blob: 84b1914a54785c67fca46acb8f19ee39557d4f01 [file] [log] [blame]
JP Abgrall4a5f5ca2011-06-15 18:37:39 -07001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
JP Abgralle4788732013-07-02 20:28:45 -070017// #define LOG_NDEBUG 0
JP Abgralldb7da582011-09-18 12:57:32 -070018
19/*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
JP Abgrall8a932722011-07-13 19:17:35 -070025#include <errno.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070026#include <fcntl.h>
JP Abgralldb7da582011-09-18 12:57:32 -070027#include <stdio.h>
JP Abgrall8a932722011-07-13 19:17:35 -070028#include <stdlib.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070029#include <string.h>
Nick Kralevich0b2b9022014-05-01 13:10:45 -070030#include <ctype.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070031
Matthew Leach2a54d962013-01-14 15:07:12 +000032#define __STDC_FORMAT_MACROS 1
33#include <inttypes.h>
34
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070035#include <sys/socket.h>
36#include <sys/stat.h>
37#include <sys/types.h>
38#include <sys/wait.h>
39
40#include <linux/netlink.h>
41#include <linux/rtnetlink.h>
42#include <linux/pkt_sched.h>
43
44#define LOG_TAG "BandwidthController"
45#include <cutils/log.h>
46#include <cutils/properties.h>
Rom Lemarchand14150212013-01-24 10:01:04 -080047#include <logwrap/logwrap.h>
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070048
JP Abgrall0031cea2012-04-17 16:38:23 -070049#include "NetdConstants.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070050#include "BandwidthController.h"
JP Abgrallbaeccc42013-06-25 09:44:10 -070051#include "NatController.h" /* For LOCAL_TETHER_COUNTERS_CHAIN */
52#include "ResponseCode.h"
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070053
JP Abgralldb7da582011-09-18 12:57:32 -070054/* Alphabetical */
SynergyDev7776cea2014-03-16 15:48:51 -070055#define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %" PRId64" --name %s"
JP Abgrallc6c67342011-10-07 16:28:54 -070056const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
Jeff Sharkey8e188ed2012-07-12 18:32:03 -070057const char* BandwidthController::LOCAL_INPUT = "bw_INPUT";
58const char* BandwidthController::LOCAL_FORWARD = "bw_FORWARD";
59const char* BandwidthController::LOCAL_OUTPUT = "bw_OUTPUT";
60const char* BandwidthController::LOCAL_RAW_PREROUTING = "bw_raw_PREROUTING";
61const char* BandwidthController::LOCAL_MANGLE_POSTROUTING = "bw_mangle_POSTROUTING";
JP Abgralldb7da582011-09-18 12:57:32 -070062const int BandwidthController::MAX_CMD_ARGS = 32;
63const int BandwidthController::MAX_CMD_LEN = 1024;
64const int BandwidthController::MAX_IFACENAME_LEN = 64;
65const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
66
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070067/**
68 * Some comments about the rules:
69 * * Ordering
70 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
JP Abgrall29e8de22012-05-03 12:52:15 -070071 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
JP Abgrall7e51cde2013-07-03 13:33:05 -070072 * - quota'd rules in the costly chain should be before bw_penalty_box lookups.
73 * - bw_happy_box rejects everything by default.
JP Abgrall29e8de22012-05-03 12:52:15 -070074 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070075 *
76 * * global quota vs per interface quota
77 * - global quota for all costly interfaces uses a single costly chain:
78 * . initial rules
JP Abgrall7e51cde2013-07-03 13:33:05 -070079 * iptables -N bw_costly_shared
80 * iptables -I bw_INPUT -i iface0 --jump bw_costly_shared
81 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_shared
82 * iptables -I bw_costly_shared -m quota \! --quota 500000 \
JP Abgrallbfa74662011-06-29 19:23:04 -070083 * --jump REJECT --reject-with icmp-net-prohibited
JP Abgrall7e51cde2013-07-03 13:33:05 -070084 * iptables -A bw_costly_shared --jump bw_penalty_box
JP Abgralle4788732013-07-02 20:28:45 -070085 * If the happy box is enabled,
JP Abgrall7e51cde2013-07-03 13:33:05 -070086 * iptables -A bw_penalty_box --jump bw_happy_box
JP Abgrall8a932722011-07-13 19:17:35 -070087 *
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070088 * . adding a new iface to this, E.g.:
JP Abgrall7e51cde2013-07-03 13:33:05 -070089 * iptables -I bw_INPUT -i iface1 --jump bw_costly_shared
90 * iptables -I bw_OUTPUT -o iface1 --jump bw_costly_shared
JP Abgrall4a5f5ca2011-06-15 18:37:39 -070091 *
92 * - quota per interface. This is achieve by having "costly" chains per quota.
93 * E.g. adding a new costly interface iface0 with its own quota:
JP Abgrall7e51cde2013-07-03 13:33:05 -070094 * iptables -N bw_costly_iface0
95 * iptables -I bw_INPUT -i iface0 --jump bw_costly_iface0
96 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_iface0
97 * iptables -A bw_costly_iface0 -m quota \! --quota 500000 \
JP Abgralle4788732013-07-02 20:28:45 -070098 * --jump REJECT --reject-with icmp-port-unreachable
JP Abgrall7e51cde2013-07-03 13:33:05 -070099 * iptables -A bw_costly_iface0 --jump bw_penalty_box
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700100 *
JP Abgrall7e51cde2013-07-03 13:33:05 -0700101 * * bw_penalty_box handling:
102 * - only one bw_penalty_box for all interfaces
103 * E.g Adding an app, it has to preserve the appened bw_happy_box, so "-I":
104 * iptables -I bw_penalty_box -m owner --uid-owner app_3 \
JP Abgralle4788732013-07-02 20:28:45 -0700105 * --jump REJECT --reject-with icmp-port-unreachable
106 *
JP Abgrall7e51cde2013-07-03 13:33:05 -0700107 * * bw_happy_box handling:
108 * - The bw_happy_box goes at the end of the penalty box.
JP Abgralle4788732013-07-02 20:28:45 -0700109 * E.g Adding a happy app,
JP Abgrall7e51cde2013-07-03 13:33:05 -0700110 * iptables -I bw_happy_box -m owner --uid-owner app_3 \
JP Abgralle4788732013-07-02 20:28:45 -0700111 * --jump RETURN
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700112 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700113const char *BandwidthController::IPT_FLUSH_COMMANDS[] = {
114 /*
115 * Cleanup rules.
JP Abgrall7e51cde2013-07-03 13:33:05 -0700116 * Should normally include bw_costly_<iface>, but we rely on the way they are setup
JP Abgrall0031cea2012-04-17 16:38:23 -0700117 * to allow coexistance.
JP Abgrall39f8f242011-06-29 19:21:58 -0700118 */
JP Abgrall0031cea2012-04-17 16:38:23 -0700119 "-F bw_INPUT",
120 "-F bw_OUTPUT",
121 "-F bw_FORWARD",
JP Abgrall7e51cde2013-07-03 13:33:05 -0700122 "-F bw_happy_box",
123 "-F bw_penalty_box",
124 "-F bw_costly_shared",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700125
126 "-t raw -F bw_raw_PREROUTING",
127 "-t mangle -F bw_mangle_POSTROUTING",
JP Abgrall0031cea2012-04-17 16:38:23 -0700128};
129
130/* The cleanup commands assume flushing has been done. */
131const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700132 "-X bw_happy_box",
133 "-X bw_penalty_box",
134 "-X bw_costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700135};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700136
JP Abgralldb7da582011-09-18 12:57:32 -0700137const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700138 "-N bw_happy_box",
139 "-N bw_penalty_box",
140 "-N bw_costly_shared",
JP Abgrall0dad7c22011-06-24 11:58:14 -0700141};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700142
JP Abgralldb7da582011-09-18 12:57:32 -0700143const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
JP Abgrall0031cea2012-04-17 16:38:23 -0700144 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700145
JP Abgrall0031cea2012-04-17 16:38:23 -0700146 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700147
JP Abgrall7e51cde2013-07-03 13:33:05 -0700148 "-A bw_costly_shared --jump bw_penalty_box",
JP Abgrallf66d6e92012-04-27 00:22:57 -0700149
JP Abgrall92009c82013-02-06 18:01:24 -0800150 "-t raw -A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
151 "-t mangle -A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700152};
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700153
154BandwidthController::BandwidthController(void) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700155}
156
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700157int BandwidthController::runIpxtablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700158 IptFailureLog failureHandling) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700159 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700160
Steve Block3fb42e02011-10-20 11:55:56 +0100161 ALOGV("runIpxtablesCmd(cmd=%s)", cmd);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700162 res |= runIptablesCmd(cmd, jumpHandling, IptIpV4, failureHandling);
163 res |= runIptablesCmd(cmd, jumpHandling, IptIpV6, failureHandling);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700164 return res;
165}
166
JP Abgrall26e0d492011-06-24 19:21:51 -0700167int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
168
169 memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
170 strncpy(buffer, src, buffSize);
171 return buffer[buffSize - 1];
172}
173
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700174int BandwidthController::runIptablesCmd(const char *cmd, IptJumpOp jumpHandling,
JP Abgrallad729ac2012-04-24 23:27:44 -0700175 IptIpVer iptVer, IptFailureLog failureHandling) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700176 char buffer[MAX_CMD_LEN];
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700177 const char *argv[MAX_CMD_ARGS];
JP Abgrall26e0d492011-06-24 19:21:51 -0700178 int argc = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700179 char *next = buffer;
180 char *tmp;
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700181 int res;
Rom Lemarchand14150212013-01-24 10:01:04 -0800182 int status = 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700183
JP Abgrall0dad7c22011-06-24 11:58:14 -0700184 std::string fullCmd = cmd;
JP Abgrall26e0d492011-06-24 19:21:51 -0700185
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700186 switch (jumpHandling) {
187 case IptJumpReject:
JP Abgrall340d5cc2013-06-28 17:06:00 -0700188 /*
189 * Must be carefull what one rejects with, as uper layer protocols will just
190 * keep on hammering the device until the number of retries are done.
191 * For port-unreachable (default), TCP should consider as an abort (RFC1122).
192 */
193 fullCmd += " --jump REJECT";
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700194 break;
195 case IptJumpReturn:
196 fullCmd += " --jump RETURN";
197 break;
198 case IptJumpNoAdd:
199 break;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700200 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700201
Paul Jensen94b2ab92015-08-04 10:35:05 -0400202 fullCmd.insert(0, " -w ");
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700203 fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700204
Rom Lemarchand14150212013-01-24 10:01:04 -0800205 if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
206 ALOGE("iptables command too long");
207 return -1;
208 }
209
210 argc = 0;
211 while ((tmp = strsep(&next, " "))) {
212 argv[argc++] = tmp;
213 if (argc >= MAX_CMD_ARGS) {
214 ALOGE("iptables argument overflow");
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700215 return -1;
216 }
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700217 }
Rom Lemarchand14150212013-01-24 10:01:04 -0800218
219 argv[argc] = NULL;
220 res = android_fork_execvp(argc, (char **)argv, &status, false,
221 failureHandling == IptFailShow);
JP Abgrallc8dc63b2013-02-13 16:30:00 -0800222 res = res || !WIFEXITED(status) || WEXITSTATUS(status);
223 if (res && failureHandling == IptFailShow) {
224 ALOGE("runIptablesCmd(): res=%d status=%d failed %s", res, status,
225 fullCmd.c_str());
JP Abgrall11b4e9b2011-08-11 15:34:49 -0700226 }
227 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700228}
229
JP Abgrall0e540ec2013-08-26 15:13:10 -0700230void BandwidthController::flushCleanTables(bool doClean) {
231 /* Flush and remove the bw_costly_<iface> tables */
232 flushExistingCostlyTables(doClean);
JP Abgrall0031cea2012-04-17 16:38:23 -0700233
234 /* Some of the initialCommands are allowed to fail */
235 runCommands(sizeof(IPT_FLUSH_COMMANDS) / sizeof(char*),
236 IPT_FLUSH_COMMANDS, RunCmdFailureOk);
237
JP Abgrall0e540ec2013-08-26 15:13:10 -0700238 if (doClean) {
239 runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
240 IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
241 }
242}
JP Abgrall0031cea2012-04-17 16:38:23 -0700243
JP Abgrall0e540ec2013-08-26 15:13:10 -0700244int BandwidthController::setupIptablesHooks(void) {
245
246 /* flush+clean is allowed to fail */
247 flushCleanTables(true);
JP Abgrall0031cea2012-04-17 16:38:23 -0700248 runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
249 IPT_SETUP_COMMANDS, RunCmdFailureBad);
250
251 return 0;
JP Abgrall0031cea2012-04-17 16:38:23 -0700252}
253
254int BandwidthController::enableBandwidthControl(bool force) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700255 int res;
JP Abgrall0031cea2012-04-17 16:38:23 -0700256 char value[PROPERTY_VALUE_MAX];
257
258 if (!force) {
259 property_get("persist.bandwidth.enable", value, "1");
260 if (!strcmp(value, "0"))
261 return 0;
262 }
JP Abgrall8a932722011-07-13 19:17:35 -0700263
JP Abgralldb7da582011-09-18 12:57:32 -0700264 /* Let's pretend we started from scratch ... */
JP Abgrall8a932722011-07-13 19:17:35 -0700265 sharedQuotaIfaces.clear();
266 quotaIfaces.clear();
267 naughtyAppUids.clear();
JP Abgralle4788732013-07-02 20:28:45 -0700268 niceAppUids.clear();
JP Abgralldb7da582011-09-18 12:57:32 -0700269 globalAlertBytes = 0;
JP Abgrallc6c67342011-10-07 16:28:54 -0700270 globalAlertTetherCount = 0;
JP Abgralldb7da582011-09-18 12:57:32 -0700271 sharedQuotaBytes = sharedAlertBytes = 0;
272
JP Abgrall0e540ec2013-08-26 15:13:10 -0700273 flushCleanTables(false);
274 res = runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
JP Abgralldb7da582011-09-18 12:57:32 -0700275 IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
JP Abgrall8a932722011-07-13 19:17:35 -0700276
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700277 return res;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700278
279}
280
281int BandwidthController::disableBandwidthControl(void) {
JP Abgrall0e540ec2013-08-26 15:13:10 -0700282
283 flushCleanTables(false);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700284 return 0;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700285}
286
JP Abgrall8a932722011-07-13 19:17:35 -0700287int BandwidthController::runCommands(int numCommands, const char *commands[],
288 RunCmdErrHandling cmdErrHandling) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700289 int res = 0;
JP Abgrallad729ac2012-04-24 23:27:44 -0700290 IptFailureLog failureLogging = IptFailShow;
291 if (cmdErrHandling == RunCmdFailureOk) {
292 failureLogging = IptFailHide;
293 }
Steve Block3fb42e02011-10-20 11:55:56 +0100294 ALOGV("runCommands(): %d commands", numCommands);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700295 for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700296 res = runIpxtablesCmd(commands[cmdNum], IptJumpNoAdd, failureLogging);
JP Abgrall0031cea2012-04-17 16:38:23 -0700297 if (res && cmdErrHandling != RunCmdFailureOk)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700298 return res;
299 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700300 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700301}
302
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700303std::string BandwidthController::makeIptablesSpecialAppCmd(IptOp op, int uid, const char *chain) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700304 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700305 char *buff;
306 const char *opFlag;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700307
308 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700309 case IptOpInsert:
310 opFlag = "-I";
311 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800312 case IptOpAppend:
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700313 ALOGE("Append op not supported for %s uids", chain);
314 res = "";
315 return res;
JP Abgrall109899b2013-02-12 19:20:13 -0800316 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700317 case IptOpReplace:
318 opFlag = "-R";
319 break;
320 default:
321 case IptOpDelete:
322 opFlag = "-D";
323 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700324 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700325 asprintf(&buff, "%s %s -m owner --uid-owner %d", opFlag, chain, uid);
JP Abgrall8a932722011-07-13 19:17:35 -0700326 res = buff;
327 free(buff);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700328 return res;
329}
330
JP Abgralle4788732013-07-02 20:28:45 -0700331int BandwidthController::enableHappyBox(void) {
332 char cmd[MAX_CMD_LEN];
333 int res = 0;
334
335 /*
336 * We tentatively delete before adding, which helps recovering
337 * from bad states (e.g. netd died).
338 */
339
340 /* Should not exist, but ignore result if already there. */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700341 snprintf(cmd, sizeof(cmd), "-N bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700342 runIpxtablesCmd(cmd, IptJumpNoAdd);
343
344 /* Should be empty, but clear in case something was wrong. */
345 niceAppUids.clear();
JP Abgrall7e51cde2013-07-03 13:33:05 -0700346 snprintf(cmd, sizeof(cmd), "-F bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700347 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
348
JP Abgrall7e51cde2013-07-03 13:33:05 -0700349 snprintf(cmd, sizeof(cmd), "-D bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700350 runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall7e51cde2013-07-03 13:33:05 -0700351 snprintf(cmd, sizeof(cmd), "-A bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700352 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
353
Felipe Leme5ebbbd82016-03-07 09:25:50 -0800354 /* Whitelist all system apps. */
355 snprintf(cmd, sizeof(cmd),
356 "-A bw_happy_box -m owner --uid-owner %d-%d -j RETURN", 0, MAX_SYSTEM_UID);
357 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
358
JP Abgralle4788732013-07-02 20:28:45 -0700359 /* Reject. Defaulting to prot-unreachable */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700360 snprintf(cmd, sizeof(cmd), "-A bw_happy_box -j REJECT");
JP Abgralle4788732013-07-02 20:28:45 -0700361 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
362
363 return res;
364}
365
366int BandwidthController::disableHappyBox(void) {
367 char cmd[MAX_CMD_LEN];
368
369 /* Best effort */
JP Abgrall7e51cde2013-07-03 13:33:05 -0700370 snprintf(cmd, sizeof(cmd), "-D bw_penalty_box -j bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700371 runIpxtablesCmd(cmd, IptJumpNoAdd);
372 niceAppUids.clear();
JP Abgrall7e51cde2013-07-03 13:33:05 -0700373 snprintf(cmd, sizeof(cmd), "-F bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700374 runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall7e51cde2013-07-03 13:33:05 -0700375 snprintf(cmd, sizeof(cmd), "-X bw_happy_box");
JP Abgralle4788732013-07-02 20:28:45 -0700376 runIpxtablesCmd(cmd, IptJumpNoAdd);
377
378 return 0;
379}
380
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700381int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700382 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700383}
384
385int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700386 return manipulateNaughtyApps(numUids, appUids, SpecialAppOpRemove);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700387}
388
JP Abgralle4788732013-07-02 20:28:45 -0700389int BandwidthController::addNiceApps(int numUids, char *appUids[]) {
390 return manipulateNiceApps(numUids, appUids, SpecialAppOpAdd);
391}
392
393int BandwidthController::removeNiceApps(int numUids, char *appUids[]) {
394 return manipulateNiceApps(numUids, appUids, SpecialAppOpRemove);
395}
396
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700397int BandwidthController::manipulateNaughtyApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700398 return manipulateSpecialApps(numUids, appStrUids, "bw_penalty_box", naughtyAppUids, IptJumpReject, appOp);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700399}
400
JP Abgralle4788732013-07-02 20:28:45 -0700401int BandwidthController::manipulateNiceApps(int numUids, char *appStrUids[], SpecialAppOp appOp) {
JP Abgrall7e51cde2013-07-03 13:33:05 -0700402 return manipulateSpecialApps(numUids, appStrUids, "bw_happy_box", niceAppUids, IptJumpReturn, appOp);
JP Abgralle4788732013-07-02 20:28:45 -0700403}
404
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700405
406int BandwidthController::manipulateSpecialApps(int numUids, char *appStrUids[],
407 const char *chain,
408 std::list<int /*appUid*/> &specialAppUids,
409 IptJumpOp jumpHandling, SpecialAppOp appOp) {
410
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700411 int uidNum;
JP Abgrall26e0d492011-06-24 19:21:51 -0700412 const char *failLogTemplate;
413 IptOp op;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700414 int appUids[numUids];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700415 std::string iptCmd;
JP Abgrallb1d24092012-04-27 01:02:31 -0700416 std::list<int /*uid*/>::iterator it;
JP Abgrall8a932722011-07-13 19:17:35 -0700417
JP Abgrall26e0d492011-06-24 19:21:51 -0700418 switch (appOp) {
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700419 case SpecialAppOpAdd:
JP Abgrall8a932722011-07-13 19:17:35 -0700420 op = IptOpInsert;
JP Abgrallaf476f72013-07-03 12:23:55 -0700421 failLogTemplate = "Failed to add app uid %s(%d) to %s.";
JP Abgrall8a932722011-07-13 19:17:35 -0700422 break;
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700423 case SpecialAppOpRemove:
JP Abgrall8a932722011-07-13 19:17:35 -0700424 op = IptOpDelete;
JP Abgrallaf476f72013-07-03 12:23:55 -0700425 failLogTemplate = "Failed to delete app uid %s(%d) from %s box.";
JP Abgrall8a932722011-07-13 19:17:35 -0700426 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700427 default:
428 ALOGE("Unexpected app Op %d", appOp);
429 return -1;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700430 }
431
432 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallaf476f72013-07-03 12:23:55 -0700433 char *end;
434 appUids[uidNum] = strtoul(appStrUids[uidNum], &end, 0);
435 if (*end || !*appStrUids[uidNum]) {
436 ALOGE(failLogTemplate, appStrUids[uidNum], appUids[uidNum], chain);
JP Abgrall26e0d492011-06-24 19:21:51 -0700437 goto fail_parse;
438 }
439 }
JP Abgrall26e0d492011-06-24 19:21:51 -0700440
441 for (uidNum = 0; uidNum < numUids; uidNum++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700442 int uid = appUids[uidNum];
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700443 for (it = specialAppUids.begin(); it != specialAppUids.end(); it++) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700444 if (*it == uid)
445 break;
446 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700447 bool found = (it != specialAppUids.end());
JP Abgrallb1d24092012-04-27 01:02:31 -0700448
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700449 if (appOp == SpecialAppOpRemove) {
JP Abgrallb1d24092012-04-27 01:02:31 -0700450 if (!found) {
451 ALOGE("No such appUid %d to remove", uid);
452 return -1;
453 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700454 specialAppUids.erase(it);
JP Abgrallb1d24092012-04-27 01:02:31 -0700455 } else {
456 if (found) {
457 ALOGE("appUid %d exists already", uid);
458 return -1;
459 }
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700460 specialAppUids.push_front(uid);
JP Abgrallb1d24092012-04-27 01:02:31 -0700461 }
462
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700463 iptCmd = makeIptablesSpecialAppCmd(op, uid, chain);
464 if (runIpxtablesCmd(iptCmd.c_str(), jumpHandling)) {
JP Abgrallaf476f72013-07-03 12:23:55 -0700465 ALOGE(failLogTemplate, appStrUids[uidNum], uid, chain);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700466 goto fail_with_uidNum;
467 }
468 }
469 return 0;
470
JP Abgrall26e0d492011-06-24 19:21:51 -0700471fail_with_uidNum:
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700472 /* Try to remove the uid that failed in any case*/
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700473 iptCmd = makeIptablesSpecialAppCmd(IptOpDelete, appUids[uidNum], chain);
474 runIpxtablesCmd(iptCmd.c_str(), jumpHandling);
JP Abgrall26e0d492011-06-24 19:21:51 -0700475fail_parse:
476 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700477}
478
JP Abgrall26e0d492011-06-24 19:21:51 -0700479std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700480 std::string res;
JP Abgrall8a932722011-07-13 19:17:35 -0700481 char *buff;
482 const char *opFlag;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700483
SynergyDev7776cea2014-03-16 15:48:51 -0700484 ALOGV("makeIptablesQuotaCmd(%d, %" PRId64")", op, quota);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700485
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700486 switch (op) {
JP Abgrall8a932722011-07-13 19:17:35 -0700487 case IptOpInsert:
488 opFlag = "-I";
489 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800490 case IptOpAppend:
491 opFlag = "-A";
492 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700493 case IptOpReplace:
494 opFlag = "-R";
495 break;
496 default:
497 case IptOpDelete:
498 opFlag = "-D";
499 break;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700500 }
JP Abgrall8a932722011-07-13 19:17:35 -0700501
JP Abgrallbfa74662011-06-29 19:23:04 -0700502 // The requried IP version specific --jump REJECT ... will be added later.
SynergyDev7776cea2014-03-16 15:48:51 -0700503 asprintf(&buff, "%s bw_costly_%s -m quota2 ! --quota %" PRId64" --name %s", opFlag, costName, quota,
JP Abgrall8a932722011-07-13 19:17:35 -0700504 costName);
505 res = buff;
506 free(buff);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700507 return res;
508}
509
JP Abgrall26e0d492011-06-24 19:21:51 -0700510int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700511 char cmd[MAX_CMD_LEN];
JP Abgrall0031cea2012-04-17 16:38:23 -0700512 int res = 0, res1, res2;
JP Abgrall8a932722011-07-13 19:17:35 -0700513 int ruleInsertPos = 1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700514 std::string costString;
515 const char *costCString;
516
JP Abgrall0dad7c22011-06-24 11:58:14 -0700517 /* The "-N costly" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700518 switch (quotaType) {
519 case QuotaUnique:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700520 costString = "bw_costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700521 costString += ifn;
522 costCString = costString.c_str();
JP Abgrall0031cea2012-04-17 16:38:23 -0700523 /*
JP Abgrall7e51cde2013-07-03 13:33:05 -0700524 * Flush the bw_costly_<iface> is allowed to fail in case it didn't exist.
JP Abgrall0031cea2012-04-17 16:38:23 -0700525 * Creating a new one is allowed to fail in case it existed.
526 * This helps with netd restarts.
527 */
528 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700529 res1 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700530 snprintf(cmd, sizeof(cmd), "-N %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700531 res2 = runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700532 res = (res1 && res2) || (!res1 && !res2);
533
JP Abgrall7e51cde2013-07-03 13:33:05 -0700534 snprintf(cmd, sizeof(cmd), "-A %s -j bw_penalty_box", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700535 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall26e0d492011-06-24 19:21:51 -0700536 break;
537 case QuotaShared:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700538 costCString = "bw_costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700539 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700540 default:
541 ALOGE("Unexpected quotatype %d", quotaType);
542 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700543 }
544
JP Abgrall8a932722011-07-13 19:17:35 -0700545 if (globalAlertBytes) {
546 /* The alert rule comes 1st */
547 ruleInsertPos = 2;
548 }
JP Abgrall0031cea2012-04-17 16:38:23 -0700549
550 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700551 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700552
553 snprintf(cmd, sizeof(cmd), "-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700554 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrall0031cea2012-04-17 16:38:23 -0700555
556 snprintf(cmd, sizeof(cmd), "-D bw_OUTPUT -o %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700557 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
JP Abgrall0031cea2012-04-17 16:38:23 -0700558
559 snprintf(cmd, sizeof(cmd), "-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700560 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
Erik Kline58a94482015-10-02 17:52:37 +0900561
562 snprintf(cmd, sizeof(cmd), "-D bw_FORWARD -o %s --jump %s", ifn, costCString);
563 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
564 snprintf(cmd, sizeof(cmd), "-A bw_FORWARD -o %s --jump %s", ifn, costCString);
565 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
566
JP Abgrall0dad7c22011-06-24 11:58:14 -0700567 return res;
568}
569
JP Abgrall26e0d492011-06-24 19:21:51 -0700570int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700571 char cmd[MAX_CMD_LEN];
572 int res = 0;
573 std::string costString;
574 const char *costCString;
575
JP Abgrall26e0d492011-06-24 19:21:51 -0700576 switch (quotaType) {
577 case QuotaUnique:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700578 costString = "bw_costly_";
JP Abgrall0dad7c22011-06-24 11:58:14 -0700579 costString += ifn;
580 costCString = costString.c_str();
JP Abgrall26e0d492011-06-24 19:21:51 -0700581 break;
582 case QuotaShared:
JP Abgrall7e51cde2013-07-03 13:33:05 -0700583 costCString = "bw_costly_shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700584 break;
JP Abgrall0031cea2012-04-17 16:38:23 -0700585 default:
586 ALOGE("Unexpected quotatype %d", quotaType);
587 return -1;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700588 }
589
JP Abgrall0031cea2012-04-17 16:38:23 -0700590 snprintf(cmd, sizeof(cmd), "-D bw_INPUT -i %s --jump %s", ifn, costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700591 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
Erik Kline58a94482015-10-02 17:52:37 +0900592 for (const auto tableName : {LOCAL_OUTPUT, LOCAL_FORWARD}) {
593 snprintf(cmd, sizeof(cmd), "-D %s -o %s --jump %s", tableName, ifn, costCString);
594 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
595 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700596
JP Abgrall7e51cde2013-07-03 13:33:05 -0700597 /* The "-N bw_costly_shared" is created upfront, no need to handle it here. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700598 if (quotaType == QuotaUnique) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700599 snprintf(cmd, sizeof(cmd), "-F %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700600 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgralla9f802c2011-06-29 15:46:45 -0700601 snprintf(cmd, sizeof(cmd), "-X %s", costCString);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700602 res |= runIpxtablesCmd(cmd, IptJumpNoAdd);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700603 }
604 return res;
605}
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700606
JP Abgrall0dad7c22011-06-24 11:58:14 -0700607int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700608 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700609 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700610 std::string quotaCmd;
JP Abgrall8a932722011-07-13 19:17:35 -0700611 std::string ifaceName;
612 ;
JP Abgrallbfa74662011-06-29 19:23:04 -0700613 const char *costName = "shared";
JP Abgrall26e0d492011-06-24 19:21:51 -0700614 std::list<std::string>::iterator it;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700615
JP Abgrall8a932722011-07-13 19:17:35 -0700616 if (!maxBytes) {
617 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000618 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700619 return -1;
620 }
JP Abgrall69261cb2014-06-19 18:35:24 -0700621 if (!isIfaceName(iface))
622 return -1;
JP Abgrall26e0d492011-06-24 19:21:51 -0700623 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000624 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700625 return -1;
626 }
627 ifaceName = ifn;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700628
629 if (maxBytes == -1) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700630 return removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700631 }
632
633 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700634 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
635 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700636 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700637 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700638
JP Abgrall0dad7c22011-06-24 11:58:14 -0700639 if (it == sharedQuotaIfaces.end()) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700640 res |= prepCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700641 if (sharedQuotaIfaces.empty()) {
JP Abgrall0dad7c22011-06-24 11:58:14 -0700642 quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700643 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700644 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000645 ALOGE("Failed set quota rule");
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700646 goto fail;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700647 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700648 sharedQuotaBytes = maxBytes;
649 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700650 sharedQuotaIfaces.push_front(ifaceName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700651
652 }
653
654 if (maxBytes != sharedQuotaBytes) {
JP Abgrall8a932722011-07-13 19:17:35 -0700655 res |= updateQuota(costName, maxBytes);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700656 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000657 ALOGE("Failed update quota for %s", costName);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700658 goto fail;
659 }
660 sharedQuotaBytes = maxBytes;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700661 }
662 return 0;
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700663
664 fail:
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700665 /*
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700666 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
667 * rules in the kernel to see which ones need cleaning up.
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700668 * For now callers needs to choose if they want to "ndc bandwidth enable"
669 * which resets everything.
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700670 */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700671 removeInterfaceSharedQuota(ifn);
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700672 return -1;
673}
674
JP Abgrall8a932722011-07-13 19:17:35 -0700675/* It will also cleanup any shared alerts */
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700676int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700677 char ifn[MAX_IFACENAME_LEN];
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700678 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700679 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700680 std::list<std::string>::iterator it;
JP Abgrallbfa74662011-06-29 19:23:04 -0700681 const char *costName = "shared";
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700682
JP Abgrall69261cb2014-06-19 18:35:24 -0700683 if (!isIfaceName(iface))
684 return -1;
JP Abgrall8a932722011-07-13 19:17:35 -0700685 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000686 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700687 return -1;
688 }
JP Abgrall8a932722011-07-13 19:17:35 -0700689 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700690
JP Abgrall0dad7c22011-06-24 11:58:14 -0700691 for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
692 if (*it == ifaceName)
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700693 break;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700694 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700695 if (it == sharedQuotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000696 ALOGE("No such iface %s to delete", ifn);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700697 return -1;
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700698 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700699
JP Abgrall26e0d492011-06-24 19:21:51 -0700700 res |= cleanupCostlyIface(ifn, QuotaShared);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700701 sharedQuotaIfaces.erase(it);
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700702
JP Abgrall0dad7c22011-06-24 11:58:14 -0700703 if (sharedQuotaIfaces.empty()) {
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700704 std::string quotaCmd;
JP Abgrallbfa74662011-06-29 19:23:04 -0700705 quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700706 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall8a932722011-07-13 19:17:35 -0700707 sharedQuotaBytes = 0;
708 if (sharedAlertBytes) {
709 removeSharedAlert();
710 sharedAlertBytes = 0;
711 }
JP Abgrallfa6f46d2011-06-17 23:17:28 -0700712 }
JP Abgrall4a5f5ca2011-06-15 18:37:39 -0700713 return res;
714}
JP Abgrall0dad7c22011-06-24 11:58:14 -0700715
716int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
717 char ifn[MAX_IFACENAME_LEN];
718 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700719 std::string ifaceName;
720 const char *costName;
721 std::list<QuotaInfo>::iterator it;
722 std::string quotaCmd;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700723
JP Abgrall69261cb2014-06-19 18:35:24 -0700724 if (!isIfaceName(iface))
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700725 return -1;
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700726
JP Abgrall8a932722011-07-13 19:17:35 -0700727 if (!maxBytes) {
728 /* Don't talk about -1, deprecate it. */
Steve Block5ea0c052012-01-06 19:18:11 +0000729 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700730 return -1;
731 }
JP Abgrall0dad7c22011-06-24 11:58:14 -0700732 if (maxBytes == -1) {
JP Abgrall26e0d492011-06-24 19:21:51 -0700733 return removeInterfaceQuota(iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700734 }
735
JP Abgrall8a932722011-07-13 19:17:35 -0700736 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000737 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700738 return -1;
739 }
740 ifaceName = ifn;
741 costName = iface;
742
JP Abgrall0dad7c22011-06-24 11:58:14 -0700743 /* Insert ingress quota. */
JP Abgrall0dad7c22011-06-24 11:58:14 -0700744 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700745 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700746 break;
747 }
748
749 if (it == quotaIfaces.end()) {
JP Abgralle4788732013-07-02 20:28:45 -0700750 /* Preparing the iface adds a penalty/happy box check */
JP Abgrall26e0d492011-06-24 19:21:51 -0700751 res |= prepCostlyIface(ifn, QuotaUnique);
JP Abgrallbaeccc42013-06-25 09:44:10 -0700752 /*
JP Abgralle4788732013-07-02 20:28:45 -0700753 * The rejecting quota limit should go after the penalty/happy box checks
JP Abgrallbaeccc42013-06-25 09:44:10 -0700754 * or else a naughty app could just eat up the quota.
755 * So we append here.
756 */
JP Abgrall109899b2013-02-12 19:20:13 -0800757 quotaCmd = makeIptablesQuotaCmd(IptOpAppend, costName, maxBytes);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700758 res |= runIpxtablesCmd(quotaCmd.c_str(), IptJumpReject);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700759 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000760 ALOGE("Failed set quota rule");
JP Abgrall0dad7c22011-06-24 11:58:14 -0700761 goto fail;
762 }
763
JP Abgrall8a932722011-07-13 19:17:35 -0700764 quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
JP Abgrall0dad7c22011-06-24 11:58:14 -0700765
766 } else {
JP Abgrall8a932722011-07-13 19:17:35 -0700767 res |= updateQuota(costName, maxBytes);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700768 if (res) {
Steve Block5ea0c052012-01-06 19:18:11 +0000769 ALOGE("Failed update quota for %s", iface);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700770 goto fail;
771 }
JP Abgrall8a932722011-07-13 19:17:35 -0700772 it->quota = maxBytes;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700773 }
774 return 0;
775
776 fail:
777 /*
778 * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
779 * rules in the kernel to see which ones need cleaning up.
780 * For now callers needs to choose if they want to "ndc bandwidth enable"
781 * which resets everything.
782 */
783 removeInterfaceSharedQuota(ifn);
784 return -1;
785}
786
JP Abgrall8a932722011-07-13 19:17:35 -0700787int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
788 return getInterfaceQuota("shared", bytes);
789}
790
791int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
792 FILE *fp;
793 char *fname;
794 int scanRes;
795
JP Abgrall69261cb2014-06-19 18:35:24 -0700796 if (!isIfaceName(costName))
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700797 return -1;
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700798
JP Abgrall8a932722011-07-13 19:17:35 -0700799 asprintf(&fname, "/proc/net/xt_quota/%s", costName);
Nick Kralevich53ea9ca2015-01-31 13:54:00 -0800800 fp = fopen(fname, "re");
JP Abgrall8a932722011-07-13 19:17:35 -0700801 free(fname);
802 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000803 ALOGE("Reading quota %s failed (%s)", costName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700804 return -1;
805 }
Mark Salyzynca0b5e22014-03-26 14:15:03 -0700806 scanRes = fscanf(fp, "%" SCNd64, bytes);
SynergyDev7776cea2014-03-16 15:48:51 -0700807 ALOGV("Read quota res=%d bytes=%" PRId64, scanRes, *bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700808 fclose(fp);
809 return scanRes == 1 ? 0 : -1;
810}
811
JP Abgrall0dad7c22011-06-24 11:58:14 -0700812int BandwidthController::removeInterfaceQuota(const char *iface) {
813
814 char ifn[MAX_IFACENAME_LEN];
815 int res = 0;
JP Abgrall26e0d492011-06-24 19:21:51 -0700816 std::string ifaceName;
JP Abgrall0dad7c22011-06-24 11:58:14 -0700817 std::list<QuotaInfo>::iterator it;
JP Abgrall26e0d492011-06-24 19:21:51 -0700818
JP Abgrall69261cb2014-06-19 18:35:24 -0700819 if (!isIfaceName(iface))
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700820 return -1;
JP Abgrall8a932722011-07-13 19:17:35 -0700821 if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
Steve Block5ea0c052012-01-06 19:18:11 +0000822 ALOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
JP Abgrall26e0d492011-06-24 19:21:51 -0700823 return -1;
824 }
825 ifaceName = ifn;
JP Abgrall26e0d492011-06-24 19:21:51 -0700826
JP Abgrall0dad7c22011-06-24 11:58:14 -0700827 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
JP Abgrall8a932722011-07-13 19:17:35 -0700828 if (it->ifaceName == ifaceName)
JP Abgrall0dad7c22011-06-24 11:58:14 -0700829 break;
830 }
831
832 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +0000833 ALOGE("No such iface %s to delete", ifn);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700834 return -1;
835 }
836
837 /* This also removes the quota command of CostlyIface chain. */
JP Abgrall26e0d492011-06-24 19:21:51 -0700838 res |= cleanupCostlyIface(ifn, QuotaUnique);
JP Abgrall0dad7c22011-06-24 11:58:14 -0700839
840 quotaIfaces.erase(it);
841
842 return res;
843}
JP Abgrall8a932722011-07-13 19:17:35 -0700844
845int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
846 FILE *fp;
847 char *fname;
848
JP Abgrall69261cb2014-06-19 18:35:24 -0700849 if (!isIfaceName(quotaName)) {
Nick Kralevich0b2b9022014-05-01 13:10:45 -0700850 ALOGE("updateQuota: Invalid quotaName \"%s\"", quotaName);
851 return -1;
852 }
853
JP Abgrall8a932722011-07-13 19:17:35 -0700854 asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
Nick Kralevich53ea9ca2015-01-31 13:54:00 -0800855 fp = fopen(fname, "we");
JP Abgrall8a932722011-07-13 19:17:35 -0700856 free(fname);
857 if (!fp) {
Steve Block5ea0c052012-01-06 19:18:11 +0000858 ALOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
JP Abgrall8a932722011-07-13 19:17:35 -0700859 return -1;
860 }
SynergyDev7776cea2014-03-16 15:48:51 -0700861 fprintf(fp, "%" PRId64"\n", bytes);
JP Abgrall8a932722011-07-13 19:17:35 -0700862 fclose(fp);
863 return 0;
864}
865
866int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
867 int res = 0;
868 const char *opFlag;
869 char *alertQuotaCmd;
870
871 switch (op) {
872 case IptOpInsert:
873 opFlag = "-I";
874 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800875 case IptOpAppend:
876 opFlag = "-A";
877 break;
JP Abgrall8a932722011-07-13 19:17:35 -0700878 case IptOpReplace:
879 opFlag = "-R";
880 break;
881 default:
882 case IptOpDelete:
883 opFlag = "-D";
884 break;
885 }
886
JP Abgrall92009c82013-02-06 18:01:24 -0800887 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800888 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700889 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700890 free(alertQuotaCmd);
JP Abgrall92009c82013-02-06 18:01:24 -0800891 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800892 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700893 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -0700894 free(alertQuotaCmd);
895 return res;
896}
897
JP Abgrallc6c67342011-10-07 16:28:54 -0700898int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
899 int res = 0;
900 const char *opFlag;
JP Abgrall8a932722011-07-13 19:17:35 -0700901 char *alertQuotaCmd;
JP Abgrallc6c67342011-10-07 16:28:54 -0700902
903 switch (op) {
904 case IptOpInsert:
905 opFlag = "-I";
906 break;
JP Abgrall109899b2013-02-12 19:20:13 -0800907 case IptOpAppend:
908 opFlag = "-A";
909 break;
JP Abgrallc6c67342011-10-07 16:28:54 -0700910 case IptOpReplace:
911 opFlag = "-R";
912 break;
913 default:
914 case IptOpDelete:
915 opFlag = "-D";
916 break;
917 }
918
JP Abgrall92009c82013-02-06 18:01:24 -0800919 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD",
Nick Kralevichc2b26cb2012-02-23 13:04:26 -0800920 bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -0700921 res = runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrallc6c67342011-10-07 16:28:54 -0700922 free(alertQuotaCmd);
923 return res;
924}
925
926int BandwidthController::setGlobalAlert(int64_t bytes) {
927 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700928 int res = 0;
929
930 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000931 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -0700932 return -1;
933 }
934 if (globalAlertBytes) {
935 res = updateQuota(alertName, bytes);
936 } else {
937 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700938 if (globalAlertTetherCount) {
Steve Block3fb42e02011-10-20 11:55:56 +0100939 ALOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700940 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
941 }
JP Abgrall8a932722011-07-13 19:17:35 -0700942 }
943 globalAlertBytes = bytes;
944 return res;
945}
946
JP Abgrallc6c67342011-10-07 16:28:54 -0700947int BandwidthController::setGlobalAlertInForwardChain(void) {
948 const char *alertName = ALERT_GLOBAL_NAME;
949 int res = 0;
JP Abgrall8a932722011-07-13 19:17:35 -0700950
JP Abgrallc6c67342011-10-07 16:28:54 -0700951 globalAlertTetherCount++;
Steve Block3fb42e02011-10-20 11:55:56 +0100952 ALOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
JP Abgrallc6c67342011-10-07 16:28:54 -0700953
954 /*
955 * If there is no globalAlert active we are done.
956 * If there is an active globalAlert but this is not the 1st
957 * tether, we are also done.
958 */
959 if (!globalAlertBytes || globalAlertTetherCount != 1) {
960 return 0;
961 }
962
963 /* We only add the rule if this was the 1st tether added. */
964 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
965 return res;
966}
967
968int BandwidthController::removeGlobalAlert(void) {
969
970 const char *alertName = ALERT_GLOBAL_NAME;
JP Abgrall8a932722011-07-13 19:17:35 -0700971 int res = 0;
972
973 if (!globalAlertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +0000974 ALOGE("No prior alert set");
JP Abgrall8a932722011-07-13 19:17:35 -0700975 return -1;
976 }
977 res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
JP Abgrallc6c67342011-10-07 16:28:54 -0700978 if (globalAlertTetherCount) {
979 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
980 }
JP Abgrall8a932722011-07-13 19:17:35 -0700981 globalAlertBytes = 0;
982 return res;
983}
984
JP Abgrallc6c67342011-10-07 16:28:54 -0700985int BandwidthController::removeGlobalAlertInForwardChain(void) {
986 int res = 0;
987 const char *alertName = ALERT_GLOBAL_NAME;
988
989 if (!globalAlertTetherCount) {
Steve Block5ea0c052012-01-06 19:18:11 +0000990 ALOGE("No prior alert set");
JP Abgrallc6c67342011-10-07 16:28:54 -0700991 return -1;
992 }
993
994 globalAlertTetherCount--;
995 /*
996 * If there is no globalAlert active we are done.
997 * If there is an active globalAlert but there are more
998 * tethers, we are also done.
999 */
1000 if (!globalAlertBytes || globalAlertTetherCount >= 1) {
1001 return 0;
1002 }
1003
1004 /* We only detete the rule if this was the last tether removed. */
1005 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
1006 return res;
1007}
1008
JP Abgrall8a932722011-07-13 19:17:35 -07001009int BandwidthController::setSharedAlert(int64_t bytes) {
1010 if (!sharedQuotaBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001011 ALOGE("Need to have a prior shared quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -07001012 return -1;
1013 }
1014 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001015 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001016 return -1;
1017 }
1018 return setCostlyAlert("shared", bytes, &sharedAlertBytes);
1019}
1020
1021int BandwidthController::removeSharedAlert(void) {
1022 return removeCostlyAlert("shared", &sharedAlertBytes);
1023}
1024
1025int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
1026 std::list<QuotaInfo>::iterator it;
1027
JP Abgrall69261cb2014-06-19 18:35:24 -07001028 if (!isIfaceName(iface)) {
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001029 ALOGE("setInterfaceAlert: Invalid iface \"%s\"", iface);
1030 return -1;
1031 }
1032
JP Abgrall8a932722011-07-13 19:17:35 -07001033 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001034 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001035 return -1;
1036 }
1037 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
1038 if (it->ifaceName == iface)
1039 break;
1040 }
1041
1042 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +00001043 ALOGE("Need to have a prior interface quota set to set an alert");
JP Abgrall8a932722011-07-13 19:17:35 -07001044 return -1;
1045 }
1046
1047 return setCostlyAlert(iface, bytes, &it->alert);
1048}
1049
1050int BandwidthController::removeInterfaceAlert(const char *iface) {
1051 std::list<QuotaInfo>::iterator it;
1052
JP Abgrall69261cb2014-06-19 18:35:24 -07001053 if (!isIfaceName(iface)) {
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001054 ALOGE("removeInterfaceAlert: Invalid iface \"%s\"", iface);
1055 return -1;
1056 }
1057
JP Abgrall8a932722011-07-13 19:17:35 -07001058 for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
1059 if (it->ifaceName == iface)
1060 break;
1061 }
1062
1063 if (it == quotaIfaces.end()) {
Steve Block5ea0c052012-01-06 19:18:11 +00001064 ALOGE("No prior alert set for interface %s", iface);
JP Abgrall8a932722011-07-13 19:17:35 -07001065 return -1;
1066 }
1067
1068 return removeCostlyAlert(iface, &it->alert);
1069}
1070
1071int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
1072 char *alertQuotaCmd;
JP Abgrall109899b2013-02-12 19:20:13 -08001073 char *chainName;
JP Abgrall8a932722011-07-13 19:17:35 -07001074 int res = 0;
1075 char *alertName;
1076
JP Abgrall69261cb2014-06-19 18:35:24 -07001077 if (!isIfaceName(costName)) {
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001078 ALOGE("setCostlyAlert: Invalid costName \"%s\"", costName);
1079 return -1;
1080 }
1081
JP Abgrall8a932722011-07-13 19:17:35 -07001082 if (!bytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001083 ALOGE("Invalid bytes value. 1..max_int64.");
JP Abgrall8a932722011-07-13 19:17:35 -07001084 return -1;
1085 }
1086 asprintf(&alertName, "%sAlert", costName);
1087 if (*alertBytes) {
1088 res = updateQuota(alertName, *alertBytes);
1089 } else {
JP Abgrall7e51cde2013-07-03 13:33:05 -07001090 asprintf(&chainName, "bw_costly_%s", costName);
JP Abgrall109899b2013-02-12 19:20:13 -08001091 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-A", chainName, bytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -07001092 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -07001093 free(alertQuotaCmd);
JP Abgrall109899b2013-02-12 19:20:13 -08001094 free(chainName);
JP Abgrall8a932722011-07-13 19:17:35 -07001095 }
1096 *alertBytes = bytes;
1097 free(alertName);
1098 return res;
1099}
1100
1101int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
1102 char *alertQuotaCmd;
1103 char *chainName;
1104 char *alertName;
1105 int res = 0;
1106
JP Abgrall69261cb2014-06-19 18:35:24 -07001107 if (!isIfaceName(costName)) {
Nick Kralevich0b2b9022014-05-01 13:10:45 -07001108 ALOGE("removeCostlyAlert: Invalid costName \"%s\"", costName);
1109 return -1;
1110 }
1111
JP Abgrall8a932722011-07-13 19:17:35 -07001112 if (!*alertBytes) {
Steve Block5ea0c052012-01-06 19:18:11 +00001113 ALOGE("No prior alert set for %s alert", costName);
JP Abgrall8a932722011-07-13 19:17:35 -07001114 return -1;
1115 }
1116
Jesper Hanssona9d791f2012-04-27 13:54:27 +02001117 asprintf(&alertName, "%sAlert", costName);
JP Abgrall7e51cde2013-07-03 13:33:05 -07001118 asprintf(&chainName, "bw_costly_%s", costName);
JP Abgrall92009c82013-02-06 18:01:24 -08001119 asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName);
JP Abgralla9ba4cb2013-07-02 19:08:48 -07001120 res |= runIpxtablesCmd(alertQuotaCmd, IptJumpNoAdd);
JP Abgrall8a932722011-07-13 19:17:35 -07001121 free(alertQuotaCmd);
1122 free(chainName);
1123
1124 *alertBytes = 0;
1125 free(alertName);
1126 return res;
1127}
JP Abgralldb7da582011-09-18 12:57:32 -07001128
1129/*
1130 * Parse the ptks and bytes out of:
JP Abgrallbaeccc42013-06-25 09:44:10 -07001131 * Chain natctrl_tether_counters (4 references)
1132 * pkts bytes target prot opt in out source destination
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001133 * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
1134 * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0
1135 * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0
1136 * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0
1137 * It results in an error if invoked and no tethering counter rules exist. The constraint
1138 * helps detect complete parsing failure.
JP Abgralldb7da582011-09-18 12:57:32 -07001139 */
JP Abgrallbaeccc42013-06-25 09:44:10 -07001140int BandwidthController::parseForwardChainStats(SocketClient *cli, const TetherStats filter,
1141 FILE *fp, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001142 int res;
1143 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
1144 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
1145 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
1146 char rest[MAX_IPT_OUTPUT_LINE_LEN];
1147
JP Abgrallbaeccc42013-06-25 09:44:10 -07001148 TetherStats stats;
JP Abgralldb7da582011-09-18 12:57:32 -07001149 char *buffPtr;
1150 int64_t packets, bytes;
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001151 int statsFound = 0;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001152
1153 bool filterPair = filter.intIface[0] && filter.extIface[0];
1154
1155 char *filterMsg = filter.getStatsLine();
1156 ALOGV("filter: %s", filterMsg);
1157 free(filterMsg);
1158
1159 stats = filter;
JP Abgralldb7da582011-09-18 12:57:32 -07001160
1161 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1162 /* Clean up, so a failed parse can still print info */
1163 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
Mark Salyzynca0b5e22014-03-26 14:15:03 -07001164 res = sscanf(buffPtr, "%" SCNd64" %" SCNd64" RETURN all -- %s %s 0.%s",
JP Abgralldb7da582011-09-18 12:57:32 -07001165 &packets, &bytes, iface0, iface1, rest);
SynergyDev7776cea2014-03-16 15:48:51 -07001166 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%" PRId64" bytes=%" PRId64" rest=<%s> orig line=<%s>", res,
JP Abgralldb7da582011-09-18 12:57:32 -07001167 iface0, iface1, packets, bytes, rest, buffPtr);
JP Abgralla2a64f02011-11-11 20:36:16 -08001168 extraProcessingInfo += buffPtr;
1169
JP Abgralldb7da582011-09-18 12:57:32 -07001170 if (res != 5) {
1171 continue;
1172 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001173 /*
1174 * The following assumes that the 1st rule has in:extIface out:intIface,
1175 * which is what NatController sets up.
1176 * If not filtering, the 1st match rx, and sets up the pair for the tx side.
1177 */
1178 if (filter.intIface[0] && filter.extIface[0]) {
1179 if (filter.intIface == iface0 && filter.extIface == iface1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001180 ALOGV("2Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001181 stats.rxPackets = packets;
1182 stats.rxBytes = bytes;
1183 } else if (filter.intIface == iface1 && filter.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001184 ALOGV("2Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001185 stats.txPackets = packets;
1186 stats.txBytes = bytes;
1187 }
1188 } else if (filter.intIface[0] || filter.extIface[0]) {
1189 if (filter.intIface == iface0 || filter.extIface == iface1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001190 ALOGV("1Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001191 stats.intIface = iface0;
1192 stats.extIface = iface1;
1193 stats.rxPackets = packets;
1194 stats.rxBytes = bytes;
1195 } else if (filter.intIface == iface1 || filter.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001196 ALOGV("1Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001197 stats.intIface = iface1;
1198 stats.extIface = iface0;
1199 stats.txPackets = packets;
1200 stats.txBytes = bytes;
1201 }
1202 } else /* if (!filter.intFace[0] && !filter.extIface[0]) */ {
1203 if (!stats.intIface[0]) {
SynergyDev7776cea2014-03-16 15:48:51 -07001204 ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001205 stats.intIface = iface0;
1206 stats.extIface = iface1;
1207 stats.rxPackets = packets;
1208 stats.rxBytes = bytes;
1209 } else if (stats.intIface == iface1 && stats.extIface == iface0) {
SynergyDev7776cea2014-03-16 15:48:51 -07001210 ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001211 stats.txPackets = packets;
1212 stats.txBytes = bytes;
1213 }
1214 }
1215 if (stats.rxBytes != -1 && stats.txBytes != -1) {
SynergyDev7776cea2014-03-16 15:48:51 -07001216 ALOGV("rx_bytes=%" PRId64" tx_bytes=%" PRId64" filterPair=%d", stats.rxBytes, stats.txBytes, filterPair);
JP Abgrallbaeccc42013-06-25 09:44:10 -07001217 /* Send out stats, and prep for the next if needed. */
1218 char *msg = stats.getStatsLine();
1219 if (filterPair) {
1220 cli->sendMsg(ResponseCode::TetheringStatsResult, msg, false);
1221 return 0;
1222 } else {
1223 cli->sendMsg(ResponseCode::TetheringStatsListResult, msg, false);
1224 stats = filter;
1225 }
1226 free(msg);
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001227 statsFound++;
JP Abgralldb7da582011-09-18 12:57:32 -07001228 }
1229 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001230
1231 /* It is always an error to find only one side of the stats. */
1232 /* It is an error to find nothing when not filtering. */
1233 if (((stats.rxBytes == -1) != (stats.txBytes == -1)) ||
1234 (!statsFound && !filterPair)) {
1235 return -1;
JP Abgrallbaeccc42013-06-25 09:44:10 -07001236 }
JP Abgrallf3cc83f2013-09-11 20:01:59 -07001237 cli->sendMsg(ResponseCode::CommandOkay, "Tethering stats list completed", false);
1238 return 0;
JP Abgralldb7da582011-09-18 12:57:32 -07001239}
1240
JP Abgrallbaeccc42013-06-25 09:44:10 -07001241char *BandwidthController::TetherStats::getStatsLine(void) const {
JP Abgralldb7da582011-09-18 12:57:32 -07001242 char *msg;
SynergyDev7776cea2014-03-16 15:48:51 -07001243 asprintf(&msg, "%s %s %" PRId64" %" PRId64" %" PRId64" %" PRId64, intIface.c_str(), extIface.c_str(),
JP Abgralldb7da582011-09-18 12:57:32 -07001244 rxBytes, rxPackets, txBytes, txPackets);
1245 return msg;
1246}
1247
JP Abgrallbaeccc42013-06-25 09:44:10 -07001248int BandwidthController::getTetherStats(SocketClient *cli, TetherStats &stats, std::string &extraProcessingInfo) {
JP Abgralldb7da582011-09-18 12:57:32 -07001249 int res;
1250 std::string fullCmd;
1251 FILE *iptOutput;
JP Abgralldb7da582011-09-18 12:57:32 -07001252
JP Abgralldb7da582011-09-18 12:57:32 -07001253 /*
1254 * Why not use some kind of lib to talk to iptables?
1255 * Because the only libs are libiptc and libip6tc in iptables, and they are
1256 * not easy to use. They require the known iptables match modules to be
1257 * preloaded/linked, and require apparently a lot of wrapper code to get
1258 * the wanted info.
1259 */
1260 fullCmd = IPTABLES_PATH;
Yusuke Sato99b40502015-08-19 13:47:30 -07001261 fullCmd += " -nvx -w -L ";
JP Abgrallbaeccc42013-06-25 09:44:10 -07001262 fullCmd += NatController::LOCAL_TETHER_COUNTERS_CHAIN;
JP Abgralldb7da582011-09-18 12:57:32 -07001263 iptOutput = popen(fullCmd.c_str(), "r");
1264 if (!iptOutput) {
Steve Block5ea0c052012-01-06 19:18:11 +00001265 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
JP Abgralla2a64f02011-11-11 20:36:16 -08001266 extraProcessingInfo += "Failed to run iptables.";
JP Abgralldb7da582011-09-18 12:57:32 -07001267 return -1;
1268 }
JP Abgrallbaeccc42013-06-25 09:44:10 -07001269 res = parseForwardChainStats(cli, stats, iptOutput, extraProcessingInfo);
JP Abgralldb7da582011-09-18 12:57:32 -07001270 pclose(iptOutput);
1271
1272 /* Currently NatController doesn't do ipv6 tethering, so we are done. */
1273 return res;
1274}
JP Abgrall0e540ec2013-08-26 15:13:10 -07001275
1276void BandwidthController::flushExistingCostlyTables(bool doClean) {
JP Abgrall0e540ec2013-08-26 15:13:10 -07001277 std::string fullCmd;
1278 FILE *iptOutput;
JP Abgrall0e540ec2013-08-26 15:13:10 -07001279
1280 /* Only lookup ip4 table names as ip6 will have the same tables ... */
1281 fullCmd = IPTABLES_PATH;
Yusuke Sato99b40502015-08-19 13:47:30 -07001282 fullCmd += " -w -S";
JP Abgrall0e540ec2013-08-26 15:13:10 -07001283 iptOutput = popen(fullCmd.c_str(), "r");
1284 if (!iptOutput) {
1285 ALOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
1286 return;
1287 }
1288 /* ... then flush/clean both ip4 and ip6 iptables. */
1289 parseAndFlushCostlyTables(iptOutput, doClean);
1290 pclose(iptOutput);
1291}
1292
1293void BandwidthController::parseAndFlushCostlyTables(FILE *fp, bool doRemove) {
1294 int res;
1295 char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
1296 char costlyIfaceName[MAX_IPT_OUTPUT_LINE_LEN];
1297 char cmd[MAX_CMD_LEN];
1298 char *buffPtr;
1299
1300 while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
1301 costlyIfaceName[0] = '\0'; /* So that debugging output always works */
1302 res = sscanf(buffPtr, "-N bw_costly_%s", costlyIfaceName);
1303 ALOGV("parse res=%d costly=<%s> orig line=<%s>", res,
1304 costlyIfaceName, buffPtr);
1305 if (res != 1) {
1306 continue;
1307 }
1308 /* Exclusions: "shared" is not an ifacename */
1309 if (!strcmp(costlyIfaceName, "shared")) {
1310 continue;
1311 }
1312
1313 snprintf(cmd, sizeof(cmd), "-F bw_costly_%s", costlyIfaceName);
1314 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
1315 if (doRemove) {
1316 snprintf(cmd, sizeof(cmd), "-X bw_costly_%s", costlyIfaceName);
1317 runIpxtablesCmd(cmd, IptJumpNoAdd, IptFailHide);
1318 }
1319 }
1320}