diff --git a/core/java/android/net/NetworkUtils.java b/core/java/android/net/NetworkUtils.java index d2d886ba9a..dd3fff89cf 100644 --- a/core/java/android/net/NetworkUtils.java +++ b/core/java/android/net/NetworkUtils.java @@ -24,7 +24,6 @@ import android.util.Log; import android.util.Pair; import java.io.FileDescriptor; -import java.io.IOException; import java.math.BigInteger; import java.net.Inet4Address; import java.net.Inet6Address; @@ -44,32 +43,6 @@ public class NetworkUtils { private static final String TAG = "NetworkUtils"; - /** - * Attaches a socket filter that accepts DHCP packets to the given socket. - */ - @UnsupportedAppUsage - public native static void attachDhcpFilter(FileDescriptor fd) throws SocketException; - - /** - * Attaches a socket filter that accepts ICMPv6 router advertisements to the given socket. - * @param fd the socket's {@link FileDescriptor}. - * @param packetType the hardware address type, one of ARPHRD_*. - */ - @UnsupportedAppUsage - public native static void attachRaFilter(FileDescriptor fd, int packetType) throws SocketException; - - /** - * Attaches a socket filter that accepts L2-L4 signaling traffic required for IP connectivity. - * - * This includes: all ARP, ICMPv6 RS/RA/NS/NA messages, and DHCPv4 exchanges. - * - * @param fd the socket's {@link FileDescriptor}. - * @param packetType the hardware address type, one of ARPHRD_*. - */ - @UnsupportedAppUsage - public native static void attachControlPacketFilter(FileDescriptor fd, int packetType) - throws SocketException; - /** * Attaches a socket filter that drops all of incoming packets. * @param fd the socket's {@link FileDescriptor}. @@ -177,18 +150,6 @@ public class NetworkUtils { */ public static native void resNetworkCancel(FileDescriptor fd); - /** - * Add an entry into the ARP cache. - */ - public static void addArpEntry(Inet4Address ipv4Addr, MacAddress ethAddr, String ifname, - FileDescriptor fd) throws IOException { - addArpEntry(ethAddr.toByteArray(), ipv4Addr.getAddress(), ifname, fd); - } - - private static native void addArpEntry(byte[] ethAddr, byte[] netAddr, String ifname, - FileDescriptor fd) throws IOException; - - /** * Get the tcp repair window associated with the {@code fd}. * diff --git a/core/jni/android_net_NetUtils.cpp b/core/jni/android_net_NetUtils.cpp index 82acf6fb43..dd754f35bb 100644 --- a/core/jni/android_net_NetUtils.cpp +++ b/core/jni/android_net_NetUtils.cpp @@ -48,17 +48,6 @@ int ifc_disable(const char *ifname); namespace android { -static const uint32_t kEtherTypeOffset = offsetof(ether_header, ether_type); -static const uint32_t kEtherHeaderLen = sizeof(ether_header); -static const uint32_t kIPv4Protocol = kEtherHeaderLen + offsetof(iphdr, protocol); -static const uint32_t kIPv4FlagsOffset = kEtherHeaderLen + offsetof(iphdr, frag_off); -static const uint32_t kIPv6NextHeader = kEtherHeaderLen + offsetof(ip6_hdr, ip6_nxt); -static const uint32_t kIPv6PayloadStart = kEtherHeaderLen + sizeof(ip6_hdr); -static const uint32_t kICMPv6TypeOffset = kIPv6PayloadStart + offsetof(icmp6_hdr, icmp6_type); -static const uint32_t kUDPSrcPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, source); -static const uint32_t kUDPDstPortIndirectOffset = kEtherHeaderLen + offsetof(udphdr, dest); -static const uint16_t kDhcpClientPort = 68; - constexpr int MAXPACKETSIZE = 8 * 1024; // FrameworkListener limits the size of commands to 1024 bytes. TODO: fix this. constexpr int MAXCMDSIZE = 1024; @@ -84,149 +73,6 @@ static void throwErrnoException(JNIEnv* env, const char* functionName, int error env->Throw(reinterpret_cast(exception)); } -static void android_net_utils_attachDhcpFilter(JNIEnv *env, jobject clazz, jobject javaFd) -{ - struct sock_filter filter_code[] = { - // Check the protocol is UDP. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 6), - - // Check this is not a fragment. - BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), - BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 4, 0), - - // Get the IP header length. - BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), - - // Check the destination port. - BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 0, 1), - - // Accept or reject. - BPF_STMT(BPF_RET | BPF_K, 0xffff), - BPF_STMT(BPF_RET | BPF_K, 0) - }; - struct sock_fprog filter = { - sizeof(filter_code) / sizeof(filter_code[0]), - filter_code, - }; - - int fd = jniGetFDFromFileDescriptor(env, javaFd); - if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { - jniThrowExceptionFmt(env, "java/net/SocketException", - "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); - } -} - -static void android_net_utils_attachRaFilter(JNIEnv *env, jobject clazz, jobject javaFd, - jint hardwareAddressType) -{ - if (hardwareAddressType != ARPHRD_ETHER) { - jniThrowExceptionFmt(env, "java/net/SocketException", - "attachRaFilter only supports ARPHRD_ETHER"); - return; - } - - struct sock_filter filter_code[] = { - // Check IPv6 Next Header is ICMPv6. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3), - - // Check ICMPv6 type is Router Advertisement. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_ROUTER_ADVERT, 0, 1), - - // Accept or reject. - BPF_STMT(BPF_RET | BPF_K, 0xffff), - BPF_STMT(BPF_RET | BPF_K, 0) - }; - struct sock_fprog filter = { - sizeof(filter_code) / sizeof(filter_code[0]), - filter_code, - }; - - int fd = jniGetFDFromFileDescriptor(env, javaFd); - if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { - jniThrowExceptionFmt(env, "java/net/SocketException", - "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); - } -} - -// TODO: Move all this filter code into libnetutils. -static void android_net_utils_attachControlPacketFilter( - JNIEnv *env, jobject clazz, jobject javaFd, jint hardwareAddressType) { - if (hardwareAddressType != ARPHRD_ETHER) { - jniThrowExceptionFmt(env, "java/net/SocketException", - "attachControlPacketFilter only supports ARPHRD_ETHER"); - return; - } - - // Capture all: - // - ARPs - // - DHCPv4 packets - // - Router Advertisements & Solicitations - // - Neighbor Advertisements & Solicitations - // - // tcpdump: - // arp or - // '(ip and udp port 68)' or - // '(icmp6 and ip6[40] >= 133 and ip6[40] <= 136)' - struct sock_filter filter_code[] = { - // Load the link layer next payload field. - BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kEtherTypeOffset), - - // Accept all ARP. - // TODO: Figure out how to better filter ARPs on noisy networks. - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_ARP, 16, 0), - - // If IPv4: - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IP, 0, 9), - - // Check the protocol is UDP. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv4Protocol), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_UDP, 0, 14), - - // Check this is not a fragment. - BPF_STMT(BPF_LD | BPF_H | BPF_ABS, kIPv4FlagsOffset), - BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, IP_OFFMASK, 12, 0), - - // Get the IP header length. - BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, kEtherHeaderLen), - - // Check the source port. - BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPSrcPortIndirectOffset), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 8, 0), - - // Check the destination port. - BPF_STMT(BPF_LD | BPF_H | BPF_IND, kUDPDstPortIndirectOffset), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, kDhcpClientPort, 6, 7), - - // IPv6 ... - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ETHERTYPE_IPV6, 0, 6), - // ... check IPv6 Next Header is ICMPv6 (ignore fragments), ... - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kIPv6NextHeader), - BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 4), - // ... and check the ICMPv6 type is one of RS/RA/NS/NA. - BPF_STMT(BPF_LD | BPF_B | BPF_ABS, kICMPv6TypeOffset), - BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, ND_ROUTER_SOLICIT, 0, 2), - BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, ND_NEIGHBOR_ADVERT, 1, 0), - - // Accept or reject. - BPF_STMT(BPF_RET | BPF_K, 0xffff), - BPF_STMT(BPF_RET | BPF_K, 0) - }; - struct sock_fprog filter = { - sizeof(filter_code) / sizeof(filter_code[0]), - filter_code, - }; - - int fd = jniGetFDFromFileDescriptor(env, javaFd); - if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) != 0) { - jniThrowExceptionFmt(env, "java/net/SocketException", - "setsockopt(SO_ATTACH_FILTER): %s", strerror(errno)); - } -} - static void android_net_utils_attachDropAllBPFFilter(JNIEnv *env, jobject clazz, jobject javaFd) { struct sock_filter filter_code[] = { @@ -389,46 +235,6 @@ static bool checkLenAndCopy(JNIEnv* env, const jbyteArray& addr, int len, void* return true; } -static void android_net_utils_addArpEntry(JNIEnv *env, jobject thiz, jbyteArray ethAddr, - jbyteArray ipv4Addr, jstring ifname, jobject javaFd) -{ - struct arpreq req = {}; - struct sockaddr_in& netAddrStruct = *reinterpret_cast(&req.arp_pa); - struct sockaddr& ethAddrStruct = req.arp_ha; - - ethAddrStruct.sa_family = ARPHRD_ETHER; - if (!checkLenAndCopy(env, ethAddr, ETH_ALEN, ethAddrStruct.sa_data)) { - jniThrowException(env, "java/io/IOException", "Invalid ethAddr length"); - return; - } - - netAddrStruct.sin_family = AF_INET; - if (!checkLenAndCopy(env, ipv4Addr, sizeof(in_addr), &netAddrStruct.sin_addr)) { - jniThrowException(env, "java/io/IOException", "Invalid ipv4Addr length"); - return; - } - - int ifLen = env->GetStringLength(ifname); - // IFNAMSIZ includes the terminating NULL character - if (ifLen >= IFNAMSIZ) { - jniThrowException(env, "java/io/IOException", "ifname too long"); - return; - } - env->GetStringUTFRegion(ifname, 0, ifLen, req.arp_dev); - - req.arp_flags = ATF_COM; // Completed entry (ha valid) - int fd = jniGetFDFromFileDescriptor(env, javaFd); - if (fd < 0) { - jniThrowExceptionFmt(env, "java/io/IOException", "Invalid file descriptor"); - return; - } - // See also: man 7 arp - if (ioctl(fd, SIOCSARP, &req)) { - jniThrowExceptionFmt(env, "java/io/IOException", "ioctl error: %s", strerror(errno)); - return; - } -} - static jobject android_net_utils_resNetworkQuery(JNIEnv *env, jobject thiz, jint netId, jstring dname, jint ns_class, jint ns_type, jint flags) { const jsize javaCharsCount = env->GetStringLength(dname); @@ -542,10 +348,6 @@ static const JNINativeMethod gNetworkUtilMethods[] = { { "bindSocketToNetwork", "(II)I", (void*) android_net_utils_bindSocketToNetwork }, { "protectFromVpn", "(I)Z", (void*)android_net_utils_protectFromVpn }, { "queryUserAccess", "(II)Z", (void*)android_net_utils_queryUserAccess }, - { "addArpEntry", "([B[BLjava/lang/String;Ljava/io/FileDescriptor;)V", (void*) android_net_utils_addArpEntry }, - { "attachDhcpFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDhcpFilter }, - { "attachRaFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachRaFilter }, - { "attachControlPacketFilter", "(Ljava/io/FileDescriptor;I)V", (void*) android_net_utils_attachControlPacketFilter }, { "attachDropAllBPFFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_attachDropAllBPFFilter }, { "detachBPFFilter", "(Ljava/io/FileDescriptor;)V", (void*) android_net_utils_detachBPFFilter }, { "getTcpRepairWindow", "(Ljava/io/FileDescriptor;)Landroid/net/TcpRepairWindow;", (void*) android_net_utils_getTcpRepairWindow },