FirewallController.h revision d8c64026aaae5a9987151b719bd840ec7d68747a 
1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef _FIREWALL_CONTROLLER_H
18#define _FIREWALL_CONTROLLER_H
19
20#include <string>
21
22enum FirewallRule { ALLOW, DENY };
23
24#define PROTOCOL_TCP 6
25#define PROTOCOL_UDP 17
26
27/*
28 * Simple firewall that drops all packets except those matching explicitly
29 * defined ALLOW rules.
30 */
31class FirewallController {
32public:
33    FirewallController();
34
35    int setupIptablesHooks(void);
36
37    int enableFirewall(void);
38    int disableFirewall(void);
39    int isFirewallEnabled(void);
40
41    /* Match traffic going in/out over the given iface. */
42    int setInterfaceRule(const char*, FirewallRule);
43    /* Match traffic coming-in-to or going-out-from given address. */
44    int setEgressSourceRule(const char*, FirewallRule);
45    /* Match traffic coming-in-from or going-out-to given address, port, and protocol. */
46    int setEgressDestRule(const char*, int, int, FirewallRule);
47    /* Match traffic owned by given UID. */
48    int setUidRule(int, FirewallRule);
49
50    static const char* LOCAL_INPUT;
51    static const char* LOCAL_OUTPUT;
52    static const char* LOCAL_FORWARD;
53
54};
55
56#endif
57