blob: 4f721267e7da2b3f201d4c0a702506c5f534188e [file] [log] [blame]
JP Abgrall4a5f5ca2011-06-15 18:37:39 -07001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrallbaeccc42013-06-25 09:44:10 -070017#define LOG_NDEBUG 0
JP Abgralldb7da582011-09-18 12:57:32 -070018
19/*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
JP Abgrall8a932722011-07-13 19:17:35 -070025#include <errno.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070026#include <fcntl.h>
JP Abgralldb7da582011-09-18 12:57:32 -070027#include <stdio.h>
JP Abgrall8a932722011-07-13 19:17:35 -070028#include <stdlib.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070029#include <string.h>
30
31#include <sys/socket.h>
32#include <sys/stat.h>
33#include <sys/types.h>
34#include <sys/wait.h>
35
36#include <linux/netlink.h>
37#include <linux/rtnetlink.h>
38#include <linux/pkt_sched.h>
39
40#define LOG_TAG "BandwidthController"
41#include <cutils/log.h>
42#include <cutils/properties.h>
Rom Lemarchand14150212013-01-24 10:01:04 -080043#include <logwrap/logwrap.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070044
JP Abgrall0031cea2012-04-17 16:38:23 -070045#include "NetdConstants.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070046#include "BandwidthController.h"
JP Abgrallbaeccc42013-06-25 09:44:10 -070047#include "NatController.h" /* For LOCAL_TETHER_COUNTERS_CHAIN */
48#include "ResponseCode.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070049
JP Abgralldb7da582011-09-18 12:57:32 -070050/* Alphabetical */
JP Abgrall92009c82013-02-06 18:01:24 -080051#define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %lld --name %s"
JP Abgrallc6c67342011-10-07 16:28:54 -070052const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070053const char* BandwidthController::LOCAL_INPUT = "bw_INPUT";
54const char* BandwidthController::LOCAL_FORWARD = "bw_FORWARD";
55const char* BandwidthController::LOCAL_OUTPUT = "bw_OUTPUT";
56const char* BandwidthController::LOCAL_RAW_PREROUTING = "bw_raw_PREROUTING";
57const char* BandwidthController::LOCAL_MANGLE_POSTROUTING = "bw_mangle_POSTROUTING";
JP Abgralldb7da582011-09-18 12:57:32 -070058const int BandwidthController::MAX_CMD_ARGS = 32;
59const int BandwidthController::MAX_CMD_LEN = 1024;
60const int BandwidthController::MAX_IFACENAME_LEN = 64;
61const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
62
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070063/**
64 * Some comments about the rules:
65 * * Ordering
66 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
JP Abgrall29e8de22012-05-03 12:52:15 -070067 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070068 * - quota'd rules in the costly chain should be before penalty_box lookups.
JP Abgrall29e8de22012-05-03 12:52:15 -070069 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070070 *
71 * * global quota vs per interface quota
72 * - global quota for all costly interfaces uses a single costly chain:
73 * . initial rules
JP Abgrallbfa74662011-06-29 19:23:04 -070074 * iptables -N costly_shared
JP Abgrall29e8de22012-05-03 12:52:15 -070075 * iptables -I bw_INPUT -i iface0 --jump costly_shared
76 * iptables -I bw_OUTPUT -o iface0 --jump costly_shared
JP Abgrallbfa74662011-06-29 19:23:04 -070077 * iptables -I costly_shared -m quota \! --quota 500000 \
78 * --jump REJECT --reject-with icmp-net-prohibited
79 * iptables -A costly_shared --jump penalty_box
JP Abgrall8a932722011-07-13 19:17:35 -070080 *
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070081 * . adding a new iface to this, E.g.:
JP Abgrall29e8de22012-05-03 12:52:15 -070082 * iptables -I bw_INPUT -i iface1 --jump costly_shared
83 * iptables -I bw_OUTPUT -o iface1 --jump costly_shared
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070084 *
85 * - quota per interface. This is achieve by having "costly" chains per quota.
86 * E.g. adding a new costly interface iface0 with its own quota:
87 * iptables -N costly_iface0
JP Abgrall29e8de22012-05-03 12:52:15 -070088 * iptables -I bw_INPUT -i iface0 --jump costly_iface0
89 * iptables -I bw_OUTPUT -o iface0 --jump costly_iface0
JP Abgrallbfa74662011-06-29 19:23:04 -070090 * iptables -A costly_iface0 -m quota \! --quota 500000 \
91 * --jump REJECT --reject-with icmp-net-prohibited
92 * iptables -A costly_iface0 --jump penalty_box
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070093 *
94 * * penalty_box handling:
95 * - only one penalty_box for all interfaces
96 * E.g Adding an app:
JP Abgrallbfa74662011-06-29 19:23:04 -070097 * iptables -A penalty_box -m owner --uid-owner app_3 \
98 * --jump REJECT --reject-with icmp-net-prohibited
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070099 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700100const char *BandwidthController::IPT_FLUSH_COMMANDS[] = {
101 /*
102 * Cleanup rules.
103 * Should normally include costly_<iface>, but we rely on the way they are setup
104 * to allow coexistance.
JP Abgrall39f8f242011-06-29 19:21:58 -0700105 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700106 "-F bw_INPUT",
107 "-F bw_OUTPUT",
108 "-F bw_FORWARD",
109 "-F penalty_box",
110 "-F costly_shared",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700111
112 "-t raw -F bw_raw_PREROUTING",
113 "-t mangle -F bw_mangle_POSTROUTING",
JP Abgrall0031cea2012-04-17 16:38:23 -0700114};
115
116/* The cleanup commands assume flushing has been done. */
117const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700118 "-X penalty_box",
119 "-X costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700120};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700121
JP Abgralldb7da582011-09-18 12:57:32 -0700122const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
JP Abgrallbfa74662011-06-29 19:23:04 -0700123 "-N costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700124 "-N penalty_box",
125};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700126
JP Abgralldb7da582011-09-18 12:57:32 -0700127const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700128 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700129
JP Abgrall0031cea2012-04-17 16:38:23 -0700130 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700131
JP Abgrallbfa74662011-06-29 19:23:04 -0700132 "-A costly_shared --jump penalty_box",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700133
JP Abgrall92009c82013-02-06 18:01:24 -0800134 "-t raw -A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
135 "-t mangle -A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700136};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700137
138BandwidthController::BandwidthController(void) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700139}
140
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700141int BandwidthController::runIpxtablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700142 IptFailureLog failureHandling) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700143 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700144
Steve Block3fb42e02011-10-20 11:55:56 +0100145 ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700146 res |= runIptablesCmd(cmd, jumpHandling, IptIpV4, failureHandling);
147 res |= runIptablesCmd(cmd, jumpHandling, IptIpV6, failureHandling);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700148 return res;
149}
150
JP Abgrall26e0d492011-06-24 19:21:51 -0700151int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
152
153 memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
154 strncpy(buffer, src, buffSize);
155 return buffer[buffSize - 1];
156}
157
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700158int BandwidthController::runIptablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700159 IptIpVer iptVer, IptFailureLog failureHandling) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700160 char buffer[MAX_CMD_LEN];
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700161 const char *argv[MAX_CMD_ARGS];
JP Abgrall26e0d492011-06-24 19:21:51 -0700162 int argc = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700163 char *next = buffer;
164 char *tmp;
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700165 int res;
Rom Lemarchand14150212013-01-24 10:01:04 -0800166 int status = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700167
JP Abgrall0dad7c22011-06-24 11:58:14 -0700168 std::string fullCmd = cmd;
JP Abgrall26e0d492011-06-24 19:21:51 -0700169
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700170 switch (jumpHandling) {
171 case IptJumpReject:
JP Abgrall340d5cc2013-06-28 17:06:00 -0700172 /*
173 * Must be carefull what one rejects with, as uper layer protocols will just
174 * keep on hammering the device until the number of retries are done.
175 * For port-unreachable (default), TCP should consider as an abort (RFC1122).
176 */
177 fullCmd += " --jump REJECT";
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700178 break;
179 case IptJumpReturn:
180 fullCmd += " --jump RETURN";
181 break;
182 case IptJumpNoAdd:
183 break;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700184 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700185
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700186 fullCmd.insert(0, " ");
187 fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700188
Rom Lemarchand14150212013-01-24 10:01:04 -0800189 if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
190 ALOGE("iptables command too long");
191 return -1;
192 }
193
194 argc = 0;
195 while ((tmp = strsep(&next, " "))) {
196 argv[argc++] = tmp;
197 if (argc >= MAX_CMD_ARGS) {
198 ALOGE("iptables argument overflow");
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700199 return -1;
200 }
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700201 }
Rom Lemarchand14150212013-01-24 10:01:04 -0800202
203 argv[argc] = NULL;
204 res = android_fork_execvp(argc, (char **)argv, &status, false,
205 failureHandling == IptFailShow);
JP Abgrallc8dc63b2013-02-13 16:30:00 -0800206 res = res || !WIFEXITED(status) || WEXITSTATUS(status);
207 if (res && failureHandling == IptFailShow) {
208 ALOGE("runIptablesCmd(): res=%d status=%d failed %s", res, status,
209 fullCmd.c_str());
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700210 }
211 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700212}
213
JP Abgrall0031cea2012-04-17 16:38:23 -0700214int BandwidthController::setupIptablesHooks(void) {
215
216 /* Some of the initialCommands are allowed to fail */
217 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
218 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
219
220 runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
221 IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
222
223 runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
224 IPT_SETUP_COMMANDS, RunCmdFailureBad);
225
226 return 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700227}
228
229int BandwidthController::enableBandwidthControl(bool force) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700230 int res;
JP Abgrall0031cea2012-04-17 16:38:23 -0700231 char value[PROPERTY_VALUE_MAX];
232
233 if (!force) {
234 property_get("persist.bandwidth.enable", value, "1");
235 if (!strcmp(value, "0"))
236 return 0;
237 }
JP Abgrall8a932722011-07-13 19:17:35 -0700238
JP Abgralldb7da582011-09-18 12:57:32 -0700239 /* Let's pretend we started from scratch ... */
JP Abgrall8a932722011-07-13 19:17:35 -0700240 sharedQuotaIfaces.clear();
241 quotaIfaces.clear();
242 naughtyAppUids.clear();
JP Abgralldb7da582011-09-18 12:57:32 -0700243 globalAlertBytes = 0;
JP Abgrallc6c67342011-10-07 16:28:54 -0700244 globalAlertTetherCount = 0;
JP Abgralldb7da582011-09-18 12:57:32 -0700245 sharedQuotaBytes = sharedAlertBytes = 0;
246
JP Abgrall0031cea2012-04-17 16:38:23 -0700247 res = runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
248 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgralldb7da582011-09-18 12:57:32 -0700249
JP Abgrall0031cea2012-04-17 16:38:23 -0700250 res |= runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
JP Abgralldb7da582011-09-18 12:57:32 -0700251 IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
JP Abgrall8a932722011-07-13 19:17:35 -0700252
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700253 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700254
255}
256
257int BandwidthController::disableBandwidthControl(void) {
JP Abgrall0031cea2012-04-17 16:38:23 -0700258 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
259 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700260 return 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700261}
262
JP Abgrall8a932722011-07-13 19:17:35 -0700263int BandwidthController::runCommands(int numCommands, const char *commands[],
264 RunCmdErrHandling cmdErrHandling) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700265 int res = 0;
JP Abgrallad729ac2012-04-24 23:27:44 -0700266 IptFailureLog failureLogging = IptFailShow;
267 if (cmdErrHandling == RunCmdFailureOk) {
268 failureLogging = IptFailHide;
269 }
Steve Block3fb42e02011-10-20 11:55:56 +0100270 ALOGV("runCommands(): %d commands", numCommands);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700271 for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700272 res = runIpxtablesCmd(commands[cmdNum], IptJumpNoAdd, failureLogging);
JP Abgrall0031cea2012-04-17 16:38:23 -0700273 if (res && cmdErrHandling != RunCmdFailureOk)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700274 return res;
275 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700276 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700277}
278
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700279std::string BandwidthController::makeIptablesSpecialAppCmd(IptOp op, int uid, const char *chain) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700280 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700281 char *buff;
282 const char *opFlag;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700283
284 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700285 case IptOpInsert:
286 opFlag = "-I";
287 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800288 case IptOpAppend:
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700289 ALOGE("Append op not supported for %s uids", chain);
290 res = "";
291 return res;
JP Abgrall109899b2013-02-12 19:20:13 -0800292 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700293 case IptOpReplace:
294 opFlag = "-R";
295 break;
296 default:
297 case IptOpDelete:
298 opFlag = "-D";
299 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700300 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700301 asprintf(&buff, "%s %s -m owner --uid-owner %d", opFlag, chain, uid);
JP Abgrall8a932722011-07-13 19:17:35 -0700302 res = buff;
303 free(buff);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700304 return res;
305}
306
307int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700308 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700309}
310
311int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700312 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpRemove);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700313}
314
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700315int BandwidthController::manipulateNaughtyApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
316 return manipulateSpecialApps(numUids, appStrUids, "penalty_box", naughtyAppUids, IptJumpReject, appOp);
317}
318
319
320int BandwidthController::manipulateSpecialApps(int numUids, char *appStrUids[],
321 const char *chain,
322 std::list<int /*appUid*/> &specialAppUids,
323 IptJumpOp jumpHandling, SpecialAppOp appOp) {
324
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700325 char cmd[MAX_CMD_LEN];
326 int uidNum;
JP Abgrall26e0d492011-06-24 19:21:51 -0700327 const char *failLogTemplate;
328 IptOp op;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700329 int appUids[numUids];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700330 std::string iptCmd;
JP Abgrallb1d24092012-04-27 01:02:31 -0700331 std::list<int /*uid*/>::iterator it;
JP Abgrall8a932722011-07-13 19:17:35 -0700332
JP Abgrall26e0d492011-06-24 19:21:51 -0700333 switch (appOp) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700334 case SpecialAppOpAdd:
JP Abgrall8a932722011-07-13 19:17:35 -0700335 op = IptOpInsert;
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700336 failLogTemplate = "Failed to add app uid %d to %s.";
JP Abgrall8a932722011-07-13 19:17:35 -0700337 break;
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700338 case SpecialAppOpRemove:
JP Abgrall8a932722011-07-13 19:17:35 -0700339 op = IptOpDelete;
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700340 failLogTemplate = "Failed to delete app uid %d from %s box.";
JP Abgrall8a932722011-07-13 19:17:35 -0700341 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700342 default:
343 ALOGE("Unexpected app Op %d", appOp);
344 return -1;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700345 }
346
347 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700348 appUids[uidNum] = atol(appStrUids[uidNum]);
349 if (appUids[uidNum] == 0) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700350 ALOGE(failLogTemplate, appUids[uidNum], chain);
JP Abgrall26e0d492011-06-24 19:21:51 -0700351 goto fail_parse;
352 }
353 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700354
355 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700356 int uid = appUids[uidNum];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700357 for (it = specialAppUids.begin(); it != specialAppUids.end(); it++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700358 if (*it == uid)
359 break;
360 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700361 bool found = (it != specialAppUids.end());
JP Abgrallb1d24092012-04-27 01:02:31 -0700362
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700363 if (appOp == SpecialAppOpRemove) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700364 if (!found) {
365 ALOGE("No such appUid %d to remove", uid);
366 return -1;
367 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700368 specialAppUids.erase(it);
JP Abgrallb1d24092012-04-27 01:02:31 -0700369 } else {
370 if (found) {
371 ALOGE("appUid %d exists already", uid);
372 return -1;
373 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700374 specialAppUids.push_front(uid);
JP Abgrallb1d24092012-04-27 01:02:31 -0700375 }
376
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700377 iptCmd = makeIptablesSpecialAppCmd(op, uid, chain);
378 if (runIpxtablesCmd(iptCmd.c_str(), jumpHandling)) {
379 ALOGE(failLogTemplate, uid, chain);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700380 goto fail_with_uidNum;
381 }
382 }
383 return 0;
384
JP Abgrall26e0d492011-06-24 19:21:51 -0700385fail_with_uidNum:
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700386 /* Try to remove the uid that failed in any case*/
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700387 iptCmd = makeIptablesSpecialAppCmd(IptOpDelete, appUids[uidNum], chain);
388 runIpxtablesCmd(iptCmd.c_str(), jumpHandling);
JP Abgrall26e0d492011-06-24 19:21:51 -0700389fail_parse:
390 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700391}
392
JP Abgrall26e0d492011-06-24 19:21:51 -0700393std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700394 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700395 char *buff;
396 const char *opFlag;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700397
Steve Block3fb42e02011-10-20 11:55:56 +0100398 ALOGV("makeIptablesQuotaCmd(%d, %lld)", op, quota);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700399
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700400 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700401 case IptOpInsert:
402 opFlag = "-I";
403 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800404 case IptOpAppend:
405 opFlag = "-A";
406 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700407 case IptOpReplace:
408 opFlag = "-R";
409 break;
410 default:
411 case IptOpDelete:
412 opFlag = "-D";
413 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700414 }
JP Abgrall8a932722011-07-13 19:17:35 -0700415
JP Abgrallbfa74662011-06-29 19:23:04 -0700416 // The requried IP version specific --jump REJECT ... will be added later.
JP Abgrall8a932722011-07-13 19:17:35 -0700417 asprintf(&buff, "%s costly_%s -m quota2 ! --quota %lld --name %s", opFlag, costName, quota,
418 costName);
419 res = buff;
420 free(buff);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700421 return res;
422}
423
JP Abgrall26e0d492011-06-24 19:21:51 -0700424int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700425 char cmd[MAX_CMD_LEN];
JP Abgrall0031cea2012-04-17 16:38:23 -0700426 int res = 0, res1, res2;
JP Abgrall8a932722011-07-13 19:17:35 -0700427 int ruleInsertPos = 1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700428 std::string costString;
429 const char *costCString;
430
JP Abgrall0dad7c22011-06-24 11:58:14 -0700431 /* The "-N costly" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700432 switch (quotaType) {
433 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700434 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700435 costString += ifn;
436 costCString = costString.c_str();
JP Abgrall0031cea2012-04-17 16:38:23 -0700437 /*
438 * Flush the costly_<iface> is allowed to fail in case it didn't exist.
439 * Creating a new one is allowed to fail in case it existed.
440 * This helps with netd restarts.
441 */
442 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700443 res1 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700444 snprintf(cmd, sizeof(cmd), "-N %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700445 res2 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700446 res = (res1 && res2) || (!res1 && !res2);
447
JP Abgrall0dad7c22011-06-24 11:58:14 -0700448 snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700449 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall26e0d492011-06-24 19:21:51 -0700450 break;
451 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700452 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700453 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700454 default:
455 ALOGE("Unexpected quotatype %d", quotaType);
456 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700457 }
458
JP Abgrall8a932722011-07-13 19:17:35 -0700459 if (globalAlertBytes) {
460 /* The alert rule comes 1st */
461 ruleInsertPos = 2;
462 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700463
464 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700465 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700466
467 snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700468 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700469
470 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700471 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700472
473 snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700474 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700475 return res;
476}
477
JP Abgrall26e0d492011-06-24 19:21:51 -0700478int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700479 char cmd[MAX_CMD_LEN];
480 int res = 0;
481 std::string costString;
482 const char *costCString;
483
JP Abgrall26e0d492011-06-24 19:21:51 -0700484 switch (quotaType) {
485 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700486 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700487 costString += ifn;
488 costCString = costString.c_str();
JP Abgrall26e0d492011-06-24 19:21:51 -0700489 break;
490 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700491 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700492 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700493 default:
494 ALOGE("Unexpected quotatype %d", quotaType);
495 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700496 }
497
JP Abgrall0031cea2012-04-17 16:38:23 -0700498 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700499 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700500 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700501 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700502
JP Abgrallbfa74662011-06-29 19:23:04 -0700503 /* The "-N costly_shared" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700504 if (quotaType == QuotaUnique) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700505 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700506 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgralla9f802c2011-06-29 15:46:45 -0700507 snprintf(cmd, sizeof(cmd), "-X %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700508 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700509 }
510 return res;
511}
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700512
JP Abgrall0dad7c22011-06-24 11:58:14 -0700513int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700514 char cmd[MAX_CMD_LEN];
515 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700516 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700517 std::string quotaCmd;
JP Abgrall8a932722011-07-13 19:17:35 -0700518 std::string ifaceName;
519 ;
JP Abgrallbfa74662011-06-29 19:23:04 -0700520 const char *costName = "shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700521 std::list<std::string>::iterator it;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700522
JP Abgrall8a932722011-07-13 19:17:35 -0700523 if (!maxBytes) {
524 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000525 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700526 return -1;
527 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700528 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000529 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700530 return -1;
531 }
532 ifaceName = ifn;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700533
534 if (maxBytes == -1) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700535 return removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700536 }
537
538 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700539 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
540 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700541 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700542 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700543
JP Abgrall0dad7c22011-06-24 11:58:14 -0700544 if (it == sharedQuotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700545 res |= prepCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700546 if (sharedQuotaIfaces.empty()) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700547 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700548 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700549 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000550 ALOGE("Failed set quota rule");
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700551 goto fail;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700552 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700553 sharedQuotaBytes = maxBytes;
554 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700555 sharedQuotaIfaces.push_front(ifaceName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700556
557 }
558
559 if (maxBytes != sharedQuotaBytes) {
JP Abgrall8a932722011-07-13 19:17:35 -0700560 res |= updateQuota(costName, maxBytes);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700561 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000562 ALOGE("Failed update quota for %s", costName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700563 goto fail;
564 }
565 sharedQuotaBytes = maxBytes;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700566 }
567 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700568
569 fail:
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700570 /*
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700571 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
572 * rules in the kernel to see which ones need cleaning up.
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700573 * For now callers needs to choose if they want to "ndc bandwidth enable"
574 * which resets everything.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700575 */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700576 removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700577 return -1;
578}
579
JP Abgrall8a932722011-07-13 19:17:35 -0700580/* It will also cleanup any shared alerts */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700581int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700582 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700583 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700584 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700585 std::list<std::string>::iterator it;
JP Abgrallbfa74662011-06-29 19:23:04 -0700586 const char *costName = "shared";
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700587
JP Abgrall8a932722011-07-13 19:17:35 -0700588 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000589 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700590 return -1;
591 }
JP Abgrall8a932722011-07-13 19:17:35 -0700592 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700593
JP Abgrall0dad7c22011-06-24 11:58:14 -0700594 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
595 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700596 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700597 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700598 if (it == sharedQuotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000599 ALOGE("No such iface %s to delete", ifn);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700600 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700601 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700602
JP Abgrall26e0d492011-06-24 19:21:51 -0700603 res |= cleanupCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700604 sharedQuotaIfaces.erase(it);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700605
JP Abgrall0dad7c22011-06-24 11:58:14 -0700606 if (sharedQuotaIfaces.empty()) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700607 std::string quotaCmd;
JP Abgrallbfa74662011-06-29 19:23:04 -0700608 quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700609 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall8a932722011-07-13 19:17:35 -0700610 sharedQuotaBytes = 0;
611 if (sharedAlertBytes) {
612 removeSharedAlert();
613 sharedAlertBytes = 0;
614 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700615 }
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700616 return res;
617}
JP Abgrall0dad7c22011-06-24 11:58:14 -0700618
619int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
620 char ifn[MAX_IFACENAME_LEN];
621 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700622 std::string ifaceName;
623 const char *costName;
624 std::list<QuotaInfo>::iterator it;
625 std::string quotaCmd;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700626
JP Abgrall8a932722011-07-13 19:17:35 -0700627 if (!maxBytes) {
628 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000629 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700630 return -1;
631 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700632 if (maxBytes == -1) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700633 return removeInterfaceQuota(iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700634 }
635
JP Abgrall8a932722011-07-13 19:17:35 -0700636 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000637 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700638 return -1;
639 }
640 ifaceName = ifn;
641 costName = iface;
642
JP Abgrall0dad7c22011-06-24 11:58:14 -0700643 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700644 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700645 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700646 break;
647 }
648
649 if (it == quotaIfaces.end()) {
JP Abgrall109899b2013-02-12 19:20:13 -0800650 /* Preparing the iface adds a penalty_box check */
JP Abgrall26e0d492011-06-24 19:21:51 -0700651 res |= prepCostlyIface(ifn, QuotaUnique);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700652 /*
653 * The rejecting quota limit should go after the penalty box checks
654 * or else a naughty app could just eat up the quota.
655 * So we append here.
656 */
JP Abgrall109899b2013-02-12 19:20:13 -0800657 quotaCmd = makeIptablesQuotaCmd(IptOpAppend, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700658 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700659 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000660 ALOGE("Failed set quota rule");
JP Abgrall0dad7c22011-06-24 11:58:14 -0700661 goto fail;
662 }
663
JP Abgrall8a932722011-07-13 19:17:35 -0700664 quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
JP Abgrall0dad7c22011-06-24 11:58:14 -0700665
666 } else {
JP Abgrall8a932722011-07-13 19:17:35 -0700667 res |= updateQuota(costName, maxBytes);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700668 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000669 ALOGE("Failed update quota for %s", iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700670 goto fail;
671 }
JP Abgrall8a932722011-07-13 19:17:35 -0700672 it->quota = maxBytes;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700673 }
674 return 0;
675
676 fail:
677 /*
678 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
679 * rules in the kernel to see which ones need cleaning up.
680 * For now callers needs to choose if they want to "ndc bandwidth enable"
681 * which resets everything.
682 */
683 removeInterfaceSharedQuota(ifn);
684 return -1;
685}
686
JP Abgrall8a932722011-07-13 19:17:35 -0700687int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
688 return getInterfaceQuota("shared", bytes);
689}
690
691int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
692 FILE *fp;
693 char *fname;
694 int scanRes;
695
696 asprintf(&fname, "/proc/net/xt_quota/%s", costName);
697 fp = fopen(fname, "r");
698 free(fname);
699 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000700 ALOGE("Reading quota %s failed (%s)", costName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700701 return -1;
702 }
703 scanRes = fscanf(fp, "%lld", bytes);
Steve Block3fb42e02011-10-20 11:55:56 +0100704 ALOGV("Read quota res=%d bytes=%lld", scanRes, *bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700705 fclose(fp);
706 return scanRes == 1 ? 0 : -1;
707}
708
JP Abgrall0dad7c22011-06-24 11:58:14 -0700709int BandwidthController::removeInterfaceQuota(const char *iface) {
710
711 char ifn[MAX_IFACENAME_LEN];
712 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700713 std::string ifaceName;
714 const char *costName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700715 std::list<QuotaInfo>::iterator it;
JP Abgrall26e0d492011-06-24 19:21:51 -0700716
JP Abgrall8a932722011-07-13 19:17:35 -0700717 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000718 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700719 return -1;
720 }
721 ifaceName = ifn;
722 costName = iface;
723
JP Abgrall0dad7c22011-06-24 11:58:14 -0700724 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700725 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700726 break;
727 }
728
729 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000730 ALOGE("No such iface %s to delete", ifn);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700731 return -1;
732 }
733
734 /* This also removes the quota command of CostlyIface chain. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700735 res |= cleanupCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700736
737 quotaIfaces.erase(it);
738
739 return res;
740}
JP Abgrall8a932722011-07-13 19:17:35 -0700741
742int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
743 FILE *fp;
744 char *fname;
745
746 asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
747 fp = fopen(fname, "w");
748 free(fname);
749 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000750 ALOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700751 return -1;
752 }
753 fprintf(fp, "%lld\n", bytes);
754 fclose(fp);
755 return 0;
756}
757
758int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
759 int res = 0;
760 const char *opFlag;
761 char *alertQuotaCmd;
762
763 switch (op) {
764 case IptOpInsert:
765 opFlag = "-I";
766 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800767 case IptOpAppend:
768 opFlag = "-A";
769 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700770 case IptOpReplace:
771 opFlag = "-R";
772 break;
773 default:
774 case IptOpDelete:
775 opFlag = "-D";
776 break;
777 }
778
JP Abgrall92009c82013-02-06 18:01:24 -0800779 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800780 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700781 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700782 free(alertQuotaCmd);
JP Abgrall92009c82013-02-06 18:01:24 -0800783 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800784 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700785 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700786 free(alertQuotaCmd);
787 return res;
788}
789
JP Abgrallc6c67342011-10-07 16:28:54 -0700790int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
791 int res = 0;
792 const char *opFlag;
JP Abgrall8a932722011-07-13 19:17:35 -0700793 char *alertQuotaCmd;
JP Abgrallc6c67342011-10-07 16:28:54 -0700794
795 switch (op) {
796 case IptOpInsert:
797 opFlag = "-I";
798 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800799 case IptOpAppend:
800 opFlag = "-A";
801 break;
JP Abgrallc6c67342011-10-07 16:28:54 -0700802 case IptOpReplace:
803 opFlag = "-R";
804 break;
805 default:
806 case IptOpDelete:
807 opFlag = "-D";
808 break;
809 }
810
JP Abgrall92009c82013-02-06 18:01:24 -0800811 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800812 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700813 res = runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrallc6c67342011-10-07 16:28:54 -0700814 free(alertQuotaCmd);
815 return res;
816}
817
818int BandwidthController::setGlobalAlert(int64_t bytes) {
819 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700820 int res = 0;
821
822 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000823 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700824 return -1;
825 }
826 if (globalAlertBytes) {
827 res = updateQuota(alertName, bytes);
828 } else {
829 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700830 if (globalAlertTetherCount) {
Steve Block3fb42e02011-10-20 11:55:56 +0100831 ALOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700832 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
833 }
JP Abgrall8a932722011-07-13 19:17:35 -0700834 }
835 globalAlertBytes = bytes;
836 return res;
837}
838
JP Abgrallc6c67342011-10-07 16:28:54 -0700839int BandwidthController::setGlobalAlertInForwardChain(void) {
840 const char *alertName = ALERT_GLOBAL_NAME;
841 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700842
JP Abgrallc6c67342011-10-07 16:28:54 -0700843 globalAlertTetherCount++;
Steve Block3fb42e02011-10-20 11:55:56 +0100844 ALOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700845
846 /*
847 * If there is no globalAlert active we are done.
848 * If there is an active globalAlert but this is not the 1st
849 * tether, we are also done.
850 */
851 if (!globalAlertBytes || globalAlertTetherCount != 1) {
852 return 0;
853 }
854
855 /* We only add the rule if this was the 1st tether added. */
856 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
857 return res;
858}
859
860int BandwidthController::removeGlobalAlert(void) {
861
862 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700863 int res = 0;
864
865 if (!globalAlertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000866 ALOGE("No prior alert set");
JP Abgrall8a932722011-07-13 19:17:35 -0700867 return -1;
868 }
869 res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700870 if (globalAlertTetherCount) {
871 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
872 }
JP Abgrall8a932722011-07-13 19:17:35 -0700873 globalAlertBytes = 0;
874 return res;
875}
876
JP Abgrallc6c67342011-10-07 16:28:54 -0700877int BandwidthController::removeGlobalAlertInForwardChain(void) {
878 int res = 0;
879 const char *alertName = ALERT_GLOBAL_NAME;
880
881 if (!globalAlertTetherCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000882 ALOGE("No prior alert set");
JP Abgrallc6c67342011-10-07 16:28:54 -0700883 return -1;
884 }
885
886 globalAlertTetherCount--;
887 /*
888 * If there is no globalAlert active we are done.
889 * If there is an active globalAlert but there are more
890 * tethers, we are also done.
891 */
892 if (!globalAlertBytes || globalAlertTetherCount >= 1) {
893 return 0;
894 }
895
896 /* We only detete the rule if this was the last tether removed. */
897 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
898 return res;
899}
900
JP Abgrall8a932722011-07-13 19:17:35 -0700901int BandwidthController::setSharedAlert(int64_t bytes) {
902 if (!sharedQuotaBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000903 ALOGE("Need to have a prior shared quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700904 return -1;
905 }
906 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000907 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700908 return -1;
909 }
910 return setCostlyAlert("shared", bytes, &sharedAlertBytes);
911}
912
913int BandwidthController::removeSharedAlert(void) {
914 return removeCostlyAlert("shared", &sharedAlertBytes);
915}
916
917int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
918 std::list<QuotaInfo>::iterator it;
919
920 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000921 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700922 return -1;
923 }
924 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
925 if (it->ifaceName == iface)
926 break;
927 }
928
929 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000930 ALOGE("Need to have a prior interface quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700931 return -1;
932 }
933
934 return setCostlyAlert(iface, bytes, &it->alert);
935}
936
937int BandwidthController::removeInterfaceAlert(const char *iface) {
938 std::list<QuotaInfo>::iterator it;
939
940 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
941 if (it->ifaceName == iface)
942 break;
943 }
944
945 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000946 ALOGE("No prior alert set for interface %s", iface);
JP Abgrall8a932722011-07-13 19:17:35 -0700947 return -1;
948 }
949
950 return removeCostlyAlert(iface, &it->alert);
951}
952
953int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
954 char *alertQuotaCmd;
JP Abgrall109899b2013-02-12 19:20:13 -0800955 char *chainName;
JP Abgrall8a932722011-07-13 19:17:35 -0700956 int res = 0;
957 char *alertName;
958
959 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000960 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700961 return -1;
962 }
963 asprintf(&alertName, "%sAlert", costName);
964 if (*alertBytes) {
965 res = updateQuota(alertName, *alertBytes);
966 } else {
JP Abgrall109899b2013-02-12 19:20:13 -0800967 asprintf(&chainName, "costly_%s", costName);
968 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-A", chainName, bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700969 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700970 free(alertQuotaCmd);
JP Abgrall109899b2013-02-12 19:20:13 -0800971 free(chainName);
JP Abgrall8a932722011-07-13 19:17:35 -0700972 }
973 *alertBytes = bytes;
974 free(alertName);
975 return res;
976}
977
978int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
979 char *alertQuotaCmd;
980 char *chainName;
981 char *alertName;
982 int res = 0;
983
984 asprintf(&alertName, "%sAlert", costName);
985 if (!*alertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000986 ALOGE("No prior alert set for %s alert", costName);
JP Abgrall8a932722011-07-13 19:17:35 -0700987 return -1;
988 }
989
990 asprintf(&chainName, "costly_%s", costName);
JP Abgrall92009c82013-02-06 18:01:24 -0800991 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700992 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700993 free(alertQuotaCmd);
994 free(chainName);
995
996 *alertBytes = 0;
997 free(alertName);
998 return res;
999}
JP Abgralldb7da582011-09-18 12:57:32 -07001000
1001/*
1002 * Parse the ptks and bytes out of:
JP Abgrallbaeccc42013-06-25 09:44:10 -07001003 * Chain natctrl_tether_counters (4 references)
1004 * pkts bytes target prot opt in out source destination
1005 * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 counter wlan0_rmnet0: 0 bytes
1006 * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0 counter rmnet0_wlan0: 0 bytes
1007 * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0 counter bt-pan_rmnet0: 0 bytes
1008 * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0 counter rmnet0_bt-pan: 0 bytes
JP Abgralldb7da582011-09-18 12:57:32 -07001009 */
JP Abgrallbaeccc42013-06-25 09:44:10 -07001010int BandwidthController::parseForwardChainStats(SocketClient *cli, const TetherStats filter,
1011 FILE *fp, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001012 int res;
1013 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
1014 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
1015 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
1016 char rest[MAX_IPT_OUTPUT_LINE_LEN];
1017
JP Abgrallbaeccc42013-06-25 09:44:10 -07001018 TetherStats stats;
JP Abgralldb7da582011-09-18 12:57:32 -07001019 char *buffPtr;
1020 int64_t packets, bytes;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001021 int statsFound = 0;
1022
1023 bool filterPair = filter.intIface[0] && filter.extIface[0];
1024
1025 char *filterMsg = filter.getStatsLine();
1026 ALOGV("filter: %s", filterMsg);
1027 free(filterMsg);
1028
1029 stats = filter;
JP Abgralldb7da582011-09-18 12:57:32 -07001030
1031 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1032 /* Clean up, so a failed parse can still print info */
1033 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
JP Abgrall0031cea2012-04-17 16:38:23 -07001034 res = sscanf(buffPtr, "%lld %lld RETURN all -- %s %s 0.%s",
JP Abgralldb7da582011-09-18 12:57:32 -07001035 &packets, &bytes, iface0, iface1, rest);
Steve Block3fb42e02011-10-20 11:55:56 +01001036 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%lld bytes=%lld rest=<%s> orig line=<%s>", res,
JP Abgralldb7da582011-09-18 12:57:32 -07001037 iface0, iface1, packets, bytes, rest, buffPtr);
JP Abgralla2a64f02011-11-11 20:36:16 -08001038 extraProcessingInfo += buffPtr;
1039
JP Abgralldb7da582011-09-18 12:57:32 -07001040 if (res != 5) {
1041 continue;
1042 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001043 /*
1044 * The following assumes that the 1st rule has in:extIface out:intIface,
1045 * which is what NatController sets up.
1046 * If not filtering, the 1st match rx, and sets up the pair for the tx side.
1047 */
1048 if (filter.intIface[0] && filter.extIface[0]) {
1049 if (filter.intIface == iface0 && filter.extIface == iface1) {
1050 ALOGV("2Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1051 stats.rxPackets = packets;
1052 stats.rxBytes = bytes;
1053 } else if (filter.intIface == iface1 && filter.extIface == iface0) {
1054 ALOGV("2Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1055 stats.txPackets = packets;
1056 stats.txBytes = bytes;
1057 }
1058 } else if (filter.intIface[0] || filter.extIface[0]) {
1059 if (filter.intIface == iface0 || filter.extIface == iface1) {
1060 ALOGV("1Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1061 stats.intIface = iface0;
1062 stats.extIface = iface1;
1063 stats.rxPackets = packets;
1064 stats.rxBytes = bytes;
1065 } else if (filter.intIface == iface1 || filter.extIface == iface0) {
1066 ALOGV("1Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1067 stats.intIface = iface1;
1068 stats.extIface = iface0;
1069 stats.txPackets = packets;
1070 stats.txBytes = bytes;
1071 }
1072 } else /* if (!filter.intFace[0] && !filter.extIface[0]) */ {
1073 if (!stats.intIface[0]) {
1074 ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1075 stats.intIface = iface0;
1076 stats.extIface = iface1;
1077 stats.rxPackets = packets;
1078 stats.rxBytes = bytes;
1079 } else if (stats.intIface == iface1 && stats.extIface == iface0) {
1080 ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1081 stats.txPackets = packets;
1082 stats.txBytes = bytes;
1083 }
1084 }
1085 if (stats.rxBytes != -1 && stats.txBytes != -1) {
1086 ALOGV("rx_bytes=%lld tx_bytes=%lld filterPair=%d", stats.rxBytes, stats.txBytes, filterPair);
1087 /* Send out stats, and prep for the next if needed. */
1088 char *msg = stats.getStatsLine();
1089 if (filterPair) {
1090 cli->sendMsg(ResponseCode::TetheringStatsResult, msg, false);
1091 return 0;
1092 } else {
1093 cli->sendMsg(ResponseCode::TetheringStatsListResult, msg, false);
1094 stats = filter;
1095 }
1096 free(msg);
1097 statsFound++;
JP Abgralldb7da582011-09-18 12:57:32 -07001098 }
1099 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001100 /* We found some stats, and the last one isn't a partial stats. */
1101 if (statsFound && (stats.rxBytes == -1 || stats.txBytes == -1)) {
1102 cli->sendMsg(ResponseCode::CommandOkay, "Tethering stats list completed", false);
1103 return 0;
1104 }
1105 return -1;
JP Abgralldb7da582011-09-18 12:57:32 -07001106}
1107
JP Abgrallbaeccc42013-06-25 09:44:10 -07001108char *BandwidthController::TetherStats::getStatsLine(void) const {
JP Abgralldb7da582011-09-18 12:57:32 -07001109 char *msg;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001110 asprintf(&msg, "%s %s %lld %lld %lld %lld", intIface.c_str(), extIface.c_str(),
JP Abgralldb7da582011-09-18 12:57:32 -07001111 rxBytes, rxPackets, txBytes, txPackets);
1112 return msg;
1113}
1114
JP Abgrallbaeccc42013-06-25 09:44:10 -07001115int BandwidthController::getTetherStats(SocketClient *cli, TetherStats &stats, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001116 int res;
1117 std::string fullCmd;
1118 FILE *iptOutput;
1119 const char *cmd;
1120
JP Abgralldb7da582011-09-18 12:57:32 -07001121 /*
1122 * Why not use some kind of lib to talk to iptables?
1123 * Because the only libs are libiptc and libip6tc in iptables, and they are
1124 * not easy to use. They require the known iptables match modules to be
1125 * preloaded/linked, and require apparently a lot of wrapper code to get
1126 * the wanted info.
1127 */
1128 fullCmd = IPTABLES_PATH;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001129 fullCmd += " -nvx -L ";
1130 fullCmd += NatController::LOCAL_TETHER_COUNTERS_CHAIN;
JP Abgralldb7da582011-09-18 12:57:32 -07001131 iptOutput = popen(fullCmd.c_str(), "r");
1132 if (!iptOutput) {
Steve Block5ea0c052012-01-06 19:18:11 +00001133 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
JP Abgralla2a64f02011-11-11 20:36:16 -08001134 extraProcessingInfo += "Failed to run iptables.";
JP Abgralldb7da582011-09-18 12:57:32 -07001135 return -1;
1136 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001137 res = parseForwardChainStats(cli, stats, iptOutput, extraProcessingInfo);
JP Abgralldb7da582011-09-18 12:57:32 -07001138 pclose(iptOutput);
1139
1140 /* Currently NatController doesn't do ipv6 tethering, so we are done. */
1141 return res;
1142}