summaryrefslogtreecommitdiff
path: root/app
diff options
context:
space:
mode:
authorcyberta <cyberta@riseup.net>2020-01-25 11:20:48 -0600
committercyberta <cyberta@riseup.net>2020-01-25 11:20:48 -0600
commitcade04a80ac91d7a4d9ea839fec75aff3f932651 (patch)
treec5982cc08de790096da4d7c0acada6e7c1201cb8 /app
parent0fe9d37a223b388103e2924e6d1a28bcb0ae38fd (diff)
implement tethering firewall rules pt.1
Diffstat (limited to 'app')
-rw-r--r--app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java95
-rw-r--r--app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java1
-rw-r--r--app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java11
-rw-r--r--app/src/main/java/se/leap/bitmaskclient/tethering/TetheringObservable.java24
-rw-r--r--app/src/main/java/se/leap/bitmaskclient/tethering/TetheringState.java7
5 files changed, 128 insertions, 10 deletions
diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java b/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java
new file mode 100644
index 00000000..29e9542d
--- /dev/null
+++ b/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java
@@ -0,0 +1,95 @@
+package se.leap.bitmaskclient.firewall;
+
+import android.os.AsyncTask;
+import android.util.Log;
+
+import java.lang.ref.WeakReference;
+
+import se.leap.bitmaskclient.tethering.TetheringState;
+
+import static se.leap.bitmaskclient.firewall.FirewallManager.BITMASK_FORWARD;
+import static se.leap.bitmaskclient.firewall.FirewallManager.BITMASK_POSTROUTING;
+import static se.leap.bitmaskclient.utils.Cmd.runBlockingCmd;
+
+public class ConfigureTetheringTask extends AsyncTask<TetheringState, Boolean, Boolean> {
+
+ private WeakReference<FirewallCallback> callbackWeakReference;
+
+ ConfigureTetheringTask(FirewallCallback callback) {
+ callbackWeakReference = new WeakReference<>(callback);
+ }
+
+ @Override
+ protected Boolean doInBackground(TetheringState... tetheringStates) {
+ TetheringState tetheringState = tetheringStates[0];
+ StringBuilder log = new StringBuilder();
+
+ String[] bitmaskChain = new String[]{
+ "su",
+ "id",
+ "iptables --list " + BITMASK_FORWARD + " && iptables --list " + BITMASK_POSTROUTING };
+
+ try {
+ boolean hasBitmaskChain = runBlockingCmd(bitmaskChain, log) == 0;
+ boolean allowSu = log.toString().contains("uid=0");
+ callbackWeakReference.get().onSuRequested(allowSu);
+ if (!allowSu) {
+ return false;
+ }
+
+ boolean success;
+ log = new StringBuilder();
+ if (hasAnyTetheringEnabled(tetheringState)) {
+ if (!hasBitmaskChain) {
+ String[] createChains = new String[]{
+ "su",
+ "iptables -t filter --new-chain " + BITMASK_FORWARD,
+ "iptables -t nat --new-chain " + BITMASK_POSTROUTING,
+ "iptables -t filter --insert FORWARD --jump " + BITMASK_FORWARD,
+ "iptables -t nat --insert POSTROUTING --jump " + BITMASK_POSTROUTING,
+ };
+ success = runBlockingCmd(createChains, log) == 0;
+ Log.d(FirewallManager.TAG, "added " + BITMASK_FORWARD + " and " + BITMASK_POSTROUTING+" to iptables: " + success);
+ Log.d(FirewallManager.TAG, log.toString());
+ }
+
+ String[] addRules = new String[] {
+ "su",
+ "iptables -t filter --flush " + BITMASK_FORWARD,
+ "iptables -t nat --flush " + BITMASK_POSTROUTING,
+ "iptables -t filter --append " + BITMASK_FORWARD + " --jump ACCEPT",
+ "iptables -t nat --append " + BITMASK_POSTROUTING + " --jump MASQUERADE" };
+ return runBlockingCmd(addRules, log) == 0;
+ } else {
+ if (!hasBitmaskChain) return true;
+ String[] removeChains = new String[] {
+ "su",
+ "iptables -t filter --delete FORWARD --jump " + BITMASK_FORWARD,
+ "iptables -t nat --delete POSTROUTING --jump " + BITMASK_POSTROUTING,
+ "iptables -t filter --flush " + BITMASK_FORWARD,
+ "iptables -t nat --flush " + BITMASK_POSTROUTING,
+ "iptables -t filter --delete-chain " + BITMASK_FORWARD,
+ "iptables -t nat --delete-chain " + BITMASK_POSTROUTING
+ };
+ return runBlockingCmd(removeChains, log) == 0;
+ }
+ } catch (Exception e) {
+ e.printStackTrace();
+ Log.e(FirewallManager.TAG, log.toString());
+ }
+ return false;
+ }
+
+ @Override
+ protected void onPostExecute(Boolean result) {
+ super.onPostExecute(result);
+ FirewallCallback callback = callbackWeakReference.get();
+ if (callback != null) {
+ callback.onTetheringConfigured(result);
+ }
+ }
+
+ private boolean hasAnyTetheringEnabled(TetheringState state) {
+ return state.isBluetoothTetheringEnabled || state.isUsbTetheringEnabled || state.isWifiTetheringEnabled;
+ }
+}
diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java
index f6ccd227..76618b8c 100644
--- a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java
+++ b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java
@@ -3,5 +3,6 @@ package se.leap.bitmaskclient.firewall;
interface FirewallCallback {
void onFirewallStarted(boolean success);
void onFirewallStopped(boolean success);
+ void onTetheringConfigured(boolean success);
void onSuRequested(boolean success);
}
diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java
index a3be46e6..a7cb2253 100644
--- a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java
+++ b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java
@@ -24,6 +24,8 @@ import se.leap.bitmaskclient.utils.PreferenceHelper;
public class FirewallManager implements FirewallCallback {
public static String BITMASK_CHAIN = "bitmask_fw";
+ public static String BITMASK_FORWARD = "bitmask_forward";
+ public static String BITMASK_POSTROUTING = "bitmask_postrouting";
static final String TAG = FirewallManager.class.getSimpleName();
private Context context;
@@ -52,6 +54,15 @@ public class FirewallManager implements FirewallCallback {
}
@Override
+ public void onTetheringConfigured(boolean success) {
+ if (success) {
+ VpnStatus.logInfo("[FIREWALL] Rules for tethering configured");
+ } else {
+ VpnStatus.logError("[FIREWALL] Could not establish rules for tethering ");
+ }
+ }
+
+ @Override
public void onSuRequested(boolean success) {
PreferenceHelper.setSuPermission(context, success);
if (!success) {
diff --git a/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringObservable.java b/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringObservable.java
index 9ea9160f..fc06ee12 100644
--- a/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringObservable.java
+++ b/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringObservable.java
@@ -21,11 +21,11 @@ import java.util.Observable;
public class TetheringObservable extends Observable {
private static TetheringObservable instance;
- private boolean isWifiTetheringEnabled;
- private boolean isUsbTetheringEnabled;
- private boolean isBluetoothTetheringEnabled;
+ private TetheringState tetheringState;
- private TetheringObservable() { }
+ private TetheringObservable() {
+ tetheringState = new TetheringState();
+ }
public static TetheringObservable getInstance() {
if (instance == null) {
@@ -35,32 +35,36 @@ public class TetheringObservable extends Observable {
}
static void setWifiTethering(boolean enabled) {
- getInstance().isWifiTetheringEnabled = enabled;
+ getInstance().tetheringState.isWifiTetheringEnabled = enabled;
getInstance().setChanged();
getInstance().notifyObservers();
}
static void setUsbTethering(boolean enabled) {
- getInstance().isUsbTetheringEnabled = enabled;
+ getInstance().tetheringState.isUsbTetheringEnabled = enabled;
getInstance().setChanged();
getInstance().notifyObservers();
}
static void setBluetoothTethering(boolean enabled) {
- getInstance().isBluetoothTetheringEnabled = enabled;
+ getInstance().tetheringState.isBluetoothTetheringEnabled = enabled;
getInstance().setChanged();
getInstance().notifyObservers();
}
public boolean isBluetoothTetheringEnabled() {
- return isBluetoothTetheringEnabled;
+ return tetheringState.isBluetoothTetheringEnabled;
}
public boolean isUsbTetheringEnabled() {
- return isUsbTetheringEnabled;
+ return tetheringState.isUsbTetheringEnabled;
}
public boolean isWifiTetheringEnabled() {
- return isWifiTetheringEnabled;
+ return tetheringState.isWifiTetheringEnabled;
+ }
+
+ public TetheringState getTetheringState() {
+ return tetheringState;
}
}
diff --git a/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringState.java b/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringState.java
new file mode 100644
index 00000000..50fead91
--- /dev/null
+++ b/app/src/main/java/se/leap/bitmaskclient/tethering/TetheringState.java
@@ -0,0 +1,7 @@
+package se.leap.bitmaskclient.tethering;
+
+public class TetheringState {
+ public boolean isWifiTetheringEnabled;
+ public boolean isUsbTetheringEnabled;
+ public boolean isBluetoothTetheringEnabled;
+}