services/jni/com_android_server_connectivity_Vpn.cpp - platform/frameworks/base - Git at Google

 /*
  * Copyright (C) 2011 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #define LOG_NDEBUG 0

 #define LOG_TAG "VpnJni"
 #include <cutils/log.h>
 #include <cutils/properties.h>

 #include <stdio.h>
 #include <string.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>

 #include <linux/if.h>
 #include <linux/if_tun.h>
 #include <linux/route.h>
 #include <linux/ipv6_route.h>

 #include "jni.h"
 #include "JNIHelp.h"

 namespace android
 {

 static int inet4 = -1;
 static int inet6 = -1;

 static inline in_addr_t *as_in_addr(sockaddr *sa) {
     return &((sockaddr_in *)sa)->sin_addr.s_addr;
 }

 //------------------------------------------------------------------------------

 #define SYSTEM_ERROR -1
 #define BAD_ARGUMENT -2

 static int create_interface(char *name, int *index, int mtu)
 {
     int tun = open("/dev/tun", O_RDWR | O_NONBLOCK);

     ifreq ifr4;
     memset(&ifr4, 0, sizeof(ifr4));

     // Allocate interface.
     ifr4.ifr_flags = IFF_TUN | IFF_NO_PI;
     if (ioctl(tun, TUNSETIFF, &ifr4)) {
         LOGE("Cannot allocate TUN: %s", strerror(errno));
         goto error;
     }

     // Activate interface.
     ifr4.ifr_flags = IFF_UP;
     if (ioctl(inet4, SIOCSIFFLAGS, &ifr4)) {
         LOGE("Cannot activate %s: %s", ifr4.ifr_name, strerror(errno));
         goto error;
     }

     // Set MTU if it is specified.
     ifr4.ifr_mtu = mtu;
     if (mtu > 0 && ioctl(inet4, SIOCSIFMTU, &ifr4)) {
         LOGE("Cannot set MTU on %s: %s", ifr4.ifr_name, strerror(errno));
         goto error;
     }

     // Get interface index.
     if (ioctl(inet4, SIOGIFINDEX, &ifr4)) {
         LOGE("Cannot get index of %s: %s", ifr4.ifr_name, strerror(errno));
         goto error;
     }

     strncpy(name, ifr4.ifr_name, IFNAMSIZ);
     *index = ifr4.ifr_ifindex;
     return tun;

 error:
     close(tun);
     return SYSTEM_ERROR;
 }

 static int set_addresses(const char *name, int index, const char *addresses)
 {
     ifreq ifr4;
     memset(&ifr4, 0, sizeof(ifr4));
     strncpy(ifr4.ifr_name, name, IFNAMSIZ);
     ifr4.ifr_addr.sa_family = AF_INET;

     in6_ifreq ifr6;
     memset(&ifr6, 0, sizeof(ifr6));
     ifr6.ifr6_ifindex = index;

     char address[65];
     int prefix;
     int chars;
     int count = 0;

     while (sscanf(addresses, " %64[^/]/%d %n", address, &prefix, &chars) == 2) {
         addresses += chars;

         if (strchr(address, ':')) {
             // Add an IPv6 address.
             if (inet_pton(AF_INET6, address, &ifr6.ifr6_addr) != 1 ||
                     prefix < 0 || prefix > 128) {
                 count = BAD_ARGUMENT;
                 break;
             }

             ifr6.ifr6_prefixlen = prefix;
             if (ioctl(inet6, SIOCSIFADDR, &ifr6)) {
                 count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
                 break;
             }
         } else {
             // Add an IPv4 address.
             if (inet_pton(AF_INET, address, as_in_addr(&ifr4.ifr_addr)) != 1 ||
                     prefix < 0 || prefix > 32) {
                 count = BAD_ARGUMENT;
                 break;
             }

             if (count) {
                 sprintf(ifr4.ifr_name, "%s:%d", name, count);
             }
             if (ioctl(inet4, SIOCSIFADDR, &ifr4)) {
                 count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
                 break;
             }

             in_addr_t mask = prefix ? (~0 << (32 - prefix)) : 0;
             *as_in_addr(&ifr4.ifr_addr) = htonl(mask);
             if (ioctl(inet4, SIOCSIFNETMASK, &ifr4)) {
                 count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
                 break;
             }
         }
         LOGD("Address added on %s: %s/%d", name, address, prefix);
         ++count;
     }

     if (count == BAD_ARGUMENT) {
         LOGE("Invalid address: %s/%d", address, prefix);
     } else if (count == SYSTEM_ERROR) {
         LOGE("Cannot add address: %s/%d: %s", address, prefix, strerror(errno));
     } else if (*addresses) {
         LOGE("Invalid address: %s", addresses);
         count = BAD_ARGUMENT;
     }

     return count;
 }

 static int set_routes(const char *name, int index, const char *routes)
 {
     rtentry rt4;
     memset(&rt4, 0, sizeof(rt4));
     rt4.rt_dev = (char *)name;
     rt4.rt_flags = RTF_UP;
     rt4.rt_dst.sa_family = AF_INET;
     rt4.rt_genmask.sa_family = AF_INET;

     in6_rtmsg rt6;
     memset(&rt6, 0, sizeof(rt6));
     rt6.rtmsg_ifindex = index;
     rt6.rtmsg_flags = RTF_UP;

     char address[65];
     int prefix;
     int chars;
     int count = 0;

     while (sscanf(routes, " %64[^/]/%d %n", address, &prefix, &chars) == 2) {
         routes += chars;

         if (strchr(address, ':')) {
             // Add an IPv6 route.
             if (inet_pton(AF_INET6, address, &rt6.rtmsg_dst) != 1 ||
                     prefix < 0 || prefix > 128) {
                 count = BAD_ARGUMENT;
                 break;
             }

             rt6.rtmsg_dst_len = prefix ? prefix : 1;
             if (ioctl(inet6, SIOCADDRT, &rt6) && errno != EEXIST) {
                 count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
                 break;
             }

             if (!prefix) {
                 // Split the route instead of replacing the default route.
                 rt6.rtmsg_dst.s6_addr[0] ^= 0x80;
                 if (ioctl(inet6, SIOCADDRT, &rt6) && errno != EEXIST) {
                     count = SYSTEM_ERROR;
                     break;
                 }
             }
         } else {
             // Add an IPv4 route.
             if (inet_pton(AF_INET, address, as_in_addr(&rt4.rt_dst)) != 1 ||
                     prefix < 0 || prefix > 32) {
                 count = BAD_ARGUMENT;
                 break;
             }

             in_addr_t mask = prefix ? (~0 << (32 - prefix)) : 0x80000000;
             *as_in_addr(&rt4.rt_genmask) = htonl(mask);
             if (ioctl(inet4, SIOCADDRT, &rt4) && errno != EEXIST) {
                 count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
                 break;
             }

             if (!prefix) {
                 // Split the route instead of replacing the default route.
                 *as_in_addr(&rt4.rt_dst) ^= htonl(0x80000000);
                 if (ioctl(inet4, SIOCADDRT, &rt4) && errno != EEXIST) {
                     count = SYSTEM_ERROR;
                     break;
                 }
             }
         }
         LOGD("Route added on %s: %s/%d", name, address, prefix);
         ++count;
     }

     if (count == BAD_ARGUMENT) {
         LOGE("Invalid route: %s/%d", address, prefix);
     } else if (count == SYSTEM_ERROR) {
         LOGE("Cannot add route: %s/%d: %s",
                 address, prefix, strerror(errno));
     } else if (*routes) {
         LOGE("Invalid route: %s", routes);
         count = BAD_ARGUMENT;
     }

     return count;
 }

 static int get_interface_name(char *name, int tun)
 {
     ifreq ifr4;
     if (ioctl(tun, TUNGETIFF, &ifr4)) {
         LOGE("Cannot get interface name: %s", strerror(errno));
         return SYSTEM_ERROR;
     }
     strncpy(name, ifr4.ifr_name, IFNAMSIZ);
     return 0;
 }

 static int reset_interface(const char *name)
 {
     ifreq ifr4;
     strncpy(ifr4.ifr_name, name, IFNAMSIZ);
     ifr4.ifr_flags = 0;

     if (ioctl(inet4, SIOCSIFFLAGS, &ifr4) && errno != ENODEV) {
         LOGE("Cannot reset %s: %s", name, strerror(errno));
         return SYSTEM_ERROR;
     }
     return 0;
 }

 static int check_interface(const char *name)
 {
     ifreq ifr4;
     strncpy(ifr4.ifr_name, name, IFNAMSIZ);
     ifr4.ifr_flags = 0;

     if (ioctl(inet4, SIOCGIFFLAGS, &ifr4) && errno != ENODEV) {
         LOGE("Cannot check %s: %s", name, strerror(errno));
     }
     return ifr4.ifr_flags;
 }

 static int bind_to_interface(int socket, const char *name)
 {
     if (setsockopt(socket, SOL_SOCKET, SO_BINDTODEVICE, name, strlen(name))) {
         LOGE("Cannot bind socket to %s: %s", name, strerror(errno));
         return SYSTEM_ERROR;
     }
     return 0;
 }

 //------------------------------------------------------------------------------

 static void throwException(JNIEnv *env, int error, const char *message)
 {
     if (error == SYSTEM_ERROR) {
         jniThrowException(env, "java/lang/IllegalStateException", message);
     } else {
         jniThrowException(env, "java/lang/IllegalArgumentException", message);
     }
 }

 static jint configure(JNIEnv *env, jobject thiz,
         jint mtu, jstring jAddresses, jstring jRoutes)
 {
     char name[IFNAMSIZ];
     int index;
     int tun = create_interface(name, &index, mtu);
     if (tun < 0) {
         throwException(env, tun, "Cannot create interface");
         return -1;
     }

     const char *addresses = NULL;
     const char *routes = NULL;
     int count;

     // At least one address must be set.
     addresses = jAddresses ? env->GetStringUTFChars(jAddresses, NULL) : NULL;
     if (!addresses) {
         jniThrowNullPointerException(env, "address");
         goto error;
     }
     count = set_addresses(name, index, addresses);
     env->ReleaseStringUTFChars(jAddresses, addresses);
     if (count <= 0) {
         throwException(env, count, "Cannot set address");
         goto error;
     }
     LOGD("Configured %d address(es) on %s", count, name);

     // On the contrary, routes are optional.
     routes = jRoutes ? env->GetStringUTFChars(jRoutes, NULL) : NULL;
     if (routes) {
         count = set_routes(name, index, routes);
         env->ReleaseStringUTFChars(jRoutes, routes);
         if (count < 0) {
             throwException(env, count, "Cannot set route");
             goto error;
         }
         LOGD("Configured %d route(s) on %s", count, name);
     }

     return tun;

 error:
     close(tun);
     LOGD("%s is destroyed", name);
     return -1;
 }

 static jstring getName(JNIEnv *env, jobject thiz, jint tun)
 {
     char name[IFNAMSIZ];
     if (get_interface_name(name, tun) < 0) {
         throwException(env, SYSTEM_ERROR, "Cannot get interface name");
         return NULL;
     }
     return env->NewStringUTF(name);
 }

 static void reset(JNIEnv *env, jobject thiz, jstring jName)
 {
     const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
     if (!name) {
         jniThrowNullPointerException(env, "name");
         return;
     }
     if (reset_interface(name) < 0) {
         throwException(env, SYSTEM_ERROR, "Cannot reset interface");
     }
     env->ReleaseStringUTFChars(jName, name);
 }

 static jint check(JNIEnv *env, jobject thiz, jstring jName)
 {
     const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
     if (!name) {
         jniThrowNullPointerException(env, "name");
         return 0;
     }
     int flags = check_interface(name);
     env->ReleaseStringUTFChars(jName, name);
     return flags;
 }

 static void protect(JNIEnv *env, jobject thiz, jint socket, jstring jName)
 {
     const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
     if (!name) {
         jniThrowNullPointerException(env, "name");
         return;
     }
     if (bind_to_interface(socket, name) < 0) {
         throwException(env, SYSTEM_ERROR, "Cannot protect socket");
     }
     env->ReleaseStringUTFChars(jName, name);
 }

 //------------------------------------------------------------------------------

 static JNINativeMethod gMethods[] = {
     {"jniConfigure", "(ILjava/lang/String;Ljava/lang/String;)I", (void *)configure},
     {"jniGetName", "(I)Ljava/lang/String;", (void *)getName},
     {"jniReset", "(Ljava/lang/String;)V", (void *)reset},
     {"jniCheck", "(Ljava/lang/String;)I", (void *)check},
     {"jniProtect", "(ILjava/lang/String;)V", (void *)protect},
 };

 int register_android_server_connectivity_Vpn(JNIEnv *env)
 {
     if (inet4 == -1) {
         inet4 = socket(AF_INET, SOCK_DGRAM, 0);
     }
     if (inet6 == -1) {
         inet6 = socket(AF_INET6, SOCK_DGRAM, 0);
     }
     return jniRegisterNativeMethods(env, "com/android/server/connectivity/Vpn",
             gMethods, NELEM(gMethods));
 }

 };
	/*
	* Copyright (C) 2011 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#define LOG_NDEBUG 0

	#define LOG_TAG "VpnJni"
	#include <cutils/log.h>
	#include <cutils/properties.h>

	#include <stdio.h>
	#include <string.h>
	#include <sys/ioctl.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <sys/socket.h>
	#include <netinet/in.h>
	#include <arpa/inet.h>
	#include <errno.h>
	#include <fcntl.h>

	#include <linux/if.h>
	#include <linux/if_tun.h>
	#include <linux/route.h>
	#include <linux/ipv6_route.h>

	#include "jni.h"
	#include "JNIHelp.h"

	namespace android
	{

	static int inet4 = -1;
	static int inet6 = -1;

	static inline in_addr_t as_in_addr(sockaddr sa) {
	return &((sockaddr_in *)sa)->sin_addr.s_addr;
	}

	//------------------------------------------------------------------------------

	#define SYSTEM_ERROR -1
	#define BAD_ARGUMENT -2

	static int create_interface(char name, int index, int mtu)
	{
	int tun = open("/dev/tun", O_RDWR \| O_NONBLOCK);

	ifreq ifr4;
	memset(&ifr4, 0, sizeof(ifr4));

	// Allocate interface.
	ifr4.ifr_flags = IFF_TUN \| IFF_NO_PI;
	if (ioctl(tun, TUNSETIFF, &ifr4)) {
	LOGE("Cannot allocate TUN: %s", strerror(errno));
	goto error;
	}

	// Activate interface.
	ifr4.ifr_flags = IFF_UP;
	if (ioctl(inet4, SIOCSIFFLAGS, &ifr4)) {
	LOGE("Cannot activate %s: %s", ifr4.ifr_name, strerror(errno));
	goto error;
	}

	// Set MTU if it is specified.
	ifr4.ifr_mtu = mtu;
	if (mtu > 0 && ioctl(inet4, SIOCSIFMTU, &ifr4)) {
	LOGE("Cannot set MTU on %s: %s", ifr4.ifr_name, strerror(errno));
	goto error;
	}

	// Get interface index.
	if (ioctl(inet4, SIOGIFINDEX, &ifr4)) {
	LOGE("Cannot get index of %s: %s", ifr4.ifr_name, strerror(errno));
	goto error;
	}

	strncpy(name, ifr4.ifr_name, IFNAMSIZ);
	*index = ifr4.ifr_ifindex;
	return tun;

	error:
	close(tun);
	return SYSTEM_ERROR;
	}

	static int set_addresses(const char name, int index, const char addresses)
	{
	ifreq ifr4;
	memset(&ifr4, 0, sizeof(ifr4));
	strncpy(ifr4.ifr_name, name, IFNAMSIZ);
	ifr4.ifr_addr.sa_family = AF_INET;

	in6_ifreq ifr6;
	memset(&ifr6, 0, sizeof(ifr6));
	ifr6.ifr6_ifindex = index;

	char address[65];
	int prefix;
	int chars;
	int count = 0;

	while (sscanf(addresses, " %64[^/]/%d %n", address, &prefix, &chars) == 2) {
	addresses += chars;

	if (strchr(address, ':')) {
	// Add an IPv6 address.
	if (inet_pton(AF_INET6, address, &ifr6.ifr6_addr) != 1 \|\|
	prefix < 0 \|\| prefix > 128) {
	count = BAD_ARGUMENT;
	break;
	}

	ifr6.ifr6_prefixlen = prefix;
	if (ioctl(inet6, SIOCSIFADDR, &ifr6)) {
	count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
	break;
	}
	} else {
	// Add an IPv4 address.
	if (inet_pton(AF_INET, address, as_in_addr(&ifr4.ifr_addr)) != 1 \|\|
	prefix < 0 \|\| prefix > 32) {
	count = BAD_ARGUMENT;
	break;
	}

	if (count) {
	sprintf(ifr4.ifr_name, "%s:%d", name, count);
	}
	if (ioctl(inet4, SIOCSIFADDR, &ifr4)) {
	count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
	break;
	}

	in_addr_t mask = prefix ? (~0 << (32 - prefix)) : 0;
	*as_in_addr(&ifr4.ifr_addr) = htonl(mask);
	if (ioctl(inet4, SIOCSIFNETMASK, &ifr4)) {
	count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
	break;
	}
	}
	LOGD("Address added on %s: %s/%d", name, address, prefix);
	++count;
	}

	if (count == BAD_ARGUMENT) {
	LOGE("Invalid address: %s/%d", address, prefix);
	} else if (count == SYSTEM_ERROR) {
	LOGE("Cannot add address: %s/%d: %s", address, prefix, strerror(errno));
	} else if (*addresses) {
	LOGE("Invalid address: %s", addresses);
	count = BAD_ARGUMENT;
	}

	return count;
	}

	static int set_routes(const char name, int index, const char routes)
	{
	rtentry rt4;
	memset(&rt4, 0, sizeof(rt4));
	rt4.rt_dev = (char *)name;
	rt4.rt_flags = RTF_UP;
	rt4.rt_dst.sa_family = AF_INET;
	rt4.rt_genmask.sa_family = AF_INET;

	in6_rtmsg rt6;
	memset(&rt6, 0, sizeof(rt6));
	rt6.rtmsg_ifindex = index;
	rt6.rtmsg_flags = RTF_UP;

	char address[65];
	int prefix;
	int chars;
	int count = 0;

	while (sscanf(routes, " %64[^/]/%d %n", address, &prefix, &chars) == 2) {
	routes += chars;

	if (strchr(address, ':')) {
	// Add an IPv6 route.
	if (inet_pton(AF_INET6, address, &rt6.rtmsg_dst) != 1 \|\|
	prefix < 0 \|\| prefix > 128) {
	count = BAD_ARGUMENT;
	break;
	}

	rt6.rtmsg_dst_len = prefix ? prefix : 1;
	if (ioctl(inet6, SIOCADDRT, &rt6) && errno != EEXIST) {
	count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
	break;
	}

	if (!prefix) {
	// Split the route instead of replacing the default route.
	rt6.rtmsg_dst.s6_addr[0] ^= 0x80;
	if (ioctl(inet6, SIOCADDRT, &rt6) && errno != EEXIST) {
	count = SYSTEM_ERROR;
	break;
	}
	}
	} else {
	// Add an IPv4 route.
	if (inet_pton(AF_INET, address, as_in_addr(&rt4.rt_dst)) != 1 \|\|
	prefix < 0 \|\| prefix > 32) {
	count = BAD_ARGUMENT;
	break;
	}

	in_addr_t mask = prefix ? (~0 << (32 - prefix)) : 0x80000000;
	*as_in_addr(&rt4.rt_genmask) = htonl(mask);
	if (ioctl(inet4, SIOCADDRT, &rt4) && errno != EEXIST) {
	count = (errno == EINVAL) ? BAD_ARGUMENT : SYSTEM_ERROR;
	break;
	}

	if (!prefix) {
	// Split the route instead of replacing the default route.
	*as_in_addr(&rt4.rt_dst) ^= htonl(0x80000000);
	if (ioctl(inet4, SIOCADDRT, &rt4) && errno != EEXIST) {
	count = SYSTEM_ERROR;
	break;
	}
	}
	}
	LOGD("Route added on %s: %s/%d", name, address, prefix);
	++count;
	}

	if (count == BAD_ARGUMENT) {
	LOGE("Invalid route: %s/%d", address, prefix);
	} else if (count == SYSTEM_ERROR) {
	LOGE("Cannot add route: %s/%d: %s",
	address, prefix, strerror(errno));
	} else if (*routes) {
	LOGE("Invalid route: %s", routes);
	count = BAD_ARGUMENT;
	}

	return count;
	}

	static int get_interface_name(char *name, int tun)
	{
	ifreq ifr4;
	if (ioctl(tun, TUNGETIFF, &ifr4)) {
	LOGE("Cannot get interface name: %s", strerror(errno));
	return SYSTEM_ERROR;
	}
	strncpy(name, ifr4.ifr_name, IFNAMSIZ);
	return 0;
	}

	static int reset_interface(const char *name)
	{
	ifreq ifr4;
	strncpy(ifr4.ifr_name, name, IFNAMSIZ);
	ifr4.ifr_flags = 0;

	if (ioctl(inet4, SIOCSIFFLAGS, &ifr4) && errno != ENODEV) {
	LOGE("Cannot reset %s: %s", name, strerror(errno));
	return SYSTEM_ERROR;
	}
	return 0;
	}

	static int check_interface(const char *name)
	{
	ifreq ifr4;
	strncpy(ifr4.ifr_name, name, IFNAMSIZ);
	ifr4.ifr_flags = 0;

	if (ioctl(inet4, SIOCGIFFLAGS, &ifr4) && errno != ENODEV) {
	LOGE("Cannot check %s: %s", name, strerror(errno));
	}
	return ifr4.ifr_flags;
	}

	static int bind_to_interface(int socket, const char *name)
	{
	if (setsockopt(socket, SOL_SOCKET, SO_BINDTODEVICE, name, strlen(name))) {
	LOGE("Cannot bind socket to %s: %s", name, strerror(errno));
	return SYSTEM_ERROR;
	}
	return 0;
	}

	//------------------------------------------------------------------------------

	static void throwException(JNIEnv env, int error, const char message)
	{
	if (error == SYSTEM_ERROR) {
	jniThrowException(env, "java/lang/IllegalStateException", message);
	} else {
	jniThrowException(env, "java/lang/IllegalArgumentException", message);
	}
	}

	static jint configure(JNIEnv *env, jobject thiz,
	jint mtu, jstring jAddresses, jstring jRoutes)
	{
	char name[IFNAMSIZ];
	int index;
	int tun = create_interface(name, &index, mtu);
	if (tun < 0) {
	throwException(env, tun, "Cannot create interface");
	return -1;
	}

	const char *addresses = NULL;
	const char *routes = NULL;
	int count;

	// At least one address must be set.
	addresses = jAddresses ? env->GetStringUTFChars(jAddresses, NULL) : NULL;
	if (!addresses) {
	jniThrowNullPointerException(env, "address");
	goto error;
	}
	count = set_addresses(name, index, addresses);
	env->ReleaseStringUTFChars(jAddresses, addresses);
	if (count <= 0) {
	throwException(env, count, "Cannot set address");
	goto error;
	}
	LOGD("Configured %d address(es) on %s", count, name);

	// On the contrary, routes are optional.
	routes = jRoutes ? env->GetStringUTFChars(jRoutes, NULL) : NULL;
	if (routes) {
	count = set_routes(name, index, routes);
	env->ReleaseStringUTFChars(jRoutes, routes);
	if (count < 0) {
	throwException(env, count, "Cannot set route");
	goto error;
	}
	LOGD("Configured %d route(s) on %s", count, name);
	}

	return tun;

	error:
	close(tun);
	LOGD("%s is destroyed", name);
	return -1;
	}

	static jstring getName(JNIEnv *env, jobject thiz, jint tun)
	{
	char name[IFNAMSIZ];
	if (get_interface_name(name, tun) < 0) {
	throwException(env, SYSTEM_ERROR, "Cannot get interface name");
	return NULL;
	}
	return env->NewStringUTF(name);
	}

	static void reset(JNIEnv *env, jobject thiz, jstring jName)
	{
	const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
	if (!name) {
	jniThrowNullPointerException(env, "name");
	return;
	}
	if (reset_interface(name) < 0) {
	throwException(env, SYSTEM_ERROR, "Cannot reset interface");
	}
	env->ReleaseStringUTFChars(jName, name);
	}

	static jint check(JNIEnv *env, jobject thiz, jstring jName)
	{
	const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
	if (!name) {
	jniThrowNullPointerException(env, "name");
	return 0;
	}
	int flags = check_interface(name);
	env->ReleaseStringUTFChars(jName, name);
	return flags;
	}

	static void protect(JNIEnv *env, jobject thiz, jint socket, jstring jName)
	{
	const char *name = jName ? env->GetStringUTFChars(jName, NULL) : NULL;
	if (!name) {
	jniThrowNullPointerException(env, "name");
	return;
	}
	if (bind_to_interface(socket, name) < 0) {
	throwException(env, SYSTEM_ERROR, "Cannot protect socket");
	}
	env->ReleaseStringUTFChars(jName, name);
	}

	//------------------------------------------------------------------------------

	static JNINativeMethod gMethods[] = {
	{"jniConfigure", "(ILjava/lang/String;Ljava/lang/String;)I", (void *)configure},
	{"jniGetName", "(I)Ljava/lang/String;", (void *)getName},
	{"jniReset", "(Ljava/lang/String;)V", (void *)reset},
	{"jniCheck", "(Ljava/lang/String;)I", (void *)check},
	{"jniProtect", "(ILjava/lang/String;)V", (void *)protect},
	};

	int register_android_server_connectivity_Vpn(JNIEnv *env)
	{
	if (inet4 == -1) {
	inet4 = socket(AF_INET, SOCK_DGRAM, 0);
	}
	if (inet6 == -1) {
	inet6 = socket(AF_INET6, SOCK_DGRAM, 0);
	}
	return jniRegisterNativeMethods(env, "com/android/server/connectivity/Vpn",
	gMethods, NELEM(gMethods));
	}

	};