atunnel: support IPv6 original destination lookup

internal/atunnel/original_dst_linux.go

@@ -18,6 +18,7 @@ package atunnel
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"net"
 	"strconv"
@@ -26,10 +27,12 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// TCPOriginalDestination reads the IPv4 destination preserved by a Linux
-// REDIRECT rule. Actor networking is currently IPv4-only.
-// TODO(liorlieberman) add the IPv6 IP6T_SO_ORIGINAL_DST variant
-// when actor veth setup gains dual-stack support.
+// IP6T_SO_ORIGINAL_DST is not generated by golang.org/x/sys/unix. It is
+// defined as 80 in linux/netfilter_ipv6/ip6_tables.h.
+const ip6tSOOriginalDst = 80
+
+// TCPOriginalDestination reads the IPv4 or IPv6 destination preserved by a
+// Linux REDIRECT rule.
 func TCPOriginalDestination(conn net.Conn) (string, error) {
 	tcpConn, ok := conn.(*net.TCPConn)
 	if !ok {
@@ -40,33 +43,60 @@ func TCPOriginalDestination(conn net.Conn) (string, error) {
 		return "", fmt.Errorf("atunnel: acquiring TCP syscall connection: %w", err)
 	}
 
-	var addr unix.RawSockaddrInet4
 	var sockoptErr error
+	var destination string
 	if err := rawConn.Control(func(fd uintptr) {
-		size := uint32(unsafe.Sizeof(addr))
-		_, _, errno := unix.Syscall6(
-			unix.SYS_GETSOCKOPT,
-			fd,
-			unix.SOL_IP,
-			unix.SO_ORIGINAL_DST,
-			uintptr(unsafe.Pointer(&addr)),
-			uintptr(unsafe.Pointer(&size)),
-			0,
-		)
-		if errno != 0 {
-			sockoptErr = errno
+		destination, sockoptErr = originalIPv4Destination(fd)
+		// Linux returns ENOENT when the IPv4 original-destination option is
+		// queried on a redirected IPv6 connection. Only then try the IPv6
+		// equivalent, so unrelated IPv4 failures retain their original error.
+		if errors.Is(sockoptErr, unix.ENOENT) {
+			destination, sockoptErr = originalIPv6Destination(fd)
 		}
 	}); err != nil {
 		return "", fmt.Errorf("atunnel: accessing TCP socket: %w", err)
 	}
 	if sockoptErr != nil {
 		return "", fmt.Errorf("atunnel: reading original TCP destination: %w", sockoptErr)
 	}
+	return destination, nil
+}
+
+func originalIPv4Destination(fd uintptr) (string, error) {
+	var addr unix.RawSockaddrInet4
+	if errno := getOriginalDestination(fd, unix.SOL_IP, unix.SO_ORIGINAL_DST, unsafe.Pointer(&addr), unsafe.Sizeof(addr)); errno != 0 {
+		return "", errno
+	}
+	return formatOriginalDestination(addr.Addr[:], addr.Port)
+}
+
+func originalIPv6Destination(fd uintptr) (string, error) {
+	var addr unix.RawSockaddrInet6
+	if errno := getOriginalDestination(fd, unix.SOL_IPV6, ip6tSOOriginalDst, unsafe.Pointer(&addr), unsafe.Sizeof(addr)); errno != 0 {
+		return "", errno
+	}
+	return formatOriginalDestination(addr.Addr[:], addr.Port)
+}
+
+func getOriginalDestination(fd uintptr, level, option int, addr unsafe.Pointer, addrSize uintptr) unix.Errno {
+	size := uint32(addrSize)
+	_, _, errno := unix.Syscall6(
+		unix.SYS_GETSOCKOPT,
+		fd,
+		uintptr(level),
+		uintptr(option),
+		uintptr(addr),
+		uintptr(unsafe.Pointer(&size)),
+		0,
+	)
+	return errno
+}
 
-	portBytes := (*[2]byte)(unsafe.Pointer(&addr.Port))
+func formatOriginalDestination(ip []byte, rawPort uint16) (string, error) {
+	portBytes := (*[2]byte)(unsafe.Pointer(&rawPort))
 	port := binary.BigEndian.Uint16(portBytes[:])
 	if port == 0 {
 		return "", fmt.Errorf("atunnel: original TCP destination has port zero")
 	}
-	return net.JoinHostPort(net.IP(addr.Addr[:]).String(), strconv.Itoa(int(port))), nil
+	return net.JoinHostPort(net.IP(ip).String(), strconv.Itoa(int(port))), nil
 }