1/* 2 * Copyright 2012 Daniel Drown 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 * 16 * clatd.c - tun interface setup and main event loop 17 */ 18#include <poll.h> 19#include <signal.h> 20#include <time.h> 21#include <stdio.h> 22#include <sys/types.h> 23#include <sys/ioctl.h> 24#include <sys/prctl.h> 25#include <sys/stat.h> 26#include <string.h> 27#include <errno.h> 28#include <stdlib.h> 29#include <unistd.h> 30#include <arpa/inet.h> 31#include <fcntl.h> 32 33#include <sys/capability.h> 34#include <sys/uio.h> 35#include <linux/filter.h> 36#include <linux/if.h> 37#include <linux/if_tun.h> 38#include <linux/if_ether.h> 39#include <linux/if_packet.h> 40#include <net/if.h> 41 42#include <private/android_filesystem_config.h> 43 44#include "translate.h" 45#include "clatd.h" 46#include "config.h" 47#include "logging.h" 48#include "resolv_netid.h" 49#include "setif.h" 50#include "mtu.h" 51#include "getaddr.h" 52#include "dump.h" 53#include "tun.h" 54#include "ring.h" 55 56#define DEVICEPREFIX "v4-" 57 58/* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */ 59#define MTU_DELTA 28 60 61volatile sig_atomic_t running = 1; 62 63/* function: stop_loop 64 * signal handler: stop the event loop 65 */ 66void stop_loop() { 67 running = 0; 68} 69 70/* function: configure_packet_socket 71 * Binds the packet socket and attaches the receive filter to it. 72 * sock - the socket to configure 73 */ 74int configure_packet_socket(int sock) { 75 struct sockaddr_ll sll = { 76 .sll_family = AF_PACKET, 77 .sll_protocol = htons(ETH_P_IPV6), 78 .sll_ifindex = if_nametoindex(Global_Clatd_Config.default_pdp_interface), 79 .sll_pkttype = PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel. 80 }; 81 if (bind(sock, (struct sockaddr *) &sll, sizeof(sll))) { 82 logmsg(ANDROID_LOG_FATAL, "binding packet socket: %s", strerror(errno)); 83 return 0; 84 } 85 86 uint32_t *ipv6 = Global_Clatd_Config.ipv6_local_subnet.s6_addr32; 87 struct sock_filter filter_code[] = { 88 // Load the first four bytes of the IPv6 destination address (starts 24 bytes in). 89 // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads 90 // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it 91 // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other 92 // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet). 93 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24), 94 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7), 95 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28), 96 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5), 97 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32), 98 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3), 99 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36), 100 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1), 101 BPF_STMT(BPF_RET | BPF_K, PACKETLEN), 102 BPF_STMT(BPF_RET | BPF_K, 0) 103 }; 104 struct sock_fprog filter = { 105 sizeof(filter_code) / sizeof(filter_code[0]), 106 filter_code 107 }; 108 109 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) { 110 logmsg(ANDROID_LOG_FATAL, "attach packet filter failed: %s", strerror(errno)); 111 return 0; 112 } 113 114 return 1; 115} 116 117/* function: configure_tun_ip 118 * configures the ipv4 and ipv6 addresses on the tunnel interface 119 * tunnel - tun device data 120 */ 121void configure_tun_ip(const struct tun_data *tunnel) { 122 int status; 123 124 // Pick an IPv4 address to use by finding a free address in the configured prefix. Technically, 125 // there is a race here - if another clatd calls config_select_ipv4_address after we do, but 126 // before we call add_address, it can end up having the same IP address as we do. But the time 127 // window in which this can happen is extremely small, and even if we end up with a duplicate 128 // address, the only damage is that IPv4 TCP connections won't be reset until both interfaces go 129 // down. 130 in_addr_t localaddr = config_select_ipv4_address(&Global_Clatd_Config.ipv4_local_subnet, 131 Global_Clatd_Config.ipv4_local_prefixlen); 132 if (localaddr == INADDR_NONE) { 133 logmsg(ANDROID_LOG_FATAL,"No free IPv4 address in %s/%d", 134 inet_ntoa(Global_Clatd_Config.ipv4_local_subnet), 135 Global_Clatd_Config.ipv4_local_prefixlen); 136 exit(1); 137 } 138 Global_Clatd_Config.ipv4_local_subnet.s_addr = localaddr; 139 140 // Configure the interface before bringing it up. As soon as we bring the interface up, the 141 // framework will be notified and will assume the interface's configuration has been finalized. 142 status = add_address(tunnel->device4, AF_INET, &Global_Clatd_Config.ipv4_local_subnet, 143 32, &Global_Clatd_Config.ipv4_local_subnet); 144 if(status < 0) { 145 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_address(4) failed: %s",strerror(-status)); 146 exit(1); 147 } 148 149 char addrstr[INET_ADDRSTRLEN]; 150 inet_ntop(AF_INET, &Global_Clatd_Config.ipv4_local_subnet, addrstr, sizeof(addrstr)); 151 logmsg(ANDROID_LOG_INFO, "Using IPv4 address %s on %s", addrstr, tunnel->device4); 152 153 if((status = if_up(tunnel->device4, Global_Clatd_Config.ipv4mtu)) < 0) { 154 logmsg(ANDROID_LOG_FATAL,"configure_tun_ip/if_up(4) failed: %s",strerror(-status)); 155 exit(1); 156 } 157} 158 159/* function: drop_root 160 * drops root privs but keeps the needed capability 161 */ 162void drop_root() { 163 gid_t groups[] = { AID_INET, AID_VPN }; 164 if(setgroups(sizeof(groups)/sizeof(groups[0]), groups) < 0) { 165 logmsg(ANDROID_LOG_FATAL,"drop_root/setgroups failed: %s",strerror(errno)); 166 exit(1); 167 } 168 169 prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); 170 171 if(setgid(AID_CLAT) < 0) { 172 logmsg(ANDROID_LOG_FATAL,"drop_root/setgid failed: %s",strerror(errno)); 173 exit(1); 174 } 175 if(setuid(AID_CLAT) < 0) { 176 logmsg(ANDROID_LOG_FATAL,"drop_root/setuid failed: %s",strerror(errno)); 177 exit(1); 178 } 179 180 struct __user_cap_header_struct header; 181 struct __user_cap_data_struct cap; 182 memset(&header, 0, sizeof(header)); 183 memset(&cap, 0, sizeof(cap)); 184 185 header.version = _LINUX_CAPABILITY_VERSION; 186 header.pid = 0; // 0 = change myself 187 cap.effective = cap.permitted = (1 << CAP_NET_ADMIN); 188 189 if(capset(&header, &cap) < 0) { 190 logmsg(ANDROID_LOG_FATAL,"drop_root/capset failed: %s",strerror(errno)); 191 exit(1); 192 } 193} 194 195/* function: open_sockets 196 * opens a packet socket to receive IPv6 packets and a raw socket to send them 197 * tunnel - tun device data 198 * mark - the socket mark to use for the sending raw socket 199 */ 200void open_sockets(struct tun_data *tunnel, uint32_t mark) { 201 int rawsock = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK, IPPROTO_RAW); 202 if (rawsock < 0) { 203 logmsg(ANDROID_LOG_FATAL, "raw socket failed: %s", strerror(errno)); 204 exit(1); 205 } 206 207 int off = 0; 208 if (setsockopt(rawsock, SOL_IPV6, IPV6_CHECKSUM, &off, sizeof(off)) < 0) { 209 logmsg(ANDROID_LOG_WARN, "could not disable checksum on raw socket: %s", strerror(errno)); 210 } 211 if (mark != MARK_UNSET && setsockopt(rawsock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) { 212 logmsg(ANDROID_LOG_ERROR, "could not set mark on raw socket: %s", strerror(errno)); 213 } 214 215 tunnel->write_fd6 = rawsock; 216 217 tunnel->read_fd6 = ring_create(tunnel); 218 if (tunnel->read_fd6 < 0) { 219 exit(1); 220 } 221} 222 223/* function: update_clat_ipv6_address 224 * picks the clat IPv6 address and configures packet translation to use it. 225 * tunnel - tun device data 226 * interface - uplink interface name 227 * returns: 1 on success, 0 on failure 228 */ 229int update_clat_ipv6_address(const struct tun_data *tunnel, const char *interface) { 230 union anyip *interface_ip; 231 char addrstr[INET6_ADDRSTRLEN]; 232 233 // TODO: check that the prefix length is /64. 234 interface_ip = getinterface_ip(interface, AF_INET6); 235 if (!interface_ip) { 236 logmsg(ANDROID_LOG_ERROR, "Unable to find an IPv6 address on interface %s", interface); 237 return 0; 238 } 239 240 // If our prefix hasn't changed, do nothing. (If this is the first time we configure an IPv6 241 // address, Global_Clatd_Config.ipv6_local_subnet will be ::, which won't match our new prefix.) 242 if (ipv6_prefix_equal(&interface_ip->ip6, &Global_Clatd_Config.ipv6_local_subnet)) { 243 free(interface_ip); 244 return 1; 245 } 246 247 // Generate an interface ID. 248 config_generate_local_ipv6_subnet(&interface_ip->ip6); 249 inet_ntop(AF_INET6, &interface_ip->ip6, addrstr, sizeof(addrstr)); 250 251 if (IN6_IS_ADDR_UNSPECIFIED(&Global_Clatd_Config.ipv6_local_subnet)) { 252 // Startup. 253 logmsg(ANDROID_LOG_INFO, "Using IPv6 address %s on %s", addrstr, interface); 254 } else { 255 // Prefix change. 256 char from_addr[INET6_ADDRSTRLEN]; 257 inet_ntop(AF_INET6, &Global_Clatd_Config.ipv6_local_subnet, from_addr, sizeof(from_addr)); 258 logmsg(ANDROID_LOG_INFO, "clat IPv6 address changed from %s to %s", from_addr, addrstr); 259 del_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet); 260 } 261 262 // Start translating packets to the new prefix. 263 Global_Clatd_Config.ipv6_local_subnet = interface_ip->ip6; 264 add_anycast_address(tunnel->write_fd6, &Global_Clatd_Config.ipv6_local_subnet, interface); 265 free(interface_ip); 266 267 // Update our packet socket filter to reflect the new 464xlat IP address. 268 if (!configure_packet_socket(tunnel->read_fd6)) { 269 // Things aren't going to work. Bail out and hope we have better luck next time. 270 // We don't log an error here because configure_packet_socket has already done so. 271 exit(1); 272 } 273 274 return 1; 275} 276 277/* function: configure_interface 278 * reads the configuration and applies it to the interface 279 * uplink_interface - network interface to use to reach the ipv6 internet 280 * plat_prefix - PLAT prefix to use 281 * tunnel - tun device data 282 * net_id - NetID to use, NETID_UNSET indicates use of default network 283 */ 284void configure_interface(const char *uplink_interface, const char *plat_prefix, struct tun_data *tunnel, unsigned net_id) { 285 int error; 286 287 if(!read_config("/system/etc/clatd.conf", uplink_interface, plat_prefix, net_id)) { 288 logmsg(ANDROID_LOG_FATAL,"read_config failed"); 289 exit(1); 290 } 291 292 if(Global_Clatd_Config.mtu > MAXMTU) { 293 logmsg(ANDROID_LOG_WARN,"Max MTU is %d, requested %d", MAXMTU, Global_Clatd_Config.mtu); 294 Global_Clatd_Config.mtu = MAXMTU; 295 } 296 if(Global_Clatd_Config.mtu <= 0) { 297 Global_Clatd_Config.mtu = getifmtu(Global_Clatd_Config.default_pdp_interface); 298 logmsg(ANDROID_LOG_WARN,"ifmtu=%d",Global_Clatd_Config.mtu); 299 } 300 if(Global_Clatd_Config.mtu < 1280) { 301 logmsg(ANDROID_LOG_WARN,"mtu too small = %d", Global_Clatd_Config.mtu); 302 Global_Clatd_Config.mtu = 1280; 303 } 304 305 if(Global_Clatd_Config.ipv4mtu <= 0 || 306 Global_Clatd_Config.ipv4mtu > Global_Clatd_Config.mtu - MTU_DELTA) { 307 Global_Clatd_Config.ipv4mtu = Global_Clatd_Config.mtu - MTU_DELTA; 308 logmsg(ANDROID_LOG_WARN,"ipv4mtu now set to = %d",Global_Clatd_Config.ipv4mtu); 309 } 310 311 error = tun_alloc(tunnel->device4, tunnel->fd4); 312 if(error < 0) { 313 logmsg(ANDROID_LOG_FATAL,"tun_alloc/4 failed: %s",strerror(errno)); 314 exit(1); 315 } 316 317 error = set_nonblocking(tunnel->fd4); 318 if (error < 0) { 319 logmsg(ANDROID_LOG_FATAL, "set_nonblocking failed: %s", strerror(errno)); 320 exit(1); 321 } 322 323 configure_tun_ip(tunnel); 324} 325 326/* function: read_packet 327 * reads a packet from the tunnel fd and translates it 328 * read_fd - file descriptor to read original packet from 329 * write_fd - file descriptor to write translated packet to 330 * to_ipv6 - whether the packet is to be translated to ipv6 or ipv4 331 */ 332void read_packet(int read_fd, int write_fd, int to_ipv6) { 333 ssize_t readlen; 334 uint8_t buf[PACKETLEN], *packet; 335 336 readlen = read(read_fd, buf, PACKETLEN); 337 338 if(readlen < 0) { 339 if (errno != EAGAIN) { 340 logmsg(ANDROID_LOG_WARN,"read_packet/read error: %s", strerror(errno)); 341 } 342 return; 343 } else if(readlen == 0) { 344 logmsg(ANDROID_LOG_WARN,"read_packet/tun interface removed"); 345 running = 0; 346 return; 347 } 348 349 struct tun_pi *tun_header = (struct tun_pi *) buf; 350 if (readlen < (ssize_t) sizeof(*tun_header)) { 351 logmsg(ANDROID_LOG_WARN,"read_packet/short read: got %ld bytes", readlen); 352 return; 353 } 354 355 uint16_t proto = ntohs(tun_header->proto); 356 if (proto != ETH_P_IP) { 357 logmsg(ANDROID_LOG_WARN, "%s: unknown packet type = 0x%x", __func__, proto); 358 return; 359 } 360 361 if(tun_header->flags != 0) { 362 logmsg(ANDROID_LOG_WARN, "%s: unexpected flags = %d", __func__, tun_header->flags); 363 } 364 365 packet = (uint8_t *) (tun_header + 1); 366 readlen -= sizeof(*tun_header); 367 translate_packet(write_fd, to_ipv6, packet, readlen); 368} 369 370/* function: event_loop 371 * reads packets from the tun network interface and passes them down the stack 372 * tunnel - tun device data 373 */ 374void event_loop(struct tun_data *tunnel) { 375 time_t last_interface_poll; 376 struct pollfd wait_fd[] = { 377 { tunnel->read_fd6, POLLIN, 0 }, 378 { tunnel->fd4, POLLIN, 0 }, 379 }; 380 381 // start the poll timer 382 last_interface_poll = time(NULL); 383 384 while(running) { 385 if (poll(wait_fd, ARRAY_SIZE(wait_fd), 386 NO_TRAFFIC_INTERFACE_POLL_FREQUENCY * 1000) == -1) { 387 if (errno != EINTR) { 388 logmsg(ANDROID_LOG_WARN,"event_loop/poll returned an error: %s", strerror(errno)); 389 } 390 } else { 391 if (wait_fd[0].revents & POLLIN) { 392 ring_read(&tunnel->ring, tunnel->fd4, 0 /* to_ipv6 */); 393 } 394 // If any other bit is set, assume it's due to an error (i.e. POLLERR). 395 if (wait_fd[0].revents & ~POLLIN) { 396 // ring_read doesn't clear the error indication on the socket. 397 recv(tunnel->read_fd6, NULL, 0, MSG_PEEK); 398 logmsg(ANDROID_LOG_WARN, "event_loop: clearing error on read_fd6: %s", 399 strerror(errno)); 400 } 401 402 // Call read_packet if the socket has data to be read, but also if an 403 // error is waiting. If we don't call read() after getting POLLERR, a 404 // subsequent poll() will return immediately with POLLERR again, 405 // causing this code to spin in a loop. Calling read() will clear the 406 // socket error flag instead. 407 if (wait_fd[1].revents) { 408 read_packet(tunnel->fd4, tunnel->write_fd6, 1 /* to_ipv6 */); 409 } 410 } 411 412 time_t now = time(NULL); 413 if(last_interface_poll < (now - INTERFACE_POLL_FREQUENCY)) { 414 update_clat_ipv6_address(tunnel, Global_Clatd_Config.default_pdp_interface); 415 last_interface_poll = now; 416 } 417 } 418} 419 420/* function: print_help 421 * in case the user is running this on the command line 422 */ 423void print_help() { 424 printf("android-clat arguments:\n"); 425 printf("-i [uplink interface]\n"); 426 printf("-p [plat prefix]\n"); 427 printf("-n [NetId]\n"); 428 printf("-m [socket mark]\n"); 429} 430 431/* function: parse_unsigned 432 * parses a string as a decimal/hex/octal unsigned integer 433 * str - the string to parse 434 * out - the unsigned integer to write to, gets clobbered on failure 435 */ 436int parse_unsigned(const char *str, unsigned *out) { 437 char *end_ptr; 438 *out = strtoul(str, &end_ptr, 0); 439 return *str && !*end_ptr; 440} 441 442/* function: main 443 * allocate and setup the tun device, then run the event loop 444 */ 445int main(int argc, char **argv) { 446 struct tun_data tunnel; 447 int opt; 448 char *uplink_interface = NULL, *plat_prefix = NULL, *net_id_str = NULL, *mark_str = NULL; 449 unsigned net_id = NETID_UNSET; 450 uint32_t mark = MARK_UNSET; 451 unsigned len; 452 453 while((opt = getopt(argc, argv, "i:p:n:m:h")) != -1) { 454 switch(opt) { 455 case 'i': 456 uplink_interface = optarg; 457 break; 458 case 'p': 459 plat_prefix = optarg; 460 break; 461 case 'n': 462 net_id_str = optarg; 463 break; 464 case 'm': 465 mark_str = optarg; 466 break; 467 case 'h': 468 print_help(); 469 exit(0); 470 default: 471 logmsg(ANDROID_LOG_FATAL, "Unknown option -%c. Exiting.", (char) optopt); 472 exit(1); 473 } 474 } 475 476 if(uplink_interface == NULL) { 477 logmsg(ANDROID_LOG_FATAL, "clatd called without an interface"); 478 exit(1); 479 } 480 481 if (net_id_str != NULL && !parse_unsigned(net_id_str, &net_id)) { 482 logmsg(ANDROID_LOG_FATAL, "invalid NetID %s", net_id_str); 483 exit(1); 484 } 485 486 if (mark_str != NULL && !parse_unsigned(mark_str, &mark)) { 487 logmsg(ANDROID_LOG_FATAL, "invalid mark %s", mark_str); 488 exit(1); 489 } 490 491 len = snprintf(tunnel.device4, sizeof(tunnel.device4), "%s%s", DEVICEPREFIX, uplink_interface); 492 if (len >= sizeof(tunnel.device4)) { 493 logmsg(ANDROID_LOG_FATAL, "interface name too long '%s'", tunnel.device4); 494 exit(1); 495 } 496 497 logmsg(ANDROID_LOG_INFO, "Starting clat version %s on %s netid=%s mark=%s", 498 CLATD_VERSION, uplink_interface, 499 net_id_str ? net_id_str : "(none)", 500 mark_str ? mark_str : "(none)"); 501 502 // open our raw sockets before dropping privs 503 open_sockets(&tunnel, mark); 504 505 // run under a regular user 506 drop_root(); 507 508 // we can create tun devices as non-root because we're in the VPN group. 509 tunnel.fd4 = tun_open(); 510 if(tunnel.fd4 < 0) { 511 logmsg(ANDROID_LOG_FATAL, "tun_open4 failed: %s", strerror(errno)); 512 exit(1); 513 } 514 515 // When run from netd, the environment variable ANDROID_DNS_MODE is set to 516 // "local", but that only works for the netd process itself. Removing the 517 // following line causes XLAT failure in permissive mode. 518 unsetenv("ANDROID_DNS_MODE"); 519 520 configure_interface(uplink_interface, plat_prefix, &tunnel, net_id); 521 522 update_clat_ipv6_address(&tunnel, uplink_interface); 523 524 // Loop until someone sends us a signal or brings down the tun interface. 525 if(signal(SIGTERM, stop_loop) == SIG_ERR) { 526 logmsg(ANDROID_LOG_FATAL, "sigterm handler failed: %s", strerror(errno)); 527 exit(1); 528 } 529 530 event_loop(&tunnel); 531 532 logmsg(ANDROID_LOG_INFO,"Shutting down clat on %s", uplink_interface); 533 del_anycast_address(tunnel.write_fd6, &Global_Clatd_Config.ipv6_local_subnet); 534 535 return 0; 536} 537