San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <stdlib.h> |
| 18 | #include <errno.h> |
| 19 | #include <sys/socket.h> |
| 20 | #include <sys/stat.h> |
| 21 | #include <fcntl.h> |
| 22 | #include <netinet/in.h> |
| 23 | #include <arpa/inet.h> |
| 24 | |
| 25 | #define LOG_TAG "NatController" |
| 26 | #include <cutils/log.h> |
| 27 | |
| 28 | #include "NatController.h" |
| 29 | |
| 30 | extern "C" int logwrap(int argc, const char **argv, int background); |
| 31 | |
| 32 | static char IPTABLES_PATH[] = "/system/bin/iptables"; |
| 33 | |
| 34 | NatController::NatController() { |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 35 | natCount = 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 36 | } |
| 37 | |
| 38 | NatController::~NatController() { |
| 39 | } |
| 40 | |
| 41 | int NatController::runIptablesCmd(const char *cmd) { |
| 42 | char buffer[255]; |
| 43 | |
| 44 | strncpy(buffer, cmd, sizeof(buffer)-1); |
| 45 | |
| 46 | const char *args[16]; |
| 47 | char *next = buffer; |
| 48 | char *tmp; |
| 49 | |
| 50 | args[0] = IPTABLES_PATH; |
| 51 | args[1] = "--verbose"; |
| 52 | int i = 2; |
| 53 | |
| 54 | while ((tmp = strsep(&next, " "))) { |
| 55 | args[i++] = tmp; |
| 56 | if (i == 16) { |
| 57 | LOGE("iptables argument overflow"); |
| 58 | errno = E2BIG; |
| 59 | return -1; |
| 60 | } |
| 61 | } |
| 62 | args[i] = NULL; |
| 63 | |
| 64 | return logwrap(i, args, 0); |
| 65 | } |
| 66 | |
| 67 | int NatController::setDefaults() { |
| 68 | |
| 69 | if (runIptablesCmd("-P INPUT ACCEPT")) |
| 70 | return -1; |
| 71 | if (runIptablesCmd("-F INPUT")) |
| 72 | return -1; |
| 73 | if (runIptablesCmd("-P OUTPUT ACCEPT")) |
| 74 | return -1; |
| 75 | if (runIptablesCmd("-F OUTPUT")) |
| 76 | return -1; |
| 77 | if (runIptablesCmd("-P FORWARD DROP")) |
| 78 | return -1; |
| 79 | if (runIptablesCmd("-F FORWARD")) |
| 80 | return -1; |
| 81 | if (runIptablesCmd("-t nat -F")) |
| 82 | return -1; |
| 83 | return 0; |
| 84 | } |
| 85 | |
| 86 | bool NatController::interfaceExists(const char *iface) { |
| 87 | // XXX: STOPSHIP - Implement this |
| 88 | return true; |
| 89 | } |
| 90 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 91 | int NatController::doNatCommands(const char *intIface, const char *extIface, bool add) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 92 | char cmd[255]; |
| 93 | |
| 94 | if (!interfaceExists(intIface) || !interfaceExists (extIface)) { |
| 95 | LOGE("Invalid interface specified"); |
| 96 | errno = ENODEV; |
| 97 | return -1; |
| 98 | } |
| 99 | |
| 100 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 101 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 102 | (add ? "A" : "D"), |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 103 | extIface, intIface); |
| 104 | if (runIptablesCmd(cmd)) { |
| 105 | return -1; |
| 106 | } |
| 107 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 108 | snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"), |
| 109 | intIface, extIface); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 110 | if (runIptablesCmd(cmd)) { |
| 111 | return -1; |
| 112 | } |
| 113 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 114 | if (add && natCount == 0) { |
| 115 | snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface); |
| 116 | if (runIptablesCmd(cmd)) { |
| 117 | return -1; |
| 118 | } |
| 119 | } else if (!add) { |
| 120 | snprintf(cmd, sizeof(cmd), "-t nat -D POSTROUTING -o %s -j MASQUERADE", extIface); |
| 121 | if (runIptablesCmd(cmd)) { |
| 122 | return -1; |
| 123 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 124 | } |
| 125 | |
| 126 | return 0; |
| 127 | } |
| 128 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 129 | int NatController::enableNat(const char *intIface, const char *extIface) { |
| 130 | natCount++; |
| 131 | return doNatCommands(intIface, extIface, true); |
| 132 | natCount++; |
| 133 | } |
| 134 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 135 | int NatController::disableNat(const char *intIface, const char *extIface) { |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame^] | 136 | if (natCount > 0) { |
| 137 | if (natCount == 1) { |
| 138 | return setDefaults(); |
| 139 | } else { |
| 140 | return doNatCommands(intIface, extIface, false); |
| 141 | } |
| 142 | natCount--; |
| 143 | } else { |
| 144 | LOGE("Trying to disableNat with none enabled!"); |
| 145 | return setDefaults(); |
| 146 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 147 | } |