San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <stdlib.h> |
| 18 | #include <errno.h> |
| 19 | #include <sys/socket.h> |
| 20 | #include <sys/stat.h> |
| 21 | #include <fcntl.h> |
| 22 | #include <netinet/in.h> |
| 23 | #include <arpa/inet.h> |
Olivier Bailly | ff2c0d8 | 2010-11-17 11:45:07 -0800 | [diff] [blame] | 24 | #include <string.h> |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 25 | #include <cutils/properties.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 26 | |
| 27 | #define LOG_TAG "NatController" |
| 28 | #include <cutils/log.h> |
| 29 | |
| 30 | #include "NatController.h" |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 31 | #include "SecondaryTableController.h" |
Kazuhiro Ondo | 4ab4685 | 2012-01-12 16:15:06 -0600 | [diff] [blame] | 32 | #include "oem_iptables_hook.h" |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 33 | #include "NetdConstants.h" |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 34 | |
JP Abgrall | 9e5e0ce | 2011-12-14 15:20:59 -0800 | [diff] [blame] | 35 | extern "C" int system_nosh(const char *command); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 36 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 37 | NatController::NatController(SecondaryTableController *ctrl) { |
| 38 | secondaryTableCtrl = ctrl; |
| 39 | setDefaults(); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 40 | } |
| 41 | |
| 42 | NatController::~NatController() { |
| 43 | } |
| 44 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 45 | int NatController::runCmd(const char *path, const char *cmd) { |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 46 | char *buffer; |
| 47 | size_t len = strnlen(cmd, 255); |
| 48 | int res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 49 | |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 50 | if (len == 255) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 51 | ALOGE("command too long"); |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 52 | errno = E2BIG; |
| 53 | return -1; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 54 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 55 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 56 | asprintf(&buffer, "%s %s", path, cmd); |
JP Abgrall | 9e5e0ce | 2011-12-14 15:20:59 -0800 | [diff] [blame] | 57 | res = system_nosh(buffer); |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 58 | free(buffer); |
| 59 | return res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 60 | } |
| 61 | |
| 62 | int NatController::setDefaults() { |
| 63 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 64 | if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 65 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 66 | if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 67 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 68 | if (runCmd(IPTABLES_PATH, "-P FORWARD DROP")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 69 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 70 | if (runCmd(IPTABLES_PATH, "-F FORWARD")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 71 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 72 | if (runCmd(IPTABLES_PATH, "-t nat -F")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 73 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 74 | |
| 75 | runCmd(IP_PATH, "rule flush"); |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 76 | runCmd(IP_PATH, "-6 rule flush"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 77 | runCmd(IP_PATH, "rule add from all lookup default prio 32767"); |
| 78 | runCmd(IP_PATH, "rule add from all lookup main prio 32766"); |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 79 | runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767"); |
| 80 | runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766"); |
| 81 | runCmd(IP_PATH, "route flush cache"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 82 | |
| 83 | natCount = 0; |
Kazuhiro Ondo | 4ab4685 | 2012-01-12 16:15:06 -0600 | [diff] [blame] | 84 | |
| 85 | setupOemIptablesHook(); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 86 | return 0; |
| 87 | } |
| 88 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 89 | bool NatController::checkInterface(const char *iface) { |
Jaime A Lopez-Sollano | d14fd4f | 2012-01-11 16:29:28 -0800 | [diff] [blame^] | 90 | if (strlen(iface) > IFNAMSIZ) return false; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 91 | return true; |
| 92 | } |
| 93 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 94 | // 0 1 2 3 4 5 |
| 95 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 96 | int NatController::enableNat(const int argc, char **argv) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 97 | char cmd[255]; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 98 | int i; |
| 99 | int addrCount = atoi(argv[4]); |
| 100 | int ret = 0; |
| 101 | const char *intIface = argv[2]; |
| 102 | const char *extIface = argv[3]; |
| 103 | int tableNumber; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 104 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 105 | if (!checkInterface(intIface) || !checkInterface(extIface)) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 106 | ALOGE("Invalid interface specified"); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 107 | errno = ENODEV; |
| 108 | return -1; |
| 109 | } |
| 110 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 111 | if (argc < 5 + addrCount) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 112 | ALOGE("Missing Argument"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 113 | errno = EINVAL; |
| 114 | return -1; |
| 115 | } |
| 116 | |
| 117 | tableNumber = secondaryTableCtrl->findTableNumber(extIface); |
| 118 | if (tableNumber != -1) { |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 119 | for(i = 0; i < addrCount; i++) { |
| 120 | ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 121 | |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 122 | ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 123 | } |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 124 | runCmd(IP_PATH, "route flush cache"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 125 | } |
| 126 | |
| 127 | if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) { |
| 128 | if (tableNumber != -1) { |
| 129 | for (i = 0; i < addrCount; i++) { |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 130 | secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 131 | |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 132 | secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 133 | } |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 134 | runCmd(IP_PATH, "route flush cache"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 135 | } |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 136 | ALOGE("Error setting forward rules"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 137 | errno = ENODEV; |
| 138 | return -1; |
| 139 | } |
| 140 | |
| 141 | natCount++; |
| 142 | // add this if we are the first added nat |
| 143 | if (natCount == 1) { |
| 144 | snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface); |
| 145 | if (runCmd(IPTABLES_PATH, cmd)) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 146 | ALOGE("Error seting postroute rule: %s", cmd); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 147 | // unwind what's been done, but don't care about success - what more could we do? |
| 148 | for (i = 0; i < addrCount; i++) { |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 149 | secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]); |
| 150 | |
| 151 | secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 152 | } |
| 153 | setDefaults(); |
| 154 | return -1; |
| 155 | } |
| 156 | } |
| 157 | |
| 158 | return 0; |
| 159 | } |
| 160 | |
| 161 | int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) { |
| 162 | char cmd[255]; |
| 163 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 164 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 165 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 166 | (add ? "A" : "D"), |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 167 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 168 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 169 | return -1; |
| 170 | } |
| 171 | |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 172 | snprintf(cmd, sizeof(cmd), |
| 173 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 174 | (add ? "A" : "D"), |
| 175 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 176 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame] | 177 | // bail on error, but only if adding |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 178 | snprintf(cmd, sizeof(cmd), |
| 179 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 180 | (!add ? "A" : "D"), |
| 181 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 182 | runCmd(IPTABLES_PATH, cmd); |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 183 | return -1; |
| 184 | } |
| 185 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 186 | snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"), |
| 187 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 188 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 189 | // unwind what's been done, but don't care about success - what more could we do? |
| 190 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 191 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 192 | (!add ? "A" : "D"), |
| 193 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 194 | runCmd(IPTABLES_PATH, cmd); |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 195 | |
| 196 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 197 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 198 | (!add ? "A" : "D"), |
| 199 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 200 | runCmd(IPTABLES_PATH, cmd); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 201 | return -1; |
| 202 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 203 | return 0; |
| 204 | } |
| 205 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 206 | // nat disable intface extface |
| 207 | // 0 1 2 3 4 5 |
| 208 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 209 | int NatController::disableNat(const int argc, char **argv) { |
| 210 | char cmd[255]; |
| 211 | int i; |
| 212 | int addrCount = atoi(argv[4]); |
| 213 | const char *intIface = argv[2]; |
| 214 | const char *extIface = argv[3]; |
| 215 | int tableNumber; |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 216 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 217 | if (!checkInterface(intIface) || !checkInterface(extIface)) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 218 | ALOGE("Invalid interface specified"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 219 | errno = ENODEV; |
| 220 | return -1; |
| 221 | } |
| 222 | |
| 223 | if (argc < 5 + addrCount) { |
Steve Block | 5ea0c05 | 2012-01-06 19:18:11 +0000 | [diff] [blame] | 224 | ALOGE("Missing Argument"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 225 | errno = EINVAL; |
| 226 | return -1; |
| 227 | } |
| 228 | |
| 229 | setForwardRules(false, intIface, extIface); |
| 230 | |
| 231 | tableNumber = secondaryTableCtrl->findTableNumber(extIface); |
| 232 | if (tableNumber != -1) { |
| 233 | for (i = 0; i < addrCount; i++) { |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 234 | secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]); |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 235 | |
Robert Greenwalt | c462177 | 2012-01-31 12:46:45 -0800 | [diff] [blame] | 236 | secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 237 | } |
Robert Greenwalt | 063af32 | 2011-11-18 15:32:13 -0800 | [diff] [blame] | 238 | |
| 239 | runCmd(IP_PATH, "route flush cache"); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 240 | } |
| 241 | |
| 242 | if (--natCount <= 0) { |
Kazuhiro Ondo | 4ab4685 | 2012-01-12 16:15:06 -0600 | [diff] [blame] | 243 | // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0 |
| 244 | setDefaults(); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame] | 245 | } |
| 246 | return 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 247 | } |