blob: b3571d194fb821be23918d664a6f778c26b8bf33 [file] [log] [blame]
Jeff Sharkeyd8c64022012-07-13 18:04:07 -07001/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <errno.h>
18#include <stdio.h>
19#include <stdlib.h>
20#include <string.h>
21
22#define LOG_TAG "FirewallController"
23#define LOG_NDEBUG 0
24
25#include <cutils/log.h>
26
27#include "NetdConstants.h"
28#include "FirewallController.h"
29
30const char* FirewallController::LOCAL_INPUT = "fw_INPUT";
31const char* FirewallController::LOCAL_OUTPUT = "fw_OUTPUT";
32const char* FirewallController::LOCAL_FORWARD = "fw_FORWARD";
33
34FirewallController::FirewallController(void) {
35}
36
37int FirewallController::setupIptablesHooks(void) {
38 return 0;
39}
40
41int FirewallController::enableFirewall(void) {
42 int res = 0;
43
44 // flush any existing rules
45 disableFirewall();
46
47 // create default rule to drop all traffic
Nilesh Poddarfb31c222014-12-19 10:43:30 -080048 res |= execIptables(V4V6, "-w", "-A", LOCAL_INPUT, "-j", "DROP", NULL);
49 res |= execIptables(V4V6, "-w", "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
50 res |= execIptables(V4V6, "-w", "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
Jeff Sharkeyd8c64022012-07-13 18:04:07 -070051
52 return res;
53}
54
55int FirewallController::disableFirewall(void) {
56 int res = 0;
57
58 // flush any existing rules
Nilesh Poddarfb31c222014-12-19 10:43:30 -080059 res |= execIptables(V4V6, "-w", "-F", LOCAL_INPUT, NULL);
60 res |= execIptables(V4V6, "-w", "-F", LOCAL_OUTPUT, NULL);
61 res |= execIptables(V4V6, "-w", "-F", LOCAL_FORWARD, NULL);
Jeff Sharkeyd8c64022012-07-13 18:04:07 -070062
63 return res;
64}
65
66int FirewallController::isFirewallEnabled(void) {
67 // TODO: verify that rules are still in place near top
68 return -1;
69}
70
71int FirewallController::setInterfaceRule(const char* iface, FirewallRule rule) {
JP Abgrall69261cb2014-06-19 18:35:24 -070072 if (!isIfaceName(iface)) {
73 errno = ENOENT;
74 return -1;
75 }
76
Jeff Sharkeyd8c64022012-07-13 18:04:07 -070077 const char* op;
78 if (rule == ALLOW) {
79 op = "-I";
80 } else {
81 op = "-D";
82 }
83
84 int res = 0;
Nilesh Poddarfb31c222014-12-19 10:43:30 -080085 res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
86 res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
Jeff Sharkeyd8c64022012-07-13 18:04:07 -070087 return res;
88}
89
90int FirewallController::setEgressSourceRule(const char* addr, FirewallRule rule) {
91 IptablesTarget target = V4;
92 if (strchr(addr, ':')) {
93 target = V6;
94 }
95
96 const char* op;
97 if (rule == ALLOW) {
98 op = "-I";
99 } else {
100 op = "-D";
101 }
102
103 int res = 0;
Nilesh Poddarfb31c222014-12-19 10:43:30 -0800104 res |= execIptables(target, "-w", op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
105 res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
Jeff Sharkeyd8c64022012-07-13 18:04:07 -0700106 return res;
107}
108
109int FirewallController::setEgressDestRule(const char* addr, int protocol, int port,
110 FirewallRule rule) {
111 IptablesTarget target = V4;
112 if (strchr(addr, ':')) {
113 target = V6;
114 }
115
116 char protocolStr[16];
117 sprintf(protocolStr, "%d", protocol);
118
119 char portStr[16];
120 sprintf(portStr, "%d", port);
121
122 const char* op;
123 if (rule == ALLOW) {
124 op = "-I";
125 } else {
126 op = "-D";
127 }
128
129 int res = 0;
Nilesh Poddarfb31c222014-12-19 10:43:30 -0800130 res |= execIptables(target, "-w", op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
Jeff Sharkeyd8c64022012-07-13 18:04:07 -0700131 "--sport", portStr, "-j", "RETURN", NULL);
Nilesh Poddarfb31c222014-12-19 10:43:30 -0800132 res |= execIptables(target, "-w", op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
Jeff Sharkeyd8c64022012-07-13 18:04:07 -0700133 "--dport", portStr, "-j", "RETURN", NULL);
134 return res;
135}
136
137int FirewallController::setUidRule(int uid, FirewallRule rule) {
138 char uidStr[16];
139 sprintf(uidStr, "%d", uid);
140
141 const char* op;
142 if (rule == ALLOW) {
143 op = "-I";
144 } else {
145 op = "-D";
146 }
147
148 int res = 0;
Nilesh Poddarfb31c222014-12-19 10:43:30 -0800149 res |= execIptables(V4V6, "-w", op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
Jeff Sharkeyd8c64022012-07-13 18:04:07 -0700150 "-j", "RETURN", NULL);
Nilesh Poddarfb31c222014-12-19 10:43:30 -0800151 res |= execIptables(V4V6, "-w", op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
Jeff Sharkeyd8c64022012-07-13 18:04:07 -0700152 "-j", "RETURN", NULL);
153 return res;
154}