Catch tcpip.ErrClosedForSend errors while forwarding. This may occur if
an endpoint is being shutdown at the same time as it's being used to
forward a packet.
PiperOrigin-RevId: 695452542
Support for multicast forwarding was finished by nahurley@google.com in
commit 7d3a75fa60. These TODOs are no
longer applicable and can be removed
Updates #7338
PiperOrigin-RevId: 650748952
Marks the structs in netstack as savable. This does not change or break any
existing behavior as the netstack itself is not savable yet.
PiperOrigin-RevId: 635943481
This new method allows checking for the existence of assigned addresses without
taking an extra reference that needs to be DecRefed. DecRef takes exclusive
locks. Contention on the addressState lock causes performance issues when
multiple goroutines are processing IP packets simultaneously. This isn't the
case today since IP processing is single threaded, but will be eventually.
PiperOrigin-RevId: 623567408
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.
The fragement ID generation for IPv6 is changed to return a completely random
uint32 number.
PiperOrigin-RevId: 581364034
... instead of depending on a flag.
In most cases the NAT table is in an all-ACCEPT default state:
```
root@5a7ce3a6c623:/# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
```
In such cases we leave iptables off in the sandbox as a performance
optimization.
But when the table contains anything else, we now install those rules inside
the sandbox.
Turns out packetdrill installes a rule, so support for that rules is also added
in this CL.
PiperOrigin-RevId: 580051079
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.
Also:
- Add a secure RNG type to prevent mixing up with the default PRNG
- Give the PRNG the name `InsecureRNG` to make it more obvious to future
contributors that some RNGs are inappropriate in certain instances.
- Some tests were injecting fake RNGs and had to be relaxed: they relied on the
stack calling the RNG a specific number of times and in a specific order.
That order is now changed, and is too brittle to unit test.
- Remove the double package comment in pkg/rand. The linter complains.
PiperOrigin-RevId: 577513723
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.
Signed-off-by: Andrei Vagin <avagin@gmail.com>
Lucas ManningandgVisor bot
Jeff MartinandgVisor bot
Koichi Shiraishi
Tony GongandgVisor bot
Andrei VaginandgVisor bot
Nayana BidariandgVisor bot
Andrei Vagin
Kevin KrakauerandgVisor bot
Christopher KochandgVisor bot