blob: 4f9344ccbcf0d5f53fc46c8f07b0de1aa0a5db55 [file] [log] [blame]
JP Abgrall4a5f5ca2011-06-15 18:37:39 -07001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgralle4788732013-07-02 20:28:45 -070017// #define LOG_NDEBUG 0
JP Abgralldb7da582011-09-18 12:57:32 -070018
19/*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
JP Abgrall8a932722011-07-13 19:17:35 -070025#include <errno.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070026#include <fcntl.h>
JP Abgralldb7da582011-09-18 12:57:32 -070027#include <stdio.h>
JP Abgrall8a932722011-07-13 19:17:35 -070028#include <stdlib.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070029#include <string.h>
Nick Kralevich0b2b9022014-05-01 13:10:45 -070030#include <ctype.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070031
Matthew Leach2a54d962013-01-14 15:07:12 +000032#define __STDC_FORMAT_MACROS 1
33#include <inttypes.h>
34
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070035#include <sys/socket.h>
36#include <sys/stat.h>
37#include <sys/types.h>
38#include <sys/wait.h>
39
40#include <linux/netlink.h>
41#include <linux/rtnetlink.h>
42#include <linux/pkt_sched.h>
43
44#define LOG_TAG "BandwidthController"
45#include <cutils/log.h>
46#include <cutils/properties.h>
Rom Lemarchand14150212013-01-24 10:01:04 -080047#include <logwrap/logwrap.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070048
JP Abgrall0031cea2012-04-17 16:38:23 -070049#include "NetdConstants.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070050#include "BandwidthController.h"
JP Abgrallbaeccc42013-06-25 09:44:10 -070051#include "NatController.h" /* For LOCAL_TETHER_COUNTERS_CHAIN */
52#include "ResponseCode.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070053
JP Abgralldb7da582011-09-18 12:57:32 -070054/* Alphabetical */
SynergyDev7776cea2014-03-16 15:48:51 -070055#define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %" PRId64" --name %s"
JP Abgrallc6c67342011-10-07 16:28:54 -070056const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070057const char* BandwidthController::LOCAL_INPUT = "bw_INPUT";
58const char* BandwidthController::LOCAL_FORWARD = "bw_FORWARD";
59const char* BandwidthController::LOCAL_OUTPUT = "bw_OUTPUT";
60const char* BandwidthController::LOCAL_RAW_PREROUTING = "bw_raw_PREROUTING";
61const char* BandwidthController::LOCAL_MANGLE_POSTROUTING = "bw_mangle_POSTROUTING";
JP Abgralldb7da582011-09-18 12:57:32 -070062const int BandwidthController::MAX_CMD_ARGS = 32;
63const int BandwidthController::MAX_CMD_LEN = 1024;
64const int BandwidthController::MAX_IFACENAME_LEN = 64;
65const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
66
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070067/**
68 * Some comments about the rules:
69 * * Ordering
70 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
JP Abgrall29e8de22012-05-03 12:52:15 -070071 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
JP Abgrall7e51cde2013-07-03 13:33:05 -070072 * - quota'd rules in the costly chain should be before bw_penalty_box lookups.
73 * - bw_happy_box rejects everything by default.
JP Abgrall29e8de22012-05-03 12:52:15 -070074 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070075 *
76 * * global quota vs per interface quota
77 * - global quota for all costly interfaces uses a single costly chain:
78 * . initial rules
JP Abgrall7e51cde2013-07-03 13:33:05 -070079 * iptables -N bw_costly_shared
80 * iptables -I bw_INPUT -i iface0 --jump bw_costly_shared
81 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_shared
82 * iptables -I bw_costly_shared -m quota \! --quota 500000 \
JP Abgrallbfa74662011-06-29 19:23:04 -070083 * --jump REJECT --reject-with icmp-net-prohibited
JP Abgrall7e51cde2013-07-03 13:33:05 -070084 * iptables -A bw_costly_shared --jump bw_penalty_box
JP Abgralle4788732013-07-02 20:28:45 -070085 * If the happy box is enabled,
JP Abgrall7e51cde2013-07-03 13:33:05 -070086 * iptables -A bw_penalty_box --jump bw_happy_box
JP Abgrall8a932722011-07-13 19:17:35 -070087 *
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070088 * . adding a new iface to this, E.g.:
JP Abgrall7e51cde2013-07-03 13:33:05 -070089 * iptables -I bw_INPUT -i iface1 --jump bw_costly_shared
90 * iptables -I bw_OUTPUT -o iface1 --jump bw_costly_shared
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070091 *
92 * - quota per interface. This is achieve by having "costly" chains per quota.
93 * E.g. adding a new costly interface iface0 with its own quota:
JP Abgrall7e51cde2013-07-03 13:33:05 -070094 * iptables -N bw_costly_iface0
95 * iptables -I bw_INPUT -i iface0 --jump bw_costly_iface0
96 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_iface0
97 * iptables -A bw_costly_iface0 -m quota \! --quota 500000 \
JP Abgralle4788732013-07-02 20:28:45 -070098 * --jump REJECT --reject-with icmp-port-unreachable
JP Abgrall7e51cde2013-07-03 13:33:05 -070099 * iptables -A bw_costly_iface0 --jump bw_penalty_box
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700100 *
JP Abgrall7e51cde2013-07-03 13:33:05 -0700101 * * bw_penalty_box handling:
102 * - only one bw_penalty_box for all interfaces
103 * E.g Adding an app, it has to preserve the appened bw_happy_box, so "-I":
104 * iptables -I bw_penalty_box -m owner --uid-owner app_3 \
JP Abgralle4788732013-07-02 20:28:45 -0700105 * --jump REJECT --reject-with icmp-port-unreachable
106 *
JP Abgrall7e51cde2013-07-03 13:33:05 -0700107 * * bw_happy_box handling:
108 * - The bw_happy_box goes at the end of the penalty box.
JP Abgralle4788732013-07-02 20:28:45 -0700109 * E.g Adding a happy app,
JP Abgrall7e51cde2013-07-03 13:33:05 -0700110 * iptables -I bw_happy_box -m owner --uid-owner app_3 \
JP Abgralle4788732013-07-02 20:28:45 -0700111 * --jump RETURN
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700112 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700113const char *BandwidthController::IPT_FLUSH_COMMANDS[] = {
114 /*
115 * Cleanup rules.
JP Abgrall7e51cde2013-07-03 13:33:05 -0700116 * Should normally include bw_costly_<iface>, but we rely on the way they are setup
JP Abgrall0031cea2012-04-17 16:38:23 -0700117 * to allow coexistance.
JP Abgrall39f8f242011-06-29 19:21:58 -0700118 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700119 "-F bw_INPUT",
120 "-F bw_OUTPUT",
121 "-F bw_FORWARD",
JP Abgrall7e51cde2013-07-03 13:33:05 -0700122 "-F bw_happy_box",
123 "-F bw_penalty_box",
124 "-F bw_costly_shared",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700125
126 "-t raw -F bw_raw_PREROUTING",
127 "-t mangle -F bw_mangle_POSTROUTING",
JP Abgrall0031cea2012-04-17 16:38:23 -0700128};
129
130/* The cleanup commands assume flushing has been done. */
131const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700132 "-X bw_happy_box",
133 "-X bw_penalty_box",
134 "-X bw_costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700135};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700136
JP Abgralldb7da582011-09-18 12:57:32 -0700137const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700138 "-N bw_happy_box",
139 "-N bw_penalty_box",
140 "-N bw_costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700141};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700142
JP Abgralldb7da582011-09-18 12:57:32 -0700143const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700144 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700145
JP Abgrall0031cea2012-04-17 16:38:23 -0700146 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700147
JP Abgrall7e51cde2013-07-03 13:33:05 -0700148 "-A bw_costly_shared --jump bw_penalty_box",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700149
JP Abgrall92009c82013-02-06 18:01:24 -0800150 "-t raw -A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
151 "-t mangle -A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700152};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700153
154BandwidthController::BandwidthController(void) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700155}
156
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700157int BandwidthController::runIpxtablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700158 IptFailureLog failureHandling) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700159 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700160
Steve Block3fb42e02011-10-20 11:55:56 +0100161 ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700162 res |= runIptablesCmd(cmd, jumpHandling, IptIpV4, failureHandling);
163 res |= runIptablesCmd(cmd, jumpHandling, IptIpV6, failureHandling);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700164 return res;
165}
166
JP Abgrall26e0d492011-06-24 19:21:51 -0700167int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
168
169 memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
170 strncpy(buffer, src, buffSize);
171 return buffer[buffSize - 1];
172}
173
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700174int BandwidthController::runIptablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700175 IptIpVer iptVer, IptFailureLog failureHandling) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700176 char buffer[MAX_CMD_LEN];
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700177 const char *argv[MAX_CMD_ARGS];
JP Abgrall26e0d492011-06-24 19:21:51 -0700178 int argc = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700179 char *next = buffer;
180 char *tmp;
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700181 int res;
Rom Lemarchand14150212013-01-24 10:01:04 -0800182 int status = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700183
JP Abgrall0dad7c22011-06-24 11:58:14 -0700184 std::string fullCmd = cmd;
JP Abgrall26e0d492011-06-24 19:21:51 -0700185
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700186 switch (jumpHandling) {
187 case IptJumpReject:
JP Abgrall340d5cc2013-06-28 17:06:00 -0700188 /*
189 * Must be carefull what one rejects with, as uper layer protocols will just
190 * keep on hammering the device until the number of retries are done.
191 * For port-unreachable (default), TCP should consider as an abort (RFC1122).
192 */
193 fullCmd += " --jump REJECT";
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700194 break;
195 case IptJumpReturn:
196 fullCmd += " --jump RETURN";
197 break;
198 case IptJumpNoAdd:
199 break;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700200 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700201
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700202 fullCmd.insert(0, " ");
203 fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700204
Rom Lemarchand14150212013-01-24 10:01:04 -0800205 if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
206 ALOGE("iptables command too long");
207 return -1;
208 }
209
210 argc = 0;
211 while ((tmp = strsep(&next, " "))) {
212 argv[argc++] = tmp;
213 if (argc >= MAX_CMD_ARGS) {
214 ALOGE("iptables argument overflow");
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700215 return -1;
216 }
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700217 }
Rom Lemarchand14150212013-01-24 10:01:04 -0800218
219 argv[argc] = NULL;
220 res = android_fork_execvp(argc, (char **)argv, &status, false,
221 failureHandling == IptFailShow);
JP Abgrallc8dc63b2013-02-13 16:30:00 -0800222 res = res || !WIFEXITED(status) || WEXITSTATUS(status);
223 if (res && failureHandling == IptFailShow) {
224 ALOGE("runIptablesCmd(): res=%d status=%d failed %s", res, status,
225 fullCmd.c_str());
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700226 }
227 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700228}
229
JP Abgrall0e540ec2013-08-26 15:13:10 -0700230void BandwidthController::flushCleanTables(bool doClean) {
231 /* Flush and remove the bw_costly_<iface> tables */
232 flushExistingCostlyTables(doClean);
JP Abgrall0031cea2012-04-17 16:38:23 -0700233
234 /* Some of the initialCommands are allowed to fail */
235 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
236 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
237
JP Abgrall0e540ec2013-08-26 15:13:10 -0700238 if (doClean) {
239 runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
240 IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
241 }
242}
JP Abgrall0031cea2012-04-17 16:38:23 -0700243
JP Abgrall0e540ec2013-08-26 15:13:10 -0700244int BandwidthController::setupIptablesHooks(void) {
245
246 /* flush+clean is allowed to fail */
247 flushCleanTables(true);
JP Abgrall0031cea2012-04-17 16:38:23 -0700248 runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
249 IPT_SETUP_COMMANDS, RunCmdFailureBad);
250
251 return 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700252}
253
254int BandwidthController::enableBandwidthControl(bool force) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700255 int res;
JP Abgrall0031cea2012-04-17 16:38:23 -0700256 char value[PROPERTY_VALUE_MAX];
257
258 if (!force) {
259 property_get("persist.bandwidth.enable", value, "1");
260 if (!strcmp(value, "0"))
261 return 0;
262 }
JP Abgrall8a932722011-07-13 19:17:35 -0700263
JP Abgralldb7da582011-09-18 12:57:32 -0700264 /* Let's pretend we started from scratch ... */
JP Abgrall8a932722011-07-13 19:17:35 -0700265 sharedQuotaIfaces.clear();
266 quotaIfaces.clear();
267 naughtyAppUids.clear();
JP Abgralle4788732013-07-02 20:28:45 -0700268 niceAppUids.clear();
JP Abgralldb7da582011-09-18 12:57:32 -0700269 globalAlertBytes = 0;
JP Abgrallc6c67342011-10-07 16:28:54 -0700270 globalAlertTetherCount = 0;
JP Abgralldb7da582011-09-18 12:57:32 -0700271 sharedQuotaBytes = sharedAlertBytes = 0;
272
JP Abgrall0e540ec2013-08-26 15:13:10 -0700273 flushCleanTables(false);
274 res = runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
JP Abgralldb7da582011-09-18 12:57:32 -0700275 IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
JP Abgrall8a932722011-07-13 19:17:35 -0700276
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700277 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700278
279}
280
281int BandwidthController::disableBandwidthControl(void) {
JP Abgrall0e540ec2013-08-26 15:13:10 -0700282
283 flushCleanTables(false);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700284 return 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700285}
286
JP Abgrall8a932722011-07-13 19:17:35 -0700287int BandwidthController::runCommands(int numCommands, const char *commands[],
288 RunCmdErrHandling cmdErrHandling) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700289 int res = 0;
JP Abgrallad729ac2012-04-24 23:27:44 -0700290 IptFailureLog failureLogging = IptFailShow;
291 if (cmdErrHandling == RunCmdFailureOk) {
292 failureLogging = IptFailHide;
293 }
Steve Block3fb42e02011-10-20 11:55:56 +0100294 ALOGV("runCommands(): %d commands", numCommands);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700295 for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700296 res = runIpxtablesCmd(commands[cmdNum], IptJumpNoAdd, failureLogging);
JP Abgrall0031cea2012-04-17 16:38:23 -0700297 if (res && cmdErrHandling != RunCmdFailureOk)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700298 return res;
299 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700300 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700301}
302
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700303std::string BandwidthController::makeIptablesSpecialAppCmd(IptOp op, int uid, const char *chain) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700304 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700305 char *buff;
306 const char *opFlag;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700307
308 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700309 case IptOpInsert:
310 opFlag = "-I";
311 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800312 case IptOpAppend:
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700313 ALOGE("Append op not supported for %s uids", chain);
314 res = "";
315 return res;
JP Abgrall109899b2013-02-12 19:20:13 -0800316 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700317 case IptOpReplace:
318 opFlag = "-R";
319 break;
320 default:
321 case IptOpDelete:
322 opFlag = "-D";
323 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700324 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700325 asprintf(&buff, "%s %s -m owner --uid-owner %d", opFlag, chain, uid);
JP Abgrall8a932722011-07-13 19:17:35 -0700326 res = buff;
327 free(buff);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700328 return res;
329}
330
JP Abgralle4788732013-07-02 20:28:45 -0700331int BandwidthController::enableHappyBox(void) {
332 char cmd[MAX_CMD_LEN];
333 int res = 0;
334
335 /*
336 * We tentatively delete before adding, which helps recovering
337 * from bad states (e.g. netd died).
338 */
339
340 /* Should not exist, but ignore result if already there. */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700341 snprintf(cmd, sizeof(cmd), "-N bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700342 runIpxtablesCmd(cmd, IptJumpNoAdd);
343
344 /* Should be empty, but clear in case something was wrong. */
345 niceAppUids.clear();
JP Abgrall7e51cde2013-07-03 13:33:05 -0700346 snprintf(cmd, sizeof(cmd), "-F bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700347 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
348
JP Abgrall7e51cde2013-07-03 13:33:05 -0700349 snprintf(cmd, sizeof(cmd), "-D bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700350 runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall7e51cde2013-07-03 13:33:05 -0700351 snprintf(cmd, sizeof(cmd), "-A bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700352 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
353
354 /* Reject. Defaulting to prot-unreachable */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700355 snprintf(cmd, sizeof(cmd), "-D bw_happy_box -j REJECT");
JP Abgralle4788732013-07-02 20:28:45 -0700356 runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall7e51cde2013-07-03 13:33:05 -0700357 snprintf(cmd, sizeof(cmd), "-A bw_happy_box -j REJECT");
JP Abgralle4788732013-07-02 20:28:45 -0700358 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
359
360 return res;
361}
362
363int BandwidthController::disableHappyBox(void) {
364 char cmd[MAX_CMD_LEN];
365
366 /* Best effort */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700367 snprintf(cmd, sizeof(cmd), "-D bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700368 runIpxtablesCmd(cmd, IptJumpNoAdd);
369 niceAppUids.clear();
JP Abgrall7e51cde2013-07-03 13:33:05 -0700370 snprintf(cmd, sizeof(cmd), "-F bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700371 runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall7e51cde2013-07-03 13:33:05 -0700372 snprintf(cmd, sizeof(cmd), "-X bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700373 runIpxtablesCmd(cmd, IptJumpNoAdd);
374
375 return 0;
376}
377
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700378int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700379 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700380}
381
382int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700383 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpRemove);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700384}
385
JP Abgralle4788732013-07-02 20:28:45 -0700386int BandwidthController::addNiceApps(int numUids, char *appUids[]) {
387 return manipulateNiceApps(numUids, appUids, SpecialAppOpAdd);
388}
389
390int BandwidthController::removeNiceApps(int numUids, char *appUids[]) {
391 return manipulateNiceApps(numUids, appUids, SpecialAppOpRemove);
392}
393
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700394int BandwidthController::manipulateNaughtyApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700395 return manipulateSpecialApps(numUids, appStrUids, "bw_penalty_box", naughtyAppUids, IptJumpReject, appOp);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700396}
397
JP Abgralle4788732013-07-02 20:28:45 -0700398int BandwidthController::manipulateNiceApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700399 return manipulateSpecialApps(numUids, appStrUids, "bw_happy_box", niceAppUids, IptJumpReturn, appOp);
JP Abgralle4788732013-07-02 20:28:45 -0700400}
401
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700402
403int BandwidthController::manipulateSpecialApps(int numUids, char *appStrUids[],
404 const char *chain,
405 std::list<int /*appUid*/> &specialAppUids,
406 IptJumpOp jumpHandling, SpecialAppOp appOp) {
407
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700408 int uidNum;
JP Abgrall26e0d492011-06-24 19:21:51 -0700409 const char *failLogTemplate;
410 IptOp op;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700411 int appUids[numUids];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700412 std::string iptCmd;
JP Abgrallb1d24092012-04-27 01:02:31 -0700413 std::list<int /*uid*/>::iterator it;
JP Abgrall8a932722011-07-13 19:17:35 -0700414
JP Abgrall26e0d492011-06-24 19:21:51 -0700415 switch (appOp) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700416 case SpecialAppOpAdd:
JP Abgrall8a932722011-07-13 19:17:35 -0700417 op = IptOpInsert;
JP Abgrallaf476f72013-07-03 12:23:55 -0700418 failLogTemplate = "Failed to add app uid %s(%d) to %s.";
JP Abgrall8a932722011-07-13 19:17:35 -0700419 break;
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700420 case SpecialAppOpRemove:
JP Abgrall8a932722011-07-13 19:17:35 -0700421 op = IptOpDelete;
JP Abgrallaf476f72013-07-03 12:23:55 -0700422 failLogTemplate = "Failed to delete app uid %s(%d) from %s box.";
JP Abgrall8a932722011-07-13 19:17:35 -0700423 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700424 default:
425 ALOGE("Unexpected app Op %d", appOp);
426 return -1;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700427 }
428
429 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallaf476f72013-07-03 12:23:55 -0700430 char *end;
431 appUids[uidNum] = strtoul(appStrUids[uidNum], &end, 0);
432 if (*end || !*appStrUids[uidNum]) {
433 ALOGE(failLogTemplate, appStrUids[uidNum], appUids[uidNum], chain);
JP Abgrall26e0d492011-06-24 19:21:51 -0700434 goto fail_parse;
435 }
436 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700437
438 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700439 int uid = appUids[uidNum];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700440 for (it = specialAppUids.begin(); it != specialAppUids.end(); it++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700441 if (*it == uid)
442 break;
443 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700444 bool found = (it != specialAppUids.end());
JP Abgrallb1d24092012-04-27 01:02:31 -0700445
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700446 if (appOp == SpecialAppOpRemove) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700447 if (!found) {
448 ALOGE("No such appUid %d to remove", uid);
449 return -1;
450 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700451 specialAppUids.erase(it);
JP Abgrallb1d24092012-04-27 01:02:31 -0700452 } else {
453 if (found) {
454 ALOGE("appUid %d exists already", uid);
455 return -1;
456 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700457 specialAppUids.push_front(uid);
JP Abgrallb1d24092012-04-27 01:02:31 -0700458 }
459
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700460 iptCmd = makeIptablesSpecialAppCmd(op, uid, chain);
461 if (runIpxtablesCmd(iptCmd.c_str(), jumpHandling)) {
JP Abgrallaf476f72013-07-03 12:23:55 -0700462 ALOGE(failLogTemplate, appStrUids[uidNum], uid, chain);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700463 goto fail_with_uidNum;
464 }
465 }
466 return 0;
467
JP Abgrall26e0d492011-06-24 19:21:51 -0700468fail_with_uidNum:
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700469 /* Try to remove the uid that failed in any case*/
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700470 iptCmd = makeIptablesSpecialAppCmd(IptOpDelete, appUids[uidNum], chain);
471 runIpxtablesCmd(iptCmd.c_str(), jumpHandling);
JP Abgrall26e0d492011-06-24 19:21:51 -0700472fail_parse:
473 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700474}
475
JP Abgrall26e0d492011-06-24 19:21:51 -0700476std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700477 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700478 char *buff;
479 const char *opFlag;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700480
SynergyDev7776cea2014-03-16 15:48:51 -0700481 ALOGV("makeIptablesQuotaCmd(%d, %" PRId64")", op, quota);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700482
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700483 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700484 case IptOpInsert:
485 opFlag = "-I";
486 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800487 case IptOpAppend:
488 opFlag = "-A";
489 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700490 case IptOpReplace:
491 opFlag = "-R";
492 break;
493 default:
494 case IptOpDelete:
495 opFlag = "-D";
496 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700497 }
JP Abgrall8a932722011-07-13 19:17:35 -0700498
JP Abgrallbfa74662011-06-29 19:23:04 -0700499 // The requried IP version specific --jump REJECT ... will be added later.
SynergyDev7776cea2014-03-16 15:48:51 -0700500 asprintf(&buff, "%s bw_costly_%s -m quota2 ! --quota %" PRId64" --name %s", opFlag, costName, quota,
JP Abgrall8a932722011-07-13 19:17:35 -0700501 costName);
502 res = buff;
503 free(buff);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700504 return res;
505}
506
JP Abgrall26e0d492011-06-24 19:21:51 -0700507int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700508 char cmd[MAX_CMD_LEN];
JP Abgrall0031cea2012-04-17 16:38:23 -0700509 int res = 0, res1, res2;
JP Abgrall8a932722011-07-13 19:17:35 -0700510 int ruleInsertPos = 1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700511 std::string costString;
512 const char *costCString;
513
JP Abgrall0dad7c22011-06-24 11:58:14 -0700514 /* The "-N costly" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700515 switch (quotaType) {
516 case QuotaUnique:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700517 costString = "bw_costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700518 costString += ifn;
519 costCString = costString.c_str();
JP Abgrall0031cea2012-04-17 16:38:23 -0700520 /*
JP Abgrall7e51cde2013-07-03 13:33:05 -0700521 * Flush the bw_costly_<iface> is allowed to fail in case it didn't exist.
JP Abgrall0031cea2012-04-17 16:38:23 -0700522 * Creating a new one is allowed to fail in case it existed.
523 * This helps with netd restarts.
524 */
525 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700526 res1 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700527 snprintf(cmd, sizeof(cmd), "-N %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700528 res2 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700529 res = (res1 && res2) || (!res1 && !res2);
530
JP Abgrall7e51cde2013-07-03 13:33:05 -0700531 snprintf(cmd, sizeof(cmd), "-A %s -j bw_penalty_box", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700532 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall26e0d492011-06-24 19:21:51 -0700533 break;
534 case QuotaShared:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700535 costCString = "bw_costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700536 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700537 default:
538 ALOGE("Unexpected quotatype %d", quotaType);
539 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700540 }
541
JP Abgrall8a932722011-07-13 19:17:35 -0700542 if (globalAlertBytes) {
543 /* The alert rule comes 1st */
544 ruleInsertPos = 2;
545 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700546
547 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700548 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700549
550 snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700551 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700552
553 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700554 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700555
556 snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700557 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700558 return res;
559}
560
JP Abgrall26e0d492011-06-24 19:21:51 -0700561int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700562 char cmd[MAX_CMD_LEN];
563 int res = 0;
564 std::string costString;
565 const char *costCString;
566
JP Abgrall26e0d492011-06-24 19:21:51 -0700567 switch (quotaType) {
568 case QuotaUnique:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700569 costString = "bw_costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700570 costString += ifn;
571 costCString = costString.c_str();
JP Abgrall26e0d492011-06-24 19:21:51 -0700572 break;
573 case QuotaShared:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700574 costCString = "bw_costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700575 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700576 default:
577 ALOGE("Unexpected quotatype %d", quotaType);
578 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700579 }
580
JP Abgrall0031cea2012-04-17 16:38:23 -0700581 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700582 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700583 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700584 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700585
JP Abgrall7e51cde2013-07-03 13:33:05 -0700586 /* The "-N bw_costly_shared" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700587 if (quotaType == QuotaUnique) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700588 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700589 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgralla9f802c2011-06-29 15:46:45 -0700590 snprintf(cmd, sizeof(cmd), "-X %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700591 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700592 }
593 return res;
594}
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700595
JP Abgrall0dad7c22011-06-24 11:58:14 -0700596int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700597 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700598 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700599 std::string quotaCmd;
JP Abgrall8a932722011-07-13 19:17:35 -0700600 std::string ifaceName;
601 ;
JP Abgrallbfa74662011-06-29 19:23:04 -0700602 const char *costName = "shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700603 std::list<std::string>::iterator it;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700604
JP Abgrall8a932722011-07-13 19:17:35 -0700605 if (!maxBytes) {
606 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000607 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700608 return -1;
609 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700610 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000611 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700612 return -1;
613 }
614 ifaceName = ifn;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700615
616 if (maxBytes == -1) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700617 return removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700618 }
619
620 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700621 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
622 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700623 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700624 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700625
JP Abgrall0dad7c22011-06-24 11:58:14 -0700626 if (it == sharedQuotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700627 res |= prepCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700628 if (sharedQuotaIfaces.empty()) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700629 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700630 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700631 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000632 ALOGE("Failed set quota rule");
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700633 goto fail;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700634 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700635 sharedQuotaBytes = maxBytes;
636 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700637 sharedQuotaIfaces.push_front(ifaceName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700638
639 }
640
641 if (maxBytes != sharedQuotaBytes) {
JP Abgrall8a932722011-07-13 19:17:35 -0700642 res |= updateQuota(costName, maxBytes);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700643 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000644 ALOGE("Failed update quota for %s", costName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700645 goto fail;
646 }
647 sharedQuotaBytes = maxBytes;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700648 }
649 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700650
651 fail:
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700652 /*
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700653 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
654 * rules in the kernel to see which ones need cleaning up.
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700655 * For now callers needs to choose if they want to "ndc bandwidth enable"
656 * which resets everything.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700657 */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700658 removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700659 return -1;
660}
661
JP Abgrall8a932722011-07-13 19:17:35 -0700662/* It will also cleanup any shared alerts */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700663int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700664 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700665 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700666 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700667 std::list<std::string>::iterator it;
JP Abgrallbfa74662011-06-29 19:23:04 -0700668 const char *costName = "shared";
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700669
JP Abgrall8a932722011-07-13 19:17:35 -0700670 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000671 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700672 return -1;
673 }
JP Abgrall8a932722011-07-13 19:17:35 -0700674 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700675
JP Abgrall0dad7c22011-06-24 11:58:14 -0700676 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
677 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700678 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700679 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700680 if (it == sharedQuotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000681 ALOGE("No such iface %s to delete", ifn);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700682 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700683 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700684
JP Abgrall26e0d492011-06-24 19:21:51 -0700685 res |= cleanupCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700686 sharedQuotaIfaces.erase(it);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700687
JP Abgrall0dad7c22011-06-24 11:58:14 -0700688 if (sharedQuotaIfaces.empty()) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700689 std::string quotaCmd;
JP Abgrallbfa74662011-06-29 19:23:04 -0700690 quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700691 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall8a932722011-07-13 19:17:35 -0700692 sharedQuotaBytes = 0;
693 if (sharedAlertBytes) {
694 removeSharedAlert();
695 sharedAlertBytes = 0;
696 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700697 }
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700698 return res;
699}
JP Abgrall0dad7c22011-06-24 11:58:14 -0700700
701int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
702 char ifn[MAX_IFACENAME_LEN];
703 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700704 std::string ifaceName;
705 const char *costName;
706 std::list<QuotaInfo>::iterator it;
707 std::string quotaCmd;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700708
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700709 if (!isNameLegal(iface)) {
710 ALOGE("setInterfaceQuota: Invalid iface \"%s\"", iface);
711 return -1;
712 }
713
JP Abgrall8a932722011-07-13 19:17:35 -0700714 if (!maxBytes) {
715 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000716 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700717 return -1;
718 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700719 if (maxBytes == -1) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700720 return removeInterfaceQuota(iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700721 }
722
JP Abgrall8a932722011-07-13 19:17:35 -0700723 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000724 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700725 return -1;
726 }
727 ifaceName = ifn;
728 costName = iface;
729
JP Abgrall0dad7c22011-06-24 11:58:14 -0700730 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700731 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700732 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700733 break;
734 }
735
736 if (it == quotaIfaces.end()) {
JP Abgralle4788732013-07-02 20:28:45 -0700737 /* Preparing the iface adds a penalty/happy box check */
JP Abgrall26e0d492011-06-24 19:21:51 -0700738 res |= prepCostlyIface(ifn, QuotaUnique);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700739 /*
JP Abgralle4788732013-07-02 20:28:45 -0700740 * The rejecting quota limit should go after the penalty/happy box checks
JP Abgrallbaeccc42013-06-25 09:44:10 -0700741 * or else a naughty app could just eat up the quota.
742 * So we append here.
743 */
JP Abgrall109899b2013-02-12 19:20:13 -0800744 quotaCmd = makeIptablesQuotaCmd(IptOpAppend, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700745 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700746 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000747 ALOGE("Failed set quota rule");
JP Abgrall0dad7c22011-06-24 11:58:14 -0700748 goto fail;
749 }
750
JP Abgrall8a932722011-07-13 19:17:35 -0700751 quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
JP Abgrall0dad7c22011-06-24 11:58:14 -0700752
753 } else {
JP Abgrall8a932722011-07-13 19:17:35 -0700754 res |= updateQuota(costName, maxBytes);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700755 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000756 ALOGE("Failed update quota for %s", iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700757 goto fail;
758 }
JP Abgrall8a932722011-07-13 19:17:35 -0700759 it->quota = maxBytes;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700760 }
761 return 0;
762
763 fail:
764 /*
765 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
766 * rules in the kernel to see which ones need cleaning up.
767 * For now callers needs to choose if they want to "ndc bandwidth enable"
768 * which resets everything.
769 */
770 removeInterfaceSharedQuota(ifn);
771 return -1;
772}
773
JP Abgrall8a932722011-07-13 19:17:35 -0700774int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
775 return getInterfaceQuota("shared", bytes);
776}
777
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700778bool BandwidthController::isNameLegal(const char* name) {
779 size_t i;
780 size_t name_len = strlen(name);
781 if (name_len == 0) {
782 return false;
783 }
784
785 /* First character must be alphanumeric */
786 if (!isalnum(name[0])) {
787 return false;
788 }
789
790 for (i = 1; i < name_len; i++) {
791 if (!isalnum(name[i]) && (name[i] != '_') && (name[i] != '-') && (name[i] != ':')) {
792 return false;
793 }
794 }
795
796 return true;
797}
798
JP Abgrall8a932722011-07-13 19:17:35 -0700799int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
800 FILE *fp;
801 char *fname;
802 int scanRes;
803
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700804 if (!isNameLegal(costName)) {
805 ALOGE("getInterfaceQuota: Invalid costName \"%s\"", costName);
806 return -1;
807 }
808
JP Abgrall8a932722011-07-13 19:17:35 -0700809 asprintf(&fname, "/proc/net/xt_quota/%s", costName);
810 fp = fopen(fname, "r");
811 free(fname);
812 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000813 ALOGE("Reading quota %s failed (%s)", costName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700814 return -1;
815 }
Mark Salyzynca0b5e22014-03-26 14:15:03 -0700816 scanRes = fscanf(fp, "%" SCNd64, bytes);
SynergyDev7776cea2014-03-16 15:48:51 -0700817 ALOGV("Read quota res=%d bytes=%" PRId64, scanRes, *bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700818 fclose(fp);
819 return scanRes == 1 ? 0 : -1;
820}
821
JP Abgrall0dad7c22011-06-24 11:58:14 -0700822int BandwidthController::removeInterfaceQuota(const char *iface) {
823
824 char ifn[MAX_IFACENAME_LEN];
825 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700826 std::string ifaceName;
827 const char *costName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700828 std::list<QuotaInfo>::iterator it;
JP Abgrall26e0d492011-06-24 19:21:51 -0700829
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700830 if (!isNameLegal(iface)) {
831 ALOGE("removeInterfaceQuota: Invalid iface \"%s\"", iface);
832 return -1;
833 }
834
JP Abgrall8a932722011-07-13 19:17:35 -0700835 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000836 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700837 return -1;
838 }
839 ifaceName = ifn;
840 costName = iface;
841
JP Abgrall0dad7c22011-06-24 11:58:14 -0700842 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700843 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700844 break;
845 }
846
847 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000848 ALOGE("No such iface %s to delete", ifn);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700849 return -1;
850 }
851
852 /* This also removes the quota command of CostlyIface chain. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700853 res |= cleanupCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700854
855 quotaIfaces.erase(it);
856
857 return res;
858}
JP Abgrall8a932722011-07-13 19:17:35 -0700859
860int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
861 FILE *fp;
862 char *fname;
863
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700864 if (!isNameLegal(quotaName)) {
865 ALOGE("updateQuota: Invalid quotaName \"%s\"", quotaName);
866 return -1;
867 }
868
JP Abgrall8a932722011-07-13 19:17:35 -0700869 asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
870 fp = fopen(fname, "w");
871 free(fname);
872 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000873 ALOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700874 return -1;
875 }
SynergyDev7776cea2014-03-16 15:48:51 -0700876 fprintf(fp, "%" PRId64"\n", bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700877 fclose(fp);
878 return 0;
879}
880
881int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
882 int res = 0;
883 const char *opFlag;
884 char *alertQuotaCmd;
885
886 switch (op) {
887 case IptOpInsert:
888 opFlag = "-I";
889 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800890 case IptOpAppend:
891 opFlag = "-A";
892 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700893 case IptOpReplace:
894 opFlag = "-R";
895 break;
896 default:
897 case IptOpDelete:
898 opFlag = "-D";
899 break;
900 }
901
JP Abgrall92009c82013-02-06 18:01:24 -0800902 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800903 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700904 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700905 free(alertQuotaCmd);
JP Abgrall92009c82013-02-06 18:01:24 -0800906 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800907 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700908 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700909 free(alertQuotaCmd);
910 return res;
911}
912
JP Abgrallc6c67342011-10-07 16:28:54 -0700913int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
914 int res = 0;
915 const char *opFlag;
JP Abgrall8a932722011-07-13 19:17:35 -0700916 char *alertQuotaCmd;
JP Abgrallc6c67342011-10-07 16:28:54 -0700917
918 switch (op) {
919 case IptOpInsert:
920 opFlag = "-I";
921 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800922 case IptOpAppend:
923 opFlag = "-A";
924 break;
JP Abgrallc6c67342011-10-07 16:28:54 -0700925 case IptOpReplace:
926 opFlag = "-R";
927 break;
928 default:
929 case IptOpDelete:
930 opFlag = "-D";
931 break;
932 }
933
JP Abgrall92009c82013-02-06 18:01:24 -0800934 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800935 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700936 res = runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrallc6c67342011-10-07 16:28:54 -0700937 free(alertQuotaCmd);
938 return res;
939}
940
941int BandwidthController::setGlobalAlert(int64_t bytes) {
942 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700943 int res = 0;
944
945 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000946 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700947 return -1;
948 }
949 if (globalAlertBytes) {
950 res = updateQuota(alertName, bytes);
951 } else {
952 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700953 if (globalAlertTetherCount) {
Steve Block3fb42e02011-10-20 11:55:56 +0100954 ALOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700955 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
956 }
JP Abgrall8a932722011-07-13 19:17:35 -0700957 }
958 globalAlertBytes = bytes;
959 return res;
960}
961
JP Abgrallc6c67342011-10-07 16:28:54 -0700962int BandwidthController::setGlobalAlertInForwardChain(void) {
963 const char *alertName = ALERT_GLOBAL_NAME;
964 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700965
JP Abgrallc6c67342011-10-07 16:28:54 -0700966 globalAlertTetherCount++;
Steve Block3fb42e02011-10-20 11:55:56 +0100967 ALOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700968
969 /*
970 * If there is no globalAlert active we are done.
971 * If there is an active globalAlert but this is not the 1st
972 * tether, we are also done.
973 */
974 if (!globalAlertBytes || globalAlertTetherCount != 1) {
975 return 0;
976 }
977
978 /* We only add the rule if this was the 1st tether added. */
979 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
980 return res;
981}
982
983int BandwidthController::removeGlobalAlert(void) {
984
985 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700986 int res = 0;
987
988 if (!globalAlertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000989 ALOGE("No prior alert set");
JP Abgrall8a932722011-07-13 19:17:35 -0700990 return -1;
991 }
992 res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700993 if (globalAlertTetherCount) {
994 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
995 }
JP Abgrall8a932722011-07-13 19:17:35 -0700996 globalAlertBytes = 0;
997 return res;
998}
999
JP Abgrallc6c67342011-10-07 16:28:54 -07001000int BandwidthController::removeGlobalAlertInForwardChain(void) {
1001 int res = 0;
1002 const char *alertName = ALERT_GLOBAL_NAME;
1003
1004 if (!globalAlertTetherCount) {
Steve Block5ea0c052012-01-06 19:18:11 +00001005 ALOGE("No prior alert set");
JP Abgrallc6c67342011-10-07 16:28:54 -07001006 return -1;
1007 }
1008
1009 globalAlertTetherCount--;
1010 /*
1011 * If there is no globalAlert active we are done.
1012 * If there is an active globalAlert but there are more
1013 * tethers, we are also done.
1014 */
1015 if (!globalAlertBytes || globalAlertTetherCount >= 1) {
1016 return 0;
1017 }
1018
1019 /* We only detete the rule if this was the last tether removed. */
1020 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
1021 return res;
1022}
1023
JP Abgrall8a932722011-07-13 19:17:35 -07001024int BandwidthController::setSharedAlert(int64_t bytes) {
1025 if (!sharedQuotaBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001026 ALOGE("Need to have a prior shared quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -07001027 return -1;
1028 }
1029 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001030 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001031 return -1;
1032 }
1033 return setCostlyAlert("shared", bytes, &sharedAlertBytes);
1034}
1035
1036int BandwidthController::removeSharedAlert(void) {
1037 return removeCostlyAlert("shared", &sharedAlertBytes);
1038}
1039
1040int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
1041 std::list<QuotaInfo>::iterator it;
1042
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001043 if (!isNameLegal(iface)) {
1044 ALOGE("setInterfaceAlert: Invalid iface \"%s\"", iface);
1045 return -1;
1046 }
1047
JP Abgrall8a932722011-07-13 19:17:35 -07001048 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001049 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001050 return -1;
1051 }
1052 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
1053 if (it->ifaceName == iface)
1054 break;
1055 }
1056
1057 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +00001058 ALOGE("Need to have a prior interface quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -07001059 return -1;
1060 }
1061
1062 return setCostlyAlert(iface, bytes, &it->alert);
1063}
1064
1065int BandwidthController::removeInterfaceAlert(const char *iface) {
1066 std::list<QuotaInfo>::iterator it;
1067
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001068 if (!isNameLegal(iface)) {
1069 ALOGE("removeInterfaceAlert: Invalid iface \"%s\"", iface);
1070 return -1;
1071 }
1072
JP Abgrall8a932722011-07-13 19:17:35 -07001073 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
1074 if (it->ifaceName == iface)
1075 break;
1076 }
1077
1078 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +00001079 ALOGE("No prior alert set for interface %s", iface);
JP Abgrall8a932722011-07-13 19:17:35 -07001080 return -1;
1081 }
1082
1083 return removeCostlyAlert(iface, &it->alert);
1084}
1085
1086int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
1087 char *alertQuotaCmd;
JP Abgrall109899b2013-02-12 19:20:13 -08001088 char *chainName;
JP Abgrall8a932722011-07-13 19:17:35 -07001089 int res = 0;
1090 char *alertName;
1091
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001092 if (!isNameLegal(costName)) {
1093 ALOGE("setCostlyAlert: Invalid costName \"%s\"", costName);
1094 return -1;
1095 }
1096
JP Abgrall8a932722011-07-13 19:17:35 -07001097 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001098 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001099 return -1;
1100 }
1101 asprintf(&alertName, "%sAlert", costName);
1102 if (*alertBytes) {
1103 res = updateQuota(alertName, *alertBytes);
1104 } else {
JP Abgrall7e51cde2013-07-03 13:33:05 -07001105 asprintf(&chainName, "bw_costly_%s", costName);
JP Abgrall109899b2013-02-12 19:20:13 -08001106 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-A", chainName, bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -07001107 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -07001108 free(alertQuotaCmd);
JP Abgrall109899b2013-02-12 19:20:13 -08001109 free(chainName);
JP Abgrall8a932722011-07-13 19:17:35 -07001110 }
1111 *alertBytes = bytes;
1112 free(alertName);
1113 return res;
1114}
1115
1116int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
1117 char *alertQuotaCmd;
1118 char *chainName;
1119 char *alertName;
1120 int res = 0;
1121
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001122 if (!isNameLegal(costName)) {
1123 ALOGE("removeCostlyAlert: Invalid costName \"%s\"", costName);
1124 return -1;
1125 }
1126
JP Abgrall8a932722011-07-13 19:17:35 -07001127 asprintf(&alertName, "%sAlert", costName);
1128 if (!*alertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001129 ALOGE("No prior alert set for %s alert", costName);
JP Abgrall8a932722011-07-13 19:17:35 -07001130 return -1;
1131 }
1132
JP Abgrall7e51cde2013-07-03 13:33:05 -07001133 asprintf(&chainName, "bw_costly_%s", costName);
JP Abgrall92009c82013-02-06 18:01:24 -08001134 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -07001135 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -07001136 free(alertQuotaCmd);
1137 free(chainName);
1138
1139 *alertBytes = 0;
1140 free(alertName);
1141 return res;
1142}
JP Abgralldb7da582011-09-18 12:57:32 -07001143
1144/*
1145 * Parse the ptks and bytes out of:
JP Abgrallbaeccc42013-06-25 09:44:10 -07001146 * Chain natctrl_tether_counters (4 references)
1147 * pkts bytes target prot opt in out source destination
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001148 * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
1149 * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0
1150 * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0
1151 * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0
1152 * It results in an error if invoked and no tethering counter rules exist. The constraint
1153 * helps detect complete parsing failure.
JP Abgralldb7da582011-09-18 12:57:32 -07001154 */
JP Abgrallbaeccc42013-06-25 09:44:10 -07001155int BandwidthController::parseForwardChainStats(SocketClient *cli, const TetherStats filter,
1156 FILE *fp, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001157 int res;
1158 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
1159 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
1160 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
1161 char rest[MAX_IPT_OUTPUT_LINE_LEN];
1162
JP Abgrallbaeccc42013-06-25 09:44:10 -07001163 TetherStats stats;
JP Abgralldb7da582011-09-18 12:57:32 -07001164 char *buffPtr;
1165 int64_t packets, bytes;
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001166 int statsFound = 0;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001167
1168 bool filterPair = filter.intIface[0] && filter.extIface[0];
1169
1170 char *filterMsg = filter.getStatsLine();
1171 ALOGV("filter: %s", filterMsg);
1172 free(filterMsg);
1173
1174 stats = filter;
JP Abgralldb7da582011-09-18 12:57:32 -07001175
1176 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1177 /* Clean up, so a failed parse can still print info */
1178 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
Mark Salyzynca0b5e22014-03-26 14:15:03 -07001179 res = sscanf(buffPtr, "%" SCNd64" %" SCNd64" RETURN all -- %s %s 0.%s",
JP Abgralldb7da582011-09-18 12:57:32 -07001180 &packets, &bytes, iface0, iface1, rest);
SynergyDev7776cea2014-03-16 15:48:51 -07001181 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%" PRId64" bytes=%" PRId64" rest=<%s> orig line=<%s>", res,
JP Abgralldb7da582011-09-18 12:57:32 -07001182 iface0, iface1, packets, bytes, rest, buffPtr);
JP Abgralla2a64f02011-11-11 20:36:16 -08001183 extraProcessingInfo += buffPtr;
1184
JP Abgralldb7da582011-09-18 12:57:32 -07001185 if (res != 5) {
1186 continue;
1187 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001188 /*
1189 * The following assumes that the 1st rule has in:extIface out:intIface,
1190 * which is what NatController sets up.
1191 * If not filtering, the 1st match rx, and sets up the pair for the tx side.
1192 */
1193 if (filter.intIface[0] && filter.extIface[0]) {
1194 if (filter.intIface == iface0 && filter.extIface == iface1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001195 ALOGV("2Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001196 stats.rxPackets = packets;
1197 stats.rxBytes = bytes;
1198 } else if (filter.intIface == iface1 && filter.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001199 ALOGV("2Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001200 stats.txPackets = packets;
1201 stats.txBytes = bytes;
1202 }
1203 } else if (filter.intIface[0] || filter.extIface[0]) {
1204 if (filter.intIface == iface0 || filter.extIface == iface1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001205 ALOGV("1Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001206 stats.intIface = iface0;
1207 stats.extIface = iface1;
1208 stats.rxPackets = packets;
1209 stats.rxBytes = bytes;
1210 } else if (filter.intIface == iface1 || filter.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001211 ALOGV("1Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001212 stats.intIface = iface1;
1213 stats.extIface = iface0;
1214 stats.txPackets = packets;
1215 stats.txBytes = bytes;
1216 }
1217 } else /* if (!filter.intFace[0] && !filter.extIface[0]) */ {
1218 if (!stats.intIface[0]) {
SynergyDev7776cea2014-03-16 15:48:51 -07001219 ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001220 stats.intIface = iface0;
1221 stats.extIface = iface1;
1222 stats.rxPackets = packets;
1223 stats.rxBytes = bytes;
1224 } else if (stats.intIface == iface1 && stats.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001225 ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001226 stats.txPackets = packets;
1227 stats.txBytes = bytes;
1228 }
1229 }
1230 if (stats.rxBytes != -1 && stats.txBytes != -1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001231 ALOGV("rx_bytes=%" PRId64" tx_bytes=%" PRId64" filterPair=%d", stats.rxBytes, stats.txBytes, filterPair);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001232 /* Send out stats, and prep for the next if needed. */
1233 char *msg = stats.getStatsLine();
1234 if (filterPair) {
1235 cli->sendMsg(ResponseCode::TetheringStatsResult, msg, false);
1236 return 0;
1237 } else {
1238 cli->sendMsg(ResponseCode::TetheringStatsListResult, msg, false);
1239 stats = filter;
1240 }
1241 free(msg);
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001242 statsFound++;
JP Abgralldb7da582011-09-18 12:57:32 -07001243 }
1244 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001245
1246 /* It is always an error to find only one side of the stats. */
1247 /* It is an error to find nothing when not filtering. */
1248 if (((stats.rxBytes == -1) != (stats.txBytes == -1)) ||
1249 (!statsFound && !filterPair)) {
1250 return -1;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001251 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001252 cli->sendMsg(ResponseCode::CommandOkay, "Tethering stats list completed", false);
1253 return 0;
JP Abgralldb7da582011-09-18 12:57:32 -07001254}
1255
JP Abgrallbaeccc42013-06-25 09:44:10 -07001256char *BandwidthController::TetherStats::getStatsLine(void) const {
JP Abgralldb7da582011-09-18 12:57:32 -07001257 char *msg;
SynergyDev7776cea2014-03-16 15:48:51 -07001258 asprintf(&msg, "%s %s %" PRId64" %" PRId64" %" PRId64" %" PRId64, intIface.c_str(), extIface.c_str(),
JP Abgralldb7da582011-09-18 12:57:32 -07001259 rxBytes, rxPackets, txBytes, txPackets);
1260 return msg;
1261}
1262
JP Abgrallbaeccc42013-06-25 09:44:10 -07001263int BandwidthController::getTetherStats(SocketClient *cli, TetherStats &stats, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001264 int res;
1265 std::string fullCmd;
1266 FILE *iptOutput;
JP Abgralldb7da582011-09-18 12:57:32 -07001267
JP Abgralldb7da582011-09-18 12:57:32 -07001268 /*
1269 * Why not use some kind of lib to talk to iptables?
1270 * Because the only libs are libiptc and libip6tc in iptables, and they are
1271 * not easy to use. They require the known iptables match modules to be
1272 * preloaded/linked, and require apparently a lot of wrapper code to get
1273 * the wanted info.
1274 */
1275 fullCmd = IPTABLES_PATH;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001276 fullCmd += " -nvx -L ";
1277 fullCmd += NatController::LOCAL_TETHER_COUNTERS_CHAIN;
JP Abgralldb7da582011-09-18 12:57:32 -07001278 iptOutput = popen(fullCmd.c_str(), "r");
1279 if (!iptOutput) {
Steve Block5ea0c052012-01-06 19:18:11 +00001280 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
JP Abgralla2a64f02011-11-11 20:36:16 -08001281 extraProcessingInfo += "Failed to run iptables.";
JP Abgralldb7da582011-09-18 12:57:32 -07001282 return -1;
1283 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001284 res = parseForwardChainStats(cli, stats, iptOutput, extraProcessingInfo);
JP Abgralldb7da582011-09-18 12:57:32 -07001285 pclose(iptOutput);
1286
1287 /* Currently NatController doesn't do ipv6 tethering, so we are done. */
1288 return res;
1289}
JP Abgrall0e540ec2013-08-26 15:13:10 -07001290
1291void BandwidthController::flushExistingCostlyTables(bool doClean) {
JP Abgrall0e540ec2013-08-26 15:13:10 -07001292 std::string fullCmd;
1293 FILE *iptOutput;
JP Abgrall0e540ec2013-08-26 15:13:10 -07001294
1295 /* Only lookup ip4 table names as ip6 will have the same tables ... */
1296 fullCmd = IPTABLES_PATH;
1297 fullCmd += " -S";
1298 iptOutput = popen(fullCmd.c_str(), "r");
1299 if (!iptOutput) {
1300 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
1301 return;
1302 }
1303 /* ... then flush/clean both ip4 and ip6 iptables. */
1304 parseAndFlushCostlyTables(iptOutput, doClean);
1305 pclose(iptOutput);
1306}
1307
1308void BandwidthController::parseAndFlushCostlyTables(FILE *fp, bool doRemove) {
1309 int res;
1310 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
1311 char costlyIfaceName[MAX_IPT_OUTPUT_LINE_LEN];
1312 char cmd[MAX_CMD_LEN];
1313 char *buffPtr;
1314
1315 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1316 costlyIfaceName[0] = '\0'; /* So that debugging output always works */
1317 res = sscanf(buffPtr, "-N bw_costly_%s", costlyIfaceName);
1318 ALOGV("parse res=%d costly=<%s> orig line=<%s>", res,
1319 costlyIfaceName, buffPtr);
1320 if (res != 1) {
1321 continue;
1322 }
1323 /* Exclusions: "shared" is not an ifacename */
1324 if (!strcmp(costlyIfaceName, "shared")) {
1325 continue;
1326 }
1327
1328 snprintf(cmd, sizeof(cmd), "-F bw_costly_%s", costlyIfaceName);
1329 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
1330 if (doRemove) {
1331 snprintf(cmd, sizeof(cmd), "-X bw_costly_%s", costlyIfaceName);
1332 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
1333 }
1334 }
1335}