blob: bdbc429e96ab4e9dcb34e4fd80ce18b06869b8b1 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <stdlib.h>
18#include <errno.h>
19#include <sys/socket.h>
20#include <sys/stat.h>
21#include <fcntl.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080024#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050025#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080026
27#define LOG_TAG "NatController"
28#include <cutils/log.h>
29
30#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070031#include "SecondaryTableController.h"
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -060032#include "oem_iptables_hook.h"
Robert Greenwaltc4621772012-01-31 12:46:45 -080033#include "NetdConstants.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080034
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080035extern "C" int system_nosh(const char *command);
San Mehat9ff78fb2010-01-19 12:59:15 -080036
Robert Greenwaltfc97b822011-11-02 16:48:36 -070037NatController::NatController(SecondaryTableController *ctrl) {
38 secondaryTableCtrl = ctrl;
39 setDefaults();
San Mehat9ff78fb2010-01-19 12:59:15 -080040}
41
42NatController::~NatController() {
43}
44
Robert Greenwaltfc97b822011-11-02 16:48:36 -070045int NatController::runCmd(const char *path, const char *cmd) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070046 char *buffer;
47 size_t len = strnlen(cmd, 255);
48 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080049
JP Abgrall11b4e9b2011-08-11 15:34:49 -070050 if (len == 255) {
Steve Block5ea0c052012-01-06 19:18:11 +000051 ALOGE("command too long");
JP Abgrall11b4e9b2011-08-11 15:34:49 -070052 errno = E2BIG;
53 return -1;
San Mehat9ff78fb2010-01-19 12:59:15 -080054 }
San Mehat9ff78fb2010-01-19 12:59:15 -080055
Robert Greenwaltfc97b822011-11-02 16:48:36 -070056 asprintf(&buffer, "%s %s", path, cmd);
JP Abgrall9e5e0ce2011-12-14 15:20:59 -080057 res = system_nosh(buffer);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070058 free(buffer);
59 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080060}
61
62int NatController::setDefaults() {
63
Robert Greenwaltfc97b822011-11-02 16:48:36 -070064 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080065 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070066 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080067 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070068 if (runCmd(IPTABLES_PATH, "-P FORWARD DROP"))
San Mehat9ff78fb2010-01-19 12:59:15 -080069 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070070 if (runCmd(IPTABLES_PATH, "-F FORWARD"))
San Mehat9ff78fb2010-01-19 12:59:15 -080071 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070072 if (runCmd(IPTABLES_PATH, "-t nat -F"))
San Mehat9ff78fb2010-01-19 12:59:15 -080073 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070074
75 runCmd(IP_PATH, "rule flush");
Robert Greenwalt063af322011-11-18 15:32:13 -080076 runCmd(IP_PATH, "-6 rule flush");
Robert Greenwaltfc97b822011-11-02 16:48:36 -070077 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
78 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
Robert Greenwalt063af322011-11-18 15:32:13 -080079 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
80 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
81 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -070082
83 natCount = 0;
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -060084
85 setupOemIptablesHook();
San Mehat9ff78fb2010-01-19 12:59:15 -080086 return 0;
87}
88
Robert Greenwaltfc97b822011-11-02 16:48:36 -070089bool NatController::checkInterface(const char *iface) {
90 if (strlen(iface) > MAX_IFACE_LENGTH) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -080091 return true;
92}
93
Robert Greenwaltfc97b822011-11-02 16:48:36 -070094// 0 1 2 3 4 5
95// nat enable intface extface addrcnt nated-ipaddr/prelength
96int NatController::enableNat(const int argc, char **argv) {
San Mehat9ff78fb2010-01-19 12:59:15 -080097 char cmd[255];
Robert Greenwaltfc97b822011-11-02 16:48:36 -070098 int i;
99 int addrCount = atoi(argv[4]);
100 int ret = 0;
101 const char *intIface = argv[2];
102 const char *extIface = argv[3];
103 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -0800104
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700105 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000106 ALOGE("Invalid interface specified");
San Mehat9ff78fb2010-01-19 12:59:15 -0800107 errno = ENODEV;
108 return -1;
109 }
110
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700111 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000112 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700113 errno = EINVAL;
114 return -1;
115 }
116
117 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
118 if (tableNumber != -1) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800119 for(i = 0; i < addrCount; i++) {
120 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700121
Robert Greenwaltc4621772012-01-31 12:46:45 -0800122 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700123 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800124 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700125 }
126
127 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
128 if (tableNumber != -1) {
129 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800130 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700131
Robert Greenwaltc4621772012-01-31 12:46:45 -0800132 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700133 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800134 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700135 }
Steve Block5ea0c052012-01-06 19:18:11 +0000136 ALOGE("Error setting forward rules");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700137 errno = ENODEV;
138 return -1;
139 }
140
141 natCount++;
142 // add this if we are the first added nat
143 if (natCount == 1) {
144 snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface);
145 if (runCmd(IPTABLES_PATH, cmd)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000146 ALOGE("Error seting postroute rule: %s", cmd);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700147 // unwind what's been done, but don't care about success - what more could we do?
148 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800149 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
150
151 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700152 }
153 setDefaults();
154 return -1;
155 }
156 }
157
158 return 0;
159}
160
161int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
162 char cmd[255];
163
San Mehat9ff78fb2010-01-19 12:59:15 -0800164 snprintf(cmd, sizeof(cmd),
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700165 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
166 (add ? "A" : "D"),
San Mehat9ff78fb2010-01-19 12:59:15 -0800167 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700168 if (runCmd(IPTABLES_PATH, cmd) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800169 return -1;
170 }
171
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700172 snprintf(cmd, sizeof(cmd),
173 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
174 (add ? "A" : "D"),
175 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700176 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700177 // bail on error, but only if adding
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700178 snprintf(cmd, sizeof(cmd),
179 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
180 (!add ? "A" : "D"),
181 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700182 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700183 return -1;
184 }
185
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700186 snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
187 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700188 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700189 // unwind what's been done, but don't care about success - what more could we do?
190 snprintf(cmd, sizeof(cmd),
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700191 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
192 (!add ? "A" : "D"),
193 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700194 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700195
196 snprintf(cmd, sizeof(cmd),
Robert Greenwalt210b9772010-03-25 14:54:45 -0700197 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
198 (!add ? "A" : "D"),
199 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700200 runCmd(IPTABLES_PATH, cmd);
San Mehat9ff78fb2010-01-19 12:59:15 -0800201 return -1;
202 }
San Mehat9ff78fb2010-01-19 12:59:15 -0800203 return 0;
204}
205
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700206// nat disable intface extface
207// 0 1 2 3 4 5
208// nat enable intface extface addrcnt nated-ipaddr/prelength
209int NatController::disableNat(const int argc, char **argv) {
210 char cmd[255];
211 int i;
212 int addrCount = atoi(argv[4]);
213 const char *intIface = argv[2];
214 const char *extIface = argv[3];
215 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700216
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700217 if (!checkInterface(intIface) || !checkInterface(extIface)) {
Steve Block5ea0c052012-01-06 19:18:11 +0000218 ALOGE("Invalid interface specified");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700219 errno = ENODEV;
220 return -1;
221 }
222
223 if (argc < 5 + addrCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000224 ALOGE("Missing Argument");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700225 errno = EINVAL;
226 return -1;
227 }
228
229 setForwardRules(false, intIface, extIface);
230
231 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
232 if (tableNumber != -1) {
233 for (i = 0; i < addrCount; i++) {
Robert Greenwaltc4621772012-01-31 12:46:45 -0800234 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
Robert Greenwalt063af322011-11-18 15:32:13 -0800235
Robert Greenwaltc4621772012-01-31 12:46:45 -0800236 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700237 }
Robert Greenwalt063af322011-11-18 15:32:13 -0800238
239 runCmd(IP_PATH, "route flush cache");
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700240 }
241
242 if (--natCount <= 0) {
Kazuhiro Ondo4ab46852012-01-12 16:15:06 -0600243 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
244 setDefaults();
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700245 }
246 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800247}