BandwidthController.cpp revision 8a93272255f1b7e3083a97e1e28ddf675c0c7fb0
14a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/* 24a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Copyright (C) 2011 The Android Open Source Project 34a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 44a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Licensed under the Apache License, Version 2.0 (the "License"); 54a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * you may not use this file except in compliance with the License. 64a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * You may obtain a copy of the License at 74a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 84a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * http://www.apache.org/licenses/LICENSE-2.0 94a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 104a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Unless required by applicable law or agreed to in writing, software 114a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * distributed under the License is distributed on an "AS IS" BASIS, 124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 134a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * See the License for the specific language governing permissions and 144a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * limitations under the License. 154a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 178a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall#include <errno.h> 184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <fcntl.h> 198a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall#include <stdlib.h> 204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <string.h> 214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/socket.h> 234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/stat.h> 244a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/types.h> 254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/wait.h> 264a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 274a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/netlink.h> 284a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/rtnetlink.h> 294a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/pkt_sched.h> 304a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 314a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#define LOG_TAG "BandwidthController" 324a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/log.h> 334a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/properties.h> 344a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 354a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallextern "C" int logwrap(int argc, const char **argv, int background); 364a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 374a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include "BandwidthController.h" 384a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 39fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst int BandwidthController::MAX_CMD_LEN = 1024; 404a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_IFACENAME_LEN = 64; 414a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_CMD_ARGS = 32; 424a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char BandwidthController::IPTABLES_PATH[] = "/system/bin/iptables"; 43fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst char BandwidthController::IP6TABLES_PATH[] = "/system/bin/ip6tables"; 448a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallconst char BandwidthController::ALERT_IPT_TEMPLATE[] = "%s %s -m quota2 ! --quota %lld --name %s"; 458a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallconst int BandwidthController::ALERT_RULE_POS_IN_COSTLY_CHAIN = 4; 464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 474a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/** 484a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Some comments about the rules: 494a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * Ordering 504a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains. 514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. "-I INPUT -i rmnet0 --goto costly" 524a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota'd rules in the costly chain should be before penalty_box lookups. 534a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 544a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * global quota vs per interface quota 554a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - global quota for all costly interfaces uses a single costly chain: 564a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . initial rules 57bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -N costly_shared 58bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I INPUT -i iface0 --goto costly_shared 59bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly_shared 60bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I costly_shared -m quota \! --quota 500000 \ 61bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 62bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_shared --jump penalty_box 63bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_shared -m owner --socket-exists 648a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall * 654a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . adding a new iface to this, E.g.: 66bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I INPUT -i iface1 --goto costly_shared 67bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I OUTPUT -o iface1 --goto costly_shared 684a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 694a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota per interface. This is achieve by having "costly" chains per quota. 704a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. adding a new costly interface iface0 with its own quota: 714a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -N costly_iface0 724a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I INPUT -i iface0 --goto costly_iface0 734a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly_iface0 74bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_iface0 -m quota \! --quota 500000 \ 75bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 76bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_iface0 --jump penalty_box 774a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly_iface0 -m owner --socket-exists 784a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 794a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * penalty_box handling: 804a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - only one penalty_box for all interfaces 814a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g Adding an app: 82bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A penalty_box -m owner --uid-owner app_3 \ 83bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 844a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 854a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::cleanupCommands[] = { 860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Cleanup rules. */ 870dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F", 880dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-t raw -F", 8939f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall /* TODO: If at some point we need more user chains than here, then we will need 9039f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall * a different cleanup approach. 9139f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall */ 92bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-X", /* Should normally only be costly_shared, penalty_box, and costly_<iface> */ 930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 944a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 954a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::setupCommands[] = { 960dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Created needed chains. */ 97bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-N costly_shared", 980dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-N penalty_box", 990dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 1000dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 1010dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallconst char *BandwidthController::basicAccountingCommands[] = { 1020dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F INPUT", 1030dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -i lo --jump ACCEPT", 1040dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -m owner --socket-exists", /* This is a tracking rule. */ 1050dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 1060dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F OUTPUT", 1070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -o lo --jump ACCEPT", 1080dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -m owner --socket-exists", /* This is a tracking rule. */ 1090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 110bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-F costly_shared", 111bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared --jump penalty_box", 112bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared -m owner --socket-exists", /* This is a tracking rule. */ 1130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 1140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 1150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 116bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared --jump ACCEPT", 1170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 1184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP AbgrallBandwidthController::BandwidthController(void) { 1204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char value[PROPERTY_VALUE_MAX]; 1214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall property_get("persist.bandwidth.enable", value, "0"); 1234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (!strcmp(value, "1")) { 1244a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall enableBandwidthControl(); 1254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1264a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1274a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1284a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 12926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling) { 1300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 1318a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 13226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGD("runIpxtablesCmd(cmd=%s)", cmd); 13326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV4); 13426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV6); 1350dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 1360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 1370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 13826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) { 13926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 14026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0' 14126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall strncpy(buffer, src, buffSize); 14226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return buffer[buffSize - 1]; 14326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall} 14426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 1458a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling, 1468a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall IptIpVer iptVer) { 14726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall char buffer[MAX_CMD_LEN]; 1484a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall const char *argv[MAX_CMD_ARGS]; 14926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall int argc = 0; 1504a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *next = buffer; 1514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *tmp; 1524a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string fullCmd = cmd; 15426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 15526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (rejectHandling == IptRejectAdd) { 1560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fullCmd += " --jump REJECT --reject-with"; 15726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (iptVer) { 15826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV4: 1598a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fullCmd += " icmp-net-prohibited"; 1608a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 16126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV6: 1628a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fullCmd += " icmp6-adm-prohibited"; 1638a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 1640dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1650dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1660dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 16726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argc = 0; 16826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH; 169fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 170a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall LOGD("runIptablesCmd(): %s %s", argv[0], fullCmd.c_str()); 17126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) { 1720dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("iptables command too long"); 1730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 1740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1754a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall while ((tmp = strsep(&next, " "))) { 17726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = tmp; 1780dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (argc >= MAX_CMD_ARGS) { 1794a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall LOGE("iptables argument overflow"); 1804a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 1814a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1824a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 183fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 1844a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall argv[argc] = NULL; 1854a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* TODO(jpa): Once this stabilizes, remove logwrap() as it tends to wedge netd 1864a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Then just talk directly to the kernel via rtnetlink. 1874a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 1884a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return logwrap(argc, argv, 0); 1894a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1914a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::enableBandwidthControl(void) { 192fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res; 193fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Some of the initialCommands are allowed to fail */ 19426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 19526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(setupCommands) / sizeof(char*), setupCommands, RunCmdFailureOk); 1968a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = runCommands(sizeof(basicAccountingCommands) / sizeof(char*), basicAccountingCommands, 1978a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall RunCmdFailureBad); 1988a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 1998a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall sharedQuotaBytes = sharedAlertBytes = 0; 2008a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall sharedQuotaIfaces.clear(); 2018a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall quotaIfaces.clear(); 2028a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall naughtyAppUids.clear(); 2038a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 204fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 2054a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 2064a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 2074a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 2084a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::disableBandwidthControl(void) { 209fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* The cleanupCommands are allowed to fail. */ 21026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 211fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 2124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 2134a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 2148a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::runCommands(int numCommands, const char *commands[], 2158a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall RunCmdErrHandling cmdErrHandling) { 216fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 217fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGD("runCommands(): %d commands", numCommands); 218fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) { 21926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd); 22026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (res && cmdErrHandling != RunCmdFailureBad) 221fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 222fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 22326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return cmdErrHandling == RunCmdFailureBad ? res : 0; 224fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 225fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 2260dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallstd::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) { 227fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 2288a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *buff; 2298a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall const char *opFlag; 230fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 231fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 2328a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpInsert: 2338a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-I"; 2348a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 2358a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpReplace: 2368a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-R"; 2378a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 2388a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall default: 2398a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpDelete: 2408a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-D"; 2418a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 242fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 2438a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&buff, "%s penalty_box -m owner --uid-owner %d", opFlag, uid); 2448a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = buff; 2458a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(buff); 246fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 247fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 248fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 249fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::addNaughtyApps(int numUids, char *appUids[]) { 25026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd); 251fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 252fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 253fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) { 25426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove); 255fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 256fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 25726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) { 258fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall char cmd[MAX_CMD_LEN]; 259fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int uidNum; 26026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *failLogTemplate; 26126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall IptOp op; 262fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int appUids[numUids]; 26326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string naughtyCmd; 2648a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 26526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (appOp) { 26626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpAdd: 2678a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall op = IptOpInsert; 2688a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall failLogTemplate = "Failed to add app uid %d to penalty box."; 2698a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 27026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpRemove: 2718a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall op = IptOpDelete; 2728a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall failLogTemplate = "Failed to delete app uid %d from penalty box."; 2738a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 27426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 27526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 276fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 277fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall appUids[uidNum] = atol(appStrUids[uidNum]); 278fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (appUids[uidNum] == 0) { 27926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 280fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_parse; 281fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 282fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 283fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 284fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 28526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(op, appUids[uidNum]); 28626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) { 28726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 288fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_with_uidNum; 289fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 290fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 291fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 292fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 29326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_with_uidNum: 294fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Try to remove the uid that failed in any case*/ 29526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]); 29626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd); 29726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_parse: 29826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 2994a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 3004a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 30126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallstd::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) { 302fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 3038a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *buff; 3048a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall const char *opFlag; 3050dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3068a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGD("makeIptablesQuotaCmd(%d, %lld)", op, quota); 3070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 308fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 3098a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpInsert: 3108a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-I"; 3118a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 3128a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpReplace: 3138a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-R"; 3148a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 3158a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall default: 3168a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpDelete: 3178a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-D"; 3188a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 319fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 3208a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 321bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall // The requried IP version specific --jump REJECT ... will be added later. 3228a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&buff, "%s costly_%s -m quota2 ! --quota %lld --name %s", opFlag, costName, quota, 3238a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall costName); 3248a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = buff; 3258a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(buff); 3260dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3270dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 32926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) { 3300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3328a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int ruleInsertPos = 1; 3330dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3350dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* The "-N costly" is created upfront, no need to handle it here. */ 33726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 33826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 339bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costString = "costly_"; 3400dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3410dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 3420dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-N %s", costCString); 34326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3440dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString); 34526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3460dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -m owner --socket-exists", costCString); 34726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 3490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 3500dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 3510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s --jump ACCEPT", costCString); 35226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 35326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 35426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 355bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costCString = "costly_shared"; 35626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3598a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (globalAlertBytes) { 3608a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall /* The alert rule comes 1st */ 3618a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall ruleInsertPos = 2; 3628a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 3638a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall snprintf(cmd, sizeof(cmd), "-I INPUT %d -i %s --goto %s", ruleInsertPos, ifn, costCString); 36426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3658a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall snprintf(cmd, sizeof(cmd), "-I OUTPUT %d -o %s --goto %s", ruleInsertPos, ifn, costCString); 36626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3670dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3680dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3690dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 37026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) { 3710dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3720dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3750dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 37626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 37726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 378bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costString = "costly_"; 3790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3800dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 38126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 38226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 383bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costCString = "costly_shared"; 38426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3850dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3870dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D INPUT -i %s --goto %s", ifn, costCString); 38826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D OUTPUT -o %s --goto %s", ifn, costCString); 39026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3910dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 392bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall /* The "-N costly_shared" is created upfront, no need to handle it here. */ 39326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (quotaType == QuotaUnique) { 3940dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-F %s", costCString); 39526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 396a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall snprintf(cmd, sizeof(cmd), "-X %s", costCString); 397a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 398fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 399fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 400fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 4014a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4020dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) { 4034a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char cmd[MAX_CMD_LEN]; 4044a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 405fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 40626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 4078a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall std::string ifaceName; 4088a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall ; 409bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall const char *costName = "shared"; 41026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<std::string>::iterator it; 4114a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4128a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!maxBytes) { 4138a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall /* Don't talk about -1, deprecate it. */ 4148a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 4158a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 4168a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 41726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 41826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 41926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 42026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 42126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 4224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (maxBytes == -1) { 424fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return removeInterfaceSharedQuota(ifn); 4254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4264a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4274a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* Insert ingress quota. */ 4280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 430fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4314a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 432fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4330dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 43426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaShared); 4350dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 4360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 43726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 4384a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (res) { 4398a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Failed set quota rule"); 440fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 4414a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 442fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 443fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 4440dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.push_front(ifaceName); 445fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 446fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 447fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 448fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (maxBytes != sharedQuotaBytes) { 4498a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= updateQuota(costName, maxBytes); 450fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (res) { 4518a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Failed update quota for %s", costName); 452fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 453fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 454fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 4554a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4564a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return 0; 457fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 458fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall fail: 4594a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* 4604a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 4614a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * rules in the kernel to see which ones need cleaning up. 462fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 463fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * which resets everything. 4644a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 465fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall removeInterfaceSharedQuota(ifn); 4664a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 4674a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 4684a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4698a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall/* It will also cleanup any shared alerts */ 470fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeInterfaceSharedQuota(const char *iface) { 4714a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 472fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 47326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 4740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::list<std::string>::iterator it; 475bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall const char *costName = "shared"; 4764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4778a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 47826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 47926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 48026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 4818a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall ifaceName = ifn; 48226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 4830dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4840dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 485fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4864a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4870dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 4888a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("No such iface %s to delete", ifn); 489fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return -1; 4904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 491fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 49226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaShared); 4930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.erase(it); 494fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4950dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 496fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string quotaCmd; 497bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes); 49826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 4998a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall sharedQuotaBytes = 0; 5008a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (sharedAlertBytes) { 5018a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall removeSharedAlert(); 5028a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall sharedAlertBytes = 0; 5038a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 504fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 5054a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return res; 5064a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 5070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5080dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) { 5090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 5100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 51126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 51226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 51326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 51426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 5150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5168a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!maxBytes) { 5178a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall /* Don't talk about -1, deprecate it. */ 5188a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 5198a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 5208a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 5210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (maxBytes == -1) { 52226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return removeInterfaceQuota(iface); 5230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5258a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 52626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 52726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 52826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 52926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 53026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 53126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 5320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Insert ingress quota. */ 5330dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 5348a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it->ifaceName == ifaceName) 5350dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 5360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5380dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 53926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaUnique); 5400dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 54126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5420dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5438a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Failed set quota rule"); 5440dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5460dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5478a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes, 0)); 5480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } else { 5508a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= updateQuota(costName, maxBytes); 5510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5528a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Failed update quota for %s", iface); 5530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5540dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5558a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall it->quota = maxBytes; 5560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return 0; 5580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fail: 5600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* 5610dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 5620dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * rules in the kernel to see which ones need cleaning up. 5630dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 5640dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * which resets everything. 5650dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 5660dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall removeInterfaceSharedQuota(ifn); 5670dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 5680dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 5690dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5708a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::getInterfaceSharedQuota(int64_t *bytes) { 5718a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return getInterfaceQuota("shared", bytes); 5728a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 5738a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 5748a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::getInterfaceQuota(const char *costName, int64_t *bytes) { 5758a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall FILE *fp; 5768a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *fname; 5778a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int scanRes; 5788a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 5798a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&fname, "/proc/net/xt_quota/%s", costName); 5808a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fp = fopen(fname, "r"); 5818a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(fname); 5828a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!fp) { 5838a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Reading quota %s failed (%s)", costName, strerror(errno)); 5848a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 5858a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 5868a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall scanRes = fscanf(fp, "%lld", bytes); 5878a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGD("Read quota res=%d bytes=%lld", scanRes, *bytes); 5888a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fclose(fp); 5898a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return scanRes == 1 ? 0 : -1; 5908a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 5918a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 5920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::removeInterfaceQuota(const char *iface) { 5930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5940dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 5950dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 59626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 59726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 59826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 5990dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6008a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 60126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 60226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 60326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 60426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 60526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 6060dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 6088a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it->ifaceName == ifaceName) 6090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 6100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 6110dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6120dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 6138a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("No such iface %s to delete", ifn); 6140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 6150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 6160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* This also removes the quota command of CostlyIface chain. */ 61826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaUnique); 6190dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6200dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaIfaces.erase(it); 6210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 6220dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 6230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 6248a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6258a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::updateQuota(const char *quotaName, int64_t bytes) { 6268a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall FILE *fp; 6278a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *fname; 6288a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6298a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&fname, "/proc/net/xt_quota/%s", quotaName); 6308a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fp = fopen(fname, "w"); 6318a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(fname); 6328a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!fp) { 6338a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Updating quota %s failed (%s)", quotaName, strerror(errno)); 6348a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 6358a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 6368a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fprintf(fp, "%lld\n", bytes); 6378a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall fclose(fp); 6388a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return 0; 6398a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 6408a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6418a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::runIptablesAlertCmd(IptOp op, const char *alertName, int64_t bytes) { 6428a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int res = 0; 6438a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall const char *opFlag; 6448a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertQuotaCmd; 6458a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6468a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall switch (op) { 6478a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpInsert: 6488a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-I"; 6498a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 6508a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpReplace: 6518a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-R"; 6528a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 6538a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall default: 6548a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall case IptOpDelete: 6558a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall opFlag = "-D"; 6568a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 6578a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 6588a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6598a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "INPUT", bytes, alertName, alertName); 6608a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd); 6618a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertQuotaCmd); 6628a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "OUTPUT", bytes, alertName, alertName); 6638a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd); 6648a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertQuotaCmd); 6658a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return res; 6668a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 6678a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6688a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::setGlobalAlert(int64_t bytes) { 6698a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertQuotaCmd; 6708a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall const char *alertName = "globalAlert"; 6718a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int res = 0; 6728a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6738a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!bytes) { 6748a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 6758a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 6768a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 6778a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (globalAlertBytes) { 6788a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = updateQuota(alertName, bytes); 6798a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } else { 6808a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = runIptablesAlertCmd(IptOpInsert, alertName, bytes); 6818a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 6828a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall globalAlertBytes = bytes; 6838a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return res; 6848a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 6858a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6868a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::removeGlobalAlert(void) { 6878a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertQuotaCmd; 6888a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6898a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall const char *alertName = "globalAlert"; 6908a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int res = 0; 6918a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 6928a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!globalAlertBytes) { 6938a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("No prior alert set"); 6948a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 6958a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 6968a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = runIptablesAlertCmd(IptOpDelete, alertName, globalAlertBytes); 6978a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall globalAlertBytes = 0; 6988a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return res; 6998a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7008a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7018a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::setSharedAlert(int64_t bytes) { 7028a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!sharedQuotaBytes) { 7038a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Need to have a prior shared quota set to set an alert"); 7048a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7058a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7068a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!bytes) { 7078a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 7088a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7098a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7108a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return setCostlyAlert("shared", bytes, &sharedAlertBytes); 7118a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7128a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7138a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::removeSharedAlert(void) { 7148a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return removeCostlyAlert("shared", &sharedAlertBytes); 7158a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7168a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7178a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::setInterfaceAlert(const char *iface, int64_t bytes) { 7188a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall std::list<QuotaInfo>::iterator it; 7198a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7208a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!bytes) { 7218a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 7228a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7238a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7248a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 7258a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it->ifaceName == iface) 7268a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 7278a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7288a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7298a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it == quotaIfaces.end()) { 7308a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Need to have a prior interface quota set to set an alert"); 7318a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7328a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7338a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7348a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return setCostlyAlert(iface, bytes, &it->alert); 7358a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7368a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7378a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::removeInterfaceAlert(const char *iface) { 7388a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall std::list<QuotaInfo>::iterator it; 7398a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7408a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 7418a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it->ifaceName == iface) 7428a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall break; 7438a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7448a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7458a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (it == quotaIfaces.end()) { 7468a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("No prior alert set for interface %s", iface); 7478a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7488a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7498a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7508a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return removeCostlyAlert(iface, &it->alert); 7518a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7528a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7538a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::setCostlyAlert(const char *costName, int64_t bytes, int64_t *alertBytes) { 7548a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertQuotaCmd; 7558a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *chainNameAndPos; 7568a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int res = 0; 7578a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertName; 7588a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7598a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!bytes) { 7608a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("Invalid bytes value. 1..max_int64."); 7618a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7628a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7638a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertName, "%sAlert", costName); 7648a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (*alertBytes) { 7658a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res = updateQuota(alertName, *alertBytes); 7668a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } else { 7678a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&chainNameAndPos, "costly_%s %d", costName, ALERT_RULE_POS_IN_COSTLY_CHAIN); 7688a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-I", chainNameAndPos, bytes, alertName, 7698a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall alertName); 7708a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd); 7718a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertQuotaCmd); 7728a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(chainNameAndPos); 7738a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7748a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall *alertBytes = bytes; 7758a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertName); 7768a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return res; 7778a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 7788a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7798a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrallint BandwidthController::removeCostlyAlert(const char *costName, int64_t *alertBytes) { 7808a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertQuotaCmd; 7818a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *chainName; 7828a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall char *alertName; 7838a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall int res = 0; 7848a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7858a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertName, "%sAlert", costName); 7868a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall if (!*alertBytes) { 7878a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall LOGE("No prior alert set for %s alert", costName); 7888a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return -1; 7898a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall } 7908a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7918a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&chainName, "costly_%s", costName); 7928a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall asprintf(&alertQuotaCmd, ALERT_IPT_TEMPLATE, "-D", chainName, *alertBytes, alertName, alertName); 7938a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall res |= runIpxtablesCmd(alertQuotaCmd, IptRejectNoAdd); 7948a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertQuotaCmd); 7958a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(chainName); 7968a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall 7978a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall *alertBytes = 0; 7988a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall free(alertName); 7998a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall return res; 8008a93272255f1b7e3083a97e1e28ddf675c0c7fb0JP Abgrall} 801