San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <stdlib.h> |
| 18 | #include <errno.h> |
| 19 | #include <sys/socket.h> |
| 20 | #include <sys/stat.h> |
| 21 | #include <fcntl.h> |
| 22 | #include <netinet/in.h> |
| 23 | #include <arpa/inet.h> |
Olivier Bailly | ff2c0d8 | 2010-11-17 11:45:07 -0800 | [diff] [blame] | 24 | #include <string.h> |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 25 | #include <cutils/properties.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 26 | |
| 27 | #define LOG_TAG "NatController" |
| 28 | #include <cutils/log.h> |
| 29 | |
| 30 | #include "NatController.h" |
| 31 | |
| 32 | extern "C" int logwrap(int argc, const char **argv, int background); |
| 33 | |
| 34 | static char IPTABLES_PATH[] = "/system/bin/iptables"; |
| 35 | |
| 36 | NatController::NatController() { |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 37 | natCount = 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 38 | } |
| 39 | |
| 40 | NatController::~NatController() { |
| 41 | } |
| 42 | |
| 43 | int NatController::runIptablesCmd(const char *cmd) { |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 44 | char *buffer; |
| 45 | size_t len = strnlen(cmd, 255); |
| 46 | int res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 47 | |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 48 | if (len == 255) { |
| 49 | LOGE("iptables command too long"); |
| 50 | errno = E2BIG; |
| 51 | return -1; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 52 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 53 | |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 54 | asprintf(&buffer, "%s %s", IPTABLES_PATH, cmd); |
| 55 | res = system(buffer); |
| 56 | free(buffer); |
| 57 | return res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 58 | } |
| 59 | |
| 60 | int NatController::setDefaults() { |
| 61 | |
| 62 | if (runIptablesCmd("-P INPUT ACCEPT")) |
| 63 | return -1; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 64 | if (runIptablesCmd("-P OUTPUT ACCEPT")) |
| 65 | return -1; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 66 | if (runIptablesCmd("-P FORWARD DROP")) |
| 67 | return -1; |
| 68 | if (runIptablesCmd("-F FORWARD")) |
| 69 | return -1; |
| 70 | if (runIptablesCmd("-t nat -F")) |
| 71 | return -1; |
| 72 | return 0; |
| 73 | } |
| 74 | |
| 75 | bool NatController::interfaceExists(const char *iface) { |
Paul Eastham | b5ff9b2 | 2010-10-13 09:42:51 -0700 | [diff] [blame] | 76 | // XXX: Implement this |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 77 | return true; |
| 78 | } |
| 79 | |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame^] | 80 | // when un-doing NAT, we should report errors, but also try to do as much cleanup |
| 81 | // as we can - don't short circuit on error. |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 82 | int NatController::doNatCommands(const char *intIface, const char *extIface, bool add) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 83 | char cmd[255]; |
| 84 | |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 85 | char bootmode[PROPERTY_VALUE_MAX] = {0}; |
| 86 | property_get("ro.bootmode", bootmode, "unknown"); |
| 87 | if (0 != strcmp("bp-tools", bootmode)) { |
| 88 | // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0 |
| 89 | if (add == false) { |
| 90 | if (natCount <= 1) { |
| 91 | int ret = setDefaults(); |
| 92 | if (ret == 0) { |
| 93 | natCount=0; |
| 94 | } |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame^] | 95 | LOGE("setDefaults returned %d", ret); |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 96 | return ret; |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 97 | } |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 98 | } |
| 99 | } |
| 100 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 101 | if (!interfaceExists(intIface) || !interfaceExists (extIface)) { |
| 102 | LOGE("Invalid interface specified"); |
| 103 | errno = ENODEV; |
| 104 | return -1; |
| 105 | } |
| 106 | |
| 107 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 108 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 109 | (add ? "A" : "D"), |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 110 | extIface, intIface); |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame^] | 111 | if (runIptablesCmd(cmd) && add) { |
| 112 | // only bail out if we are adding, not removing nat rules |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 113 | return -1; |
| 114 | } |
| 115 | |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 116 | snprintf(cmd, sizeof(cmd), |
| 117 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 118 | (add ? "A" : "D"), |
| 119 | intIface, extIface); |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame^] | 120 | if (runIptablesCmd(cmd) && add) { |
| 121 | // bail on error, but only if adding |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 122 | snprintf(cmd, sizeof(cmd), |
| 123 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 124 | (!add ? "A" : "D"), |
| 125 | extIface, intIface); |
Robert Greenwalt | 6e4d5db | 2011-08-03 16:51:30 -0700 | [diff] [blame] | 126 | runIptablesCmd(cmd); |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 127 | return -1; |
| 128 | } |
| 129 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 130 | snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"), |
| 131 | intIface, extIface); |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame^] | 132 | if (runIptablesCmd(cmd) && add) { |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 133 | // unwind what's been done, but don't care about success - what more could we do? |
| 134 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 135 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 136 | (!add ? "A" : "D"), |
| 137 | intIface, extIface); |
| 138 | runIptablesCmd(cmd); |
| 139 | |
| 140 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 141 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 142 | (!add ? "A" : "D"), |
| 143 | extIface, intIface); |
Robert Greenwalt | 6e4d5db | 2011-08-03 16:51:30 -0700 | [diff] [blame] | 144 | runIptablesCmd(cmd); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 145 | return -1; |
| 146 | } |
| 147 | |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 148 | // add this if we are the first added nat |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 149 | if (add && natCount == 0) { |
| 150 | snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface); |
| 151 | if (runIptablesCmd(cmd)) { |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 152 | if (0 != strcmp("bp-tools", bootmode)) { |
| 153 | // unwind what's been done, but don't care about success - what more could we do? |
| 154 | setDefaults();; |
| 155 | } |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 156 | return -1; |
| 157 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 158 | } |
| 159 | |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 160 | if (add) { |
| 161 | natCount++; |
| 162 | } else { |
| 163 | natCount--; |
| 164 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 165 | return 0; |
| 166 | } |
| 167 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 168 | int NatController::enableNat(const char *intIface, const char *extIface) { |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 169 | return doNatCommands(intIface, extIface, true); |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 170 | } |
| 171 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 172 | int NatController::disableNat(const char *intIface, const char *extIface) { |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 173 | return doNatCommands(intIface, extIface, false); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 174 | } |