From 10c98a6dd659b969dc374d21fb576774baa4d01d Mon Sep 17 00:00:00 2001 From: Hungming Chen Date: Fri, 22 Apr 2022 19:19:24 +0000 Subject: Remove ClatdController relevant stubs Since the clatd control plane has been moved to mainline ClatCoordinator, netd/ClatdController is not required anymore. 1. Delete ClatdController files ClatdController.cpp ClatdController.h ClatdControllerTest.cpp 2. Deprecate clatd binder calls NetdNativeService::clatdStart NetdNativeService::clatdStop New tests (some of them use java mock test) partial cover removed tests. We are going to have a clat integration test to cover more native behavior. Test changes: ClatdControllerTest::SelectIpv4Address -> ClatUtils::SelectIpv4Address ClatdControllerTest::MakeChecksumNeutral -> ClatUtils::MakeChecksumNeutral ClatdControllerTest::DetectMtu -> ClatUtils::DetectMtu ClatdControllerTest::ConfigureTunIpManual -> ClatCoordinatorTest::testStartStopClatd (only mock test) ClatdControllerTest::ConfigureIpv6Address -> ClatCoordinatorTest::testStartStopClatd (only mock test), ClatUtils::ConfigurePacketSocket New test path: packages/modules/Connectivity/service/native/libs/libclat/clatutils_test.cpp packages/modules/Connectivity/tests/unit/java/com/android/server/connectivity/ClatCoordinatorTest.java Bug: 212345928 Bug: 215655463 Test: cd system/netd; atest Original change: https://android-review.googlesource.com/c/platform/system/netd/+/2072829 Merged-In: Ie2c341f943f9f383f42d6333abb594997085e7a1 Change-Id: Ie2c341f943f9f383f42d6333abb594997085e7a1 Signed-off-by: Nucca Chen (cherry picked from commit bbdea2d15cf8e1f6ce3ff44d2b3459930be5c313) --- server/Android.bp | 2 - server/ClatdController.cpp | 925 ----------------------------------------- server/ClatdController.h | 123 ------ server/ClatdControllerTest.cpp | 301 -------------- server/Controllers.cpp | 6 +- server/Controllers.h | 2 - server/NetdNativeService.cpp | 20 +- 7 files changed, 11 insertions(+), 1368 deletions(-) delete mode 100644 server/ClatdController.cpp delete mode 100644 server/ClatdController.h delete mode 100644 server/ClatdControllerTest.cpp diff --git a/server/Android.bp b/server/Android.bp index be599dec..f29f6cfc 100644 --- a/server/Android.bp +++ b/server/Android.bp @@ -45,7 +45,6 @@ cc_library_static { header_libs: ["bpf_connectivity_headers"], srcs: [ "BandwidthController.cpp", - "ClatdController.cpp", "Controllers.cpp", "NetdConstants.cpp", "FirewallController.cpp", @@ -204,7 +203,6 @@ cc_test { ], srcs: [ "BandwidthControllerTest.cpp", - "ClatdControllerTest.cpp", "ControllersTest.cpp", "FirewallControllerTest.cpp", "IdletimerControllerTest.cpp", diff --git a/server/ClatdController.cpp b/server/ClatdController.cpp deleted file mode 100644 index bf51d9e0..00000000 --- a/server/ClatdController.cpp +++ /dev/null @@ -1,925 +0,0 @@ -/* - * Copyright (C) 2008 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define LOG_TAG "ClatdController" -#include - -#include "ClatdController.h" -#include "InterfaceController.h" - -#include -#include - -#include "android-base/properties.h" -#include "android-base/scopeguard.h" -#include "android-base/stringprintf.h" -#include "android-base/unique_fd.h" -#include "bpf/BpfMap.h" -#include "bpf_shared.h" -#include "netdutils/DumpWriter.h" - -extern "C" { -#include "checksum.h" -} - -#include "Fwmark.h" -#include "NetdConstants.h" -#include "NetworkController.h" -#include "TcUtils.h" -#include "netid_client.h" - -// Sync from external/android-clat/clatd.{c, h} -#define MAXMTU 65536 -#define PACKETLEN (MAXMTU + sizeof(struct tun_pi)) -/* 40 bytes IPv6 header - 20 bytes IPv4 header + 8 bytes fragment header */ -#define MTU_DELTA 28 - -static const char* kClatdPath = "/apex/com.android.tethering/bin/for-system/clatd"; - -// For historical reasons, start with 192.0.0.4, and after that, use all subsequent addresses in -// 192.0.0.0/29 (RFC 7335). -static const char* kV4AddrString = "192.0.0.4"; -static const in_addr kV4Addr = {inet_addr(kV4AddrString)}; -static const int kV4AddrLen = 29; - -using android::base::Result; -using android::base::unique_fd; -using android::bpf::BpfMap; -using android::netdutils::DumpWriter; -using android::netdutils::ScopedIndent; - -namespace android { -namespace net { - -void ClatdController::init(void) { - std::lock_guard guard(mutex); - - int rv = getClatEgress4MapFd(); - if (rv < 0) { - ALOGE("getClatEgress4MapFd() failure: %s", strerror(-rv)); - return; - } - mClatEgress4Map.reset(rv); - - rv = getClatIngress6MapFd(); - if (rv < 0) { - ALOGE("getClatIngress6MapFd() failure: %s", strerror(-rv)); - mClatEgress4Map.reset(-1); - return; - } - mClatIngress6Map.reset(rv); - - mClatEgress4Map.clear(); - mClatIngress6Map.clear(); -} - -bool ClatdController::isIpv4AddressFree(in_addr_t addr) { - int s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s == -1) { - return 0; - } - - // Attempt to connect to the address. If the connection succeeds and getsockname returns the - // same then the address is already assigned to the system and we can't use it. - struct sockaddr_in sin = { - .sin_family = AF_INET, - .sin_port = htons(53), - .sin_addr = {addr}, - }; - socklen_t len = sizeof(sin); - bool inuse = connect(s, (struct sockaddr*)&sin, sizeof(sin)) == 0 && - getsockname(s, (struct sockaddr*)&sin, &len) == 0 && (size_t)len >= sizeof(sin) && - sin.sin_addr.s_addr == addr; - - close(s); - return !inuse; -} - -// Picks a free IPv4 address, starting from ip and trying all addresses in the prefix in order. -// ip - the IP address from the configuration file -// prefixlen - the length of the prefix from which addresses may be selected. -// returns: the IPv4 address, or INADDR_NONE if no addresses were available -in_addr_t ClatdController::selectIpv4Address(const in_addr ip, int16_t prefixlen) { - // Don't accept prefixes that are too large because we scan addresses one by one. - if (prefixlen < 16 || prefixlen > 32) { - return INADDR_NONE; - } - - // All these are in host byte order. - in_addr_t mask = 0xffffffff >> (32 - prefixlen) << (32 - prefixlen); - in_addr_t ipv4 = ntohl(ip.s_addr); - in_addr_t first_ipv4 = ipv4; - in_addr_t prefix = ipv4 & mask; - - // Pick the first IPv4 address in the pool, wrapping around if necessary. - // So, for example, 192.0.0.4 -> 192.0.0.5 -> 192.0.0.6 -> 192.0.0.7 -> 192.0.0.0. - do { - if (isIpv4AddressFreeFunc(htonl(ipv4))) { - return htonl(ipv4); - } - ipv4 = prefix | ((ipv4 + 1) & ~mask); - } while (ipv4 != first_ipv4); - - return INADDR_NONE; -} - -// Alters the bits in the IPv6 address to make them checksum neutral with v4 and nat64Prefix. -void ClatdController::makeChecksumNeutral(in6_addr* v6, const in_addr v4, - const in6_addr& nat64Prefix) { - // Fill last 8 bytes of IPv6 address with random bits. - arc4random_buf(&v6->s6_addr[8], 8); - - // Make the IID checksum-neutral. That is, make it so that: - // checksum(Local IPv4 | Remote IPv4) = checksum(Local IPv6 | Remote IPv6) - // in other words (because remote IPv6 = NAT64 prefix | Remote IPv4): - // checksum(Local IPv4) = checksum(Local IPv6 | NAT64 prefix) - // Do this by adjusting the two bytes in the middle of the IID. - - uint16_t middlebytes = (v6->s6_addr[11] << 8) + v6->s6_addr[12]; - - uint32_t c1 = ip_checksum_add(0, &v4, sizeof(v4)); - uint32_t c2 = ip_checksum_add(0, &nat64Prefix, sizeof(nat64Prefix)) + - ip_checksum_add(0, v6, sizeof(*v6)); - - uint16_t delta = ip_checksum_adjust(middlebytes, c1, c2); - v6->s6_addr[11] = delta >> 8; - v6->s6_addr[12] = delta & 0xff; -} - -// Picks a random interface ID that is checksum neutral with the IPv4 address and the NAT64 prefix. -int ClatdController::generateIpv6Address(const char* iface, const in_addr v4, - const in6_addr& nat64Prefix, in6_addr* v6) { - unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0)); - if (s == -1) return -errno; - - if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1) == -1) { - return -errno; - } - - sockaddr_in6 sin6 = {.sin6_family = AF_INET6, .sin6_addr = nat64Prefix}; - if (connect(s, reinterpret_cast(&sin6), sizeof(sin6)) == -1) { - return -errno; - } - - socklen_t len = sizeof(sin6); - if (getsockname(s, reinterpret_cast(&sin6), &len) == -1) { - return -errno; - } - - *v6 = sin6.sin6_addr; - - if (IN6_IS_ADDR_UNSPECIFIED(v6) || IN6_IS_ADDR_LOOPBACK(v6) || IN6_IS_ADDR_LINKLOCAL(v6) || - IN6_IS_ADDR_SITELOCAL(v6) || IN6_IS_ADDR_ULA(v6)) { - return -ENETUNREACH; - } - - makeChecksumNeutral(v6, v4, nat64Prefix); - - return 0; -} - -void ClatdController::maybeStartBpf(const ClatdTracker& tracker) { - auto isEthernet = android::net::isEthernet(tracker.iface); - if (!isEthernet.ok()) { - ALOGE("isEthernet(%s[%d]) failure: %s", tracker.iface, tracker.ifIndex, - isEthernet.error().message().c_str()); - return; - } - - ClatEgress4Key txKey = { - .iif = tracker.v4ifIndex, - .local4 = tracker.v4, - }; - ClatEgress4Value txValue = { - .oif = tracker.ifIndex, - .local6 = tracker.v6, - .pfx96 = tracker.pfx96, - .oifIsEthernet = isEthernet.value(), - }; - - auto ret = mClatEgress4Map.writeValue(txKey, txValue, BPF_ANY); - if (!ret.ok()) { - ALOGE("mClatEgress4Map.writeValue failure: %s", strerror(ret.error().code())); - return; - } - - ClatIngress6Key rxKey = { - .iif = tracker.ifIndex, - .pfx96 = tracker.pfx96, - .local6 = tracker.v6, - }; - ClatIngress6Value rxValue = { - // TODO: move all the clat code to eBPF and remove the tun interface entirely. - .oif = tracker.v4ifIndex, - .local4 = tracker.v4, - }; - - ret = mClatIngress6Map.writeValue(rxKey, rxValue, BPF_ANY); - if (!ret.ok()) { - ALOGE("mClatIngress6Map.writeValue failure: %s", strerror(ret.error().code())); - ret = mClatEgress4Map.deleteValue(txKey); - if (!ret.ok()) - ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code())); - return; - } - - // We do tc setup *after* populating the maps, so scanning through them - // can always be used to tell us what needs cleanup. - - // Usually the clsact will be added in RouteController::addInterfaceToPhysicalNetwork. - // But clat is started before the v4- interface is added to the network. The clat startup have - // to add clsact of v4- tun interface first for adding bpf filter in maybeStartBpf. - // TODO: move "qdisc add clsact" of v4- tun interface out from ClatdController. - int rv = tcQdiscAddDevClsact(tracker.v4ifIndex); - if (rv) { - ALOGE("tcQdiscAddDevClsact(%d[%s]) failure: %s", tracker.v4ifIndex, tracker.v4iface, - strerror(-rv)); - ret = mClatEgress4Map.deleteValue(txKey); - if (!ret.ok()) - ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code())); - ret = mClatIngress6Map.deleteValue(rxKey); - if (!ret.ok()) - ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code())); - return; - } - - // This program will be attached to the v4-* interface which is a TUN and thus always rawip. - rv = tcFilterAddDevEgressClatIpv4(tracker.v4ifIndex, CLAT_EGRESS4_PROG_RAWIP_PATH); - if (rv) { - ALOGE("tcFilterAddDevEgressClatIpv4(%d[%s], RAWIP) failure: %s", tracker.v4ifIndex, - tracker.v4iface, strerror(-rv)); - - // The v4- interface clsact is not deleted for unwinding error because once it is created - // with interface addition, the lifetime is till interface deletion. Moreover, the clsact - // has no clat filter now. It should not break anything. - - ret = mClatEgress4Map.deleteValue(txKey); - if (!ret.ok()) - ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code())); - ret = mClatIngress6Map.deleteValue(rxKey); - if (!ret.ok()) - ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code())); - return; - } - - std::string rxProgPath = - isEthernet.value() ? CLAT_INGRESS6_PROG_ETHER_PATH : CLAT_INGRESS6_PROG_RAWIP_PATH; - rv = tcFilterAddDevIngressClatIpv6(tracker.ifIndex, rxProgPath); - if (rv) { - ALOGE("tcFilterAddDevIngressClatIpv6(%d[%s], %d) failure: %s", tracker.ifIndex, - tracker.iface, isEthernet.value(), strerror(-rv)); - rv = tcFilterDelDevEgressClatIpv4(tracker.v4ifIndex); - if (rv) { - ALOGE("tcFilterDelDevEgressClatIpv4(%d[%s]) failure: %s", tracker.v4ifIndex, - tracker.v4iface, strerror(-rv)); - } - - // The v4- interface clsact is not deleted. See the reason in the error unwinding code of - // the egress filter attaching of v4- tun interface. - - ret = mClatEgress4Map.deleteValue(txKey); - if (!ret.ok()) - ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code())); - ret = mClatIngress6Map.deleteValue(rxKey); - if (!ret.ok()) - ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code())); - return; - } - - // success -} - -void ClatdController::maybeStopBpf(const ClatdTracker& tracker) { - int rv = tcFilterDelDevIngressClatIpv6(tracker.ifIndex); - if (rv < 0) { - ALOGE("tcFilterDelDevIngressClatIpv6(%d[%s]) failure: %s", tracker.ifIndex, tracker.iface, - strerror(-rv)); - } - - rv = tcFilterDelDevEgressClatIpv4(tracker.v4ifIndex); - if (rv < 0) { - ALOGE("tcFilterDelDevEgressClatIpv4(%d[%s]) failure: %s", tracker.v4ifIndex, - tracker.v4iface, strerror(-rv)); - } - - // We cleanup the maps last, so scanning through them can be used to - // determine what still needs cleanup. - - ClatEgress4Key txKey = { - .iif = tracker.v4ifIndex, - .local4 = tracker.v4, - }; - - auto ret = mClatEgress4Map.deleteValue(txKey); - if (!ret.ok()) ALOGE("mClatEgress4Map.deleteValue failure: %s", strerror(ret.error().code())); - - ClatIngress6Key rxKey = { - .iif = tracker.ifIndex, - .pfx96 = tracker.pfx96, - .local6 = tracker.v6, - }; - - ret = mClatIngress6Map.deleteValue(rxKey); - if (!ret.ok()) ALOGE("mClatIngress6Map.deleteValue failure: %s", strerror(ret.error().code())); -} - -// Finds the tracker of the clatd running on interface |interface|, or nullptr if clatd has not been -// started on |interface|. -ClatdController::ClatdTracker* ClatdController::getClatdTracker(const std::string& interface) { - auto it = mClatdTrackers.find(interface); - return (it == mClatdTrackers.end() ? nullptr : &it->second); -} - -// Initializes a ClatdTracker for the specified interface. -int ClatdController::ClatdTracker::init(unsigned networkId, const std::string& interface, - const std::string& v4interface, - const std::string& nat64Prefix) { - fwmark.netId = networkId; - fwmark.explicitlySelected = true; - fwmark.protectedFromVpn = true; - fwmark.permission = PERMISSION_SYSTEM; - - snprintf(fwmarkString, sizeof(fwmarkString), "0x%x", fwmark.intValue); - strlcpy(iface, interface.c_str(), sizeof(iface)); - ifIndex = if_nametoindex(iface); - strlcpy(v4iface, v4interface.c_str(), sizeof(v4iface)); - v4ifIndex = if_nametoindex(v4iface); - - // Pass in everything that clatd needs: interface, a fwmark for outgoing packets, the NAT64 - // prefix, and the IPv4 and IPv6 addresses. - // Validate the prefix and strip off the prefix length. - uint8_t family; - uint8_t prefixLen; - int res = parsePrefix(nat64Prefix.c_str(), &family, &pfx96, sizeof(pfx96), &prefixLen); - // clatd only supports /96 prefixes. - if (res != sizeof(pfx96)) return res; - if (family != AF_INET6) return -EAFNOSUPPORT; - if (prefixLen != 96) return -EINVAL; - if (!inet_ntop(AF_INET6, &pfx96, pfx96String, sizeof(pfx96String))) return -errno; - - // Pick an IPv4 address. - // TODO: this picks the address based on other addresses that are assigned to interfaces, but - // the address is only actually assigned to an interface once clatd starts up. So we could end - // up with two clatd instances with the same IPv4 address. - // Stop doing this and instead pick a free one from the kV4Addr pool. - v4 = {selectIpv4Address(kV4Addr, kV4AddrLen)}; - if (v4.s_addr == INADDR_NONE) { - ALOGE("No free IPv4 address in %s/%d", kV4AddrString, kV4AddrLen); - return -EADDRNOTAVAIL; - } - if (!inet_ntop(AF_INET, &v4, v4Str, sizeof(v4Str))) return -errno; - - // Generate a checksum-neutral IID. - if (generateIpv6Address(iface, v4, pfx96, &v6)) { - ALOGE("Unable to find global source address on %s for %s", iface, pfx96String); - return -EADDRNOTAVAIL; - } - if (!inet_ntop(AF_INET6, &v6, v6Str, sizeof(v6Str))) return -errno; - - ALOGD("starting clatd on %s v4=%s v6=%s pfx96=%s", iface, v4Str, v6Str, pfx96String); - return 0; -} - -/* function: configure_tun_ip - * configures the ipv4 address on the tunnel interface - * v4iface - tunnel interface name - * v4Str - tunnel ipv4 address - * mtu - mtu of tun device - * returns: 0 on success, -errno on failure - */ -int ClatdController::configure_tun_ip(const char* v4iface, const char* v4Str, int mtu) { - ALOGI("Using IPv4 address %s on %s", v4Str, v4iface); - - // Configure the interface before bringing it up. As soon as we bring the interface up, the - // framework will be notified and will assume the interface's configuration has been finalized. - std::string mtuStr = std::to_string(mtu); - if (int res = InterfaceController::setMtu(v4iface, mtuStr.c_str())) { - ALOGE("setMtu %s failed (%s)", v4iface, strerror(-res)); - return res; - } - - InterfaceConfigurationParcel ifConfig; - ifConfig.ifName = std::string(v4iface); - ifConfig.ipv4Addr = std::string(v4Str); - ifConfig.prefixLength = 32; - ifConfig.hwAddr = std::string(""); - ifConfig.flags = std::vector{std::string(String8(INetd::IF_STATE_UP().string()))}; - const auto& status = InterfaceController::setCfg(ifConfig); - if (!status.ok()) { - ALOGE("configure_tun_ip/setCfg failed: %s", strerror(status.code())); - return -status.code(); - } - - return 0; -} - -/* function: add_anycast_address - * adds an anycast IPv6 address to an interface, returns 0 on success and <0 on failure - * sock - the socket to add the address to - * addr - the IP address to add - * ifindex - index of interface to add the address to - * returns: 0 on success, -errno on failure - */ -int ClatdController::add_anycast_address(int sock, struct in6_addr* addr, int ifindex) { - struct ipv6_mreq mreq = {*addr, ifindex}; - int ret = setsockopt(sock, SOL_IPV6, IPV6_JOIN_ANYCAST, &mreq, sizeof(mreq)); - if (ret) { - ret = errno; - ALOGE("setsockopt(IPV6_JOIN_ANYCAST): %s", strerror(errno)); - return -ret; - } - - return 0; -} - -/* function: configure_packet_socket - * Binds the packet socket and attaches the receive filter to it. - * sock - the socket to configure - * addr - the IP address to filter - * ifindex - index of interface to add the filter to - * returns: 0 on success, -errno on failure - */ -int ClatdController::configure_packet_socket(int sock, in6_addr* addr, int ifindex) { - uint32_t* ipv6 = addr->s6_addr32; - - // clang-format off - struct sock_filter filter_code[] = { - // Load the first four bytes of the IPv6 destination address (starts 24 bytes in). - // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads - // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it - // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other - // three words of the IPv6 address, and if they all match, return PACKETLEN (accept packet). - BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 24), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[0]), 0, 7), - BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 28), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[1]), 0, 5), - BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 32), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[2]), 0, 3), - BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 36), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, htonl(ipv6[3]), 0, 1), - BPF_STMT(BPF_RET | BPF_K, PACKETLEN), - BPF_STMT(BPF_RET | BPF_K, 0), - }; - // clang-format on - struct sock_fprog filter = {sizeof(filter_code) / sizeof(filter_code[0]), filter_code}; - - if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) { - int res = errno; - ALOGE("attach packet filter failed: %s", strerror(errno)); - return -res; - } - - struct sockaddr_ll sll = { - .sll_family = AF_PACKET, - .sll_protocol = htons(ETH_P_IPV6), - .sll_ifindex = ifindex, - .sll_pkttype = - PACKET_OTHERHOST, // The 464xlat IPv6 address is not assigned to the kernel. - }; - if (bind(sock, (struct sockaddr*)&sll, sizeof(sll))) { - int res = errno; - ALOGE("binding packet socket: %s", strerror(errno)); - return -res; - } - - return 0; -} - -/* function: configure_clat_ipv6_address - * picks the clat IPv6 address and configures packet translation to use it. - * tunnel - tun device data - * interface - uplink interface name - * returns: 0 on success, -errno on failure - */ -int ClatdController::configure_clat_ipv6_address(struct ClatdTracker* tracker, - struct tun_data* tunnel) { - ALOGI("Using IPv6 address %s on %s", tracker->v6Str, tracker->iface); - - // Start translating packets to the new prefix. - // TODO: return if error. b/212679140 needs to be fixed first. - add_anycast_address(tunnel->write_fd6, &tracker->v6, tracker->ifIndex); - - // Update our packet socket filter to reflect the new 464xlat IP address. - if (int res = configure_packet_socket(tunnel->read_fd6, &tracker->v6, tracker->ifIndex)) { - // Things aren't going to work. Bail out and hope we have better luck next time. - // We don't log an error here because configure_packet_socket has already done so. - return res; - } - - return 0; -} - -/* function: detect mtu - * returns: mtu on success, -errno on failure - */ -int ClatdController::detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix, - uint32_t mark) { - // Create an IPv6 UDP socket. - unique_fd s(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0)); - if (s < 0) { - int ret = errno; - ALOGE("socket(AF_INET6, SOCK_DGRAM, 0) failed: %s", strerror(errno)); - return -ret; - } - - // Socket's mark affects routing decisions (network selection) - if ((mark != MARK_UNSET) && setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) { - int ret = errno; - ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(errno)); - return -ret; - } - - // Try to connect udp socket to plat_subnet(96 bits):plat_suffix(32 bits) - struct sockaddr_in6 dst = { - .sin6_family = AF_INET6, - .sin6_addr = *plat_subnet, - }; - dst.sin6_addr.s6_addr32[3] = plat_suffix; - if (connect(s, (struct sockaddr*)&dst, sizeof(dst))) { - int ret = errno; - ALOGE("connect() failed: %s", strerror(errno)); - return -ret; - } - - // Fetch the socket's IPv6 mtu - this is effectively fetching mtu from routing table - int mtu; - socklen_t sz_mtu = sizeof(mtu); - if (getsockopt(s, SOL_IPV6, IPV6_MTU, &mtu, &sz_mtu)) { - int ret = errno; - ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) failed: %s", strerror(errno)); - return -ret; - } - if (sz_mtu != sizeof(mtu)) { - ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) returned unexpected size: %d", sz_mtu); - return -EFAULT; - } - - return mtu; -} - -/* function: configure_interface - * reads the configuration and applies it to the interface - * tracker - clat tracker - * tunnel - tun device data - * returns: 0 on success, -errno on failure - */ -int ClatdController::configure_interface(struct ClatdTracker* tracker, struct tun_data* tunnel) { - int res = detect_mtu(&tracker->pfx96, htonl(0x08080808), tracker->fwmark.intValue); - if (res < 0) return -res; - - int mtu = res; - // clamp to minimum ipv6 mtu - this probably cannot ever trigger - if (mtu < 1280) mtu = 1280; - // clamp to buffer size - if (mtu > MAXMTU) mtu = MAXMTU; - // decrease by ipv6(40) + ipv6 fragmentation header(8) vs ipv4(20) overhead of 28 bytes - mtu -= MTU_DELTA; - ALOGI("ipv4 mtu is %d", mtu); - - if (int ret = configure_tun_ip(tracker->v4iface, tracker->v4Str, mtu)) return ret; - if (int ret = configure_clat_ipv6_address(tracker, tunnel)) return ret; - - return 0; -} - -int ClatdController::startClatd(const std::string& interface, const std::string& nat64Prefix, - std::string* v6Str) { - std::lock_guard guard(mutex); - - // 1. fail if pre-existing tracker already exists - ClatdTracker* existing = getClatdTracker(interface); - if (existing != nullptr) { - ALOGE("clatd pid=%d already started on %s", existing->pid, interface.c_str()); - return -EBUSY; - } - - // 2. get network id associated with this external interface - unsigned networkId = mNetCtrl->getNetworkForInterface(interface.c_str()); - if (networkId == NETID_UNSET) { - ALOGE("Interface %s not assigned to any netId", interface.c_str()); - return -ENODEV; - } - - // 3. open the tun device in non blocking mode as required by clatd - int res = open("/dev/net/tun", O_RDWR | O_NONBLOCK | O_CLOEXEC); - if (res == -1) { - res = errno; - ALOGE("open of tun device failed (%s)", strerror(res)); - return -res; - } - unique_fd tmpTunFd(res); - - // 4. create the v4-... tun interface - std::string v4interface("v4-"); - v4interface += interface; - - struct ifreq ifr = { - .ifr_flags = IFF_TUN, - }; - strlcpy(ifr.ifr_name, v4interface.c_str(), sizeof(ifr.ifr_name)); - - res = ioctl(tmpTunFd, TUNSETIFF, &ifr, sizeof(ifr)); - if (res == -1) { - res = errno; - ALOGE("ioctl(TUNSETIFF) failed (%s)", strerror(res)); - return -res; - } - - // disable IPv6 on it - failing to do so is not a critical error - res = InterfaceController::setEnableIPv6(v4interface.c_str(), 0); - if (res) ALOGE("setEnableIPv6 %s failed (%s)", v4interface.c_str(), strerror(res)); - - // 5. initialize tracker object - ClatdTracker tracker; - int ret = tracker.init(networkId, interface, v4interface, nat64Prefix); - if (ret) return ret; - - // 6. create a throwaway socket to reserve a file descriptor number - res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (res == -1) { - res = errno; - ALOGE("socket(ipv6/udp) failed (%s)", strerror(res)); - return -res; - } - unique_fd passedTunFd(res); - - // 7. this is the FD we'll pass to clatd on the cli, so need it as a string - char passedTunFdStr[INT32_STRLEN]; - snprintf(passedTunFdStr, sizeof(passedTunFdStr), "%d", passedTunFd.get()); - - // 8. create a raw socket for clatd sending packets to the tunnel - res = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW); - if (res < 0) { - res = errno; - ALOGE("raw socket failed: %s", strerror(errno)); - return -res; - } - unique_fd tmpRawSock(res); - - const int mark = tracker.fwmark.intValue; - if (mark != MARK_UNSET && - setsockopt(tmpRawSock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) { - res = errno; - ALOGE("could not set mark on raw socket: %s", strerror(errno)); - return -res; - } - - // create a throwaway socket to reserve a file descriptor number - res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (res == -1) { - res = errno; - ALOGE("socket(ipv6/udp) failed (%s) for raw socket", strerror(res)); - return -res; - } - unique_fd passedRawSock(res); - - // this is the raw socket FD we'll pass to clatd on the cli, so need it as a string - char passedRawSockStr[INT32_STRLEN]; - snprintf(passedRawSockStr, sizeof(passedRawSockStr), "%d", passedRawSock.get()); - - // 9. create a packet socket for clatd sending packets to the tunnel - // Will eventually be bound to htons(ETH_P_IPV6) protocol, - // but only after appropriate bpf filter is attached. - res = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (res < 0) { - res = errno; - ALOGE("packet socket failed: %s", strerror(errno)); - return -res; - } - unique_fd tmpPacketSock(res); - - // create a throwaway socket to reserve a file descriptor number - res = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (res == -1) { - res = errno; - ALOGE("socket(ipv6/udp) failed (%s) for packet socket", strerror(res)); - return -res; - } - unique_fd passedPacketSock(res); - - // this is the packet socket FD we'll pass to clatd on the cli, so need it as a string - char passedPacketSockStr[INT32_STRLEN]; - snprintf(passedPacketSockStr, sizeof(passedPacketSock), "%d", passedPacketSock.get()); - - // 10. configure tun and clat interface - struct tun_data tunnel = {.fd4 = tmpTunFd, .read_fd6 = tmpPacketSock, .write_fd6 = tmpRawSock}; - res = configure_interface(&tracker, &tunnel); - if (res) { - ALOGE("configure interface failed: %s", strerror(res)); - return -res; - } - - // 11. we're going to use this as argv[0] to clatd to make ps output more useful - std::string progname("clatd-"); - progname += tracker.iface; - - // clang-format off - const char* args[] = {progname.c_str(), - "-i", tracker.iface, - "-p", tracker.pfx96String, - "-4", tracker.v4Str, - "-6", tracker.v6Str, - "-t", passedTunFdStr, - "-r", passedPacketSockStr, - "-w", passedRawSockStr, - nullptr}; - // clang-format on - - // 12. register vfork requirement - posix_spawnattr_t attr; - res = posix_spawnattr_init(&attr); - if (res) { - ALOGE("posix_spawnattr_init failed (%s)", strerror(res)); - return -res; - } - const android::base::ScopeGuard attrGuard = [&] { posix_spawnattr_destroy(&attr); }; - res = posix_spawnattr_setflags(&attr, POSIX_SPAWN_USEVFORK); - if (res) { - ALOGE("posix_spawnattr_setflags failed (%s)", strerror(res)); - return -res; - } - - // 13. register dup2() action: this is what 'clears' the CLOEXEC flag - // on the tun fd that we want the child clatd process to inherit - // (this will happen after the vfork, and before the execve) - posix_spawn_file_actions_t fa; - res = posix_spawn_file_actions_init(&fa); - if (res) { - ALOGE("posix_spawn_file_actions_init failed (%s)", strerror(res)); - return -res; - } - const android::base::ScopeGuard faGuard = [&] { posix_spawn_file_actions_destroy(&fa); }; - res = posix_spawn_file_actions_adddup2(&fa, tmpTunFd, passedTunFd); - if (res) { - ALOGE("posix_spawn_file_actions_adddup2 tun fd failed (%s)", strerror(res)); - return -res; - } - res = posix_spawn_file_actions_adddup2(&fa, tmpPacketSock, passedPacketSock); - if (res) { - ALOGE("posix_spawn_file_actions_adddup2 packet socket failed (%s)", strerror(res)); - return -res; - } - res = posix_spawn_file_actions_adddup2(&fa, tmpRawSock, passedRawSock); - if (res) { - ALOGE("posix_spawn_file_actions_adddup2 raw socket failed (%s)", strerror(res)); - return -res; - } - - // 14. actually perform vfork/dup2/execve - res = posix_spawn(&tracker.pid, kClatdPath, &fa, &attr, (char* const*)args, nullptr); - if (res) { - ALOGE("posix_spawn failed (%s)", strerror(res)); - return -res; - } - - // 15. configure eBPF offload - if possible - maybeStartBpf(tracker); - - mClatdTrackers[interface] = tracker; - ALOGD("clatd started on %s", interface.c_str()); - - *v6Str = tracker.v6Str; - return 0; -} - -int ClatdController::stopClatd(const std::string& interface) { - std::lock_guard guard(mutex); - ClatdTracker* tracker = getClatdTracker(interface); - - if (tracker == nullptr) { - ALOGE("clatd already stopped"); - return -ENODEV; - } - - ALOGD("Stopping clatd pid=%d on %s", tracker->pid, interface.c_str()); - - maybeStopBpf(*tracker); - - ::stopProcess(tracker->pid, "clatd"); - - mClatdTrackers.erase(interface); - - ALOGD("clatd on %s stopped", interface.c_str()); - - return 0; -} - -void ClatdController::dumpEgress(DumpWriter& dw) { - if (!mClatEgress4Map.isValid()) return; // if unsupported just don't dump anything - - ScopedIndent bpfIndent(dw); - dw.println("BPF egress map: iif(iface) v4Addr -> v6Addr nat64Prefix oif(iface)"); - - ScopedIndent bpfDetailIndent(dw); - const auto printClatMap = [&dw](const ClatEgress4Key& key, const ClatEgress4Value& value, - const BpfMap&) { - char iifStr[IFNAMSIZ] = "?"; - char local4Str[INET_ADDRSTRLEN] = "?"; - char local6Str[INET6_ADDRSTRLEN] = "?"; - char pfx96Str[INET6_ADDRSTRLEN] = "?"; - char oifStr[IFNAMSIZ] = "?"; - - if_indextoname(key.iif, iifStr); - inet_ntop(AF_INET, &key.local4, local4Str, sizeof(local4Str)); - inet_ntop(AF_INET6, &value.local6, local6Str, sizeof(local6Str)); - inet_ntop(AF_INET6, &value.pfx96, pfx96Str, sizeof(pfx96Str)); - if_indextoname(value.oif, oifStr); - - dw.println("%u(%s) %s -> %s %s/96 %u(%s) %s", key.iif, iifStr, local4Str, local6Str, - pfx96Str, value.oif, oifStr, value.oifIsEthernet ? "ether" : "rawip"); - return Result(); - }; - auto res = mClatEgress4Map.iterateWithValue(printClatMap); - if (!res.ok()) { - dw.println("Error printing BPF map: %s", res.error().message().c_str()); - } -} - -void ClatdController::dumpIngress(DumpWriter& dw) { - if (!mClatIngress6Map.isValid()) return; // if unsupported just don't dump anything - - ScopedIndent bpfIndent(dw); - dw.println("BPF ingress map: iif(iface) nat64Prefix v6Addr -> v4Addr oif(iface)"); - - ScopedIndent bpfDetailIndent(dw); - const auto printClatMap = [&dw](const ClatIngress6Key& key, const ClatIngress6Value& value, - const BpfMap&) { - char iifStr[IFNAMSIZ] = "?"; - char pfx96Str[INET6_ADDRSTRLEN] = "?"; - char local6Str[INET6_ADDRSTRLEN] = "?"; - char local4Str[INET_ADDRSTRLEN] = "?"; - char oifStr[IFNAMSIZ] = "?"; - - if_indextoname(key.iif, iifStr); - inet_ntop(AF_INET6, &key.pfx96, pfx96Str, sizeof(pfx96Str)); - inet_ntop(AF_INET6, &key.local6, local6Str, sizeof(local6Str)); - inet_ntop(AF_INET, &value.local4, local4Str, sizeof(local4Str)); - if_indextoname(value.oif, oifStr); - - dw.println("%u(%s) %s/96 %s -> %s %u(%s)", key.iif, iifStr, pfx96Str, local6Str, local4Str, - value.oif, oifStr); - return Result(); - }; - auto res = mClatIngress6Map.iterateWithValue(printClatMap); - if (!res.ok()) { - dw.println("Error printing BPF map: %s", res.error().message().c_str()); - } -} - -void ClatdController::dumpTrackers(DumpWriter& dw) { - ScopedIndent trackerIndent(dw); - dw.println("Trackers: iif[iface] nat64Prefix v6Addr -> v4Addr v4iif[v4iface] [fwmark]"); - - ScopedIndent trackerDetailIndent(dw); - for (const auto& pair : mClatdTrackers) { - const ClatdTracker& tracker = pair.second; - dw.println("%u[%s] %s/96 %s -> %s %u[%s] [%s]", tracker.ifIndex, tracker.iface, - tracker.pfx96String, tracker.v6Str, tracker.v4Str, tracker.v4ifIndex, - tracker.v4iface, tracker.fwmarkString); - } -} - -void ClatdController::dump(DumpWriter& dw) { - std::lock_guard guard(mutex); - - ScopedIndent clatdIndent(dw); - dw.println("ClatdController"); - - dumpTrackers(dw); - dumpIngress(dw); - dumpEgress(dw); -} - -auto ClatdController::isIpv4AddressFreeFunc = isIpv4AddressFree; -auto ClatdController::iptablesRestoreFunction = execIptablesRestore; - -} // namespace net -} // namespace android diff --git a/server/ClatdController.h b/server/ClatdController.h deleted file mode 100644 index 74690ff4..00000000 --- a/server/ClatdController.h +++ /dev/null @@ -1,123 +0,0 @@ -/* - * Copyright (C) 2008 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#ifndef _CLATD_CONTROLLER_H -#define _CLATD_CONTROLLER_H - -#include -#include -#include - -#include -#include - -#include - -#include "Fwmark.h" -#include "NetdConstants.h" -#include "bpf/BpfMap.h" -#include "bpf_shared.h" -#include "netdutils/DumpWriter.h" - -namespace android { -namespace net { - -class NetworkController; - -class ClatdController { - public: - explicit ClatdController(NetworkController* controller) EXCLUDES(mutex) - : mNetCtrl(controller){}; - virtual ~ClatdController() EXCLUDES(mutex){}; - - /* First thing init/startClatd/stopClatd/dump do is grab the mutex. */ - void init(void) EXCLUDES(mutex); - - int startClatd(const std::string& interface, const std::string& nat64Prefix, - std::string* v6Addr) EXCLUDES(mutex); - int stopClatd(const std::string& interface) EXCLUDES(mutex); - - void dump(netdutils::DumpWriter& dw) EXCLUDES(mutex); - - // Public struct ClatdTracker and tun_data for testing. gtest/TEST_F macro changes the class - // name. In TEST_F(ClatdControllerTest..), can't access struct ClatdTracker and tun_data. - // TODO: probably use gtest/FRIEND_TEST macro. - struct ClatdTracker { - pid_t pid = -1; - unsigned ifIndex; - char iface[IFNAMSIZ]; - unsigned v4ifIndex; - char v4iface[IFNAMSIZ]; - Fwmark fwmark; - char fwmarkString[UINT32_STRLEN]; - in_addr v4; - char v4Str[INET_ADDRSTRLEN]; - in6_addr v6; - char v6Str[INET6_ADDRSTRLEN]; - in6_addr pfx96; - char pfx96String[INET6_ADDRSTRLEN]; - - int init(unsigned networkId, const std::string& interface, const std::string& v4interface, - const std::string& nat64Prefix); - }; - - // Public for testing. See above reason in struct ClatdTracker. - struct tun_data { - int read_fd6, write_fd6, fd4; - }; - - private: - std::mutex mutex; - - const NetworkController* mNetCtrl GUARDED_BY(mutex); - std::map mClatdTrackers GUARDED_BY(mutex); - ClatdTracker* getClatdTracker(const std::string& interface) REQUIRES(mutex); - - void dumpEgress(netdutils::DumpWriter& dw) REQUIRES(mutex); - void dumpIngress(netdutils::DumpWriter& dw) REQUIRES(mutex); - void dumpTrackers(netdutils::DumpWriter& dw) REQUIRES(mutex); - - static in_addr_t selectIpv4Address(const in_addr ip, int16_t prefixlen); - static int generateIpv6Address(const char* iface, const in_addr v4, const in6_addr& nat64Prefix, - in6_addr* v6); - static void makeChecksumNeutral(in6_addr* v6, const in_addr v4, const in6_addr& nat64Prefix); - - bpf::BpfMap mClatEgress4Map GUARDED_BY(mutex); - bpf::BpfMap mClatIngress6Map GUARDED_BY(mutex); - - void maybeStartBpf(const ClatdTracker& tracker) REQUIRES(mutex); - void maybeStopBpf(const ClatdTracker& tracker) REQUIRES(mutex); - - int detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix, uint32_t mark); - int configure_interface(struct ClatdTracker* tracker, struct tun_data* tunnel) REQUIRES(mutex); - int configure_tun_ip(const char* v4iface, const char* v4Str, int mtu) REQUIRES(mutex); - int configure_clat_ipv6_address(struct ClatdTracker* tracker, struct tun_data* tunnel) - REQUIRES(mutex); - int add_anycast_address(int sock, struct in6_addr* addr, int ifindex) REQUIRES(mutex); - int configure_packet_socket(int sock, in6_addr* addr, int ifindex) REQUIRES(mutex); - - // For testing. - friend class ClatdControllerTest; - - static bool (*isIpv4AddressFreeFunc)(in_addr_t); - static bool isIpv4AddressFree(in_addr_t addr); - static int (*iptablesRestoreFunction)(IptablesTarget target, const std::string& commands); -}; - -} // namespace net -} // namespace android - -#endif diff --git a/server/ClatdControllerTest.cpp b/server/ClatdControllerTest.cpp deleted file mode 100644 index d44e092d..00000000 --- a/server/ClatdControllerTest.cpp +++ /dev/null @@ -1,301 +0,0 @@ -/* - * Copyright 2018 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * ClatdControllerTest.cpp - unit tests for ClatdController.cpp - */ - -#include -#include -#include - -#include - -#include -#include -#include -#include - -extern "C" { -#include -} - -#include "ClatdController.h" -#include "IptablesBaseTest.h" -#include "NetworkController.h" -#include "tun_interface.h" - -static const char kIPv4LocalAddr[] = "192.0.0.4"; - -namespace android { -namespace net { - -using android::base::StringPrintf; -using android::net::TunInterface; - -// Mock functions for isIpv4AddressFree. -bool neverFree(in_addr_t /* addr */) { - return 0; -} -bool alwaysFree(in_addr_t /* addr */) { - return 1; -} -bool only2Free(in_addr_t addr) { - return (ntohl(addr) & 0xff) == 2; -} -bool over6Free(in_addr_t addr) { - return (ntohl(addr) & 0xff) >= 6; -} -bool only10Free(in_addr_t addr) { - return (ntohl(addr) & 0xff) == 10; -} - -class ClatdControllerTest : public IptablesBaseTest { - public: - ClatdControllerTest() : mClatdCtrl(nullptr) { - ClatdController::iptablesRestoreFunction = fakeExecIptablesRestore; - } - - void SetUp() { resetIpv4AddressFreeFunc(); } - - protected: - ClatdController mClatdCtrl; - void setIpv4AddressFreeFunc(bool (*func)(in_addr_t)) { - ClatdController::isIpv4AddressFreeFunc = func; - } - void resetIpv4AddressFreeFunc() { - ClatdController::isIpv4AddressFreeFunc = ClatdController::isIpv4AddressFree; - } - in_addr_t selectIpv4Address(const in_addr a, int16_t b) { - return ClatdController::selectIpv4Address(a, b); - } - void makeChecksumNeutral(in6_addr* a, const in_addr b, const in6_addr& c) { - ClatdController::makeChecksumNeutral(a, b, c); - } - int detect_mtu(const struct in6_addr* a, uint32_t b, uint32_t c) { - return mClatdCtrl.detect_mtu(a, b, c); - } - int configure_tun_ip(const char* a, const char* b, int c) { - std::lock_guard guard(mClatdCtrl.mutex); - return mClatdCtrl.configure_tun_ip(a, b, c); - } - int configure_clat_ipv6_address(ClatdController::ClatdTracker* a, - ClatdController::tun_data* b) { - std::lock_guard guard(mClatdCtrl.mutex); - return mClatdCtrl.configure_clat_ipv6_address(a, b); - } -}; - -TEST_F(ClatdControllerTest, SelectIpv4Address) { - struct in_addr addr; - - inet_pton(AF_INET, kIPv4LocalAddr, &addr); - - // If no addresses are free, return INADDR_NONE. - setIpv4AddressFreeFunc(neverFree); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 29)); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 16)); - - // If the configured address is free, pick that. But a prefix that's too big is invalid. - setIpv4AddressFreeFunc(alwaysFree); - EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 29)); - EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 20)); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 15)); - - // A prefix length of 32 works, but anything above it is invalid. - EXPECT_EQ(inet_addr(kIPv4LocalAddr), selectIpv4Address(addr, 32)); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 33)); - - // If another address is free, pick it. - setIpv4AddressFreeFunc(over6Free); - EXPECT_EQ(inet_addr("192.0.0.6"), selectIpv4Address(addr, 29)); - - // Check that we wrap around to addresses that are lower than the first address. - setIpv4AddressFreeFunc(only2Free); - EXPECT_EQ(inet_addr("192.0.0.2"), selectIpv4Address(addr, 29)); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 30)); - - // If a free address exists outside the prefix, we don't pick it. - setIpv4AddressFreeFunc(only10Free); - EXPECT_EQ(INADDR_NONE, selectIpv4Address(addr, 29)); - EXPECT_EQ(inet_addr("192.0.0.10"), selectIpv4Address(addr, 24)); - - // Now try using the real function which sees if IP addresses are free using bind(). - // Assume that the machine running the test has the address 127.0.0.1, but not 8.8.8.8. - resetIpv4AddressFreeFunc(); - addr.s_addr = inet_addr("8.8.8.8"); - EXPECT_EQ(inet_addr("8.8.8.8"), selectIpv4Address(addr, 29)); - - addr.s_addr = inet_addr("127.0.0.1"); - EXPECT_EQ(inet_addr("127.0.0.2"), selectIpv4Address(addr, 29)); -} - -TEST_F(ClatdControllerTest, MakeChecksumNeutral) { - // We can't test generateIPv6Address here since it requires manipulating routing, which we can't - // do without talking to the real netd on the system. - uint32_t rand = arc4random_uniform(0xffffffff); - uint16_t rand1 = rand & 0xffff; - uint16_t rand2 = (rand >> 16) & 0xffff; - std::string v6PrefixStr = StringPrintf("2001:db8:%x:%x", rand1, rand2); - std::string v6InterfaceAddrStr = StringPrintf("%s::%x:%x", v6PrefixStr.c_str(), rand2, rand1); - std::string nat64PrefixStr = StringPrintf("2001:db8:%x:%x::", rand2, rand1); - - in_addr v4 = {inet_addr(kIPv4LocalAddr)}; - in6_addr v6InterfaceAddr; - ASSERT_TRUE(inet_pton(AF_INET6, v6InterfaceAddrStr.c_str(), &v6InterfaceAddr)); - in6_addr nat64Prefix; - ASSERT_TRUE(inet_pton(AF_INET6, nat64PrefixStr.c_str(), &nat64Prefix)); - - // Generate a boatload of random IIDs. - int onebits = 0; - uint64_t prev_iid = 0; - for (int i = 0; i < 100000; i++) { - in6_addr v6 = v6InterfaceAddr; - makeChecksumNeutral(&v6, v4, nat64Prefix); - - // Check the generated IP address is in the same prefix as the interface IPv6 address. - EXPECT_EQ(0, memcmp(&v6, &v6InterfaceAddr, 8)); - - // Check that consecutive IIDs are not the same. - uint64_t iid = *(uint64_t*)(&v6.s6_addr[8]); - ASSERT_TRUE(iid != prev_iid) - << "Two consecutive random IIDs are the same: " << std::showbase << std::hex << iid - << "\n"; - prev_iid = iid; - - // Check that the IID is checksum-neutral with the NAT64 prefix and the - // local prefix. - uint16_t c1 = ip_checksum_finish(ip_checksum_add(0, &v4, sizeof(v4))); - uint16_t c2 = ip_checksum_finish(ip_checksum_add(0, &nat64Prefix, sizeof(nat64Prefix)) + - ip_checksum_add(0, &v6, sizeof(v6))); - - if (c1 != c2) { - char v6Str[INET6_ADDRSTRLEN]; - inet_ntop(AF_INET6, &v6, v6Str, sizeof(v6Str)); - FAIL() << "Bad IID: " << v6Str << " not checksum-neutral with " << kIPv4LocalAddr - << " and " << nat64PrefixStr.c_str() << std::showbase << std::hex - << "\n IPv4 checksum: " << c1 << "\n IPv6 checksum: " << c2 << "\n"; - } - - // Check that IIDs are roughly random and use all the bits by counting the - // total number of bits set to 1 in a random sample of 100000 generated IIDs. - onebits += __builtin_popcountll(*(uint64_t*)&iid); - } - EXPECT_LE(3190000, onebits); - EXPECT_GE(3210000, onebits); -} - -TEST_F(ClatdControllerTest, DetectMtu) { - // ::1 with bottom 32 bits set to 1 is still ::1 which routes via lo with mtu of 64KiB - ASSERT_EQ(detect_mtu(&in6addr_loopback, htonl(1), 0 /*MARK_UNSET*/), 65536); -} - -// Get the first IPv4 address for a given interface name -in_addr* getinterface_ip(const char* interface) { - ifaddrs *ifaddr, *ifa; - in_addr* retval = nullptr; - - if (getifaddrs(&ifaddr) == -1) return nullptr; - - for (ifa = ifaddr; ifa != nullptr; ifa = ifa->ifa_next) { - if (ifa->ifa_addr == nullptr) continue; - - if ((strcmp(ifa->ifa_name, interface) == 0) && (ifa->ifa_addr->sa_family == AF_INET)) { - retval = (in_addr*)malloc(sizeof(in_addr)); - if (retval) { - const sockaddr_in* sin = reinterpret_cast(ifa->ifa_addr); - *retval = sin->sin_addr; - } - break; - } - } - - freeifaddrs(ifaddr); - return retval; -} - -TEST_F(ClatdControllerTest, ConfigureTunIpManual) { - // Create an interface for configure_tun_ip to configure and bring up. - TunInterface v4Iface; - ASSERT_EQ(0, v4Iface.init()); - - configure_tun_ip(v4Iface.name().c_str(), "192.0.2.1" /* v4Str */, 1472 /* mtu */); - in_addr* ip = getinterface_ip(v4Iface.name().c_str()); - ASSERT_NE(nullptr, ip); - EXPECT_EQ(inet_addr("192.0.2.1"), ip->s_addr); - free(ip); - - v4Iface.destroy(); -} - -ClatdController::tun_data makeTunData() { - // Create some fake but realistic-looking sockets so configure_clat_ipv6_address doesn't balk. - return { - .read_fd6 = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, htons(ETH_P_IPV6)), - .write_fd6 = socket(AF_INET6, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW), - .fd4 = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0), - }; -} - -void cleanupTunData(ClatdController::tun_data* tunnel) { - close(tunnel->write_fd6); - close(tunnel->read_fd6); - close(tunnel->fd4); -} - -TEST_F(ClatdControllerTest, ConfigureIpv6Address) { - // Create an interface for configure_clat_ipv6_address to attach socket filter to. - TunInterface v6Iface; - ASSERT_EQ(0, v6Iface.init()); - ClatdController::tun_data tunnel = makeTunData(); - - // Only initialize valid value to configure_clat_ipv6_address() required fields - // {ifIndex, v6, v6Str}. The uninitialized fields have initialized with invalid - // value just in case. - ClatdController::ClatdTracker tracker = { - .pid = -1, // unused - .ifIndex = 0, // initialize later - .iface = "", // unused - .v4ifIndex = 0, // unused - .v4iface = "", // unused - .fwmark.intValue = 0, // unused - .fwmarkString = "0x0", // unused - .v4 = {}, // unused - .v4Str = "", // unused - .v6 = {}, // initialize later - .v6Str = "", // initialize later - .pfx96 = {}, // unused - .pfx96String = "", // unused - }; - tracker.ifIndex = static_cast(v6Iface.ifindex()); - const char* addrStr = "2001:db8::f00"; - ASSERT_EQ(1, inet_pton(AF_INET6, addrStr, &tracker.v6)); - strlcpy(tracker.v6Str, addrStr, sizeof(tracker.v6Str)); - - ASSERT_EQ(0, configure_clat_ipv6_address(&tracker, &tunnel)); - - // Check that the packet socket is bound to the interface. We can't check the socket filter - // because there is no way to fetch it from the kernel. - sockaddr_ll sll; - socklen_t len = sizeof(sll); - ASSERT_EQ(0, getsockname(tunnel.read_fd6, reinterpret_cast(&sll), &len)); - EXPECT_EQ(htons(ETH_P_IPV6), sll.sll_protocol); - EXPECT_EQ(sll.sll_ifindex, v6Iface.ifindex()); - - v6Iface.destroy(); - cleanupTunData(&tunnel); -} - -} // namespace net -} // namespace android diff --git a/server/Controllers.cpp b/server/Controllers.cpp index 62828346..0df6b0ee 100644 --- a/server/Controllers.cpp +++ b/server/Controllers.cpp @@ -191,8 +191,7 @@ void Controllers::createChildChains(IptablesTarget target, const char* table, } Controllers::Controllers() - : clatdCtrl(&netCtrl), - wakeupCtrl( + : wakeupCtrl( [this](const WakeupController::ReportArgs& args) { const auto listener = eventReporter.getNetdEventListener(); if (listener == nullptr) { @@ -278,9 +277,6 @@ void Controllers::init() { initIptablesRules(); Stopwatch s; - clatdCtrl.init(); - gLog.info("Initializing ClatdController: %" PRId64 "us", s.getTimeAndResetUs()); - bandwidthCtrl.enableBandwidthControl(); gLog.info("Enabling bandwidth control: %" PRId64 "us", s.getTimeAndResetUs()); diff --git a/server/Controllers.h b/server/Controllers.h index d1e3ea3d..8b51ddf1 100644 --- a/server/Controllers.h +++ b/server/Controllers.h @@ -18,7 +18,6 @@ #define _CONTROLLERS_H__ #include "BandwidthController.h" -#include "ClatdController.h" #include "EventReporter.h" #include "FirewallController.h" #include "IdletimerController.h" @@ -46,7 +45,6 @@ class Controllers { BandwidthController bandwidthCtrl; IdletimerController idletimerCtrl; FirewallController firewallCtrl; - ClatdController clatdCtrl; StrictController strictCtrl; EventReporter eventReporter; IptablesRestoreController iptablesRestoreCtrl; diff --git a/server/NetdNativeService.cpp b/server/NetdNativeService.cpp index 7264c319..466d8ba7 100644 --- a/server/NetdNativeService.cpp +++ b/server/NetdNativeService.cpp @@ -169,9 +169,6 @@ status_t NetdNativeService::dump(int fd, const Vector &args) { gCtls->xfrmCtrl.dump(dw); dw.blankline(); - gCtls->clatdCtrl.dump(dw); - dw.blankline(); - gCtls->tetherCtrl.dump(dw); dw.blankline(); @@ -753,17 +750,20 @@ binder::Status NetdNativeService::strictUidCleartextPenalty(int32_t uid, int32_t return statusFromErrcode(res); } -binder::Status NetdNativeService::clatdStart(const std::string& ifName, - const std::string& nat64Prefix, std::string* v6Addr) { +// TODO: remark @deprecated in INetd.aidl. +binder::Status NetdNativeService::clatdStart(const std::string& /* ifName */, + const std::string& /* nat64Prefix */, + std::string* /* v6Addr */) { ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK); - int res = gCtls->clatdCtrl.startClatd(ifName.c_str(), nat64Prefix, v6Addr); - return statusFromErrcode(res); + // deprecated + return binder::Status::fromExceptionCode(binder::Status::EX_UNSUPPORTED_OPERATION); } -binder::Status NetdNativeService::clatdStop(const std::string& ifName) { +// TODO: remark @deprecated in INetd.aidl. +binder::Status NetdNativeService::clatdStop(const std::string& /* ifName */) { ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK); - int res = gCtls->clatdCtrl.stopClatd(ifName.c_str()); - return statusFromErrcode(res); + // deprecated + return binder::Status::fromExceptionCode(binder::Status::EX_UNSUPPORTED_OPERATION); } binder::Status NetdNativeService::ipfwdEnabled(bool* status) { -- cgit v1.2.3