diff --git a/server/FirewallController.cpp b/server/FirewallController.cpp
index dc4fa36..26c2126 100644
--- a/server/FirewallController.cpp
+++ b/server/FirewallController.cpp
@@ -308,8 +308,8 @@
 }
 
 int FirewallController::replaceUidChain(
-        const char *name, bool isWhitelist, const std::vector<int32_t>& uids) {
-   std::string commands4 = makeUidRules(V4, name, isWhitelist, uids);
-   std::string commands6 = makeUidRules(V6, name, isWhitelist, uids);
+        const std::string &name, bool isWhitelist, const std::vector<int32_t>& uids) {
+   std::string commands4 = makeUidRules(V4, name.c_str(), isWhitelist, uids);
+   std::string commands6 = makeUidRules(V6, name.c_str(), isWhitelist, uids);
    return execIptablesRestore(V4, commands4.c_str()) | execIptablesRestore(V6, commands6.c_str());
 }
diff --git a/server/FirewallController.h b/server/FirewallController.h
index 1da9e70..c7928b9 100644
--- a/server/FirewallController.h
+++ b/server/FirewallController.h
@@ -34,9 +34,6 @@
 
 enum ChildChain { NONE, DOZABLE, STANDBY, POWERSAVE, INVALID_CHAIN };
 
-#define PROTOCOL_TCP 6
-#define PROTOCOL_UDP 17
-
 /*
  * Simple firewall that drops all packets except those matching explicitly
  * defined ALLOW rules.
@@ -62,7 +59,7 @@
 
     int enableChildChains(ChildChain, bool);
 
-    int replaceUidChain(const char*, bool, const std::vector<int32_t>&);
+    int replaceUidChain(const std::string&, bool, const std::vector<int32_t>&);
 
     static std::string makeCriticalCommands(IptablesTarget target, const char* chainName);
 
diff --git a/server/NetdNativeService.cpp b/server/NetdNativeService.cpp
index 31a87dc..a3dd980 100644
--- a/server/NetdNativeService.cpp
+++ b/server/NetdNativeService.cpp
@@ -153,12 +153,11 @@
     return binder::Status::ok();
 }
 
-binder::Status NetdNativeService::firewallReplaceUidChain(const android::String16& chainName,
+binder::Status NetdNativeService::firewallReplaceUidChain(const std::string& chainName,
         bool isWhitelist, const std::vector<int32_t>& uids, bool *ret) {
     NETD_LOCKING_RPC(CONNECTIVITY_INTERNAL, gCtls->firewallCtrl.lock);
 
-    android::String8 name = android::String8(chainName);
-    int err = gCtls->firewallCtrl.replaceUidChain(name.string(), isWhitelist, uids);
+    int err = gCtls->firewallCtrl.replaceUidChain(chainName, isWhitelist, uids);
     *ret = (err == 0);
     return binder::Status::ok();
 }
diff --git a/server/NetdNativeService.h b/server/NetdNativeService.h
index 2f6cb80..c90ff94 100644
--- a/server/NetdNativeService.h
+++ b/server/NetdNativeService.h
@@ -37,7 +37,7 @@
 
     // Firewall commands.
     binder::Status firewallReplaceUidChain(
-            const String16& chainName, bool isWhitelist,
+            const std::string& chainName, bool isWhitelist,
             const std::vector<int32_t>& uids, bool *ret) override;
 
     // Bandwidth control commands.
diff --git a/server/binder/android/net/INetd.aidl b/server/binder/android/net/INetd.aidl
index 5c9e8a4..13dc9e4 100644
--- a/server/binder/android/net/INetd.aidl
+++ b/server/binder/android/net/INetd.aidl
@@ -39,7 +39,9 @@
      * @param uids The list of UIDs to allow/deny.
      * @return true if the chain was successfully replaced, false otherwise.
      */
-    boolean firewallReplaceUidChain(String chainName, boolean isWhitelist, in int[] uids);
+    boolean firewallReplaceUidChain(in @utf8InCpp String chainName,
+                                    boolean isWhitelist,
+                                    in int[] uids);
 
     /**
      * Enables or disables data saver mode on costly network interfaces.
@@ -73,7 +75,7 @@
      * @throws ServiceSpecificException in case of failure, with an error code corresponding to the
      *         unix errno.
      */
-    void networkCreatePhysical(int netId, @utf8InCpp String permission);
+    void networkCreatePhysical(int netId, in @utf8InCpp String permission);
 
     /**
      * Creates a VPN network.
diff --git a/tests/binder_test.cpp b/tests/binder_test.cpp
index 6f87745..c26705e 100644
--- a/tests/binder_test.cpp
+++ b/tests/binder_test.cpp
@@ -204,7 +204,7 @@
     bool ret;
     {
         TimedOperation op(StringPrintf("Programming %d-UID whitelist chain", kNumUids));
-        mNetd->firewallReplaceUidChain(String16(chainName.c_str()), true, uids, &ret);
+        mNetd->firewallReplaceUidChain(chainName, true, uids, &ret);
     }
     EXPECT_EQ(true, ret);
     EXPECT_EQ((int) uids.size() + 9, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str()));
@@ -213,7 +213,7 @@
     EXPECT_EQ(true, iptablesEspAllowRuleExists(chainName.c_str()));
     {
         TimedOperation op("Clearing whitelist chain");
-        mNetd->firewallReplaceUidChain(String16(chainName.c_str()), false, noUids, &ret);
+        mNetd->firewallReplaceUidChain(chainName, false, noUids, &ret);
     }
     EXPECT_EQ(true, ret);
     EXPECT_EQ(5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str()));
@@ -221,7 +221,7 @@
 
     {
         TimedOperation op(StringPrintf("Programming %d-UID blacklist chain", kNumUids));
-        mNetd->firewallReplaceUidChain(String16(chainName.c_str()), false, uids, &ret);
+        mNetd->firewallReplaceUidChain(chainName, false, uids, &ret);
     }
     EXPECT_EQ(true, ret);
     EXPECT_EQ((int) uids.size() + 5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str()));
@@ -231,7 +231,7 @@
 
     {
         TimedOperation op("Clearing blacklist chain");
-        mNetd->firewallReplaceUidChain(String16(chainName.c_str()), false, noUids, &ret);
+        mNetd->firewallReplaceUidChain(chainName, false, noUids, &ret);
     }
     EXPECT_EQ(true, ret);
     EXPECT_EQ(5, iptablesRuleLineLength(IPTABLES_PATH, chainName.c_str()));
@@ -239,7 +239,7 @@
 
     // Check that the call fails if iptables returns an error.
     std::string veryLongStringName = "netd_binder_test_UnacceptablyLongIptablesChainName";
-    mNetd->firewallReplaceUidChain(String16(veryLongStringName.c_str()), true, noUids, &ret);
+    mNetd->firewallReplaceUidChain(veryLongStringName, true, noUids, &ret);
     EXPECT_EQ(false, ret);
 }