From 867dfd105779da338b16acf46c33e63955019506 Mon Sep 17 00:00:00 2001 From: Erik Kline Date: Wed, 19 Oct 2016 17:42:01 +0900 Subject: [PATCH] Have IpManager track L2-L4 signaling traffic required for IP connectivity. Test: as follows - built and flashed - observed logcat - observed "dumpsys wifi ipmanager" - runtest BlockingSocketReaderTest passes - runtest ConnectivityPacketSummaryTest passes Bug: 21859053 Bug: 26101306 Bug: 31742572 Bug: 31707128 Bug: 33531488 Change-Id: Ibecaf809dcc1813924b25749e8ba8eb2d4bdf114 --- core/java/android/net/NetworkUtils.java | 11 +++ core/jni/android_net_NetUtils.cpp | 107 ++++++++++++++++++++---- 2 files changed, 103 insertions(+), 15 deletions(-) diff --git a/core/java/android/net/NetworkUtils.java b/core/java/android/net/NetworkUtils.java index 35e3065b07..a677d7342d 100644 --- a/core/java/android/net/NetworkUtils.java +++ b/core/java/android/net/NetworkUtils.java @@ -51,6 +51,17 @@ public class NetworkUtils { */ public native static void attachRaFilter(FileDescriptor fd, int packetType) throws SocketException; + /** + * Attaches a socket filter that accepts L2-L4 signaling traffic required for IP connectivity. + * + * This includes: all ARP, ICMPv6 RS/RA/NS/NA messages, and DHCPv4 exchanges. + * + * @param fd the socket's {@link FileDescriptor}. + * @param packetType the hardware address type, one of ARPHRD_*. + */ + public native static void attachControlPacketFilter(FileDescriptor fd, int packetType) + throws SocketException; + /** * Configures a socket for receiving ICMPv6 router solicitations and sending advertisements. * @param fd the socket's {@link FileDescriptor}. diff --git a/core/jni/android_net_NetUtils.cpp b/core/jni/android_net_NetUtils.cpp index 26a2cf0126..3e99521f8a 100644 --- a/core/jni/android_net_NetUtils.cpp +++ b/core/jni/android_net_NetUtils.cpp @@ -44,28 +44,33 @@ int ifc_disable(const char *ifname); namespace android { +static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type); +static const uint32_t kEtherHeaderLen = sizeof(ether_header); +static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol); +static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off); +static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt); +static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr); +static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type); +static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source); +static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest); static const uint16_t kDhcpClientPort = 68; static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd) { - uint32_t ip_offset = sizeof(ether_header); - uint32_t proto_offset = ip_offset + offsetof(iphdr, protocol); - uint32_t flags_offset = ip_offset + offsetof(iphdr, frag_off); - uint32_t dport_indirect_offset = ip_offset + offsetof(udphdr, dest); struct sock_filter filter_code[] = { // Check the protocol is UDP. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, proto_offset), + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6), // Check this is not a fragment. - BPF_STMT(BPF_LD | BPF_H | BPF_ABS, flags_offset), - BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0x1fff, 4, 0), + BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), + BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0), // Get the IP header length. - BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, ip_offset), + BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), // Check the destination port. - BPF_STMT(BPF_LD | BPF_H | BPF_IND, dport_indirect_offset), + BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1), // Accept or reject. @@ -93,17 +98,13 @@ static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject return; } - uint32_t ipv6_offset = sizeof(ether_header); - uint32_t ipv6_next_header_offset = ipv6_offset + offsetof(ip6_hdr, ip6_nxt); - uint32_t icmp6_offset = ipv6_offset + sizeof(ip6_hdr); - uint32_t icmp6_type_offset = icmp6_offset + offsetof(icmp6_hdr, icmp6_type); struct sock_filter filter_code[] = { // Check IPv6 Next Header is ICMPv6. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, ipv6_next_header_offset), + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3), // Check ICMPv6 type is Router Advertisement. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, icmp6_type_offset), + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1), // Accept or reject. @@ -122,6 +123,81 @@ static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject } } +// TODO: Move all this filter code into libnetutils. +static void android_net_utils_attachControlPacketFilter( + JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) { + if (hardwareAddressType != ARPHRD_ETHER) { + jniThrowExceptionFmt(env, "java/net/SocketException", + "attachControlPacketFilter only supports ARPHRD_ETHER"); + return; + } + + // Capture all: + // - ARPs + // - DHCPv4 packets + // - Router Advertisements & Solicitations + // - Neighbor Advertisements & Solicitations + // + // tcpdump: + // arp or + // '(ip and udp port 68)' or + // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)' + struct sock_filter filter_code[] = { + // Load the link layer next payload field. + BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset), + + // Accept all ARP. + // TODO: Figure out how to better filter ARPs on noisy networks. + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0), + + // If IPv4: + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9), + + // Check the protocol is UDP. + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14), + + // Check this is not a fragment. + BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), + BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0), + + // Get the IP header length. + BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), + + // Check the source port. + BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0), + + // Check the destination port. + BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7), + + // IPv6 ... + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6), + // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ... + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), + BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4), + // ... and check the ICMPv6 type is one of RS/RA/NS/NA. + BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), + BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2), + BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0), + + // Accept or reject. + BPF_STMT(BPF_RET | BPF_K, 0xffff), + BPF_STMT(BPF_RET | BPF_K, 0) + }; + struct sock_fprog filter = { + sizeof(filter_code) / sizeof(filter_code[0]), + filter_code, + }; + + int fd = jniGetFDFromFileDescriptor(env, javaFd); + if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { + jniThrowExceptionFmt(env, "java/net/SocketException", + "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); + } +} + static void android_net_utils_setupRaSocket(JNIEnv *env, jobject clazz, jobject javaFd, jint ifIndex) { @@ -263,6 +339,7 @@ static const JNINativeMethod gNetworkUtilMethods[] = { { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess }, { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter }, { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter }, + { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter }, { "setupRaSocket", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_setupRaSocket }, };