netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Describe what iptables checkescape covers specifically

Browse Source 
PiperOrigin-RevId: 448037248
This commit is contained in:
Kevin Krakauer
2022-05-11 11:07:54 -07:00
committed by gVisor bot
parent 3f44cd556b
commit 9bc06340b2
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tcpip/stack/iptables.go
+5 -2
View File
@@ -275,8 +275,11 @@ type checkTable struct {
// specified table.
//
// This is called in the hot path even when iptables are disabled, so we ensure
// it does not allocate.
// +checkescape:heap,builtin
// it does not allocate. We check recursively for heap allocations, but not for:
// - Stack splitting, which can allocate.
// - Calls to interfaces, which can allocate.
// - Calls to dynamic functions, which can allocate.
// +checkescape:hard
func (it *IPTables) shouldSkipOrPopulateTables(tables []checkTable, pkt *PacketBuffer) bool {
switch pkt.NetworkProtocolNumber {
case header.IPv4ProtocolNumber, header.IPv6ProtocolNumber: