Project import
diff --git a/firewalld/Android.mk b/firewalld/Android.mk
new file mode 100644
index 0000000..d0f44f4
--- /dev/null
+++ b/firewalld/Android.mk
@@ -0,0 +1,100 @@
+#
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+
+# Definitions applying to all targets. Be sure to $(eval) this last.
+define firewalld_common_cpp
+ LOCAL_CPP_EXTENSION := .cc
+ LOCAL_CLANG := true
+ LOCAL_CFLAGS += -Wall -Werror -Wno-unused-parameter
+ LOCAL_CPPFLAGS += -Wno-sign-promo
+endef
+
+# Definitions applying to all targets except the client library.
+# Be sure to $(eval) this last.
+define firewalld_common
+ LOCAL_SHARED_LIBRARIES += \
+ libbinder \
+ libbinderwrapper \
+ libbrillo \
+ libbrillo-binder \
+ libbrillo-dbus \
+ libbrillo-minijail \
+ libchrome \
+ libchrome-dbus \
+ libdbus \
+ libminijail \
+ libutils
+ $(eval $(firewalld_common_cpp))
+endef
+
+# === libfirewalld-client (shared library) ===
+include $(CLEAR_VARS)
+LOCAL_MODULE := libfirewalld-client
+LOCAL_SRC_FILES := \
+ dbus_bindings/dbus-service-config.json \
+ dbus_bindings/org.chromium.Firewalld.dbus-xml
+LOCAL_DBUS_PROXY_PREFIX := firewalld
+include $(BUILD_SHARED_LIBRARY)
+
+# === libfirewalld-binder-client (shared library) ===
+include $(CLEAR_VARS)
+LOCAL_MODULE := libfirewalld-binder-client
+LOCAL_SRC_FILES := \
+ binder_bindings/android/firewalld/IFirewall.aidl \
+ firewall_binder_client.cc
+LOCAL_SHARED_LIBRARIES := libutils libbinder libchrome
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
+LOCAL_CFLAGS += -I$(LOCAL_PATH)/include
+$(eval $(firewalld_common_cpp))
+include $(BUILD_SHARED_LIBRARY)
+
+# === libfirewalld (static library) ===
+include $(CLEAR_VARS)
+LOCAL_MODULE := libfirewalld
+LOCAL_SRC_FILES := \
+ dbus_bindings/dbus-service-config.json \
+ dbus_bindings/org.chromium.Firewalld.dbus-xml \
+ binder_bindings/android/firewalld/IFirewall.aidl \
+ binder_interface.cc \
+ firewall_daemon.cc \
+ firewall_service.cc \
+ iptables.cc
+$(eval $(firewalld_common))
+include $(BUILD_STATIC_LIBRARY)
+
+# === firewalld ===
+include $(CLEAR_VARS)
+LOCAL_MODULE := firewalld
+LOCAL_INIT_RC := firewalld.rc
+LOCAL_SRC_FILES := \
+ main.cc
+LOCAL_STATIC_LIBRARIES := libfirewalld
+$(eval $(firewalld_common))
+include $(BUILD_EXECUTABLE)
+
+# === unittest ===
+include $(CLEAR_VARS)
+LOCAL_MODULE := firewalld_unittest
+LOCAL_SRC_FILES := \
+ iptables_unittest.cc \
+ mock_iptables.cc \
+ run_all_tests.cc
+LOCAL_STATIC_LIBRARIES := libfirewalld libgmock
+$(eval $(firewalld_common))
+include $(BUILD_NATIVE_TEST)
diff --git a/firewalld/MODULE_LICENSE_APACHE2 b/firewalld/MODULE_LICENSE_APACHE2
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/firewalld/MODULE_LICENSE_APACHE2
diff --git a/firewalld/NOTICE b/firewalld/NOTICE
new file mode 100644
index 0000000..a849a94
--- /dev/null
+++ b/firewalld/NOTICE
@@ -0,0 +1,190 @@
+
+ Copyright (c) 2014-2015, The Android Open Source Project
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
diff --git a/firewalld/OWNERS b/firewalld/OWNERS
new file mode 100644
index 0000000..14589ff
--- /dev/null
+++ b/firewalld/OWNERS
@@ -0,0 +1,2 @@
+jorgelo@chromium.org
+keescook@chromium.org
diff --git a/firewalld/binder_bindings/android/firewalld/IFirewall.aidl b/firewalld/binder_bindings/android/firewalld/IFirewall.aidl
new file mode 100644
index 0000000..45c58c4
--- /dev/null
+++ b/firewalld/binder_bindings/android/firewalld/IFirewall.aidl
@@ -0,0 +1,25 @@
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package android.firewalld;
+
+@utf8InCpp
+interface IFirewall {
+ void PunchTcpHole(int port, String iface);
+ void PunchUdpHole(int port, String iface);
+ void PlugTcpHole(int port, String iface);
+ void PlugUdpHole(int port, String iface);
+ void RequestVpnSetup(in String[] usernames, String iface);
+ void RemoveVpnSetup(in String[] usernames, String iface);
+}
diff --git a/firewalld/binder_interface.cc b/firewalld/binder_interface.cc
new file mode 100644
index 0000000..6205770
--- /dev/null
+++ b/firewalld/binder_interface.cc
@@ -0,0 +1,78 @@
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "binder_interface.h"
+#include "iptables.h"
+
+using android::binder::Status;
+
+using std::string;
+using std::vector;
+
+namespace firewalld {
+
+BinderInterface::BinderInterface(IpTables* service)
+ : service_(service) {}
+
+Status BinderInterface::PunchTcpHole(int32_t port, const string& iface) {
+ if (service_->PunchTcpHole(port, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+Status BinderInterface::PunchUdpHole(int32_t port, const string& iface) {
+ if (service_->PunchUdpHole(port, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+Status BinderInterface::PlugTcpHole(int32_t port, const string& iface) {
+ if (service_->PlugTcpHole(port, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+Status BinderInterface::PlugUdpHole(int32_t port, const string& iface) {
+ if (service_->PlugUdpHole(port, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+Status BinderInterface::RequestVpnSetup(const vector<string>& usernames,
+ const string& iface) {
+ if (service_->RequestVpnSetup(usernames, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+Status BinderInterface::RemoveVpnSetup(const vector<string>& usernames,
+ const string& iface) {
+ if (service_->RemoveVpnSetup(usernames, iface)) {
+ return Status::ok();
+ }
+
+ return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+}
+
+} // namespace firewalld
diff --git a/firewalld/binder_interface.h b/firewalld/binder_interface.h
new file mode 100644
index 0000000..01600b9
--- /dev/null
+++ b/firewalld/binder_interface.h
@@ -0,0 +1,53 @@
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_BINDER_INTERFACE_H_
+#define FIREWALLD_BINDER_INTERFACE_H_
+
+#include <base/macros.h>
+
+#include "android/firewalld/BnFirewall.h"
+
+namespace firewalld {
+
+class IpTables;
+class BinderInterface : public android::firewalld::BnFirewall {
+ public:
+ explicit BinderInterface(IpTables* service);
+ virtual ~BinderInterface() = default;
+
+ android::binder::Status PunchTcpHole(int32_t port, const std::string& iface)
+ override;
+ android::binder::Status PunchUdpHole(int32_t port, const std::string& iface)
+ override;
+ android::binder::Status PlugTcpHole(int32_t port, const std::string& iface)
+ override;
+ android::binder::Status PlugUdpHole(int32_t port, const std::string& iface)
+ override;
+ android::binder::Status RequestVpnSetup(
+ const std::vector<std::string>& usernames,
+ const std::string& iface) override;
+ android::binder::Status RemoveVpnSetup(
+ const std::vector<std::string>& usernames,
+ const std::string& iface) override;
+
+ private:
+ IpTables* service_;
+
+ DISALLOW_COPY_AND_ASSIGN(BinderInterface);
+};
+
+} // namespace firewalld
+
+#endif /* FIREWALLD_BINDER_INTERFACE_H_ */
diff --git a/firewalld/dbus/org.chromium.Firewalld.conf b/firewalld/dbus/org.chromium.Firewalld.conf
new file mode 100644
index 0000000..000b74e
--- /dev/null
+++ b/firewalld/dbus/org.chromium.Firewalld.conf
@@ -0,0 +1,18 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+ <policy user="root">
+ <allow own="org.chromium.Firewalld"/>
+ </policy>
+
+ <policy user="devbroker">
+ <allow send_destination="org.chromium.Firewalld"/>
+ </policy>
+
+ <policy context="default">
+ <deny send_destination="org.chromium.Firewalld"/>
+ </policy>
+
+ <limit name="max_replies_per_connection">512</limit>
+</busconfig>
diff --git a/firewalld/dbus_bindings/dbus-service-config.json b/firewalld/dbus_bindings/dbus-service-config.json
new file mode 100644
index 0000000..f62c2d2
--- /dev/null
+++ b/firewalld/dbus_bindings/dbus-service-config.json
@@ -0,0 +1,6 @@
+{
+ "service_name": "org.chromium.Firewalld",
+ "object_manager": {
+ "object_path": "/org/chromium/Firewalld"
+ }
+}
diff --git a/firewalld/dbus_bindings/org.chromium.Firewalld.dbus-xml b/firewalld/dbus_bindings/org.chromium.Firewalld.dbus-xml
new file mode 100644
index 0000000..97ea215
--- /dev/null
+++ b/firewalld/dbus_bindings/org.chromium.Firewalld.dbus-xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<node name="/org/chromium/Firewalld/Firewall">
+ <interface name="org.chromium.Firewalld">
+ <method name="PunchTcpHole">
+ <arg type="q" name="port" direction="in" />
+ <arg type="s" name="interface" direction="in"/>
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ <method name="PunchUdpHole">
+ <arg type="q" name="port" direction="in" />
+ <arg type="s" name="interface" direction="in"/>
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ <method name="PlugTcpHole">
+ <arg type="q" name="port" direction="in" />
+ <arg type="s" name="interface" direction="in"/>
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ <method name="PlugUdpHole">
+ <arg type="q" name="port" direction="in" />
+ <arg type="s" name="interface" direction="in"/>
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ <method name="RequestVpnSetup">
+ <arg type="as" name="usernames" direction="in" />
+ <arg type="s" name="interface" direction="in" />
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ <method name="RemoveVpnSetup">
+ <arg type="as" name="usernames" direction="in" />
+ <arg type="s" name="interface" direction="in" />
+ <arg type="b" name="success" direction="out" />
+ <annotation name="org.chromium.DBus.Method.Kind" value="simple"/>
+ </method>
+ </interface>
+</node>
diff --git a/firewalld/dbus_interface.h b/firewalld/dbus_interface.h
new file mode 100644
index 0000000..829d666
--- /dev/null
+++ b/firewalld/dbus_interface.h
@@ -0,0 +1,25 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_DBUS_INTERFACE_H_
+#define FIREWALLD_DBUS_INTERFACE_H_
+
+namespace firewalld {
+
+const char kFirewallServicePath[] = "/org/chromium/Firewalld";
+const char kFirewallServiceName[] = "org.chromium.Firewalld";
+
+} // namespace firewalld
+
+#endif // FIREWALLD_DBUS_INTERFACE_H_
diff --git a/firewalld/firewall_binder_client.cc b/firewalld/firewall_binder_client.cc
new file mode 100644
index 0000000..b29f49c
--- /dev/null
+++ b/firewalld/firewall_binder_client.cc
@@ -0,0 +1,98 @@
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <base/logging.h>
+#include <firewalld/firewall.h>
+
+#include <unistd.h>
+
+#include "android/firewalld/IFirewall.h"
+
+#define FIREWALL_BINDER_CLIENT_EXPORT __attribute__((__visibility__("default")))
+
+using std::unique_ptr;
+using std::vector;
+using std::string;
+
+using android::firewalld::IFirewall;
+using android::IBinder;
+using android::sp;
+
+namespace firewalld {
+
+const char kServiceName[] = "android.firewalld.Firewall";
+
+class FirewallImpl : public Firewall {
+ public:
+ explicit FirewallImpl(sp<IBinder> server_firewall)
+ : server_firewall_(android::interface_cast<IFirewall>(server_firewall)) {}
+ virtual ~FirewallImpl() = default;
+
+ bool PunchTcpHole(int16_t port, const string& iface) override {
+ return server_firewall_->PunchTcpHole(port, iface).isOk();
+ }
+
+ bool PunchUdpHole(int16_t port, const string& iface) override {
+ return server_firewall_->PunchUdpHole(port, iface).isOk();
+ }
+
+ bool PlugTcpHole(int16_t port, const string& iface) override {
+ return server_firewall_->PlugTcpHole(port, iface).isOk();
+ }
+
+ bool PlugUdpHole(int16_t port, const string& iface) override {
+ return server_firewall_->PlugUdpHole(port, iface).isOk();
+ }
+
+ bool RequestVpnSetup(const vector<string>& usernames,
+ const string& iface) override {
+ return server_firewall_->RequestVpnSetup(usernames, iface).isOk();
+ }
+
+ bool RemoveVpnSetup(const vector<string>& usernames,
+ const string& iface) override {
+ return server_firewall_->RemoveVpnSetup(usernames, iface).isOk();
+ }
+
+ private:
+ sp<IFirewall> server_firewall_;
+
+ DISALLOW_COPY_AND_ASSIGN(FirewallImpl);
+};
+
+FIREWALL_BINDER_CLIENT_EXPORT
+unique_ptr<Firewall> Firewall::Connect(
+ android::BinderWrapper* binder_wrapper) {
+ sp<IBinder> binder(nullptr);
+ int retries = 15;
+
+ while (retries--) {
+ binder = binder_wrapper->GetService(kServiceName);
+
+ if (binder.get()) {
+ break;
+ }
+
+ sleep(1);
+ }
+
+ if (!binder.get()) {
+ LOG(WARNING) << "Could not connect to " << kServiceName << " service.";
+ return unique_ptr<Firewall>();
+ }
+
+ return unique_ptr<Firewall>(new FirewallImpl(binder));
+}
+
+} // namespace firewalld
diff --git a/firewalld/firewall_daemon.cc b/firewalld/firewall_daemon.cc
new file mode 100644
index 0000000..ae12e5a
--- /dev/null
+++ b/firewalld/firewall_daemon.cc
@@ -0,0 +1,59 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "firewall_daemon.h"
+
+#include <string>
+
+#include <base/logging.h>
+
+#ifdef __ANDROID__
+#include <sysexits.h>
+#include <binderwrapper/binder_wrapper.h>
+#endif // __ANDROID__
+
+namespace firewalld {
+
+#ifdef __ANDROID__
+const char kServiceName[] = "android.firewalld.Firewall";
+#endif // __ANDROID__
+
+FirewallDaemon::FirewallDaemon()
+ : brillo::DBusServiceDaemon{kFirewallServiceName,
+ dbus::ObjectPath{kFirewallServicePath}} {
+}
+
+void FirewallDaemon::RegisterDBusObjectsAsync(AsyncEventSequencer* sequencer) {
+ firewall_service_.reset(
+ new firewalld::FirewallService{object_manager_.get()});
+ firewall_service_->RegisterAsync(
+ sequencer->GetHandler("Service.RegisterAsync() failed.", true));
+
+#ifdef __ANDROID__
+ android::BinderWrapper::Create();
+ if (!binder_watcher_.Init()) {
+ LOG(ERROR) << "Could not initialize binder watcher.";
+ return;
+ }
+
+ if (!android::BinderWrapper::Get()->RegisterService(
+ kServiceName,
+ firewall_service_->GetBinderInterface())) {
+ LOG(ERROR) << "Could not register service " << kServiceName << ".";
+ }
+#endif // __ANDROID__
+
+}
+
+} // namespace firewalld
diff --git a/firewalld/firewall_daemon.h b/firewalld/firewall_daemon.h
new file mode 100644
index 0000000..89ed4ad
--- /dev/null
+++ b/firewalld/firewall_daemon.h
@@ -0,0 +1,51 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_FIREWALL_DAEMON_H_
+#define FIREWALLD_FIREWALL_DAEMON_H_
+
+#include <base/macros.h>
+#include <brillo/daemons/dbus_daemon.h>
+#include <brillo/dbus/async_event_sequencer.h>
+
+#ifdef __ANDROID__
+#include <brillo/binder_watcher.h>
+#endif // __ANDROID__
+
+#include "dbus_interface.h"
+#include "firewall_service.h"
+
+using brillo::dbus_utils::AsyncEventSequencer;
+
+namespace firewalld {
+
+class FirewallDaemon : public brillo::DBusServiceDaemon {
+ public:
+ FirewallDaemon();
+
+ protected:
+ void RegisterDBusObjectsAsync(AsyncEventSequencer* sequencer) override;
+
+ private:
+#ifdef __ANDROID__
+ brillo::BinderWatcher binder_watcher_;
+#endif // __ANDROID__
+ std::unique_ptr<FirewallService> firewall_service_;
+
+ DISALLOW_COPY_AND_ASSIGN(FirewallDaemon);
+};
+
+} // namespace firewalld
+
+#endif // FIREWALLD_FIREWALL_DAEMON_H_
diff --git a/firewalld/firewall_service.cc b/firewalld/firewall_service.cc
new file mode 100644
index 0000000..b339e96
--- /dev/null
+++ b/firewalld/firewall_service.cc
@@ -0,0 +1,64 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "firewall_service.h"
+
+#include "dbus_interface.h"
+#include "iptables.h"
+
+namespace firewalld {
+
+FirewallService::FirewallService(
+ brillo::dbus_utils::ExportedObjectManager* object_manager)
+ : org::chromium::FirewalldAdaptor(&iptables_),
+ dbus_object_{object_manager, object_manager->GetBus(),
+ org::chromium::FirewalldAdaptor::GetObjectPath()} {}
+
+void FirewallService::RegisterAsync(const CompletionAction& callback) {
+ RegisterWithDBusObject(&dbus_object_);
+
+#if !defined(__ANDROID__)
+ // Track permission_broker's lifetime so that we can close firewall holes
+ // if/when permission_broker exits.
+ permission_broker_.reset(
+ new org::chromium::PermissionBroker::ObjectManagerProxy(
+ dbus_object_.GetBus()));
+ permission_broker_->SetPermissionBrokerRemovedCallback(
+ base::Bind(&FirewallService::OnPermissionBrokerRemoved,
+ weak_ptr_factory_.GetWeakPtr()));
+#endif // __ANDROID__
+
+ dbus_object_.RegisterAsync(callback);
+}
+
+#ifdef __ANDROID__
+ // Get the binder interface for this service
+android::sp<BinderInterface> FirewallService::GetBinderInterface() {
+ if (!binder_interface_.get()) {
+ binder_interface_ =
+ android::sp<BinderInterface>(new BinderInterface(&iptables_));
+ }
+
+ return binder_interface_;
+}
+#endif // __ANDROID__
+
+#if !defined(__ANDROID__)
+void FirewallService::OnPermissionBrokerRemoved(const dbus::ObjectPath& path) {
+ LOG(INFO) << "permission_broker died, plugging all firewall holes";
+ iptables_.PlugAllHoles();
+}
+#endif // __ANDROID__
+
+} // namespace firewalld
diff --git a/firewalld/firewall_service.h b/firewalld/firewall_service.h
new file mode 100644
index 0000000..bcfb546
--- /dev/null
+++ b/firewalld/firewall_service.h
@@ -0,0 +1,80 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_FIREWALL_SERVICE_H_
+#define FIREWALLD_FIREWALL_SERVICE_H_
+
+#if !defined(__ANDROID__)
+# include <memory>
+#endif // !__ANDROID__
+
+#include <base/callback.h>
+#include <base/macros.h>
+#include <base/memory/weak_ptr.h>
+#include <brillo/dbus/dbus_object.h>
+
+#include "dbus_bindings/org.chromium.Firewalld.h"
+#if !defined(__ANDROID__)
+# include "permission_broker/dbus-proxies.h"
+#endif // __ANDROID__
+
+#ifdef __ANDROID__
+#include "binder_interface.h"
+#endif // __ANDROID__
+
+#include "iptables.h"
+
+using CompletionAction =
+ brillo::dbus_utils::AsyncEventSequencer::CompletionAction;
+
+namespace firewalld {
+
+class FirewallService : public org::chromium::FirewalldAdaptor {
+ public:
+ explicit FirewallService(
+ brillo::dbus_utils::ExportedObjectManager* object_manager);
+ virtual ~FirewallService() = default;
+
+ // Connects to D-Bus system bus and exports methods.
+ void RegisterAsync(const CompletionAction& callback);
+
+#ifdef __ANDROID__
+ // Get the binder interface for this firewall.
+ android::sp<BinderInterface> GetBinderInterface();
+#endif // __ANDROID__
+
+ private:
+#if !defined(__ANDROID__)
+ void OnPermissionBrokerRemoved(const dbus::ObjectPath& path);
+#endif // __ANDROID__
+
+ brillo::dbus_utils::DBusObject dbus_object_;
+#if !defined(__ANDROID__)
+ std::unique_ptr<org::chromium::PermissionBroker::ObjectManagerProxy>
+ permission_broker_;
+#endif // __ANDROID__
+ IpTables iptables_;
+
+#ifdef __ANDROID__
+ // A binder interface for this firewall.
+ android::sp<BinderInterface> binder_interface_;
+#endif // __ANDROID__
+
+ base::WeakPtrFactory<FirewallService> weak_ptr_factory_{this};
+ DISALLOW_COPY_AND_ASSIGN(FirewallService);
+};
+
+} // namespace firewalld
+
+#endif // FIREWALLD_FIREWALL_SERVICE_H_
diff --git a/firewalld/firewalld.conf b/firewalld/firewalld.conf
new file mode 100644
index 0000000..bfa521a
--- /dev/null
+++ b/firewalld/firewalld.conf
@@ -0,0 +1,24 @@
+#
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+description "Firewall daemon"
+author "chromium-os-dev@chromium.org"
+
+start on stopped iptables and stopped ip6tables
+stop on stopping system-services
+respawn
+
+exec firewalld
diff --git a/firewalld/firewalld.gyp b/firewalld/firewalld.gyp
new file mode 100644
index 0000000..4b110e8
--- /dev/null
+++ b/firewalld/firewalld.gyp
@@ -0,0 +1,85 @@
+{
+ 'target_defaults': {
+ 'variables': {
+ 'deps': [
+ 'libbrillo-<(libbase_ver)',
+ 'libchrome-<(libbase_ver)',
+ 'libpermission_broker-client',
+ ],
+ },
+ },
+ 'targets': [
+ {
+ 'target_name': 'libfirewalld',
+ 'type': 'static_library',
+ 'sources': [
+ 'firewall_daemon.cc',
+ 'firewall_service.cc',
+ 'iptables.cc',
+ ],
+ },
+ {
+ 'target_name': 'firewalld-dbus-adaptor',
+ 'type': 'none',
+ 'variables': {
+ 'dbus_service_config': 'dbus_bindings/dbus-service-config.json',
+ 'dbus_adaptors_out_dir': 'include/dbus_bindings',
+ 'dbus_xml_extension': 'dbus-xml',
+ },
+ 'sources': [
+ 'dbus_bindings/org.chromium.Firewalld.dbus-xml',
+ ],
+ 'includes': ['../common-mk/generate-dbus-adaptors.gypi'],
+ },
+ {
+ 'target_name': 'firewalld-dbus-proxies',
+ 'type': 'none',
+ 'actions': [
+ {
+ 'action_name': 'generate-firewalld-dbus-proxies',
+ 'variables': {
+ 'dbus_service_config': 'dbus_bindings/dbus-service-config.json',
+ 'proxy_output_file': 'include/firewalld/dbus-proxies.h',
+ 'mock_output_file': 'include/firewalld/dbus-mocks.h',
+ 'proxy_path_in_mocks': 'firewalld/dbus-proxies.h',
+ },
+ 'sources': [
+ 'dbus_bindings/org.chromium.Firewalld.dbus-xml',
+ ],
+ 'includes': ['../common-mk/generate-dbus-proxies.gypi'],
+ },
+ ],
+ },
+ {
+ 'target_name': 'firewalld',
+ 'type': 'executable',
+ 'dependencies': [
+ 'libfirewalld',
+ 'firewalld-dbus-adaptor',
+ ],
+ 'sources': ['main.cc'],
+ },
+ ],
+ 'conditions': [
+ ['USE_test == 1', {
+ 'targets': [
+ {
+ 'target_name': 'firewalld_unittest',
+ 'type': 'executable',
+ 'variables': {
+ 'deps': [
+ 'libpermission_broker-client-test',
+ ],
+ },
+ 'includes': ['../common-mk/common_test.gypi'],
+ 'dependencies': ['libfirewalld'],
+ 'sources': [
+ 'iptables_unittest.cc',
+ 'mock_iptables.cc',
+ 'run_all_tests.cc',
+ ],
+ },
+ ],
+ }],
+ ],
+}
diff --git a/firewalld/firewalld.rc b/firewalld/firewalld.rc
new file mode 100644
index 0000000..b3da589
--- /dev/null
+++ b/firewalld/firewalld.rc
@@ -0,0 +1,5 @@
+service firewalld /system/bin/firewalld
+ class main
+ user firewall
+ group firewall dbus
+ disabled
diff --git a/firewalld/generate_pc_file.sh b/firewalld/generate_pc_file.sh
new file mode 100755
index 0000000..82f8740
--- /dev/null
+++ b/firewalld/generate_pc_file.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Copyright 2015 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+set -e
+
+OUT=$1
+shift
+PC_IN=$1
+shift
+INCLUDE_DIR=$1
+shift
+
+sed \
+ -e "s|@INCLUDE_DIR@|${INCLUDE_DIR}|g" \
+ "${PC_IN}.pc.in" > "${OUT}/${PC_IN}.pc"
diff --git a/firewalld/include/firewalld/firewall.h b/firewalld/include/firewalld/firewall.h
new file mode 100644
index 0000000..04718fa
--- /dev/null
+++ b/firewalld/include/firewalld/firewall.h
@@ -0,0 +1,49 @@
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_BINDER_CLIENT_FIREWALL_H_
+#define FIREWALLD_BINDER_CLIENT_FIREWALL_H_
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <binderwrapper/binder_wrapper.h>
+
+namespace firewalld {
+
+class Firewall {
+ public:
+ Firewall() = default;
+ virtual ~Firewall() = default;
+
+ static std::unique_ptr<Firewall> Connect(
+ android::BinderWrapper* binder_wrapper);
+
+ virtual bool PunchTcpHole(int16_t port, const std::string& iface) = 0;
+ virtual bool PunchUdpHole(int16_t port, const std::string& iface) = 0;
+ virtual bool PlugTcpHole(int16_t port, const std::string& iface) = 0;
+ virtual bool PlugUdpHole(int16_t port, const std::string& iface) = 0;
+ virtual bool RequestVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& iface) = 0;
+ virtual bool RemoveVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& iface) = 0;
+
+ private:
+ DISALLOW_COPY_AND_ASSIGN(Firewall);
+};
+
+} // namespace firewalld
+
+#endif /* FIREWALLD_BINDER_CLIENT_FIREWALL_H_ */
diff --git a/firewalld/iptables.cc b/firewalld/iptables.cc
new file mode 100644
index 0000000..62201dd
--- /dev/null
+++ b/firewalld/iptables.cc
@@ -0,0 +1,472 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "iptables.h"
+
+#include <linux/capability.h>
+
+#include <string>
+#include <vector>
+
+#include <base/bind.h>
+#include <base/bind_helpers.h>
+#include <base/callback.h>
+#include <base/logging.h>
+#include <base/strings/string_number_conversions.h>
+#include <base/strings/string_util.h>
+#include <base/strings/stringprintf.h>
+#include <brillo/minijail/minijail.h>
+#include <brillo/process.h>
+
+namespace {
+
+using IpTablesCallback = base::Callback<bool(const std::string&, bool)>;
+
+#if defined(__ANDROID__)
+const char kIpTablesPath[] = "/system/bin/iptables";
+const char kIp6TablesPath[] = "/system/bin/ip6tables";
+const char kIpPath[] = "/system/bin/ip";
+#else
+const char kIpTablesPath[] = "/sbin/iptables";
+const char kIp6TablesPath[] = "/sbin/ip6tables";
+const char kIpPath[] = "/bin/ip";
+const char kUnprivilegedUser[] = "nobody";
+#endif // __ANDROID__
+
+const char kIPv4[] = "IPv4";
+const char kIPv6[] = "IPv6";
+
+const uint64_t kIpTablesCapMask =
+ CAP_TO_MASK(CAP_NET_ADMIN) | CAP_TO_MASK(CAP_NET_RAW);
+
+// Interface names must be shorter than 'IFNAMSIZ' chars.
+// See http://man7.org/linux/man-pages/man7/netdevice.7.html
+// 'IFNAMSIZ' is 16 in recent kernels.
+// See http://lxr.free-electrons.com/source/include/uapi/linux/if.h#L26
+const size_t kInterfaceNameSize = 16;
+
+const char kMarkForUserTraffic[] = "1";
+
+const char kTableIdForUserTraffic[] = "1";
+
+bool IsValidInterfaceName(const std::string& iface) {
+ // |iface| should be shorter than |kInterfaceNameSize| chars and have only
+ // alphanumeric characters (embedded hypens and periods are also permitted).
+ if (iface.length() >= kInterfaceNameSize) {
+ return false;
+ }
+ if (base::StartsWith(iface, "-", base::CompareCase::SENSITIVE) ||
+ base::EndsWith(iface, "-", base::CompareCase::SENSITIVE) ||
+ base::StartsWith(iface, ".", base::CompareCase::SENSITIVE) ||
+ base::EndsWith(iface, ".", base::CompareCase::SENSITIVE)) {
+ return false;
+ }
+ for (auto c : iface) {
+ if (!std::isalnum(c) && (c != '-') && (c != '.')) {
+ return false;
+ }
+ }
+ return true;
+}
+
+bool RunForAllArguments(const IpTablesCallback& iptables_cmd,
+ const std::vector<std::string>& arguments,
+ bool add) {
+ bool success = true;
+ for (const auto& argument : arguments) {
+ if (!iptables_cmd.Run(argument, add)) {
+ // On failure, only abort if rules are being added.
+ // If removing a rule fails, attempt the remaining removals but still
+ // return 'false'.
+ success = false;
+ if (add)
+ break;
+ }
+ }
+ return success;
+}
+
+} // namespace
+
+namespace firewalld {
+
+IpTables::IpTables() {
+}
+
+IpTables::~IpTables() {
+ // Plug all holes when destructed.
+ PlugAllHoles();
+}
+
+bool IpTables::PunchTcpHole(uint16_t in_port, const std::string& in_interface) {
+ return PunchHole(in_port, in_interface, &tcp_holes_, kProtocolTcp);
+}
+
+bool IpTables::PunchUdpHole(uint16_t in_port, const std::string& in_interface) {
+ return PunchHole(in_port, in_interface, &udp_holes_, kProtocolUdp);
+}
+
+bool IpTables::PlugTcpHole(uint16_t in_port, const std::string& in_interface) {
+ return PlugHole(in_port, in_interface, &tcp_holes_, kProtocolTcp);
+}
+
+bool IpTables::PlugUdpHole(uint16_t in_port, const std::string& in_interface) {
+ return PlugHole(in_port, in_interface, &udp_holes_, kProtocolUdp);
+}
+
+bool IpTables::RequestVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface) {
+ return ApplyVpnSetup(usernames, interface, true /* add */);
+}
+
+bool IpTables::RemoveVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface) {
+ return ApplyVpnSetup(usernames, interface, false /* delete */);
+}
+
+bool IpTables::PunchHole(uint16_t port,
+ const std::string& interface,
+ std::set<Hole>* holes,
+ ProtocolEnum protocol) {
+ if (port == 0) {
+ // Port 0 is not a valid TCP/UDP port.
+ return false;
+ }
+
+ if (!IsValidInterfaceName(interface)) {
+ LOG(ERROR) << "Invalid interface name '" << interface << "'";
+ return false;
+ }
+
+ Hole hole = std::make_pair(port, interface);
+ if (holes->find(hole) != holes->end()) {
+ // We have already punched a hole for |port| on |interface|.
+ // Be idempotent: do nothing and succeed.
+ return true;
+ }
+
+ std::string sprotocol = protocol == kProtocolTcp ? "TCP" : "UDP";
+ LOG(INFO) << "Punching hole for " << sprotocol << " port " << port
+ << " on interface '" << interface << "'";
+ if (!AddAcceptRules(protocol, port, interface)) {
+ // If the 'iptables' command fails, this method fails.
+ LOG(ERROR) << "Adding ACCEPT rules failed.";
+ return false;
+ }
+
+ // Track the hole we just punched.
+ holes->insert(hole);
+
+ return true;
+}
+
+bool IpTables::PlugHole(uint16_t port,
+ const std::string& interface,
+ std::set<Hole>* holes,
+ ProtocolEnum protocol) {
+ if (port == 0) {
+ // Port 0 is not a valid TCP/UDP port.
+ return false;
+ }
+
+ Hole hole = std::make_pair(port, interface);
+
+ if (holes->find(hole) == holes->end()) {
+ // There is no firewall hole for |port| on |interface|.
+ // Even though this makes |PlugHole| not idempotent,
+ // and Punch/Plug not entirely symmetrical, fail. It might help catch bugs.
+ return false;
+ }
+
+ std::string sprotocol = protocol == kProtocolTcp ? "TCP" : "UDP";
+ LOG(INFO) << "Plugging hole for " << sprotocol << " port " << port
+ << " on interface '" << interface << "'";
+ if (!DeleteAcceptRules(protocol, port, interface)) {
+ // If the 'iptables' command fails, this method fails.
+ LOG(ERROR) << "Deleting ACCEPT rules failed.";
+ return false;
+ }
+
+ // Stop tracking the hole we just plugged.
+ holes->erase(hole);
+
+ return true;
+}
+
+void IpTables::PlugAllHoles() {
+ // Copy the container so that we can remove elements from the original.
+ // TCP
+ std::set<Hole> holes = tcp_holes_;
+ for (auto hole : holes) {
+ PlugHole(hole.first /* port */, hole.second /* interface */, &tcp_holes_,
+ kProtocolTcp);
+ }
+
+ // UDP
+ holes = udp_holes_;
+ for (auto hole : holes) {
+ PlugHole(hole.first /* port */, hole.second /* interface */, &udp_holes_,
+ kProtocolUdp);
+ }
+
+ CHECK(tcp_holes_.size() == 0) << "Failed to plug all TCP holes.";
+ CHECK(udp_holes_.size() == 0) << "Failed to plug all UDP holes.";
+}
+
+bool IpTables::AddAcceptRules(ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface) {
+ if (!AddAcceptRule(kIpTablesPath, protocol, port, interface)) {
+ LOG(ERROR) << "Could not add ACCEPT rule using '" << kIpTablesPath << "'";
+ return false;
+ }
+
+ if (AddAcceptRule(kIp6TablesPath, protocol, port, interface)) {
+ // This worked, record this fact and insist that it works thereafter.
+ ip6_enabled_ = true;
+ } else if (ip6_enabled_) {
+ // It's supposed to work, fail.
+ LOG(ERROR) << "Could not add ACCEPT rule using '" << kIp6TablesPath
+ << "', aborting operation.";
+ DeleteAcceptRule(kIpTablesPath, protocol, port, interface);
+ return false;
+ } else {
+ // It never worked, just ignore it.
+ LOG(WARNING) << "Could not add ACCEPT rule using '" << kIp6TablesPath
+ << "', ignoring.";
+ }
+
+ return true;
+}
+
+bool IpTables::DeleteAcceptRules(ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface) {
+ bool ip4_success = DeleteAcceptRule(kIpTablesPath, protocol, port,
+ interface);
+ bool ip6_success = !ip6_enabled_ || DeleteAcceptRule(kIp6TablesPath, protocol,
+ port, interface);
+ return ip4_success && ip6_success;
+}
+
+bool IpTables::ApplyVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface,
+ bool add) {
+ bool success = true;
+ std::vector<std::string> added_usernames;
+
+ if (!ApplyRuleForUserTraffic(add)) {
+ if (add) {
+ ApplyRuleForUserTraffic(false /* remove */);
+ return false;
+ }
+ success = false;
+ }
+
+ if (!ApplyMasquerade(interface, add)) {
+ if (add) {
+ ApplyVpnSetup(added_usernames, interface, false /* remove */);
+ return false;
+ }
+ success = false;
+ }
+
+ for (const auto& username : usernames) {
+ if (!ApplyMarkForUserTraffic(username, add)) {
+ if (add) {
+ ApplyVpnSetup(added_usernames, interface, false /* remove */);
+ return false;
+ }
+ success = false;
+ }
+ if (add) {
+ added_usernames.push_back(username);
+ }
+ }
+
+ return success;
+}
+
+bool IpTables::ApplyMasquerade(const std::string& interface, bool add) {
+ const IpTablesCallback apply_masquerade =
+ base::Bind(&IpTables::ApplyMasqueradeWithExecutable,
+ base::Unretained(this),
+ interface);
+
+ return RunForAllArguments(
+ apply_masquerade, {kIpTablesPath, kIp6TablesPath}, add);
+}
+
+bool IpTables::ApplyMarkForUserTraffic(const std::string& username, bool add) {
+ const IpTablesCallback apply_mark =
+ base::Bind(&IpTables::ApplyMarkForUserTrafficWithExecutable,
+ base::Unretained(this),
+ username);
+
+ return RunForAllArguments(apply_mark, {kIpTablesPath, kIp6TablesPath}, add);
+}
+
+bool IpTables::ApplyRuleForUserTraffic(bool add) {
+ const IpTablesCallback apply_rule = base::Bind(
+ &IpTables::ApplyRuleForUserTrafficWithVersion, base::Unretained(this));
+
+ return RunForAllArguments(apply_rule, {kIPv4, kIPv6}, add);
+}
+
+bool IpTables::AddAcceptRule(const std::string& executable_path,
+ ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface) {
+ std::vector<std::string> argv;
+ argv.push_back(executable_path);
+ argv.push_back("-I"); // insert
+ argv.push_back("INPUT");
+ argv.push_back("-p"); // protocol
+ argv.push_back(protocol == kProtocolTcp ? "tcp" : "udp");
+ argv.push_back("--dport"); // destination port
+ argv.push_back(std::to_string(port));
+ if (!interface.empty()) {
+ argv.push_back("-i"); // interface
+ argv.push_back(interface);
+ }
+ argv.push_back("-j");
+ argv.push_back("ACCEPT");
+ argv.push_back("-w"); // Wait for xtables lock.
+
+ // Use CAP_NET_ADMIN|CAP_NET_RAW.
+ return ExecvNonRoot(argv, kIpTablesCapMask) == 0;
+}
+
+bool IpTables::DeleteAcceptRule(const std::string& executable_path,
+ ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface) {
+ std::vector<std::string> argv;
+ argv.push_back(executable_path);
+ argv.push_back("-D"); // delete
+ argv.push_back("INPUT");
+ argv.push_back("-p"); // protocol
+ argv.push_back(protocol == kProtocolTcp ? "tcp" : "udp");
+ argv.push_back("--dport"); // destination port
+ argv.push_back(std::to_string(port));
+ if (interface != "") {
+ argv.push_back("-i"); // interface
+ argv.push_back(interface);
+ }
+ argv.push_back("-j");
+ argv.push_back("ACCEPT");
+ argv.push_back("-w"); // Wait for xtables lock.
+
+ // Use CAP_NET_ADMIN|CAP_NET_RAW.
+ return ExecvNonRoot(argv, kIpTablesCapMask) == 0;
+}
+
+bool IpTables::ApplyMasqueradeWithExecutable(const std::string& interface,
+ const std::string& executable_path,
+ bool add) {
+ std::vector<std::string> argv;
+ argv.push_back(executable_path);
+ argv.push_back("-t"); // table
+ argv.push_back("nat");
+ argv.push_back(add ? "-A" : "-D"); // rule
+ argv.push_back("POSTROUTING");
+ argv.push_back("-o"); // output interface
+ argv.push_back(interface);
+ argv.push_back("-j");
+ argv.push_back("MASQUERADE");
+
+ // Use CAP_NET_ADMIN|CAP_NET_RAW.
+ bool success = ExecvNonRoot(argv, kIpTablesCapMask) == 0;
+
+ if (!success) {
+ LOG(ERROR) << (add ? "Adding" : "Removing")
+ << " masquerade failed for interface " << interface
+ << " using '" << executable_path << "'";
+ }
+ return success;
+}
+
+bool IpTables::ApplyMarkForUserTrafficWithExecutable(
+ const std::string& username, const std::string& executable_path, bool add) {
+ std::vector<std::string> argv;
+ argv.push_back(executable_path);
+ argv.push_back("-t"); // table
+ argv.push_back("mangle");
+ argv.push_back(add ? "-A" : "-D"); // rule
+ argv.push_back("OUTPUT");
+ argv.push_back("-m");
+ argv.push_back("owner");
+ argv.push_back("--uid-owner");
+ argv.push_back(username);
+ argv.push_back("-j");
+ argv.push_back("MARK");
+ argv.push_back("--set-mark");
+ argv.push_back(kMarkForUserTraffic);
+
+ // Use CAP_NET_ADMIN|CAP_NET_RAW.
+ bool success = ExecvNonRoot(argv, kIpTablesCapMask) == 0;
+
+ if (!success) {
+ LOG(ERROR) << (add ? "Adding" : "Removing")
+ << " mark failed for user " << username
+ << " using '" << kIpTablesPath << "'";
+ }
+ return success;
+}
+
+bool IpTables::ApplyRuleForUserTrafficWithVersion(const std::string& ip_version,
+ bool add) {
+ brillo::ProcessImpl ip;
+ ip.AddArg(kIpPath);
+ if (ip_version == kIPv6)
+ ip.AddArg("-6");
+ ip.AddArg("rule");
+ ip.AddArg(add ? "add" : "delete");
+ ip.AddArg("fwmark");
+ ip.AddArg(kMarkForUserTraffic);
+ ip.AddArg("table");
+ ip.AddArg(kTableIdForUserTraffic);
+
+ bool success = ip.Run() == 0;
+
+ if (!success) {
+ LOG(ERROR) << (add ? "Adding" : "Removing") << " rule for " << ip_version
+ << " user traffic failed";
+ }
+ return success;
+}
+
+int IpTables::ExecvNonRoot(const std::vector<std::string>& argv,
+ uint64_t capmask) {
+ brillo::Minijail* m = brillo::Minijail::GetInstance();
+ minijail* jail = m->New();
+#if !defined(__ANDROID__)
+ // TODO(garnold) This needs to be re-enabled once we figure out which
+ // unprivileged user we want to use.
+ m->DropRoot(jail, kUnprivilegedUser, kUnprivilegedUser);
+#endif // __ANDROID__
+ m->UseCapabilities(jail, capmask);
+
+ std::vector<char*> args;
+ for (const auto& arg : argv) {
+ args.push_back(const_cast<char*>(arg.c_str()));
+ }
+ args.push_back(nullptr);
+
+ int status;
+ bool ran = m->RunSyncAndDestroy(jail, args, &status);
+ return ran ? status : -1;
+}
+
+} // namespace firewalld
diff --git a/firewalld/iptables.h b/firewalld/iptables.h
new file mode 100644
index 0000000..74b9acb
--- /dev/null
+++ b/firewalld/iptables.h
@@ -0,0 +1,124 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_IPTABLES_H_
+#define FIREWALLD_IPTABLES_H_
+
+#include <stdint.h>
+
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include <base/macros.h>
+#include <brillo/errors/error.h>
+
+#include "dbus_bindings/org.chromium.Firewalld.h"
+
+namespace firewalld {
+
+enum ProtocolEnum { kProtocolTcp, kProtocolUdp };
+
+class IpTables : public org::chromium::FirewalldInterface {
+ public:
+ typedef std::pair<uint16_t, std::string> Hole;
+
+ IpTables();
+ ~IpTables();
+
+ // D-Bus methods.
+ bool PunchTcpHole(uint16_t in_port, const std::string& in_interface) override;
+ bool PunchUdpHole(uint16_t in_port, const std::string& in_interface) override;
+ bool PlugTcpHole(uint16_t in_port, const std::string& in_interface) override;
+ bool PlugUdpHole(uint16_t in_port, const std::string& in_interface) override;
+
+ bool RequestVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface) override;
+ bool RemoveVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface) override;
+
+ // Close all outstanding firewall holes.
+ void PlugAllHoles();
+
+ private:
+ friend class IpTablesTest;
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupAdd_Success);
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupAdd_FailureInUsername);
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupAdd_FailureInMasquerade);
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupAdd_FailureInRuleForUserTraffic);
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupRemove_Success);
+ FRIEND_TEST(IpTablesTest, ApplyVpnSetupRemove_Failure);
+
+ bool PunchHole(uint16_t port,
+ const std::string& interface,
+ std::set<Hole>* holes,
+ ProtocolEnum protocol);
+ bool PlugHole(uint16_t port,
+ const std::string& interface,
+ std::set<Hole>* holes,
+ ProtocolEnum protocol);
+
+ bool AddAcceptRules(ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface);
+ bool DeleteAcceptRules(ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface);
+
+ virtual bool AddAcceptRule(const std::string& executable_path,
+ ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface);
+ virtual bool DeleteAcceptRule(const std::string& executable_path,
+ ProtocolEnum protocol,
+ uint16_t port,
+ const std::string& interface);
+
+ bool ApplyVpnSetup(const std::vector<std::string>& usernames,
+ const std::string& interface,
+ bool add);
+
+ virtual bool ApplyMasquerade(const std::string& interface, bool add);
+ bool ApplyMasqueradeWithExecutable(const std::string& interface,
+ const std::string& executable_path,
+ bool add);
+
+ virtual bool ApplyMarkForUserTraffic(const std::string& username, bool add);
+ bool ApplyMarkForUserTrafficWithExecutable(const std::string& username,
+ const std::string& executable_path,
+ bool add);
+
+ virtual bool ApplyRuleForUserTraffic(bool add);
+ bool ApplyRuleForUserTrafficWithVersion(const std::string& ip_version,
+ bool add);
+
+ int ExecvNonRoot(const std::vector<std::string>& argv, uint64_t capmask);
+
+ // Keep track of firewall holes to avoid adding redundant firewall rules.
+ std::set<Hole> tcp_holes_;
+ std::set<Hole> udp_holes_;
+
+ // Tracks whether IPv6 filtering is enabled. If set to |true| (the default),
+ // then it is required to be working. If |false|, then adding of IPv6 rules is
+ // still attempted but not mandatory; however, if it is successful even once,
+ // then it'll be changed to |true| and enforced thereafter.
+ bool ip6_enabled_ = true;
+
+ DISALLOW_COPY_AND_ASSIGN(IpTables);
+};
+
+} // namespace firewalld
+
+#endif // FIREWALLD_IPTABLES_H_
diff --git a/firewalld/iptables_unittest.cc b/firewalld/iptables_unittest.cc
new file mode 100644
index 0000000..615b4f8
--- /dev/null
+++ b/firewalld/iptables_unittest.cc
@@ -0,0 +1,353 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "iptables.h"
+
+#include <gtest/gtest.h>
+
+#include "mock_iptables.h"
+
+namespace {
+#if defined(__ANDROID__)
+const char kIpTablesPath[] = "/system/bin/iptables";
+const char kIp6TablesPath[] = "/system/bin/ip6tables";
+#else
+const char kIpTablesPath[] = "/sbin/iptables";
+const char kIp6TablesPath[] = "/sbin/ip6tables";
+#endif // __ANDROID__
+} // namespace
+
+namespace firewalld {
+
+using testing::_;
+using testing::Return;
+
+class IpTablesTest : public testing::Test {
+ public:
+ IpTablesTest() = default;
+ ~IpTablesTest() override = default;
+
+ protected:
+ void SetMockExpectations(MockIpTables* iptables, bool success) {
+ EXPECT_CALL(*iptables, AddAcceptRule(_, _, _, _))
+ .WillRepeatedly(Return(success));
+ EXPECT_CALL(*iptables, DeleteAcceptRule(_, _, _, _))
+ .WillRepeatedly(Return(success));
+ }
+
+ void SetMockExpectationsPerExecutable(MockIpTables* iptables,
+ bool ip4_success,
+ bool ip6_success) {
+ EXPECT_CALL(*iptables, AddAcceptRule(kIpTablesPath, _, _, _))
+ .WillRepeatedly(Return(ip4_success));
+ EXPECT_CALL(*iptables, AddAcceptRule(kIp6TablesPath, _, _, _))
+ .WillRepeatedly(Return(ip6_success));
+ EXPECT_CALL(*iptables, DeleteAcceptRule(kIpTablesPath, _, _, _))
+ .WillRepeatedly(Return(ip4_success));
+ EXPECT_CALL(*iptables, DeleteAcceptRule(kIp6TablesPath, _, _, _))
+ .WillRepeatedly(Return(ip6_success));
+ }
+
+ private:
+ DISALLOW_COPY_AND_ASSIGN(IpTablesTest);
+};
+
+TEST_F(IpTablesTest, Port0Fails) {
+ MockIpTables mock_iptables;
+ // We should not be adding any rules for port 0.
+ EXPECT_CALL(mock_iptables, AddAcceptRule(_, _, _, _)).Times(0);
+ EXPECT_CALL(mock_iptables, DeleteAcceptRule(_, _, _, _)).Times(0);
+ // Try to punch hole for TCP port 0, port 0 is not a valid port.
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(0, "iface"));
+ // Try to punch hole for UDP port 0, port 0 is not a valid port.
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(0, "iface"));
+}
+
+TEST_F(IpTablesTest, ValidInterfaceName) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, true /* success */);
+
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "shortname"));
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "shortname"));
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "middle-dash"));
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "middle-dash"));
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "middle.dot"));
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "middle.dot"));
+}
+
+TEST_F(IpTablesTest, InvalidInterfaceName) {
+ MockIpTables mock_iptables;
+ // We should not be adding any rules for invalid interface names.
+ EXPECT_CALL(mock_iptables, AddAcceptRule(_, _, _, _)).Times(0);
+ EXPECT_CALL(mock_iptables, DeleteAcceptRule(_, _, _, _)).Times(0);
+
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "reallylonginterfacename"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "with spaces"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "with$ymbols"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "-startdash"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "enddash-"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, ".startdot"));
+ EXPECT_FALSE(mock_iptables.PunchTcpHole(80, "enddot."));
+
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "reallylonginterfacename"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "with spaces"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "with$ymbols"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "-startdash"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "enddash-"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, ".startdot"));
+ EXPECT_FALSE(mock_iptables.PunchUdpHole(53, "enddot."));
+}
+
+TEST_F(IpTablesTest, PunchTcpHoleSucceeds) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, true /* success */);
+
+ // Punch hole for TCP port 80, should succeed.
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "iface"));
+ // Punch again, should still succeed.
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "iface"));
+ // Plug the hole, should succeed.
+ EXPECT_TRUE(mock_iptables.PlugTcpHole(80, "iface"));
+}
+
+TEST_F(IpTablesTest, PlugTcpHoleSucceeds) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, true /* success */);
+
+ // Punch hole for TCP port 80, should succeed.
+ EXPECT_TRUE(mock_iptables.PunchTcpHole(80, "iface"));
+ // Plug the hole, should succeed.
+ EXPECT_TRUE(mock_iptables.PlugTcpHole(80, "iface"));
+ // Plug again, should fail.
+ EXPECT_FALSE(mock_iptables.PlugTcpHole(80, "iface"));
+}
+
+TEST_F(IpTablesTest, PunchUdpHoleSucceeds) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, true /* success */);
+
+ // Punch hole for UDP port 53, should succeed.
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "iface"));
+ // Punch again, should still succeed.
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "iface"));
+ // Plug the hole, should succeed.
+ EXPECT_TRUE(mock_iptables.PlugUdpHole(53, "iface"));
+}
+
+TEST_F(IpTablesTest, PlugUdpHoleSucceeds) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, true /* success */);
+
+ // Punch hole for UDP port 53, should succeed.
+ EXPECT_TRUE(mock_iptables.PunchUdpHole(53, "iface"));
+ // Plug the hole, should succeed.
+ EXPECT_TRUE(mock_iptables.PlugUdpHole(53, "iface"));
+ // Plug again, should fail.
+ EXPECT_FALSE(mock_iptables.PlugUdpHole(53, "iface"));
+}
+
+TEST_F(IpTablesTest, PunchTcpHoleFails) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, false /* success */);
+ // Punch hole for TCP port 80, should fail.
+ ASSERT_FALSE(mock_iptables.PunchTcpHole(80, "iface"));
+}
+
+TEST_F(IpTablesTest, PunchUdpHoleFails) {
+ MockIpTables mock_iptables;
+ SetMockExpectations(&mock_iptables, false /* success */);
+ // Punch hole for UDP port 53, should fail.
+ ASSERT_FALSE(mock_iptables.PunchUdpHole(53, "iface"));
+}
+
+TEST_F(IpTablesTest, PunchTcpHoleIpv6Fails) {
+ MockIpTables mock_iptables;
+ SetMockExpectationsPerExecutable(
+ &mock_iptables, true /* ip4_success */, false /* ip6_success */);
+ // Punch hole for TCP port 80, should fail because 'ip6tables' fails.
+ ASSERT_FALSE(mock_iptables.PunchTcpHole(80, "iface"));
+}
+
+TEST_F(IpTablesTest, PunchUdpHoleIpv6Fails) {
+ MockIpTables mock_iptables;
+ SetMockExpectationsPerExecutable(
+ &mock_iptables, true /* ip4_success */, false /* ip6_success */);
+ // Punch hole for UDP port 53, should fail because 'ip6tables' fails.
+ ASSERT_FALSE(mock_iptables.PunchUdpHole(53, "iface"));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupAdd_Success) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, add))
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(usernames[0], add))
+ .WillOnce(Return(true));
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(usernames[1], add))
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add))
+ .WillOnce(Return(true));
+
+ ASSERT_TRUE(
+ mock_iptables.ApplyVpnSetup(usernames, interface, add));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupAdd_FailureInUsername) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool remove = false;
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, add))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables,
+ ApplyMarkForUserTraffic(usernames[0], add))
+ .Times(1)
+ .WillOnce(Return(true));
+ EXPECT_CALL(mock_iptables,
+ ApplyMarkForUserTraffic(usernames[1], add))
+ .Times(1)
+ .WillOnce(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, remove))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables,
+ ApplyMarkForUserTraffic(usernames[0], remove))
+ .Times(1)
+ .WillOnce(Return(false));
+ EXPECT_CALL(mock_iptables,
+ ApplyMarkForUserTraffic(usernames[1], remove))
+ .Times(0);
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(remove))
+ .Times(1)
+ .WillOnce(Return(false));
+
+ ASSERT_FALSE(
+ mock_iptables.ApplyVpnSetup(usernames, interface, add));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupAdd_FailureInMasquerade) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool remove = false;
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, add))
+ .Times(1)
+ .WillOnce(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, _)).Times(0);
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, remove))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(remove))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ ASSERT_FALSE(
+ mock_iptables.ApplyVpnSetup(usernames, interface, add));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupAdd_FailureInRuleForUserTraffic) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool remove = false;
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, _)).Times(0);
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, _)).Times(0);
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add))
+ .Times(1)
+ .WillOnce(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(remove)).Times(1);
+
+ ASSERT_FALSE(mock_iptables.ApplyVpnSetup(usernames, interface, add));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupRemove_Success) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool remove = false;
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, remove))
+ .Times(1)
+ .WillOnce(Return(true));
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, remove))
+ .Times(2)
+ .WillRepeatedly(Return(true));
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(remove))
+ .Times(1)
+ .WillOnce(Return(true));
+
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, add)).Times(0);
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, add)).Times(0);
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add)).Times(0);
+
+ ASSERT_TRUE(mock_iptables.ApplyVpnSetup(usernames, interface, remove));
+}
+
+TEST_F(IpTablesTest, ApplyVpnSetupRemove_Failure) {
+ const std::vector<std::string> usernames = {"testuser0", "testuser1"};
+ const std::string interface = "ifc0";
+ const bool remove = false;
+ const bool add = true;
+
+ MockIpTables mock_iptables;
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, remove))
+ .Times(1)
+ .WillRepeatedly(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, remove))
+ .Times(2)
+ .WillRepeatedly(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(remove))
+ .Times(1)
+ .WillRepeatedly(Return(false));
+
+ EXPECT_CALL(mock_iptables, ApplyMasquerade(interface, add)).Times(0);
+
+ EXPECT_CALL(mock_iptables, ApplyMarkForUserTraffic(_, add)).Times(0);
+ EXPECT_CALL(mock_iptables, ApplyRuleForUserTraffic(add)).Times(0);
+
+ ASSERT_FALSE(mock_iptables.ApplyVpnSetup(usernames, interface, remove));
+}
+
+} // namespace firewalld
diff --git a/firewalld/libfirewalld-client-test.pc.in b/firewalld/libfirewalld-client-test.pc.in
new file mode 100644
index 0000000..a075a16
--- /dev/null
+++ b/firewalld/libfirewalld-client-test.pc.in
@@ -0,0 +1,6 @@
+include_dir=@INCLUDE_DIR@
+
+Name: libfirewalld-client-test
+Version: 1.0
+Description: firewalld client interface mock library
+Cflags: -I${include_dir}
diff --git a/firewalld/libfirewalld-client.pc.in b/firewalld/libfirewalld-client.pc.in
new file mode 100644
index 0000000..79c7d78
--- /dev/null
+++ b/firewalld/libfirewalld-client.pc.in
@@ -0,0 +1,6 @@
+include_dir=@INCLUDE_DIR@
+
+Name: libfirewalld-client
+Version: 1.0
+Description: firewalld client interface library
+Cflags: -I${include_dir}
diff --git a/firewalld/main.cc b/firewalld/main.cc
new file mode 100644
index 0000000..76e8dd5
--- /dev/null
+++ b/firewalld/main.cc
@@ -0,0 +1,28 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <base/command_line.h>
+#include <brillo/syslog_logging.h>
+
+#include "firewall_daemon.h"
+
+using firewalld::FirewallDaemon;
+
+int main(int argc, char** argv) {
+ base::CommandLine::Init(argc, argv);
+ brillo::InitLog(brillo::kLogToSyslog);
+
+ FirewallDaemon daemon;
+ return daemon.Run();
+}
diff --git a/firewalld/mock_iptables.cc b/firewalld/mock_iptables.cc
new file mode 100644
index 0000000..767637f
--- /dev/null
+++ b/firewalld/mock_iptables.cc
@@ -0,0 +1,23 @@
+// Copyright 2015 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "mock_iptables.h"
+
+namespace firewalld {
+
+MockIpTables::~MockIpTables() {
+ PlugAllHoles();
+}
+
+} // namespace firewalld
diff --git a/firewalld/mock_iptables.h b/firewalld/mock_iptables.h
new file mode 100644
index 0000000..54aaa25
--- /dev/null
+++ b/firewalld/mock_iptables.h
@@ -0,0 +1,50 @@
+// Copyright 2015 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef FIREWALLD_MOCK_IPTABLES_H_
+#define FIREWALLD_MOCK_IPTABLES_H_
+
+#include <string>
+
+#include <base/macros.h>
+#include <gmock/gmock.h>
+
+#include "iptables.h"
+
+namespace firewalld {
+
+class MockIpTables : public IpTables {
+ public:
+ MockIpTables() = default;
+ ~MockIpTables() override;
+
+ MOCK_METHOD4(
+ AddAcceptRule,
+ bool(const std::string&, ProtocolEnum, uint16_t, const std::string&));
+
+ MOCK_METHOD4(
+ DeleteAcceptRule,
+ bool(const std::string&, ProtocolEnum, uint16_t, const std::string&));
+
+ MOCK_METHOD2(ApplyMasquerade, bool(const std::string&, bool));
+ MOCK_METHOD2(ApplyMarkForUserTraffic, bool(const std::string&, bool));
+ MOCK_METHOD1(ApplyRuleForUserTraffic, bool(bool));
+
+ private:
+ DISALLOW_COPY_AND_ASSIGN(MockIpTables);
+};
+
+} // namespace firewalld
+
+#endif // FIREWALLD_MOCK_IPTABLES_H_
diff --git a/firewalld/run_all_tests.cc b/firewalld/run_all_tests.cc
new file mode 100644
index 0000000..b3137cf
--- /dev/null
+++ b/firewalld/run_all_tests.cc
@@ -0,0 +1,20 @@
+// Copyright 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <gtest/gtest.h>
+
+int main(int argc, char **argv) {
+ ::testing::InitGoogleTest(&argc, argv);
+ return RUN_ALL_TESTS();
+}
