1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef _FIREWALL_CONTROLLER_H
18 #define _FIREWALL_CONTROLLER_H
19 
20 #include <sys/types.h>
21 #include <mutex>
22 #include <set>
23 #include <string>
24 #include <vector>
25 
26 #include "android/net/INetd.h"
27 
28 #include "NetdConstants.h"
29 #include "bpf/BpfUtils.h"
30 
31 namespace android {
32 namespace net {
33 
34 enum FirewallRule { ALLOW = INetd::FIREWALL_RULE_ALLOW, DENY = INetd::FIREWALL_RULE_DENY };
35 
36 // ALLOWLIST means the firewall denies all by default, uids must be explicitly ALLOWed
37 // DENYLIST means the firewall allows all by default, uids must be explicitly DENYed
38 
39 enum FirewallType { ALLOWLIST = INetd::FIREWALL_WHITELIST, DENYLIST = INetd::FIREWALL_BLACKLIST };
40 
41 enum ChildChain {
42     NONE = INetd::FIREWALL_CHAIN_NONE,
43     DOZABLE = INetd::FIREWALL_CHAIN_DOZABLE,
44     STANDBY = INetd::FIREWALL_CHAIN_STANDBY,
45     POWERSAVE = INetd::FIREWALL_CHAIN_POWERSAVE,
46     INVALID_CHAIN
47 };
48 
49 /*
50  * Simple firewall that drops all packets except those matching explicitly
51  * defined ALLOW rules.
52  *
53  * Methods in this class must be called when holding a write lock on |lock|, and may not call
54  * any other controller without explicitly managing that controller's lock. There are currently
55  * no such methods.
56  */
57 class FirewallController {
58 public:
59     FirewallController();
60 
61     int setupIptablesHooks(void);
62 
63     int setFirewallType(FirewallType);
64     int resetFirewall(void);
65     int isFirewallEnabled(void);
66 
67     /* Match traffic going in/out over the given iface. */
68     int setInterfaceRule(const char*, FirewallRule);
69     /* Match traffic owned by given UID. This is specific to a particular chain. */
70     int setUidRule(ChildChain, int, FirewallRule);
71 
72     int enableChildChains(ChildChain, bool);
73 
74     int replaceUidChain(const std::string&, bool, const std::vector<int32_t>&);
75 
76     static std::string makeCriticalCommands(IptablesTarget target, const char* chainName);
77     static uid_t discoverMaximumValidUid(const std::string& fileName);
78 
79     static const char* TABLE;
80 
81     static const char* LOCAL_INPUT;
82     static const char* LOCAL_OUTPUT;
83     static const char* LOCAL_FORWARD;
84 
85     static const char* LOCAL_DOZABLE;
86     static const char* LOCAL_STANDBY;
87     static const char* LOCAL_POWERSAVE;
88 
89     static const char* ICMPV6_TYPES[];
90 
91     std::mutex lock;
92 
93 protected:
94     friend class FirewallControllerTest;
95     std::string makeUidRules(IptablesTarget target, const char* name, bool isAllowlist,
96                              const std::vector<int32_t>& uids);
97     static int (*execIptablesRestore)(IptablesTarget target, const std::string& commands);
98 
99 private:
100   // Netd supports two cases, in both of which mMaxUid that derives from the uid mapping is const:
101   //  - netd runs in a root namespace which contains all UIDs.
102   //  - netd runs in a user namespace where the uid mapping is written once before netd starts.
103   //    In that case, an attempt to write more than once to a uid_map file in a user namespace
104   //    fails with EPERM. Netd can therefore assumes the max valid uid to be const.
105   const uid_t mMaxUid;
106   FirewallType mFirewallType;
107   bool mUseBpfOwnerMatch;
108   std::set<std::string> mIfaceRules;
109   int attachChain(const char*, const char*);
110   int detachChain(const char*, const char*);
111   int createChain(const char*, FirewallType);
112   FirewallType getFirewallType(ChildChain);
113 };
114 
115 }  // namespace net
116 }  // namespace android
117 
118 #endif
119