Catch tcpip.ErrClosedForSend errors while forwarding. This may occur if
an endpoint is being shutdown at the same time as it's being used to
forward a packet.
PiperOrigin-RevId: 695452542
Martian packets are dropped by default, but some setups require accepting them.
A rate limited log will help users quickly hone in on the issue, which is
otherwise unclear and time-consuming to debug.
PiperOrigin-RevId: 693487838
Support for multicast forwarding was finished by nahurley@google.com in
commit 7d3a75fa60. These TODOs are no
longer applicable and can be removed
Updates #7338
PiperOrigin-RevId: 650748952
Marks the structs in netstack as savable. This does not change or break any
existing behavior as the netstack itself is not savable yet.
PiperOrigin-RevId: 635943481
This new method allows checking for the existence of assigned addresses without
taking an extra reference that needs to be DecRefed. DecRef takes exclusive
locks. Contention on the addressState lock causes performance issues when
multiple goroutines are processing IP packets simultaneously. This isn't the
case today since IP processing is single threaded, but will be eventually.
PiperOrigin-RevId: 623567408
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.
The ID generation for IPv4 is changed to return a completely random number.
PiperOrigin-RevId: 587102343
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.
Update the IPv4 ID generation algorithm by incrementing the hash value with a
random number rather than incrementing it by 1 everytime.
PiperOrigin-RevId: 582753591
... instead of depending on a flag.
In most cases the NAT table is in an all-ACCEPT default state:
```
root@5a7ce3a6c623:/# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
```
In such cases we leave iptables off in the sandbox as a performance
optimization.
But when the table contains anything else, we now install those rules inside
the sandbox.
Turns out packetdrill installes a rule, so support for that rules is also added
in this CL.
PiperOrigin-RevId: 580051079
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.
Also:
- Add a secure RNG type to prevent mixing up with the default PRNG
- Give the PRNG the name `InsecureRNG` to make it more obvious to future
contributors that some RNGs are inappropriate in certain instances.
- Some tests were injecting fake RNGs and had to be relaxed: they relied on the
stack calling the RNG a specific number of times and in a specific order.
That order is now changed, and is too brittle to unit test.
- Remove the double package comment in pkg/rand. The linter complains.
PiperOrigin-RevId: 577513723
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.
Signed-off-by: Andrei Vagin <avagin@gmail.com>
The underlying chunks returned from PullUp should not be shared,
since the underlying slice can sometimes be directly modified. This change
also reworks some of the network parsing code so that ownership of
views is more explicit to the reader.
PiperOrigin-RevId: 538230394
