1 /*
2  * Copyright 2019, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "NetworkStackUtils-JNI"
18 
19 #include <dlfcn.h>
20 #include <errno.h>
21 #include <jni.h>
22 #include <linux/filter.h>
23 #include <linux/if_arp.h>
24 #include <net/if.h>
25 #include <netinet/ether.h>
26 #include <netinet/icmp6.h>
27 #include <netinet/ip.h>
28 #include <netinet/ip6.h>
29 #include <netinet/udp.h>
30 #include <stdlib.h>
31 #include <sys/system_properties.h>
32 
33 #include <string>
34 
35 #include <nativehelper/JNIHelp.h>
36 #include <netjniutils/netjniutils.h>
37 
38 #include <android/log.h>
39 
40 namespace android {
41 constexpr const char NETWORKSTACKUTILS_PKG_NAME[] = "android/net/util/NetworkStackUtils";
42 
43 static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type);
44 static const uint32_t kEtherHeaderLen = sizeof(ether_header);
45 static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol);
46 static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off);
47 static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt);
48 static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr);
49 static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type);
50 static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source);
51 static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest);
52 static const uint16_t kDhcpClientPort = 68;
53 
checkLenAndCopy(JNIEnv * env,const jbyteArray & addr,int len,void * dst)54 static bool checkLenAndCopy(JNIEnv* env, const jbyteArray& addr, int len, void* dst) {
55     if (env->GetArrayLength(addr) != len) {
56         return false;
57     }
58     env->GetByteArrayRegion(addr, 0, len, reinterpret_cast<jbyte*>(dst));
59     return true;
60 }
61 
network_stack_utils_addArpEntry(JNIEnv * env,jobject thiz,jbyteArray ethAddr,jbyteArray ipv4Addr,jstring ifname,jobject javaFd)62 static void network_stack_utils_addArpEntry(JNIEnv *env, jobject thiz, jbyteArray ethAddr,
63         jbyteArray ipv4Addr, jstring ifname, jobject javaFd) {
64     arpreq req = {};
65     sockaddr_in& netAddrStruct = *reinterpret_cast<sockaddr_in*>(&req.arp_pa);
66     sockaddr& ethAddrStruct = req.arp_ha;
67 
68     ethAddrStruct.sa_family = ARPHRD_ETHER;
69     if (!checkLenAndCopy(env, ethAddr, ETH_ALEN, ethAddrStruct.sa_data)) {
70         jniThrowException(env, "java/io/IOException", "Invalid ethAddr length");
71         return;
72     }
73 
74     netAddrStruct.sin_family = AF_INET;
75     if (!checkLenAndCopy(env, ipv4Addr, sizeof(in_addr), &netAddrStruct.sin_addr)) {
76         jniThrowException(env, "java/io/IOException", "Invalid ipv4Addr length");
77         return;
78     }
79 
80     int ifLen = env->GetStringLength(ifname);
81     // IFNAMSIZ includes the terminating NULL character
82     if (ifLen >= IFNAMSIZ) {
83         jniThrowException(env, "java/io/IOException", "ifname too long");
84         return;
85     }
86     env->GetStringUTFRegion(ifname, 0, ifLen, req.arp_dev);
87 
88     req.arp_flags = ATF_COM;  // Completed entry (ha valid)
89     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
90     if (fd < 0) {
91         jniThrowExceptionFmt(env, "java/io/IOException", "Invalid file descriptor");
92         return;
93     }
94     // See also: man 7 arp
95     if (ioctl(fd, SIOCSARP, &req)) {
96         jniThrowExceptionFmt(env, "java/io/IOException", "ioctl error: %s", strerror(errno));
97         return;
98     }
99 }
100 
network_stack_utils_attachDhcpFilter(JNIEnv * env,jobject clazz,jobject javaFd)101 static void network_stack_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd) {
102     static sock_filter filter_code[] = {
103         // Check the protocol is UDP.
104         BPF_STMT(BPF_LD  | BPF_B    | BPF_ABS, kIPv4Protocol),
105         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   IPPROTO_UDP, 0, 6),
106 
107         // Check this is not a fragment.
108         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS, kIPv4FlagsOffset),
109         BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K,   IP_OFFMASK, 4, 0),
110 
111         // Get the IP header length.
112         BPF_STMT(BPF_LDX | BPF_B    | BPF_MSH, kEtherHeaderLen),
113 
114         // Check the destination port.
115         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPDstPortIndirectOffset),
116         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 0, 1),
117 
118         // Accept or reject.
119         BPF_STMT(BPF_RET | BPF_K,              0xffff),
120         BPF_STMT(BPF_RET | BPF_K,              0)
121     };
122     static const sock_fprog filter = {
123         sizeof(filter_code) / sizeof(filter_code[0]),
124         filter_code,
125     };
126 
127     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
128     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
129         jniThrowExceptionFmt(env, "java/net/SocketException",
130                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
131     }
132 }
133 
network_stack_utils_attachRaFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)134 static void network_stack_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd,
135         jint hardwareAddressType) {
136     if (hardwareAddressType != ARPHRD_ETHER) {
137         jniThrowExceptionFmt(env, "java/net/SocketException",
138                 "attachRaFilter only supports ARPHRD_ETHER");
139         return;
140     }
141 
142     static sock_filter filter_code[] = {
143         // Check IPv6 Next Header is ICMPv6.
144         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kIPv6NextHeader),
145         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    IPPROTO_ICMPV6, 0, 3),
146 
147         // Check ICMPv6 type is Router Advertisement.
148         BPF_STMT(BPF_LD  | BPF_B   | BPF_ABS,  kICMPv6TypeOffset),
149         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    ND_ROUTER_ADVERT, 0, 1),
150 
151         // Accept or reject.
152         BPF_STMT(BPF_RET | BPF_K,              0xffff),
153         BPF_STMT(BPF_RET | BPF_K,              0)
154     };
155     static const sock_fprog filter = {
156         sizeof(filter_code) / sizeof(filter_code[0]),
157         filter_code,
158     };
159 
160     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
161     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
162         jniThrowExceptionFmt(env, "java/net/SocketException",
163                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
164     }
165 }
166 
167 // TODO: Move all this filter code into libnetutils.
network_stack_utils_attachControlPacketFilter(JNIEnv * env,jobject clazz,jobject javaFd,jint hardwareAddressType)168 static void network_stack_utils_attachControlPacketFilter(
169         JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) {
170     if (hardwareAddressType != ARPHRD_ETHER) {
171         jniThrowExceptionFmt(env, "java/net/SocketException",
172                 "attachControlPacketFilter only supports ARPHRD_ETHER");
173         return;
174     }
175 
176     // Capture all:
177     //     - ARPs
178     //     - DHCPv4 packets
179     //     - Router Advertisements & Solicitations
180     //     - Neighbor Advertisements & Solicitations
181     //
182     // tcpdump:
183     //     arp or
184     //     '(ip and udp port 68)' or
185     //     '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)'
186     static sock_filter filter_code[] = {
187         // Load the link layer next payload field.
188         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS,  kEtherTypeOffset),
189 
190         // Accept all ARP.
191         // TODO: Figure out how to better filter ARPs on noisy networks.
192         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   ETHERTYPE_ARP, 16, 0),
193 
194         // If IPv4:
195         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   ETHERTYPE_IP, 0, 9),
196 
197         // Check the protocol is UDP.
198         BPF_STMT(BPF_LD  | BPF_B    | BPF_ABS, kIPv4Protocol),
199         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   IPPROTO_UDP, 0, 14),
200 
201         // Check this is not a fragment.
202         BPF_STMT(BPF_LD  | BPF_H    | BPF_ABS, kIPv4FlagsOffset),
203         BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K,   IP_OFFMASK, 12, 0),
204 
205         // Get the IP header length.
206         BPF_STMT(BPF_LDX | BPF_B    | BPF_MSH, kEtherHeaderLen),
207 
208         // Check the source port.
209         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPSrcPortIndirectOffset),
210         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 8, 0),
211 
212         // Check the destination port.
213         BPF_STMT(BPF_LD  | BPF_H    | BPF_IND, kUDPDstPortIndirectOffset),
214         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   kDhcpClientPort, 6, 7),
215 
216         // IPv6 ...
217         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   ETHERTYPE_IPV6, 0, 6),
218         // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ...
219         BPF_STMT(BPF_LD  | BPF_B    | BPF_ABS, kIPv6NextHeader),
220         BPF_JUMP(BPF_JMP | BPF_JEQ  | BPF_K,   IPPROTO_ICMPV6, 0, 4),
221         // ... and check the ICMPv6 type is one of RS/RA/NS/NA.
222         BPF_STMT(BPF_LD  | BPF_B    | BPF_ABS, kICMPv6TypeOffset),
223         BPF_JUMP(BPF_JMP | BPF_JGE  | BPF_K,   ND_ROUTER_SOLICIT, 0, 2),
224         BPF_JUMP(BPF_JMP | BPF_JGT  | BPF_K,   ND_NEIGHBOR_ADVERT, 1, 0),
225 
226         // Accept or reject.
227         BPF_STMT(BPF_RET | BPF_K,              0xffff),
228         BPF_STMT(BPF_RET | BPF_K,              0)
229     };
230     static const sock_fprog filter = {
231         sizeof(filter_code) / sizeof(filter_code[0]),
232         filter_code,
233     };
234 
235     int fd = netjniutils::GetNativeFileDescriptor(env, javaFd);
236     if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) {
237         jniThrowExceptionFmt(env, "java/net/SocketException",
238                 "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno));
239     }
240 }
241 
242 /*
243  * JNI registration.
244  */
245 static const JNINativeMethod gNetworkStackUtilsMethods[] = {
246     /* name, signature, funcPtr */
247     { "addArpEntry", "([B[BLjava/lang/String;Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_addArpEntry },
248     { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) network_stack_utils_attachDhcpFilter },
249     { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) network_stack_utils_attachRaFilter },
250     { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) network_stack_utils_attachControlPacketFilter },
251 };
252 
JNI_OnLoad(JavaVM * vm,void *)253 extern "C" jint JNI_OnLoad(JavaVM* vm, void*) {
254     JNIEnv *env;
255     if (vm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK) {
256         __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "ERROR: GetEnv failed");
257         return JNI_ERR;
258     }
259 
260     if (jniRegisterNativeMethods(env, NETWORKSTACKUTILS_PKG_NAME,
261             gNetworkStackUtilsMethods, NELEM(gNetworkStackUtilsMethods)) < 0) {
262         return JNI_ERR;
263     }
264 
265     return JNI_VERSION_1_6;
266 
267 }
268 }; // namespace android
269