Merge branch 'uid-routing'
Lorenzo Colitti says:
====================
net: inet: Support UID-based routing
This patchset adds support for per-UID routing. It allows the
administrator to configure rules such as:
ip rule add uidrange 100-200 lookup 123
This functionality has been in use by all Android devices since
5.0. It is primarily used to impose per-app routing policies (on
Android, every app has its own UID) without having to resort to
rerouting packets in iptables, which breaks getsockname() and
MTU/MSS calculation, and generally disrupts end-to-end
connectivity.
This patch series is similar to the code currently used on
Android, but has better correctness and performance because
it stores the UID in the socket instead of calling sock_i_uid.
This avoids contention on sk->sk_callback_lock, and makes it
possible to correctly route a socket on which userspace has
called close(), for which sock_i_uid will return 0.
Changes from v1:
- Don't set the UID in sk_clone_lock, it's already set by
sock_copy.
- For packets originated by kernel sockets, don't use the socket
UID. This is the UID that created the namespace, but it might
not be mapped in the namespace at all. Instead, use UID 0 in
the namespace, which is less surprising and consistent with
what happens in the root namespace.
- Fix UID routing of IPv4 and IPv6 SYN_RECV sockets.
- Fix UID routing of received IPv6 redirects.
====================
Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
Please register or sign in to comment