blob: 8340b734e4827f23384d1524644058c4dc1c0159 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrallbaeccc42013-06-25 09:44:10 -070017#define LOG_NDEBUG 0
JP Abgrall0031cea2012-04-17 16:38:23 -070018
San Mehat9ff78fb2010-01-19 12:59:15 -080019#include <stdlib.h>
20#include <errno.h>
21#include <sys/socket.h>
22#include <sys/stat.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080023#include <sys/wait.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080024#include <fcntl.h>
25#include <netinet/in.h>
26#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080027#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050028#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080029
30#define LOG_TAG "NatController"
31#include <cutils/log.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080032#include <logwrap/logwrap.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080033
34#include "NatController.h"
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -050035#include "NetworkController.h"
Robert Greenwaltc4621772012-01-31 12:46:45 -080036#include "NetdConstants.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080037
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070038const char* NatController::LOCAL_FORWARD = "natctrl_FORWARD";
39const char* NatController::LOCAL_NAT_POSTROUTING = "natctrl_nat_POSTROUTING";
JP Abgrallbaeccc42013-06-25 09:44:10 -070040const char* NatController::LOCAL_TETHER_COUNTERS_CHAIN = "natctrl_tether_counters";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070041
Sreeram Ramachandran6a773532014-07-11 09:10:20 -070042NatController::NatController(NetworkController* net_ctrl) : mNetCtrl(net_ctrl) {
San Mehat9ff78fb2010-01-19 12:59:15 -080043}
44
45NatController::~NatController() {
46}
47
JP Abgrall4ae80de2013-03-14 20:06:20 -070048struct CommandsAndArgs {
49 /* The array size doesn't really matter as the compiler will barf if too many initializers are specified. */
50 const char *cmd[32];
51 bool checkRes;
52};
53
Rom Lemarchand001f0a42013-01-31 12:41:03 -080054int NatController::runCmd(int argc, const char **argv) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070055 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080056
Rom Lemarchand001f0a42013-01-31 12:41:03 -080057 res = android_fork_execvp(argc, (char **)argv, NULL, false, false);
JP Abgrallbaeccc42013-06-25 09:44:10 -070058
59#if !LOG_NDEBUG
60 std::string full_cmd = argv[0];
61 argc--; argv++;
62 /*
63 * HACK: Sometimes runCmd() is called with a ridcously large value (32)
64 * and it works because the argv[] contains a NULL after the last
65 * true argv. So here we use the NULL argv[] to terminate when the argc
66 * is horribly wrong, and argc for the normal cases.
67 */
68 for (; argc && argv[0]; argc--, argv++) {
69 full_cmd += " ";
70 full_cmd += argv[0];
71 }
72 ALOGV("runCmd(%s) res=%d", full_cmd.c_str(), res);
73#endif
JP Abgrall11b4e9b2011-08-11 15:34:49 -070074 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080075}
76
JP Abgrall0031cea2012-04-17 16:38:23 -070077int NatController::setupIptablesHooks() {
JP Abgrallbaeccc42013-06-25 09:44:10 -070078 int res;
79 res = setDefaults();
80 if (res < 0) {
81 return res;
82 }
83
84 struct CommandsAndArgs defaultCommands[] = {
85 /*
86 * Chain for tethering counters.
87 * This chain is reached via --goto, and then RETURNS.
88 */
89 {{IPTABLES_PATH, "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
90 {{IPTABLES_PATH, "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
91 {{IPTABLES_PATH, "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1},
92 };
93 for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) {
94 if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) &&
95 defaultCommands[cmdNum].checkRes) {
96 return -1;
97 }
98 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -070099 ifacePairList.clear();
JP Abgrallbaeccc42013-06-25 09:44:10 -0700100
JP Abgrall0031cea2012-04-17 16:38:23 -0700101 return 0;
102}
103
104int NatController::setDefaults() {
JP Abgrallbaeccc42013-06-25 09:44:10 -0700105 /*
106 * The following only works because:
107 * - the defaultsCommands[].cmd array is padded with NULL, and
108 * - the 1st argc of runCmd() will just be the max for the CommandsAndArgs[].cmd, and
109 * - internally it will be memcopied to an array and terminated with a NULL.
110 */
JP Abgrall4ae80de2013-03-14 20:06:20 -0700111 struct CommandsAndArgs defaultCommands[] = {
JP Abgrallbaeccc42013-06-25 09:44:10 -0700112 {{IPTABLES_PATH, "-F", LOCAL_FORWARD,}, 1},
113 {{IPTABLES_PATH, "-A", LOCAL_FORWARD, "-j", "DROP"}, 1},
114 {{IPTABLES_PATH, "-t", "nat", "-F", LOCAL_NAT_POSTROUTING}, 1},
JP Abgrall4ae80de2013-03-14 20:06:20 -0700115 {{IP_PATH, "route", "flush", "cache"}, 0},
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800116 };
JP Abgrall4ae80de2013-03-14 20:06:20 -0700117 for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) {
118 if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) &&
119 defaultCommands[cmdNum].checkRes) {
120 return -1;
121 }
122 }
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700123
124 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600125
San Mehat9ff78fb2010-01-19 12:59:15 -0800126 return 0;
127}
128
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700129int NatController::routesOp(bool add, const char *intIface, char **argv, int addrCount) {
130 unsigned netId = mNetCtrl->getNetworkForInterface(intIface);
JP Abgrall4ae80de2013-03-14 20:06:20 -0700131 int ret = 0;
132
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500133 for (int i = 0; i < addrCount; i++) {
134 if (add) {
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700135 ret |= mNetCtrl->addRoute(netId, intIface, argv[5+i], NULL, false, INVALID_UID);
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500136 } else {
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700137 ret |= mNetCtrl->addRoute(netId, intIface, argv[5+i], NULL, false, INVALID_UID);
JP Abgrall4ae80de2013-03-14 20:06:20 -0700138 }
JP Abgrall4ae80de2013-03-14 20:06:20 -0700139 }
Szymon Jakubczaka0efaec2014-02-14 17:09:43 -0500140 const char *cmd[] = {
141 IP_PATH,
142 "route",
143 "flush",
144 "cache"
145 };
146 runCmd(ARRAY_SIZE(cmd), cmd);
JP Abgrall4ae80de2013-03-14 20:06:20 -0700147 return ret;
148}
149
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700150// 0 1 2 3 4 5
151// nat enable intface extface addrcnt nated-ipaddr/prelength
152int NatController::enableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700153 int addrCount = atoi(argv[4]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700154 const char *intIface = argv[2];
155 const char *extIface = argv[3];
San Mehat9ff78fb2010-01-19 12:59:15 -0800156
JP Abgrallbaeccc42013-06-25 09:44:10 -0700157 ALOGV("enableNat(intIface=<%s>, extIface=<%s>)",intIface, extIface);
158
JP Abgrall69261cb2014-06-19 18:35:24 -0700159 if (!isIfaceName(intIface) || !isIfaceName(extIface)) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800160 errno = ENODEV;
161 return -1;
162 }
163
JP Abgrallbaeccc42013-06-25 09:44:10 -0700164 /* Bug: b/9565268. "enableNat wlan0 wlan0". For now we fail until java-land is fixed */
165 if (!strcmp(intIface, extIface)) {
166 ALOGE("Duplicate interface specified: %s %s", intIface, extIface);
167 errno = EINVAL;
168 return -1;
169 }
170
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700171 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000172 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700173 errno = EINVAL;
174 return -1;
175 }
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700176 if (routesOp(true, intIface, argv, addrCount)) {
JP Abgrall659692a2013-03-14 20:07:17 -0700177 ALOGE("Error setting route rules");
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700178 routesOp(false, intIface, argv, addrCount);
JP Abgrall659692a2013-03-14 20:07:17 -0700179 errno = ENODEV;
180 return -1;
181 }
182
183 // add this if we are the first added nat
184 if (natCount == 0) {
185 const char *cmd[] = {
186 IPTABLES_PATH,
187 "-t",
188 "nat",
189 "-A",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700190 LOCAL_NAT_POSTROUTING,
JP Abgrall659692a2013-03-14 20:07:17 -0700191 "-o",
192 extIface,
193 "-j",
194 "MASQUERADE"
195 };
196 if (runCmd(ARRAY_SIZE(cmd), cmd)) {
197 ALOGE("Error seting postroute rule: iface=%s", extIface);
198 // unwind what's been done, but don't care about success - what more could we do?
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700199 routesOp(false, intIface, argv, addrCount);
JP Abgrall659692a2013-03-14 20:07:17 -0700200 setDefaults();
201 return -1;
202 }
203 }
204
205
206 if (setForwardRules(true, intIface, extIface) != 0) {
Steve Block5ea0c052012-01-06 19:18:11 +0000207 ALOGE("Error setting forward rules");
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700208 routesOp(false, intIface, argv, addrCount);
JP Abgrall659692a2013-03-14 20:07:17 -0700209 if (natCount == 0) {
210 setDefaults();
211 }
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700212 errno = ENODEV;
213 return -1;
214 }
215
JP Abgrall0031cea2012-04-17 16:38:23 -0700216 /* Always make sure the drop rule is at the end */
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800217 const char *cmd1[] = {
218 IPTABLES_PATH,
219 "-D",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700220 LOCAL_FORWARD,
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800221 "-j",
222 "DROP"
223 };
224 runCmd(ARRAY_SIZE(cmd1), cmd1);
225 const char *cmd2[] = {
226 IPTABLES_PATH,
227 "-A",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700228 LOCAL_FORWARD,
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800229 "-j",
230 "DROP"
231 };
232 runCmd(ARRAY_SIZE(cmd2), cmd2);
JP Abgrall0031cea2012-04-17 16:38:23 -0700233
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700234 natCount++;
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700235 return 0;
236}
237
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700238bool NatController::checkTetherCountingRuleExist(const char *pair_name) {
239 std::list<std::string>::iterator it;
240
241 for (it = ifacePairList.begin(); it != ifacePairList.end(); it++) {
242 if (*it == pair_name) {
243 /* We already have this counter */
244 return true;
245 }
246 }
247 return false;
248}
249
JP Abgrallbaeccc42013-06-25 09:44:10 -0700250int NatController::setTetherCountingRules(bool add, const char *intIface, const char *extIface) {
251
252 /* We only ever add tethering quota rules so that they stick. */
253 if (!add) {
254 return 0;
255 }
Sreeram Ramachandran56afacf2014-05-28 15:07:00 -0700256 char *pair_name;
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700257 asprintf(&pair_name, "%s_%s", intIface, extIface);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700258
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700259 if (checkTetherCountingRuleExist(pair_name)) {
260 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700261 return 0;
262 }
JP Abgrallbaeccc42013-06-25 09:44:10 -0700263 const char *cmd2b[] = {
264 IPTABLES_PATH,
265 "-A",
266 LOCAL_TETHER_COUNTERS_CHAIN,
267 "-i",
268 intIface,
269 "-o",
270 extIface,
JP Abgrallbaeccc42013-06-25 09:44:10 -0700271 "-j",
272 "RETURN"
273 };
274
275 if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) && add) {
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700276 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700277 return -1;
278 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700279 ifacePairList.push_front(pair_name);
280 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700281
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700282 asprintf(&pair_name, "%s_%s", extIface, intIface);
283 if (checkTetherCountingRuleExist(pair_name)) {
284 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700285 return 0;
286 }
JP Abgrallbaeccc42013-06-25 09:44:10 -0700287
288 const char *cmd3b[] = {
289 IPTABLES_PATH,
290 "-A",
291 LOCAL_TETHER_COUNTERS_CHAIN,
292 "-i",
293 extIface,
294 "-o",
295 intIface,
JP Abgrallbaeccc42013-06-25 09:44:10 -0700296 "-j",
297 "RETURN"
298 };
299
300 if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) && add) {
301 // unwind what's been done, but don't care about success - what more could we do?
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700302 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700303 return -1;
304 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -0700305 ifacePairList.push_front(pair_name);
306 free(pair_name);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700307 return 0;
308}
309
310int NatController::setForwardRules(bool add, const char *intIface, const char *extIface) {
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800311 const char *cmd1[] = {
312 IPTABLES_PATH,
313 add ? "-A" : "-D",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700314 LOCAL_FORWARD,
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800315 "-i",
316 extIface,
317 "-o",
318 intIface,
319 "-m",
320 "state",
321 "--state",
322 "ESTABLISHED,RELATED",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700323 "-g",
324 LOCAL_TETHER_COUNTERS_CHAIN
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800325 };
326 int rc = 0;
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700327
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800328 if (runCmd(ARRAY_SIZE(cmd1), cmd1) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800329 return -1;
330 }
331
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800332 const char *cmd2[] = {
333 IPTABLES_PATH,
334 add ? "-A" : "-D",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700335 LOCAL_FORWARD,
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800336 "-i",
337 intIface,
338 "-o",
339 extIface,
340 "-m",
341 "state",
342 "--state",
343 "INVALID",
344 "-j",
345 "DROP"
346 };
347
348 const char *cmd3[] = {
349 IPTABLES_PATH,
350 add ? "-A" : "-D",
JP Abgrallbaeccc42013-06-25 09:44:10 -0700351 LOCAL_FORWARD,
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800352 "-i",
353 intIface,
354 "-o",
355 extIface,
JP Abgrallbaeccc42013-06-25 09:44:10 -0700356 "-g",
357 LOCAL_TETHER_COUNTERS_CHAIN
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800358 };
359
360 if (runCmd(ARRAY_SIZE(cmd2), cmd2) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700361 // bail on error, but only if adding
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800362 rc = -1;
363 goto err_invalid_drop;
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700364 }
365
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800366 if (runCmd(ARRAY_SIZE(cmd3), cmd3) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700367 // unwind what's been done, but don't care about success - what more could we do?
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800368 rc = -1;
369 goto err_return;
San Mehat9ff78fb2010-01-19 12:59:15 -0800370 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700371
JP Abgrallbaeccc42013-06-25 09:44:10 -0700372 if (setTetherCountingRules(add, intIface, extIface) && add) {
373 rc = -1;
374 goto err_return;
375 }
376
San Mehat9ff78fb2010-01-19 12:59:15 -0800377 return 0;
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800378
379err_return:
380 cmd2[1] = "-D";
381 runCmd(ARRAY_SIZE(cmd2), cmd2);
382err_invalid_drop:
383 cmd1[1] = "-D";
384 runCmd(ARRAY_SIZE(cmd1), cmd1);
385 return rc;
San Mehat9ff78fb2010-01-19 12:59:15 -0800386}
387
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700388// nat disable intface extface
389// 0 1 2 3 4 5
390// nat enable intface extface addrcnt nated-ipaddr/prelength
391int NatController::disableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700392 int addrCount = atoi(argv[4]);
393 const char *intIface = argv[2];
394 const char *extIface = argv[3];
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700395
JP Abgrall69261cb2014-06-19 18:35:24 -0700396 if (!isIfaceName(intIface) || !isIfaceName(extIface)) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700397 errno = ENODEV;
398 return -1;
399 }
400
401 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000402 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700403 errno = EINVAL;
404 return -1;
405 }
406
407 setForwardRules(false, intIface, extIface);
Sreeram Ramachandran6a773532014-07-11 09:10:20 -0700408 routesOp(false, intIface, argv, addrCount);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700409 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600410 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
411 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700412 }
413 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800414}