xlat 0.1.0.alpha1

data/fuzz/instrumentation.rb

@@ -0,0 +1,13 @@
+class IO::Buffer
+  def <=>(other)
+    return -1 if self.size < other.size
+    return +1 if self.size > other.size
+
+    self.size.times do |i|
+      cmp = self.get_value(:U8, i) <=> self.get_value(:U8, i)
+      return cmp if cmp != 0
+    end
+
+    return 0
+  end
+end

data/fuzz/run

@@ -0,0 +1,11 @@
+#!/usr/bin/bash
+
+if ! bundle exec ruby -e 'exit(RbConfig::CONFIG["CC"] =~ /\Aclang/ ? 0 : 1)'; then
+  echo "!! Ruby needs to be built with clang !!" >&2
+fi
+
+bundle install --with=fuzz
+
+export ASAN_OPTIONS="allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0"
+
+bundle exec env LD_PRELOAD="$(bundle exec ruby -r ruzzy -e 'puts Ruzzy::ASAN_PATH')" ruby fuzz/test_tracer.rb fuzz/corpus "$@"

data/fuzz/test_harness.rb

@@ -0,0 +1,38 @@
+require_relative './instrumentation'
+
+require 'ruzzy'
+require 'xlat/rfc7915'
+require 'xlat/address_translators/rfc6052'
+require 'xlat/protocols/ip'
+
+@xlat = Xlat::Rfc7915.new(
+  source_address_translator: Xlat::AddressTranslators::Rfc6052.new('2001:db8:60::/96'),
+  destination_address_translator: Xlat::AddressTranslators::Rfc6052.new('2001:db8:64::/96'),
+)
+
+def fuzzing_target(input)
+  buffer = IO::Buffer.new(input.bytesize)
+  buffer.set_string(input)
+  pkt = Xlat::Protocols::Ip.parse(buffer)
+  return unless pkt
+
+  case pkt.version.to_i
+  when 4
+    output = @xlat.translate_to_ipv6(pkt, 1500)
+  when 6
+    output = @xlat.translate_to_ipv4(pkt, 1500)
+  else
+    fail 'unknown IP version'
+  end
+
+  return output
+ensure
+  @xlat.return_buffer_ownership
+end
+
+test_one_input = lambda do |data|
+  fuzzing_target(data) ? 0 : -1
+end
+
+RubyVM::YJIT.enable
+Ruzzy.fuzz(test_one_input)

data/fuzz/test_tracer.rb

@@ -0,0 +1,16 @@
+require_relative '../spec/test_packets.rb'
+require 'digest/sha1'
+require 'pathname'
+
+corpus_dir = Pathname(__dir__).join('corpus').tap(&:mkpath)
+TestPackets.constants.each do |k|
+  val = TestPackets.const_get(k)
+  next unless val.is_a?(IO::Buffer)
+
+  digest = Digest::SHA1.hexdigest(val.get_string)
+  File.write(corpus_dir + digest, val.get_string)
+end
+
+require 'ruzzy'
+
+Ruzzy.trace('test_harness.rb')

data/lib/xlat/adapters/linux_tun.rb

@@ -0,0 +1,55 @@
+require 'socket'
+require 'xlat/io_buffer_ext'
+
+module Xlat
+  module Adapters
+    class LinuxTun
+      DEV_TUN = -'/dev/net/tun'
+      IFF_TUN = 0x0001
+      IFF_MULTI_QUEUE = 0x0100
+      IFF_NO_PI = 0x1000
+      TUNSETIFF = 0x400454ca
+      SIOCSIFMTU = 0x8922
+
+      def initialize(ifname, multiqueue: false)
+        unless ifname.bytesize < Socket::IFNAMSIZ  # maxlen including the terminating NUL
+          raise ArgumentError, "Too long interface name: #{ifname}"
+        end
+
+        @ifname = ifname
+        @mtu = 1500
+        @io = File.open(DEV_TUN, 'r+:BINARY')
+        options = IFF_TUN | (multiqueue ? IFF_MULTI_QUEUE : 0) | IFF_NO_PI
+        @io.ioctl(TUNSETIFF, [@ifname, options].pack("a#{Socket::IFNAMSIZ}s!"))
+      end
+
+      attr_reader :mtu
+
+      def mtu=(value)
+        Socket.open(Socket::AF_INET, Socket::SOCK_STREAM, 0) do |sock|
+          sock.ioctl(SIOCSIFMTU, [@ifname, value].pack("a#{Socket::IFNAMSIZ}i!"))
+        end
+        @mtu = value
+      end
+
+      def read(buf)
+        IOBufferExt.readv(@io, [buf])
+      end
+
+      def write(*bufs)
+        IOBufferExt.writev(@io, bufs)
+      end
+
+      def close
+        @io.close
+      end
+
+      def self.open(...)
+        tun = new(...)
+        yield tun
+      ensure
+        tun&.close
+      end
+    end
+  end
+end

data/lib/xlat/address_translation.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Xlat
+  module AddressTranslation
+    # Translate IPv6 address bytestring into IPv4 address and write to given buffer
+    # Must return true when translation took place
+    #
+    # @param ipv6_address [IO::Buffer] IPv6 address buffer
+    # @param buffer [IO::Buffer] Destination packet buffer
+    # @param offset [Integer] Offset in buffer to write IPv6 address
+    # @return [Integer, nil] checksum delta value or nil when no translation took place
+    def translate_address_to_ipv4(ipv6_address,buffer,offset = 0)
+      raise NotImplementedError
+    end
+
+    # Translate IPv4 address bytestring into IPv6 address and write to given buffer
+    #
+    # @param ipv4_address [IO::Buffer] IPv4 address buffer
+    # @param buffer [IO::Buffer] Destination packet buffer
+    # @param offset [Integer] Offset in buffer to write IPv4 address
+    # @return [Integer, nil] checksum delta value or nil when no translation took place
+    def translate_address_to_ipv6(ipv4_address,buffer,offset = 0)
+      raise NotImplementedError
+    end
+
+    # # Must return true when receiver (translator) can perform in checksum neutral manner
+    # # https://datatracker.ietf.org/doc/html/rfc6052#section-4.1
+    # def checksum_neutral?
+    #   false
+    # end
+  end
+end

data/lib/xlat/address_translators/rfc6052.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+require 'xlat/address_translation'
+require 'xlat/common'
+require 'ipaddr'
+
+module Xlat
+  module AddressTranslators
+    # RFC 6052 based IPv4/IPv6 address translator. Accepts Pref64n::/96.
+    #
+    # https://www.rfc-editor.org/info/rfc6052
+    # https://datatracker.ietf.org/doc/html/rfc6052
+    class Rfc6052
+      include Xlat::AddressTranslation
+
+      def initialize(pref64n_string)
+        @pref64n = IPAddr.new(pref64n_string, Socket::AF_INET6)
+        unless @pref64n.prefix == 96
+          raise ArgumentError, "#{self.class.name} only supports Pref64::/96"
+        end
+
+        @pref64n_prefix = IO::Buffer.for(@pref64n.hton).slice(0, 12)
+        unless @pref64n_prefix.get_value(:U8, 8) == 0
+          raise ArgumentError, "Bits 64-71 in Pref64::/96 must be all zeroes"
+        end
+
+        @cs_delta = Xlat::Common.sum16be(@pref64n_prefix)
+        @cs_delta = 0 if @cs_delta % 0xffff == 0 # checksum neutrality
+        @negative_cs_delta = -@cs_delta
+      end
+
+      def translate_address_to_ipv4(ipv6_address,buffer,offset = 0)
+        return unless (ipv6_address.slice(0, @pref64n_prefix.size) <=> @pref64n_prefix) == 0
+        buffer.copy(ipv6_address, offset, 4, 12)
+
+        @negative_cs_delta
+      end
+
+      def translate_address_to_ipv6(ipv4_address,buffer,offset = 0)
+        buffer.copy(@pref64n_prefix, offset, 12)
+        buffer.copy(ipv4_address, offset + 12, 4)
+
+        @cs_delta
+      end
+    end
+  end
+end

data/lib/xlat/common.rb

@@ -0,0 +1,13 @@
+module Xlat
+  module Common
+    module_function
+
+    def sum16be(buffer)
+      sum = 0
+      buffer.each(:U16) do |_, x|
+        sum += x
+      end
+      sum
+    end
+  end
+end

data/lib/xlat/pcap.rb

@@ -0,0 +1,48 @@
+# https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcap/04/
+
+module Xlat
+  class Pcap
+    attr_reader :io, :snap_len
+
+    def initialize(io, snap_len: 0xffff)
+      @io = io
+      @snap_len = snap_len
+
+      write_header
+    end
+
+    MAGIC = 0xA1B23C4D  # nanosec timestamp
+    MAJOR = 2
+    MINOR = 4
+    LINKTYPE_RAW = 101  # raw IP
+
+    private def write_header
+      h = IO::Buffer.new(24)
+      h.set_values(%i[u32 u16 u16 u32 u32 u32 u32], 0, [
+        MAGIC,
+        MAJOR, MINOR,
+        0,
+        0,
+        @snap_len,
+        LINKTYPE_RAW,
+      ])
+
+      h.write(@io)
+    end
+
+    def write(packet, ts: Time.now)
+      caplen = [packet.size, @snap_len].min
+
+      h = IO::Buffer.new(16)
+      h.set_values(%i[u32 u32 u32 u32], 0, [
+        ts.to_i,
+        ts.nsec,
+        caplen,
+        packet.size,
+      ])
+
+      h.write(@io)
+      packet.write(@io, caplen)
+    end
+  end
+end

data/lib/xlat/protocols/icmp/base.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+# This file is based on the source code available at https://github.com/kazuho/rat under MIT License
+# 
+# Copyright (c) 2022 Kazuho Oku
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+# 
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'xlat/common'
+
+module Xlat
+  module Protocols
+    module Icmp
+      class Base
+        include Xlat::Common
+
+        V4_PROTOCOL_ID = 1
+        V6_PROTOCOL_ID = 58
+
+        attr_reader :type, :code
+
+        def initialize(packet)
+          @packet = packet
+        end
+
+        def _parse
+          bytes = @packet.l4_bytes
+          offset = @packet.l4_bytes_offset
+
+          @type = bytes.get_value(:U8, offset)
+          @code = bytes.get_value(:U8, offset + 1)
+
+          self
+        end
+
+        def self.parse(packet)
+          bytes = packet.l4_bytes
+          offset = packet.l4_bytes_offset
+
+          return nil if packet.l4_bytes_length < 8
+
+          type = bytes.get_value(:U8, offset)
+          icmp = packet.version.new_icmp(packet, type)
+          icmp._parse
+        end
+
+        def apply(cs_delta)
+          # ICMP does not use pseudo headers
+        end
+
+        def self.recalculate_checksum(packet)
+          packet.bytes.set_value(:U16, packet.l4_start + 2, 0)
+          checksum = Ip.checksum(packet.bytes, packet.l4_start)
+          checksum = Ip.checksum_adjust(checksum, packet.version.icmp_cs_delta(packet)) # pseudo header
+          packet.bytes.set_value(:U16, packet.l4_start + 2, checksum)
+        end
+      end
+    end
+  end
+end

data/lib/xlat/protocols/icmp/echo.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# This file is based on the source code available at https://github.com/kazuho/rat under MIT License
+# 
+# Copyright (c) 2022 Kazuho Oku
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+# 
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require_relative './base'
+
+module Xlat
+  module Protocols
+    module Icmp
+      class Echo < Base
+        V4_TYPE_REQUEST = 8
+        V4_TYPE_REPLY = 0
+        V6_TYPE_REQUEST = 128
+        V6_TYPE_REPLY = 129
+
+        attr_accessor :src_port, :dest_port
+
+        def initialize(packet, is_req)
+          super(packet)
+          @is_req = is_req
+        end
+
+        def _parse
+          super
+
+          port = @packet.bytes.get_value(:U16, @packet.l4_start + 4)
+          if @is_req
+            @src_port = port
+            @dest_port = 0
+          else
+            @src_port = 0
+            @dest_port = port
+          end
+
+          self
+        end
+
+        def tuple
+          [src_port, dest_port].pack('n*')
+        end
+
+        def apply(cs_delta)
+          #string_set16be(@packet.bytes,@packet.l4_start + 4, @is_req ? @src_port : @dest_port)
+          #Base.recalculate_checksum(@packet)
+        end
+      end
+    end
+  end
+end
+
+