patchpanel/init/patchpanel.conf

# Copyright 2015 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description     "Starts platform guest networking services"
author          "chromium-os-dev@chromium.org"

start on starting system-services
stop on stopping system-services

respawn
respawn limit 3 10

# Killable for memory leaks.
oom score -100
# This limit is high to accommodate the adp-proxy child process which will
# attempt to mmap over 200MB on first connect.
limit as 400000000 unlimited

pre-start script
{
  echo "Setting up NAT and IP forwarding"
  sysctl net.ipv4.ip_forward=1

  # Only packets marked with a 1 will be forwarded. A service depending on
  # this should then set up a rule to mark its packets. For example, to mark
  # all packets from interface br0:
  # iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1 -w
  #
  # chromium:1050579: INVALID packets cannot be tracked by conntrack therefore
  # need to be explicitly dropped.
  iptables -A FORWARD -m mark --mark 1 -m state --state INVALID -j DROP -w
  iptables -A FORWARD -m mark --mark 1 -j ACCEPT -w
  iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT -w
  iptables -t nat -A POSTROUTING -m mark --mark 1 -j MASQUERADE -w

  # TODO(chromium:898210): Move interface-specific masquerading setup to shill;
  # such that we can better set up the masquerade rules based on connection
  # type rather than interface names.
  iptables -t nat -A POSTROUTING -o wwan+ -j MASQUERADE -w

  # This marks packets from _all_ interfaces starting with vmtap, since
  # they all belong to termina, and will all want to be NAT'ed.
  iptables -t mangle -A PREROUTING -i vmtap+ -j MARK --set-mark 1 -w

  echo "Starting patchpaneld"
} 2>&1 | logger -t "${UPSTART_JOB}"
end script # pre-start

exec /usr/bin/patchpaneld

post-stop script
{
  echo "Stopped patchpaneld"
  echo "Tearing down NAT and IP forwarding"
  iptables -t mangle -D PREROUTING -i vmtap+ -j MARK --set-mark 1 -w

  iptables -D FORWARD -m mark --mark 1 -j ACCEPT -w
  iptables -D FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT -w
  iptables -t nat -D POSTROUTING -m mark --mark 1 -j MASQUERADE -w

  # TODO(chromium:898210): Move interface-specific masquerading setup to shill
  # such that we can better set up the masquerade rules based on connection
  # type rather than interface names.
  iptables -t nat -D POSTROUTING -o wwan+ -j MASQUERADE -w

  sysctl net.ipv4.ip_forward=0
} 2>&1 | logger -t "${UPSTART_JOB}"
end script # post-stop