Convert NatController to iptables-restore.
This conversion is a bit more involved than previous ones, mostly
due to all the error unwinding.
For the sake of readability, this change limits itself to
converting mostly maintaining their order, with the exception
that it puts the rpfilter rule before all the LOCAL_FORWARD rules
to simplify error handling.
It also groups commands together as much as possible to simplify
error handling: because a set of iptables commands between
"*<table>" and "COMMIT" will either all succeed or all fail,
grouping commands together limits the number of required
error handling paths.
Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Change-Id: Idc0ef937583574ceb5b7a8b12ecbaf4c00a49f6d
diff --git a/server/NatController.h b/server/NatController.h
index 5541a26..4c711b0 100644
--- a/server/NatController.h
+++ b/server/NatController.h
@@ -17,7 +17,6 @@
#ifndef _NAT_CONTROLLER_H
#define _NAT_CONTROLLER_H
-#include <linux/in.h>
#include <list>
#include <string>
@@ -44,7 +43,8 @@
private:
int natCount;
- bool checkTetherCountingRuleExist(const char *pair_name);
+ static std::string makeTetherCountingRule(const char *if1, const char *if2);
+ bool checkTetherCountingRuleExist(const std::string& pair_name);
int setDefaults();
int runCmd(int argc, const char **argv);