2 * Copyright (C) 2012 The Android Open Source Project
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
22 #define LOG_TAG "FirewallController"
25 #include <cutils/log.h>
27 #include "NetdConstants.h"
28 #include "FirewallController.h"
30 const char* FirewallController::LOCAL_INPUT = "fw_INPUT";
31 const char* FirewallController::LOCAL_OUTPUT = "fw_OUTPUT";
32 const char* FirewallController::LOCAL_FORWARD = "fw_FORWARD";
34 FirewallController::FirewallController(void) {
37 int FirewallController::setupIptablesHooks(void) {
41 int FirewallController::enableFirewall(void) {
44 // flush any existing rules
47 // create default rule to drop all traffic
48 res |= execIptables(V4V6, "-A", LOCAL_INPUT, "-j", "DROP", NULL);
49 res |= execIptables(V4V6, "-A", LOCAL_OUTPUT, "-j", "REJECT", NULL);
50 res |= execIptables(V4V6, "-A", LOCAL_FORWARD, "-j", "REJECT", NULL);
55 int FirewallController::disableFirewall(void) {
58 // flush any existing rules
59 res |= execIptables(V4V6, "-F", LOCAL_INPUT, NULL);
60 res |= execIptables(V4V6, "-F", LOCAL_OUTPUT, NULL);
61 res |= execIptables(V4V6, "-F", LOCAL_FORWARD, NULL);
66 int FirewallController::isFirewallEnabled(void) {
67 // TODO: verify that rules are still in place near top
71 int FirewallController::setInterfaceRule(const char* iface, FirewallRule rule) {
72 if (!isIfaceName(iface)) {
85 res |= execIptables(V4V6, op, LOCAL_INPUT, "-i", iface, "-j", "RETURN", NULL);
86 res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-o", iface, "-j", "RETURN", NULL);
90 int FirewallController::setEgressSourceRule(const char* addr, FirewallRule rule) {
91 IptablesTarget target = V4;
92 if (strchr(addr, ':')) {
104 res |= execIptables(target, op, LOCAL_INPUT, "-d", addr, "-j", "RETURN", NULL);
105 res |= execIptables(target, op, LOCAL_OUTPUT, "-s", addr, "-j", "RETURN", NULL);
109 int FirewallController::setEgressDestRule(const char* addr, int protocol, int port,
111 IptablesTarget target = V4;
112 if (strchr(addr, ':')) {
116 char protocolStr[16];
117 sprintf(protocolStr, "%d", protocol);
120 sprintf(portStr, "%d", port);
130 res |= execIptables(target, op, LOCAL_INPUT, "-s", addr, "-p", protocolStr,
131 "--sport", portStr, "-j", "RETURN", NULL);
132 res |= execIptables(target, op, LOCAL_OUTPUT, "-d", addr, "-p", protocolStr,
133 "--dport", portStr, "-j", "RETURN", NULL);
137 int FirewallController::setUidRule(int uid, FirewallRule rule) {
139 sprintf(uidStr, "%d", uid);
149 res |= execIptables(V4V6, op, LOCAL_INPUT, "-m", "owner", "--uid-owner", uidStr,
150 "-j", "RETURN", NULL);
151 res |= execIptables(V4V6, op, LOCAL_OUTPUT, "-m", "owner", "--uid-owner", uidStr,
152 "-j", "RETURN", NULL);