BandwidthController.cpp revision bfa7466b328101a8b04807f26e85c84526c9a774
14a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/* 24a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Copyright (C) 2011 The Android Open Source Project 34a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 44a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Licensed under the Apache License, Version 2.0 (the "License"); 54a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * you may not use this file except in compliance with the License. 64a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * You may obtain a copy of the License at 74a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 84a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * http://www.apache.org/licenses/LICENSE-2.0 94a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 104a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Unless required by applicable law or agreed to in writing, software 114a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * distributed under the License is distributed on an "AS IS" BASIS, 124a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 134a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * See the License for the specific language governing permissions and 144a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * limitations under the License. 154a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 174a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <stdlib.h> 184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <fcntl.h> 194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <string.h> 204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/socket.h> 224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/stat.h> 234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/types.h> 244a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <sys/wait.h> 254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 264a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/netlink.h> 274a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/rtnetlink.h> 284a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <linux/pkt_sched.h> 294a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 304a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#define LOG_TAG "BandwidthController" 314a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/log.h> 324a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include <cutils/properties.h> 334a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 344a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallextern "C" int logwrap(int argc, const char **argv, int background); 354a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 364a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall#include "BandwidthController.h" 374a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 38fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst int BandwidthController::MAX_CMD_LEN = 1024; 394a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_IFACENAME_LEN = 64; 404a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst int BandwidthController::MAX_CMD_ARGS = 32; 414a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char BandwidthController::IPTABLES_PATH[] = "/system/bin/iptables"; 42fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallconst char BandwidthController::IP6TABLES_PATH[] = "/system/bin/ip6tables"; 434a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 444a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall/** 454a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Some comments about the rules: 464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * Ordering 474a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains. 484a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. "-I INPUT -i rmnet0 --goto costly" 494a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota'd rules in the costly chain should be before penalty_box lookups. 504a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * global quota vs per interface quota 524a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - global quota for all costly interfaces uses a single costly chain: 534a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . initial rules 54bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -N costly_shared 55bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I INPUT -i iface0 --goto costly_shared 56bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly_shared 57bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I costly_shared -m quota \! --quota 500000 \ 58bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 59bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_shared --jump penalty_box 60bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_shared -m owner --socket-exists 614a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * . adding a new iface to this, E.g.: 62bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I INPUT -i iface1 --goto costly_shared 63bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -I OUTPUT -o iface1 --goto costly_shared 644a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 654a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - quota per interface. This is achieve by having "costly" chains per quota. 664a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g. adding a new costly interface iface0 with its own quota: 674a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -N costly_iface0 684a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I INPUT -i iface0 --goto costly_iface0 694a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -I OUTPUT -o iface0 --goto costly_iface0 70bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_iface0 -m quota \! --quota 500000 \ 71bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 72bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A costly_iface0 --jump penalty_box 734a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * iptables -A costly_iface0 -m owner --socket-exists 744a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * 754a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * * penalty_box handling: 764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * - only one penalty_box for all interfaces 774a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * E.g Adding an app: 78bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * iptables -A penalty_box -m owner --uid-owner app_3 \ 79bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall * --jump REJECT --reject-with icmp-net-prohibited 804a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 814a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::cleanupCommands[] = { 820dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Cleanup rules. */ 830dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F", 840dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-t raw -F", 8539f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall /* TODO: If at some point we need more user chains than here, then we will need 8639f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall * a different cleanup approach. 8739f8f24246a5dac21be5cc5e32c0f395ee803766JP Abgrall */ 88bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-X", /* Should normally only be costly_shared, penalty_box, and costly_<iface> */ 890dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 904a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 914a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallconst char *BandwidthController::setupCommands[] = { 920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Created needed chains. */ 93bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-N costly_shared", 940dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-N penalty_box", 950dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 960dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 970dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallconst char *BandwidthController::basicAccountingCommands[] = { 980dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F INPUT", 990dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -i lo --jump ACCEPT", 1000dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A INPUT -m owner --socket-exists", /* This is a tracking rule. */ 1010dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 1020dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-F OUTPUT", 1030dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -o lo --jump ACCEPT", 1040dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall "-A OUTPUT -m owner --socket-exists", /* This is a tracking rule. */ 1050dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 106bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-F costly_shared", 107bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared --jump penalty_box", 108bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared -m owner --socket-exists", /* This is a tracking rule. */ 1090dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 1100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 1110dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 112bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall "-A costly_shared --jump ACCEPT", 1130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall}; 1144a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1154a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP AbgrallBandwidthController::BandwidthController(void) { 1164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1174a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char value[PROPERTY_VALUE_MAX]; 1184a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall property_get("persist.bandwidth.enable", value, "0"); 1204a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (!strcmp(value, "1")) { 1214a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall enableBandwidthControl(); 1224a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1234a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1244a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1254a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 12626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runIpxtablesCmd(const char *cmd, IptRejectOp rejectHandling) { 1270dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 12826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGD("runIpxtablesCmd(cmd=%s)", cmd); 12926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV4); 13026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIptablesCmd(cmd, rejectHandling, IptIpV6); 1310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 1320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 1330dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 13426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::StrncpyAndCheck(char *buffer, const char *src, size_t buffSize) { 13526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 13626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall memset(buffer, '\0', buffSize); // strncpy() is not filling leftover with '\0' 13726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall strncpy(buffer, src, buffSize); 13826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return buffer[buffSize - 1]; 13926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall} 14026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 14126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runIptablesCmd(const char *cmd, IptRejectOp rejectHandling, IptIpVer iptVer) { 14226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall char buffer[MAX_CMD_LEN]; 1434a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall const char *argv[MAX_CMD_ARGS]; 14426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall int argc = 0; 1454a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *next = buffer; 1464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char *tmp; 1474a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string fullCmd = cmd; 14926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 15026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (rejectHandling == IptRejectAdd) { 1510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fullCmd += " --jump REJECT --reject-with"; 15226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (iptVer) { 15326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV4: 15426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall fullCmd += " icmp-net-prohibited"; 15526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 15626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case IptIpV6: 15726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall fullCmd += " icmp6-adm-prohibited"; 15826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 1590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1610dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 16226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argc = 0; 16326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = iptVer == IptIpV4 ? IPTABLES_PATH : IP6TABLES_PATH; 164fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 165a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall LOGD("runIptablesCmd(): %s %s", argv[0], fullCmd.c_str()); 16626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(buffer, fullCmd.c_str(), sizeof(buffer))) { 1670dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("iptables command too long"); 1680dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 1690dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 1704a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1714a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall while ((tmp = strsep(&next, " "))) { 17226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall argv[argc++] = tmp; 1730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (argc >= MAX_CMD_ARGS) { 1744a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall LOGE("iptables argument overflow"); 1754a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 1764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 1774a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 178fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 1794a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall argv[argc] = NULL; 1804a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* TODO(jpa): Once this stabilizes, remove logwrap() as it tends to wedge netd 1814a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * Then just talk directly to the kernel via rtnetlink. 1824a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 1834a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return logwrap(argc, argv, 0); 1844a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1854a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1864a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::enableBandwidthControl(void) { 187fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res; 188fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Some of the initialCommands are allowed to fail */ 18926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 19026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(setupCommands) / sizeof(char*), setupCommands, RunCmdFailureOk); 19126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res = runCommands(sizeof(basicAccountingCommands) / sizeof(char*), basicAccountingCommands, RunCmdFailureBad); 192fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 1934a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1944a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 1954a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 1964a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrallint BandwidthController::disableBandwidthControl(void) { 197fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* The cleanupCommands are allowed to fail. */ 19826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runCommands(sizeof(cleanupCommands) / sizeof(char*), cleanupCommands, RunCmdFailureOk); 199fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 2004a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 2014a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 20226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::runCommands(int numCommands, const char *commands[], RunCmdErrHandling cmdErrHandling) { 203fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 204fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGD("runCommands(): %d commands", numCommands); 205fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (int cmdNum = 0; cmdNum < numCommands; cmdNum++) { 20626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res = runIpxtablesCmd(commands[cmdNum], IptRejectNoAdd); 20726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (res && cmdErrHandling != RunCmdFailureBad) 208fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 209fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 21026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return cmdErrHandling == RunCmdFailureBad ? res : 0; 211fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 212fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 2130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallstd::string BandwidthController::makeIptablesNaughtyCmd(IptOp op, int uid) { 214fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 21526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall char *convBuff; 216fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 217fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 218fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpInsert: 219fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-I"; 220fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 221fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpReplace: 222fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-R"; 223fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 224fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall default: 225fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpDelete: 226fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-D"; 227fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 228fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 229fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " penalty_box"; 23026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall asprintf(&convBuff, "%d", uid); 231fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += " -m owner --uid-owner "; 232fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += convBuff; 23326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall free(convBuff); 234fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 235fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 236fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 237fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::addNaughtyApps(int numUids, char *appUids[]) { 23826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpAdd); 239fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 240fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 241fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) { 24226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return maninpulateNaughtyApps(numUids, appUids, NaughtyAppOpRemove); 243fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 244fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 24526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::maninpulateNaughtyApps(int numUids, char *appStrUids[], NaughtyAppOp appOp) { 246fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall char cmd[MAX_CMD_LEN]; 247fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int uidNum; 24826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *failLogTemplate; 24926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall IptOp op; 250fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int appUids[numUids]; 25126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string naughtyCmd; 25226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (appOp) { 25326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpAdd: 25426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall op = IptOpInsert; 25526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall failLogTemplate = "Failed to add app uid %d to penalty box."; 25626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 25726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case NaughtyAppOpRemove: 25826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall op = IptOpDelete; 25926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall failLogTemplate = "Failed to delete app uid %d from penalty box."; 26026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 26126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 26226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 263fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 264fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall appUids[uidNum] = atol(appStrUids[uidNum]); 265fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (appUids[uidNum] == 0) { 26626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 267fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_parse; 268fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 269fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 270fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 271fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall for (uidNum = 0; uidNum < numUids; uidNum++) { 27226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(op, appUids[uidNum]); 27326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd)) { 27426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE(failLogTemplate, appUids[uidNum]); 275fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail_with_uidNum; 276fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 277fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 278fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return 0; 279fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 28026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_with_uidNum: 281fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Try to remove the uid that failed in any case*/ 28226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall naughtyCmd = makeIptablesNaughtyCmd(IptOpDelete, appUids[uidNum]); 28326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall runIpxtablesCmd(naughtyCmd.c_str(), IptRejectAdd); 28426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallfail_parse: 28526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 2864a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 2874a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 28826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallstd::string BandwidthController::makeIptablesQuotaCmd(IptOp op, const char *costName, int64_t quota) { 289fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string res; 290bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall char *convBuff; 2910dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 2920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGD("makeIptablesQuotaCmd(%d, %llu)", op, quota); 2930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 294fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall switch (op) { 295fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpInsert: 296fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-I"; 297fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 298fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpReplace: 299fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-R"; 300fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 301fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall default: 302fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall case IptOpDelete: 303fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res = "-D"; 304fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 305fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 306bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall res += " costly_"; 307bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall res += costName; 308bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall asprintf(&convBuff, "%lld", quota); 309bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall res += " -m quota2 --name "; 310bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall res += costName; 311bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall res += " ! --quota "; 312fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall res += convBuff; 313bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall free(convBuff); 314bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall // The requried IP version specific --jump REJECT ... will be added later. 3150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 31826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::prepCostlyIface(const char *ifn, QuotaType quotaType) { 3190dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3200dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3220dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* The "-N costly" is created upfront, no need to handle it here. */ 32526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 32626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 327bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costString = "costly_"; 3280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 3300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-N %s", costCString); 33126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -j penalty_box", costCString); 33326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s -m owner --socket-exists", costCString); 33526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3360dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* TODO(jpa): Figure out why iptables doesn't correctly return from this 3370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * chain. For now, hack the chain exit with an ACCEPT. 3380dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 3390dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-A %s --jump ACCEPT", costCString); 34026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 34126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 34226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 343bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costCString = "costly_shared"; 34426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3460dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3470dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-I INPUT -i %s --goto %s", ifn, costCString); 34826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-I OUTPUT -o %s --goto %s", ifn, costCString); 35026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 3520dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 3530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 35426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrallint BandwidthController::cleanupCostlyIface(const char *ifn, QuotaType quotaType) { 3550dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char cmd[MAX_CMD_LEN]; 3560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 3570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::string costString; 3580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall const char *costCString; 3590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 36026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall switch (quotaType) { 36126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaUnique: 362bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costString = "costly_"; 3630dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costString += ifn; 3640dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall costCString = costString.c_str(); 36526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 36626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall case QuotaShared: 367bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall costCString = "costly_shared"; 36826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall break; 3690dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 3700dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 3710dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D INPUT -i %s --goto %s", ifn, costCString); 37226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-D OUTPUT -o %s --goto %s", ifn, costCString); 37426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 3750dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 376bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall /* The "-N costly_shared" is created upfront, no need to handle it here. */ 37726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (quotaType == QuotaUnique) { 3780dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall snprintf(cmd, sizeof(cmd), "-F %s", costCString); 37926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 380a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall snprintf(cmd, sizeof(cmd), "-X %s", costCString); 381a9f802c23f4c2c53fa1065b75f712ce46f384c3aJP Abgrall res |= runIpxtablesCmd(cmd, IptRejectNoAdd); 382fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 383fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return res; 384fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall} 3854a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 3860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceSharedQuota(const char *iface, int64_t maxBytes) { 3874a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char cmd[MAX_CMD_LEN]; 3884a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 389fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 39026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 39126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName;; 392bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall const char *costName = "shared"; 39326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<std::string>::iterator it; 3944a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 39526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if (StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 39626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 39726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 39826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 39926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 4004a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4014a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (maxBytes == -1) { 402fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return removeInterfaceSharedQuota(ifn); 4034a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4044a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 4054a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* Insert ingress quota. */ 4060dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4070dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 408fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4094a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 410fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4110dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 41226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaShared); 4130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 4140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 41526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 4164a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall if (res) { 417fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("Failed set quota rule."); 418fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 4194a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 420fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 421fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 4220dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.push_front(ifaceName); 423fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 424fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 425fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 426fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (maxBytes != sharedQuotaBytes) { 427fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall /* Instead of replacing, which requires being aware of the rules in 428fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * the kernel, we just add a new one, then delete the older one. 429fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall */ 430fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 43226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 433fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes); 43526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 436fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 437fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall if (res) { 438fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("Failed replace quota rule."); 439fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall goto fail; 440fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 441fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = maxBytes; 4424a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4434a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return 0; 444fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 445fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall fail: 4464a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall /* 4474a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 4484a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall * rules in the kernel to see which ones need cleaning up. 449fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 450fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall * which resets everything. 4514a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall */ 452fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall removeInterfaceSharedQuota(ifn); 4534a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return -1; 4544a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 4554a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 456fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrallint BandwidthController::removeInterfaceSharedQuota(const char *iface) { 4574a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall char ifn[MAX_IFACENAME_LEN]; 458fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall int res = 0; 45926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 4600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall std::list<std::string>::iterator it; 461bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall const char *costName = "shared"; 4624a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall 46326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 46426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 46526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 46626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 46726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName =ifn; 46826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 4690dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = sharedQuotaIfaces.begin(); it != sharedQuotaIfaces.end(); it++) { 4700dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (*it == ifaceName) 471fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall break; 4724a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 4730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == sharedQuotaIfaces.end()) { 474fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall LOGE("No such iface %s to delete.", ifn); 475fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall return -1; 4764a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall } 477fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 47826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaShared); 4790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall sharedQuotaIfaces.erase(it); 480fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (sharedQuotaIfaces.empty()) { 482fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall std::string quotaCmd; 483bfa7466b328101a8b04807f26e85c84526c9a774JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, sharedQuotaBytes); 48426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 485fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall sharedQuotaBytes = -1; 486fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall } 487fa6f46d3370ae5475fc3bc8273bbe04ee7348d60JP Abgrall 4884a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall return res; 4894a5f5ca3c9e07fc3e6feca2afde07f41a8a64f11JP Abgrall} 4900dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 4910dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::setInterfaceQuota(const char *iface, int64_t maxBytes) { 4920dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 4930dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 49426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 49526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 49626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 49726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string quotaCmd; 4980dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 4990dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (maxBytes == -1) { 50026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return removeInterfaceQuota(iface); 5010dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5020dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 50326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 50426e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 50526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 50626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 50726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 50826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 50926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall 5100dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5110dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Insert ingress quota. */ 5120dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 5130dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it->first == ifaceName) 5140dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 5150dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5160dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5170dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 51826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= prepCostlyIface(ifn, QuotaUnique); 5190dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 52026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5210dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5220dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("Failed set quota rule."); 5230dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5240dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5250dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5260dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaIfaces.push_front(QuotaInfo(ifaceName, maxBytes)); 5270dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5280dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } else { 5290dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* Instead of replacing, which requires being aware of the rules in 5300dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * the kernel, we just add a new one, then delete the older one. 5310dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 5320dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpInsert, costName, maxBytes); 53326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5340dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5350dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaCmd = makeIptablesQuotaCmd(IptOpDelete, costName, it->second); 53626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= runIpxtablesCmd(quotaCmd.c_str(), IptRejectAdd); 5370dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5380dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (res) { 5390dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("Failed replace quota rule."); 5400dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall goto fail; 5410dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5420dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall it->second = maxBytes; 5430dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5440dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return 0; 5450dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5460dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall fail: 5470dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* 5480dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * TODO(jpa): once we get rid of iptables in favor of rtnetlink, reparse 5490dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * rules in the kernel to see which ones need cleaning up. 5500dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * For now callers needs to choose if they want to "ndc bandwidth enable" 5510dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall * which resets everything. 5520dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall */ 5530dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall removeInterfaceSharedQuota(ifn); 5540dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 5550dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 5560dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5570dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrallint BandwidthController::removeInterfaceQuota(const char *iface) { 5580dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5590dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall char ifn[MAX_IFACENAME_LEN]; 5600dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall int res = 0; 56126e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::string ifaceName; 56226e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall const char *costName; 56326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall std::list<QuotaInfo>::iterator it; 5640dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 56526e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall if(StrncpyAndCheck(ifn, iface, sizeof(ifn))) { 56626e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall LOGE("Interface name longer than %d", MAX_IFACENAME_LEN); 56726e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall return -1; 56826e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall } 56926e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall ifaceName = ifn; 57026e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall costName = iface; 5710dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5720dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall for (it = quotaIfaces.begin(); it != quotaIfaces.end(); it++) { 5730dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it->first == ifaceName) 5740dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall break; 5750dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5760dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5770dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall if (it == quotaIfaces.end()) { 5780dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall LOGE("No such iface %s to delete.", ifn); 5790dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return -1; 5800dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall } 5810dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5820dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall /* This also removes the quota command of CostlyIface chain. */ 58326e0d49fa743d7881104196a9eda733bd2aac92fJP Abgrall res |= cleanupCostlyIface(ifn, QuotaUnique); 5840dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5850dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall quotaIfaces.erase(it); 5860dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall 5870dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall return res; 5880dad7c2f1f6994fbe5e85b9e1fc72d29d6453211JP Abgrall} 589