1 /*
2 * Copyright 2008, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "NetUtils"
18
19 #include "jni.h"
20 #include "JNIHelp.h"
21 #include "NetdClient.h"
22 #include <utils/misc.h>
23 #include <android_runtime/AndroidRuntime.h>
24 #include <utils/Log.h>
25 #include <arpa/inet.h>
26 #include <net/if.h>
27 #include <linux/filter.h>
28 #include <linux/if.h>
29 #include <linux/if_arp.h>
30 #include <linux/if_ether.h>
31 #include <linux/if_packet.h>
32 #include <net/if_ether.h>
33 #include <netinet/icmp6.h>
34 #include <netinet/ip.h>
35 #include <netinet/ip6.h>
36 #include <netinet/udp.h>
37 #include <cutils/properties.h>
38
39 #include "core_jni_helpers.h"
40
41 extern "C" {
42 int ifc_enable(const char *ifname);
43 int ifc_disable(const char *ifname);
44 }
45
46 #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
47
48 namespace android {
49
50 static const uint16_t kDhcpClientPort = 68;
51
android_net_utils_attachDhcpFilter(JNIEnv * env,jobject clazz,jobject javaFd)52 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
53 {
54 uint32_t ip_offset = sizeof(ether_header);
55 uint32_t proto_offset = ip_offset + offsetof(iphdr, protocol);
56 uint32_t flags_offset = ip_offset + offsetof(iphdr, frag_off);
57 uint32_t dport_indirect_offset = ip_offset + offsetof(udphdr, dest);
58 struct sock_filter filter_code[] = {
59 // Check the protocol is UDP.
60 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, proto_offset),
61 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6),
62
63 // Check this is not a fragment.
64 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, flags_offset),
65 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0x1fff, 4, 0),
66
67 // Get the IP header length.
68 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, ip_offset),
69
70 // Check the destination port.
71 BPF_STMT(BPF_LD | BPF_H | BPF_IND, dport_indirect_offset),
72 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1),
73
74 // Accept or reject.
75 BPF_STMT(BPF_RET | BPF_K, 0xffff),
76 BPF_STMT(BPF_RET | BPF_K, 0)
77 };
78 struct sock_fprog filter = {
79 sizeof(filter_code) / sizeof(filter_code[0]),
80 filter_code,
81 };
82
83 int fd = jniGetFDFromFileDescriptor(env, javaFd);
84 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
85 jniThrowExceptionFmt(env, "java/net/SocketException",
86 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
87 }
88 }
89
android_net_utils_attachRaFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)90 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
91 jint hardwareAddressType)
92 {
93 if (hardwareAddressType != ARPHRD_ETHER) {
94 jniThrowExceptionFmt(env, "java/net/SocketException",
95 "attachRaFilter only supports ARPHRD_ETHER");
96 return;
97 }
98
99 uint32_t ipv6_offset = sizeof(ether_header);
100 uint32_t ipv6_next_header_offset = ipv6_offset + offsetof(ip6_hdr, ip6_nxt);
101 uint32_t icmp6_offset = ipv6_offset + sizeof(ip6_hdr);
102 uint32_t icmp6_type_offset = icmp6_offset + offsetof(icmp6_hdr, icmp6_type);
103 struct sock_filter filter_code[] = {
104 // Check IPv6 Next Header is ICMPv6.
105 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, ipv6_next_header_offset),
106 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
107
108 // Check ICMPv6 type is Router Advertisement.
109 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, icmp6_type_offset),
110 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1),
111
112 // Accept or reject.
113 BPF_STMT(BPF_RET | BPF_K, 0xffff),
114 BPF_STMT(BPF_RET | BPF_K, 0)
115 };
116 struct sock_fprog filter = {
117 sizeof(filter_code) / sizeof(filter_code[0]),
118 filter_code,
119 };
120
121 int fd = jniGetFDFromFileDescriptor(env, javaFd);
122 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
123 jniThrowExceptionFmt(env, "java/net/SocketException",
124 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
125 }
126 }
127
android_net_utils_setupRaSocket(JNIEnv * env,jobject clazz,jobject javaFd,jint ifIndex)128 static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd,
129 jint ifIndex)
130 {
131 static const int kLinkLocalHopLimit = 255;
132
133 int fd = jniGetFDFromFileDescriptor(env, javaFd);
134
135 // Set an ICMPv6 filter that only passes Router Solicitations.
136 struct icmp6_filter rs_only;
137 ICMP6_FILTER_SETBLOCKALL(&rs_only);
138 ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only);
139 socklen_t len = sizeof(rs_only);
140 if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) {
141 jniThrowExceptionFmt(env, "java/net/SocketException",
142 "setsockopt(ICMP6_FILTER): %s", strerror(errno));
143 return;
144 }
145
146 // Most/all of the rest of these options can be set via Java code, but
147 // because we're here on account of setting an icmp6_filter go ahead
148 // and do it all natively for now.
149 //
150 // TODO: Consider moving these out to Java.
151
152 // Set the multicast hoplimit to 255 (link-local only).
153 int hops = kLinkLocalHopLimit;
154 len = sizeof(hops);
155 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) {
156 jniThrowExceptionFmt(env, "java/net/SocketException",
157 "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno));
158 return;
159 }
160
161 // Set the unicast hoplimit to 255 (link-local only).
162 hops = kLinkLocalHopLimit;
163 len = sizeof(hops);
164 if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) {
165 jniThrowExceptionFmt(env, "java/net/SocketException",
166 "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno));
167 return;
168 }
169
170 // Explicitly disable multicast loopback.
171 int off = 0;
172 len = sizeof(off);
173 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) {
174 jniThrowExceptionFmt(env, "java/net/SocketException",
175 "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno));
176 return;
177 }
178
179 // Specify the IPv6 interface to use for outbound multicast.
180 len = sizeof(ifIndex);
181 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) {
182 jniThrowExceptionFmt(env, "java/net/SocketException",
183 "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno));
184 return;
185 }
186
187 // Additional options to be considered:
188 // - IPV6_TCLASS
189 // - IPV6_RECVPKTINFO
190 // - IPV6_RECVHOPLIMIT
191
192 // Bind to [::].
193 const struct sockaddr_in6 sin6 = {
194 .sin6_family = AF_INET6,
195 .sin6_port = 0,
196 .sin6_flowinfo = 0,
197 .sin6_addr = IN6ADDR_ANY_INIT,
198 .sin6_scope_id = 0,
199 };
200 auto sa = reinterpret_cast<const struct sockaddr *>(&sin6);
201 len = sizeof(sin6);
202 if (bind(fd, sa, len) != 0) {
203 jniThrowExceptionFmt(env, "java/net/SocketException",
204 "bind(IN6ADDR_ANY): %s", strerror(errno));
205 return;
206 }
207
208 // Join the all-routers multicast group, ff02::2%index.
209 struct ipv6_mreq all_rtrs = {
210 .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}},
211 .ipv6mr_interface = ifIndex,
212 };
213 len = sizeof(all_rtrs);
214 if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) {
215 jniThrowExceptionFmt(env, "java/net/SocketException",
216 "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno));
217 return;
218 }
219 }
220
android_net_utils_bindProcessToNetwork(JNIEnv * env,jobject thiz,jint netId)221 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
222 {
223 return (jboolean) !setNetworkForProcess(netId);
224 }
225
android_net_utils_getBoundNetworkForProcess(JNIEnv * env,jobject thiz)226 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
227 {
228 return getNetworkForProcess();
229 }
230
android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv * env,jobject thiz,jint netId)231 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
232 jint netId)
233 {
234 return (jboolean) !setNetworkForResolv(netId);
235 }
236
android_net_utils_bindSocketToNetwork(JNIEnv * env,jobject thiz,jint socket,jint netId)237 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
238 jint netId)
239 {
240 return setNetworkForSocket(netId, socket);
241 }
242
android_net_utils_protectFromVpn(JNIEnv * env,jobject thiz,jint socket)243 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
244 {
245 return (jboolean) !protectFromVpn(socket);
246 }
247
android_net_utils_queryUserAccess(JNIEnv * env,jobject thiz,jint uid,jint netId)248 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
249 {
250 return (jboolean) !queryUserAccess(uid, netId);
251 }
252
253
254 // ----------------------------------------------------------------------------
255
256 /*
257 * JNI registration.
258 */
259 static const JNINativeMethod gNetworkUtilMethods[] = {
260 /* name, signature, funcPtr */
261 { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
262 { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
263 { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
264 { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
265 { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
266 { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
267 { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
268 { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
269 { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket },
270 };
271
register_android_net_NetworkUtils(JNIEnv * env)272 int register_android_net_NetworkUtils(JNIEnv* env)
273 {
274 return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
275 NELEM(gNetworkUtilMethods));
276 }
277
278 }; // namespace android
279