1 /* 2 * Copyright 2008, The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #define LOG_TAG "NetUtils" 18 19 #include "jni.h" 20 #include <nativehelper/JNIHelp.h> 21 #include "NetdClient.h" 22 #include <utils/misc.h> 23 #include <android_runtime/AndroidRuntime.h> 24 #include <utils/Log.h> 25 #include <arpa/inet.h> 26 #include <net/if.h> 27 #include <linux/filter.h> 28 #include <linux/if_arp.h> 29 #include <netinet/ether.h> 30 #include <netinet/icmp6.h> 31 #include <netinet/ip.h> 32 #include <netinet/ip6.h> 33 #include <netinet/udp.h> 34 #include <cutils/properties.h> 35 36 #include "core_jni_helpers.h" 37 38 extern "C" { 39 int ifc_enable(const char *ifname); 40 int ifc_disable(const char *ifname); 41 } 42 43 #define NETUTILS_PKG_NAME "android/net/NetworkUtils" 44 45 namespace android { 46 47 static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type); 48 static const uint32_t kEtherHeaderLen = sizeof(ether_header); 49 static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol); 50 static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off); 51 static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt); 52 static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr); 53 static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type); 54 static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source); 55 static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest); 56 static const uint16_t kDhcpClientPort = 68; 57 58 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd) 59 { 60 struct sock_filter filter_code[] = { 61 // Check the protocol is UDP. 62 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), 63 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6), 64 65 // Check this is not a fragment. 66 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), 67 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0), 68 69 // Get the IP header length. 70 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), 71 72 // Check the destination port. 73 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), 74 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1), 75 76 // Accept or reject. 77 BPF_STMT(BPF_RET | BPF_K, 0xffff), 78 BPF_STMT(BPF_RET | BPF_K, 0) 79 }; 80 struct sock_fprog filter = { 81 sizeof(filter_code) / sizeof(filter_code[0]), 82 filter_code, 83 }; 84 85 int fd = jniGetFDFromFileDescriptor(env, javaFd); 86 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { 87 jniThrowExceptionFmt(env, "java/net/SocketException", 88 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); 89 } 90 } 91 92 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd, 93 jint hardwareAddressType) 94 { 95 if (hardwareAddressType != ARPHRD_ETHER) { 96 jniThrowExceptionFmt(env, "java/net/SocketException", 97 "attachRaFilter only supports ARPHRD_ETHER"); 98 return; 99 } 100 101 struct sock_filter filter_code[] = { 102 // Check IPv6 Next Header is ICMPv6. 103 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), 104 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3), 105 106 // Check ICMPv6 type is Router Advertisement. 107 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), 108 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1), 109 110 // Accept or reject. 111 BPF_STMT(BPF_RET | BPF_K, 0xffff), 112 BPF_STMT(BPF_RET | BPF_K, 0) 113 }; 114 struct sock_fprog filter = { 115 sizeof(filter_code) / sizeof(filter_code[0]), 116 filter_code, 117 }; 118 119 int fd = jniGetFDFromFileDescriptor(env, javaFd); 120 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { 121 jniThrowExceptionFmt(env, "java/net/SocketException", 122 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); 123 } 124 } 125 126 // TODO: Move all this filter code into libnetutils. 127 static void android_net_utils_attachControlPacketFilter( 128 JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) { 129 if (hardwareAddressType != ARPHRD_ETHER) { 130 jniThrowExceptionFmt(env, "java/net/SocketException", 131 "attachControlPacketFilter only supports ARPHRD_ETHER"); 132 return; 133 } 134 135 // Capture all: 136 // - ARPs 137 // - DHCPv4 packets 138 // - Router Advertisements & Solicitations 139 // - Neighbor Advertisements & Solicitations 140 // 141 // tcpdump: 142 // arp or 143 // '(ip and udp port 68)' or 144 // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)' 145 struct sock_filter filter_code[] = { 146 // Load the link layer next payload field. 147 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset), 148 149 // Accept all ARP. 150 // TODO: Figure out how to better filter ARPs on noisy networks. 151 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0), 152 153 // If IPv4: 154 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9), 155 156 // Check the protocol is UDP. 157 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), 158 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14), 159 160 // Check this is not a fragment. 161 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), 162 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0), 163 164 // Get the IP header length. 165 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), 166 167 // Check the source port. 168 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset), 169 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0), 170 171 // Check the destination port. 172 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), 173 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7), 174 175 // IPv6 ... 176 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6), 177 // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ... 178 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), 179 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4), 180 // ... and check the ICMPv6 type is one of RS/RA/NS/NA. 181 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), 182 BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2), 183 BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0), 184 185 // Accept or reject. 186 BPF_STMT(BPF_RET | BPF_K, 0xffff), 187 BPF_STMT(BPF_RET | BPF_K, 0) 188 }; 189 struct sock_fprog filter = { 190 sizeof(filter_code) / sizeof(filter_code[0]), 191 filter_code, 192 }; 193 194 int fd = jniGetFDFromFileDescriptor(env, javaFd); 195 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { 196 jniThrowExceptionFmt(env, "java/net/SocketException", 197 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); 198 } 199 } 200 201 static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd, 202 jint ifIndex) 203 { 204 static const int kLinkLocalHopLimit = 255; 205 206 int fd = jniGetFDFromFileDescriptor(env, javaFd); 207 208 // Set an ICMPv6 filter that only passes Router Solicitations. 209 struct icmp6_filter rs_only; 210 ICMP6_FILTER_SETBLOCKALL(&rs_only); 211 ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only); 212 socklen_t len = sizeof(rs_only); 213 if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) { 214 jniThrowExceptionFmt(env, "java/net/SocketException", 215 "setsockopt(ICMP6_FILTER): %s", strerror(errno)); 216 return; 217 } 218 219 // Most/all of the rest of these options can be set via Java code, but 220 // because we're here on account of setting an icmp6_filter go ahead 221 // and do it all natively for now. 222 // 223 // TODO: Consider moving these out to Java. 224 225 // Set the multicast hoplimit to 255 (link-local only). 226 int hops = kLinkLocalHopLimit; 227 len = sizeof(hops); 228 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) { 229 jniThrowExceptionFmt(env, "java/net/SocketException", 230 "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno)); 231 return; 232 } 233 234 // Set the unicast hoplimit to 255 (link-local only). 235 hops = kLinkLocalHopLimit; 236 len = sizeof(hops); 237 if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) { 238 jniThrowExceptionFmt(env, "java/net/SocketException", 239 "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno)); 240 return; 241 } 242 243 // Explicitly disable multicast loopback. 244 int off = 0; 245 len = sizeof(off); 246 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) { 247 jniThrowExceptionFmt(env, "java/net/SocketException", 248 "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno)); 249 return; 250 } 251 252 // Specify the IPv6 interface to use for outbound multicast. 253 len = sizeof(ifIndex); 254 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) { 255 jniThrowExceptionFmt(env, "java/net/SocketException", 256 "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno)); 257 return; 258 } 259 260 // Additional options to be considered: 261 // - IPV6_TCLASS 262 // - IPV6_RECVPKTINFO 263 // - IPV6_RECVHOPLIMIT 264 265 // Bind to [::]. 266 const struct sockaddr_in6 sin6 = { 267 .sin6_family = AF_INET6, 268 .sin6_port = 0, 269 .sin6_flowinfo = 0, 270 .sin6_addr = IN6ADDR_ANY_INIT, 271 .sin6_scope_id = 0, 272 }; 273 auto sa = reinterpret_cast<const struct sockaddr *>(&sin6); 274 len = sizeof(sin6); 275 if (bind(fd, sa, len) != 0) { 276 jniThrowExceptionFmt(env, "java/net/SocketException", 277 "bind(IN6ADDR_ANY): %s", strerror(errno)); 278 return; 279 } 280 281 // Join the all-routers multicast group, ff02::2%index. 282 struct ipv6_mreq all_rtrs = { 283 .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}}, 284 .ipv6mr_interface = ifIndex, 285 }; 286 len = sizeof(all_rtrs); 287 if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) { 288 jniThrowExceptionFmt(env, "java/net/SocketException", 289 "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno)); 290 return; 291 } 292 } 293 294 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId) 295 { 296 return (jboolean) !setNetworkForProcess(netId); 297 } 298 299 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz) 300 { 301 return getNetworkForProcess(); 302 } 303 304 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz, 305 jint netId) 306 { 307 return (jboolean) !setNetworkForResolv(netId); 308 } 309 310 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket, 311 jint netId) 312 { 313 return setNetworkForSocket(netId, socket); 314 } 315 316 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket) 317 { 318 return (jboolean) !protectFromVpn(socket); 319 } 320 321 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId) 322 { 323 return (jboolean) !queryUserAccess(uid, netId); 324 } 325 326 327 // ---------------------------------------------------------------------------- 328 329 /* 330 * JNI registration. 331 */ 332 static const JNINativeMethod gNetworkUtilMethods[] = { 333 /* name, signature, funcPtr */ 334 { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork }, 335 { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess }, 336 { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution }, 337 { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork }, 338 { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn }, 339 { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess }, 340 { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter }, 341 { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter }, 342 { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter }, 343 { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket }, 344 }; 345 346 int register_android_net_NetworkUtils(JNIEnv* env) 347 { 348 return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods, 349 NELEM(gNetworkUtilMethods)); 350 } 351 352 }; // namespace android 353
