joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

netd.c - only check clat uid on egress

Browse source 
On ingress:
(a) the socket is not a normal socket (it's AF_PACKET)
    and thus (likely) doesn't hit this code path
    [if it did... we'd have double or more accounting
    of any traffic captured by AF_PACKET sockets,
    I haven't checked - but I assume that doesn't happen]
(b) is created by the system server (so not AID_CLAT)
(c) is not tagged by the system server (so not AID_CLAT)

So this is a no-op, but it simplifies the bpf program,
since 'egress' is a compile time evaluated constant.

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iec693548789eb2752f9f30038e72e35c876f986c
This commit is contained in:
Maciej Żenczykowski 2023-08-29 15:00:01 +00:00
commit fca4ee4f08
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
bpf_progs/netd.c
View file

@ -413,7 +413,8 @@ static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, boo
// Always allow and never count clat traffic. Only the IPv4 traffic on the stacked
// interface is accounted for and subject to usage restrictions.
// CLAT IPv6 TX sockets are *always* tagged with CLAT uid, see tagSocketAsClat()
if (uid == AID_CLAT) return PASS;
// CLAT daemon receives via an untagged AF_PACKET socket.
if (egress && uid == AID_CLAT) return PASS;
int match = bpf_owner_match(skb, sock_uid, egress, kver);