blob: 9af6a675c3c2dba1722906ecd7e97a6a4d5a0f3d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
Session API
***********
Connection management algorithm basics
======================================
The Session core uses the normal auto-connect algorithm for selecting
which services will be connected or disconnected. That means only
Services with AutoConnect to set to true will be used. The Session
core will assign a connected Service to a Session if the Service
is matching the AllowedBearer filter.
By using the normal auto-connect algorithm, it is possible to
use the Session API and the Service API at the same time.
Session States and Transitions
==============================
There is only one state which is called Free Ride.
The Free Ride state means that a session will go online if a matching
service goes online without calling Service.Connect() itself. The idea
behind this is that a session doesn't request a connection for itself
instead waits until another session actively requires to go online.
This is comparable to piggy-backing.
Connnect()
+------+
| v
+------------+
| Free Ride |
+------------+
| ^
+-----+
Disconnect()
If an application wants to stay offline it can set an empty
AllowedBearers list.
Session application identification
==================================
Application using session can be identified through different means.
- SELinux
- UID
- GID
ConnMan will try to identify the application in the given order above.
If SELinux is not supported by the system or not configured, ConnMan
will ignore it and fallback asking the D-Bus daemon about the UID of
the application.
The identification is only useful in combination with the policy plugin.
Policy Plugin
=============
The policy plugin allows the administrator to provision/configure
sessions. Each policy needs an application identification in order to
match the policy to a session.
See session-policy-format.txt for more details.
Per application routing
=======================
For each session a policy routing table is maintained. Each policy
routing table contains a default route to the selected service.
Per session iptables rules:
iptables -t mangle -A OUTPUT -m owner [--uid-owner|--gid-owner] $OWNER \
-j MARK --set-mark $MARK
Global rules for all sessions:
iptables -t mangle -A INPUT -j CONNMARK --restore-mark
iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
Per application routing is only available when policy files are
used. Without the policy plugin or a valid configuration, the default
session configuration is applied.
The default session configuration does not enable the per application
routing. Sessions are still useful in this setup, because the
notification of sessions is still available, e.g. the online/offline
notification.
|
