tree 142640a823efa3959de54efe88ad8661028ea641
parent bb07f00b6af7fe8f5935ee3e1fdced4ef77fae68
author Lorenzo Colitti <lorenzo@google.com> 1502382004 +0900
committer Lorenzo Colitti <lorenzo@google.com> 1503108946 +0900

Convert NatController to iptables-restore.

This conversion is a bit more involved than previous ones, mostly
due to all the error unwinding.

For the sake of readability, this change limits itself to
converting mostly maintaining their order, with the exception
that it puts the rpfilter rule before all the LOCAL_FORWARD rules
to simplify error handling.

It also groups commands together as much as possible to simplify
error handling: because a set of iptables commands between
"*<table>" and "COMMIT" will either all succeed or all fail,
grouping commands together limits the number of required
error handling paths.

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Change-Id: Idc0ef937583574ceb5b7a8b12ecbaf4c00a49f6d