blob: ff35d8905b91b8aa7df65832dcf14ce8fb7029bf [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrall0031cea2012-04-17 16:38:23 -070017// #define LOG_NDEBUG 0
18
San Mehat9ff78fb2010-01-19 12:59:15 -080019#include <stdlib.h>
20#include <errno.h>
21#include <sys/socket.h>
22#include <sys/stat.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080023#include <sys/wait.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080024#include <fcntl.h>
25#include <netinet/in.h>
26#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080027#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050028#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080029
30#define LOG_TAG "NatController"
31#include <cutils/log.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080032#include <logwrap/logwrap.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080033
34#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070035#include "SecondaryTableController.h"
Robert Greenwaltc4621772012-01-31 12:46:45 -080036#include "NetdConstants.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080037
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070038const char* NatController::LOCAL_FORWARD = "natctrl_FORWARD";
39const char* NatController::LOCAL_NAT_POSTROUTING = "natctrl_nat_POSTROUTING";
40
Robert Greenwaltfc97b822011-11-02 16:48:36 -070041NatController::NatController(SecondaryTableController *ctrl) {
42 secondaryTableCtrl = ctrl;
San Mehat9ff78fb2010-01-19 12:59:15 -080043}
44
45NatController::~NatController() {
46}
47
Rom Lemarchand001f0a42013-01-31 12:41:03 -080048int NatController::runCmd(int argc, const char **argv) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070049 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080050
Rom Lemarchand001f0a42013-01-31 12:41:03 -080051 res = android_fork_execvp(argc, (char **)argv, NULL, false, false);
52 ALOGV("runCmd() res=%d", res);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070053 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080054}
55
JP Abgrall0031cea2012-04-17 16:38:23 -070056int NatController::setupIptablesHooks() {
JP Abgrall458f3182012-04-24 21:30:43 -070057 setDefaults();
JP Abgrall0031cea2012-04-17 16:38:23 -070058 return 0;
59}
60
61int NatController::setDefaults() {
Rom Lemarchand001f0a42013-01-31 12:41:03 -080062 const char *cmd1[] = {
63 IPTABLES_PATH,
64 "-F",
65 "natctrl_FORWARD"
66 };
67 if (runCmd(ARRAY_SIZE(cmd1), cmd1))
San Mehat9ff78fb2010-01-19 12:59:15 -080068 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070069
Rom Lemarchand001f0a42013-01-31 12:41:03 -080070 const char *cmd2[] = {
71 IPTABLES_PATH,
72 "-t",
73 "nat",
74 "-F",
75 "natctrl_nat_POSTROUTING"
76 };
77 if (runCmd(ARRAY_SIZE(cmd2), cmd2))
78 return -1;
79
80 const char *cmd3[] = {
81 IP_PATH,
82 "rule",
83 "flush"
84 };
85 runCmd(ARRAY_SIZE(cmd3), cmd3);
86
87 const char *cmd4[] = {
88 IP_PATH,
89 "-6",
90 "rule",
91 "flush"
92 };
93 runCmd(ARRAY_SIZE(cmd4), cmd4);
94
95 const char *cmd5[] = {
96 IP_PATH,
97 "rule",
98 "add",
99 "from",
100 "all",
101 "lookup",
102 "default",
103 "prio",
104 "32767"
105 };
106 runCmd(ARRAY_SIZE(cmd5), cmd5);
107
108 const char *cmd6[] = {
109 IP_PATH,
110 "rule",
111 "add",
112 "from",
113 "all",
114 "lookup",
115 "main",
116 "prio",
117 "32766"
118 };
119 runCmd(ARRAY_SIZE(cmd6), cmd6);
120
121 const char *cmd7[] = {
122 IP_PATH,
123 "-6",
124 "rule",
125 "add",
126 "from",
127 "all",
128 "lookup",
129 "default",
130 "prio",
131 "32767"
132 };
133 runCmd(ARRAY_SIZE(cmd7), cmd7);
134
135 const char *cmd8[] = {
136 IP_PATH,
137 "-6",
138 "rule",
139 "add",
140 "from",
141 "all",
142 "lookup",
143 "main",
144 "prio",
145 "32766"
146 };
147 runCmd(ARRAY_SIZE(cmd8), cmd8);
148
149 const char *cmd9[] = {
150 IP_PATH,
151 "route",
152 "flush",
153 "cache"
154 };
155 runCmd(ARRAY_SIZE(cmd9), cmd9);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700156
157 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600158
San Mehat9ff78fb2010-01-19 12:59:15 -0800159 return 0;
160}
161
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700162bool NatController::checkInterface(const char *iface) {
Jaime A Lopez-Sollanod14fd4f2012-01-11 16:29:28 -0800163 if (strlen(iface) > IFNAMSIZ) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -0800164 return true;
165}
166
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700167// 0 1 2 3 4 5
168// nat enable intface extface addrcnt nated-ipaddr/prelength
169int NatController::enableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700170 int i;
171 int addrCount = atoi(argv[4]);
172 int ret = 0;
173 const char *intIface = argv[2];
174 const char *extIface = argv[3];
175 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -0800176
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700177 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000178 ALOGE("Invalid interface specified");
San Mehat9ff78fb2010-01-19 12:59:15 -0800179 errno = ENODEV;
180 return -1;
181 }
182
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700183 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000184 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700185 errno = EINVAL;
186 return -1;
187 }
188
189 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
190 if (tableNumber != -1) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800191 for(i = 0; i < addrCount; i++) {
192 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700193
Robert Greenwaltc4621772012-01-31 12:46:45 -0800194 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700195 }
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800196 const char *cmd[] = {
197 IP_PATH,
198 "route",
199 "flush",
200 "cache"
201 };
202 runCmd(ARRAY_SIZE(cmd), cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700203 }
204
205 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
206 if (tableNumber != -1) {
207 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800208 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700209
Robert Greenwaltc4621772012-01-31 12:46:45 -0800210 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700211 }
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800212 const char *cmd[] = {
213 IP_PATH,
214 "route",
215 "flush",
216 "cache"
217 };
218 runCmd(ARRAY_SIZE(cmd), cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700219 }
Steve Block5ea0c052012-01-06 19:18:11 +0000220 ALOGE("Error setting forward rules");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700221 errno = ENODEV;
222 return -1;
223 }
224
JP Abgrall0031cea2012-04-17 16:38:23 -0700225 /* Always make sure the drop rule is at the end */
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800226 const char *cmd1[] = {
227 IPTABLES_PATH,
228 "-D",
229 "natctrl_FORWARD",
230 "-j",
231 "DROP"
232 };
233 runCmd(ARRAY_SIZE(cmd1), cmd1);
234 const char *cmd2[] = {
235 IPTABLES_PATH,
236 "-A",
237 "natctrl_FORWARD",
238 "-j",
239 "DROP"
240 };
241 runCmd(ARRAY_SIZE(cmd2), cmd2);
JP Abgrall0031cea2012-04-17 16:38:23 -0700242
243
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700244 natCount++;
245 // add this if we are the first added nat
246 if (natCount == 1) {
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800247 const char *cmd[] = {
248 IPTABLES_PATH,
249 "-t",
250 "nat",
251 "-A",
252 "natctrl_nat_POSTROUTING",
253 "-o",
254 extIface,
255 "-j",
256 "MASQUERADE"
257 };
258 if (runCmd(ARRAY_SIZE(cmd), cmd)) {
259 ALOGE("Error seting postroute rule: iface=%s", extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700260 // unwind what's been done, but don't care about success - what more could we do?
261 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800262 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
263
264 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700265 }
266 setDefaults();
267 return -1;
268 }
269 }
270
271 return 0;
272}
273
274int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800275 const char *cmd1[] = {
276 IPTABLES_PATH,
277 add ? "-A" : "-D",
278 "natctrl_FORWARD",
279 "-i",
280 extIface,
281 "-o",
282 intIface,
283 "-m",
284 "state",
285 "--state",
286 "ESTABLISHED,RELATED",
287 "-j",
288 "RETURN"
289 };
290 int rc = 0;
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700291
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800292 if (runCmd(ARRAY_SIZE(cmd1), cmd1) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800293 return -1;
294 }
295
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800296 const char *cmd2[] = {
297 IPTABLES_PATH,
298 add ? "-A" : "-D",
299 "natctrl_FORWARD",
300 "-i",
301 intIface,
302 "-o",
303 extIface,
304 "-m",
305 "state",
306 "--state",
307 "INVALID",
308 "-j",
309 "DROP"
310 };
311
312 const char *cmd3[] = {
313 IPTABLES_PATH,
314 add ? "-A" : "-D",
315 "natctrl_FORWARD",
316 "-i",
317 intIface,
318 "-o",
319 extIface,
320 "-j",
321 "RETURN"
322 };
323
324 if (runCmd(ARRAY_SIZE(cmd2), cmd2) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700325 // bail on error, but only if adding
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800326 rc = -1;
327 goto err_invalid_drop;
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700328 }
329
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800330 if (runCmd(ARRAY_SIZE(cmd3), cmd3) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700331 // unwind what's been done, but don't care about success - what more could we do?
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800332 rc = -1;
333 goto err_return;
San Mehat9ff78fb2010-01-19 12:59:15 -0800334 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700335
San Mehat9ff78fb2010-01-19 12:59:15 -0800336 return 0;
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800337
338err_return:
339 cmd2[1] = "-D";
340 runCmd(ARRAY_SIZE(cmd2), cmd2);
341err_invalid_drop:
342 cmd1[1] = "-D";
343 runCmd(ARRAY_SIZE(cmd1), cmd1);
344 return rc;
San Mehat9ff78fb2010-01-19 12:59:15 -0800345}
346
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700347// nat disable intface extface
348// 0 1 2 3 4 5
349// nat enable intface extface addrcnt nated-ipaddr/prelength
350int NatController::disableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700351 int i;
352 int addrCount = atoi(argv[4]);
353 const char *intIface = argv[2];
354 const char *extIface = argv[3];
355 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700356
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700357 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000358 ALOGE("Invalid interface specified");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700359 errno = ENODEV;
360 return -1;
361 }
362
363 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000364 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700365 errno = EINVAL;
366 return -1;
367 }
368
369 setForwardRules(false, intIface, extIface);
370
371 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
372 if (tableNumber != -1) {
373 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800374 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwalt063af322011-11-18 15:32:13 -0800375
Robert Greenwaltc4621772012-01-31 12:46:45 -0800376 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700377 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800378
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800379 const char *cmd[] = {
380 IP_PATH,
381 "route",
382 "flush",
383 "cache"
384 };
385 runCmd(ARRAY_SIZE(cmd), cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700386 }
387
388 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600389 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
390 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700391 }
392 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800393}