2 * Copyright (c) 2016 Samsung Electronics Co., Ltd.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "table-firewall.h"
19 #include "helper-firewall.h"
20 #include "stc-firewall.h"
21 #include "stc-manager-gdbus.h"
23 #define IDENTIFIER_LEN 512
25 #define LOCK_NAME "admin"
27 #define CHAIN_NAME "chain"
28 #define CHAIN_TARGET "target"
29 #define CHAIN_PRIORITY "priority"
31 #define RULE_IDENTIFIER "identifier"
32 #define RULE_KEY "key"
34 #define FIREWALL_DBUS_ERROR_NAME "net.stc.firewall.Error.Failed"
36 #define STC_FIREWALL_DBUS_REPLY_ERROR(invocation, err_num) \
37 g_dbus_method_invocation_return_dbus_error((invocation), \
38 FIREWALL_DBUS_ERROR_NAME, \
39 stc_err_strs[-(err_num)])
41 #define STC_FIREWALL_CHECK_LOCK_STATE(invocation) do { \
42 if (g_lock_state == FIREWALL_LOCKED) { \
43 STC_LOGD("Firewall is locked"); \
44 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, \
45 STC_ERROR_PERMISSION_DENIED); \
46 __STC_LOG_FUNC_EXIT__; \
51 static const gchar *stc_err_strs[] = {
64 static GHashTable *g_firewalls = NULL;
65 static int g_lock_state = FIREWALL_UNKONWN;
66 static uint g_chain_priority = 0;
68 static void __fw_rule_copy(firewall_rule_s *rule,
69 const firewall_rule_s *info)
73 rule->chain = g_strdup(info->chain);
76 rule->direction = info->direction;
77 rule->s_ip_type = info->s_ip_type;
78 rule->d_ip_type = info->d_ip_type;
79 rule->s_port_type = info->s_port_type;
80 rule->d_port_type = info->d_port_type;
81 rule->protocol = info->protocol;
82 rule->family = info->family;
84 rule->s_ip1 = info->s_ip1;
85 rule->s_ip2 = info->s_ip2;
86 rule->d_ip1 = info->d_ip1;
87 rule->d_ip2 = info->d_ip2;
89 rule->s_port1 = info->s_port1;
90 rule->s_port2 = info->s_port2;
91 rule->d_port1 = info->d_port1;
92 rule->d_port2 = info->d_port2;
96 rule->ifname = g_strdup(info->ifname);
99 rule->target = info->target;
101 if (info->target_str) {
102 FREE(rule->target_str);
103 rule->target_str = g_strdup(info->target_str);
106 rule->log_level = info->log_level;
108 if (info->log_prefix) {
109 FREE(rule->log_prefix);
110 rule->log_prefix = g_strdup(info->log_prefix);
113 rule->nflog_group = info->nflog_group;
114 rule->nflog_range = info->nflog_range;
115 rule->nflog_threshold = info->nflog_threshold;
117 if (info->nflog_prefix) {
118 FREE(rule->nflog_prefix);
119 rule->nflog_prefix = g_strdup(info->nflog_prefix);
122 if (info->identifier) {
123 FREE(rule->identifier);
124 rule->identifier = g_strdup(info->identifier);
127 rule->key = info->key;
130 static void __fw_rule_make_key(firewall_rule_s *rule,
131 firewall_rule_s *info)
138 str = g_string_sized_new(IDENTIFIER_LEN);
142 g_string_append_printf(str, "%s", rule->chain);
144 g_string_append_printf(str, "_%u%u%u%u%u%u%u", rule->direction,
145 rule->s_ip_type, rule->d_ip_type, rule->s_port_type,
146 rule->d_port_type, rule->protocol, rule->family);
148 if (rule->family == STC_FW_FAMILY_V4) {
149 g_string_append_printf(str, "_");
150 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv4.s_addr);
151 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv4.s_addr);
153 g_string_append_printf(str, "_");
154 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv4.s_addr);
155 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv4.s_addr);
156 } else if (rule->family == STC_FW_FAMILY_V6) {
157 g_string_append_printf(str, "_");
158 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[0]);
159 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[1]);
160 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[2]);
161 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[3]);
162 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[0]);
163 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[1]);
164 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[2]);
165 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[3]);
167 g_string_append_printf(str, "_");
168 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[0]);
169 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[1]);
170 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[2]);
171 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[3]);
172 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[0]);
173 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[1]);
174 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[2]);
175 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[3]);
178 g_string_append_printf(str, "_%04x", rule->s_port1);
179 g_string_append_printf(str, "%04x", rule->s_port2);
181 g_string_append_printf(str, "_%04x", rule->d_port1);
182 g_string_append_printf(str, "%04x", rule->d_port2);
184 g_string_append_printf(str, "_%s", (rule->ifname) ? rule->ifname : "");
185 g_string_append_printf(str, "_%u", rule->target);
187 switch (rule->target) {
188 case STC_FW_RULE_TARGET_LOG:
189 g_string_append_printf(str, "_%u", rule->log_level);
190 g_string_append_printf(str, "_%s", rule->log_prefix);
192 case STC_FW_RULE_TARGET_NFLOG:
193 g_string_append_printf(str, "_%u", rule->nflog_group);
194 g_string_append_printf(str, "_%s", rule->nflog_prefix);
195 g_string_append_printf(str, "_%u", rule->nflog_range);
196 g_string_append_printf(str, "_%u", rule->nflog_threshold);
202 FREE(rule->identifier);
203 rule->identifier = g_string_free(str, FALSE);
204 rule->key = g_str_hash(rule->identifier);
206 FREE(info->identifier);
207 info->identifier = g_strdup(rule->identifier);
208 info->key = rule->key;
210 STC_LOGD("Identifier [%s]", rule->identifier);
211 STC_LOGD("Key [%u]", rule->key);
214 static void __fw_rule_free(void *data)
216 firewall_rule_s *rule = (firewall_rule_s *)data;
220 FREE(rule->target_str);
221 FREE(rule->log_prefix);
222 FREE(rule->nflog_prefix);
223 FREE(rule->identifier);
227 static void __fw_data_free(gpointer value)
229 stc_fw_data_s *data = (stc_fw_data_s *)value;
231 g_slist_free_full(data->rules, __fw_rule_free);
237 static gint __fw_rule_comp(gconstpointer a, gconstpointer b)
239 firewall_rule_s *data = (firewall_rule_s *)a;
240 firewall_rule_s *rule = (firewall_rule_s *)b;
242 if ((data->key == rule->key) &&
243 (g_strcmp0(data->identifier, rule->identifier) == 0))
249 static stc_error_e __fw_chain_add(const char *chain)
252 stc_fw_data_s *lookup;
254 ret_value_msg_if(g_firewalls == NULL,
256 "firewall is not initialized!");
258 lookup = g_hash_table_lookup(g_firewalls, chain);
260 STC_LOGD("chain already present");
261 return STC_ERROR_ALREADY_DATA;
264 data = MALLOC0(stc_fw_data_s, 1);
266 STC_LOGE("data allocation failed");
267 return STC_ERROR_OUT_OF_MEMORY;
270 data->target = STC_FW_CHAIN_TARGET_NONE;
274 g_hash_table_insert(g_firewalls, g_strdup(chain), data);
276 return STC_ERROR_NONE;
279 static stc_error_e __fw_chain_remove(const char *chain)
281 stc_fw_data_s *lookup;
283 ret_value_msg_if(g_firewalls == NULL,
285 "firewall is not initialized!");
287 lookup = g_hash_table_lookup(g_firewalls, chain);
289 STC_LOGE("chain not found");
290 return STC_ERROR_NO_DATA;
293 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
294 STC_LOGE("can't be applied bcz chain is set");
295 return STC_ERROR_INVALID_PARAMETER;
298 g_slist_free_full(lookup->rules, __fw_rule_free);
299 lookup->rules = NULL;
301 g_hash_table_remove(g_firewalls, chain);
303 return STC_ERROR_NONE;
306 static stc_error_e __fw_chain_flush(const char *chain)
308 stc_fw_data_s *lookup;
310 ret_value_msg_if(g_firewalls == NULL,
312 "firewall is not initialized!");
314 lookup = g_hash_table_lookup(g_firewalls, chain);
316 STC_LOGE("chain not found");
317 return STC_ERROR_NO_DATA;
320 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
321 STC_LOGE("can't be applied bcz chain is set");
322 return STC_ERROR_INVALID_PARAMETER;
325 g_slist_free_full(lookup->rules, __fw_rule_free);
326 lookup->rules = NULL;
328 return STC_ERROR_NONE;
331 static stc_error_e __fw_chain_set(const char *chain, stc_fw_data_s value)
333 stc_fw_data_s *lookup;
335 ret_value_msg_if(g_firewalls == NULL,
337 "firewall is not initialized!");
339 lookup = g_hash_table_lookup(g_firewalls, chain);
341 STC_LOGE("chain not found");
342 return STC_ERROR_NO_DATA;
345 lookup->target = value.target;
346 lookup->priority = value.priority;
348 return STC_ERROR_NONE;
351 static stc_fw_data_s *__fw_chain_get(const char *chain)
353 stc_fw_data_s *lookup;
355 ret_value_msg_if(g_firewalls == NULL, NULL,
356 "firewall is not initialized!");
358 lookup = g_hash_table_lookup(g_firewalls, chain);
360 STC_LOGE("chain not found");
367 static stc_error_e __fw_chain_unset(const char *chain)
369 stc_error_e ret = STC_ERROR_NONE;
370 stc_fw_data_s *lookup;
372 ret_value_msg_if(g_firewalls == NULL,
374 "firewall is not initialized!");
376 lookup = g_hash_table_lookup(g_firewalls, chain);
378 STC_LOGE("chain not found");
379 return STC_ERROR_NO_DATA;
382 lookup->target = STC_FW_CHAIN_TARGET_NONE;
383 lookup->priority = 0;
388 static void __fw_chain_make_params(gpointer key, gpointer value,
391 char *chain = (char *)key;
392 stc_fw_data_s *data = (stc_fw_data_s *)value;
393 GVariantBuilder *builder = (GVariantBuilder *)user_data;
394 GVariantBuilder sub_builder;
396 g_variant_builder_init(&sub_builder, G_VARIANT_TYPE("a{sv}"));
398 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_NAME,
399 g_variant_new_string(chain));
401 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_PRIORITY,
402 g_variant_new_uint32(data->priority));
404 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_TARGET,
405 g_variant_new_uint16(data->target));
407 g_variant_builder_add_value(builder, g_variant_builder_end(&sub_builder));
410 static void __fw_rule_make_params(gpointer data, gpointer user_data)
412 firewall_rule_s *rule = (firewall_rule_s *)data;
413 GVariantBuilder *builder = (GVariantBuilder *)user_data;
414 GVariantBuilder sub_builder;
416 g_variant_builder_init(&sub_builder, G_VARIANT_TYPE("a{sv}"));
418 g_variant_builder_add(&sub_builder, "{sv}", RULE_CHAIN,
419 g_variant_new_string(rule->chain));
421 if (rule->direction != STC_FW_DIRECTION_NONE)
422 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIRECTION,
423 g_variant_new_uint16(rule->direction));
425 if (rule->s_ip_type != STC_FW_IP_NONE)
426 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIPTYPE,
427 g_variant_new_uint16(rule->s_ip_type));
429 if (rule->d_ip_type != STC_FW_IP_NONE)
430 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIPTYPE,
431 g_variant_new_uint16(rule->d_ip_type));
433 if (rule->s_port_type != STC_FW_PORT_NONE)
434 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORTTYPE,
435 g_variant_new_uint16(rule->s_port_type));
437 if (rule->d_port_type != STC_FW_PORT_NONE)
438 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORTTYPE,
439 g_variant_new_uint16(rule->d_port_type));
441 if (rule->protocol != STC_FW_PROTOCOL_NONE)
442 g_variant_builder_add(&sub_builder, "{sv}", RULE_PROTOCOL,
443 g_variant_new_uint16(rule->protocol));
445 if (rule->family != STC_FW_FAMILY_NONE)
446 g_variant_builder_add(&sub_builder, "{sv}", RULE_FAMILY,
447 g_variant_new_uint16(rule->family));
449 if (rule->family == STC_FW_FAMILY_V4) {
452 switch (rule->s_ip_type) {
453 case STC_FW_IP_RANGE:
456 addr = g_try_malloc0(INET_ADDRSTRLEN);
458 inet_ntop(AF_INET, &(rule->s_ip2.Ipv4), addr, INET_ADDRSTRLEN);
459 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP2,
460 g_variant_new_string(addr));
464 case STC_FW_IP_SINGLE:
465 addr = g_try_malloc0(INET_ADDRSTRLEN);
467 inet_ntop(AF_INET, &(rule->s_ip1.Ipv4), addr, INET_ADDRSTRLEN);
468 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP1,
469 g_variant_new_string(addr));
477 switch (rule->d_ip_type) {
478 case STC_FW_IP_RANGE:
481 addr = g_try_malloc0(INET_ADDRSTRLEN);
483 inet_ntop(AF_INET, &(rule->d_ip2.Ipv4), addr, INET_ADDRSTRLEN);
484 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP2,
485 g_variant_new_string(addr));
489 case STC_FW_IP_SINGLE:
490 addr = g_try_malloc0(INET_ADDRSTRLEN);
492 inet_ntop(AF_INET, &(rule->d_ip1.Ipv4), addr, INET_ADDRSTRLEN);
493 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP1,
494 g_variant_new_string(addr));
501 } else if (rule->family == STC_FW_FAMILY_V6) {
504 switch (rule->s_ip_type) {
505 case STC_FW_IP_RANGE:
508 addr = g_try_malloc0(INET6_ADDRSTRLEN);
510 inet_ntop(AF_INET6, &(rule->s_ip2.Ipv6), addr, INET6_ADDRSTRLEN);
511 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP2,
512 g_variant_new_string(addr));
516 case STC_FW_IP_SINGLE:
517 addr = g_try_malloc0(INET6_ADDRSTRLEN);
519 inet_ntop(AF_INET6, &(rule->s_ip1.Ipv6), addr, INET6_ADDRSTRLEN);
520 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP1,
521 g_variant_new_string(addr));
529 switch (rule->d_ip_type) {
530 case STC_FW_IP_RANGE:
533 addr = g_try_malloc0(INET6_ADDRSTRLEN);
535 inet_ntop(AF_INET6, &(rule->d_ip2.Ipv6), addr, INET6_ADDRSTRLEN);
536 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP2,
537 g_variant_new_string(addr));
541 case STC_FW_IP_SINGLE:
542 addr = g_try_malloc0(INET6_ADDRSTRLEN);
544 inet_ntop(AF_INET6, &(rule->d_ip1.Ipv6), addr, INET6_ADDRSTRLEN);
545 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP1,
546 g_variant_new_string(addr));
555 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORT1,
556 g_variant_new_uint32(rule->s_port1));
558 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORT2,
559 g_variant_new_uint32(rule->s_port2));
561 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORT1,
562 g_variant_new_uint32(rule->d_port1));
564 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORT2,
565 g_variant_new_uint32(rule->d_port2));
568 g_variant_builder_add(&sub_builder, "{sv}", RULE_IFNAME,
569 g_variant_new_string(rule->ifname));
571 if (rule->target != STC_FW_RULE_TARGET_NONE)
572 g_variant_builder_add(&sub_builder, "{sv}", RULE_TARGET,
573 g_variant_new_uint16(rule->target));
575 switch (rule->target) {
576 case STC_FW_RULE_TARGET_LOG:
577 g_variant_builder_add(&sub_builder, "{sv}", RULE_LOG_LEVEL,
578 g_variant_new_uint16(rule->log_level));
580 if (rule->log_prefix)
581 g_variant_builder_add(&sub_builder, "{sv}", RULE_LOG_PREFIX,
582 g_variant_new_string(rule->log_prefix));
584 case STC_FW_RULE_TARGET_NFLOG:
585 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_GROUP,
586 g_variant_new_uint16(rule->nflog_group));
588 if (rule->nflog_prefix)
589 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_PREFIX,
590 g_variant_new_string(rule->nflog_prefix));
592 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_RANGE,
593 g_variant_new_uint16(rule->nflog_range));
595 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_THRESHOLD,
596 g_variant_new_uint16(rule->nflog_threshold));
602 g_variant_builder_add(&sub_builder, "{sv}", RULE_IDENTIFIER,
603 g_variant_new_string(rule->identifier));
605 g_variant_builder_add(&sub_builder, "{sv}", RULE_KEY,
606 g_variant_new_uint32(rule->key));
608 g_variant_builder_add_value(builder, g_variant_builder_end(&sub_builder));
611 static void __fw_rule_set_to_chain(gpointer data, gpointer user_data)
613 firewall_rule_s *rule = (firewall_rule_s *)data;
614 char *chain = (char *)user_data;
616 if (chain && (g_strcmp0(rule->chain, chain) != 0))
619 switch (rule->target) {
620 case STC_FW_RULE_TARGET_ACCEPT:
621 FREE(rule->target_str);
622 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_ACCEPT);
624 case STC_FW_RULE_TARGET_DROP:
625 FREE(rule->target_str);
626 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_DROP);
628 case STC_FW_RULE_TARGET_LOG:
629 FREE(rule->target_str);
630 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_LOG);
632 case STC_FW_RULE_TARGET_NFLOG:
633 FREE(rule->target_str);
634 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_NFLOG);
640 firewall_rule_append(rule);
643 static void __fw_rule_print_rules(gpointer data, gpointer user_data)
645 firewall_rule_s *rule = (firewall_rule_s *)data;
647 STC_LOGD("[%s][%d][%s][%d][%d][%04x][%04x]"
648 "[%d][%04x][%04x][%d][%s][%d][%s][%d][%d]",
649 rule->chain, rule->direction, rule->ifname,
651 rule->s_port_type, rule->s_port1, rule->s_port2,
652 rule->d_port_type, rule->d_port1, rule->d_port2,
653 rule->target, rule->target_str,
654 rule->nflog_group, rule->nflog_prefix,
655 rule->nflog_range, rule->nflog_threshold);
657 switch (rule->family) {
658 case STC_FW_FAMILY_V4:
659 STC_LOGD("[%d][%d][%08x][%08x][%d][%08x][%08x]",
661 rule->s_ip_type, rule->s_ip1.Ipv4.s_addr, rule->s_ip2.Ipv4.s_addr,
662 rule->d_ip_type, rule->d_ip1.Ipv4.s_addr, rule->d_ip2.Ipv4.s_addr);
664 case STC_FW_FAMILY_V6:
665 STC_LOGD("[%d][%d][%08x:%08x:%08x:%08x]"
666 "[%d][%08x:%08x:%08x:%08x]",
669 rule->s_ip1.Ipv6.s6_addr32[0], rule->s_ip1.Ipv6.s6_addr32[1],
670 rule->s_ip1.Ipv6.s6_addr32[2], rule->s_ip1.Ipv6.s6_addr32[3],
672 rule->d_ip1.Ipv6.s6_addr32[0], rule->d_ip1.Ipv6.s6_addr32[1],
673 rule->d_ip1.Ipv6.s6_addr32[2], rule->d_ip1.Ipv6.s6_addr32[3]);
680 static void __fw_foreach_to_print_rule(gpointer key, gpointer value,
683 stc_fw_data_s *data = (stc_fw_data_s *)value;
685 g_slist_foreach(data->rules, __fw_rule_print_rules, user_data);
688 static void __fw_foreach_to_make_rule_param(gpointer key, gpointer value,
691 stc_fw_data_s *data = (stc_fw_data_s *)value;
693 g_slist_foreach(data->rules, __fw_rule_make_params, user_data);
696 static void __fw_foreach_to_set_rule_to_chain(gpointer key, gpointer value,
699 stc_fw_data_s *data = (stc_fw_data_s *)value;
700 char *chain = (char *)user_data;
702 if (chain || (data->target != STC_FW_CHAIN_TARGET_NONE))
703 g_slist_foreach(data->rules, __fw_rule_set_to_chain, user_data);
706 static void __fw_foreach_to_set_chain(gpointer key, gpointer value,
709 char *chain = (char *)key;
710 stc_fw_data_s *data = (stc_fw_data_s *)value;
712 if (data->target != STC_FW_CHAIN_TARGET_NONE) {
713 firewall_chain_s info;
714 memset(&info, 0, sizeof(firewall_chain_s));
716 info.target = data->target;
717 info.priority = data->priority;
718 firewall_chain_set(&info);
722 static void __fw_foreach_to_add_chain(gpointer key, gpointer value,
725 char *chain = (char *)key;
726 stc_fw_data_s *data = (stc_fw_data_s *)value;
728 if (data->target != STC_FW_CHAIN_TARGET_NONE) {
729 firewall_chain_s info;
730 memset(&info, 0, sizeof(firewall_chain_s));
732 info.target = data->target;
733 info.priority = data->priority;
734 firewall_chain_add(&info);
738 static void __fw_chain_foreach(GHFunc func, void *user_data)
740 g_hash_table_foreach(g_firewalls, func, user_data);
743 stc_cb_ret_e __fw_table_chain_info_cb(const firewall_chain_s *info,
748 data = MALLOC0(stc_fw_data_s, 1);
750 STC_LOGE("data allocation failed");
754 data->target = info->target;
755 data->priority = info->priority;
758 g_hash_table_insert(g_firewalls, g_strdup(info->chain), data);
763 stc_cb_ret_e __fw_table_rule_info_cb(const firewall_rule_s *info,
766 stc_fw_data_s *lookup;
767 firewall_rule_s *rule;
769 lookup = g_hash_table_lookup(g_firewalls, info->chain);
771 STC_LOGE("chain not found");
775 rule = MALLOC0(firewall_rule_s, 1);
777 STC_LOGE("rule allocation failed");
781 memset(rule, 0, sizeof(firewall_rule_s));
782 __fw_rule_copy(rule, info);
784 lookup->rules = g_slist_append(lookup->rules, rule);
789 static stc_error_e __fw_rule_add(firewall_rule_s *info)
791 stc_fw_data_s *lookup;
792 firewall_rule_s *rule;
795 ret_value_msg_if(g_firewalls == NULL,
797 "firewall is not initialized!");
799 lookup = g_hash_table_lookup(g_firewalls, info->chain);
801 STC_LOGE("chain not found");
802 return STC_ERROR_NO_DATA;
805 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
806 STC_LOGE("can't be applied bcz chain is set");
807 return STC_ERROR_INVALID_PARAMETER;
810 rule = MALLOC0(firewall_rule_s, 1);
812 STC_LOGE("rule allocation failed");
813 return STC_ERROR_OUT_OF_MEMORY;
816 memset(rule, 0, sizeof(firewall_rule_s));
817 __fw_rule_copy(rule, info);
818 __fw_rule_make_key(rule, info);
820 comp = g_slist_find_custom(lookup->rules, rule, __fw_rule_comp);
822 STC_LOGD("rule already present");
823 __fw_rule_free(rule);
824 return STC_ERROR_ALREADY_DATA;
827 lookup->rules = g_slist_append(lookup->rules, rule);
829 return STC_ERROR_NONE;
832 static stc_error_e __fw_rule_remove(const firewall_rule_s *info)
834 stc_fw_data_s *lookup;
837 firewall_rule_s *rule;
839 ret_value_msg_if(g_firewalls == NULL,
841 "firewall is not initialized!");
843 lookup = g_hash_table_lookup(g_firewalls, info->chain);
845 STC_LOGE("chain not found");
846 return STC_ERROR_NO_DATA;
849 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
850 STC_LOGE("can't be applied bcz chain is set");
851 return STC_ERROR_INVALID_PARAMETER;
854 rule_list = lookup->rules;
855 comp = g_slist_find_custom(rule_list, info, __fw_rule_comp);
857 STC_LOGD("rule not found");
858 return STC_ERROR_NO_DATA;
862 lookup->rules = g_slist_remove(lookup->rules, rule);
863 __fw_rule_free(rule);
865 return STC_ERROR_NONE;
868 static stc_error_e __fw_rule_update(firewall_rule_s *info)
870 stc_fw_data_s *lookup;
873 firewall_rule_s *origin_rule;
874 firewall_rule_s *update_rule;
876 ret_value_msg_if(g_firewalls == NULL,
878 "firewall is not initialized!");
880 lookup = g_hash_table_lookup(g_firewalls, info->chain);
882 STC_LOGE("chain not found");
883 return STC_ERROR_NO_DATA;
886 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
887 STC_LOGE("can't be applied bcz chain is set");
888 return STC_ERROR_INVALID_PARAMETER;
891 rule_list = lookup->rules;
892 comp = g_slist_find_custom(rule_list, info, __fw_rule_comp);
894 STC_LOGD("rule not found");
895 return STC_ERROR_NO_DATA;
898 origin_rule = comp->data;
900 update_rule = MALLOC0(firewall_rule_s, 1);
902 STC_LOGE("rule allocation failed");
903 return STC_ERROR_OUT_OF_MEMORY;
906 memset(update_rule, 0, sizeof(firewall_rule_s));
907 __fw_rule_copy(update_rule, info);
908 __fw_rule_make_key(update_rule, info);
910 comp = g_slist_find_custom(lookup->rules, update_rule, __fw_rule_comp);
912 STC_LOGD("rule already present");
913 __fw_rule_free(update_rule);
914 return STC_ERROR_ALREADY_DATA;
917 lookup->rules = g_slist_remove(lookup->rules, origin_rule);
918 __fw_rule_free(origin_rule);
920 lookup->rules = g_slist_append(lookup->rules, update_rule);
922 return STC_ERROR_NONE;
925 static void __fw_rule_extract(const char *key, GVariant *value,
928 firewall_rule_s *rule = (firewall_rule_s *)user_data;
930 __STC_LOG_FUNC_EXIT__;
934 if (g_strcmp0(key, RULE_CHAIN) == 0) {
936 const gchar *str = g_variant_get_string(value, &str_length);
937 rule->chain = g_strdup(str);
938 STC_LOGD("%s: [%s]", RULE_CHAIN, rule->chain);
940 } else if (g_strcmp0(key, RULE_DIRECTION) == 0) {
941 rule->direction = g_variant_get_uint16(value);
942 STC_LOGD("%s: [%u]", RULE_DIRECTION, rule->direction);
944 } else if (g_strcmp0(key, RULE_SIPTYPE) == 0) {
945 rule->s_ip_type = g_variant_get_uint16(value);
946 STC_LOGD("%s: [%u]", RULE_SIPTYPE, rule->s_ip_type);
948 } else if (g_strcmp0(key, RULE_DIPTYPE) == 0) {
949 rule->d_ip_type = g_variant_get_uint16(value);
950 STC_LOGD("%s: [%u]", RULE_DIPTYPE, rule->d_ip_type);
952 } else if (g_strcmp0(key, RULE_SPORTTYPE) == 0) {
953 rule->s_port_type = g_variant_get_uint16(value);
954 STC_LOGD("%s: [%u]", RULE_SPORTTYPE, rule->s_port_type);
956 } else if (g_strcmp0(key, RULE_DPORTTYPE) == 0) {
957 rule->d_port_type = g_variant_get_uint16(value);
958 STC_LOGD("%s: [%u]", RULE_DPORTTYPE, rule->d_port_type);
960 } else if (g_strcmp0(key, RULE_PROTOCOL) == 0) {
961 rule->protocol = g_variant_get_uint16(value);
962 STC_LOGD("%s: [%u]", RULE_PROTOCOL, rule->protocol);
964 } else if (g_strcmp0(key, RULE_FAMILY) == 0) {
965 rule->family = g_variant_get_uint16(value);
966 STC_LOGD("%s: [%u]", RULE_FAMILY, rule->family);
968 } else if (g_strcmp0(key, RULE_SIP1) == 0) {
969 if (rule->s_ip_type != STC_FW_IP_NONE) {
971 const gchar *str = g_variant_get_string(value, &str_length);
972 if (rule->family == STC_FW_FAMILY_V4) {
973 inet_pton(AF_INET, str, &(rule->s_ip1.Ipv4));
974 STC_LOGD("%s: [%08x]", RULE_SIP1, rule->s_ip1.Ipv4.s_addr);
975 } else if (rule->family == STC_FW_FAMILY_V6) {
976 inet_pton(AF_INET6, str, &(rule->s_ip1.Ipv6));
977 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_SIP1,
978 rule->s_ip1.Ipv6.s6_addr32[0], rule->s_ip1.Ipv6.s6_addr32[1],
979 rule->s_ip1.Ipv6.s6_addr32[2], rule->s_ip1.Ipv6.s6_addr32[3]);
983 } else if (g_strcmp0(key, RULE_SIP2) == 0) {
984 if (rule->s_ip_type != STC_FW_IP_NONE) {
986 const gchar *str = g_variant_get_string(value, &str_length);
987 if (rule->family == STC_FW_FAMILY_V4) {
988 inet_pton(AF_INET, str, &(rule->s_ip2.Ipv4));
989 STC_LOGD("%s: [%08x]", RULE_SIP2, rule->s_ip2.Ipv4.s_addr);
990 } else if (rule->family == STC_FW_FAMILY_V6) {
991 inet_pton(AF_INET6, str, &(rule->s_ip2.Ipv6));
992 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_SIP2,
993 rule->s_ip2.Ipv6.s6_addr32[0], rule->s_ip2.Ipv6.s6_addr32[1],
994 rule->s_ip2.Ipv6.s6_addr32[2], rule->s_ip2.Ipv6.s6_addr32[3]);
998 } else if (g_strcmp0(key, RULE_DIP1) == 0) {
999 if (rule->d_ip_type != STC_FW_IP_NONE) {
1001 const gchar *str = g_variant_get_string(value, &str_length);
1002 if (rule->family == STC_FW_FAMILY_V4) {
1003 inet_pton(AF_INET, str, &(rule->d_ip1.Ipv4));
1004 STC_LOGD("%s: [%08x]", RULE_DIP1, rule->d_ip1.Ipv4.s_addr);
1005 } else if (rule->family == STC_FW_FAMILY_V6) {
1006 inet_pton(AF_INET6, str, &(rule->d_ip1.Ipv6));
1007 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_DIP1,
1008 rule->d_ip1.Ipv6.s6_addr32[0], rule->d_ip1.Ipv6.s6_addr32[1],
1009 rule->d_ip1.Ipv6.s6_addr32[2], rule->d_ip1.Ipv6.s6_addr32[3]);
1013 } else if (g_strcmp0(key, RULE_DIP2) == 0) {
1014 if (rule->d_ip_type != STC_FW_IP_NONE) {
1016 const gchar *str = g_variant_get_string(value, &str_length);
1017 if (rule->family == STC_FW_FAMILY_V4) {
1018 inet_pton(AF_INET, str, &(rule->d_ip2.Ipv4));
1019 STC_LOGD("%s: [%08x]", RULE_DIP2, rule->d_ip2.Ipv4.s_addr);
1020 } else if (rule->family == STC_FW_FAMILY_V6) {
1021 inet_pton(AF_INET6, str, &(rule->d_ip2.Ipv6));
1022 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_DIP2,
1023 rule->d_ip2.Ipv6.s6_addr32[0], rule->d_ip2.Ipv6.s6_addr32[1],
1024 rule->d_ip2.Ipv6.s6_addr32[2], rule->d_ip2.Ipv6.s6_addr32[3]);
1028 } else if (g_strcmp0(key, RULE_SPORT1) == 0) {
1029 if (rule->s_port_type != STC_FW_PORT_NONE) {
1030 rule->s_port1 = g_variant_get_uint32(value);
1031 STC_LOGD("%s: [%04x]", RULE_SPORT1, rule->s_port1);
1034 } else if (g_strcmp0(key, RULE_SPORT2) == 0) {
1035 if (rule->s_port_type != STC_FW_PORT_NONE) {
1036 rule->s_port2 = g_variant_get_uint32(value);
1037 STC_LOGD("%s: [%04x]", RULE_SPORT2, rule->s_port2);
1040 } else if (g_strcmp0(key, RULE_DPORT1) == 0) {
1041 if (rule->d_port_type != STC_FW_PORT_NONE) {
1042 rule->d_port1 = g_variant_get_uint32(value);
1043 STC_LOGD("%s: [%04x]", RULE_DPORT1, rule->d_port1);
1046 } else if (g_strcmp0(key, RULE_DPORT2) == 0) {
1047 if (rule->d_port_type != STC_FW_PORT_NONE) {
1048 rule->d_port2 = g_variant_get_uint32(value);
1049 STC_LOGD("%s: [%04x]", RULE_DPORT2, rule->d_port2);
1052 } else if (g_strcmp0(key, RULE_IFNAME) == 0) {
1053 if (rule->direction != STC_FW_DIRECTION_NONE) {
1055 const gchar *str = g_variant_get_string(value, &str_length);
1056 rule->ifname = g_strdup(str);
1057 STC_LOGD("%s: [%s]", RULE_IFNAME, rule->ifname);
1060 } else if (g_strcmp0(key, RULE_TARGET) == 0) {
1061 rule->target = g_variant_get_uint16(value);
1062 STC_LOGD("%s: [%u]", RULE_TARGET, rule->target);
1064 } else if (g_strcmp0(key, RULE_LOG_LEVEL) == 0) {
1065 if (rule->target == STC_FW_RULE_TARGET_LOG) {
1066 rule->log_level = g_variant_get_uint16(value);
1067 STC_LOGD("%s: [%u]", RULE_LOG_LEVEL, rule->log_level);
1070 } else if (g_strcmp0(key, RULE_LOG_PREFIX) == 0) {
1071 if (rule->target == STC_FW_RULE_TARGET_LOG) {
1073 const gchar *str = g_variant_get_string(value, &str_length);
1074 rule->log_prefix = g_strdup(str);
1075 STC_LOGD("%s: [%s]", RULE_LOG_PREFIX, rule->log_prefix);
1078 } else if (g_strcmp0(key, RULE_NFLOG_GROUP) == 0) {
1079 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1080 rule->nflog_group = g_variant_get_uint16(value);
1081 STC_LOGD("%s: [%u]", RULE_NFLOG_GROUP, rule->nflog_group);
1084 } else if (g_strcmp0(key, RULE_NFLOG_PREFIX) == 0) {
1085 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1087 const gchar *str = g_variant_get_string(value, &str_length);
1088 rule->nflog_prefix = g_strdup(str);
1089 STC_LOGD("%s: [%s]", RULE_NFLOG_PREFIX, rule->nflog_prefix);
1092 } else if (g_strcmp0(key, RULE_NFLOG_RANGE) == 0) {
1093 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1094 rule->nflog_range = g_variant_get_uint16(value);
1095 STC_LOGD("%s: [%u]", RULE_NFLOG_RANGE, rule->nflog_range);
1098 } else if (g_strcmp0(key, RULE_NFLOG_THRESHOLD) == 0) {
1099 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1100 rule->nflog_threshold = g_variant_get_uint16(value);
1101 STC_LOGD("%s: [%u]", RULE_NFLOG_THRESHOLD, rule->nflog_threshold);
1104 } else if (g_strcmp0(key, RULE_IDENTIFIER) == 0) {
1106 const gchar *str = g_variant_get_string(value, &str_length);
1107 rule->identifier = g_strdup(str);
1108 STC_LOGD("%s: [%s]", RULE_IDENTIFIER, rule->identifier);
1110 } else if (g_strcmp0(key, RULE_KEY) == 0) {
1111 rule->key = g_variant_get_uint32(value);
1112 STC_LOGD("%s: [%u]", RULE_KEY, rule->key);
1115 STC_LOGD("Unknown rule [%s]", key);
1119 gboolean __validate_fw_rule(firewall_rule_s *rule)
1121 __STC_LOG_FUNC_ENTER__;
1124 __STC_LOG_FUNC_EXIT__;
1128 if (rule->chain == NULL) {
1129 __STC_LOG_FUNC_EXIT__;
1133 if (rule->direction > STC_FW_DIRECTION_OUT) {
1134 __STC_LOG_FUNC_EXIT__;
1138 if (rule->s_ip_type > STC_FW_IP_RANGE) {
1139 __STC_LOG_FUNC_EXIT__;
1143 if (rule->d_ip_type > STC_FW_IP_RANGE) {
1144 __STC_LOG_FUNC_EXIT__;
1148 if (rule->s_port_type > STC_FW_PORT_RANGE) {
1149 __STC_LOG_FUNC_EXIT__;
1153 if (rule->d_port_type > STC_FW_PORT_RANGE) {
1154 __STC_LOG_FUNC_EXIT__;
1158 if (rule->protocol > STC_FW_PROTOCOL_ALL) {
1159 __STC_LOG_FUNC_EXIT__;
1163 if (rule->family > STC_FW_FAMILY_V6) {
1164 __STC_LOG_FUNC_EXIT__;
1168 if (rule->target >= STC_FW_RULE_TARGET_MAX) {
1169 __STC_LOG_FUNC_EXIT__;
1173 if (rule->target == STC_FW_RULE_TARGET_LOG &&
1174 (rule->log_prefix == NULL ||
1175 rule->log_prefix[0] == '\0')) {
1176 __STC_LOG_FUNC_EXIT__;
1180 if (rule->target == STC_FW_RULE_TARGET_NFLOG &&
1181 (rule->nflog_prefix == NULL ||
1182 rule->nflog_prefix[0] == '\0')) {
1183 __STC_LOG_FUNC_EXIT__;
1187 __STC_LOG_FUNC_EXIT__;
1191 void stc_firewall_init(void)
1193 int ret = STC_ERROR_NONE;
1195 g_firewalls = g_hash_table_new_full(g_str_hash,
1196 g_str_equal, g_free, __fw_data_free);
1198 ret = table_firewall_get_lock(LOCK_NAME, &g_lock_state);
1199 if (ret != STC_ERROR_NONE)
1200 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1202 if (g_lock_state == FIREWALL_UNKONWN)
1203 g_lock_state = FIREWALL_UNLOCKED;
1205 table_firewall_foreach_chain(__fw_table_chain_info_cb, NULL);
1206 table_firewall_foreach_rule(__fw_table_rule_info_cb, NULL);
1209 void stc_firewall_update(void)
1211 __fw_chain_foreach(__fw_foreach_to_add_chain, NULL);
1212 __fw_chain_foreach(__fw_foreach_to_set_rule_to_chain, NULL);
1213 __fw_chain_foreach(__fw_foreach_to_set_chain, NULL);
1216 void stc_firewall_deinit(void)
1219 g_hash_table_destroy(g_firewalls);
1224 gboolean handle_firewall_lock(StcFirewall *object,
1225 GDBusMethodInvocation *invocation,
1228 __STC_LOG_FUNC_ENTER__;
1229 int ret = STC_ERROR_NONE;
1231 ret = table_firewall_update_lock(LOCK_NAME, FIREWALL_LOCKED);
1232 if (ret != STC_ERROR_NONE)
1233 table_firewall_insert_lock(LOCK_NAME, FIREWALL_LOCKED);
1235 g_lock_state = FIREWALL_LOCKED;
1237 STC_DBUS_REPLY_ERROR_NONE(invocation);
1238 __STC_LOG_FUNC_EXIT__;
1242 gboolean handle_firewall_unlock(StcFirewall *object,
1243 GDBusMethodInvocation *invocation,
1246 __STC_LOG_FUNC_ENTER__;
1247 int ret = STC_ERROR_NONE;
1249 ret = table_firewall_update_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1250 if (ret != STC_ERROR_NONE)
1251 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1253 g_lock_state = FIREWALL_UNLOCKED;
1255 STC_DBUS_REPLY_ERROR_NONE(invocation);
1256 __STC_LOG_FUNC_EXIT__;
1260 gboolean handle_firewall_get_lock(StcFirewall *object,
1261 GDBusMethodInvocation *invocation,
1264 __STC_LOG_FUNC_ENTER__;
1265 int ret = STC_ERROR_NONE;
1266 GVariant *return_parameters = NULL;
1268 if (g_lock_state == FIREWALL_UNKONWN) {
1269 ret = table_firewall_get_lock(LOCK_NAME, &g_lock_state);
1270 if (ret != STC_ERROR_NONE)
1271 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1273 if (g_lock_state == FIREWALL_UNKONWN)
1274 g_lock_state = FIREWALL_UNLOCKED;
1277 return_parameters = g_variant_new("(i)", g_lock_state);
1278 STC_DBUS_REPLY(invocation, return_parameters);
1279 __STC_LOG_FUNC_EXIT__;
1283 gboolean handle_firewall_add_chain(StcFirewall *object,
1284 GDBusMethodInvocation *invocation,
1288 __STC_LOG_FUNC_ENTER__;
1289 firewall_chain_s info;
1290 int ret = STC_ERROR_NONE;
1292 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1294 if (chain == NULL) {
1295 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1296 STC_ERROR_INVALID_PARAMETER);
1297 __STC_LOG_FUNC_EXIT__;
1301 ret = __fw_chain_add(chain);
1302 if (ret == STC_ERROR_NONE) {
1303 memset(&info, 0, sizeof(firewall_chain_s));
1306 info.target = STC_FW_CHAIN_TARGET_NONE;
1307 table_firewall_insert_chain(&info);
1309 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1310 __STC_LOG_FUNC_EXIT__;
1314 STC_DBUS_REPLY_ERROR_NONE(invocation);
1315 __STC_LOG_FUNC_EXIT__;
1319 gboolean handle_firewall_remove_chain(StcFirewall *object,
1320 GDBusMethodInvocation *invocation,
1324 __STC_LOG_FUNC_ENTER__;
1325 firewall_chain_s info;
1326 int ret = STC_ERROR_NONE;
1328 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1330 if (chain == NULL) {
1331 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1332 STC_ERROR_INVALID_PARAMETER);
1333 __STC_LOG_FUNC_EXIT__;
1337 ret = __fw_chain_remove(chain);
1338 if (ret == STC_ERROR_NONE) {
1339 memset(&info, 0, sizeof(firewall_chain_s));
1341 table_firewall_flush_chain(&info);
1342 table_firewall_delete_chain(&info);
1344 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1345 __STC_LOG_FUNC_EXIT__;
1349 STC_DBUS_REPLY_ERROR_NONE(invocation);
1350 __STC_LOG_FUNC_EXIT__;
1354 gboolean handle_firewall_flush_chain(StcFirewall *object,
1355 GDBusMethodInvocation *invocation,
1359 __STC_LOG_FUNC_ENTER__;
1360 firewall_chain_s info;
1361 int ret = STC_ERROR_NONE;
1363 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1365 if (chain == NULL) {
1366 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1367 STC_ERROR_INVALID_PARAMETER);
1368 __STC_LOG_FUNC_EXIT__;
1372 ret = __fw_chain_flush(chain);
1373 if (ret == STC_ERROR_NONE) {
1374 memset(&info, 0, sizeof(firewall_chain_s));
1376 table_firewall_flush_chain(&info);
1378 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1379 __STC_LOG_FUNC_EXIT__;
1383 STC_DBUS_REPLY_ERROR_NONE(invocation);
1384 __STC_LOG_FUNC_EXIT__;
1388 gboolean handle_firewall_get_all_chain(StcFirewall *object,
1389 GDBusMethodInvocation *invocation,
1392 __STC_LOG_FUNC_ENTER__;
1393 GVariantBuilder *builder = NULL;
1394 GVariant *return_parameters = NULL;
1396 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1398 builder = g_variant_builder_new(G_VARIANT_TYPE("aa{sv}"));
1400 __fw_chain_foreach(__fw_chain_make_params, builder);
1402 return_parameters = g_variant_new("(aa{sv})", builder);
1403 g_variant_builder_unref(builder);
1405 DEBUG_GDBUS_VARIANT("Return parameters: ", return_parameters);
1406 STC_DBUS_REPLY(invocation, return_parameters);
1407 __STC_LOG_FUNC_EXIT__;
1411 gboolean handle_firewall_set_chain(StcFirewall *object,
1412 GDBusMethodInvocation *invocation,
1414 unsigned int target,
1417 __STC_LOG_FUNC_ENTER__;
1418 stc_fw_data_s *lookup = NULL;
1420 firewall_chain_s info;
1422 int ret = STC_ERROR_NONE;
1424 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1426 if (chain == NULL ||
1427 target >= STC_FW_CHAIN_TARGET_MAX) {
1428 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1429 STC_ERROR_INVALID_PARAMETER);
1430 __STC_LOG_FUNC_EXIT__;
1434 lookup = __fw_chain_get(chain);
1435 if (lookup == NULL) {
1436 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1438 __STC_LOG_FUNC_EXIT__;
1442 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
1443 STC_LOGE("chain is already set");
1444 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1445 STC_ERROR_INVALID_PARAMETER);
1446 __STC_LOG_FUNC_EXIT__;
1451 memset(&info, 0, sizeof(firewall_chain_s));
1453 info.target = target;
1455 ret = firewall_chain_add(&info);
1456 if (ret != STC_ERROR_NONE) {
1457 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1458 __STC_LOG_FUNC_EXIT__;
1462 __fw_chain_foreach(__fw_foreach_to_set_rule_to_chain, chain);
1463 ret = firewall_chain_set(&info);
1464 if (ret != STC_ERROR_NONE) {
1465 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1466 __STC_LOG_FUNC_EXIT__;
1471 priority = g_chain_priority + 1;
1473 memset(&data, 0, sizeof(stc_fw_data_s));
1474 data.target = target;
1475 data.priority = priority;
1477 ret = __fw_chain_set(chain, data);
1478 if (ret == STC_ERROR_NONE) {
1479 info.priority = priority;
1480 table_firewall_update_chain(&info);
1481 g_chain_priority = priority;
1483 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1484 __STC_LOG_FUNC_EXIT__;
1488 STC_DBUS_REPLY_ERROR_NONE(invocation);
1489 __STC_LOG_FUNC_EXIT__;
1493 gboolean handle_firewall_unset_chain(StcFirewall *object,
1494 GDBusMethodInvocation *invocation,
1498 __STC_LOG_FUNC_ENTER__;
1499 stc_fw_data_s *lookup = NULL;
1500 firewall_chain_s info;
1501 int ret = STC_ERROR_NONE;
1503 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1505 if (chain == NULL) {
1506 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1507 STC_ERROR_INVALID_PARAMETER);
1508 __STC_LOG_FUNC_EXIT__;
1512 lookup = __fw_chain_get(chain);
1513 if (lookup == NULL) {
1514 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1516 __STC_LOG_FUNC_EXIT__;
1520 if (lookup->target == STC_FW_CHAIN_TARGET_NONE) {
1521 STC_LOGE("chain is not set");
1522 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1523 STC_ERROR_INVALID_PARAMETER);
1524 __STC_LOG_FUNC_EXIT__;
1529 memset(&info, 0, sizeof(firewall_chain_s));
1531 info.target = lookup->target;
1533 ret = firewall_chain_unset(&info);
1534 if (ret != STC_ERROR_NONE) {
1535 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1536 __STC_LOG_FUNC_EXIT__;
1540 ret = firewall_chain_remove(&info);
1541 if (ret != STC_ERROR_NONE) {
1542 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1543 __STC_LOG_FUNC_EXIT__;
1548 ret = __fw_chain_unset(chain);
1549 if (ret == STC_ERROR_NONE) {
1550 info.target = STC_FW_CHAIN_TARGET_NONE;
1552 table_firewall_update_chain(&info);
1554 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1555 __STC_LOG_FUNC_EXIT__;
1559 STC_DBUS_REPLY_ERROR_NONE(invocation);
1560 __STC_LOG_FUNC_EXIT__;
1564 gboolean handle_firewall_add_rule(StcFirewall *object,
1565 GDBusMethodInvocation *invocation,
1566 GVariant *parameters,
1569 __STC_LOG_FUNC_ENTER__;
1570 GVariantIter *iter = NULL;
1571 firewall_rule_s *rule;
1572 int ret = STC_ERROR_NONE;
1574 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1576 rule = MALLOC0(firewall_rule_s, 1);
1578 STC_LOGE("rule allocation failed");
1579 return STC_ERROR_OUT_OF_MEMORY;
1582 memset(rule, 0, sizeof(firewall_rule_s));
1584 g_variant_get(parameters, "a{sv}", &iter);
1586 stc_manager_gdbus_dict_foreach(iter,
1589 g_variant_iter_free(iter);
1592 if (__validate_fw_rule(rule) == FALSE) {
1593 __fw_rule_free(rule);
1594 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1595 STC_ERROR_INVALID_PARAMETER);
1596 __STC_LOG_FUNC_EXIT__;
1600 ret = __fw_rule_add(rule);
1601 if (ret == STC_ERROR_NONE) {
1602 table_firewall_insert_rule(rule);
1604 __fw_rule_free(rule);
1605 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1606 __STC_LOG_FUNC_EXIT__;
1610 __fw_rule_free(rule);
1611 STC_DBUS_REPLY_ERROR_NONE(invocation);
1612 __STC_LOG_FUNC_EXIT__;
1616 gboolean handle_firewall_remove_rule(StcFirewall *object,
1617 GDBusMethodInvocation *invocation,
1618 GVariant *parameters,
1621 __STC_LOG_FUNC_ENTER__;
1622 GVariantIter *iter = NULL;
1623 firewall_rule_s *rule;
1624 int ret = STC_ERROR_NONE;
1626 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1628 rule = MALLOC0(firewall_rule_s, 1);
1630 STC_LOGE("rule allocation failed");
1631 return STC_ERROR_OUT_OF_MEMORY;
1634 memset(rule, 0, sizeof(firewall_rule_s));
1636 g_variant_get(parameters, "a{sv}", &iter);
1638 stc_manager_gdbus_dict_foreach(iter,
1641 g_variant_iter_free(iter);
1644 if (__validate_fw_rule(rule) == FALSE) {
1645 __fw_rule_free(rule);
1646 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1647 STC_ERROR_INVALID_PARAMETER);
1648 __STC_LOG_FUNC_EXIT__;
1652 ret = __fw_rule_remove(rule);
1653 if (ret == STC_ERROR_NONE) {
1654 table_firewall_delete_rule(rule);
1656 __fw_rule_free(rule);
1657 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1658 __STC_LOG_FUNC_EXIT__;
1662 __fw_rule_free(rule);
1663 STC_DBUS_REPLY_ERROR_NONE(invocation);
1664 __STC_LOG_FUNC_EXIT__;
1668 gboolean handle_firewall_update_rule(StcFirewall *object,
1669 GDBusMethodInvocation *invocation,
1670 GVariant *parameters,
1673 __STC_LOG_FUNC_ENTER__;
1674 GVariantIter *iter = NULL;
1675 firewall_rule_s *rule;
1677 int ret = STC_ERROR_NONE;
1679 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1681 rule = MALLOC0(firewall_rule_s, 1);
1683 STC_LOGE("rule allocation failed");
1684 return STC_ERROR_OUT_OF_MEMORY;
1687 memset(rule, 0, sizeof(firewall_rule_s));
1689 g_variant_get(parameters, "a{sv}", &iter);
1691 stc_manager_gdbus_dict_foreach(iter,
1694 g_variant_iter_free(iter);
1697 if (__validate_fw_rule(rule) == FALSE) {
1698 __fw_rule_free(rule);
1699 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1700 STC_ERROR_INVALID_PARAMETER);
1701 __STC_LOG_FUNC_EXIT__;
1706 ret = __fw_rule_update(rule);
1707 if (ret == STC_ERROR_NONE) {
1708 table_firewall_update_rule(rule, key);
1710 __fw_rule_free(rule);
1711 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1712 __STC_LOG_FUNC_EXIT__;
1716 __fw_rule_free(rule);
1717 STC_DBUS_REPLY_ERROR_NONE(invocation);
1718 __STC_LOG_FUNC_EXIT__;
1722 gboolean handle_firewall_get_all_rule(StcFirewall *object,
1723 GDBusMethodInvocation *invocation,
1726 __STC_LOG_FUNC_ENTER__;
1727 GVariantBuilder *builder = NULL;
1728 GVariant *return_parameters = NULL;
1730 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1732 builder = g_variant_builder_new(G_VARIANT_TYPE("aa{sv}"));
1734 __fw_chain_foreach(__fw_foreach_to_make_rule_param, builder);
1735 __fw_chain_foreach(__fw_foreach_to_print_rule, NULL);
1737 return_parameters = g_variant_new("(aa{sv})", builder);
1738 g_variant_builder_unref(builder);
1740 DEBUG_GDBUS_VARIANT("Return parameters: ", return_parameters);
1741 STC_DBUS_REPLY(invocation, return_parameters);
1742 __STC_LOG_FUNC_EXIT__;