passt/merd.c

/* MERD - MacVTap Egress and Routing Daemon
 *
 * Author: Stefano Brivio <sbrivio@redhat.com>
 * License: GPLv2
 *
 * Grab packets from Ethernet interface via AF_PACKET, build AF_INET sockets for
 * each 5-tuple from ICMP, TCP, UDP packets, perform connection tracking and
 * forward them with destination address NAT. Forward packets received on
 * sockets back to the AF_PACKET interface (typically, a macvtap, tap or veth
 * interface towards a network namespace or a VM).
 *
 * TODO:
 * - steal packets from AF_INET sockets (using eBPF/XDP, or a new socket
 *   option): currently, incoming packets are also handled by in-kernel protocol
 *   handlers, so every incoming untracked TCP packet gets a RST. Workaround:
 *	iptables -A OUTPUT -m state --state INVALID,NEW,ESTABLISHED \
 *				-p tcp --tcp-flags RST RST -j DROP
 * - and use XDP sockmap on top of that to improve performance
 * - add IPv6 support. Current workaround on the namespace or machine on the
 *   tap side:
 *	echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
 * - reserve and translate ports
 * - aging and timeout/RST bookkeeping for connection tracking entries
 */

#include <stdio.h>
#include <sys/epoll.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <ifaddrs.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/if_link.h>
#include <net/ethernet.h>
#include <stdlib.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <netdb.h>
#include <string.h>
#include <errno.h>
#include <linux/ip.h>

#define EPOLL_EVENTS	10
#define CT_SIZE		4096

/**
 * struct ct4 - IPv4 connection tracking entry
 * @p:		IANA protocol number
 * @sa:		Source address (as seen from tap interface)
 * @da:		Destination address
 * @sp:		Source port, network order
 * @dp:		Destination port, network order
 * @hd:		Destination MAC address
 * @hs:		Source MAC address
 * @fd:		File descriptor for corresponding AF_INET socket
 */
struct ct4 {
	uint8_t p;
	uint32_t sa;
	uint32_t da;
	uint16_t sp;
	uint16_t dp;
	unsigned char hd[ETH_ALEN];
	unsigned char hs[ETH_ALEN];
	int fd;
};

/**
 * struct ctx - Execution context
 * @epollfd:	file descriptor for epoll instance
 * @ext_addr4:	IPv4 address for external, routable interface
 * @tap_idx:	Interface index for tap interface
 * @fd_tap4:	IPv4 AF_PACKET socket for tap interface
 * @map4:	Connection tracking table
 */
struct ctx {
	int epollfd;
	unsigned long ext_addr4;
	int tap_idx;
	int fd_tap4;
	struct ct4 map4[CT_SIZE];
};

/**
 * sock4_l3() - Create and bind AF_PACKET socket for IPv4, add to epoll list
 * @c:		Execution context
 * @ifn:	Name of tap interface
 * @type:	AF_PACKET protocol type
 *
 * Return: newly created socket, doesn't return on error
 */
static int sock4_l3(struct ctx *c, const char *ifn, int type)
{
	struct sockaddr_ll addr = {
		.sll_family = AF_PACKET,
		.sll_protocol = htons(ETH_P_IP),
		.sll_ifindex = if_nametoindex(ifn),
	};
	struct epoll_event ev = { 0 };
	int fd;

	fd = socket(AF_PACKET, type, htons(ETH_P_IP));
	if (fd < 0) {
		perror("L3 socket");
		exit(EXIT_FAILURE);
	}

	if (bind(fd, (const struct sockaddr *)&addr, sizeof(addr)) < 0) {
		perror("L3 bind");
		exit(EXIT_FAILURE);
	}

	ev.events = EPOLLIN;
	ev.data.fd = fd;
	if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD, fd, &ev) == -1) {
		perror("epoll_ctl");
		exit(EXIT_FAILURE);
	}

	return fd;
}

/**
 * getaddrs_ext() - Fetch IP addresses of external routable interface
 * @c:		Execution context
 * @ifn:	Name of external interface
 */
static void getaddrs_ext(struct ctx *c, const char *ifn)
{
	struct ifaddrs *ifaddr, *ifa;

	if (getifaddrs(&ifaddr) == -1) {
		perror("getifaddrs");
		exit(EXIT_FAILURE);
	}

	for (ifa = ifaddr; ifa; ifa = ifa->ifa_next) {
		struct sockaddr_in *in_addr;

		if (strcmp(ifa->ifa_name, ifn))
			continue;

		if (!ifa->ifa_addr)
			continue;

		if (ifa->ifa_addr->sa_family != AF_INET)
			continue;

		in_addr = (struct sockaddr_in *)ifa->ifa_addr;
		c->ext_addr4 = in_addr->sin_addr.s_addr;
		freeifaddrs(ifaddr);
		return;
	}

	fprintf(stderr, "Couldn't get IPv4 address for external interface\n");
	freeifaddrs(ifaddr);
	exit(EXIT_FAILURE);
}

/**
 * sock4_l4() - Create and bind AF_INET socket for given L4, add to epoll list
 * @c:		Execution context
 * @proto:	Protocol number, network order
 * @port:	L4 port, network order
 *
 * Return: newly created socket, -1 on error
 */
static int sock4_l4(struct ctx *c, uint16_t proto, uint16_t port)
{
	struct sockaddr_in addr = {
		.sin_family = AF_INET,
		.sin_port = port,
		.sin_addr = { .s_addr = c->ext_addr4 },
	};
	struct epoll_event ev = { 0 };
	int fd;

	fd = socket(AF_INET, SOCK_RAW, proto);
	if (fd < 0) {
		perror("L4 socket");
		return -1;
	}

	if (bind(fd, (const struct sockaddr *)&addr, sizeof(addr)) < 0) {
		perror("bind");
		close(fd);
		return -1;
	}

	ev.events = EPOLLIN;
	ev.data.fd = fd;
	if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD, fd, &ev) == -1) {
		perror("epoll_ctl");
		return -1;
	}

	return fd;
}

/**
 * usage() - Print usage and exit
 * @name:	Executable name
 */
void usage(const char *name)
{
	fprintf(stderr, "Usage: %s IF_TAP IF_EXT\n", name);

	exit(EXIT_FAILURE);
}

/**
 * lookup4() - Look up socket entry from tap-sourced packet, create if missing
 * @c:		Execution context
 * @in:		Packet buffer, L2 headers
 *
 * Return: -1 for unsupported or too many sockets, matching socket otherwise
 */
static int lookup4(struct ctx *c, const char *in)
{
	char buf_s[BUFSIZ], buf_d[BUFSIZ];
	struct ct4 *ct = c->map4;
	struct tcphdr *th;
	struct iphdr *iph;
	struct ethhdr *eh;
	int i;

	eh = (struct ethhdr *)in;
	iph = (struct iphdr *)(in + ETH_HLEN);
	th = (struct tcphdr *)(iph + 1);

	switch (iph->protocol) {
	case IPPROTO_ICMP:
	case IPPROTO_TCP:
	case IPPROTO_UDP:
		break;
	default:
		return -1;
	}

	for (i = 0; i < CT_SIZE; i++) {
		if (ct[i].p == iph->protocol &&
		    ct[i].sa == iph->saddr && ct[i].da == iph->daddr &&
		    (ct[i].p == IPPROTO_ICMP ||
		     (ct[i].sp == th->source && ct[i].dp == th->dest)) &&
		    !memcmp(ct[i].hd, eh->h_dest, ETH_ALEN) &&
		    !memcmp(ct[i].hs, eh->h_source, ETH_ALEN))
			return ct[i].fd;
	}

	for (i = 0; i < CT_SIZE && ct[i].p; i++);

	if (i == CT_SIZE) {
		fprintf(stderr, "\nToo many sockets, aborting ");
	} else {
		ct[i].fd = sock4_l4(c, iph->protocol, th->source);

		fprintf(stderr, "\n(socket %i) New ", ct[i].fd);
		ct[i].p = iph->protocol;
		ct[i].sa = iph->saddr;
		ct[i].da = iph->daddr;
		if (iph->protocol != IPPROTO_ICMP) {
			ct[i].sp = th->source;
			ct[i].dp = th->dest;
		}
		memcpy(&ct[i].hd, eh->h_dest, ETH_ALEN);
		memcpy(&ct[i].hs, eh->h_source, ETH_ALEN);
	}

	if (iph->protocol == IPPROTO_ICMP) {
		fprintf(stderr, "icmp connection\n\tfrom %s to %s\n\n",
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)));
	} else {
		fprintf(stderr, "%s connection\n\tfrom %s:%i to %s:%i\n\n",
			getprotobynumber(iph->protocol)->p_name,
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			ntohs(th->source),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)),
			ntohs(th->dest));
	}

	return (i == CT_SIZE) ? -1 : ct[i].fd;
}

/**
 * lookup4_r4() - Reverse look up connection tracking entry from incoming packet
 * @ct:		Connection tracking table
 * @in:		Packet buffer, L3 headers
 *
 * Return: matching entry if any, NULL otherwise
 */
struct ct4 *lookup_r4(struct ct4 *ct, const char *in)
{
	struct tcphdr *th;
	struct iphdr *iph;
	int i;

	iph = (struct iphdr *)in;
	th = (struct tcphdr *)(iph + 1);

	for (i = 0; i < CT_SIZE; i++) {
		if (iph->protocol == ct[i].p &&
		    iph->saddr == ct[i].da &&
		    (iph->protocol == IPPROTO_ICMP ||
		     (th->source == ct[i].dp && th->dest == ct[i].sp)))
			return &ct[i];
	}

	return NULL;
}

/**
 * nat4_out() - Perform outgoing IPv4 address translation
 * @addr:	Source address to be used
 * @in:		Packet buffer, L3 headers
 */
static void nat4_out(unsigned long addr, const char *in)
{
	struct iphdr *iph = (struct iphdr *)in;

	iph->saddr = addr;
}

/**
 * nat4_in() - Perform incoming IPv4 address translation
 * @addr:	Original destination address to be used
 * @in:		Packet buffer, L3 headers
 */
static void nat_in(unsigned long addr, const char *in)
{
	struct iphdr *iph = (struct iphdr *)in;

	iph->daddr = addr;
}

/**
 * csum_fold() - Fold long sum for IP and TCP checksum
 * @sum:	Original long sum
 *
 * Return: 16-bit folded sum
 */
static uint16_t csum_fold(uint32_t sum)
{
	while (sum >> 16)
		sum = (sum & 0xffff) + (sum >> 16);

	return sum;
}

/**
 * csum_ipv4() - Calculate IPv4 checksum
 * @buf:	Packet buffer, L3 headers
 * @len:	Total L3 packet length
 *
 * Return: 16-bit IPv4-style checksum
 */
static uint16_t csum_ip4(void *buf, size_t len)
{
	uint32_t sum = 0;
	uint16_t *p = buf;
	size_t len1 = len / 2;
	size_t off;

	for (off = 0; off < len1; off++, p++)
		sum += *p;

	if (len % 2)
		sum += *p & 0xff;

	return ~csum_fold(sum);
}

/**
 * csum_ipv4() - Calculate TCP checksum for IPv4 and set in place
 * @in:		Packet buffer, L3 headers
 */
static void csum_tcp4(uint16_t *in)
{
	struct iphdr *iph = (struct iphdr *)in;
	struct tcphdr *th;
	uint16_t tcp_len;
	uint32_t sum = 0;

	tcp_len = ntohs(iph->tot_len) - (iph->ihl << 2);
	th = (struct tcphdr *)(iph + 1);
	in = (uint16_t *)th;

	sum += (iph->saddr >> 16) & 0xffff;
	sum += iph->saddr & 0xffff;
	sum += (iph->daddr >> 16) & 0xffff;
	sum += iph->daddr & 0xffff;

	sum += htons(IPPROTO_TCP);
	sum += htons(tcp_len);

	th->check = 0;
	while (tcp_len > 1) {
		sum += *in++;
		tcp_len -= 2;
	}

	if (tcp_len > 0) {
		sum += *in & htons(0xff00);
	}

	th->check = (uint16_t)~csum_fold(sum);
}

/**
 * tap4_handler() - Packet handler for tap interface
 * @c:		Execution context
 * @len:	Total L2 packet length
 * @in:		Packet buffer, L2 headers
 */
static void tap4_handler(struct ctx *c, int len, char *in)
{
	struct iphdr *iph = (struct iphdr *)(in + ETH_HLEN);
	struct tcphdr *th = (struct tcphdr *)(iph + 1);
	struct udphdr *uh = (struct udphdr *)(iph + 1);
	struct sockaddr_in addr = {
		.sin_family = AF_INET,
		.sin_port = th->dest,
		.sin_addr = { .s_addr = iph->daddr },
	};
	char buf_s[BUFSIZ], buf_d[BUFSIZ];
	int fd;

	fd = lookup4(c, in);
	if (fd == -1)
		return;

	nat4_out(c->ext_addr4, in + ETH_HLEN);

	switch (iph->protocol) {
	case IPPROTO_TCP:
		csum_tcp4((uint16_t *)(in + ETH_HLEN));
		break;
	case IPPROTO_UDP:
		uh->check = 0;
		break;
	case IPPROTO_ICMP:
		break;
	default:
		return;
	}

	if (iph->protocol == IPPROTO_ICMP) {
		fprintf(stderr, "icmp from tap: %s -> %s (socket %i)\n",
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)),
			fd);
	} else {
		fprintf(stderr, "%s from tap: %s:%i -> %s:%i (socket %i)\n",
			getprotobynumber(iph->protocol)->p_name,
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			ntohs(th->source),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)),
			ntohs(th->dest),
			fd);
	}

	if (sendto(fd, in + sizeof(struct ethhdr) + sizeof(struct iphdr),
		   len - sizeof(struct ethhdr) - 4 * iph->ihl, 0,
		   (struct sockaddr *)&addr, sizeof(addr)) < 0)
		perror("sendto");

}

/**
 * tap4_handler() - Packet handler for external routable interface
 * @c:		Execution context
 * @len:	Total L3 packet length
 * @in:		Packet buffer, L3 headers
 */
static void ext4_handler(struct ctx *c, int len, char *in)
{
	struct sockaddr_ll addr = {
		.sll_family = AF_PACKET,
		.sll_protocol = ntohs(ETH_P_IP),
		.sll_ifindex = c->tap_idx,
		.sll_halen = ETHER_ADDR_LEN,
	};
	struct iphdr *iph = (struct iphdr *)in;
	struct tcphdr *th = (struct tcphdr *)(iph + 1);
	char buf_s[BUFSIZ], buf_d[BUFSIZ];
	struct ethhdr *eh;
	struct ct4 *entry;
	char buf[1 << 16];

	entry = lookup_r4(c->map4, in);
	if (!entry)
		return;

	nat_in(entry->sa, in);

	iph->check = 0;
	iph->check = csum_ip4(iph, 4 * iph->ihl);

	if (iph->protocol == IPPROTO_TCP)
		csum_tcp4((uint16_t *)in);
	else if (iph->protocol == IPPROTO_UDP) {
		struct udphdr *uh = (struct udphdr *)(iph + 1);
		uh->check = 0;
	}

	memcpy(&addr.sll_addr, entry->hs, ETH_ALEN);

	eh = (struct ethhdr *)buf;
	memcpy(eh->h_dest, entry->hs, ETH_ALEN);
	memcpy(eh->h_source, entry->hd, ETH_ALEN);
	eh->h_proto = ntohs(ETH_P_IP);

	memcpy(buf + sizeof(struct ethhdr), in, len);

	if (iph->protocol == IPPROTO_ICMP) {
		fprintf(stderr, "icmp (socket %i) to tap: %s -> %s\n",
			entry->fd,
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)));
	} else {
		fprintf(stderr, "%s (socket %i) to tap: %s:%i -> %s:%i\n",
			getprotobynumber(iph->protocol)->p_name,
			entry->fd,
			inet_ntop(AF_INET, &iph->saddr, buf_s, sizeof(buf_s)),
			ntohs(th->source),
			inet_ntop(AF_INET, &iph->daddr, buf_d, sizeof(buf_d)),
			ntohs(th->dest));
	}

	if (sendto(c->fd_tap4, buf, len + sizeof(struct ethhdr), 0,
		   (struct sockaddr *)&addr, sizeof(addr)) < 0)
		perror("sendto");
}

/**
 * main() - Entry point and main loop
 * @argc:	Argument count
 * @argv:	Interface names
 *
 * Return: 0 once interrupted, non-zero on failure
 */
int main(int argc, char **argv)
{
	struct epoll_event events[EPOLL_EVENTS];
	const char *if_tap, *if_ext;
	struct ctx c = { 0 };
	char buf[1 << 16];
	int nfds, i, len;

	if (argc != 3)
		usage(argv[0]);
	if_tap = argv[1];
	if_ext = argv[2];

	getaddrs_ext(&c, if_ext);
	c.tap_idx = if_nametoindex(if_tap);

	c.epollfd = epoll_create1(0);
	if (c.epollfd == -1) {
		perror("epoll_create1");
		exit(EXIT_FAILURE);
	}

	c.fd_tap4 = sock4_l3(&c, if_tap, SOCK_RAW);

loop:
	nfds = epoll_wait(c.epollfd, events, EPOLL_EVENTS, -1);
	if (nfds == -1) {
		perror("epoll_wait");
		exit(EXIT_FAILURE);
	}

	for (i = 0; i < nfds; i++) {
		len = recv(events[i].data.fd, buf, sizeof(buf), MSG_DONTWAIT);
		if (len == 0)
			continue;
		if (len < 0) {
			if (errno == EAGAIN || errno == EWOULDBLOCK)
				break;
			goto out;
		}

		if (events[i].data.fd == c.fd_tap4)
			tap4_handler(&c, len, buf);
		else
			ext4_handler(&c, len, buf);
	}

	goto loop;

out:
	return 0;
}