SecondaryTableController: force the MSS to match pmtu on TCP SYN

Without this change, the VPN sets up a tun/ppp that needs a small
MTU, and during TCP SYN the MSS will end up matching the outgoing iface
MTU which is potentially too big.
This leads to connection flakiness. The wrong MSS is visible by
tcpdump-ing on the tun/ppp device.

With this change, the MSS now is correct.
It requires the kernel to be configured with
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
If kernel is not configured, it silently fails.

Bug: 11579326
Change-Id: I254d8c39435b92dff91931e461e1efb8b35f6b1e
Mark uids without rules with PROTECT_MARK

The default result for a uid without a mark should be MARK_PROTECT
because the service using the uid's mark may be covered by a VPN that
should not cover the user it is acting for.

Bug: 12608570
Change-Id: I2402cb86ddb2fe6e670d1793263ff6c2c31d32fe
Move VPN routing decisions from iptables to ip

Routes are now encoded by ip rules that send connections to the Vpn
table if the connection is marked and the destination falls into a
route. This differs from the previous design where a mark meant that
the connection must go over the VPN, now a mark simply means that it
may.
Bug: 12549060
Change-Id: I9be7e27a0f46858f109d8bc5c5bced309b05201a
Update clearifaceforuidrange to take the interface

resolv's uid range=>iface map now allows overlap in uid ranges to support
simultaneous tuns. _resolv_clear_iface_for_uid_range now takes the
interface to support removing only one of the rules.

Bug: 12134439
Change-Id: I3e2a167875bbd381846d5c47d7b34c625abfb2e0
Allow overlap in UidMarkMap

To support simultaneous tuns UidMarkMap now allows for
overlaping/duplicate rules. If there are multiple rules for a given uid
the most recently added rule will be used in all cases.

When overlapping rules are added in addUidRule there may be multiple
iptables rules matching the uid. Since addUidRule appends it will use
the most recent rule as well, no change required. Previously
UidMarkMap->add would fail and the rule would never be added.

Bug: 12134439
Change-Id: I5f2976dd3ee334584a9f98f6eacd5edbe5c9bb6b
Merge "Update clearifaceforuidrange to take the interface" into klp-dev
Merge "Allow overlap in UidMarkMap" into klp-dev
Merge "Move VPN routing decisions from iptables to ip" into klp-dev
Merge tag 'android-4.4.3_r1' into HEAD

Android 4.4.3 release 1
Squashed revert of SoftapControllerTI changes

Revert "SoftapControllerTI: update parameters for setSoftap"

This reverts commit 6d68d652b12595e843af1f3e6077dbd34d329bbf.

Change-Id: I5af1404d56133267fff546a14a8d9a18e1b33eeb

Revert "netd: Enabling softAP/Hotspot for TI solution"

This reverts commit f939d82f6ea1eab3fcc18a273c0d654ceed3ad1e.

Change-Id: I6871ceac9f36fb82e674e16efdac97ae1cb9891a
netd: Don't reload fw if a single fw is supported

TI's mac80211 solution uses only a single fw,
so return immediately in case of fwreload command.

Change-Id: I4157d50a3c29a0053caf099f51bb78077d16af17
Signed-off-by: Eliad Peller <eliad@wizery.com>
Don't choke if IPv6 rules fail.

On networks with a low MTU, these IPv6 commands may fail because v6 requires a
minimum MTU of 1280. Ignore the failures, since these networks are clearly meant
to be IPv4 only.

Bug: 15466895
Change-Id: Ie8f24f6e7a316633fb60661a07a3e715b6ab6add