blob: ce5b3f17ed66a014a00f320063db77a157e1e624 [file] [log] [blame]
San Mehat9ff78fb2010-01-19 12:59:15 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <stdlib.h>
18#include <errno.h>
19#include <sys/socket.h>
20#include <sys/stat.h>
21#include <fcntl.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
Olivier Baillyff2c0d82010-11-17 11:45:07 -080024#include <string.h>
John Michelauac208602011-05-27 22:07:20 -050025#include <cutils/properties.h>
San Mehat9ff78fb2010-01-19 12:59:15 -080026
27#define LOG_TAG "NatController"
28#include <cutils/log.h>
29
30#include "NatController.h"
Robert Greenwaltfc97b822011-11-02 16:48:36 -070031#include "SecondaryTableController.h"
San Mehat9ff78fb2010-01-19 12:59:15 -080032
33extern "C" int logwrap(int argc, const char **argv, int background);
34
35static char IPTABLES_PATH[] = "/system/bin/iptables";
Robert Greenwaltfc97b822011-11-02 16:48:36 -070036static char IP_PATH[] = "/system/bin/ip";
San Mehat9ff78fb2010-01-19 12:59:15 -080037
Robert Greenwaltfc97b822011-11-02 16:48:36 -070038NatController::NatController(SecondaryTableController *ctrl) {
39 secondaryTableCtrl = ctrl;
40 setDefaults();
San Mehat9ff78fb2010-01-19 12:59:15 -080041}
42
43NatController::~NatController() {
44}
45
Robert Greenwaltfc97b822011-11-02 16:48:36 -070046int NatController::runCmd(const char *path, const char *cmd) {
JP Abgrall11b4e9b2011-08-11 15:34:49 -070047 char *buffer;
48 size_t len = strnlen(cmd, 255);
49 int res;
San Mehat9ff78fb2010-01-19 12:59:15 -080050
JP Abgrall11b4e9b2011-08-11 15:34:49 -070051 if (len == 255) {
Robert Greenwaltfc97b822011-11-02 16:48:36 -070052 LOGE("command too long");
JP Abgrall11b4e9b2011-08-11 15:34:49 -070053 errno = E2BIG;
54 return -1;
San Mehat9ff78fb2010-01-19 12:59:15 -080055 }
San Mehat9ff78fb2010-01-19 12:59:15 -080056
Robert Greenwaltfc97b822011-11-02 16:48:36 -070057 asprintf(&buffer, "%s %s", path, cmd);
JP Abgrall11b4e9b2011-08-11 15:34:49 -070058 res = system(buffer);
59 free(buffer);
60 return res;
San Mehat9ff78fb2010-01-19 12:59:15 -080061}
62
63int NatController::setDefaults() {
64
Robert Greenwaltfc97b822011-11-02 16:48:36 -070065 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080066 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070067 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
San Mehat9ff78fb2010-01-19 12:59:15 -080068 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070069 if (runCmd(IPTABLES_PATH, "-P FORWARD DROP"))
San Mehat9ff78fb2010-01-19 12:59:15 -080070 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070071 if (runCmd(IPTABLES_PATH, "-F FORWARD"))
San Mehat9ff78fb2010-01-19 12:59:15 -080072 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070073 if (runCmd(IPTABLES_PATH, "-t nat -F"))
San Mehat9ff78fb2010-01-19 12:59:15 -080074 return -1;
Robert Greenwaltfc97b822011-11-02 16:48:36 -070075
76 runCmd(IP_PATH, "rule flush");
77 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
78 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
79
80 natCount = 0;
San Mehat9ff78fb2010-01-19 12:59:15 -080081 return 0;
82}
83
Robert Greenwaltfc97b822011-11-02 16:48:36 -070084bool NatController::checkInterface(const char *iface) {
85 if (strlen(iface) > MAX_IFACE_LENGTH) return false;
San Mehat9ff78fb2010-01-19 12:59:15 -080086 return true;
87}
88
Robert Greenwaltfc97b822011-11-02 16:48:36 -070089// 0 1 2 3 4 5
90// nat enable intface extface addrcnt nated-ipaddr/prelength
91int NatController::enableNat(const int argc, char **argv) {
San Mehat9ff78fb2010-01-19 12:59:15 -080092 char cmd[255];
Robert Greenwaltfc97b822011-11-02 16:48:36 -070093 int i;
94 int addrCount = atoi(argv[4]);
95 int ret = 0;
96 const char *intIface = argv[2];
97 const char *extIface = argv[3];
98 int tableNumber;
San Mehat9ff78fb2010-01-19 12:59:15 -080099
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700100 if (!checkInterface(intIface) || !checkInterface(extIface)) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800101 LOGE("Invalid interface specified");
102 errno = ENODEV;
103 return -1;
104 }
105
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700106 if (argc < 5 + addrCount) {
107 LOGE("Missing Argument");
108 errno = EINVAL;
109 return -1;
110 }
111
112 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
113 if (tableNumber != -1) {
114 for(i = 0; i < addrCount && ret == 0; i++) {
115 snprintf(cmd, sizeof(cmd), "rule add from %s table %d", argv[5+i],
116 tableNumber + BASE_TABLE_NUMBER);
117 ret |= runCmd(IP_PATH, cmd);
118 if (ret) LOGE("IP rule %s got %d", cmd, ret);
119
120 snprintf(cmd, sizeof(cmd), "route add %s dev %s table %d", argv[5+i], intIface,
121 tableNumber + BASE_TABLE_NUMBER);
122 ret |= runCmd(IP_PATH, cmd);
123 if (ret) LOGE("IP route %s got %d", cmd, ret);
124 }
125 }
126
127 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
128 if (tableNumber != -1) {
129 for (i = 0; i < addrCount; i++) {
130 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
131 tableNumber + BASE_TABLE_NUMBER);
132 runCmd(IP_PATH, cmd);
133
134 snprintf(cmd, sizeof(cmd), "rule del from %s table %d", argv[5+i],
135 tableNumber + BASE_TABLE_NUMBER);
136 runCmd(IP_PATH, cmd);
137 }
138 }
139 LOGE("Error setting forward rules");
140 errno = ENODEV;
141 return -1;
142 }
143
144 natCount++;
145 // add this if we are the first added nat
146 if (natCount == 1) {
147 snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface);
148 if (runCmd(IPTABLES_PATH, cmd)) {
149 LOGE("Error seting postroute rule: %s", cmd);
150 // unwind what's been done, but don't care about success - what more could we do?
151 for (i = 0; i < addrCount; i++) {
152 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
153 tableNumber + BASE_TABLE_NUMBER);
154 runCmd(IP_PATH, cmd);
155 }
156 setDefaults();
157 return -1;
158 }
159 }
160
161 return 0;
162}
163
164int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
165 char cmd[255];
166
San Mehat9ff78fb2010-01-19 12:59:15 -0800167 snprintf(cmd, sizeof(cmd),
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700168 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
169 (add ? "A" : "D"),
San Mehat9ff78fb2010-01-19 12:59:15 -0800170 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700171 if (runCmd(IPTABLES_PATH, cmd) && add) {
San Mehat9ff78fb2010-01-19 12:59:15 -0800172 return -1;
173 }
174
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700175 snprintf(cmd, sizeof(cmd),
176 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
177 (add ? "A" : "D"),
178 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700179 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwaltf7bf29c2011-11-01 22:07:28 -0700180 // bail on error, but only if adding
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700181 snprintf(cmd, sizeof(cmd),
182 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
183 (!add ? "A" : "D"),
184 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700185 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700186 return -1;
187 }
188
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700189 snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
190 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700191 if (runCmd(IPTABLES_PATH, cmd) && add) {
Robert Greenwalt210b9772010-03-25 14:54:45 -0700192 // unwind what's been done, but don't care about success - what more could we do?
193 snprintf(cmd, sizeof(cmd),
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700194 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
195 (!add ? "A" : "D"),
196 intIface, extIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700197 runCmd(IPTABLES_PATH, cmd);
Robert Greenwaltddb9f6e2011-08-02 13:00:11 -0700198
199 snprintf(cmd, sizeof(cmd),
Robert Greenwalt210b9772010-03-25 14:54:45 -0700200 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
201 (!add ? "A" : "D"),
202 extIface, intIface);
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700203 runCmd(IPTABLES_PATH, cmd);
San Mehat9ff78fb2010-01-19 12:59:15 -0800204 return -1;
205 }
San Mehat9ff78fb2010-01-19 12:59:15 -0800206 return 0;
207}
208
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700209// nat disable intface extface
210// 0 1 2 3 4 5
211// nat enable intface extface addrcnt nated-ipaddr/prelength
212int NatController::disableNat(const int argc, char **argv) {
213 char cmd[255];
214 int i;
215 int addrCount = atoi(argv[4]);
216 const char *intIface = argv[2];
217 const char *extIface = argv[3];
218 int tableNumber;
Robert Greenwalt1caafe62010-03-24 15:43:00 -0700219
Robert Greenwaltfc97b822011-11-02 16:48:36 -0700220 if (!checkInterface(intIface) || !checkInterface(extIface)) {
221 LOGE("Invalid interface specified");
222 errno = ENODEV;
223 return -1;
224 }
225
226 if (argc < 5 + addrCount) {
227 LOGE("Missing Argument");
228 errno = EINVAL;
229 return -1;
230 }
231
232 setForwardRules(false, intIface, extIface);
233
234 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
235 if (tableNumber != -1) {
236 for (i = 0; i < addrCount; i++) {
237 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
238 tableNumber + BASE_TABLE_NUMBER);
239 // if the interface has gone down these will be gone already and give errors
240 // ignore them.
241 runCmd(IP_PATH, cmd);
242 }
243 }
244
245 if (--natCount <= 0) {
246 char bootmode[PROPERTY_VALUE_MAX] = {0};
247 property_get("ro.bootmode", bootmode, "unknown");
248 if (0 != strcmp("bp-tools", bootmode)) {
249 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0
250 setDefaults();
251 }
252 natCount = 0;
253 }
254 return 0;
San Mehat9ff78fb2010-01-19 12:59:15 -0800255}