2020-07-30 20:28:21 +00:00
|
|
|
// Copyright 2020 The gVisor Authors.
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package stack
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"sync"
|
2020-11-03 03:18:28 +00:00
|
|
|
"time"
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip"
|
2020-09-29 07:18:37 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/header"
|
2020-07-30 20:28:21 +00:00
|
|
|
)
|
|
|
|
|
2020-11-03 03:18:28 +00:00
|
|
|
const (
|
|
|
|
// immediateDuration is a duration of zero for scheduling work that needs to
|
|
|
|
// be done immediately but asynchronously to avoid deadlock.
|
|
|
|
immediateDuration time.Duration = 0
|
|
|
|
)
|
|
|
|
|
2020-07-30 20:28:21 +00:00
|
|
|
// NeighborEntry describes a neighboring device in the local network.
|
|
|
|
type NeighborEntry struct {
|
2020-10-28 19:59:27 +00:00
|
|
|
Addr tcpip.Address
|
|
|
|
LinkAddr tcpip.LinkAddress
|
|
|
|
State NeighborState
|
|
|
|
UpdatedAtNanos int64
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// NeighborState defines the state of a NeighborEntry within the Neighbor
|
|
|
|
// Unreachability Detection state machine, as per RFC 4861 section 7.3.2.
|
|
|
|
type NeighborState uint8
|
|
|
|
|
|
|
|
const (
|
|
|
|
// Unknown means reachability has not been verified yet. This is the initial
|
|
|
|
// state of entries that have been created automatically by the Neighbor
|
|
|
|
// Unreachability Detection state machine.
|
|
|
|
Unknown NeighborState = iota
|
|
|
|
// Incomplete means that there is an outstanding request to resolve the
|
|
|
|
// address.
|
|
|
|
Incomplete
|
|
|
|
// Reachable means the path to the neighbor is functioning properly for both
|
|
|
|
// receive and transmit paths.
|
|
|
|
Reachable
|
|
|
|
// Stale means reachability to the neighbor is unknown, but packets are still
|
|
|
|
// able to be transmitted to the possibly stale link address.
|
|
|
|
Stale
|
|
|
|
// Delay means reachability to the neighbor is unknown and pending
|
|
|
|
// confirmation from an upper-level protocol like TCP, but packets are still
|
|
|
|
// able to be transmitted to the possibly stale link address.
|
|
|
|
Delay
|
|
|
|
// Probe means a reachability confirmation is actively being sought by
|
|
|
|
// periodically retransmitting reachability probes until a reachability
|
|
|
|
// confirmation is received, or until the max amount of probes has been sent.
|
|
|
|
Probe
|
|
|
|
// Static describes entries that have been explicitly added by the user. They
|
|
|
|
// do not expire and are not deleted until explicitly removed.
|
|
|
|
Static
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// Failed means recent attempts of reachability have returned inconclusive.
|
2020-07-30 20:28:21 +00:00
|
|
|
Failed
|
|
|
|
)
|
|
|
|
|
|
|
|
// neighborEntry implements a neighbor entry's individual node behavior, as per
|
|
|
|
// RFC 4861 section 7.3.3. Neighbor Unreachability Detection operates in
|
|
|
|
// parallel with the sending of packets to a neighbor, necessitating the
|
|
|
|
// entry's lock to be acquired for all operations.
|
|
|
|
type neighborEntry struct {
|
|
|
|
neighborEntryEntry
|
|
|
|
|
2020-09-24 00:13:32 +00:00
|
|
|
nic *NIC
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
// linkRes provides the functionality to send reachability probes, used in
|
|
|
|
// Neighbor Unreachability Detection.
|
|
|
|
linkRes LinkAddressResolver
|
|
|
|
|
|
|
|
// nudState points to the Neighbor Unreachability Detection configuration.
|
|
|
|
nudState *NUDState
|
|
|
|
|
|
|
|
// mu protects the fields below.
|
|
|
|
mu sync.RWMutex
|
|
|
|
|
|
|
|
neigh NeighborEntry
|
|
|
|
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// done is closed when address resolution is complete. It is nil iff s is
|
|
|
|
// incomplete and resolution is not yet in progress.
|
2020-07-30 20:28:21 +00:00
|
|
|
done chan struct{}
|
|
|
|
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// onResolve is called with the result of address resolution.
|
|
|
|
onResolve []func(tcpip.LinkAddress, bool)
|
|
|
|
|
2020-07-30 20:28:21 +00:00
|
|
|
isRouter bool
|
|
|
|
job *tcpip.Job
|
|
|
|
}
|
|
|
|
|
|
|
|
// newNeighborEntry creates a neighbor cache entry starting at the default
|
|
|
|
// state, Unknown. Transition out of Unknown by calling either
|
|
|
|
// `handlePacketQueuedLocked` or `handleProbeLocked` on the newly created
|
|
|
|
// neighborEntry.
|
2020-10-23 17:29:46 +00:00
|
|
|
func newNeighborEntry(nic *NIC, remoteAddr tcpip.Address, nudState *NUDState, linkRes LinkAddressResolver) *neighborEntry {
|
2020-07-30 20:28:21 +00:00
|
|
|
return &neighborEntry{
|
|
|
|
nic: nic,
|
|
|
|
linkRes: linkRes,
|
|
|
|
nudState: nudState,
|
|
|
|
neigh: NeighborEntry{
|
2020-10-23 17:29:46 +00:00
|
|
|
Addr: remoteAddr,
|
|
|
|
State: Unknown,
|
2020-07-30 20:28:21 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-10-27 22:43:08 +00:00
|
|
|
// newStaticNeighborEntry creates a neighbor cache entry starting at the
|
|
|
|
// Static state. The entry can only transition out of Static by directly
|
|
|
|
// calling `setStateLocked`.
|
2020-07-30 20:28:21 +00:00
|
|
|
func newStaticNeighborEntry(nic *NIC, addr tcpip.Address, linkAddr tcpip.LinkAddress, state *NUDState) *neighborEntry {
|
2020-10-27 22:43:08 +00:00
|
|
|
entry := NeighborEntry{
|
2020-10-28 19:59:27 +00:00
|
|
|
Addr: addr,
|
|
|
|
LinkAddr: linkAddr,
|
|
|
|
State: Static,
|
|
|
|
UpdatedAtNanos: nic.stack.clock.NowNanoseconds(),
|
2020-10-27 22:43:08 +00:00
|
|
|
}
|
2020-07-30 20:28:21 +00:00
|
|
|
if nic.stack.nudDisp != nil {
|
2020-10-27 22:43:08 +00:00
|
|
|
nic.stack.nudDisp.OnNeighborAdded(nic.id, entry)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
return &neighborEntry{
|
|
|
|
nic: nic,
|
|
|
|
nudState: state,
|
2020-10-27 22:43:08 +00:00
|
|
|
neigh: entry,
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// notifyCompletionLocked notifies those waiting for address resolution, with
|
|
|
|
// the link address if resolution completed successfully.
|
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
|
|
|
func (e *neighborEntry) notifyCompletionLocked(succeeded bool) {
|
|
|
|
for _, callback := range e.onResolve {
|
|
|
|
callback(e.neigh.LinkAddr, succeeded)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
e.onResolve = nil
|
2020-07-30 20:28:21 +00:00
|
|
|
if ch := e.done; ch != nil {
|
|
|
|
close(ch)
|
|
|
|
e.done = nil
|
2021-01-22 00:37:35 +00:00
|
|
|
// Dequeue the pending packets in a new goroutine to not hold up the current
|
|
|
|
// goroutine as writing packets may be a costly operation.
|
|
|
|
//
|
|
|
|
// At the time of writing, when writing packets, a neighbor's link address
|
|
|
|
// is resolved (which ends up obtaining the entry's lock) while holding the
|
|
|
|
// link resolution queue's lock. Dequeuing packets in a new goroutine avoids
|
|
|
|
// a lock ordering violation.
|
|
|
|
go e.nic.linkResQueue.dequeue(ch, e.neigh.LinkAddr, succeeded)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// dispatchAddEventLocked signals to stack's NUD Dispatcher that the entry has
|
|
|
|
// been added.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-10-27 22:43:08 +00:00
|
|
|
func (e *neighborEntry) dispatchAddEventLocked() {
|
2020-07-30 20:28:21 +00:00
|
|
|
if nudDisp := e.nic.stack.nudDisp; nudDisp != nil {
|
2020-10-27 22:43:08 +00:00
|
|
|
nudDisp.OnNeighborAdded(e.nic.id, e.neigh)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// dispatchChangeEventLocked signals to stack's NUD Dispatcher that the entry
|
|
|
|
// has changed state or link-layer address.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-10-27 22:43:08 +00:00
|
|
|
func (e *neighborEntry) dispatchChangeEventLocked() {
|
2020-07-30 20:28:21 +00:00
|
|
|
if nudDisp := e.nic.stack.nudDisp; nudDisp != nil {
|
2020-10-27 22:43:08 +00:00
|
|
|
nudDisp.OnNeighborChanged(e.nic.id, e.neigh)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// dispatchRemoveEventLocked signals to stack's NUD Dispatcher that the entry
|
|
|
|
// has been removed.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-07-30 20:28:21 +00:00
|
|
|
func (e *neighborEntry) dispatchRemoveEventLocked() {
|
|
|
|
if nudDisp := e.nic.stack.nudDisp; nudDisp != nil {
|
2020-10-27 22:43:08 +00:00
|
|
|
nudDisp.OnNeighborRemoved(e.nic.id, e.neigh)
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// cancelJobLocked cancels the currently scheduled action, if there is one.
|
|
|
|
// Entries in Unknown, Stale, or Static state do not have a scheduled action.
|
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
|
|
|
func (e *neighborEntry) cancelJobLocked() {
|
|
|
|
if job := e.job; job != nil {
|
|
|
|
job.Cancel()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// removeLocked prepares the entry for removal.
|
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
|
|
|
func (e *neighborEntry) removeLocked() {
|
|
|
|
e.neigh.UpdatedAtNanos = e.nic.stack.clock.NowNanoseconds()
|
|
|
|
e.dispatchRemoveEventLocked()
|
|
|
|
e.cancelJobLocked()
|
|
|
|
e.notifyCompletionLocked(false /* succeeded */)
|
|
|
|
}
|
|
|
|
|
2020-07-30 20:28:21 +00:00
|
|
|
// setStateLocked transitions the entry to the specified state immediately.
|
|
|
|
//
|
|
|
|
// Follows the logic defined in RFC 4861 section 7.3.3.
|
|
|
|
//
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-07-30 20:28:21 +00:00
|
|
|
func (e *neighborEntry) setStateLocked(next NeighborState) {
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
e.cancelJobLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
prev := e.neigh.State
|
|
|
|
e.neigh.State = next
|
2020-10-28 19:59:27 +00:00
|
|
|
e.neigh.UpdatedAtNanos = e.nic.stack.clock.NowNanoseconds()
|
2020-07-30 20:28:21 +00:00
|
|
|
config := e.nudState.Config()
|
|
|
|
|
|
|
|
switch next {
|
|
|
|
case Incomplete:
|
2020-10-23 17:29:46 +00:00
|
|
|
panic(fmt.Sprintf("should never transition to Incomplete with setStateLocked; neigh = %#v, prev state = %s", e.neigh, prev))
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
case Reachable:
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, func() {
|
|
|
|
e.setStateLocked(Stale)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
})
|
|
|
|
e.job.Schedule(e.nudState.ReachableTime())
|
|
|
|
|
|
|
|
case Delay:
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, func() {
|
|
|
|
e.setStateLocked(Probe)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
})
|
|
|
|
e.job.Schedule(config.DelayFirstProbeTime)
|
|
|
|
|
|
|
|
case Probe:
|
|
|
|
var retryCounter uint32
|
|
|
|
var sendUnicastProbe func()
|
|
|
|
|
|
|
|
sendUnicastProbe = func() {
|
|
|
|
if retryCounter == config.MaxUnicastProbes {
|
|
|
|
e.dispatchRemoveEventLocked()
|
|
|
|
e.setStateLocked(Failed)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-10-23 17:29:46 +00:00
|
|
|
if err := e.linkRes.LinkAddressRequest(e.neigh.Addr, "" /* localAddr */, e.neigh.LinkAddr, e.nic); err != nil {
|
2020-07-30 20:28:21 +00:00
|
|
|
e.dispatchRemoveEventLocked()
|
|
|
|
e.setStateLocked(Failed)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
retryCounter++
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, sendUnicastProbe)
|
|
|
|
e.job.Schedule(config.RetransmitTimer)
|
|
|
|
}
|
|
|
|
|
2020-11-03 03:18:28 +00:00
|
|
|
// Send a probe in another gorountine to free this thread of execution
|
|
|
|
// for finishing the state transition. This is necessary to avoid
|
|
|
|
// deadlock where sending and processing probes are done synchronously,
|
|
|
|
// such as loopback and integration tests.
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, sendUnicastProbe)
|
|
|
|
e.job.Schedule(immediateDuration)
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
case Failed:
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
e.notifyCompletionLocked(false /* succeeded */)
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
case Unknown, Stale, Static:
|
|
|
|
// Do nothing
|
|
|
|
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid state transition from %q to %q", prev, next))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// handlePacketQueuedLocked advances the state machine according to a packet
|
|
|
|
// being queued for outgoing transmission.
|
|
|
|
//
|
|
|
|
// Follows the logic defined in RFC 4861 section 7.3.3.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-10-23 17:29:46 +00:00
|
|
|
func (e *neighborEntry) handlePacketQueuedLocked(localAddr tcpip.Address) {
|
2020-07-30 20:28:21 +00:00
|
|
|
switch e.neigh.State {
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
case Failed:
|
|
|
|
e.nic.stats.Neighbor.FailedEntryLookups.Increment()
|
|
|
|
|
|
|
|
fallthrough
|
2020-07-30 20:28:21 +00:00
|
|
|
case Unknown:
|
2020-10-23 17:29:46 +00:00
|
|
|
e.neigh.State = Incomplete
|
2020-10-28 19:59:27 +00:00
|
|
|
e.neigh.UpdatedAtNanos = e.nic.stack.clock.NowNanoseconds()
|
2020-10-27 22:43:08 +00:00
|
|
|
|
|
|
|
e.dispatchAddEventLocked()
|
|
|
|
|
2020-10-23 17:29:46 +00:00
|
|
|
config := e.nudState.Config()
|
|
|
|
|
|
|
|
var retryCounter uint32
|
|
|
|
var sendMulticastProbe func()
|
|
|
|
|
|
|
|
sendMulticastProbe = func() {
|
|
|
|
if retryCounter == config.MaxMulticastProbes {
|
|
|
|
// "If no Neighbor Advertisement is received after
|
|
|
|
// MAX_MULTICAST_SOLICIT solicitations, address resolution has failed.
|
|
|
|
// The sender MUST return ICMP destination unreachable indications with
|
|
|
|
// code 3 (Address Unreachable) for each packet queued awaiting address
|
|
|
|
// resolution." - RFC 4861 section 7.2.2
|
|
|
|
//
|
|
|
|
// There is no need to send an ICMP destination unreachable indication
|
|
|
|
// since the failure to resolve the address is expected to only occur
|
|
|
|
// on this node. Thus, redirecting traffic is currently not supported.
|
|
|
|
//
|
|
|
|
// "If the error occurs on a node other than the node originating the
|
|
|
|
// packet, an ICMP error message is generated. If the error occurs on
|
|
|
|
// the originating node, an implementation is not required to actually
|
|
|
|
// create and send an ICMP error packet to the source, as long as the
|
|
|
|
// upper-layer sender is notified through an appropriate mechanism
|
|
|
|
// (e.g. return value from a procedure call). Note, however, that an
|
|
|
|
// implementation may find it convenient in some cases to return errors
|
|
|
|
// to the sender by taking the offending packet, generating an ICMP
|
|
|
|
// error message, and then delivering it (locally) through the generic
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
// error-handling routines." - RFC 4861 section 2.1
|
2020-10-23 17:29:46 +00:00
|
|
|
e.dispatchRemoveEventLocked()
|
|
|
|
e.setStateLocked(Failed)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// As per RFC 4861 section 7.2.2:
|
|
|
|
//
|
|
|
|
// If the source address of the packet prompting the solicitation is the
|
|
|
|
// same as one of the addresses assigned to the outgoing interface, that
|
|
|
|
// address SHOULD be placed in the IP Source Address of the outgoing
|
|
|
|
// solicitation.
|
|
|
|
//
|
|
|
|
if err := e.linkRes.LinkAddressRequest(e.neigh.Addr, localAddr, "", e.nic); err != nil {
|
|
|
|
// There is no need to log the error here; the NUD implementation may
|
|
|
|
// assume a working link. A valid link should be the responsibility of
|
|
|
|
// the NIC/stack.LinkEndpoint.
|
|
|
|
e.dispatchRemoveEventLocked()
|
|
|
|
e.setStateLocked(Failed)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
retryCounter++
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, sendMulticastProbe)
|
|
|
|
e.job.Schedule(config.RetransmitTimer)
|
|
|
|
}
|
|
|
|
|
2020-11-03 03:18:28 +00:00
|
|
|
// Send a probe in another gorountine to free this thread of execution
|
|
|
|
// for finishing the state transition. This is necessary to avoid
|
|
|
|
// deadlock where sending and processing probes are done synchronously,
|
|
|
|
// such as loopback and integration tests.
|
|
|
|
e.job = e.nic.stack.newJob(&e.mu, sendMulticastProbe)
|
|
|
|
e.job.Schedule(immediateDuration)
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
case Stale:
|
|
|
|
e.setStateLocked(Delay)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
|
2020-11-24 22:20:15 +00:00
|
|
|
case Incomplete, Reachable, Delay, Probe, Static:
|
2020-07-30 20:28:21 +00:00
|
|
|
// Do nothing
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid cache entry state: %s", e.neigh.State))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// handleProbeLocked processes an incoming neighbor probe (e.g. ARP request or
|
|
|
|
// Neighbor Solicitation for ARP or NDP, respectively).
|
|
|
|
//
|
|
|
|
// Follows the logic defined in RFC 4861 section 7.2.3.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-07-30 20:28:21 +00:00
|
|
|
func (e *neighborEntry) handleProbeLocked(remoteLinkAddr tcpip.LinkAddress) {
|
|
|
|
// Probes MUST be silently discarded if the target address is tentative, does
|
|
|
|
// not exist, or not bound to the NIC as per RFC 4861 section 7.2.3. These
|
|
|
|
// checks MUST be done by the NetworkEndpoint.
|
|
|
|
|
|
|
|
switch e.neigh.State {
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
case Unknown, Failed:
|
2020-07-30 20:28:21 +00:00
|
|
|
e.neigh.LinkAddr = remoteLinkAddr
|
|
|
|
e.setStateLocked(Stale)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchAddEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
case Incomplete:
|
|
|
|
// "If an entry already exists, and the cached link-layer address
|
|
|
|
// differs from the one in the received Source Link-Layer option, the
|
|
|
|
// cached address should be replaced by the received address, and the
|
|
|
|
// entry's reachability state MUST be set to STALE."
|
|
|
|
// - RFC 4861 section 7.2.3
|
|
|
|
e.neigh.LinkAddr = remoteLinkAddr
|
|
|
|
e.setStateLocked(Stale)
|
|
|
|
e.notifyCompletionLocked(true /* succeeded */)
|
|
|
|
e.dispatchChangeEventLocked()
|
|
|
|
|
2020-07-30 20:28:21 +00:00
|
|
|
case Reachable, Delay, Probe:
|
|
|
|
if e.neigh.LinkAddr != remoteLinkAddr {
|
|
|
|
e.neigh.LinkAddr = remoteLinkAddr
|
|
|
|
e.setStateLocked(Stale)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
case Stale:
|
|
|
|
if e.neigh.LinkAddr != remoteLinkAddr {
|
|
|
|
e.neigh.LinkAddr = remoteLinkAddr
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
case Static:
|
|
|
|
// Do nothing
|
|
|
|
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid cache entry state: %s", e.neigh.State))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// handleConfirmationLocked processes an incoming neighbor confirmation
|
|
|
|
// (e.g. ARP reply or Neighbor Advertisement for ARP or NDP, respectively).
|
|
|
|
//
|
|
|
|
// Follows the state machine defined by RFC 4861 section 7.2.5.
|
|
|
|
//
|
|
|
|
// TODO(gvisor.dev/issue/2277): To protect against ARP poisoning and other
|
|
|
|
// attacks against NDP functions, Secure Neighbor Discovery (SEND) Protocol
|
|
|
|
// should be deployed where preventing access to the broadcast segment might
|
|
|
|
// not be possible. SEND uses RSA key pairs to produce Cryptographically
|
|
|
|
// Generated Addresses (CGA), as defined in RFC 3972. This ensures that the
|
|
|
|
// claimed source of an NDP message is the owner of the claimed address.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-07-30 20:28:21 +00:00
|
|
|
func (e *neighborEntry) handleConfirmationLocked(linkAddr tcpip.LinkAddress, flags ReachabilityConfirmationFlags) {
|
|
|
|
switch e.neigh.State {
|
|
|
|
case Incomplete:
|
|
|
|
if len(linkAddr) == 0 {
|
|
|
|
// "If the link layer has addresses and no Target Link-Layer Address
|
|
|
|
// option is included, the receiving node SHOULD silently discard the
|
|
|
|
// received advertisement." - RFC 4861 section 7.2.5
|
|
|
|
break
|
|
|
|
}
|
|
|
|
|
|
|
|
e.neigh.LinkAddr = linkAddr
|
|
|
|
if flags.Solicited {
|
|
|
|
e.setStateLocked(Reachable)
|
|
|
|
} else {
|
|
|
|
e.setStateLocked(Stale)
|
|
|
|
}
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
e.isRouter = flags.IsRouter
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
e.notifyCompletionLocked(true /* succeeded */)
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
// "Note that the Override flag is ignored if the entry is in the
|
|
|
|
// INCOMPLETE state." - RFC 4861 section 7.2.5
|
|
|
|
|
|
|
|
case Reachable, Stale, Delay, Probe:
|
2020-10-15 22:35:22 +00:00
|
|
|
isLinkAddrDifferent := len(linkAddr) != 0 && e.neigh.LinkAddr != linkAddr
|
2020-07-30 20:28:21 +00:00
|
|
|
|
2020-10-15 22:35:22 +00:00
|
|
|
if isLinkAddrDifferent {
|
2020-07-30 20:28:21 +00:00
|
|
|
if !flags.Override {
|
|
|
|
if e.neigh.State == Reachable {
|
|
|
|
e.setStateLocked(Stale)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
break
|
|
|
|
}
|
|
|
|
|
|
|
|
e.neigh.LinkAddr = linkAddr
|
|
|
|
|
|
|
|
if !flags.Solicited {
|
|
|
|
if e.neigh.State != Stale {
|
|
|
|
e.setStateLocked(Stale)
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
} else {
|
|
|
|
// Notify the LinkAddr change, even though NUD state hasn't changed.
|
2020-10-27 22:43:08 +00:00
|
|
|
e.dispatchChangeEventLocked()
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-10-15 22:35:22 +00:00
|
|
|
if flags.Solicited && (flags.Override || !isLinkAddrDifferent) {
|
2020-10-27 22:43:08 +00:00
|
|
|
wasReachable := e.neigh.State == Reachable
|
2020-07-30 20:28:21 +00:00
|
|
|
// Set state to Reachable again to refresh timers.
|
|
|
|
e.setStateLocked(Reachable)
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
e.notifyCompletionLocked(true /* succeeded */)
|
2020-10-27 22:43:08 +00:00
|
|
|
if !wasReachable {
|
|
|
|
e.dispatchChangeEventLocked()
|
|
|
|
}
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
|
2020-09-29 07:18:37 +00:00
|
|
|
if e.isRouter && !flags.IsRouter && header.IsV6UnicastAddress(e.neigh.Addr) {
|
2020-07-30 20:28:21 +00:00
|
|
|
// "In those cases where the IsRouter flag changes from TRUE to FALSE as
|
|
|
|
// a result of this update, the node MUST remove that router from the
|
|
|
|
// Default Router List and update the Destination Cache entries for all
|
|
|
|
// destinations using that neighbor as a router as specified in Section
|
|
|
|
// 7.3.3. This is needed to detect when a node that is used as a router
|
|
|
|
// stops forwarding packets due to being configured as a host."
|
|
|
|
// - RFC 4861 section 7.2.5
|
2020-09-29 07:18:37 +00:00
|
|
|
//
|
|
|
|
// TODO(gvisor.dev/issue/4085): Remove the special casing we do for IPv6
|
|
|
|
// here.
|
|
|
|
ep, ok := e.nic.networkEndpoints[header.IPv6ProtocolNumber]
|
|
|
|
if !ok {
|
|
|
|
panic(fmt.Sprintf("have a neighbor entry for an IPv6 router but no IPv6 network endpoint"))
|
|
|
|
}
|
|
|
|
|
|
|
|
if ndpEP, ok := ep.(NDPEndpoint); ok {
|
|
|
|
ndpEP.InvalidateDefaultRouter(e.neigh.Addr)
|
|
|
|
}
|
2020-07-30 20:28:21 +00:00
|
|
|
}
|
|
|
|
e.isRouter = flags.IsRouter
|
|
|
|
|
|
|
|
case Unknown, Failed, Static:
|
|
|
|
// Do nothing
|
|
|
|
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid cache entry state: %s", e.neigh.State))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// handleUpperLevelConfirmationLocked processes an incoming upper-level protocol
|
|
|
|
// (e.g. TCP acknowledgements) reachability confirmation.
|
Invoke address resolution upon subsequent traffic to Failed neighbor
Removes the period of time in which subseqeuent traffic to a Failed neighbor
immediately fails with ErrNoLinkAddress. A Failed neighbor is one in which
address resolution fails; or in other words, the neighbor's IP address cannot
be translated to a MAC address.
This means removing the Failed state for linkAddrCache and allowing transitiong
out of Failed into Incomplete for neighborCache. Previously, both caches would
transition entries to Failed after address resolution fails. In this state, any
subsequent traffic requested within an unreachable time would immediately fail
with ErrNoLinkAddress. This does not follow RFC 4861 section 7.3.3:
If address resolution fails, the entry SHOULD be deleted, so that subsequent
traffic to that neighbor invokes the next-hop determination procedure again.
Invoking next-hop determination at this point ensures that alternate default
routers are tried.
The API for getting a link address for a given address, whether through the link
address cache or the neighbor table, is updated to optionally take a callback
which will be called when address resolution completes. This allows `Route` to
handle completing link resolution internally, so callers of (*Route).Resolve
(e.g. endpoints) don’t have to keep track of when it completes and update the
Route accordingly.
This change also removes the wakers from LinkAddressCache, NeighborCache, and
Route in favor of the callbacks, and callers that previously used a waker can
now just pass a callback to (*Route).Resolve that will notify the waker on
resolution completion.
Fixes #4796
Startblock:
has LGTM from sbalana
and then
add reviewer ghanan
PiperOrigin-RevId: 348597478
2020-12-22 09:34:41 +00:00
|
|
|
//
|
|
|
|
// Precondition: e.mu MUST be locked.
|
2020-07-30 20:28:21 +00:00
|
|
|
func (e *neighborEntry) handleUpperLevelConfirmationLocked() {
|
|
|
|
switch e.neigh.State {
|
|
|
|
case Reachable, Stale, Delay, Probe:
|
2020-10-27 22:43:08 +00:00
|
|
|
wasReachable := e.neigh.State == Reachable
|
|
|
|
// Set state to Reachable again to refresh timers.
|
2020-07-30 20:28:21 +00:00
|
|
|
e.setStateLocked(Reachable)
|
2020-10-27 22:43:08 +00:00
|
|
|
if !wasReachable {
|
|
|
|
e.dispatchChangeEventLocked()
|
|
|
|
}
|
2020-07-30 20:28:21 +00:00
|
|
|
|
|
|
|
case Unknown, Incomplete, Failed, Static:
|
|
|
|
// Do nothing
|
|
|
|
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid cache entry state: %s", e.neigh.State))
|
|
|
|
}
|
|
|
|
}
|