android_external_iptables, branch stable/cm-13.0-ZNH2K

Merge tag 'android-6.0.0_r26' into cm-13.0

2015-11-05T00:42:15+00:00

Android 6.0.0 release 26

extensions: libxt_socket: add --restore-skmark option

2015-10-06T09:30:27+00:00

xt_socket is useful for matching sockets with IP_TRANSPARENT and
taking some action on the matching packets. However, it lacks the
ability to match only a small subset of transparent sockets.

Suppose there are 2 applications, each with its own set of transparent
sockets. The first application wants all matching packets dropped,
while the second application wants them forwarded somewhere else.

Add the ability to retore the skb->mark from the sk_mark. The mark
is only restored if a matching socket is found and the transparent /
nowildcard conditions are satisfied.

Now the 2 hypothetical applications can differentiate their sockets
based on a mark value set with SO_MARK.

iptables -t mangle -I PREROUTING -m socket --transparent \
                                           --restore-skmark -j action
iptables -t mangle -A action -m mark --mark 10 -j action2
iptables -t mangle -A action -m mark --mark 11 -j action3

Change-Id: I962e87f32c241cb8d056dfd62f296fa312b05162
Signed-off-by: Harout Hedeshian 
Signed-off-by: Pablo Neira Ayuso

xt_socket: add --nowildcard flag

2015-10-06T09:30:27+00:00

xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)

But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).

Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism

The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)

iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket -j ACCEPT

Change-Id: Ic5bbebbfccc1ccede0157cd3b5ea4863c1ed2fa7
Signed-off-by: Eric Dumazet 
Cc: Patrick McHardy 
Cc: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

extensions: add hard idletimer xt target extension

2015-10-06T09:30:26+00:00

Add the extension plugin for the HARDIDLETIMER x_tables target

Change-Id: I318bc9f69f845b273c198bec80754eb5886e77d1

extensions: libxt_socket: add --restore-skmark option

2015-07-29T07:54:07+00:00

xt_socket is useful for matching sockets with IP_TRANSPARENT and
taking some action on the matching packets. However, it lacks the
ability to match only a small subset of transparent sockets.

Suppose there are 2 applications, each with its own set of transparent
sockets. The first application wants all matching packets dropped,
while the second application wants them forwarded somewhere else.

Add the ability to retore the skb->mark from the sk_mark. The mark
is only restored if a matching socket is found and the transparent /
nowildcard conditions are satisfied.

Now the 2 hypothetical applications can differentiate their sockets
based on a mark value set with SO_MARK.

iptables -t mangle -I PREROUTING -m socket --transparent \
                                           --restore-skmark -j action
iptables -t mangle -A action -m mark --mark 10 -j action2
iptables -t mangle -A action -m mark --mark 11 -j action3

Bug: 20663075
Signed-off-by: Harout Hedeshian 
Signed-off-by: Pablo Neira Ayuso 

(cherry picked from commit 3b20fc71c99acd604d635deacef99769e36191b5)

Change-Id: If746841dea9db9f1c7ad1d74ed37fa13109e37ff

Merge "xt_socket: add --nowildcard flag" into mnc-dr-dev

2015-07-29T07:53:42+00:00

xt_socket: add --nowildcard flag

2015-07-29T07:23:06+00:00

xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)

But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).

Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism

The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)

iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket -j ACCEPT

Bug: 20663075
Signed-off-by: Eric Dumazet 
Cc: Patrick McHardy 
Cc: Jesper Dangaard Brouer 
Signed-off-by: Pablo Neira Ayuso

Merge remote-tracking branch 'goog/mirror-m-wireless-internal-release' into master_merge

2015-03-24T20:34:54+00:00

Merge "extensions: libxt_TEE: Trim kernel struct to allow deletion"

2015-03-19T06:09:25+00:00

extensions: libxt_TEE: Trim kernel struct to allow deletion

2015-03-19T04:44:53+00:00

Correct trimming of userspacesize to fix deletions.

Fixes: Bugzilla #884.

The rule having TEE target with '--oif' option cannot be deleted by iptables command.

  $ iptables -I INPUT -i foo -j TEE --gateway x.x.x.x --oif bar
  $ iptables -D INPUT -i foo -j TEE --gateway x.x.x.x --oif bar
  iptables: No chain/target/match by that name.

[Cherry-pick of iptables df3741332d86629a8fdd267930e0a249803f6aa8]

Signed-off-by: Loganaden Velvindron 
Signed-off-by: Pablo Neira Ayuso 
Change-Id: Ieb43487811669d502074330a0cba7c8d4c9c7446