1 /*
2  * Copyright 2008, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "NetUtils"
18 
19 #include "jni.h"
20 #include <nativehelper/JNIHelp.h>
21 #include "NetdClient.h"
22 #include <utils/misc.h>
23 #include <android_runtime/AndroidRuntime.h>
24 #include <utils/Log.h>
25 #include <arpa/inet.h>
26 #include <net/if.h>
27 #include <linux/filter.h>
28 #include <linux/if_arp.h>
29 #include <netinet/ether.h>
30 #include <netinet/icmp6.h>
31 #include <netinet/ip.h>
32 #include <netinet/ip6.h>
33 #include <netinet/udp.h>
34 #include <cutils/properties.h>
35 
36 #include "core_jni_helpers.h"
37 
38 extern "C" {
39 int ifc_enable(const char *ifname);
40 int ifc_disable(const char *ifname);
41 }
42 
43 #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
44 
45 namespace android {
46 
47 static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type);
48 static const uint32_t kEtherHeaderLen = sizeof(ether_header);
49 static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol);
50 static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off);
51 static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt);
52 static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr);
53 static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type);
54 static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source);
55 static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest);
56 static const uint16_t kDhcpClientPort = 68;
57 
android_net_utils_attachDhcpFilter(JNIEnv * env,jobject clazz,jobject javaFd)58 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
59 {
60     struct sock_filter filter_code[] = {
61         // Check the protocol is UDP.
62         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kIPv4Protocol),
63         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_UDP, 0, 6),
64 
65         // Check this is not a fragment.
66         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS, kIPv4FlagsOffset),
67         BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K,   IP_OFFMASK, 4, 0),
68 
69         // Get the IP header length.
70         BPF_STMT(BPF_LDX | BPF_B    | BPF_MSH, kEtherHeaderLen),
71 
72         // Check the destination port.
73         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPDstPortIndirectOffset),
74         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 0, 1),
75 
76         // Accept or reject.
77         BPF_STMT(BPF_RET | BPF_K,              0xffff),
78         BPF_STMT(BPF_RET | BPF_K,              0)
79     };
80     struct sock_fprog filter = {
81         sizeof(filter_code) / sizeof(filter_code[0]),
82         filter_code,
83     };
84 
85     int fd = jniGetFDFromFileDescriptor(env, javaFd);
86     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
87         jniThrowExceptionFmt(env, "java/net/SocketException",
88                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
89     }
90 }
91 
android_net_utils_attachRaFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)92 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
93         jint hardwareAddressType)
94 {
95     if (hardwareAddressType != ARPHRD_ETHER) {
96         jniThrowExceptionFmt(env, "java/net/SocketException",
97                 "attachRaFilter only supports ARPHRD_ETHER");
98         return;
99     }
100 
101     struct sock_filter filter_code[] = {
102         // Check IPv6 Next Header is ICMPv6.
103         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kIPv6NextHeader),
104         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_ICMPV6, 0, 3),
105 
106         // Check ICMPv6 type is Router Advertisement.
107         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kICMPv6TypeOffset),
108         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    ND_ROUTER_ADVERT, 0, 1),
109 
110         // Accept or reject.
111         BPF_STMT(BPF_RET | BPF_K,              0xffff),
112         BPF_STMT(BPF_RET | BPF_K,              0)
113     };
114     struct sock_fprog filter = {
115         sizeof(filter_code) / sizeof(filter_code[0]),
116         filter_code,
117     };
118 
119     int fd = jniGetFDFromFileDescriptor(env, javaFd);
120     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
121         jniThrowExceptionFmt(env, "java/net/SocketException",
122                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
123     }
124 }
125 
126 // TODO: Move all this filter code into libnetutils.
android_net_utils_attachControlPacketFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)127 static void android_net_utils_attachControlPacketFilter(
128         JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) {
129     if (hardwareAddressType != ARPHRD_ETHER) {
130         jniThrowExceptionFmt(env, "java/net/SocketException",
131                 "attachControlPacketFilter only supports ARPHRD_ETHER");
132         return;
133     }
134 
135     // Capture all:
136     //     - ARPs
137     //     - DHCPv4 packets
138     //     - Router Advertisements & Solicitations
139     //     - Neighbor Advertisements & Solicitations
140     //
141     // tcpdump:
142     //     arp or
143     //     '(ip and udp port 68)' or
144     //     '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
145     struct sock_filter filter_code[] = {
146         // Load the link layer next payload field.
147         BPF_STMT(BPF_LD  | BPF_H   | BPF_ABS,  kEtherTypeOffset),
148 
149         // Accept all ARP.
150         // TODO: Figure out how to better filter ARPs on noisy networks.
151         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0),
152 
153         // If IPv4:
154         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9),
155 
156         // Check the protocol is UDP.
157         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kIPv4Protocol),
158         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_UDP, 0, 14),
159 
160         // Check this is not a fragment.
161         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS, kIPv4FlagsOffset),
162         BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K,   IP_OFFMASK, 12, 0),
163 
164         // Get the IP header length.
165         BPF_STMT(BPF_LDX | BPF_B    | BPF_MSH, kEtherHeaderLen),
166 
167         // Check the source port.
168         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPSrcPortIndirectOffset),
169         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 8, 0),
170 
171         // Check the destination port.
172         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPDstPortIndirectOffset),
173         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 6, 7),
174 
175         // IPv6 ...
176         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6),
177         // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
178         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kIPv6NextHeader),
179         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_ICMPV6, 0, 4),
180         // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
181         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kICMPv6TypeOffset),
182         BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K,    ND_ROUTER_SOLICIT, 0, 2),
183         BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K,    ND_NEIGHBOR_ADVERT, 1, 0),
184 
185         // Accept or reject.
186         BPF_STMT(BPF_RET | BPF_K,              0xffff),
187         BPF_STMT(BPF_RET | BPF_K,              0)
188     };
189     struct sock_fprog filter = {
190         sizeof(filter_code) / sizeof(filter_code[0]),
191         filter_code,
192     };
193 
194     int fd = jniGetFDFromFileDescriptor(env, javaFd);
195     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
196         jniThrowExceptionFmt(env, "java/net/SocketException",
197                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
198     }
199 }
200 
android_net_utils_setupRaSocket(JNIEnv * env,jobject clazz,jobject javaFd,jint ifIndex)201 static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd,
202         jint ifIndex)
203 {
204     static const int kLinkLocalHopLimit = 255;
205 
206     int fd = jniGetFDFromFileDescriptor(env, javaFd);
207 
208     // Set an ICMPv6 filter that only passes Router Solicitations.
209     struct icmp6_filter rs_only;
210     ICMP6_FILTER_SETBLOCKALL(&rs_only);
211     ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only);
212     socklen_t len = sizeof(rs_only);
213     if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) {
214         jniThrowExceptionFmt(env, "java/net/SocketException",
215                 "setsockopt(ICMP6_FILTER): %s", strerror(errno));
216         return;
217     }
218 
219     // Most/all of the rest of these options can be set via Java code, but
220     // because we're here on account of setting an icmp6_filter go ahead
221     // and do it all natively for now.
222     //
223     // TODO: Consider moving these out to Java.
224 
225     // Set the multicast hoplimit to 255 (link-local only).
226     int hops = kLinkLocalHopLimit;
227     len = sizeof(hops);
228     if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) {
229         jniThrowExceptionFmt(env, "java/net/SocketException",
230                 "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno));
231         return;
232     }
233 
234     // Set the unicast hoplimit to 255 (link-local only).
235     hops = kLinkLocalHopLimit;
236     len = sizeof(hops);
237     if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) {
238         jniThrowExceptionFmt(env, "java/net/SocketException",
239                 "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno));
240         return;
241     }
242 
243     // Explicitly disable multicast loopback.
244     int off = 0;
245     len = sizeof(off);
246     if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) {
247         jniThrowExceptionFmt(env, "java/net/SocketException",
248                 "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno));
249         return;
250     }
251 
252     // Specify the IPv6 interface to use for outbound multicast.
253     len = sizeof(ifIndex);
254     if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) {
255         jniThrowExceptionFmt(env, "java/net/SocketException",
256                 "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno));
257         return;
258     }
259 
260     // Additional options to be considered:
261     //     - IPV6_TCLASS
262     //     - IPV6_RECVPKTINFO
263     //     - IPV6_RECVHOPLIMIT
264 
265     // Bind to [::].
266     const struct sockaddr_in6 sin6 = {
267             .sin6_family = AF_INET6,
268             .sin6_port = 0,
269             .sin6_flowinfo = 0,
270             .sin6_addr = IN6ADDR_ANY_INIT,
271             .sin6_scope_id = 0,
272     };
273     auto sa = reinterpret_cast<const struct sockaddr *>(&sin6);
274     len = sizeof(sin6);
275     if (bind(fd, sa, len) != 0) {
276         jniThrowExceptionFmt(env, "java/net/SocketException",
277                 "bind(IN6ADDR_ANY): %s", strerror(errno));
278         return;
279     }
280 
281     // Join the all-routers multicast group, ff02::2%index.
282     struct ipv6_mreq all_rtrs = {
283         .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}},
284         .ipv6mr_interface = ifIndex,
285     };
286     len = sizeof(all_rtrs);
287     if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) {
288         jniThrowExceptionFmt(env, "java/net/SocketException",
289                 "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno));
290         return;
291     }
292 }
293 
android_net_utils_bindProcessToNetwork(JNIEnv * env,jobject thiz,jint netId)294 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
295 {
296     return (jboolean) !setNetworkForProcess(netId);
297 }
298 
android_net_utils_getBoundNetworkForProcess(JNIEnv * env,jobject thiz)299 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
300 {
301     return getNetworkForProcess();
302 }
303 
android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv * env,jobject thiz,jint netId)304 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
305         jint netId)
306 {
307     return (jboolean) !setNetworkForResolv(netId);
308 }
309 
android_net_utils_bindSocketToNetwork(JNIEnv * env,jobject thiz,jint socket,jint netId)310 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
311         jint netId)
312 {
313     return setNetworkForSocket(netId, socket);
314 }
315 
android_net_utils_protectFromVpn(JNIEnv * env,jobject thiz,jint socket)316 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
317 {
318     return (jboolean) !protectFromVpn(socket);
319 }
320 
android_net_utils_queryUserAccess(JNIEnv * env,jobject thiz,jint uid,jint netId)321 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
322 {
323     return (jboolean) !queryUserAccess(uid, netId);
324 }
325 
326 
327 // ----------------------------------------------------------------------------
328 
329 /*
330  * JNI registration.
331  */
332 static const JNINativeMethod gNetworkUtilMethods[] = {
333     /* name, signature, funcPtr */
334     { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
335     { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
336     { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
337     { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
338     { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
339     { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
340     { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
341     { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
342     { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter },
343     { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket },
344 };
345 
register_android_net_NetworkUtils(JNIEnv * env)346 int register_android_net_NetworkUtils(JNIEnv* env)
347 {
348     return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
349                                 NELEM(gNetworkUtilMethods));
350 }
351 
352 }; // namespace android
353