcntl.h> 32 33#include <sys/capability.h> 34#include <sys/uio.h> 35#include <linux/filter.h> 36#include <linux/if.h> 37#include <linux/if_tun.h> 38#include <linux/if_ether.h> 39#include <linux/if_packet.h> 40#include <net/if.h> 41 42#include <private/android_filesystem_config.h> 43 44#include "translate.h" 45#include "clatd.h" 46#include "config.h" 47#include "logging.h" 48#include "resolv_netid.h" 49#include "setif.h" 50#include "mtu.h" 51#include "getaddr.h" 52#include "dump.h" 53 54#define DEVICEPREFIX "v4-" 55 56/* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */ 57#define MTU_DELTA 28 58 59volatile sig_atomic_t running = 1; 60 61/* function: stop_loop 62 * signal handler: stop the event loop 63 */ 64void stop_loop() { 65 running = 0; 66} 67 68/* function: tun_open 69 * tries to open the tunnel device 70 */ 71int tun_open() { 72 int fd; 73 74 fd = open("/dev/tun", O_RDWR); 75 if(fd < 0) { 76 fd = open("/dev/net/tun", O_RDWR); 77 } 78 79 return fd; 80} 81 82/* function: tun_alloc 83 * creates a tun interface and names it 84 * dev - the name for the new tun device 85 */ 86int tun_alloc(char *dev, int fd) { 87 struct ifreq ifr; 88 int err; 89 90 memset(&ifr, 0, sizeof(ifr)); 91 92 ifr.ifr_flags = IFF_TUN; 93 if( *dev ) { 94 strncpy(ifr.ifr_name, dev, IFNAMSIZ); 95 ifr.ifr_name[IFNAMSIZ-1] = '\0'; 96 } 97 98 if( (err = ioctl(fd, TUNSETIFF, (void *) &ifr)) < 0 ){ 99 close(fd); 100 return err; 101 } 102 strcpy(dev, ifr.ifr_name); 103 return 0; 104} 105 106/* function: configure_packet_socket 107 * Binds the packet socket and attaches the receive filter to it. 108 * sock - the socket to configure 109 */ 110int configure_packet_socket(int sock) { 111 struct sockaddr_ll sll = { 112 .sll_family = AF_PACKET, 113 .sll_protocol = htons(ETH_P_IPV6), 114 .sll_ifindex = if_nametoindex((char *) &Global_Clatd_Config.default_pdp_interface), 115 .sll_pkttype = PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel. 116 }; 117 if (bind(sock, (struct sockaddr *) &sll, sizeof(sll))) { 118 logmsg(ANDROID_LOG_FATAL, "binding packet socket: %s", strerror(errno)); 119 return 0; 120 } 121 122 uint32_t *ipv6 = Global_Clatd_Config.ipv6_local_subnet.s6_addr32; 123 struct sock_filter filter_code[] = { 124 // Load the first four bytes of the IPv6 destination address (starts 24 bytes in). 125 // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads 126 // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it 127 // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other 128 // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet). 129 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24), 130 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7), 131 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28), 132 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5), 133 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32), 134 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3), 135 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36), 136 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1), 137 BPF_STMT(BPF_RET | BPF_K, PACKETLEN), 138 BPF_STMT(BPF_RET | BPF_K, 0) 139 }; 140 struct sock_fprog filter = { 141 sizeof(filter_code) / sizeof(filter_code[0]), 142 filter_code 143 }; 144 145 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) { 146 logmsg(ANDROID_LOG_FATAL, "attach packet filter failed: %s", strerror(errno)); 147 return 0; 148 } 149 150 return 1; 151} 152 153/* function: configure_tun_ip 154 * configures the ipv4 and ipv6 addresses on the tunnel interface 155 * tunnel - tun device data 156 */ 157void configure_tun_ip(const struct tun_data *tunnel) { 158 int status; 159 160 // Pick an IPv4 address to use by finding a free address in the configured prefix. Technically, 161 // there is a race here - if another clatd calls config_select_ipv4_address after we do, but 162 // before we call add_address, it can end up having the same IP address as we do. But the time 163 // window in which this can happen is extremely small, and even if we end up with a duplicate 164 // address, the only damage is that IPv4 TCP connections won't be reset until both interfaces go 165 // down. 166 in_addr_t localaddr = config_select_ipv4_address(&Global_Clatd_Config.ipv4_local_subnet, 167 Global_Clatd_Config.ipv4_local_prefixlen); 168 if (localaddr == INADDR_NONE) { 169 logmsg(ANDROID_LOG_FATAL,"No free IPv4 address in %s/%d", 170 inet_ntoa(Global_Clatd_Config.ipv4_local_subnet), 171 Global_Clatd_Config.ipv4_local_prefixlen); 172 exit(1); 173 } 174 Global_Clatd_Config.ipv4_local_subnet.s_addr = localaddr; 175 176 // Configure the interface before bringing it up. As soon as we bring the interface up, the 177 // framework will be notified and will assume the interface's configuration has been finalized. 178 status = add_address(tunnel->device4, AF_INET, &Global_Clatd_Config.ipv4_local_subnet, 179 32, &Global_Clatd_Config.ipv4_local_subnet); 180 if(status < 0) { 181 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_address(4) failed: %s",strerror(-status)); 182 exit(1); 183 } 184 185 char addrstr[INET_ADDRSTRLEN]; 186 inet_ntop(AF_INET, &Global_Clatd_Config.ipv4_local_subnet, addrstr, sizeof(addrstr)); 187 logmsg(ANDROID_LOG_INFO, "Using IPv4 address %s on %s", addrstr, tunnel->device4); 188 189 if((status = if_up(tunnel->device4, Global_Clatd_Config.ipv4mtu)) < 0) { 190 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_up(4) failed: %s",strerror(-status)); 191 exit(1); 192 } 193} 194 195/* function: drop_root 196 * drops root privs but keeps the needed capability 197 */ 198void drop_root() { 199 gid_t groups[] = { AID_INET, AID_VPN }; 200 if(setgroups(sizeof(groups)/sizeof(groups[0]), groups) < 0) { 201 logmsg(ANDROID_LOG_FATAL,"drop_root/setgroups failed: %s",strerror(errno)); 202 exit(1); 203 } 204 205 prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); 206 207 if(setgid(AID_CLAT) < 0) { 208 logmsg(ANDROID_LOG_FATAL,"drop_root/setgid failed: %s",strerror(errno)); 209 exit(1); 210 } 211 if(setuid(AID_CLAT) < 0) { 212 logmsg(ANDROID_LOG_FATAL,"drop_root/setuid failed: %s",strerror(errno)); 213 exit(1); 214 } 215 216 struct __user_cap_header_struct header; 217 struct __user_cap_data_struct cap; 218 memset(&header, 0, sizeof(header)); 219 memset(&cap, 0, sizeof(cap)); 220 221 header.version = _LINUX_CAPABILITY_VERSION; 222 header.pid = 0; // 0 = change myself 223 cap.effective = cap.permitted = (1 << CAP_NET_ADMIN); 224 225 if(capset(&header, &cap) < 0) { 226 logmsg(ANDROID_LOG_FATAL,"drop_root/capset failed: %s",strerror(errno)); 227 exit(1); 228 } 229} 230 231/* function: open_sockets 232 * opens a packet socket to receive IPv6 packets and a raw socket to send them 233 * tunnel - tun device data 234 * mark - the socket mark to use for the sending raw socket 235 */ 236void open_sockets(struct tun_data *tunnel, uint32_t mark) { 237 int rawsock = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW); 238 if (rawsock < 0) { 239 logmsg(ANDROID_LOG_FATAL, "raw socket failed: %s", strerror(errno)); 240 exit(1); 241 } 242 243 int off = 0; 244 if (setsockopt(rawsock, SOL_IPV6, IPV6_CHECKSUM, &off, sizeof(off)) < 0) { 245 logmsg(ANDROID_LOG_WARN, "could not disable checksum on raw socket: %s", strerror(errno)); 246 } 247 if (mark != MARK_UNSET && setsockopt(rawsock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) { 248 logmsg(ANDROID_LOG_ERROR, "could not set mark on raw socket: %s", strerror(errno)); 249 } 250 251 tunnel->write_fd6 = rawsock; 252 253 int packetsock = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_IPV6)); 254 if (packetsock < 0) { 255 logmsg(ANDROID_LOG_FATAL, "packet socket failed: %s", strerror(errno)); 256 exit(1); 257 } 258 259 tunnel->read_fd6 = packetsock; 260} 261 262/* function: update_clat_ipv6_address 263 * picks the clat IPv6 address and configures packet translation to use it. 264 * tunnel - tun device data 265 * interface - uplink interface name 266 * returns: 1 on success, 0 on failure 267 */ 268int update_clat_ipv6_address(const struct tun_data *tunnel, const char *interface) { 269 union anyip *interface_ip; 270 char addrstr[INET6_ADDRSTRLEN]; 271 272 // TODO: check that the prefix length is /64. 273 interface_ip = getinterface_ip(interface, AF_INET6); 274 if (!interface_ip) { 275 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface); 276 return 0; 277 } 278 279 // If our prefix hasn't changed, do nothing. (If this is the first time we configure an IPv6 280 // address, Global_Clatd_Config.ipv6_local_subnet will be ::, which won't match our new prefix.) 281 if (ipv6_prefix_equal(&interface_ip->ip6, &Global_Clatd_Config.ipv6_local_subnet)) { 282 free(interface_ip); 283 return 1; 284 } 285 286 // Generate an interface ID. 287 config_generate_local_ipv6_subnet(&interface_ip->ip6); 288 inet_ntop(AF_INET6, &interface_ip->ip6, addrstr, sizeof(addrstr)); 289 290 if (IN6_IS_ADDR_UNSPECIFIED(&Global_Clatd_Config.ipv6_local_subnet)) { 291 // Startup. 292 logmsg(ANDROID_LOG_INFO, "Using IPv6 address %s on %s", addrstr, interface); 293 } else { 294 // Prefix change. 295 char from_addr[INET6_ADDRSTRLEN]; 296 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, from_addr, sizeof(from_addr)); 297 logmsg(ANDROID_LOG_INFO, "clat IPv6 address changed from %s to %s", from_addr, addrstr); 298 del_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet); 299 } 300 301 // Start translating packets to the new prefix. 302 Global_Clatd_Config.ipv6_local_subnet = interface_ip->ip6; 303 add_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet, interface); 304 free(interface_ip); 305 306 // Update our packet socket filter to reflect the new 464xlat IP address. 307 if (!configure_packet_socket(tunnel->read_fd6)) { 308 // Things aren't going to work. Bail out and hope we have better luck next time. 309 // We don't log an error here because configure_packet_socket has already done so. 310 exit(1); 311 } 312 313 return 1; 314} 315 316/* function: configure_interface 317 * reads the configuration and applies it to the interface 318 * uplink_interface - network interface to use to reach the ipv6 internet 319 * plat_prefix - PLAT prefix to use 320 * tunnel - tun device data 321 * net_id - NetID to use, NETID_UNSET indicates use of default network 322 */ 323void configure_interface(const char *uplink_interface, const char *plat_prefix, struct tun_data *tunnel, unsigned net_id) { 324 int error; 325 326 if(!read_config("/system/etc/clatd.conf", uplink_interface, plat_prefix, net_id)) { 327 logmsg(ANDROID_LOG_FATAL,"read_config failed"); 328 exit(1); 329 } 330 331 if(Global_Clatd_Config.mtu > MAXMTU) { 332 logmsg(ANDROID_LOG_WARN,"Max MTU is %d, requested %d", MAXMTU, Global_Clatd_Config.mtu); 333 Global_Clatd_Config.mtu = MAXMTU; 334 } 335 if(Global_Clatd_Config.mtu <= 0) { 336 Global_Clatd_Config.mtu = getifmtu(Global_Clatd_Config.default_pdp_interface); 337 logmsg(ANDROID_LOG_WARN,"ifmtu=%d",Global_Clatd_Config.mtu); 338 } 339 if(Global_Clatd_Config.mtu < 1280) { 340 logmsg(ANDROID_LOG_WARN,"mtu too small = %d", Global_Clatd_Config.mtu); 341 Global_Clatd_Config.mtu = 1280; 342 } 343 344 if(Global_Clatd_Config.ipv4mtu <= 0 || 345 Global_Clatd_Config.ipv4mtu > Global_Clatd_Config.mtu - MTU_DELTA) { 346 Global_Clatd_Config.ipv4mtu = Global_Clatd_Config.mtu - MTU_DELTA; 347 logmsg(ANDROID_LOG_WARN,"ipv4mtu now set to = %d",Global_Clatd_Config.ipv4mtu); 348 } 349 350 error = tun_alloc(tunnel->device4, tunnel->fd4); 351 if(error < 0) { 352 logmsg(ANDROID_LOG_FATAL,"tun_alloc/4 failed: %s",strerror(errno)); 353 exit(1); 354 } 355 356 configure_tun_ip(tunnel); 357} 358 359/* function: read_packet 360 * reads a packet from the tunnel fd and passes it down the stack 361 * active_fd - tun file descriptor marked ready for reading 362 * tunnel - tun device data 363 */ 364void read_packet(int active_fd, const struct tun_data *tunnel) { 365 ssize_t readlen; 366 uint8_t buf[PACKETLEN], *packet; 367 int fd; 368 369 readlen = read(active_fd, buf, PACKETLEN); 370 371 if(readlen < 0) { 372 logmsg(ANDROID_LOG_WARN,"read_packet/read error: %s", strerror(errno)); 373 return; 374 } else if(readlen == 0) { 375 logmsg(ANDROID_LOG_WARN,"read_packet/tun interface removed"); 376 running = 0; 377 return; 378 } 379 380 if (active_fd == tunnel->fd4) { 381 ssize_t header_size = sizeof(struct tun_pi); 382 383 if (readlen < header_size) { 384 logmsg(ANDROID_LOG_WARN,"read_packet/short read: got %ld bytes", readlen); 385 return; 386 } 387 388 struct tun_pi *tun_header = (struct tun_pi *) buf; 389 uint16_t proto = ntohs(tun_header->proto); 390 if (proto != ETH_P_IP) { 391 logmsg(ANDROID_LOG_WARN, "%s: unknown packet type = 0x%x", __func__, proto); 392 return; 393 } 394 395 if(tun_header->flags != 0) { 396 logmsg(ANDROID_LOG_WARN, "%s: unexpected flags = %d", __func__, tun_header->flags); 397 } 398 399 fd = tunnel->write_fd6; 400 packet = buf + header_size; 401 readlen -= header_size; 402 } else { 403 fd = tunnel->fd4; 404 packet = buf; 405 } 406 407 translate_packet(fd, (fd == tunnel->write_fd6), packet, readlen); 408} 409 410/* function: event_loop 411 * reads packets from the tun network interface and passes them down the stack 412 * tunnel - tun device data 413 */ 414void event_loop(const struct tun_data *tunnel) { 415 time_t last_interface_poll; 416 struct pollfd wait_fd[] = { 417 { tunnel->read_fd6, POLLIN, 0 }, 418 { tunnel->fd4, POLLIN, 0 }, 419 }; 420 421 // start the poll timer 422 last_interface_poll = time(NULL); 423 424 while(running) { 425 if(poll(wait_fd, 2, NO_TRAFFIC_INTERFACE_POLL_FREQUENCY*1000) == -1) { 426 if(errno != EINTR) { 427 logmsg(ANDROID_LOG_WARN,"event_loop/poll returned an error: %s",strerror(errno)); 428 } 429 } else { 430 size_t i; 431 for(i = 0; i < ARRAY_SIZE(wait_fd); i++) { 432 // Call read_packet if the socket has data to be read, but also if an 433 // error is waiting. If we don't call read() after getting POLLERR, a 434 // subsequent poll() will return immediately with POLLERR again, 435 // causing this code to spin in a loop. Calling read() will clear the 436 // socket error flag instead. 437 if(wait_fd[i].revents != 0) { 438 read_packet(wait_fd[i].fd,tunnel); 439 } 440 } 441 } 442 443 time_t now = time(NULL); 444 if(last_interface_poll < (now - INTERFACE_POLL_FREQUENCY)) { 445 update_clat_ipv6_address(tunnel, Global_Clatd_Config.default_pdp_interface); 446 last_interface_poll = now; 447 } 448 } 449} 450 451/* function: print_help 452 * in case the user is running this on the command line 453 */ 454void print_help() { 455 printf("android-clat arguments:\n"); 456 printf("-i [uplink interface]\n"); 457 printf("-p [plat prefix]\n"); 458 printf("-n [NetId]\n"); 459 printf("-m [socket mark]\n"); 460} 461 462/* function: parse_unsigned 463 * parses a string as a decimal/hex/octal unsigned integer 464 * str - the string to parse 465 * out - the unsigned integer to write to, gets clobbered on failure 466 */ 467int parse_unsigned(const char *str, unsigned *out) { 468 char *end_ptr; 469 *out = strtoul(str, &end_ptr, 0); 470 return *str && !*end_ptr; 471} 472 473/* function: main 474 * allocate and setup the tun device, then run the event loop 475 */ 476int main(int argc, char **argv) { 477 struct tun_data tunnel; 478 int opt; 479 char *uplink_interface = NULL, *plat_prefix = NULL, *net_id_str = NULL, *mark_str = NULL; 480 unsigned net_id = NETID_UNSET; 481 uint32_t mark = MARK_UNSET; 482 unsigned len; 483 484 while((opt = getopt(argc, argv, "i:p:n:m:h")) != -1) { 485 switch(opt) { 486 case 'i': 487 uplink_interface = optarg; 488 break; 489 case 'p': 490 plat_prefix = optarg; 491 break; 492 case 'n': 493 net_id_str = optarg; 494 break; 495 case 'm': 496 mark_str = optarg; 497 break; 498 case 'h': 499 print_help(); 500 exit(0); 501 default: 502 logmsg(ANDROID_LOG_FATAL, "Unknown option -%c. Exiting.", (char) optopt); 503 exit(1); 504 } 505 } 506 507 if(uplink_interface == NULL) { 508 logmsg(ANDROID_LOG_FATAL, "clatd called without an interface"); 509 exit(1); 510 } 511 512 if (net_id_str != NULL && !parse_unsigned(net_id_str, &net_id)) { 513 logmsg(ANDROID_LOG_FATAL, "invalid NetID %s", net_id_str); 514 exit(1); 515 } 516 517 if (mark_str != NULL && !parse_unsigned(mark_str, &mark)) { 518 logmsg(ANDROID_LOG_FATAL, "invalid mark %s", mark_str); 519 exit(1); 520 } 521 522 len = snprintf(tunnel.device4, sizeof(tunnel.device4), "%s%s", DEVICEPREFIX, uplink_interface); 523 if (len >= sizeof(tunnel.device4)) { 524 logmsg(ANDROID_LOG_FATAL, "interface name too long '%s'", tunnel.device4); 525 exit(1); 526 } 527 528 logmsg(ANDROID_LOG_INFO, "Starting clat version %s on %s netid=%s mark=%s", 529 CLATD_VERSION, uplink_interface, 530 net_id_str ? net_id_str : "(none)", 531 mark_str ? mark_str : "(none)"); 532 533 // open our raw sockets before dropping privs 534 open_sockets(&tunnel, mark); 535 536 // run under a regular user 537 drop_root(); 538 539 // we can create tun devices as non-root because we're in the VPN group. 540 tunnel.fd4 = tun_open(); 541 if(tunnel.fd4 < 0) { 542 logmsg(ANDROID_LOG_FATAL, "tun_open4 failed: %s", strerror(errno)); 543 exit(1); 544 } 545 546 // When run from netd, the environment variable ANDROID_DNS_MODE is set to 547 // "local", but that only works for the netd process itself. 548 unsetenv("ANDROID_DNS_MODE"); 549 550 configure_interface(uplink_interface, plat_prefix, &tunnel, net_id); 551 552 update_clat_ipv6_address(&tunnel, uplink_interface); 553 554 // Loop until someone sends us a signal or brings down the tun interface. 555 if(signal(SIGTERM, stop_loop) == SIG_ERR) { 556 logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno)); 557 exit(1); 558 } 559 560 event_loop(&tunnel); 561 562 logmsg(ANDROID_LOG_INFO,"Shutting down clat on %s", uplink_interface); 563 del_anycast_address(tunnel.write_fd6, &Global_Clatd_Config.ipv6_local_subnet); 564 565 return 0; 566} 567