summaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2016-02-16misc seq_printf fixes for 4.4Amit Pundir
Update seq_printf() usage in aosp patches to align with changes from mainline commit 6798a8caaf64 "fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void". Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16net: wireless: Decrease scan entry expiration to avoid stall resultsDmitry Shmidt
Change-Id: I0e23ce45d78d7c17633670973f49943a5ed6032d Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-02-16bridge: Have tx_bytes count headers like rx_bytes.Ashish Sharma
Since rx_bytes accounting does not include Ethernet Headers in br_input.c, excluding ETH_HLEN on the transmit path for consistent measurement of packet length on both the Tx and Rx chains. The clean way would be for Rx to include the eth header, but the skb len has already been adjusted by the time the br code sees the skb. This is only a temporary workaround until we can completely ignore or cleanly fix the skb->len handling. Change-Id: I910de95a4686b2119da7f1f326e2154ef31f9972 Signed-off-by: Ashish Sharma <ashishsharma@google.com>
2016-02-16rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power downNick Pelly
Some platforms do not want to power down rfkill devices on suspend. Change-Id: I62a11630521c636d54a4a02ab9037a43435925f5 Signed-off-by: Nick Pelly <npelly@google.com>
2016-02-16tcp: Fix IPV6 module build errorsTushar Behera
If CONFIG_IPV6=m is selected, we are getting following build errors. net/built-in.o: In function `tcp_is_local6': net/ipv4/tcp.c:3261: undefined reference to `rt6_lookup' Making the code conditional upon only CONFIG_IPV6=y fixes this issue. Also export tcp_nuke_addr to build IPv6 modules. Otherwise we run into following build error: CC [M] lib/zlib_deflate/deftree.o CC [M] lib/zlib_deflate/deflate_syms.o LD [M] lib/zlib_deflate/zlib_deflate.o Building modules, stage 2. MODPOST 46 modules ERROR: "tcp_nuke_addr" [net/ipv6/ipv6.ko] undefined! make[2]: *** [__modpost] Error 1 Signed-off-by: Tushar Behera <tushar.behera@linaro.org> CC: John Stultz <john.stultz@linaro.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16net: ipv6: fix virtual tunneling buildAmit Pundir
IPv6 PMTUD has been updated to support UID-based routing. Pass INVALID_UID as the socket UID to ip6_update_pmtu(), otherwise we run into following build error: ---------------- CC net/ipv6/ip6_vti.o net/ipv6/ip6_vti.c: In function ‘vti6_err’: net/ipv6/ip6_vti.c:559:3: error: too few arguments to function ‘ip6_update_pmtu’ In file included from include/net/ip_tunnels.h:19:0, from net/ipv6/ip6_vti.c:44: include/net/ip6_route.h:110:6: note: declared here make[2]: *** [net/ipv6/ip6_vti.o] Error 1 ---------------- Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16Don't kill IPv4 sockets when killing IPv6 sockets was requested.Lorenzo Colitti
c7c3ec4903d32c60423ee013d96e94602f66042c cherry-picked the tcp_nuke_addr ioctl, but omitted a check that ensures that a socket is an IPv6 socket. This makes it so that if we issue a SIOCKILLADDR on ::, it kills IPv4 sockets as well. This is because every IPv4 socket has an IPv6 source address (sk_v6_rcv_saddr) of ::. Thus, when we iterate over an IPv4 socket, and compare the source address of the socket to the source address in the ioctl, it matches the :: that was passed in, and we kill the socket. Change-Id: I736431a898e6ec91536536d352936a210aa10100
2016-02-16tcp: fix tcp_default_init_rwnd() for 4.1Dmitry Shmidt
Change-Id: If3ecf5f59acf379ffcc468f28434830a92b0383d Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-02-16tcp: add a sysctl to config the tcp_default_init_rwndJP Abgrall
The default initial rwnd is hardcoded to 10. Now we allow it to be controlled via /proc/sys/net/ipv4/tcp_default_init_rwnd which limits the values from 3 to 100 This is somewhat needed because ipv6 routes are autoconfigured by the kernel. See "An Argument for Increasing TCP's Initial Congestion Window" in https://developers.google.com/speed/articles/tcp_initcwnd_paper.pdf Change-Id: I386b2a9d62de0ebe05c1ebe1b4bd91b314af5c54 Signed-off-by: JP Abgrall <jpa@google.com> Conflicts: net/ipv4/sysctl_net_ipv4.c net/ipv4/tcp_input.c
2016-02-16net: activity_stats: Stop using obsolete create_proc_read_entry apiArve Hjønnevåg
Convert to use seq_read Signed-off-by: Arve Hjønnevåg <arve@android.com>
2016-02-16net: activity_stats: Add statistics for network transmission activityMike Chan
When enabled, tracks the frequency of network transmissions (inbound and outbound) and buckets them accordingly. Buckets are determined by time between network activity. Each bucket represents the number of network transmisions that were N sec or longer apart. Where N is defined as 1 << bucket index. This network pattern tracking is particularly useful for wireless networks (ie: 3G) where batching network activity closely together is more power efficient than far apart. New file: /proc/net/stat/activity output: Min Bucket(sec) Count 1 7 2 0 4 1 8 0 16 0 32 2 64 1 128 0 Change-Id: I4c4cd8627b872a55f326b1715c51bc3bdd6e8d92 Signed-off-by: Mike Chan <mike@android.com>
2016-02-16xt_qtaguid: fix a race condition in if_tag_stat_updateliping.zhang
Miss a lock protection in if_tag_stat_update while doing get_iface_entry. So if one CPU is doing iface_stat_create while another CPU is doing if_tag_stat_update, race will happened. Change-Id: Ib8d98e542f4e385685499f5b7bb7354f08654a75 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
2016-02-16netfilter: xt_qtaguid/socket: build fixes for 4.4Amit Pundir
Update xt_socket_lookup_slow_v* usage in aosp patches, to align with changes from mainline commit 686c9b50809d "netfilter: x_tables: Use par->net instead of computing from the passed net devices". Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16netfilter: xt_qtaguid: xt_socket: build fixesAmit Pundir
Add missing header <linux/miscdevice.h> and use xt_socket_lookup_slow_v* instead of xt_socket_get*_sk in xt_qtaguid.c. Fix xt_socket_lookup_slow_v* functions in xt_socket.c and declare them in xt_socket.h Change-Id: I55819b2d4ffa82a2be20995c87d28fb5cc77b5ba Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16net: xt_qtaguid/xt_socket: fix refcount underflow and crashDmitry Torokhov
xt_socket_get[4|6]_sk() do not always increment sock refcount, which causes confusion in xt_qtaguid module which is not aware of this fact and drops the reference whether it should have or not. Fix it by changing xt_socket_get[4|6]_sk() to always increment recount of returned sock. This should fix the following crash: [ 111.319523] BUG: failure at /mnt/host/source/src/third_party/kernel/v3.18/net/ipv4/inet_timewait_sock.c:90/__inet_twsk_kill()! [ 111.331192] Kernel panic - not syncing: BUG! [ 111.335468] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G U W 3.18.0-06867-g268df91 #1 [ 111.343810] Hardware name: Google Tegra210 Smaug Rev 1+ (DT) [ 111.349463] Call trace: [ 111.351917] [<ffffffc000207288>] dump_backtrace+0x0/0x10c [ 111.357314] [<ffffffc0002073a4>] show_stack+0x10/0x1c [ 111.362367] [<ffffffc000a82d1c>] dump_stack+0x74/0x94 [ 111.367414] [<ffffffc000a81824>] panic+0xec/0x238 [ 111.372116] [<ffffffc000981648>] __inet_twsk_kill+0xd0/0xf8 [ 111.377684] [<ffffffc0009817b0>] inet_twdr_do_twkill_work+0x64/0xd0 [ 111.383946] [<ffffffc000981a5c>] inet_twdr_hangman+0x2c/0xa4 [ 111.389602] [<ffffffc000271cf0>] call_timer_fn+0xac/0x160 [ 111.394995] [<ffffffc00027250c>] run_timer_softirq+0x23c/0x274 [ 111.400824] [<ffffffc000220a68>] __do_softirq+0x1a4/0x330 [ 111.406218] [<ffffffc000220e94>] irq_exit+0x70/0xd0 [ 111.411093] [<ffffffc000264e00>] __handle_domain_irq+0x84/0xa8 [ 111.416922] [<ffffffc0002003ec>] gic_handle_irq+0x4c/0x80 b/22476945 Originally reviewed at: https://chromium-review.googlesource.com/#/c/297414/ Change-Id: I51fa94a9d92a84a0bd3b58466d711e46a6892a79 Signed-off-by: Dmitry Torokhov <dtor@google.com> [jstultz: Cherry-picked and added missing local var definition] Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16xt_qtaguid: use sock_gen_put() instead of xt_socket_put_sk()Amit Pundir
Removing obsolete xt_socket_put_sk() and using sock_gen_put() instead. xt_socket_put_sk() was reintroduced for xt_qtaguid in one of the patches, but it turned out sock_gen_put() supersedes xt_socket_put_sk(). So we don't need xt_socket_put_sk() any more. This patch is based on commit 1a8bf6eeef9f (netfilter: xt_socket: use sock_gen_put()) Change-Id: I976d5f7f7eded0f3cc91b596acfeb35e4c2057e5 Signed-off-by: Amit Pundir <amit.pundir@linaro.org> (cherry picked from commit 551780fc28cb7480dbc4f585ef80ca02c2922ec1) Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16xt_qtaguid: Use sk_callback_lock read locks before reading sk->sk_socketMohamad Ayyash
It prevents a kernel panic when accessing sk->sk_socket fields due to NULLing sk->sk_socket when sock_orphan is called through sk_common_release. Change-Id: I4aa46b4e2d8600e4d4ef8dcdd363aa4e6e5f8433 Signed-off-by: Mohamad Ayyash <mkayyash@google.com> (cherry picked from commit cdea0ebcb8bcfe57688f6cb692b49e550ebd9796) Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16xt_qtaguid: fix broken uid/gid range checkAmit Pundir
The existing test to check if current uid/gid is within valid range is broken due to missing parenthesis. Change-Id: I889ebbd0e2ea6a9426cb1509a2975e7107666407 Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16netfilter: Build fixups - kuid/kguid changes & xt_socket_get/put_skJohn Stultz
Fix up build kuid/kguid build issues in netfilter code. Also re-add the xt_socket_get/put_sk interfaces needed by xt_qtaguid. Change-Id: I7027fb840e109785bddffe8ea717b8d018b26d82 Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16net: core: Handle 'sk' being NULL in UID-based routingSreeram Ramachandran
It has Amit Pundir <amit.pundir@linaro.org> fix: net: core: fix UID-based routing build Bug: 15413527 Change-Id: Iab1fae9da6053b284591628ef1de878761b137b1 Signed-off-by: Sreeram Ramachandran <sreeram@google.com> Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16net: core: Support UID-based routing.Lorenzo Colitti
This contains the following commits: 1. cc2f522 net: core: Add a UID range to fib rules. 2. d7ed2bd net: core: Use the socket UID in routing lookups. 3. 2f9306a net: core: Add a RTA_UID attribute to routes. This is so that userspace can do per-UID route lookups. 4. 8e46efb net: ipv6: Use the UID in IPv6 PMTUD IPv4 PMTUD already does this because ipv4_sk_update_pmtu uses __build_flow_key, which includes the UID. Bug: 15413527 Change-Id: Iae3d4ca3979d252b6cec989bdc1a6875f811f03a Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2016-02-16net: ipv6: fix build failure if IPV6_ROUTE_INFO config is enabledAmit Pundir
Pass correct arguments to rt6_get_route_info() function, otherwise we run into following Kernel build failure: ---------- CC net/ipv6/route.o net/ipv6/route.c: In function ‘rt6_route_rcv’: net/ipv6/route.c:746:27: error: ‘net’ undeclared (first use in this function) net/ipv6/route.c:746:27: note: each undeclared identifier is reported only once for each function it appears in make[2]: *** [net/ipv6/route.o] Error 1 make[1]: *** [net/ipv6] Error 2 make: *** [net] Error 2 ---------- Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-02-16net: ipv6: autoconf routes into per-device tablesLorenzo Colitti
Currently, IPv6 router discovery always puts routes into RT6_TABLE_MAIN. This causes problems for connection managers that want to support multiple simultaneous network connections and want control over which one is used by default (e.g., wifi and wired). To work around this connection managers typically take the routes they prefer and copy them to static routes with low metrics in the main table. This puts the burden on the connection manager to watch netlink to see if the routes have changed, delete the routes when their lifetime expires, etc. Instead, this patch adds a per-interface sysctl to have the kernel put autoconf routes into different tables. This allows each interface to have its own autoconf table, and choosing the default interface (or using different interfaces at the same time for different types of traffic) can be done using appropriate ip rules. The sysctl behaves as follows: - = 0: default. Put routes into RT6_TABLE_MAIN as before. - > 0: manual. Put routes into the specified table. - < 0: automatic. Add the absolute value of the sysctl to the device's ifindex, and use that table. The automatic mode is most useful in conjunction with net.ipv6.conf.default.accept_ra_rt_table. A connection manager or distribution could set it to, say, -100 on boot, and thereafter just use IP rules. Change-Id: I82d16e3737d9cdfa6489e649e247894d0d60cbb1 Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2016-02-16nf: IDLETIMER: Fix broken uid field in the msgAmit Pundir
Create uid from kuid to fix the broken uid field in the message notifications introduced in Change-Id: I18fc73eada512e370d7ab24fc9f890845037b729, Otherwise we run into following build error: --------------- CC net/netfilter/xt_IDLETIMER.o net/netfilter/xt_IDLETIMER.c: In function ‘reset_timer’: net/netfilter/xt_IDLETIMER.c:360:16: error: incompatible types when assigning to type ‘uid_t’ from type ‘kuid_t’ make[2]: *** [net/netfilter/xt_IDLETIMER.o] Error 1 --------------- Signed-off-by: Amit Pundir <amit.pundir@linaro.org> (cherry picked from commit 706060ba3e1dee9ec3c4a4a1480d663b6cd71cad) Change-Id: Ifd66df45a58d1a5a60c3816c373ee3008292eee8
2016-02-16nf: IDLETIMER: Adds the uid field in the msgRuchi Kandoi
Message notifications contains an additional uid field. This field represents the uid that was responsible for waking the radio. And hence it is present only in notifications stating that the radio is now active. Change-Id: I18fc73eada512e370d7ab24fc9f890845037b729 Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com> Bug: 20264396
2016-02-16netfilter: fix seq_printf type mismatch warningSherman Yin
The return type of atomic64_read() varies depending on arch. The arm64 version is being changed from long long to long in the mainline for v3.16, causing a seq_printf type mismatch (%llu) in guid_ctrl_proc_show(). This commit fixes the type mismatch by casting atomic64_read() to u64. Change-Id: Iae0a6bd4314f5686a9f4fecbe6203e94ec0870de Signed-off-by: Sherman Yin <shermanyin@gmail.com>
2016-02-16nf: Remove compilation error caused by e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35Ruchi Kandoi
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2016-02-16nf: IDLETIMER: time-stamp and suspend/resume handling.Ruchi Kandoi
Message notifications contains an additional timestamp field in nano seconds. The expiry time for the timers are modified during suspend/resume. If timer was supposed to expire while the system is suspended then a notification is sent when it resumes with the timestamp of the scheduled expiry. Removes the race condition for multiple work scheduled. Bug: 13247811 Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2016-02-16xt_qtaguid: Fix boot panicJon Medhurst (Tixy)
We need the change below because of mainline commit 351638e7de (net: pass info struct via netdevice notifier). Otherwise we panic. Change-Id: I7daf7513a733933fdcbaeebea7f8191f8b6a0432 Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16net: kuid/kguid build fixesJohn Stultz
Small build fixes for xt_quota2 and ipv4 changes Change-Id: Ib098768040c8875887b2081c3165a6c83b37e180 Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-02-16netfilter: ipv6: fix crash caused by ipv6_find_hdr()JP Abgrall
When calling: ipv6_find_hdr(skb, &thoff, -1, NULL) on a fragmented packet, thoff would be left with a random value causing callers to read random memory offsets with: skb_header_pointer(skb, thoff, ...) Now we force ipv6_find_hdr() to return a failure in this case. Calling: ipv6_find_hdr(skb, &thoff, -1, &fragoff) will set fragoff as expected, and not return a failure. Change-Id: Ib474e8a4267dd2b300feca325811330329684a88 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: 64-bit warning fixesGreg Hackmann
Change-Id: I2adc517c0c51050ed601992fa0ea4de8f1449414 Signed-off-by: Greg Hackmann <ghackmann@google.com>
2016-02-16netfilter: xt_qtaguid: fix memory leak in seq_file handlersGreg Hackmann
Change-Id: I15b21230d52479d008a00d9e2191dda020f00925 Signed-off-by: Greg Hackmann <ghackmann@google.com>
2016-02-16netfilter: xt_qtaguid: fix bad tcp_time_wait sock handlingJP Abgrall
Since (41063e9 ipv4: Early TCP socket demux), skb's can have an sk which is not a struct sock but the smaller struct inet_timewait_sock without an sk->sk_socket. Now we bypass sk_state == TCP_TIME_WAIT Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: 3.10 fixesArve Hjønnevåg
Stop using obsolete procfs api. Signed-off-by: Arve Hjønnevåg <arve@android.com>
2016-02-16netfilter: xt_quota2: 3.10 fixes.Arve Hjønnevåg
- Stop using obsolete create_proc_entry api. - Use proc_set_user instead of directly accessing the private structure. Signed-off-by: Arve Hjønnevåg <arve@android.com>
2016-02-16netfilter: qtaguid: rate limit some of the printksJP Abgrall
Some of the printks are in the packet handling path. We now ratelimit the very unlikely errors to avoid kmsg spamming. Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: Allow tracking loopbackJP Abgrall
In the past it would always ignore interfaces with loopback addresses. Now we just treat them like any other. This also helps with writing tests that check for the presence of the qtaguid module. Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: extend iface stat to report protocolsJP Abgrall
In the past the iface_stat_fmt would only show global bytes/packets for the skb-based numbers. For stall detection in userspace, distinguishing tcp vs other protocols makes it easier. Now we report ifname total_skb_rx_bytes total_skb_rx_packets total_skb_tx_bytes total_skb_tx_packets {rx,tx}_{tcp,udp,ohter}_{bytes,packets} Bug: 6818637 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: remove AID_* dependency for access controlJP Abgrall
qtaguid limits what can be done with /ctrl and /stats based on group membership. This changes removes AID_NET_BW_STATS and AID_NET_BW_ACCT, and picks up the groups from the gid of the matching proc entry files. Signed-off-by: JP Abgrall <jpa@google.com> Change-Id: I42e477adde78a12ed5eb58fbc0b277cdaadb6f94
2016-02-16netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat failsPontus Fuchs
If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the following will happen: qtaguid: iface_stat: tag stat alloc failed ... kernel BUG at xt_qtaguid.c:1482! Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
2016-02-16netfilter: xt_qtaguid: fix error exit that would keep a spinlock.JP Abgrall
qtudev_open() could return with a uid_tag_data_tree_lock held when an kzalloc(..., GFP_ATOMIC) would fail. Very unlikely to get triggered AND survive the mayhem of running out of mem. Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: report only uid tags to non-privileged processesJP Abgrall
In the past, a process could only see its own stats (uid-based summary, and details). Now we allow any process to see other UIDs uid-based stats, but still hide the detailed stats. Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: start tracking iface rx/tx at low levelJP Abgrall
qtaguid tracks the device stats by monitoring when it goes up and down, then it gets the dev_stats(). But devs don't correctly report stats (either they don't count headers symmetrically between rx/tx, or they count internal control messages). Now qtaguid counts the rx/tx bytes/packets during raw:prerouting and mangle:postrouting (nat is not available in ipv6). The results are in /proc/net/xt_qtaguid/iface_stat_fmt which outputs a format line (bash expansion): ifname total_skb_{rx,tx}_{bytes,packets} Added event counters for pre/post handling. Added extra ctrl_*() pid/uid debugging. Change-Id: Id84345d544ad1dd5f63e3842cab229e71d339297 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_IDLETIMER: Add new netlink msg typeJP Abgrall
Send notifications when the label becomes active after an idle period. Send netlink message notifications in addition to sysfs notifications. Using a uevent with subsystem=xt_idletimer INTERFACE=... STATE={active,inactive} This is backport from common android-3.0 commit: beb914e987cbbd368988d2b94a6661cb907c4d5a with uevent support instead of a new netlink message type. Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523 Signed-off-by: Ashish Sharma <ashishsharma@google.com> Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: xt_qtaguid: fix ipv6 protocol lookupJP Abgrall
When updating the stats for a given uid it would incorrectly assume IPV4 and pick up the wrong protocol when IPV6. Change-Id: Iea4a635012b4123bf7aa93809011b7b2040bb3d5 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: qtaguid: initialize a local var to keep compiler happy.JP Abgrall
There was a case that might have seemed like new_tag_stat was not initialized and actually used. Added comment explaining why it was impossible, and a BUG() in case the logic gets changed. Change-Id: I1eddd1b6f754c08a3bf89f7e9427e5dce1dfb081 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: fixup the quota2, and enable.JP Abgrall
The xt_quota2 came from http://sourceforge.net/projects/xtables-addons/develop It needed tweaking for it to compile within the kernel tree. Fixed kmalloc() and create_proc_entry() invocations within a non-interruptible context. Removed useless copying of current quota back to the iptable's struct matchinfo: - those are per CPU: they will change randomly based on which cpu gets to update the value. - they prevent matching a rule: e.g. -A chain -m quota2 --name q1 --quota 123 can't be followed by -D chain -m quota2 --name q1 --quota 123 as the 123 will be compared to the struct matchinfo's quota member. Use the NETLINK NETLINK_NFLOG family to log a single message when the quota limit is reached. It uses the same packet type as ipt_ULOG, but - never copies skb data, - uses 112 as the event number (ULOG's +1) It doesn't log if the module param "event_num" is 0. Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492 Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: adding the original quota2 from xtables-addonsJP Abgrall
The original xt_quota in the kernel is plain broken: - counts quota at a per CPU level (was written back when ubiquitous SMP was just a dream) - provides no way to count across IPV4/IPV6. This patch is the original unaltered code from: http://sourceforge.net/projects/xtables-addons at commit e84391ce665cef046967f796dd91026851d6bbf3 Change-Id: I19d49858840effee9ecf6cff03c23b45a97efdeb Signed-off-by: JP Abgrall <jpa@google.com>
2016-02-16netfilter: add xt_qtaguid matching moduleJP Abgrall
This module allows tracking stats at the socket level for given UIDs. It replaces xt_owner. If the --uid-owner is not specified, it will just count stats based on who the skb belongs to. This will even happen on incoming skbs as it looks into the skb via xt_socket magic to see who owns it. If an skb is lost, it will be assigned to uid=0. To control what sockets of what UIDs are tagged by what, one uses: echo t $sock_fd $accounting_tag $the_billed_uid \ > /proc/net/xt_qtaguid/ctrl So whenever an skb belongs to a sock_fd, it will be accounted against $the_billed_uid and matching stats will show up under the uid with the given $accounting_tag. Because the number of allocations for the stats structs is not that big: ~500 apps * 32 per app we'll just do it atomic. This avoids walking lists many times, and the fancy worker thread handling. Slabs will grow when needed later. It use netdevice and inetaddr notifications instead of hooks in the core dev code to track when a device comes and goes. This removes the need for exposed iface_stat.h. Put procfs dirs in /proc/net/xt_qtaguid/ ctrl stats iface_stat/<iface>/... The uid stats are obtainable in ./stats. Change-Id: I01af4fd91c8de651668d3decb76d9bdc1e343919 Signed-off-by: JP Abgrall <jpa@google.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-13 21:16:08 +0000