San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <stdlib.h> |
| 18 | #include <errno.h> |
| 19 | #include <sys/socket.h> |
| 20 | #include <sys/stat.h> |
| 21 | #include <fcntl.h> |
| 22 | #include <netinet/in.h> |
| 23 | #include <arpa/inet.h> |
Olivier Bailly | ff2c0d8 | 2010-11-17 11:45:07 -0800 | [diff] [blame] | 24 | #include <string.h> |
John Michelau | ac20860 | 2011-05-27 22:07:20 -0500 | [diff] [blame] | 25 | #include <cutils/properties.h> |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 26 | |
| 27 | #define LOG_TAG "NatController" |
| 28 | #include <cutils/log.h> |
| 29 | |
| 30 | #include "NatController.h" |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 31 | #include "SecondaryTableController.h" |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 32 | |
| 33 | extern "C" int logwrap(int argc, const char **argv, int background); |
| 34 | |
| 35 | static char IPTABLES_PATH[] = "/system/bin/iptables"; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 36 | static char IP_PATH[] = "/system/bin/ip"; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 37 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 38 | NatController::NatController(SecondaryTableController *ctrl) { |
| 39 | secondaryTableCtrl = ctrl; |
| 40 | setDefaults(); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 41 | } |
| 42 | |
| 43 | NatController::~NatController() { |
| 44 | } |
| 45 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 46 | int NatController::runCmd(const char *path, const char *cmd) { |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 47 | char *buffer; |
| 48 | size_t len = strnlen(cmd, 255); |
| 49 | int res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 50 | |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 51 | if (len == 255) { |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 52 | LOGE("command too long"); |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 53 | errno = E2BIG; |
| 54 | return -1; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 55 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 56 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 57 | asprintf(&buffer, "%s %s", path, cmd); |
JP Abgrall | 11b4e9b | 2011-08-11 15:34:49 -0700 | [diff] [blame] | 58 | res = system(buffer); |
| 59 | free(buffer); |
| 60 | return res; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | int NatController::setDefaults() { |
| 64 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 65 | if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 66 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 67 | if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 68 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 69 | if (runCmd(IPTABLES_PATH, "-P FORWARD DROP")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 70 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 71 | if (runCmd(IPTABLES_PATH, "-F FORWARD")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 72 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 73 | if (runCmd(IPTABLES_PATH, "-t nat -F")) |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 74 | return -1; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 75 | |
| 76 | runCmd(IP_PATH, "rule flush"); |
| 77 | runCmd(IP_PATH, "rule add from all lookup default prio 32767"); |
| 78 | runCmd(IP_PATH, "rule add from all lookup main prio 32766"); |
| 79 | |
| 80 | natCount = 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 81 | return 0; |
| 82 | } |
| 83 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 84 | bool NatController::checkInterface(const char *iface) { |
| 85 | if (strlen(iface) > MAX_IFACE_LENGTH) return false; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 86 | return true; |
| 87 | } |
| 88 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 89 | // 0 1 2 3 4 5 |
| 90 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 91 | int NatController::enableNat(const int argc, char **argv) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 92 | char cmd[255]; |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 93 | int i; |
| 94 | int addrCount = atoi(argv[4]); |
| 95 | int ret = 0; |
| 96 | const char *intIface = argv[2]; |
| 97 | const char *extIface = argv[3]; |
| 98 | int tableNumber; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 99 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 100 | if (!checkInterface(intIface) || !checkInterface(extIface)) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 101 | LOGE("Invalid interface specified"); |
| 102 | errno = ENODEV; |
| 103 | return -1; |
| 104 | } |
| 105 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 106 | if (argc < 5 + addrCount) { |
| 107 | LOGE("Missing Argument"); |
| 108 | errno = EINVAL; |
| 109 | return -1; |
| 110 | } |
| 111 | |
| 112 | tableNumber = secondaryTableCtrl->findTableNumber(extIface); |
| 113 | if (tableNumber != -1) { |
| 114 | for(i = 0; i < addrCount && ret == 0; i++) { |
| 115 | snprintf(cmd, sizeof(cmd), "rule add from %s table %d", argv[5+i], |
| 116 | tableNumber + BASE_TABLE_NUMBER); |
| 117 | ret |= runCmd(IP_PATH, cmd); |
| 118 | if (ret) LOGE("IP rule %s got %d", cmd, ret); |
| 119 | |
| 120 | snprintf(cmd, sizeof(cmd), "route add %s dev %s table %d", argv[5+i], intIface, |
| 121 | tableNumber + BASE_TABLE_NUMBER); |
| 122 | ret |= runCmd(IP_PATH, cmd); |
| 123 | if (ret) LOGE("IP route %s got %d", cmd, ret); |
| 124 | } |
| 125 | } |
| 126 | |
| 127 | if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) { |
| 128 | if (tableNumber != -1) { |
| 129 | for (i = 0; i < addrCount; i++) { |
| 130 | snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface, |
| 131 | tableNumber + BASE_TABLE_NUMBER); |
| 132 | runCmd(IP_PATH, cmd); |
| 133 | |
| 134 | snprintf(cmd, sizeof(cmd), "rule del from %s table %d", argv[5+i], |
| 135 | tableNumber + BASE_TABLE_NUMBER); |
| 136 | runCmd(IP_PATH, cmd); |
| 137 | } |
| 138 | } |
| 139 | LOGE("Error setting forward rules"); |
| 140 | errno = ENODEV; |
| 141 | return -1; |
| 142 | } |
| 143 | |
| 144 | natCount++; |
| 145 | // add this if we are the first added nat |
| 146 | if (natCount == 1) { |
| 147 | snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface); |
| 148 | if (runCmd(IPTABLES_PATH, cmd)) { |
| 149 | LOGE("Error seting postroute rule: %s", cmd); |
| 150 | // unwind what's been done, but don't care about success - what more could we do? |
| 151 | for (i = 0; i < addrCount; i++) { |
| 152 | snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface, |
| 153 | tableNumber + BASE_TABLE_NUMBER); |
| 154 | runCmd(IP_PATH, cmd); |
| 155 | } |
| 156 | setDefaults(); |
| 157 | return -1; |
| 158 | } |
| 159 | } |
| 160 | |
| 161 | return 0; |
| 162 | } |
| 163 | |
| 164 | int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) { |
| 165 | char cmd[255]; |
| 166 | |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 167 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 168 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 169 | (add ? "A" : "D"), |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 170 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 171 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 172 | return -1; |
| 173 | } |
| 174 | |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 175 | snprintf(cmd, sizeof(cmd), |
| 176 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 177 | (add ? "A" : "D"), |
| 178 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 179 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
Robert Greenwalt | f7bf29c | 2011-11-01 22:07:28 -0700 | [diff] [blame] | 180 | // bail on error, but only if adding |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 181 | snprintf(cmd, sizeof(cmd), |
| 182 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 183 | (!add ? "A" : "D"), |
| 184 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 185 | runCmd(IPTABLES_PATH, cmd); |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 186 | return -1; |
| 187 | } |
| 188 | |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 189 | snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"), |
| 190 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 191 | if (runCmd(IPTABLES_PATH, cmd) && add) { |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 192 | // unwind what's been done, but don't care about success - what more could we do? |
| 193 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 194 | "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP", |
| 195 | (!add ? "A" : "D"), |
| 196 | intIface, extIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 197 | runCmd(IPTABLES_PATH, cmd); |
Robert Greenwalt | ddb9f6e | 2011-08-02 13:00:11 -0700 | [diff] [blame] | 198 | |
| 199 | snprintf(cmd, sizeof(cmd), |
Robert Greenwalt | 210b977 | 2010-03-25 14:54:45 -0700 | [diff] [blame] | 200 | "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT", |
| 201 | (!add ? "A" : "D"), |
| 202 | extIface, intIface); |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 203 | runCmd(IPTABLES_PATH, cmd); |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 204 | return -1; |
| 205 | } |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 206 | return 0; |
| 207 | } |
| 208 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 209 | // nat disable intface extface |
| 210 | // 0 1 2 3 4 5 |
| 211 | // nat enable intface extface addrcnt nated-ipaddr/prelength |
| 212 | int NatController::disableNat(const int argc, char **argv) { |
| 213 | char cmd[255]; |
| 214 | int i; |
| 215 | int addrCount = atoi(argv[4]); |
| 216 | const char *intIface = argv[2]; |
| 217 | const char *extIface = argv[3]; |
| 218 | int tableNumber; |
Robert Greenwalt | 1caafe6 | 2010-03-24 15:43:00 -0700 | [diff] [blame] | 219 | |
Robert Greenwalt | fc97b82 | 2011-11-02 16:48:36 -0700 | [diff] [blame^] | 220 | if (!checkInterface(intIface) || !checkInterface(extIface)) { |
| 221 | LOGE("Invalid interface specified"); |
| 222 | errno = ENODEV; |
| 223 | return -1; |
| 224 | } |
| 225 | |
| 226 | if (argc < 5 + addrCount) { |
| 227 | LOGE("Missing Argument"); |
| 228 | errno = EINVAL; |
| 229 | return -1; |
| 230 | } |
| 231 | |
| 232 | setForwardRules(false, intIface, extIface); |
| 233 | |
| 234 | tableNumber = secondaryTableCtrl->findTableNumber(extIface); |
| 235 | if (tableNumber != -1) { |
| 236 | for (i = 0; i < addrCount; i++) { |
| 237 | snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface, |
| 238 | tableNumber + BASE_TABLE_NUMBER); |
| 239 | // if the interface has gone down these will be gone already and give errors |
| 240 | // ignore them. |
| 241 | runCmd(IP_PATH, cmd); |
| 242 | } |
| 243 | } |
| 244 | |
| 245 | if (--natCount <= 0) { |
| 246 | char bootmode[PROPERTY_VALUE_MAX] = {0}; |
| 247 | property_get("ro.bootmode", bootmode, "unknown"); |
| 248 | if (0 != strcmp("bp-tools", bootmode)) { |
| 249 | // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0 |
| 250 | setDefaults(); |
| 251 | } |
| 252 | natCount = 0; |
| 253 | } |
| 254 | return 0; |
San Mehat | 9ff78fb | 2010-01-19 12:59:15 -0800 | [diff] [blame] | 255 | } |