UDP firewall rules for Windows.

chrome/installer/setup/install_worker.cc

Index: chrome/installer/setup/install_worker.cc
diff --git a/chrome/installer/setup/install_worker.cc b/chrome/installer/setup/install_worker.cc
index 1713fe5884a2077c9cf9376eba5bce734372bab2..62bbbf17261a5d6e4a830b69d57ff95269b0c8a5 100644
--- a/chrome/installer/setup/install_worker.cc
+++ b/chrome/installer/setup/install_worker.cc
@@ -36,6 +36,7 @@
 #include "chrome/installer/util/callback_work_item.h"
 #include "chrome/installer/util/conditional_work_item_list.h"
 #include "chrome/installer/util/create_reg_key_work_item.h"
+#include "chrome/installer/util/firewall_manager.h"
 #include "chrome/installer/util/google_update_constants.h"
 #include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/install_util.h"
@@ -255,6 +256,55 @@ void AddInstallExtensionCommandWorkItem(const InstallerState& installer_state,
                                    work_item_list);
 }
 
+// A callback invoked by |work_item| that adds firewall rules for Chrome. Rules
+// are left in-place on rollback unless |remove_on_rollback| is true. This is
+// the case for new installs only. Updates and overinstalls leave the rule
+// in-place on rollback since a previous install of Chrome will be used in that
+// case.
+bool AddFirewallRulesCallback(bool system_level,
+                              BrowserDistribution* dist,
+                              const base::FilePath& chrome_path,
+                              bool remove_on_rollback,
+                              const CallbackWorkItem& work_item) {
+  // There is no work to do on rollback if this is not a new install.
+  if (work_item.IsRollback() && !remove_on_rollback)
+    return true;
+
+  scoped_ptr<FirewallManager> firewall_manager(
+      FirewallManager::Create(dist, chrome_path));
+  if (!firewall_manager) {
+    LOG(ERROR) << "Failed creating a FirewallManager to adjust rules."
+                  " Continuing with install.";
+    return true;
+  }
+
+  if (work_item.IsRollback()) {
+    firewall_manager->DeleteUDPFirewallRule();
+    return true;
+  }
+
+  // Adding the firewall rule is expected to fail for user-level installs on
+  // Vista+. Try anyway in case the installer is running elevated.
+  if (!firewall_manager->AddUDPFirewallRuleIfAbsent() && !system_level)
+    LOG(ERROR) << "Failed to add UDP firewall rule. Continuing with install.";
+
+  // Don't abort installation if the firewall rule couldn't be added.
+  return true;
+}
+
+// Adds work items to |list| to create firewall rules.
+void AddFirewallRulesWorkItems(const InstallerState& installer_state,
+                               BrowserDistribution* dist,
+                               bool is_new_install,
+                               WorkItemList* list) {
+  list->AddCallbackWorkItem(
+      base::Bind(&AddFirewallRulesCallback,
+                 installer_state.system_install(),
+                 dist,
+                 installer_state.target_path().Append(kChromeExe),
+                 is_new_install));
+}
+
 // Returns the basic CommandLine to setup.exe for a quick-enable operation on
 // the binaries. This will unconditionally include --multi-install as well as
 // --verbose-logging if the current installation was launched with
@@ -345,6 +395,7 @@ void AddProductSpecificWorkItems(const InstallationState& original_state,
                                  const InstallerState& installer_state,
                                  const base::FilePath& setup_path,
                                  const Version& new_version,
+                                 bool is_new_install,
                                  WorkItemList* list) {
   const Products& products = installer_state.products();
   for (Products::const_iterator it = products.begin(); it < products.end();
@@ -359,6 +410,8 @@ void AddProductSpecificWorkItems(const InstallationState& original_state,
                             list);
       AddInstallExtensionCommandWorkItem(installer_state, original_state,
                                          setup_path, new_version, p, list);
+      AddFirewallRulesWorkItems(installer_state, p.distribution(),
+                                is_new_install, list);
     }
     if (p.is_chrome_binaries()) {
       AddQueryEULAAcceptanceWorkItems(
@@ -1178,7 +1231,8 @@ void AddInstallWorkItems(const InstallationState& original_state,
   // Add any remaining work items that involve special settings for
   // each product.
   AddProductSpecificWorkItems(original_state, installer_state, setup_path,
-                              new_version, install_list);
+                              new_version, current_version == NULL,
+                              install_list);
 
   // Copy over brand, usagestats, and other values.
   AddGoogleUpdateWorkItems(original_state, installer_state, install_list);