From: Lorenzo Colitti <lorenzo@google.com>
To: netdev@vger.kernel.org
Cc: davem@davemloft.net, ek@google.com, eric.dumazet@gmail.com,
zenczykowski@gmail.com
Subject: [PATCH net-next] net: inet: Support UID-based routing
Date: Fri, 28 Oct 2016 02:20:38 +0900 [thread overview]
Message-ID: <1477588841-140767-1-git-send-email-lorenzo@google.com> (raw)
This patchset adds support for per-UID routing. It allows the
administrator to configure rules such as:
ip rule add uidrange 100-200 lookup 123
This functionality has been in use by all Android devices since
5.0, which was released in late 2014. It is primarily used to
impose per-app routing policies (on Android, every app has its
own UID) without having to resort to rerouting packets in
iptables, which breaks getsockname() and MTU/MSS calculation,
and generally disrupts end-to-end connectivity.
This patch series is similar to the code currently used on
Android, but has better correctness and performance because
it stores the UID in the socket instead of calling sock_i_uid.
This avoids contention on sk->sk_callback_lock, and makes it
possible to correctly route a socket on which userspace has
called close(), for which sock_i_uid will return 0.
next reply other threads:[~2016-10-27 17:20 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-27 17:20 Lorenzo Colitti [this message]
2016-10-27 17:20 ` [PATCH net-next 1/3] net: core: Add a UID field to struct sock Lorenzo Colitti
2016-10-27 17:36 ` Eric Dumazet
2016-10-27 20:02 ` David Miller
2016-10-27 19:05 ` kbuild test robot
2016-10-27 17:20 ` [PATCH net-next 2/3] net: core: add UID to flows, rules, and routes Lorenzo Colitti
2016-10-27 17:20 ` [PATCH net-next 3/3] net: inet: Support UID-based routing in IP protocols Lorenzo Colitti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1477588841-140767-1-git-send-email-lorenzo@google.com \
--to=lorenzo@google.com \
--cc=davem@davemloft.net \
--cc=ek@google.com \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=zenczykowski@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).