| 53ea9cadf6cc5f8be1c16b5b6b660cd7366fd3f0 |
|
31-Jan-2015 |
Nick Kralevich <nnk@google.com> |
Avoid leaking file descriptors
Add O_CLOEXEC on open() calls, and SOCK_CLOEXEC on socket calls.
This avoids leaking file descriptors across execs.
Addresses the following SELinux denial:
audit(1422740213.283:8): avc: denied { read write } for pid=2597 comm="clatd" path="socket:[6709]" dev="sockfs" ino=6709 scontext=u:r:clatd:s0 tcontext=u:r:netd:s0 tclass=netlink_socket
and allows the removal of some other SELinux rules which were
inappropriately added because of leaking file descriptors.
Change-Id: I9c180488ea1969d610e488f967a7276a672bb477
/system/netd/server/NetlinkManager.cpp
|
| 9088f10010646383cb48c9412b3f20b3fa434fc7 |
|
23-Jan-2015 |
Jeff Sharkey <jsharkey@android.com> |
Config NFLOG target before listening.
Otherwise the listener thread races with us and can eat the
responses to the config messages.
Bug: 19066761
Change-Id: I484fd79414731ab74ebc3ea50446e374a50eac77
/system/netd/server/NetlinkManager.cpp
|
| fbe497fcd808e4317572ad48c42545105309a347 |
|
29-Oct-2014 |
Jeff Sharkey <jsharkey@android.com> |
Offer to detect non-SSL/TLS network traffic.
Introduces new module that provides network-related features for
the StrictMode developer API. The first feature offers to detect
sockets sending data not wrapped inside a layer of SSL/TLS
encryption.
This carefully only adds overhead to UIDs that have requested
detection, and it uses CONNMARK to quickly accept/reject packets
from streams that have already been inspected. Detection is done
by looking for a well-known TLS handshake header; it's not future
proof, but it's a good start. Handles both IPv4 and IPv6.
When requested, we also log the triggering packet through NFLOG and
back up to the framework to aid investigation.
Bug: 18335678
Change-Id: Ie8fab785139dfb55a71b6dc7a0f3c75a8408224b
/system/netd/server/NetlinkManager.cpp
|
| bd0f224f077264f21fa858b7a93062e3b8564006 |
|
12-Jun-2014 |
Lorenzo Colitti <lorenzo@google.com> |
Notify network observers of route changes.
This reverts commit 20d3f5e856a38ef22851e32d7f9b6a7cd02eb459.
Bug: 9180552
Change-Id: I004448e2f0c731f6ca2c6d3535dc4dd51a622293
/system/netd/server/NetlinkManager.cpp
|
| 20d3f5e856a38ef22851e32d7f9b6a7cd02eb459 |
|
20-Jun-2014 |
Lorenzo Colitti <lorenzo@google.com> |
Revert "Notify network observers of route changes."
This reverts commit d2f23fb6285000831f14cacc16881d96f6046c33.
Change-Id: Ifabbc6848ab33842461465fccb9886863a08aec6
/system/netd/server/NetlinkManager.cpp
|
| d2f23fb6285000831f14cacc16881d96f6046c33 |
|
12-Jun-2014 |
Lorenzo Colitti <lorenzo@google.com> |
Notify network observers of route changes.
Bug: 9180552
Change-Id: Ic23025e4d7cb4e58ae59017777267ac45f00b434
/system/netd/server/NetlinkManager.cpp
|
| f4cfad361175a7f9ccf4d41e76a9b289c3c3da22 |
|
21-May-2014 |
Sreeram Ramachandran <sreeram@google.com> |
Move netd_client into netd.
Change-Id: Ie4b6b303225c93f2448a503d6ea9cebb552cbad5
/system/netd/server/NetlinkManager.cpp
|