Home | History | Annotate | Download | only in jni 
      1 /*
      2  * Copyright 2008, The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *     http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define LOG_TAG "NetUtils"
     18 
     19 #include "jni.h"
     20 #include "JNIHelp.h"
     21 #include "NetdClient.h"
     22 #include <utils/misc.h>
     23 #include <android_runtime/AndroidRuntime.h>
     24 #include <utils/Log.h>
     25 #include <arpa/inet.h>
     26 #include <net/if.h>
     27 #include <linux/filter.h>
     28 #include <linux/if.h>
     29 #include <linux/if_arp.h>
     30 #include <linux/if_ether.h>
     31 #include <linux/if_packet.h>
     32 #include <net/if_ether.h>
     33 #include <netinet/icmp6.h>
     34 #include <netinet/ip.h>
     35 #include <netinet/ip6.h>
     36 #include <netinet/udp.h>
     37 #include <cutils/properties.h>
     38 
     39 #include "core_jni_helpers.h"
     40 
     41 extern "C" {
     42 int ifc_enable(const char *ifname);
     43 int ifc_disable(const char *ifname);
     44 }
     45 
     46 #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
     47 
     48 namespace android {
     49 
     50 static const uint16_t kDhcpClientPort = 68;
     51 
     52 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
     53 {
     54     uint32_t ip_offset = sizeof(ether_header);
     55     uint32_t proto_offset = ip_offset + offsetof(iphdr, protocol);
     56     uint32_t flags_offset = ip_offset + offsetof(iphdr, frag_off);
     57     uint32_t dport_indirect_offset = ip_offset + offsetof(udphdr, dest);
     58     struct sock_filter filter_code[] = {
     59         // Check the protocol is UDP.
     60         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  proto_offset),
     61         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_UDP, 0, 6),
     62 
     63         // Check this is not a fragment.
     64         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS, flags_offset),
     65         BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K,   0x1fff, 4, 0),
     66 
     67         // Get the IP header length.
     68         BPF_STMT(BPF_LDX | BPF_B    | BPF_MSH, ip_offset),
     69 
     70         // Check the destination port.
     71         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, dport_indirect_offset),
     72         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 0, 1),
     73 
     74         // Accept or reject.
     75         BPF_STMT(BPF_RET | BPF_K,              0xffff),
     76         BPF_STMT(BPF_RET | BPF_K,              0)
     77     };
     78     struct sock_fprog filter = {
     79         sizeof(filter_code) / sizeof(filter_code[0]),
     80         filter_code,
     81     };
     82 
     83     int fd = jniGetFDFromFileDescriptor(env, javaFd);
     84     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
     85         jniThrowExceptionFmt(env, "java/net/SocketException",
     86                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
     87     }
     88 }
     89 
     90 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
     91         jint hardwareAddressType)
     92 {
     93     if (hardwareAddressType != ARPHRD_ETHER) {
     94         jniThrowExceptionFmt(env, "java/net/SocketException",
     95                 "attachRaFilter only supports ARPHRD_ETHER");
     96         return;
     97     }
     98 
     99     uint32_t ipv6_offset = sizeof(ether_header);
    100     uint32_t ipv6_next_header_offset = ipv6_offset + offsetof(ip6_hdr, ip6_nxt);
    101     uint32_t icmp6_offset = ipv6_offset + sizeof(ip6_hdr);
    102     uint32_t icmp6_type_offset = icmp6_offset + offsetof(icmp6_hdr, icmp6_type);
    103     struct sock_filter filter_code[] = {
    104         // Check IPv6 Next Header is ICMPv6.
    105         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  ipv6_next_header_offset),
    106         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_ICMPV6, 0, 3),
    107 
    108         // Check ICMPv6 type is Router Advertisement.
    109         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  icmp6_type_offset),
    110         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    ND_ROUTER_ADVERT, 0, 1),
    111 
    112         // Accept or reject.
    113         BPF_STMT(BPF_RET | BPF_K,              0xffff),
    114         BPF_STMT(BPF_RET | BPF_K,              0)
    115     };
    116     struct sock_fprog filter = {
    117         sizeof(filter_code) / sizeof(filter_code[0]),
    118         filter_code,
    119     };
    120 
    121     int fd = jniGetFDFromFileDescriptor(env, javaFd);
    122     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
    123         jniThrowExceptionFmt(env, "java/net/SocketException",
    124                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
    125     }
    126 }
    127 
    128 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
    129 {
    130     return (jboolean) !setNetworkForProcess(netId);
    131 }
    132 
    133 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
    134 {
    135     return getNetworkForProcess();
    136 }
    137 
    138 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
    139         jint netId)
    140 {
    141     return (jboolean) !setNetworkForResolv(netId);
    142 }
    143 
    144 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
    145         jint netId)
    146 {
    147     return setNetworkForSocket(netId, socket);
    148 }
    149 
    150 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
    151 {
    152     return (jboolean) !protectFromVpn(socket);
    153 }
    154 
    155 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
    156 {
    157     return (jboolean) !queryUserAccess(uid, netId);
    158 }
    159 
    160 
    161 // ----------------------------------------------------------------------------
    162 
    163 /*
    164  * JNI registration.
    165  */
    166 static const JNINativeMethod gNetworkUtilMethods[] = {
    167     /* name, signature, funcPtr */
    168     { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
    169     { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
    170     { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
    171     { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
    172     { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
    173     { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
    174     { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
    175     { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
    176 };
    177 
    178 int register_android_net_NetworkUtils(JNIEnv* env)
    179 {
    180     return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
    181                                 NELEM(gNetworkUtilMethods));
    182 }
    183 
    184 }; // namespace android
    185