Bump version to v1.4

Just pass the entire supplied command line, be it a single scalar or an array,
to system(). It'll do the right thing with it. This gets rid of a spurious
trailing space in debugging output when cmd() was called with a single scalar
as the command argument (leaving @cmdline undefined).

LICENCE

@@ -1,5 +1,19 @@
-Copyright (c) 2014 Tore Anderson <tore@fud.no>
+Copyright (c) 2014-2015 Tore Anderson <tore@fud.no>
 
-  As long as you retain this notice, you may use this piece of software as
-  you wish. If you like it, and we happen to meet one day, you can buy me
-  a beer in return. If you really like it, make it an IPA.
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.pod

@@ -1,6 +1,6 @@
 =head1 NAME
 
-B<clatd> - a CLAT implementation for Linux
+B<clatd> - a CLAT / SIIT-DC Edge Relay implementation for Linux
 
 =head1 DESCRIPTION
 
@@ -13,11 +13,12 @@ local applications on the host requires actual IPv4 connectivity or cannot
 make use of DNS64 (for example because they use legacy AF_INET socket calls,
 or if they are simply not using DNS64).
 
-It may also be used in combination with a stateless PLAT as defined by
-I<I-D.anderson-siit-dc> to give the otherwise IPv6-only host a public IPv4
-address with connectivity to the IPv4 internet. This may be useful in a
-server environment that are using legacy IPv4-only applications as described
-above.
+B<clatd> may also be used to implement an SIIT-DC Edge Relay as described in
+I<I-D.ietf-v6ops-siit-dc-2xlat>. In this scenario, the PLAT is in reality a
+SIIT-DC Border Relay (see I<I-D.ietf-v6ops-siit-dc>) instead of a Stateful
+NAT64 (see I<RFC6146>). When used as a SIIT-DC Edge Relay, you will probably
+want to manually configure the settings I<clat-v4-addr>, I<clat-v6-addr>, and
+I<plat-prefix> to mirror the SIIT-DC Border Relay's configuration.
 
 It relies on the software package TAYGA by Nathan Lutchansky for the actual
 translation of packets between IPv4 and IPv6 (I<RFC 6145>) TAYGA may be
@@ -33,7 +34,7 @@ B<clatd> [options]
 
 =item -q
 
-Quiet mode; suppress normal output This is the same as setting B<quiet=1>.
+Quiet mode; suppress normal output. This is the same as setting B<quiet=1>.
 Warnings and errors are still outputted, to silence those too, repeat I<-q>.
 
 =item -d
@@ -118,6 +119,57 @@ Set this to 1 to get debugging output from B<clatd>, or 2 to get even more of
 the stuff. These are the equivalent of providing the command line option I<-d>
 the specified number of times.
 
+=item B<script-up=string> (no default)
+
+Specify a custom script to be run when B<clatd> is starting up. The invocation
+of this script is the last thing that happens before TAYGA starts up, so all
+the preparations have been completed at that point (i.e., the B<clat-dev>
+exists and has routing/addressing configured, forwarding has been enabled, and
+so on).
+
+The script is run by the system shell, so you can do everything you could in an
+interactive shell: run multiple commands by separating them by semi-colon or
+double ampersands, use standard if/else statements, use variable substitutions,
+redirect output to files, set up command pipelines, and so on. However it must
+all be on one line, so if you want to do complex things or use some other
+programming language it's probably better to put the script itself in a
+separate executable file and just make B<script-up> invoke that file instead.
+
+If the script returns a nonzero exit status, this is considered a fatal error,
+and B<clatd> will abort. This can be prevented by appending I<|| true> at the
+end of the script.
+
+All of B<clatd>'s configuration settings are available as standard variables in
+the script's environment (hyphens are replaced with underscores).
+
+Logging or debug messages from the script may simply be sent to stdout, where
+it will be picked up by the init system along with B<clatd>'s own output. The
+script may of course consult the I<$quiet> and I<$debug> environment variables
+in order to determine how much output is appropriate.
+
+The script should not be enclosed in quotes in the configuration file (even
+though it contains whitespace). For example:
+
+B<script-up=echo `date -Ins`: clatd started on $clat_dev | tee -a ~/clatd.log>
+
+If on the other hand you want to supply a B<script-up> containing whitespace
+directly B<clatd>'s command line, quoting is required in order to prevent the
+shell from splitting it up and into multiple command line arguments. For
+example:
+
+B<clatd 'script-up=ip route add 192.0.2.0/24 dev $clat_dev || true'>
+
+=item B<script-up=string> (no default)
+
+This works exactly the same as B<script-up>, only that this script is run right
+after TAYGA has exited, before the clean-up process of restoring any settings
+that were changed.
+
+An unsuccessful exit code from B<script-down> will cause B<clatd> to exit
+unsuccessfully too. Beyond that an unsuccessful exit won't change anything,
+because B<script-down> is invoked at a point in time where the only thing left
+for B<clatd> to do is to clean up after itself and exit anyway.
+
 =item B<clat-dev=string> (default: I<clat>)
 
 The name of the network device used by the CLAT. There should be no reason to
@@ -129,22 +181,40 @@ simultaneously.
 The IPv4 address that will be assigned to the CLAT device. Local applications
 will bind to this address when communicating with external IPv4 destinations.
 In a standard 464XLAT environment with a stateful NAT64 serving as the PLAT,
-there should be no need to change the default, but if the PLAT is a stateless
-translator (a la I-D.draft-anderson-siit-dc), you might want to set this to
-the true external address used externally, so the the local applications can
-correctly identify which public address they'll be using on the IPv4 internet.
+there should be no need to change the default.
 
-The default address is one from I<I-D.draft-byrne-v6ops-clatip>.
+When using B<clatd> as an SIIT-DC Edge Relay (I<I-D.ietf-v6ops-siit-dc-2xlat>),
+you will want to set this to the IPv4 Service Address configured in the SIIT-DC
+Border Relay. This way, local applications can correctly identify which public
+address they'll be using on the IPv4 internet, and will be able to provide
+fully functional references to it in application-level payload, and so on.
+
+The default address is one from I<RFC 7335>.
 
 =item B<clat-v6-addr=ipv6-address> (default: auto-generated)
 
 The IPv6 address of the CLAT. Traffic to/from the B<clat-v4-addr> will be
-translated into this address. By default, B<clatd> will attempt to figure out
-which network device will be used for traffic towards the PLAT, see if there
-is any SLAAC-configured addresses on it, and if so substitute the '0xfffe'
-value in the middle of the Interface ID for '0xc1a7' to generate a new
-address for the CLAT. If you're not using SLAAC you will have to set this
-manually.
+translated into this address. When using B<clatd> as an SIIT-DC Edge Relay, you
+will want to set this to the same IPv6 address in the Explicit Address Mapping
+configured in the SIIT-DC Border Relay.
+
+By default, B<clatd> will attempt to figure out which network device will be
+used for traffic towards the PLAT, see if there is any SLAAC-based globally
+scoped addresses on it (i.e., a /64 with '0xfffe' in the middle of the
+Interface ID), and will if so substitute that '0xfffe' value with '0xc1a7'
+("clat") to generate a CLAT IPv6 address.
+
+If only a non-SLAAC global address is found on the PLAT-facing device,
+B<clatd> will substitute its Interface ID with a random integer and use the
+result as the CLAT IPv6 address. It will only do so if the prefix length is
+/120 or smaller, as otherwise the risk of IID collisions is considered to be
+too high. Note that on most Perl platforms, the I<rand()> function is limited
+to 48 bits, which means that for longer IIDs, the least significant bits will
+be all 0.
+
+If multiple addresses are found in either category, the one that shares the
+longest common prefix with the PLAT prefix will be preferred when deriving
+the CLAT IPv6 address according to the algorithm described above.
 
 =item B<dns64-servers=srv1,[srv2,..]> (default: use system resolver)
 
@@ -173,10 +243,11 @@ L<http://www.litech.org/tayga>. Required.
 
 =item B<forwarding-enable=bool> (default: I<yes>)
 
-Controls whether or not B<clatd> should enable IPv6 forwarding if necessary. IPv6
-forwarding is necessary for B<clatd> to work correctly. It will also ensure that
-the I<accept_ra> sysctl is to '2' for all devices have it set to '1', in order
-to prevent any connectivity loss as a result of enabling forwarding.
+Controls whether or not B<clatd> should enable IPv6 forwarding if necessary.
+IPv6 forwarding is necessary for B<clatd> to work correctly. It will also
+ensure that the I<accept_ra> sysctl is to '2' for all devices have it set to
+'1', in order to prevent any connectivity loss as a result of enabling
+forwarding.
 
 All sysctls that are modified will be restored to their original values when
 B<clatd> is shutting down.
@@ -185,8 +256,8 @@ B<clatd> is shutting down.
 
 Controls whether or not B<clatd> should insert ip6tables rules that permit the
 forwarding of IPv6 traffic between the CLAT and PLAT devices. Such forwarding
-must be permitted for B<clatd> to work correctly. Any rules added will be removed
-when B<clatd> is shutting down.
+must be permitted for B<clatd> to work correctly. Any rules added will be
+removed when B<clatd> is shutting down.
 
 The default is I<yes> if the ip6tables_filter kernel module is loaded, I<no>
 if it is not.
@@ -194,7 +265,7 @@ if it is not.
 =item B<plat-dev> (default: auto-detect)
 
 Which network device is facing the PLAT (NAT64). By default, this is
-auto-detecting by performing a route table lookup towards the PLAT prefix.
+auto-detected by performing a route table lookup towards the PLAT prefix.
 This setting is used when setting up generating the CLAT IPv6 address, and
 when setting up ip6tables rules and Proxy-ND entries.
 
@@ -230,7 +301,7 @@ ICMPv4 errors back to the host (i.e., it will show up as the first hop when
 tracerouting to IPv4 destinations), and you may also ping it to verify that
 the TAYGA process is still alive and well.
 
-The default address is one from I<I-D.draft-byrne-v6ops-clatip>.
+The default address is one from I<RFC 7335>.
 
 =item B<v4-conncheck-enable=bool> (default: I<yes>)
 
@@ -246,6 +317,9 @@ system has IPv4 connectivity, disable this setting. You may instead use the
 B<v4-defaultroute-enable> and B<v4-defaultroute-metric> settings to prevent
 B<clatd> from interfering with native IPv4 connectivity.
 
+Note that enabling B<v4-defaultroute-replace> will override
+B<v4-conncheck-enable> and unconditionally disable IPv4 connectivity checking.
+
 =item B<v4-conncheck-delay=seconds> (default: I<10>)
 
 When performing an IPv4 connectivity check, wait this number of seconds
@@ -266,6 +340,23 @@ an environment where native IPv4 connectivity is also present, you might want
 to disable this and instead control manually which IPv4 destinations is
 reached through the CLAT and which are not.
 
+=item B<v4-defaultroute-replace=bool> (default: I<no>)
+
+Instructs B<clatd> to remove any pre-existing IPv4 default routes, replacing it
+with one pointing to the CLAT (assuming B<v4-defaultroute-enable> is I<yes>).
+The replacement is temporary, any pre-existing routes that were removed will be
+restored when B<clatd> is shutting down.
+
+Note that nothing prevents software like a connection manager or a DHCPv4
+client daemon from re-adding any replaced routes while B<clatd> is running.
+
+If you enable B<v4-defaultroute-replace> while at the same time disabling
+B<v4-defaultroute-enable>, B<clatd> will remove any pre-existing IPv4 default
+routes but not add any of its own.
+
+Setting B<v4-defaultroute-replace> to I<yes>will disable the IPv4 connectivity
+check.
+
 =item B<v4-defaultroute-metric=integer> (default: I<2048>)
 
 The metric of the IPv4 default route pointing to the CLAT. The default is
@@ -286,6 +377,17 @@ If you know that the IPv6 Path MTU between the host and the PLAT is larger
 than 1280, you may increase this, but then you should also recompile TAYGA
 with a larger B<ipv6_offlink_mtu> setting in I<conffile.c>.
 
+=item B<v4-defaultroute-advmss=integer> (default: B<v4-defaultroute-mtu> - 40)
+
+The "advmss" value assigned to the the default route potining to the CLAT. This
+controls the advertised TCP MSS value for TCP connections made through the
+CLAT.
+
+You should normally not need to set this. By default the value is calculated by
+taking the value of B<v4-defaultroute-mtu> and substracting 40 (20 bytes for
+the IPv4 header + 20 bytes for the TCP header). If B<v4-defaultroute-mtu> is
+unset or 0, there is no default.
+
 =back
 
 =head1 LIMITATIONS
@@ -310,18 +412,32 @@ configuration file) when reporting a bug.
 
 =head1 LICENCE
 
-Copyright (c) 2014 Tore Anderson <tore@fud.no>
+Copyright (c) 2014-2015 Tore Anderson <tore@fud.no>
 
-As long as you retain this notice, you may use this piece of software as
-you wish. If you like it, and we happen to meet one day, you can buy me
-a beer in return. If you really like it, make it an IPA.
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
 
 =head1 SEE ALSO
 
 ip(8), ip6tables(8), tayga(8), tayga.conf(5)
 
-RFC 6052, RFC 6145, RFC 6146, RFC 6877, RFC 7050
+RFC 6052, RFC 6145, RFC 6146, RFC 6877, RFC 7050, RFC 7335
 
-I-D.anderson-siit-dc, I-D.byrne-v6ops-clatip
+I-D.ietf-v6ops-siit-dc, I-D.ietf-v6ops-siit-dc-2xlat, I-D.ietf-v6ops-siit-eam
 
 =cut

clatd

@@ -12,7 +12,7 @@
 use strict;
 use Net::IP;
 
-my $VERSION = "1.0";
+my $VERSION = "1.4";
 
 #
 # Populate the global config hash with the default values
@@ -20,8 +20,10 @@ my $VERSION = "1.0";
 my %CFG;
 $CFG{"quiet"} = 0;			# suppress normal output
 $CFG{"debug"} = 0;			# debugging output level
+$CFG{"script-up"} = undef;              # sh script to run when starting up
+$CFG{"script-down"} = undef;            # sh script to run when shutting down
 $CFG{"clat-dev"} = "clat";		# TUN interface name to use
-$CFG{"clat-v4-addr"} = "192.0.0.1";	# from I-D.draft-byrne-v6ops-clatip
+$CFG{"clat-v4-addr"} = "192.0.0.1";	# from RFC 7335
 $CFG{"clat-v6-addr"} = undef;		# derive from existing SLAAC addr
 $CFG{"dns64-servers"} = undef;		# use system resolver by default
 $CFG{"cmd-ip"} = "ip";			# assume in $PATH
@@ -33,12 +35,14 @@ $CFG{"plat-dev"} = undef;		# PLAT-facing device, default detect
 $CFG{"plat-prefix"} = undef;		# detect using DNS64 by default
 $CFG{"proxynd-enable"} = 1;		# add proxy-nd entry for clat?
 $CFG{"tayga-conffile"} = undef;		# make a temporary one by default
-$CFG{"tayga-v4-addr"} = "192.0.0.2";	# from I-D.draft-byrne-v6ops-clatip
+$CFG{"tayga-v4-addr"} = "192.0.0.2";	# from RFC 7335
 $CFG{"v4-conncheck-enable"} = 1;	# exit if there's already a defroute
 $CFG{"v4-conncheck-delay"} = 10;	# seconds before checking for v4 conn.
 $CFG{"v4-defaultroute-enable"} = 1;	# add a v4 defaultroute via the CLAT?
+$CFG{"v4-defaultroute-replace"} = 0;	# replace existing v4 defaultroute?
 $CFG{"v4-defaultroute-metric"} = 2048;	# metric for the IPv4 defaultroute
 $CFG{"v4-defaultroute-mtu"} = 1260;	# MTU for the IPv4 defaultroute
+$CFG{"v4-defaultroute-advmss"} = 0;	# TCP MSS for the IPv4 defaultroute
 
 
 #
@@ -69,18 +73,17 @@ sub err {
 #
 sub cmd {
   my $msgsub = shift;
-  my $command = shift;
-  my @cmdline = @_;
+  my @cmd = @_;
 
-  d("cmd($command @cmdline)");
+  d("cmd(@cmd)");
 
-  if(system($command, @cmdline)) {
+  if(system(@cmd)) {
     if($? == -1) {
-      &{$msgsub}("cmd($command @cmdline) failed to execute");
+      &{$msgsub}("cmd(@cmd) failed to execute");
     } elsif($? & 127) {
-      &{$msgsub}("cmd($command @cmdline) died with signal ", ($? & 127));
+      &{$msgsub}("cmd(@cmd) died with signal ", ($? & 127));
     } else {
-      &{$msgsub}("cmd($command @cmdline) returned ", ($? >> 127));
+      &{$msgsub}("cmd(@cmd) returned ", ($? >> 127));
     }
   }
   return $?;
@@ -89,7 +92,8 @@ sub cmd {
 
 #
 # Reads in key=value pairs from a configuration file, overwriting the default
-# setting in the %CFG hash. The key must exist, or we
+# setting in the %CFG hash. The key must exist in the built-in hash, or we
+# ignore the setting in the config file.
 #
 sub readconf {
   d("readconf('@_')");
@@ -134,7 +138,7 @@ sub cfgbool {
 #
 sub cfgint {
   my ($key) = @_;
-  d2("cfgstr($key)");
+  d2("cfgint($key)");
   if(!exists($CFG{$key})) {
     err("key '$key' doesn't exist in config hash");
   }
@@ -149,7 +153,7 @@ sub cfgint {
 #
 sub cfg {
   my ($key) = @_;
-  d2("cfgstr($key)");
+  d2("cfg($key)");
   if(!exists($CFG{$key})) {
     err("key '$key' doesn't exist in config hash");
   }
@@ -424,47 +428,134 @@ sub is_modified_eui64 {
 
 
 #
-# This function considers any globally scoped /64 address on the PLAT-facing
-# device, checks to see if it is base on Modified EUI-64, and generates a
-# new address for the CLAT by substituting the "0xfffe" bits in the middle
-# of the Interface ID with 0xc1a7 ("clat"). This keeps the last 24 bits
-# unchanged, which has the added bonus of not requiring the host to join
-# another Solicited-Node multicast group.
+# This function considers any globally scoped IPv6 address on the PLAT-facing
+# device, and derives an CLAT IPv6 address from the best match (longest
+# common prefix with PLAT prefix). Addresses based on Modified EUI-64 are
+# preferred, and if found, it generates a new address for the CLAT by
+# substituting the "0xfffe" bits in the middle of the Interface ID with
+# 0xc1a7 ("clat"). This keeps the last 24 bits unchanged, which has the added
+# bonus of not requiring the host to join another Solicited-Node multicast
+# group. If no EUI-64 address is seen, it'll use a random IID instead.
 #
 sub get_clat_v6_addr {
   my $plat_dev = cfg("plat-dev");
   if(!$plat_dev) {
     err("get_clat_v6_addr(): No PLAT device to work with");
   }
-  p("Attempting to derive a CLAT IPv6 address from a EUI-64 address on ",
+
+  # In case there are more than one EUI-64-based addresses on the plat device,
+  # we'll need the plat prefix as an bigint in order to find which of those
+  # addresses share the longest common prefix. We'll prefer to use that one.
+  my $plat_prefix_int = Net::IP->new(cfg("plat-prefix"), 6)->intip();
+  if(!$plat_prefix_int) {
+    err("Failed to convert plat prefix to bigint");
+  }
+  my $ip; # will contain the best candidate ip in bigint format
+  my $ip_plen; # will contain the prefix length of the best candidate ip
+  my $best_score; # will contain the score of the best candidate seen
+  my $seen_eui64; # set if we've seen an eui-64 based address
+
+  p("Attempting to derive a CLAT IPv6 address from an IPv6 address on ",
     "'$plat_dev'");
   open(my $fd, '-|', cfg("cmd-ip"), qw(-6 address list scope global dev),
        $plat_dev)
     or err("'ip -6 address list scope global dev $plat_dev' failed to execute");
   while(<$fd>) {
-    if(m| inet6 (\S+)/64 scope global |) {
+    if(m| inet6 (\S+)/(\d{1,3}) scope global |) {
       my $candidate = $1;
-      next unless(is_modified_eui64($candidate));
-      d2("Saw EUI-64 based address: $candidate");
-      my $ip = Net::IP->new($candidate, 6) or next;
-      $ip = $ip->intip();
+      my $plen = $2;
+      d2("Saw a candidate address on '$plat_dev': $candidate/$plen");
+      my $candidate_int = Net::IP->new($candidate, 6)->intip();
+      if(!$candidate_int) {
+        err("Failed to convert plat prefix to bigint");
+      }
 
-      # First clear the middle 0xfffe bits of the interface ID
-      my $mask = Net::IP->new("ffff:ffff:ffff:ffff:ffff:ff00:00ff:ffff");
-      $mask = $mask->intip();
-      $ip &= $mask;
+      if($plen > 120) {
+        # We'll need a subnet with some space if we are to generate a random
+        # IID and don't have too large risk of collisions... /120 seems like
+        # an OK limit
+        d2("Refusing to use random IIDs for prefix lengths > /120");
+        next;
+      }
 
-      # Next set them to the value 0xc1a7 and return
-      $mask = Net::IP->new("::c1:a700:0", 6) or next;
-      $mask = $mask->intip();
-      $ip |= $mask;
+      # True if the candidate under consideration is EUI-64 based
+      my $is_eui64 = ($plen == 64) && is_modified_eui64($candidate);
 
-      $ip = Net::IP->new(Net::IP::ip_bintoip(Net::IP::ip_inttobin($ip, 6), 6));
-      return $ip->short() if $ip;
+      # If this is the first time we're considering an EUI-64 based address,
+      # we unconditionally prefer it (even if it doesn't have the longest
+      # matching prefix), because we consider deriving the CLAT IPv6
+      # address from an EUI-64 based candidate to be safer than generating
+      # a truly random CLAT IPv6 address.
+      if($is_eui64 and !$seen_eui64++) {
+        d2("Preferring $candidate/$plen; it's the first EUI-64 seen");
+        $best_score = $plat_prefix_int ^ $candidate_int;
+        $ip = $candidate_int;
+        $ip_plen = $plen;
+        next;
+      }
+
+      # If we already have found an EUI-64 based address, we can reject this
+      # candidate outright, as it is *not* EUI-64 based.
+      if(!$is_eui64 and $seen_eui64) {
+        d2("Rejecting $candidate/$plen; we have better EUI-64 candidates");
+        next;
+      }
+
+      # Otherwise, we'll be comparing EUI-64 to EUI-64, or non EUI-64 to
+      # non EUI-64. If so, we prefer the current candidate if it has a better
+      # score than the current best match (or if there is no current best
+      # match).
+      if(!$best_score or $best_score > ($plat_prefix_int ^ $candidate_int)) {
+        d2("Preferring $candidate/$plen; best match so far");
+        $best_score = $plat_prefix_int ^ $candidate_int;
+        $ip = $candidate_int;
+        $ip_plen = $plen;
+        next;
+      }
+
+      d2("Rejecting $candidate/$plen; we've seen better matches");
     }
   }
   close($fd)
     or err("'ip -6 address list scope global dev $plat_dev' failed");
+
+  if(!$ip) {
+    err("Could not find a global IPv6 address on $plat_dev from which ",
+        "to derive a CLAT IPv6 address (try setting 'clat-v6-addr')");
+  }
+
+  if($seen_eui64) {
+    # If the chosen candidate IP is EUI-64 based, we derive a CLAT IPv6
+    # address by replacing the 0xffe in the middle of the Interface ID with
+    # 0xc1a7 ("CLAT").
+
+    # First clear the middle 0xfffe bits of the interface ID
+    my $mask = Net::IP->new("ffff:ffff:ffff:ffff:ffff:ff00:00ff:ffff");
+    $mask = $mask->intip();
+    $ip &= $mask;
+
+    # Next set them to the value 0xc1a7
+    $mask = Net::IP->new("::c1:a700:0", 6) or err(Net::IP::Error());
+    $mask = $mask->intip();
+    $ip |= $mask;
+  } else {
+    # If the chosen candidate IP is NOT EUI-64 based, we'll just make up a
+    # random interface ID. There is no guarantee that this will actually
+    # work, but it's the best thing we can try...
+
+    # First zero out the entire Interface ID
+    $ip >>= (128-$ip_plen);
+    $ip <<= (128-$ip_plen);
+
+    my $iid = int(rand(2**(128-$ip_plen)));
+    d2(sprintf("Using random interface ID: %x", $iid));
+    $ip |= $iid;
+  }
+
+  # Convert back the BigInt to a regular Net::IP object and return
+  $ip = Net::IP->new(Net::IP::ip_bintoip(Net::IP::ip_inttobin($ip, 6), 6));
+  return $ip->short() if $ip;
+
   err("Failed to generate a CLAT IPv6 address (try setting 'clat-v6-addr')");
 }
 
@@ -481,6 +572,7 @@ my @cleanup_accept_ra_sysctls;		# accept_ra sysctls to be reset to '1'
 my $cleanup_zero_proxynd_sysctl;	# zero proxy_ndp sysctl if set
 my $cleanup_remove_proxynd_entry,	# true if having added proxynd entry
 my $cleanup_remove_ip6tables_rules;	# true if having added ip6tables rules
+my @cleanup_restore_v4_defaultroutes;   # temporarily replaced defaultroutes
 
 sub cleanup_and_exit {
   my $exitcode = shift;
@@ -520,6 +612,10 @@ sub cleanup_and_exit {
     cmd(\&w, cfg("cmd-ip6tables"), qw(-D FORWARD -i), cfg("plat-dev"),
         "-o", cfg("clat-dev"), qw(-j ACCEPT));
   }
+  for my $rt (@cleanup_restore_v4_defaultroutes) {
+    d("Cleanup: Restoring temporarily replaced IPv4 default route");
+    cmd(\&w, cfg("cmd-ip"), qw(-4 route add), @{$rt});
+  }
 
   exit($exitcode);
 }
@@ -554,8 +650,10 @@ for (my $i = 0; $i < @ARGV;) {
     splice(@ARGV, $i, 2);
     next;
   } elsif($ARGV[$i] =~ /^(-h|--help)$/) {
-    print "clatd v$VERSION - a 464XLAT (RFC 6877) CLAT implementation for ",
-          "Linux\n";
+    print <<"EOF";
+clatd v$VERSION - a 464XLAT (RFC 6877) CLAT and SIIT-DC Host Agent
+             (I-D.anderson-v6ops-siit-dc-2xlat) implementation for Linux
+EOF
     print "\n";
     print "  Usage:    clatd [-q] [-d [-d]] [-c config-file] ",
           "[conf-key=val ...]\n";
@@ -635,12 +733,15 @@ p("Using CLAT IPv6 address: ", $CFG{"clat-v6-addr"});
 if(!defined($CFG{"ip6tables-enable"})) {
   $CFG{"ip6tables-enable"} = -e "/sys/module/ip6table_filter" ? 1 : 0;
 }
+if(!$CFG{"v4-defaultroute-advmss"} and cfgint("v4-defaultroute-mtu")) {
+  $CFG{"v4-defaultroute-advmss"} = $CFG{"v4-defaultroute-mtu"} - 40;
+}
 
 #
 # Step 1: Detect if there is an IPv4 default route on the system from before.
 # If so we have no need for 464XLAT, and we can just exit straight away
 #
-if(cfgbool("v4-conncheck-enable")) {
+if(cfgbool("v4-conncheck-enable") and !cfgbool("v4-defaultroute-replace")) {
   my $delay = cfgint("v4-conncheck-delay");
   p("Checking if this system already has IPv4 connectivity ",
     $delay ? "in $delay sec(s)" : "now");
@@ -650,7 +751,7 @@ if(cfgbool("v4-conncheck-enable")) {
   while(<$fd>) {
     if(/^default /) {
       p("This system already has IPv4 connectivity; no need for a CLAT.");
-      exit_and_cleanup(0);
+      cleanup_and_exit(0);
     }
   }
   close($fd) or err("cmd(ip -4 route list default) failed");
@@ -755,18 +856,44 @@ cmd(\&err, cfg("cmd-ip"), qw(-4 address add), cfg("clat-v4-addr"),
     "dev", cfg("clat-dev"));
 cmd(\&err, cfg("cmd-ip"), qw(-6 route add), cfg("clat-v6-addr"),
     "dev", cfg("clat-dev"));
+if(cfgbool("v4-defaultroute-replace")) {
+  open(my $fd, '-|', cfg("cmd-ip"), qw(-4 route show default))
+    or err("'ip -4 route show default' failed to execute");
+  while(<$fd>) {
+    my @rt = split(/\s+/, $_);
+    d("Replacing pre-existing IPv4 default route: @rt");
+    cmd(\&err, cfg("cmd-ip"), qw(-4 route del), @rt);
+    push(@cleanup_restore_v4_defaultroutes, \@rt);
+  }
+  close($fd) or err("'ip -4 route show default' failed");
+}
 if(cfgbool("v4-defaultroute-enable")) {
   my @cmdline = (qw(-4 route add default dev), cfg("clat-dev"));
   if(cfgint("v4-defaultroute-metric")) {
     push(@cmdline, ("metric", cfgint("v4-defaultroute-metric")))
   }
   if(cfgint("v4-defaultroute-mtu")) {
-    push(@cmdline, ("mtu", cfgint("v4-defaultroute-mtu")))
+    push(@cmdline, ("mtu", cfgint("v4-defaultroute-mtu")));
+  }
+  if(cfgint("v4-defaultroute-advmss")) {
+    push(@cmdline, ("advmss", cfgint("v4-defaultroute-advmss")));
   }
   p("Adding IPv4 default route via the CLAT");
   cmd(\&err, cfg("cmd-ip"), @cmdline);
 }
 
+# Inject %CFG into %ENV and then run the up script
+for my $key (sort keys(%CFG)) {
+  my $var = $key;
+  $var =~ y/-/_/;
+  d2(sprintf("Script env: %s=%s", $key, $CFG{$key} || ''));
+  $ENV{$var} = $CFG{$key};
+}
+if(cfg("script-up")) {
+  d("Running custom startup script: ", cfg("script-up"));
+  cmd(\&err, cfg("script-up"));
+}
+
 #
 # All preparation done! We can now start TAYGA, which will handle the actual
 # translation of IP packets.
@@ -787,6 +914,11 @@ $SIG{'INT'} = 'DEFAULT';
 $SIG{'TERM'} = 'DEFAULT';
 
 #
-# TAYGA exited, probably because we're shutting down. Cleanup and exit.
+# TAYGA exited, probably because we're shutting down. Run the down script, then
+# cleanup and exit.
 #
+if(cfg("script-down")) {
+  d("Running custom shutdown script: ", cfg("script-down"));
+  cmd(\&err, cfg("script-down"));
+}
 cleanup_and_exit(0);

scripts/clatd.networkmanager

@@ -7,8 +7,15 @@
 # Written by Tore Anderson <tore@fud.no>
 #
 
+# Newer NetworkManager versions will run the dispatcher scripts once
+# a new unmanaged interface shows up, including the 'clat' interface
+# created by clatd/TAYGA. So if we're being called due to our own
+# interface showing up, do nothing, otherwise we will end up
+# committing suicide from the restarts below
+[ "$DEVICE_IFACE" = "clat" ] && exit 0
+
 # We simply restart clatd in all situations, as no matter if an interface
-# goes up or down, it may mean that the PLAT devices changes, it may mean
+# goes up or down, it may mean that the PLAT device changes, it may mean
 # native IPv4 appearing or disappearing, or it may mean that DNS64 became
 # available or unavailable...it's far easier to simply restart always and
 # start from scratch than to figure out if a restart is truly necessary