2 * Copyright (C) 2008 The Android Open Source Project
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
19 #include <sys/socket.h>
22 #include <netinet/in.h>
23 #include <arpa/inet.h>
25 #include <cutils/properties.h>
27 #define LOG_TAG "NatController"
28 #include <cutils/log.h>
30 #include "NatController.h"
31 #include "SecondaryTableController.h"
32 #include "oem_iptables_hook.h"
34 extern "C" int system_nosh(const char *command);
36 static char IPTABLES_PATH[] = "/system/bin/iptables";
37 static char IP_PATH[] = "/system/bin/ip";
39 NatController::NatController(SecondaryTableController *ctrl) {
40 secondaryTableCtrl = ctrl;
44 NatController::~NatController() {
47 int NatController::runCmd(const char *path, const char *cmd) {
49 size_t len = strnlen(cmd, 255);
53 LOGE("command too long");
58 asprintf(&buffer, "%s %s", path, cmd);
59 res = system_nosh(buffer);
64 int NatController::setDefaults() {
66 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
68 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
70 if (runCmd(IPTABLES_PATH, "-P FORWARD DROP"))
72 if (runCmd(IPTABLES_PATH, "-F FORWARD"))
74 if (runCmd(IPTABLES_PATH, "-t nat -F"))
77 runCmd(IP_PATH, "rule flush");
78 runCmd(IP_PATH, "-6 rule flush");
79 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
80 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
81 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
82 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
83 runCmd(IP_PATH, "route flush cache");
87 setupOemIptablesHook();
91 bool NatController::checkInterface(const char *iface) {
92 if (strlen(iface) > IFNAMSIZ) return false;
96 const char *NatController::getVersion(const char *addr) {
97 if (strchr(addr, ':') != NULL) {
105 // nat enable intface extface addrcnt nated-ipaddr/prelength
106 int NatController::enableNat(const int argc, char **argv) {
109 int addrCount = atoi(argv[4]);
111 const char *intIface = argv[2];
112 const char *extIface = argv[3];
115 if (!checkInterface(intIface) || !checkInterface(extIface)) {
116 LOGE("Invalid interface specified");
121 if (argc < 5 + addrCount) {
122 LOGE("Missing Argument");
127 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
128 if (tableNumber != -1) {
129 for(i = 0; i < addrCount && ret == 0; i++) {
130 snprintf(cmd, sizeof(cmd), "%s rule add from %s table %d", getVersion(argv[5+i]),
131 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
132 ret |= runCmd(IP_PATH, cmd);
133 if (ret) LOGE("IP rule %s got %d", cmd, ret);
135 snprintf(cmd, sizeof(cmd), "route add %s dev %s table %d", argv[5+i], intIface,
136 tableNumber + BASE_TABLE_NUMBER);
137 ret |= runCmd(IP_PATH, cmd);
138 if (ret) LOGE("IP route %s got %d", cmd, ret);
140 runCmd(IP_PATH, "route flush cache");
143 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
144 if (tableNumber != -1) {
145 for (i = 0; i < addrCount; i++) {
146 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
147 tableNumber + BASE_TABLE_NUMBER);
148 runCmd(IP_PATH, cmd);
150 snprintf(cmd, sizeof(cmd), "%s rule del from %s table %d", getVersion(argv[5+i]),
151 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
152 runCmd(IP_PATH, cmd);
154 runCmd(IP_PATH, "route flush cache");
156 LOGE("Error setting forward rules");
162 // add this if we are the first added nat
164 snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface);
165 if (runCmd(IPTABLES_PATH, cmd)) {
166 LOGE("Error seting postroute rule: %s", cmd);
167 // unwind what's been done, but don't care about success - what more could we do?
168 for (i = 0; i < addrCount; i++) {
169 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
170 tableNumber + BASE_TABLE_NUMBER);
171 runCmd(IP_PATH, cmd);
181 int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
184 snprintf(cmd, sizeof(cmd),
185 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
188 if (runCmd(IPTABLES_PATH, cmd) && add) {
192 snprintf(cmd, sizeof(cmd),
193 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
196 if (runCmd(IPTABLES_PATH, cmd) && add) {
197 // bail on error, but only if adding
198 snprintf(cmd, sizeof(cmd),
199 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
202 runCmd(IPTABLES_PATH, cmd);
206 snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
208 if (runCmd(IPTABLES_PATH, cmd) && add) {
209 // unwind what's been done, but don't care about success - what more could we do?
210 snprintf(cmd, sizeof(cmd),
211 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
214 runCmd(IPTABLES_PATH, cmd);
216 snprintf(cmd, sizeof(cmd),
217 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
220 runCmd(IPTABLES_PATH, cmd);
226 // nat disable intface extface
228 // nat enable intface extface addrcnt nated-ipaddr/prelength
229 int NatController::disableNat(const int argc, char **argv) {
232 int addrCount = atoi(argv[4]);
233 const char *intIface = argv[2];
234 const char *extIface = argv[3];
237 if (!checkInterface(intIface) || !checkInterface(extIface)) {
238 LOGE("Invalid interface specified");
243 if (argc < 5 + addrCount) {
244 LOGE("Missing Argument");
249 setForwardRules(false, intIface, extIface);
251 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
252 if (tableNumber != -1) {
253 for (i = 0; i < addrCount; i++) {
254 snprintf(cmd, sizeof(cmd), "route del %s dev %s table %d", argv[5+i], intIface,
255 tableNumber + BASE_TABLE_NUMBER);
256 // if the interface has gone down these will be gone already and give errors
258 runCmd(IP_PATH, cmd);
260 snprintf(cmd, sizeof(cmd), "%s rule del from %s table %d", getVersion(argv[5+i]),
261 argv[5+i], tableNumber + BASE_TABLE_NUMBER);
262 runCmd(IP_PATH, cmd);
265 runCmd(IP_PATH, "route flush cache");
268 if (--natCount <= 0) {
269 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0