blob: e4171d6e3acc49d72e4a534b544da82968afe78b [file] [log] [blame]
JP Abgrall4a5f5ca2011-06-15 18:37:39 -07001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgralldb7da582011-09-18 12:57:32 -070017// #define LOG_NDEBUG 0
18
19/*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
JP Abgrall8a932722011-07-13 19:17:35 -070025#include <errno.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070026#include <fcntl.h>
JP Abgralldb7da582011-09-18 12:57:32 -070027#include <stdio.h>
JP Abgrall8a932722011-07-13 19:17:35 -070028#include <stdlib.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070029#include <string.h>
30
31#include <sys/socket.h>
32#include <sys/stat.h>
33#include <sys/types.h>
34#include <sys/wait.h>
35
36#include <linux/netlink.h>
37#include <linux/rtnetlink.h>
38#include <linux/pkt_sched.h>
39
40#define LOG_TAG "BandwidthController"
41#include <cutils/log.h>
42#include <cutils/properties.h>
Rom Lemarchand14150212013-01-24 10:01:04 -080043#include <logwrap/logwrap.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070044
JP Abgrall0031cea2012-04-17 16:38:23 -070045#include "NetdConstants.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070046#include "BandwidthController.h"
47
JP Abgralldb7da582011-09-18 12:57:32 -070048/* Alphabetical */
JP Abgrall92009c82013-02-06 18:01:24 -080049#define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %lld --name %s"
JP Abgralldb7da582011-09-18 12:57:32 -070050const int BandwidthController::ALERT_RULE_POS_IN_COSTLY_CHAIN = 4;
JP Abgrallc6c67342011-10-07 16:28:54 -070051const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070052const char* BandwidthController::LOCAL_INPUT = "bw_INPUT";
53const char* BandwidthController::LOCAL_FORWARD = "bw_FORWARD";
54const char* BandwidthController::LOCAL_OUTPUT = "bw_OUTPUT";
55const char* BandwidthController::LOCAL_RAW_PREROUTING = "bw_raw_PREROUTING";
56const char* BandwidthController::LOCAL_MANGLE_POSTROUTING = "bw_mangle_POSTROUTING";
JP Abgralldb7da582011-09-18 12:57:32 -070057const int BandwidthController::MAX_CMD_ARGS = 32;
58const int BandwidthController::MAX_CMD_LEN = 1024;
59const int BandwidthController::MAX_IFACENAME_LEN = 64;
60const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
61
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070062/**
63 * Some comments about the rules:
64 * * Ordering
65 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
JP Abgrall29e8de22012-05-03 12:52:15 -070066 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070067 * - quota'd rules in the costly chain should be before penalty_box lookups.
JP Abgrall29e8de22012-05-03 12:52:15 -070068 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070069 *
70 * * global quota vs per interface quota
71 * - global quota for all costly interfaces uses a single costly chain:
72 * . initial rules
JP Abgrallbfa74662011-06-29 19:23:04 -070073 * iptables -N costly_shared
JP Abgrall29e8de22012-05-03 12:52:15 -070074 * iptables -I bw_INPUT -i iface0 --jump costly_shared
75 * iptables -I bw_OUTPUT -o iface0 --jump costly_shared
JP Abgrallbfa74662011-06-29 19:23:04 -070076 * iptables -I costly_shared -m quota \! --quota 500000 \
77 * --jump REJECT --reject-with icmp-net-prohibited
78 * iptables -A costly_shared --jump penalty_box
JP Abgrall8a932722011-07-13 19:17:35 -070079 *
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070080 * . adding a new iface to this, E.g.:
JP Abgrall29e8de22012-05-03 12:52:15 -070081 * iptables -I bw_INPUT -i iface1 --jump costly_shared
82 * iptables -I bw_OUTPUT -o iface1 --jump costly_shared
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070083 *
84 * - quota per interface. This is achieve by having "costly" chains per quota.
85 * E.g. adding a new costly interface iface0 with its own quota:
86 * iptables -N costly_iface0
JP Abgrall29e8de22012-05-03 12:52:15 -070087 * iptables -I bw_INPUT -i iface0 --jump costly_iface0
88 * iptables -I bw_OUTPUT -o iface0 --jump costly_iface0
JP Abgrallbfa74662011-06-29 19:23:04 -070089 * iptables -A costly_iface0 -m quota \! --quota 500000 \
90 * --jump REJECT --reject-with icmp-net-prohibited
91 * iptables -A costly_iface0 --jump penalty_box
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070092 *
93 * * penalty_box handling:
94 * - only one penalty_box for all interfaces
95 * E.g Adding an app:
JP Abgrallbfa74662011-06-29 19:23:04 -070096 * iptables -A penalty_box -m owner --uid-owner app_3 \
97 * --jump REJECT --reject-with icmp-net-prohibited
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070098 */
JP Abgrall0031cea2012-04-17 16:38:23 -070099const char *BandwidthController::IPT_FLUSH_COMMANDS[] = {
100 /*
101 * Cleanup rules.
102 * Should normally include costly_<iface>, but we rely on the way they are setup
103 * to allow coexistance.
JP Abgrall39f8f242011-06-29 19:21:58 -0700104 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700105 "-F bw_INPUT",
106 "-F bw_OUTPUT",
107 "-F bw_FORWARD",
108 "-F penalty_box",
109 "-F costly_shared",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700110
111 "-t raw -F bw_raw_PREROUTING",
112 "-t mangle -F bw_mangle_POSTROUTING",
JP Abgrall0031cea2012-04-17 16:38:23 -0700113};
114
115/* The cleanup commands assume flushing has been done. */
116const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700117 "-X penalty_box",
118 "-X costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700119};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700120
JP Abgralldb7da582011-09-18 12:57:32 -0700121const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
JP Abgrallbfa74662011-06-29 19:23:04 -0700122 "-N costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700123 "-N penalty_box",
124};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700125
JP Abgralldb7da582011-09-18 12:57:32 -0700126const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700127 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700128
JP Abgrall0031cea2012-04-17 16:38:23 -0700129 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700130
JP Abgrallbfa74662011-06-29 19:23:04 -0700131 "-A costly_shared --jump penalty_box",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700132
JP Abgrall92009c82013-02-06 18:01:24 -0800133 "-t raw -A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
134 "-t mangle -A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700135};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700136
137BandwidthController::BandwidthController(void) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700138}
139
JP Abgrallad729ac2012-04-24 23:27:44 -0700140int BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling,
141 IptFailureLog failureHandling) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700142 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700143
Steve Block3fb42e02011-10-20 11:55:56 +0100144 ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
JP Abgrallad729ac2012-04-24 23:27:44 -0700145 res |= runIptablesCmd(cmd, rejectHandling, IptIpV4, failureHandling);
146 res |= runIptablesCmd(cmd, rejectHandling, IptIpV6, failureHandling);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700147 return res;
148}
149
JP Abgrall26e0d492011-06-24 19:21:51 -0700150int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
151
152 memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
153 strncpy(buffer, src, buffSize);
154 return buffer[buffSize - 1];
155}
156
JP Abgrall8a932722011-07-13 19:17:35 -0700157int BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700158 IptIpVer iptVer, IptFailureLog failureHandling) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700159 char buffer[MAX_CMD_LEN];
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700160 const char *argv[MAX_CMD_ARGS];
JP Abgrall26e0d492011-06-24 19:21:51 -0700161 int argc = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700162 char *next = buffer;
163 char *tmp;
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700164 int res;
Rom Lemarchand14150212013-01-24 10:01:04 -0800165 int status = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700166
JP Abgrall0dad7c22011-06-24 11:58:14 -0700167 std::string fullCmd = cmd;
JP Abgrall26e0d492011-06-24 19:21:51 -0700168
169 if (rejectHandling == IptRejectAdd) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700170 fullCmd += " --jump REJECT --reject-with";
JP Abgrall26e0d492011-06-24 19:21:51 -0700171 switch (iptVer) {
172 case IptIpV4:
JP Abgrall8a932722011-07-13 19:17:35 -0700173 fullCmd += " icmp-net-prohibited";
174 break;
JP Abgrall26e0d492011-06-24 19:21:51 -0700175 case IptIpV6:
JP Abgrall8a932722011-07-13 19:17:35 -0700176 fullCmd += " icmp6-adm-prohibited";
177 break;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700178 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700179 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700180
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700181 fullCmd.insert(0, " ");
182 fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700183
Rom Lemarchand14150212013-01-24 10:01:04 -0800184 if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
185 ALOGE("iptables command too long");
186 return -1;
187 }
188
189 argc = 0;
190 while ((tmp = strsep(&next, " "))) {
191 argv[argc++] = tmp;
192 if (argc >= MAX_CMD_ARGS) {
193 ALOGE("iptables argument overflow");
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700194 return -1;
195 }
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700196 }
Rom Lemarchand14150212013-01-24 10:01:04 -0800197
198 argv[argc] = NULL;
199 res = android_fork_execvp(argc, (char **)argv, &status, false,
200 failureHandling == IptFailShow);
JP Abgrallc8dc63b2013-02-13 16:30:00 -0800201 res = res || !WIFEXITED(status) || WEXITSTATUS(status);
202 if (res && failureHandling == IptFailShow) {
203 ALOGE("runIptablesCmd(): res=%d status=%d failed %s", res, status,
204 fullCmd.c_str());
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700205 }
206 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700207}
208
JP Abgrall0031cea2012-04-17 16:38:23 -0700209int BandwidthController::setupIptablesHooks(void) {
210
211 /* Some of the initialCommands are allowed to fail */
212 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
213 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
214
215 runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
216 IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
217
218 runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
219 IPT_SETUP_COMMANDS, RunCmdFailureBad);
220
221 return 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700222}
223
224int BandwidthController::enableBandwidthControl(bool force) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700225 int res;
JP Abgrall0031cea2012-04-17 16:38:23 -0700226 char value[PROPERTY_VALUE_MAX];
227
228 if (!force) {
229 property_get("persist.bandwidth.enable", value, "1");
230 if (!strcmp(value, "0"))
231 return 0;
232 }
JP Abgrall8a932722011-07-13 19:17:35 -0700233
JP Abgralldb7da582011-09-18 12:57:32 -0700234 /* Let's pretend we started from scratch ... */
JP Abgrall8a932722011-07-13 19:17:35 -0700235 sharedQuotaIfaces.clear();
236 quotaIfaces.clear();
237 naughtyAppUids.clear();
JP Abgralldb7da582011-09-18 12:57:32 -0700238 globalAlertBytes = 0;
JP Abgrallc6c67342011-10-07 16:28:54 -0700239 globalAlertTetherCount = 0;
JP Abgralldb7da582011-09-18 12:57:32 -0700240 sharedQuotaBytes = sharedAlertBytes = 0;
241
JP Abgrall0031cea2012-04-17 16:38:23 -0700242 res = runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
243 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgralldb7da582011-09-18 12:57:32 -0700244
JP Abgrall0031cea2012-04-17 16:38:23 -0700245 res |= runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
JP Abgralldb7da582011-09-18 12:57:32 -0700246 IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
JP Abgrall8a932722011-07-13 19:17:35 -0700247
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700248 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700249
250}
251
252int BandwidthController::disableBandwidthControl(void) {
JP Abgrall0031cea2012-04-17 16:38:23 -0700253 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
254 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700255 return 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700256}
257
JP Abgrall8a932722011-07-13 19:17:35 -0700258int BandwidthController::runCommands(int numCommands, const char *commands[],
259 RunCmdErrHandling cmdErrHandling) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700260 int res = 0;
JP Abgrallad729ac2012-04-24 23:27:44 -0700261 IptFailureLog failureLogging = IptFailShow;
262 if (cmdErrHandling == RunCmdFailureOk) {
263 failureLogging = IptFailHide;
264 }
Steve Block3fb42e02011-10-20 11:55:56 +0100265 ALOGV("runCommands(): %d commands", numCommands);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700266 for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
JP Abgrallad729ac2012-04-24 23:27:44 -0700267 res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd, failureLogging);
JP Abgrall0031cea2012-04-17 16:38:23 -0700268 if (res && cmdErrHandling != RunCmdFailureOk)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700269 return res;
270 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700271 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700272}
273
JP Abgrall0dad7c22011-06-24 11:58:14 -0700274std::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700275 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700276 char *buff;
277 const char *opFlag;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700278
279 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700280 case IptOpInsert:
281 opFlag = "-I";
282 break;
283 case IptOpReplace:
284 opFlag = "-R";
285 break;
286 default:
287 case IptOpDelete:
288 opFlag = "-D";
289 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700290 }
JP Abgrall8a932722011-07-13 19:17:35 -0700291 asprintf(&buff, "%s penalty_box -m owner --uid-owner %d", opFlag, uid);
292 res = buff;
293 free(buff);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700294 return res;
295}
296
297int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700298 return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700299}
300
301int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700302 return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700303}
304
JP Abgrall26e0d492011-06-24 19:21:51 -0700305int BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700306 char cmd[MAX_CMD_LEN];
307 int uidNum;
JP Abgrall26e0d492011-06-24 19:21:51 -0700308 const char *failLogTemplate;
309 IptOp op;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700310 int appUids[numUids];
JP Abgrall26e0d492011-06-24 19:21:51 -0700311 std::string naughtyCmd;
JP Abgrallb1d24092012-04-27 01:02:31 -0700312 std::list<int /*uid*/>::iterator it;
JP Abgrall8a932722011-07-13 19:17:35 -0700313
JP Abgrall26e0d492011-06-24 19:21:51 -0700314 switch (appOp) {
315 case NaughtyAppOpAdd:
JP Abgrall8a932722011-07-13 19:17:35 -0700316 op = IptOpInsert;
317 failLogTemplate = "Failed to add app uid %d to penalty box.";
318 break;
JP Abgrall26e0d492011-06-24 19:21:51 -0700319 case NaughtyAppOpRemove:
JP Abgrall8a932722011-07-13 19:17:35 -0700320 op = IptOpDelete;
321 failLogTemplate = "Failed to delete app uid %d from penalty box.";
322 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700323 default:
324 ALOGE("Unexpected app Op %d", appOp);
325 return -1;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700326 }
327
328 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700329 appUids[uidNum] = atol(appStrUids[uidNum]);
330 if (appUids[uidNum] == 0) {
Steve Block5ea0c052012-01-06 19:18:11 +0000331 ALOGE(failLogTemplate, appUids[uidNum]);
JP Abgrall26e0d492011-06-24 19:21:51 -0700332 goto fail_parse;
333 }
334 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700335
336 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700337 int uid = appUids[uidNum];
338 for (it = naughtyAppUids.begin(); it != naughtyAppUids.end(); it++) {
339 if (*it == uid)
340 break;
341 }
342 bool found = (it != naughtyAppUids.end());
343
344 if (appOp == NaughtyAppOpRemove) {
345 if (!found) {
346 ALOGE("No such appUid %d to remove", uid);
347 return -1;
348 }
349 naughtyAppUids.erase(it);
350 } else {
351 if (found) {
352 ALOGE("appUid %d exists already", uid);
353 return -1;
354 }
355 naughtyAppUids.push_front(uid);
356 }
357
358 naughtyCmd = makeIptablesNaughtyCmd(op, uid);
JP Abgrall26e0d492011-06-24 19:21:51 -0700359 if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700360 ALOGE(failLogTemplate, uid);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700361 goto fail_with_uidNum;
362 }
363 }
364 return 0;
365
JP Abgrall26e0d492011-06-24 19:21:51 -0700366fail_with_uidNum:
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700367 /* Try to remove the uid that failed in any case*/
JP Abgrall26e0d492011-06-24 19:21:51 -0700368 naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]);
369 runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd);
370fail_parse:
371 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700372}
373
JP Abgrall26e0d492011-06-24 19:21:51 -0700374std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700375 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700376 char *buff;
377 const char *opFlag;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700378
Steve Block3fb42e02011-10-20 11:55:56 +0100379 ALOGV("makeIptablesQuotaCmd(%d, %lld)", op, quota);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700380
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700381 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700382 case IptOpInsert:
383 opFlag = "-I";
384 break;
385 case IptOpReplace:
386 opFlag = "-R";
387 break;
388 default:
389 case IptOpDelete:
390 opFlag = "-D";
391 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700392 }
JP Abgrall8a932722011-07-13 19:17:35 -0700393
JP Abgrallbfa74662011-06-29 19:23:04 -0700394 // The requried IP version specific --jump REJECT ... will be added later.
JP Abgrall8a932722011-07-13 19:17:35 -0700395 asprintf(&buff, "%s costly_%s -m quota2 ! --quota %lld --name %s", opFlag, costName, quota,
396 costName);
397 res = buff;
398 free(buff);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700399 return res;
400}
401
JP Abgrall26e0d492011-06-24 19:21:51 -0700402int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700403 char cmd[MAX_CMD_LEN];
JP Abgrall0031cea2012-04-17 16:38:23 -0700404 int res = 0, res1, res2;
JP Abgrall8a932722011-07-13 19:17:35 -0700405 int ruleInsertPos = 1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700406 std::string costString;
407 const char *costCString;
408
JP Abgrall0dad7c22011-06-24 11:58:14 -0700409 /* The "-N costly" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700410 switch (quotaType) {
411 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700412 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700413 costString += ifn;
414 costCString = costString.c_str();
JP Abgrall0031cea2012-04-17 16:38:23 -0700415 /*
416 * Flush the costly_<iface> is allowed to fail in case it didn't exist.
417 * Creating a new one is allowed to fail in case it existed.
418 * This helps with netd restarts.
419 */
420 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700421 res1 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700422 snprintf(cmd, sizeof(cmd), "-N %s", costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700423 res2 = runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700424 res = (res1 && res2) || (!res1 && !res2);
425
JP Abgrall0dad7c22011-06-24 11:58:14 -0700426 snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700427 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall26e0d492011-06-24 19:21:51 -0700428 break;
429 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700430 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700431 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700432 default:
433 ALOGE("Unexpected quotatype %d", quotaType);
434 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700435 }
436
JP Abgrall8a932722011-07-13 19:17:35 -0700437 if (globalAlertBytes) {
438 /* The alert rule comes 1st */
439 ruleInsertPos = 2;
440 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700441
442 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700443 runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700444
445 snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700446 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700447
448 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgrallad729ac2012-04-24 23:27:44 -0700449 runIpxtablesCmd(cmd, IptRejectNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700450
451 snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700452 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700453 return res;
454}
455
JP Abgrall26e0d492011-06-24 19:21:51 -0700456int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700457 char cmd[MAX_CMD_LEN];
458 int res = 0;
459 std::string costString;
460 const char *costCString;
461
JP Abgrall26e0d492011-06-24 19:21:51 -0700462 switch (quotaType) {
463 case QuotaUnique:
JP Abgrallbfa74662011-06-29 19:23:04 -0700464 costString = "costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700465 costString += ifn;
466 costCString = costString.c_str();
JP Abgrall26e0d492011-06-24 19:21:51 -0700467 break;
468 case QuotaShared:
JP Abgrallbfa74662011-06-29 19:23:04 -0700469 costCString = "costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700470 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700471 default:
472 ALOGE("Unexpected quotatype %d", quotaType);
473 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700474 }
475
JP Abgrall0031cea2012-04-17 16:38:23 -0700476 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700477 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700478 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700479 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700480
JP Abgrallbfa74662011-06-29 19:23:04 -0700481 /* The "-N costly_shared" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700482 if (quotaType == QuotaUnique) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700483 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgrall26e0d492011-06-24 19:21:51 -0700484 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgralla9f802c2011-06-29 15:46:45 -0700485 snprintf(cmd, sizeof(cmd), "-X %s", costCString);
486 res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700487 }
488 return res;
489}
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700490
JP Abgrall0dad7c22011-06-24 11:58:14 -0700491int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700492 char cmd[MAX_CMD_LEN];
493 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700494 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700495 std::string quotaCmd;
JP Abgrall8a932722011-07-13 19:17:35 -0700496 std::string ifaceName;
497 ;
JP Abgrallbfa74662011-06-29 19:23:04 -0700498 const char *costName = "shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700499 std::list<std::string>::iterator it;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700500
JP Abgrall8a932722011-07-13 19:17:35 -0700501 if (!maxBytes) {
502 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000503 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700504 return -1;
505 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700506 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000507 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700508 return -1;
509 }
510 ifaceName = ifn;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700511
512 if (maxBytes == -1) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700513 return removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700514 }
515
516 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700517 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
518 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700519 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700520 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700521
JP Abgrall0dad7c22011-06-24 11:58:14 -0700522 if (it == sharedQuotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700523 res |= prepCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700524 if (sharedQuotaIfaces.empty()) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700525 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700526 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700527 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000528 ALOGE("Failed set quota rule");
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700529 goto fail;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700530 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700531 sharedQuotaBytes = maxBytes;
532 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700533 sharedQuotaIfaces.push_front(ifaceName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700534
535 }
536
537 if (maxBytes != sharedQuotaBytes) {
JP Abgrall8a932722011-07-13 19:17:35 -0700538 res |= updateQuota(costName, maxBytes);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700539 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000540 ALOGE("Failed update quota for %s", costName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700541 goto fail;
542 }
543 sharedQuotaBytes = maxBytes;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700544 }
545 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700546
547 fail:
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700548 /*
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700549 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
550 * rules in the kernel to see which ones need cleaning up.
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700551 * For now callers needs to choose if they want to "ndc bandwidth enable"
552 * which resets everything.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700553 */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700554 removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700555 return -1;
556}
557
JP Abgrall8a932722011-07-13 19:17:35 -0700558/* It will also cleanup any shared alerts */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700559int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700560 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700561 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700562 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700563 std::list<std::string>::iterator it;
JP Abgrallbfa74662011-06-29 19:23:04 -0700564 const char *costName = "shared";
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700565
JP Abgrall8a932722011-07-13 19:17:35 -0700566 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000567 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700568 return -1;
569 }
JP Abgrall8a932722011-07-13 19:17:35 -0700570 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700571
JP Abgrall0dad7c22011-06-24 11:58:14 -0700572 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
573 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700574 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700575 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700576 if (it == sharedQuotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000577 ALOGE("No such iface %s to delete", ifn);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700578 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700579 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700580
JP Abgrall26e0d492011-06-24 19:21:51 -0700581 res |= cleanupCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700582 sharedQuotaIfaces.erase(it);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700583
JP Abgrall0dad7c22011-06-24 11:58:14 -0700584 if (sharedQuotaIfaces.empty()) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700585 std::string quotaCmd;
JP Abgrallbfa74662011-06-29 19:23:04 -0700586 quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700587 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700588 sharedQuotaBytes = 0;
589 if (sharedAlertBytes) {
590 removeSharedAlert();
591 sharedAlertBytes = 0;
592 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700593 }
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700594 return res;
595}
JP Abgrall0dad7c22011-06-24 11:58:14 -0700596
597int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
598 char ifn[MAX_IFACENAME_LEN];
599 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700600 std::string ifaceName;
601 const char *costName;
602 std::list<QuotaInfo>::iterator it;
603 std::string quotaCmd;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700604
JP Abgrall8a932722011-07-13 19:17:35 -0700605 if (!maxBytes) {
606 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000607 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700608 return -1;
609 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700610 if (maxBytes == -1) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700611 return removeInterfaceQuota(iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700612 }
613
JP Abgrall8a932722011-07-13 19:17:35 -0700614 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000615 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700616 return -1;
617 }
618 ifaceName = ifn;
619 costName = iface;
620
JP Abgrall0dad7c22011-06-24 11:58:14 -0700621 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700622 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700623 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700624 break;
625 }
626
627 if (it == quotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700628 res |= prepCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700629 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgrall26e0d492011-06-24 19:21:51 -0700630 res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700631 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000632 ALOGE("Failed set quota rule");
JP Abgrall0dad7c22011-06-24 11:58:14 -0700633 goto fail;
634 }
635
JP Abgrall8a932722011-07-13 19:17:35 -0700636 quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
JP Abgrall0dad7c22011-06-24 11:58:14 -0700637
638 } else {
JP Abgrall8a932722011-07-13 19:17:35 -0700639 res |= updateQuota(costName, maxBytes);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700640 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000641 ALOGE("Failed update quota for %s", iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700642 goto fail;
643 }
JP Abgrall8a932722011-07-13 19:17:35 -0700644 it->quota = maxBytes;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700645 }
646 return 0;
647
648 fail:
649 /*
650 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
651 * rules in the kernel to see which ones need cleaning up.
652 * For now callers needs to choose if they want to "ndc bandwidth enable"
653 * which resets everything.
654 */
655 removeInterfaceSharedQuota(ifn);
656 return -1;
657}
658
JP Abgrall8a932722011-07-13 19:17:35 -0700659int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
660 return getInterfaceQuota("shared", bytes);
661}
662
663int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
664 FILE *fp;
665 char *fname;
666 int scanRes;
667
668 asprintf(&fname, "/proc/net/xt_quota/%s", costName);
669 fp = fopen(fname, "r");
670 free(fname);
671 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000672 ALOGE("Reading quota %s failed (%s)", costName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700673 return -1;
674 }
675 scanRes = fscanf(fp, "%lld", bytes);
Steve Block3fb42e02011-10-20 11:55:56 +0100676 ALOGV("Read quota res=%d bytes=%lld", scanRes, *bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700677 fclose(fp);
678 return scanRes == 1 ? 0 : -1;
679}
680
JP Abgrall0dad7c22011-06-24 11:58:14 -0700681int BandwidthController::removeInterfaceQuota(const char *iface) {
682
683 char ifn[MAX_IFACENAME_LEN];
684 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700685 std::string ifaceName;
686 const char *costName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700687 std::list<QuotaInfo>::iterator it;
JP Abgrall26e0d492011-06-24 19:21:51 -0700688
JP Abgrall8a932722011-07-13 19:17:35 -0700689 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000690 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700691 return -1;
692 }
693 ifaceName = ifn;
694 costName = iface;
695
JP Abgrall0dad7c22011-06-24 11:58:14 -0700696 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700697 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700698 break;
699 }
700
701 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000702 ALOGE("No such iface %s to delete", ifn);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700703 return -1;
704 }
705
706 /* This also removes the quota command of CostlyIface chain. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700707 res |= cleanupCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700708
709 quotaIfaces.erase(it);
710
711 return res;
712}
JP Abgrall8a932722011-07-13 19:17:35 -0700713
714int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
715 FILE *fp;
716 char *fname;
717
718 asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
719 fp = fopen(fname, "w");
720 free(fname);
721 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000722 ALOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700723 return -1;
724 }
725 fprintf(fp, "%lld\n", bytes);
726 fclose(fp);
727 return 0;
728}
729
730int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
731 int res = 0;
732 const char *opFlag;
733 char *alertQuotaCmd;
734
735 switch (op) {
736 case IptOpInsert:
737 opFlag = "-I";
738 break;
739 case IptOpReplace:
740 opFlag = "-R";
741 break;
742 default:
743 case IptOpDelete:
744 opFlag = "-D";
745 break;
746 }
747
JP Abgrall92009c82013-02-06 18:01:24 -0800748 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800749 bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700750 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
751 free(alertQuotaCmd);
JP Abgrall92009c82013-02-06 18:01:24 -0800752 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800753 bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700754 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
755 free(alertQuotaCmd);
756 return res;
757}
758
JP Abgrallc6c67342011-10-07 16:28:54 -0700759int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
760 int res = 0;
761 const char *opFlag;
JP Abgrall8a932722011-07-13 19:17:35 -0700762 char *alertQuotaCmd;
JP Abgrallc6c67342011-10-07 16:28:54 -0700763
764 switch (op) {
765 case IptOpInsert:
766 opFlag = "-I";
767 break;
768 case IptOpReplace:
769 opFlag = "-R";
770 break;
771 default:
772 case IptOpDelete:
773 opFlag = "-D";
774 break;
775 }
776
JP Abgrall92009c82013-02-06 18:01:24 -0800777 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800778 bytes, alertName);
JP Abgrallc6c67342011-10-07 16:28:54 -0700779 res = runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
780 free(alertQuotaCmd);
781 return res;
782}
783
784int BandwidthController::setGlobalAlert(int64_t bytes) {
785 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700786 int res = 0;
787
788 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000789 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700790 return -1;
791 }
792 if (globalAlertBytes) {
793 res = updateQuota(alertName, bytes);
794 } else {
795 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700796 if (globalAlertTetherCount) {
Steve Block3fb42e02011-10-20 11:55:56 +0100797 ALOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700798 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
799 }
JP Abgrall8a932722011-07-13 19:17:35 -0700800 }
801 globalAlertBytes = bytes;
802 return res;
803}
804
JP Abgrallc6c67342011-10-07 16:28:54 -0700805int BandwidthController::setGlobalAlertInForwardChain(void) {
806 const char *alertName = ALERT_GLOBAL_NAME;
807 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700808
JP Abgrallc6c67342011-10-07 16:28:54 -0700809 globalAlertTetherCount++;
Steve Block3fb42e02011-10-20 11:55:56 +0100810 ALOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700811
812 /*
813 * If there is no globalAlert active we are done.
814 * If there is an active globalAlert but this is not the 1st
815 * tether, we are also done.
816 */
817 if (!globalAlertBytes || globalAlertTetherCount != 1) {
818 return 0;
819 }
820
821 /* We only add the rule if this was the 1st tether added. */
822 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
823 return res;
824}
825
826int BandwidthController::removeGlobalAlert(void) {
827
828 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700829 int res = 0;
830
831 if (!globalAlertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000832 ALOGE("No prior alert set");
JP Abgrall8a932722011-07-13 19:17:35 -0700833 return -1;
834 }
835 res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700836 if (globalAlertTetherCount) {
837 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
838 }
JP Abgrall8a932722011-07-13 19:17:35 -0700839 globalAlertBytes = 0;
840 return res;
841}
842
JP Abgrallc6c67342011-10-07 16:28:54 -0700843int BandwidthController::removeGlobalAlertInForwardChain(void) {
844 int res = 0;
845 const char *alertName = ALERT_GLOBAL_NAME;
846
847 if (!globalAlertTetherCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000848 ALOGE("No prior alert set");
JP Abgrallc6c67342011-10-07 16:28:54 -0700849 return -1;
850 }
851
852 globalAlertTetherCount--;
853 /*
854 * If there is no globalAlert active we are done.
855 * If there is an active globalAlert but there are more
856 * tethers, we are also done.
857 */
858 if (!globalAlertBytes || globalAlertTetherCount >= 1) {
859 return 0;
860 }
861
862 /* We only detete the rule if this was the last tether removed. */
863 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
864 return res;
865}
866
JP Abgrall8a932722011-07-13 19:17:35 -0700867int BandwidthController::setSharedAlert(int64_t bytes) {
868 if (!sharedQuotaBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000869 ALOGE("Need to have a prior shared quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700870 return -1;
871 }
872 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000873 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700874 return -1;
875 }
876 return setCostlyAlert("shared", bytes, &sharedAlertBytes);
877}
878
879int BandwidthController::removeSharedAlert(void) {
880 return removeCostlyAlert("shared", &sharedAlertBytes);
881}
882
883int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
884 std::list<QuotaInfo>::iterator it;
885
886 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000887 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700888 return -1;
889 }
890 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
891 if (it->ifaceName == iface)
892 break;
893 }
894
895 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000896 ALOGE("Need to have a prior interface quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -0700897 return -1;
898 }
899
900 return setCostlyAlert(iface, bytes, &it->alert);
901}
902
903int BandwidthController::removeInterfaceAlert(const char *iface) {
904 std::list<QuotaInfo>::iterator it;
905
906 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
907 if (it->ifaceName == iface)
908 break;
909 }
910
911 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000912 ALOGE("No prior alert set for interface %s", iface);
JP Abgrall8a932722011-07-13 19:17:35 -0700913 return -1;
914 }
915
916 return removeCostlyAlert(iface, &it->alert);
917}
918
919int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
920 char *alertQuotaCmd;
921 char *chainNameAndPos;
922 int res = 0;
923 char *alertName;
924
925 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000926 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700927 return -1;
928 }
929 asprintf(&alertName, "%sAlert", costName);
930 if (*alertBytes) {
931 res = updateQuota(alertName, *alertBytes);
932 } else {
933 asprintf(&chainNameAndPos, "costly_%s %d", costName, ALERT_RULE_POS_IN_COSTLY_CHAIN);
JP Abgrall92009c82013-02-06 18:01:24 -0800934 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-I", chainNameAndPos, bytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700935 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
936 free(alertQuotaCmd);
937 free(chainNameAndPos);
938 }
939 *alertBytes = bytes;
940 free(alertName);
941 return res;
942}
943
944int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
945 char *alertQuotaCmd;
946 char *chainName;
947 char *alertName;
948 int res = 0;
949
950 asprintf(&alertName, "%sAlert", costName);
951 if (!*alertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000952 ALOGE("No prior alert set for %s alert", costName);
JP Abgrall8a932722011-07-13 19:17:35 -0700953 return -1;
954 }
955
956 asprintf(&chainName, "costly_%s", costName);
JP Abgrall92009c82013-02-06 18:01:24 -0800957 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
JP Abgrall8a932722011-07-13 19:17:35 -0700958 res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
959 free(alertQuotaCmd);
960 free(chainName);
961
962 *alertBytes = 0;
963 free(alertName);
964 return res;
965}
JP Abgralldb7da582011-09-18 12:57:32 -0700966
967/*
968 * Parse the ptks and bytes out of:
JP Abgrall0031cea2012-04-17 16:38:23 -0700969 * Chain FORWARD (policy RETURN 0 packets, 0 bytes)
JP Abgralldb7da582011-09-18 12:57:32 -0700970 * pkts bytes target prot opt in out source destination
JP Abgrall0031cea2012-04-17 16:38:23 -0700971 * 0 0 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
JP Abgralldb7da582011-09-18 12:57:32 -0700972 * 0 0 DROP all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 state INVALID
JP Abgrall0031cea2012-04-17 16:38:23 -0700973 * 0 0 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
JP Abgralldb7da582011-09-18 12:57:32 -0700974 *
975 */
JP Abgralla2a64f02011-11-11 20:36:16 -0800976int BandwidthController::parseForwardChainStats(TetherStats &stats, FILE *fp,
977 std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -0700978 int res;
979 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
980 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
981 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
982 char rest[MAX_IPT_OUTPUT_LINE_LEN];
983
984 char *buffPtr;
985 int64_t packets, bytes;
986
987 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
988 /* Clean up, so a failed parse can still print info */
989 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700990 res = sscanf(buffPtr, "%lld %lld RETURN all -- %s %s 0.%s",
JP Abgralldb7da582011-09-18 12:57:32 -0700991 &packets, &bytes, iface0, iface1, rest);
Steve Block3fb42e02011-10-20 11:55:56 +0100992 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%lld bytes=%lld rest=<%s> orig line=<%s>", res,
JP Abgralldb7da582011-09-18 12:57:32 -0700993 iface0, iface1, packets, bytes, rest, buffPtr);
JP Abgralla2a64f02011-11-11 20:36:16 -0800994 extraProcessingInfo += buffPtr;
995
JP Abgralldb7da582011-09-18 12:57:32 -0700996 if (res != 5) {
997 continue;
998 }
999 if ((stats.ifaceIn == iface0) && (stats.ifaceOut == iface1)) {
Steve Block3fb42e02011-10-20 11:55:56 +01001000 ALOGV("iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
JP Abgralldb7da582011-09-18 12:57:32 -07001001 stats.rxPackets = packets;
1002 stats.rxBytes = bytes;
1003 } else if ((stats.ifaceOut == iface0) && (stats.ifaceIn == iface1)) {
Steve Block3fb42e02011-10-20 11:55:56 +01001004 ALOGV("iface_in=%s iface_out=%s tx_bytes=%lld tx_packets=%lld ", iface1, iface0, bytes, packets);
JP Abgralldb7da582011-09-18 12:57:32 -07001005 stats.txPackets = packets;
1006 stats.txBytes = bytes;
1007 }
1008 }
1009 /* Failure if rx or tx was not found */
1010 return (stats.rxBytes == -1 || stats.txBytes == -1) ? -1 : 0;
1011}
1012
1013
1014char *BandwidthController::TetherStats::getStatsLine(void) {
1015 char *msg;
1016 asprintf(&msg, "%s %s %lld %lld %lld %lld", ifaceIn.c_str(), ifaceOut.c_str(),
1017 rxBytes, rxPackets, txBytes, txPackets);
1018 return msg;
1019}
1020
JP Abgralla2a64f02011-11-11 20:36:16 -08001021int BandwidthController::getTetherStats(TetherStats &stats, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001022 int res;
1023 std::string fullCmd;
1024 FILE *iptOutput;
1025 const char *cmd;
1026
1027 if (stats.rxBytes != -1 || stats.txBytes != -1) {
Steve Block5ea0c052012-01-06 19:18:11 +00001028 ALOGE("Unexpected input stats. Byte counts should be -1.");
JP Abgralldb7da582011-09-18 12:57:32 -07001029 return -1;
1030 }
1031
1032 /*
1033 * Why not use some kind of lib to talk to iptables?
1034 * Because the only libs are libiptc and libip6tc in iptables, and they are
1035 * not easy to use. They require the known iptables match modules to be
1036 * preloaded/linked, and require apparently a lot of wrapper code to get
1037 * the wanted info.
1038 */
1039 fullCmd = IPTABLES_PATH;
JP Abgrall0031cea2012-04-17 16:38:23 -07001040 fullCmd += " -nvx -L natctrl_FORWARD";
JP Abgralldb7da582011-09-18 12:57:32 -07001041 iptOutput = popen(fullCmd.c_str(), "r");
1042 if (!iptOutput) {
Steve Block5ea0c052012-01-06 19:18:11 +00001043 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
JP Abgralla2a64f02011-11-11 20:36:16 -08001044 extraProcessingInfo += "Failed to run iptables.";
JP Abgralldb7da582011-09-18 12:57:32 -07001045 return -1;
1046 }
JP Abgralla2a64f02011-11-11 20:36:16 -08001047 res = parseForwardChainStats(stats, iptOutput, extraProcessingInfo);
JP Abgralldb7da582011-09-18 12:57:32 -07001048 pclose(iptOutput);
1049
1050 /* Currently NatController doesn't do ipv6 tethering, so we are done. */
1051 return res;
1052}