Use binder firewalld interface in binder mode

Test: Binder mode can successfully punch holes in the firewall
Bug: 27204884
Change-Id: I35852941afbd6091e396938eed03cc7ac3b2cea9

Android.mk

diff --git a/Android.mk b/Android.mk
index 971603d..25b5310 100644
--- a/Android.mk
+++ b/Android.mk
@@ -50,14 +50,12 @@
       libchrome \
       libmicrohttpd
 
-  # TODO(wiley) Uncomment these guards once firewalld moves to binder
-  #             b/25932807
-  # ifeq ($(system_webservd_use_dbus),true)
+  ifeq ($(system_webservd_use_dbus),true)
     LOCAL_SHARED_LIBRARIES += \
         libbrillo-dbus \
         libchrome-dbus \
         libdbus
-  # endif
+  endif
   ifeq ($(system_webservd_use_binder),true)
     LOCAL_SHARED_LIBRARIES += \
         libbrillo-binder \

webservd/Android.mk

diff --git a/webservd/Android.mk b/webservd/Android.mk
index 2224f0d..76240ec 100644
--- a/webservd/Android.mk
+++ b/webservd/Android.mk
@@ -25,12 +25,12 @@
 LOCAL_MODULE := webservd
 LOCAL_SHARED_LIBRARIES := \
     libcrypto \
-    libfirewalld-client \
     libwebserv
 
 ifeq ($(system_webservd_use_dbus),true)
 LOCAL_SHARED_LIBRARIES += \
-    libwebserv-proxies-internal
+    libwebserv-proxies-internal \
+    libfirewalld-client
 endif
 
 ifdef BRILLO
@@ -44,7 +44,6 @@
 LOCAL_SRC_FILES := \
     config.cc \
     error_codes.cc \
-    firewalld_firewall.cc \
     log_manager.cc \
     main.cc \
     protocol_handler.cc \
@@ -60,6 +59,8 @@
     ../aidl/android/webservd/IHttpRequest.aidl \
     binder_request.cc \
     binder_server.cc
+LOCAL_SHARED_LIBRARIES += \
+    libfirewalld-binder-client
 endif
 
 ifeq ($(system_webservd_use_dbus),true)
@@ -69,6 +70,7 @@
     dbus_bindings/org.chromium.WebServer.Server.dbus-xml \
     dbus_protocol_handler.cc \
     dbus_request_handler.cc \
+    firewalld_firewall.cc \
     server.cc
 endif
 

webservd/binder_server.cc

diff --git a/webservd/binder_server.cc b/webservd/binder_server.cc
index 98ea010..290c5ce 100644
--- a/webservd/binder_server.cc
+++ b/webservd/binder_server.cc
@@ -18,6 +18,8 @@
 #include <brillo/http/http_request.h>
 #include <brillo/mime_utils.h>
 
+#include <firewalld/firewall.h>
+
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 
@@ -222,18 +224,32 @@
   }
 }
 
-BinderServer::BinderServer(const Config& config)
+BinderServer::BinderServer(const Config& config,
+                           android::BinderWrapper* binder_wrapper)
     : config_(config),
       default_encryptor_{Encryptor::CreateDefaultEncryptor()},
       encryptor_(default_encryptor_.get()) {
   InitTlsData();
 
+  unique_ptr<firewalld::Firewall> firewall =
+      firewalld::Firewall::Connect(binder_wrapper);
+
+  if (!firewall) {
+    LOG(ERROR) << "Could not connect to firewall.";
+  }
+
   for (const auto& handler_config : config_.protocol_handlers) {
     sp<BinderProtocolHandler> handler_ptr{
         new BinderProtocolHandler(handler_config.name, this)};
 
     if (handler_ptr->Start(handler_config)) {
       protocol_handlers_.push_back(handler_ptr);
+      if (firewall &&
+          !firewall->PunchTcpHole(handler_config.port,
+                                  handler_config.interface_name)) {
+          LOG(ERROR) << "Could not open port " << handler_config.port
+                     << " for protocol handler.";
+      }
     }
   }
 }

webservd/binder_server.h

diff --git a/webservd/binder_server.h b/webservd/binder_server.h
index da3229d..d2e6654 100644
--- a/webservd/binder_server.h
+++ b/webservd/binder_server.h
@@ -26,12 +26,15 @@
 #include "android/webservd/BnServer.h"
 #include "android/webservd/IProtocolHandler.h"
 
+#include <binderwrapper/binder_wrapper.h>
+
 namespace webservd {
 
 class BinderServer : public android::webservd::BnServer,
                      public webservd::ServerInterface {
  public:
-  explicit BinderServer(const Config& config);
+  explicit BinderServer(const Config& config,
+                        android::BinderWrapper* binder_wrapper);
 
   // Overrides from BnServer
   android::binder::Status Ping(std::string* result) override;

webservd/main.cc

diff --git a/webservd/main.cc b/webservd/main.cc
index b4691d4..8782e15 100644
--- a/webservd/main.cc
+++ b/webservd/main.cc
@@ -50,16 +50,19 @@
 #endif  // WEBSERV_USE_BINDER
 
 #if defined(__ANDROID__)
+#ifdef WEBSERV_USE_BINDER
+#include <firewalld/firewall.h>
+#else
 #include "webservd/firewalld_firewall.h"
 using FirewallImpl = webservd::FirewalldFirewall;
+#endif
 #else
 #include "webservd/permission_broker_firewall.h"
 using FirewallImpl = webservd::PermissionBrokerFirewall;
 #endif  // defined(__ANDROID__)
 
-using brillo::dbus_utils::AsyncEventSequencer;
-
 #ifdef WEBSERV_USE_DBUS
+using brillo::dbus_utils::AsyncEventSequencer;
 using BaseDaemon = brillo::DBusServiceDaemon;
 #else
 using BaseDaemon = brillo::Daemon;
@@ -121,7 +124,8 @@
         return EX_OSERR;
     }
 
-    server_.reset(new webservd::BinderServer(config_));
+    server_.reset(new webservd::BinderServer(config_,
+                  android::BinderWrapper::Get()));
 
     if (!android::BinderWrapper::Get()->RegisterService(
             webservd::kWebserverBinderServiceName,