blob: 46ac01c9e4adfa3327b53b0ea91c956c7f1826e8 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrall0031cea2012-04-17 16:38:23 -070017// #define LOG_NDEBUG 0
18
San Mehat9ff78fb2010-01-19 12:59:15 -080019#include <stdlib.h>
20#include <errno.h>
21#include <sys/socket.h>
22#include <sys/stat.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080023#include <sys/wait.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080024#include <fcntl.h>
25#include <netinet/in.h>
26#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080027#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050028#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080029
30#define LOG_TAG "NatController"
31#include <cutils/log.h>
Rom Lemarchand001f0a42013-01-31 12:41:03 -080032#include <logwrap/logwrap.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080033
34#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070035#include "SecondaryTableController.h"
Robert Greenwaltc4621772012-01-31 12:46:45 -080036#include "NetdConstants.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080037
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070038const char* NatController::LOCAL_FORWARD = "natctrl_FORWARD";
39const char* NatController::LOCAL_NAT_POSTROUTING = "natctrl_nat_POSTROUTING";
40
Robert Greenwaltfc97b822011-11-02 16:48:36 -070041NatController::NatController(SecondaryTableController *ctrl) {
42 secondaryTableCtrl = ctrl;
San Mehat9ff78fb2010-01-19 12:59:15 -080043}
44
45NatController::~NatController() {
46}
47
JP Abgrall4ae80de2013-03-14 20:06:20 -070048struct CommandsAndArgs {
49 /* The array size doesn't really matter as the compiler will barf if too many initializers are specified. */
50 const char *cmd[32];
51 bool checkRes;
52};
53
Rom Lemarchand001f0a42013-01-31 12:41:03 -080054int NatController::runCmd(int argc, const char **argv) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070055 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080056
Rom Lemarchand001f0a42013-01-31 12:41:03 -080057 res = android_fork_execvp(argc, (char **)argv, NULL, false, false);
58 ALOGV("runCmd() res=%d", res);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070059 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080060}
61
JP Abgrall0031cea2012-04-17 16:38:23 -070062int NatController::setupIptablesHooks() {
JP Abgrall458f3182012-04-24 21:30:43 -070063 setDefaults();
JP Abgrall0031cea2012-04-17 16:38:23 -070064 return 0;
65}
66
67int NatController::setDefaults() {
JP Abgrall4ae80de2013-03-14 20:06:20 -070068 struct CommandsAndArgs defaultCommands[] = {
69 {{IPTABLES_PATH, "-F", "natctrl_FORWARD",}, 1},
70 {{IPTABLES_PATH, "-t", "nat", "-F", "natctrl_nat_POSTROUTING"}, 1},
71 {{IP_PATH, "rule", "flush"}, 0},
72 {{IP_PATH, "-6", "rule", "flush"}, 0},
73 {{IP_PATH, "rule", "add", "from", "all", "lookup", "default", "prio", "32767"}, 0},
74 {{IP_PATH, "rule", "add", "from", "all", "lookup", "main", "prio", "32766"}, 0},
75 {{IP_PATH, "-6", "rule", "add", "from", "all", "lookup", "default", "prio", "32767"}, 0},
76 {{IP_PATH, "-6", "rule", "add", "from", "all", "lookup", "main", "prio", "32766"}, 0},
77 {{IP_PATH, "route", "flush", "cache"}, 0},
Rom Lemarchand001f0a42013-01-31 12:41:03 -080078 };
JP Abgrall4ae80de2013-03-14 20:06:20 -070079 for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) {
80 if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) &&
81 defaultCommands[cmdNum].checkRes) {
82 return -1;
83 }
84 }
Robert Greenwaltfc97b822011-11-02 16:48:36 -070085
86 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -060087
San Mehat9ff78fb2010-01-19 12:59:15 -080088 return 0;
89}
90
Robert Greenwaltfc97b822011-11-02 16:48:36 -070091bool NatController::checkInterface(const char *iface) {
Jaime A Lopez-Sollanod14fd4f2012-01-11 16:29:28 -080092 if (strlen(iface) > IFNAMSIZ) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -080093 return true;
94}
95
JP Abgrall4ae80de2013-03-14 20:06:20 -070096int NatController::routesOp(bool add, const char *intIface, const char *extIface, char **argv, int addrCount) {
97 int tableNumber = secondaryTableCtrl->findTableNumber(extIface);
98 int ret = 0;
99
100 if (tableNumber != -1) {
101 for (int i = 0; i < addrCount; i++) {
102 if (add) {
103 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
104 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
105 } else {
106 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
107 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
108 }
109 }
110 const char *cmd[] = {
111 IP_PATH,
112 "route",
113 "flush",
114 "cache"
115 };
116 runCmd(ARRAY_SIZE(cmd), cmd);
117 }
118 return ret;
119}
120
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700121// 0 1 2 3 4 5
122// nat enable intface extface addrcnt nated-ipaddr/prelength
123int NatController::enableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700124 int i;
125 int addrCount = atoi(argv[4]);
126 int ret = 0;
127 const char *intIface = argv[2];
128 const char *extIface = argv[3];
129 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -0800130
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700131 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000132 ALOGE("Invalid interface specified");
San Mehat9ff78fb2010-01-19 12:59:15 -0800133 errno = ENODEV;
134 return -1;
135 }
136
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700137 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000138 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700139 errno = EINVAL;
140 return -1;
141 }
JP Abgrall4ae80de2013-03-14 20:06:20 -0700142 ret = routesOp(true, intIface, extIface, argv, addrCount);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700143 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
Steve Block5ea0c052012-01-06 19:18:11 +0000144 ALOGE("Error setting forward rules");
JP Abgrall4ae80de2013-03-14 20:06:20 -0700145 routesOp(false, intIface, extIface, argv, addrCount);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700146 errno = ENODEV;
147 return -1;
148 }
149
JP Abgrall0031cea2012-04-17 16:38:23 -0700150 /* Always make sure the drop rule is at the end */
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800151 const char *cmd1[] = {
152 IPTABLES_PATH,
153 "-D",
154 "natctrl_FORWARD",
155 "-j",
156 "DROP"
157 };
158 runCmd(ARRAY_SIZE(cmd1), cmd1);
159 const char *cmd2[] = {
160 IPTABLES_PATH,
161 "-A",
162 "natctrl_FORWARD",
163 "-j",
164 "DROP"
165 };
166 runCmd(ARRAY_SIZE(cmd2), cmd2);
JP Abgrall0031cea2012-04-17 16:38:23 -0700167
168
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700169 natCount++;
170 // add this if we are the first added nat
171 if (natCount == 1) {
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800172 const char *cmd[] = {
173 IPTABLES_PATH,
174 "-t",
175 "nat",
176 "-A",
177 "natctrl_nat_POSTROUTING",
178 "-o",
179 extIface,
180 "-j",
181 "MASQUERADE"
182 };
183 if (runCmd(ARRAY_SIZE(cmd), cmd)) {
184 ALOGE("Error seting postroute rule: iface=%s", extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700185 // unwind what's been done, but don't care about success - what more could we do?
JP Abgrall4ae80de2013-03-14 20:06:20 -0700186 routesOp(false, intIface, extIface, argv, addrCount);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700187 setDefaults();
188 return -1;
189 }
190 }
191
192 return 0;
193}
194
195int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800196 const char *cmd1[] = {
197 IPTABLES_PATH,
198 add ? "-A" : "-D",
199 "natctrl_FORWARD",
200 "-i",
201 extIface,
202 "-o",
203 intIface,
204 "-m",
205 "state",
206 "--state",
207 "ESTABLISHED,RELATED",
208 "-j",
209 "RETURN"
210 };
211 int rc = 0;
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700212
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800213 if (runCmd(ARRAY_SIZE(cmd1), cmd1) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800214 return -1;
215 }
216
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800217 const char *cmd2[] = {
218 IPTABLES_PATH,
219 add ? "-A" : "-D",
220 "natctrl_FORWARD",
221 "-i",
222 intIface,
223 "-o",
224 extIface,
225 "-m",
226 "state",
227 "--state",
228 "INVALID",
229 "-j",
230 "DROP"
231 };
232
233 const char *cmd3[] = {
234 IPTABLES_PATH,
235 add ? "-A" : "-D",
236 "natctrl_FORWARD",
237 "-i",
238 intIface,
239 "-o",
240 extIface,
241 "-j",
242 "RETURN"
243 };
244
245 if (runCmd(ARRAY_SIZE(cmd2), cmd2) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700246 // bail on error, but only if adding
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800247 rc = -1;
248 goto err_invalid_drop;
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700249 }
250
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800251 if (runCmd(ARRAY_SIZE(cmd3), cmd3) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700252 // unwind what's been done, but don't care about success - what more could we do?
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800253 rc = -1;
254 goto err_return;
San Mehat9ff78fb2010-01-19 12:59:15 -0800255 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700256
San Mehat9ff78fb2010-01-19 12:59:15 -0800257 return 0;
Rom Lemarchand001f0a42013-01-31 12:41:03 -0800258
259err_return:
260 cmd2[1] = "-D";
261 runCmd(ARRAY_SIZE(cmd2), cmd2);
262err_invalid_drop:
263 cmd1[1] = "-D";
264 runCmd(ARRAY_SIZE(cmd1), cmd1);
265 return rc;
San Mehat9ff78fb2010-01-19 12:59:15 -0800266}
267
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700268// nat disable intface extface
269// 0 1 2 3 4 5
270// nat enable intface extface addrcnt nated-ipaddr/prelength
271int NatController::disableNat(const int argc, char **argv) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700272 int i;
273 int addrCount = atoi(argv[4]);
274 const char *intIface = argv[2];
275 const char *extIface = argv[3];
276 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700277
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700278 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000279 ALOGE("Invalid interface specified");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700280 errno = ENODEV;
281 return -1;
282 }
283
284 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000285 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700286 errno = EINVAL;
287 return -1;
288 }
289
290 setForwardRules(false, intIface, extIface);
JP Abgrall4ae80de2013-03-14 20:06:20 -0700291 routesOp(false, intIface, extIface, argv, addrCount);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700292 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600293 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
294 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700295 }
296 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800297}