2 * Copyright (C) 2008 The Android Open Source Project
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
19 #include <sys/socket.h>
22 #include <netinet/in.h>
23 #include <arpa/inet.h>
25 #include <cutils/properties.h>
27 #define LOG_TAG "NatController"
28 #include <cutils/log.h>
30 #include "NatController.h"
31 #include "SecondaryTableController.h"
32 #include "oem_iptables_hook.h"
33 #include "NetdConstants.h"
35 extern "C" int system_nosh(const char *command);
37 NatController::NatController(SecondaryTableController *ctrl) {
38 secondaryTableCtrl = ctrl;
42 NatController::~NatController() {
45 int NatController::runCmd(const char *path, const char *cmd) {
47 size_t len = strnlen(cmd, 255);
51 ALOGE("command too long");
56 asprintf(&buffer, "%s %s", path, cmd);
57 res = system_nosh(buffer);
62 int NatController::setDefaults() {
64 if (runCmd(IPTABLES_PATH, "-P INPUT ACCEPT"))
66 if (runCmd(IPTABLES_PATH, "-P OUTPUT ACCEPT"))
68 if (runCmd(IPTABLES_PATH, "-P FORWARD DROP"))
70 if (runCmd(IPTABLES_PATH, "-F FORWARD"))
72 if (runCmd(IPTABLES_PATH, "-t nat -F"))
75 runCmd(IP_PATH, "rule flush");
76 runCmd(IP_PATH, "-6 rule flush");
77 runCmd(IP_PATH, "rule add from all lookup default prio 32767");
78 runCmd(IP_PATH, "rule add from all lookup main prio 32766");
79 runCmd(IP_PATH, "-6 rule add from all lookup default prio 32767");
80 runCmd(IP_PATH, "-6 rule add from all lookup main prio 32766");
81 runCmd(IP_PATH, "route flush cache");
85 setupOemIptablesHook();
89 bool NatController::checkInterface(const char *iface) {
90 if (strlen(iface) > MAX_IFACE_LENGTH) return false;
95 // nat enable intface extface addrcnt nated-ipaddr/prelength
96 int NatController::enableNat(const int argc, char **argv) {
99 int addrCount = atoi(argv[4]);
101 const char *intIface = argv[2];
102 const char *extIface = argv[3];
105 if (!checkInterface(intIface) || !checkInterface(extIface)) {
106 ALOGE("Invalid interface specified");
111 if (argc < 5 + addrCount) {
112 ALOGE("Missing Argument");
117 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
118 if (tableNumber != -1) {
119 for(i = 0; i < addrCount; i++) {
120 ret |= secondaryTableCtrl->modifyFromRule(tableNumber, ADD, argv[5+i]);
122 ret |= secondaryTableCtrl->modifyLocalRoute(tableNumber, ADD, intIface, argv[5+i]);
124 runCmd(IP_PATH, "route flush cache");
127 if (ret != 0 || setForwardRules(true, intIface, extIface) != 0) {
128 if (tableNumber != -1) {
129 for (i = 0; i < addrCount; i++) {
130 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
132 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
134 runCmd(IP_PATH, "route flush cache");
136 ALOGE("Error setting forward rules");
142 // add this if we are the first added nat
144 snprintf(cmd, sizeof(cmd), "-t nat -A POSTROUTING -o %s -j MASQUERADE", extIface);
145 if (runCmd(IPTABLES_PATH, cmd)) {
146 ALOGE("Error seting postroute rule: %s", cmd);
147 // unwind what's been done, but don't care about success - what more could we do?
148 for (i = 0; i < addrCount; i++) {
149 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
151 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
161 int NatController::setForwardRules(bool add, const char *intIface, const char * extIface) {
164 snprintf(cmd, sizeof(cmd),
165 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
168 if (runCmd(IPTABLES_PATH, cmd) && add) {
172 snprintf(cmd, sizeof(cmd),
173 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
176 if (runCmd(IPTABLES_PATH, cmd) && add) {
177 // bail on error, but only if adding
178 snprintf(cmd, sizeof(cmd),
179 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
182 runCmd(IPTABLES_PATH, cmd);
186 snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
188 if (runCmd(IPTABLES_PATH, cmd) && add) {
189 // unwind what's been done, but don't care about success - what more could we do?
190 snprintf(cmd, sizeof(cmd),
191 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
194 runCmd(IPTABLES_PATH, cmd);
196 snprintf(cmd, sizeof(cmd),
197 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
200 runCmd(IPTABLES_PATH, cmd);
206 // nat disable intface extface
208 // nat enable intface extface addrcnt nated-ipaddr/prelength
209 int NatController::disableNat(const int argc, char **argv) {
212 int addrCount = atoi(argv[4]);
213 const char *intIface = argv[2];
214 const char *extIface = argv[3];
217 if (!checkInterface(intIface) || !checkInterface(extIface)) {
218 ALOGE("Invalid interface specified");
223 if (argc < 5 + addrCount) {
224 ALOGE("Missing Argument");
229 setForwardRules(false, intIface, extIface);
231 tableNumber = secondaryTableCtrl->findTableNumber(extIface);
232 if (tableNumber != -1) {
233 for (i = 0; i < addrCount; i++) {
234 secondaryTableCtrl->modifyLocalRoute(tableNumber, DEL, intIface, argv[5+i]);
236 secondaryTableCtrl->modifyFromRule(tableNumber, DEL, argv[5+i]);
239 runCmd(IP_PATH, "route flush cache");
242 if (--natCount <= 0) {
243 // handle decrement to 0 case (do reset to defaults) and erroneous dec below 0