/* print ipv6/tcp header */ void dump_tcp6(const struct tcphdr *tcp, const struct ip6_hdr *ip6, const uint8_t *payload, size_t payload_size, const uint8_t *options, size_t options_size) { uint32_t temp_checksum; temp_checksum = ipv6_pseudo_header_checksum(ip6, sizeof(*tcp) + options_size + payload_size, IPPROTO_TCP); dump_tcp_generic(tcp, options, options_size, temp_checksum, payload, payload_size); }
/* function: tcp_to_tcp6 * translate ipv4 tcp to ipv6 tcp * fd - tun interface fd * ip - source packet ipv4 header * tcp - source packet tcp header * payload - tcp payload * payload_size - size of payload * options - tcp options * options_size - size of options */ void tcp_to_tcp6(int fd,const struct iphdr *ip, const struct tcphdr *tcp, const char *payload, size_t payload_size, const char *options, size_t options_size) { struct ip6_hdr ip6_targ; struct iovec io_targ[5]; struct tun_pi tun_header; uint32_t checksum; fill_tun_header(&tun_header,ETH_P_IPV6); fill_ip6_header(&ip6_targ,payload_size+options_size+sizeof(struct tcphdr),IPPROTO_TCP,ip); checksum = ipv6_pseudo_header_checksum(0, &ip6_targ); io_targ[0].iov_base = &tun_header; io_targ[0].iov_len = sizeof(tun_header); io_targ[1].iov_base = &ip6_targ; io_targ[1].iov_len = sizeof(ip6_targ); tcp_translate(fd,tcp,payload,payload_size,io_targ,checksum,options,options_size); }
/* function: udp_to_udp6 * translate ipv4 udp to ipv6 udp * fd - tun interface fd * ip - source packet ipv4 header * udp - source packet udp header * payload - udp payload * payload_size - size of payload */ void udp_to_udp6(int fd, const struct iphdr *ip, const struct udphdr *udp, const char *payload, size_t payload_size) { struct ip6_hdr ip6_targ; struct iovec io_targ[4]; struct tun_pi tun_header; uint32_t checksum; fill_tun_header(&tun_header,ETH_P_IPV6); fill_ip6_header(&ip6_targ,payload_size + sizeof(struct udphdr),IPPROTO_UDP,ip); checksum = ipv6_pseudo_header_checksum(0, &ip6_targ); io_targ[0].iov_base = &tun_header; io_targ[0].iov_len = sizeof(tun_header); io_targ[1].iov_base = &ip6_targ; io_targ[1].iov_len = sizeof(ip6_targ); udp_translate(fd,udp,payload,payload_size,io_targ,checksum); }
/* function: icmp_to_icmp6 * translate ipv4 icmp to ipv6 icmp * fd - tun interface fd * ip - source packet ipv4 header * icmp - source packet icmp header * payload - icmp payload * payload_size - size of payload */ void icmp_to_icmp6(int fd, const struct iphdr *ip, const struct icmphdr *icmp, const char *payload, size_t payload_size) { struct ip6_hdr ip6_targ; struct icmp6_hdr icmp6_targ; struct iovec io_targ[4]; struct tun_pi tun_header; uint32_t checksum_temp; if(icmp->type != ICMP_ECHO && icmp->type != ICMP_ECHOREPLY) { #if CLAT_DEBUG logmsg(ANDROID_LOG_WARN,"icmp_to_icmp6/unhandled icmp type: 0x%x",icmp->type); #endif return; } fill_tun_header(&tun_header,ETH_P_IPV6); fill_ip6_header(&ip6_targ,payload_size + sizeof(icmp6_targ),IPPROTO_ICMPV6,ip); memset(&icmp6_targ, 0, sizeof(icmp6_targ)); icmp6_targ.icmp6_type = (icmp->type == ICMP_ECHO) ? ICMP6_ECHO_REQUEST : ICMP6_ECHO_REPLY; icmp6_targ.icmp6_code = 0; icmp6_targ.icmp6_cksum = 0; icmp6_targ.icmp6_id = icmp->un.echo.id; icmp6_targ.icmp6_seq = icmp->un.echo.sequence; checksum_temp = ipv6_pseudo_header_checksum(0,&ip6_targ); checksum_temp = ip_checksum_add(checksum_temp,&icmp6_targ,sizeof(icmp6_targ)); checksum_temp = ip_checksum_add(checksum_temp,payload,payload_size); icmp6_targ.icmp6_cksum = ip_checksum_finish(checksum_temp); io_targ[0].iov_base = &tun_header; io_targ[0].iov_len = sizeof(tun_header); io_targ[1].iov_base = &ip6_targ; io_targ[1].iov_len = sizeof(ip6_targ); io_targ[2].iov_base = &icmp6_targ; io_targ[2].iov_len = sizeof(icmp6_targ); io_targ[3].iov_base = (char *)payload; io_targ[3].iov_len = payload_size; writev(fd, io_targ, 4); }
/* print ipv6/udp header */ void dump_udp6(const struct udphdr *udp, const struct ip6_hdr *ip6, const uint8_t *payload, size_t payload_size) { uint32_t temp_checksum; temp_checksum = ipv6_pseudo_header_checksum(ip6, sizeof(*udp) + payload_size, IPPROTO_UDP); dump_udp_generic(udp, temp_checksum, payload, payload_size); }
/* function: ipv4_packet * translates an ipv4 packet * out - output packet * packet - packet data * len - size of packet * returns: the highest position in the output clat_packet that's filled in */ int ipv4_packet(clat_packet out, int pos, const char *packet, size_t len) { const struct iphdr *header = (struct iphdr *) packet; struct ip6_hdr *ip6_targ = (struct ip6_hdr *) out[pos].iov_base; uint16_t frag_flags; uint8_t nxthdr; const char *next_header; size_t len_left; uint32_t checksum; int iov_len; if(len < sizeof(struct iphdr)) { logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/too short for an ip header"); return 0; } frag_flags = ntohs(header->frag_off); if(frag_flags & IP_MF) { // this could theoretically be supported, but isn't logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/more fragments set, dropping"); return 0; } if(header->ihl < 5) { logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set to less than 5: %x", header->ihl); return 0; } if((size_t) header->ihl * 4 > len) { // ip header length larger than entire packet logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set too large: %x", header->ihl); return 0; } if(header->version != 4) { logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header version not 4: %x", header->version); return 0; } /* rfc6145 - If any IPv4 options are present in the IPv4 packet, they MUST be * ignored and the packet translated normally; there is no attempt to * translate the options. */ next_header = packet + header->ihl*4; len_left = len - header->ihl * 4; nxthdr = header->protocol; if (nxthdr == IPPROTO_ICMP) { // ICMP and ICMPv6 have different protocol numbers. nxthdr = IPPROTO_ICMPV6; } /* Fill in the IPv6 header. We need to do this before we translate the packet because TCP and * UDP include parts of the IP header in the checksum. Set the length to zero because we don't * know it yet. */ fill_ip6_header(ip6_targ, 0, nxthdr, header); out[pos].iov_len = sizeof(struct ip6_hdr); // Calculate the pseudo-header checksum. checksum = ipv6_pseudo_header_checksum(0, ip6_targ, len_left); if (nxthdr == IPPROTO_ICMPV6) { iov_len = icmp_packet(out, pos + 1, (const struct icmphdr *) next_header, checksum, len_left); } else if (nxthdr == IPPROTO_TCP) { iov_len = tcp_packet(out, pos + 1, (const struct tcphdr *) next_header, checksum, len_left); } else if (nxthdr == IPPROTO_UDP) { iov_len = udp_packet(out, pos + 1, (const struct udphdr *) next_header, checksum, len_left); } else if (nxthdr == IPPROTO_GRE) { iov_len = generic_packet(out, pos + 1, next_header, len_left); } else { #if CLAT_DEBUG logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/unknown protocol: %x",header->protocol); logcat_hexdump("ipv4/protocol", packet, len); #endif return 0; } // Set the length. ip6_targ->ip6_plen = htons(packet_length(out, pos)); return iov_len; }
/* print ipv6/tcp header */ void dump_tcp6(const struct tcphdr *tcp, const struct ip6_hdr *ip6, const char *payload, size_t payload_size, const char *options, size_t options_size) { uint32_t temp_checksum; temp_checksum = ipv6_pseudo_header_checksum(0, ip6); dump_tcp_generic(tcp, options, options_size, temp_checksum, payload, payload_size); }
/* print ipv6/udp header */ void dump_udp6(const struct udphdr *udp, const struct ip6_hdr *ip6, const char *payload, size_t payload_size) { uint32_t temp_checksum; temp_checksum = ipv6_pseudo_header_checksum(0, ip6); dump_udp_generic(udp, temp_checksum, payload, payload_size); }
/* function: ipv6_packet * takes an ipv6 packet and hands it off to the layer 4 protocol function * out - output packet * packet - packet data * len - size of packet * returns: the highest position in the output clat_packet that's filled in */ int ipv6_packet(clat_packet out, clat_packet_index pos, const uint8_t *packet, size_t len) { const struct ip6_hdr *ip6 = (struct ip6_hdr *) packet; struct iphdr *ip_targ = (struct iphdr *) out[pos].iov_base; struct ip6_frag *frag_hdr = NULL; uint8_t protocol; const uint8_t *next_header; size_t len_left; uint32_t old_sum, new_sum; int iov_len; if(len < sizeof(struct ip6_hdr)) { logmsg_dbg(ANDROID_LOG_ERROR, "ipv6_packet/too short for an ip6 header: %d", len); return 0; } if(IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { log_bad_address("ipv6_packet/multicast %s->%s", &ip6->ip6_src, &ip6->ip6_dst); return 0; // silently ignore } // If the packet is not from the plat subnet to the local subnet, or vice versa, drop it, unless // it's an ICMP packet (which can come from anywhere). We do not send IPv6 packets from the plat // subnet to the local subnet, but these can appear as inner packets in ICMP errors, so we need // to translate them. We accept third-party ICMPv6 errors, even though their source addresses // cannot be translated, so that things like unreachables and traceroute will work. fill_ip_header // takes care of faking a source address for them. if (!(is_in_plat_subnet(&ip6->ip6_src) && IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &Global_Clatd_Config.ipv6_local_subnet)) && !(is_in_plat_subnet(&ip6->ip6_dst) && IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &Global_Clatd_Config.ipv6_local_subnet)) && ip6->ip6_nxt != IPPROTO_ICMPV6) { log_bad_address("ipv6_packet/wrong source address: %s->%s", &ip6->ip6_src, &ip6->ip6_dst); return 0; } next_header = packet + sizeof(struct ip6_hdr); len_left = len - sizeof(struct ip6_hdr); protocol = ip6->ip6_nxt; /* Fill in the IPv4 header. We need to do this before we translate the packet because TCP and * UDP include parts of the IP header in the checksum. Set the length to zero because we don't * know it yet. */ fill_ip_header(ip_targ, 0, protocol, ip6); out[pos].iov_len = sizeof(struct iphdr); // If there's a Fragment header, parse it and decide what the next header is. // Do this before calculating the pseudo-header checksum because it updates the next header value. if (protocol == IPPROTO_FRAGMENT) { frag_hdr = (struct ip6_frag *) next_header; if (len_left < sizeof(*frag_hdr)) { logmsg_dbg(ANDROID_LOG_ERROR, "ipv6_packet/too short for fragment header: %d", len); return 0; } next_header += sizeof(*frag_hdr); len_left -= sizeof(*frag_hdr); protocol = parse_frag_header(frag_hdr, ip_targ); } // ICMP and ICMPv6 have different protocol numbers. if (protocol == IPPROTO_ICMPV6) { protocol = IPPROTO_ICMP; ip_targ->protocol = IPPROTO_ICMP; } /* Calculate the pseudo-header checksum. * Technically, the length that is used in the pseudo-header checksum is the transport layer * length, which is not the same as len_left in the case of fragmented packets. But since * translation does not change the transport layer length, the checksum is unaffected. */ old_sum = ipv6_pseudo_header_checksum(ip6, len_left, protocol); new_sum = ipv4_pseudo_header_checksum(ip_targ, len_left); // Does not support IPv6 extension headers except Fragment. if (frag_hdr && (frag_hdr->ip6f_offlg & IP6F_OFF_MASK)) { iov_len = generic_packet(out, pos + 2, next_header, len_left); } else if (protocol == IPPROTO_ICMP) { iov_len = icmp6_packet(out, pos + 2, (const struct icmp6_hdr *) next_header, len_left); } else if (protocol == IPPROTO_TCP) { iov_len = tcp_packet(out, pos + 2, (const struct tcphdr *) next_header, old_sum, new_sum, len_left); } else if (protocol == IPPROTO_UDP) { iov_len = udp_packet(out, pos + 2, (const struct udphdr *) next_header, old_sum, new_sum, len_left); } else if (protocol == IPPROTO_GRE) { iov_len = generic_packet(out, pos + 2, next_header, len_left); } else { #if CLAT_DEBUG logmsg(ANDROID_LOG_ERROR, "ipv6_packet/unknown next header type: %x", ip6->ip6_nxt); logcat_hexdump("ipv6/nxthdr", packet, len); #endif return 0; } // Set the length and calculate the checksum. ip_targ->tot_len = htons(ntohs(ip_targ->tot_len) + packet_length(out, pos)); ip_targ->check = ip_checksum(ip_targ, sizeof(struct iphdr)); return iov_len; }