Remove ClatdController relevant stubs am: 10c98a6dd6

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/netd/+/17938674

Change-Id: I7b7e3e499ee74f53514ba16ba106b64c4aa2c639
Ignore-AOSP-First: this is an automerge
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

7 files changed, 11 insertions, 1368 deletions

diff --git a/server/Android.bp b/server/Android.bp
index be599dec..f29f6cfc 100644
--- a/server/Android.bp
+++ b/server/Android.bp
@@ -45,7 +45,6 @@ cc_library_static {
     header_libs: ["bpf_connectivity_headers"],
     srcs: [
         "BandwidthController.cpp",
-        "ClatdController.cpp",
         "Controllers.cpp",
         "NetdConstants.cpp",
         "FirewallController.cpp",
@@ -204,7 +203,6 @@ cc_test {
     ],
     srcs: [
         "BandwidthControllerTest.cpp",
-        "ClatdControllerTest.cpp",
         "ControllersTest.cpp",
         "FirewallControllerTest.cpp",
         "IdletimerControllerTest.cpp",
diff --git a/server/ClatdController.cpp b/server/ClatdController.cpp
deleted file mode 100644
index bf51d9e0..00000000
--- a/server/ClatdController.cpp
+++ /dev/null
@@ -1,925 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <map>
-#include <string>
-
-#include <arpa/inet.h>
-#include <errno.h>
-#include <linux/if_packet.h>
-#include <linux/if_tun.h>
-#include <linux/ioctl.h>
-#include <net/if.h>
-#include <netinet/in.h>
-#include <spawn.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-
-#define LOG_TAG "ClatdController"
-#include <log/log.h>
-
-#include "ClatdController.h"
-#include "InterfaceController.h"
-
-#include <android/net/InterfaceConfigurationParcel.h>
-#include <netdutils/Status.h>
-
-#include "android-base/properties.h"
-#include "android-base/scopeguard.h"
-#include "android-base/stringprintf.h"
-#include "android-base/unique_fd.h"
-#include "bpf/BpfMap.h"
-#include "bpf_shared.h"
-#include "netdutils/DumpWriter.h"
-
-extern "C" {
-#include "checksum.h"
-}
-
-#include "Fwmark.h"
-#include "NetdConstants.h"
-#include "NetworkController.h"
-#include "TcUtils.h"
-#include "netid_client.h"
-
-// Sync from external/android-clat/clatd.{c, h}
-#define MAXMTU 65536
-#define PACKETLEN (MAXMTU + sizeof(struct tun_pi))
-/* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */
-#define MTU_DELTA 28
-
-static const char* kClatdPath = "/apex/com.android.tethering/bin/for-system/clatd";
-
-// For historical reasons, start with 192.0.0.4, and after that, use all subsequent addresses in
-// 192.0.0.0/29 (RFC 7335).
-static const char* kV4AddrString = "192.0.0.4";
-static const in_addr kV4Addr = {inet_addr(kV4AddrString)};
-static const int kV4AddrLen = 29;
-
-using android::base::Result;
-using android::base::unique_fd;
-using android::bpf::BpfMap;
-using android::netdutils::DumpWriter;
-using android::netdutils::ScopedIndent;
-
-namespace android {
-namespace net {
-
-void ClatdController::init(void) {
-    std::lock_guard guard(mutex);
-
-    int rv = getClatEgress4MapFd();
-    if (rv < 0) {
-        ALOGE("getClatEgress4MapFd() failure: %s", strerror(-rv));
-        return;
-    }
-    mClatEgress4Map.reset(rv);
-
-    rv = getClatIngress6MapFd();
-    if (rv < 0) {
-        ALOGE("getClatIngress6MapFd() failure: %s", strerror(-rv));
-        mClatEgress4Map.reset(-1);
-        return;
-    }
-    mClatIngress6Map.reset(rv);
-
-    mClatEgress4Map.clear();
-    mClatIngress6Map.clear();
-}
-
-bool ClatdController::isIpv4AddressFree(in_addr_t addr) {
-    int s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (s == -1) {
-        return 0;
-    }
-
-    // Attempt to connect to the address. If the connection succeeds and getsockname returns the
-    // same then the address is already assigned to the system and we can't use it.
-    struct sockaddr_in sin = {
-            .sin_family = AF_INET,
-            .sin_port = htons(53),
-            .sin_addr = {addr},
-    };
-    socklen_t len = sizeof(sin);
-    bool inuse = connect(s, (struct sockaddr*)&sin, sizeof(sin)) == 0 &&
-                 getsockname(s, (struct sockaddr*)&sin, &len) == 0 && (size_t)len >= sizeof(sin) &&
-                 sin.sin_addr.s_addr == addr;
-
-    close(s);
-    return !inuse;
-}
-
-// Picks a free IPv4 address, starting from ip and trying all addresses in the prefix in order.
-//   ip        - the IP address from the configuration file
-//   prefixlen - the length of the prefix from which addresses may be selected.
-//   returns: the IPv4 address, or INADDR_NONE if no addresses were available
-in_addr_t ClatdController::selectIpv4Address(const in_addr ip, int16_t prefixlen) {
-    // Don't accept prefixes that are too large because we scan addresses one by one.
-    if (prefixlen < 16 || prefixlen > 32) {
-        return INADDR_NONE;
-    }
-
-    // All these are in host byte order.
-    in_addr_t mask = 0xffffffff >> (32 - prefixlen) << (32 - prefixlen);
-    in_addr_t ipv4 = ntohl(ip.s_addr);
-    in_addr_t first_ipv4 = ipv4;
-    in_addr_t prefix = ipv4 & mask;
-
-    // Pick the first IPv4 address in the pool, wrapping around if necessary.
-    // So, for example, 192.0.0.4 -> 192.0.0.5 -> 192.0.0.6 -> 192.0.0.7 -> 192.0.0.0.
-    do {
-        if (isIpv4AddressFreeFunc(htonl(ipv4))) {
-            return htonl(ipv4);
-        }
-        ipv4 = prefix | ((ipv4 + 1) & ~mask);
-    } while (ipv4 != first_ipv4);
-
-    return INADDR_NONE;
-}
-
-// Alters the bits in the IPv6 address to make them checksum neutral with v4 and nat64Prefix.
-void ClatdController::makeChecksumNeutral(in6_addr* v6, const in_addr v4,
-                                          const in6_addr& nat64Prefix) {
-    // Fill last 8 bytes of IPv6 address with random bits.
-    arc4random_buf(&v6->s6_addr[8], 8);
-
-    // Make the IID checksum-neutral. That is, make it so that:
-    //   checksum(Local IPv4 | Remote IPv4) = checksum(Local IPv6 | Remote IPv6)
-    // in other words (because remote IPv6 = NAT64 prefix | Remote IPv4):
-    //   checksum(Local IPv4) = checksum(Local IPv6 | NAT64 prefix)
-    // Do this by adjusting the two bytes in the middle of the IID.
-
-    uint16_t middlebytes = (v6->s6_addr[11] << 8) + v6->s6_addr[12];
-
-    uint32_t c1 = ip_checksum_add(0, &v4, sizeof(v4));
-    uint32_t c2 = ip_checksum_add(0, &nat64Prefix, sizeof(nat64Prefix)) +
-                  ip_checksum_add(0, v6, sizeof(*v6));
-
-    uint16_t delta = ip_checksum_adjust(middlebytes, c1, c2);
-    v6->s6_addr[11] = delta >> 8;
-    v6->s6_addr[12] = delta & 0xff;
-}
-
-// Picks a random interface ID that is checksum neutral with the IPv4 address and the NAT64 prefix.
-int ClatdController::generateIpv6Address(const char* iface, const in_addr v4,
-                                         const in6_addr& nat64Prefix, in6_addr* v6) {
-    unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
-    if (s == -1) return -errno;
-
-    if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1) == -1) {
-        return -errno;
-    }
-
-    sockaddr_in6 sin6 = {.sin6_family = AF_INET6, .sin6_addr = nat64Prefix};
-    if (connect(s, reinterpret_cast<struct sockaddr*>(&sin6), sizeof(sin6)) == -1) {
-        return -errno;
-    }
-
-    socklen_t len = sizeof(sin6);
-    if (getsockname(s, reinterpret_cast<struct sockaddr*>(&sin6), &len) == -1) {
-        return -errno;
-    }
-
-    *v6 = sin6.sin6_addr;
-
-    if (IN6_IS_ADDR_UNSPECIFIED(v6) || IN6_IS_ADDR_LOOPBACK(v6) || IN6_IS_ADDR_LINKLOCAL(v6) ||
-        IN6_IS_ADDR_SITELOCAL(v6) || IN6_IS_ADDR_ULA(v6)) {
-        return -ENETUNREACH;
-    }
-
-    makeChecksumNeutral(v6, v4, nat64Prefix);
-
-    return 0;
-}
-
-void ClatdController::maybeStartBpf(const ClatdTracker& tracker) {
-    auto isEthernet = android::net::isEthernet(tracker.iface);
-    if (!isEthernet.ok()) {
-        ALOGE("isEthernet(%s[%d]) failure: %s", tracker.iface, tracker.ifIndex,
-              isEthernet.error().message().c_str());
-        return;
-    }
-
-    ClatEgress4Key txKey = {
-            .iif = tracker.v4ifIndex,
-            .local4 = tracker.v4,
-    };
-    ClatEgress4Value txValue = {
-            .oif = tracker.ifIndex,
-            .local6 = tracker.v6,
-            .pfx96 = tracker.pfx96,
-            .oifIsEthernet = isEthernet.value(),
-    };
-
-    auto ret = mClatEgress4Map.writeValue(txKey, txValue, BPF_ANY);
-    if (!ret.ok()) {
-        ALOGE("mClatEgress4Map.writeValue failure: %s", strerror(ret.error().code()));
-        return;
-    }
-
-    ClatIngress6Key rxKey = {
-            .iif = tracker.ifIndex,
-            .pfx96 = tracker.pfx96,
-            .local6 = tracker.v6,
-    };
-    ClatIngress6Value rxValue = {
-            // TODO: move all the clat code to eBPF and remove the tun interface entirely.
-            .oif = tracker.v4ifIndex,
-            .local4 = tracker.v4,
-    };
-
-    ret = mClatIngress6Map.writeValue(rxKey, rxValue, BPF_ANY);
-    if (!ret.ok()) {
-        ALOGE("mClatIngress6Map.writeValue failure: %s", strerror(ret.error().code()));
-        ret = mClatEgress4Map.deleteValue(txKey);
-        if (!ret.ok())
-            ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code()));
-        return;
-    }
-
-    // We do tc setup *after* populating the maps, so scanning through them
-    // can always be used to tell us what needs cleanup.
-
-    // Usually the clsact will be added in RouteController::addInterfaceToPhysicalNetwork.
-    // But clat is started before the v4- interface is added to the network. The clat startup have
-    // to add clsact of v4- tun interface first for adding bpf filter in maybeStartBpf.
-    // TODO: move "qdisc add clsact" of v4- tun interface out from ClatdController.
-    int rv = tcQdiscAddDevClsact(tracker.v4ifIndex);
-    if (rv) {
-        ALOGE("tcQdiscAddDevClsact(%d[%s]) failure: %s", tracker.v4ifIndex, tracker.v4iface,
-              strerror(-rv));
-        ret = mClatEgress4Map.deleteValue(txKey);
-        if (!ret.ok())
-            ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code()));
-        ret = mClatIngress6Map.deleteValue(rxKey);
-        if (!ret.ok())
-            ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code()));
-        return;
-    }
-
-    // This program will be attached to the v4-* interface which is a TUN and thus always rawip.
-    rv = tcFilterAddDevEgressClatIpv4(tracker.v4ifIndex, CLAT_EGRESS4_PROG_RAWIP_PATH);
-    if (rv) {
-        ALOGE("tcFilterAddDevEgressClatIpv4(%d[%s], RAWIP) failure: %s", tracker.v4ifIndex,
-              tracker.v4iface, strerror(-rv));
-
-        // The v4- interface clsact is not deleted for unwinding error because once it is created
-        // with interface addition, the lifetime is till interface deletion. Moreover, the clsact
-        // has no clat filter now. It should not break anything.
-
-        ret = mClatEgress4Map.deleteValue(txKey);
-        if (!ret.ok())
-            ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code()));
-        ret = mClatIngress6Map.deleteValue(rxKey);
-        if (!ret.ok())
-            ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code()));
-        return;
-    }
-
-    std::string rxProgPath =
-            isEthernet.value() ? CLAT_INGRESS6_PROG_ETHER_PATH : CLAT_INGRESS6_PROG_RAWIP_PATH;
-    rv = tcFilterAddDevIngressClatIpv6(tracker.ifIndex, rxProgPath);
-    if (rv) {
-        ALOGE("tcFilterAddDevIngressClatIpv6(%d[%s], %d) failure: %s", tracker.ifIndex,
-              tracker.iface, isEthernet.value(), strerror(-rv));
-        rv = tcFilterDelDevEgressClatIpv4(tracker.v4ifIndex);
-        if (rv) {
-            ALOGE("tcFilterDelDevEgressClatIpv4(%d[%s]) failure: %s", tracker.v4ifIndex,
-                  tracker.v4iface, strerror(-rv));
-        }
-
-        // The v4- interface clsact is not deleted. See the reason in the error unwinding code of
-        // the egress filter attaching of v4- tun interface.
-
-        ret = mClatEgress4Map.deleteValue(txKey);
-        if (!ret.ok())
-            ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code()));
-        ret = mClatIngress6Map.deleteValue(rxKey);
-        if (!ret.ok())
-            ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code()));
-        return;
-    }
-
-    // success
-}
-
-void ClatdController::maybeStopBpf(const ClatdTracker& tracker) {
-    int rv = tcFilterDelDevIngressClatIpv6(tracker.ifIndex);
-    if (rv < 0) {
-        ALOGE("tcFilterDelDevIngressClatIpv6(%d[%s]) failure: %s", tracker.ifIndex, tracker.iface,
-              strerror(-rv));
-    }
-
-    rv = tcFilterDelDevEgressClatIpv4(tracker.v4ifIndex);
-    if (rv < 0) {
-        ALOGE("tcFilterDelDevEgressClatIpv4(%d[%s]) failure: %s", tracker.v4ifIndex,
-              tracker.v4iface, strerror(-rv));
-    }
-
-    // We cleanup the maps last, so scanning through them can be used to
-    // determine what still needs cleanup.
-
-    ClatEgress4Key txKey = {
-            .iif = tracker.v4ifIndex,
-            .local4 = tracker.v4,
-    };
-
-    auto ret = mClatEgress4Map.deleteValue(txKey);
-    if (!ret.ok()) ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code()));
-
-    ClatIngress6Key rxKey = {
-            .iif = tracker.ifIndex,
-            .pfx96 = tracker.pfx96,
-            .local6 = tracker.v6,
-    };
-
-    ret = mClatIngress6Map.deleteValue(rxKey);
-    if (!ret.ok()) ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code()));
-}
-
-// Finds the tracker of the clatd running on interface |interface|, or nullptr if clatd has not been
-// started  on |interface|.
-ClatdController::ClatdTracker* ClatdController::getClatdTracker(const std::string& interface) {
-    auto it = mClatdTrackers.find(interface);
-    return (it == mClatdTrackers.end() ? nullptr : &it->second);
-}
-
-// Initializes a ClatdTracker for the specified interface.
-int ClatdController::ClatdTracker::init(unsigned networkId, const std::string& interface,
-                                        const std::string& v4interface,
-                                        const std::string& nat64Prefix) {
-    fwmark.netId = networkId;
-    fwmark.explicitlySelected = true;
-    fwmark.protectedFromVpn = true;
-    fwmark.permission = PERMISSION_SYSTEM;
-
-    snprintf(fwmarkString, sizeof(fwmarkString), "0x%x", fwmark.intValue);
-    strlcpy(iface, interface.c_str(), sizeof(iface));
-    ifIndex = if_nametoindex(iface);
-    strlcpy(v4iface, v4interface.c_str(), sizeof(v4iface));
-    v4ifIndex = if_nametoindex(v4iface);
-
-    // Pass in everything that clatd needs: interface, a fwmark for outgoing packets, the NAT64
-    // prefix, and the IPv4 and IPv6 addresses.
-    // Validate the prefix and strip off the prefix length.
-    uint8_t family;
-    uint8_t prefixLen;
-    int res = parsePrefix(nat64Prefix.c_str(), &family, &pfx96, sizeof(pfx96), &prefixLen);
-    // clatd only supports /96 prefixes.
-    if (res != sizeof(pfx96)) return res;
-    if (family != AF_INET6) return -EAFNOSUPPORT;
-    if (prefixLen != 96) return -EINVAL;
-    if (!inet_ntop(AF_INET6, &pfx96, pfx96String, sizeof(pfx96String))) return -errno;
-
-    // Pick an IPv4 address.
-    // TODO: this picks the address based on other addresses that are assigned to interfaces, but
-    // the address is only actually assigned to an interface once clatd starts up. So we could end
-    // up with two clatd instances with the same IPv4 address.
-    // Stop doing this and instead pick a free one from the kV4Addr pool.
-    v4 = {selectIpv4Address(kV4Addr, kV4AddrLen)};
-    if (v4.s_addr == INADDR_NONE) {
-        ALOGE("No free IPv4 address in %s/%d", kV4AddrString, kV4AddrLen);
-        return -EADDRNOTAVAIL;
-    }
-    if (!inet_ntop(AF_INET, &v4, v4Str, sizeof(v4Str))) return -errno;
-
-    // Generate a checksum-neutral IID.
-    if (generateIpv6Address(iface, v4, pfx96, &v6)) {
-        ALOGE("Unable to find global source address on %s for %s", iface, pfx96String);
-        return -EADDRNOTAVAIL;
-    }
-    if (!inet_ntop(AF_INET6, &v6, v6Str, sizeof(v6Str))) return -errno;
-
-    ALOGD("starting clatd on %s v4=%s v6=%s pfx96=%s", iface, v4Str, v6Str, pfx96String);
-    return 0;
-}
-
-/* function: configure_tun_ip
- * configures the ipv4 address on the tunnel interface
- *   v4iface - tunnel interface name
- *   v4Str   - tunnel ipv4 address
- *   mtu     - mtu of tun device
- * returns: 0 on success, -errno on failure
- */
-int ClatdController::configure_tun_ip(const char* v4iface, const char* v4Str, int mtu) {
-    ALOGI("Using IPv4 address %s on %s", v4Str, v4iface);
-
-    // Configure the interface before bringing it up. As soon as we bring the interface up, the
-    // framework will be notified and will assume the interface's configuration has been finalized.
-    std::string mtuStr = std::to_string(mtu);
-    if (int res = InterfaceController::setMtu(v4iface, mtuStr.c_str())) {
-        ALOGE("setMtu %s failed (%s)", v4iface, strerror(-res));
-        return res;
-    }
-
-    InterfaceConfigurationParcel ifConfig;
-    ifConfig.ifName = std::string(v4iface);
-    ifConfig.ipv4Addr = std::string(v4Str);
-    ifConfig.prefixLength = 32;
-    ifConfig.hwAddr = std::string("");
-    ifConfig.flags = std::vector<std::string>{std::string(String8(INetd::IF_STATE_UP().string()))};
-    const auto& status = InterfaceController::setCfg(ifConfig);
-    if (!status.ok()) {
-        ALOGE("configure_tun_ip/setCfg failed: %s", strerror(status.code()));
-        return -status.code();
-    }
-
-    return 0;
-}
-
-/* function: add_anycast_address
- * adds an anycast IPv6 address to an interface, returns 0 on success and <0 on failure
- *   sock      - the socket to add the address to
- *   addr      - the IP address to add
- *   ifindex   - index of interface to add the address to
- * returns: 0 on success, -errno on failure
- */
-int ClatdController::add_anycast_address(int sock, struct in6_addr* addr, int ifindex) {
-    struct ipv6_mreq mreq = {*addr, ifindex};
-    int ret = setsockopt(sock, SOL_IPV6, IPV6_JOIN_ANYCAST, &mreq, sizeof(mreq));
-    if (ret) {
-        ret = errno;
-        ALOGE("setsockopt(IPV6_JOIN_ANYCAST): %s", strerror(errno));
-        return -ret;
-    }
-
-    return 0;
-}
-
-/* function: configure_packet_socket
- * Binds the packet socket and attaches the receive filter to it.
- *   sock    - the socket to configure
- *   addr    - the IP address to filter
- *   ifindex - index of interface to add the filter to
- * returns: 0 on success, -errno on failure
- */
-int ClatdController::configure_packet_socket(int sock, in6_addr* addr, int ifindex) {
-    uint32_t* ipv6 = addr->s6_addr32;
-
-    // clang-format off
-    struct sock_filter filter_code[] = {
-    // Load the first four bytes of the IPv6 destination address (starts 24 bytes in).
-    // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads
-    // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it
-    // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other
-    // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet).
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  24),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[0]), 0, 7),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  28),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[1]), 0, 5),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  32),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[2]), 0, 3),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  36),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[3]), 0, 1),
-        BPF_STMT(BPF_RET | BPF_K,              PACKETLEN),
-        BPF_STMT(BPF_RET | BPF_K,              0),
-    };
-    // clang-format on
-    struct sock_fprog filter = {sizeof(filter_code) / sizeof(filter_code[0]), filter_code};
-
-    if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) {
-        int res = errno;
-        ALOGE("attach packet filter failed: %s", strerror(errno));
-        return -res;
-    }
-
-    struct sockaddr_ll sll = {
-            .sll_family = AF_PACKET,
-            .sll_protocol = htons(ETH_P_IPV6),
-            .sll_ifindex = ifindex,
-            .sll_pkttype =
-                    PACKET_OTHERHOST,  // The 464xlat IPv6 address is not assigned to the kernel.
-    };
-    if (bind(sock, (struct sockaddr*)&sll, sizeof(sll))) {
-        int res = errno;
-        ALOGE("binding packet socket: %s", strerror(errno));
-        return -res;
-    }
-
-    return 0;
-}
-
-/* function: configure_clat_ipv6_address
- * picks the clat IPv6 address and configures packet translation to use it.
- *   tunnel - tun device data
- *   interface - uplink interface name
- * returns: 0 on success, -errno on failure
- */
-int ClatdController::configure_clat_ipv6_address(struct ClatdTracker* tracker,
-                                                 struct tun_data* tunnel) {
-    ALOGI("Using IPv6 address %s on %s", tracker->v6Str, tracker->iface);
-
-    // Start translating packets to the new prefix.
-    // TODO: return if error. b/212679140 needs to be fixed first.
-    add_anycast_address(tunnel->write_fd6, &tracker->v6, tracker->ifIndex);
-
-    // Update our packet socket filter to reflect the new 464xlat IP address.
-    if (int res = configure_packet_socket(tunnel->read_fd6, &tracker->v6, tracker->ifIndex)) {
-        // Things aren't going to work. Bail out and hope we have better luck next time.
-        // We don't log an error here because configure_packet_socket has already done so.
-        return res;
-    }
-
-    return 0;
-}
-
-/* function: detect mtu
- * returns: mtu on success, -errno on failure
- */
-int ClatdController::detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix,
-                                uint32_t mark) {
-    // Create an IPv6 UDP socket.
-    unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
-    if (s < 0) {
-        int ret = errno;
-        ALOGE("socket(AF_INET6, SOCK_DGRAM, 0) failed: %s", strerror(errno));
-        return -ret;
-    }
-
-    // Socket's mark affects routing decisions (network selection)
-    if ((mark != MARK_UNSET) && setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) {
-        int ret = errno;
-        ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(errno));
-        return -ret;
-    }
-
-    // Try to connect udp socket to plat_subnet(96 bits):plat_suffix(32 bits)
-    struct sockaddr_in6 dst = {
-            .sin6_family = AF_INET6,
-            .sin6_addr = *plat_subnet,
-    };
-    dst.sin6_addr.s6_addr32[3] = plat_suffix;
-    if (connect(s, (struct sockaddr*)&dst, sizeof(dst))) {
-        int ret = errno;
-        ALOGE("connect() failed: %s", strerror(errno));
-        return -ret;
-    }
-
-    // Fetch the socket's IPv6 mtu - this is effectively fetching mtu from routing table
-    int mtu;
-    socklen_t sz_mtu = sizeof(mtu);
-    if (getsockopt(s, SOL_IPV6, IPV6_MTU, &mtu, &sz_mtu)) {
-        int ret = errno;
-        ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) failed: %s", strerror(errno));
-        return -ret;
-    }
-    if (sz_mtu != sizeof(mtu)) {
-        ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) returned unexpected size: %d", sz_mtu);
-        return -EFAULT;
-    }
-
-    return mtu;
-}
-
-/* function: configure_interface
- * reads the configuration and applies it to the interface
- *   tracker - clat tracker
- *   tunnel - tun device data
- * returns: 0 on success, -errno on failure
- */
-int ClatdController::configure_interface(struct ClatdTracker* tracker, struct tun_data* tunnel) {
-    int res = detect_mtu(&tracker->pfx96, htonl(0x08080808), tracker->fwmark.intValue);
-    if (res < 0) return -res;
-
-    int mtu = res;
-    // clamp to minimum ipv6 mtu - this probably cannot ever trigger
-    if (mtu < 1280) mtu = 1280;
-    // clamp to buffer size
-    if (mtu > MAXMTU) mtu = MAXMTU;
-    // decrease by ipv6(40) + ipv6 fragmentation header(8) vs ipv4(20) overhead of 28 bytes
-    mtu -= MTU_DELTA;
-    ALOGI("ipv4 mtu is %d", mtu);
-
-    if (int ret = configure_tun_ip(tracker->v4iface, tracker->v4Str, mtu)) return ret;
-    if (int ret = configure_clat_ipv6_address(tracker, tunnel)) return ret;
-
-    return 0;
-}
-
-int ClatdController::startClatd(const std::string& interface, const std::string& nat64Prefix,
-                                std::string* v6Str) {
-    std::lock_guard guard(mutex);
-
-    // 1. fail if pre-existing tracker already exists
-    ClatdTracker* existing = getClatdTracker(interface);
-    if (existing != nullptr) {
-        ALOGE("clatd pid=%d already started on %s", existing->pid, interface.c_str());
-        return -EBUSY;
-    }
-
-    // 2. get network id associated with this external interface
-    unsigned networkId = mNetCtrl->getNetworkForInterface(interface.c_str());
-    if (networkId == NETID_UNSET) {
-        ALOGE("Interface %s not assigned to any netId", interface.c_str());
-        return -ENODEV;
-    }
-
-    // 3. open the tun device in non blocking mode as required by clatd
-    int res = open("/dev/net/tun", O_RDWR | O_NONBLOCK | O_CLOEXEC);
-    if (res == -1) {
-        res = errno;
-        ALOGE("open of tun device failed (%s)", strerror(res));
-        return -res;
-    }
-    unique_fd tmpTunFd(res);
-
-    // 4. create the v4-... tun interface
-    std::string v4interface("v4-");
-    v4interface += interface;
-
-    struct ifreq ifr = {
-            .ifr_flags = IFF_TUN,
-    };
-    strlcpy(ifr.ifr_name, v4interface.c_str(), sizeof(ifr.ifr_name));
-
-    res = ioctl(tmpTunFd, TUNSETIFF, &ifr, sizeof(ifr));
-    if (res == -1) {
-        res = errno;
-        ALOGE("ioctl(TUNSETIFF) failed (%s)", strerror(res));
-        return -res;
-    }
-
-    // disable IPv6 on it - failing to do so is not a critical error
-    res = InterfaceController::setEnableIPv6(v4interface.c_str(), 0);
-    if (res) ALOGE("setEnableIPv6 %s failed (%s)", v4interface.c_str(), strerror(res));
-
-    // 5. initialize tracker object
-    ClatdTracker tracker;
-    int ret = tracker.init(networkId, interface, v4interface, nat64Prefix);
-    if (ret) return ret;
-
-    // 6. create a throwaway socket to reserve a file descriptor number
-    res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (res == -1) {
-        res = errno;
-        ALOGE("socket(ipv6/udp) failed (%s)", strerror(res));
-        return -res;
-    }
-    unique_fd passedTunFd(res);
-
-    // 7. this is the FD we'll pass to clatd on the cli, so need it as a string
-    char passedTunFdStr[INT32_STRLEN];
-    snprintf(passedTunFdStr, sizeof(passedTunFdStr), "%d", passedTunFd.get());
-
-    // 8. create a raw socket for clatd sending packets to the tunnel
-    res = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW);
-    if (res < 0) {
-        res = errno;
-        ALOGE("raw socket failed: %s", strerror(errno));
-        return -res;
-    }
-    unique_fd tmpRawSock(res);
-
-    const int mark = tracker.fwmark.intValue;
-    if (mark != MARK_UNSET &&
-        setsockopt(tmpRawSock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
-        res = errno;
-        ALOGE("could not set mark on raw socket: %s", strerror(errno));
-        return -res;
-    }
-
-    // create a throwaway socket to reserve a file descriptor number
-    res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (res == -1) {
-        res = errno;
-        ALOGE("socket(ipv6/udp) failed (%s) for raw socket", strerror(res));
-        return -res;
-    }
-    unique_fd passedRawSock(res);
-
-    // this is the raw socket FD we'll pass to clatd on the cli, so need it as a string
-    char passedRawSockStr[INT32_STRLEN];
-    snprintf(passedRawSockStr, sizeof(passedRawSockStr), "%d", passedRawSock.get());
-
-    // 9. create a packet socket for clatd sending packets to the tunnel
-    // Will eventually be bound to htons(ETH_P_IPV6) protocol,
-    // but only after appropriate bpf filter is attached.
-    res = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (res < 0) {
-        res = errno;
-        ALOGE("packet socket failed: %s", strerror(errno));
-        return -res;
-    }
-    unique_fd tmpPacketSock(res);
-
-    // create a throwaway socket to reserve a file descriptor number
-    res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (res == -1) {
-        res = errno;
-        ALOGE("socket(ipv6/udp) failed (%s) for packet socket", strerror(res));
-        return -res;
-    }
-    unique_fd passedPacketSock(res);
-
-    // this is the packet socket FD we'll pass to clatd on the cli, so need it as a string
-    char passedPacketSockStr[INT32_STRLEN];
-    snprintf(passedPacketSockStr, sizeof(passedPacketSock), "%d", passedPacketSock.get());
-
-    // 10. configure tun and clat interface
-    struct tun_data tunnel = {.fd4 = tmpTunFd, .read_fd6 = tmpPacketSock, .write_fd6 = tmpRawSock};
-    res = configure_interface(&tracker, &tunnel);
-    if (res) {
-        ALOGE("configure interface failed: %s", strerror(res));
-        return -res;
-    }
-
-    // 11. we're going to use this as argv[0] to clatd to make ps output more useful
-    std::string progname("clatd-");
-    progname += tracker.iface;
-
-    // clang-format off
-    const char* args[] = {progname.c_str(),
-                          "-i", tracker.iface,
-                          "-p", tracker.pfx96String,
-                          "-4", tracker.v4Str,
-                          "-6", tracker.v6Str,
-                          "-t", passedTunFdStr,
-                          "-r", passedPacketSockStr,
-                          "-w", passedRawSockStr,
-                          nullptr};
-    // clang-format on
-
-    // 12. register vfork requirement
-    posix_spawnattr_t attr;
-    res = posix_spawnattr_init(&attr);
-    if (res) {
-        ALOGE("posix_spawnattr_init failed (%s)", strerror(res));
-        return -res;
-    }
-    const android::base::ScopeGuard attrGuard = [&] { posix_spawnattr_destroy(&attr); };
-    res = posix_spawnattr_setflags(&attr, POSIX_SPAWN_USEVFORK);
-    if (res) {
-        ALOGE("posix_spawnattr_setflags failed (%s)", strerror(res));
-        return -res;
-    }
-
-    // 13. register dup2() action: this is what 'clears' the CLOEXEC flag
-    // on the tun fd that we want the child clatd process to inherit
-    // (this will happen after the vfork, and before the execve)
-    posix_spawn_file_actions_t fa;
-    res = posix_spawn_file_actions_init(&fa);
-    if (res) {
-        ALOGE("posix_spawn_file_actions_init failed (%s)", strerror(res));
-        return -res;
-    }
-    const android::base::ScopeGuard faGuard = [&] { posix_spawn_file_actions_destroy(&fa); };
-    res = posix_spawn_file_actions_adddup2(&fa, tmpTunFd, passedTunFd);
-    if (res) {
-        ALOGE("posix_spawn_file_actions_adddup2 tun fd failed (%s)", strerror(res));
-        return -res;
-    }
-    res = posix_spawn_file_actions_adddup2(&fa, tmpPacketSock, passedPacketSock);
-    if (res) {
-        ALOGE("posix_spawn_file_actions_adddup2 packet socket failed (%s)", strerror(res));
-        return -res;
-    }
-    res = posix_spawn_file_actions_adddup2(&fa, tmpRawSock, passedRawSock);
-    if (res) {
-        ALOGE("posix_spawn_file_actions_adddup2 raw socket failed (%s)", strerror(res));
-        return -res;
-    }
-
-    // 14. actually perform vfork/dup2/execve
-    res = posix_spawn(&tracker.pid, kClatdPath, &fa, &attr, (char* const*)args, nullptr);
-    if (res) {
-        ALOGE("posix_spawn failed (%s)", strerror(res));
-        return -res;
-    }
-
-    // 15. configure eBPF offload - if possible
-    maybeStartBpf(tracker);
-
-    mClatdTrackers[interface] = tracker;
-    ALOGD("clatd started on %s", interface.c_str());
-
-    *v6Str = tracker.v6Str;
-    return 0;
-}
-
-int ClatdController::stopClatd(const std::string& interface) {
-    std::lock_guard guard(mutex);
-    ClatdTracker* tracker = getClatdTracker(interface);
-
-    if (tracker == nullptr) {
-        ALOGE("clatd already stopped");
-        return -ENODEV;
-    }
-
-    ALOGD("Stopping clatd pid=%d on %s", tracker->pid, interface.c_str());
-
-    maybeStopBpf(*tracker);
-
-    ::stopProcess(tracker->pid, "clatd");
-
-    mClatdTrackers.erase(interface);
-
-    ALOGD("clatd on %s stopped", interface.c_str());
-
-    return 0;
-}
-
-void ClatdController::dumpEgress(DumpWriter& dw) {
-    if (!mClatEgress4Map.isValid()) return;  // if unsupported just don't dump anything
-
-    ScopedIndent bpfIndent(dw);
-    dw.println("BPF egress map: iif(iface) v4Addr -> v6Addr nat64Prefix oif(iface)");
-
-    ScopedIndent bpfDetailIndent(dw);
-    const auto printClatMap = [&dw](const ClatEgress4Key& key, const ClatEgress4Value& value,
-                                    const BpfMap<ClatEgress4Key, ClatEgress4Value>&) {
-        char iifStr[IFNAMSIZ] = "?";
-        char local4Str[INET_ADDRSTRLEN] = "?";
-        char local6Str[INET6_ADDRSTRLEN] = "?";
-        char pfx96Str[INET6_ADDRSTRLEN] = "?";
-        char oifStr[IFNAMSIZ] = "?";
-
-        if_indextoname(key.iif, iifStr);
-        inet_ntop(AF_INET, &key.local4, local4Str, sizeof(local4Str));
-        inet_ntop(AF_INET6, &value.local6, local6Str, sizeof(local6Str));
-        inet_ntop(AF_INET6, &value.pfx96, pfx96Str, sizeof(pfx96Str));
-        if_indextoname(value.oif, oifStr);
-
-        dw.println("%u(%s) %s -> %s %s/96 %u(%s) %s", key.iif, iifStr, local4Str, local6Str,
-                   pfx96Str, value.oif, oifStr, value.oifIsEthernet ? "ether" : "rawip");
-        return Result<void>();
-    };
-    auto res = mClatEgress4Map.iterateWithValue(printClatMap);
-    if (!res.ok()) {
-        dw.println("Error printing BPF map: %s", res.error().message().c_str());
-    }
-}
-
-void ClatdController::dumpIngress(DumpWriter& dw) {
-    if (!mClatIngress6Map.isValid()) return;  // if unsupported just don't dump anything
-
-    ScopedIndent bpfIndent(dw);
-    dw.println("BPF ingress map: iif(iface) nat64Prefix v6Addr -> v4Addr oif(iface)");
-
-    ScopedIndent bpfDetailIndent(dw);
-    const auto printClatMap = [&dw](const ClatIngress6Key& key, const ClatIngress6Value& value,
-                                    const BpfMap<ClatIngress6Key, ClatIngress6Value>&) {
-        char iifStr[IFNAMSIZ] = "?";
-        char pfx96Str[INET6_ADDRSTRLEN] = "?";
-        char local6Str[INET6_ADDRSTRLEN] = "?";
-        char local4Str[INET_ADDRSTRLEN] = "?";
-        char oifStr[IFNAMSIZ] = "?";
-
-        if_indextoname(key.iif, iifStr);
-        inet_ntop(AF_INET6, &key.pfx96, pfx96Str, sizeof(pfx96Str));
-        inet_ntop(AF_INET6, &key.local6, local6Str, sizeof(local6Str));
-        inet_ntop(AF_INET, &value.local4, local4Str, sizeof(local4Str));
-        if_indextoname(value.oif, oifStr);
-
-        dw.println("%u(%s) %s/96 %s -> %s %u(%s)", key.iif, iifStr, pfx96Str, local6Str, local4Str,
-                   value.oif, oifStr);
-        return Result<void>();
-    };
-    auto res = mClatIngress6Map.iterateWithValue(printClatMap);
-    if (!res.ok()) {
-        dw.println("Error printing BPF map: %s", res.error().message().c_str());
-    }
-}
-
-void ClatdController::dumpTrackers(DumpWriter& dw) {
-    ScopedIndent trackerIndent(dw);
-    dw.println("Trackers: iif[iface] nat64Prefix v6Addr -> v4Addr v4iif[v4iface] [fwmark]");
-
-    ScopedIndent trackerDetailIndent(dw);
-    for (const auto& pair : mClatdTrackers) {
-        const ClatdTracker& tracker = pair.second;
-        dw.println("%u[%s] %s/96 %s -> %s %u[%s] [%s]", tracker.ifIndex, tracker.iface,
-                   tracker.pfx96String, tracker.v6Str, tracker.v4Str, tracker.v4ifIndex,
-                   tracker.v4iface, tracker.fwmarkString);
-    }
-}
-
-void ClatdController::dump(DumpWriter& dw) {
-    std::lock_guard guard(mutex);
-
-    ScopedIndent clatdIndent(dw);
-    dw.println("ClatdController");
-
-    dumpTrackers(dw);
-    dumpIngress(dw);
-    dumpEgress(dw);
-}
-
-auto ClatdController::isIpv4AddressFreeFunc = isIpv4AddressFree;
-auto ClatdController::iptablesRestoreFunction = execIptablesRestore;
-
-}  // namespace net
-}  // namespace android
diff --git a/server/ClatdController.h b/server/ClatdController.h
deleted file mode 100644
index 74690ff4..00000000
--- a/server/ClatdController.h
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef _CLATD_CONTROLLER_H
-#define _CLATD_CONTROLLER_H
-
-#include <map>
-#include <mutex>
-#include <string>
-
-#include <linux/if.h>
-#include <netinet/in.h>
-
-#include <android-base/thread_annotations.h>
-
-#include "Fwmark.h"
-#include "NetdConstants.h"
-#include "bpf/BpfMap.h"
-#include "bpf_shared.h"
-#include "netdutils/DumpWriter.h"
-
-namespace android {
-namespace net {
-
-class NetworkController;
-
-class ClatdController {
-  public:
-    explicit ClatdController(NetworkController* controller) EXCLUDES(mutex)
-        : mNetCtrl(controller){};
-    virtual ~ClatdController() EXCLUDES(mutex){};
-
-    /* First thing init/startClatd/stopClatd/dump do is grab the mutex. */
-    void init(void) EXCLUDES(mutex);
-
-    int startClatd(const std::string& interface, const std::string& nat64Prefix,
-                   std::string* v6Addr) EXCLUDES(mutex);
-    int stopClatd(const std::string& interface) EXCLUDES(mutex);
-
-    void dump(netdutils::DumpWriter& dw) EXCLUDES(mutex);
-
-    // Public struct ClatdTracker and tun_data for testing. gtest/TEST_F macro changes the class
-    // name. In TEST_F(ClatdControllerTest..), can't access struct ClatdTracker and tun_data.
-    // TODO: probably use gtest/FRIEND_TEST macro.
-    struct ClatdTracker {
-        pid_t pid = -1;
-        unsigned ifIndex;
-        char iface[IFNAMSIZ];
-        unsigned v4ifIndex;
-        char v4iface[IFNAMSIZ];
-        Fwmark fwmark;
-        char fwmarkString[UINT32_STRLEN];
-        in_addr v4;
-        char v4Str[INET_ADDRSTRLEN];
-        in6_addr v6;
-        char v6Str[INET6_ADDRSTRLEN];
-        in6_addr pfx96;
-        char pfx96String[INET6_ADDRSTRLEN];
-
-        int init(unsigned networkId, const std::string& interface, const std::string& v4interface,
-                 const std::string& nat64Prefix);
-    };
-
-    // Public for testing. See above reason in struct ClatdTracker.
-    struct tun_data {
-        int read_fd6, write_fd6, fd4;
-    };
-
-  private:
-    std::mutex mutex;
-
-    const NetworkController* mNetCtrl GUARDED_BY(mutex);
-    std::map<std::string, ClatdTracker> mClatdTrackers GUARDED_BY(mutex);
-    ClatdTracker* getClatdTracker(const std::string& interface) REQUIRES(mutex);
-
-    void dumpEgress(netdutils::DumpWriter& dw) REQUIRES(mutex);
-    void dumpIngress(netdutils::DumpWriter& dw) REQUIRES(mutex);
-    void dumpTrackers(netdutils::DumpWriter& dw) REQUIRES(mutex);
-
-    static in_addr_t selectIpv4Address(const in_addr ip, int16_t prefixlen);
-    static int generateIpv6Address(const char* iface, const in_addr v4, const in6_addr& nat64Prefix,
-                                   in6_addr* v6);
-    static void makeChecksumNeutral(in6_addr* v6, const in_addr v4, const in6_addr& nat64Prefix);
-
-    bpf::BpfMap<ClatEgress4Key, ClatEgress4Value> mClatEgress4Map GUARDED_BY(mutex);
-    bpf::BpfMap<ClatIngress6Key, ClatIngress6Value> mClatIngress6Map GUARDED_BY(mutex);
-
-    void maybeStartBpf(const ClatdTracker& tracker) REQUIRES(mutex);
-    void maybeStopBpf(const ClatdTracker& tracker) REQUIRES(mutex);
-
-    int detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix, uint32_t mark);
-    int configure_interface(struct ClatdTracker* tracker, struct tun_data* tunnel) REQUIRES(mutex);
-    int configure_tun_ip(const char* v4iface, const char* v4Str, int mtu) REQUIRES(mutex);
-    int configure_clat_ipv6_address(struct ClatdTracker* tracker, struct tun_data* tunnel)
-            REQUIRES(mutex);
-    int add_anycast_address(int sock, struct in6_addr* addr, int ifindex) REQUIRES(mutex);
-    int configure_packet_socket(int sock, in6_addr* addr, int ifindex) REQUIRES(mutex);
-
-    // For testing.
-    friend class ClatdControllerTest;
-
-    static bool (*isIpv4AddressFreeFunc)(in_addr_t);
-    static bool isIpv4AddressFree(in_addr_t addr);
-    static int (*iptablesRestoreFunction)(IptablesTarget target, const std::string& commands);
-};
-
-}  // namespace net
-}  // namespace android
-
-#endif
diff --git a/server/ClatdControllerTest.cpp b/server/ClatdControllerTest.cpp
deleted file mode 100644
index d44e092d..00000000
--- a/server/ClatdControllerTest.cpp
+++ /dev/null
@@ -1,301 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * ClatdControllerTest.cpp - unit tests for ClatdController.cpp
- */
-
-#include <arpa/inet.h>
-#include <netinet/in.h>
-#include <string>
-
-#include <gtest/gtest.h>
-
-#include <android-base/stringprintf.h>
-#include <android-base/strings.h>
-#include <linux/if_packet.h>
-#include <netutils/ifc.h>
-
-extern "C" {
-#include <checksum.h>
-}
-
-#include "ClatdController.h"
-#include "IptablesBaseTest.h"
-#include "NetworkController.h"
-#include "tun_interface.h"
-
-static const char kIPv4LocalAddr[] = "192.0.0.4";
-
-namespace android {
-namespace net {
-
-using android::base::StringPrintf;
-using android::net::TunInterface;
-
-// Mock functions for isIpv4AddressFree.
-bool neverFree(in_addr_t /* addr */) {
-    return 0;
-}
-bool alwaysFree(in_addr_t /* addr */) {
-    return 1;
-}
-bool only2Free(in_addr_t addr) {
-    return (ntohl(addr) & 0xff) == 2;
-}
-bool over6Free(in_addr_t addr) {
-    return (ntohl(addr) & 0xff) >= 6;
-}
-bool only10Free(in_addr_t addr) {
-    return (ntohl(addr) & 0xff) == 10;
-}
-
-class ClatdControllerTest : public IptablesBaseTest {
-  public:
-    ClatdControllerTest() : mClatdCtrl(nullptr) {
-        ClatdController::iptablesRestoreFunction = fakeExecIptablesRestore;
-    }
-
-    void SetUp() { resetIpv4AddressFreeFunc(); }
-
-  protected:
-    ClatdController mClatdCtrl;
-    void setIpv4AddressFreeFunc(bool (*func)(in_addr_t)) {
-        ClatdController::isIpv4AddressFreeFunc = func;
-    }
-    void resetIpv4AddressFreeFunc() {
-        ClatdController::isIpv4AddressFreeFunc = ClatdController::isIpv4AddressFree;
-    }
-    in_addr_t selectIpv4Address(const in_addr a, int16_t b) {
-        return ClatdController::selectIpv4Address(a, b);
-    }
-    void makeChecksumNeutral(in6_addr* a, const in_addr b, const in6_addr& c) {
-        ClatdController::makeChecksumNeutral(a, b, c);
-    }
-    int detect_mtu(const struct in6_addr* a, uint32_t b, uint32_t c) {
-        return mClatdCtrl.detect_mtu(a, b, c);
-    }
-    int configure_tun_ip(const char* a, const char* b, int c) {
-        std::lock_guard guard(mClatdCtrl.mutex);
-        return mClatdCtrl.configure_tun_ip(a, b, c);
-    }
-    int configure_clat_ipv6_address(ClatdController::ClatdTracker* a,
-                                    ClatdController::tun_data* b) {
-        std::lock_guard guard(mClatdCtrl.mutex);
-        return mClatdCtrl.configure_clat_ipv6_address(a, b);
-    }
-};
-
-TEST_F(ClatdControllerTest, SelectIpv4Address) {
-    struct in_addr addr;
-
-    inet_pton(AF_INET, kIPv4LocalAddr, &addr);
-
-    // If no addresses are free, return INADDR_NONE.
-    setIpv4AddressFreeFunc(neverFree);
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 29));
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 16));
-
-    // If the configured address is free, pick that. But a prefix that's too big is invalid.
-    setIpv4AddressFreeFunc(alwaysFree);
-    EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 29));
-    EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 20));
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 15));
-
-    // A prefix length of 32 works, but anything above it is invalid.
-    EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 32));
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 33));
-
-    // If another address is free, pick it.
-    setIpv4AddressFreeFunc(over6Free);
-    EXPECT_EQ(inet_addr("192.0.0.6"), selectIpv4Address(addr, 29));
-
-    // Check that we wrap around to addresses that are lower than the first address.
-    setIpv4AddressFreeFunc(only2Free);
-    EXPECT_EQ(inet_addr("192.0.0.2"), selectIpv4Address(addr, 29));
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 30));
-
-    // If a free address exists outside the prefix, we don't pick it.
-    setIpv4AddressFreeFunc(only10Free);
-    EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 29));
-    EXPECT_EQ(inet_addr("192.0.0.10"), selectIpv4Address(addr, 24));
-
-    // Now try using the real function which sees if IP addresses are free using bind().
-    // Assume that the machine running the test has the address 127.0.0.1, but not 8.8.8.8.
-    resetIpv4AddressFreeFunc();
-    addr.s_addr = inet_addr("8.8.8.8");
-    EXPECT_EQ(inet_addr("8.8.8.8"), selectIpv4Address(addr, 29));
-
-    addr.s_addr = inet_addr("127.0.0.1");
-    EXPECT_EQ(inet_addr("127.0.0.2"), selectIpv4Address(addr, 29));
-}
-
-TEST_F(ClatdControllerTest, MakeChecksumNeutral) {
-    // We can't test generateIPv6Address here since it requires manipulating routing, which we can't
-    // do without talking to the real netd on the system.
-    uint32_t rand = arc4random_uniform(0xffffffff);
-    uint16_t rand1 = rand & 0xffff;
-    uint16_t rand2 = (rand >> 16) & 0xffff;
-    std::string v6PrefixStr = StringPrintf("2001:db8:%x:%x", rand1, rand2);
-    std::string v6InterfaceAddrStr = StringPrintf("%s::%x:%x", v6PrefixStr.c_str(), rand2, rand1);
-    std::string nat64PrefixStr = StringPrintf("2001:db8:%x:%x::", rand2, rand1);
-
-    in_addr v4 = {inet_addr(kIPv4LocalAddr)};
-    in6_addr v6InterfaceAddr;
-    ASSERT_TRUE(inet_pton(AF_INET6, v6InterfaceAddrStr.c_str(), &v6InterfaceAddr));
-    in6_addr nat64Prefix;
-    ASSERT_TRUE(inet_pton(AF_INET6, nat64PrefixStr.c_str(), &nat64Prefix));
-
-    // Generate a boatload of random IIDs.
-    int onebits = 0;
-    uint64_t prev_iid = 0;
-    for (int i = 0; i < 100000; i++) {
-        in6_addr v6 = v6InterfaceAddr;
-        makeChecksumNeutral(&v6, v4, nat64Prefix);
-
-        // Check the generated IP address is in the same prefix as the interface IPv6 address.
-        EXPECT_EQ(0, memcmp(&v6, &v6InterfaceAddr, 8));
-
-        // Check that consecutive IIDs are not the same.
-        uint64_t iid = *(uint64_t*)(&v6.s6_addr[8]);
-        ASSERT_TRUE(iid != prev_iid)
-                << "Two consecutive random IIDs are the same: " << std::showbase << std::hex << iid
-                << "\n";
-        prev_iid = iid;
-
-        // Check that the IID is checksum-neutral with the NAT64 prefix and the
-        // local prefix.
-        uint16_t c1 = ip_checksum_finish(ip_checksum_add(0, &v4, sizeof(v4)));
-        uint16_t c2 = ip_checksum_finish(ip_checksum_add(0, &nat64Prefix, sizeof(nat64Prefix)) +
-                                         ip_checksum_add(0, &v6, sizeof(v6)));
-
-        if (c1 != c2) {
-            char v6Str[INET6_ADDRSTRLEN];
-            inet_ntop(AF_INET6, &v6, v6Str, sizeof(v6Str));
-            FAIL() << "Bad IID: " << v6Str << " not checksum-neutral with " << kIPv4LocalAddr
-                   << " and " << nat64PrefixStr.c_str() << std::showbase << std::hex
-                   << "\n  IPv4 checksum: " << c1 << "\n  IPv6 checksum: " << c2 << "\n";
-        }
-
-        // Check that IIDs are roughly random and use all the bits by counting the
-        // total number of bits set to 1 in a random sample of 100000 generated IIDs.
-        onebits += __builtin_popcountll(*(uint64_t*)&iid);
-    }
-    EXPECT_LE(3190000, onebits);
-    EXPECT_GE(3210000, onebits);
-}
-
-TEST_F(ClatdControllerTest, DetectMtu) {
-    // ::1 with bottom 32 bits set to 1 is still ::1 which routes via lo with mtu of 64KiB
-    ASSERT_EQ(detect_mtu(&in6addr_loopback, htonl(1), 0 /*MARK_UNSET*/), 65536);
-}
-
-// Get the first IPv4 address for a given interface name
-in_addr* getinterface_ip(const char* interface) {
-    ifaddrs *ifaddr, *ifa;
-    in_addr* retval = nullptr;
-
-    if (getifaddrs(&ifaddr) == -1) return nullptr;
-
-    for (ifa = ifaddr; ifa != nullptr; ifa = ifa->ifa_next) {
-        if (ifa->ifa_addr == nullptr) continue;
-
-        if ((strcmp(ifa->ifa_name, interface) == 0) && (ifa->ifa_addr->sa_family == AF_INET)) {
-            retval = (in_addr*)malloc(sizeof(in_addr));
-            if (retval) {
-                const sockaddr_in* sin = reinterpret_cast<sockaddr_in*>(ifa->ifa_addr);
-                *retval = sin->sin_addr;
-            }
-            break;
-        }
-    }
-
-    freeifaddrs(ifaddr);
-    return retval;
-}
-
-TEST_F(ClatdControllerTest, ConfigureTunIpManual) {
-    // Create an interface for configure_tun_ip to configure and bring up.
-    TunInterface v4Iface;
-    ASSERT_EQ(0, v4Iface.init());
-
-    configure_tun_ip(v4Iface.name().c_str(), "192.0.2.1" /* v4Str */, 1472 /* mtu */);
-    in_addr* ip = getinterface_ip(v4Iface.name().c_str());
-    ASSERT_NE(nullptr, ip);
-    EXPECT_EQ(inet_addr("192.0.2.1"), ip->s_addr);
-    free(ip);
-
-    v4Iface.destroy();
-}
-
-ClatdController::tun_data makeTunData() {
-    // Create some fake but realistic-looking sockets so configure_clat_ipv6_address doesn't balk.
-    return {
-            .read_fd6 = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, htons(ETH_P_IPV6)),
-            .write_fd6 = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW),
-            .fd4 = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0),
-    };
-}
-
-void cleanupTunData(ClatdController::tun_data* tunnel) {
-    close(tunnel->write_fd6);
-    close(tunnel->read_fd6);
-    close(tunnel->fd4);
-}
-
-TEST_F(ClatdControllerTest, ConfigureIpv6Address) {
-    // Create an interface for configure_clat_ipv6_address to attach socket filter to.
-    TunInterface v6Iface;
-    ASSERT_EQ(0, v6Iface.init());
-    ClatdController::tun_data tunnel = makeTunData();
-
-    // Only initialize valid value to configure_clat_ipv6_address() required fields
-    // {ifIndex, v6, v6Str}. The uninitialized fields have initialized with invalid
-    // value just in case.
-    ClatdController::ClatdTracker tracker = {
-            .pid = -1,              // unused
-            .ifIndex = 0,           // initialize later
-            .iface = "",            // unused
-            .v4ifIndex = 0,         // unused
-            .v4iface = "",          // unused
-            .fwmark.intValue = 0,   // unused
-            .fwmarkString = "0x0",  // unused
-            .v4 = {},               // unused
-            .v4Str = "",            // unused
-            .v6 = {},               // initialize later
-            .v6Str = "",            // initialize later
-            .pfx96 = {},            // unused
-            .pfx96String = "",      // unused
-    };
-    tracker.ifIndex = static_cast<unsigned int>(v6Iface.ifindex());
-    const char* addrStr = "2001:db8::f00";
-    ASSERT_EQ(1, inet_pton(AF_INET6, addrStr, &tracker.v6));
-    strlcpy(tracker.v6Str, addrStr, sizeof(tracker.v6Str));
-
-    ASSERT_EQ(0, configure_clat_ipv6_address(&tracker, &tunnel));
-
-    // Check that the packet socket is bound to the interface. We can't check the socket filter
-    // because there is no way to fetch it from the kernel.
-    sockaddr_ll sll;
-    socklen_t len = sizeof(sll);
-    ASSERT_EQ(0, getsockname(tunnel.read_fd6, reinterpret_cast<sockaddr*>(&sll), &len));
-    EXPECT_EQ(htons(ETH_P_IPV6), sll.sll_protocol);
-    EXPECT_EQ(sll.sll_ifindex, v6Iface.ifindex());
-
-    v6Iface.destroy();
-    cleanupTunData(&tunnel);
-}
-
-}  // namespace net
-}  // namespace android
diff --git a/server/Controllers.cpp b/server/Controllers.cpp
index 62828346..0df6b0ee 100644
--- a/server/Controllers.cpp
+++ b/server/Controllers.cpp
@@ -191,8 +191,7 @@ void Controllers::createChildChains(IptablesTarget target, const char* table,
 }
 
 Controllers::Controllers()
-    : clatdCtrl(&netCtrl),
-      wakeupCtrl(
+    : wakeupCtrl(
               [this](const WakeupController::ReportArgs& args) {
                   const auto listener = eventReporter.getNetdEventListener();
                   if (listener == nullptr) {
@@ -278,9 +277,6 @@ void Controllers::init() {
     initIptablesRules();
     Stopwatch s;
 
-    clatdCtrl.init();
-    gLog.info("Initializing ClatdController: %" PRId64 "us", s.getTimeAndResetUs());
-
     bandwidthCtrl.enableBandwidthControl();
     gLog.info("Enabling bandwidth control: %" PRId64 "us", s.getTimeAndResetUs());
 
diff --git a/server/Controllers.h b/server/Controllers.h
index d1e3ea3d..8b51ddf1 100644
--- a/server/Controllers.h
+++ b/server/Controllers.h
@@ -18,7 +18,6 @@
 #define _CONTROLLERS_H__
 
 #include "BandwidthController.h"
-#include "ClatdController.h"
 #include "EventReporter.h"
 #include "FirewallController.h"
 #include "IdletimerController.h"
@@ -46,7 +45,6 @@ class Controllers {
     BandwidthController bandwidthCtrl;
     IdletimerController idletimerCtrl;
     FirewallController firewallCtrl;
-    ClatdController clatdCtrl;
     StrictController strictCtrl;
     EventReporter eventReporter;
     IptablesRestoreController iptablesRestoreCtrl;
diff --git a/server/NetdNativeService.cpp b/server/NetdNativeService.cpp
index 7264c319..466d8ba7 100644
--- a/server/NetdNativeService.cpp
+++ b/server/NetdNativeService.cpp
@@ -169,9 +169,6 @@ status_t NetdNativeService::dump(int fd, const Vector<String16> &args) {
     gCtls->xfrmCtrl.dump(dw);
     dw.blankline();
 
-    gCtls->clatdCtrl.dump(dw);
-    dw.blankline();
-
     gCtls->tetherCtrl.dump(dw);
     dw.blankline();
 
@@ -753,17 +750,20 @@ binder::Status NetdNativeService::strictUidCleartextPenalty(int32_t uid, int32_t
     return statusFromErrcode(res);
 }
 
-binder::Status NetdNativeService::clatdStart(const std::string& ifName,
-                                             const std::string& nat64Prefix, std::string* v6Addr) {
+// TODO: remark @deprecated in INetd.aidl.
+binder::Status NetdNativeService::clatdStart(const std::string& /* ifName */,
+                                             const std::string& /* nat64Prefix */,
+                                             std::string* /* v6Addr */) {
     ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK);
-    int res = gCtls->clatdCtrl.startClatd(ifName.c_str(), nat64Prefix, v6Addr);
-    return statusFromErrcode(res);
+    // deprecated
+    return binder::Status::fromExceptionCode(binder::Status::EX_UNSUPPORTED_OPERATION);
 }
 
-binder::Status NetdNativeService::clatdStop(const std::string& ifName) {
+// TODO: remark @deprecated in INetd.aidl.
+binder::Status NetdNativeService::clatdStop(const std::string& /* ifName */) {
     ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK);
-    int res = gCtls->clatdCtrl.stopClatd(ifName.c_str());
-    return statusFromErrcode(res);
+    // deprecated
+    return binder::Status::fromExceptionCode(binder::Status::EX_UNSUPPORTED_OPERATION);
 }
 
 binder::Status NetdNativeService::ipfwdEnabled(bool* status) {