1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef _FIREWALL_CONTROLLER_H 18 #define _FIREWALL_CONTROLLER_H 19 20 #include <sys/types.h> 21 #include <mutex> 22 #include <set> 23 #include <string> 24 #include <vector> 25 26 #include "android/net/INetd.h" 27 28 #include "NetdConstants.h" 29 #include "bpf/BpfUtils.h" 30 31 namespace android { 32 namespace net { 33 34 enum FirewallRule { ALLOW = INetd::FIREWALL_RULE_ALLOW, DENY = INetd::FIREWALL_RULE_DENY }; 35 36 // ALLOWLIST means the firewall denies all by default, uids must be explicitly ALLOWed 37 // DENYLIST means the firewall allows all by default, uids must be explicitly DENYed 38 39 enum FirewallType { ALLOWLIST = INetd::FIREWALL_ALLOWLIST, DENYLIST = INetd::FIREWALL_DENYLIST }; 40 41 enum ChildChain { 42 NONE = INetd::FIREWALL_CHAIN_NONE, 43 DOZABLE = INetd::FIREWALL_CHAIN_DOZABLE, 44 STANDBY = INetd::FIREWALL_CHAIN_STANDBY, 45 POWERSAVE = INetd::FIREWALL_CHAIN_POWERSAVE, 46 RESTRICTED = INetd::FIREWALL_CHAIN_RESTRICTED, 47 INVALID_CHAIN 48 }; 49 50 /* 51 * Simple firewall that drops all packets except those matching explicitly 52 * defined ALLOW rules. 53 * 54 * Methods in this class must be called when holding a write lock on |lock|, and may not call 55 * any other controller without explicitly managing that controller's lock. There are currently 56 * no such methods. 57 */ 58 class FirewallController { 59 public: 60 FirewallController(); 61 62 int setupIptablesHooks(void); 63 64 int setFirewallType(FirewallType); 65 int resetFirewall(void); 66 int isFirewallEnabled(void); 67 68 /* Match traffic going in/out over the given iface. */ 69 int setInterfaceRule(const char*, FirewallRule); 70 /* Match traffic owned by given UID. This is specific to a particular chain. */ 71 int setUidRule(ChildChain, int, FirewallRule); 72 73 int enableChildChains(ChildChain, bool); 74 75 int replaceUidChain(const std::string&, bool, const std::vector<int32_t>&); 76 77 static std::string makeCriticalCommands(IptablesTarget target, const char* chainName); 78 static uid_t discoverMaximumValidUid(const std::string& fileName); 79 80 static const char* TABLE; 81 82 static const char* LOCAL_INPUT; 83 static const char* LOCAL_OUTPUT; 84 static const char* LOCAL_FORWARD; 85 86 static const char* LOCAL_DOZABLE; 87 static const char* LOCAL_STANDBY; 88 static const char* LOCAL_POWERSAVE; 89 static const char* LOCAL_RESTRICTED; 90 91 static const char* ICMPV6_TYPES[]; 92 93 std::mutex lock; 94 95 protected: 96 friend class FirewallControllerTest; 97 std::string makeUidRules(IptablesTarget target, const char* name, bool isAllowlist, 98 const std::vector<int32_t>& uids); 99 static int (*execIptablesRestore)(IptablesTarget target, const std::string& commands); 100 101 private: 102 // Netd supports two cases, in both of which mMaxUid that derives from the uid mapping is const: 103 // - netd runs in a root namespace which contains all UIDs. 104 // - netd runs in a user namespace where the uid mapping is written once before netd starts. 105 // In that case, an attempt to write more than once to a uid_map file in a user namespace 106 // fails with EPERM. Netd can therefore assumes the max valid uid to be const. 107 const uid_t mMaxUid; 108 FirewallType mFirewallType; 109 bool mUseBpfOwnerMatch; 110 std::set<std::string> mIfaceRules; 111 int attachChain(const char*, const char*); 112 int detachChain(const char*, const char*); 113 int createChain(const char*, FirewallType); 114 FirewallType getFirewallType(ChildChain); 115 }; 116 117 } // namespace net 118 } // namespace android 119 120 #endif 121