Add IPv6 prefix handling to unix tun interface

burrow/src/daemon/rpc/response.rs

@@ -36,6 +36,8 @@ impl DaemonResponse {
 pub struct ServerInfo {
     pub name: Option<String>,
     pub ip: Option<String>,
+    #[serde(default)]
+    pub ipv6: Vec<String>,
     pub mtu: Option<i32>,
 }
 
@@ -47,6 +49,12 @@ impl TryFrom<&TunInterface> for ServerInfo {
         Ok(ServerInfo {
             name: server.name().ok(),
             ip: server.ipv4_addr().ok().map(|ip| ip.to_string()),
+            ipv6: server
+                .ipv6_addrs()
+                .unwrap_or_default()
+                .into_iter()
+                .map(|ip| ip.to_string())
+                .collect(),
             mtu: server.mtu().ok(),
         })
     }
@@ -109,6 +117,7 @@ fn test_response_serialization() -> anyhow::Result<()> {
         DaemonResponseData::ServerInfo(ServerInfo {
             name: Some("burrow".to_string()),
             ip: None,
+            ipv6: Vec::new(),
             mtu: Some(1500)
         })
     )))?);

burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-2.snap

@@ -1,5 +1,5 @@
 ---
 source: burrow/src/daemon/rpc/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            mtu: Some(1500),\n                        }))))?"
+expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            ipv6: Vec::new(),\n                            mtu: Some(1500),\n                        }))))?"
 ---
-{"result":{"Ok":{"type":"ServerInfo","name":"burrow","ip":null,"mtu":1500}},"id":0}
+{"result":{"Ok":{"type":"ServerInfo","name":"burrow","ip":null,"ipv6":[],"mtu":1500}},"id":0}

burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-2.snap

@@ -1,5 +1,5 @@
 ---
 source: burrow/src/daemon/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            mtu: Some(1500),\n                        }))))?"
+expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            ipv6: Vec::new(),\n                            mtu: Some(1500),\n                        }))))?"
 ---
-{"result":{"Ok":{"ServerInfo":{"name":"burrow","ip":null,"mtu":1500}}},"id":0}
+{"result":{"Ok":{"ServerInfo":{"name":"burrow","ip":null,"ipv6":[],"mtu":1500}}},"id":0}

proto/google/protobuf/duration.proto

@@ -0,0 +1,115 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/durationpb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "DurationProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+
+// A Duration represents a signed, fixed-length span of time represented
+// as a count of seconds and fractions of seconds at nanosecond
+// resolution. It is independent of any calendar and concepts like "day"
+// or "month". It is related to Timestamp in that the difference between
+// two Timestamp values is a Duration and it can be added or subtracted
+// from a Timestamp. Range is approximately +-10,000 years.
+//
+// # Examples
+//
+// Example 1: Compute Duration from two Timestamps in pseudo code.
+//
+//     Timestamp start = ...;
+//     Timestamp end = ...;
+//     Duration duration = ...;
+//
+//     duration.seconds = end.seconds - start.seconds;
+//     duration.nanos = end.nanos - start.nanos;
+//
+//     if (duration.seconds < 0 && duration.nanos > 0) {
+//       duration.seconds += 1;
+//       duration.nanos -= 1000000000;
+//     } else if (duration.seconds > 0 && duration.nanos < 0) {
+//       duration.seconds -= 1;
+//       duration.nanos += 1000000000;
+//     }
+//
+// Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
+//
+//     Timestamp start = ...;
+//     Duration duration = ...;
+//     Timestamp end = ...;
+//
+//     end.seconds = start.seconds + duration.seconds;
+//     end.nanos = start.nanos + duration.nanos;
+//
+//     if (end.nanos < 0) {
+//       end.seconds -= 1;
+//       end.nanos += 1000000000;
+//     } else if (end.nanos >= 1000000000) {
+//       end.seconds += 1;
+//       end.nanos -= 1000000000;
+//     }
+//
+// Example 3: Compute Duration from datetime.timedelta in Python.
+//
+//     td = datetime.timedelta(days=3, minutes=10)
+//     duration = Duration()
+//     duration.FromTimedelta(td)
+//
+// # JSON Mapping
+//
+// In JSON format, the Duration type is encoded as a string rather than an
+// object, where the string ends in the suffix "s" (indicating seconds) and
+// is preceded by the number of seconds, with nanoseconds expressed as
+// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
+// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
+// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
+// microsecond should be expressed in JSON format as "3.000001s".
+//
+message Duration {
+  // Signed seconds of the span of time. Must be from -315,576,000,000
+  // to +315,576,000,000 inclusive. Note: these bounds are computed from:
+  // 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
+  int64 seconds = 1;
+
+  // Signed fractions of a second at nanosecond resolution of the span
+  // of time. Durations less than one second are represented with a 0
+  // `seconds` field and a positive or negative `nanos` field. For durations
+  // of one second or more, a non-zero value for the `nanos` field must be
+  // of the same sign as the `seconds` field. Must be from -999,999,999
+  // to +999,999,999 inclusive.
+  int32 nanos = 2;
+}

proto/google/protobuf/timestamp.proto

@@ -0,0 +1,144 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/timestamppb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "TimestampProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+
+// A Timestamp represents a point in time independent of any time zone or local
+// calendar, encoded as a count of seconds and fractions of seconds at
+// nanosecond resolution. The count is relative to an epoch at UTC midnight on
+// January 1, 1970, in the proleptic Gregorian calendar which extends the
+// Gregorian calendar backwards to year one.
+//
+// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
+// second table is needed for interpretation, using a [24-hour linear
+// smear](https://developers.google.com/time/smear).
+//
+// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
+// restricting to that range, we ensure that we can convert to and from [RFC
+// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
+//
+// # Examples
+//
+// Example 1: Compute Timestamp from POSIX `time()`.
+//
+//     Timestamp timestamp;
+//     timestamp.set_seconds(time(NULL));
+//     timestamp.set_nanos(0);
+//
+// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
+//
+//     struct timeval tv;
+//     gettimeofday(&tv, NULL);
+//
+//     Timestamp timestamp;
+//     timestamp.set_seconds(tv.tv_sec);
+//     timestamp.set_nanos(tv.tv_usec * 1000);
+//
+// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
+//
+//     FILETIME ft;
+//     GetSystemTimeAsFileTime(&ft);
+//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+//
+//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+//     Timestamp timestamp;
+//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+//
+// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
+//
+//     long millis = System.currentTimeMillis();
+//
+//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+//         .setNanos((int) ((millis % 1000) * 1000000)).build();
+//
+// Example 5: Compute Timestamp from Java `Instant.now()`.
+//
+//     Instant now = Instant.now();
+//
+//     Timestamp timestamp =
+//         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+//             .setNanos(now.getNano()).build();
+//
+// Example 6: Compute Timestamp from current time in Python.
+//
+//     timestamp = Timestamp()
+//     timestamp.GetCurrentTime()
+//
+// # JSON Mapping
+//
+// In JSON format, the Timestamp type is encoded as a string in the
+// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+// where {year} is always expressed using four digits while {month}, {day},
+// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+// is required. A proto3 JSON serializer should always use UTC (as indicated by
+// "Z") when printing the Timestamp type and a proto3 JSON parser should be
+// able to accept both UTC and other timezones (as indicated by an offset).
+//
+// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+// 01:30 UTC on January 15, 2017.
+//
+// In JavaScript, one can convert a Date object to this format using the
+// standard
+// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
+// method. In Python, a standard `datetime.datetime` object can be converted
+// to this format using
+// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
+// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
+// the Joda Time's [`ISODateTimeFormat.dateTime()`](
+// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
+// ) to obtain a formatter capable of generating timestamps in this format.
+//
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  int32 nanos = 2;
+}

tun/src/options.rs

@@ -1,5 +1,7 @@
+#[cfg(all(any(target_os = "linux", target_vendor = "apple"), feature = "tokio"))]
 use std::io::Error;
 
+#[cfg(all(any(target_os = "linux", target_vendor = "apple"), feature = "tokio"))]
 use fehler::throws;
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]

tun/src/unix/address.rs

@@ -0,0 +1,120 @@
+use std::io::{Error, ErrorKind};
+use std::net::IpAddr;
+
+use fehler::throws;
+
+#[throws]
+pub(crate) fn ensure_valid_ipv6_prefix(prefix_len: u8) {
+    if prefix_len > 128 {
+        Err(Error::new(
+            ErrorKind::InvalidInput,
+            "IPv6 prefix length must be between 0 and 128",
+        ))?;
+    }
+}
+
+#[cfg_attr(not(any(test, target_vendor = "apple")), allow(dead_code))]
+#[throws]
+pub(crate) fn ipv6_prefix_octets(prefix_len: u8) -> [u8; 16] {
+    ensure_valid_ipv6_prefix(prefix_len)?;
+
+    let mut octets = [0u8; 16];
+    for bit in 0..prefix_len {
+        let idx = (bit / 8) as usize;
+        let offset = (bit % 8) as u8;
+        octets[idx] |= 0x80 >> offset;
+    }
+
+    octets
+}
+
+#[cfg_attr(not(any(test, target_vendor = "apple")), allow(dead_code))]
+pub(crate) fn parse_addr_spec(spec: &str) -> Result<Option<(IpAddr, Option<u8>)>, Error> {
+    let (addr_str, prefix) = match spec.split_once('/') {
+        Some((addr, prefix)) => (addr, Some(prefix)),
+        None => (spec, None),
+    };
+
+    let addr: IpAddr = match addr_str.parse() {
+        Ok(addr) => addr,
+        Err(_) => return Ok(None),
+    };
+
+    let prefix_len = if let Some(prefix) = prefix {
+        let parsed = prefix
+            .parse::<u8>()
+            .map_err(|_| Error::new(ErrorKind::InvalidInput, "Invalid prefix length"))?;
+        ensure_valid_ipv6_prefix(parsed)?;
+        Some(parsed)
+    } else {
+        None
+    };
+
+    Ok(Some((addr, prefix_len)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+    #[test]
+    fn parse_ipv4_without_prefix() {
+        let parsed = parse_addr_spec("192.0.2.1").expect("parse succeeds");
+        assert_eq!(
+            parsed,
+            Some((IpAddr::V4(Ipv4Addr::new(192, 0, 2, 1)), None))
+        );
+    }
+
+    #[test]
+    fn parse_ipv6_with_prefix() {
+        let parsed = parse_addr_spec("2001:db8::1/64").expect("parse succeeds");
+        assert_eq!(
+            parsed,
+            Some((
+                IpAddr::V6("2001:db8::1".parse::<Ipv6Addr>().unwrap()),
+                Some(64),
+            ))
+        );
+    }
+
+    #[test]
+    fn parse_invalid_addr_returns_none() {
+        assert_eq!(parse_addr_spec("not-an-ip").unwrap(), None);
+    }
+
+    #[test]
+    fn parse_invalid_prefix_string_errors() {
+        assert!(parse_addr_spec("::1/not-a-number").is_err());
+    }
+
+    #[test]
+    fn parse_prefix_out_of_range_errors() {
+        assert!(parse_addr_spec("::1/129").is_err());
+    }
+
+    #[test]
+    fn ensure_valid_ipv6_prefix_accepts_bounds() {
+        ensure_valid_ipv6_prefix(0).expect("zero prefix is allowed");
+        ensure_valid_ipv6_prefix(128).expect("max prefix is allowed");
+    }
+
+    #[test]
+    fn ensure_valid_ipv6_prefix_rejects_invalid() {
+        assert!(ensure_valid_ipv6_prefix(129).is_err());
+    }
+
+    #[test]
+    fn ipv6_prefix_octets_zero_prefix() {
+        assert_eq!(ipv6_prefix_octets(0).unwrap(), [0u8; 16]);
+    }
+
+    #[test]
+    fn ipv6_prefix_octets_sets_bits_correctly() {
+        let mask = ipv6_prefix_octets(65).unwrap();
+        assert_eq!(mask[0..8], [0xFF; 8]);
+        assert_eq!(mask[8], 0x80);
+        assert_eq!(mask[9..], [0u8; 7]);
+    }
+}

tun/src/unix/apple/mod.rs

@@ -1,7 +1,8 @@
 use std::{
-    io::{Error, IoSlice},
+    ffi::CStr,
+    io::{Error, ErrorKind, IoSlice},
     mem,
-    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddrV4},
+    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddrV4, SocketAddrV6},
     os::fd::{AsRawFd, FromRawFd, RawFd},
 };
 
@@ -16,6 +17,7 @@ pub mod sys;
 
 use kern_control::SysControlSocket;
 
+use super::address::{ensure_valid_ipv6_prefix, ipv6_prefix_octets, parse_addr_spec};
 use super::{ifname_to_string, string_to_ifname};
 use crate::TunOptions;
 
@@ -71,11 +73,11 @@ impl TunInterface {
 
     #[throws]
     fn configure(&self, options: TunOptions) {
-        for addr in options.address {
+        for spec in options.address {
-            if let Ok(addr) = addr.parse::<IpAddr>() {
+            if let Some((addr, prefix_len)) = parse_addr_spec(&spec)? {
                 match addr {
                     IpAddr::V4(addr) => self.set_ipv4_addr(addr)?,
-                    IpAddr::V6(addr) => self.set_ipv6_addr(addr)?,
+                    IpAddr::V6(addr) => self.add_ipv6_addr(addr, prefix_len.unwrap_or(128))?,
                 }
             }
         }
@@ -148,18 +150,78 @@ impl TunInterface {
     }
 
     #[throws]
-    pub fn set_ipv6_addr(&self, _addr: Ipv6Addr) {
+    #[instrument]
-        // let addr = SockAddr::from(SocketAddrV6::new(addr, 0, 0, 0));
+    pub fn add_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
-        // println!("addr: {:?}", addr);
+        ensure_valid_ipv6_prefix(prefix_len)?;
-        // let mut iff = self.in6_ifreq()?;
+
-        // let sto = addr.as_storage();
+        let mut req: sys::in6_aliasreq = unsafe { mem::zeroed() };
-        // let ifadddr_ptr: *const sockaddr_in6 = addr_of!(sto).cast();
+        req.ifra_name = string_to_ifname(&self.name()?);
-        // iff.ifr_ifru.ifru_addr = unsafe { *ifadddr_ptr };
+        req.ifra_addr = ipv6_to_sockaddr(addr);
-        // println!("ifru addr set");
+        req.ifra_prefixmask = ipv6_prefix_mask(prefix_len)?;
-        // println!("{:?}", sys::SIOCSIFADDR_IN6);
+        self.perform6(|fd| unsafe { sys::if_add_addr6(fd, &req) })?;
-        // self.perform6(|fd| unsafe { sys::if_set_addr6(fd, &iff) })?;
+        tracing::info!(
-        // tracing::info!("ipv6_addr_set");
+            "ipv6_addr_added: {:?}/{} (fd: {:?})",
-        tracing::warn!("Setting IPV6 address on MacOS CLI mode is not supported yet.");
+            addr,
+            prefix_len,
+            self.as_raw_fd()
+        );
+    }
+
+    #[throws]
+    #[instrument]
+    pub fn remove_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
+        ensure_valid_ipv6_prefix(prefix_len)?;
+
+        let mut iff = self.in6_ifreq()?;
+        iff.ifr_ifru.ifru_addr = ipv6_to_sockaddr(addr);
+        iff.ifr_ifru.ifru_prefixmask = ipv6_prefix_mask(prefix_len)?;
+        self.perform6(|fd| unsafe { sys::if_del_addr6(fd, &iff) })?;
+        tracing::info!(
+            "ipv6_addr_removed: {:?}/{} (fd: {:?})",
+            addr,
+            prefix_len,
+            self.as_raw_fd()
+        );
+    }
+
+    #[throws]
+    #[instrument]
+    pub fn ipv6_addrs(&self) -> Vec<Ipv6Addr> {
+        struct IfAddrs(*mut libc::ifaddrs);
+
+        impl Drop for IfAddrs {
+            fn drop(&mut self) {
+                if !self.0.is_null() {
+                    unsafe { libc::freeifaddrs(self.0) };
+                }
+            }
+        }
+
+        let mut ifaddrs = std::ptr::null_mut();
+        unsafe {
+            if libc::getifaddrs(&mut ifaddrs) != 0 {
+                Err(Error::last_os_error())?;
+            }
+        }
+
+        let guard = IfAddrs(ifaddrs);
+        let interface_name = self.name()?;
+        let mut cursor = guard.0;
+        let mut result = Vec::new();
+
+        while let Some(ifa) = unsafe { cursor.as_ref() } {
+            if !ifa.ifa_addr.is_null()
+                && unsafe { (*ifa.ifa_addr).sa_family as i32 } == AF_INET6
+                && unsafe { CStr::from_ptr(ifa.ifa_name) }.to_string_lossy() == interface_name
+            {
+                let sockaddr = unsafe { *(ifa.ifa_addr as *const libc::sockaddr_in6) };
+                result.push(Ipv6Addr::from(in6_addr_octets(sockaddr.sin6_addr)));
+            }
+
+            cursor = ifa.ifa_next;
+        }
+
+        result
     }
 
     #[throws]
@@ -228,7 +290,6 @@ impl TunInterface {
     #[throws]
     #[instrument]
     pub fn send(&self, buf: &[u8]) -> usize {
-        use std::io::ErrorKind;
         let proto = match buf[0] >> 4 {
             6 => Ok(AF_INET6),
             4 => Ok(AF_INET),
@@ -250,3 +311,19 @@ impl TunInterface {
             .map_err(|_| Error::new(ErrorKind::Other, "Conversion error"))?
     }
 }
+
+#[inline]
+fn in6_addr_octets(addr: libc::in6_addr) -> [u8; 16] {
+    addr.s6_addr
+}
+
+fn ipv6_to_sockaddr(addr: Ipv6Addr) -> libc::sockaddr_in6 {
+    let sockaddr = SockAddr::from(SocketAddrV6::new(addr, 0, 0, 0));
+    unsafe { *(sockaddr.as_ptr() as *const libc::sockaddr_in6) }
+}
+
+#[throws]
+fn ipv6_prefix_mask(prefix_len: u8) -> libc::sockaddr_in6 {
+    let octets = ipv6_prefix_octets(prefix_len)?;
+    ipv6_to_sockaddr(Ipv6Addr::from(octets))
+}

tun/src/unix/apple/sys.rs

@@ -2,20 +2,11 @@ use std::mem;
 
 use libc::{c_char, c_int, c_short, c_uint, c_ulong, sockaddr, sockaddr_in6, time_t};
 pub use libc::{
-    c_void,
+    c_void, sockaddr_ctl, sockaddr_in, socklen_t, AF_SYSTEM, AF_SYS_CONTROL, IFNAMSIZ,
-    sockaddr_ctl,
-    sockaddr_in,
-    socklen_t,
-    AF_SYSTEM,
-    AF_SYS_CONTROL,
-    IFNAMSIZ,
     SYSPROTO_CONTROL,
 };
 use nix::{
-    ioctl_read_bad,
+    ioctl_read_bad, ioctl_readwrite, ioctl_write_ptr_bad, request_code_readwrite,
-    ioctl_readwrite,
-    ioctl_write_ptr_bad,
-    request_code_readwrite,
     request_code_write,
 };
 
@@ -77,7 +68,7 @@ pub struct ifreq {
 
 #[repr(C)]
 #[derive(Copy, Clone, Debug)]
-pub struct in6_addrlifetime{
+pub struct in6_addrlifetime {
     pub ia6t_expire: time_t,
     pub ia6t_preferred: time_t,
     pub ia6t_vltime: u32,
@@ -157,6 +148,7 @@ pub struct icmp6_ifstat {
 pub union ifr_ifru6 {
     pub ifru_addr: sockaddr_in6,
     pub ifru_dstaddr: sockaddr_in6,
+    pub ifru_prefixmask: sockaddr_in6,
     pub ifru_flags: c_int,
     pub ifru_flags6: c_int,
     pub ifru_metric: c_int,
@@ -165,7 +157,7 @@ pub union ifr_ifru6 {
     pub ifru_lifetime: in6_addrlifetime, // ifru_lifetime
     pub ifru_stat: in6_ifstat,
     pub ifru_icmp6stat: icmp6_ifstat,
-    pub ifru_scope_id: [u32; SCOPE6_ID_MAX]
+    pub ifru_scope_id: [u32; SCOPE6_ID_MAX],
 }
 
 #[repr(C)]
@@ -174,8 +166,21 @@ pub struct in6_ifreq {
     pub ifr_ifru: ifr_ifru6,
 }
 
+#[repr(C)]
+#[derive(Copy, Clone, Debug)]
+pub struct in6_aliasreq {
+    pub ifra_name: [c_char; IFNAMSIZ],
+    pub ifra_addr: sockaddr_in6,
+    pub ifra_dstaddr: sockaddr_in6,
+    pub ifra_prefixmask: sockaddr_in6,
+    pub ifra_lifetime: in6_addrlifetime,
+    pub ifra_flags: c_int,
+}
+
 pub const SIOCSIFADDR: c_ulong = request_code_write!(b'i', 12, mem::size_of::<ifreq>());
 pub const SIOCSIFADDR_IN6: c_ulong = request_code_write!(b'i', 12, mem::size_of::<in6_ifreq>());
+pub const SIOCAIFADDR_IN6: c_ulong = request_code_write!(b'i', 30, mem::size_of::<in6_aliasreq>());
+pub const SIOCDIFADDR_IN6: c_ulong = request_code_write!(b'i', 25, mem::size_of::<in6_ifreq>());
 pub const SIOCGIFMTU: c_ulong = request_code_readwrite!(b'i', 51, mem::size_of::<ifreq>());
 pub const SIOCSIFMTU: c_ulong = request_code_write!(b'i', 52, mem::size_of::<ifreq>());
 pub const SIOCGIFNETMASK: c_ulong = request_code_readwrite!(b'i', 37, mem::size_of::<ifreq>());
@@ -198,6 +203,7 @@ ioctl_read_bad!(if_get_addr, libc::SIOCGIFADDR, ifreq);
 ioctl_read_bad!(if_get_mtu, SIOCGIFMTU, ifreq);
 ioctl_read_bad!(if_get_netmask, SIOCGIFNETMASK, ifreq);
 ioctl_write_ptr_bad!(if_set_addr, SIOCSIFADDR, ifreq);
-ioctl_write_ptr_bad!(if_set_addr6, SIOCSIFADDR_IN6, in6_ifreq);
+ioctl_write_ptr_bad!(if_add_addr6, SIOCAIFADDR_IN6, in6_aliasreq);
+ioctl_write_ptr_bad!(if_del_addr6, SIOCDIFADDR_IN6, in6_ifreq);
 ioctl_write_ptr_bad!(if_set_mtu, SIOCSIFMTU, ifreq);
 ioctl_write_ptr_bad!(if_set_netmask, SIOCSIFNETMASK, ifreq);

tun/src/unix/linux/mod.rs

@@ -1,6 +1,7 @@
 use std::{
+    ffi::CStr,
     fs::OpenOptions,
-    io::{Error, Write},
+    io::Error,
     mem,
     net::{Ipv4Addr, Ipv6Addr, SocketAddrV4},
     os::{
@@ -10,10 +11,11 @@ use std::{
 };
 
 use fehler::throws;
-use libc::in6_ifreq;
+use libc::{in6_ifreq, AF_INET6};
 use socket2::{Domain, SockAddr, Socket, Type};
 use tracing::{info, instrument};
 
+use super::address::ensure_valid_ipv6_prefix;
 use super::{ifname_to_string, string_to_ifname};
 use crate::TunOptions;
 
@@ -140,11 +142,76 @@ impl TunInterface {
 
     #[throws]
     #[instrument]
-    pub fn set_ipv6_addr(&self, addr: Ipv6Addr) {
+    pub fn add_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
+        ensure_valid_ipv6_prefix(prefix_len)?;
+
         let mut iff = self.in6_ifreq()?;
         iff.ifr6_addr.s6_addr = addr.octets();
-        self.perform6(|fd| unsafe { sys::if_set_addr6(fd, &iff) })?;
+        iff.ifr6_prefixlen = prefix_len.into();
-        info!("ipv6_addr_set: {:?} (fd: {:?})", addr, self.as_raw_fd())
+        self.perform6(|fd| unsafe { sys::if_add_addr6(fd, &iff) })?;
+        info!(
+            "ipv6_addr_added: {:?}/{} (fd: {:?})",
+            addr,
+            prefix_len,
+            self.as_raw_fd()
+        )
+    }
+
+    #[throws]
+    #[instrument]
+    pub fn remove_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
+        ensure_valid_ipv6_prefix(prefix_len)?;
+
+        let mut iff = self.in6_ifreq()?;
+        iff.ifr6_addr.s6_addr = addr.octets();
+        iff.ifr6_prefixlen = prefix_len.into();
+        self.perform6(|fd| unsafe { sys::if_del_addr6(fd, &iff) })?;
+        info!(
+            "ipv6_addr_removed: {:?}/{} (fd: {:?})",
+            addr,
+            prefix_len,
+            self.as_raw_fd()
+        )
+    }
+
+    #[throws]
+    #[instrument]
+    pub fn ipv6_addrs(&self) -> Vec<Ipv6Addr> {
+        struct IfAddrs(*mut libc::ifaddrs);
+
+        impl Drop for IfAddrs {
+            fn drop(&mut self) {
+                if !self.0.is_null() {
+                    unsafe { libc::freeifaddrs(self.0) };
+                }
+            }
+        }
+
+        let mut ifaddrs = std::ptr::null_mut();
+        unsafe {
+            if libc::getifaddrs(&mut ifaddrs) != 0 {
+                Err(Error::last_os_error())?;
+            }
+        }
+
+        let guard = IfAddrs(ifaddrs);
+        let interface_name = self.name()?;
+        let mut cursor = guard.0;
+        let mut result = Vec::new();
+
+        while let Some(ifa) = unsafe { cursor.as_ref() } {
+            if !ifa.ifa_addr.is_null()
+                && unsafe { (*ifa.ifa_addr).sa_family as i32 } == AF_INET6
+                && unsafe { CStr::from_ptr(ifa.ifa_name) }.to_string_lossy() == interface_name
+            {
+                let sockaddr = unsafe { *(ifa.ifa_addr as *const libc::sockaddr_in6) };
+                result.push(Ipv6Addr::from(sockaddr.sin6_addr.s6_addr));
+            }
+
+            cursor = ifa.ifa_next;
+        }
+
+        result
     }
 
     #[throws]

tun/src/unix/linux/sys.rs

@@ -1,6 +1,6 @@
 use std::mem::size_of;
 
-pub use libc::{ifreq, sockaddr, sockaddr_in, sockaddr_in6};
+pub use libc::{ifreq, sockaddr_in};
 use nix::{ioctl_read_bad, ioctl_write_ptr_bad, request_code_read, request_code_write};
 
 ioctl_write_ptr_bad!(
@@ -20,7 +20,8 @@ ioctl_read_bad!(if_get_mtu, libc::SIOCGIFMTU, libc::ifreq);
 ioctl_read_bad!(if_get_netmask, libc::SIOCGIFNETMASK, libc::ifreq);
 
 ioctl_write_ptr_bad!(if_set_addr, libc::SIOCSIFADDR, libc::ifreq);
-ioctl_write_ptr_bad!(if_set_addr6, libc::SIOCSIFADDR, libc::in6_ifreq);
+ioctl_write_ptr_bad!(if_add_addr6, libc::SIOCSIFADDR, libc::in6_ifreq);
+ioctl_write_ptr_bad!(if_del_addr6, libc::SIOCDIFADDR, libc::in6_ifreq);
 ioctl_write_ptr_bad!(if_set_brdaddr, libc::SIOCSIFBRDADDR, libc::ifreq);
 ioctl_write_ptr_bad!(if_set_mtu, libc::SIOCSIFMTU, libc::ifreq);
 ioctl_write_ptr_bad!(if_set_netmask, libc::SIOCSIFNETMASK, libc::ifreq);

tun/src/unix/mod.rs

@@ -6,6 +6,7 @@ use std::{
 
 use tracing::instrument;
 
+mod address;
 mod queue;
 
 #[cfg(target_vendor = "apple")]

tun/tests/configure.rs

@@ -46,7 +46,7 @@ fn test_set_get_ipv6() {
     let tun = TunInterface::new()?;
 
     let addr = Ipv6Addr::new(1, 1, 1, 1, 1, 1, 1, 1);
-    tun.set_ipv6_addr(addr)?;
+    tun.add_ipv6_addr(addr, 128)?;
 
     // let result = tun.ipv6_addr()?;
     // assert_eq!(addr, result);

tun/tests/packets.rs

@@ -1,5 +1,5 @@
-use std::{io::Error, net::Ipv4Addr};
 use std::net::Ipv6Addr;
+use std::{io::Error, net::Ipv4Addr};
 
 use fehler::throws;
 use tun::TunInterface;
@@ -44,5 +44,5 @@ fn set_ipv6() {
     println!("tun name: {:?}", tun.name()?);
     let targ_addr: Ipv6Addr = "::1".parse().unwrap();
     println!("v6 addr: {:?}", targ_addr);
-    tun.set_ipv6_addr(targ_addr)?;
+    tun.add_ipv6_addr(targ_addr, 128)?;
 }

tun/tests/tokio.rs

@@ -1,3 +1,4 @@
+#[cfg(all(feature = "tokio", not(target_os = "windows")))]
 use std::net::Ipv4Addr;
 
 #[tokio::test]