1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef _FIREWALL_CONTROLLER_H
18#define _FIREWALL_CONTROLLER_H
19
20#include <string>
21
22enum FirewallRule { DENY, ALLOW };
23
24// WHITELIST means the firewall denies all by default, uids must be explicitly ALLOWed
25// BLACKLIST means the firewall allows all by default, uids must be explicitly DENYed
26
27enum FirewallType { WHITELIST, BLACKLIST };
28
29enum ChildChain { NONE, DOZABLE, STANDBY, INVALID_CHAIN };
30
31#define PROTOCOL_TCP 6
32#define PROTOCOL_UDP 17
33
34/*
35 * Simple firewall that drops all packets except those matching explicitly
36 * defined ALLOW rules.
37 */
38class FirewallController {
39public:
40    FirewallController();
41
42    int setupIptablesHooks(void);
43
44    int enableFirewall(FirewallType);
45    int disableFirewall(void);
46    int isFirewallEnabled(void);
47
48    /* Match traffic going in/out over the given iface. */
49    int setInterfaceRule(const char*, FirewallRule);
50    /* Match traffic coming-in-to or going-out-from given address. */
51    int setEgressSourceRule(const char*, FirewallRule);
52    /* Match traffic coming-in-from or going-out-to given address, port, and protocol. */
53    int setEgressDestRule(const char*, int, int, FirewallRule);
54    /* Match traffic owned by given UID. This is specific to a particular chain. */
55    int setUidRule(ChildChain, int, FirewallRule);
56
57    int enableChildChains(ChildChain, bool);
58
59    static const char* TABLE;
60
61    static const char* LOCAL_INPUT;
62    static const char* LOCAL_OUTPUT;
63    static const char* LOCAL_FORWARD;
64
65    static const char* LOCAL_DOZABLE;
66    static const char* LOCAL_STANDBY;
67
68    static const char* ICMPV6_TYPES[];
69
70private:
71    FirewallType mFirewallType;
72    int attachChain(const char*, const char*);
73    int detachChain(const char*, const char*);
74    int createChain(const char*, const char*, FirewallType);
75    FirewallType getFirewallType(ChildChain);
76};
77
78#endif
79