blob: f720e0c3ff52279c1cd3f1e806908520b3babde3 [file] [log] [blame]
JP Abgrall4a5f5ca2011-06-15 18:37:39 -07001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgrallbaeccc42013-06-25 09:44:10 -070017#define LOG_NDEBUG 0
JP Abgralldb7da582011-09-18 12:57:32 -070018
19/*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
JP Abgrall8a932722011-07-13 19:17:35 -070025#include <errno.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070026#include <fcntl.h>
JP Abgralldb7da582011-09-18 12:57:32 -070027#include <stdio.h>
JP Abgrall8a932722011-07-13 19:17:35 -070028#include <stdlib.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070029#include <string.h>
30
31#include <sys/socket.h>
32#include <sys/stat.h>
33#include <sys/types.h>
34#include <sys/wait.h>
35
36#include <linux/netlink.h>
37#include <linux/rtnetlink.h>
38#include <linux/pkt_sched.h>
39
40#define LOG_TAG "BandwidthController"
41#include <cutils/log.h>
42#include <cutils/properties.h>
Rom Lemarchand14150212013-01-24 10:01:04 -080043#include <logwrap/logwrap.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070044
JP Abgrall0031cea2012-04-17 16:38:23 -070045#include "NetdConstants.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070046#include "BandwidthController.h"
JP Abgrallbaeccc42013-06-25 09:44:10 -070047#include "NatController.h" /* For LOCAL_TETHER_COUNTERS_CHAIN */
48#include "ResponseCode.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070049
JP Abgralldb7da582011-09-18 12:57:32 -070050/* Alphabetical */
JP Abgrall92009c82013-02-06 18:01:24 -080051#define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %lld --name %s"
JP Abgrallc6c67342011-10-07 16:28:54 -070052const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070053const char* BandwidthController::LOCAL_INPUT = "bw_INPUT";
54const char* BandwidthController::LOCAL_FORWARD = "bw_FORWARD";
55const char* BandwidthController::LOCAL_OUTPUT = "bw_OUTPUT";
56const char* BandwidthController::LOCAL_RAW_PREROUTING = "bw_raw_PREROUTING";
57const char* BandwidthController::LOCAL_MANGLE_POSTROUTING = "bw_mangle_POSTROUTING";
JP Abgralldb7da582011-09-18 12:57:32 -070058const int BandwidthController::MAX_CMD_ARGS = 32;
59const int BandwidthController::MAX_CMD_LEN = 1024;
60const int BandwidthController::MAX_IFACENAME_LEN = 64;
61const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
62
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070063/**
64 * Some comments about the rules:
65 * * Ordering
66 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
JP Abgrall29e8de22012-05-03 12:52:15 -070067 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070068 * - quota'd rules in the costly chain should be before penalty_box lookups.
JP Abgrall29e8de22012-05-03 12:52:15 -070069 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070070 *
71 * * global quota vs per interface quota
72 * - global quota for all costly interfaces uses a single costly chain:
73 * . initial rules
JP Abgrallbfa74662011-06-29 19:23:04 -070074 * iptables -N costly_shared
JP Abgrall29e8de22012-05-03 12:52:15 -070075 * iptables -I bw_INPUT -i iface0 --jump costly_shared
76 * iptables -I bw_OUTPUT -o iface0 --jump costly_shared
JP Abgrallbfa74662011-06-29 19:23:04 -070077 * iptables -I costly_shared -m quota \! --quota 500000 \
78 * --jump REJECT --reject-with icmp-net-prohibited
79 * iptables -A costly_shared --jump penalty_box
JP Abgrall8a932722011-07-13 19:17:35 -070080 *
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070081 * . adding a new iface to this, E.g.:
JP Abgrall29e8de22012-05-03 12:52:15 -070082 * iptables -I bw_INPUT -i iface1 --jump costly_shared
83 * iptables -I bw_OUTPUT -o iface1 --jump costly_shared
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070084 *
85 * - quota per interface. This is achieve by having "costly" chains per quota.
86 * E.g. adding a new costly interface iface0 with its own quota:
87 * iptables -N costly_iface0
JP Abgrall29e8de22012-05-03 12:52:15 -070088 * iptables -I bw_INPUT -i iface0 --jump costly_iface0
89 * iptables -I bw_OUTPUT -o iface0 --jump costly_iface0
JP Abgrallbfa74662011-06-29 19:23:04 -070090 * iptables -A costly_iface0 -m quota \! --quota 500000 \
91 * --jump REJECT --reject-with icmp-net-prohibited
92 * iptables -A costly_iface0 --jump penalty_box
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070093 *
94 * * penalty_box handling:
95 * - only one penalty_box for all interfaces
96 * E.g Adding an app:
JP Abgrallbfa74662011-06-29 19:23:04 -070097 * iptables -A penalty_box -m owner --uid-owner app_3 \
98 * --jump REJECT --reject-with icmp-net-prohibited
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070099 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700100const char *BandwidthController::IPT_FLUSH_COMMANDS[] = {
101 /*
102 * Cleanup rules.
103 * Should normally include costly_<iface>, but we rely on the way they are setup
104 * to allow coexistance.
JP Abgrall39f8f242011-06-29 19:21:58 -0700105 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700106 "-F bw_INPUT",
107 "-F bw_OUTPUT",
108 "-F bw_FORWARD",
109 "-F penalty_box",
110 "-F costly_shared",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700111
112 "-t raw -F bw_raw_PREROUTING",
113 "-t mangle -F bw_mangle_POSTROUTING",
JP Abgrall0031cea2012-04-17 16:38:23 -0700114};
115
116/* The cleanup commands assume flushing has been done. */
117const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700118 "-X penalty_box",
119 "-X costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700120};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700121
JP Abgralldb7da582011-09-18 12:57:32 -0700122const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
JP Abgrallbfa74662011-06-29 19:23:04 -0700123 "-N costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700124 "-N penalty_box",
125};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700126
JP Abgralldb7da582011-09-18 12:57:32 -0700127const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700128 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700129
JP Abgrall0031cea2012-04-17 16:38:23 -0700130 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700131
JP Abgrallbfa74662011-06-29 19:23:04 -0700132 "-A costly_shared --jump penalty_box",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700133
JP Abgrall92009c82013-02-06 18:01:24 -0800134 "-t raw -A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
135 "-t mangle -A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700136};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700137
138BandwidthController::BandwidthController(void) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700139}
140
JP Abgrallad729ac2012-04-24 23:27:44 -0700141int BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling,
142 IptFailureLog failureHandling) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700143 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700144
Steve Block3fb42e02011-10-20 11:55:56 +0100145 ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
JP Abgrallad729ac2012-04-24 23:27:44 -0700146 res |= runIptablesCmd(cmd, rejectHandling, IptIpV4, failureHandling);
147 res |= runIptablesCmd(cmd, rejectHandling, IptIpV6, failureHandling);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700148 return res;
149}
150
JP Abgrall26e0d492011-06-24 19:21:51 -0700151int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
152
153 memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
154 strncpy(buffer, src, buffSize);
155 return buffer[buffSize - 1];
156}
157
JP Abgrall8a932722011-07-13 19:17:35 -0700158int BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700159 IptIpVer iptVer, IptFailureLog failureHandling) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700160 char buffer[MAX_CMD_LEN];
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700161 const char *argv[MAX_CMD_ARGS];
JP Abgrall26e0d492011-06-24 19:21:51 -0700162 int argc = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700163 char *next = buffer;
164 char *tmp;
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700165 int res;
Rom Lemarchand14150212013-01-24 10:01:04 -0800166 int status = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700167
JP Abgrall0dad7c22011-06-24 11:58:14 -0700168 std::string fullCmd = cmd;
JP Abgrall26e0d492011-06-24 19:21:51 -0700169
170 if (rejectHandling == IptRejectAdd) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700171 fullCmd += " --jump REJECT --reject-with";
JP Abgrall26e0d492011-06-24 19:21:51 -0700172 switch (iptVer) {
173 case IptIpV4:
JP Abgrall8a932722011-07-13 19:17:35 -0700174 fullCmd += " icmp-net-prohibited";
175 break;
JP Abgrall26e0d492011-06-24 19:21:51 -0700176 case IptIpV6:
JP Abgrall8a932722011-07-13 19:17:35 -0700177 fullCmd += " icmp6-adm-prohibited";
178 break;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700179 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700180 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700181
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700182 fullCmd.insert(0, " ");
183 fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700184
Rom Lemarchand14150212013-01-24 10:01:04 -0800185 if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
186 ALOGE("iptables command too long");
187 return -1;
188 }
189
190 argc = 0;
191 while ((tmp = strsep(&next, " "))) {
192 argv[argc++] = tmp;
193 if (argc >= MAX_CMD_ARGS) {
194 ALOGE("iptables argument overflow");
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700195 return -1;
196 }
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700197 }
Rom Lemarchand14150212013-01-24 10:01:04 -0800198
199 argv[argc] = NULL;
200 res = android_fork_execvp(argc, (char **)argv, &status, false,
201 failureHandling == IptFailShow);
JP Abgrallc8dc63b2013-02-13 16:30:00 -0800202 res = res || !WIFEXITED(status) || WEXITSTATUS(status);
203 if (res && failureHandling == IptFailShow) {
204 ALOGE("runIptablesCmd(): res=%d status=%d failed %s", res, status,
205 fullCmd.c_str());
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700206 }
207 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700208}
209
JP Abgrall0031cea2012-04-17 16:38:23 -0700210int BandwidthController::setupIptablesHooks(void) {
211
212 /* Some of the initialCommands are allowed to fail */
213 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
214 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
215
216 runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
217 IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
218
219 runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
220 IPT_SETUP_COMMANDS, RunCmdFailureBad);
221
222 return 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700223}
224
225int BandwidthController::enableBandwidthControl(bool force) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700226 int res;
JP Abgrall0031cea2012-04-17 16:38:23 -0700227 char value[PROPERTY_VALUE_MAX];
228
229 if (!force) {
230 property_get("persist.bandwidth.enable", value, "1");
231 if (!strcmp(value, "0"))
232 return 0;
233 }
JP Abgrall8a932722011-07-13 19:17:35 -0700234
JP Abgralldb7da582011-09-18 12:57:32 -0700235 /* Let's pretend we started from scratch ... */
JP Abgrall8a932722011-07-13 19:17:35 -0700236 sharedQuotaIfaces.clear();
237 quotaIfaces.clear();
238 naughtyAppUids.clear();
JP Abgralldb7da582011-09-18 12:57:32 -0700239 globalAlertBytes = 0;
JP Abgrallc6c67342011-10-07 16:28:54 -0700240 globalAlertTetherCount = 0;
JP Abgralldb7da582011-09-18 12:57:32 -0700241 sharedQuotaBytes = sharedAlertBytes = 0;
242
JP Abgrall0031cea2012-04-17 16:38:23 -0700243 res = runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
244 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgralldb7da582011-09-18 12:57:32 -0700245
JP Abgrall0031cea2012-04-17 16:38:23 -0700246 res |= runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
JP Abgralldb7da582011-09-18 12:57:32 -0700247 IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
JP Abgrall8a932722011-07-13 19:17:35 -0700248
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700249 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700250
251}
252
253int BandwidthController::disableBandwidthControl(void) {
JP Abgrall0031cea2012-04-17 16:38:23 -0700254 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
255 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700256 return 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700257}
258
JP Abgrall8a932722011-07-13 19:17:35 -0700259int BandwidthController::runCommands(int numCommands, const char *commands[],
260 RunCmdErrHandling cmdErrHandling) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700261 int res = 0;
JP Abgrallad729ac2012-04-24 23:27:44 -0700262 IptFailureLog failureLogging = IptFailShow;
263 if (cmdErrHandling == RunCmdFailureOk) {
264 failureLogging = IptFailHide;
265 }
Steve Block3fb42e02011-10-20 11:55:56 +0100266 ALOGV("runCommands(): %d commands", numCommands);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700267 for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
JP Abgrallad729ac2012-04-24 23:27:44 -0700268 res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd, failureLogging);
JP Abgrall0031cea2012-04-17 16:38:23 -0700269 if (res && cmdErrHandling != RunCmdFailureOk)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700270 return res;
271 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700272 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700273}
274
JP Abgrall0dad7c22011-06-24 11:58:14 -0700275std::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700276 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700277 char *buff;
278 const char *opFlag;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700279
280 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700281 case IptOpInsert:
282 opFlag = "-I";
283 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800284 case IptOpAppend:
285 opFlag = "-A";
286 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700287 case IptOpReplace:
288 opFlag = "-R";
289 break;
290 default:
291 case IptOpDelete:
292 opFlag = "-D";
293 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700294 }
JP Abgrall8a932722011-07-13 19:17:35 -0700295 asprintf(&buff, "%s penalty_box -m owner --uid-owner %d", opFlag, uid);
296 res = buff;
297 free(buff);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700298 return res;
299}
300
301int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700302 return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700303}
304
305int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700306 return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700307}
308
JP Abgrall26e0d492011-06-24 19:21:51 -0700309int BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700310 char cmd[MAX_CMD_LEN];
311 int uidNum;
JP Abgrall26e0d492011-06-24 19:21:51 -0700312 const char *failLogTemplate;
313 IptOp op;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700314 int appUids[numUids];
JP Abgrall26e0d492011-06-24 19:21:51 -0700315 std::string naughtyCmd;
JP Abgrallb1d24092012-04-27 01:02:31 -0700316 std::list<int /*uid*/>::iterator it;
JP Abgrall8a932722011-07-13 19:17:35 -0700317
JP Abgrall26e0d492011-06-24 19:21:51 -0700318 switch (appOp) {
319 case NaughtyAppOpAdd:
JP Abgrall8a932722011-07-13 19:17:35 -0700320 op = IptOpInsert;
321 failLogTemplate = "Failed to add app uid %d to penalty box.";
322 break;
JP Abgrall26e0d492011-06-24 19:21:51 -0700323 case NaughtyAppOpRemove:
JP Abgrall8a932722011-07-13 19:17:35 -0700324 op = IptOpDelete;
325 failLogTemplate = "Failed to delete app uid %d from penalty box.";
326 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700327 default:
328 ALOGE("Unexpected app Op %d", appOp);
329 return -1;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700330 }
331
332 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700333 appUids[uidNum] = atol(appStrUids[uidNum]);
334 if (appUids[uidNum] == 0) {
Steve Block5ea0c052012-01-06 19:18:11 +0000335 ALOGE(failLogTemplate, appUids[uidNum]);
JP Abgrall26e0d492011-06-24 19:21:51 -0700336 goto fail_parse;
337 }
338 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700339
340 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700341 int uid = appUids[uidNum];
342 for (it = naughtyAppUids.begin(); it != naughtyAppUids.end(); it++) {
343 if (*it == uid)
344 break;
345 }
346 bool found = (it != naughtyAppUids.end());
347
348 if (appOp == NaughtyAppOpRemove) {
349 if (!found) {
350 ALOGE("No such appUid %d to remove", uid);
351 return -1;
352 }
353 naughtyAppUids.erase(it);
354 } else {
355 if (found) {
356 ALOGE("appUid %d exists already", uid);
357 return -1;
358 }
359 naughtyAppUids.push_front(uid);
360 }
361
362 naughtyCmd = makeIptablesNaughtyCmd(op, uid);
JP Abgrall26e0d492011-06-24 19:21:51 -0700363 if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700364 ALOGE(failLogTemplate, uid);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700365 goto fail_with_uidNum;
366 }
367 }
368 return 0;
369
JP Abgrall26e0d492011-06-24 19:21:51 -0700370fail_with_uidNum:
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700371 /* Try to remove the uid that failed in any case*/
JP Abgrall26e0d492011-06-24 19:21:51 -0700372 naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]);
373 runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd);
374fail_parse:
375 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700376}
377
JP Abgrall26e0d492011-06-24 19:21:51 -0700378std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700379 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700380 char *buff;
381 const char *opFlag;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700382
Steve Block3fb42e02011-10-20 11:55:56 +0100383 ALOGV("makeIptablesQuotaCmd(%d, %lld)", op, quota);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700384
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700385 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700386 case IptOpInsert:
387 opFlag = "-I";
388 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800389 case IptOpAppend:
390 opFlag = "-A";
391 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700392 case IptOpReplace:
393 opFlag = "-R";
394 break;
395 default:
396 case IptOpDelete:
397 opFlag = "-D";
398 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700399 }
JP Abgrall8a932722011-07-13 19:17:35 -0700400
JP Abgrallbfa74662011-06-29 19:23:04 -0700401 // The requried IP version specific --jump REJECT ... will be added later.
JP Abgrall8a932722011-07-13 19:17:35 -0700402 asprintf(&buff, "%s costly_%s -m quota2 ! --quota %lld --name %s", opFlag, costName, quota,
403 costName);
404 res = buff;
405 free(buff);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700406 return res;
407}
408
JP Abgrall26e0d492011-06-24 19:21:51 -0700409int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700410 char cmd[MAX_CMD_LEN];
JP Abgrall0031cea2012-04-17 16:38:23 -0700411 int res = 0, res1, res2;
JP Abgrall8a932722011-07-13 19:17:35 -0700412 int ruleInsertPos = 1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700413 std::string costString;
414 const char *costCString;
415
JP Abgrall0dad7c22011-06-24 11:58:14 -0700416 /* The "-N costly" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700417 switch (quotaType) {
418 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700419 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700420 costString += ifn;
421 costCString = costString.c_str();
JP Abgrall0031cea2012-04-17 16:38:23 -0700422 /*
423 * Flush the costly_<iface> is allowed to fail in case it didn't exist.
424 * Creating a new one is allowed to fail in case it existed.
425 * This helps with netd restarts.
426 */
427 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700428 res1 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700429 snprintf(cmd, sizeof(cmd), "-N %s", costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700430 res2 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700431 res = (res1 && res2) || (!res1 && !res2);
432
JP Abgrall0dad7c22011-06-24 11:58:14 -0700433 snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700434 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall26e0d492011-06-24 19:21:51 -0700435 break;
436 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700437 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700438 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700439 default:
440 ALOGE("Unexpected quotatype %d", quotaType);
441 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700442 }
443
JP Abgrall8a932722011-07-13 19:17:35 -0700444 if (globalAlertBytes) {
445 /* The alert rule comes 1st */
446 ruleInsertPos = 2;
447 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700448
449 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700450 runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700451
452 snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700453 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700454
455 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700456 runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700457
458 snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700459 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700460 return res;
461}
462
JP Abgrall26e0d492011-06-24 19:21:51 -0700463int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700464 char cmd[MAX_CMD_LEN];
465 int res = 0;
466 std::string costString;
467 const char *costCString;
468
JP Abgrall26e0d492011-06-24 19:21:51 -0700469 switch (quotaType) {
470 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700471 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700472 costString += ifn;
473 costCString = costString.c_str();
JP Abgrall26e0d492011-06-24 19:21:51 -0700474 break;
475 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700476 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700477 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700478 default:
479 ALOGE("Unexpected quotatype %d", quotaType);
480 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700481 }
482
JP Abgrall0031cea2012-04-17 16:38:23 -0700483 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700484 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700485 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700486 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700487
JP Abgrallbfa74662011-06-29 19:23:04 -0700488 /* The "-N costly_shared" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700489 if (quotaType == QuotaUnique) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700490 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700491 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgralla9f802c2011-06-29 15:46:45 -0700492 snprintf(cmd, sizeof(cmd), "-X %s", costCString);
493 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700494 }
495 return res;
496}
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700497
JP Abgrall0dad7c22011-06-24 11:58:14 -0700498int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700499 char cmd[MAX_CMD_LEN];
500 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700501 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700502 std::string quotaCmd;
JP Abgrall8a932722011-07-13 19:17:35 -0700503 std::string ifaceName;
504 ;
JP Abgrallbfa74662011-06-29 19:23:04 -0700505 const char *costName = "shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700506 std::list<std::string>::iterator it;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700507
JP Abgrall8a932722011-07-13 19:17:35 -0700508 if (!maxBytes) {
509 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000510 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700511 return -1;
512 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700513 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000514 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700515 return -1;
516 }
517 ifaceName = ifn;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700518
519 if (maxBytes == -1) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700520 return removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700521 }
522
523 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700524 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
525 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700526 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700527 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700528
JP Abgrall0dad7c22011-06-24 11:58:14 -0700529 if (it == sharedQuotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700530 res |= prepCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700531 if (sharedQuotaIfaces.empty()) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700532 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700533 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700534 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000535 ALOGE("Failed set quota rule");
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700536 goto fail;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700537 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700538 sharedQuotaBytes = maxBytes;
539 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700540 sharedQuotaIfaces.push_front(ifaceName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700541
542 }
543
544 if (maxBytes != sharedQuotaBytes) {
JP Abgrall8a932722011-07-13 19:17:35 -0700545 res |= updateQuota(costName, maxBytes);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700546 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000547 ALOGE("Failed update quota for %s", costName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700548 goto fail;
549 }
550 sharedQuotaBytes = maxBytes;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700551 }
552 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700553
554 fail:
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700555 /*
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700556 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
557 * rules in the kernel to see which ones need cleaning up.
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700558 * For now callers needs to choose if they want to "ndc bandwidth enable"
559 * which resets everything.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700560 */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700561 removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700562 return -1;
563}
564
JP Abgrall8a932722011-07-13 19:17:35 -0700565/* It will also cleanup any shared alerts */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700566int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700567 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700568 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700569 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700570 std::list<std::string>::iterator it;
JP Abgrallbfa74662011-06-29 19:23:04 -0700571 const char *costName = "shared";
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700572
JP Abgrall8a932722011-07-13 19:17:35 -0700573 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000574 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700575 return -1;
576 }
JP Abgrall8a932722011-07-13 19:17:35 -0700577 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700578
JP Abgrall0dad7c22011-06-24 11:58:14 -0700579 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
580 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700581 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700582 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700583 if (it == sharedQuotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000584 ALOGE("No such iface %s to delete", ifn);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700585 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700586 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700587
JP Abgrall26e0d492011-06-24 19:21:51 -0700588 res |= cleanupCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700589 sharedQuotaIfaces.erase(it);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700590
JP Abgrall0dad7c22011-06-24 11:58:14 -0700591 if (sharedQuotaIfaces.empty()) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700592 std::string quotaCmd;
JP Abgrallbfa74662011-06-29 19:23:04 -0700593 quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700594 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700595 sharedQuotaBytes = 0;
596 if (sharedAlertBytes) {
597 removeSharedAlert();
598 sharedAlertBytes = 0;
599 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700600 }
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700601 return res;
602}
JP Abgrall0dad7c22011-06-24 11:58:14 -0700603
604int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
605 char ifn[MAX_IFACENAME_LEN];
606 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700607 std::string ifaceName;
608 const char *costName;
609 std::list<QuotaInfo>::iterator it;
610 std::string quotaCmd;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700611
JP Abgrall8a932722011-07-13 19:17:35 -0700612 if (!maxBytes) {
613 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000614 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700615 return -1;
616 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700617 if (maxBytes == -1) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700618 return removeInterfaceQuota(iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700619 }
620
JP Abgrall8a932722011-07-13 19:17:35 -0700621 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000622 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700623 return -1;
624 }
625 ifaceName = ifn;
626 costName = iface;
627
JP Abgrall0dad7c22011-06-24 11:58:14 -0700628 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700629 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700630 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700631 break;
632 }
633
634 if (it == quotaIfaces.end()) {
JP Abgrall109899b2013-02-12 19:20:13 -0800635 /* Preparing the iface adds a penalty_box check */
JP Abgrall26e0d492011-06-24 19:21:51 -0700636 res |= prepCostlyIface(ifn, QuotaUnique);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700637 /*
638 * The rejecting quota limit should go after the penalty box checks
639 * or else a naughty app could just eat up the quota.
640 * So we append here.
641 */
JP Abgrall109899b2013-02-12 19:20:13 -0800642 quotaCmd = makeIptablesQuotaCmd(IptOpAppend, costName, maxBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700643 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700644 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000645 ALOGE("Failed set quota rule");
JP Abgrall0dad7c22011-06-24 11:58:14 -0700646 goto fail;
647 }
648
JP Abgrall8a932722011-07-13 19:17:35 -0700649 quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
JP Abgrall0dad7c22011-06-24 11:58:14 -0700650
651 } else {
JP Abgrall8a932722011-07-13 19:17:35 -0700652 res |= updateQuota(costName, maxBytes);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700653 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000654 ALOGE("Failed update quota for %s", iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700655 goto fail;
656 }
JP Abgrall8a932722011-07-13 19:17:35 -0700657 it->quota = maxBytes;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700658 }
659 return 0;
660
661 fail:
662 /*
663 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
664 * rules in the kernel to see which ones need cleaning up.
665 * For now callers needs to choose if they want to "ndc bandwidth enable"
666 * which resets everything.
667 */
668 removeInterfaceSharedQuota(ifn);
669 return -1;
670}
671
JP Abgrall8a932722011-07-13 19:17:35 -0700672int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
673 return getInterfaceQuota("shared", bytes);
674}
675
676int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
677 FILE *fp;
678 char *fname;
679 int scanRes;
680
681 asprintf(&fname, "/proc/net/xt_quota/%s", costName);
682 fp = fopen(fname, "r");
683 free(fname);
684 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000685 ALOGE("Reading quota %s failed (%s)", costName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700686 return -1;
687 }
688 scanRes = fscanf(fp, "%lld", bytes);
Steve Block3fb42e02011-10-20 11:55:56 +0100689 ALOGV("Read quota res=%d bytes=%lld", scanRes, *bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700690 fclose(fp);
691 return scanRes == 1 ? 0 : -1;
692}
693
JP Abgrall0dad7c22011-06-24 11:58:14 -0700694int BandwidthController::removeInterfaceQuota(const char *iface) {
695
696 char ifn[MAX_IFACENAME_LEN];
697 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700698 std::string ifaceName;
699 const char *costName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700700 std::list<QuotaInfo>::iterator it;
JP Abgrall26e0d492011-06-24 19:21:51 -0700701
JP Abgrall8a932722011-07-13 19:17:35 -0700702 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000703 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700704 return -1;
705 }
706 ifaceName = ifn;
707 costName = iface;
708
JP Abgrall0dad7c22011-06-24 11:58:14 -0700709 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700710 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700711 break;
712 }
713
714 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000715 ALOGE("No such iface %s to delete", ifn);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700716 return -1;
717 }
718
719 /* This also removes the quota command of CostlyIface chain. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700720 res |= cleanupCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700721
722 quotaIfaces.erase(it);
723
724 return res;
725}
JP Abgrall8a932722011-07-13 19:17:35 -0700726
727int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
728 FILE *fp;
729 char *fname;
730
731 asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
732 fp = fopen(fname, "w");
733 free(fname);
734 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000735 ALOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700736 return -1;
737 }
738 fprintf(fp, "%lld\n", bytes);
739 fclose(fp);
740 return 0;
741}
742
743int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
744 int res = 0;
745 const char *opFlag;
746 char *alertQuotaCmd;
747
748 switch (op) {
749 case IptOpInsert:
750 opFlag = "-I";
751 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800752 case IptOpAppend:
753 opFlag = "-A";
754 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700755 case IptOpReplace:
756 opFlag = "-R";
757 break;
758 default:
759 case IptOpDelete:
760 opFlag = "-D";
761 break;
762 }
763
JP Abgrall92009c82013-02-06 18:01:24 -0800764 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800765 bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700766 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
767 free(alertQuotaCmd);
JP Abgrall92009c82013-02-06 18:01:24 -0800768 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800769 bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700770 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
771 free(alertQuotaCmd);
772 return res;
773}
774
JP Abgrallc6c67342011-10-07 16:28:54 -0700775int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
776 int res = 0;
777 const char *opFlag;
JP Abgrall8a932722011-07-13 19:17:35 -0700778 char *alertQuotaCmd;
JP Abgrallc6c67342011-10-07 16:28:54 -0700779
780 switch (op) {
781 case IptOpInsert:
782 opFlag = "-I";
783 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800784 case IptOpAppend:
785 opFlag = "-A";
786 break;
JP Abgrallc6c67342011-10-07 16:28:54 -0700787 case IptOpReplace:
788 opFlag = "-R";
789 break;
790 default:
791 case IptOpDelete:
792 opFlag = "-D";
793 break;
794 }
795
JP Abgrall92009c82013-02-06 18:01:24 -0800796 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800797 bytes, alertName);
JP Abgrallc6c67342011-10-07 16:28:54 -0700798 res = runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
799 free(alertQuotaCmd);
800 return res;
801}
802
803int BandwidthController::setGlobalAlert(int64_t bytes) {
804 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700805 int res = 0;
806
807 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000808 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700809 return -1;
810 }
811 if (globalAlertBytes) {
812 res = updateQuota(alertName, bytes);
813 } else {
814 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700815 if (globalAlertTetherCount) {
Steve Block3fb42e02011-10-20 11:55:56 +0100816 ALOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700817 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
818 }
JP Abgrall8a932722011-07-13 19:17:35 -0700819 }
820 globalAlertBytes = bytes;
821 return res;
822}
823
JP Abgrallc6c67342011-10-07 16:28:54 -0700824int BandwidthController::setGlobalAlertInForwardChain(void) {
825 const char *alertName = ALERT_GLOBAL_NAME;
826 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700827
JP Abgrallc6c67342011-10-07 16:28:54 -0700828 globalAlertTetherCount++;
Steve Block3fb42e02011-10-20 11:55:56 +0100829 ALOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700830
831 /*
832 * If there is no globalAlert active we are done.
833 * If there is an active globalAlert but this is not the 1st
834 * tether, we are also done.
835 */
836 if (!globalAlertBytes || globalAlertTetherCount != 1) {
837 return 0;
838 }
839
840 /* We only add the rule if this was the 1st tether added. */
841 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
842 return res;
843}
844
845int BandwidthController::removeGlobalAlert(void) {
846
847 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700848 int res = 0;
849
850 if (!globalAlertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000851 ALOGE("No prior alert set");
JP Abgrall8a932722011-07-13 19:17:35 -0700852 return -1;
853 }
854 res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700855 if (globalAlertTetherCount) {
856 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
857 }
JP Abgrall8a932722011-07-13 19:17:35 -0700858 globalAlertBytes = 0;
859 return res;
860}
861
JP Abgrallc6c67342011-10-07 16:28:54 -0700862int BandwidthController::removeGlobalAlertInForwardChain(void) {
863 int res = 0;
864 const char *alertName = ALERT_GLOBAL_NAME;
865
866 if (!globalAlertTetherCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000867 ALOGE("No prior alert set");
JP Abgrallc6c67342011-10-07 16:28:54 -0700868 return -1;
869 }
870
871 globalAlertTetherCount--;
872 /*
873 * If there is no globalAlert active we are done.
874 * If there is an active globalAlert but there are more
875 * tethers, we are also done.
876 */
877 if (!globalAlertBytes || globalAlertTetherCount >= 1) {
878 return 0;
879 }
880
881 /* We only detete the rule if this was the last tether removed. */
882 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
883 return res;
884}
885
JP Abgrall8a932722011-07-13 19:17:35 -0700886int BandwidthController::setSharedAlert(int64_t bytes) {
887 if (!sharedQuotaBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000888 ALOGE("Need to have a prior shared quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700889 return -1;
890 }
891 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000892 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700893 return -1;
894 }
895 return setCostlyAlert("shared", bytes, &sharedAlertBytes);
896}
897
898int BandwidthController::removeSharedAlert(void) {
899 return removeCostlyAlert("shared", &sharedAlertBytes);
900}
901
902int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
903 std::list<QuotaInfo>::iterator it;
904
905 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000906 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700907 return -1;
908 }
909 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
910 if (it->ifaceName == iface)
911 break;
912 }
913
914 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000915 ALOGE("Need to have a prior interface quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700916 return -1;
917 }
918
919 return setCostlyAlert(iface, bytes, &it->alert);
920}
921
922int BandwidthController::removeInterfaceAlert(const char *iface) {
923 std::list<QuotaInfo>::iterator it;
924
925 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
926 if (it->ifaceName == iface)
927 break;
928 }
929
930 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000931 ALOGE("No prior alert set for interface %s", iface);
JP Abgrall8a932722011-07-13 19:17:35 -0700932 return -1;
933 }
934
935 return removeCostlyAlert(iface, &it->alert);
936}
937
938int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
939 char *alertQuotaCmd;
JP Abgrall109899b2013-02-12 19:20:13 -0800940 char *chainName;
JP Abgrall8a932722011-07-13 19:17:35 -0700941 int res = 0;
942 char *alertName;
943
944 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000945 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700946 return -1;
947 }
948 asprintf(&alertName, "%sAlert", costName);
949 if (*alertBytes) {
950 res = updateQuota(alertName, *alertBytes);
951 } else {
JP Abgrall109899b2013-02-12 19:20:13 -0800952 asprintf(&chainName, "costly_%s", costName);
953 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-A", chainName, bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700954 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
955 free(alertQuotaCmd);
JP Abgrall109899b2013-02-12 19:20:13 -0800956 free(chainName);
JP Abgrall8a932722011-07-13 19:17:35 -0700957 }
958 *alertBytes = bytes;
959 free(alertName);
960 return res;
961}
962
963int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
964 char *alertQuotaCmd;
965 char *chainName;
966 char *alertName;
967 int res = 0;
968
969 asprintf(&alertName, "%sAlert", costName);
970 if (!*alertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000971 ALOGE("No prior alert set for %s alert", costName);
JP Abgrall8a932722011-07-13 19:17:35 -0700972 return -1;
973 }
974
975 asprintf(&chainName, "costly_%s", costName);
JP Abgrall92009c82013-02-06 18:01:24 -0800976 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700977 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
978 free(alertQuotaCmd);
979 free(chainName);
980
981 *alertBytes = 0;
982 free(alertName);
983 return res;
984}
JP Abgralldb7da582011-09-18 12:57:32 -0700985
986/*
987 * Parse the ptks and bytes out of:
JP Abgrallbaeccc42013-06-25 09:44:10 -0700988 * Chain natctrl_tether_counters (4 references)
989 * pkts bytes target prot opt in out source destination
990 * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 counter wlan0_rmnet0: 0 bytes
991 * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0 counter rmnet0_wlan0: 0 bytes
992 * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0 counter bt-pan_rmnet0: 0 bytes
993 * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0 counter rmnet0_bt-pan: 0 bytes
JP Abgralldb7da582011-09-18 12:57:32 -0700994 */
JP Abgrallbaeccc42013-06-25 09:44:10 -0700995int BandwidthController::parseForwardChainStats(SocketClient *cli, const TetherStats filter,
996 FILE *fp, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -0700997 int res;
998 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
999 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
1000 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
1001 char rest[MAX_IPT_OUTPUT_LINE_LEN];
1002
JP Abgrallbaeccc42013-06-25 09:44:10 -07001003 TetherStats stats;
JP Abgralldb7da582011-09-18 12:57:32 -07001004 char *buffPtr;
1005 int64_t packets, bytes;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001006 int statsFound = 0;
1007
1008 bool filterPair = filter.intIface[0] && filter.extIface[0];
1009
1010 char *filterMsg = filter.getStatsLine();
1011 ALOGV("filter: %s", filterMsg);
1012 free(filterMsg);
1013
1014 stats = filter;
JP Abgralldb7da582011-09-18 12:57:32 -07001015
1016 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1017 /* Clean up, so a failed parse can still print info */
1018 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
JP Abgrall0031cea2012-04-17 16:38:23 -07001019 res = sscanf(buffPtr, "%lld %lld RETURN all -- %s %s 0.%s",
JP Abgralldb7da582011-09-18 12:57:32 -07001020 &packets, &bytes, iface0, iface1, rest);
Steve Block3fb42e02011-10-20 11:55:56 +01001021 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%lld bytes=%lld rest=<%s> orig line=<%s>", res,
JP Abgralldb7da582011-09-18 12:57:32 -07001022 iface0, iface1, packets, bytes, rest, buffPtr);
JP Abgralla2a64f02011-11-11 20:36:16 -08001023 extraProcessingInfo += buffPtr;
1024
JP Abgralldb7da582011-09-18 12:57:32 -07001025 if (res != 5) {
1026 continue;
1027 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001028 /*
1029 * The following assumes that the 1st rule has in:extIface out:intIface,
1030 * which is what NatController sets up.
1031 * If not filtering, the 1st match rx, and sets up the pair for the tx side.
1032 */
1033 if (filter.intIface[0] && filter.extIface[0]) {
1034 if (filter.intIface == iface0 && filter.extIface == iface1) {
1035 ALOGV("2Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1036 stats.rxPackets = packets;
1037 stats.rxBytes = bytes;
1038 } else if (filter.intIface == iface1 && filter.extIface == iface0) {
1039 ALOGV("2Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1040 stats.txPackets = packets;
1041 stats.txBytes = bytes;
1042 }
1043 } else if (filter.intIface[0] || filter.extIface[0]) {
1044 if (filter.intIface == iface0 || filter.extIface == iface1) {
1045 ALOGV("1Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1046 stats.intIface = iface0;
1047 stats.extIface = iface1;
1048 stats.rxPackets = packets;
1049 stats.rxBytes = bytes;
1050 } else if (filter.intIface == iface1 || filter.extIface == iface0) {
1051 ALOGV("1Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1052 stats.intIface = iface1;
1053 stats.extIface = iface0;
1054 stats.txPackets = packets;
1055 stats.txBytes = bytes;
1056 }
1057 } else /* if (!filter.intFace[0] && !filter.extIface[0]) */ {
1058 if (!stats.intIface[0]) {
1059 ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1060 stats.intIface = iface0;
1061 stats.extIface = iface1;
1062 stats.rxPackets = packets;
1063 stats.rxBytes = bytes;
1064 } else if (stats.intIface == iface1 && stats.extIface == iface0) {
1065 ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
1066 stats.txPackets = packets;
1067 stats.txBytes = bytes;
1068 }
1069 }
1070 if (stats.rxBytes != -1 && stats.txBytes != -1) {
1071 ALOGV("rx_bytes=%lld tx_bytes=%lld filterPair=%d", stats.rxBytes, stats.txBytes, filterPair);
1072 /* Send out stats, and prep for the next if needed. */
1073 char *msg = stats.getStatsLine();
1074 if (filterPair) {
1075 cli->sendMsg(ResponseCode::TetheringStatsResult, msg, false);
1076 return 0;
1077 } else {
1078 cli->sendMsg(ResponseCode::TetheringStatsListResult, msg, false);
1079 stats = filter;
1080 }
1081 free(msg);
1082 statsFound++;
JP Abgralldb7da582011-09-18 12:57:32 -07001083 }
1084 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001085 /* We found some stats, and the last one isn't a partial stats. */
1086 if (statsFound && (stats.rxBytes == -1 || stats.txBytes == -1)) {
1087 cli->sendMsg(ResponseCode::CommandOkay, "Tethering stats list completed", false);
1088 return 0;
1089 }
1090 return -1;
JP Abgralldb7da582011-09-18 12:57:32 -07001091}
1092
JP Abgrallbaeccc42013-06-25 09:44:10 -07001093char *BandwidthController::TetherStats::getStatsLine(void) const {
JP Abgralldb7da582011-09-18 12:57:32 -07001094 char *msg;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001095 asprintf(&msg, "%s %s %lld %lld %lld %lld", intIface.c_str(), extIface.c_str(),
JP Abgralldb7da582011-09-18 12:57:32 -07001096 rxBytes, rxPackets, txBytes, txPackets);
1097 return msg;
1098}
1099
JP Abgrallbaeccc42013-06-25 09:44:10 -07001100int BandwidthController::getTetherStats(SocketClient *cli, TetherStats &stats, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001101 int res;
1102 std::string fullCmd;
1103 FILE *iptOutput;
1104 const char *cmd;
1105
JP Abgralldb7da582011-09-18 12:57:32 -07001106 /*
1107 * Why not use some kind of lib to talk to iptables?
1108 * Because the only libs are libiptc and libip6tc in iptables, and they are
1109 * not easy to use. They require the known iptables match modules to be
1110 * preloaded/linked, and require apparently a lot of wrapper code to get
1111 * the wanted info.
1112 */
1113 fullCmd = IPTABLES_PATH;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001114 fullCmd += " -nvx -L ";
1115 fullCmd += NatController::LOCAL_TETHER_COUNTERS_CHAIN;
JP Abgralldb7da582011-09-18 12:57:32 -07001116 iptOutput = popen(fullCmd.c_str(), "r");
1117 if (!iptOutput) {
Steve Block5ea0c052012-01-06 19:18:11 +00001118 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
JP Abgralla2a64f02011-11-11 20:36:16 -08001119 extraProcessingInfo += "Failed to run iptables.";
JP Abgralldb7da582011-09-18 12:57:32 -07001120 return -1;
1121 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001122 res = parseForwardChainStats(cli, stats, iptOutput, extraProcessingInfo);
JP Abgralldb7da582011-09-18 12:57:32 -07001123 pclose(iptOutput);
1124
1125 /* Currently NatController doesn't do ipv6 tethering, so we are done. */
1126 return res;
1127}