BandwidthController.cpp revision 39f8f24246a5dac21be5cc5e32c0f395ee803766
14a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/* 24a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Copyright (C) 2011 The Android Open Source Project 34a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 44a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Licensed under the Apache License, Version 2.0 (the "License"); 54a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * you may not use this file except in compliance with the License. 64a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * You may obtain a copy of the License at 74a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 84a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * http://www.apache.org/licenses/LICENSE-2.0 94a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 104a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Unless required by applicable law or agreed to in writing, software 114a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * distributed under the License is distributed on an "AS IS" BASIS, 124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 134a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * See the License for the specific language governing permissions and 144a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * limitations under the License. 154a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 174a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <stdlib.h> 184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <fcntl.h> 194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <string.h> 204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/socket.h> 224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/stat.h> 234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/types.h> 244a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/wait.h> 254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 264a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/netlink.h> 274a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/rtnetlink.h> 284a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/pkt_sched.h> 294a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 304a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#define LOG_TAG "BandwidthController" 314a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/log.h> 324a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/properties.h> 334a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 344a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallextern "C" int logwrap(int argc, const char **argv, int background); 354a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 364a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include "BandwidthController.h" 374a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 38fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst int BandwidthController::MAX_CMD_LEN = 1024; 394a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_IFACENAME_LEN = 64; 404a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_CMD_ARGS = 32; 414a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char BandwidthController::IPTABLES_PATH[] = "/system/bin/iptables"; 42fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst char BandwidthController::IP6TABLES_PATH[] = "/system/bin/ip6tables"; 434a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 444a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/** 454a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Some comments about the rules: 464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * Ordering 474a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains. 484a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. "-I INPUT -i rmnet0 --goto costly" 494a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota'd rules in the costly chain should be before penalty_box lookups. 504a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * global quota vs per interface quota 524a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - global quota for all costly interfaces uses a single costly chain: 534a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . initial rules 544a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -N costly 554a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I INPUT -i iface0 --goto costly 564a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly 574a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I costly -m quota \! --quota 500000 --jump REJECT --reject-with icmp-net-prohibited 584a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly --jump penalty_box 594a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly -m owner --socket-exists 604a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . adding a new iface to this, E.g.: 614a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I INPUT -i iface1 --goto costly 624a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I OUTPUT -o iface1 --goto costly 634a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 644a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota per interface. This is achieve by having "costly" chains per quota. 654a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. adding a new costly interface iface0 with its own quota: 664a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -N costly_iface0 674a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I INPUT -i iface0 --goto costly_iface0 684a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly_iface0 694a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly_iface0 -m quota \! --quota 500000 --jump REJECT --reject-with icmp-net-prohibited 704a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly_iface0 --jump penalty_box 714a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly_iface0 -m owner --socket-exists 724a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 734a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * penalty_box handling: 744a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - only one penalty_box for all interfaces 754a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g Adding an app: 764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A penalty_box -m owner --uid-owner app_3 --jump REJECT --reject-with icmp-net-prohibited 774a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 784a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::cleanupCommands[] = { 790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Cleanup rules. */ 800dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F", 810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-t raw -F", 8239f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall /* TODO: If at some point we need more user chains than here, then we will need 8339f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall * a different cleanup approach. 8439f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall */ 8539f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall "-X", /* Should normally only be costly, penalty_box, and costly_<iface> */ 860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 874a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 884a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::setupCommands[] = { 890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Created needed chains. */ 900dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-N costly", 910dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-N penalty_box", 920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 940dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallconst char *BandwidthController::basicAccountingCommands[] = { 950dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F INPUT", 960dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -i lo --jump ACCEPT", 970dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -m owner --socket-exists", /* This is a tracking rule. */ 980dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 990dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F OUTPUT", 1000dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -o lo --jump ACCEPT", 1010dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -m owner --socket-exists", /* This is a tracking rule. */ 1020dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 1030dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F costly", 1040dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A costly --jump penalty_box", 1050dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A costly -m owner --socket-exists", /* This is a tracking rule. */ 1060dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 1070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 1080dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 1090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A costly --jump ACCEPT", 1100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 1114a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP AbgrallBandwidthController::BandwidthController(void) { 1134a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1144a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char value[PROPERTY_VALUE_MAX]; 1154a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall property_get("persist.bandwidth.enable", value, "0"); 1174a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (!strcmp(value, "1")) { 1184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall enableBandwidthControl(); 1194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 12326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling) { 1240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 12526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGD("runIpxtablesCmd(cmd=%s)", cmd); 12626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV4); 12726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV6); 1280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 1290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 1300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 13126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) { 13226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 13326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0' 13426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall strncpy(buffer, src, buffSize); 13526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return buffer[buffSize - 1]; 13626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall} 13726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 13826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling, IptIpVer iptVer) { 13926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall char buffer[MAX_CMD_LEN]; 1404a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall const char *argv[MAX_CMD_ARGS]; 14126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall int argc = 0; 1424a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *next = buffer; 1434a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *tmp; 1444a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string fullCmd = cmd; 14626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 14726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (rejectHandling == IptRejectAdd) { 1480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fullCmd += " --jump REJECT --reject-with"; 14926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (iptVer) { 15026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV4: 15126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall fullCmd += " icmp-net-prohibited"; 15226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 15326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV6: 15426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall fullCmd += " icmp6-adm-prohibited"; 15526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 1560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 15926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argc = 0; 16026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH; 161fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 162a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall LOGD("runIptablesCmd(): %s %s", argv[0], fullCmd.c_str()); 16326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) { 1640dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("iptables command too long"); 1650dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 1660dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1674a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1684a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall while ((tmp = strsep(&next, " "))) { 16926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = tmp; 1700dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (argc >= MAX_CMD_ARGS) { 1714a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall LOGE("iptables argument overflow"); 1724a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 1734a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1744a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 175fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 1764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall argv[argc] = NULL; 1774a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* TODO(jpa): Once this stabilizes, remove logwrap() as it tends to wedge netd 1784a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Then just talk directly to the kernel via rtnetlink. 1794a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 1804a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return logwrap(argc, argv, 0); 1814a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1824a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1834a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::enableBandwidthControl(void) { 184fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res; 185fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Some of the initialCommands are allowed to fail */ 18626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 18726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(setupCommands) / sizeof(char*), setupCommands, RunCmdFailureOk); 18826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res = runCommands(sizeof(basicAccountingCommands) / sizeof(char*), basicAccountingCommands, RunCmdFailureBad); 189fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 1904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1914a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1924a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1934a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::disableBandwidthControl(void) { 194fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* The cleanupCommands are allowed to fail. */ 19526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 196fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 1974a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1984a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 19926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runCommands(int numCommands, const char *commands[], RunCmdErrHandling cmdErrHandling) { 200fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 201fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGD("runCommands(): %d commands", numCommands); 202fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) { 20326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd); 20426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (res && cmdErrHandling != RunCmdFailureBad) 205fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 206fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 20726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return cmdErrHandling == RunCmdFailureBad ? res : 0; 208fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 209fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 2100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallstd::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) { 211fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 21226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall char *convBuff; 213fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 214fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 215fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpInsert: 216fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-I"; 217fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 218fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpReplace: 219fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-R"; 220fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 221fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall default: 222fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpDelete: 223fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-D"; 224fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 225fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 226fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " penalty_box"; 22726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall asprintf(&convBuff, "%d", uid); 228fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " -m owner --uid-owner "; 229fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += convBuff; 23026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall free(convBuff); 231fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 232fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 233fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 234fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::addNaughtyApps(int numUids, char *appUids[]) { 23526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd); 236fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 237fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 238fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) { 23926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove); 240fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 241fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 24226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) { 243fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall char cmd[MAX_CMD_LEN]; 244fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int uidNum; 24526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *failLogTemplate; 24626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall IptOp op; 247fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int appUids[numUids]; 24826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string naughtyCmd; 24926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (appOp) { 25026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpAdd: 25126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall op = IptOpInsert; 25226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall failLogTemplate = "Failed to add app uid %d to penalty box."; 25326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 25426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpRemove: 25526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall op = IptOpDelete; 25626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall failLogTemplate = "Failed to delete app uid %d from penalty box."; 25726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 25826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 25926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 260fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 261fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall appUids[uidNum] = atol(appStrUids[uidNum]); 262fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (appUids[uidNum] == 0) { 26326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 264fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_parse; 265fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 266fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 267fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 268fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 26926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(op, appUids[uidNum]); 27026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) { 27126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 272fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_with_uidNum; 273fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 274fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 275fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 276fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 27726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_with_uidNum: 278fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Try to remove the uid that failed in any case*/ 27926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]); 28026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd); 28126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_parse: 28226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 2834a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 2844a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 28526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallstd::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) { 286fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 287fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall char convBuff[21]; // log10(2^64) ~ 20 2880dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 2890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGD("makeIptablesQuotaCmd(%d, %llu)", op, quota); 2900dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 291fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 292fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpInsert: 293fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-I"; 294fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 295fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpReplace: 296fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-R"; 297fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 298fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall default: 299fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpDelete: 300fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-D"; 301fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 302fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 303fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " costly"; 304fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (costName) { 3050dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall res += "_"; 3060dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall res += costName; 307fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 308fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sprintf(convBuff, "%lld", quota); 3090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Use -m quota2 --name " + costName + " ! --quota " 3100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * once available. 3110dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 312fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " -m quota ! --quota "; 313fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += convBuff; 314fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall ; 3150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall // The requried --jump REJECT ... will be added later. 3160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3180dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 31926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) { 3200dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3220dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3250dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString = "costly"; 3260dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* The "-N costly" is created upfront, no need to handle it here. */ 32726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 32826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 3290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += "_"; 3300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 3320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-N %s", costCString); 33326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString); 33526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -m owner --socket-exists", costCString); 33726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3380dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 3390dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 3400dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 3410dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s --jump ACCEPT", costCString); 34226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 34326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 34426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 3450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 34626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3470dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-I INPUT -i %s --goto %s", ifn, costCString); 35026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-I OUTPUT -o %s --goto %s", ifn, costCString); 35226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3540dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3550dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 35626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) { 3570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3610dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3620dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString = "costly"; 36326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 36426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 3650dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += "_"; 3660dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3670dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 36826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 36926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 3700dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 37126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3720dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D INPUT -i %s --goto %s", ifn, costCString); 37526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3760dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D OUTPUT -o %s --goto %s", ifn, costCString); 37726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3780dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* The "-N costly" is created upfront, no need to handle it here. */ 38026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (quotaType == QuotaUnique) { 3810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-F %s", costCString); 38226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 383a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall snprintf(cmd, sizeof(cmd), "-X %s", costCString); 384a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 385fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 386fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 387fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 3884a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 3890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) { 3904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char cmd[MAX_CMD_LEN]; 3914a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 392fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 39326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 39426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName;; 39526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName = NULL; /* Shared quota */ 39626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<std::string>::iterator it; 3974a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 39826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 39926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 40026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 40126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 40226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 4034a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4044a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (maxBytes == -1) { 405fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return removeInterfaceSharedQuota(ifn); 4064a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4074a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4084a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* Insert ingress quota. */ 4090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 411fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 413fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 41526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaShared); 4160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 4170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 41826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 4194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (res) { 420fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("Failed set quota rule."); 421fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 4224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 423fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 424fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 4250dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.push_front(ifaceName); 426fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 427fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 428fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 429fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (maxBytes != sharedQuotaBytes) { 430fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Instead of replacing, which requires being aware of the rules in 431fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * the kernel, we just add a new one, then delete the older one. 432fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall */ 433fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 43526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 436fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes); 43826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 439fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 440fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (res) { 441fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("Failed replace quota rule."); 442fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 443fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 444fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 4454a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return 0; 447fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 448fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall fail: 4494a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* 4504a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 4514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * rules in the kernel to see which ones need cleaning up. 452fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 453fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * which resets everything. 4544a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 455fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall removeInterfaceSharedQuota(ifn); 4564a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 4574a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 4584a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 459fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeInterfaceSharedQuota(const char *iface) { 4604a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 461fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 46226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 4630dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::list<std::string>::iterator it; 4644a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 46526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 46626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 46726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 46826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 46926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName =ifn; 47026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 4710dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4720dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 473fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4744a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4750dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 476fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("No such iface %s to delete.", ifn); 477fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return -1; 4784a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 479fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 48026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaShared); 4810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.erase(it); 482fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4830dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 484fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string quotaCmd; 4850dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, NULL, sharedQuotaBytes); 48626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 487fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = -1; 488fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 489fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return res; 4914a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 4920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 4930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) { 4940dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 4950dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 49626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 49726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 49826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 49926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 5000dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5010dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (maxBytes == -1) { 50226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return removeInterfaceQuota(iface); 5030dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5040dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 50526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 50626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 50726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 50826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 50926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 51026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 51126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 5120dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Insert ingress quota. */ 5140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 5150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it->first == ifaceName) 5160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 5170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5180dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5190dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 52026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaUnique); 5210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 52226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("Failed set quota rule."); 5250dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5260dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5270dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes)); 5290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } else { 5310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Instead of replacing, which requires being aware of the rules in 5320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * the kernel, we just add a new one, then delete the older one. 5330dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 5340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 53526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, it->second); 53826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5390dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5400dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5410dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("Failed replace quota rule."); 5420dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5430dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5440dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall it->second = maxBytes; 5450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5460dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return 0; 5470dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fail: 5490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* 5500dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 5510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * rules in the kernel to see which ones need cleaning up. 5520dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 5530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * which resets everything. 5540dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 5550dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall removeInterfaceSharedQuota(ifn); 5560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 5570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 5580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::removeInterfaceQuota(const char *iface) { 5600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5610dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 5620dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 56326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 56426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 56526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 5660dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 56726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 56826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 56926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 57026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 57126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 57226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 5730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 5750dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it->first == ifaceName) 5760dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 5770dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5780dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 5800dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("No such iface %s to delete.", ifn); 5810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 5820dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5830dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5840dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* This also removes the quota command of CostlyIface chain. */ 58526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaUnique); 5860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5870dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaIfaces.erase(it); 5880dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 5900dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 591