2 * Copyright (c) 2016 Samsung Electronics Co., Ltd.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "table-firewall.h"
19 #include "helper-firewall.h"
20 #include "stc-firewall.h"
21 #include "stc-manager-gdbus.h"
23 #define IDENTIFIER_LEN 512
25 #define LOCK_NAME "admin"
27 #define CHAIN_NAME "chain"
28 #define CHAIN_TARGET "target"
29 #define CHAIN_PRIORITY "priority"
31 #define RULE_IDENTIFIER "identifier"
32 #define RULE_KEY "key"
34 #define FIREWALL_DBUS_ERROR_NAME "net.stc.firewall.Error.Failed"
36 #define STC_FIREWALL_DBUS_REPLY_ERROR(invocation, err_num) \
37 g_dbus_method_invocation_return_dbus_error((invocation), \
38 FIREWALL_DBUS_ERROR_NAME, \
39 stc_err_strs[-(err_num)])
41 #define STC_FIREWALL_CHECK_LOCK_STATE(invocation) do { \
42 if (g_lock_state == FIREWALL_LOCKED) { \
43 STC_LOGD("Firewall is locked"); \
44 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, \
45 STC_ERROR_PERMISSION_DENIED); \
46 __STC_LOG_FUNC_EXIT__; \
51 static const gchar *stc_err_strs[] = {
64 static GHashTable *g_firewalls = NULL;
65 static int g_lock_state = FIREWALL_UNKONWN;
66 static uint g_chain_priority = 0;
68 static void __fw_rule_copy(firewall_rule_s *rule,
69 const firewall_rule_s *info)
73 rule->chain = g_strdup(info->chain);
76 rule->direction = info->direction;
77 rule->s_ip_type = info->s_ip_type;
78 rule->d_ip_type = info->d_ip_type;
79 rule->s_port_type = info->s_port_type;
80 rule->d_port_type = info->d_port_type;
81 rule->protocol = info->protocol;
82 rule->family = info->family;
84 rule->s_ip1 = info->s_ip1;
85 rule->s_ip2 = info->s_ip2;
86 rule->d_ip1 = info->d_ip1;
87 rule->d_ip2 = info->d_ip2;
89 rule->s_port1 = info->s_port1;
90 rule->s_port2 = info->s_port2;
91 rule->d_port1 = info->d_port1;
92 rule->d_port2 = info->d_port2;
96 rule->ifname = g_strdup(info->ifname);
99 rule->target = info->target;
101 if (info->target_str) {
102 FREE(rule->target_str);
103 rule->target_str = g_strdup(info->target_str);
106 rule->log_level = info->log_level;
108 if (info->log_prefix) {
109 FREE(rule->log_prefix);
110 rule->log_prefix = g_strdup(info->log_prefix);
113 rule->nflog_group = info->nflog_group;
114 rule->nflog_range = info->nflog_range;
115 rule->nflog_threshold = info->nflog_threshold;
117 if (info->nflog_prefix) {
118 FREE(rule->nflog_prefix);
119 rule->nflog_prefix = g_strdup(info->nflog_prefix);
122 if (info->identifier) {
123 FREE(rule->identifier);
124 rule->identifier = g_strdup(info->identifier);
127 rule->key = info->key;
130 static void __fw_rule_make_key(firewall_rule_s *rule,
131 firewall_rule_s *info)
138 str = g_string_sized_new(IDENTIFIER_LEN);
142 g_string_append_printf(str, "%s", rule->chain);
144 g_string_append_printf(str, "_%u%u%u%u%u%u%u", rule->direction,
145 rule->s_ip_type, rule->d_ip_type, rule->s_port_type,
146 rule->d_port_type, rule->protocol, rule->family);
148 if (rule->family == STC_FW_FAMILY_V4) {
149 g_string_append_printf(str, "_");
150 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv4.s_addr);
151 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv4.s_addr);
153 g_string_append_printf(str, "_");
154 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv4.s_addr);
155 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv4.s_addr);
156 } else if (rule->family == STC_FW_FAMILY_V6) {
157 g_string_append_printf(str, "_");
158 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[0]);
159 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[1]);
160 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[2]);
161 g_string_append_printf(str, "%08x", rule->s_ip1.Ipv6.s6_addr32[3]);
162 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[0]);
163 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[1]);
164 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[2]);
165 g_string_append_printf(str, "%08x", rule->s_ip2.Ipv6.s6_addr32[3]);
167 g_string_append_printf(str, "_");
168 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[0]);
169 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[1]);
170 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[2]);
171 g_string_append_printf(str, "%08x", rule->d_ip1.Ipv6.s6_addr32[3]);
172 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[0]);
173 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[1]);
174 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[2]);
175 g_string_append_printf(str, "%08x", rule->d_ip2.Ipv6.s6_addr32[3]);
178 g_string_append_printf(str, "_%04x", rule->s_port1);
179 g_string_append_printf(str, "%04x", rule->s_port2);
181 g_string_append_printf(str, "_%04x", rule->d_port1);
182 g_string_append_printf(str, "%04x", rule->d_port2);
184 g_string_append_printf(str, "_%s", (rule->ifname) ? rule->ifname : "");
185 g_string_append_printf(str, "_%u", rule->target);
187 switch (rule->target) {
188 case STC_FW_RULE_TARGET_LOG:
189 g_string_append_printf(str, "_%u", rule->log_level);
190 g_string_append_printf(str, "_%s", rule->log_prefix);
192 case STC_FW_RULE_TARGET_NFLOG:
193 g_string_append_printf(str, "_%u", rule->nflog_group);
194 g_string_append_printf(str, "_%s", rule->nflog_prefix);
195 g_string_append_printf(str, "_%u", rule->nflog_range);
196 g_string_append_printf(str, "_%u", rule->nflog_threshold);
202 FREE(rule->identifier);
203 rule->identifier = g_string_free(str, FALSE);
204 rule->key = g_str_hash(rule->identifier);
206 FREE(info->identifier);
207 info->identifier = g_strdup(rule->identifier);
208 info->key = rule->key;
210 STC_LOGD("Identifier [%s]", rule->identifier);
211 STC_LOGD("Key [%u]", rule->key);
214 static void __fw_rule_free(void *data)
216 firewall_rule_s *rule = (firewall_rule_s *)data;
220 FREE(rule->target_str);
221 FREE(rule->log_prefix);
222 FREE(rule->nflog_prefix);
223 FREE(rule->identifier);
227 static void __fw_data_free(gpointer value)
229 stc_fw_data_s *data = (stc_fw_data_s *)value;
231 g_slist_free_full(data->rules, __fw_rule_free);
237 static gint __fw_rule_comp(gconstpointer a, gconstpointer b)
239 firewall_rule_s *data = (firewall_rule_s *)a;
240 firewall_rule_s *rule = (firewall_rule_s *)b;
242 if ((data->key == rule->key) &&
243 (g_strcmp0(data->identifier, rule->identifier) == 0))
249 static stc_error_e __fw_chain_add(const char *chain)
252 stc_fw_data_s *lookup;
254 ret_value_msg_if(g_firewalls == NULL,
256 "firewall is not initialized!");
258 lookup = g_hash_table_lookup(g_firewalls, chain);
260 STC_LOGD("chain already present");
261 return STC_ERROR_ALREADY_DATA;
264 data = MALLOC0(stc_fw_data_s, 1);
266 STC_LOGE("data allocation failed");
267 return STC_ERROR_OUT_OF_MEMORY;
270 data->target = STC_FW_CHAIN_TARGET_NONE;
274 g_hash_table_insert(g_firewalls, g_strdup(chain), data);
276 return STC_ERROR_NONE;
279 static stc_error_e __fw_chain_remove(const char *chain)
281 stc_fw_data_s *lookup;
283 ret_value_msg_if(g_firewalls == NULL,
285 "firewall is not initialized!");
287 lookup = g_hash_table_lookup(g_firewalls, chain);
289 STC_LOGE("chain not found");
290 return STC_ERROR_NO_DATA;
293 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
294 STC_LOGE("can't be applied bcz chain is set");
295 return STC_ERROR_INVALID_PARAMETER;
298 g_slist_free_full(lookup->rules, __fw_rule_free);
299 lookup->rules = NULL;
301 g_hash_table_remove(g_firewalls, chain);
303 return STC_ERROR_NONE;
306 static stc_error_e __fw_chain_flush(const char *chain)
308 stc_fw_data_s *lookup;
310 ret_value_msg_if(g_firewalls == NULL,
312 "firewall is not initialized!");
314 lookup = g_hash_table_lookup(g_firewalls, chain);
316 STC_LOGE("chain not found");
317 return STC_ERROR_NO_DATA;
320 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
321 STC_LOGE("can't be applied bcz chain is set");
322 return STC_ERROR_INVALID_PARAMETER;
325 g_slist_free_full(lookup->rules, __fw_rule_free);
326 lookup->rules = NULL;
328 return STC_ERROR_NONE;
331 static stc_error_e __fw_chain_set(const char *chain, stc_fw_data_s value)
333 stc_fw_data_s *lookup;
335 ret_value_msg_if(g_firewalls == NULL,
337 "firewall is not initialized!");
339 lookup = g_hash_table_lookup(g_firewalls, chain);
341 STC_LOGE("chain not found");
342 return STC_ERROR_NO_DATA;
345 lookup->target = value.target;
346 lookup->priority = value.priority;
348 return STC_ERROR_NONE;
351 static stc_fw_data_s *__fw_chain_get(const char *chain)
353 stc_fw_data_s *lookup;
355 ret_value_msg_if(g_firewalls == NULL, NULL,
356 "firewall is not initialized!");
358 lookup = g_hash_table_lookup(g_firewalls, chain);
360 STC_LOGE("chain not found");
367 static stc_error_e __fw_chain_unset(const char *chain)
369 stc_error_e ret = STC_ERROR_NONE;
370 stc_fw_data_s *lookup;
372 ret_value_msg_if(g_firewalls == NULL,
374 "firewall is not initialized!");
376 lookup = g_hash_table_lookup(g_firewalls, chain);
378 STC_LOGE("chain not found");
379 return STC_ERROR_NO_DATA;
382 lookup->target = STC_FW_CHAIN_TARGET_NONE;
383 lookup->priority = 0;
388 static void __fw_chain_make_params(gpointer key, gpointer value,
391 char *chain = (char *)key;
392 stc_fw_data_s *data = (stc_fw_data_s *)value;
393 GVariantBuilder *builder = (GVariantBuilder *)user_data;
394 GVariantBuilder sub_builder;
396 g_variant_builder_init(&sub_builder, G_VARIANT_TYPE("a{sv}"));
398 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_NAME,
399 g_variant_new_string(chain));
401 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_PRIORITY,
402 g_variant_new_uint32(data->priority));
404 g_variant_builder_add(&sub_builder, "{sv}", CHAIN_TARGET,
405 g_variant_new_uint16(data->target));
407 g_variant_builder_add_value(builder, g_variant_builder_end(&sub_builder));
410 static void __fw_rule_make_params(gpointer data, gpointer user_data)
412 firewall_rule_s *rule = (firewall_rule_s *)data;
413 GVariantBuilder *builder = (GVariantBuilder *)user_data;
414 GVariantBuilder sub_builder;
416 g_variant_builder_init(&sub_builder, G_VARIANT_TYPE("a{sv}"));
418 g_variant_builder_add(&sub_builder, "{sv}", RULE_CHAIN,
419 g_variant_new_string(rule->chain));
421 if (rule->direction != STC_FW_DIRECTION_NONE)
422 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIRECTION,
423 g_variant_new_uint16(rule->direction));
425 if (rule->s_ip_type != STC_FW_IP_NONE)
426 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIPTYPE,
427 g_variant_new_uint16(rule->s_ip_type));
429 if (rule->d_ip_type != STC_FW_IP_NONE)
430 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIPTYPE,
431 g_variant_new_uint16(rule->d_ip_type));
433 if (rule->s_port_type != STC_FW_PORT_NONE)
434 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORTTYPE,
435 g_variant_new_uint16(rule->s_port_type));
437 if (rule->d_port_type != STC_FW_PORT_NONE)
438 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORTTYPE,
439 g_variant_new_uint16(rule->d_port_type));
441 if (rule->protocol != STC_FW_PROTOCOL_NONE)
442 g_variant_builder_add(&sub_builder, "{sv}", RULE_PROTOCOL,
443 g_variant_new_uint16(rule->protocol));
445 if (rule->family != STC_FW_FAMILY_NONE)
446 g_variant_builder_add(&sub_builder, "{sv}", RULE_FAMILY,
447 g_variant_new_uint16(rule->family));
449 if (rule->family == STC_FW_FAMILY_V4) {
452 switch (rule->s_ip_type) {
453 case STC_FW_IP_RANGE:
455 addr = g_try_malloc0(INET_ADDRSTRLEN);
457 inet_ntop(AF_INET, &(rule->s_ip2.Ipv4), addr, INET_ADDRSTRLEN);
458 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP2,
459 g_variant_new_string(addr));
462 case STC_FW_IP_SINGLE:
463 addr = g_try_malloc0(INET_ADDRSTRLEN);
465 inet_ntop(AF_INET, &(rule->s_ip1.Ipv4), addr, INET_ADDRSTRLEN);
466 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP1,
467 g_variant_new_string(addr));
475 switch (rule->d_ip_type) {
476 case STC_FW_IP_RANGE:
478 addr = g_try_malloc0(INET_ADDRSTRLEN);
480 inet_ntop(AF_INET, &(rule->d_ip2.Ipv4), addr, INET_ADDRSTRLEN);
481 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP2,
482 g_variant_new_string(addr));
485 case STC_FW_IP_SINGLE:
486 addr = g_try_malloc0(INET_ADDRSTRLEN);
488 inet_ntop(AF_INET, &(rule->d_ip1.Ipv4), addr, INET_ADDRSTRLEN);
489 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP1,
490 g_variant_new_string(addr));
497 } else if (rule->family == STC_FW_FAMILY_V6) {
500 switch (rule->s_ip_type) {
501 case STC_FW_IP_RANGE:
503 addr = g_try_malloc0(INET6_ADDRSTRLEN);
505 inet_ntop(AF_INET6, &(rule->s_ip2.Ipv6), addr, INET6_ADDRSTRLEN);
506 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP2,
507 g_variant_new_string(addr));
510 case STC_FW_IP_SINGLE:
511 addr = g_try_malloc0(INET6_ADDRSTRLEN);
513 inet_ntop(AF_INET6, &(rule->s_ip1.Ipv6), addr, INET6_ADDRSTRLEN);
514 g_variant_builder_add(&sub_builder, "{sv}", RULE_SIP1,
515 g_variant_new_string(addr));
523 switch (rule->d_ip_type) {
524 case STC_FW_IP_RANGE:
526 addr = g_try_malloc0(INET6_ADDRSTRLEN);
528 inet_ntop(AF_INET6, &(rule->d_ip2.Ipv6), addr, INET6_ADDRSTRLEN);
529 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP2,
530 g_variant_new_string(addr));
533 case STC_FW_IP_SINGLE:
534 addr = g_try_malloc0(INET6_ADDRSTRLEN);
536 inet_ntop(AF_INET6, &(rule->d_ip1.Ipv6), addr, INET6_ADDRSTRLEN);
537 g_variant_builder_add(&sub_builder, "{sv}", RULE_DIP1,
538 g_variant_new_string(addr));
547 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORT1,
548 g_variant_new_uint32(rule->s_port1));
550 g_variant_builder_add(&sub_builder, "{sv}", RULE_SPORT2,
551 g_variant_new_uint32(rule->s_port2));
553 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORT1,
554 g_variant_new_uint32(rule->d_port1));
556 g_variant_builder_add(&sub_builder, "{sv}", RULE_DPORT2,
557 g_variant_new_uint32(rule->d_port2));
560 g_variant_builder_add(&sub_builder, "{sv}", RULE_IFNAME,
561 g_variant_new_string(rule->ifname));
563 if (rule->target != STC_FW_RULE_TARGET_NONE)
564 g_variant_builder_add(&sub_builder, "{sv}", RULE_TARGET,
565 g_variant_new_uint16(rule->target));
567 switch (rule->target) {
568 case STC_FW_RULE_TARGET_LOG:
569 g_variant_builder_add(&sub_builder, "{sv}", RULE_LOG_LEVEL,
570 g_variant_new_uint16(rule->log_level));
572 if (rule->log_prefix)
573 g_variant_builder_add(&sub_builder, "{sv}", RULE_LOG_PREFIX,
574 g_variant_new_string(rule->log_prefix));
576 case STC_FW_RULE_TARGET_NFLOG:
577 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_GROUP,
578 g_variant_new_uint16(rule->nflog_group));
580 if (rule->nflog_prefix)
581 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_PREFIX,
582 g_variant_new_string(rule->nflog_prefix));
584 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_RANGE,
585 g_variant_new_uint16(rule->nflog_range));
587 g_variant_builder_add(&sub_builder, "{sv}", RULE_NFLOG_THRESHOLD,
588 g_variant_new_uint16(rule->nflog_threshold));
594 g_variant_builder_add(&sub_builder, "{sv}", RULE_IDENTIFIER,
595 g_variant_new_string(rule->identifier));
597 g_variant_builder_add(&sub_builder, "{sv}", RULE_KEY,
598 g_variant_new_uint32(rule->key));
600 g_variant_builder_add_value(builder, g_variant_builder_end(&sub_builder));
603 static void __fw_rule_set_to_chain(gpointer data, gpointer user_data)
605 firewall_rule_s *rule = (firewall_rule_s *)data;
606 char *chain = (char *)user_data;
608 if (chain && (g_strcmp0(rule->chain, chain) != 0))
611 switch (rule->target) {
612 case STC_FW_RULE_TARGET_ACCEPT:
613 FREE(rule->target_str);
614 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_ACCEPT);
616 case STC_FW_RULE_TARGET_DROP:
617 FREE(rule->target_str);
618 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_DROP);
620 case STC_FW_RULE_TARGET_LOG:
621 FREE(rule->target_str);
622 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_LOG);
624 case STC_FW_RULE_TARGET_NFLOG:
625 FREE(rule->target_str);
626 rule->target_str = g_strdup(FIREWALL_RULE_TARGET_NFLOG);
632 firewall_rule_add(rule);
635 static void __fw_rule_print_rules(gpointer data, gpointer user_data)
637 firewall_rule_s *rule = (firewall_rule_s *)data;
639 STC_LOGD("[%s][%d][%s][%d][%d][%04x][%04x]"
640 "[%d][%04x][%04x][%d][%s][%d][%s][%d][%d]",
641 rule->chain, rule->direction, rule->ifname,
643 rule->s_port_type, rule->s_port1, rule->s_port2,
644 rule->d_port_type, rule->d_port1, rule->d_port2,
645 rule->target, rule->target_str,
646 rule->nflog_group, rule->nflog_prefix,
647 rule->nflog_range, rule->nflog_threshold);
649 switch (rule->family) {
650 case STC_FW_FAMILY_V4:
651 STC_LOGD("[%d][%d][%08x][%08x][%d][%08x][%08x]",
653 rule->s_ip_type, rule->s_ip1.Ipv4.s_addr, rule->s_ip2.Ipv4.s_addr,
654 rule->d_ip_type, rule->d_ip1.Ipv4.s_addr, rule->d_ip2.Ipv4.s_addr);
656 case STC_FW_FAMILY_V6:
657 STC_LOGD("[%d][%d][%08x:%08x:%08x:%08x][%08x:%08x:%08x:%08x]"
658 "[%d][%08x:%08x:%08x:%08x][%08x:%08x:%08x:%08x]",
661 rule->s_ip1.Ipv6.s6_addr32[0], rule->s_ip1.Ipv6.s6_addr32[1],
662 rule->s_ip1.Ipv6.s6_addr32[2], rule->s_ip1.Ipv6.s6_addr32[3],
664 rule->d_ip1.Ipv6.s6_addr32[0], rule->d_ip1.Ipv6.s6_addr32[1],
665 rule->d_ip1.Ipv6.s6_addr32[2], rule->d_ip1.Ipv6.s6_addr32[3]);
672 static void __fw_foreach_to_print_rule(gpointer key, gpointer value,
675 stc_fw_data_s *data = (stc_fw_data_s *)value;
677 g_slist_foreach(data->rules, __fw_rule_print_rules, user_data);
680 static void __fw_foreach_to_make_rule_param(gpointer key, gpointer value,
683 stc_fw_data_s *data = (stc_fw_data_s *)value;
685 g_slist_foreach(data->rules, __fw_rule_make_params, user_data);
688 static void __fw_foreach_to_set_rule_to_chain(gpointer key, gpointer value,
691 stc_fw_data_s *data = (stc_fw_data_s *)value;
692 char *chain = (char *)user_data;
694 if (chain || (data->target != STC_FW_CHAIN_TARGET_NONE))
695 g_slist_foreach(data->rules, __fw_rule_set_to_chain, user_data);
698 static void __fw_foreach_to_set_chain(gpointer key, gpointer value,
701 char *chain = (char *)key;
702 stc_fw_data_s *data = (stc_fw_data_s *)value;
704 if (data->target != STC_FW_CHAIN_TARGET_NONE) {
705 firewall_chain_s info;
706 memset(&info, 0, sizeof(firewall_chain_s));
708 info.target = data->target;
709 info.priority = data->priority;
710 firewall_chain_set(&info);
714 static void __fw_foreach_to_add_chain(gpointer key, gpointer value,
717 char *chain = (char *)key;
718 stc_fw_data_s *data = (stc_fw_data_s *)value;
720 if (data->target != STC_FW_CHAIN_TARGET_NONE) {
721 firewall_chain_s info;
722 memset(&info, 0, sizeof(firewall_chain_s));
724 info.target = data->target;
725 info.priority = data->priority;
726 firewall_chain_add(&info);
730 static void __fw_chain_foreach(GHFunc func, void *user_data)
732 g_hash_table_foreach(g_firewalls, func, user_data);
735 stc_cb_ret_e __fw_table_chain_info_cb(const firewall_chain_s *info,
740 data = MALLOC0(stc_fw_data_s, 1);
742 STC_LOGE("data allocation failed");
746 data->target = info->target;
747 data->priority = info->priority;
750 g_hash_table_insert(g_firewalls, g_strdup(info->chain), data);
755 stc_cb_ret_e __fw_table_rule_info_cb(const firewall_rule_s *info,
758 stc_fw_data_s *lookup;
759 firewall_rule_s *rule;
761 lookup = g_hash_table_lookup(g_firewalls, info->chain);
763 STC_LOGE("chain not found");
767 rule = MALLOC0(firewall_rule_s, 1);
769 STC_LOGE("rule allocation failed");
773 memset(rule, 0, sizeof(firewall_rule_s));
774 __fw_rule_copy(rule, info);
776 lookup->rules = g_slist_append(lookup->rules, rule);
781 static stc_error_e __fw_rule_add(firewall_rule_s *info)
783 stc_fw_data_s *lookup;
784 firewall_rule_s *rule;
787 ret_value_msg_if(g_firewalls == NULL,
789 "firewall is not initialized!");
791 lookup = g_hash_table_lookup(g_firewalls, info->chain);
793 STC_LOGE("chain not found");
794 return STC_ERROR_NO_DATA;
797 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
798 STC_LOGE("can't be applied bcz chain is set");
799 return STC_ERROR_INVALID_PARAMETER;
802 rule = MALLOC0(firewall_rule_s, 1);
804 STC_LOGE("rule allocation failed");
805 return STC_ERROR_OUT_OF_MEMORY;
808 memset(rule, 0, sizeof(firewall_rule_s));
809 __fw_rule_copy(rule, info);
810 __fw_rule_make_key(rule, info);
812 comp = g_slist_find_custom(lookup->rules, rule, __fw_rule_comp);
814 STC_LOGD("rule already present");
815 __fw_rule_free(rule);
816 return STC_ERROR_ALREADY_DATA;
819 lookup->rules = g_slist_append(lookup->rules, rule);
821 return STC_ERROR_NONE;
824 static stc_error_e __fw_rule_remove(const firewall_rule_s *info)
826 stc_fw_data_s *lookup;
829 firewall_rule_s *rule;
831 ret_value_msg_if(g_firewalls == NULL,
833 "firewall is not initialized!");
835 lookup = g_hash_table_lookup(g_firewalls, info->chain);
837 STC_LOGE("chain not found");
838 return STC_ERROR_NO_DATA;
841 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
842 STC_LOGE("can't be applied bcz chain is set");
843 return STC_ERROR_INVALID_PARAMETER;
846 rule_list = lookup->rules;
847 comp = g_slist_find_custom(rule_list, info, __fw_rule_comp);
849 STC_LOGD("rule not found");
850 return STC_ERROR_NO_DATA;
854 lookup->rules = g_slist_remove(lookup->rules, rule);
855 __fw_rule_free(rule);
857 return STC_ERROR_NONE;
860 static stc_error_e __fw_rule_update(firewall_rule_s *info)
862 stc_fw_data_s *lookup;
865 firewall_rule_s *origin_rule;
866 firewall_rule_s *update_rule;
868 ret_value_msg_if(g_firewalls == NULL,
870 "firewall is not initialized!");
872 lookup = g_hash_table_lookup(g_firewalls, info->chain);
874 STC_LOGE("chain not found");
875 return STC_ERROR_NO_DATA;
878 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
879 STC_LOGE("can't be applied bcz chain is set");
880 return STC_ERROR_INVALID_PARAMETER;
883 rule_list = lookup->rules;
884 comp = g_slist_find_custom(rule_list, info, __fw_rule_comp);
886 STC_LOGD("rule not found");
887 return STC_ERROR_NO_DATA;
890 origin_rule = comp->data;
892 update_rule = MALLOC0(firewall_rule_s, 1);
894 STC_LOGE("rule allocation failed");
895 return STC_ERROR_OUT_OF_MEMORY;
898 memset(update_rule, 0, sizeof(firewall_rule_s));
899 __fw_rule_copy(update_rule, info);
900 __fw_rule_make_key(update_rule, info);
902 comp = g_slist_find_custom(lookup->rules, update_rule, __fw_rule_comp);
904 STC_LOGD("rule already present");
905 __fw_rule_free(update_rule);
906 return STC_ERROR_ALREADY_DATA;
909 lookup->rules = g_slist_remove(lookup->rules, origin_rule);
910 __fw_rule_free(origin_rule);
912 lookup->rules = g_slist_append(lookup->rules, update_rule);
914 return STC_ERROR_NONE;
917 static void __fw_rule_extract(const char *key, GVariant *value,
920 firewall_rule_s *rule = (firewall_rule_s *)user_data;
922 __STC_LOG_FUNC_EXIT__;
926 if (g_strcmp0(key, RULE_CHAIN) == 0) {
928 const gchar *str = g_variant_get_string(value, &str_length);
929 rule->chain = g_strdup(str);
930 STC_LOGD("%s: [%s]", RULE_CHAIN, rule->chain);
932 } else if (g_strcmp0(key, RULE_DIRECTION) == 0) {
933 rule->direction = g_variant_get_uint16(value);
934 STC_LOGD("%s: [%u]", RULE_DIRECTION, rule->direction);
936 } else if (g_strcmp0(key, RULE_SIPTYPE) == 0) {
937 rule->s_ip_type = g_variant_get_uint16(value);
938 STC_LOGD("%s: [%u]", RULE_SIPTYPE, rule->s_ip_type);
940 } else if (g_strcmp0(key, RULE_DIPTYPE) == 0) {
941 rule->d_ip_type = g_variant_get_uint16(value);
942 STC_LOGD("%s: [%u]", RULE_DIPTYPE, rule->d_ip_type);
944 } else if (g_strcmp0(key, RULE_SPORTTYPE) == 0) {
945 rule->s_port_type = g_variant_get_uint16(value);
946 STC_LOGD("%s: [%u]", RULE_SPORTTYPE, rule->s_port_type);
948 } else if (g_strcmp0(key, RULE_DPORTTYPE) == 0) {
949 rule->d_port_type = g_variant_get_uint16(value);
950 STC_LOGD("%s: [%u]", RULE_DPORTTYPE, rule->d_port_type);
952 } else if (g_strcmp0(key, RULE_PROTOCOL) == 0) {
953 rule->protocol = g_variant_get_uint16(value);
954 STC_LOGD("%s: [%u]", RULE_PROTOCOL, rule->protocol);
956 } else if (g_strcmp0(key, RULE_FAMILY) == 0) {
957 rule->family = g_variant_get_uint16(value);
958 STC_LOGD("%s: [%u]", RULE_FAMILY, rule->family);
960 } else if (g_strcmp0(key, RULE_SIP1) == 0) {
961 if (rule->s_ip_type != STC_FW_IP_NONE) {
963 const gchar *str = g_variant_get_string(value, &str_length);
964 if (rule->family == STC_FW_FAMILY_V4) {
965 inet_pton(AF_INET, str, &(rule->s_ip1.Ipv4));
966 STC_LOGD("%s: [%08x]", RULE_SIP1, rule->s_ip1.Ipv4.s_addr);
967 } else if (rule->family == STC_FW_FAMILY_V6) {
968 inet_pton(AF_INET6, str, &(rule->s_ip1.Ipv6));
969 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_SIP1,
970 rule->s_ip1.Ipv6.s6_addr32[0], rule->s_ip1.Ipv6.s6_addr32[1],
971 rule->s_ip1.Ipv6.s6_addr32[2], rule->s_ip1.Ipv6.s6_addr32[3]);
975 } else if (g_strcmp0(key, RULE_SIP2) == 0) {
976 if (rule->s_ip_type != STC_FW_IP_NONE) {
978 const gchar *str = g_variant_get_string(value, &str_length);
979 if (rule->family == STC_FW_FAMILY_V4) {
980 inet_pton(AF_INET, str, &(rule->s_ip2.Ipv4));
981 STC_LOGD("%s: [%08x]", RULE_SIP2, rule->s_ip2.Ipv4.s_addr);
982 } else if (rule->family == STC_FW_FAMILY_V6) {
983 inet_pton(AF_INET6, str, &(rule->s_ip2.Ipv6));
984 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_SIP2,
985 rule->s_ip2.Ipv6.s6_addr32[0], rule->s_ip2.Ipv6.s6_addr32[1],
986 rule->s_ip2.Ipv6.s6_addr32[2], rule->s_ip2.Ipv6.s6_addr32[3]);
990 } else if (g_strcmp0(key, RULE_DIP1) == 0) {
991 if (rule->d_ip_type != STC_FW_IP_NONE) {
993 const gchar *str = g_variant_get_string(value, &str_length);
994 if (rule->family == STC_FW_FAMILY_V4) {
995 inet_pton(AF_INET, str, &(rule->d_ip1.Ipv4));
996 STC_LOGD("%s: [%08x]", RULE_DIP1, rule->d_ip1.Ipv4.s_addr);
997 } else if (rule->family == STC_FW_FAMILY_V6) {
998 inet_pton(AF_INET6, str, &(rule->d_ip1.Ipv6));
999 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_DIP1,
1000 rule->d_ip1.Ipv6.s6_addr32[0], rule->d_ip1.Ipv6.s6_addr32[1],
1001 rule->d_ip1.Ipv6.s6_addr32[2], rule->d_ip1.Ipv6.s6_addr32[3]);
1005 } else if (g_strcmp0(key, RULE_DIP2) == 0) {
1006 if (rule->d_ip_type != STC_FW_IP_NONE) {
1008 const gchar *str = g_variant_get_string(value, &str_length);
1009 if (rule->family == STC_FW_FAMILY_V4) {
1010 inet_pton(AF_INET, str, &(rule->d_ip2.Ipv4));
1011 STC_LOGD("%s: [%08x]", RULE_DIP2, rule->d_ip2.Ipv4.s_addr);
1012 } else if (rule->family == STC_FW_FAMILY_V6) {
1013 inet_pton(AF_INET6, str, &(rule->d_ip2.Ipv6));
1014 STC_LOGD("%s: [%08x:%08x:%08x:%08x]", RULE_DIP2,
1015 rule->d_ip2.Ipv6.s6_addr32[0], rule->d_ip2.Ipv6.s6_addr32[1],
1016 rule->d_ip2.Ipv6.s6_addr32[2], rule->d_ip2.Ipv6.s6_addr32[3]);
1020 } else if (g_strcmp0(key, RULE_SPORT1) == 0) {
1021 if (rule->s_port_type != STC_FW_PORT_NONE) {
1022 rule->s_port1 = g_variant_get_uint32(value);
1023 STC_LOGD("%s: [%04x]", RULE_SPORT1, rule->s_port1);
1026 } else if (g_strcmp0(key, RULE_SPORT2) == 0) {
1027 if (rule->s_port_type != STC_FW_PORT_NONE) {
1028 rule->s_port2 = g_variant_get_uint32(value);
1029 STC_LOGD("%s: [%04x]", RULE_SPORT2, rule->s_port2);
1032 } else if (g_strcmp0(key, RULE_DPORT1) == 0) {
1033 if (rule->s_port_type != STC_FW_PORT_NONE) {
1034 rule->d_port1 = g_variant_get_uint32(value);
1035 STC_LOGD("%s: [%04x]", RULE_DPORT1, rule->d_port1);
1038 } else if (g_strcmp0(key, RULE_DPORT2) == 0) {
1039 if (rule->d_port_type != STC_FW_PORT_NONE) {
1040 rule->d_port2 = g_variant_get_uint32(value);
1041 STC_LOGD("%s: [%04x]", RULE_DPORT2, rule->d_port2);
1044 } else if (g_strcmp0(key, RULE_IFNAME) == 0) {
1045 if (rule->direction != STC_FW_DIRECTION_NONE) {
1047 const gchar *str = g_variant_get_string(value, &str_length);
1048 rule->ifname = g_strdup(str);
1049 STC_LOGD("%s: [%s]", RULE_IFNAME, rule->ifname);
1052 } else if (g_strcmp0(key, RULE_TARGET) == 0) {
1053 rule->target = g_variant_get_uint16(value);
1054 STC_LOGD("%s: [%u]", RULE_TARGET, rule->target);
1056 } else if (g_strcmp0(key, RULE_LOG_LEVEL) == 0) {
1057 if (rule->target == STC_FW_RULE_TARGET_LOG) {
1058 rule->log_level = g_variant_get_uint16(value);
1059 STC_LOGD("%s: [%u]", RULE_LOG_LEVEL, rule->log_level);
1062 } else if (g_strcmp0(key, RULE_LOG_PREFIX) == 0) {
1063 if (rule->target == STC_FW_RULE_TARGET_LOG) {
1065 const gchar *str = g_variant_get_string(value, &str_length);
1066 rule->log_prefix = g_strdup(str);
1067 STC_LOGD("%s: [%s]", RULE_LOG_PREFIX, rule->log_prefix);
1070 } else if (g_strcmp0(key, RULE_NFLOG_GROUP) == 0) {
1071 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1072 rule->nflog_group = g_variant_get_uint16(value);
1073 STC_LOGD("%s: [%u]", RULE_NFLOG_GROUP, rule->nflog_group);
1076 } else if (g_strcmp0(key, RULE_NFLOG_PREFIX) == 0) {
1077 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1079 const gchar *str = g_variant_get_string(value, &str_length);
1080 rule->nflog_prefix = g_strdup(str);
1081 STC_LOGD("%s: [%s]", RULE_NFLOG_PREFIX, rule->nflog_prefix);
1084 } else if (g_strcmp0(key, RULE_NFLOG_RANGE) == 0) {
1085 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1086 rule->nflog_range = g_variant_get_uint16(value);
1087 STC_LOGD("%s: [%u]", RULE_NFLOG_RANGE, rule->nflog_range);
1090 } else if (g_strcmp0(key, RULE_NFLOG_THRESHOLD) == 0) {
1091 if (rule->target == STC_FW_RULE_TARGET_NFLOG) {
1092 rule->nflog_threshold = g_variant_get_uint16(value);
1093 STC_LOGD("%s: [%u]", RULE_NFLOG_THRESHOLD, rule->nflog_threshold);
1096 } else if (g_strcmp0(key, RULE_IDENTIFIER) == 0) {
1098 const gchar *str = g_variant_get_string(value, &str_length);
1099 rule->identifier = g_strdup(str);
1100 STC_LOGD("%s: [%s]", RULE_IDENTIFIER, rule->identifier);
1102 } else if (g_strcmp0(key, RULE_KEY) == 0) {
1103 rule->key = g_variant_get_uint32(value);
1104 STC_LOGD("%s: [%u]", RULE_KEY, rule->key);
1107 STC_LOGD("Unknown rule [%s]", key);
1111 gboolean __validate_fw_rule(firewall_rule_s *rule)
1113 __STC_LOG_FUNC_ENTER__;
1116 __STC_LOG_FUNC_EXIT__;
1120 if (rule->chain == NULL) {
1121 __STC_LOG_FUNC_EXIT__;
1125 if (rule->direction > STC_FW_DIRECTION_OUT) {
1126 __STC_LOG_FUNC_EXIT__;
1130 if (rule->s_ip_type > STC_FW_IP_RANGE) {
1131 __STC_LOG_FUNC_EXIT__;
1135 if (rule->d_ip_type > STC_FW_IP_RANGE) {
1136 __STC_LOG_FUNC_EXIT__;
1140 if (rule->s_port_type > STC_FW_PORT_RANGE) {
1141 __STC_LOG_FUNC_EXIT__;
1145 if (rule->d_port_type > STC_FW_PORT_RANGE) {
1146 __STC_LOG_FUNC_EXIT__;
1150 if (rule->protocol > STC_FW_PROTOCOL_ALL) {
1151 __STC_LOG_FUNC_EXIT__;
1155 if (rule->family > STC_FW_FAMILY_V6) {
1156 __STC_LOG_FUNC_EXIT__;
1160 if (rule->target == STC_FW_RULE_TARGET_LOG &&
1161 (rule->log_prefix == NULL ||
1162 rule->log_prefix[0] == '\0')) {
1163 __STC_LOG_FUNC_EXIT__;
1167 if (rule->target == STC_FW_RULE_TARGET_NFLOG &&
1168 (rule->nflog_prefix == NULL ||
1169 rule->nflog_prefix[0] == '\0')) {
1170 __STC_LOG_FUNC_EXIT__;
1174 __STC_LOG_FUNC_EXIT__;
1178 void stc_firewall_init(void)
1180 int ret = STC_ERROR_NONE;
1182 g_firewalls = g_hash_table_new_full(g_str_hash,
1183 g_str_equal, g_free, __fw_data_free);
1185 ret = table_firewall_get_lock(LOCK_NAME, &g_lock_state);
1186 if (ret != STC_ERROR_NONE)
1187 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1189 if (g_lock_state == FIREWALL_UNKONWN)
1190 g_lock_state = FIREWALL_UNLOCKED;
1192 table_firewall_foreach_chain(__fw_table_chain_info_cb, NULL);
1193 table_firewall_foreach_rule(__fw_table_rule_info_cb, NULL);
1196 void stc_firewall_update(void)
1198 __fw_chain_foreach(__fw_foreach_to_add_chain, NULL);
1199 __fw_chain_foreach(__fw_foreach_to_set_rule_to_chain, NULL);
1200 __fw_chain_foreach(__fw_foreach_to_set_chain, NULL);
1203 void stc_firewall_deinit(void)
1206 g_hash_table_destroy(g_firewalls);
1211 gboolean handle_firewall_lock(StcFirewall *object,
1212 GDBusMethodInvocation *invocation,
1215 __STC_LOG_FUNC_ENTER__;
1216 int ret = STC_ERROR_NONE;
1218 ret = table_firewall_update_lock(LOCK_NAME, FIREWALL_LOCKED);
1219 if (ret != STC_ERROR_NONE)
1220 table_firewall_insert_lock(LOCK_NAME, FIREWALL_LOCKED);
1222 g_lock_state = FIREWALL_LOCKED;
1224 STC_DBUS_REPLY_ERROR_NONE(invocation);
1225 __STC_LOG_FUNC_EXIT__;
1229 gboolean handle_firewall_unlock(StcFirewall *object,
1230 GDBusMethodInvocation *invocation,
1233 __STC_LOG_FUNC_ENTER__;
1234 int ret = STC_ERROR_NONE;
1236 ret = table_firewall_update_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1237 if (ret != STC_ERROR_NONE)
1238 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1240 g_lock_state = FIREWALL_UNLOCKED;
1242 STC_DBUS_REPLY_ERROR_NONE(invocation);
1243 __STC_LOG_FUNC_EXIT__;
1247 gboolean handle_firewall_get_lock(StcFirewall *object,
1248 GDBusMethodInvocation *invocation,
1251 __STC_LOG_FUNC_ENTER__;
1252 int ret = STC_ERROR_NONE;
1253 GVariant *return_parameters = NULL;
1255 if (g_lock_state == FIREWALL_UNKONWN) {
1256 ret = table_firewall_get_lock(LOCK_NAME, &g_lock_state);
1257 if (ret != STC_ERROR_NONE)
1258 table_firewall_insert_lock(LOCK_NAME, FIREWALL_UNLOCKED);
1260 if (g_lock_state == FIREWALL_UNKONWN)
1261 g_lock_state = FIREWALL_UNLOCKED;
1264 return_parameters = g_variant_new("(i)", g_lock_state);
1265 STC_DBUS_REPLY(invocation, return_parameters);
1266 __STC_LOG_FUNC_EXIT__;
1270 gboolean handle_firewall_add_chain(StcFirewall *object,
1271 GDBusMethodInvocation *invocation,
1275 __STC_LOG_FUNC_ENTER__;
1276 firewall_chain_s info;
1277 int ret = STC_ERROR_NONE;
1279 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1281 if (chain == NULL) {
1282 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1283 STC_ERROR_INVALID_PARAMETER);
1284 __STC_LOG_FUNC_EXIT__;
1288 ret = __fw_chain_add(chain);
1289 if (ret == STC_ERROR_NONE) {
1290 memset(&info, 0, sizeof(firewall_chain_s));
1293 info.target = STC_FW_CHAIN_TARGET_NONE;
1294 table_firewall_insert_chain(&info);
1296 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1297 __STC_LOG_FUNC_EXIT__;
1301 STC_DBUS_REPLY_ERROR_NONE(invocation);
1302 __STC_LOG_FUNC_EXIT__;
1306 gboolean handle_firewall_remove_chain(StcFirewall *object,
1307 GDBusMethodInvocation *invocation,
1311 __STC_LOG_FUNC_ENTER__;
1312 firewall_chain_s info;
1313 int ret = STC_ERROR_NONE;
1315 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1317 if (chain == NULL) {
1318 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1319 STC_ERROR_INVALID_PARAMETER);
1320 __STC_LOG_FUNC_EXIT__;
1324 ret = __fw_chain_remove(chain);
1325 if (ret == STC_ERROR_NONE) {
1326 memset(&info, 0, sizeof(firewall_chain_s));
1328 table_firewall_flush_chain(&info);
1329 table_firewall_delete_chain(&info);
1331 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1332 __STC_LOG_FUNC_EXIT__;
1336 STC_DBUS_REPLY_ERROR_NONE(invocation);
1337 __STC_LOG_FUNC_EXIT__;
1341 gboolean handle_firewall_flush_chain(StcFirewall *object,
1342 GDBusMethodInvocation *invocation,
1346 __STC_LOG_FUNC_ENTER__;
1347 firewall_chain_s info;
1348 int ret = STC_ERROR_NONE;
1350 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1352 if (chain == NULL) {
1353 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1354 STC_ERROR_INVALID_PARAMETER);
1355 __STC_LOG_FUNC_EXIT__;
1359 ret = __fw_chain_flush(chain);
1360 if (ret == STC_ERROR_NONE) {
1361 memset(&info, 0, sizeof(firewall_chain_s));
1363 table_firewall_flush_chain(&info);
1365 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1366 __STC_LOG_FUNC_EXIT__;
1370 STC_DBUS_REPLY_ERROR_NONE(invocation);
1371 __STC_LOG_FUNC_EXIT__;
1375 gboolean handle_firewall_get_all_chain(StcFirewall *object,
1376 GDBusMethodInvocation *invocation,
1379 __STC_LOG_FUNC_ENTER__;
1380 GVariantBuilder *builder = NULL;
1381 GVariant *return_parameters = NULL;
1383 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1385 builder = g_variant_builder_new(G_VARIANT_TYPE("aa{sv}"));
1387 __fw_chain_foreach(__fw_chain_make_params, builder);
1389 return_parameters = g_variant_new("(aa{sv})", builder);
1390 g_variant_builder_unref(builder);
1392 DEBUG_GDBUS_VARIANT("Return parameters: ", return_parameters);
1393 STC_DBUS_REPLY(invocation, return_parameters);
1394 __STC_LOG_FUNC_EXIT__;
1398 gboolean handle_firewall_set_chain(StcFirewall *object,
1399 GDBusMethodInvocation *invocation,
1401 unsigned int target,
1404 __STC_LOG_FUNC_ENTER__;
1405 stc_fw_data_s *lookup = NULL;
1407 firewall_chain_s info;
1409 int ret = STC_ERROR_NONE;
1411 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1413 if (chain == NULL ||
1414 target >= STC_FW_CHAIN_TARGET_MAX) {
1415 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1416 STC_ERROR_INVALID_PARAMETER);
1417 __STC_LOG_FUNC_EXIT__;
1421 lookup = __fw_chain_get(chain);
1422 if (lookup == NULL) {
1423 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1425 __STC_LOG_FUNC_EXIT__;
1429 if (lookup->target != STC_FW_CHAIN_TARGET_NONE) {
1430 STC_LOGE("chain is already set");
1431 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1432 STC_ERROR_INVALID_PARAMETER);
1433 __STC_LOG_FUNC_EXIT__;
1438 memset(&info, 0, sizeof(firewall_chain_s));
1440 info.target = target;
1442 ret = firewall_chain_add(&info);
1443 if (ret != STC_ERROR_NONE) {
1444 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1445 __STC_LOG_FUNC_EXIT__;
1449 __fw_chain_foreach(__fw_foreach_to_set_rule_to_chain, chain);
1450 ret = firewall_chain_set(&info);
1451 if (ret != STC_ERROR_NONE) {
1452 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1453 __STC_LOG_FUNC_EXIT__;
1458 priority = g_chain_priority + 1;
1460 memset(&data, 0, sizeof(stc_fw_data_s));
1461 data.target = target;
1462 data.priority = priority;
1464 ret = __fw_chain_set(chain, data);
1465 if (ret == STC_ERROR_NONE) {
1466 info.priority = priority;
1467 table_firewall_update_chain(&info);
1468 g_chain_priority = priority;
1470 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1471 __STC_LOG_FUNC_EXIT__;
1475 STC_DBUS_REPLY_ERROR_NONE(invocation);
1476 __STC_LOG_FUNC_EXIT__;
1480 gboolean handle_firewall_unset_chain(StcFirewall *object,
1481 GDBusMethodInvocation *invocation,
1485 __STC_LOG_FUNC_ENTER__;
1486 stc_fw_data_s *lookup = NULL;
1487 firewall_chain_s info;
1488 int ret = STC_ERROR_NONE;
1490 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1492 if (chain == NULL) {
1493 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1494 STC_ERROR_INVALID_PARAMETER);
1495 __STC_LOG_FUNC_EXIT__;
1499 lookup = __fw_chain_get(chain);
1500 if (lookup == NULL) {
1501 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1503 __STC_LOG_FUNC_EXIT__;
1507 if (lookup->target == STC_FW_CHAIN_TARGET_NONE) {
1508 STC_LOGE("chain is not set");
1509 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1510 STC_ERROR_INVALID_PARAMETER);
1511 __STC_LOG_FUNC_EXIT__;
1516 memset(&info, 0, sizeof(firewall_chain_s));
1518 info.target = lookup->target;
1520 ret = firewall_chain_unset(&info);
1521 if (ret != STC_ERROR_NONE) {
1522 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1523 __STC_LOG_FUNC_EXIT__;
1527 ret = firewall_chain_remove(&info);
1528 if (ret != STC_ERROR_NONE) {
1529 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1530 __STC_LOG_FUNC_EXIT__;
1535 ret = __fw_chain_unset(chain);
1536 if (ret == STC_ERROR_NONE) {
1537 info.target = STC_FW_CHAIN_TARGET_NONE;
1539 table_firewall_update_chain(&info);
1541 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1542 __STC_LOG_FUNC_EXIT__;
1546 STC_DBUS_REPLY_ERROR_NONE(invocation);
1547 __STC_LOG_FUNC_EXIT__;
1551 gboolean handle_firewall_add_rule(StcFirewall *object,
1552 GDBusMethodInvocation *invocation,
1553 GVariant *parameters,
1556 __STC_LOG_FUNC_ENTER__;
1557 GVariantIter *iter = NULL;
1558 firewall_rule_s *rule;
1559 int ret = STC_ERROR_NONE;
1561 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1563 rule = MALLOC0(firewall_rule_s, 1);
1565 STC_LOGE("rule allocation failed");
1566 return STC_ERROR_OUT_OF_MEMORY;
1569 memset(rule, 0, sizeof(firewall_rule_s));
1571 g_variant_get(parameters, "a{sv}", &iter);
1573 stc_manager_gdbus_dict_foreach(iter,
1576 g_variant_iter_free(iter);
1579 if (__validate_fw_rule(rule) == FALSE) {
1580 __fw_rule_free(rule);
1581 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1582 STC_ERROR_INVALID_PARAMETER);
1583 __STC_LOG_FUNC_EXIT__;
1587 ret = __fw_rule_add(rule);
1588 if (ret == STC_ERROR_NONE) {
1589 table_firewall_insert_rule(rule);
1591 __fw_rule_free(rule);
1592 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1593 __STC_LOG_FUNC_EXIT__;
1597 __fw_rule_free(rule);
1598 STC_DBUS_REPLY_ERROR_NONE(invocation);
1599 __STC_LOG_FUNC_EXIT__;
1603 gboolean handle_firewall_remove_rule(StcFirewall *object,
1604 GDBusMethodInvocation *invocation,
1605 GVariant *parameters,
1608 __STC_LOG_FUNC_ENTER__;
1609 GVariantIter *iter = NULL;
1610 firewall_rule_s *rule;
1611 int ret = STC_ERROR_NONE;
1613 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1615 rule = MALLOC0(firewall_rule_s, 1);
1617 STC_LOGE("rule allocation failed");
1618 return STC_ERROR_OUT_OF_MEMORY;
1621 memset(rule, 0, sizeof(firewall_rule_s));
1623 g_variant_get(parameters, "a{sv}", &iter);
1625 stc_manager_gdbus_dict_foreach(iter,
1628 g_variant_iter_free(iter);
1631 if (__validate_fw_rule(rule) == FALSE) {
1632 __fw_rule_free(rule);
1633 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1634 STC_ERROR_INVALID_PARAMETER);
1635 __STC_LOG_FUNC_EXIT__;
1639 ret = __fw_rule_remove(rule);
1640 if (ret == STC_ERROR_NONE) {
1641 table_firewall_delete_rule(rule);
1643 __fw_rule_free(rule);
1644 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1645 __STC_LOG_FUNC_EXIT__;
1649 __fw_rule_free(rule);
1650 STC_DBUS_REPLY_ERROR_NONE(invocation);
1651 __STC_LOG_FUNC_EXIT__;
1655 gboolean handle_firewall_update_rule(StcFirewall *object,
1656 GDBusMethodInvocation *invocation,
1657 GVariant *parameters,
1660 __STC_LOG_FUNC_ENTER__;
1661 GVariantIter *iter = NULL;
1662 firewall_rule_s *rule;
1664 int ret = STC_ERROR_NONE;
1666 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1668 rule = MALLOC0(firewall_rule_s, 1);
1670 STC_LOGE("rule allocation failed");
1671 return STC_ERROR_OUT_OF_MEMORY;
1674 memset(rule, 0, sizeof(firewall_rule_s));
1676 g_variant_get(parameters, "a{sv}", &iter);
1678 stc_manager_gdbus_dict_foreach(iter,
1681 g_variant_iter_free(iter);
1684 if (__validate_fw_rule(rule) == FALSE) {
1685 __fw_rule_free(rule);
1686 STC_FIREWALL_DBUS_REPLY_ERROR(invocation,
1687 STC_ERROR_INVALID_PARAMETER);
1688 __STC_LOG_FUNC_EXIT__;
1693 ret = __fw_rule_update(rule);
1694 if (ret == STC_ERROR_NONE) {
1695 table_firewall_update_rule(rule, key);
1697 __fw_rule_free(rule);
1698 STC_FIREWALL_DBUS_REPLY_ERROR(invocation, ret);
1699 __STC_LOG_FUNC_EXIT__;
1703 __fw_rule_free(rule);
1704 STC_DBUS_REPLY_ERROR_NONE(invocation);
1705 __STC_LOG_FUNC_EXIT__;
1709 gboolean handle_firewall_get_all_rule(StcFirewall *object,
1710 GDBusMethodInvocation *invocation,
1713 __STC_LOG_FUNC_ENTER__;
1714 GVariantBuilder *builder = NULL;
1715 GVariant *return_parameters = NULL;
1717 STC_FIREWALL_CHECK_LOCK_STATE(invocation);
1719 builder = g_variant_builder_new(G_VARIANT_TYPE("aa{sv}"));
1721 __fw_chain_foreach(__fw_foreach_to_make_rule_param, builder);
1722 __fw_chain_foreach(__fw_foreach_to_print_rule, NULL);
1724 return_parameters = g_variant_new("(aa{sv})", builder);
1725 g_variant_builder_unref(builder);
1727 DEBUG_GDBUS_VARIANT("Return parameters: ", return_parameters);
1728 STC_DBUS_REPLY(invocation, return_parameters);
1729 __STC_LOG_FUNC_EXIT__;