Add counters for IPv6 tethering.

Bug: 9580643
Change-Id: I60ff10cea8e8e90eeaf5412f1b6254696073506d

diff --git a/server/CommandListener.cpp b/server/CommandListener.cpp
index 6d0e088..6b65d64 100644 (file)
--- a/server/CommandListener.cpp
+++ b/server/CommandListener.cpp
@@ -216,7 +216,7 @@ CommandListener::CommandListener() :
     createChildChains(V4V6, "filter", "OUTPUT", FILTER_OUTPUT);
     createChildChains(V4V6, "raw", "PREROUTING", RAW_PREROUTING);
     createChildChains(V4V6, "mangle", "POSTROUTING", MANGLE_POSTROUTING);
-    createChildChains(V4, "mangle", "FORWARD", MANGLE_FORWARD);
+    createChildChains(V4V6, "mangle", "FORWARD", MANGLE_FORWARD);
     createChildChains(V4, "nat", "PREROUTING", NAT_PREROUTING);
     createChildChains(V4, "nat", "POSTROUTING", NAT_POSTROUTING);
 

diff --git a/server/NatController.cpp b/server/NatController.cpp
index fba96ca..b978358 100644 (file)
--- a/server/NatController.cpp
+++ b/server/NatController.cpp
@@ -86,9 +86,17 @@ int NatController::setupIptablesHooks() {
 
     struct CommandsAndArgs defaultCommands[] = {
         /*
-         * First chain is for tethering counters.
+         * This is for tethering counters.
          * This chain is reached via --goto, and then RETURNS.
-         *
+         */
+        {{IPTABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
+        {{IP6TABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
+        {{IPTABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
+        {{IP6TABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
+        {{IPTABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1},
+        {{IP6TABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1},
+
+        /*
          * Second chain is used to limit downstream mss to the upstream pmtu
          * so we don't end up fragmenting every large packet tethered devices
          * send.  Note this feature requires kernel support with flag
@@ -97,11 +105,8 @@ int NatController::setupIptablesHooks() {
          * Bug 17629786 asks to make the failure more obvious, or even fatal
          * so that all builds eventually gain the performance improvement.
          */
-        {{IPTABLES_PATH, "-w", "-F", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
-        {{IPTABLES_PATH, "-w", "-X", LOCAL_TETHER_COUNTERS_CHAIN,}, 0},
-        {{IPTABLES_PATH, "-w", "-N", LOCAL_TETHER_COUNTERS_CHAIN,}, 1},
-        {{IPTABLES_PATH, "-w", "-t", "mangle", "-A", LOCAL_MANGLE_FORWARD, "-p", "tcp", "--tcp-flags",
-                "SYN", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu"}, 0},
+        {{IPTABLES_PATH, "-w", "-t", "mangle", "-A", LOCAL_MANGLE_FORWARD, "-p", "tcp",
+                "--tcp-flags", "SYN", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu"}, 0},
     };
     for (unsigned int cmdNum = 0; cmdNum < ARRAY_SIZE(defaultCommands); cmdNum++) {
         if (runCmd(ARRAY_SIZE(defaultCommands[cmdNum].cmd), defaultCommands[cmdNum].cmd) &&
@@ -123,6 +128,7 @@ int NatController::setDefaults() {
      */
     struct CommandsAndArgs defaultCommands[] = {
         {{IPTABLES_PATH, "-w", "-F", LOCAL_FORWARD,}, 1},
+        {{IP6TABLES_PATH, "-w", "-F", LOCAL_FORWARD,}, 1},
         {{IPTABLES_PATH, "-w", "-A", LOCAL_FORWARD, "-j", "DROP"}, 1},
         {{IPTABLES_PATH, "-w", "-t", "nat", "-F", LOCAL_NAT_POSTROUTING}, 1},
     };
@@ -155,7 +161,7 @@ int NatController::enableNat(const char* intIface, const char* extIface) {
 
     // add this if we are the first added nat
     if (natCount == 0) {
-        const char *cmd[] = {
+        const char *v4Cmd[] = {
                 IPTABLES_PATH,
                 "-w",
                 "-t",
@@ -167,7 +173,15 @@ int NatController::enableNat(const char* intIface, const char* extIface) {
                 "-j",
                 "MASQUERADE"
         };
-        if (runCmd(ARRAY_SIZE(cmd), cmd)) {
+
+        /*
+         * IPv6 tethering doesn't need the state-based conntrack rules, so
+         * it unconditionally jumps to the tether counters chain all the time.
+         */
+        const char *v6Cmd[] = {IP6TABLES_PATH, "-w", "-A", LOCAL_FORWARD,
+                               "-g", LOCAL_TETHER_COUNTERS_CHAIN};
+
+        if (runCmd(ARRAY_SIZE(v4Cmd), v4Cmd) || runCmd(ARRAY_SIZE(v6Cmd), v6Cmd)) {
             ALOGE("Error setting postroute rule: iface=%s", extIface);
             // unwind what's been done, but don't care about success - what more could we do?
             setDefaults();
@@ -234,19 +248,16 @@ int NatController::setTetherCountingRules(bool add, const char *intIface, const
         return 0;
     }
     const char *cmd2b[] = {
-            IPTABLES_PATH,
-            "-w",
-            "-A",
-            LOCAL_TETHER_COUNTERS_CHAIN,
-            "-i",
-            intIface,
-            "-o",
-            extIface,
-            "-j",
-          "RETURN"
+        IPTABLES_PATH,
+        "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", intIface, "-o", extIface, "-j", "RETURN"
     };
 
-    if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) && add) {
+    const char *cmd2c[] = {
+        IP6TABLES_PATH,
+        "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", intIface, "-o", extIface, "-j", "RETURN"
+    };
+
+    if (runCmd(ARRAY_SIZE(cmd2b), cmd2b) || runCmd(ARRAY_SIZE(cmd2c), cmd2c)) {
         free(pair_name);
         return -1;
     }
@@ -260,19 +271,16 @@ int NatController::setTetherCountingRules(bool add, const char *intIface, const
     }
 
     const char *cmd3b[] = {
-            IPTABLES_PATH,
-            "-w",
-            "-A",
-            LOCAL_TETHER_COUNTERS_CHAIN,
-            "-i",
-            extIface,
-            "-o",
-            intIface,
-            "-j",
-            "RETURN"
+        IPTABLES_PATH,
+        "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", extIface, "-o", intIface, "-j", "RETURN"
+    };
+
+    const char *cmd3c[] = {
+        IP6TABLES_PATH,
+        "-w", "-A", LOCAL_TETHER_COUNTERS_CHAIN, "-i", extIface, "-o", intIface, "-j", "RETURN"
     };
 
-    if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) && add) {
+    if (runCmd(ARRAY_SIZE(cmd3b), cmd3b) || runCmd(ARRAY_SIZE(cmd3c), cmd3c)) {
         // unwind what's been done, but don't care about success - what more could we do?
         free(pair_name);
         return -1;

diff --git a/server/NatControllerTest.cpp b/server/NatControllerTest.cpp
index 551efc6..e6c7b47 100644 (file)
--- a/server/NatControllerTest.cpp
+++ b/server/NatControllerTest.cpp
@@ -48,20 +48,20 @@ protected:
     }
 
     const ExpectedIptablesCommands FLUSH_COMMANDS = {
-        { V4, "-F natctrl_FORWARD" },
-        { V4, "-A natctrl_FORWARD -j DROP" },
-        { V4, "-t nat -F natctrl_nat_POSTROUTING" },
+        { V4V6, "-F natctrl_FORWARD" },
+        { V4,   "-A natctrl_FORWARD -j DROP" },
+        { V4,   "-t nat -F natctrl_nat_POSTROUTING" },
     };
 
     const ExpectedIptablesCommands SETUP_COMMANDS = {
-        { V4, "-F natctrl_FORWARD" },
-        { V4, "-A natctrl_FORWARD -j DROP" },
-        { V4, "-t nat -F natctrl_nat_POSTROUTING" },
-        { V4, "-F natctrl_tether_counters" },
-        { V4, "-X natctrl_tether_counters" },
-        { V4, "-N natctrl_tether_counters" },
-        { V4, "-t mangle -A natctrl_mangle_FORWARD -p tcp --tcp-flags SYN SYN "
-              "-j TCPMSS --clamp-mss-to-pmtu" },
+        { V4V6, "-F natctrl_FORWARD" },
+        { V4,   "-A natctrl_FORWARD -j DROP" },
+        { V4,   "-t nat -F natctrl_nat_POSTROUTING" },
+        { V4V6, "-F natctrl_tether_counters" },
+        { V4V6, "-X natctrl_tether_counters" },
+        { V4V6, "-N natctrl_tether_counters" },
+        { V4,   "-t mangle -A natctrl_mangle_FORWARD -p tcp --tcp-flags SYN SYN "
+                "-j TCPMSS --clamp-mss-to-pmtu" },
     };
 
     const ExpectedIptablesCommands TWIDDLE_COMMANDS = {
@@ -69,22 +69,25 @@ protected:
         { V4, "-A natctrl_FORWARD -j DROP" },
     };
 
-    ExpectedIptablesCommands enableMasqueradeCommand(const char *extIf) {
+    ExpectedIptablesCommands firstNatCommands(const char *extIf) {
         return {
             { V4, StringPrintf("-t nat -A natctrl_nat_POSTROUTING -o %s -j MASQUERADE", extIf) },
+            { V6, "-A natctrl_FORWARD -g natctrl_tether_counters" },
         };
     }
 
     ExpectedIptablesCommands startNatCommands(const char *intIf, const char *extIf) {
         return {
-            { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state"
-                               " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) },
-            { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
-                               intIf, extIf) },
-            { V4, StringPrintf("-A natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters",
-                               intIf, extIf) },
-            { V4, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", intIf, extIf) },
-            { V4, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN", extIf, intIf) },
+            { V4,   StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state"
+                                 " ESTABLISHED,RELATED -g natctrl_tether_counters", extIf, intIf) },
+            { V4,   StringPrintf("-A natctrl_FORWARD -i %s -o %s -m state --state INVALID -j DROP",
+                                 intIf, extIf) },
+            { V4,   StringPrintf("-A natctrl_FORWARD -i %s -o %s -g natctrl_tether_counters",
+                                 intIf, extIf) },
+            { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN",
+                                 intIf, extIf) },
+            { V4V6, StringPrintf("-A natctrl_tether_counters -i %s -o %s -j RETURN",
+                                 extIf, intIf) },
         };
     }
 
@@ -113,7 +116,7 @@ TEST_F(NatControllerTest, TestSetDefaults) {
 TEST_F(NatControllerTest, TestAddAndRemoveNat) {
 
     std::vector<ExpectedIptablesCommands> startFirstNat = {
-        enableMasqueradeCommand("rmnet0"),
+        firstNatCommands("rmnet0"),
         startNatCommands("wlan0", "rmnet0"),
         TWIDDLE_COMMANDS,
     };