jni/network_stack_utils_jni.cpp - platform/packages/modules/NetworkStack - Gitiles

 /*
  * Copyright 2019, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  * http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #define LOG_TAG "NetworkStackUtils-JNI"

 #include <dlfcn.h>
 #include <errno.h>
 #include <jni.h>
 #include <linux/filter.h>
 #include <linux/if_arp.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <netinet/icmp6.h>
 #include <netinet/ip.h>
 #include <netinet/ip6.h>
 #include <netinet/udp.h>
 #include <stdlib.h>
 #include <sys/system_properties.h>

 #include <string>

 #include <nativehelper/JNIHelp.h>
 #include <netjniutils/netjniutils.h>

 #include <android/log.h>
 #include <bpf/BpfClassic.h>

 namespace android {
 constexpr const char NETWORKSTACKUTILS_PKG_NAME[] =
     "com/android/networkstack/util/NetworkStackUtils";

 static const uint16_t kDhcpClientPort = 68;

 static bool checkLenAndCopy(JNIEnv* env, const jbyteArray& addr, int len, void* dst) {
     if (env->GetArrayLength(addr) != len) {
         return false;
     }
     env->GetByteArrayRegion(addr, 0, len, reinterpret_cast<jbyte*>(dst));
     return true;
 }

 static void network_stack_utils_addArpEntry(JNIEnv *env, jclass clazz, jbyteArray ethAddr,
         jbyteArray ipv4Addr, jstring ifname, jobject javaFd) {
     arpreq req = {};
     sockaddr_in& netAddrStruct = *reinterpret_cast<sockaddr_in*>(&req.arp_pa);
     sockaddr& ethAddrStruct = req.arp_ha;

     ethAddrStruct.sa_family = ARPHRD_ETHER;
     if (!checkLenAndCopy(env, ethAddr, ETH_ALEN, ethAddrStruct.sa_data)) {
         jniThrowException(env, "java/io/IOException", "Invalid ethAddr length");
         return;
     }

     netAddrStruct.sin_family = AF_INET;
     if (!checkLenAndCopy(env, ipv4Addr, sizeof(in_addr), &netAddrStruct.sin_addr)) {
         jniThrowException(env, "java/io/IOException", "Invalid ipv4Addr length");
         return;
     }

     int ifLen = env->GetStringLength(ifname);
     // IFNAMSIZ includes the terminating NULL character
     if (ifLen >= IFNAMSIZ) {
         jniThrowException(env, "java/io/IOException", "ifname too long");
         return;
     }
     env->GetStringUTFRegion(ifname, 0, ifLen, req.arp_dev);

     req.arp_flags = ATF_COM;  // Completed entry (ha valid)
     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
     if (fd < 0) {
         jniThrowExceptionFmt(env, "java/io/IOException", "Invalid file descriptor");
         return;
     }
     // See also: man 7 arp
     if (ioctl(fd, SIOCSARP, &req)) {
         jniThrowExceptionFmt(env, "java/io/IOException", "ioctl error: %s", strerror(errno));
         return;
     }
 }

 // fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_IP)"
 // which guarantees packets already have skb->protocol == htons(ETH_P_IP)
 static void network_stack_utils_attachDhcpFilter(JNIEnv *env, jclass clazz, jobject javaFd) {
     static sock_filter filter_code[] = {
         // Check the protocol is UDP.
         BPF_LOAD_IPV4_U8(protocol),
         BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_UDP),

         // Check this is not a fragment.
         BPF_LOAD_IPV4_BE16(frag_off),
         BPF2_REJECT_IF_ANY_MASKED_BITS_SET(IP_MF | IP_OFFMASK),

         // Get the IP header length.
         BPF_LOADX_NET_RELATIVE_IPV4_HLEN,

         // Check the destination port.
         BPF_LOAD_NETX_RELATIVE_DST_PORT,
         BPF2_REJECT_IF_NOT_EQUAL(kDhcpClientPort),

         BPF_ACCEPT,
     };
     const sock_fprog filter = {
         sizeof(filter_code) / sizeof(filter_code[0]),
         filter_code,
     };

     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
         jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
     }
 }

 // fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_IPV6)"
 // which guarantees packets already have skb->protocol == htons(ETH_P_IPV6)
 static void network_stack_utils_attachRaFilter(JNIEnv *env, jclass clazz, jobject javaFd) {
     static sock_filter filter_code[] = {
         BPF_LOADX_CONSTANT_IPV6_HLEN,

         // Check IPv6 Next Header is ICMPv6.
         BPF_LOAD_IPV6_U8(nexthdr),
         BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_ICMPV6),

         // Check ICMPv6 type is Router Advertisement.
         BPF_LOAD_NETX_RELATIVE_ICMP_TYPE,
         BPF2_REJECT_IF_NOT_EQUAL(ND_ROUTER_ADVERT),

         BPF_ACCEPT,
     };
     static const sock_fprog filter = {
         sizeof(filter_code) / sizeof(filter_code[0]),
         filter_code,
     };

     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
         jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
     }
 }

 // TODO: Move all this filter code into libnetutils.
 // fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_ALL)"
 static void network_stack_utils_attachControlPacketFilter(
         JNIEnv *env, jclass clazz, jobject javaFd) {
     // Capture all:
     //     - ARPs
     //     - DHCPv4 packets
     //     - Router Advertisements & Solicitations
     //     - Neighbor Advertisements & Solicitations
     //
     // tcpdump:
     //     arp or
     //     '(ip and udp port 68)' or
     //     '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
     static sock_filter filter_code[] = {
         // Load the ethertype from skb->protocol
         BPF_LOAD_SKB_PROTOCOL,

         // Accept all ARP.
         // TODO: Figure out how to better filter ARPs on noisy networks.
         BPF2_ACCEPT_IF_EQUAL(ETHERTYPE_ARP),

         // If IPv4:  (otherwise jump to the 'IPv6 ...' below)
         BPF_JUMP_IF_NOT_EQUAL(ETHERTYPE_IP, 14),

         // Check the protocol is UDP.
         BPF_LOAD_IPV4_U8(protocol),
         BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_UDP),

         // Check this is not a fragment.
         BPF_LOAD_IPV4_BE16(frag_off),
         BPF2_REJECT_IF_ANY_MASKED_BITS_SET(IP_MF | IP_OFFMASK),

         // Get the IP header length.
         BPF_LOADX_NET_RELATIVE_IPV4_HLEN,

         // Check the source port.
         BPF_LOAD_NETX_RELATIVE_SRC_PORT,
         BPF2_ACCEPT_IF_EQUAL(kDhcpClientPort),

         // Check the destination port.
         BPF_LOAD_NETX_RELATIVE_DST_PORT,
         BPF2_ACCEPT_IF_EQUAL(kDhcpClientPort),

         // Reject any other UDPv4
         BPF_REJECT,

         // IPv6 ...
         BPF2_REJECT_IF_NOT_EQUAL(ETHERTYPE_IPV6),
         // Assume standard, 40-byte, extension header-less ipv6 packet
         BPF_LOADX_CONSTANT_IPV6_HLEN,
         // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
         BPF_LOAD_IPV6_U8(nexthdr),
         BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_ICMPV6),
         // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
         BPF_LOAD_NETX_RELATIVE_ICMP_TYPE,
         BPF3_REJECT_IF_NOT_IN_RANGE(ND_ROUTER_SOLICIT, ND_NEIGHBOR_ADVERT),

         BPF_ACCEPT,
     };
     static const sock_fprog filter = {
         sizeof(filter_code) / sizeof(filter_code[0]),
         filter_code,
     };

     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
         jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
     }
 }

 /*
  * JNI registration.
  */
 static const JNINativeMethod gNetworkStackUtilsMethods[] = {
     /* name, signature, funcPtr */
     { "addArpEntry", "([B[BLjava/lang/String;Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_addArpEntry },
     { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachDhcpFilter },
     { "attachRaFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachRaFilter },
     { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachControlPacketFilter },
 };

 extern "C" jint JNI_OnLoad(JavaVM* vm, void*) {
     JNIEnv *env;
     if (vm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK) {
         __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "ERROR: GetEnv failed");
         return JNI_ERR;
     }

     if (jniRegisterNativeMethods(env, NETWORKSTACKUTILS_PKG_NAME,
             gNetworkStackUtilsMethods, NELEM(gNetworkStackUtilsMethods)) < 0) {
         return JNI_ERR;
     }

     return JNI_VERSION_1_6;

 }
 }; // namespace android
	/*
	* Copyright 2019, The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#define LOG_TAG "NetworkStackUtils-JNI"

	#include <dlfcn.h>
	#include <errno.h>
	#include <jni.h>
	#include <linux/filter.h>
	#include <linux/if_arp.h>
	#include <net/if.h>
	#include <netinet/ether.h>
	#include <netinet/icmp6.h>
	#include <netinet/ip.h>
	#include <netinet/ip6.h>
	#include <netinet/udp.h>
	#include <stdlib.h>
	#include <sys/system_properties.h>

	#include <string>

	#include <nativehelper/JNIHelp.h>
	#include <netjniutils/netjniutils.h>

	#include <android/log.h>
	#include <bpf/BpfClassic.h>

	namespace android {
	constexpr const char NETWORKSTACKUTILS_PKG_NAME[] =
	"com/android/networkstack/util/NetworkStackUtils";

	static const uint16_t kDhcpClientPort = 68;

	static bool checkLenAndCopy(JNIEnv* env, const jbyteArray& addr, int len, void* dst) {
	if (env->GetArrayLength(addr) != len) {
	return false;
	}
	env->GetByteArrayRegion(addr, 0, len, reinterpret_cast<jbyte*>(dst));
	return true;
	}

	static void network_stack_utils_addArpEntry(JNIEnv *env, jclass clazz, jbyteArray ethAddr,
	jbyteArray ipv4Addr, jstring ifname, jobject javaFd) {
	arpreq req = {};
	sockaddr_in& netAddrStruct = reinterpret_cast<sockaddr_in>(&req.arp_pa);
	sockaddr& ethAddrStruct = req.arp_ha;

	ethAddrStruct.sa_family = ARPHRD_ETHER;
	if (!checkLenAndCopy(env, ethAddr, ETH_ALEN, ethAddrStruct.sa_data)) {
	jniThrowException(env, "java/io/IOException", "Invalid ethAddr length");
	return;
	}

	netAddrStruct.sin_family = AF_INET;
	if (!checkLenAndCopy(env, ipv4Addr, sizeof(in_addr), &netAddrStruct.sin_addr)) {
	jniThrowException(env, "java/io/IOException", "Invalid ipv4Addr length");
	return;
	}

	int ifLen = env->GetStringLength(ifname);
	// IFNAMSIZ includes the terminating NULL character
	if (ifLen >= IFNAMSIZ) {
	jniThrowException(env, "java/io/IOException", "ifname too long");
	return;
	}
	env->GetStringUTFRegion(ifname, 0, ifLen, req.arp_dev);

	req.arp_flags = ATF_COM; // Completed entry (ha valid)
	int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
	if (fd < 0) {
	jniThrowExceptionFmt(env, "java/io/IOException", "Invalid file descriptor");
	return;
	}
	// See also: man 7 arp
	if (ioctl(fd, SIOCSARP, &req)) {
	jniThrowExceptionFmt(env, "java/io/IOException", "ioctl error: %s", strerror(errno));
	return;
	}
	}

	// fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_IP)"
	// which guarantees packets already have skb->protocol == htons(ETH_P_IP)
	static void network_stack_utils_attachDhcpFilter(JNIEnv *env, jclass clazz, jobject javaFd) {
	static sock_filter filter_code[] = {
	// Check the protocol is UDP.
	BPF_LOAD_IPV4_U8(protocol),
	BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_UDP),

	// Check this is not a fragment.
	BPF_LOAD_IPV4_BE16(frag_off),
	BPF2_REJECT_IF_ANY_MASKED_BITS_SET(IP_MF \| IP_OFFMASK),

	// Get the IP header length.
	BPF_LOADX_NET_RELATIVE_IPV4_HLEN,

	// Check the destination port.
	BPF_LOAD_NETX_RELATIVE_DST_PORT,
	BPF2_REJECT_IF_NOT_EQUAL(kDhcpClientPort),

	BPF_ACCEPT,
	};
	const sock_fprog filter = {
	sizeof(filter_code) / sizeof(filter_code[0]),
	filter_code,
	};

	int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
	if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
	jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
	}
	}

	// fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_IPV6)"
	// which guarantees packets already have skb->protocol == htons(ETH_P_IPV6)
	static void network_stack_utils_attachRaFilter(JNIEnv *env, jclass clazz, jobject javaFd) {
	static sock_filter filter_code[] = {
	BPF_LOADX_CONSTANT_IPV6_HLEN,

	// Check IPv6 Next Header is ICMPv6.
	BPF_LOAD_IPV6_U8(nexthdr),
	BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_ICMPV6),

	// Check ICMPv6 type is Router Advertisement.
	BPF_LOAD_NETX_RELATIVE_ICMP_TYPE,
	BPF2_REJECT_IF_NOT_EQUAL(ND_ROUTER_ADVERT),

	BPF_ACCEPT,
	};
	static const sock_fprog filter = {
	sizeof(filter_code) / sizeof(filter_code[0]),
	filter_code,
	};

	int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
	if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
	jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
	}
	}

	// TODO: Move all this filter code into libnetutils.
	// fd is a "socket(AF_PACKET, SOCK_RAW, ETH_P_ALL)"
	static void network_stack_utils_attachControlPacketFilter(
	JNIEnv *env, jclass clazz, jobject javaFd) {
	// Capture all:
	// - ARPs
	// - DHCPv4 packets
	// - Router Advertisements & Solicitations
	// - Neighbor Advertisements & Solicitations
	//
	// tcpdump:
	// arp or
	// '(ip and udp port 68)' or
	// '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
	static sock_filter filter_code[] = {
	// Load the ethertype from skb->protocol
	BPF_LOAD_SKB_PROTOCOL,

	// Accept all ARP.
	// TODO: Figure out how to better filter ARPs on noisy networks.
	BPF2_ACCEPT_IF_EQUAL(ETHERTYPE_ARP),

	// If IPv4: (otherwise jump to the 'IPv6 ...' below)
	BPF_JUMP_IF_NOT_EQUAL(ETHERTYPE_IP, 14),

	// Check the protocol is UDP.
	BPF_LOAD_IPV4_U8(protocol),
	BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_UDP),

	// Check this is not a fragment.
	BPF_LOAD_IPV4_BE16(frag_off),
	BPF2_REJECT_IF_ANY_MASKED_BITS_SET(IP_MF \| IP_OFFMASK),

	// Get the IP header length.
	BPF_LOADX_NET_RELATIVE_IPV4_HLEN,

	// Check the source port.
	BPF_LOAD_NETX_RELATIVE_SRC_PORT,
	BPF2_ACCEPT_IF_EQUAL(kDhcpClientPort),

	// Check the destination port.
	BPF_LOAD_NETX_RELATIVE_DST_PORT,
	BPF2_ACCEPT_IF_EQUAL(kDhcpClientPort),

	// Reject any other UDPv4
	BPF_REJECT,

	// IPv6 ...
	BPF2_REJECT_IF_NOT_EQUAL(ETHERTYPE_IPV6),
	// Assume standard, 40-byte, extension header-less ipv6 packet
	BPF_LOADX_CONSTANT_IPV6_HLEN,
	// ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
	BPF_LOAD_IPV6_U8(nexthdr),
	BPF2_REJECT_IF_NOT_EQUAL(IPPROTO_ICMPV6),
	// ... and check the ICMPv6 type is one of RS/RA/NS/NA.
	BPF_LOAD_NETX_RELATIVE_ICMP_TYPE,
	BPF3_REJECT_IF_NOT_IN_RANGE(ND_ROUTER_SOLICIT, ND_NEIGHBOR_ADVERT),

	BPF_ACCEPT,
	};
	static const sock_fprog filter = {
	sizeof(filter_code) / sizeof(filter_code[0]),
	filter_code,
	};

	int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
	if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
	jniThrowErrnoException(env, "setsockopt(SO_ATTACH_FILTER)", errno);
	}
	}

	/*
	* JNI registration.
	*/
	static const JNINativeMethod gNetworkStackUtilsMethods[] = {
	/* name, signature, funcPtr */
	{ "addArpEntry", "([B[BLjava/lang/String;Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_addArpEntry },
	{ "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachDhcpFilter },
	{ "attachRaFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachRaFilter },
	{ "attachControlPacketFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachControlPacketFilter },
	};

	extern "C" jint JNI_OnLoad(JavaVM* vm, void*) {
	JNIEnv *env;
	if (vm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK) {
	__android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "ERROR: GetEnv failed");
	return JNI_ERR;
	}

	if (jniRegisterNativeMethods(env, NETWORKSTACKUTILS_PKG_NAME,
	gNetworkStackUtilsMethods, NELEM(gNetworkStackUtilsMethods)) < 0) {
	return JNI_ERR;
	}

	return JNI_VERSION_1_6;

	}
	}; // namespace android