BandwidthController: switch to generic handling for naughty apps.
Rename some stuff in preparation for nice apps and the "happy box".
Bug: 6212480
Change-Id: I637c4283695ac619533999beab4f88968580d2e4
diff --git a/BandwidthController.cpp b/BandwidthController.cpp
index 277f320..4f72126 100644
--- a/BandwidthController.cpp
+++ b/BandwidthController.cpp
@@ -138,13 +138,13 @@
BandwidthController::BandwidthController(void) {
}
-int BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling,
+int BandwidthController::runIpxtablesCmd(const char *cmd, IptJumpOp jumpHandling,
IptFailureLog failureHandling) {
int res = 0;
ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
- res |= runIptablesCmd(cmd, rejectHandling, IptIpV4, failureHandling);
- res |= runIptablesCmd(cmd, rejectHandling, IptIpV6, failureHandling);
+ res |= runIptablesCmd(cmd, jumpHandling, IptIpV4, failureHandling);
+ res |= runIptablesCmd(cmd, jumpHandling, IptIpV6, failureHandling);
return res;
}
@@ -155,7 +155,7 @@
return buffer[buffSize - 1];
}
-int BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling,
+int BandwidthController::runIptablesCmd(const char *cmd, IptJumpOp jumpHandling,
IptIpVer iptVer, IptFailureLog failureHandling) {
char buffer[MAX_CMD_LEN];
const char *argv[MAX_CMD_ARGS];
@@ -167,13 +167,20 @@
std::string fullCmd = cmd;
- if (rejectHandling == IptRejectAdd) {
+ switch (jumpHandling) {
+ case IptJumpReject:
/*
* Must be carefull what one rejects with, as uper layer protocols will just
* keep on hammering the device until the number of retries are done.
* For port-unreachable (default), TCP should consider as an abort (RFC1122).
*/
fullCmd += " --jump REJECT";
+ break;
+ case IptJumpReturn:
+ fullCmd += " --jump RETURN";
+ break;
+ case IptJumpNoAdd:
+ break;
}
fullCmd.insert(0, " ");
@@ -262,14 +269,14 @@
}
ALOGV("runCommands(): %d commands", numCommands);
for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
- res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd, failureLogging);
+ res = runIpxtablesCmd(commands[cmdNum], IptJumpNoAdd, failureLogging);
if (res && cmdErrHandling != RunCmdFailureOk)
return res;
}
return 0;
}
-std::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) {
+std::string BandwidthController::makeIptablesSpecialAppCmd(IptOp op, int uid, const char *chain) {
std::string res;
char *buff;
const char *opFlag;
@@ -279,7 +286,9 @@
opFlag = "-I";
break;
case IptOpAppend:
- opFlag = "-A";
+ ALOGE("Append op not supported for %s uids", chain);
+ res = "";
+ return res;
break;
case IptOpReplace:
opFlag = "-R";
@@ -289,37 +298,46 @@
opFlag = "-D";
break;
}
- asprintf(&buff, "%s penalty_box -m owner --uid-owner %d", opFlag, uid);
+ asprintf(&buff, "%s %s -m owner --uid-owner %d", opFlag, chain, uid);
res = buff;
free(buff);
return res;
}
int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
- return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd);
+ return manipulateNaughtyApps(numUids, appUids, SpecialAppOpAdd);
}
int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
- return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove);
+ return manipulateNaughtyApps(numUids, appUids, SpecialAppOpRemove);
}
-int BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) {
+int BandwidthController::manipulateNaughtyApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
+ return manipulateSpecialApps(numUids, appStrUids, "penalty_box", naughtyAppUids, IptJumpReject, appOp);
+}
+
+
+int BandwidthController::manipulateSpecialApps(int numUids, char *appStrUids[],
+ const char *chain,
+ std::list<int /*appUid*/> &specialAppUids,
+ IptJumpOp jumpHandling, SpecialAppOp appOp) {
+
char cmd[MAX_CMD_LEN];
int uidNum;
const char *failLogTemplate;
IptOp op;
int appUids[numUids];
- std::string naughtyCmd;
+ std::string iptCmd;
std::list<int /*uid*/>::iterator it;
switch (appOp) {
- case NaughtyAppOpAdd:
+ case SpecialAppOpAdd:
op = IptOpInsert;
- failLogTemplate = "Failed to add app uid %d to penalty box.";
+ failLogTemplate = "Failed to add app uid %d to %s.";
break;
- case NaughtyAppOpRemove:
+ case SpecialAppOpRemove:
op = IptOpDelete;
- failLogTemplate = "Failed to delete app uid %d from penalty box.";
+ failLogTemplate = "Failed to delete app uid %d from %s box.";
break;
default:
ALOGE("Unexpected app Op %d", appOp);
@@ -329,36 +347,36 @@
for (uidNum = 0; uidNum < numUids; uidNum++) {
appUids[uidNum] = atol(appStrUids[uidNum]);
if (appUids[uidNum] == 0) {
- ALOGE(failLogTemplate, appUids[uidNum]);
+ ALOGE(failLogTemplate, appUids[uidNum], chain);
goto fail_parse;
}
}
for (uidNum = 0; uidNum < numUids; uidNum++) {
int uid = appUids[uidNum];
- for (it = naughtyAppUids.begin(); it != naughtyAppUids.end(); it++) {
+ for (it = specialAppUids.begin(); it != specialAppUids.end(); it++) {
if (*it == uid)
break;
}
- bool found = (it != naughtyAppUids.end());
+ bool found = (it != specialAppUids.end());
- if (appOp == NaughtyAppOpRemove) {
+ if (appOp == SpecialAppOpRemove) {
if (!found) {
ALOGE("No such appUid %d to remove", uid);
return -1;
}
- naughtyAppUids.erase(it);
+ specialAppUids.erase(it);
} else {
if (found) {
ALOGE("appUid %d exists already", uid);
return -1;
}
- naughtyAppUids.push_front(uid);
+ specialAppUids.push_front(uid);
}
- naughtyCmd = makeIptablesNaughtyCmd(op, uid);
- if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) {
- ALOGE(failLogTemplate, uid);
+ iptCmd = makeIptablesSpecialAppCmd(op, uid, chain);
+ if (runIpxtablesCmd(iptCmd.c_str(), jumpHandling)) {
+ ALOGE(failLogTemplate, uid, chain);
goto fail_with_uidNum;
}
}
@@ -366,8 +384,8 @@
fail_with_uidNum:
/* Try to remove the uid that failed in any case*/
- naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]);
- runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd);
+ iptCmd = makeIptablesSpecialAppCmd(IptOpDelete, appUids[uidNum], chain);
+ runIpxtablesCmd(iptCmd.c_str(), jumpHandling);
fail_parse:
return -1;
}
@@ -422,13 +440,13 @@
* This helps with netd restarts.
*/
snprintf(cmd, sizeof(cmd), "-F %s", costCString);
- res1 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
+ res1 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
snprintf(cmd, sizeof(cmd), "-N %s", costCString);
- res2 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
+ res2 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
res = (res1 && res2) || (!res1 && !res2);
snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
break;
case QuotaShared:
costCString = "costly_shared";
@@ -444,16 +462,16 @@
}
snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
- runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
+ runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
- runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
+ runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
return res;
}
@@ -478,16 +496,16 @@
}
snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
/* The "-N costly_shared" is created upfront, no need to handle it here. */
if (quotaType == QuotaUnique) {
snprintf(cmd, sizeof(cmd), "-F %s", costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
snprintf(cmd, sizeof(cmd), "-X %s", costCString);
- res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
}
return res;
}
@@ -527,7 +545,7 @@
res |= prepCostlyIface(ifn, QuotaShared);
if (sharedQuotaIfaces.empty()) {
quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
- res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
+ res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
if (res) {
ALOGE("Failed set quota rule");
goto fail;
@@ -588,7 +606,7 @@
if (sharedQuotaIfaces.empty()) {
std::string quotaCmd;
quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
- res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
+ res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
sharedQuotaBytes = 0;
if (sharedAlertBytes) {
removeSharedAlert();
@@ -637,7 +655,7 @@
* So we append here.
*/
quotaCmd = makeIptablesQuotaCmd(IptOpAppend, costName, maxBytes);
- res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
+ res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
if (res) {
ALOGE("Failed set quota rule");
goto fail;
@@ -760,11 +778,11 @@
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
bytes, alertName);
- res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
free(alertQuotaCmd);
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
bytes, alertName);
- res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
free(alertQuotaCmd);
return res;
}
@@ -792,7 +810,7 @@
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
bytes, alertName);
- res = runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
+ res = runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
free(alertQuotaCmd);
return res;
}
@@ -948,7 +966,7 @@
} else {
asprintf(&chainName, "costly_%s", costName);
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-A", chainName, bytes, alertName);
- res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
free(alertQuotaCmd);
free(chainName);
}
@@ -971,7 +989,7 @@
asprintf(&chainName, "costly_%s", costName);
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
- res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
+ res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
free(alertQuotaCmd);
free(chainName);