blob: db96ed38f5bc44a7d539177fe261b8e483da5e39 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrall0031cea2012-04-17 16:38:23 -070017// #define LOG_NDEBUG 0
18
San Mehat9ff78fb2010-01-19 12:59:15 -080019#include <stdlib.h>
20#include <errno.h>
21#include <sys/socket.h>
22#include <sys/stat.h>
23#include <fcntl.h>
24#include <netinet/in.h>
25#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080026#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050027#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080028
29#define LOG_TAG "NatController"
30#include <cutils/log.h>
31
32#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070033#include "SecondaryTableController.h"
Robert Greenwaltc4621772012-01-31 12:46:45 -080034#include "NetdConstants.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080035
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080036extern "C" int system_nosh(const char *command);
San Mehat9ff78fb2010-01-19 12:59:15 -080037
Robert Greenwaltfc97b822011-11-02 16:48:36 -070038NatController::NatController(SecondaryTableController *ctrl) {
39 secondaryTableCtrl = ctrl;
JP Abgrall0031cea2012-04-17 16:38:23 -070040
41 setupIptablesHooks();
Robert Greenwaltfc97b822011-11-02 16:48:36 -070042 setDefaults();
San Mehat9ff78fb2010-01-19 12:59:15 -080043}
44
45NatController::~NatController() {
46}
47
Robert Greenwaltfc97b822011-11-02 16:48:36 -070048int NatController::runCmd(const char *path, const char *cmd) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070049 char *buffer;
50 size_t len = strnlen(cmd, 255);
51 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080052
JP Abgrall11b4e9b2011-08-11 15:34:49 -070053 if (len == 255) {
Steve Block5ea0c052012-01-06 19:18:11 +000054 ALOGE("command too long");
JP Abgrall11b4e9b2011-08-11 15:34:49 -070055 errno = E2BIG;
56 return -1;
San Mehat9ff78fb2010-01-19 12:59:15 -080057 }
San Mehat9ff78fb2010-01-19 12:59:15 -080058
Robert Greenwaltfc97b822011-11-02 16:48:36 -070059 asprintf(&buffer, "%s %s", path, cmd);
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080060 res = system_nosh(buffer);
JP Abgrall0031cea2012-04-17 16:38:23 -070061 ALOGV("runCmd() buffer='%s' res=%d", buffer, res);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070062 free(buffer);
63 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080064}
65
JP Abgrall0031cea2012-04-17 16:38:23 -070066int NatController::setupIptablesHooks() {
Robert Greenwaltfc97b822011-11-02 16:48:36 -070067 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080068 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070069 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080070 return -1;
JP Abgrall0031cea2012-04-17 16:38:23 -070071 if (runCmd(IPTABLES_PATH, "-P FORWARD ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080072 return -1;
JP Abgrall0031cea2012-04-17 16:38:23 -070073
74 // Order is important!
75 // -D to delete any pre-existing jump rule, to prevent dupes (no-op if doesn't exist)
76 // -F to flush the chain (no-op if doesn't exist).
77 // -N to create the chain (no-op if already exist).
78
79 runCmd(IPTABLES_PATH, "-D FORWARD -j natctrl_FORWARD");
80 runCmd(IPTABLES_PATH, "-F natctrl_FORWARD");
81 runCmd(IPTABLES_PATH, "-N natctrl_FORWARD");
82 if (runCmd(IPTABLES_PATH, "-A FORWARD -j natctrl_FORWARD"))
San Mehat9ff78fb2010-01-19 12:59:15 -080083 return -1;
JP Abgrall0031cea2012-04-17 16:38:23 -070084
85 runCmd(IPTABLES_PATH, "-t nat -D POSTROUTING -j natctrl_nat_POSTROUTING");
86 runCmd(IPTABLES_PATH, "-t nat -F natctrl_nat_POSTROUTING");
87 runCmd(IPTABLES_PATH, "-t nat -N natctrl_nat_POSTROUTING");
88 if (runCmd(IPTABLES_PATH, "-t nat -A POSTROUTING -j natctrl_nat_POSTROUTING"))
89 return -1;
90
91 return 0;
92}
93
94int NatController::setDefaults() {
95 if (runCmd(IPTABLES_PATH, "-F natctrl_FORWARD"))
96 return -1;
97 if (runCmd(IPTABLES_PATH, "-t nat -F natctrl_nat_POSTROUTING"))
San Mehat9ff78fb2010-01-19 12:59:15 -080098 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070099
100 runCmd(IP_PATH, "rule flush");
Robert Greenwalt063af322011-11-18 15:32:13 -0800101 runCmd(IP_PATH, "-6 rule flush");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700102 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
103 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
Robert Greenwalt063af322011-11-18 15:32:13 -0800104 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
105 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
106 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700107
108 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600109
San Mehat9ff78fb2010-01-19 12:59:15 -0800110 return 0;
111}
112
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700113bool NatController::checkInterface(const char *iface) {
Jaime A Lopez-Sollanod14fd4f2012-01-11 16:29:28 -0800114 if (strlen(iface) > IFNAMSIZ) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -0800115 return true;
116}
117
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700118// 0 1 2 3 4 5
119// nat enable intface extface addrcnt nated-ipaddr/prelength
120int NatController::enableNat(const int argc, char **argv) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800121 char cmd[255];
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700122 int i;
123 int addrCount = atoi(argv[4]);
124 int ret = 0;
125 const char *intIface = argv[2];
126 const char *extIface = argv[3];
127 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -0800128
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700129 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000130 ALOGE("Invalid interface specified");
San Mehat9ff78fb2010-01-19 12:59:15 -0800131 errno = ENODEV;
132 return -1;
133 }
134
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700135 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000136 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700137 errno = EINVAL;
138 return -1;
139 }
140
141 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
142 if (tableNumber != -1) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800143 for(i = 0; i < addrCount; i++) {
144 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700145
Robert Greenwaltc4621772012-01-31 12:46:45 -0800146 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700147 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800148 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700149 }
150
151 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
152 if (tableNumber != -1) {
153 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800154 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700155
Robert Greenwaltc4621772012-01-31 12:46:45 -0800156 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700157 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800158 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700159 }
Steve Block5ea0c052012-01-06 19:18:11 +0000160 ALOGE("Error setting forward rules");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700161 errno = ENODEV;
162 return -1;
163 }
164
JP Abgrall0031cea2012-04-17 16:38:23 -0700165 /* Always make sure the drop rule is at the end */
166 snprintf(cmd, sizeof(cmd), "-D natctrl_FORWARD -j DROP");
167 runCmd(IPTABLES_PATH, cmd);
168 snprintf(cmd, sizeof(cmd), "-A natctrl_FORWARD -j DROP");
169 runCmd(IPTABLES_PATH, cmd);
170
171
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700172 natCount++;
173 // add this if we are the first added nat
174 if (natCount == 1) {
JP Abgrall0031cea2012-04-17 16:38:23 -0700175 snprintf(cmd, sizeof(cmd), "-t nat -A natctrl_nat_POSTROUTING -o %s -j MASQUERADE", extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700176 if (runCmd(IPTABLES_PATH, cmd)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000177 ALOGE("Error seting postroute rule: %s", cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700178 // unwind what's been done, but don't care about success - what more could we do?
179 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800180 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
181
182 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700183 }
184 setDefaults();
185 return -1;
186 }
187 }
188
189 return 0;
190}
191
192int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
193 char cmd[255];
194
San Mehat9ff78fb2010-01-19 12:59:15 -0800195 snprintf(cmd, sizeof(cmd),
JP Abgrall0031cea2012-04-17 16:38:23 -0700196 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700197 (add ? "A" : "D"),
San Mehat9ff78fb2010-01-19 12:59:15 -0800198 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700199 if (runCmd(IPTABLES_PATH, cmd) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800200 return -1;
201 }
202
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700203 snprintf(cmd, sizeof(cmd),
JP Abgrall0031cea2012-04-17 16:38:23 -0700204 "-%s natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700205 (add ? "A" : "D"),
206 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700207 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700208 // bail on error, but only if adding
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700209 snprintf(cmd, sizeof(cmd),
JP Abgrall0031cea2012-04-17 16:38:23 -0700210 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700211 (!add ? "A" : "D"),
212 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700213 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700214 return -1;
215 }
216
JP Abgrall0031cea2012-04-17 16:38:23 -0700217 snprintf(cmd, sizeof(cmd), "-%s natctrl_FORWARD -i %s -o %s -j RETURN", (add ? "A" : "D"),
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700218 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700219 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700220 // unwind what's been done, but don't care about success - what more could we do?
221 snprintf(cmd, sizeof(cmd),
JP Abgrall0031cea2012-04-17 16:38:23 -0700222 "-%s natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700223 (!add ? "A" : "D"),
224 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700225 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700226
227 snprintf(cmd, sizeof(cmd),
JP Abgrall0031cea2012-04-17 16:38:23 -0700228 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
Robert Greenwalt210b9772010-03-25 14:54:45 -0700229 (!add ? "A" : "D"),
230 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700231 runCmd(IPTABLES_PATH, cmd);
San Mehat9ff78fb2010-01-19 12:59:15 -0800232 return -1;
233 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700234
235 snprintf(cmd, sizeof(cmd), "-%s natctrl_FORWARD -j DROP", (add ? "A" : "D"),
236 intIface, extIface);
237 runCmd(IPTABLES_PATH, cmd);
238
San Mehat9ff78fb2010-01-19 12:59:15 -0800239 return 0;
240}
241
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700242// nat disable intface extface
243// 0 1 2 3 4 5
244// nat enable intface extface addrcnt nated-ipaddr/prelength
245int NatController::disableNat(const int argc, char **argv) {
246 char cmd[255];
247 int i;
248 int addrCount = atoi(argv[4]);
249 const char *intIface = argv[2];
250 const char *extIface = argv[3];
251 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700252
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700253 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000254 ALOGE("Invalid interface specified");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700255 errno = ENODEV;
256 return -1;
257 }
258
259 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000260 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700261 errno = EINVAL;
262 return -1;
263 }
264
265 setForwardRules(false, intIface, extIface);
266
267 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
268 if (tableNumber != -1) {
269 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800270 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwalt063af322011-11-18 15:32:13 -0800271
Robert Greenwaltc4621772012-01-31 12:46:45 -0800272 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700273 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800274
275 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700276 }
277
278 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600279 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
280 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700281 }
282 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800283}