1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef _FIREWALL_CONTROLLER_H
18 #define _FIREWALL_CONTROLLER_H
19 
20 #include <sys/types.h>
21 #include <mutex>
22 #include <set>
23 #include <string>
24 #include <vector>
25 
26 #include "android/net/INetd.h"
27 
28 #include "NetdConstants.h"
29 #include "bpf/BpfUtils.h"
30 
31 namespace android {
32 namespace net {
33 
34 enum FirewallRule { ALLOW = INetd::FIREWALL_RULE_ALLOW, DENY = INetd::FIREWALL_RULE_DENY };
35 
36 // ALLOWLIST means the firewall denies all by default, uids must be explicitly ALLOWed
37 // DENYLIST means the firewall allows all by default, uids must be explicitly DENYed
38 
39 enum FirewallType { ALLOWLIST = INetd::FIREWALL_ALLOWLIST, DENYLIST = INetd::FIREWALL_DENYLIST };
40 
41 enum ChildChain {
42     NONE = INetd::FIREWALL_CHAIN_NONE,
43     DOZABLE = INetd::FIREWALL_CHAIN_DOZABLE,
44     STANDBY = INetd::FIREWALL_CHAIN_STANDBY,
45     POWERSAVE = INetd::FIREWALL_CHAIN_POWERSAVE,
46     RESTRICTED = INetd::FIREWALL_CHAIN_RESTRICTED,
47     INVALID_CHAIN
48 };
49 
50 /*
51  * Simple firewall that drops all packets except those matching explicitly
52  * defined ALLOW rules.
53  *
54  * Methods in this class must be called when holding a write lock on |lock|, and may not call
55  * any other controller without explicitly managing that controller's lock. There are currently
56  * no such methods.
57  */
58 class FirewallController {
59 public:
60   FirewallController();
61 
62   int setupIptablesHooks(void);
63 
64   int setFirewallType(FirewallType);
65   int resetFirewall(void);
66   int isFirewallEnabled(void);
67 
68   /* Match traffic going in/out over the given iface. */
69   int setInterfaceRule(const char*, FirewallRule);
70   /* Match traffic owned by given UID. This is specific to a particular chain. */
71   int setUidRule(ChildChain, int, FirewallRule);
72 
73   int enableChildChains(ChildChain, bool);
74 
75   int replaceUidChain(const std::string&, bool, const std::vector<int32_t>&);
76 
77   static std::string makeCriticalCommands(IptablesTarget target, const char* chainName);
78   static uid_t discoverMaximumValidUid(const std::string& fileName);
79 
80   static const char* TABLE;
81 
82   static const char* LOCAL_INPUT;
83   static const char* LOCAL_OUTPUT;
84   static const char* LOCAL_FORWARD;
85 
86   static const char* LOCAL_DOZABLE;
87   static const char* LOCAL_STANDBY;
88   static const char* LOCAL_POWERSAVE;
89   static const char* LOCAL_RESTRICTED;
90 
91   static const char* ICMPV6_TYPES[];
92 
93   std::mutex lock;
94 
95 protected:
96   friend class FirewallControllerTest;
97   std::string makeUidRules(IptablesTarget target, const char* name, bool isAllowlist,
98                            const std::vector<int32_t>& uids);
99   static int (*execIptablesRestore)(IptablesTarget target, const std::string& commands);
100 
101 private:
102   // Netd supports two cases, in both of which mMaxUid that derives from the uid mapping is const:
103   //  - netd runs in a root namespace which contains all UIDs.
104   //  - netd runs in a user namespace where the uid mapping is written once before netd starts.
105   //    In that case, an attempt to write more than once to a uid_map file in a user namespace
106   //    fails with EPERM. Netd can therefore assumes the max valid uid to be const.
107   const uid_t mMaxUid;
108   FirewallType mFirewallType;
109   bool mUseBpfOwnerMatch;
110   std::set<std::string> mIfaceRules;
111   int flushRules(void);
112   int attachChain(const char*, const char*);
113   int detachChain(const char*, const char*);
114   int createChain(const char*, FirewallType);
115   FirewallType getFirewallType(ChildChain);
116 };
117 
118 }  // namespace net
119 }  // namespace android
120 
121 #endif
122