Merge changes I804a0ba0,I5667cbb4,Ic2c85f3c (b942012f) · Commits · e / os / android_packages_modules_NetworkStack

common/moduleutils/src/android/net/ip/ConntrackMonitor.java

+106 −2

Original line number	Diff line number	Diff line
		@@ -16,7 +16,11 @@

		package android.net.ip;

		import static android.net.netlink.ConntrackMessage.DYING_MASK;
		import static android.net.netlink.ConntrackMessage.ESTABLISHED_MASK;

		import android.net.netlink.ConntrackMessage;
		import android.net.netlink.NetlinkConstants;
		import android.net.netlink.NetlinkMessage;
		import android.net.util.SharedLog;
		import android.os.Handler;
		@@ -24,6 +28,11 @@ import android.system.OsConstants;

		import androidx.annotation.NonNull;

		import com.android.internal.annotations.VisibleForTesting;

		import java.util.Objects;


		/**
		* ConntrackMonitor.
		*
		@@ -45,7 +54,96 @@ public class ConntrackMonitor extends NetlinkMonitor {
		/**
		* A class for describing parsed netfilter conntrack events.
		*/
		public static class ConntrackEvent { /TODO/ }
		public static class ConntrackEvent {
		/**
		* Conntrack event type.
		*/
		public final short msgType;
		/**
		* Original direction conntrack tuple.
		*/
		public final ConntrackMessage.Tuple tupleOrig;
		/**
		* Reply direction conntrack tuple.
		*/
		public final ConntrackMessage.Tuple tupleReply;
		/**
		* Connection status. A bitmask of ip_conntrack_status enum flags.
		*/
		public final int status;
		/**
		* Conntrack timeout.
		*/
		public final int timeoutSec;

		public ConntrackEvent(ConntrackMessage msg) {
		this.msgType = msg.getHeader().nlmsg_type;
		this.tupleOrig = msg.tupleOrig;
		this.tupleReply = msg.tupleReply;
		this.status = msg.status;
		this.timeoutSec = msg.timeoutSec;
		}

		@VisibleForTesting
		public ConntrackEvent(short msgType, ConntrackMessage.Tuple tupleOrig,
		ConntrackMessage.Tuple tupleReply, int status, int timeoutSec) {
		this.msgType = msgType;
		this.tupleOrig = tupleOrig;
		this.tupleReply = tupleReply;
		this.status = status;
		this.timeoutSec = timeoutSec;
		}

		@Override
		@VisibleForTesting
		public boolean equals(Object o) {
		if (!(o instanceof ConntrackEvent)) return false;
		ConntrackEvent that = (ConntrackEvent) o;
		return this.msgType == that.msgType
		&& Objects.equals(this.tupleOrig, that.tupleOrig)
		&& Objects.equals(this.tupleReply, that.tupleReply)
		&& this.status == that.status
		&& this.timeoutSec == that.timeoutSec;
		}

		@Override
		public int hashCode() {
		return Objects.hash(msgType, tupleOrig, tupleReply, status, timeoutSec);
		}

		/**
		* Check the established NAT session conntrack message.
		*
		* @param msg the conntrack message to check.
		* @return true if an established NAT message, false if not.
		*/
		public static boolean isEstablishedNatSession(@NonNull ConntrackMessage msg) {
		if (msg.getMessageType() != NetlinkConstants.IPCTNL_MSG_CT_NEW) return false;
		if (msg.tupleOrig == null) return false;
		if (msg.tupleReply == null) return false;
		if (msg.timeoutSec == 0) return false;
		if ((msg.status & ESTABLISHED_MASK) != ESTABLISHED_MASK) return false;

		return true;
		}

		/**
		* Check the dying NAT session conntrack message.
		* Note that IPCTNL_MSG_CT_DELETE event has no CTA_TIMEOUT attribute.
		*
		* @param msg the conntrack message to check.
		* @return true if a dying NAT message, false if not.
		*/
		public static boolean isDyingNatSession(@NonNull ConntrackMessage msg) {
		if (msg.getMessageType() != NetlinkConstants.IPCTNL_MSG_CT_DELETE) return false;
		if (msg.tupleOrig == null) return false;
		if (msg.tupleReply == null) return false;
		if (msg.timeoutSec != 0) return false;
		if ((msg.status & DYING_MASK) != DYING_MASK) return false;

		return true;
		}
		}

		/**
		* A callback to caller for conntrack event.
		@@ -74,6 +172,12 @@ public class ConntrackMonitor extends NetlinkMonitor {
		return;
		}

		mConsumer.accept(new ConntrackEvent() /* TODO */);
		final ConntrackMessage conntrackMsg = (ConntrackMessage) nlMsg;
		if (!(ConntrackEvent.isEstablishedNatSession(conntrackMsg)
		\|\| ConntrackEvent.isDyingNatSession(conntrackMsg))) {
		return;
		}

		mConsumer.accept(new ConntrackEvent(conntrackMsg));
		}
		}

common/netlinkclient/src/android/net/netlink/ConntrackMessage.java

+273 −4

Original line number	Diff line number	Diff line
		@@ -16,18 +16,27 @@

		package android.net.netlink;

		import static android.net.netlink.StructNlAttr.findNextAttrOfType;
		import static android.net.netlink.StructNlAttr.makeNestedType;
		import static android.net.netlink.StructNlMsgHdr.NLM_F_ACK;
		import static android.net.netlink.StructNlMsgHdr.NLM_F_REPLACE;
		import static android.net.netlink.StructNlMsgHdr.NLM_F_REQUEST;
		import static android.system.OsConstants.IPPROTO_TCP;
		import static android.system.OsConstants.IPPROTO_UDP;

		import static java.nio.ByteOrder.BIG_ENDIAN;

		import android.annotation.NonNull;
		import android.annotation.Nullable;
		import android.system.OsConstants;

		import com.android.internal.annotations.VisibleForTesting;

		import java.net.Inet4Address;
		import java.net.InetAddress;
		import java.nio.ByteBuffer;
		import java.nio.ByteOrder;
		import java.util.Objects;


		/**
		@@ -59,6 +68,106 @@ public class ConntrackMessage extends NetlinkMessage {
		public static final short CTA_PROTO_SRC_PORT = 2;
		public static final short CTA_PROTO_DST_PORT = 3;

		// enum ip_conntrack_status
		public static final int IPS_EXPECTED = 0x00000001;
		public static final int IPS_SEEN_REPLY = 0x00000002;
		public static final int IPS_ASSURED = 0x00000004;
		public static final int IPS_CONFIRMED = 0x00000008;
		public static final int IPS_SRC_NAT = 0x00000010;
		public static final int IPS_DST_NAT = 0x00000020;
		public static final int IPS_SEQ_ADJUST = 0x00000040;
		public static final int IPS_SRC_NAT_DONE = 0x00000080;
		public static final int IPS_DST_NAT_DONE = 0x00000100;
		public static final int IPS_DYING = 0x00000200;
		public static final int IPS_FIXED_TIMEOUT = 0x00000400;
		public static final int IPS_TEMPLATE = 0x00000800;
		public static final int IPS_UNTRACKED = 0x00001000;
		public static final int IPS_HELPER = 0x00002000;
		public static final int IPS_OFFLOAD = 0x00004000;
		public static final int IPS_HW_OFFLOAD = 0x00008000;

		// ip_conntrack_status mask
		// Interesting on the NAT conntrack session which has already seen two direction traffic.
		// TODO: Probably IPS_{SRC, DST}_NAT_DONE are also interesting.
		public static final int ESTABLISHED_MASK = IPS_CONFIRMED \| IPS_ASSURED \| IPS_SEEN_REPLY
		\| IPS_SRC_NAT;
		// Interesting on the established NAT conntrack session which is dying.
		public static final int DYING_MASK = ESTABLISHED_MASK \| IPS_DYING;

		/**
		* A tuple for the conntrack connection information.
		*
		* see also CTA_TUPLE_ORIG and CTA_TUPLE_REPLY.
		*/
		public static class Tuple {
		public final Inet4Address srcIp;
		public final Inet4Address dstIp;

		// Both port and protocol number are unsigned numbers stored in signed integers, and that
		// callers that want to compare them to integers should either cast those integers, or
		// convert them to unsigned using Byte.toUnsignedInt() and Short.toUnsignedInt().
		public final short srcPort;
		public final short dstPort;
		public final byte protoNum;

		public Tuple(TupleIpv4 ip, TupleProto proto) {
		this.srcIp = ip.src;
		this.dstIp = ip.dst;
		this.srcPort = proto.srcPort;
		this.dstPort = proto.dstPort;
		this.protoNum = proto.protoNum;
		}

		@Override
		@VisibleForTesting
		public boolean equals(Object o) {
		if (!(o instanceof Tuple)) return false;
		Tuple that = (Tuple) o;
		return Objects.equals(this.srcIp, that.srcIp)
		&& Objects.equals(this.dstIp, that.dstIp)
		&& this.srcPort == that.srcPort
		&& this.dstPort == that.dstPort
		&& this.protoNum == that.protoNum;
		}

		@Override
		public int hashCode() {
		return Objects.hash(srcIp, dstIp, srcPort, dstPort, protoNum);
		}
		}

		/**
		* A tuple for the conntrack connection address.
		*
		* see also CTA_TUPLE_IP.
		*/
		public static class TupleIpv4 {
		public final Inet4Address src;
		public final Inet4Address dst;

		public TupleIpv4(Inet4Address src, Inet4Address dst) {
		this.src = src;
		this.dst = dst;
		}
		}

		/**
		* A tuple for the conntrack connection protocol.
		*
		* see also CTA_TUPLE_PROTO.
		*/
		public static class TupleProto {
		public final byte protoNum;
		public final short srcPort;
		public final short dstPort;

		public TupleProto(byte protoNum, short srcPort, short dstPort) {
		this.protoNum = protoNum;
		this.srcPort = srcPort;
		this.dstPort = dstPort;
		}
		}

		public static byte[] newIPv4TimeoutUpdateRequest(
		int proto, Inet4Address src, int sport, Inet4Address dst, int dport, int timeoutSec) {
		// * STYLE WARNING *
		@@ -113,19 +222,33 @@ public class ConntrackMessage extends NetlinkMessage {
		}

		final int baseOffset = byteBuffer.position();
		StructNlAttr nlAttr = StructNlAttr.findNextAttrOfType(CTA_STATUS, byteBuffer);
		StructNlAttr nlAttr = findNextAttrOfType(CTA_STATUS, byteBuffer);
		int status = 0;
		if (nlAttr != null) {
		status = nlAttr.getValueAsBe32(0);
		}

		byteBuffer.position(baseOffset);
		nlAttr = StructNlAttr.findNextAttrOfType(CTA_TIMEOUT, byteBuffer);
		nlAttr = findNextAttrOfType(CTA_TIMEOUT, byteBuffer);
		int timeoutSec = 0;
		if (nlAttr != null) {
		timeoutSec = nlAttr.getValueAsBe32(0);
		}

		byteBuffer.position(baseOffset);
		nlAttr = findNextAttrOfType(makeNestedType(CTA_TUPLE_ORIG), byteBuffer);
		Tuple tupleOrig = null;
		if (nlAttr != null) {
		tupleOrig = parseTuple(nlAttr.getValueAsByteBuffer());
		}

		byteBuffer.position(baseOffset);
		nlAttr = findNextAttrOfType(makeNestedType(CTA_TUPLE_REPLY), byteBuffer);
		Tuple tupleReply = null;
		if (nlAttr != null) {
		tupleReply = parseTuple(nlAttr.getValueAsByteBuffer());
		}

		// Advance to the end of the message.
		byteBuffer.position(baseOffset);
		final int kMinConsumed = StructNlMsgHdr.STRUCT_SIZE + StructNfGenMsg.STRUCT_SIZE;
		@@ -136,13 +259,148 @@ public class ConntrackMessage extends NetlinkMessage {
		}
		byteBuffer.position(baseOffset + kAdditionalSpace);

		return new ConntrackMessage(header, nfGenMsg, status, timeoutSec);
		return new ConntrackMessage(header, nfGenMsg, tupleOrig, tupleReply, status, timeoutSec);
		}

		/**
		* Parses a conntrack tuple from a {@link ByteBuffer}.
		*
		* The attribute parsing is interesting on:
		* - CTA_TUPLE_IP
		* CTA_IP_V4_SRC
		* CTA_IP_V4_DST
		* - CTA_TUPLE_PROTO
		* CTA_PROTO_NUM
		* CTA_PROTO_SRC_PORT
		* CTA_PROTO_DST_PORT
		*
		* Assume that the minimum size is the sum of CTA_TUPLE_IP (size: 20) and CTA_TUPLE_PROTO
		* (size: 28). Here is an example for an expected CTA_TUPLE_ORIG message in raw data:
		* +--------------------------------------------------------------------------------------+
		* \| CTA_TUPLE_ORIG \|
		* +--------------------------+-----------------------------------------------------------+
		* \| 1400 \| nla_len = 20 \|
		* \| 0180 \| nla_type = nested CTA_TUPLE_IP \|
		* \| 0800 0100 C0A8500C \| nla_type=CTA_IP_V4_SRC, ip=192.168.80.12 \|
		* \| 0800 0200 8C700874 \| nla_type=CTA_IP_V4_DST, ip=140.112.8.116 \|
		* \| 1C00 \| nla_len = 28 \|
		* \| 0280 \| nla_type = nested CTA_TUPLE_PROTO \|
		* \| 0500 0100 06 000000 \| nla_type=CTA_PROTO_NUM, proto=IPPROTO_TCP (6) \|
		* \| 0600 0200 F3F1 0000 \| nla_type=CTA_PROTO_SRC_PORT, port=62449 (big endian) \|
		* \| 0600 0300 01BB 0000 \| nla_type=CTA_PROTO_DST_PORT, port=433 (big endian) \|
		* +--------------------------+-----------------------------------------------------------+
		*
		* The position of the byte buffer doesn't set to the end when the function returns. It is okay
		* because the caller ConntrackMessage#parse has passed a copy which is used for this parser
		* only. Moreover, the parser behavior is the same as other existing netlink struct class
		* parser. Ex: StructInetDiagMsg#parse.
		*/
		@Nullable
		private static Tuple parseTuple(@Nullable ByteBuffer byteBuffer) {
		if (byteBuffer == null) return null;

		TupleIpv4 tupleIpv4 = null;
		TupleProto tupleProto = null;

		final int baseOffset = byteBuffer.position();
		StructNlAttr nlAttr = findNextAttrOfType(makeNestedType(CTA_TUPLE_IP), byteBuffer);
		if (nlAttr != null) {
		tupleIpv4 = parseTupleIpv4(nlAttr.getValueAsByteBuffer());
		}
		if (tupleIpv4 == null) return null;

		byteBuffer.position(baseOffset);
		nlAttr = findNextAttrOfType(makeNestedType(CTA_TUPLE_PROTO), byteBuffer);
		if (nlAttr != null) {
		tupleProto = parseTupleProto(nlAttr.getValueAsByteBuffer());
		}
		if (tupleProto == null) return null;

		return new Tuple(tupleIpv4, tupleProto);
		}

		@Nullable
		private static Inet4Address castToInet4Address(@Nullable InetAddress address) {
		if (address == null \|\| !(address instanceof Inet4Address)) return null;
		return (Inet4Address) address;
		}

		@Nullable
		private static TupleIpv4 parseTupleIpv4(@Nullable ByteBuffer byteBuffer) {
		if (byteBuffer == null) return null;

		Inet4Address src = null;
		Inet4Address dst = null;

		final int baseOffset = byteBuffer.position();
		StructNlAttr nlAttr = findNextAttrOfType(CTA_IP_V4_SRC, byteBuffer);
		if (nlAttr != null) {
		src = castToInet4Address(nlAttr.getValueAsInetAddress());
		}
		if (src == null) return null;

		byteBuffer.position(baseOffset);
		nlAttr = findNextAttrOfType(CTA_IP_V4_DST, byteBuffer);
		if (nlAttr != null) {
		dst = castToInet4Address(nlAttr.getValueAsInetAddress());
		}
		if (dst == null) return null;

		return new TupleIpv4(src, dst);
		}

		@Nullable
		private static TupleProto parseTupleProto(@Nullable ByteBuffer byteBuffer) {
		if (byteBuffer == null) return null;

		byte protoNum = 0;
		short srcPort = 0;
		short dstPort = 0;

		final int baseOffset = byteBuffer.position();
		StructNlAttr nlAttr = findNextAttrOfType(CTA_PROTO_NUM, byteBuffer);
		if (nlAttr != null) {
		protoNum = nlAttr.getValueAsByte((byte) 0);
		}
		if (!(protoNum == IPPROTO_TCP \|\| protoNum == IPPROTO_UDP)) return null;

		byteBuffer.position(baseOffset);
		nlAttr = StructNlAttr.findNextAttrOfType(CTA_PROTO_SRC_PORT, byteBuffer);
		if (nlAttr != null) {
		srcPort = nlAttr.getValueAsBe16((short) 0);
		}
		if (srcPort == 0) return null;

		byteBuffer.position(baseOffset);
		nlAttr = StructNlAttr.findNextAttrOfType(CTA_PROTO_DST_PORT, byteBuffer);
		if (nlAttr != null) {
		dstPort = nlAttr.getValueAsBe16((short) 0);
		}
		if (dstPort == 0) return null;

		return new TupleProto(protoNum, srcPort, dstPort);
		}

		/**
		* Netfilter header.
		*/
		public final StructNfGenMsg nfGenMsg;
		/**
		* Original direction conntrack tuple.
		*
		* The tuple is determined by the parsed attribute value CTA_TUPLE_ORIG, or null if the
		* tuple could not be parsed successfully (for example, if it was truncated or absent).
		*/
		@Nullable
		public final Tuple tupleOrig;
		/**
		* Reply direction conntrack tuple.
		*
		* The tuple is determined by the parsed attribute value CTA_TUPLE_REPLY, or null if the
		* tuple could not be parsed successfully (for example, if it was truncated or absent).
		*/
		@Nullable
		public final Tuple tupleReply;
		/**
		* Connection status. A bitmask of ip_conntrack_status enum flags.
		*
		@@ -165,14 +423,21 @@ public class ConntrackMessage extends NetlinkMessage {
		private ConntrackMessage() {
		super(new StructNlMsgHdr());
		nfGenMsg = new StructNfGenMsg((byte) OsConstants.AF_INET);

		// This constructor is only used by #newIPv4TimeoutUpdateRequest which doesn't use these
		// data member for packing message. Simply fill them to null or 0.
		tupleOrig = null;
		tupleReply = null;
		status = 0;
		timeoutSec = 0;
		}

		private ConntrackMessage(@NonNull StructNlMsgHdr header, @NonNull StructNfGenMsg nfGenMsg,
		int status, int timeoutSec) {
		@Nullable Tuple tupleOrig, @Nullable Tuple tupleReply, int status, int timeoutSec) {
		super(header);
		this.nfGenMsg = nfGenMsg;
		this.tupleOrig = tupleOrig;
		this.tupleReply = tupleReply;
		this.status = status;
		this.timeoutSec = timeoutSec;
		}
		@@ -181,4 +446,8 @@ public class ConntrackMessage extends NetlinkMessage {
		mHeader.pack(byteBuffer);
		nfGenMsg.pack(byteBuffer);
		}

		public short getMessageType() {
		return (short) (getHeader().nlmsg_type & ~(NetlinkConstants.NFNL_SUBSYS_CTNETLINK << 8));
		}
		}

common/netlinkclient/src/android/net/netlink/StructNlAttr.java

+28 −0

Original line number	Diff line number	Diff line
		@@ -183,6 +183,23 @@ public class StructNlAttr {
		return NetlinkConstants.alignedLengthOf(nla_len);
		}

		/**
		* Get attribute value as BE16.
		*/
		public short getValueAsBe16(short defaultValue) {
		final ByteBuffer byteBuffer = getValueAsByteBuffer();
		if (byteBuffer == null \|\| byteBuffer.remaining() != Short.BYTES) {
		return defaultValue;
		}
		final ByteOrder originalOrder = byteBuffer.order();
		try {
		byteBuffer.order(ByteOrder.BIG_ENDIAN);
		return byteBuffer.getShort();
		} finally {
		byteBuffer.order(originalOrder);
		}
		}

		public int getValueAsBe32(int defaultValue) {
		final ByteBuffer byteBuffer = getValueAsByteBuffer();
		if (byteBuffer == null \|\| byteBuffer.remaining() != Integer.BYTES) {
		@@ -207,6 +224,17 @@ public class StructNlAttr {
		return byteBuffer;
		}

		/**
		* Get attribute value as byte.
		*/
		public byte getValueAsByte(byte defaultValue) {
		final ByteBuffer byteBuffer = getValueAsByteBuffer();
		if (byteBuffer == null \|\| byteBuffer.remaining() != Byte.BYTES) {
		return defaultValue;
		}
		return getValueAsByteBuffer().get();
		}

		public int getValueAsInt(int defaultValue) {
		final ByteBuffer byteBuffer = getValueAsByteBuffer();
		if (byteBuffer == null \|\| byteBuffer.remaining() != Integer.BYTES) {

tests/unit/src/android/net/ip/ConntrackMonitorTest.java

+179 −11

File changed.

Preview size limit exceeded, changes collapsed.

tests/unit/src/android/net/netlink/ConntrackMessageTest.java

+145 −10

File changed.

Preview size limit exceeded, changes collapsed.