{"push_id":1430898320,"size":11,"distinct_size":11,"ref":"refs/heads/bpf-firewall","head":"779ad751cebf8c4ec819408711165ef967f019fb","before":"0063dbb6cb2e80df9a937b17ae4a342fc5a1c163","commits":[{"sha":"c9cb38415e64049584b7eec3d7683cec39bcfeee","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"configure, missing.h: check for new BPF types\n\nProvide own #defines in case the kernel headers are too old.","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/c9cb38415e64049584b7eec3d7683cec39bcfeee"},{"sha":"72238305b8889ec33673b9cd0a081de1b409eb36","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"Add abstraction model for BPF program\n\nThis object takes a number of bpf_insn members and wraps them together with\nthe in-kernel reference id. Will be needed by the firewall code.","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/72238305b8889ec33673b9cd0a081de1b409eb36"},{"sha":"0c1d9f8f3b18b5df4c414b97a20fa9108ea542c9","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"Add host access address representation and parser\n\nAdd a config directive parser that takes multiple space separated IPv4\nor IPv6 addresses with optional netmasks in CIDR notation rvalue and\nputs a parsed version of it to linked list of HostsAccessAddress objects.\nThe code actually using this will be added later.","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/0c1d9f8f3b18b5df4c414b97a20fa9108ea542c9"},{"sha":"3e413bfe5c366d404c75328058edfece4a5f9836","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"cgroup: add fields to accommodate eBPF related details\n\nAdd pointers for compiled eBPF programs as well as list heads for allowed\nand denied hosts for both directions.","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/3e413bfe5c366d404c75328058edfece4a5f9836"},{"sha":"6fa0c13926767de831b5a7a91f4b02f34494e0d3","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"Add firewall eBPF compiler","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/6fa0c13926767de831b5a7a91f4b02f34494e0d3"},{"sha":"067c83cd31c355d563b0f26f875499bc21fc6d1d","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"cgroup, unit, fragment parser: make use of new firewall functions\n\n* Map \"IPAccounting\" and \"IPHosts{Allow,Deny}{In,E}gress\" directives in\n  config file sections for cgroup contexts.\n\n* Expose network byte counters via D-Bus\n\n* Set up firewall before starting services","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/067c83cd31c355d563b0f26f875499bc21fc6d1d"},{"sha":"a67f84ce72db597c4fa8f2ab799f7169905a9b08","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"manager: hook up IP accounting defaults","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/a67f84ce72db597c4fa8f2ab799f7169905a9b08"},{"sha":"33f20549d6fc82f4890eca841351c6d795653791","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"systemctl: report accounted network traffic in \"systemctl status\"\n\nThis hooks up the eposed D-Bus values and displays them like this:\n\n-bash-4.3# systemctl status httpd\n● httpd.service - The Apache HTTP Server\n   Loaded: loaded (/etc/systemd/system/httpd.service; enabled; vendor preset: disabled)\n   Active: active (running) since Fri 2016-11-11 20:10:36 CET; 1min 29s ago\n Main PID: 33 (httpd)\n   Status: \"Total requests: 22514; Idle/Busy workers 92/7;Requests/sec: 259; Bytes served/sec:  87KB/sec\"\n  Network: 15.8M in, 51.1M out\n  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n   CGroup: /system.slice/httpd.service\n           ├─ 33 /usr/sbin/httpd -DFOREGROUND\n           ├─ 37 /usr/sbin/httpd -DFOREGROUND\n           ├─112 /usr/sbin/httpd -DFOREGROUND\n           └─119 /usr/sbin/httpd -DFOREGROUND","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/33f20549d6fc82f4890eca841351c6d795653791"},{"sha":"f15c29efbfde186571954fc34b11b23a236d019e","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"man: document the new ip accounting and filting directives","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/f15c29efbfde186571954fc34b11b23a236d019e"},{"sha":"9c2a553fbd1b07669200f59c324cab7c99fd4250","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"Add test for eBPF firewall code","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/9c2a553fbd1b07669200f59c324cab7c99fd4250"},{"sha":"779ad751cebf8c4ec819408711165ef967f019fb","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"nspawn: allow bpf syscall usage from inside the container\n\nThis allows containers to install own eBPF programs and attach them to its\ncgroups.","distinct":true,"url":"https://api.github.com/repos/zonque/systemd/commits/779ad751cebf8c4ec819408711165ef967f019fb"}]}
{"actor":{"display_login":"zonque"}}