PageRenderTime 59ms CodeModel.GetById 25ms RepoModel.GetById 0ms app.codeStats 0ms

/core/jni/android_net_NetUtils.cpp

https://gitlab.com/drgroovestarr/frameworks_base
C++ | 352 lines | 232 code | 52 blank | 68 comment | 24 complexity | e5e12d1708cddc2bfb88c1a159169c40 MD5 | raw file
  1. /*
  2. * Copyright 2008, The Android Open Source Project
  3. *
  4. * Licensed under the Apache License, Version 2.0 (the "License");
  5. * you may not use this file except in compliance with the License.
  6. * You may obtain a copy of the License at
  7. *
  8. * http://www.apache.org/licenses/LICENSE-2.0
  9. *
  10. * Unless required by applicable law or agreed to in writing, software
  11. * distributed under the License is distributed on an "AS IS" BASIS,
  12. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. * See the License for the specific language governing permissions and
  14. * limitations under the License.
  15. */
  16. #define LOG_TAG "NetUtils"
  17. #include "jni.h"
  18. #include <nativehelper/JNIHelp.h>
  19. #include "NetdClient.h"
  20. #include <utils/misc.h>
  21. #include <android_runtime/AndroidRuntime.h>
  22. #include <utils/Log.h>
  23. #include <arpa/inet.h>
  24. #include <net/if.h>
  25. #include <linux/filter.h>
  26. #include <linux/if_arp.h>
  27. #include <netinet/ether.h>
  28. #include <netinet/icmp6.h>
  29. #include <netinet/ip.h>
  30. #include <netinet/ip6.h>
  31. #include <netinet/udp.h>
  32. #include <cutils/properties.h>
  33. #include "core_jni_helpers.h"
  34. extern "C" {
  35. int ifc_enable(const char *ifname);
  36. int ifc_disable(const char *ifname);
  37. }
  38. #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
  39. namespace android {
  40. static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type);
  41. static const uint32_t kEtherHeaderLen = sizeof(ether_header);
  42. static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol);
  43. static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off);
  44. static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt);
  45. static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr);
  46. static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type);
  47. static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source);
  48. static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest);
  49. static const uint16_t kDhcpClientPort = 68;
  50. static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
  51. {
  52. struct sock_filter filter_code[] = {
  53. // Check the protocol is UDP.
  54. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
  55. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6),
  56. // Check this is not a fragment.
  57. BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
  58. BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0),
  59. // Get the IP header length.
  60. BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
  61. // Check the destination port.
  62. BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
  63. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1),
  64. // Accept or reject.
  65. BPF_STMT(BPF_RET | BPF_K, 0xffff),
  66. BPF_STMT(BPF_RET | BPF_K, 0)
  67. };
  68. struct sock_fprog filter = {
  69. sizeof(filter_code) / sizeof(filter_code[0]),
  70. filter_code,
  71. };
  72. int fd = jniGetFDFromFileDescriptor(env, javaFd);
  73. if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
  74. jniThrowExceptionFmt(env, "java/net/SocketException",
  75. "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
  76. }
  77. }
  78. static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
  79. jint hardwareAddressType)
  80. {
  81. if (hardwareAddressType != ARPHRD_ETHER) {
  82. jniThrowExceptionFmt(env, "java/net/SocketException",
  83. "attachRaFilter only supports ARPHRD_ETHER");
  84. return;
  85. }
  86. struct sock_filter filter_code[] = {
  87. // Check IPv6 Next Header is ICMPv6.
  88. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
  89. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
  90. // Check ICMPv6 type is Router Advertisement.
  91. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
  92. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1),
  93. // Accept or reject.
  94. BPF_STMT(BPF_RET | BPF_K, 0xffff),
  95. BPF_STMT(BPF_RET | BPF_K, 0)
  96. };
  97. struct sock_fprog filter = {
  98. sizeof(filter_code) / sizeof(filter_code[0]),
  99. filter_code,
  100. };
  101. int fd = jniGetFDFromFileDescriptor(env, javaFd);
  102. if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
  103. jniThrowExceptionFmt(env, "java/net/SocketException",
  104. "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
  105. }
  106. }
  107. // TODO: Move all this filter code into libnetutils.
  108. static void android_net_utils_attachControlPacketFilter(
  109. JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) {
  110. if (hardwareAddressType != ARPHRD_ETHER) {
  111. jniThrowExceptionFmt(env, "java/net/SocketException",
  112. "attachControlPacketFilter only supports ARPHRD_ETHER");
  113. return;
  114. }
  115. // Capture all:
  116. // - ARPs
  117. // - DHCPv4 packets
  118. // - Router Advertisements & Solicitations
  119. // - Neighbor Advertisements & Solicitations
  120. //
  121. // tcpdump:
  122. // arp or
  123. // '(ip and udp port 68)' or
  124. // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
  125. struct sock_filter filter_code[] = {
  126. // Load the link layer next payload field.
  127. BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset),
  128. // Accept all ARP.
  129. // TODO: Figure out how to better filter ARPs on noisy networks.
  130. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0),
  131. // If IPv4:
  132. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9),
  133. // Check the protocol is UDP.
  134. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
  135. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14),
  136. // Check this is not a fragment.
  137. BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
  138. BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0),
  139. // Get the IP header length.
  140. BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
  141. // Check the source port.
  142. BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset),
  143. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0),
  144. // Check the destination port.
  145. BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
  146. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7),
  147. // IPv6 ...
  148. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6),
  149. // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
  150. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
  151. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4),
  152. // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
  153. BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
  154. BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2),
  155. BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0),
  156. // Accept or reject.
  157. BPF_STMT(BPF_RET | BPF_K, 0xffff),
  158. BPF_STMT(BPF_RET | BPF_K, 0)
  159. };
  160. struct sock_fprog filter = {
  161. sizeof(filter_code) / sizeof(filter_code[0]),
  162. filter_code,
  163. };
  164. int fd = jniGetFDFromFileDescriptor(env, javaFd);
  165. if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
  166. jniThrowExceptionFmt(env, "java/net/SocketException",
  167. "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
  168. }
  169. }
  170. static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd,
  171. jint ifIndex)
  172. {
  173. static const int kLinkLocalHopLimit = 255;
  174. int fd = jniGetFDFromFileDescriptor(env, javaFd);
  175. // Set an ICMPv6 filter that only passes Router Solicitations.
  176. struct icmp6_filter rs_only;
  177. ICMP6_FILTER_SETBLOCKALL(&rs_only);
  178. ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only);
  179. socklen_t len = sizeof(rs_only);
  180. if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) {
  181. jniThrowExceptionFmt(env, "java/net/SocketException",
  182. "setsockopt(ICMP6_FILTER): %s", strerror(errno));
  183. return;
  184. }
  185. // Most/all of the rest of these options can be set via Java code, but
  186. // because we're here on account of setting an icmp6_filter go ahead
  187. // and do it all natively for now.
  188. //
  189. // TODO: Consider moving these out to Java.
  190. // Set the multicast hoplimit to 255 (link-local only).
  191. int hops = kLinkLocalHopLimit;
  192. len = sizeof(hops);
  193. if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) {
  194. jniThrowExceptionFmt(env, "java/net/SocketException",
  195. "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno));
  196. return;
  197. }
  198. // Set the unicast hoplimit to 255 (link-local only).
  199. hops = kLinkLocalHopLimit;
  200. len = sizeof(hops);
  201. if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) {
  202. jniThrowExceptionFmt(env, "java/net/SocketException",
  203. "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno));
  204. return;
  205. }
  206. // Explicitly disable multicast loopback.
  207. int off = 0;
  208. len = sizeof(off);
  209. if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) {
  210. jniThrowExceptionFmt(env, "java/net/SocketException",
  211. "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno));
  212. return;
  213. }
  214. // Specify the IPv6 interface to use for outbound multicast.
  215. len = sizeof(ifIndex);
  216. if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) {
  217. jniThrowExceptionFmt(env, "java/net/SocketException",
  218. "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno));
  219. return;
  220. }
  221. // Additional options to be considered:
  222. // - IPV6_TCLASS
  223. // - IPV6_RECVPKTINFO
  224. // - IPV6_RECVHOPLIMIT
  225. // Bind to [::].
  226. const struct sockaddr_in6 sin6 = {
  227. .sin6_family = AF_INET6,
  228. .sin6_port = 0,
  229. .sin6_flowinfo = 0,
  230. .sin6_addr = IN6ADDR_ANY_INIT,
  231. .sin6_scope_id = 0,
  232. };
  233. auto sa = reinterpret_cast<const struct sockaddr *>(&sin6);
  234. len = sizeof(sin6);
  235. if (bind(fd, sa, len) != 0) {
  236. jniThrowExceptionFmt(env, "java/net/SocketException",
  237. "bind(IN6ADDR_ANY): %s", strerror(errno));
  238. return;
  239. }
  240. // Join the all-routers multicast group, ff02::2%index.
  241. struct ipv6_mreq all_rtrs = {
  242. .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}},
  243. .ipv6mr_interface = ifIndex,
  244. };
  245. len = sizeof(all_rtrs);
  246. if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) {
  247. jniThrowExceptionFmt(env, "java/net/SocketException",
  248. "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno));
  249. return;
  250. }
  251. }
  252. static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
  253. {
  254. return (jboolean) !setNetworkForProcess(netId);
  255. }
  256. static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
  257. {
  258. return getNetworkForProcess();
  259. }
  260. static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
  261. jint netId)
  262. {
  263. return (jboolean) !setNetworkForResolv(netId);
  264. }
  265. static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
  266. jint netId)
  267. {
  268. return setNetworkForSocket(netId, socket);
  269. }
  270. static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
  271. {
  272. return (jboolean) !protectFromVpn(socket);
  273. }
  274. static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
  275. {
  276. return (jboolean) !queryUserAccess(uid, netId);
  277. }
  278. // ----------------------------------------------------------------------------
  279. /*
  280. * JNI registration.
  281. */
  282. static const JNINativeMethod gNetworkUtilMethods[] = {
  283. /* name, signature, funcPtr */
  284. { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
  285. { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
  286. { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
  287. { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
  288. { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
  289. { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
  290. { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
  291. { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
  292. { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter },
  293. { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket },
  294. };
  295. int register_android_net_NetworkUtils(JNIEnv* env)
  296. {
  297. return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
  298. NELEM(gNetworkUtilMethods));
  299. }
  300. }; // namespace android