3450b662e8adbff215aa05fdc3c8e3167819c672 |
|
26-Sep-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Allow connectivity-critical packets in data saver mode. This makes IPv6 work on metered wifi networks. Without this: 1. We reject incoming RAs, so we lose connectivity when the RA parameters expire. 2. We reject incoming NAs, so we get NUD failures. Bug: 66015813 Test: angler builds, boots Test: netd_{unit,integration}_test pass Test: CtsHostsideNetworkTests tests pass Change-Id: I033040ef0b91c22035e29c636123cd41ab1967ec Merged-In: I033040ef0b91c22035e29c636123cd41ab1967ec
/system/netd/server/BandwidthController.cpp
|
066b822f78666758ff82c43321ade07fd0d54eb3 |
|
10-Aug-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Delete all remaining callers of iptables. Also move to binder_test.cpp some string constants that are used only there. (cherry picked from commit 5c68b9c1e4b7d8cf05b6ce9f6d1458ffda225eac) Bug: 28362720 Test: bullhead builds,boots Test: netd_{unit,integration}_test pass Change-Id: Icebaac93fc3a661902deced985119d2d1735732e Merged-In: I3f72946de374a7deaeef88b1dd5589d9a20ccce7
/system/netd/server/BandwidthController.cpp
|
c61625942041127913de28ad0732b1ad2f6ef60b |
|
16-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Remove now-unused strncpyAndCheck. Test: bullhead-eng builds Change-Id: Idacfeb71c1f108d9f51ce6f509ae16dbba8a2c2b
/system/netd/server/BandwidthController.cpp
|
0ecddc0aa28d6caf0f7c61710ff9ce189980283c |
|
06-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Delete the last iptables commands in BandwidthController. Bug: 28362720 Test: netd_{unit,integration}_test pass Change-Id: I7e64747e3b933cdf1b76cd20356b9ff86015ec61
/system/netd/server/BandwidthController.cpp
|
e85ffe1f7f97fb7f2c60e237167b090d3aa85a80 |
|
06-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Switch costly alerts to iptables-restore. Costly alerts appear to be currently unused, but they are the last user of iptables commands in BandwidthController, so migrating them to iptables-restore will allow us to delete the iptables-specific code in BandwidthController. Bug: 28362720 Test: netd_{unit,integration}_test pass Change-Id: I07c6df6df347fd6485e6d0740b7d6165a423e34b
/system/netd/server/BandwidthController.cpp
|
b7ac3f7e3ed4569e15bb5a57d70458585eb9fe53 |
|
06-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Minor improvements to shared quota error handling. Bug: 28362720 Test: bullhead builds,boots Test: netd_{unit,integration}_test pass Change-Id: Ib3de9f4f3317373619ba185a6e7860f0fc82ca7b
/system/netd/server/BandwidthController.cpp
|
48f83006a0c5cf35d1f8d20fcd4213e4b325997e |
|
06-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Convert set*Quota to use iptablesRestore. Bug: 28362720 Test: bullhead builds,boots Test: netd_{unit,integration}_test pass Test: quota rules are added and removed when quotas are enabled/disabled Change-Id: Ib4df4f10a26c8bc206cc67671da09618fa4224ac
/system/netd/server/BandwidthController.cpp
|
d59526a685e883752ad2139ba870aea86dbbd104 |
|
28-Jun-2017 |
Joel Scherpelz <jscherpelz@google.com> |
Refactor interface quota code before moving to iptables-restore. This change substantially refactors the interface and shared quota code in BandwidthController in preparation for making it use IptablesRestoreController. There should be no functional change. Bug: 28362720 Test: bullhead builds,boots Test: netd_{unit,integration}_test pass Test: quota rules are added and removed when quotas are enabled/disabled Change-Id: I7379fac58da4d98958bb050055a3c6bd7c617aa3
/system/netd/server/BandwidthController.cpp
|
2782b6b4bee3934c52596d932d3d7c7367b434b6 |
|
06-Jul-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Remove superfluous quota rule delete commands. When setting shared or interface quota, BandwidthController will delete rules in bw_{FORWARD,INPUT,OUTPUT} before re-adding them. These deletes are guaranteed to fail because the rules being deleted only exist when bandwidth control is enabled and the applicable interface is in mQuotaIfaces. Specifically, as long as no intermediate iptables commands fail: 1. When bandwidth control is enabled or disabled, all the bw_{FORWARD,INPUT,OUTPUT} chains are cleared by flushCleanTables. 2. The rules that were being deleted are only added when bandwidth control is enabled and an interface is added to mQuotaIfaces. 3. Adding a quota is a no-op if the interface is already in mQuotaIfaces (or mSharedQuotaIfaces for shared quotas). 4. When an interface is removed from mQuotaIfaces (or mSharedQuotaIfaces), the rules are always deleted. In the presence of intermediate iptables command failures this change could make things worse, but an upcoming change will move the quota commands to iptables-restore, which will ensure that iptables commands in a quota operation either all succeed or all fail. In addition to removing the superfluous deletes, also change the order of the commands that create a chain from "-F then -N" to "-N then -F". This simplifies the code and the tests a bit. Bug: 28362720 Test: bullhead builds, boots Test: netd_{unit,integration}_test pass Test: quota rules are added and removed when quotas are enabled/disabled Change-Id: I64a0a2aa16066163c71f6d3ead36839b51c34620
/system/netd/server/BandwidthController.cpp
|
ced1dd9b01e19f0e675357844fcb3cf9f1870e33 |
|
28-Jun-2017 |
Joel Scherpelz <jscherpelz@google.com> |
Change list + manual search to set/map Continued incremental cleanup to simplify change to iptables restore. Rename some data members and switch to better data structures. Test: as follows - built - flashed - booted - "runtest -x .../netd_unit_test.cpp" passes - "runtest -x .../netd_integration_test.cpp" passes Bug: 28362720 Bug: 38143143 Change-Id: Iff231bf180f9195b01e09c5cb8c883c5d3f2852a
/system/netd/server/BandwidthController.cpp
|
01cc5490175b29e2adeb24dd5aefd089b7e1abf9 |
|
16-Jun-2017 |
Joel Scherpelz <jscherpelz@google.com> |
Add unit test for shared/unshared interface quotas Test: as follows - built - flashed - booted - "runtest -x .../netd_unit_test.cpp" passes Bug: 28362720 Bug: 38143143 Change-Id: I0b962898f9e3d7e86d5c0d0d01b79b3e3543b5ee
/system/netd/server/BandwidthController.cpp
|
bcad661ab90d5e4d04d41747d109f9c97c5f9490 |
|
30-May-2017 |
Joel Scherpelz <jscherpelz@google.com> |
Modernize string handling in BandwidthController This change is preparation for removal of xt_quota2 in favor of NFLOG. Note that the scope of changes is mostly limited to mechanical single line changes from "const char*" to "const std::string&". Test: as follows - built - flashed - booted - "runtest -x .../netd_unit_test.cpp" passes - "runtest -x .../netd_integration_test.cpp" passes Bug: 38143143 Bug: 28362720 Change-Id: I56ba810ff6fa2f409e32d86508cfdb1a81a50a4e
/system/netd/server/BandwidthController.cpp
|
911bc4ccc96a323a8029adce3edba3aa6a030f45 |
|
28-Apr-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Switch BandwidthController per-UID commands to iptables-restore Bug: 32073253 Test: bullhead builds and boots Test: netd_{unit,integration}_test pass Test: Turning datasaver on/off changes rules as expected Test: Modifying datasaver whitelist changes rules as expected when datasaver is on Test: Adding and removing cell data limits changes rules as expected Test: No IptablesRestoreController methods in normal usage Change-Id: I83723db6a539b641308ef0f74ac30b4db304295c
/system/netd/server/BandwidthController.cpp
|
d9db08c4a12d6a2953b597d39bb3ac37c43d3658 |
|
28-Apr-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Simplify enums in BandwidthController. 1. Ensure that the code always uses all enum values. This provides a clear compile-time error if a passed-in enum value is not handled, and allows us to remove several default case labels and unreachable error logging code. 2. Factor out to common functions the code that converts enum values to parts of iptables command lines. Bug: 32073253 Test: netd_{unit,integration}_test pass Change-Id: I7136055100dc312fa7cb8bba5506fe86412b1f4d
/system/netd/server/BandwidthController.cpp
|
4773cb4e74f037b7e82f7394474ead52657560c5 |
|
27-Apr-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Properly report failure in runIptablesAlertCmd. (cherry picked from commit 7647305c6b13d0e448b055c8af9c09b34af79f5c) Bug: 37641280 Test: netd_{unit,integration}_test pass Change-Id: Ic2b692efae14c4c9ca19972bdd812edce1c39bb3 Merged-In: I36ef121ae0cfaa16032289fa6f8b0341e1a9ca20
/system/netd/server/BandwidthController.cpp
|
3c27270c18eeb922342135fd119cc567689cd465 |
|
26-Apr-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Move runIptablesAlert{,Fwd}Cmd to iptables-restore. This saves about 100ms on boot. (cherry picked from commit 546fe48d36859e1ef2a0df2ffc1067dc2916ba44) Bug: 37641280 Test: marlin builds and boots Test: netd_{unit,integration}_test pass Test: iptables rules look identical to other marlin running oc-release Test: Enabling/disabling tethering adds/removes the forward rule Change-Id: I8e15940565894d44a819b9cef25790d443b25df5 Merged-In: I56ce20a0efef8b1aba5f55bc823926447b21a614
/system/netd/server/BandwidthController.cpp
|
e8b56e453605727daf4f037580f6616cc8fb8838 |
|
26-Apr-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Add test coverage for IptablesAlert{,Fwd}Cmd. Additionally, remove some unused code. (cherry picked from commit 615df791ab6081921114369052ffcdba7b67eebe) Bug: 37641280 Test: marlin builds and boots Test: new unit test passes Test: netd_{unit,integration}_test pass Change-Id: I8224b4cc0382f5efe57723baa1513c693d42535b Merged-In: I32072a2701fe1f52d5b3cfb0d57b3f296d7c37df
/system/netd/server/BandwidthController.cpp
|
ce6748a3f656a206b4e85f48cda949bc152cf741 |
|
01-Feb-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Use iptables pipes when fetching tether counters. Tested using: adb shell ndc bandwidth gettetherstats adb shell iptables -nvx -L natctrl_tether_counters adb shell ip6tables -nvx -L natctrl_tether_counters Results: 114 0 wlan0 rmnet_data0 272883 2976 8624804 6032 200 0 Tethering stats list completed Chain natctrl_tether_counters (2 references) pkts bytes target prot opt in out source destination 2688 179096 RETURN all -- wlan0 rmnet_data0 0.0.0.0/0 0.0.0.0/0 5713 8351999 RETURN all -- rmnet_data0 wlan0 0.0.0.0/0 0.0.0.0/0 Chain natctrl_tether_counters (1 references) pkts bytes target prot opt in out source destination 288 93787 RETURN all wlan0 rmnet_data0 ::/0 ::/0 319 272805 RETURN all rmnet_data0 wlan0 ::/0 ::/0 Test: manual test described above Test: data usage increases by 10MB when downloading 10MB file Test: netd_unit_test passes Bug: 34873832 Change-Id: I32c4e750a4d3c379074cc13ab1302d51421860d2
/system/netd/server/BandwidthController.cpp
|
56c4b1eb7d15e55a4edb88cfc0d190d8817d1353 |
|
31-Jan-2017 |
Lorenzo Colitti <lorenzo@google.com> |
Use iptables pipes in BandwidthController startup. Most of BandwidthController startup is already using iptables-restore, but some commands (notably listing the costly chains so they can be flushed by flushCleanTables) still use iptables. Move these to use execIptablesRestoreWithOutput. Test: netd_unit_test passes Bug: 34873832 Change-Id: Ib0741a99a2605cd6934186fd4e5364331a4eab5a
/system/netd/server/BandwidthController.cpp
|
26c9132b8b5993f8edbb999696e18fa6469d6759 |
|
11-Jul-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Parse IPv6 tethering counters. Bug: 9580643 Change-Id: Icbfd8c6480a4e14433004e90b71a104ae4da9c5d
/system/netd/server/BandwidthController.cpp
|
7364b75ca058d34875eb3567a57bfd9c03628129 |
|
08-Jul-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Refactor getTetherStats in preparation for IPv6 tether counters. Bug: 9580643 Change-Id: I11565cafbefbc06a7992d1ff18c707165d5b31ed
/system/netd/server/BandwidthController.cpp
|
13debb8996ca9cd3ce5d7f2817fe19e5df148f08 |
|
27-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Use iptables-restore in BandwidthController startup. This saves approximately 800ms on boot. From the perspective of the rules, this change is a no-op. As the unit test shows, the commands are the same, though some are in a slightly different order because iptables-restore requires that COMMIT be called between different tables (e.g., filter and mangle). For simplicity, enableBandwidthControl runs two iptables-restore commands instead of one. This is not semantically different from the previous code because the previous code just ran iptables commands one by one, which provides no atomicity. Running two commands is a bit slower than running one, but it's still much faster than using iptables. Using iptables-restore allows us to do things like ":<chain> -", which both creates the chain (if it does not already exist) and flushes it. This allows us to remove IPT_CLEANUP_COMMANDS and IPT_SETUP_COMMANDS. Those two sets of commands, which basically just did "-X bw_<foo>" and "-N bw_<foo>" were only necessary because the preceding "-F bw_<foo>" command would not create bw_<foo> if it did not already exist (e.g. in setupIptablesHooks, which runs on netd startup). Bug: 21725996 Change-Id: I6656aed4287dfcb2311c94800f430c143fb0b1a5
/system/netd/server/BandwidthController.cpp
|
464eabecf1174154b8f61845610c3f4f0ca294b3 |
|
25-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Attempt to make data saver mode work for real. The data saver refactoring change was incorrect in >= two ways: 1. It relied on the bw_costly_shared chain, which is currently unused. NetworkManagementService just has a "TODO: support quota shared across interfaces" comment about it. What actually happens when setting quota is that each costly interface chain (e.g., bw_costly_rmnet_data0) directly hooks in the bw_penalty box chain. 2. Implementing app whitelisting using "RETURN" inside bw_happy_box was pointless because if data saver was enabled, there was a REJECT at the end of the bw_costly_shared chain that it was returning to. Instead, go back to the previous approach which hooked bw_happy_box at the end of bw_penalty_box. Also, add an additional bw_data_saver rule at the end of bw_happy_box. bw_data_saver only contains one rule: RETURN if data saver is enabled or REJECT if data saver is disabled. That way: 1. If the app is blacklisted, bw_penalty_box REJECTs. If not: 2. If the app is whitelisted (system apps are always whitelisted) bw_happy_box RETURNs to bw_costly_rmnet_data0, skipping bw_data_saver. 3. If an app is neither blacklisted nor whitelisted, bw_happy_box jumps to bw_data_saver. If data saver is enabled, it REJECTs the packet, and if not, it RETURNs to bw_costly_rmnet_data0. 4. When we RETURN to bw_costly_rmnet_data0, either because the app is whitelisted, or because data saver is off, bw_costly_rmnet_data0 applies mobile data usage limits, and then RETURNs to bw_OUTPUT, which calls xt_qtaguid, etc. Bug: 26685616 Bug: 27506285 Change-Id: If15397afde6862d95827a1fdd30f60efd7fab66a
/system/netd/server/BandwidthController.cpp
|
86a4798264c9421cb02bc69836a323d918f73779 |
|
18-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Add a rudimentary unit test for BandwidthController. Bug: 26685616 Bug: 27506285 Change-Id: I4457abd43697a0425f167b81c1432d743800abb8
/system/netd/server/BandwidthController.cpp
|
7618ccb39a9e61b4b1e28e96394fd7097e62db8e |
|
17-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Slightly restructure the data saver iptables rules. 1. Make bw_costly_shared jump to bw_happy_box after bw_penalty_box. This allows the framework to manipulate whitelists and blacklists independently. 2. Make bw_happy box always whitelist system apps. Because bw_penalty_box is consulted before bw_happy_box, the framework can always blacklist certain system apps (e.g., the media server) by putting them in the blacklist. 3. Add a method to add/remove a reject at the end of bw_costly_shared. This will allow the framework to enable/disable data saver by changing only one rule. Bug: 26685616 Bug: 27506285 Change-Id: I67bff7c3c9ff5eb3f84fb84550cdf49f153e1b68
/system/netd/server/BandwidthController.cpp
|
a33d47992ca04eb3f911fa41ca9d3794f1986b27 |
|
17-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Remove the ability to enable/disable the happy box. This code is unused, and the plan is to have the happy box enabled at all times. Bug: 26685616 Bug: 27506285 Change-Id: Ie15b0775d535df7ca94547a7d8b8a5ed536e6dbd
/system/netd/server/BandwidthController.cpp
|
b1f0557b544cd5e689e013ff66591361d75ab1ff |
|
18-Mar-2016 |
Lorenzo Colitti <lorenzo@google.com> |
Don't keep naughty/nice app state in BandwidthController. Copies of this state are already kept in NetworkManagementService, NetworkPolicyManagerService, and iptables rules. A third copy of this state is not necessary. Bug: 26685616 Bug: 27506285 Change-Id: I8dd9fc60a28804ec95660092b13a2895f7480f56
/system/netd/server/BandwidthController.cpp
|
5ebbbd83bb204b916a60f68221fa9ea9506e5769 |
|
07-Mar-2016 |
Felipe Leme <felipeal@google.com> |
Whitelist system apps when using bw_happy_box. BUG: 27506285 BUG: 26685616 Change-Id: I8352ebbab1778c85e0a1da79a0acede5aea144a1
/system/netd/server/BandwidthController.cpp
|
9fbf60d5a2bec3ea6079e360e00c0c26ed44a245 |
|
02-Mar-2016 |
Erik Kline <ek@google.com> |
Remove unused costName variable am: 87732125ef * commit '87732125ef05808bf958530c8319026e7a1efbce': Remove unused costName variable
|
87732125ef05808bf958530c8319026e7a1efbce |
|
02-Mar-2016 |
Erik Kline <ek@google.com> |
Remove unused costName variable Bug: 27432583 Change-Id: Ica6f8714eb6c40a4b6a94ac5e40144d0e781155e
/system/netd/server/BandwidthController.cpp
|
58a944859781731de308939e914ea3ba27465f25 |
|
02-Oct-2015 |
Erik Kline <ek@google.com> |
Always add costly interfaces to the bw_FORWARD chain This adds a jump to bw_costly_<ifname> for traffic forwarded out interface <ifname> to the bw_FORWARD chain, regardless of tethering state (as having it safely in place is harmless). Bug: 24497044 Change-Id: I165724c319051ddf29a2833912eb286368b0570d
/system/netd/server/BandwidthController.cpp
|
7e5323d7663710208036e08a6fd43929739939cd |
|
20-Aug-2015 |
Yusuke Sato <yusukes@google.com> |
am 93e6f6a7: Merge "Make iptables -L and -S calls wait for xtables lock" * commit '93e6f6a70c83b700aacaa16396449c3d9946b94c': Make iptables -L and -S calls wait for xtables lock
|
99b40503edccae74d0917b9d1e17a5939ac7193b |
|
19-Aug-2015 |
Yusuke Sato <yusukes@google.com> |
Make iptables -L and -S calls wait for xtables lock Bug:22802665 Change-Id: I95b83ec0a926208e20659ad4b5355cf8500821f5
/system/netd/server/BandwidthController.cpp
|
94b2ab92f6e886d24092781159714be75c9f3954 |
|
04-Aug-2015 |
Paul Jensen <pauljensen@google.com> |
Make netd calls to iptables wait for xtables lock Without this wait iptables commands can fail with various unpleasant consequences like Log.wtf() or missing iptables rules. The most critical calls to iptables in NetdConstants.cpp already wait for the lock. Bug:22802665 Change-Id: I7d542c3d4f0e005618e368da674159b90d652c8a
/system/netd/server/BandwidthController.cpp
|
53ea9cadf6cc5f8be1c16b5b6b660cd7366fd3f0 |
|
31-Jan-2015 |
Nick Kralevich <nnk@google.com> |
Avoid leaking file descriptors Add O_CLOEXEC on open() calls, and SOCK_CLOEXEC on socket calls. This avoids leaking file descriptors across execs. Addresses the following SELinux denial: audit(1422740213.283:8): avc: denied { read write } for pid=2597 comm="clatd" path="socket:[6709]" dev="sockfs" ino=6709 scontext=u:r:clatd:s0 tcontext=u:r:netd:s0 tclass=netlink_socket and allows the removal of some other SELinux rules which were inappropriately added because of leaking file descriptors. Change-Id: I9c180488ea1969d610e488f967a7276a672bb477
/system/netd/server/BandwidthController.cpp
|
a9d791f48e3472400ffad73dca88c28fb2f7aaa7 |
|
27-Apr-2012 |
Jesper Hansson <jesper.hansson@sonymobile.com> |
Plug some leaks Change-Id: I4268ea32cfb0ebd6ce5711e30865750dffa94e92
/system/netd/server/BandwidthController.cpp
|
69261cb65186e27dfbdc1e3eec796437f9968ff9 |
|
20-Jun-2014 |
JP Abgrall <jpa@google.com> |
server: check interface names in RPC arguments for validity This patch introduces a method isIfaceName that checks interface names from various RPCs for validity before e.g. using them as part of iptables arguments or in filenames. All of these RPC calls can only be called from applications with at least the CONNECTIVITY_INTERNAL permission in recent Android versions, so the impact of the missing checks luckily isn't very high. Orig-Author: Jann Horn <jann@thejh.net> Change-Id: I80df8d745a3de99ad02d6649f0d10562c81f6b98 Signed-off-by: JP Abgrall <jpa@google.com>
/system/netd/server/BandwidthController.cpp
|
56afacf838d24cf8e54d2cf0d8ab9182ab704125 |
|
29-May-2014 |
Sreeram Ramachandran <sreeram@google.com> |
Turn on C++11 and make all warnings into errors. As a consequence: + Comment out the names of all unused parameters. + Remove all unused variables and functions. In server/Android.mk, there are a couple of non-trivial changes: + Use libcxx instead of stlport. This is needed to fix a bunch of errors due to specifying -std=c++11. + LOCAL_SHARED_LIBRARIES is sorted. Technically, the order in which libraries are listed has an effect on linking, but nobody should be doing such brittle things anyway. Change-Id: I0aff5b745e04609da23144d0e8be4c5694321b8b
/system/netd/server/BandwidthController.cpp
|
f4cfad361175a7f9ccf4d41e76a9b289c3c3da22 |
|
21-May-2014 |
Sreeram Ramachandran <sreeram@google.com> |
Move netd_client into netd. Change-Id: Ie4b6b303225c93f2448a503d6ea9cebb552cbad5
/system/netd/server/BandwidthController.cpp
|