History log of /system/netd/server/BandwidthController.cpp
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
3450b662e8adbff215aa05fdc3c8e3167819c672 26-Sep-2017 Lorenzo Colitti <lorenzo@google.com> Allow connectivity-critical packets in data saver mode.

This makes IPv6 work on metered wifi networks. Without this:

1. We reject incoming RAs, so we lose connectivity when the RA
parameters expire.
2. We reject incoming NAs, so we get NUD failures.

Bug: 66015813
Test: angler builds, boots
Test: netd_{unit,integration}_test pass
Test: CtsHostsideNetworkTests tests pass
Change-Id: I033040ef0b91c22035e29c636123cd41ab1967ec
Merged-In: I033040ef0b91c22035e29c636123cd41ab1967ec
/system/netd/server/BandwidthController.cpp
066b822f78666758ff82c43321ade07fd0d54eb3 10-Aug-2017 Lorenzo Colitti <lorenzo@google.com> Delete all remaining callers of iptables.

Also move to binder_test.cpp some string constants that are used
only there.

(cherry picked from commit 5c68b9c1e4b7d8cf05b6ce9f6d1458ffda225eac)

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Change-Id: Icebaac93fc3a661902deced985119d2d1735732e
Merged-In: I3f72946de374a7deaeef88b1dd5589d9a20ccce7
/system/netd/server/BandwidthController.cpp
c61625942041127913de28ad0732b1ad2f6ef60b 16-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Remove now-unused strncpyAndCheck.

Test: bullhead-eng builds
Change-Id: Idacfeb71c1f108d9f51ce6f509ae16dbba8a2c2b
/system/netd/server/BandwidthController.cpp
0ecddc0aa28d6caf0f7c61710ff9ce189980283c 06-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Delete the last iptables commands in BandwidthController.

Bug: 28362720
Test: netd_{unit,integration}_test pass
Change-Id: I7e64747e3b933cdf1b76cd20356b9ff86015ec61
/system/netd/server/BandwidthController.cpp
e85ffe1f7f97fb7f2c60e237167b090d3aa85a80 06-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Switch costly alerts to iptables-restore.

Costly alerts appear to be currently unused, but they are the
last user of iptables commands in BandwidthController, so
migrating them to iptables-restore will allow us to delete
the iptables-specific code in BandwidthController.

Bug: 28362720
Test: netd_{unit,integration}_test pass
Change-Id: I07c6df6df347fd6485e6d0740b7d6165a423e34b
/system/netd/server/BandwidthController.cpp
b7ac3f7e3ed4569e15bb5a57d70458585eb9fe53 06-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Minor improvements to shared quota error handling.

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Change-Id: Ib3de9f4f3317373619ba185a6e7860f0fc82ca7b
/system/netd/server/BandwidthController.cpp
48f83006a0c5cf35d1f8d20fcd4213e4b325997e 06-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Convert set*Quota to use iptablesRestore.

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Test: quota rules are added and removed when quotas are enabled/disabled
Change-Id: Ib4df4f10a26c8bc206cc67671da09618fa4224ac
/system/netd/server/BandwidthController.cpp
d59526a685e883752ad2139ba870aea86dbbd104 28-Jun-2017 Joel Scherpelz <jscherpelz@google.com> Refactor interface quota code before moving to iptables-restore.

This change substantially refactors the interface and shared
quota code in BandwidthController in preparation for making it
use IptablesRestoreController.

There should be no functional change.

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Test: quota rules are added and removed when quotas are enabled/disabled
Change-Id: I7379fac58da4d98958bb050055a3c6bd7c617aa3
/system/netd/server/BandwidthController.cpp
2782b6b4bee3934c52596d932d3d7c7367b434b6 06-Jul-2017 Lorenzo Colitti <lorenzo@google.com> Remove superfluous quota rule delete commands.

When setting shared or interface quota, BandwidthController will
delete rules in bw_{FORWARD,INPUT,OUTPUT} before re-adding them.
These deletes are guaranteed to fail because the rules being
deleted only exist when bandwidth control is enabled and the
applicable interface is in mQuotaIfaces. Specifically, as long
as no intermediate iptables commands fail:

1. When bandwidth control is enabled or disabled, all the
bw_{FORWARD,INPUT,OUTPUT} chains are cleared by
flushCleanTables.
2. The rules that were being deleted are only added when
bandwidth control is enabled and an interface is added to
mQuotaIfaces.
3. Adding a quota is a no-op if the interface is already in
mQuotaIfaces (or mSharedQuotaIfaces for shared quotas).
4. When an interface is removed from mQuotaIfaces (or
mSharedQuotaIfaces), the rules are always deleted.

In the presence of intermediate iptables command failures this
change could make things worse, but an upcoming change will move
the quota commands to iptables-restore, which will ensure that
iptables commands in a quota operation either all succeed or all
fail.

In addition to removing the superfluous deletes, also change the
order of the commands that create a chain from "-F then -N" to
"-N then -F". This simplifies the code and the tests a bit.

Bug: 28362720
Test: bullhead builds, boots
Test: netd_{unit,integration}_test pass
Test: quota rules are added and removed when quotas are enabled/disabled
Change-Id: I64a0a2aa16066163c71f6d3ead36839b51c34620
/system/netd/server/BandwidthController.cpp
ced1dd9b01e19f0e675357844fcb3cf9f1870e33 28-Jun-2017 Joel Scherpelz <jscherpelz@google.com> Change list + manual search to set/map

Continued incremental cleanup to simplify change to iptables restore.
Rename some data members and switch to better data structures.

Test: as follows
- built
- flashed
- booted
- "runtest -x .../netd_unit_test.cpp" passes
- "runtest -x .../netd_integration_test.cpp" passes
Bug: 28362720
Bug: 38143143

Change-Id: Iff231bf180f9195b01e09c5cb8c883c5d3f2852a
/system/netd/server/BandwidthController.cpp
01cc5490175b29e2adeb24dd5aefd089b7e1abf9 16-Jun-2017 Joel Scherpelz <jscherpelz@google.com> Add unit test for shared/unshared interface quotas

Test: as follows
- built
- flashed
- booted
- "runtest -x .../netd_unit_test.cpp" passes
Bug: 28362720
Bug: 38143143

Change-Id: I0b962898f9e3d7e86d5c0d0d01b79b3e3543b5ee
/system/netd/server/BandwidthController.cpp
bcad661ab90d5e4d04d41747d109f9c97c5f9490 30-May-2017 Joel Scherpelz <jscherpelz@google.com> Modernize string handling in BandwidthController

This change is preparation for removal of xt_quota2 in favor of NFLOG.
Note that the scope of changes is mostly limited to mechanical single
line changes from "const char*" to "const std::string&".

Test: as follows
- built
- flashed
- booted
- "runtest -x .../netd_unit_test.cpp" passes
- "runtest -x .../netd_integration_test.cpp" passes
Bug: 38143143
Bug: 28362720

Change-Id: I56ba810ff6fa2f409e32d86508cfdb1a81a50a4e
/system/netd/server/BandwidthController.cpp
911bc4ccc96a323a8029adce3edba3aa6a030f45 28-Apr-2017 Lorenzo Colitti <lorenzo@google.com> Switch BandwidthController per-UID commands to iptables-restore

Bug: 32073253
Test: bullhead builds and boots
Test: netd_{unit,integration}_test pass
Test: Turning datasaver on/off changes rules as expected
Test: Modifying datasaver whitelist changes rules as expected when datasaver is on
Test: Adding and removing cell data limits changes rules as expected
Test: No IptablesRestoreController methods in normal usage
Change-Id: I83723db6a539b641308ef0f74ac30b4db304295c
/system/netd/server/BandwidthController.cpp
d9db08c4a12d6a2953b597d39bb3ac37c43d3658 28-Apr-2017 Lorenzo Colitti <lorenzo@google.com> Simplify enums in BandwidthController.

1. Ensure that the code always uses all enum values. This
provides a clear compile-time error if a passed-in enum value
is not handled, and allows us to remove several default
case labels and unreachable error logging code.
2. Factor out to common functions the code that converts enum
values to parts of iptables command lines.

Bug: 32073253
Test: netd_{unit,integration}_test pass
Change-Id: I7136055100dc312fa7cb8bba5506fe86412b1f4d
/system/netd/server/BandwidthController.cpp
4773cb4e74f037b7e82f7394474ead52657560c5 27-Apr-2017 Lorenzo Colitti <lorenzo@google.com> Properly report failure in runIptablesAlertCmd.

(cherry picked from commit 7647305c6b13d0e448b055c8af9c09b34af79f5c)

Bug: 37641280
Test: netd_{unit,integration}_test pass
Change-Id: Ic2b692efae14c4c9ca19972bdd812edce1c39bb3
Merged-In: I36ef121ae0cfaa16032289fa6f8b0341e1a9ca20
/system/netd/server/BandwidthController.cpp
3c27270c18eeb922342135fd119cc567689cd465 26-Apr-2017 Lorenzo Colitti <lorenzo@google.com> Move runIptablesAlert{,Fwd}Cmd to iptables-restore.

This saves about 100ms on boot.

(cherry picked from commit 546fe48d36859e1ef2a0df2ffc1067dc2916ba44)

Bug: 37641280
Test: marlin builds and boots
Test: netd_{unit,integration}_test pass
Test: iptables rules look identical to other marlin running oc-release
Test: Enabling/disabling tethering adds/removes the forward rule
Change-Id: I8e15940565894d44a819b9cef25790d443b25df5
Merged-In: I56ce20a0efef8b1aba5f55bc823926447b21a614
/system/netd/server/BandwidthController.cpp
e8b56e453605727daf4f037580f6616cc8fb8838 26-Apr-2017 Lorenzo Colitti <lorenzo@google.com> Add test coverage for IptablesAlert{,Fwd}Cmd.

Additionally, remove some unused code.

(cherry picked from commit 615df791ab6081921114369052ffcdba7b67eebe)

Bug: 37641280
Test: marlin builds and boots
Test: new unit test passes
Test: netd_{unit,integration}_test pass
Change-Id: I8224b4cc0382f5efe57723baa1513c693d42535b
Merged-In: I32072a2701fe1f52d5b3cfb0d57b3f296d7c37df
/system/netd/server/BandwidthController.cpp
ce6748a3f656a206b4e85f48cda949bc152cf741 01-Feb-2017 Lorenzo Colitti <lorenzo@google.com> Use iptables pipes when fetching tether counters.

Tested using:

adb shell ndc bandwidth gettetherstats
adb shell iptables -nvx -L natctrl_tether_counters
adb shell ip6tables -nvx -L natctrl_tether_counters

Results:

114 0 wlan0 rmnet_data0 272883 2976 8624804 6032
200 0 Tethering stats list completed
Chain natctrl_tether_counters (2 references)
pkts bytes target prot opt in out source destination
2688 179096 RETURN all -- wlan0 rmnet_data0 0.0.0.0/0 0.0.0.0/0
5713 8351999 RETURN all -- rmnet_data0 wlan0 0.0.0.0/0 0.0.0.0/0
Chain natctrl_tether_counters (1 references)
pkts bytes target prot opt in out source destination
288 93787 RETURN all wlan0 rmnet_data0 ::/0 ::/0
319 272805 RETURN all rmnet_data0 wlan0 ::/0 ::/0

Test: manual test described above
Test: data usage increases by 10MB when downloading 10MB file
Test: netd_unit_test passes
Bug: 34873832
Change-Id: I32c4e750a4d3c379074cc13ab1302d51421860d2
/system/netd/server/BandwidthController.cpp
56c4b1eb7d15e55a4edb88cfc0d190d8817d1353 31-Jan-2017 Lorenzo Colitti <lorenzo@google.com> Use iptables pipes in BandwidthController startup.

Most of BandwidthController startup is already using
iptables-restore, but some commands (notably listing the costly
chains so they can be flushed by flushCleanTables) still
use iptables. Move these to use execIptablesRestoreWithOutput.

Test: netd_unit_test passes
Bug: 34873832
Change-Id: Ib0741a99a2605cd6934186fd4e5364331a4eab5a
/system/netd/server/BandwidthController.cpp
26c9132b8b5993f8edbb999696e18fa6469d6759 11-Jul-2016 Lorenzo Colitti <lorenzo@google.com> Parse IPv6 tethering counters.

Bug: 9580643
Change-Id: Icbfd8c6480a4e14433004e90b71a104ae4da9c5d
/system/netd/server/BandwidthController.cpp
7364b75ca058d34875eb3567a57bfd9c03628129 08-Jul-2016 Lorenzo Colitti <lorenzo@google.com> Refactor getTetherStats in preparation for IPv6 tether counters.

Bug: 9580643
Change-Id: I11565cafbefbc06a7992d1ff18c707165d5b31ed
/system/netd/server/BandwidthController.cpp
13debb8996ca9cd3ce5d7f2817fe19e5df148f08 27-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Use iptables-restore in BandwidthController startup.

This saves approximately 800ms on boot.

From the perspective of the rules, this change is a no-op. As the
unit test shows, the commands are the same, though some are in a
slightly different order because iptables-restore requires that
COMMIT be called between different tables (e.g., filter and
mangle).

For simplicity, enableBandwidthControl runs two iptables-restore
commands instead of one. This is not semantically different from
the previous code because the previous code just ran iptables
commands one by one, which provides no atomicity. Running two
commands is a bit slower than running one, but it's still much
faster than using iptables.

Using iptables-restore allows us to do things like ":<chain> -",
which both creates the chain (if it does not already exist) and
flushes it. This allows us to remove IPT_CLEANUP_COMMANDS and
IPT_SETUP_COMMANDS. Those two sets of commands, which basically
just did "-X bw_<foo>" and "-N bw_<foo>" were only necessary
because the preceding "-F bw_<foo>" command would not create
bw_<foo> if it did not already exist (e.g. in setupIptablesHooks,
which runs on netd startup).

Bug: 21725996
Change-Id: I6656aed4287dfcb2311c94800f430c143fb0b1a5
/system/netd/server/BandwidthController.cpp
464eabecf1174154b8f61845610c3f4f0ca294b3 25-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Attempt to make data saver mode work for real.

The data saver refactoring change was incorrect in >= two ways:

1. It relied on the bw_costly_shared chain, which is currently
unused. NetworkManagementService just has a "TODO: support
quota shared across interfaces" comment about it. What
actually happens when setting quota is that each costly
interface chain (e.g., bw_costly_rmnet_data0) directly hooks
in the bw_penalty box chain.

2. Implementing app whitelisting using "RETURN" inside
bw_happy_box was pointless because if data saver was enabled,
there was a REJECT at the end of the bw_costly_shared chain
that it was returning to.

Instead, go back to the previous approach which hooked
bw_happy_box at the end of bw_penalty_box. Also, add an
additional bw_data_saver rule at the end of bw_happy_box.
bw_data_saver only contains one rule: RETURN if data saver is
enabled or REJECT if data saver is disabled.

That way:

1. If the app is blacklisted, bw_penalty_box REJECTs. If not:
2. If the app is whitelisted (system apps are always whitelisted)
bw_happy_box RETURNs to bw_costly_rmnet_data0, skipping
bw_data_saver.
3. If an app is neither blacklisted nor whitelisted, bw_happy_box
jumps to bw_data_saver. If data saver is enabled, it REJECTs
the packet, and if not, it RETURNs to bw_costly_rmnet_data0.
4. When we RETURN to bw_costly_rmnet_data0, either because the
app is whitelisted, or because data saver is off,
bw_costly_rmnet_data0 applies mobile data usage limits,
and then RETURNs to bw_OUTPUT, which calls xt_qtaguid, etc.

Bug: 26685616
Bug: 27506285
Change-Id: If15397afde6862d95827a1fdd30f60efd7fab66a
/system/netd/server/BandwidthController.cpp
86a4798264c9421cb02bc69836a323d918f73779 18-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Add a rudimentary unit test for BandwidthController.

Bug: 26685616
Bug: 27506285
Change-Id: I4457abd43697a0425f167b81c1432d743800abb8
/system/netd/server/BandwidthController.cpp
7618ccb39a9e61b4b1e28e96394fd7097e62db8e 17-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Slightly restructure the data saver iptables rules.

1. Make bw_costly_shared jump to bw_happy_box after
bw_penalty_box. This allows the framework to manipulate
whitelists and blacklists independently.
2. Make bw_happy box always whitelist system apps. Because
bw_penalty_box is consulted before bw_happy_box, the
framework can always blacklist certain system apps (e.g.,
the media server) by putting them in the blacklist.
3. Add a method to add/remove a reject at the end of
bw_costly_shared. This will allow the framework to
enable/disable data saver by changing only one rule.

Bug: 26685616
Bug: 27506285
Change-Id: I67bff7c3c9ff5eb3f84fb84550cdf49f153e1b68
/system/netd/server/BandwidthController.cpp
a33d47992ca04eb3f911fa41ca9d3794f1986b27 17-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Remove the ability to enable/disable the happy box.

This code is unused, and the plan is to have the happy box
enabled at all times.

Bug: 26685616
Bug: 27506285
Change-Id: Ie15b0775d535df7ca94547a7d8b8a5ed536e6dbd
/system/netd/server/BandwidthController.cpp
b1f0557b544cd5e689e013ff66591361d75ab1ff 18-Mar-2016 Lorenzo Colitti <lorenzo@google.com> Don't keep naughty/nice app state in BandwidthController.

Copies of this state are already kept in NetworkManagementService,
NetworkPolicyManagerService, and iptables rules. A third copy of
this state is not necessary.

Bug: 26685616
Bug: 27506285
Change-Id: I8dd9fc60a28804ec95660092b13a2895f7480f56
/system/netd/server/BandwidthController.cpp
5ebbbd83bb204b916a60f68221fa9ea9506e5769 07-Mar-2016 Felipe Leme <felipeal@google.com> Whitelist system apps when using bw_happy_box.

BUG: 27506285
BUG: 26685616
Change-Id: I8352ebbab1778c85e0a1da79a0acede5aea144a1
/system/netd/server/BandwidthController.cpp
9fbf60d5a2bec3ea6079e360e00c0c26ed44a245 02-Mar-2016 Erik Kline <ek@google.com> Remove unused costName variable
am: 87732125ef

* commit '87732125ef05808bf958530c8319026e7a1efbce':
Remove unused costName variable
87732125ef05808bf958530c8319026e7a1efbce 02-Mar-2016 Erik Kline <ek@google.com> Remove unused costName variable

Bug: 27432583
Change-Id: Ica6f8714eb6c40a4b6a94ac5e40144d0e781155e
/system/netd/server/BandwidthController.cpp
58a944859781731de308939e914ea3ba27465f25 02-Oct-2015 Erik Kline <ek@google.com> Always add costly interfaces to the bw_FORWARD chain

This adds a jump to bw_costly_<ifname> for traffic forwarded out
interface <ifname> to the bw_FORWARD chain, regardless of tethering
state (as having it safely in place is harmless).

Bug: 24497044
Change-Id: I165724c319051ddf29a2833912eb286368b0570d
/system/netd/server/BandwidthController.cpp
7e5323d7663710208036e08a6fd43929739939cd 20-Aug-2015 Yusuke Sato <yusukes@google.com> am 93e6f6a7: Merge "Make iptables -L and -S calls wait for xtables lock"

* commit '93e6f6a70c83b700aacaa16396449c3d9946b94c':
Make iptables -L and -S calls wait for xtables lock
99b40503edccae74d0917b9d1e17a5939ac7193b 19-Aug-2015 Yusuke Sato <yusukes@google.com> Make iptables -L and -S calls wait for xtables lock

Bug:22802665
Change-Id: I95b83ec0a926208e20659ad4b5355cf8500821f5
/system/netd/server/BandwidthController.cpp
94b2ab92f6e886d24092781159714be75c9f3954 04-Aug-2015 Paul Jensen <pauljensen@google.com> Make netd calls to iptables wait for xtables lock

Without this wait iptables commands can fail with various unpleasant
consequences like Log.wtf() or missing iptables rules. The most
critical calls to iptables in NetdConstants.cpp already wait for the
lock.

Bug:22802665
Change-Id: I7d542c3d4f0e005618e368da674159b90d652c8a
/system/netd/server/BandwidthController.cpp
53ea9cadf6cc5f8be1c16b5b6b660cd7366fd3f0 31-Jan-2015 Nick Kralevich <nnk@google.com> Avoid leaking file descriptors

Add O_CLOEXEC on open() calls, and SOCK_CLOEXEC on socket calls.
This avoids leaking file descriptors across execs.

Addresses the following SELinux denial:

audit(1422740213.283:8): avc: denied { read write } for pid=2597 comm="clatd" path="socket:[6709]" dev="sockfs" ino=6709 scontext=u:r:clatd:s0 tcontext=u:r:netd:s0 tclass=netlink_socket

and allows the removal of some other SELinux rules which were
inappropriately added because of leaking file descriptors.

Change-Id: I9c180488ea1969d610e488f967a7276a672bb477
/system/netd/server/BandwidthController.cpp
a9d791f48e3472400ffad73dca88c28fb2f7aaa7 27-Apr-2012 Jesper Hansson <jesper.hansson@sonymobile.com> Plug some leaks

Change-Id: I4268ea32cfb0ebd6ce5711e30865750dffa94e92
/system/netd/server/BandwidthController.cpp
69261cb65186e27dfbdc1e3eec796437f9968ff9 20-Jun-2014 JP Abgrall <jpa@google.com> server: check interface names in RPC arguments for validity

This patch introduces a method isIfaceName that checks interface
names from various RPCs for validity before e.g. using them as
part of iptables arguments or in filenames.

All of these RPC calls can only be called from applications
with at least the CONNECTIVITY_INTERNAL permission in recent
Android versions, so the impact of the missing checks luckily
isn't very high.

Orig-Author: Jann Horn <jann@thejh.net>

Change-Id: I80df8d745a3de99ad02d6649f0d10562c81f6b98
Signed-off-by: JP Abgrall <jpa@google.com>
/system/netd/server/BandwidthController.cpp
56afacf838d24cf8e54d2cf0d8ab9182ab704125 29-May-2014 Sreeram Ramachandran <sreeram@google.com> Turn on C++11 and make all warnings into errors.

As a consequence:
+ Comment out the names of all unused parameters.
+ Remove all unused variables and functions.

In server/Android.mk, there are a couple of non-trivial changes:
+ Use libcxx instead of stlport. This is needed to fix a bunch of errors due to
specifying -std=c++11.
+ LOCAL_SHARED_LIBRARIES is sorted. Technically, the order in which libraries
are listed has an effect on linking, but nobody should be doing such brittle
things anyway.

Change-Id: I0aff5b745e04609da23144d0e8be4c5694321b8b
/system/netd/server/BandwidthController.cpp
f4cfad361175a7f9ccf4d41e76a9b289c3c3da22 21-May-2014 Sreeram Ramachandran <sreeram@google.com> Move netd_client into netd.

Change-Id: Ie4b6b303225c93f2448a503d6ea9cebb552cbad5
/system/netd/server/BandwidthController.cpp