diff options
| author | Kevin Krakauer <krakauer@google.com> | 2020-06-07 13:37:25 -0700 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-06-07 13:38:43 -0700 |
| commit | 32b823fcdb00a7d6eb5ddcd378f19a659edc3da3 (patch) | |
| tree | bed24f8b692caa0e24cd1351d22bb35522cbfe3e /pkg/tcpip/stack/iptables_targets.go | |
| parent | 62603041792021f654cfb3418e9a728220feaf60 (diff) | |
netstack: parse incoming packet headers up-front
Netstack has traditionally parsed headers on-demand as a packet moves up the
stack. This is conceptually simple and convenient, but incompatible with
iptables, where headers can be inspected and mangled before even a routing
decision is made.
This changes header parsing to happen early in the incoming packet path, as soon
as the NIC gets the packet from a link endpoint. Even if an invalid packet is
found (e.g. a TCP header of insufficient length), the packet is passed up the
stack for proper stats bookkeeping.
PiperOrigin-RevId: 315179302
Diffstat (limited to 'pkg/tcpip/stack/iptables_targets.go')
| -rw-r--r-- | pkg/tcpip/stack/iptables_targets.go | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/pkg/tcpip/stack/iptables_targets.go b/pkg/tcpip/stack/iptables_targets.go index 36cc6275d..92e31643e 100644 --- a/pkg/tcpip/stack/iptables_targets.go +++ b/pkg/tcpip/stack/iptables_targets.go @@ -98,11 +98,6 @@ func (rt RedirectTarget) Action(pkt *PacketBuffer, ct *ConnTrackTable, hook Hook return RuleAccept, 0 } - // Set network header. - if hook == Prerouting { - parseHeaders(pkt) - } - // Drop the packet if network and transport header are not set. if pkt.NetworkHeader == nil || pkt.TransportHeader == nil { return RuleDrop, 0 |