1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef _FIREWALL_CONTROLLER_H 18 #define _FIREWALL_CONTROLLER_H 19 20 #include <string> 21 22 enum FirewallRule { DENY, ALLOW }; 23 24 // WHITELIST means the firewall denies all by default, uids must be explicitly ALLOWed 25 // BLACKLIST means the firewall allows all by default, uids must be explicitly DENYed 26 27 enum FirewallType { WHITELIST, BLACKLIST }; 28 29 enum ChildChain { NONE, DOZABLE, STANDBY, INVALID_CHAIN }; 30 31 #define PROTOCOL_TCP 6 32 #define PROTOCOL_UDP 17 33 34 /* 35 * Simple firewall that drops all packets except those matching explicitly 36 * defined ALLOW rules. 37 */ 38 class FirewallController { 39 public: 40 FirewallController(); 41 42 int setupIptablesHooks(void); 43 44 int enableFirewall(FirewallType); 45 int disableFirewall(void); 46 int isFirewallEnabled(void); 47 48 /* Match traffic going in/out over the given iface. */ 49 int setInterfaceRule(const char*, FirewallRule); 50 /* Match traffic coming-in-to or going-out-from given address. */ 51 int setEgressSourceRule(const char*, FirewallRule); 52 /* Match traffic coming-in-from or going-out-to given address, port, and protocol. */ 53 int setEgressDestRule(const char*, int, int, FirewallRule); 54 /* Match traffic owned by given UID. This is specific to a particular chain. */ 55 int setUidRule(ChildChain, int, FirewallRule); 56 57 int enableChildChains(ChildChain, bool); 58 59 static const char* TABLE; 60 61 static const char* LOCAL_INPUT; 62 static const char* LOCAL_OUTPUT; 63 static const char* LOCAL_FORWARD; 64 65 static const char* LOCAL_DOZABLE; 66 static const char* LOCAL_STANDBY; 67 68 static const char* ICMPV6_TYPES[]; 69 70 private: 71 FirewallType mFirewallType; 72 int attachChain(const char*, const char*); 73 int detachChain(const char*, const char*); 74 int createChain(const char*, const char*, FirewallType); 75 FirewallType getFirewallType(ChildChain); 76 }; 77 78 #endif 79