/*
* Copyright (C) 2011 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
// #define LOG_NDEBUG 0
/*
* The CommandListener, FrameworkListener don't allow for
* multiple calls in parallel to reach the BandwidthController.
* If they ever were to allow it, then netd/ would need some tweaking.
*/
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/pkt_sched.h>
#define LOG_TAG "BandwidthController"
#include <cutils/log.h>
#include <cutils/properties.h>
extern "C" int logwrap(int argc, const char **argv, int background);
#include "BandwidthController.h"
/* Alphabetical */
const char BandwidthController::ALERT_IPT_TEMPLATE[] = "%s %s %s -m quota2 ! --quota %lld --name %s";
const int BandwidthController::ALERT_RULE_POS_IN_COSTLY_CHAIN = 4;
const char BandwidthController::ALERT_GLOBAL_NAME[] = "globalAlert";
const char BandwidthController::IP6TABLES_PATH[] = "/system/bin/ip6tables";
const char BandwidthController::IPTABLES_PATH[] = "/system/bin/iptables";
const int BandwidthController::MAX_CMD_ARGS = 32;
const int BandwidthController::MAX_CMD_LEN = 1024;
const int BandwidthController::MAX_IFACENAME_LEN = 64;
const int BandwidthController::MAX_IPT_OUTPUT_LINE_LEN = 256;
bool BandwidthController::useLogwrapCall = false;
/**
* Some comments about the rules:
* * Ordering
* - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
* E.g. "-I INPUT -i rmnet0 --goto costly"
* - quota'd rules in the costly chain should be before penalty_box lookups.
*
* * global quota vs per interface quota
* - global quota for all costly interfaces uses a single costly chain:
* . initial rules
* iptables -N costly_shared
* iptables -I INPUT -i iface0 --goto costly_shared
* iptables -I OUTPUT -o iface0 --goto costly_shared
* iptables -I costly_shared -m quota \! --quota 500000 \
* --jump REJECT --reject-with icmp-net-prohibited
* iptables -A costly_shared --jump penalty_box
* iptables -A costly_shared -m owner --socket-exists
*
* . adding a new iface to this, E.g.:
* iptables -I INPUT -i iface1 --goto costly_shared
* iptables -I OUTPUT -o iface1 --goto costly_shared
*
* - quota per interface. This is achieve by having "costly" chains per quota.
* E.g. adding a new costly interface iface0 with its own quota:
* iptables -N costly_iface0
* iptables -I INPUT -i iface0 --goto costly_iface0
* iptables -I OUTPUT -o iface0 --goto costly_iface0
* iptables -A costly_iface0 -m quota \! --quota 500000 \
* --jump REJECT --reject-with icmp-net-prohibited
* iptables -A costly_iface0 --jump penalty_box
* iptables -A costly_iface0 -m owner --socket-exists
*
* * penalty_box handling:
* - only one penalty_box for all interfaces
* E.g Adding an app:
* iptables -A penalty_box -m owner --uid-owner app_3 \
* --jump REJECT --reject-with icmp-net-prohibited
*/
const char *BandwidthController::IPT_CLEANUP_COMMANDS[] = {
/* Cleanup rules. */
"-F",
"-t raw -F",
/* TODO: If at some point we need more user chains than here, then we will need
* a different cleanup approach.
*/
"-X", /* Should normally only be costly_shared, penalty_box, and costly_<iface> */
};
const char *BandwidthController::IPT_SETUP_COMMANDS[] = {
/* Created needed chains. */
"-N costly_shared",
"-N penalty_box",
};
const char *BandwidthController::IPT_BASIC_ACCOUNTING_COMMANDS[] = {
"-F INPUT",
"-A INPUT -i lo --jump ACCEPT",
"-A INPUT -m owner --socket-exists", /* This is a tracking rule. */
"-F OUTPUT",
"-A OUTPUT -o lo --jump ACCEPT",
"-A OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
"-F costly_shared",
"-A costly_shared --jump penalty_box",
"-A costly_shared -m owner --socket-exists", /* This is a tracking rule. */
/* TODO(jpa): Figure out why iptables doesn't correctly return from this
* chain. For now, hack the chain exit with an ACCEPT.
*/
"-A costly_shared --jump ACCEPT",
};
BandwidthController::BandwidthController(void) {
char value[PROPERTY_VALUE_MAX];
property_get("persist.bandwidth.enable", value, "0");
if (!strcmp(value, "1")) {
enableBandwidthControl();
}
property_get("persist.bandwidth.uselogwrap", value, "0");
useLogwrapCall = !strcmp(value, "1");
}
int BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling) {
int res = 0;
LOGV("runIpxtablesCmd(cmd=%s)", cmd);
res |= runIptablesCmd(cmd, rejectHandling, IptIpV4);
res |= runIptablesCmd(cmd, rejectHandling, IptIpV6);
return res;
}
int BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) {
memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0'
strncpy(buffer, src, buffSize);
return buffer[buffSize - 1];
}
int BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling,
IptIpVer iptVer) {
char buffer[MAX_CMD_LEN];
const char *argv[MAX_CMD_ARGS];
int argc = 0;
char *next = buffer;
char *tmp;
int res;
std::string fullCmd = cmd;
if (rejectHandling == IptRejectAdd) {
fullCmd += " --jump REJECT --reject-with";
switch (iptVer) {
case IptIpV4:
fullCmd += " icmp-net-prohibited";
break;
case IptIpV6:
fullCmd += " icmp6-adm-prohibited";
break;
}
}
fullCmd.insert(0, " ");
fullCmd.insert(0, iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH);
if (!useLogwrapCall) {
res = system(fullCmd.c_str());
} else {
if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) {
LOGE("iptables command too long");
return -1;
}
argc = 0;
while ((tmp = strsep(&next, " "))) {
argv[argc++] = tmp;
if (argc >= MAX_CMD_ARGS) {
LOGE("iptables argument overflow");
return -1;
}
}
argv[argc] = NULL;
res = logwrap(argc, argv, 0);
}
if (res) {
LOGE("runIptablesCmd(): failed %s res=%d", fullCmd.c_str(), res);
}
return res;
}
int BandwidthController::enableBandwidthControl(void) {
int res;
/* Let's pretend we started from scratch ... */
sharedQuotaIfaces.clear();
quotaIfaces.clear();
naughtyAppUids.clear();
globalAlertBytes = 0;
globalAlertTetherCount = 0;
sharedQuotaBytes = sharedAlertBytes = 0;
/* Some of the initialCommands are allowed to fail */
runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
runCommands(sizeof(IPT_SETUP_COMMANDS) / sizeof(char*),
IPT_SETUP_COMMANDS, RunCmdFailureOk);
res = runCommands(sizeof(IPT_BASIC_ACCOUNTING_COMMANDS) / sizeof(char*),
IPT_BASIC_ACCOUNTING_COMMANDS, RunCmdFailureBad);
return res;
}
int BandwidthController::disableBandwidthControl(void) {
/* The IPT_CLEANUP_COMMANDS are allowed to fail. */
runCommands(sizeof(IPT_CLEANUP_COMMANDS) / sizeof(char*),
IPT_CLEANUP_COMMANDS, RunCmdFailureOk);
return 0;
}
int BandwidthController::runCommands(int numCommands, const char *commands[],
RunCmdErrHandling cmdErrHandling) {
int res = 0;
LOGV("runCommands(): %d commands", numCommands);
for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) {
res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd);
if (res && cmdErrHandling != RunCmdFailureBad)
return res;
}
return cmdErrHandling == RunCmdFailureBad ? res : 0;
}
std::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) {
std::string res;
char *buff;
const char *opFlag;
switch (op) {
case IptOpInsert:
opFlag = "-I";
break;
case IptOpReplace:
opFlag = "-R";
break;
default:
case IptOpDelete:
opFlag = "-D";
break;
}
asprintf(&buff, "%s penalty_box -m owner --uid-owner %d", opFlag, uid);
res = buff;
free(buff);
return res;
}
int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd);
}
int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove);
}
int BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) {
char cmd[MAX_CMD_LEN];
int uidNum;
const char *failLogTemplate;
IptOp op;
int appUids[numUids];
std::string naughtyCmd;
switch (appOp) {
case NaughtyAppOpAdd:
op = IptOpInsert;
failLogTemplate = "Failed to add app uid %d to penalty box.";
break;
case NaughtyAppOpRemove:
op = IptOpDelete;
failLogTemplate = "Failed to delete app uid %d from penalty box.";
break;
}
for (uidNum = 0; uidNum < numUids; uidNum++) {
appUids[uidNum] = atol(appStrUids[uidNum]);
if (appUids[uidNum] == 0) {
LOGE(failLogTemplate, appUids[uidNum]);
goto fail_parse;
}
}
for (uidNum = 0; uidNum < numUids; uidNum++) {
naughtyCmd = makeIptablesNaughtyCmd(op, appUids[uidNum]);
if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) {
LOGE(failLogTemplate, appUids[uidNum]);
goto fail_with_uidNum;
}
}
return 0;
fail_with_uidNum:
/* Try to remove the uid that failed in any case*/
naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]);
runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd);
fail_parse:
return -1;
}
std::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) {
std::string res;
char *buff;
const char *opFlag;
LOGV("makeIptablesQuotaCmd(%d, %lld)", op, quota);
switch (op) {
case IptOpInsert:
opFlag = "-I";
break;
case IptOpReplace:
opFlag = "-R";
break;
default:
case IptOpDelete:
opFlag = "-D";
break;
}
// The requried IP version specific --jump REJECT ... will be added later.
asprintf(&buff, "%s costly_%s -m quota2 ! --quota %lld --name %s", opFlag, costName, quota,
costName);
res = buff;
free(buff);
return res;
}
int BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) {
char cmd[MAX_CMD_LEN];
int res = 0;
int ruleInsertPos = 1;
std::string costString;
const char *costCString;
/* The "-N costly" is created upfront, no need to handle it here. */
switch (quotaType) {
case QuotaUnique:
costString = "costly_";
costString += ifn;
costCString = costString.c_str();
snprintf(cmd, sizeof(cmd), "-N %s", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
snprintf(cmd, sizeof(cmd), "-A %s -m owner --socket-exists", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
/* TODO(jpa): Figure out why iptables doesn't correctly return from this
* chain. For now, hack the chain exit with an ACCEPT.
*/
snprintf(cmd, sizeof(cmd), "-A %s --jump ACCEPT", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
break;
case QuotaShared:
costCString = "costly_shared";
break;
}
if (globalAlertBytes) {
/* The alert rule comes 1st */
ruleInsertPos = 2;
}
snprintf(cmd, sizeof(cmd), "-I INPUT %d -i %s --goto %s", ruleInsertPos, ifn, costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
snprintf(cmd, sizeof(cmd), "-I OUTPUT %d -o %s --goto %s", ruleInsertPos, ifn, costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
return res;
}
int BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) {
char cmd[MAX_CMD_LEN];
int res = 0;
std::string costString;
const char *costCString;
switch (quotaType) {
case QuotaUnique:
costString = "costly_";
costString += ifn;
costCString = costString.c_str();
break;
case QuotaShared:
costCString = "costly_shared";
break;
}
snprintf(cmd, sizeof(cmd), "-D INPUT -i %s --goto %s", ifn, costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
snprintf(cmd, sizeof(cmd), "-D OUTPUT -o %s --goto %s", ifn, costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
/* The "-N costly_shared" is created upfront, no need to handle it here. */
if (quotaType == QuotaUnique) {
snprintf(cmd, sizeof(cmd), "-F %s", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
snprintf(cmd, sizeof(cmd), "-X %s", costCString);
res |= runIpxtablesCmd(cmd, IptRejectNoAdd);
}
return res;
}
int BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) {
char cmd[MAX_CMD_LEN];
char ifn[MAX_IFACENAME_LEN];
int res = 0;
std::string quotaCmd;
std::string ifaceName;
;
const char *costName = "shared";
std::list<std::string>::iterator it;
if (!maxBytes) {
/* Don't talk about -1, deprecate it. */
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
LOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
return -1;
}
ifaceName = ifn;
if (maxBytes == -1) {
return removeInterfaceSharedQuota(ifn);
}
/* Insert ingress quota. */
for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
if (*it == ifaceName)
break;
}
if (it == sharedQuotaIfaces.end()) {
res |= prepCostlyIface(ifn, QuotaShared);
if (sharedQuotaIfaces.empty()) {
quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
if (res) {
LOGE("Failed set quota rule");
goto fail;
}
sharedQuotaBytes = maxBytes;
}
sharedQuotaIfaces.push_front(ifaceName);
}
if (maxBytes != sharedQuotaBytes) {
res |= updateQuota(costName, maxBytes);
if (res) {
LOGE("Failed update quota for %s", costName);
goto fail;
}
sharedQuotaBytes = maxBytes;
}
return 0;
fail:
/*
* TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
* rules in the kernel to see which ones need cleaning up.
* For now callers needs to choose if they want to "ndc bandwidth enable"
* which resets everything.
*/
removeInterfaceSharedQuota(ifn);
return -1;
}
/* It will also cleanup any shared alerts */
int BandwidthController::removeInterfaceSharedQuota(const char *iface) {
char ifn[MAX_IFACENAME_LEN];
int res = 0;
std::string ifaceName;
std::list<std::string>::iterator it;
const char *costName = "shared";
if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
LOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
return -1;
}
ifaceName = ifn;
for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) {
if (*it == ifaceName)
break;
}
if (it == sharedQuotaIfaces.end()) {
LOGE("No such iface %s to delete", ifn);
return -1;
}
res |= cleanupCostlyIface(ifn, QuotaShared);
sharedQuotaIfaces.erase(it);
if (sharedQuotaIfaces.empty()) {
std::string quotaCmd;
quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes);
res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
sharedQuotaBytes = 0;
if (sharedAlertBytes) {
removeSharedAlert();
sharedAlertBytes = 0;
}
}
return res;
}
int BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) {
char ifn[MAX_IFACENAME_LEN];
int res = 0;
std::string ifaceName;
const char *costName;
std::list<QuotaInfo>::iterator it;
std::string quotaCmd;
if (!maxBytes) {
/* Don't talk about -1, deprecate it. */
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
if (maxBytes == -1) {
return removeInterfaceQuota(iface);
}
if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
LOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
return -1;
}
ifaceName = ifn;
costName = iface;
/* Insert ingress quota. */
for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
if (it->ifaceName == ifaceName)
break;
}
if (it == quotaIfaces.end()) {
res |= prepCostlyIface(ifn, QuotaUnique);
quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes);
res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd);
if (res) {
LOGE("Failed set quota rule");
goto fail;
}
quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0));
} else {
res |= updateQuota(costName, maxBytes);
if (res) {
LOGE("Failed update quota for %s", iface);
goto fail;
}
it->quota = maxBytes;
}
return 0;
fail:
/*
* TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse
* rules in the kernel to see which ones need cleaning up.
* For now callers needs to choose if they want to "ndc bandwidth enable"
* which resets everything.
*/
removeInterfaceSharedQuota(ifn);
return -1;
}
int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
return getInterfaceQuota("shared", bytes);
}
int BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) {
FILE *fp;
char *fname;
int scanRes;
asprintf(&fname, "/proc/net/xt_quota/%s", costName);
fp = fopen(fname, "r");
free(fname);
if (!fp) {
LOGE("Reading quota %s failed (%s)", costName, strerror(errno));
return -1;
}
scanRes = fscanf(fp, "%lld", bytes);
LOGV("Read quota res=%d bytes=%lld", scanRes, *bytes);
fclose(fp);
return scanRes == 1 ? 0 : -1;
}
int BandwidthController::removeInterfaceQuota(const char *iface) {
char ifn[MAX_IFACENAME_LEN];
int res = 0;
std::string ifaceName;
const char *costName;
std::list<QuotaInfo>::iterator it;
if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) {
LOGE("Interface name longer than %d", MAX_IFACENAME_LEN);
return -1;
}
ifaceName = ifn;
costName = iface;
for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
if (it->ifaceName == ifaceName)
break;
}
if (it == quotaIfaces.end()) {
LOGE("No such iface %s to delete", ifn);
return -1;
}
/* This also removes the quota command of CostlyIface chain. */
res |= cleanupCostlyIface(ifn, QuotaUnique);
quotaIfaces.erase(it);
return res;
}
int BandwidthController::updateQuota(const char *quotaName, int64_t bytes) {
FILE *fp;
char *fname;
asprintf(&fname, "/proc/net/xt_quota/%s", quotaName);
fp = fopen(fname, "w");
free(fname);
if (!fp) {
LOGE("Updating quota %s failed (%s)", quotaName, strerror(errno));
return -1;
}
fprintf(fp, "%lld\n", bytes);
fclose(fp);
return 0;
}
int BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) {
int res = 0;
const char *opFlag;
const char *ifaceLimiting;
char *alertQuotaCmd;
switch (op) {
case IptOpInsert:
opFlag = "-I";
break;
case IptOpReplace:
opFlag = "-R";
break;
default:
case IptOpDelete:
opFlag = "-D";
break;
}
ifaceLimiting = "! -i lo+";
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, ifaceLimiting, opFlag, "INPUT",
bytes, alertName, alertName);
res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
free(alertQuotaCmd);
ifaceLimiting = "! -o lo+";
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, ifaceLimiting, opFlag, "OUTPUT",
bytes, alertName, alertName);
res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
free(alertQuotaCmd);
return res;
}
int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const char *alertName, int64_t bytes) {
int res = 0;
const char *opFlag;
const char *ifaceLimiting;
char *alertQuotaCmd;
switch (op) {
case IptOpInsert:
opFlag = "-I";
break;
case IptOpReplace:
opFlag = "-R";
break;
default:
case IptOpDelete:
opFlag = "-D";
break;
}
ifaceLimiting = "! -i lo+";
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, ifaceLimiting, opFlag, "FORWARD",
bytes, alertName, alertName);
res = runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
free(alertQuotaCmd);
return res;
}
int BandwidthController::setGlobalAlert(int64_t bytes) {
const char *alertName = ALERT_GLOBAL_NAME;
int res = 0;
if (!bytes) {
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
if (globalAlertBytes) {
res = updateQuota(alertName, bytes);
} else {
res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
if (globalAlertTetherCount) {
LOGV("setGlobalAlert for %d tether", globalAlertTetherCount);
res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
}
}
globalAlertBytes = bytes;
return res;
}
int BandwidthController::setGlobalAlertInForwardChain(void) {
const char *alertName = ALERT_GLOBAL_NAME;
int res = 0;
globalAlertTetherCount++;
LOGV("setGlobalAlertInForwardChain(): %d tether", globalAlertTetherCount);
/*
* If there is no globalAlert active we are done.
* If there is an active globalAlert but this is not the 1st
* tether, we are also done.
*/
if (!globalAlertBytes || globalAlertTetherCount != 1) {
return 0;
}
/* We only add the rule if this was the 1st tether added. */
res = runIptablesAlertFwdCmd(IptOpInsert, alertName, globalAlertBytes);
return res;
}
int BandwidthController::removeGlobalAlert(void) {
const char *alertName = ALERT_GLOBAL_NAME;
int res = 0;
if (!globalAlertBytes) {
LOGE("No prior alert set");
return -1;
}
res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes);
if (globalAlertTetherCount) {
res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
}
globalAlertBytes = 0;
return res;
}
int BandwidthController::removeGlobalAlertInForwardChain(void) {
int res = 0;
const char *alertName = ALERT_GLOBAL_NAME;
if (!globalAlertTetherCount) {
LOGE("No prior alert set");
return -1;
}
globalAlertTetherCount--;
/*
* If there is no globalAlert active we are done.
* If there is an active globalAlert but there are more
* tethers, we are also done.
*/
if (!globalAlertBytes || globalAlertTetherCount >= 1) {
return 0;
}
/* We only detete the rule if this was the last tether removed. */
res = runIptablesAlertFwdCmd(IptOpDelete, alertName, globalAlertBytes);
return res;
}
int BandwidthController::setSharedAlert(int64_t bytes) {
if (!sharedQuotaBytes) {
LOGE("Need to have a prior shared quota set to set an alert");
return -1;
}
if (!bytes) {
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
return setCostlyAlert("shared", bytes, &sharedAlertBytes);
}
int BandwidthController::removeSharedAlert(void) {
return removeCostlyAlert("shared", &sharedAlertBytes);
}
int BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) {
std::list<QuotaInfo>::iterator it;
if (!bytes) {
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
if (it->ifaceName == iface)
break;
}
if (it == quotaIfaces.end()) {
LOGE("Need to have a prior interface quota set to set an alert");
return -1;
}
return setCostlyAlert(iface, bytes, &it->alert);
}
int BandwidthController::removeInterfaceAlert(const char *iface) {
std::list<QuotaInfo>::iterator it;
for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) {
if (it->ifaceName == iface)
break;
}
if (it == quotaIfaces.end()) {
LOGE("No prior alert set for interface %s", iface);
return -1;
}
return removeCostlyAlert(iface, &it->alert);
}
int BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) {
char *alertQuotaCmd;
char *chainNameAndPos;
int res = 0;
char *alertName;
if (!bytes) {
LOGE("Invalid bytes value. 1..max_int64.");
return -1;
}
asprintf(&alertName, "%sAlert", costName);
if (*alertBytes) {
res = updateQuota(alertName, *alertBytes);
} else {
asprintf(&chainNameAndPos, "costly_%s %d", costName, ALERT_RULE_POS_IN_COSTLY_CHAIN);
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-I", chainNameAndPos, bytes, alertName,
alertName);
res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
free(alertQuotaCmd);
free(chainNameAndPos);
}
*alertBytes = bytes;
free(alertName);
return res;
}
int BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) {
char *alertQuotaCmd;
char *chainName;
char *alertName;
int res = 0;
asprintf(&alertName, "%sAlert", costName);
if (!*alertBytes) {
LOGE("No prior alert set for %s alert", costName);
return -1;
}
asprintf(&chainName, "costly_%s", costName);
asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName, alertName);
res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd);
free(alertQuotaCmd);
free(chainName);
*alertBytes = 0;
free(alertName);
return res;
}
/*
* Parse the ptks and bytes out of:
* Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
* pkts bytes target prot opt in out source destination
* 0 0 ACCEPT all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
* 0 0 DROP all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0 state INVALID
* 0 0 ACCEPT all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
*
*/
int BandwidthController::parseForwardChainStats(TetherStats &stats, FILE *fp) {
int res;
char lineBuffer[MAX_IPT_OUTPUT_LINE_LEN];
char iface0[MAX_IPT_OUTPUT_LINE_LEN];
char iface1[MAX_IPT_OUTPUT_LINE_LEN];
char rest[MAX_IPT_OUTPUT_LINE_LEN];
char *buffPtr;
int64_t packets, bytes;
while (NULL != (buffPtr = fgets(lineBuffer, MAX_IPT_OUTPUT_LINE_LEN, fp))) {
/* Clean up, so a failed parse can still print info */
iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
res = sscanf(buffPtr, "%lld %lld ACCEPT all -- %s %s 0.%s",
&packets, &bytes, iface0, iface1, rest);
LOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%lld bytes=%lld rest=<%s> orig line=<%s>", res,
iface0, iface1, packets, bytes, rest, buffPtr);
if (res != 5) {
continue;
}
if ((stats.ifaceIn == iface0) && (stats.ifaceOut == iface1)) {
LOGV("iface_in=%s iface_out=%s rx_bytes=%lld rx_packets=%lld ", iface0, iface1, bytes, packets);
stats.rxPackets = packets;
stats.rxBytes = bytes;
} else if ((stats.ifaceOut == iface0) && (stats.ifaceIn == iface1)) {
LOGV("iface_in=%s iface_out=%s tx_bytes=%lld tx_packets=%lld ", iface1, iface0, bytes, packets);
stats.txPackets = packets;
stats.txBytes = bytes;
}
}
/* Failure if rx or tx was not found */
return (stats.rxBytes == -1 || stats.txBytes == -1) ? -1 : 0;
}
char *BandwidthController::TetherStats::getStatsLine(void) {
char *msg;
asprintf(&msg, "%s %s %lld %lld %lld %lld", ifaceIn.c_str(), ifaceOut.c_str(),
rxBytes, rxPackets, txBytes, txPackets);
return msg;
}
int BandwidthController::getTetherStats(TetherStats &stats) {
int res;
std::string fullCmd;
FILE *iptOutput;
const char *cmd;
if (stats.rxBytes != -1 || stats.txBytes != -1) {
LOGE("Unexpected input stats. Byte counts should be -1.");
return -1;
}
/*
* Why not use some kind of lib to talk to iptables?
* Because the only libs are libiptc and libip6tc in iptables, and they are
* not easy to use. They require the known iptables match modules to be
* preloaded/linked, and require apparently a lot of wrapper code to get
* the wanted info.
*/
fullCmd = IPTABLES_PATH;
fullCmd += " -nvx -L FORWARD";
iptOutput = popen(fullCmd.c_str(), "r");
if (!iptOutput) {
LOGE("Failed to run %s err=%s", fullCmd.c_str(), strerror(errno));
return -1;
}
res = parseForwardChainStats(stats, iptOutput);
pclose(iptOutput);
/* Currently NatController doesn't do ipv6 tethering, so we are done. */
return res;
}