OSDN Git Service
Elliott Hughes [Wed, 4 Feb 2015 22:43:44 +0000 (22:43 +0000)]
Merge "Switch writing to <utils/file.h>."
Elliott Hughes [Wed, 4 Feb 2015 21:25:14 +0000 (13:25 -0800)]
Switch writing to <utils/file.h>.
Change-Id: Idb2de24414f4dd8e926e625b62e4d12152dc4527
Elliott Hughes [Tue, 3 Feb 2015 23:33:40 +0000 (23:33 +0000)]
Merge "Use StringPrintf."
Elliott Hughes [Tue, 3 Feb 2015 23:31:07 +0000 (15:31 -0800)]
Use StringPrintf.
This doesn't replace every asprintf in netd, but it replaces the ones in code
I touched.
Change-Id: I2de5c7772523372bb36145e66e885aa8132ad58e
Elliott Hughes [Tue, 3 Feb 2015 22:12:23 +0000 (22:12 +0000)]
Merge "Switch netd over to <utils/file.h>."
Elliott Hughes [Tue, 3 Feb 2015 02:08:59 +0000 (18:08 -0800)]
Switch netd over to <utils/file.h>.
Change-Id: Id79961cc4feee1c307dad06d64e3f4ffe060c4da
Nick Kralevich [Sat, 31 Jan 2015 22:16:14 +0000 (22:16 +0000)]
Merge "Avoid leaking file descriptors"
Nick Kralevich [Sat, 31 Jan 2015 21:54:00 +0000 (13:54 -0800)]
Avoid leaking file descriptors
Add O_CLOEXEC on open() calls, and SOCK_CLOEXEC on socket calls.
This avoids leaking file descriptors across execs.
Addresses the following SELinux denial:
audit(
1422740213.283:8): avc: denied { read write } for pid=2597 comm="clatd" path="socket:[6709]" dev="sockfs" ino=6709 scontext=u:r:clatd:s0 tcontext=u:r:netd:s0 tclass=netlink_socket
and allows the removal of some other SELinux rules which were
inappropriately added because of leaking file descriptors.
Change-Id: I9c180488ea1969d610e488f967a7276a672bb477
Lorenzo Colitti [Thu, 29 Jan 2015 08:44:09 +0000 (08:44 +0000)]
Merge "Don't fail when trying to add routes that already exist."
Sreeram Ramachandran [Thu, 30 Oct 2014 17:01:07 +0000 (10:01 -0700)]
Don't fail when trying to add routes that already exist.
Previously, we suppressed failures for the special case of
requestRouteToHost() being called multiple times. Turns out that other
parts of the system also try to add duplicate routes, so just suppress
EEXIST errors in general (as far as adding routes is concerned). For
example, this happens when the WiFi P2P DHCP client renews its lease
and blindly requests to add a route that it had already added before.
(cherry picked from commit
64166e7666e3cc7f4b9c715f2b4e19d28ae44c5a)
Bug:
17205769
Change-Id: I11d50052f616cb48a912d647b8024ccef01b736d
Elliott Hughes [Wed, 28 Jan 2015 19:27:52 +0000 (19:27 +0000)]
Merge "Add missing <string.h> include."
Elliott Hughes [Wed, 28 Jan 2015 19:25:33 +0000 (19:25 +0000)]
Merge "Add missing <malloc.h> include."
Elliott Hughes [Wed, 28 Jan 2015 19:22:38 +0000 (11:22 -0800)]
Add missing <malloc.h> include.
Change-Id: I0259da35f2dc8ff87c928eb5bd378f39cbfc9f9c
Elliott Hughes [Wed, 28 Jan 2015 19:22:06 +0000 (11:22 -0800)]
Add missing <string.h> include.
Change-Id: I14ea45e98b8271d6b53ac86e92ad3b5c7dac8f75
Jeff Sharkey [Fri, 23 Jan 2015 19:26:42 +0000 (19:26 +0000)]
Merge "Config NFLOG target before listening."
Jeff Sharkey [Fri, 23 Jan 2015 19:09:49 +0000 (12:09 -0700)]
Config NFLOG target before listening.
Otherwise the listener thread races with us and can eat the
responses to the config messages.
Bug:
19066761
Change-Id: I484fd79414731ab74ebc3ea50446e374a50eac77
Jeff Sharkey [Fri, 16 Jan 2015 01:11:18 +0000 (01:11 +0000)]
Merge "Offer to detect non-SSL/TLS network traffic."
Jeff Sharkey [Tue, 28 Oct 2014 23:50:07 +0000 (16:50 -0700)]
Offer to detect non-SSL/TLS network traffic.
Introduces new module that provides network-related features for
the StrictMode developer API. The first feature offers to detect
sockets sending data not wrapped inside a layer of SSL/TLS
encryption.
This carefully only adds overhead to UIDs that have requested
detection, and it uses CONNMARK to quickly accept/reject packets
from streams that have already been inspected. Detection is done
by looking for a well-known TLS handshake header; it's not future
proof, but it's a good start. Handles both IPv4 and IPv6.
When requested, we also log the triggering packet through NFLOG and
back up to the framework to aid investigation.
Bug:
18335678
Change-Id: Ie8fab785139dfb55a71b6dc7a0f3c75a8408224b
Dan Albert [Tue, 6 Jan 2015 18:02:09 +0000 (18:02 +0000)]
Merge "Fix missing errno.h includes after libc cleanup."
Dan Albert [Tue, 6 Jan 2015 17:36:17 +0000 (09:36 -0800)]
Fix missing errno.h includes after libc cleanup.
These issues hadn't been found yet because a libc++ header was
unconditionally pulling in errno.h. I've fixed the libc++ header now.
Change-Id: Ib096634cdd231fc75bf7548e4b99babc7442dc53
Elliott Hughes [Mon, 29 Dec 2014 19:55:14 +0000 (19:55 +0000)]
Merge "Include what you use: <errno.h>."
Elliott Hughes [Mon, 29 Dec 2014 19:48:03 +0000 (11:48 -0800)]
Include what you use: <errno.h>.
Change-Id: Ic970f6bf4558e8e0ef3d7e480c2532c102abfd7c
Elliott Hughes [Mon, 24 Nov 2014 18:58:35 +0000 (18:58 +0000)]
Merge "Plug some leaks"
Jesper Hansson [Fri, 27 Apr 2012 11:54:27 +0000 (13:54 +0200)]
Plug some leaks
Change-Id: I4268ea32cfb0ebd6ce5711e30865750dffa94e92
Elliott Hughes [Thu, 13 Nov 2014 17:56:05 +0000 (17:56 +0000)]
Merge "Don't send structs containing pointers over sockets."
Elliott Hughes [Thu, 13 Nov 2014 01:01:46 +0000 (17:01 -0800)]
Don't send structs containing pointers over sockets.
Fixes x86-64 netd.
Change-Id: Iee5ef802ebbf2e000b2593643de4eec46f296c04
Robert Greenwalt [Thu, 9 Oct 2014 22:07:03 +0000 (22:07 +0000)]
am
388cd671: (-s ours) Merge "Fix MDnsSdListener::Monitor::Monitor()"
* commit '
388cd671ff5237aabcd728794af49d33e18fda8b':
Fix MDnsSdListener::Monitor::Monitor()
Robert Greenwalt [Thu, 9 Oct 2014 19:13:59 +0000 (19:13 +0000)]
Merge "Fix MDnsSdListener::Monitor::Monitor()"
Kévin Petit [Thu, 9 Oct 2014 14:20:56 +0000 (15:20 +0100)]
Fix MDnsSdListener::Monitor::Monitor()
* Initialisation of mLiveCount
The value of mLiveCount was being used without being initialised, and
this was causing the CTS class android.net.wifi.cts.NsdManagerTest
method testAndroidTestCaseSetupProperly test to fail when the calls
to calloc in the MDnsSdListener::Monitor::rescan() method returned a
value of NULL due to the large value of mPollSize, which had been set
to "mLiveCount + 5". The mPollFds and mPollRefs pointers were then used
without checking that they were not NULL, resulting in a segmentation
violation when the NULL pointer value was dereferenced. Initialising
the value of mLiveCount to zero in MDnsSdListener::Monitor::Monitor()
fixes this problem, and the test then passes.
* Also initilize mPollFds, mPollRefs and mPollSize
Change-Id: I1a8f7ee0f3ed38f46854e9ba6d5c432c9412b7c3
Signed-off-by: Marcus Oakland <marcus.oakland@arm.com>
Signed-off-by: Kévin Petit <kevin.petit@arm.com>
Lorenzo Colitti [Fri, 3 Oct 2014 02:20:26 +0000 (02:20 +0000)]
am
a1067c8d: Improve error return values on network selection.
* commit '
a1067c8d2b2165f1058a3a8216bed4efacfa1c80':
Improve error return values on network selection.
Lorenzo Colitti [Fri, 3 Oct 2014 01:39:21 +0000 (01:39 +0000)]
am
e8164ddc: Fix MSS clamping.
* commit '
e8164ddc8204b626c1144a0a504754bf6622c6fd':
Fix MSS clamping.
Lorenzo Colitti [Thu, 2 Oct 2014 13:47:41 +0000 (22:47 +0900)]
Improve error return values on network selection.
It's very confusing to see EPERM when opening or connecting a
socket when the problem is not security-related. In the (common)
case where an app cannot select a network because it does not
exist, return ENONET ("Machine is not on network") instead.
Also, return EREMOTEIO for when we can't figure out who the user
is, and use EPERM for VPN denials and EACCES for permission
bits.
Bug:
17702933
Change-Id: Ia680c485e0ea1efad1ad374231d994e9bfd4cd5a
Lorenzo Colitti [Thu, 2 Oct 2014 11:46:23 +0000 (20:46 +0900)]
Fix MSS clamping.
http://ag/553410 added an iptables chain and rule to do MSS
clamping for tethered clients, but did not add the chain to any
other chains, so the rule had no effect.
Fix this by adding the chain to the proper forwarding chains.
Also rename some of the new variables and constants so they are
more consistent with the previous code.
Bug:
17552732
Bug:
17727533
Change-Id: I9fcae31de5c0283d7d9f1dac989de84f77c5e53c
Gordon Gao [Fri, 26 Sep 2014 23:44:04 +0000 (23:44 +0000)]
am
6b6f22fa: Enable tcp mss clamp for Tethering
* commit '
6b6f22fac4c33fcd349aaf6970bbdc191db752a3':
Enable tcp mss clamp for Tethering
Gordon Gao [Thu, 18 Sep 2014 18:50:09 +0000 (11:50 -0700)]
Enable tcp mss clamp for Tethering
With this change, IPv4 tethering clients (such as PC) with default
MTU size 1500 will be configured again in the phone to use MTU
matching the carrier network, then no IP fragemention in the phone
and have higher data throughput for tethering.
bug:
17552732
Change-Id: Ia306b1b8454da1b0e2d9c320e770aeff172d5fc4
Lorenzo Colitti [Mon, 22 Sep 2014 17:25:28 +0000 (17:25 +0000)]
am
4c95a125: Support manipulating throw routes.
* commit '
4c95a125e0930c112555437589f7620575482095':
Support manipulating throw routes.
Lorenzo Colitti [Thu, 18 Sep 2014 07:01:50 +0000 (16:01 +0900)]
Support manipulating throw routes.
We already supported unreachable routes. Throw routes are
necessary so we can exempt the VPN endpoint from being routed
through the VPN in legacy VPN modes that do not pass traffic
through a tun or ppp interface but just directly appply IPsec
transformations to outgoing packets.
Bug:
17462989
Change-Id: I8635472ca3e96ec2866af2de48e6260ab2da13fb
Dan Albert [Fri, 12 Sep 2014 20:01:53 +0000 (20:01 +0000)]
am
100457df: (-s ours) Merge "Remove makefile cruft."
* commit '
100457df47b8a453eb94df3cf2e87f6248e783d1':
Remove makefile cruft.
Dan Albert [Fri, 12 Sep 2014 18:07:44 +0000 (18:07 +0000)]
Merge "Remove makefile cruft."
Dan Albert [Fri, 12 Sep 2014 17:47:14 +0000 (10:47 -0700)]
Remove makefile cruft.
Don't manually include stlport, and don't use private bionic headers.
Change-Id: Ibe91ed010b8558fba4ce08fdcf789cbed006f6ef
Sreeram Ramachandran [Wed, 10 Sep 2014 00:51:21 +0000 (00:51 +0000)]
am
6a834abb: Merge "Reset connections whenever an address goes away." into lmp-dev
* commit '
6a834abb5acca22e47b70ee88e55f394f909559b':
Reset connections whenever an address goes away.
Sreeram Ramachandran [Tue, 9 Sep 2014 23:24:52 +0000 (23:24 +0000)]
Merge "Reset connections whenever an address goes away." into lmp-dev
Sreeram Ramachandran [Mon, 8 Sep 2014 23:03:18 +0000 (16:03 -0700)]
Reset connections whenever an address goes away.
Bug:
15414453
Change-Id: Ibf1f052e12b88838a328148e25817a96f10d50f5
Sreeram Ramachandran [Mon, 8 Sep 2014 23:50:49 +0000 (23:50 +0000)]
am
bbdde990: Reserve NetIds 1..50 for OEM use.
* commit '
bbdde9909b7b4fd31c5857156ceb00049bf4992d':
Reserve NetIds 1..50 for OEM use.
Sreeram Ramachandran [Fri, 5 Sep 2014 23:05:03 +0000 (16:05 -0700)]
Reserve NetIds 1..50 for OEM use.
Also reserve 51..100 for our use.
Bug:
17303534
Change-Id: Id082368b493dc3c5b5c479e51d273458d80ec6aa
Dmitry Shmidt [Thu, 4 Sep 2014 17:49:28 +0000 (17:49 +0000)]
am
928294e4: Merge "softap: Add wowlan_triggers=any parameter" into lmp-dev
* commit '
928294e4e778338c2a120c96373a779de8027ec6':
softap: Add wowlan_triggers=any parameter
Dmitry Shmidt [Thu, 4 Sep 2014 17:23:26 +0000 (17:23 +0000)]
Merge "softap: Add wowlan_triggers=any parameter" into lmp-dev
Dmitry Shmidt [Wed, 3 Sep 2014 22:19:36 +0000 (15:19 -0700)]
softap: Add wowlan_triggers=any parameter
New kernels in wiphy_suspend() will call cfg80211_leave_all()
that will eventually end up in cfg80211_stop_ap() unless
wowlan_triggers were set.
Bug:
17269024
Change-Id: I609d78f5bb573b4c6a9dae25a3b2a345499f6853
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Lorenzo Colitti [Wed, 3 Sep 2014 05:49:15 +0000 (05:49 +0000)]
am
667c4771: Add a socket mark parameter to tethering DNS commands.
* commit '
667c477133318e4779819d34364194c8e5eaf19c':
Add a socket mark parameter to tethering DNS commands.
Lorenzo Colitti [Tue, 26 Aug 2014 21:13:07 +0000 (14:13 -0700)]
Add a socket mark parameter to tethering DNS commands.
This allows the framework to pass down to dnsmasq the socket mark
to use for DNS queries.
Bug:
16357676
Change-Id: I8933b6de198a92c2aaf0291931ace8966ddba275
Lorenzo Colitti [Fri, 15 Aug 2014 11:49:37 +0000 (11:49 +0000)]
am
99286fe1: Make destroying networks more robust.
* commit '
99286fe1ef6fc325c28dd10b651b5adedd549495':
Make destroying networks more robust.
Lorenzo Colitti [Tue, 12 Aug 2014 06:08:00 +0000 (15:08 +0900)]
Make destroying networks more robust.
1. Retry route flushes if they fail.
2. Make destroyNetwork ignore (but return) errors.
Bug:
16944962
Change-Id: I26301613437d7cc373ff64955fd44d716e9982b9
Paul Jensen [Thu, 7 Aug 2014 02:42:07 +0000 (02:42 +0000)]
am
6a46f338: Revert DNS cache flush command deletion from "Cleanup: Delete dead code."
* commit '
6a46f3384b3f48e6ef77a83a5e058a47a2939a0d':
Revert DNS cache flush command deletion from "Cleanup: Delete dead code."
Paul Jensen [Wed, 6 Aug 2014 18:42:27 +0000 (18:42 +0000)]
Revert DNS cache flush command deletion from "Cleanup: Delete dead code."
This reverts part of commit
1604e18615f824adb2d54c36320069ba6fcb4796.
The DNS cache flushing code needs to be called when routes change.
Change-Id: I20d39eabfa088deeeeeff0c3292b1910fd948b0d
bug:
16549455
Narayan Kamath [Mon, 4 Aug 2014 16:00:40 +0000 (16:00 +0000)]
am
10190d06: Merge "Fix initialization of Monitor fields." into lmp-dev
* commit '
10190d06d273577d85c42a947e4e0ab804411733':
Fix initialization of Monitor fields.
Robert Greenwalt [Mon, 4 Aug 2014 16:00:39 +0000 (16:00 +0000)]
am
47f8597b: Add logging of calloc failures.
* commit '
47f8597b42b849d22c6cc128f27bba4a7692d371':
Add logging of calloc failures.
Narayan Kamath [Mon, 4 Aug 2014 15:54:00 +0000 (15:54 +0000)]
Merge "Fix initialization of Monitor fields." into lmp-dev
Narayan Kamath [Mon, 4 Aug 2014 15:20:47 +0000 (16:20 +0100)]
Fix initialization of Monitor fields.
mLiveCount was never initialized. Also moves
initialization of mPollCount to the constructor, where
it belongs. Also, fields are now initialized in the order
in which they are declared.
bug:
16734745
Change-Id: I9cc668a6fc5649d3ea550bc3a47c0eef210cad07
Robert Greenwalt [Fri, 1 Aug 2014 23:19:02 +0000 (16:19 -0700)]
Add logging of calloc failures.
Re-adding after build-break and revert
bug:
16734745
Change-Id: I26f9ff8c43836fd35778db61915ce37fd2025ba7
Ben Murdoch [Sat, 2 Aug 2014 12:38:48 +0000 (12:38 +0000)]
am
515a5909: Merge "Revert "Add logging of calloc failures."" into lmp-dev
* commit '
515a59097e8b6d87023b824554e82b98aca8edf5':
Revert "Add logging of calloc failures."
Robert Greenwalt [Fri, 1 Aug 2014 23:52:51 +0000 (23:52 +0000)]
am
3bc81979: Merge "Add logging of calloc failures." into lmp-dev
* commit '
3bc819792bc617427512b0fe7b60c7ce2653094e':
Add logging of calloc failures.
Ben Murdoch [Sat, 2 Aug 2014 09:47:35 +0000 (09:47 +0000)]
Merge "Revert "Add logging of calloc failures."" into lmp-dev
Ben Murdoch [Sat, 2 Aug 2014 09:43:22 +0000 (09:43 +0000)]
Revert "Add logging of calloc failures."
This reverts commit
96dd5bfec1693fee29ed0c728cf6ab4f0f0ec6e9 as it breaks the
64b build.
Bug:
16734745
Change-Id: Icf83b35ca0f99c2b5d6d919cfc8c2b02ee980e0b
Robert Greenwalt [Fri, 1 Aug 2014 23:19:02 +0000 (16:19 -0700)]
Add logging of calloc failures.
bug:
16734745
Change-Id: I30437983e93fc2420e291e3d2e6ffbe4d8a47af4
Paul Jensen [Fri, 1 Aug 2014 15:47:49 +0000 (15:47 +0000)]
am
6d7e6235: Remove default routing rule & table before we forget table number.
* commit '
6d7e6235b560be2ead9889c4035184573ab1b70a':
Remove default routing rule & table before we forget table number.
Paul Jensen [Fri, 1 Aug 2014 14:54:03 +0000 (10:54 -0400)]
Remove default routing rule & table before we forget table number.
We clear the interface index cache when we remove an interface from a
network, so we must only do this after we remove the default rule so
we still know the table number (calculated from interface index).
bug:
16728065
Change-Id: I538673dcba49820a9e21f60407754fae30de02cf
Robert Greenwalt [Fri, 1 Aug 2014 23:46:24 +0000 (23:46 +0000)]
Merge "Add logging of calloc failures." into lmp-dev
Lorenzo Colitti [Thu, 31 Jul 2014 13:27:36 +0000 (13:27 +0000)]
am
738c93ee: Minor improvements to NetworkController error reporting.
* commit '
738c93ee075354ffafb3a8ceef76e9aa711f057b':
Minor improvements to NetworkController error reporting.
Lorenzo Colitti [Wed, 30 Jul 2014 08:46:08 +0000 (17:46 +0900)]
Minor improvements to NetworkController error reporting.
Currently, when trying to perform an operation on netId that
does not exist, we return EINVAL. This can be confusing
because lots of things can return EINVAL for many different
reasons.
Instead, change this to ENONET ("Machine is not on network"),
which was what Sreeram originally implemented before we changed
it to EINVAL. I also considered ENOENT ("No such file or
directory"), but on reflection that seems less appropriate, and
it's used by other things as well. ENONET appears to have no
uses in our tree. It is also clearly separate from the ESRCH we
return for nonexistent rules.
While I'm at it, also disambiguate some of the
if (foo || bar ) { return EFOO; } to return two different error
codes.
Bug:
16667349
Change-Id: Ief2d720a58679aa746f5ba273d545487d0825e52
Lorenzo Colitti [Tue, 29 Jul 2014 13:15:23 +0000 (13:15 +0000)]
am
db74dba7: Stop copying directly-connected routes to the main table, #2.
* commit '
db74dba7ccfe9e9504e0acd440a23fed96682842':
Stop copying directly-connected routes to the main table, #2.
Lorenzo Colitti [Tue, 29 Jul 2014 13:15:23 +0000 (13:15 +0000)]
am
a2c23052: Revert "Stop copying directly-connected routes to the main table."
* commit '
a2c230520be5fdafce8bbc0b6ee52262f981f75a':
Revert "Stop copying directly-connected routes to the main table."
Lorenzo Colitti [Tue, 29 Jul 2014 13:15:22 +0000 (13:15 +0000)]
am
2f5ea0e9: Stop copying directly-connected routes to the main table.
* commit '
2f5ea0e99e9a436cd43901b1772b77a410a62f8d':
Stop copying directly-connected routes to the main table.
Sreeram Ramachandran [Tue, 29 Jul 2014 13:15:21 +0000 (13:15 +0000)]
am
2bff72e0: Add "scope link" when adding routes without a nexthop.
* commit '
2bff72e0cf091f4d71af0c81cfc74e8ebd8c6644':
Add "scope link" when adding routes without a nexthop.
Lorenzo Colitti [Tue, 29 Jul 2014 09:26:21 +0000 (18:26 +0900)]
Stop copying directly-connected routes to the main table, #2.
For a long time we have thought that copying directly-connected
routes to the main table was necessary to add gatewayed routes
to other routing tables. However, this is not necessary when the
directly-connected routes are properly created with "scope link"
as we do in http://ag/513100 .
Delete the copying code, but don't delete the rule that looks up
the main table or the code that dumps it. The main table is used
for things like cell networking, because the RIL emulates cell
networks, which are actually point-to-point, as directly
connected broadcast subnets (e.g., a /30 or a /27) with a fake
default gateway. The directly-connected route that covers the
fake default gateway is implicitly created by adding the IP
address, but it's in the main table, so we can't add the default
route without looking up the main table.
Change-Id: I93bd4764ac75fdcc98fa4206c601524100d53fc3
Lorenzo Colitti [Tue, 29 Jul 2014 09:25:44 +0000 (09:25 +0000)]
Revert "Stop copying directly-connected routes to the main table."
This reverts commit
2f5ea0e99e9a436cd43901b1772b77a410a62f8d.
Change-Id: I1fe1df0249714cb650a34fae56476236ac0108e3
Lorenzo Colitti [Tue, 29 Jul 2014 06:46:56 +0000 (15:46 +0900)]
Stop copying directly-connected routes to the main table.
For a long time we have thought that copying directly-connected
routes to the main table was necessary to add gatewayed routes
to other routing tables. However, this is not necessary when the
directly-connected routes are properly created with "scope link"
as we do in http://ag/513100 .
Delete the copying code, but keep dumping the main table in
bugreports, so we can see if third-party code such as RIL
daemons is putting anything in it.
Change-Id: Iddd531daaf9881ffd82f0a4b4f6cc857ce8788fd
Sreeram Ramachandran [Fri, 18 Jul 2014 20:03:47 +0000 (13:03 -0700)]
Add "scope link" when adding routes without a nexthop.
This is consistent with what /sbin/ip does, and it makes
recursive lookups on secondary tables work even when the main
table is empty.
This was originally proposed by Sreeram as http://ag/506456 to
fix a VPN issue, but then abandoned because it did not fix that
particular problem.
Bug:
16628572
Change-Id: I85753389c683ae2127b21af722463a35a33b60eb
Sreeram Ramachandran [Mon, 28 Jul 2014 19:03:46 +0000 (19:03 +0000)]
am
060d855a: Merge "Prohibit address families by default unless a VPN explicitly allows them." into lmp-dev
* commit '
060d855a00cb94e8903fd1551c9bf040f42b57d1':
Prohibit address families by default unless a VPN explicitly allows them.
Sreeram Ramachandran [Mon, 28 Jul 2014 19:03:46 +0000 (19:03 +0000)]
am
507e7c5b: Merge "Fix fwmark handling for bypassable VPNs and DNS." into lmp-dev
* commit '
507e7c5bbfcd1d68f67477866497adb1748c5fd5':
Fix fwmark handling for bypassable VPNs and DNS.
Sreeram Ramachandran [Mon, 28 Jul 2014 14:29:59 +0000 (14:29 +0000)]
am
48e19b03: Implement the fallthrough rule to support split tunnel VPNs.
* commit '
48e19b037e7e20674048ef76bf31ce65c741347c':
Implement the fallthrough rule to support split tunnel VPNs.
Sreeram Ramachandran [Mon, 28 Jul 2014 18:53:50 +0000 (18:53 +0000)]
Merge "Prohibit address families by default unless a VPN explicitly allows them." into lmp-dev
Sreeram Ramachandran [Sun, 27 Jul 2014 01:43:25 +0000 (18:43 -0700)]
Prohibit address families by default unless a VPN explicitly allows them.
Bug:
15972465
Change-Id: I3278d94536fefacc86390c1ba4231680f7be8589
Sreeram Ramachandran [Wed, 23 Jul 2014 05:23:20 +0000 (22:23 -0700)]
Implement the fallthrough rule to support split tunnel VPNs.
Change-Id: Ibc48caedb5954c6b12bfa553d978bab56c4b09aa
Sreeram Ramachandran [Fri, 25 Jul 2014 23:08:55 +0000 (23:08 +0000)]
am
95684ba1: Implement support for bypassable VPNs.
* commit '
95684ba176a9fe5ea59207d7202e47fa12bbfdbe':
Implement support for bypassable VPNs.
Sreeram Ramachandran [Wed, 23 Jul 2014 20:27:31 +0000 (13:27 -0700)]
Implement support for bypassable VPNs.
Bypassable VPNs grab all traffic by default (just like secure VPNs), but:
+ They allow all apps to choose other networks using the multinetwork APIs.
If these other networks are insecure ("untrusted"), they will enforce that the
app holds the necessary permissions, such as CHANGE_NETWORK_STATE.
+ They support consistent routing. If an app has an existing connection over
some other network when the bypassable VPN comes up, it's not interrupted.
Bug:
15347374
Change-Id: Iaee9c6f6fa8103215738570d2b65d3fcf10343f3
Sreeram Ramachandran [Mon, 28 Jul 2014 18:52:15 +0000 (18:52 +0000)]
Merge "Fix fwmark handling for bypassable VPNs and DNS." into lmp-dev
Sreeram Ramachandran [Fri, 25 Jul 2014 02:04:32 +0000 (19:04 -0700)]
Fix fwmark handling for bypassable VPNs and DNS.
This is a significant change to the way fwmarks are handled for two purposes:
1. Bypassable VPN.
This was introduced in http://ag/510058 and had an issue that if there's a
default network, it would always be used in connect(), so the bypassable VPN
wouldn't get any traffic. This CL fixes that issue by using the bypassable
VPN's NetId in connect(). See the comments in the code for more details.
2. DNS.
The previous DNS code (specifically, getNetworkForUser()) had two problems:
+ Even if a user asks for a NetId they have permission for, we'd always use
the user's VPN if they were subject to one. So, for example, a system IMS
app that brings up the mobile network in the presence of a VPN would still
have its DNS queries sent over the VPN, instead of mobile as desired.
+ Any user could perform DNS over any valid network, even one they didn't
have permissions for, as long as they weren't subject to a VPN. So, for
example, an app could use the DNS servers of a different profile's VPN.
This CL fixes those problems. See getNetworkForDns() for more details.
The two pieces above are inter-related. Previously, we never set the explicit
bit from the DNS code. But we need to do that if the user asks for a network
explicitly, for two reasons:
o So that the DNS query is really restricted to that network and doesn't
fallthrough to the default network.
o So that the heuristic described in ON_CONNECT works in all cases. I.e., if the
DNS proxy's connect() request comes in with the explicit bit NOT set, we know
that the NetId can only be either the default network or a VPN.
This CL is not intended to be robust against race conditions. In general, very
little of the netd code is resilient. A separate effort needs to be undertaken
to carefully audit all the code and logic to guard against things like:
* A VPN being established between calls to getNetworkForDns() and connect().
* State changes between multiple calls to NetworkController from clients such as
FwmarkServer and DnsProxyListener.
* Routing rules / iptables rules being set up in a less-than-ideal order.
* ... etc.
Bug:
15347374
Change-Id: I5baad9168c4f4f3ef4129e07234b4bf24b0d8ba2
Sreeram Ramachandran [Wed, 23 Jul 2014 19:36:49 +0000 (19:36 +0000)]
am
111bec20: Implement the rule to forward traffic to local networks via VPNs.
* commit '
111bec203e82bdc9fb2c27df7c232465dffeee5f':
Implement the rule to forward traffic to local networks via VPNs.
Sreeram Ramachandran [Wed, 23 Jul 2014 01:51:06 +0000 (18:51 -0700)]
Implement the rule to forward traffic to local networks via VPNs.
Change-Id: I4bffb2ce854a6fa7d4c0d35b97f123d91c6a84d6
Sreeram Ramachandran [Wed, 23 Jul 2014 01:45:50 +0000 (01:45 +0000)]
am
fa9f4dcd: Cosmetic: Move some functions around to match rule priority order.
* commit '
fa9f4dcd79dcfd24af276263159c5315abb06df6':
Cosmetic: Move some functions around to match rule priority order.
Sreeram Ramachandran [Wed, 23 Jul 2014 01:16:44 +0000 (18:16 -0700)]
Cosmetic: Move some functions around to match rule priority order.
Change-Id: I81af639b66ac66272e0fae2d53119de1bfa12e69
Sreeram Ramachandran [Wed, 23 Jul 2014 00:23:05 +0000 (00:23 +0000)]
am
182a26ff: Remove the oif=iface clause when tethering.
* commit '
182a26ff95515179b1a7e62a806f90279cdcd9b3':
Remove the oif=iface clause when tethering.
Sreeram Ramachandran [Wed, 23 Jul 2014 00:08:02 +0000 (17:08 -0700)]
resolved conflicts for merge of
1604e186 to lmp-dev-plus-aosp
Change-Id: Ia37af0e92adc8c119ce170e072f4cd3899927bf6
Sreeram Ramachandran [Tue, 22 Jul 2014 23:44:37 +0000 (16:44 -0700)]
Remove the oif=iface clause when tethering.
The rule is meant to be "iif=inputIface => lookup <table_for_outputIface>", not
"iif=foo oif=bar => lookup <table_for_bar>" (the latter would never match
because packets coming in on the input interface will not have any output
interface binding).
Bug:
16242255
Change-Id: I98a2a8ab90765aee833134297b58d4f7a212036f
Sreeram Ramachandran [Sun, 20 Jul 2014 06:22:33 +0000 (23:22 -0700)]
Cleanup: Delete dead code.
Bug:
15413389
Change-Id: I315468832ef18ffc84174e54774ab63b86d284dc
Sreeram Ramachandran [Tue, 22 Jul 2014 21:53:46 +0000 (21:53 +0000)]
am
8b3b91c6: Try to undo iptables rules if a command fails.
* commit '
8b3b91c6cad577e2928a29073fc962c57ef75af5':
Try to undo iptables rules if a command fails.
Sreeram Ramachandran [Tue, 22 Jul 2014 19:40:36 +0000 (12:40 -0700)]
Try to undo iptables rules if a command fails.
As per review comments at:
https://googleplex-android-review.git.corp.google.com/#/c/504240/5/server/NatController.cpp@194
Bug:
15413694
Bug:
15413741
Change-Id: I99e2f83792fa81498447e4c03f5f8be1d2c43b7d
Sreeram Ramachandran [Tue, 22 Jul 2014 18:54:06 +0000 (18:54 +0000)]
am
b717e74d: Flush routing rules and add an "unreachable" rule on Init().
* commit '
b717e74df3571951890cf36ee8bd559501d7fdc4':
Flush routing rules and add an "unreachable" rule on Init().
Sreeram Ramachandran [Tue, 22 Jul 2014 18:54:05 +0000 (18:54 +0000)]
am
87475a14: Fix WiFi-Direct and Tethering.
* commit '
87475a1471373b72ffc9f81f17dfd7884723fa86':
Fix WiFi-Direct and Tethering.
Sreeram Ramachandran [Sat, 19 Jul 2014 07:22:15 +0000 (00:22 -0700)]
Flush routing rules and add an "unreachable" rule on Init().
Without the flush, rules accumulate duplicates when netd is restarted due to a
runtime restart. Nothing functionally wrong with having duplicates; it just
makes the output of "ip rule" look as though something went wrong in the system.
Time to add the unreachable rule, to suss out issues with corner cases. With the
flush, there's no more a naked "from main" rule that we need to protect by
adding the unreachable rule. But it's a good idea to add the unreachable rule
anyway, in case somebody comes along and adds a rule below it later.
Change-Id: I975b2221868b7f5366bd7cf60937a82fb4b75913