blob: 7f1bc60101d6260832feb62f217ead507843b678 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <stdlib.h>
18#include <errno.h>
19#include <sys/socket.h>
20#include <sys/stat.h>
21#include <fcntl.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080024#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050025#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080026
27#define LOG_TAG "NatController"
28#include <cutils/log.h>
29
30#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070031#include "SecondaryTableController.h"
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -060032#include "oem_iptables_hook.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080033
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080034extern "C" int system_nosh(const char *command);
San Mehat9ff78fb2010-01-19 12:59:15 -080035
36static char IPTABLES_PATH[] = "/system/bin/iptables";
Robert Greenwaltfc97b822011-11-02 16:48:36 -070037static char IP_PATH[] = "/system/bin/ip";
San Mehat9ff78fb2010-01-19 12:59:15 -080038
Robert Greenwaltfc97b822011-11-02 16:48:36 -070039NatController::NatController(SecondaryTableController *ctrl) {
40 secondaryTableCtrl = ctrl;
41 setDefaults();
San Mehat9ff78fb2010-01-19 12:59:15 -080042}
43
44NatController::~NatController() {
45}
46
Robert Greenwaltfc97b822011-11-02 16:48:36 -070047int NatController::runCmd(const char *path, const char *cmd) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070048 char *buffer;
49 size_t len = strnlen(cmd, 255);
50 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080051
JP Abgrall11b4e9b2011-08-11 15:34:49 -070052 if (len == 255) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -070053 LOGE("command too long");
JP Abgrall11b4e9b2011-08-11 15:34:49 -070054 errno = E2BIG;
55 return -1;
San Mehat9ff78fb2010-01-19 12:59:15 -080056 }
San Mehat9ff78fb2010-01-19 12:59:15 -080057
Robert Greenwaltfc97b822011-11-02 16:48:36 -070058 asprintf(&buffer, "%s %s", path, cmd);
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080059 res = system_nosh(buffer);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070060 free(buffer);
61 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080062}
63
64int NatController::setDefaults() {
65
Robert Greenwaltfc97b822011-11-02 16:48:36 -070066 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080067 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070068 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080069 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070070 if (runCmd(IPTABLES_PATH, "-P FORWARD DROP"))
San Mehat9ff78fb2010-01-19 12:59:15 -080071 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070072 if (runCmd(IPTABLES_PATH, "-F FORWARD"))
San Mehat9ff78fb2010-01-19 12:59:15 -080073 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070074 if (runCmd(IPTABLES_PATH, "-t nat -F"))
San Mehat9ff78fb2010-01-19 12:59:15 -080075 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070076
77 runCmd(IP_PATH, "rule flush");
Robert Greenwalt063af322011-11-18 15:32:13 -080078 runCmd(IP_PATH, "-6 rule flush");
Robert Greenwaltfc97b822011-11-02 16:48:36 -070079 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
80 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
Robert Greenwalt063af322011-11-18 15:32:13 -080081 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
82 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
83 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -070084
85 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -060086
87 setupOemIptablesHook();
San Mehat9ff78fb2010-01-19 12:59:15 -080088 return 0;
89}
90
Robert Greenwaltfc97b822011-11-02 16:48:36 -070091bool NatController::checkInterface(const char *iface) {
92 if (strlen(iface) > MAX_IFACE_LENGTH) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -080093 return true;
94}
95
Robert Greenwalt063af322011-11-18 15:32:13 -080096const char *NatController::getVersion(const char *addr) {
97 if (strchr(addr, ':') != NULL) {
98 return "-6";
99 } else {
100 return "-4";
101 }
102}
103
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700104// 0 1 2 3 4 5
105// nat enable intface extface addrcnt nated-ipaddr/prelength
106int NatController::enableNat(const int argc, char **argv) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800107 char cmd[255];
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700108 int i;
109 int addrCount = atoi(argv[4]);
110 int ret = 0;
111 const char *intIface = argv[2];
112 const char *extIface = argv[3];
113 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -0800114
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700115 if (!checkInterface(intIface) || !checkInterface(extIface)) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800116 LOGE("Invalid interface specified");
117 errno = ENODEV;
118 return -1;
119 }
120
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700121 if (argc < 5 + addrCount) {
122 LOGE("Missing Argument");
123 errno = EINVAL;
124 return -1;
125 }
126
127 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
128 if (tableNumber != -1) {
129 for(i = 0; i < addrCount && ret == 0; i++) {
Robert Greenwalt063af322011-11-18 15:32:13 -0800130 snprintf(cmd, sizeof(cmd), "%s rule add from %s table %d", getVersion(argv[5+i]),
131 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700132 ret |= runCmd(IP_PATH, cmd);
133 if (ret) LOGE("IP rule %s got %d", cmd, ret);
134
135 snprintf(cmd, sizeof(cmd), "route add %s dev %s table %d", argv[5+i], intIface,
136 tableNumber + BASE_TABLE_NUMBER);
137 ret |= runCmd(IP_PATH, cmd);
138 if (ret) LOGE("IP route %s got %d", cmd, ret);
139 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800140 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700141 }
142
143 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
144 if (tableNumber != -1) {
145 for (i = 0; i < addrCount; i++) {
146 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
147 tableNumber + BASE_TABLE_NUMBER);
148 runCmd(IP_PATH, cmd);
149
Robert Greenwalt063af322011-11-18 15:32:13 -0800150 snprintf(cmd, sizeof(cmd), "%s rule del from %s table %d", getVersion(argv[5+i]),
151 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700152 runCmd(IP_PATH, cmd);
153 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800154 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700155 }
156 LOGE("Error setting forward rules");
157 errno = ENODEV;
158 return -1;
159 }
160
161 natCount++;
162 // add this if we are the first added nat
163 if (natCount == 1) {
164 snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface);
165 if (runCmd(IPTABLES_PATH, cmd)) {
166 LOGE("Error seting postroute rule: %s", cmd);
167 // unwind what's been done, but don't care about success - what more could we do?
168 for (i = 0; i < addrCount; i++) {
169 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
170 tableNumber + BASE_TABLE_NUMBER);
171 runCmd(IP_PATH, cmd);
172 }
173 setDefaults();
174 return -1;
175 }
176 }
177
178 return 0;
179}
180
181int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
182 char cmd[255];
183
San Mehat9ff78fb2010-01-19 12:59:15 -0800184 snprintf(cmd, sizeof(cmd),
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700185 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
186 (add ? "A" : "D"),
San Mehat9ff78fb2010-01-19 12:59:15 -0800187 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700188 if (runCmd(IPTABLES_PATH, cmd) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800189 return -1;
190 }
191
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700192 snprintf(cmd, sizeof(cmd),
193 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
194 (add ? "A" : "D"),
195 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700196 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700197 // bail on error, but only if adding
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700198 snprintf(cmd, sizeof(cmd),
199 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
200 (!add ? "A" : "D"),
201 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700202 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700203 return -1;
204 }
205
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700206 snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
207 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700208 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700209 // unwind what's been done, but don't care about success - what more could we do?
210 snprintf(cmd, sizeof(cmd),
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700211 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
212 (!add ? "A" : "D"),
213 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700214 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700215
216 snprintf(cmd, sizeof(cmd),
Robert Greenwalt210b9772010-03-25 14:54:45 -0700217 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
218 (!add ? "A" : "D"),
219 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700220 runCmd(IPTABLES_PATH, cmd);
San Mehat9ff78fb2010-01-19 12:59:15 -0800221 return -1;
222 }
San Mehat9ff78fb2010-01-19 12:59:15 -0800223 return 0;
224}
225
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700226// nat disable intface extface
227// 0 1 2 3 4 5
228// nat enable intface extface addrcnt nated-ipaddr/prelength
229int NatController::disableNat(const int argc, char **argv) {
230 char cmd[255];
231 int i;
232 int addrCount = atoi(argv[4]);
233 const char *intIface = argv[2];
234 const char *extIface = argv[3];
235 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700236
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700237 if (!checkInterface(intIface) || !checkInterface(extIface)) {
238 LOGE("Invalid interface specified");
239 errno = ENODEV;
240 return -1;
241 }
242
243 if (argc < 5 + addrCount) {
244 LOGE("Missing Argument");
245 errno = EINVAL;
246 return -1;
247 }
248
249 setForwardRules(false, intIface, extIface);
250
251 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
252 if (tableNumber != -1) {
253 for (i = 0; i < addrCount; i++) {
254 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
255 tableNumber + BASE_TABLE_NUMBER);
256 // if the interface has gone down these will be gone already and give errors
257 // ignore them.
258 runCmd(IP_PATH, cmd);
Robert Greenwalt063af322011-11-18 15:32:13 -0800259
260 snprintf(cmd, sizeof(cmd), "%s rule del from %s table %d", getVersion(argv[5+i]),
261 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
262 runCmd(IP_PATH, cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700263 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800264
265 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700266 }
267
268 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600269 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
270 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700271 }
272 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800273}