/* function: icmp6_to_icmp_code
* Maps ICMPv6 codes to ICMP codes. Partial implementation of RFC 6145, section 5.2.
* type - the ICMPv6 type
* code - the ICMPv6 code
*/
uint8_t icmp6_to_icmp_code(uint8_t type, uint8_t code) {
switch (type) {
case ICMP6_ECHO_REQUEST:
case ICMP6_ECHO_REPLY:
case ICMP6_TIME_EXCEEDED:
return code;
case ICMP6_DST_UNREACH:
switch (code) {
case ICMP6_DST_UNREACH_NOROUTE:
return ICMP_UNREACH_HOST;
case ICMP6_DST_UNREACH_ADMIN:
return ICMP_UNREACH_HOST_PROHIB;
case ICMP6_DST_UNREACH_BEYONDSCOPE:
return ICMP_UNREACH_HOST;
case ICMP6_DST_UNREACH_ADDR:
return ICMP_HOST_UNREACH;
case ICMP6_DST_UNREACH_NOPORT:
return ICMP_UNREACH_PORT;
// Otherwise, we don't understand this ICMPv6 type/code combination. Fall through.
}
}
logmsg_dbg(ANDROID_LOG_DEBUG, "icmp6_to_icmp_code: unhandled ICMP type/code %d/%d", type, code);
return 0;
}
/* function: icmp_to_icmp6_code
* Maps ICMP codes to ICMPv6 codes. Partial implementation of RFC 6145, section 4.2.
* type - the ICMP type
* code - the ICMP code
*/
uint8_t icmp_to_icmp6_code(uint8_t type, uint8_t code) {
switch (type) {
case ICMP_ECHO:
case ICMP_ECHOREPLY:
return 0;
case ICMP_TIME_EXCEEDED:
return code;
case ICMP_DEST_UNREACH:
switch (code) {
case ICMP_UNREACH_NET:
case ICMP_UNREACH_HOST:
return ICMP6_DST_UNREACH_NOROUTE;
case ICMP_UNREACH_PORT:
return ICMP6_DST_UNREACH_NOPORT;
case ICMP_UNREACH_NET_PROHIB:
case ICMP_UNREACH_HOST_PROHIB:
case ICMP_UNREACH_FILTER_PROHIB:
case ICMP_UNREACH_PRECEDENCE_CUTOFF:
return ICMP6_DST_UNREACH_ADMIN;
// Otherwise, we don't understand this ICMP type/code combination. Fall through.
}
}
logmsg_dbg(ANDROID_LOG_DEBUG, "icmp_to_icmp6_code: unhandled ICMP type/code %d/%d", type, code);
return 0;
}
void log_bad_address(const char *fmt, const struct in6_addr *src, const struct in6_addr *dst) {
char srcstr[INET6_ADDRSTRLEN];
char dststr[INET6_ADDRSTRLEN];
inet_ntop(AF_INET6, src, srcstr, sizeof(srcstr));
inet_ntop(AF_INET6, dst, dststr, sizeof(dststr));
logmsg_dbg(ANDROID_LOG_ERROR, fmt, srcstr, dststr);
}
/* function: icmp_packet
* translates an icmp packet
* out - output packet
* icmp - pointer to icmp header in packet
* checksum - pseudo-header checksum
* len - size of ip payload
* returns: the highest position in the output clat_packet that's filled in
*/
int icmp_packet(clat_packet out, int pos, const struct icmphdr *icmp, uint32_t checksum,
size_t len) {
const char *payload;
size_t payload_size;
if(len < sizeof(struct icmphdr)) {
logmsg_dbg(ANDROID_LOG_ERROR, "icmp_packet/(too small)");
return 0;
}
payload = (const char *) (icmp + 1);
payload_size = len - sizeof(struct icmphdr);
return icmp_to_icmp6(out, pos, icmp, checksum, payload, payload_size);
}
/* function: icmp6_packet
* takes an icmp6 packet and sets it up for translation
* out - output packet
* icmp6 - pointer to icmp6 header in packet
* checksum - pseudo-header checksum (unused)
* len - size of ip payload
* returns: the highest position in the output clat_packet that's filled in
*/
int icmp6_packet(clat_packet out, clat_packet_index pos, const struct icmp6_hdr *icmp6,
size_t len) {
const uint8_t *payload;
size_t payload_size;
if(len < sizeof(struct icmp6_hdr)) {
logmsg_dbg(ANDROID_LOG_ERROR, "icmp6_packet/(too small)");
return 0;
}
payload = (const uint8_t *) (icmp6 + 1);
payload_size = len - sizeof(struct icmp6_hdr);
return icmp6_to_icmp(out, pos, icmp6, payload, payload_size);
}
/* function: icmp6_to_icmp_type
* Maps ICMPv6 types to ICMP types. Partial implementation of RFC 6145, section 5.2.
* type - the ICMP type
*/
uint8_t icmp6_to_icmp_type(uint8_t type, uint8_t code) {
switch (type) {
case ICMP6_ECHO_REQUEST:
return ICMP_ECHO;
case ICMP6_ECHO_REPLY:
return ICMP_ECHOREPLY;
case ICMP6_DST_UNREACH:
return ICMP_DEST_UNREACH;
case ICMP6_TIME_EXCEEDED:
return ICMP_TIME_EXCEEDED;
}
// We don't understand this ICMP type. Return parameter problem so the caller will bail out.
logmsg_dbg(ANDROID_LOG_DEBUG, "icmp6_to_icmp_type: unhandled ICMP type %d", type);
return ICMP_PARAMETERPROB;
}
/* function: icmp_to_icmp6_type
* Maps ICMP types to ICMPv6 types. Partial implementation of RFC 6145, section 4.2.
* type - the ICMPv6 type
*/
uint8_t icmp_to_icmp6_type(uint8_t type, uint8_t code) {
switch (type) {
case ICMP_ECHO:
return ICMP6_ECHO_REQUEST;
case ICMP_ECHOREPLY:
return ICMP6_ECHO_REPLY;
case ICMP_TIME_EXCEEDED:
return ICMP6_TIME_EXCEEDED;
case ICMP_DEST_UNREACH:
// These two types need special translation which we don't support yet.
if (code != ICMP_UNREACH_PROTOCOL && code != ICMP_UNREACH_NEEDFRAG) {
return ICMP6_DST_UNREACH;
}
}
// We don't understand this ICMP type. Return parameter problem so the caller will bail out.
logmsg_dbg(ANDROID_LOG_DEBUG, "icmp_to_icmp6_type: unhandled ICMP type %d", type);
return ICMP6_PARAM_PROB;
}
/* function: ipv4_packet
* translates an ipv4 packet
* out - output packet
* packet - packet data
* len - size of packet
* returns: the highest position in the output clat_packet that's filled in
*/
int ipv4_packet(clat_packet out, int pos, const char *packet, size_t len) {
const struct iphdr *header = (struct iphdr *) packet;
struct ip6_hdr *ip6_targ = (struct ip6_hdr *) out[pos].iov_base;
uint16_t frag_flags;
uint8_t nxthdr;
const char *next_header;
size_t len_left;
uint32_t checksum;
int iov_len;
if(len < sizeof(struct iphdr)) {
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/too short for an ip header");
return 0;
}
frag_flags = ntohs(header->frag_off);
if(frag_flags & IP_MF) { // this could theoretically be supported, but isn't
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/more fragments set, dropping");
return 0;
}
if(header->ihl < 5) {
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set to less than 5: %x", header->ihl);
return 0;
}
if((size_t) header->ihl * 4 > len) { // ip header length larger than entire packet
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header length set too large: %x", header->ihl);
return 0;
}
if(header->version != 4) {
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/ip header version not 4: %x", header->version);
return 0;
}
/* rfc6145 - If any IPv4 options are present in the IPv4 packet, they MUST be
* ignored and the packet translated normally; there is no attempt to
* translate the options.
*/
next_header = packet + header->ihl*4;
len_left = len - header->ihl * 4;
nxthdr = header->protocol;
if (nxthdr == IPPROTO_ICMP) {
// ICMP and ICMPv6 have different protocol numbers.
nxthdr = IPPROTO_ICMPV6;
}
/* Fill in the IPv6 header. We need to do this before we translate the packet because TCP and
* UDP include parts of the IP header in the checksum. Set the length to zero because we don't
* know it yet.
*/
fill_ip6_header(ip6_targ, 0, nxthdr, header);
out[pos].iov_len = sizeof(struct ip6_hdr);
// Calculate the pseudo-header checksum.
checksum = ipv6_pseudo_header_checksum(0, ip6_targ, len_left);
if (nxthdr == IPPROTO_ICMPV6) {
iov_len = icmp_packet(out, pos + 1, (const struct icmphdr *) next_header, checksum, len_left);
} else if (nxthdr == IPPROTO_TCP) {
iov_len = tcp_packet(out, pos + 1, (const struct tcphdr *) next_header, checksum, len_left);
} else if (nxthdr == IPPROTO_UDP) {
iov_len = udp_packet(out, pos + 1, (const struct udphdr *) next_header, checksum, len_left);
} else if (nxthdr == IPPROTO_GRE) {
iov_len = generic_packet(out, pos + 1, next_header, len_left);
} else {
#if CLAT_DEBUG
logmsg_dbg(ANDROID_LOG_ERROR, "ip_packet/unknown protocol: %x",header->protocol);
logcat_hexdump("ipv4/protocol", packet, len);
#endif
return 0;
}
// Set the length.
ip6_targ->ip6_plen = htons(packet_length(out, pos));
return iov_len;
}
/* function: ipv6_packet
* takes an ipv6 packet and hands it off to the layer 4 protocol function
* out - output packet
* packet - packet data
* len - size of packet
* returns: the highest position in the output clat_packet that's filled in
*/
int ipv6_packet(clat_packet out, clat_packet_index pos, const uint8_t *packet, size_t len) {
const struct ip6_hdr *ip6 = (struct ip6_hdr *) packet;
struct iphdr *ip_targ = (struct iphdr *) out[pos].iov_base;
struct ip6_frag *frag_hdr = NULL;
uint8_t protocol;
const uint8_t *next_header;
size_t len_left;
uint32_t old_sum, new_sum;
int iov_len;
if(len < sizeof(struct ip6_hdr)) {
logmsg_dbg(ANDROID_LOG_ERROR, "ipv6_packet/too short for an ip6 header: %d", len);
return 0;
}
if(IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
log_bad_address("ipv6_packet/multicast %s->%s", &ip6->ip6_src, &ip6->ip6_dst);
return 0; // silently ignore
}
// If the packet is not from the plat subnet to the local subnet, or vice versa, drop it, unless
// it's an ICMP packet (which can come from anywhere). We do not send IPv6 packets from the plat
// subnet to the local subnet, but these can appear as inner packets in ICMP errors, so we need
// to translate them. We accept third-party ICMPv6 errors, even though their source addresses
// cannot be translated, so that things like unreachables and traceroute will work. fill_ip_header
// takes care of faking a source address for them.
if (!(is_in_plat_subnet(&ip6->ip6_src) &&
IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &Global_Clatd_Config.ipv6_local_subnet)) &&
!(is_in_plat_subnet(&ip6->ip6_dst) &&
IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &Global_Clatd_Config.ipv6_local_subnet)) &&
ip6->ip6_nxt != IPPROTO_ICMPV6) {
log_bad_address("ipv6_packet/wrong source address: %s->%s", &ip6->ip6_src, &ip6->ip6_dst);
return 0;
}
next_header = packet + sizeof(struct ip6_hdr);
len_left = len - sizeof(struct ip6_hdr);
protocol = ip6->ip6_nxt;
/* Fill in the IPv4 header. We need to do this before we translate the packet because TCP and
* UDP include parts of the IP header in the checksum. Set the length to zero because we don't
* know it yet.
*/
fill_ip_header(ip_targ, 0, protocol, ip6);
out[pos].iov_len = sizeof(struct iphdr);
// If there's a Fragment header, parse it and decide what the next header is.
// Do this before calculating the pseudo-header checksum because it updates the next header value.
if (protocol == IPPROTO_FRAGMENT) {
frag_hdr = (struct ip6_frag *) next_header;
if (len_left < sizeof(*frag_hdr)) {
logmsg_dbg(ANDROID_LOG_ERROR, "ipv6_packet/too short for fragment header: %d", len);
return 0;
}
next_header += sizeof(*frag_hdr);
len_left -= sizeof(*frag_hdr);
protocol = parse_frag_header(frag_hdr, ip_targ);
}
// ICMP and ICMPv6 have different protocol numbers.
if (protocol == IPPROTO_ICMPV6) {
protocol = IPPROTO_ICMP;
ip_targ->protocol = IPPROTO_ICMP;
}
/* Calculate the pseudo-header checksum.
* Technically, the length that is used in the pseudo-header checksum is the transport layer
* length, which is not the same as len_left in the case of fragmented packets. But since
* translation does not change the transport layer length, the checksum is unaffected.
*/
old_sum = ipv6_pseudo_header_checksum(ip6, len_left, protocol);
new_sum = ipv4_pseudo_header_checksum(ip_targ, len_left);
// Does not support IPv6 extension headers except Fragment.
if (frag_hdr && (frag_hdr->ip6f_offlg & IP6F_OFF_MASK)) {
iov_len = generic_packet(out, pos + 2, next_header, len_left);
} else if (protocol == IPPROTO_ICMP) {
iov_len = icmp6_packet(out, pos + 2, (const struct icmp6_hdr *) next_header, len_left);
} else if (protocol == IPPROTO_TCP) {
iov_len = tcp_packet(out, pos + 2, (const struct tcphdr *) next_header, old_sum, new_sum,
len_left);
} else if (protocol == IPPROTO_UDP) {
iov_len = udp_packet(out, pos + 2, (const struct udphdr *) next_header, old_sum, new_sum,
len_left);
} else if (protocol == IPPROTO_GRE) {
iov_len = generic_packet(out, pos + 2, next_header, len_left);
} else {
#if CLAT_DEBUG
logmsg(ANDROID_LOG_ERROR, "ipv6_packet/unknown next header type: %x", ip6->ip6_nxt);
logcat_hexdump("ipv6/nxthdr", packet, len);
#endif
return 0;
}
// Set the length and calculate the checksum.
ip_targ->tot_len = htons(ntohs(ip_targ->tot_len) + packet_length(out, pos));
ip_targ->check = ip_checksum(ip_targ, sizeof(struct iphdr));
return iov_len;
}
