summaryrefslogtreecommitdiffhomepage
path: root/pkg/tcpip
AgeCommit message (Collapse)Author
2021-10-01Drop IPTables.checkPacketsGhanan Gowripalan
...and have `CheckOutputPackets`, `CheckPostroutingPackets` call their equivalent methods that operate on a single packet buffer directly. This is so that the `Check{Output, Postrouting}Packets` methods may leverage any hook-specific work that `Check{Output, Postrouting}` may perform. Note: Later changes will add hook-specific logic to the `Check{Output, Postrouting}` methods. PiperOrigin-RevId: 400255651
2021-10-01Merge release-20210921.0-51-g807337000 (automated)gVisor bot
2021-10-01Let connection handle tracked packetsGhanan Gowripalan
...to save a call to `ConnTrack.connFor` when callers already have a reference to the ConnTrack entry. PiperOrigin-RevId: 400244955
2021-10-01Merge release-20210921.0-48-g0db2ab932 (automated)gVisor bot
2021-10-01Move pendingEndpoints to acceptQueueTamir Duberstein
This obsoletes the need for the pendingMu and pending, since they are redundant with acceptMu and pendingAccepted. Fixes #6671. PiperOrigin-RevId: 400162391
2021-09-29Merge release-20210921.0-42-gf4340b0c9 (automated)gVisor bot
2021-09-29Avoid comparisons to zero value of acceptQueueTamir Duberstein
PiperOrigin-RevId: 399765414
2021-09-29Merge release-20210921.0-41-g36b36a8a7 (automated)gVisor bot
2021-09-29Rename accepted -> acceptQueueTamir Duberstein
Rename cap -> capacity to avoid collision with the builtin. PiperOrigin-RevId: 399753630
2021-09-29Merge release-20210921.0-40-g5aa37994c (automated)gVisor bot
2021-09-29Remove syncRcvdCountTamir Duberstein
This is redundant with listenContext.pendingEndpoints PiperOrigin-RevId: 399722472
2021-09-28Merge release-20210921.0-38-gfa4c30c63 (automated)gVisor bot
2021-09-28Inline handleSynSegmentTamir Duberstein
This function has only one caller. Remove segment reference count manipulation since it is only used synchronously. PiperOrigin-RevId: 399525343
2021-09-28Merge release-20210921.0-37-ged083bac4 (automated)gVisor bot
2021-09-28Support naive Masquerade NAT targetGhanan Gowripalan
* Does not accept a port range (Issue #5772). * Does not support checking for tuple conflits (Issue #5773). PiperOrigin-RevId: 399524088
2021-09-27Merge release-20210921.0-35-gdc64617d5 (automated)gVisor bot
2021-09-27Implement S/R for StatsTamir Duberstein
PiperOrigin-RevId: 399276940
2021-09-27Merge release-20210921.0-34-g1fe0a6691 (automated)gVisor bot
2021-09-27Prevent PacketData from being modified.Ayush Ranjan
PacketData should not be modified and should be treated readonly because it represents packet payload. The old DeleteFront method allowed callers to modify the underlying buffer which should not be allowed. Added a way to consume from the PacketData instead of deleting from it. Updated call points to use that instead. Reported-by: syzbot+faee5cb350f769a52d1b@syzkaller.appspotmail.com PiperOrigin-RevId: 399268473
2021-09-27Merge release-20210921.0-33-g455924ee1 (automated)gVisor bot
2021-09-27Store pending endpoints in a setTamir Duberstein
There's no need for synthetic keys here. PiperOrigin-RevId: 399263134
2021-09-23Merge release-20210921.0-20-g8627db006 (automated)gVisor bot
2021-09-23Pass AddressableEndpoint to IPTablesGhanan Gowripalan
...instead of an address. This allows a later change to more precisely select an address based on the NAT type (source vs. destination NAT). PiperOrigin-RevId: 398559901
2021-09-23Merge release-20210921.0-19-g1df5ad1c7 (automated)gVisor bot
2021-09-23Implement S/R for TransportEndpointStatsTamir Duberstein
PiperOrigin-RevId: 398559780
2021-09-23Merge release-20210921.0-18-g2e4f26ac5 (automated)gVisor bot
2021-09-23Compose ICMP endpoint with datagram-based endpointGhanan Gowripalan
An ICMP endpoint's write path can use the datagram-based endpoint. Updates #6565. Test: Datagram-based generic socket + ICMP/ping syscall tests. PiperOrigin-RevId: 398539844
2021-09-23Merge release-20210921.0-17-gd480289ad (automated)gVisor bot
2021-09-23Introduce method per iptables hookGhanan Gowripalan
...to make it clear what arguments are needed per hook. PiperOrigin-RevId: 398538776
2021-09-23Merge release-20210921.0-16-g603de33b7 (automated)gVisor bot
2021-09-23Avoid listenContext.listenEP when it is the receiverTamir Duberstein
This circular reference is misleading at best, and the various code and commentary that claim `listenEP` can be nil are impossible by definition. Add checklocks annotations to enforce preconditions. PiperOrigin-RevId: 398517574
2021-09-23Merge release-20210921.0-12-gd87725451 (automated)gVisor bot
2021-09-22Track UDP connectionsGhanan Gowripalan
This will enable NAT to be performed on UDP packets that are sent in response to packets sent by the stack. This will also enable ICMP errors to be properly NAT-ed in response to UDP packets (#5916). Updates #5915. PiperOrigin-RevId: 398373251
2021-09-22Fold rcv_test into tcp_testTamir Duberstein
This prevents go module errors of the form found packages tcp (accept.go) and rcv (rcv_test.go) in ... PiperOrigin-RevId: 398370042
2021-09-22Merge release-20210906.0-59-g586f147cd (automated)gVisor bot
2021-09-22Do not rate limit ICMP Echos by defaultBruno Dal Bo
As per https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt linux does not limit ICMP Echos by default. icmp_ratemask - INTEGER Mask made of ICMP types for which rates are being limited. Significant bits: IHGFEDCBA9876543210 Default mask: 0000001100000011000 (6168) Bit definitions (see include/linux/icmp.h): 0 Echo Reply 3 Destination Unreachable * 4 Source Quench * 5 Redirect 8 Echo Request B Time Exceeded * C Parameter Problem * D Timestamp Request E Timestamp Reply F Info Request G Info Reply H Address Mask Request I Address Mask Reply * These are rate limited by default (see default mask above) Equivalently for ICMPv6. Lay out foundation for ICMP rate masks, exposing that configuration will be addressed later when the need arises (#6521). Fixes #6519 PiperOrigin-RevId: 398337963
2021-09-22Merge release-20210906.0-57-g5768a147b (automated)gVisor bot
2021-09-22Populate forwarded packet buffer's TransportHeaderGhanan Gowripalan
Turns out certain features of iptables (e.g. NAT) will not perform any checks/work unless both the Network and Transport headers are populated. With this change, provide the packet directly to the outgoing network endpoint's `writePacket` method instead of going through `WriteHeaderIncludedPacket` which expected the headers to not be set. PiperOrigin-RevId: 398304004
2021-09-22Merge release-20210906.0-55-g0ed53e5e9 (automated)gVisor bot
2021-09-21Handle Shutdown on connecting tcp socketArthur Sfez
Fixes #6495 PiperOrigin-RevId: 398121921
2021-09-21Merge release-20210906.0-54-gc633a7f9d (automated)gVisor bot
2021-09-21Deliver endpoints to the accept queue synchronously when possibleArthur Sfez
Before this change, when a new connection was created after receiving an ACK that matched a SYN-cookie, it was always delivered asynchronously to the accept queue. There was a chance that the listening endpoint would process a SYN from another client before the delivery happened, and the listening endpoint would not know yet that the queue was about to be full, once the delivery happened. Now, when an ACK matching a SYN-cookie is received, the new endpoint is created and moved to the accept queue synchronously, while holding the accept lock. Fixes #6545 PiperOrigin-RevId: 398107254
2021-09-21Merge release-20210906.0-50-g3fe8d7ecf (automated)gVisor bot
2021-09-20Support getsockname for packet socketsGhanan Gowripalan
Updates #6621 PiperOrigin-RevId: 397898852
2021-09-20Merge release-20210906.0-48-g5951ec5bc (automated)gVisor bot
2021-09-20Do not allow unbinding network protocolGhanan Gowripalan
Once a packet socket is bound to a network protocol, it cannot be unbound from that protocol; the network protocol binding may only be updated to a different network protocol. To comply with Linux. PiperOrigin-RevId: 397810878
2021-09-19Merge release-20210906.0-46-g89a0011c1 (automated)gVisor bot
2021-09-19Support IPV6_RECVPKTINFO on UDP socketsGhanan Gowripalan
PiperOrigin-RevId: 397631833
2021-09-18Merge release-20210906.0-45-g09477db2b (automated)gVisor bot
2021-09-18Avoid ambient clock on ICMP Rate LimiterBruno Dal Bo
PiperOrigin-RevId: 397496920
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-02 23:21:57 +0000