2 * Copyright (C) 2008 The Android Open Source Project
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 // #define LOG_NDEBUG 0
21 #include <sys/socket.h>
24 #include <netinet/in.h>
25 #include <arpa/inet.h>
27 #include <cutils/properties.h>
29 #define LOG_TAG "NatController"
30 #include <cutils/log.h>
32 #include "NatController.h"
33 #include "SecondaryTableController.h"
34 #include "NetdConstants.h"
36 extern "C" int system_nosh(const char *command);
38 NatController::NatController(SecondaryTableController *ctrl) {
39 secondaryTableCtrl = ctrl;
42 NatController::~NatController() {
45 int NatController::runCmd(const char *path, const char *cmd) {
47 size_t len = strnlen(cmd, 255);
51 ALOGE("command too long");
56 asprintf(&buffer, "%s %s", path, cmd);
57 res = system_nosh(buffer);
58 ALOGV("runCmd() buffer='%s' res=%d", buffer, res);
63 int NatController::setupIptablesHooks() {
64 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
66 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
68 if (runCmd(IPTABLES_PATH, "-P FORWARD ACCEPT"))
71 // Order is important!
72 // -D to delete any pre-existing jump rule, to prevent dupes (no-op if doesn't exist)
73 // -F to flush the chain (no-op if doesn't exist).
74 // -N to create the chain (no-op if already exist).
76 runCmd(IPTABLES_PATH, "-D FORWARD -j natctrl_FORWARD");
77 runCmd(IPTABLES_PATH, "-F natctrl_FORWARD");
78 runCmd(IPTABLES_PATH, "-N natctrl_FORWARD");
79 if (runCmd(IPTABLES_PATH, "-A FORWARD -j natctrl_FORWARD"))
82 runCmd(IPTABLES_PATH, "-t nat -D POSTROUTING -j natctrl_nat_POSTROUTING");
83 runCmd(IPTABLES_PATH, "-t nat -F natctrl_nat_POSTROUTING");
84 runCmd(IPTABLES_PATH, "-t nat -N natctrl_nat_POSTROUTING");
85 if (runCmd(IPTABLES_PATH, "-t nat -A POSTROUTING -j natctrl_nat_POSTROUTING"))
92 int NatController::setDefaults() {
93 if (runCmd(IPTABLES_PATH, "-F natctrl_FORWARD"))
95 if (runCmd(IPTABLES_PATH, "-t nat -F natctrl_nat_POSTROUTING"))
98 runCmd(IP_PATH, "rule flush");
99 runCmd(IP_PATH, "-6 rule flush");
100 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
101 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
102 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
103 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
104 runCmd(IP_PATH, "route flush cache");
111 bool NatController::checkInterface(const char *iface) {
112 if (strlen(iface) > IFNAMSIZ) return false;
117 // nat enable intface extface addrcnt nated-ipaddr/prelength
118 int NatController::enableNat(const int argc, char **argv) {
121 int addrCount = atoi(argv[4]);
123 const char *intIface = argv[2];
124 const char *extIface = argv[3];
127 if (!checkInterface(intIface) || !checkInterface(extIface)) {
128 ALOGE("Invalid interface specified");
133 if (argc < 5 + addrCount) {
134 ALOGE("Missing Argument");
139 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
140 if (tableNumber != -1) {
141 for(i = 0; i < addrCount; i++) {
142 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
144 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
146 runCmd(IP_PATH, "route flush cache");
149 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
150 if (tableNumber != -1) {
151 for (i = 0; i < addrCount; i++) {
152 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
154 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
156 runCmd(IP_PATH, "route flush cache");
158 ALOGE("Error setting forward rules");
163 /* Always make sure the drop rule is at the end */
164 snprintf(cmd, sizeof(cmd), "-D natctrl_FORWARD -j DROP");
165 runCmd(IPTABLES_PATH, cmd);
166 snprintf(cmd, sizeof(cmd), "-A natctrl_FORWARD -j DROP");
167 runCmd(IPTABLES_PATH, cmd);
171 // add this if we are the first added nat
173 snprintf(cmd, sizeof(cmd), "-t nat -A natctrl_nat_POSTROUTING -o %s -j MASQUERADE", extIface);
174 if (runCmd(IPTABLES_PATH, cmd)) {
175 ALOGE("Error seting postroute rule: %s", cmd);
176 // unwind what's been done, but don't care about success - what more could we do?
177 for (i = 0; i < addrCount; i++) {
178 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
180 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
190 int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
193 snprintf(cmd, sizeof(cmd),
194 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
197 if (runCmd(IPTABLES_PATH, cmd) && add) {
201 snprintf(cmd, sizeof(cmd),
202 "-%s natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
205 if (runCmd(IPTABLES_PATH, cmd) && add) {
206 // bail on error, but only if adding
207 snprintf(cmd, sizeof(cmd),
208 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
211 runCmd(IPTABLES_PATH, cmd);
215 snprintf(cmd, sizeof(cmd), "-%s natctrl_FORWARD -i %s -o %s -j RETURN", (add ? "A" : "D"),
217 if (runCmd(IPTABLES_PATH, cmd) && add) {
218 // unwind what's been done, but don't care about success - what more could we do?
219 snprintf(cmd, sizeof(cmd),
220 "-%s natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
223 runCmd(IPTABLES_PATH, cmd);
225 snprintf(cmd, sizeof(cmd),
226 "-%s natctrl_FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j RETURN",
229 runCmd(IPTABLES_PATH, cmd);
236 // nat disable intface extface
238 // nat enable intface extface addrcnt nated-ipaddr/prelength
239 int NatController::disableNat(const int argc, char **argv) {
242 int addrCount = atoi(argv[4]);
243 const char *intIface = argv[2];
244 const char *extIface = argv[3];
247 if (!checkInterface(intIface) || !checkInterface(extIface)) {
248 ALOGE("Invalid interface specified");
253 if (argc < 5 + addrCount) {
254 ALOGE("Missing Argument");
259 setForwardRules(false, intIface, extIface);
261 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
262 if (tableNumber != -1) {
263 for (i = 0; i < addrCount; i++) {
264 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
266 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
269 runCmd(IP_PATH, "route flush cache");
272 if (--natCount <= 0) {
273 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0