From 05cfd25d3f22c71c2c6980d1880c01162d915665 Mon Sep 17 00:00:00 2001 From: Lorenzo Colitti Date: Sun, 10 Jul 2016 23:15:46 +0900 Subject: [PATCH 1/1] Add counters for IPv6 tethering. Bug: 9580643 Change-Id: I60ff10cea8e8e90eeaf5412f1b6254696073506d --- server/CommandListener.cpp | 2 +- server/NatController.cpp | 70 ++++++++++++++++++++++++-------------------- server/NatControllerTest.cpp | 45 +++++++++++++++------------- 3 files changed, 64 insertions(+), 53 deletions(-) diff --git a/server/CommandListener.cpp b/server/CommandListener.cpp index 6d0e088..6b65d64 100644 --- a/server/CommandListener.cpp +++ b/server/CommandListener.cpp @@ -216,7 +216,7 @@ CommandListener::CommandListener() : createChildChains(V4V6, "filter", "OUTPUT", FILTER_OUTPUT); createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING); createChildChains(V4V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING); - createChildChains(V4, "mangle", "FORWARD", MANGLE_FORWARD); + createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD); createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING); createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING); diff --git a/server/NatController.cpp b/server/NatController.cpp index fba96ca..b978358 100644 --- a/server/NatController.cpp +++ b/server/NatController.cpp @@ -86,9 +86,17 @@ int NatController::setupIptablesHooks() { struct CommandsAndArgs defaultCommands[] = { /* - * First chain is for tethering counters. + * This is for tethering counters. * This chain is reached via --goto, and then RETURNS. - * + */ + {{IPTABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, + {{IP6TABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, + {{IPTABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, + {{IP6TABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, + {{IPTABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1}, + {{IP6TABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1}, + + /* * Second chain is used to limit downstream mss to the upstream pmtu * so we don't end up fragmenting every large packet tethered devices * send. Note this feature requires kernel support with flag @@ -97,11 +105,8 @@ int NatController::setupIptablesHooks() { * Bug 17629786 asks to make the failure more obvious, or even fatal * so that all builds eventually gain the performance improvement. */ - {{IPTABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, - {{IPTABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0}, - {{IPTABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1}, - {{IPTABLES_PATH, "-w", "-t", "mangle", "-A", LOCAL_MANGLE_FORWARD, "-p", "tcp", "--tcp-flags", - "SYN", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu"}, 0}, + {{IPTABLES_PATH, "-w", "-t", "mangle", "-A", LOCAL_MANGLE_FORWARD, "-p", "tcp", + "--tcp-flags", "SYN", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu"}, 0}, }; for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) { if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) && @@ -123,6 +128,7 @@ int NatController::setDefaults() { */ struct CommandsAndArgs defaultCommands[] = { {{IPTABLES_PATH, "-w", "-F", LOCAL_FORWARD,}, 1}, + {{IP6TABLES_PATH, "-w", "-F", LOCAL_FORWARD,}, 1}, {{IPTABLES_PATH, "-w", "-A", LOCAL_FORWARD, "-j", "DROP"}, 1}, {{IPTABLES_PATH, "-w", "-t", "nat", "-F", LOCAL_NAT_POSTROUTING}, 1}, }; @@ -155,7 +161,7 @@ int NatController::enableNat(const char* intIface, const char* extIface) { // add this if we are the first added nat if (natCount == 0) { - const char *cmd[] = { + const char *v4Cmd[] = { IPTABLES_PATH, "-w", "-t", @@ -167,7 +173,15 @@ int NatController::enableNat(const char* intIface, const char* extIface) { "-j", "MASQUERADE" }; - if (runCmd(ARRAY_SIZE(cmd), cmd)) { + + /* + * IPv6 tethering doesn't need the state-based conntrack rules, so + * it unconditionally jumps to the tether counters chain all the time. + */ + const char *v6Cmd[] = {IP6TABLES_PATH, "-w", "-A", LOCAL_FORWARD, + "-g", LOCAL_TETHER_COUNTERS_CHAIN}; + + if (runCmd(ARRAY_SIZE(v4Cmd), v4Cmd) || runCmd(ARRAY_SIZE(v6Cmd), v6Cmd)) { ALOGE("Error setting postroute rule: iface=%s", extIface); // unwind what's been done, but don't care about success - what more could we do? setDefaults(); @@ -234,19 +248,16 @@ int NatController::setTetherCountingRules(bool add, const char *intIface, const return 0; } const char *cmd2b[] = { - IPTABLES_PATH, - "-w", - "-A", - LOCAL_TETHER_COUNTERS_CHAIN, - "-i", - intIface, - "-o", - extIface, - "-j", - "RETURN" + IPTABLES_PATH, + "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", intIface, "-o", extIface, "-j", "RETURN" }; - if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) && add) { + const char *cmd2c[] = { + IP6TABLES_PATH, + "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", intIface, "-o", extIface, "-j", "RETURN" + }; + + if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) || runCmd(ARRAY_SIZE(cmd2c), cmd2c)) { free(pair_name); return -1; } @@ -260,19 +271,16 @@ int NatController::setTetherCountingRules(bool add, const char *intIface, const } const char *cmd3b[] = { - IPTABLES_PATH, - "-w", - "-A", - LOCAL_TETHER_COUNTERS_CHAIN, - "-i", - extIface, - "-o", - intIface, - "-j", - "RETURN" + IPTABLES_PATH, + "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", extIface, "-o", intIface, "-j", "RETURN" + }; + + const char *cmd3c[] = { + IP6TABLES_PATH, + "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", extIface, "-o", intIface, "-j", "RETURN" }; - if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) && add) { + if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) || runCmd(ARRAY_SIZE(cmd3c), cmd3c)) { // unwind what's been done, but don't care about success - what more could we do? free(pair_name); return -1; diff --git a/server/NatControllerTest.cpp b/server/NatControllerTest.cpp index 551efc6..e6c7b47 100644 --- a/server/NatControllerTest.cpp +++ b/server/NatControllerTest.cpp @@ -48,20 +48,20 @@ protected: } const ExpectedIptablesCommands FLUSH_COMMANDS = { - { V4, "-F natctrl_FORWARD" }, - { V4, "-A natctrl_FORWARD -j DROP" }, - { V4, "-t nat -F natctrl_nat_POSTROUTING" }, + { V4V6, "-F natctrl_FORWARD" }, + { V4, "-A natctrl_FORWARD -j DROP" }, + { V4, "-t nat -F natctrl_nat_POSTROUTING" }, }; const ExpectedIptablesCommands SETUP_COMMANDS = { - { V4, "-F natctrl_FORWARD" }, - { V4, "-A natctrl_FORWARD -j DROP" }, - { V4, "-t nat -F natctrl_nat_POSTROUTING" }, - { V4, "-F natctrl_tether_counters" }, - { V4, "-X natctrl_tether_counters" }, - { V4, "-N natctrl_tether_counters" }, - { V4, "-t mangle -A natctrl_mangle_FORWARD -p tcp --tcp-flags SYN SYN " - "-j TCPMSS --clamp-mss-to-pmtu" }, + { V4V6, "-F natctrl_FORWARD" }, + { V4, "-A natctrl_FORWARD -j DROP" }, + { V4, "-t nat -F natctrl_nat_POSTROUTING" }, + { V4V6, "-F natctrl_tether_counters" }, + { V4V6, "-X natctrl_tether_counters" }, + { V4V6, "-N natctrl_tether_counters" }, + { V4, "-t mangle -A natctrl_mangle_FORWARD -p tcp --tcp-flags SYN SYN " + "-j TCPMSS --clamp-mss-to-pmtu" }, }; const ExpectedIptablesCommands TWIDDLE_COMMANDS = { @@ -69,22 +69,25 @@ protected: { V4, "-A natctrl_FORWARD -j DROP" }, }; - ExpectedIptablesCommands enableMasqueradeCommand(const char *extIf) { + ExpectedIptablesCommands firstNatCommands(const char *extIf) { return { { V4, StringPrintf("-t nat -A natctrl_nat_POSTROUTING -o %s -j MASQUERADE", extIf) }, + { V6, "-A natctrl_FORWARD -g natctrl_tether_counters" }, }; } ExpectedIptablesCommands startNatCommands(const char *intIf, const char *extIf) { return { - { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state" - " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) }, - { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP", - intIf, extIf) }, - { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters", - intIf, extIf) }, - { V4, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", intIf, extIf) }, - { V4, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", extIf, intIf) }, + { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state" + " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) }, + { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP", + intIf, extIf) }, + { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters", + intIf, extIf) }, + { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", + intIf, extIf) }, + { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", + extIf, intIf) }, }; } @@ -113,7 +116,7 @@ TEST_F(NatControllerTest, TestSetDefaults) { TEST_F(NatControllerTest, TestAddAndRemoveNat) { std::vector startFirstNat = { - enableMasqueradeCommand("rmnet0"), + firstNatCommands("rmnet0"), startNatCommands("wlan0", "rmnet0"), TWIDDLE_COMMANDS, }; -- 2.11.0