OSDN Git Service
Lorenzo Colitti [Tue, 26 Apr 2016 09:01:56 +0000 (09:01 +0000)]
Allow TCP RSTs to make it through firewall rules.
am:
932c44c
* commit '
932c44c9bd875060219df7f2ad78769e65adbaca':
Allow TCP RSTs to make it through firewall rules.
Change-Id: I34b136804e7eb1a4fb27314e51c4967de21da486
Lorenzo Colitti [Tue, 26 Apr 2016 09:01:55 +0000 (09:01 +0000)]
Add a binder IPC to close socket connections.
am:
563d98b
* commit '
563d98b27d02a1d694fc4ed82b5554fd534c9daf':
Add a binder IPC to close socket connections.
Change-Id: Idb7e6cf83e6134d390c3e505973e245c7dc718de
Lorenzo Colitti [Sun, 24 Apr 2016 07:58:02 +0000 (16:58 +0900)]
Allow TCP RSTs to make it through firewall rules.
This allows us to cleanly close apps' TCP connections when we
remove their network connectivity.
Bug:
27824851
Change-Id: I69ae0e860536139d30d14d580a36c82f79dc2f82
Lorenzo Colitti [Sun, 24 Apr 2016 04:13:14 +0000 (13:13 +0900)]
Add a binder IPC to close socket connections.
Bug:
27824851
Bug:
27867653
Change-Id: I2e63ccfb268db763ec732594a73c2908838468b8
Robin Lee [Tue, 19 Apr 2016 19:40:30 +0000 (19:40 +0000)]
Server API to only allow networking by VPN apps
am:
b808736
* commit '
b8087363143050d214d48e5620a330776ca95a69':
Server API to only allow networking by VPN apps
Change-Id: I2dd017089226356eda452d6cc246f6e9b3e3166f
Robin Lee [Tue, 19 Apr 2016 19:40:30 +0000 (19:40 +0000)]
Have modifyIpRule take an explicit action
am:
4ef9464
* commit '
4ef94642636182e68495f606a65c00f8a830aad4':
Have modifyIpRule take an explicit action
Change-Id: I9836350a8042622ca440ffdc057d799de561f71f
Robin Lee [Tue, 19 Apr 2016 19:40:30 +0000 (19:40 +0000)]
Move UidRange aidl to create a native cpp version
am:
9f9aae9
* commit '
9f9aae9102f62f5f96ccec670170ee1fb262ef09':
Move UidRange aidl to create a native cpp version
Change-Id: Idc705f22d3eeeb8de90a1133e42e05c184518e25
Robin Lee [Wed, 30 Mar 2016 17:43:08 +0000 (18:43 +0100)]
Server API to only allow networking by VPN apps
Secure virtual networks already create rules to route all traffic into
theirselves. This depends on the secure network already existing.
API creates an ip rule at a priority level below SECURE_VPN which
can catch traffic before VPN comes up, if it is a requirement that no
traffic ever leaves without first going through VPN.
Bug:
26694104
Bug:
26354134
Change-Id: If23df0760c6eb0ad137fc26c5124e48edf23b722
Robin Lee [Fri, 1 Apr 2016 10:50:49 +0000 (11:50 +0100)]
Have modifyIpRule take an explicit action
Instead of inferring from the priority what the action should be.
Bug:
26694104
Change-Id: I7d9752e86fa1a4564c622152a5be6ce2c1eda150
Robin Lee [Wed, 30 Mar 2016 17:33:07 +0000 (18:33 +0100)]
Move UidRange aidl to create a native cpp version
Moved from:
//frameworks/base/core/java/android/net/
To:
//system/netd/binder
Since frameworks/base depends on netd but not vice versa, it is cleaner
to keep the internal aidl in the same place as the native implementation
in netd.
Bug:
26694104
Change-Id: If21a72978ad5b93f0eed04c75143b55157c1a014
Lorenzo Colitti [Tue, 12 Apr 2016 14:28:50 +0000 (23:28 +0900)]
Netd metrics logging for DNS queries
This CL defines a new IDnsEventListener interface and instruments
DnsProxyListener to send log events to it after every DNS query.
Bug:
28204408
Change-Id: I7ef09d8fac2a583fb3dc8e392c4fff5649258b28
Lorenzo Colitti [Fri, 15 Apr 2016 01:22:37 +0000 (10:22 +0900)]
Move the Stopwatch class to NetdConstants.
Also implement TimedOperation by subclassing Stopwatch, since
it essentially does the same thing.
Change-Id: I68febcf1caa8a00b548790f9e3ccc10836877639
TreeHugger Robot [Thu, 14 Apr 2016 09:55:18 +0000 (09:55 +0000)]
Merge "Kill sockets when a VPN comes up." into nyc-dev
Lorenzo Colitti [Wed, 13 Apr 2016 15:56:01 +0000 (00:56 +0900)]
Kill sockets when a VPN comes up.
1. Change the SockDiag callback function to be a filter that
returns a bool instead of a function that optionally kills a
socket. All existing callbacks basically only existed to kill
sockets under certain conditions, and making them return a
boolean allows reusing the same callback function signature
to filter sockets as well.
2. Add a new SockDiag method to kill sockets based on a UidRanges
object (which contains a number of UID ranges) and a list of
users to skip.
3. Add a new UIDRANGE mode to SockDiagTest to test the above.
4. When UID ranges are added or removed from the VPN, kill
sockets in those UID ranges unless the socket UIDs are in
mProtectableUsers and thus their creator might have set the
protect bit on their mark. Short of actually being
able to see the socket mark on each socket and basing our
decision on that, this is the best we can do.
Bug:
26976388
Change-Id: I53a30df3feb63254a6451a29fa6041c9b679f9bb
Pierre Imai [Tue, 12 Apr 2016 02:35:47 +0000 (02:35 +0000)]
Merge "Fix netd_test by removing flush cache call." into nyc-dev
Jon Larimer [Mon, 11 Apr 2016 16:43:41 +0000 (16:43 +0000)]
Merge "Workaround ASan false positive in RouteController." into nyc-dev
Pierre Imai [Fri, 8 Apr 2016 04:15:27 +0000 (13:15 +0900)]
Fix netd_test by removing flush cache call.
Change-Id: Iba3ff9da55cbc709d12b12b9c65dbc565bbd2828
Lorenzo Colitti [Fri, 8 Apr 2016 04:33:38 +0000 (13:33 +0900)]
Deduplicate test targets.
netd_integration_test already runs all the tests in netd_test.
Change-Id: I44c2ffaecded071a54af1c54c823856ffc6eb0cf
Evgenii Stepanov [Fri, 12 Feb 2016 00:55:56 +0000 (16:55 -0800)]
Workaround ASan false positive in RouteController.
Bug:
27037723
Change-Id: I40e7f0d07652aeb6484de5f963a7698b6805d582
(cherry picked from commit
dfde1d6c6c397e437adf937a1718784d9cb2c0cf)
Erik Kline [Wed, 6 Apr 2016 04:07:15 +0000 (04:07 +0000)]
Merge "Remove "resolver flushnet <netid>" command." into nyc-dev
Erik Kline [Wed, 6 Apr 2016 02:46:32 +0000 (11:46 +0900)]
Remove "resolver flushnet <netid>" command.
Change-Id: I117adc3c7e240597e7fd91c709898bbbbe988261
Pierre Imai [Wed, 9 Mar 2016 09:09:25 +0000 (18:09 +0900)]
DO NOT MERGE: Let netd to use the new set_nameservers_for_net call.
Also add more test for netd's resolver.
(cherry picked from commit
12f6baf16328cdeea8f079616c2c44ac28f82496)
Change-Id: I446f11b3462522ec3a18c2a3ec9401ad6cf77e8b
Erik Kline [Thu, 31 Mar 2016 05:57:24 +0000 (05:57 +0000)]
Merge "Switch from android::netd::List to std::list" into nyc-dev
Erik Kline [Thu, 31 Mar 2016 02:39:53 +0000 (11:39 +0900)]
Switch from android::netd::List to std::list
Change-Id: I3e6560bbc46fd551d3501227250536cabeff4f71
Philip P. Moltmann [Wed, 16 Mar 2016 16:43:26 +0000 (09:43 -0700)]
Add mDNS TXT records to the resolve-call result.
I added binary value support. This changes the format of the
communication between the android framework and netd.
Bug:
27696905
Change-Id: I85122062d63f1047c618be0b16e6e95621790fd6
Lorenzo Colitti [Mon, 28 Mar 2016 15:53:45 +0000 (00:53 +0900)]
Use iptables-restore in StrictController startup.
Bug:
21725996
Change-Id: I2c049a934189f3c87ee15f052abc07d35814f0c9
Lorenzo Colitti [Sun, 27 Mar 2016 17:34:54 +0000 (02:34 +0900)]
Add a test for StrictController.
Bug:
21725996
Bug:
25691379
Change-Id: I24b838161eaf98dede2ae897157ba42414fc926f
Lorenzo Colitti [Sun, 27 Mar 2016 17:30:27 +0000 (02:30 +0900)]
Move iptables test code to a new IptablesBaseTest class.
Bug:
25691379
Bug:
21725996
Change-Id: Ia0598e60ad24714d53470e05849929831ba9dbf6
Lorenzo Colitti [Sun, 27 Mar 2016 08:46:30 +0000 (17:46 +0900)]
Use iptables-restore in BandwidthController startup.
This saves approximately 800ms on boot.
From the perspective of the rules, this change is a no-op. As the
unit test shows, the commands are the same, though some are in a
slightly different order because iptables-restore requires that
COMMIT be called between different tables (e.g., filter and
mangle).
For simplicity, enableBandwidthControl runs two iptables-restore
commands instead of one. This is not semantically different from
the previous code because the previous code just ran iptables
commands one by one, which provides no atomicity. Running two
commands is a bit slower than running one, but it's still much
faster than using iptables.
Using iptables-restore allows us to do things like ":<chain> -",
which both creates the chain (if it does not already exist) and
flushes it. This allows us to remove IPT_CLEANUP_COMMANDS and
IPT_SETUP_COMMANDS. Those two sets of commands, which basically
just did "-X bw_<foo>" and "-N bw_<foo>" were only necessary
because the preceding "-F bw_<foo>" command would not create
bw_<foo> if it did not already exist (e.g. in setupIptablesHooks,
which runs on netd startup).
Bug:
21725996
Change-Id: I6656aed4287dfcb2311c94800f430c143fb0b1a5
Lorenzo Colitti [Sat, 26 Mar 2016 13:42:07 +0000 (22:42 +0900)]
Add more test coverage for BandwidthController.
Bug:
25691379
Bug:
21725996
Change-Id: I196f568221b3bad98ba2d60e019c2b24c59a9cbc
Lorenzo Colitti [Fri, 25 Mar 2016 04:38:19 +0000 (13:38 +0900)]
Attempt to make data saver mode work for real.
The data saver refactoring change was incorrect in >= two ways:
1. It relied on the bw_costly_shared chain, which is currently
unused. NetworkManagementService just has a "TODO: support
quota shared across interfaces" comment about it. What
actually happens when setting quota is that each costly
interface chain (e.g., bw_costly_rmnet_data0) directly hooks
in the bw_penalty box chain.
2. Implementing app whitelisting using "RETURN" inside
bw_happy_box was pointless because if data saver was enabled,
there was a REJECT at the end of the bw_costly_shared chain
that it was returning to.
Instead, go back to the previous approach which hooked
bw_happy_box at the end of bw_penalty_box. Also, add an
additional bw_data_saver rule at the end of bw_happy_box.
bw_data_saver only contains one rule: RETURN if data saver is
enabled or REJECT if data saver is disabled.
That way:
1. If the app is blacklisted, bw_penalty_box REJECTs. If not:
2. If the app is whitelisted (system apps are always whitelisted)
bw_happy_box RETURNs to bw_costly_rmnet_data0, skipping
bw_data_saver.
3. If an app is neither blacklisted nor whitelisted, bw_happy_box
jumps to bw_data_saver. If data saver is enabled, it REJECTs
the packet, and if not, it RETURNs to bw_costly_rmnet_data0.
4. When we RETURN to bw_costly_rmnet_data0, either because the
app is whitelisted, or because data saver is off,
bw_costly_rmnet_data0 applies mobile data usage limits,
and then RETURNs to bw_OUTPUT, which calls xt_qtaguid, etc.
Bug:
26685616
Bug:
27506285
Change-Id: If15397afde6862d95827a1fdd30f60efd7fab66a
Lorenzo Colitti [Thu, 24 Mar 2016 07:47:12 +0000 (16:47 +0900)]
Support destroying sockets for UIDs.
Bug:
27824851
Change-Id: Iab5ebfd1c3d463d60d3dbd3a271737c8bc824298
Lorenzo Colitti [Thu, 24 Mar 2016 08:19:28 +0000 (17:19 +0900)]
Refactor SockDiagTest in preparation for per-UID SOCK_DESTROY.
Bug:
27824851
Change-Id: I98fa7aefdd9d0acf0a352970e3ba236227182da6
Lorenzo Colitti [Tue, 22 Mar 2016 03:36:29 +0000 (12:36 +0900)]
Add a binder RPC to enable/disable data saver.
Bug:
26685616
Bug:
27506285
Change-Id: Id11ee717cfc1c79070b6bbec397986c25947646c
Lorenzo Colitti [Tue, 22 Mar 2016 05:33:50 +0000 (05:33 +0000)]
Merge changes I149ccda5,I4457abd4,I67bff7c3,Ie15b0775,I8dd9fc60 into nyc-dev
* changes:
Stop using SIOCKILLADDR in netd.
Add a rudimentary unit test for BandwidthController.
Slightly restructure the data saver iptables rules.
Remove the ability to enable/disable the happy box.
Don't keep naughty/nice app state in BandwidthController.
Lorenzo Colitti [Tue, 22 Mar 2016 01:14:03 +0000 (10:14 +0900)]
Stop using SIOCKILLADDR in netd.
SOCK_DESTROY is now supported in all N device kernels.
Bug:
26976388
Change-Id: I149ccda56edacac28602daddb01b5fd0222d5fb0
Lorenzo Colitti [Fri, 18 Mar 2016 08:52:25 +0000 (17:52 +0900)]
Add a rudimentary unit test for BandwidthController.
Bug:
26685616
Bug:
27506285
Change-Id: I4457abd43697a0425f167b81c1432d743800abb8
Lorenzo Colitti [Fri, 18 Mar 2016 03:36:03 +0000 (12:36 +0900)]
Slightly restructure the data saver iptables rules.
1. Make bw_costly_shared jump to bw_happy_box after
bw_penalty_box. This allows the framework to manipulate
whitelists and blacklists independently.
2. Make bw_happy box always whitelist system apps. Because
bw_penalty_box is consulted before bw_happy_box, the
framework can always blacklist certain system apps (e.g.,
the media server) by putting them in the blacklist.
3. Add a method to add/remove a reject at the end of
bw_costly_shared. This will allow the framework to
enable/disable data saver by changing only one rule.
Bug:
26685616
Bug:
27506285
Change-Id: I67bff7c3c9ff5eb3f84fb84550cdf49f153e1b68
Erik Kline [Tue, 15 Mar 2016 07:33:48 +0000 (16:33 +0900)]
Add initial dump() method to NetdNativeService
This is called by "dumpsys netd".
Bug:
27239233
Change-Id: I27fb308f8067243ff241a6f8fd6a83f406087d2a
Dmitry Shmidt [Mon, 21 Mar 2016 21:02:54 +0000 (14:02 -0700)]
netd: softap: Ignore fwreload command if FW path is not defined
Some wlan solutions can not switch or do not need to switch FW.
In this case we don't want the function to fail and to prevent
Wifi to start in settings.
Bug:
27774657
Change-Id: I11f3cf709db6f17fc558454aa894e4a2211a9312
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Lorenzo Colitti [Fri, 18 Mar 2016 03:05:19 +0000 (12:05 +0900)]
Remove the ability to enable/disable the happy box.
This code is unused, and the plan is to have the happy box
enabled at all times.
Bug:
26685616
Bug:
27506285
Change-Id: Ie15b0775d535df7ca94547a7d8b8a5ed536e6dbd
Lorenzo Colitti [Fri, 18 Mar 2016 02:55:56 +0000 (11:55 +0900)]
Don't keep naughty/nice app state in BandwidthController.
Copies of this state are already kept in NetworkManagementService,
NetworkPolicyManagerService, and iptables rules. A third copy of
this state is not necessary.
Bug:
26685616
Bug:
27506285
Change-Id: I8dd9fc60a28804ec95660092b13a2895f7480f56
Lorenzo Colitti [Thu, 17 Mar 2016 04:23:28 +0000 (13:23 +0900)]
Start NetdNativeService before CommandListener.
Starting CommandListener tells NetworkManagementService that netd
is ready to accept commands. Ensure that the binder service is
started (i.e., we have called startThreadPool) before we do this.
Bug:
27239233
Change-Id: Ica89e72f51eb4752cb5cea2e4096c6a9dc5776d7
Felipe Leme [Mon, 7 Mar 2016 17:25:50 +0000 (09:25 -0800)]
Whitelist system apps when using bw_happy_box.
BUG:
27506285
BUG:
26685616
Change-Id: I8352ebbab1778c85e0a1da79a0acede5aea144a1
Pierre Imai [Fri, 11 Mar 2016 08:54:48 +0000 (17:54 +0900)]
Fix netd tests for use with APCT
Change-Id: Ica37a812c37036ffecd45b8f078d8ed9928d01fc
Erik Kline [Wed, 9 Mar 2016 05:56:00 +0000 (14:56 +0900)]
More correctly set app_mark in getNetworkContext.
Specifically: set explicitlySelected, protectedFromVpn and permissions.
Bug:
26256264
Change-Id: I1ebd2c1878fb7166ac63c061c8731e66b0050a30
Lorenzo Colitti [Wed, 2 Mar 2016 13:30:41 +0000 (13:30 +0000)]
Merge changes I2dc1a074,Ic83d8160,I246696c4 into nyc-dev
* changes:
Move SockDiagTest into system/netd/server.
Add an RPC to replace a UID firewall rule.
Allow finer-grained locking, and use it in FirewallCmd.
Lorenzo Colitti [Wed, 2 Mar 2016 05:09:38 +0000 (14:09 +0900)]
Move SockDiagTest into system/netd/server.
My recollection is that we decided to put unit tests next to
the corresponding code and integration tests into tests/.
Change-Id: I2dc1a074ba8d323253d9be3b2052d6b287bacc15
Lorenzo Colitti [Fri, 26 Feb 2016 02:38:47 +0000 (11:38 +0900)]
Add an RPC to replace a UID firewall rule.
Also add a binder_test that exercises binder RPCs to the real
netd service running on the device
Bug:
21725996
Bug:
27239233
Change-Id: Ic83d81605021a0578d6cd32f889290be61d76125
Erik Kline [Wed, 2 Mar 2016 04:52:36 +0000 (04:52 +0000)]
Remove unused costName variable
am:
87732125ef
* commit '
87732125ef05808bf958530c8319026e7a1efbce':
Remove unused costName variable
Erik Kline [Wed, 2 Mar 2016 04:18:06 +0000 (13:18 +0900)]
Remove unused costName variable
Bug:
27432583
Change-Id: Ica6f8714eb6c40a4b6a94ac5e40144d0e781155e
Felipe Leme [Tue, 1 Mar 2016 01:31:44 +0000 (01:31 +0000)]
Merge "Created a firewall chain for power save mode." into nyc-dev
Lorenzo Colitti [Fri, 26 Feb 2016 02:30:59 +0000 (11:30 +0900)]
Allow finer-grained locking, and use it in FirewallCmd.
FirewallController is stateless and FirewallCmd does not access
any other controllers, so it is safe not to take the big netd
lock.
Bug:
27239233
Change-Id: I246696c4b17fa005c7d6b38ecd627747aa608831
Lorenzo Colitti [Tue, 23 Feb 2016 07:59:21 +0000 (16:59 +0900)]
Don't use a manually-sized buffer for the PID.
Change-Id: Ibdda590b828c61caa488e959f3e596dc981a2c65
Pierre Imai [Thu, 25 Feb 2016 07:34:29 +0000 (16:34 +0900)]
Minor improvements for netd_test
Change-Id: Icd89045c7099949ea66bd88b2ce5551301366640
Pierre Imai [Wed, 24 Feb 2016 09:00:03 +0000 (18:00 +0900)]
Wrap netd's controller to make them usable from other classes
Change-Id: Icb76b43e89c5a9e5806b95002d3653dd99912494
Lorenzo Colitti [Tue, 23 Feb 2016 13:25:11 +0000 (22:25 +0900)]
Rename the netd service from "android.net.INetd" to "netd".
Bug:
27239233
Change-Id: I34a5554604e6d8b8a50838c6911c28503cbf4540
Lorenzo Colitti [Tue, 2 Feb 2016 08:19:04 +0000 (17:19 +0900)]
Initial netd binder interface.
In this change:
1. AIDL files for a new, android.net.INetd service, and
corresponding implementation using generated code. For now the
interface is just a prototype: it only has one trivial method.
2. Permission checking code to check for CONNECTIVITY_INTERNAL.
3. Add a Big Netd Lock and provide a wrapper that makes it easy
to ensure that it is taken by every CommandListener command.
Bug:
27239233
Change-Id: I448d0ac233edd0e351a7fe7f13901fb6871683a2
Pierre Imai [Thu, 18 Feb 2016 04:13:12 +0000 (13:13 +0900)]
Add test for DNS resolver code in netd.
Change-Id: I92466868ae32ee67fb5d17c7758a7841f614e827
Lorenzo Colitti [Wed, 17 Feb 2016 03:06:57 +0000 (03:06 +0000)]
Merge "Use SOCK_DESTROY in netd." into nyc-dev
Lorenzo Colitti [Sun, 14 Feb 2016 16:09:14 +0000 (01:09 +0900)]
Use SOCK_DESTROY in netd.
Bug:
26976388
Change-Id: I1965ece8ae65d78323b5a49eeebefe29677be63f
Erik Kline [Tue, 16 Feb 2016 23:56:16 +0000 (23:56 +0000)]
Switch to ifc_add_address() for setcfg
am:
397fbc056c
* commit '
397fbc056c1ae1478f0311feab3a8a44cc6a4685':
Switch to ifc_add_address() for setcfg
Erik Kline [Fri, 5 Feb 2016 09:06:15 +0000 (18:06 +0900)]
Switch to ifc_add_address() for setcfg
This avoids the issue where, for example, 10.0.0.1/8 is added first,
then 10.0.0.1/8 is deleted, and 10.0.0.1/24 is added. Netlink changes
observed at the wrong time would make it seem as though IPv4 had
been lost when in fact everthing was fine.
Bug:
26991160
(cherry picked from commit
397fbc056c1ae1478f0311feab3a8a44cc6a4685)
Change-Id: Ia5a5fcdd01e0950ac099c2054d74f0c52aa20b9c
Lorenzo Colitti [Thu, 4 Feb 2016 15:57:26 +0000 (00:57 +0900)]
Support killing sockets using SOCK_DESTROY.
This gives netd the ability to close sockets on a particular
source IP address using SOCK_DESTROY. It does not yet enable
this behaviour.
The microbenchmark is able to close 500 IPv6 sockets in ~30ms on
my angler. Specifically:
- Scanning 500 socketpairs: ~5ms
- Scanning 500 socketpairs and killing one half of each: ~30ms
- Scanning 500 socketpairs and killing both halves of each: ~40ms
This is about ~2.5x-3.5x slower than SIOCKILLADDR:
- For 500 sockets, it's 9.5ms vs. 22.9ms.
- For 4000 sockets, it's ~40ms vs ~135ms.
A large part of that is due to sending RST packets, which
SIOCKILLADDR does not do. If the kernel is modified so that
SOCK_DESTROY does not send RSTs, the time taken to kill 4000
sockets goes down to ~70ms
Batching the destroy operations does not help much. It saves
5-10%, but it complicates error handling.
Bug:
26976388
Change-Id: I2e1ac30af5dbcdb98dbb7c6e4d4d67c55b9fd00f
Felipe Leme [Thu, 11 Feb 2016 02:12:39 +0000 (18:12 -0800)]
Created a firewall chain for power save mode.
When power-save mode was first implemented, there were no firewall rules
on netd, so the solution was to make all network interface metered and
re-use the bw_penalty_box chain.
This change removes that workaround by creating a explicit fw_powersave
chain, whose behavior is similar to fw_dozable (in fact, it reuses some
of its code); such change not only makes network restrictions on
power-save mode simpler, but it also allows to optimze how the restrict
network rules are changed.
BUG:
27127112
Change-Id: I52aee49d80386594e3a52fea9667d580d2d944a1
Erik Kline [Fri, 5 Feb 2016 09:06:15 +0000 (18:06 +0900)]
Switch to ifc_add_address() for setcfg
This avoids the issue where, for example, 10.0.0.1/8 is added first,
then 10.0.0.1/8 is deleted, and 10.0.0.1/24 is added. Netlink changes
observed at the wrong time would make it seem as though IPv4 had
been lost when in fact everthing was fine.
Bug:
26991160
Change-Id: If0dad2993f818686ef8a99618e779813e9c7af90
Erik Kline [Tue, 5 Jan 2016 05:14:40 +0000 (05:14 +0000)]
Merge "Revert "Tell dnsmasq not to start wildcard sockets""
Erik Kline [Tue, 5 Jan 2016 03:52:07 +0000 (03:52 +0000)]
Revert "Tell dnsmasq not to start wildcard sockets"
This reverts commit
f1dfabed0a9b6ee9c37b64db3bbcb656281d4771.
The 3.4 kernel does not have SO_REUSEPORT functionality but the
headers #define it, so dnsmasq tries to use it and setsockopt
duly fails.
This is not a problem on 3.10 and later kernels, but reverting anyway.
Bug:
9580643
Bug:
26301652
Change-Id: I2322a80caa76ee4b7bb290f1665081b17d86fd43
Sreeram Ramachandran [Thu, 24 Dec 2015 02:15:25 +0000 (18:15 -0800)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f am:
3b61825abc am:
a8c4601961 am:
296f2ef5c1
am:
dccd7e51e3
* commit '
dccd7e51e369cea69d0200eda6e49615a6318d8d':
Erik Kline [Thu, 17 Dec 2015 06:48:18 +0000 (06:48 +0000)]
Merge "Tell dnsmasq not to start wildcard sockets"
Elliott Hughes [Sat, 5 Dec 2015 00:55:50 +0000 (00:55 +0000)]
Merge "Track rename from base/ to android-base/." am:
c4f60ec960
am:
569ec05819
* commit '
569ec05819d63f57e680a01f54119ea2df462192':
Track rename from base/ to android-base/.
Elliott Hughes [Fri, 4 Dec 2015 23:57:31 +0000 (23:57 +0000)]
Merge "Track rename from base/ to android-base/."
am:
c4f60ec960
* commit '
c4f60ec960885154863824dc2f9eb1e4b84f4b9d':
Track rename from base/ to android-base/.
Elliott Hughes [Fri, 4 Dec 2015 23:45:39 +0000 (23:45 +0000)]
Merge "Track rename from base/ to android-base/."
Elliott Hughes [Fri, 4 Dec 2015 23:45:10 +0000 (15:45 -0800)]
Track rename from base/ to android-base/.
Change-Id: Ice6d43c0f9b16b8fb441158a0f7344dfbf969dea
Lorenzo Colitti [Wed, 25 Nov 2015 13:13:57 +0000 (22:13 +0900)]
Support scoped addresses as tethered DNS servers.
Bug:
9580643
Change-Id: Id086ff9194097fc1e0ab8e2e58e6ff843303f051
Sreeram Ramachandran [Fri, 20 Nov 2015 04:28:36 +0000 (04:28 +0000)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f am:
3b61825abc am:
a8c4601961 am:
296f2ef5c1
am:
b338d7c705
* commit '
b338d7c705e81fefd8a2b8d2613ce05986c2809e':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Fri, 20 Nov 2015 04:21:09 +0000 (04:21 +0000)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f am:
3b61825abc am:
a8c4601961
am:
296f2ef5c1
* commit '
296f2ef5c1fc8b7d865cbad7c071d5d9dc7a4698':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Thu, 19 Nov 2015 16:39:59 +0000 (16:39 +0000)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f am:
3b61825abc am:
a8c4601961
am:
296f2ef5c1
* commit '
296f2ef5c1fc8b7d865cbad7c071d5d9dc7a4698':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Thu, 19 Nov 2015 16:19:47 +0000 (16:19 +0000)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f am:
3b61825abc
am:
a8c4601961
* commit '
a8c4601961ee82d9e5a1646cda5e6dec491b98f6':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Thu, 19 Nov 2015 16:14:41 +0000 (16:14 +0000)]
Don\'t use framework permission strings for netd permissions. am:
5c8c42e90f
am:
3b61825abc
* commit '
3b61825abc108135f992f7fe1ffbe8d99f5fd85d':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Thu, 19 Nov 2015 16:04:24 +0000 (16:04 +0000)]
Don\'t use framework permission strings for netd permissions.
am:
5c8c42e90f
* commit '
5c8c42e90f7c5ad609c477f54dc9a62ddea7875a':
Don't use framework permission strings for netd permissions.
Sreeram Ramachandran [Tue, 4 Nov 2014 18:18:25 +0000 (10:18 -0800)]
Don't use framework permission strings for netd permissions.
These framework permission strings were being used as arbitrary labels
that mapped to netd permissions that have completely different meaning.
This leads to confusion, so use different strings.
This is being cherry picked from lmp-mr1-dev to lmp-dev to fix failures
when creating restricted networks due to prior back-port
a120442.
Bug:
21900139
Bug:
18194858
Change-Id: Ib3ec377ab26ce904d3d4678f04edec6cb1260517
(cherry picked from commit
584dbee59ceb7750e22c48371342635aa6a98517)
Erik Kline [Fri, 13 Nov 2015 11:30:22 +0000 (20:30 +0900)]
Tell dnsmasq not to start wildcard sockets
Bug:
9580643
Change-Id: I8c95c15970d6ed72dc44cec42c4eb78e18ed46ba
Erik Kline [Fri, 13 Nov 2015 07:26:27 +0000 (16:26 +0900)]
Pass both IPv4 and IPv6 nameservers to dnsmasq
Additionally, store and return a list of strings for
DNS forwarders, since that's what is most useful. These
strings are guaranteed to be valid IP string literals by
virtue of validation on input.
Bug:
9580643
Change-Id: I4fbaf19835055b12e38d585c0bfba0d2b18b9717
Erik Kline [Thu, 12 Nov 2015 08:49:23 +0000 (17:49 +0900)]
Change dnsmasq input command argument separator
Heretofore netd issued commands to dnsmasq over a stdin channel
using ":" as an argument separator. This make it very complicated
to issue commands that involve IPv6 addresses.
This changes the separator from ":" to "|".
Additionally:
- Pass DHCP range string literals through to startTethering(),
still performing string literal to IPv4 address validation.
Bug:
9580643
Change-Id: I210daf311a4c3d84dae3ed054b92c9fa399a791f
Kenny Root [Thu, 5 Nov 2015 19:56:13 +0000 (19:56 +0000)]
Merge "system/netd: check return value of PKCS5_PBKDF2_HMAC_SHA1."
am:
b407c9b318
* commit '
b407c9b318b07c0f659444d0295380e7fd48ed77':
system/netd: check return value of PKCS5_PBKDF2_HMAC_SHA1.
Kenny Root [Thu, 5 Nov 2015 19:29:20 +0000 (19:29 +0000)]
Merge "system/netd: check return value of PKCS5_PBKDF2_HMAC_SHA1."
Adam Langley [Wed, 4 Nov 2015 22:35:25 +0000 (14:35 -0800)]
system/netd: check return value of PKCS5_PBKDF2_HMAC_SHA1.
The function PKCS5_PBKDF2_HMAC_SHA1 can fail for a number of reasons and
thus its return value should be checked and handled.
Change-Id: I63bd1378e78926372309072c3fa821666cac1b01
Gaurav Shah [Mon, 2 Nov 2015 06:02:30 +0000 (06:02 +0000)]
Merge "netd: Add NOTICE and MODULE_LICENSE_* files" am:
04c820c5f1
am:
8a55a1b087
* commit '
8a55a1b087de5882808495e1a85e5ca52ef470a1':
netd: Add NOTICE and MODULE_LICENSE_* files
Gaurav Shah [Mon, 2 Nov 2015 02:35:03 +0000 (02:35 +0000)]
Merge "netd: Add NOTICE and MODULE_LICENSE_* files"
am:
04c820c5f1
* commit '
04c820c5f1591e1afd287519efd1a4df162d2551':
netd: Add NOTICE and MODULE_LICENSE_* files
Gaurav Shah [Mon, 2 Nov 2015 02:33:15 +0000 (02:33 +0000)]
Merge "netd: Add NOTICE and MODULE_LICENSE_* files"
Gaurav Shah [Fri, 2 Oct 2015 22:47:47 +0000 (15:47 -0700)]
netd: Add NOTICE and MODULE_LICENSE_* files
BUG:
24605215
Change-Id: Ice2df1dcaca7af089e6228c4bbf5b5b285b51622
Erik Kline [Fri, 2 Oct 2015 08:52:37 +0000 (17:52 +0900)]
Always add costly interfaces to the bw_FORWARD chain
This adds a jump to bw_costly_<ifname> for traffic forwarded out
interface <ifname> to the bw_FORWARD chain, regardless of tethering
state (as having it safely in place is harmless).
Bug:
24497044
Change-Id: I165724c319051ddf29a2833912eb286368b0570d
Lorenzo Colitti [Thu, 3 Sep 2015 17:35:36 +0000 (17:35 +0000)]
am
4485c500: am
c8683d7e: Don\'t break IPv6 connectivity when in doze mode.
* commit '
4485c500f838726ded5a910364469eace225db28':
Don't break IPv6 connectivity when in doze mode.
Lorenzo Colitti [Thu, 3 Sep 2015 06:21:38 +0000 (06:21 +0000)]
am
c8683d7e: Don\'t break IPv6 connectivity when in doze mode.
* commit '
c8683d7eb9bb95de2090431e8daaa45d92b45e38':
Don't break IPv6 connectivity when in doze mode.
Lorenzo Colitti [Tue, 1 Sep 2015 07:53:35 +0000 (16:53 +0900)]
Don't break IPv6 connectivity when in doze mode.
Working IPv6 connectivity relies on the kernel being able to
receive certain ICMPv6 packets (router advertisements, neighbour
solicitations, neighbour advertisements) at all times. Allow
these packets when in doze mode.
This is not necessary for IPv4 because in IPv4 these functions
use ARP, which is invisible to iptables.
Bug:
23158230
Change-Id: I29ed77561db9688486cf58cd14ac3bce7fce4b40
Tom Cherry [Thu, 27 Aug 2015 20:21:55 +0000 (20:21 +0000)]
am
88d94fd9: am
f228899a: (-s ours) am
8246d45e: Merge "bundle init.rc contents with its service"
* commit '
88d94fd9f69942b0a0789af26d32d4046c715855':
Yusuke Sato [Thu, 27 Aug 2015 20:21:54 +0000 (20:21 +0000)]
am
916188db: am
56cc45f1: (-s ours) am
f2fed764: Make iptables -L and -S calls wait for xtables lock
* commit '
916188db012f458aeab7c6857db2dc1618a98a26':
Yusuke Sato [Thu, 27 Aug 2015 20:21:54 +0000 (20:21 +0000)]
am
d9c0c36a: am
c132be49: (-s ours) am
93e6f6a7: Merge "Make iptables -L and -S calls wait for xtables lock"
* commit '
d9c0c36ad3141d23a8621ce0325bf727c035b5cf':
Tom Cherry [Thu, 27 Aug 2015 11:28:08 +0000 (11:28 +0000)]
am
f228899a: (-s ours) am
8246d45e: Merge "bundle init.rc contents with its service"
* commit '
f228899aef79c5bad319aa88e1861da225b18fc0':