WIP: IPv6 support

cmd/gvproxy/main.go

@@ -108,6 +108,7 @@ func main() {
 		MTU:               mtu,
 		Subnet:            "192.168.127.0/24",
 		GatewayIP:         gatewayIP,
+		GatewayIPv6:       "fe80::1",
 		GatewayMacAddress: "5a:94:ef:e4:0c:dd",
 		DHCPStaticLeases: map[string]string{
 			"192.168.127.2": "5a:94:ef:e4:0c:ee",

pkg/services/dns/dns.go

@@ -107,7 +107,28 @@ func (h *dnsHandler) addAnswers(m *dns.Msg) {
 					A: ip.IP.To4(),
 				})
 			}
+		case dns.TypeAAAA:
+			ips, err := resolver.LookupIPAddr(context.TODO(), q.Name)
+			if err != nil {
+				m.Rcode = dns.RcodeNameError
+				return
+			}
+			for _, ip := range ips {
+				if len(ip.IP) != net.IPv6len {
+					continue
+				}
+				m.Answer = append(m.Answer, &dns.AAAA{
+					Hdr: dns.RR_Header{
+						Name:   q.Name,
+						Rrtype: dns.TypeAAAA,
+						Class:  dns.ClassINET,
+						Ttl:    0,
+					},
+					AAAA: ip.IP.To16(),
+				})
+			}
 		}
+
 	}
 }
 

pkg/services/forwarder/tcp.go

@@ -2,8 +2,8 @@ package forwarder
 
 import (
 	"context"
-	"fmt"
 	"net"
+	"strconv"
 	"sync"
 
 	"github.com/google/tcpproxy"
@@ -31,7 +31,7 @@ func TCP(s *stack.Stack, nat map[tcpip.Address]tcpip.Address, natLock *sync.Mute
 			localAddress = replaced
 		}
 		natLock.Unlock()
-		outbound, err := net.Dial("tcp", fmt.Sprintf("%s:%d", localAddress, r.ID().LocalPort))
+		outbound, err := net.Dial("tcp", net.JoinHostPort(localAddress.String(), strconv.Itoa(int(r.ID().LocalPort))))
 		if err != nil {
 			log.Errorf("net.Dial() = %v", err)
 			r.Complete(true)

pkg/services/forwarder/udp.go

@@ -1,8 +1,8 @@
 package forwarder
 
 import (
-	"fmt"
 	"net"
+	"strconv"
 	"sync"
 
 	log "github.com/sirupsen/logrus"
@@ -36,7 +36,7 @@ func UDP(s *stack.Stack, nat map[tcpip.Address]tcpip.Address, natLock *sync.Mute
 		}
 
 		p, _ := NewUDPProxy(&autoStoppingListener{underlying: gonet.NewUDPConn(s, &wq, ep)}, func() (net.Conn, error) {
-			return net.Dial("udp", fmt.Sprintf("%s:%d", localAddress, r.ID().LocalPort))
+			return net.Dial("udp", net.JoinHostPort(localAddress.String(), strconv.Itoa(int(r.ID().LocalPort))))
 		})
 		go p.Run()
 	})

pkg/tap/link.go

@@ -9,7 +9,9 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
 )
 
 type LinkEndpoint struct {
@@ -111,6 +113,17 @@ func (e *LinkEndpoint) WritePacket(r stack.RouteInfo, protocol tcpip.NetworkProt
 		}
 	}
 
+	if pkt.NetworkProtocolNumber == ipv6.ProtocolNumber && pkt.TransportProtocolNumber == icmp.ProtocolNumber6 {
+		transportLayer := header.ICMPv6(pkt.TransportHeader().View())
+		if transportLayer.Type() == header.ICMPv6NeighborAdvert {
+			ip := header.NDPNeighborAdvert(transportLayer.MessageBody()).TargetAddress().String()
+			if ip != "fe80::1" {
+				log.Debugf("dropping spoofing packets from the gateway about IP %s", ip)
+				return nil
+			}
+		}
+	}
+
 	if e.debug {
 		vv := buffer.NewVectorisedView(pkt.Size(), pkt.Views())
 		packet := gopacket.NewPacket(vv.ToView(), layers.LayerTypeEthernet, gopacket.Default)

pkg/tap/router_advertisement.go

@@ -0,0 +1,83 @@
+package tap
+
+import (
+	"encoding/binary"
+
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+)
+
+// raBuf returns a valid NDP Router Advertisement with options, router
+// preference and DHCPv6 configurations specified.
+func raBuf(src, dst tcpip.LinkAddress, ip tcpip.Address, rl uint16, managedAddress, otherConfigurations bool, prf header.NDPRoutePreference, optSer header.NDPOptionsSerializer) *stack.PacketBuffer {
+	const flagsByte = 1
+	const routerLifetimeOffset = 2
+
+	icmpSize := header.ICMPv6HeaderSize + header.NDPRAMinimumSize + optSer.Length()
+	hdr := buffer.NewPrependable(header.EthernetMinimumSize + header.IPv6MinimumSize + icmpSize)
+	pkt := header.ICMPv6(hdr.Prepend(icmpSize))
+	pkt.SetType(header.ICMPv6RouterAdvert)
+	pkt.SetCode(0)
+	raPayload := pkt.MessageBody()
+	ra := header.NDPRouterAdvert(raPayload)
+	// Populate the Router Lifetime.
+	binary.BigEndian.PutUint16(raPayload[routerLifetimeOffset:], rl)
+	// Populate the Managed Address flag field.
+	if managedAddress {
+		// The Managed Addresses flag field is the 7th bit of the flags byte.
+		raPayload[flagsByte] |= 1 << 7
+	}
+	// Populate the Other Configurations flag field.
+	if otherConfigurations {
+		// The Other Configurations flag field is the 6th bit of the flags byte.
+		raPayload[flagsByte] |= 1 << 6
+	}
+	// The Prf field is held in the flags byte.
+	raPayload[flagsByte] |= byte(prf) << 3
+	opts := ra.Options()
+	opts.Serialize(optSer)
+	pkt.SetChecksum(header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
+		Header: pkt,
+		Src:    ip,
+		Dst:    header.IPv6AllNodesMulticastAddress,
+	}))
+	payloadLength := hdr.UsedLength()
+	iph := header.IPv6(hdr.Prepend(header.IPv6MinimumSize))
+	iph.Encode(&header.IPv6Fields{
+		PayloadLength:     uint16(payloadLength),
+		TransportProtocol: icmp.ProtocolNumber6,
+		HopLimit:          header.NDPHopLimit,
+		SrcAddr:           ip,
+		DstAddr:           header.IPv6AllNodesMulticastAddress,
+	})
+
+	eth := header.Ethernet(hdr.Prepend(header.EthernetMinimumSize))
+	eth.Encode(&header.EthernetFields{
+		Type:    ipv6.ProtocolNumber,
+		SrcAddr: src,
+		DstAddr: dst,
+	})
+	return stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Data: hdr.View().ToVectorisedView(),
+	})
+}
+
+// raBufWithOpts returns a valid NDP Router Advertisement with options.
+//
+// Note, raBufWithOpts does not populate any of the RA fields other than the
+// Router Lifetime.
+func raBufWithOpts(src, dst tcpip.LinkAddress, ip tcpip.Address, rl uint16, optSer header.NDPOptionsSerializer) *stack.PacketBuffer {
+	return raBuf(src, dst, ip, rl, false /* managedAddress */, false /* otherConfigurations */, 0 /* prf */, optSer)
+}
+
+// raBuf returns a valid NDP Router Advertisement.
+//
+// Note, raBuf does not populate any of the RA fields other than the
+// Router Lifetime.
+func raBufSimple(src, dst tcpip.LinkAddress, ip tcpip.Address, rl uint16) *stack.PacketBuffer {
+	return raBufWithOpts(src, dst, ip, rl, header.NDPOptionsSerializer{})
+}

pkg/tap/switch.go

@@ -15,6 +15,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
 
@@ -121,7 +122,7 @@ func (e *Switch) tx(src, dst tcpip.LinkAddress, pkt *stack.PacketBuffer) error {
 	e.connLock.Lock()
 	defer e.connLock.Unlock()
 
-	if dst == header.EthernetBroadcastAddress {
+	if dst == header.EthernetBroadcastAddress || header.IsMulticastEthernetAddress(dst) {
 		e.camLock.RLock()
 		srcID, ok := e.cam[src]
 		if !ok {
@@ -217,14 +218,27 @@ loop:
 		e.cam[eth.SourceAddress()] = id
 		e.camLock.Unlock()
 
+		if eth.Type() == ipv6.ProtocolNumber {
+			networkLayer := header.IPv6(buf[header.EthernetMinimumSize:])
+			if networkLayer.TransportProtocol() == header.ICMPv6ProtocolNumber {
+				transportLayer := header.ICMPv6(networkLayer.Payload())
+				if transportLayer.Type() == header.ICMPv6RouterSolicit {
+					routerAdvertisement := raBufSimple(e.gateway.LinkAddress(), eth.SourceAddress(), tcpip.Address(net.ParseIP("fe80::1")), 1000)
+					if err := e.tx(e.gateway.LinkAddress(), eth.SourceAddress(), routerAdvertisement); err != nil {
+						log.Error(err)
+					}
+				}
+			}
+		}
+
 		if eth.DestinationAddress() != e.gateway.LinkAddress() {
 			if err := e.tx(eth.SourceAddress(), eth.DestinationAddress(), stack.NewPacketBuffer(stack.PacketBufferOptions{
 				Data: vv,
 			})); err != nil {
 				log.Error(err)
 			}
 		}
-		if eth.DestinationAddress() == e.gateway.LinkAddress() || eth.DestinationAddress() == header.EthernetBroadcastAddress {
+		if eth.DestinationAddress() == e.gateway.LinkAddress() || eth.DestinationAddress() == header.EthernetBroadcastAddress || header.IsMulticastEthernetAddress(eth.DestinationAddress()) {
 			vv.TrimFront(header.EthernetMinimumSize)
 			e.gateway.DeliverNetworkPacket(
 				eth.SourceAddress(),

pkg/types/configuration.go

@@ -22,6 +22,9 @@ type Configuration struct {
 	// IP address of the virtual gateway
 	GatewayIP string
 
+	// IPv6 address of the virtual gateway. Prefix will be 64.
+	GatewayIPv6 string
+
 	// MAC address of the virtual gateway
 	GatewayMacAddress string
 

pkg/virtualnetwork/virtualnetwork.go

@@ -13,6 +13,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/link/sniffer"
 	"gvisor.dev/gvisor/pkg/tcpip/network/arp"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
@@ -99,13 +100,15 @@ func (n *VirtualNetwork) BytesReceived() uint64 {
 func createStack(configuration *types.Configuration, endpoint stack.LinkEndpoint) (*stack.Stack, error) {
 	s := stack.New(stack.Options{
 		NetworkProtocols: []stack.NetworkProtocolFactory{
+			ipv6.NewProtocol,
 			ipv4.NewProtocol,
 			arp.NewProtocol,
 		},
 		TransportProtocols: []stack.TransportProtocolFactory{
 			tcp.NewProtocol,
 			udp.NewProtocol,
 			icmp.NewProtocol4,
+			icmp.NewProtocol6,
 		},
 	})
 
@@ -119,6 +122,15 @@ func createStack(configuration *types.Configuration, endpoint stack.LinkEndpoint
 	}, stack.AddressProperties{}); err != nil {
 		return nil, errors.New(err.String())
 	}
+	if err := s.AddProtocolAddress(1, tcpip.ProtocolAddress{
+		Protocol: ipv6.ProtocolNumber,
+		AddressWithPrefix: tcpip.AddressWithPrefix{
+			Address:   tcpip.Address(net.ParseIP(configuration.GatewayIPv6)),
+			PrefixLen: 64,
+		},
+	}, stack.AddressProperties{}); err != nil {
+		return nil, errors.New(err.String())
+	}
 
 	s.SetSpoofing(1, true)
 	s.SetPromiscuousMode(1, true)

test/basic_test.go

@@ -58,4 +58,24 @@ var _ = Describe("dns", func() {
 		Expect(err).ShouldNot(HaveOccurred())
 		Expect(string(out)).To(ContainSubstring("Address: 192.168.127.254"))
 	})
+
+	It("should resolve ipv6", func() {
+		out, err := sshExec("nslookup ipv6.google.com")
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(string(out)).To(ContainSubstring("Address: 2a00:1450:4007:810::200e"))
+	})
+})
+
+var _ = Describe("ipv6", func() {
+	It("tcp should work", func() {
+		out, err := sshExec("curl ipv6.google.com")
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(string(out)).To(ContainSubstring("<!doctype html>"))
+	})
+
+	It("udp should work", func() {
+		out, err := sshExec("dig ipv6.google.com @2001:4860:4860::8888")
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(string(out)).To(ContainSubstring("opcode: QUERY, status: NOERROR"))
+	})
 })