Currently, when a packet hits the NAT table and does not hit any NAT targets,
its connection is assigned "no-op NAT", which basically means that the
connection will not be NATed. However, this causes a problem when, for example,
locally-generated traffic chooses a local port that has already been used by
forwarded traffic that the stack is NATing. In this case, the locally-generated
traffic will simply be dropped when the connection is finalized due to a tuple
conflict.
Instead of doing nothing, the netstack must implicitly perform SNAT for the
locally-generated traffic to remap its source port to prevent that traffic from
being dropped.
Also, when setting up NAT for a connection, the netstack checks if the
connections' reply tuple is unique to see whether it needs to rewrite the
transport-layer port/ID. This logic currently doesn't account for self-connected
sockets, where the original and reply tuples are identical and point to the same
connection; add logic handling that scenario, such that the reply tuple can be
non-unique if it refers to the same connection as the original tuple.
PiperOrigin-RevId: 612969884
... instead of depending on a flag.
In most cases the NAT table is in an all-ACCEPT default state:
```
root@5a7ce3a6c623:/# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
```
In such cases we leave iptables off in the sandbox as a performance
optimization.
But when the table contains anything else, we now install those rules inside
the sandbox.
Turns out packetdrill installes a rule, so support for that rules is also added
in this CL.
PiperOrigin-RevId: 580051079
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.
Signed-off-by: Andrei Vagin <avagin@gmail.com>
tcp_benchmark throughput increase 2-3%, but allocations go down (25% in the
download benchmark, only 2% in the upload path).
PiperOrigin-RevId: 532523146
The important change here is in tcpip/tcpip.go, where tcpip.Address is defined.
The rest is updating uses of tcpip.Address.
This is preparation for netip.Addr or []byte based addresses, which should save
us a bunch of allocations. Currently, we allocate every time we want to, say,
get a tcpip.Address from a header. This is because the header is a byte slice,
but Address is a string. Strings are immutable, so Go allocates and copies.
PiperOrigin-RevId: 532284732
This is effectively a rollback of cl/450976957. The original motivation never
panned out, and it's easier to work with the lists. They also are easier to
avoid allocations with.
PiperOrigin-RevId: 531020857
...by only sending one packet.
The stack does not guard against re-ordering and the test asserted on a
specific order of packets so only send one packet.
Note that this test does not need to send two packets so only sending
one is fine to test link resolution.
PiperOrigin-RevId: 514852179
...by making sure all endpoints created by the test is properly closed
before the test fn returns. Previously, the listener endpoint was not.
PiperOrigin-RevId: 512129775
...by not assuming that the NUD event is available immediately after
receiving the readable signal from the TCP endpoint. The readable
signal may be triggered before the NUD event is sent.
PiperOrigin-RevId: 512120289
mointorableEndpoint was flaking because of a race between the
pending packet from the failed write and the new write. We don't
actually need the new write to show that link resolution worked.
PiperOrigin-RevId: 502699348
This change introduces support for MLDv2/IGMPv3. Note that this change
does not yet introduce APIs to perform source filtering so SSM is not
yet supported. Also note that this change does not yet coalesce records
in a report as that will come in a follow-up.
Updates #8346
PiperOrigin-RevId: 501336347
