From cade04a80ac91d7a4d9ea839fec75aff3f932651 Mon Sep 17 00:00:00 2001 From: cyberta Date: Sat, 25 Jan 2020 11:20:48 -0600 Subject: implement tethering firewall rules pt.1 --- .../firewall/ConfigureTetheringTask.java | 95 ++++++++++++++++++++++ .../bitmaskclient/firewall/FirewallCallback.java | 1 + .../bitmaskclient/firewall/FirewallManager.java | 11 +++ 3 files changed, 107 insertions(+) create mode 100644 app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java (limited to 'app/src/main/java/se/leap/bitmaskclient/firewall') diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java b/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java new file mode 100644 index 00000000..29e9542d --- /dev/null +++ b/app/src/main/java/se/leap/bitmaskclient/firewall/ConfigureTetheringTask.java @@ -0,0 +1,95 @@ +package se.leap.bitmaskclient.firewall; + +import android.os.AsyncTask; +import android.util.Log; + +import java.lang.ref.WeakReference; + +import se.leap.bitmaskclient.tethering.TetheringState; + +import static se.leap.bitmaskclient.firewall.FirewallManager.BITMASK_FORWARD; +import static se.leap.bitmaskclient.firewall.FirewallManager.BITMASK_POSTROUTING; +import static se.leap.bitmaskclient.utils.Cmd.runBlockingCmd; + +public class ConfigureTetheringTask extends AsyncTask { + + private WeakReference callbackWeakReference; + + ConfigureTetheringTask(FirewallCallback callback) { + callbackWeakReference = new WeakReference<>(callback); + } + + @Override + protected Boolean doInBackground(TetheringState... tetheringStates) { + TetheringState tetheringState = tetheringStates[0]; + StringBuilder log = new StringBuilder(); + + String[] bitmaskChain = new String[]{ + "su", + "id", + "iptables --list " + BITMASK_FORWARD + " && iptables --list " + BITMASK_POSTROUTING }; + + try { + boolean hasBitmaskChain = runBlockingCmd(bitmaskChain, log) == 0; + boolean allowSu = log.toString().contains("uid=0"); + callbackWeakReference.get().onSuRequested(allowSu); + if (!allowSu) { + return false; + } + + boolean success; + log = new StringBuilder(); + if (hasAnyTetheringEnabled(tetheringState)) { + if (!hasBitmaskChain) { + String[] createChains = new String[]{ + "su", + "iptables -t filter --new-chain " + BITMASK_FORWARD, + "iptables -t nat --new-chain " + BITMASK_POSTROUTING, + "iptables -t filter --insert FORWARD --jump " + BITMASK_FORWARD, + "iptables -t nat --insert POSTROUTING --jump " + BITMASK_POSTROUTING, + }; + success = runBlockingCmd(createChains, log) == 0; + Log.d(FirewallManager.TAG, "added " + BITMASK_FORWARD + " and " + BITMASK_POSTROUTING+" to iptables: " + success); + Log.d(FirewallManager.TAG, log.toString()); + } + + String[] addRules = new String[] { + "su", + "iptables -t filter --flush " + BITMASK_FORWARD, + "iptables -t nat --flush " + BITMASK_POSTROUTING, + "iptables -t filter --append " + BITMASK_FORWARD + " --jump ACCEPT", + "iptables -t nat --append " + BITMASK_POSTROUTING + " --jump MASQUERADE" }; + return runBlockingCmd(addRules, log) == 0; + } else { + if (!hasBitmaskChain) return true; + String[] removeChains = new String[] { + "su", + "iptables -t filter --delete FORWARD --jump " + BITMASK_FORWARD, + "iptables -t nat --delete POSTROUTING --jump " + BITMASK_POSTROUTING, + "iptables -t filter --flush " + BITMASK_FORWARD, + "iptables -t nat --flush " + BITMASK_POSTROUTING, + "iptables -t filter --delete-chain " + BITMASK_FORWARD, + "iptables -t nat --delete-chain " + BITMASK_POSTROUTING + }; + return runBlockingCmd(removeChains, log) == 0; + } + } catch (Exception e) { + e.printStackTrace(); + Log.e(FirewallManager.TAG, log.toString()); + } + return false; + } + + @Override + protected void onPostExecute(Boolean result) { + super.onPostExecute(result); + FirewallCallback callback = callbackWeakReference.get(); + if (callback != null) { + callback.onTetheringConfigured(result); + } + } + + private boolean hasAnyTetheringEnabled(TetheringState state) { + return state.isBluetoothTetheringEnabled || state.isUsbTetheringEnabled || state.isWifiTetheringEnabled; + } +} diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java index f6ccd227..76618b8c 100644 --- a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java +++ b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallCallback.java @@ -3,5 +3,6 @@ package se.leap.bitmaskclient.firewall; interface FirewallCallback { void onFirewallStarted(boolean success); void onFirewallStopped(boolean success); + void onTetheringConfigured(boolean success); void onSuRequested(boolean success); } diff --git a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java index a3be46e6..a7cb2253 100644 --- a/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java +++ b/app/src/main/java/se/leap/bitmaskclient/firewall/FirewallManager.java @@ -24,6 +24,8 @@ import se.leap.bitmaskclient.utils.PreferenceHelper; public class FirewallManager implements FirewallCallback { public static String BITMASK_CHAIN = "bitmask_fw"; + public static String BITMASK_FORWARD = "bitmask_forward"; + public static String BITMASK_POSTROUTING = "bitmask_postrouting"; static final String TAG = FirewallManager.class.getSimpleName(); private Context context; @@ -51,6 +53,15 @@ public class FirewallManager implements FirewallCallback { } } + @Override + public void onTetheringConfigured(boolean success) { + if (success) { + VpnStatus.logInfo("[FIREWALL] Rules for tethering configured"); + } else { + VpnStatus.logError("[FIREWALL] Could not establish rules for tethering "); + } + } + @Override public void onSuRequested(boolean success) { PreferenceHelper.setSuPermission(context, success); -- cgit v1.2.3