1 /*
2  * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "net_policy_firewall.h"
17 
18 #include "ipc_skeleton.h"
19 
20 #include "firewall_rule.h"
21 #include "net_policy_core.h"
22 #include "net_policy_event_handler.h"
23 #include "net_settings.h"
24 
25 namespace OHOS {
26 namespace NetManagerStandard {
27 constexpr uint32_t MAX_LIST_SIZE = 1000;
Init()28 void NetPolicyFirewall::Init()
29 {
30     deviceIdleFirewallRule_ = FirewallRule::CreateFirewallRule(FIREWALL_CHAIN_DEVICE_IDLE);
31     powerSaveFirewallRule_ = FirewallRule::CreateFirewallRule(FIREWALL_CHAIN_POWER_SAVE);
32 
33     GetFileInst()->ReadFirewallRules(FIREWALL_CHAIN_DEVICE_IDLE, deviceIdleAllowedList_, deviceIdleDeniedList_);
34     GetFileInst()->ReadFirewallRules(FIREWALL_CHAIN_POWER_SAVE, powerSaveAllowedList_, powerSaveDeniedList_);
35 
36     deviceIdleFirewallRule_->SetAllowedList(deviceIdleAllowedList_);
37     powerSaveFirewallRule_->SetAllowedList(powerSaveAllowedList_);
38 }
39 
SetDeviceIdleTrustlist(const std::vector<uint32_t> & uids,bool isAllowed)40 int32_t NetPolicyFirewall::SetDeviceIdleTrustlist(const std::vector<uint32_t> &uids, bool isAllowed)
41 {
42     if (powerSaveAllowedList_.size() > MAX_LIST_SIZE) {
43         NETMGR_LOG_E("Device idle allowed list's size is over the max size.");
44         return NETMANAGER_ERR_PARAMETER_ERROR;
45     }
46     UpdateFirewallPolicyList(FIREWALL_CHAIN_DEVICE_IDLE, uids, isAllowed);
47     GetFileInst()->WriteFirewallRules(FIREWALL_CHAIN_DEVICE_IDLE, deviceIdleAllowedList_, deviceIdleDeniedList_);
48     deviceIdleFirewallRule_->SetAllowedList(uids, isAllowed ? FIREWALL_RULE_ALLOW : FIREWALL_RULE_DENY);
49 
50     std::shared_ptr<PolicyEvent> eventData = std::make_shared<PolicyEvent>();
51     eventData->eventId = NetPolicyEventHandler::MSG_DEVICE_IDLE_LIST_UPDATED;
52     eventData->deviceIdleList = deviceIdleAllowedList_;
53     SendEvent(NetPolicyEventHandler::MSG_DEVICE_IDLE_LIST_UPDATED, eventData);
54     return NETMANAGER_SUCCESS;
55 }
56 
SetPowerSaveTrustlist(const std::vector<uint32_t> & uids,bool isAllowed)57 int32_t NetPolicyFirewall::SetPowerSaveTrustlist(const std::vector<uint32_t> &uids, bool isAllowed)
58 {
59     if (powerSaveAllowedList_.size() > MAX_LIST_SIZE) {
60         NETMGR_LOG_E("Power save allowed list's size is over the max size.");
61         return NETMANAGER_ERR_PARAMETER_ERROR;
62     }
63     UpdateFirewallPolicyList(FIREWALL_CHAIN_POWER_SAVE, uids, isAllowed);
64     GetFileInst()->WriteFirewallRules(FIREWALL_CHAIN_POWER_SAVE, powerSaveAllowedList_, powerSaveDeniedList_);
65     if (powerSaveFirewallRule_ == nullptr) {
66         NETMGR_LOG_E("powerSaveFirewallRule_ is nullptr");
67         return NETMANAGER_ERR_LOCAL_PTR_NULL;
68     }
69     powerSaveFirewallRule_->SetAllowedList(uids, isAllowed ? FIREWALL_RULE_ALLOW : FIREWALL_RULE_DENY);
70 
71     std::shared_ptr<PolicyEvent> eventData = std::make_shared<PolicyEvent>();
72     eventData->eventId = NetPolicyEventHandler::MSG_POWER_SAVE_LIST_UPDATED;
73     eventData->powerSaveList = powerSaveAllowedList_;
74     SendEvent(NetPolicyEventHandler::MSG_POWER_SAVE_LIST_UPDATED, eventData);
75     return NETMANAGER_SUCCESS;
76 }
77 
UpdateFirewallPolicyList(uint32_t chainType,const std::vector<uint32_t> & uids,bool isAllowed)78 void NetPolicyFirewall::UpdateFirewallPolicyList(uint32_t chainType, const std::vector<uint32_t> &uids, bool isAllowed)
79 {
80     for (auto &uid : uids) {
81         if (chainType == FIREWALL_CHAIN_DEVICE_IDLE) {
82             if (isAllowed) {
83                 deviceIdleAllowedList_.emplace(uid);
84             } else {
85                 deviceIdleAllowedList_.erase(uid);
86             }
87         }
88 
89         if (chainType == FIREWALL_CHAIN_POWER_SAVE) {
90             if (isAllowed) {
91                 powerSaveAllowedList_.emplace(uid);
92             } else {
93                 powerSaveAllowedList_.erase(uid);
94             }
95         }
96     }
97 }
98 
GetDeviceIdleTrustlist(std::vector<uint32_t> & uids)99 int32_t NetPolicyFirewall::GetDeviceIdleTrustlist(std::vector<uint32_t> &uids)
100 {
101     if (deviceIdleFirewallRule_ == nullptr) {
102         NETMGR_LOG_E("deviceIdleFirewallRule_ is nullptr");
103         return NETMANAGER_ERR_LOCAL_PTR_NULL;
104     }
105     uids = deviceIdleFirewallRule_->GetAllowedList();
106     return NETMANAGER_SUCCESS;
107 }
108 
GetPowerSaveTrustlist(std::vector<uint32_t> & uids)109 int32_t NetPolicyFirewall::GetPowerSaveTrustlist(std::vector<uint32_t> &uids)
110 {
111     if (powerSaveFirewallRule_ == nullptr) {
112         NETMGR_LOG_E("deviceIdleFirewallRule_ is nullptr");
113         return NETMANAGER_ERR_LOCAL_PTR_NULL;
114     }
115     uids = powerSaveFirewallRule_->GetAllowedList();
116     return NETMANAGER_SUCCESS;
117 }
118 
UpdateDeviceIdlePolicy(bool enable)119 int32_t NetPolicyFirewall::UpdateDeviceIdlePolicy(bool enable)
120 {
121     if (deviceIdleMode_ == enable) {
122         NETMGR_LOG_E("Same device idle policy.");
123         return NETMANAGER_ERR_STATUS_EXIST;
124     }
125     if (deviceIdleFirewallRule_ == nullptr) {
126         NETMGR_LOG_E("deviceIdleFirewallRule_ is nullptr");
127         return NETMANAGER_ERR_LOCAL_PTR_NULL;
128     }
129     if (enable) {
130         deviceIdleFirewallRule_->SetAllowedList();
131     }
132     NetmanagerHiTrace::NetmanagerStartSyncTrace("Update device idle firewall status start");
133     deviceIdleFirewallRule_->EnableFirewall(enable);
134     NetmanagerHiTrace::NetmanagerFinishSyncTrace("Update device idle firewall status end");
135     deviceIdleMode_ = enable;
136     // notify to other core.
137     auto policyEvent = std::make_shared<PolicyEvent>();
138     policyEvent->deviceIdleMode = enable;
139     NetmanagerHiTrace::NetmanagerStartSyncTrace("Notify other policy class device idle status start");
140     SendEvent(NetPolicyEventHandler::MSG_DEVICE_IDLE_MODE_CHANGED, policyEvent);
141     NetmanagerHiTrace::NetmanagerFinishSyncTrace("Notify other policy class device idle status end");
142     NETMGR_LOG_I("NetPolicyFirewall::UpdateDeviceIdlePolicy End.");
143     return NETMANAGER_SUCCESS;
144 }
145 
UpdatePowerSavePolicy(bool enable)146 int32_t NetPolicyFirewall::UpdatePowerSavePolicy(bool enable)
147 {
148     if (powerSaveMode_ == enable) {
149         NETMGR_LOG_E("Same power save policy.");
150         return NETMANAGER_ERR_STATUS_EXIST;
151     }
152     if (powerSaveFirewallRule_ == nullptr) {
153         NETMGR_LOG_E("powerSaveFirewallRule_ is nullptr");
154         return NETMANAGER_ERR_LOCAL_PTR_NULL;
155     }
156     if (enable) {
157         powerSaveFirewallRule_->SetAllowedList();
158     } else {
159         powerSaveFirewallRule_->ClearFirewallAllRules();  // power save mode off, clear firewall all reules
160     }
161     NetmanagerHiTrace::NetmanagerStartSyncTrace("Update power save firewall status start");
162     powerSaveFirewallRule_->EnableFirewall(enable);
163     NetmanagerHiTrace::NetmanagerFinishSyncTrace("Update power save firewall status end");
164     powerSaveMode_ = enable;
165     // notify to other core.
166     auto policyEvent = std::make_shared<PolicyEvent>();
167     policyEvent->powerSaveMode = enable;
168     NetmanagerHiTrace::NetmanagerStartSyncTrace("Notify other policy class power save status start");
169     SendEvent(NetPolicyEventHandler::MSG_POWER_SAVE_MODE_CHANGED, policyEvent);
170     NetmanagerHiTrace::NetmanagerFinishSyncTrace("Notify other policy class power save status end");
171     NETMGR_LOG_I("NetPolicyFirewall::UpdatePowerSavePolicy End");
172     return NETMANAGER_SUCCESS;
173 }
174 
ResetPolicies()175 void NetPolicyFirewall::ResetPolicies()
176 {
177     if (deviceIdleFirewallRule_ == nullptr) {
178         NETMGR_LOG_E("deviceIdleFirewallRule_ is nullptr");
179         return ;
180     }
181     deviceIdleFirewallRule_->ClearAllowedList();
182     deviceIdleFirewallRule_->ClearDeniedList();
183 
184     if (powerSaveFirewallRule_ == nullptr) {
185         NETMGR_LOG_E("powerSaveFirewallRule_ is nullptr");
186         return ;
187     }
188     powerSaveFirewallRule_->ClearAllowedList();
189     powerSaveFirewallRule_->ClearDeniedList();
190 
191     deviceIdleAllowedList_.clear();
192     deviceIdleDeniedList_.clear();
193     GetFileInst()->WriteFirewallRules(FIREWALL_CHAIN_DEVICE_IDLE, deviceIdleAllowedList_, deviceIdleDeniedList_);
194 
195     powerSaveAllowedList_.clear();
196     powerSaveDeniedList_.clear();
197     GetFileInst()->WriteFirewallRules(FIREWALL_CHAIN_POWER_SAVE, powerSaveAllowedList_, powerSaveDeniedList_);
198 
199     UpdateDeviceIdlePolicy(false);
200     UpdatePowerSavePolicy(false);
201 }
202 
DeleteUid(uint32_t uid)203 void NetPolicyFirewall::DeleteUid(uint32_t uid)
204 {
205     SetDeviceIdleTrustlist({uid}, false);
206     SetPowerSaveTrustlist({uid}, false);
207 
208     deviceIdleFirewallRule_->RemoveFromAllowedList(uid);
209     powerSaveFirewallRule_->RemoveFromAllowedList(uid);
210     NETMGR_LOG_I("NetPolicyFirewall::DeleteUid End");
211 }
212 
HandleEvent(int32_t eventId,const std::shared_ptr<PolicyEvent> & policyEvent)213 void NetPolicyFirewall::HandleEvent(int32_t eventId, const std::shared_ptr<PolicyEvent> &policyEvent)
214 {
215     switch (eventId) {
216         case NetPolicyEventHandler::MSG_UID_REMOVED:
217             DeleteUid(policyEvent->deletedUid);
218             break;
219         case NetPolicyEventHandler::MSG_POWER_SAVE_MODE_CHANGED:
220             UpdatePowerSavePolicy(policyEvent->powerSaveMode);
221             break;
222         case NetPolicyEventHandler::MSG_DEVICE_IDLE_MODE_CHANGED:
223             UpdateDeviceIdlePolicy(policyEvent->deviceIdleMode);
224             break;
225         default:
226             break;
227     }
228 }
229 } // namespace NetManagerStandard
230 } // namespace OHOS
231