• Home
  • History
  • Annotate
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
3  *
4  *  Use of this source code is governed by a BSD-style license
5  *  that can be found in the LICENSE file in the root of the source
6  *  tree. An additional intellectual property rights grant can be found
7  *  in the file PATENTS.  All contributing project authors may
8  *  be found in the AUTHORS file in the root of the source tree.
9  */
10 
11 #include "webrtc/base/firewallsocketserver.h"
12 
13 #include <assert.h>
14 
15 #include <algorithm>
16 
17 #include "webrtc/base/asyncsocket.h"
18 #include "webrtc/base/logging.h"
19 
20 namespace rtc {
21 
22 class FirewallSocket : public AsyncSocketAdapter {
23  public:
FirewallSocket(FirewallSocketServer * server,AsyncSocket * socket,int type)24   FirewallSocket(FirewallSocketServer* server, AsyncSocket* socket, int type)
25     : AsyncSocketAdapter(socket), server_(server), type_(type) {
26   }
27 
Connect(const SocketAddress & addr)28   virtual int Connect(const SocketAddress& addr) {
29     if (type_ == SOCK_STREAM) {
30       if (!server_->Check(FP_TCP, GetLocalAddress(), addr)) {
31         LOG(LS_VERBOSE) << "FirewallSocket outbound TCP connection from "
32                         << GetLocalAddress().ToSensitiveString() << " to "
33                         << addr.ToSensitiveString() << " denied";
34         // TODO: Handle this asynchronously.
35         SetError(EHOSTUNREACH);
36         return SOCKET_ERROR;
37       }
38     }
39     return AsyncSocketAdapter::Connect(addr);
40   }
Send(const void * pv,size_t cb)41   virtual int Send(const void* pv, size_t cb) {
42     return SendTo(pv, cb, GetRemoteAddress());
43   }
SendTo(const void * pv,size_t cb,const SocketAddress & addr)44   virtual int SendTo(const void* pv, size_t cb, const SocketAddress& addr) {
45     if (type_ == SOCK_DGRAM) {
46       if (!server_->Check(FP_UDP, GetLocalAddress(), addr)) {
47         LOG(LS_VERBOSE) << "FirewallSocket outbound UDP packet from "
48                         << GetLocalAddress().ToSensitiveString() << " to "
49                         << addr.ToSensitiveString() << " dropped";
50         return static_cast<int>(cb);
51       }
52     }
53     return AsyncSocketAdapter::SendTo(pv, cb, addr);
54   }
Recv(void * pv,size_t cb)55   virtual int Recv(void* pv, size_t cb) {
56     SocketAddress addr;
57     return RecvFrom(pv, cb, &addr);
58   }
RecvFrom(void * pv,size_t cb,SocketAddress * paddr)59   virtual int RecvFrom(void* pv, size_t cb, SocketAddress* paddr) {
60     if (type_ == SOCK_DGRAM) {
61       while (true) {
62         int res = AsyncSocketAdapter::RecvFrom(pv, cb, paddr);
63         if (res <= 0)
64           return res;
65         if (server_->Check(FP_UDP, *paddr, GetLocalAddress()))
66           return res;
67         LOG(LS_VERBOSE) << "FirewallSocket inbound UDP packet from "
68                         << paddr->ToSensitiveString() << " to "
69                         << GetLocalAddress().ToSensitiveString() << " dropped";
70       }
71     }
72     return AsyncSocketAdapter::RecvFrom(pv, cb, paddr);
73   }
74 
Listen(int backlog)75   virtual int Listen(int backlog) {
76     if (!server_->tcp_listen_enabled()) {
77       LOG(LS_VERBOSE) << "FirewallSocket listen attempt denied";
78       return -1;
79     }
80 
81     return AsyncSocketAdapter::Listen(backlog);
82   }
Accept(SocketAddress * paddr)83   virtual AsyncSocket* Accept(SocketAddress* paddr) {
84     SocketAddress addr;
85     while (AsyncSocket* sock = AsyncSocketAdapter::Accept(&addr)) {
86       if (server_->Check(FP_TCP, addr, GetLocalAddress())) {
87         if (paddr)
88           *paddr = addr;
89         return sock;
90       }
91       sock->Close();
92       delete sock;
93       LOG(LS_VERBOSE) << "FirewallSocket inbound TCP connection from "
94                       << addr.ToSensitiveString() << " to "
95                       << GetLocalAddress().ToSensitiveString() << " denied";
96     }
97     return 0;
98   }
99 
100  private:
101   FirewallSocketServer* server_;
102   int type_;
103 };
104 
FirewallSocketServer(SocketServer * server,FirewallManager * manager,bool should_delete_server)105 FirewallSocketServer::FirewallSocketServer(SocketServer* server,
106                                            FirewallManager* manager,
107                                            bool should_delete_server)
108     : server_(server), manager_(manager),
109       should_delete_server_(should_delete_server),
110       udp_sockets_enabled_(true), tcp_sockets_enabled_(true),
111       tcp_listen_enabled_(true) {
112   if (manager_)
113     manager_->AddServer(this);
114 }
115 
~FirewallSocketServer()116 FirewallSocketServer::~FirewallSocketServer() {
117   if (manager_)
118     manager_->RemoveServer(this);
119 
120   if (server_ && should_delete_server_) {
121     delete server_;
122     server_ = NULL;
123   }
124 }
125 
AddRule(bool allow,FirewallProtocol p,FirewallDirection d,const SocketAddress & addr)126 void FirewallSocketServer::AddRule(bool allow, FirewallProtocol p,
127                                    FirewallDirection d,
128                                    const SocketAddress& addr) {
129   SocketAddress src, dst;
130   if (d == FD_IN) {
131     dst = addr;
132   } else {
133     src = addr;
134   }
135   AddRule(allow, p, src, dst);
136 }
137 
138 
AddRule(bool allow,FirewallProtocol p,const SocketAddress & src,const SocketAddress & dst)139 void FirewallSocketServer::AddRule(bool allow, FirewallProtocol p,
140                                    const SocketAddress& src,
141                                    const SocketAddress& dst) {
142   Rule r;
143   r.allow = allow;
144   r.p = p;
145   r.src = src;
146   r.dst = dst;
147   CritScope scope(&crit_);
148   rules_.push_back(r);
149 }
150 
ClearRules()151 void FirewallSocketServer::ClearRules() {
152   CritScope scope(&crit_);
153   rules_.clear();
154 }
155 
Check(FirewallProtocol p,const SocketAddress & src,const SocketAddress & dst)156 bool FirewallSocketServer::Check(FirewallProtocol p,
157                                  const SocketAddress& src,
158                                  const SocketAddress& dst) {
159   CritScope scope(&crit_);
160   for (size_t i = 0; i < rules_.size(); ++i) {
161     const Rule& r = rules_[i];
162     if ((r.p != p) && (r.p != FP_ANY))
163       continue;
164     if ((r.src.ipaddr() != src.ipaddr()) && !r.src.IsNil())
165       continue;
166     if ((r.src.port() != src.port()) && (r.src.port() != 0))
167       continue;
168     if ((r.dst.ipaddr() != dst.ipaddr()) && !r.dst.IsNil())
169       continue;
170     if ((r.dst.port() != dst.port()) && (r.dst.port() != 0))
171       continue;
172     return r.allow;
173   }
174   return true;
175 }
176 
CreateSocket(int type)177 Socket* FirewallSocketServer::CreateSocket(int type) {
178   return CreateSocket(AF_INET, type);
179 }
180 
CreateSocket(int family,int type)181 Socket* FirewallSocketServer::CreateSocket(int family, int type) {
182   return WrapSocket(server_->CreateAsyncSocket(family, type), type);
183 }
184 
CreateAsyncSocket(int type)185 AsyncSocket* FirewallSocketServer::CreateAsyncSocket(int type) {
186   return CreateAsyncSocket(AF_INET, type);
187 }
188 
CreateAsyncSocket(int family,int type)189 AsyncSocket* FirewallSocketServer::CreateAsyncSocket(int family, int type) {
190   return WrapSocket(server_->CreateAsyncSocket(family, type), type);
191 }
192 
WrapSocket(AsyncSocket * sock,int type)193 AsyncSocket* FirewallSocketServer::WrapSocket(AsyncSocket* sock, int type) {
194   if (!sock ||
195       (type == SOCK_STREAM && !tcp_sockets_enabled_) ||
196       (type == SOCK_DGRAM && !udp_sockets_enabled_)) {
197     LOG(LS_VERBOSE) << "FirewallSocketServer socket creation denied";
198     delete sock;
199     return NULL;
200   }
201   return new FirewallSocket(this, sock, type);
202 }
203 
FirewallManager()204 FirewallManager::FirewallManager() {
205 }
206 
~FirewallManager()207 FirewallManager::~FirewallManager() {
208   assert(servers_.empty());
209 }
210 
AddServer(FirewallSocketServer * server)211 void FirewallManager::AddServer(FirewallSocketServer* server) {
212   CritScope scope(&crit_);
213   servers_.push_back(server);
214 }
215 
RemoveServer(FirewallSocketServer * server)216 void FirewallManager::RemoveServer(FirewallSocketServer* server) {
217   CritScope scope(&crit_);
218   servers_.erase(std::remove(servers_.begin(), servers_.end(), server),
219                  servers_.end());
220 }
221 
AddRule(bool allow,FirewallProtocol p,FirewallDirection d,const SocketAddress & addr)222 void FirewallManager::AddRule(bool allow, FirewallProtocol p,
223                               FirewallDirection d, const SocketAddress& addr) {
224   CritScope scope(&crit_);
225   for (std::vector<FirewallSocketServer*>::const_iterator it =
226       servers_.begin(); it != servers_.end(); ++it) {
227     (*it)->AddRule(allow, p, d, addr);
228   }
229 }
230 
ClearRules()231 void FirewallManager::ClearRules() {
232   CritScope scope(&crit_);
233   for (std::vector<FirewallSocketServer*>::const_iterator it =
234       servers_.begin(); it != servers_.end(); ++it) {
235     (*it)->ClearRules();
236   }
237 }
238 
239 }  // namespace rtc
240