summaryrefslogtreecommitdiff
path: root/server/IptablesRestoreController.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Merge "Refactor stoping process to one util API Try SIGTERM with timeout ↵Treehugger Robot2021-12-091-26/+9
|\ | | | | | | first. If failure, use SIGKILL"
| * Refactor stoping process to one util APIWeiZhang2021-12-081-26/+9
| | | | | | | | | | | | | | | | Try SIGTERM with timeout first. If failure, use SIGKILL Use the stoping process API for clatd, dnsmasq, iptables-restore Change-Id: I299c2023d2661ffc6c9d7eacf1650cb233ed22e3
* | [NETD-TC#6] Clean up the dependency between FirewallController andwaynema2021-12-021-1/+1
|/ | | | | | | | TrafficController. Test: m; flash; boot Test: atest FirewallControllerTest TrafficControllerTest Change-Id: I0a8f3f2e9c1f4510021570e7894a56e4998f3ede
* IptablesRestoreController - work around for ALOGE truncationMaciej Żenczykowski2020-05-291-7/+6
| | | | | | | Test: builds, atest, log at logcat Bug: 157777758 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ic9a4a8228028228020bea3101dca3d47be0e6ab5
* Enable more clang-tidy checks and treat them as errorsBernie Innocenti2019-02-011-2/+2
| | | | | Test: tests/runtests.sh Change-Id: If59480cee6460847f5c1cef17e3ef036b8e75651
* Let lock_guard deduce its template argumentBernie Innocenti2018-08-101-1/+1
| | | | | | | | | | | | | | | No functional change, this is a cleanup. With C++17, it's no longer necessary to specify the teplate argument when it can be deduced from the types of constructor arguments. This allows de-cluttering our locking statements. To avoid typos, this patch was mechanically generated: perl -p -i -e 's/std::lock_guard<std::mutex>/std::lock_guard/g' \ $(find . -name '*.cpp' -o -name '*.h') Change-Id: Ibb15d9a6c5b1c861d81353e47d25474eb1d4c2df
* Open iptables-restore pipes with O_CLOEXEC.Lorenzo Colitti2017-08-281-13/+3
| | | | | | | | | | | This improves security and reliability, and also avoids keeping superflous fds open in iptables-restore processes: the pipe fds that are dup2()d are never closed. Bug: 28362720 Test: bullhead builds, boots Test: netd_{unit,integration}_test pass Change-Id: Ifb57082a6c711f0684fc37a254076e84ad097b6e
* Don't start iptables and ip6tables on parallel threads.Lorenzo Colitti2017-08-281-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This still ensures that the child processes initialize in parallel (which is the slow part of starting them, since forkAndExec itself is sub-millisecond), but it does not fork them in parallel. Forking them in parallel is incorrect because forkAndExec first creates pipes, then forks, then closes the pipes. If this is done in parallel on two threads, the following can happen: 1. Create pipes to subprocess A. 2. Create pipes to subprocess B. 3. Fork process A. 4. Fork process B. 5. Close child end of pipes to subprocess A. 6. Close child end of pipes to subprocess B. If this happens, then the subprocess B will inherit all the fds of the pipes to subprocess A in addition to its own. This includes the read end of the pipe that netd uses to send commands to subprocess A, and the write ends of the pipes that netd uses to receive subprocess A's stdout and stderr. Subprocess B never reads or writes to these fds because it never dup2()s them to stdin/stdout/stderr before calling exec(). However, it also never closes them. Therefore, if process A dies (e.g., due to an invalid command), then netd will never receive a POLLHUP on the read ends or a POLLERR on the write end of these pipes. This means that: 1. The invalid command to subprocess A will time out (imposing a 5-second delay) instead of failing fast. 2. Even though the timeout causes us to call stop() on subprocess A, and stop() causes processTerminated to be set to true, sendCommand does not check processTerminated, it only checks outputReady. Therefore, when we get told to send another command to subprocess A, if subprocess B is still around, outputReady will return true. The result is that we do not fork a new subprocess to replace subprocess A. These effects caused flakiness of TestRestartOnMalformedCommand and a latency hit to the first invalid command sent after boot. Bug: 28362720 Bug: 64687442 Test: bullhead builds, boots Test: netd_{unit,integration}_test pass Test: TestRestartOnMalformedCommand passes 100 times in a row Change-Id: I117359b9ca9c82dd676608100fed6957c9a93c92
* Test for races in IptablesRestoreController::Init.Lorenzo Colitti2017-08-141-11/+20
| | | | | | | Bug: 28362720 Test: angler builds, boots Test: netd_{unit,integration}_test pass Change-Id: I73ed28c7e7edaeb65a3b346b89ec69f472fd5974
* Start the iptables and ip6tables processes in parallel.Lorenzo Colitti2017-08-101-3/+6
| | | | | | | | | | | | | This saves ~30ms on boot. There should be no races between the threads that start the and the main thread because pthread_join is documented to synchronize memory with respect to other threads. Bug: 28362720 Test: bullhead builds, boots Test: netd_{unit,integration}_test pass Change-Id: I24d83b880bd011bc801178f57f46d90f36621f9f
* Improve iptables timeout behaviour.Lorenzo Colitti2017-03-011-12/+8
| | | | | | | | | | | | | | | | | | | | | | | 1. Increase the default timeout from 1s to 5s. This is necessary for as long as our version of iptables sleeps for 1 second at a time while the iptables lock is contended. 2. When a timeout occurs, kill the process to ensure that if it recovers, any output is not returned to subsequent commands. Add corresponding unit tests. While I'm at it: - Ensure that iptables commands that take an output string clear the output string before appending to it. Otherwise, callers that passed the same output string object to two separate iptables commands would think the second command returned both outputs. This does not affect any existing callers. - Delete some unused code. Bug: 35634318 Test: netd_{unit,integration}_test pass Change-Id: Ife3dfd328ea82f2e93fb903fcf3660a13078b7b5
* Delete all EOTs in iptables commands and remove fixCommandString.Lorenzo Colitti2017-02-101-18/+2
| | | | | | | Test: bullead builds and boots with no iptables errors Test: netd_{unit,integration}_test pass Bug: 32323979 Change-Id: I33ad04ee8f0562bcd4e14046352c934cd2039a5d
* Improve IptablesRestoreController error logging.Lorenzo Colitti2017-02-101-34/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | - Switch tag from /system/bin/netd to IptablesController for consistency. - When a command fails, include the command that caused the error in addition to the error itself. Example output: 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: iptables error: 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: ------- COMMAND ------- 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: *filter 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: :natctrl_tether_counters - 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: badbadbadbad 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: COMMIT 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: ------- ERROR ------- 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: Bad argument `badbadbadbad' 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: Error occurred at line: 112 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information. 02-03 16:35:01.044 17129 17129 E IptablesRestoreController: ---------------------- Test: added an invalid command to NatController, observed above log messages Bug: 32323979 Change-Id: I0c1c37464f5b19c64d6e043aef8704285df4c508
* Support reading output from IptablesRestoreController.Lorenzo Colitti2017-02-101-37/+46
| | | | | | | | | | | | | | | | Add the ability to IptablesRestoreController to return the output of a command. This is useful to run commands that list chains or return counters through the ip[6]tables-restore. Also enable unsigned-integer-overflow sanitization the unit tests because their behaviour should be representative of actual code. Having address sanitization enabled would have saved a fair amount of time debugging an on-device abort() that did not affect the tests. Test: new unit test passes Bug: 32323979 Change-Id: I70726ebbade0cb792aba38787c57378df177f2d8
* More robust handling of iptables-restore process terminationLorenzo Colitti2017-02-091-74/+73
| | | | | | | Bug: 32323979 Test: unit tests pass Test: bullhead builds and boots Change-Id: Ib3ea4221b1b2025a0a236f2607db29e1cd30ffa9
* netd: Use a persistent iptables[6]-restore processNarayan Kamath2017-01-231-0/+381
iptables-restore and ip[6]tables-restore are forked on demand whenever we need them, and their stdin/out/err are replaced by pipes to the parent process. All commands are sent via the stdin pipe. We also add SIGCHLD handling so that we can detect error conditions and restart the process whenever required. Bug: 32323979 Test: Manual Test: netd_unit_test, netd_integration_test Change-Id: Ia12ee01f8b45e5b8a699c27eea1b6b55d40f16b5
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-20 04:56:38 +0000