1 /*
2 * Copyright 2008, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "NetUtils"
18
19 #include "jni.h"
20 #include "JNIHelp.h"
21 #include "NetdClient.h"
22 #include <utils/misc.h>
23 #include <android_runtime/AndroidRuntime.h>
24 #include <utils/Log.h>
25 #include <arpa/inet.h>
26 #include <net/if.h>
27 #include <linux/filter.h>
28 #include <linux/if.h>
29 #include <linux/if_arp.h>
30 #include <linux/if_ether.h>
31 #include <linux/if_packet.h>
32 #include <net/if_ether.h>
33 #include <netinet/icmp6.h>
34 #include <netinet/ip.h>
35 #include <netinet/ip6.h>
36 #include <netinet/udp.h>
37 #include <cutils/properties.h>
38
39 #include "core_jni_helpers.h"
40
41 extern "C" {
42 int ifc_enable(const char *ifname);
43 int ifc_disable(const char *ifname);
44 }
45
46 #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
47
48 namespace android {
49
50 static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type);
51 static const uint32_t kEtherHeaderLen = sizeof(ether_header);
52 static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol);
53 static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off);
54 static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt);
55 static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr);
56 static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type);
57 static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source);
58 static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest);
59 static const uint16_t kDhcpClientPort = 68;
60
android_net_utils_attachDhcpFilter(JNIEnv * env,jobject clazz,jobject javaFd)61 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
62 {
63 struct sock_filter filter_code[] = {
64 // Check the protocol is UDP.
65 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
66 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6),
67
68 // Check this is not a fragment.
69 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
70 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0),
71
72 // Get the IP header length.
73 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
74
75 // Check the destination port.
76 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
77 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1),
78
79 // Accept or reject.
80 BPF_STMT(BPF_RET | BPF_K, 0xffff),
81 BPF_STMT(BPF_RET | BPF_K, 0)
82 };
83 struct sock_fprog filter = {
84 sizeof(filter_code) / sizeof(filter_code[0]),
85 filter_code,
86 };
87
88 int fd = jniGetFDFromFileDescriptor(env, javaFd);
89 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
90 jniThrowExceptionFmt(env, "java/net/SocketException",
91 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
92 }
93 }
94
android_net_utils_attachRaFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)95 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
96 jint hardwareAddressType)
97 {
98 if (hardwareAddressType != ARPHRD_ETHER) {
99 jniThrowExceptionFmt(env, "java/net/SocketException",
100 "attachRaFilter only supports ARPHRD_ETHER");
101 return;
102 }
103
104 struct sock_filter filter_code[] = {
105 // Check IPv6 Next Header is ICMPv6.
106 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
107 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
108
109 // Check ICMPv6 type is Router Advertisement.
110 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
111 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1),
112
113 // Accept or reject.
114 BPF_STMT(BPF_RET | BPF_K, 0xffff),
115 BPF_STMT(BPF_RET | BPF_K, 0)
116 };
117 struct sock_fprog filter = {
118 sizeof(filter_code) / sizeof(filter_code[0]),
119 filter_code,
120 };
121
122 int fd = jniGetFDFromFileDescriptor(env, javaFd);
123 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
124 jniThrowExceptionFmt(env, "java/net/SocketException",
125 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
126 }
127 }
128
129 // TODO: Move all this filter code into libnetutils.
android_net_utils_attachControlPacketFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)130 static void android_net_utils_attachControlPacketFilter(
131 JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) {
132 if (hardwareAddressType != ARPHRD_ETHER) {
133 jniThrowExceptionFmt(env, "java/net/SocketException",
134 "attachControlPacketFilter only supports ARPHRD_ETHER");
135 return;
136 }
137
138 // Capture all:
139 // - ARPs
140 // - DHCPv4 packets
141 // - Router Advertisements & Solicitations
142 // - Neighbor Advertisements & Solicitations
143 //
144 // tcpdump:
145 // arp or
146 // '(ip and udp port 68)' or
147 // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
148 struct sock_filter filter_code[] = {
149 // Load the link layer next payload field.
150 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset),
151
152 // Accept all ARP.
153 // TODO: Figure out how to better filter ARPs on noisy networks.
154 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0),
155
156 // If IPv4:
157 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9),
158
159 // Check the protocol is UDP.
160 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
161 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14),
162
163 // Check this is not a fragment.
164 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
165 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0),
166
167 // Get the IP header length.
168 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
169
170 // Check the source port.
171 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset),
172 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0),
173
174 // Check the destination port.
175 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
176 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7),
177
178 // IPv6 ...
179 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6),
180 // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
181 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
182 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4),
183 // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
184 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
185 BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2),
186 BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0),
187
188 // Accept or reject.
189 BPF_STMT(BPF_RET | BPF_K, 0xffff),
190 BPF_STMT(BPF_RET | BPF_K, 0)
191 };
192 struct sock_fprog filter = {
193 sizeof(filter_code) / sizeof(filter_code[0]),
194 filter_code,
195 };
196
197 int fd = jniGetFDFromFileDescriptor(env, javaFd);
198 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
199 jniThrowExceptionFmt(env, "java/net/SocketException",
200 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
201 }
202 }
203
android_net_utils_setupRaSocket(JNIEnv * env,jobject clazz,jobject javaFd,jint ifIndex)204 static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd,
205 jint ifIndex)
206 {
207 static const int kLinkLocalHopLimit = 255;
208
209 int fd = jniGetFDFromFileDescriptor(env, javaFd);
210
211 // Set an ICMPv6 filter that only passes Router Solicitations.
212 struct icmp6_filter rs_only;
213 ICMP6_FILTER_SETBLOCKALL(&rs_only);
214 ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only);
215 socklen_t len = sizeof(rs_only);
216 if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) {
217 jniThrowExceptionFmt(env, "java/net/SocketException",
218 "setsockopt(ICMP6_FILTER): %s", strerror(errno));
219 return;
220 }
221
222 // Most/all of the rest of these options can be set via Java code, but
223 // because we're here on account of setting an icmp6_filter go ahead
224 // and do it all natively for now.
225 //
226 // TODO: Consider moving these out to Java.
227
228 // Set the multicast hoplimit to 255 (link-local only).
229 int hops = kLinkLocalHopLimit;
230 len = sizeof(hops);
231 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) {
232 jniThrowExceptionFmt(env, "java/net/SocketException",
233 "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno));
234 return;
235 }
236
237 // Set the unicast hoplimit to 255 (link-local only).
238 hops = kLinkLocalHopLimit;
239 len = sizeof(hops);
240 if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) {
241 jniThrowExceptionFmt(env, "java/net/SocketException",
242 "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno));
243 return;
244 }
245
246 // Explicitly disable multicast loopback.
247 int off = 0;
248 len = sizeof(off);
249 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) {
250 jniThrowExceptionFmt(env, "java/net/SocketException",
251 "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno));
252 return;
253 }
254
255 // Specify the IPv6 interface to use for outbound multicast.
256 len = sizeof(ifIndex);
257 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) {
258 jniThrowExceptionFmt(env, "java/net/SocketException",
259 "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno));
260 return;
261 }
262
263 // Additional options to be considered:
264 // - IPV6_TCLASS
265 // - IPV6_RECVPKTINFO
266 // - IPV6_RECVHOPLIMIT
267
268 // Bind to [::].
269 const struct sockaddr_in6 sin6 = {
270 .sin6_family = AF_INET6,
271 .sin6_port = 0,
272 .sin6_flowinfo = 0,
273 .sin6_addr = IN6ADDR_ANY_INIT,
274 .sin6_scope_id = 0,
275 };
276 auto sa = reinterpret_cast<const struct sockaddr *>(&sin6);
277 len = sizeof(sin6);
278 if (bind(fd, sa, len) != 0) {
279 jniThrowExceptionFmt(env, "java/net/SocketException",
280 "bind(IN6ADDR_ANY): %s", strerror(errno));
281 return;
282 }
283
284 // Join the all-routers multicast group, ff02::2%index.
285 struct ipv6_mreq all_rtrs = {
286 .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}},
287 .ipv6mr_interface = ifIndex,
288 };
289 len = sizeof(all_rtrs);
290 if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) {
291 jniThrowExceptionFmt(env, "java/net/SocketException",
292 "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno));
293 return;
294 }
295 }
296
android_net_utils_bindProcessToNetwork(JNIEnv * env,jobject thiz,jint netId)297 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
298 {
299 return (jboolean) !setNetworkForProcess(netId);
300 }
301
android_net_utils_getBoundNetworkForProcess(JNIEnv * env,jobject thiz)302 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
303 {
304 return getNetworkForProcess();
305 }
306
android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv * env,jobject thiz,jint netId)307 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
308 jint netId)
309 {
310 return (jboolean) !setNetworkForResolv(netId);
311 }
312
android_net_utils_bindSocketToNetwork(JNIEnv * env,jobject thiz,jint socket,jint netId)313 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
314 jint netId)
315 {
316 return setNetworkForSocket(netId, socket);
317 }
318
android_net_utils_protectFromVpn(JNIEnv * env,jobject thiz,jint socket)319 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
320 {
321 return (jboolean) !protectFromVpn(socket);
322 }
323
android_net_utils_queryUserAccess(JNIEnv * env,jobject thiz,jint uid,jint netId)324 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
325 {
326 return (jboolean) !queryUserAccess(uid, netId);
327 }
328
329
330 // ----------------------------------------------------------------------------
331
332 /*
333 * JNI registration.
334 */
335 static const JNINativeMethod gNetworkUtilMethods[] = {
336 /* name, signature, funcPtr */
337 { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
338 { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
339 { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
340 { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
341 { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
342 { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
343 { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
344 { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
345 { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter },
346 { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket },
347 };
348
register_android_net_NetworkUtils(JNIEnv * env)349 int register_android_net_NetworkUtils(JNIEnv* env)
350 {
351 return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
352 NELEM(gNetworkUtilMethods));
353 }
354
355 }; // namespace android
356