GitLab

Move creation and management of module iptables chains up into
CommandListener, which gives better visibility into ordering.

Change-Id: If0c94187c6e59a20840b035d7241057f45a0f74b

iptables top-level chain updates should happen within CommandListener()
when it invokes the various modules' setupIptablesHooks().
And remove the extra DROP rule.

Change-Id: I33d2cfbd5444516f855ff85152c472352944cc77

iptables top-level chain updates should happen within CommandListener()
when it invokes the various modules' setupIptablesHooks().
And remove the extra DROP rule.


Change-Id: I33d2cfbd5444516f855ff85152c472352944cc77

* modified iptables users to work in controller specific custom chains.
 - each controller only works withing his own custom chains and not the
  top level ones (INPUT, OUTPUT, FORWARD, POSTROUTING,...)
 - CommandListener now invokes setupIptablesHooks() for each controller
   once. That is the only time they are allowed to access the top-level
   chains.

* Added idletimer controller.
  From https://android-git.corp.google.com/g/#/c/180769/2


 - supported commands
   . ndc idletimer enable
   . ndc idletimer add <iface> <timeout>
   . ndc idletimer remove <iface> <timeout_used_during_add>
 There is a framework change elsewhere that receives netlink messages.
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
Signed-off-by: JP Abgrall <jpa@google.com>
Change-Id: Ia57450c09166ce20f21d1e3b49047ef1e98f2a3d

Define MAX_IFACE_LENGTH as IFNAMSIZ instead of 10, to
prevent netd from treating an interface name 'rmnet_sdio0'
as invalid.
Also fix an off-by-one error.

bug:5675718
Change-Id: I2b6ba823c89941031e5898b24dab388cd9c2dae8

Define MAX_IFACE_LENGTH as IFNAMSIZ instead of 10, to
prevent netd from treating an interface name 'rmnet_sdio0'
as invalid.
Also fix an off-by-one error.

Change-Id: If6b2b27d2da6eb72f01c090cbe4f7dc2b9c296ae

We had some places (NatController) where routes were being set
but not accounted for in the number-of-routes talley so we
could end up thinking the table was empty and not clean up
after ourselves properly.

Also consolidated constants.

bug:5917475
Change-Id: I98a41d433e1d4b4ca6692fb2328e2c9afc828145

The functionality was lost during merge in ICS branch.
This patch is adding back OEM iptables hook in netd.

Bug:5862460
Change-Id: I9444b8c53e8b84fea2002c2c1d9ba42e45ae5f0c

See https://android-git.corp.google.com/g/#/c/157220

Bug: 5449033
Change-Id: I8ab66debe4d0c3857a4b80f6f7b6925a352cda87

While working around the logwrap() issue, it was replaced with system()
which could lead to various commands getting misinterpreted.

We now use a system() equivalent that doesn't use "sh -c".

Bug:5758556
Change-Id: I2599b526ac34bcfca18d05261286d902d547efda

While working around the logwrap() issue, it was replaced with system()
which could lead to various commands getting misinterpreted.

We now use a system() equivalent that doesn't use "sh -c".

Bug:5758556
Change-Id: I2599b526ac34bcfca18d05261286d902d547efda

Was not building secondary tables properly.  Also IPv6 host routes
were failing.

bug:5615697
Change-Id: I0d5ad2ed7d13e4d5bd8c2f8ce15fc0ccb36a4690

bug:5495862
bug:5396842
Change-Id: I51f21060947f57e63b18c4d35e9d49fac488d48a

Regardless of errors we should try to do as much as possible.  Sometimes
some steps may fail if interfaces are taken down before we can un-nat them.

bug:5536516
Change-Id: I9c9b0123198dba890565e0a6e4e15add16b369c2

The logwrapper uses a blocking read() which does not always
correctly detect when the child process at the other end is gone.
This is a quick workaround for http://b/5144246


A cleaner logwrapper parent() will follow.

Add support for BandwidthController() to use either system() or
logwrap(). It looks at "persist.bandwidth.uselogwrap" to be 0 or 1.

Change-Id: I2d17732214f1a7fef6838eee05d827695b707ab0
Signed-off-by: JP Abgrall <jpa@google.com>

Noticed by moto, I missed to calls to actually do the unwinding.

Change-Id: Ie4da4979a3ad0eedcb6d468fecdff6614b1819bd

bug:5094583
Change-Id: Ib942c557e7f2694b6ee18cc6562df597165894ce

This is a squash of two changes from partner repo:

    Clean up OEM iptables hooks

    Id: Ife7a1c08ca88beba2dede776d2e4dd6097dad05a

And

    Add hooks for OEM iptables rules and IP fwd

    - Useful for integrating peripherals that use IP for control and
    diagnostics.
    - Add hooks for specifying static iptables rules at startup.
    - Add system prop to keep IP forwarding enabled all the time.
    - Remove the ro.bootmode=bp-tools hacks.

    Id: Ic70d4c88179c530414505976193bf616037500a6

Bug: 5045218
Change-Id: I4229d3576426880b68ac448f9fbb67f2f8f304a0

DO NOT MERGE: cherry-pick from master, as oem's will be updating this
file in HC.

It doesn't use them, so it should not have to flush them.
This is a minimalistic attempt to cooperate with the BandwidthController.

Change-Id: Ia175a86403adf034ac6f44d7ebc4ebe941881368

It doesn't use them, so it should not have to flush them.
This is a minimalistic attempt to cooperate with the BandwidthController.

Change-Id: Ia175a86403adf034ac6f44d7ebc4ebe941881368

The NatController fail-safe which flushes the iptables when the ref
count reaches zero unintentionally wipes out all static rules setup
by init in bp-tools test mode.  Doing this flush is not necessary.

Change-Id: I37890e79cd701aa2e970958a246dfe7514a65c47

Change-Id: I99f7b79bfb5b6305a0772f418a54ace50cac1bbe

Change-Id: I2d42d6ddb16f88929b5edeeeb653feca8348e804

Silly errors in refcount logic did the wrong thing.

Change-Id: I2cfc208615258397501450717cfcb7eb0386c9d4

It was flushing on every unNAT, but really you want to remove just those rules.  We'll
Flush when we get to 0 NATs.

bug: 2542176
Change-Id: Ia70580191b1aed754689864044de122234346011

Update: Add stub function to validate interface existance
Signed-off-by: San Mehat <san@google.com>