netstack: only do connected TCP S/R for loopback connections.

PiperOrigin-RevId: 204006237
Change-Id: Ica8402ab54d9dd7d11cc41c6d74aacef51d140b7

pkg/tcpip/link/loopback/loopback.go

@@ -56,7 +56,7 @@ func (*endpoint) MTU() uint32 {
 // Capabilities implements stack.LinkEndpoint.Capabilities. Loopback advertises
 // itself as supporting checksum offload, but in reality it's just omitted.
 func (*endpoint) Capabilities() stack.LinkEndpointCapabilities {
-	return stack.CapabilityChecksumOffload
+	return stack.CapabilityChecksumOffload | stack.CapabilitySaveRestore
 }
 
 // MaxHeaderLength implements stack.LinkEndpoint.MaxHeaderLength. Given that the

pkg/tcpip/stack/registration.go

@@ -201,6 +201,7 @@ type LinkEndpointCapabilities uint
 const (
 	CapabilityChecksumOffload LinkEndpointCapabilities = 1 << iota
 	CapabilityResolutionRequired
+	CapabilitySaveRestore
 )
 
 // LinkEndpoint is the interface implemented by data link layer protocols (e.g.,

pkg/tcpip/transport/tcp/endpoint_state.go

@@ -50,11 +50,16 @@ func (e *endpoint) beforeSave() {
 
 	switch e.state {
 	case stateInitial, stateBound:
-	case stateListen, stateConnecting, stateConnected:
-		if e.state == stateConnected && !e.workerRunning {
+	case stateConnected:
+		if e.route.Capabilities()&stack.CapabilitySaveRestore == 0 {
+			panic(tcpip.ErrSaveRejection{fmt.Errorf("endpoint cannot be saved in connected state: local %v:%d, remote %v:%d", e.id.LocalAddress, e.id.LocalPort, e.id.RemoteAddress, e.id.RemotePort)})
+		}
+		if !e.workerRunning {
 			// The endpoint must be in acceptedChan.
 			break
 		}
+		fallthrough
+	case stateListen, stateConnecting:
 		e.drainSegmentLocked()
 		if e.state != stateClosed && e.state != stateError {
 			if !e.workerRunning {