1 /*
2 * Copyright 2008, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "NetUtils"
18
19 #include "jni.h"
20 #include <nativehelper/JNIHelp.h>
21 #include "NetdClient.h"
22 #include <utils/misc.h>
23 #include <android_runtime/AndroidRuntime.h>
24 #include <utils/Log.h>
25 #include <arpa/inet.h>
26 #include <net/if.h>
27 #include <linux/filter.h>
28 #include <linux/if_arp.h>
29 #include <netinet/ether.h>
30 #include <netinet/icmp6.h>
31 #include <netinet/ip.h>
32 #include <netinet/ip6.h>
33 #include <netinet/udp.h>
34 #include <cutils/properties.h>
35
36 #include "core_jni_helpers.h"
37
38 extern "C" {
39 int ifc_enable(const char *ifname);
40 int ifc_disable(const char *ifname);
41 }
42
43 #define NETUTILS_PKG_NAME "android/net/NetworkUtils"
44
45 namespace android {
46
47 static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type);
48 static const uint32_t kEtherHeaderLen = sizeof(ether_header);
49 static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol);
50 static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off);
51 static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt);
52 static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr);
53 static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type);
54 static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source);
55 static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest);
56 static const uint16_t kDhcpClientPort = 68;
57
android_net_utils_attachDhcpFilter(JNIEnv * env,jobject clazz,jobject javaFd)58 static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd)
59 {
60 struct sock_filter filter_code[] = {
61 // Check the protocol is UDP.
62 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
63 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6),
64
65 // Check this is not a fragment.
66 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
67 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0),
68
69 // Get the IP header length.
70 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
71
72 // Check the destination port.
73 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
74 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1),
75
76 // Accept or reject.
77 BPF_STMT(BPF_RET | BPF_K, 0xffff),
78 BPF_STMT(BPF_RET | BPF_K, 0)
79 };
80 struct sock_fprog filter = {
81 sizeof(filter_code) / sizeof(filter_code[0]),
82 filter_code,
83 };
84
85 int fd = jniGetFDFromFileDescriptor(env, javaFd);
86 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
87 jniThrowExceptionFmt(env, "java/net/SocketException",
88 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
89 }
90 }
91
android_net_utils_attachRaFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)92 static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
93 jint hardwareAddressType)
94 {
95 if (hardwareAddressType != ARPHRD_ETHER) {
96 jniThrowExceptionFmt(env, "java/net/SocketException",
97 "attachRaFilter only supports ARPHRD_ETHER");
98 return;
99 }
100
101 struct sock_filter filter_code[] = {
102 // Check IPv6 Next Header is ICMPv6.
103 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
104 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
105
106 // Check ICMPv6 type is Router Advertisement.
107 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
108 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1),
109
110 // Accept or reject.
111 BPF_STMT(BPF_RET | BPF_K, 0xffff),
112 BPF_STMT(BPF_RET | BPF_K, 0)
113 };
114 struct sock_fprog filter = {
115 sizeof(filter_code) / sizeof(filter_code[0]),
116 filter_code,
117 };
118
119 int fd = jniGetFDFromFileDescriptor(env, javaFd);
120 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
121 jniThrowExceptionFmt(env, "java/net/SocketException",
122 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
123 }
124 }
125
126 // TODO: Move all this filter code into libnetutils.
android_net_utils_attachControlPacketFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)127 static void android_net_utils_attachControlPacketFilter(
128 JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) {
129 if (hardwareAddressType != ARPHRD_ETHER) {
130 jniThrowExceptionFmt(env, "java/net/SocketException",
131 "attachControlPacketFilter only supports ARPHRD_ETHER");
132 return;
133 }
134
135 // Capture all:
136 // - ARPs
137 // - DHCPv4 packets
138 // - Router Advertisements & Solicitations
139 // - Neighbor Advertisements & Solicitations
140 //
141 // tcpdump:
142 // arp or
143 // '(ip and udp port 68)' or
144 // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
145 struct sock_filter filter_code[] = {
146 // Load the link layer next payload field.
147 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset),
148
149 // Accept all ARP.
150 // TODO: Figure out how to better filter ARPs on noisy networks.
151 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0),
152
153 // If IPv4:
154 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9),
155
156 // Check the protocol is UDP.
157 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol),
158 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14),
159
160 // Check this is not a fragment.
161 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset),
162 BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0),
163
164 // Get the IP header length.
165 BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen),
166
167 // Check the source port.
168 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset),
169 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0),
170
171 // Check the destination port.
172 BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset),
173 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7),
174
175 // IPv6 ...
176 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6),
177 // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
178 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader),
179 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4),
180 // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
181 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset),
182 BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2),
183 BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0),
184
185 // Accept or reject.
186 BPF_STMT(BPF_RET | BPF_K, 0xffff),
187 BPF_STMT(BPF_RET | BPF_K, 0)
188 };
189 struct sock_fprog filter = {
190 sizeof(filter_code) / sizeof(filter_code[0]),
191 filter_code,
192 };
193
194 int fd = jniGetFDFromFileDescriptor(env, javaFd);
195 if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
196 jniThrowExceptionFmt(env, "java/net/SocketException",
197 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
198 }
199 }
200
android_net_utils_setupRaSocket(JNIEnv * env,jobject clazz,jobject javaFd,jint ifIndex)201 static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd,
202 jint ifIndex)
203 {
204 static const int kLinkLocalHopLimit = 255;
205
206 int fd = jniGetFDFromFileDescriptor(env, javaFd);
207
208 // Set an ICMPv6 filter that only passes Router Solicitations.
209 struct icmp6_filter rs_only;
210 ICMP6_FILTER_SETBLOCKALL(&rs_only);
211 ICMP6_FILTER_SETPASS(ND_ROUTER_SOLICIT, &rs_only);
212 socklen_t len = sizeof(rs_only);
213 if (setsockopt(fd, IPPROTO_ICMPV6, ICMP6_FILTER, &rs_only, len) != 0) {
214 jniThrowExceptionFmt(env, "java/net/SocketException",
215 "setsockopt(ICMP6_FILTER): %s", strerror(errno));
216 return;
217 }
218
219 // Most/all of the rest of these options can be set via Java code, but
220 // because we're here on account of setting an icmp6_filter go ahead
221 // and do it all natively for now.
222 //
223 // TODO: Consider moving these out to Java.
224
225 // Set the multicast hoplimit to 255 (link-local only).
226 int hops = kLinkLocalHopLimit;
227 len = sizeof(hops);
228 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &hops, len) != 0) {
229 jniThrowExceptionFmt(env, "java/net/SocketException",
230 "setsockopt(IPV6_MULTICAST_HOPS): %s", strerror(errno));
231 return;
232 }
233
234 // Set the unicast hoplimit to 255 (link-local only).
235 hops = kLinkLocalHopLimit;
236 len = sizeof(hops);
237 if (setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hops, len) != 0) {
238 jniThrowExceptionFmt(env, "java/net/SocketException",
239 "setsockopt(IPV6_UNICAST_HOPS): %s", strerror(errno));
240 return;
241 }
242
243 // Explicitly disable multicast loopback.
244 int off = 0;
245 len = sizeof(off);
246 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &off, len) != 0) {
247 jniThrowExceptionFmt(env, "java/net/SocketException",
248 "setsockopt(IPV6_MULTICAST_LOOP): %s", strerror(errno));
249 return;
250 }
251
252 // Specify the IPv6 interface to use for outbound multicast.
253 len = sizeof(ifIndex);
254 if (setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &ifIndex, len) != 0) {
255 jniThrowExceptionFmt(env, "java/net/SocketException",
256 "setsockopt(IPV6_MULTICAST_IF): %s", strerror(errno));
257 return;
258 }
259
260 // Additional options to be considered:
261 // - IPV6_TCLASS
262 // - IPV6_RECVPKTINFO
263 // - IPV6_RECVHOPLIMIT
264
265 // Bind to [::].
266 const struct sockaddr_in6 sin6 = {
267 .sin6_family = AF_INET6,
268 .sin6_port = 0,
269 .sin6_flowinfo = 0,
270 .sin6_addr = IN6ADDR_ANY_INIT,
271 .sin6_scope_id = 0,
272 };
273 auto sa = reinterpret_cast<const struct sockaddr *>(&sin6);
274 len = sizeof(sin6);
275 if (bind(fd, sa, len) != 0) {
276 jniThrowExceptionFmt(env, "java/net/SocketException",
277 "bind(IN6ADDR_ANY): %s", strerror(errno));
278 return;
279 }
280
281 // Join the all-routers multicast group, ff02::2%index.
282 struct ipv6_mreq all_rtrs = {
283 .ipv6mr_multiaddr = {{{0xff,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2}}},
284 .ipv6mr_interface = ifIndex,
285 };
286 len = sizeof(all_rtrs);
287 if (setsockopt(fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &all_rtrs, len) != 0) {
288 jniThrowExceptionFmt(env, "java/net/SocketException",
289 "setsockopt(IPV6_JOIN_GROUP): %s", strerror(errno));
290 return;
291 }
292 }
293
android_net_utils_bindProcessToNetwork(JNIEnv * env,jobject thiz,jint netId)294 static jboolean android_net_utils_bindProcessToNetwork(JNIEnv *env, jobject thiz, jint netId)
295 {
296 return (jboolean) !setNetworkForProcess(netId);
297 }
298
android_net_utils_getBoundNetworkForProcess(JNIEnv * env,jobject thiz)299 static jint android_net_utils_getBoundNetworkForProcess(JNIEnv *env, jobject thiz)
300 {
301 return getNetworkForProcess();
302 }
303
android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv * env,jobject thiz,jint netId)304 static jboolean android_net_utils_bindProcessToNetworkForHostResolution(JNIEnv *env, jobject thiz,
305 jint netId)
306 {
307 return (jboolean) !setNetworkForResolv(netId);
308 }
309
android_net_utils_bindSocketToNetwork(JNIEnv * env,jobject thiz,jint socket,jint netId)310 static jint android_net_utils_bindSocketToNetwork(JNIEnv *env, jobject thiz, jint socket,
311 jint netId)
312 {
313 return setNetworkForSocket(netId, socket);
314 }
315
android_net_utils_protectFromVpn(JNIEnv * env,jobject thiz,jint socket)316 static jboolean android_net_utils_protectFromVpn(JNIEnv *env, jobject thiz, jint socket)
317 {
318 return (jboolean) !protectFromVpn(socket);
319 }
320
android_net_utils_queryUserAccess(JNIEnv * env,jobject thiz,jint uid,jint netId)321 static jboolean android_net_utils_queryUserAccess(JNIEnv *env, jobject thiz, jint uid, jint netId)
322 {
323 return (jboolean) !queryUserAccess(uid, netId);
324 }
325
326
327 // ----------------------------------------------------------------------------
328
329 /*
330 * JNI registration.
331 */
332 static const JNINativeMethod gNetworkUtilMethods[] = {
333 /* name, signature, funcPtr */
334 { "bindProcessToNetwork", "(I)Z", (void*) android_net_utils_bindProcessToNetwork },
335 { "getBoundNetworkForProcess", "()I", (void*) android_net_utils_getBoundNetworkForProcess },
336 { "bindProcessToNetworkForHostResolution", "(I)Z", (void*) android_net_utils_bindProcessToNetworkForHostResolution },
337 { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork },
338 { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn },
339 { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess },
340 { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter },
341 { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter },
342 { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter },
343 { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket },
344 };
345
register_android_net_NetworkUtils(JNIEnv * env)346 int register_android_net_NetworkUtils(JNIEnv* env)
347 {
348 return RegisterMethodsOrDie(env, NETUTILS_PKG_NAME, gNetworkUtilMethods,
349 NELEM(gNetworkUtilMethods));
350 }
351
352 }; // namespace android
353