src/ndp.c

   1 /**
   2  * Copyright (C) 2012-2013 Steven Barth <steven@midlink.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License v2 as published by
   6  * the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  * GNU General Public License for more details.
  12  *
  13  */
  14
  15 #include <stdio.h>
  16 #include <stdlib.h>
  17 #include <signal.h>
  18 #include <errno.h>
  19
  20 #include <fcntl.h>
  21 #include <unistd.h>
  22 #include <arpa/inet.h>
  23 #include <sys/socket.h>
  24 #include <net/ethernet.h>
  25 #include <netinet/ip6.h>
  26 #include <netinet/icmp6.h>
  27 #include <netpacket/packet.h>
  28
  29 #include <linux/filter.h>
  30 #include <linux/neighbour.h>
  31
  32 #include "dhcpv6.h"
  33 #include "odhcpd.h"
  34
  35
  36 static void ndp_netevent_cb(unsigned long event, struct netevent_handler_info *info);
  37 static void setup_route(struct in6_addr *addr, struct interface *iface, bool add);
  38 static void setup_addr_for_relaying(struct in6_addr *addr, struct interface *iface, bool add);
  39 static void handle_solicit(void *addr, void *data, size_t len,
  40                 struct interface *iface, void *dest);
  41
  42 static int ping_socket = -1;
  43
  44 // Filter ICMPv6 messages of type neighbor soliciation
  45 static struct sock_filter bpf[] = {
  46         BPF_STMT(BPF_LD | BPF_B | BPF_ABS, offsetof(struct ip6_hdr, ip6_nxt)),
  47         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
  48         BPF_STMT(BPF_LD | BPF_B | BPF_ABS, sizeof(struct ip6_hdr) +
  49                         offsetof(struct icmp6_hdr, icmp6_type)),
  50         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_NEIGHBOR_SOLICIT, 0, 1),
  51         BPF_STMT(BPF_RET | BPF_K, 0xffffffff),
  52         BPF_STMT(BPF_RET | BPF_K, 0),
  53 };
  54 static const struct sock_fprog bpf_prog = {sizeof(bpf) / sizeof(*bpf), bpf};
  55 static struct netevent_handler ndp_netevent_handler = { .cb = ndp_netevent_cb, };
  56
  57 // Initialize NDP-proxy
  58 int ndp_init(void)
  59 {
  60         int val = 2;
  61
  62         // Open ICMPv6 socket
  63         ping_socket = socket(AF_INET6, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_ICMPV6);
  64         if (ping_socket < 0) {
  65                 syslog(LOG_ERR, "Unable to open raw socket: %m");
  66                         return -1;
  67         }
  68
  69         setsockopt(ping_socket, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
  70
  71         // This is required by RFC 4861
  72         val = 255;
  73         setsockopt(ping_socket, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
  74         setsockopt(ping_socket, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
  75
  76         // Filter all packages, we only want to send
  77         struct icmp6_filter filt;
  78         ICMP6_FILTER_SETBLOCKALL(&filt);
  79         setsockopt(ping_socket, IPPROTO_ICMPV6, ICMP6_FILTER, &filt, sizeof(filt));
  80
  81         netlink_add_netevent_handler(&ndp_netevent_handler);
  82
  83         return 0;
  84 }
  85
  86 int ndp_setup_interface(struct interface *iface, bool enable)
  87 {
  88         int ret = 0, procfd;
  89         bool dump_neigh = false;
  90         char procbuf[64];
  91
  92         snprintf(procbuf, sizeof(procbuf), "/proc/sys/net/ipv6/conf/%s/proxy_ndp", iface->ifname);
  93         procfd = open(procbuf, O_WRONLY);
  94
  95         if (procfd < 0) {
  96                 ret = -1;
  97                 goto out;
  98         }
  99
 100         if (iface->ndp_event.uloop.fd > 0) {
 101                 uloop_fd_delete(&iface->ndp_event.uloop);
 102                 close(iface->ndp_event.uloop.fd);
 103                 iface->ndp_event.uloop.fd = -1;
 104
 105                 if (!enable || iface->ndp != MODE_RELAY)
 106                         if (write(procfd, "0\n", 2) < 0) {}
 107
 108                 dump_neigh = true;
 109         }
 110
 111         if (enable && iface->ndp == MODE_RELAY) {
 112                 if (write(procfd, "1\n", 2) < 0) {}
 113
 114                 int sock = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, htons(ETH_P_IPV6));
 115                 if (sock < 0) {
 116                         syslog(LOG_ERR, "Unable to open packet socket: %m");
 117                         ret = -1;
 118                         goto out;
 119                 }
 120
 121 #ifdef PACKET_RECV_TYPE
 122                 int pktt = 1 << PACKET_MULTICAST;
 123                 setsockopt(sock, SOL_PACKET, PACKET_RECV_TYPE, &pktt, sizeof(pktt));
 124 #endif
 125
 126                 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER,
 127                                 &bpf_prog, sizeof(bpf_prog))) {
 128                         syslog(LOG_ERR, "Failed to set BPF: %m");
 129                         ret = -1;
 130                         goto out;
 131                 }
 132
 133                 struct sockaddr_ll ll = {
 134                         .sll_family = AF_PACKET,
 135                         .sll_ifindex = iface->ifindex,
 136                         .sll_protocol = htons(ETH_P_IPV6),
 137                         .sll_hatype = 0,
 138                         .sll_pkttype = 0,
 139                         .sll_halen = 0,
 140                         .sll_addr = {0},
 141                 };
 142                 bind(sock, (struct sockaddr*)&ll, sizeof(ll));
 143
 144                 struct packet_mreq mreq = {iface->ifindex, PACKET_MR_ALLMULTI, ETH_ALEN, {0}};
 145                 setsockopt(sock, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq));
 146
 147                 iface->ndp_event.uloop.fd = sock;
 148                 iface->ndp_event.handle_dgram = handle_solicit;
 149                 odhcpd_register(&iface->ndp_event);
 150
 151                 // If we already were enabled dump is unnecessary, if not do dump
 152                 if (!dump_neigh)
 153                         netlink_dump_neigh_table(false);
 154                 else
 155                         dump_neigh = false;
 156         }
 157
 158         if (dump_neigh)
 159                 netlink_dump_neigh_table(true);
 160
 161 out:
 162         if (procfd >= 0)
 163                 close(procfd);
 164
 165         return ret;
 166 }
 167
 168 static void ndp_netevent_cb(unsigned long event, struct netevent_handler_info *info)
 169 {
 170         struct interface *iface = info->iface;
 171         bool add = true;
 172
 173         if (!iface || iface->ndp == MODE_DISABLED)
 174                 return;
 175
 176         switch (event) {
 177         case NETEV_ADDR6_DEL:
 178                 add = false;
 179                 netlink_dump_neigh_table(false);
 180                 /* fall through */
 181         case NETEV_ADDR6_ADD:
 182                 setup_addr_for_relaying(&info->addr.in6, iface, add);
 183                 break;
 184         case NETEV_NEIGH6_DEL:
 185                 add = false;
 186                 /* fall through */
 187         case NETEV_NEIGH6_ADD:
 188                 if (info->neigh.flags & NTF_PROXY) {
 189                         if (add) {
 190                                 netlink_setup_proxy_neigh(&info->neigh.dst.in6, iface->ifindex, false);
 191                                 setup_route(&info->neigh.dst.in6, iface, false);
 192                                 netlink_dump_neigh_table(false);
 193                         }
 194                         break;
 195                 }
 196
 197                 if (add &&
 198                     !(info->neigh.state &
 199                       (NUD_REACHABLE|NUD_STALE|NUD_DELAY|NUD_PROBE|NUD_PERMANENT|NUD_NOARP)))
 200                         break;
 201
 202                 setup_addr_for_relaying(&info->neigh.dst.in6, iface, add);
 203                 setup_route(&info->neigh.dst.in6, iface, add);
 204
 205                 if (!add)
 206                         netlink_dump_neigh_table(false);
 207                 break;
 208         default:
 209                 break;
 210         }
 211 }
 212
 213 // Send an ICMP-ECHO. This is less for actually pinging but for the
 214 // neighbor cache to be kept up-to-date.
 215 static void ping6(struct in6_addr *addr,
 216                 const struct interface *iface)
 217 {
 218         struct sockaddr_in6 dest = { .sin6_family = AF_INET6, .sin6_addr = *addr, .sin6_scope_id = iface->ifindex, };
 219         struct icmp6_hdr echo = { .icmp6_type = ICMP6_ECHO_REQUEST };
 220         struct iovec iov = { .iov_base = &echo, .iov_len = sizeof(echo) };
 221         char ipbuf[INET6_ADDRSTRLEN];
 222
 223         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
 224         syslog(LOG_NOTICE, "Pinging for %s%%%s", ipbuf, iface->ifname);
 225
 226         netlink_setup_route(addr, 128, iface->ifindex, NULL, 128, true);
 227         odhcpd_send(ping_socket, &dest, &iov, 1, iface);
 228         netlink_setup_route(addr, 128, iface->ifindex, NULL, 128, false);
 229 }
 230
 231 // Handle solicitations
 232 static void handle_solicit(void *addr, void *data, size_t len,
 233                 struct interface *iface, _unused void *dest)
 234 {
 235         struct ip6_hdr *ip6 = data;
 236         struct nd_neighbor_solicit *req = (struct nd_neighbor_solicit*)&ip6[1];
 237         struct sockaddr_ll *ll = addr;
 238         char ipbuf[INET6_ADDRSTRLEN];
 239         uint8_t mac[6];
 240
 241         // Solicitation is for duplicate address detection
 242         bool ns_is_dad = IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src);
 243
 244         // Don't process solicit messages on non relay interfaces
 245         // Don't forward any non-DAD solicitation for external ifaces
 246         // TODO: check if we should even forward DADs for them
 247         if (iface->ndp != MODE_RELAY || (iface->external && !ns_is_dad))
 248                 return;
 249
 250         if (len < sizeof(*ip6) + sizeof(*req))
 251                 return; // Invalid reqicitation
 252
 253         if (IN6_IS_ADDR_LINKLOCAL(&req->nd_ns_target) ||
 254                         IN6_IS_ADDR_LOOPBACK(&req->nd_ns_target) ||
 255                         IN6_IS_ADDR_MULTICAST(&req->nd_ns_target))
 256                 return; // Invalid target
 257
 258         inet_ntop(AF_INET6, &req->nd_ns_target, ipbuf, sizeof(ipbuf));
 259         syslog(LOG_DEBUG, "Got a NS for %s%%%s", ipbuf, iface->ifname);
 260
 261         odhcpd_get_mac(iface, mac);
 262         if (!memcmp(ll->sll_addr, mac, sizeof(mac)))
 263                 return; // Looped back
 264
 265         struct interface *c;
 266         list_for_each_entry(c, &interfaces, head)
 267                 if (iface != c && c->ndp == MODE_RELAY &&
 268                                 (ns_is_dad || !c->external))
 269                         ping6(&req->nd_ns_target, c);
 270 }
 271
 272 // Use rtnetlink to modify kernel routes
 273 static void setup_route(struct in6_addr *addr, struct interface *iface, bool add)
 274 {
 275         char ipbuf[INET6_ADDRSTRLEN];
 276
 277         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
 278         syslog(LOG_NOTICE, "%s about %s%s%%%s",
 279                         (add) ? "Learning" : "Forgetting",
 280                         iface->learn_routes ? "proxy routing for " : "",
 281                         ipbuf, iface->ifname);
 282
 283         if (iface->learn_routes)
 284                 netlink_setup_route(addr, 128, iface->ifindex, NULL, 1024, add);
 285 }
 286
 287 static void setup_addr_for_relaying(struct in6_addr *addr, struct interface *iface, bool add)
 288 {
 289         struct interface *c;
 290         char ipbuf[INET6_ADDRSTRLEN];
 291
 292         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
 293
 294         list_for_each_entry(c, &interfaces, head) {
 295                 if (iface == c || (c->ndp != MODE_RELAY && !add))
 296                         continue;
 297
 298                 bool neigh_add = (c->ndp == MODE_RELAY ? add : false);
 299
 300                 if (netlink_setup_proxy_neigh(addr, c->ifindex, neigh_add))
 301                         syslog(LOG_DEBUG, "Failed to %s proxy neighbour entry %s%%%s",
 302                                 neigh_add ? "add" : "delete", ipbuf, c->ifname);
 303                 else
 304                         syslog(LOG_DEBUG, "%s proxy neighbour entry %s%%%s",
 305                                 neigh_add ? "Added" : "Deleted", ipbuf, c->ifname);
 306         }
 307 }