Skip to content

GitLab

Switch branch/tag
  1. 04 Aug, 2015 1 commit
    • Paul Jensen's avatar
      Make netd calls to iptables wait for xtables lock · 94b2ab92
      Paul Jensen authored 
      Without this wait iptables commands can fail with various unpleasant
consequences like Log.wtf() or missing iptables rules.  The most
critical calls to iptables in NetdConstants.cpp already wait for the
lock.

Bug:22802665
Change-Id: I7d542c3d4f0e005618e368da674159b90d652c8a
      94b2ab92
  3. 06 Jul, 2015 1 commit
    • Erik Kline's avatar
      Use struct android_net_context when interfacing with bionic · cea2d345
      Erik Kline authored 
      Add a new NetworkController::getNetworkContext() that builds the
contents of a struct net_context out of getNetworkForConnect()
and getNetworkForDns().

Bug: 19470192
Bug: 20733156
Bug: 21832279
Change-Id: I5a69b0413a83d33be28b78c0a99359b109517a8f
      cea2d345
  5. 26 Jun, 2015 1 commit
    • Xiaohui Chen's avatar
      netd: add default fw white list for system uids · feb2b61d
      Xiaohui Chen authored 
      In uid firewall white list, we white list the system uid range
by default to make sure system processes will always have network
access.

BUG:22094135
Change-Id: I8f472a98a9fd93591a2887982cec1458d7683613
      feb2b61d
  7. 15 Jun, 2015 1 commit
    • Xiaohui Chen's avatar
      netd: add two child chains to firewall · 1cdfa9ad
      Xiaohui Chen authored 
      This is an attempt to speed up getting out of device idle.  It groups
uid firewall rules in these child chains so we can attach/detach a whole
chain instead of individual uid rules.

BUG:21446713
Change-Id: I61dc7d14110e633c5994e466481b9cac633a7a4f
      1cdfa9ad
  9. 03 Jun, 2015 1 commit
  11. 13 May, 2015 4 commits
  13. 06 May, 2015 1 commit
  15. 29 Apr, 2015 1 commit
    • Amith Yamasani's avatar
      Blacklist uids for network access · 390e4ea8
      Amith Yamasani authored 
      FirewallController can now be in blacklist mode (aka disabled)
or whitelist mode (aka enabled).

Some of the methods don't do anything when in blacklist mode.

Uid rules updated to allow dropping packets to uids that
shouldn't get any network access, usually for idle apps.

Added a wait option to iptables calls to make sure it doesn't
fail if there's contention. Fixes a flakiness I was seeing in
removing rules.

Bug: 20066058
Change-Id: I815bcb45aa06d04020e902df8c67bb3894e98f40
      390e4ea8
  17. 28 Apr, 2015 1 commit
  19. 01 Apr, 2015 1 commit
  21. 27 Mar, 2015 1 commit
  23. 16 Mar, 2015 11 commits
  25. 15 Mar, 2015 1 commit
  27. 14 Mar, 2015 2 commits
  29. 13 Mar, 2015 1 commit
  31. 10 Mar, 2015 3 commits
  33. 05 Mar, 2015 1 commit
  35. 27 Feb, 2015 3 commits
    • Lorenzo Colitti's avatar
      Add oif rules that allow UID 0 to bypass the VPN. · 57947f02
      Lorenzo Colitti authored 
      This is needed for wifi calling so that the kernel (which does
not set marks) can tee packets towards the modem. It also fixes
things like not being able to reply to DHCP requests from
tethered clients when a VPN is up.

System apps can already bypass the VPN using explicit marks, so
allowing UID 0 to do so does not create additional bypass VPN
issues.

Bug: 19500693
Change-Id: Ie324026893637e9bd8e7aa65a37579569390e7b7
      57947f02
    • Lorenzo Colitti's avatar
      Separate NAT from forwarding. · 32d76879
      Lorenzo Colitti authored 
      Bug: 19500693

Change-Id: Ib3871106ea3c0d68327611e7568c0710210e4ff2
      32d76879
    • Lorenzo Colitti's avatar
      Make the VPN rule only to originated, not forwarded, traffic. · 5ad4e98f
      Lorenzo Colitti authored 
      Currently the VPN rule for the primary user will match every
forwarded packet on the system, because it specifies a UID range
that includes 0, and forwarded packets have UID 0.

Use "iif lo" to limit the rule match to locally-originated
traffic. This requires a kernel that sets the loopback ifindex.
when originating packets. Anything based on 3.10 is fine, but
devices using 3.4 will need a one-line change for IPv6.

Bug: 19500693
Change-Id: Iaab88bed62716dc1cea33b45c4e258f6b3bfc9d0
      5ad4e98f
  37. 25 Feb, 2015 2 commits
  39. 12 Feb, 2015 2 commits