From 70dc6ea4ceb3f8fe153f5b37a3cd48ff20986743 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Thu, 5 Dec 2024 09:41:42 -0800
Subject: [PATCH] netstack: re-enable checkescape

This was enabled in cl/452137751 and accidentally turned back off in
cl/479437464 (probably me messing up a rebase).

PiperOrigin-RevId: 703146788
---
 pkg/tcpip/stack/iptables.go | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkg/tcpip/stack/iptables.go b/pkg/tcpip/stack/iptables.go
index a28ea90cc..c80b299fb 100644
--- a/pkg/tcpip/stack/iptables.go
+++ b/pkg/tcpip/stack/iptables.go
@@ -335,9 +335,9 @@ func (it *IPTables) shouldSkipOrPopulateTables(tables []checkTable, pkt *PacketB
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
+// +checkescape
 func (it *IPTables) CheckPrerouting(pkt *PacketBuffer, addressEP AddressableEndpoint, inNicName string) bool {
-	tables := [...]checkTable{
+	tables := [...]checkTable{ // escapes: on arm this causes an allocation.
 		{
 			fn:      check,
 			tableID: MangleID,
@@ -373,9 +373,9 @@ func (it *IPTables) CheckPrerouting(pkt *PacketBuffer, addressEP AddressableEndp
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
+// +checkescape
 func (it *IPTables) CheckInput(pkt *PacketBuffer, inNicName string) bool {
-	tables := [...]checkTable{
+	tables := [...]checkTable{ // escapes: on arm this causes an allocation.
 		{
 			fn:      checkNAT,
 			tableID: NATID,
@@ -413,9 +413,9 @@ func (it *IPTables) CheckInput(pkt *PacketBuffer, inNicName string) bool {
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
+// +checkescape
 func (it *IPTables) CheckForward(pkt *PacketBuffer, inNicName, outNicName string) bool {
-	tables := [...]checkTable{
+	tables := [...]checkTable{ // escapes: on arm this causes an allocation.
 		{
 			fn:      check,
 			tableID: FilterID,
@@ -445,9 +445,9 @@ func (it *IPTables) CheckForward(pkt *PacketBuffer, inNicName, outNicName string
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
+// +checkescape
 func (it *IPTables) CheckOutput(pkt *PacketBuffer, r *Route, outNicName string) bool {
-	tables := [...]checkTable{
+	tables := [...]checkTable{ // escapes: on arm this causes an allocation.
 		{
 			fn:      check,
 			tableID: MangleID,
@@ -489,9 +489,9 @@ func (it *IPTables) CheckOutput(pkt *PacketBuffer, r *Route, outNicName string)
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
+// +checkescape
 func (it *IPTables) CheckPostrouting(pkt *PacketBuffer, r *Route, addressEP AddressableEndpoint, outNicName string) bool {
-	tables := [...]checkTable{
+	tables := [...]checkTable{ // escapes: on arm this causes an allocation.
 		{
 			fn:      check,
 			tableID: MangleID,