San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 17 | #define LOG_NDEBUG 0 |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 18 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 19 | #include <stdlib.h> |
| 20 | #include <errno.h> |
| 21 | #include <sys/socket.h> |
| 22 | #include <sys/stat.h> |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 23 | #include <sys/wait.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 24 | #include <fcntl.h> |
| 25 | #include <netinet/in.h> |
| 26 | #include <arpa/inet.h> |
Olivier Bailly | ff2c0d8 | 2010-11-17 11:45:07 -0800 | [diff] [blame] | 27 | #include <string.h> |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 28 | #include <cutils/properties.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 29 | |
| 30 | #define LOG_TAG "NatController" |
| 31 | #include <cutils/log.h> |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 32 | #include <logwrap/logwrap.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 33 | |
| 34 | #include "NatController.h" |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 35 | #include "NetworkController.h" |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 36 | #include "NetdConstants.h" |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 37 | |
Jeff Sharkey | 8e188ed | 2012-07-12 18:32:03 -0700 | [diff] [blame] | 38 | const char* NatController::LOCAL_FORWARD = "natctrl_FORWARD"; |
| 39 | const char* NatController::LOCAL_NAT_POSTROUTING = "natctrl_nat_POSTROUTING"; |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 40 | const char* NatController::LOCAL_TETHER_COUNTERS_CHAIN = "natctrl_tether_counters"; |
Jeff Sharkey | 8e188ed | 2012-07-12 18:32:03 -0700 | [diff] [blame] | 41 | |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 42 | NatController::NatController(NetworkController* net_ctrl) : mNetCtrl(net_ctrl) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 43 | } |
| 44 | |
| 45 | NatController::~NatController() { |
| 46 | } |
| 47 | |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 48 | struct CommandsAndArgs { |
| 49 | /* The array size doesn't really matter as the compiler will barf if too many initializers are specified. */ |
| 50 | const char *cmd[32]; |
| 51 | bool checkRes; |
| 52 | }; |
| 53 | |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 54 | int NatController::runCmd(int argc, const char **argv) { |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 55 | int res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 56 | |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 57 | res = android_fork_execvp(argc, (char **)argv, NULL, false, false); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 58 | |
| 59 | #if !LOG_NDEBUG |
| 60 | std::string full_cmd = argv[0]; |
| 61 | argc--; argv++; |
| 62 | /* |
| 63 | * HACK: Sometimes runCmd() is called with a ridcously large value (32) |
| 64 | * and it works because the argv[] contains a NULL after the last |
| 65 | * true argv. So here we use the NULL argv[] to terminate when the argc |
| 66 | * is horribly wrong, and argc for the normal cases. |
| 67 | */ |
| 68 | for (; argc && argv[0]; argc--, argv++) { |
| 69 | full_cmd += " "; |
| 70 | full_cmd += argv[0]; |
| 71 | } |
| 72 | ALOGV("runCmd(%s) res=%d", full_cmd.c_str(), res); |
| 73 | #endif |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 74 | return res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 75 | } |
| 76 | |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 77 | int NatController::setupIptablesHooks() { |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 78 | int res; |
| 79 | res = setDefaults(); |
| 80 | if (res < 0) { |
| 81 | return res; |
| 82 | } |
| 83 | |
| 84 | struct CommandsAndArgs defaultCommands[] = { |
| 85 | /* |
| 86 | * Chain for tethering counters. |
| 87 | * This chain is reached via --goto, and then RETURNS. |
| 88 | */ |
| 89 | {{IPTABLES_PATH, "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, |
| 90 | {{IPTABLES_PATH, "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, |
| 91 | {{IPTABLES_PATH, "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1}, |
| 92 | }; |
| 93 | for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) { |
| 94 | if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) && |
| 95 | defaultCommands[cmdNum].checkRes) { |
| 96 | return -1; |
| 97 | } |
| 98 | } |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 99 | ifacePairList.clear(); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 100 | |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 101 | return 0; |
| 102 | } |
| 103 | |
| 104 | int NatController::setDefaults() { |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 105 | /* |
| 106 | * The following only works because: |
| 107 | * - the defaultsCommands[].cmd array is padded with NULL, and |
| 108 | * - the 1st argc of runCmd() will just be the max for the CommandsAndArgs[].cmd, and |
| 109 | * - internally it will be memcopied to an array and terminated with a NULL. |
| 110 | */ |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 111 | struct CommandsAndArgs defaultCommands[] = { |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 112 | {{IPTABLES_PATH, "-F", LOCAL_FORWARD,}, 1}, |
| 113 | {{IPTABLES_PATH, "-A", LOCAL_FORWARD, "-j", "DROP"}, 1}, |
| 114 | {{IPTABLES_PATH, "-t", "nat", "-F", LOCAL_NAT_POSTROUTING}, 1}, |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 115 | {{IP_PATH, "route", "flush", "cache"}, 0}, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 116 | }; |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 117 | for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) { |
| 118 | if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) && |
| 119 | defaultCommands[cmdNum].checkRes) { |
| 120 | return -1; |
| 121 | } |
| 122 | } |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 123 | |
| 124 | natCount = 0; |
Kazuhiro Ondo | 4ab4685 | 2012-01-12 16:15:06 -0600 | [diff] [blame] | 125 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 126 | return 0; |
| 127 | } |
| 128 | |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 129 | int NatController::routesOp(bool add, const char *intIface, char **argv, int addrCount) { |
| 130 | unsigned netId = mNetCtrl->getNetworkForInterface(intIface); |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 131 | int ret = 0; |
| 132 | |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 133 | for (int i = 0; i < addrCount; i++) { |
| 134 | if (add) { |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 135 | ret |= mNetCtrl->addRoute(netId, intIface, argv[5+i], NULL, false, INVALID_UID); |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 136 | } else { |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 137 | ret |= mNetCtrl->addRoute(netId, intIface, argv[5+i], NULL, false, INVALID_UID); |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 138 | } |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 139 | } |
Szymon Jakubczak | a0efaec | 2014-02-14 17:09:43 -0500 | [diff] [blame] | 140 | const char *cmd[] = { |
| 141 | IP_PATH, |
| 142 | "route", |
| 143 | "flush", |
| 144 | "cache" |
| 145 | }; |
| 146 | runCmd(ARRAY_SIZE(cmd), cmd); |
JP Abgrall | 4ae80de | 2013-03-14 20:06:20 -0700 | [diff] [blame] | 147 | return ret; |
| 148 | } |
| 149 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 150 | // 0 1 2 3 4 5 |
| 151 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 152 | int NatController::enableNat(const int argc, char **argv) { |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 153 | int addrCount = atoi(argv[4]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 154 | const char *intIface = argv[2]; |
| 155 | const char *extIface = argv[3]; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 156 | |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 157 | ALOGV("enableNat(intIface=<%s>, extIface=<%s>)",intIface, extIface); |
| 158 | |
JP Abgrall | 69261cb | 2014-06-19 18:35:24 -0700 | [diff] [blame] | 159 | if (!isIfaceName(intIface) || !isIfaceName(extIface)) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 160 | errno = ENODEV; |
| 161 | return -1; |
| 162 | } |
| 163 | |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 164 | /* Bug: b/9565268. "enableNat wlan0 wlan0". For now we fail until java-land is fixed */ |
| 165 | if (!strcmp(intIface, extIface)) { |
| 166 | ALOGE("Duplicate interface specified: %s %s", intIface, extIface); |
| 167 | errno = EINVAL; |
| 168 | return -1; |
| 169 | } |
| 170 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 171 | if (argc < 5 + addrCount) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 172 | ALOGE("Missing Argument"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 173 | errno = EINVAL; |
| 174 | return -1; |
| 175 | } |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 176 | if (routesOp(true, intIface, argv, addrCount)) { |
JP Abgrall | 659692a | 2013-03-14 20:07:17 -0700 | [diff] [blame] | 177 | ALOGE("Error setting route rules"); |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 178 | routesOp(false, intIface, argv, addrCount); |
JP Abgrall | 659692a | 2013-03-14 20:07:17 -0700 | [diff] [blame] | 179 | errno = ENODEV; |
| 180 | return -1; |
| 181 | } |
| 182 | |
| 183 | // add this if we are the first added nat |
| 184 | if (natCount == 0) { |
| 185 | const char *cmd[] = { |
| 186 | IPTABLES_PATH, |
| 187 | "-t", |
| 188 | "nat", |
| 189 | "-A", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 190 | LOCAL_NAT_POSTROUTING, |
JP Abgrall | 659692a | 2013-03-14 20:07:17 -0700 | [diff] [blame] | 191 | "-o", |
| 192 | extIface, |
| 193 | "-j", |
| 194 | "MASQUERADE" |
| 195 | }; |
| 196 | if (runCmd(ARRAY_SIZE(cmd), cmd)) { |
| 197 | ALOGE("Error seting postroute rule: iface=%s", extIface); |
| 198 | // unwind what's been done, but don't care about success - what more could we do? |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 199 | routesOp(false, intIface, argv, addrCount); |
JP Abgrall | 659692a | 2013-03-14 20:07:17 -0700 | [diff] [blame] | 200 | setDefaults(); |
| 201 | return -1; |
| 202 | } |
| 203 | } |
| 204 | |
| 205 | |
| 206 | if (setForwardRules(true, intIface, extIface) != 0) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 207 | ALOGE("Error setting forward rules"); |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 208 | routesOp(false, intIface, argv, addrCount); |
JP Abgrall | 659692a | 2013-03-14 20:07:17 -0700 | [diff] [blame] | 209 | if (natCount == 0) { |
| 210 | setDefaults(); |
| 211 | } |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 212 | errno = ENODEV; |
| 213 | return -1; |
| 214 | } |
| 215 | |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 216 | /* Always make sure the drop rule is at the end */ |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 217 | const char *cmd1[] = { |
| 218 | IPTABLES_PATH, |
| 219 | "-D", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 220 | LOCAL_FORWARD, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 221 | "-j", |
| 222 | "DROP" |
| 223 | }; |
| 224 | runCmd(ARRAY_SIZE(cmd1), cmd1); |
| 225 | const char *cmd2[] = { |
| 226 | IPTABLES_PATH, |
| 227 | "-A", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 228 | LOCAL_FORWARD, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 229 | "-j", |
| 230 | "DROP" |
| 231 | }; |
| 232 | runCmd(ARRAY_SIZE(cmd2), cmd2); |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 233 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 234 | natCount++; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 235 | return 0; |
| 236 | } |
| 237 | |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 238 | bool NatController::checkTetherCountingRuleExist(const char *pair_name) { |
| 239 | std::list<std::string>::iterator it; |
| 240 | |
| 241 | for (it = ifacePairList.begin(); it != ifacePairList.end(); it++) { |
| 242 | if (*it == pair_name) { |
| 243 | /* We already have this counter */ |
| 244 | return true; |
| 245 | } |
| 246 | } |
| 247 | return false; |
| 248 | } |
| 249 | |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 250 | int NatController::setTetherCountingRules(bool add, const char *intIface, const char *extIface) { |
| 251 | |
| 252 | /* We only ever add tethering quota rules so that they stick. */ |
| 253 | if (!add) { |
| 254 | return 0; |
| 255 | } |
Sreeram Ramachandran | 56afacf | 2014-05-28 15:07:00 -0700 | [diff] [blame] | 256 | char *pair_name; |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 257 | asprintf(&pair_name, "%s_%s", intIface, extIface); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 258 | |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 259 | if (checkTetherCountingRuleExist(pair_name)) { |
| 260 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 261 | return 0; |
| 262 | } |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 263 | const char *cmd2b[] = { |
| 264 | IPTABLES_PATH, |
| 265 | "-A", |
| 266 | LOCAL_TETHER_COUNTERS_CHAIN, |
| 267 | "-i", |
| 268 | intIface, |
| 269 | "-o", |
| 270 | extIface, |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 271 | "-j", |
| 272 | "RETURN" |
| 273 | }; |
| 274 | |
| 275 | if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) && add) { |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 276 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 277 | return -1; |
| 278 | } |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 279 | ifacePairList.push_front(pair_name); |
| 280 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 281 | |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 282 | asprintf(&pair_name, "%s_%s", extIface, intIface); |
| 283 | if (checkTetherCountingRuleExist(pair_name)) { |
| 284 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 285 | return 0; |
| 286 | } |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 287 | |
| 288 | const char *cmd3b[] = { |
| 289 | IPTABLES_PATH, |
| 290 | "-A", |
| 291 | LOCAL_TETHER_COUNTERS_CHAIN, |
| 292 | "-i", |
| 293 | extIface, |
| 294 | "-o", |
| 295 | intIface, |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 296 | "-j", |
| 297 | "RETURN" |
| 298 | }; |
| 299 | |
| 300 | if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) && add) { |
| 301 | // unwind what's been done, but don't care about success - what more could we do? |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 302 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 303 | return -1; |
| 304 | } |
JP Abgrall | f3cc83f | 2013-09-11 20:01:59 -0700 | [diff] [blame] | 305 | ifacePairList.push_front(pair_name); |
| 306 | free(pair_name); |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 307 | return 0; |
| 308 | } |
| 309 | |
| 310 | int NatController::setForwardRules(bool add, const char *intIface, const char *extIface) { |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 311 | const char *cmd1[] = { |
| 312 | IPTABLES_PATH, |
| 313 | add ? "-A" : "-D", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 314 | LOCAL_FORWARD, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 315 | "-i", |
| 316 | extIface, |
| 317 | "-o", |
| 318 | intIface, |
| 319 | "-m", |
| 320 | "state", |
| 321 | "--state", |
| 322 | "ESTABLISHED,RELATED", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 323 | "-g", |
| 324 | LOCAL_TETHER_COUNTERS_CHAIN |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 325 | }; |
| 326 | int rc = 0; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 327 | |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 328 | if (runCmd(ARRAY_SIZE(cmd1), cmd1) && add) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 329 | return -1; |
| 330 | } |
| 331 | |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 332 | const char *cmd2[] = { |
| 333 | IPTABLES_PATH, |
| 334 | add ? "-A" : "-D", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 335 | LOCAL_FORWARD, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 336 | "-i", |
| 337 | intIface, |
| 338 | "-o", |
| 339 | extIface, |
| 340 | "-m", |
| 341 | "state", |
| 342 | "--state", |
| 343 | "INVALID", |
| 344 | "-j", |
| 345 | "DROP" |
| 346 | }; |
| 347 | |
| 348 | const char *cmd3[] = { |
| 349 | IPTABLES_PATH, |
| 350 | add ? "-A" : "-D", |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 351 | LOCAL_FORWARD, |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 352 | "-i", |
| 353 | intIface, |
| 354 | "-o", |
| 355 | extIface, |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 356 | "-g", |
| 357 | LOCAL_TETHER_COUNTERS_CHAIN |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 358 | }; |
| 359 | |
| 360 | if (runCmd(ARRAY_SIZE(cmd2), cmd2) && add) { |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame] | 361 | // bail on error, but only if adding |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 362 | rc = -1; |
| 363 | goto err_invalid_drop; |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 364 | } |
| 365 | |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 366 | if (runCmd(ARRAY_SIZE(cmd3), cmd3) && add) { |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 367 | // unwind what's been done, but don't care about success - what more could we do? |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 368 | rc = -1; |
| 369 | goto err_return; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 370 | } |
JP Abgrall | 0031cea | 2012-04-17 16:38:23 -0700 | [diff] [blame] | 371 | |
JP Abgrall | baeccc4 | 2013-06-25 09:44:10 -0700 | [diff] [blame] | 372 | if (setTetherCountingRules(add, intIface, extIface) && add) { |
| 373 | rc = -1; |
| 374 | goto err_return; |
| 375 | } |
| 376 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 377 | return 0; |
Rom Lemarchand | 001f0a4 | 2013-01-31 12:41:03 -0800 | [diff] [blame] | 378 | |
| 379 | err_return: |
| 380 | cmd2[1] = "-D"; |
| 381 | runCmd(ARRAY_SIZE(cmd2), cmd2); |
| 382 | err_invalid_drop: |
| 383 | cmd1[1] = "-D"; |
| 384 | runCmd(ARRAY_SIZE(cmd1), cmd1); |
| 385 | return rc; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 386 | } |
| 387 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 388 | // nat disable intface extface |
| 389 | // 0 1 2 3 4 5 |
| 390 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 391 | int NatController::disableNat(const int argc, char **argv) { |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 392 | int addrCount = atoi(argv[4]); |
| 393 | const char *intIface = argv[2]; |
| 394 | const char *extIface = argv[3]; |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 395 | |
JP Abgrall | 69261cb | 2014-06-19 18:35:24 -0700 | [diff] [blame] | 396 | if (!isIfaceName(intIface) || !isIfaceName(extIface)) { |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 397 | errno = ENODEV; |
| 398 | return -1; |
| 399 | } |
| 400 | |
| 401 | if (argc < 5 + addrCount) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 402 | ALOGE("Missing Argument"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 403 | errno = EINVAL; |
| 404 | return -1; |
| 405 | } |
| 406 | |
| 407 | setForwardRules(false, intIface, extIface); |
Sreeram Ramachandran | 6a77353 | 2014-07-11 09:10:20 -0700 | [diff] [blame] | 408 | routesOp(false, intIface, argv, addrCount); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 409 | if (--natCount <= 0) { |
Kazuhiro Ondo | 4ab4685 | 2012-01-12 16:15:06 -0600 | [diff] [blame] | 410 | // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0 |
| 411 | setDefaults(); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 412 | } |
| 413 | return 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 414 | } |