1 /*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 // #define LOG_NDEBUG 0
18
19 /*
20 * The CommandListener, FrameworkListener don't allow for
21 * multiple calls in parallel to reach the BandwidthController.
22 * If they ever were to allow it, then netd/ would need some tweaking.
23 */
24
25 #include <ctype.h>
26 #include <errno.h>
27 #include <fcntl.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <string>
32 #include <vector>
33
34 #define __STDC_FORMAT_MACROS 1
35 #include <inttypes.h>
36
37 #include <sys/socket.h>
38 #include <sys/stat.h>
39 #include <sys/types.h>
40 #include <sys/wait.h>
41
42 #include <linux/netlink.h>
43 #include <linux/rtnetlink.h>
44 #include <linux/pkt_sched.h>
45
46 #include "android-base/stringprintf.h"
47 #include "android-base/strings.h"
48 #define LOG_TAG "BandwidthController"
49 #include <cutils/log.h>
50 #include <cutils/properties.h>
51 #include <logwrap/logwrap.h>
52
53 #include <netdutils/Syscalls.h>
54 #include "BandwidthController.h"
55 #include "FirewallController.h" /* For makeCriticalCommands */
56 #include "NatController.h" /* For LOCAL_TETHER_COUNTERS_CHAIN */
57 #include "NetdConstants.h"
58 #include "ResponseCode.h"
59
60 /* Alphabetical */
61 #define ALERT_IPT_TEMPLATE "%s %s -m quota2 ! --quota %" PRId64" --name %s\n"
62 const char BandwidthController::LOCAL_INPUT[] = "bw_INPUT";
63 const char BandwidthController::LOCAL_FORWARD[] = "bw_FORWARD";
64 const char BandwidthController::LOCAL_OUTPUT[] = "bw_OUTPUT";
65 const char BandwidthController::LOCAL_RAW_PREROUTING[] = "bw_raw_PREROUTING";
66 const char BandwidthController::LOCAL_MANGLE_POSTROUTING[] = "bw_mangle_POSTROUTING";
67
68 auto BandwidthController::iptablesRestoreFunction = execIptablesRestoreWithOutput;
69
70 using android::base::Join;
71 using android::base::StringAppendF;
72 using android::base::StringPrintf;
73 using android::netdutils::StatusOr;
74 using android::netdutils::UniqueFile;
75
76 namespace {
77
78 const char ALERT_GLOBAL_NAME[] = "globalAlert";
79 const int MAX_IPT_OUTPUT_LINE_LEN = 256;
80 const std::string NEW_CHAIN_COMMAND = "-N ";
81 const std::string GET_TETHER_STATS_COMMAND = StringPrintf(
82 "*filter\n"
83 "-nvx -L %s\n"
84 "COMMIT\n", NatController::LOCAL_TETHER_COUNTERS_CHAIN);
85
86 const char NAUGHTY_CHAIN[] = "bw_penalty_box";
87 const char NICE_CHAIN[] = "bw_happy_box";
88
89 /**
90 * Some comments about the rules:
91 * * Ordering
92 * - when an interface is marked as costly it should be INSERTED into the INPUT/OUTPUT chains.
93 * E.g. "-I bw_INPUT -i rmnet0 --jump costly"
94 * - quota'd rules in the costly chain should be before bw_penalty_box lookups.
95 * - the qtaguid counting is done at the end of the bw_INPUT/bw_OUTPUT user chains.
96 *
97 * * global quota vs per interface quota
98 * - global quota for all costly interfaces uses a single costly chain:
99 * . initial rules
100 * iptables -N bw_costly_shared
101 * iptables -I bw_INPUT -i iface0 --jump bw_costly_shared
102 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_shared
103 * iptables -I bw_costly_shared -m quota \! --quota 500000 \
104 * --jump REJECT --reject-with icmp-net-prohibited
105 * iptables -A bw_costly_shared --jump bw_penalty_box
106 * iptables -A bw_penalty_box --jump bw_happy_box
107 * iptables -A bw_happy_box --jump bw_data_saver
108 *
109 * . adding a new iface to this, E.g.:
110 * iptables -I bw_INPUT -i iface1 --jump bw_costly_shared
111 * iptables -I bw_OUTPUT -o iface1 --jump bw_costly_shared
112 *
113 * - quota per interface. This is achieve by having "costly" chains per quota.
114 * E.g. adding a new costly interface iface0 with its own quota:
115 * iptables -N bw_costly_iface0
116 * iptables -I bw_INPUT -i iface0 --jump bw_costly_iface0
117 * iptables -I bw_OUTPUT -o iface0 --jump bw_costly_iface0
118 * iptables -A bw_costly_iface0 -m quota \! --quota 500000 \
119 * --jump REJECT --reject-with icmp-port-unreachable
120 * iptables -A bw_costly_iface0 --jump bw_penalty_box
121 *
122 * * Penalty box, happy box and data saver.
123 * - bw_penalty box is a blacklist of apps that are rejected.
124 * - bw_happy_box is a whitelist of apps. It always includes all system apps
125 * - bw_data_saver implements data usage restrictions.
126 * - Via the UI the user can add and remove apps from the whitelist and
127 * blacklist, and turn on/off data saver.
128 * - The blacklist takes precedence over the whitelist and the whitelist
129 * takes precedence over data saver.
130 *
131 * * bw_penalty_box handling:
132 * - only one bw_penalty_box for all interfaces
133 * E.g Adding an app:
134 * iptables -I bw_penalty_box -m owner --uid-owner app_3 \
135 * --jump REJECT --reject-with icmp-port-unreachable
136 *
137 * * bw_happy_box handling:
138 * - The bw_happy_box comes after the penalty box.
139 * E.g Adding a happy app,
140 * iptables -I bw_happy_box -m owner --uid-owner app_3 \
141 * --jump RETURN
142 *
143 * * bw_data_saver handling:
144 * - The bw_data_saver comes after the happy box.
145 * Enable data saver:
146 * iptables -R 1 bw_data_saver --jump REJECT --reject-with icmp-port-unreachable
147 * Disable data saver:
148 * iptables -R 1 bw_data_saver --jump RETURN
149 */
150
151 const std::string COMMIT_AND_CLOSE = "COMMIT\n";
152 const std::string HAPPY_BOX_WHITELIST_COMMAND = StringPrintf(
153 "-I bw_happy_box -m owner --uid-owner %d-%d --jump RETURN", 0, MAX_SYSTEM_UID);
154
155 static const std::vector<std::string> IPT_FLUSH_COMMANDS = {
156 /*
157 * Cleanup rules.
158 * Should normally include bw_costly_<iface>, but we rely on the way they are setup
159 * to allow coexistance.
160 */
161 "*filter",
162 ":bw_INPUT -",
163 ":bw_OUTPUT -",
164 ":bw_FORWARD -",
165 ":bw_happy_box -",
166 ":bw_penalty_box -",
167 ":bw_data_saver -",
168 ":bw_costly_shared -",
169 "COMMIT",
170 "*raw",
171 ":bw_raw_PREROUTING -",
172 "COMMIT",
173 "*mangle",
174 ":bw_mangle_POSTROUTING -",
175 COMMIT_AND_CLOSE
176 };
177
178 static const std::vector<std::string> IPT_BASIC_ACCOUNTING_COMMANDS = {
179 "*filter",
180 "-A bw_INPUT -m owner --socket-exists", /* This is a tracking rule. */
181 "-A bw_OUTPUT -m owner --socket-exists", /* This is a tracking rule. */
182 "-A bw_costly_shared --jump bw_penalty_box",
183 "-A bw_penalty_box --jump bw_happy_box",
184 "-A bw_happy_box --jump bw_data_saver",
185 "-A bw_data_saver -j RETURN",
186 HAPPY_BOX_WHITELIST_COMMAND,
187 "COMMIT",
188
189 "*raw",
190 "-A bw_raw_PREROUTING -m owner --socket-exists", /* This is a tracking rule. */
191 "COMMIT",
192
193 "*mangle",
194 "-A bw_mangle_POSTROUTING -m owner --socket-exists", /* This is a tracking rule. */
195 COMMIT_AND_CLOSE
196 };
197
toStrVec(int num,char * strs[])198 std::vector<std::string> toStrVec(int num, char* strs[]) {
199 std::vector<std::string> tmp;
200 for (int i = 0; i < num; ++i) {
201 tmp.emplace_back(strs[i]);
202 }
203 return tmp;
204 }
205
206 } // namespace
207
BandwidthController()208 BandwidthController::BandwidthController() {
209 }
210
flushCleanTables(bool doClean)211 void BandwidthController::flushCleanTables(bool doClean) {
212 /* Flush and remove the bw_costly_<iface> tables */
213 flushExistingCostlyTables(doClean);
214
215 std::string commands = Join(IPT_FLUSH_COMMANDS, '\n');
216 iptablesRestoreFunction(V4V6, commands, nullptr);
217 }
218
setupIptablesHooks()219 int BandwidthController::setupIptablesHooks() {
220 /* flush+clean is allowed to fail */
221 flushCleanTables(true);
222 return 0;
223 }
224
enableBandwidthControl(bool force)225 int BandwidthController::enableBandwidthControl(bool force) {
226 char value[PROPERTY_VALUE_MAX];
227
228 if (!force) {
229 property_get("persist.bandwidth.enable", value, "1");
230 if (!strcmp(value, "0"))
231 return 0;
232 }
233
234 /* Let's pretend we started from scratch ... */
235 mSharedQuotaIfaces.clear();
236 mQuotaIfaces.clear();
237 mGlobalAlertBytes = 0;
238 mGlobalAlertTetherCount = 0;
239 mSharedQuotaBytes = mSharedAlertBytes = 0;
240
241 flushCleanTables(false);
242 std::string commands = Join(IPT_BASIC_ACCOUNTING_COMMANDS, '\n');
243 return iptablesRestoreFunction(V4V6, commands, nullptr);
244 }
245
disableBandwidthControl()246 int BandwidthController::disableBandwidthControl() {
247
248 flushCleanTables(false);
249 return 0;
250 }
251
makeDataSaverCommand(IptablesTarget target,bool enable)252 std::string BandwidthController::makeDataSaverCommand(IptablesTarget target, bool enable) {
253 std::string cmd;
254 const char *chainName = "bw_data_saver";
255 const char *op = jumpToString(enable ? IptJumpReject : IptJumpReturn);
256 std::string criticalCommands = enable ?
257 FirewallController::makeCriticalCommands(target, chainName) : "";
258 StringAppendF(&cmd,
259 "*filter\n"
260 ":%s -\n"
261 "%s"
262 "-A %s%s\n"
263 "COMMIT\n", chainName, criticalCommands.c_str(), chainName, op);
264 return cmd;
265 }
266
enableDataSaver(bool enable)267 int BandwidthController::enableDataSaver(bool enable) {
268 int ret = iptablesRestoreFunction(V4, makeDataSaverCommand(V4, enable), nullptr);
269 ret |= iptablesRestoreFunction(V6, makeDataSaverCommand(V6, enable), nullptr);
270 return ret;
271 }
272
addNaughtyApps(int numUids,char * appUids[])273 int BandwidthController::addNaughtyApps(int numUids, char *appUids[]) {
274 return manipulateSpecialApps(toStrVec(numUids, appUids), NAUGHTY_CHAIN,
275 IptJumpReject, IptOpInsert);
276 }
277
removeNaughtyApps(int numUids,char * appUids[])278 int BandwidthController::removeNaughtyApps(int numUids, char *appUids[]) {
279 return manipulateSpecialApps(toStrVec(numUids, appUids), NAUGHTY_CHAIN,
280 IptJumpReject, IptOpDelete);
281 }
282
addNiceApps(int numUids,char * appUids[])283 int BandwidthController::addNiceApps(int numUids, char *appUids[]) {
284 return manipulateSpecialApps(toStrVec(numUids, appUids), NICE_CHAIN,
285 IptJumpReturn, IptOpInsert);
286 }
287
removeNiceApps(int numUids,char * appUids[])288 int BandwidthController::removeNiceApps(int numUids, char *appUids[]) {
289 return manipulateSpecialApps(toStrVec(numUids, appUids), NICE_CHAIN,
290 IptJumpReturn, IptOpDelete);
291 }
292
manipulateSpecialApps(const std::vector<std::string> & appStrUids,const std::string & chain,IptJumpOp jumpHandling,IptOp op)293 int BandwidthController::manipulateSpecialApps(const std::vector<std::string>& appStrUids,
294 const std::string& chain, IptJumpOp jumpHandling,
295 IptOp op) {
296 std::string cmd = "*filter\n";
297 for (const auto& appStrUid : appStrUids) {
298 StringAppendF(&cmd, "%s %s -m owner --uid-owner %s%s\n", opToString(op), chain.c_str(),
299 appStrUid.c_str(), jumpToString(jumpHandling));
300 }
301 StringAppendF(&cmd, "COMMIT\n");
302 return iptablesRestoreFunction(V4V6, cmd, nullptr);
303 }
304
setInterfaceSharedQuota(const std::string & iface,int64_t maxBytes)305 int BandwidthController::setInterfaceSharedQuota(const std::string& iface, int64_t maxBytes) {
306 int res = 0;
307 std::string quotaCmd;
308 constexpr char cost[] = "shared";
309 constexpr char chain[] = "bw_costly_shared";
310
311 if (!maxBytes) {
312 /* Don't talk about -1, deprecate it. */
313 ALOGE("Invalid bytes value. 1..max_int64.");
314 return -1;
315 }
316 if (!isIfaceName(iface))
317 return -1;
318
319 if (maxBytes == -1) {
320 return removeInterfaceSharedQuota(iface);
321 }
322
323 auto it = mSharedQuotaIfaces.find(iface);
324
325 if (it == mSharedQuotaIfaces.end()) {
326 const int ruleInsertPos = (mGlobalAlertBytes) ? 2 : 1;
327 std::vector<std::string> cmds = {
328 "*filter",
329 StringPrintf("-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, iface.c_str(), chain),
330 StringPrintf("-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, iface.c_str(), chain),
331 StringPrintf("-A bw_FORWARD -o %s --jump %s", iface.c_str(), chain),
332 };
333 if (mSharedQuotaIfaces.empty()) {
334 cmds.push_back(StringPrintf("-I %s -m quota2 ! --quota %" PRId64
335 " --name %s --jump REJECT",
336 chain, maxBytes, cost));
337 }
338 cmds.push_back("COMMIT\n");
339
340 res |= iptablesRestoreFunction(V4V6, Join(cmds, "\n"), nullptr);
341 if (res) {
342 ALOGE("Failed set quota rule");
343 removeInterfaceSharedQuota(iface);
344 return -1;
345 }
346 mSharedQuotaBytes = maxBytes;
347 mSharedQuotaIfaces.insert(iface);
348 }
349
350 if (maxBytes != mSharedQuotaBytes) {
351 res |= updateQuota(cost, maxBytes);
352 if (res) {
353 ALOGE("Failed update quota for %s", cost);
354 removeInterfaceSharedQuota(iface);
355 return -1;
356 }
357 mSharedQuotaBytes = maxBytes;
358 }
359 return 0;
360 }
361
362 /* It will also cleanup any shared alerts */
removeInterfaceSharedQuota(const std::string & iface)363 int BandwidthController::removeInterfaceSharedQuota(const std::string& iface) {
364 constexpr char cost[] = "shared";
365 constexpr char chain[] = "bw_costly_shared";
366
367 if (!isIfaceName(iface))
368 return -1;
369
370 auto it = mSharedQuotaIfaces.find(iface);
371
372 if (it == mSharedQuotaIfaces.end()) {
373 ALOGE("No such iface %s to delete", iface.c_str());
374 return -1;
375 }
376
377 std::vector<std::string> cmds = {
378 "*filter",
379 StringPrintf("-D bw_INPUT -i %s --jump %s", iface.c_str(), chain),
380 StringPrintf("-D bw_OUTPUT -o %s --jump %s", iface.c_str(), chain),
381 StringPrintf("-D bw_FORWARD -o %s --jump %s", iface.c_str(), chain),
382 };
383 if (mSharedQuotaIfaces.size() == 1) {
384 cmds.push_back(StringPrintf("-D %s -m quota2 ! --quota %" PRIu64
385 " --name %s --jump REJECT",
386 chain, mSharedQuotaBytes, cost));
387 }
388 cmds.push_back("COMMIT\n");
389
390 if (iptablesRestoreFunction(V4V6, Join(cmds, "\n"), nullptr) != 0) {
391 ALOGE("Failed to remove shared quota on %s", iface.c_str());
392 return -1;
393 }
394
395 int res = 0;
396 mSharedQuotaIfaces.erase(it);
397 if (mSharedQuotaIfaces.empty()) {
398 mSharedQuotaBytes = 0;
399 if (mSharedAlertBytes) {
400 res = removeSharedAlert();
401 if (res == 0) {
402 mSharedAlertBytes = 0;
403 }
404 }
405 }
406
407 return res;
408
409 }
410
setInterfaceQuota(const std::string & iface,int64_t maxBytes)411 int BandwidthController::setInterfaceQuota(const std::string& iface, int64_t maxBytes) {
412 const std::string& cost = iface;
413
414 if (!isIfaceName(iface))
415 return -1;
416
417 if (!maxBytes) {
418 /* Don't talk about -1, deprecate it. */
419 ALOGE("Invalid bytes value. 1..max_int64.");
420 return -1;
421 }
422 if (maxBytes == -1) {
423 return removeInterfaceQuota(iface);
424 }
425
426 /* Insert ingress quota. */
427 auto it = mQuotaIfaces.find(iface);
428
429 if (it != mQuotaIfaces.end()) {
430 if (updateQuota(cost, maxBytes) != 0) {
431 ALOGE("Failed update quota for %s", iface.c_str());
432 removeInterfaceQuota(iface);
433 return -1;
434 }
435 it->second.quota = maxBytes;
436 return 0;
437 }
438
439 const std::string chain = "bw_costly_" + iface;
440 const int ruleInsertPos = (mGlobalAlertBytes) ? 2 : 1;
441 std::vector<std::string> cmds = {
442 "*filter",
443 StringPrintf(":%s -", chain.c_str()),
444 StringPrintf("-A %s -j bw_penalty_box", chain.c_str()),
445 StringPrintf("-I bw_INPUT %d -i %s --jump %s", ruleInsertPos, iface.c_str(),
446 chain.c_str()),
447 StringPrintf("-I bw_OUTPUT %d -o %s --jump %s", ruleInsertPos, iface.c_str(),
448 chain.c_str()),
449 StringPrintf("-A bw_FORWARD -o %s --jump %s", iface.c_str(), chain.c_str()),
450 StringPrintf("-A %s -m quota2 ! --quota %" PRId64 " --name %s --jump REJECT",
451 chain.c_str(), maxBytes, cost.c_str()),
452 "COMMIT\n",
453 };
454
455 if (iptablesRestoreFunction(V4V6, Join(cmds, "\n"), nullptr) != 0) {
456 ALOGE("Failed set quota rule");
457 removeInterfaceQuota(iface);
458 return -1;
459 }
460
461 mQuotaIfaces[iface] = QuotaInfo{maxBytes, 0};
462 return 0;
463 }
464
getInterfaceSharedQuota(int64_t * bytes)465 int BandwidthController::getInterfaceSharedQuota(int64_t *bytes) {
466 return getInterfaceQuota("shared", bytes);
467 }
468
getInterfaceQuota(const std::string & iface,int64_t * bytes)469 int BandwidthController::getInterfaceQuota(const std::string& iface, int64_t* bytes) {
470 const auto& sys = android::netdutils::sSyscalls.get();
471 const std::string fname = "/proc/net/xt_quota/" + iface;
472
473 if (!isIfaceName(iface)) return -1;
474
475 StatusOr<UniqueFile> file = sys.fopen(fname, "re");
476 if (!isOk(file)) {
477 ALOGE("Reading quota %s failed (%s)", iface.c_str(), toString(file).c_str());
478 return -1;
479 }
480 auto rv = sys.fscanf(file.value().get(), "%" SCNd64, bytes);
481 if (!isOk(rv)) {
482 ALOGE("Reading quota %s failed (%s)", iface.c_str(), toString(rv).c_str());
483 return -1;
484 }
485 ALOGV("Read quota res=%d bytes=%" PRId64, rv.value(), *bytes);
486 return rv.value() == 1 ? 0 : -1;
487 }
488
removeInterfaceQuota(const std::string & iface)489 int BandwidthController::removeInterfaceQuota(const std::string& iface) {
490 if (!isIfaceName(iface))
491 return -1;
492
493 auto it = mQuotaIfaces.find(iface);
494
495 if (it == mQuotaIfaces.end()) {
496 ALOGE("No such iface %s to delete", iface.c_str());
497 return -1;
498 }
499
500 const std::string chain = "bw_costly_" + iface;
501 std::vector<std::string> cmds = {
502 "*filter",
503 StringPrintf("-D bw_INPUT -i %s --jump %s", iface.c_str(), chain.c_str()),
504 StringPrintf("-D bw_OUTPUT -o %s --jump %s", iface.c_str(), chain.c_str()),
505 StringPrintf("-D bw_FORWARD -o %s --jump %s", iface.c_str(), chain.c_str()),
506 StringPrintf("-F %s", chain.c_str()),
507 StringPrintf("-X %s", chain.c_str()),
508 "COMMIT\n",
509 };
510
511 const int res = iptablesRestoreFunction(V4V6, Join(cmds, "\n"), nullptr);
512
513 if (res == 0) {
514 mQuotaIfaces.erase(it);
515 }
516
517 return res;
518 }
519
updateQuota(const std::string & quotaName,int64_t bytes)520 int BandwidthController::updateQuota(const std::string& quotaName, int64_t bytes) {
521 const auto& sys = android::netdutils::sSyscalls.get();
522 const std::string fname = "/proc/net/xt_quota/" + quotaName;
523
524 if (!isIfaceName(quotaName)) {
525 ALOGE("updateQuota: Invalid quotaName \"%s\"", quotaName.c_str());
526 return -1;
527 }
528
529 StatusOr<UniqueFile> file = sys.fopen(fname, "we");
530 if (!isOk(file)) {
531 ALOGE("Updating quota %s failed (%s)", quotaName.c_str(), toString(file).c_str());
532 return -1;
533 }
534 sys.fprintf(file.value().get(), "%" PRId64 "\n", bytes);
535 return 0;
536 }
537
runIptablesAlertCmd(IptOp op,const std::string & alertName,int64_t bytes)538 int BandwidthController::runIptablesAlertCmd(IptOp op, const std::string& alertName,
539 int64_t bytes) {
540 const char *opFlag = opToString(op);
541 std::string alertQuotaCmd = "*filter\n";
542
543 // TODO: consider using an alternate template for the delete that does not include the --quota
544 // value. This code works because the --quota value is ignored by deletes
545 StringAppendF(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_INPUT", bytes,
546 alertName.c_str());
547 StringAppendF(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_OUTPUT", bytes,
548 alertName.c_str());
549 StringAppendF(&alertQuotaCmd, "COMMIT\n");
550
551 return iptablesRestoreFunction(V4V6, alertQuotaCmd, nullptr);
552 }
553
runIptablesAlertFwdCmd(IptOp op,const std::string & alertName,int64_t bytes)554 int BandwidthController::runIptablesAlertFwdCmd(IptOp op, const std::string& alertName,
555 int64_t bytes) {
556 const char *opFlag = opToString(op);
557 std::string alertQuotaCmd = "*filter\n";
558 StringAppendF(&alertQuotaCmd, ALERT_IPT_TEMPLATE, opFlag, "bw_FORWARD", bytes,
559 alertName.c_str());
560 StringAppendF(&alertQuotaCmd, "COMMIT\n");
561
562 return iptablesRestoreFunction(V4V6, alertQuotaCmd, nullptr);
563 }
564
setGlobalAlert(int64_t bytes)565 int BandwidthController::setGlobalAlert(int64_t bytes) {
566 const char *alertName = ALERT_GLOBAL_NAME;
567 int res = 0;
568
569 if (!bytes) {
570 ALOGE("Invalid bytes value. 1..max_int64.");
571 return -1;
572 }
573 if (mGlobalAlertBytes) {
574 res = updateQuota(alertName, bytes);
575 } else {
576 res = runIptablesAlertCmd(IptOpInsert, alertName, bytes);
577 if (mGlobalAlertTetherCount) {
578 ALOGV("setGlobalAlert for %d tether", mGlobalAlertTetherCount);
579 res |= runIptablesAlertFwdCmd(IptOpInsert, alertName, bytes);
580 }
581 }
582 mGlobalAlertBytes = bytes;
583 return res;
584 }
585
setGlobalAlertInForwardChain()586 int BandwidthController::setGlobalAlertInForwardChain() {
587 const char *alertName = ALERT_GLOBAL_NAME;
588 int res = 0;
589
590 mGlobalAlertTetherCount++;
591 ALOGV("setGlobalAlertInForwardChain(): %d tether", mGlobalAlertTetherCount);
592
593 /*
594 * If there is no globalAlert active we are done.
595 * If there is an active globalAlert but this is not the 1st
596 * tether, we are also done.
597 */
598 if (!mGlobalAlertBytes || mGlobalAlertTetherCount != 1) {
599 return 0;
600 }
601
602 /* We only add the rule if this was the 1st tether added. */
603 res = runIptablesAlertFwdCmd(IptOpInsert, alertName, mGlobalAlertBytes);
604 return res;
605 }
606
removeGlobalAlert()607 int BandwidthController::removeGlobalAlert() {
608
609 const char *alertName = ALERT_GLOBAL_NAME;
610 int res = 0;
611
612 if (!mGlobalAlertBytes) {
613 ALOGE("No prior alert set");
614 return -1;
615 }
616 res = runIptablesAlertCmd(IptOpDelete, alertName, mGlobalAlertBytes);
617 if (mGlobalAlertTetherCount) {
618 res |= runIptablesAlertFwdCmd(IptOpDelete, alertName, mGlobalAlertBytes);
619 }
620 mGlobalAlertBytes = 0;
621 return res;
622 }
623
removeGlobalAlertInForwardChain()624 int BandwidthController::removeGlobalAlertInForwardChain() {
625 int res = 0;
626 const char *alertName = ALERT_GLOBAL_NAME;
627
628 if (!mGlobalAlertTetherCount) {
629 ALOGE("No prior alert set");
630 return -1;
631 }
632
633 mGlobalAlertTetherCount--;
634 /*
635 * If there is no globalAlert active we are done.
636 * If there is an active globalAlert but there are more
637 * tethers, we are also done.
638 */
639 if (!mGlobalAlertBytes || mGlobalAlertTetherCount >= 1) {
640 return 0;
641 }
642
643 /* We only detete the rule if this was the last tether removed. */
644 res = runIptablesAlertFwdCmd(IptOpDelete, alertName, mGlobalAlertBytes);
645 return res;
646 }
647
setSharedAlert(int64_t bytes)648 int BandwidthController::setSharedAlert(int64_t bytes) {
649 if (!mSharedQuotaBytes) {
650 ALOGE("Need to have a prior shared quota set to set an alert");
651 return -1;
652 }
653 if (!bytes) {
654 ALOGE("Invalid bytes value. 1..max_int64.");
655 return -1;
656 }
657 return setCostlyAlert("shared", bytes, &mSharedAlertBytes);
658 }
659
removeSharedAlert()660 int BandwidthController::removeSharedAlert() {
661 return removeCostlyAlert("shared", &mSharedAlertBytes);
662 }
663
setInterfaceAlert(const std::string & iface,int64_t bytes)664 int BandwidthController::setInterfaceAlert(const std::string& iface, int64_t bytes) {
665 if (!isIfaceName(iface)) {
666 ALOGE("setInterfaceAlert: Invalid iface \"%s\"", iface.c_str());
667 return -1;
668 }
669
670 if (!bytes) {
671 ALOGE("Invalid bytes value. 1..max_int64.");
672 return -1;
673 }
674 auto it = mQuotaIfaces.find(iface);
675
676 if (it == mQuotaIfaces.end()) {
677 ALOGE("Need to have a prior interface quota set to set an alert");
678 return -1;
679 }
680
681 return setCostlyAlert(iface, bytes, &it->second.alert);
682 }
683
removeInterfaceAlert(const std::string & iface)684 int BandwidthController::removeInterfaceAlert(const std::string& iface) {
685 if (!isIfaceName(iface)) {
686 ALOGE("removeInterfaceAlert: Invalid iface \"%s\"", iface.c_str());
687 return -1;
688 }
689
690 auto it = mQuotaIfaces.find(iface);
691
692 if (it == mQuotaIfaces.end()) {
693 ALOGE("No prior alert set for interface %s", iface.c_str());
694 return -1;
695 }
696
697 return removeCostlyAlert(iface, &it->second.alert);
698 }
699
setCostlyAlert(const std::string & costName,int64_t bytes,int64_t * alertBytes)700 int BandwidthController::setCostlyAlert(const std::string& costName, int64_t bytes,
701 int64_t* alertBytes) {
702 int res = 0;
703
704 if (!isIfaceName(costName)) {
705 ALOGE("setCostlyAlert: Invalid costName \"%s\"", costName.c_str());
706 return -1;
707 }
708
709 if (!bytes) {
710 ALOGE("Invalid bytes value. 1..max_int64.");
711 return -1;
712 }
713
714 std::string alertName = costName + "Alert";
715 std::string chainName = "bw_costly_" + costName;
716 if (*alertBytes) {
717 res = updateQuota(alertName, *alertBytes);
718 } else {
719 std::vector<std::string> commands = {
720 "*filter\n",
721 StringPrintf(ALERT_IPT_TEMPLATE, "-A", chainName.c_str(), bytes, alertName.c_str()),
722 "COMMIT\n"
723 };
724 res = iptablesRestoreFunction(V4V6, Join(commands, ""), nullptr);
725 if (res) {
726 ALOGE("Failed to set costly alert for %s", costName.c_str());
727 }
728 }
729 if (res == 0) {
730 *alertBytes = bytes;
731 }
732 return res;
733 }
734
removeCostlyAlert(const std::string & costName,int64_t * alertBytes)735 int BandwidthController::removeCostlyAlert(const std::string& costName, int64_t* alertBytes) {
736 if (!isIfaceName(costName)) {
737 ALOGE("removeCostlyAlert: Invalid costName \"%s\"", costName.c_str());
738 return -1;
739 }
740
741 if (!*alertBytes) {
742 ALOGE("No prior alert set for %s alert", costName.c_str());
743 return -1;
744 }
745
746 std::string alertName = costName + "Alert";
747 std::string chainName = "bw_costly_" + costName;
748 std::vector<std::string> commands = {
749 "*filter\n",
750 StringPrintf(ALERT_IPT_TEMPLATE, "-D", chainName.c_str(), *alertBytes, alertName.c_str()),
751 "COMMIT\n"
752 };
753 if (iptablesRestoreFunction(V4V6, Join(commands, ""), nullptr) != 0) {
754 ALOGE("Failed to remove costly alert %s", costName.c_str());
755 return -1;
756 }
757
758 *alertBytes = 0;
759 return 0;
760 }
761
addStats(TetherStatsList & statsList,const TetherStats & stats)762 void BandwidthController::addStats(TetherStatsList& statsList, const TetherStats& stats) {
763 for (TetherStats& existing : statsList) {
764 if (existing.addStatsIfMatch(stats)) {
765 return;
766 }
767 }
768 // No match. Insert a new interface pair.
769 statsList.push_back(stats);
770 }
771
772 /*
773 * Parse the ptks and bytes out of:
774 * Chain natctrl_tether_counters (4 references)
775 * pkts bytes target prot opt in out source destination
776 * 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
777 * 27 2002 RETURN all -- rmnet0 wlan0 0.0.0.0/0 0.0.0.0/0
778 * 1040 107471 RETURN all -- bt-pan rmnet0 0.0.0.0/0 0.0.0.0/0
779 * 1450 1708806 RETURN all -- rmnet0 bt-pan 0.0.0.0/0 0.0.0.0/0
780 * or:
781 * Chain natctrl_tether_counters (0 references)
782 * pkts bytes target prot opt in out source destination
783 * 0 0 RETURN all wlan0 rmnet_data0 ::/0 ::/0
784 * 0 0 RETURN all rmnet_data0 wlan0 ::/0 ::/0
785 *
786 * It results in an error if invoked and no tethering counter rules exist. The constraint
787 * helps detect complete parsing failure.
788 */
addForwardChainStats(const TetherStats & filter,TetherStatsList & statsList,const std::string & statsOutput,std::string & extraProcessingInfo)789 int BandwidthController::addForwardChainStats(const TetherStats& filter,
790 TetherStatsList& statsList,
791 const std::string& statsOutput,
792 std::string &extraProcessingInfo) {
793 int res;
794 std::string statsLine;
795 char iface0[MAX_IPT_OUTPUT_LINE_LEN];
796 char iface1[MAX_IPT_OUTPUT_LINE_LEN];
797 char rest[MAX_IPT_OUTPUT_LINE_LEN];
798
799 TetherStats stats;
800 const char *buffPtr;
801 int64_t packets, bytes;
802 int statsFound = 0;
803
804 bool filterPair = filter.intIface[0] && filter.extIface[0];
805
806 ALOGV("filter: %s", filter.getStatsLine().c_str());
807
808 stats = filter;
809
810 std::stringstream stream(statsOutput);
811 while (std::getline(stream, statsLine, '\n')) {
812 buffPtr = statsLine.c_str();
813
814 /* Clean up, so a failed parse can still print info */
815 iface0[0] = iface1[0] = rest[0] = packets = bytes = 0;
816 if (strstr(buffPtr, "0.0.0.0")) {
817 // IPv4 has -- indicating what to do with fragments...
818 // 26 2373 RETURN all -- wlan0 rmnet0 0.0.0.0/0 0.0.0.0/0
819 res = sscanf(buffPtr, "%" SCNd64" %" SCNd64" RETURN all -- %s %s 0.%s",
820 &packets, &bytes, iface0, iface1, rest);
821 } else {
822 // ... but IPv6 does not.
823 // 26 2373 RETURN all wlan0 rmnet0 ::/0 ::/0
824 res = sscanf(buffPtr, "%" SCNd64" %" SCNd64" RETURN all %s %s ::/%s",
825 &packets, &bytes, iface0, iface1, rest);
826 }
827 ALOGV("parse res=%d iface0=<%s> iface1=<%s> pkts=%" PRId64" bytes=%" PRId64" rest=<%s> orig line=<%s>", res,
828 iface0, iface1, packets, bytes, rest, buffPtr);
829 extraProcessingInfo += buffPtr;
830 extraProcessingInfo += "\n";
831
832 if (res != 5) {
833 continue;
834 }
835 /*
836 * The following assumes that the 1st rule has in:extIface out:intIface,
837 * which is what NatController sets up.
838 * If not filtering, the 1st match rx, and sets up the pair for the tx side.
839 */
840 if (filter.intIface[0] && filter.extIface[0]) {
841 if (filter.intIface == iface0 && filter.extIface == iface1) {
842 ALOGV("2Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
843 stats.rxPackets = packets;
844 stats.rxBytes = bytes;
845 } else if (filter.intIface == iface1 && filter.extIface == iface0) {
846 ALOGV("2Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
847 stats.txPackets = packets;
848 stats.txBytes = bytes;
849 }
850 } else if (filter.intIface[0] || filter.extIface[0]) {
851 if (filter.intIface == iface0 || filter.extIface == iface1) {
852 ALOGV("1Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
853 stats.intIface = iface0;
854 stats.extIface = iface1;
855 stats.rxPackets = packets;
856 stats.rxBytes = bytes;
857 } else if (filter.intIface == iface1 || filter.extIface == iface0) {
858 ALOGV("1Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
859 stats.intIface = iface1;
860 stats.extIface = iface0;
861 stats.txPackets = packets;
862 stats.txBytes = bytes;
863 }
864 } else /* if (!filter.intFace[0] && !filter.extIface[0]) */ {
865 if (!stats.intIface[0]) {
866 ALOGV("0Filter RX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
867 stats.intIface = iface0;
868 stats.extIface = iface1;
869 stats.rxPackets = packets;
870 stats.rxBytes = bytes;
871 } else if (stats.intIface == iface1 && stats.extIface == iface0) {
872 ALOGV("0Filter TX iface_in=%s iface_out=%s rx_bytes=%" PRId64" rx_packets=%" PRId64" ", iface0, iface1, bytes, packets);
873 stats.txPackets = packets;
874 stats.txBytes = bytes;
875 }
876 }
877 if (stats.rxBytes != -1 && stats.txBytes != -1) {
878 ALOGV("rx_bytes=%" PRId64" tx_bytes=%" PRId64" filterPair=%d", stats.rxBytes, stats.txBytes, filterPair);
879 addStats(statsList, stats);
880 if (filterPair) {
881 return 0;
882 } else {
883 statsFound++;
884 stats = filter;
885 }
886 }
887 }
888
889 /* It is always an error to find only one side of the stats. */
890 /* It is an error to find nothing when not filtering. */
891 if (((stats.rxBytes == -1) != (stats.txBytes == -1)) ||
892 (!statsFound && !filterPair)) {
893 return -1;
894 }
895 return 0;
896 }
897
getStatsLine() const898 std::string BandwidthController::TetherStats::getStatsLine() const {
899 std::string msg;
900 StringAppendF(&msg, "%s %s %" PRId64" %" PRId64" %" PRId64" %" PRId64, intIface.c_str(),
901 extIface.c_str(), rxBytes, rxPackets, txBytes, txPackets);
902 return msg;
903 }
904
getTetherStats(SocketClient * cli,TetherStats & filter,std::string & extraProcessingInfo)905 int BandwidthController::getTetherStats(SocketClient *cli, TetherStats& filter,
906 std::string &extraProcessingInfo) {
907 int res = 0;
908
909 TetherStatsList statsList;
910
911 for (const IptablesTarget target : {V4, V6}) {
912 std::string statsString;
913 res = iptablesRestoreFunction(target, GET_TETHER_STATS_COMMAND, &statsString);
914 if (res != 0) {
915 ALOGE("Failed to run %s err=%d", GET_TETHER_STATS_COMMAND.c_str(), res);
916 return -1;
917 }
918
919 res = addForwardChainStats(filter, statsList, statsString, extraProcessingInfo);
920 if (res != 0) {
921 return res;
922 }
923 }
924
925 if (filter.intIface[0] && filter.extIface[0] && statsList.size() == 1) {
926 cli->sendMsg(ResponseCode::TetheringStatsResult,
927 statsList[0].getStatsLine().c_str(), false);
928 } else {
929 for (const auto& stats: statsList) {
930 cli->sendMsg(ResponseCode::TetheringStatsListResult,
931 stats.getStatsLine().c_str(), false);
932 }
933 if (res == 0) {
934 cli->sendMsg(ResponseCode::CommandOkay, "Tethering stats list completed", false);
935 }
936 }
937
938 return res;
939 }
940
flushExistingCostlyTables(bool doClean)941 void BandwidthController::flushExistingCostlyTables(bool doClean) {
942 std::string fullCmd = "*filter\n-S\nCOMMIT\n";
943 std::string ruleList;
944
945 /* Only lookup ip4 table names as ip6 will have the same tables ... */
946 if (int ret = iptablesRestoreFunction(V4, fullCmd, &ruleList)) {
947 ALOGE("Failed to list existing costly tables ret=%d", ret);
948 return;
949 }
950 /* ... then flush/clean both ip4 and ip6 iptables. */
951 parseAndFlushCostlyTables(ruleList, doClean);
952 }
953
parseAndFlushCostlyTables(const std::string & ruleList,bool doRemove)954 void BandwidthController::parseAndFlushCostlyTables(const std::string& ruleList, bool doRemove) {
955 std::stringstream stream(ruleList);
956 std::string rule;
957 std::vector<std::string> clearCommands = { "*filter" };
958 std::string chainName;
959
960 // Find and flush all rules starting with "-N bw_costly_<iface>" except "-N bw_costly_shared".
961 while (std::getline(stream, rule, '\n')) {
962 if (rule.find(NEW_CHAIN_COMMAND) != 0) continue;
963 chainName = rule.substr(NEW_CHAIN_COMMAND.size());
964 ALOGV("parse chainName=<%s> orig line=<%s>", chainName.c_str(), rule.c_str());
965
966 if (chainName.find("bw_costly_") != 0 || chainName == std::string("bw_costly_shared")) {
967 continue;
968 }
969
970 clearCommands.push_back(StringPrintf(":%s -", chainName.c_str()));
971 if (doRemove) {
972 clearCommands.push_back(StringPrintf("-X %s", chainName.c_str()));
973 }
974 }
975
976 if (clearCommands.size() == 1) {
977 // No rules found.
978 return;
979 }
980
981 clearCommands.push_back("COMMIT\n");
982 iptablesRestoreFunction(V4V6, Join(clearCommands, '\n'), nullptr);
983 }
984
opToString(IptOp op)985 inline const char *BandwidthController::opToString(IptOp op) {
986 switch (op) {
987 case IptOpInsert:
988 return "-I";
989 case IptOpDelete:
990 return "-D";
991 }
992 }
993
jumpToString(IptJumpOp jumpHandling)994 inline const char *BandwidthController::jumpToString(IptJumpOp jumpHandling) {
995 /*
996 * Must be careful what one rejects with, as upper layer protocols will just
997 * keep on hammering the device until the number of retries are done.
998 * For port-unreachable (default), TCP should consider as an abort (RFC1122).
999 */
1000 switch (jumpHandling) {
1001 case IptJumpNoAdd:
1002 return "";
1003 case IptJumpReject:
1004 return " --jump REJECT";
1005 case IptJumpReturn:
1006 return " --jump RETURN";
1007 }
1008 }
1009