permission_broker/firewall.h

// Copyright 2017 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef PERMISSION_BROKER_FIREWALL_H_
#define PERMISSION_BROKER_FIREWALL_H_

#include <stdint.h>

#include <set>
#include <string>
#include <utility>
#include <vector>

#include <base/macros.h>
#include <brillo/errors/error.h>

namespace permission_broker {

extern const char kIpTablesPath[];
extern const char kIp6TablesPath[];
extern const char kIpPath[];

enum ProtocolEnum { kProtocolTcp, kProtocolUdp };

class Firewall {
 public:
  typedef std::pair<uint16_t, std::string> Hole;

  Firewall() = default;
  ~Firewall() = default;

  bool AddAcceptRules(ProtocolEnum protocol,
                      uint16_t port,
                      const std::string& interface);
  bool DeleteAcceptRules(ProtocolEnum protocol,
                         uint16_t port,
                         const std::string& interface);
  bool ApplyVpnSetup(const std::vector<std::string>& usernames,
                     const std::string& interface,
                     bool add);

 private:
  friend class FirewallTest;
  FRIEND_TEST(FirewallTest, ApplyVpnSetupAdd_Success);
  FRIEND_TEST(FirewallTest, ApplyVpnSetupAdd_FailureInUsername);
  FRIEND_TEST(FirewallTest, ApplyVpnSetupAdd_FailureInMasquerade);
  FRIEND_TEST(FirewallTest, ApplyVpnSetupAdd_FailureInRuleForUserTraffic);
  FRIEND_TEST(FirewallTest, ApplyVpnSetupRemove_Success);
  FRIEND_TEST(FirewallTest, ApplyVpnSetupRemove_Failure);

  virtual bool AddAcceptRule(const std::string& executable_path,
                             ProtocolEnum protocol,
                             uint16_t port,
                             const std::string& interface);
  virtual bool DeleteAcceptRule(const std::string& executable_path,
                                ProtocolEnum protocol,
                                uint16_t port,
                                const std::string& interface);

  virtual bool ApplyMasquerade(const std::string& interface, bool add);
  bool ApplyMasqueradeWithExecutable(const std::string& interface,
                                     const std::string& executable_path,
                                     bool add);

  virtual bool ApplyMarkForUserTraffic(const std::string& username, bool add);
  bool ApplyMarkForUserTrafficWithExecutable(const std::string& username,
                                             const std::string& executable_path,
                                             bool add);

  virtual bool ApplyRuleForUserTraffic(bool add);
  bool ApplyRuleForUserTrafficWithVersion(const std::string& ip_version,
                                          bool add);

  // Even though permission_broker runs as a regular user, it can still add
  // other restrictions when launching 'iptables'.
  virtual int RunInMinijail(const std::vector<std::string>& argv);

  // Tracks whether IPv6 filtering is enabled. If set to |true| (the default),
  // then it is required to be working. If |false|, then adding of IPv6 rules is
  // still attempted but not mandatory; however, if it is successful even once,
  // then it'll be changed to |true| and enforced thereafter.
  bool ip6_enabled_ = true;

  DISALLOW_COPY_AND_ASSIGN(Firewall);
};

}  // namespace permission_broker

#endif  // PERMISSION_BROKER_FIREWALL_H_