Commit Graph

444 Commits

Author SHA1 Message Date
Ghanan Gowripalan 431ff52768 Update link address for senders of Neighbor Solicitations
Update link address for senders of NDP Neighbor Solicitations when the NS
contains an NDP Source Link Layer Address option.

Tests:
- ipv6.TestNeighorSolicitationWithSourceLinkLayerOption
- ipv6.TestNeighorSolicitationWithInvalidSourceLinkLayerOption
PiperOrigin-RevId: 292028553
2020-01-28 15:45:36 -08:00
Ghanan Gowripalan ce0bac4be9 Include the NDP Source Link Layer option when sending DAD messages
Test: stack_test.TestDADResolve
PiperOrigin-RevId: 292003124
2020-01-28 13:52:04 -08:00
Ghanan Gowripalan 2a2da5be31 Add a type to represent the NDP Source Link Layer Address option
Tests:
- header.TestNDPSourceLinkLayerAddressOptionEthernetAddress
- header.TestNDPSourceLinkLayerAddressOptionSerialize
- header.TestNDPOptionsIterCheck
- header.TestNDPOptionsIter
PiperOrigin-RevId: 291856429
2020-01-27 20:51:28 -08:00
gVisor bot 60d7ff73e1 Merge pull request #1676 from majek:marek/FIX-1632-expose-NewPacketConn
PiperOrigin-RevId: 291803499
2020-01-27 15:30:32 -08:00
Adin Scannell 90ec596166 Fix licenses.
The preferred Copyright holder is "The gVisor Authors".

PiperOrigin-RevId: 291786657
2020-01-27 13:23:57 -08:00
Bhasker Hariharan fbfcfcf5b0 Update ChecksumVVWithoffset to use unrolled version.
Fixes #1656

PiperOrigin-RevId: 291777279
2020-01-27 13:05:26 -08:00
Ting-Yu Wang 6b14be4246 Refactor to hide C from channel.Endpoint.
This is to aid later implementation for /dev/net/tun device.

PiperOrigin-RevId: 291746025
2020-01-27 12:31:47 -08:00
Adin Scannell d29e59af9f Standardize on tools directory.
PiperOrigin-RevId: 291745021
2020-01-27 12:21:00 -08:00
Marek Majkowski 45398b160f Expose gonet.NewPacketConn, for parity with gonet.NewConn API
gonet.Conn can be created with both gonet.NewConn and gonet.Dial.
gonet.PacketConn was created only by gonet.DialUDP. This prevented
us from being able to use PacketConn in udp.NewForwarder() context.

This simple constructor - NewPacketConn, allows user to create
correct structure from that context.
2020-01-27 13:51:15 +00:00
Bhasker Hariharan 6b43cf791a Replace calculateChecksum w/ the unrolled version.
Fixes #1656

PiperOrigin-RevId: 291703760
2020-01-27 05:34:34 -08:00
Bhasker Hariharan 68514d4ba3 Unroll checksum computation loop.
Checksum computation is one of the most expensive bits of
packet processing. Manual unrolling of the loop provides
significant improvement in checksum speed.

Updates #1656

BenchmarkChecksum/checksum_64-12                49834124                23.6 ns/op
BenchmarkChecksum/checksum_128-12               27111997                44.1 ns/op
BenchmarkChecksum/checksum_256-12               11416683                91.5 ns/op
BenchmarkChecksum/checksum_512-12                6375298               174 ns/op
BenchmarkChecksum/checksum_1024-12               3403852               338 ns/op
BenchmarkChecksum/checksum_1500-12               2343576               493 ns/op
BenchmarkChecksum/checksum_2048-12               1730521               656 ns/op
BenchmarkChecksum/checksum_4096-12                920469              1327 ns/op
BenchmarkChecksum/checksum_8192-12                445885              2637 ns/op
BenchmarkChecksum/checksum_16384-12               226342              5268 ns/op
BenchmarkChecksum/checksum_32767-12               114210             10503 ns/op
BenchmarkChecksum/checksum_32768-12                99138             10610 ns/op
BenchmarkChecksum/checksum_65535-12                53438             21158 ns/op
BenchmarkChecksum/checksum_65536-12                52993             21067 ns/op
BenchmarkUnrolledChecksum/checksum_64-12        61035639                19.1 ns/op
BenchmarkUnrolledChecksum/checksum_128-12               36067015                33.6 ns/op
BenchmarkUnrolledChecksum/checksum_256-12               19731220                60.4 ns/op
BenchmarkUnrolledChecksum/checksum_512-12                9091291               116 ns/op
BenchmarkUnrolledChecksum/checksum_1024-12               4976406               226 ns/op
BenchmarkUnrolledChecksum/checksum_1500-12               3685224               328 ns/op
BenchmarkUnrolledChecksum/checksum_2048-12               2579108               447 ns/op
BenchmarkUnrolledChecksum/checksum_4096-12               1350475               887 ns/op
BenchmarkUnrolledChecksum/checksum_8192-12                658248              1780 ns/op
BenchmarkUnrolledChecksum/checksum_16384-12               335869              3534 ns/op
BenchmarkUnrolledChecksum/checksum_32767-12               168650              7095 ns/op
BenchmarkUnrolledChecksum/checksum_32768-12               168075              7098 ns/op
BenchmarkUnrolledChecksum/checksum_65535-12                75085             14277 ns/op
BenchmarkUnrolledChecksum/checksum_65536-12                75921             14127 ns/op

PiperOrigin-RevId: 291643290
2020-01-26 18:35:01 -08:00
Ghanan Gowripalan 878bda6e19 Lock the NIC when checking if an address is tentative
PiperOrigin-RevId: 291426657
2020-01-24 13:10:08 -08:00
Ghanan Gowripalan fb80979e3f Increase timeouts for NDP tests' async events
Increase the timeout to 1s when waiting for async NDP events to help
reduce flakiness. This will not significantly increase test times as the
async events continue to receive an event on a channel. The increased
timeout allows more time for an event to be sent on the channel as the
previous timeout of 100ms caused some flakes.

Test: Existing tests pass
PiperOrigin-RevId: 291420936
2020-01-24 12:30:23 -08:00
gVisor bot 3d10edc942 Merge pull request #1617 from kevinGC:iptables-write-filter-proto
PiperOrigin-RevId: 291249314
2020-01-23 14:48:39 -08:00
Ghanan Gowripalan 1d97adaa6d Use embedded mutex pattern for stack.NIC
- Wrap NIC's fields that should only be accessed while holding the mutex in
  an anonymous struct with the embedded mutex.
- Make sure NIC's spoofing and promiscuous mode flags are only read while
  holding the NIC's mutex.
- Use the correct endpoint when sending DAD messages.
- Do not hold the NIC's lock when sending DAD messages.

This change does not introduce any behaviour changes.

Tests: Existing tests continue to pass.
PiperOrigin-RevId: 291036251
2020-01-22 14:51:53 -08:00
Kevin Krakauer 747137c120 Address GitHub comments. 2020-01-22 10:23:44 -08:00
Marek Majkowski 38fe05eb69 gonet PacketConn.RemoteAddr() incorrectly returns *net.TCPAddr, should be *net.UDPAddr
PacketConn.LocalAddr() already returns *net.UDPAddr correctly.
2020-01-22 11:34:29 +00:00
gVisor bot 45a8edbd5a Merge pull request #1492 from majek:err_typo_in_netstack_tests
PiperOrigin-RevId: 290840370
2020-01-21 16:32:49 -08:00
Mithun Iyer 7e6fbc6afe Add a new TCP stat for current open connections.
Such a stat accounts for all connections that are currently
established and not yet transitioned to close state.
Also fix bug in double increment of CurrentEstablished stat.

Fixes #1579

PiperOrigin-RevId: 290827365
2020-01-21 15:43:39 -08:00
Kevin Krakauer 47bc7550c0 Fixing stuff 2020-01-21 13:37:25 -08:00
Kevin Krakauer 62357a0afb Merge branch 'master' into iptables-write-filter-proto 2020-01-21 13:16:25 -08:00
gVisor bot 5f82f092e7 Merge pull request #1558 from kevinGC:iptables-write-input-drop
PiperOrigin-RevId: 290793754
2020-01-21 12:08:52 -08:00
Eyal Soha 47d85257d3 Filter out received packets with a local source IP address.
CERT Advisory CA-96.21 III. Solution advises that devices drop packets which
could not have correctly arrived on the wire, such as receiving a packet where
the source IP address is owned by the device that sent it.

Fixes #1507

PiperOrigin-RevId: 290378240
2020-01-17 18:26:20 -08:00
Tamir Duberstein 23fa847910 Remove addPermanentAddressLocked
It was possible to use this function incorrectly, and its separation
wasn't buying us anything.

PiperOrigin-RevId: 290311100
2020-01-17 11:48:06 -08:00
Ghanan Gowripalan a7a1f00425 Support upgrading expired/removed IPv6 addresses to permanent SLAAC addresses
If a previously added IPv6 address (statically or via SLAAC) was removed, it
would be left in an expired state waiting to be cleaned up if any references to
it were still held. During this time, the same address could be regenerated via
SLAAC, which should be allowed. This change supports this scenario.

When upgrading an endpoint from temporary or permanentExpired to permanent,
respect the new configuration type (static or SLAAC) and deprecated status,
along with the new PrimaryEndpointBehavior (which was already supported).

Test: stack.TestAutoGenAddrAfterRemoval
PiperOrigin-RevId: 289990168
2020-01-15 20:23:06 -08:00
Ghanan Gowripalan 815df2959a Solicit IPv6 routers when a NIC becomes enabled as a host
This change adds support to send NDP Router Solicitation messages when a NIC
becomes enabled as a host, as per RFC 4861 section 6.3.7.

Note, Router Solicitations will only be sent when the stack has forwarding
disabled.

Tests: Unittests to make sure that the initial Router Solicitations are sent
as configured. The tests also validate the sent Router Solicitations' fields.
PiperOrigin-RevId: 289964095
2020-01-15 17:10:48 -08:00
Bhasker Hariharan 275ac8ce1d Bugfix to terminate the protocol loop on StateError.
The change to introduce worker goroutines can cause the endpoint
to transition to StateError and we should terminate the loop rather
than let the endpoint transition to a CLOSED state as we do
in case the endpoint enters TIME-WAIT/CLOSED. Moving to a closed
state would cause the actual error to not be propagated to
any read() calls etc.

PiperOrigin-RevId: 289923568
2020-01-15 13:21:50 -08:00
Kevin Krakauer 95e9de31d2 Address Nic's comments. 2020-01-14 17:54:02 -08:00
Bhasker Hariharan a611fdaee3 Changes TCP packet dispatch to use a pool of goroutines.
All inbound segments for connections in ESTABLISHED state are delivered to the
endpoint's queue but for every segment delivered we also queue the endpoint for
processing to a selected processor. This ensures that when there are a large
number of connections in ESTABLISHED state the inbound packets are all handled
by a small number of goroutines and significantly reduces the amount of work the
goscheduler has to perform.

We let connections in other states follow the current path where the
endpoint's goroutine directly handles the segments.

Updates #231

PiperOrigin-RevId: 289728325
2020-01-14 14:15:50 -08:00
Tamir Duberstein 50625cee59 Implement {g,s}etsockopt(IP_RECVTOS) for UDP sockets
PiperOrigin-RevId: 289718534
2020-01-14 13:33:23 -08:00
Ghanan Gowripalan 1ad8381eac Do Source Address Selection when choosing an IPv6 source address
Do Source Address Selection when choosing an IPv6 source address as per RFC 6724
section 5 rules 1-3:
1) Prefer same address
2) Prefer appropriate scope
3) Avoid deprecated addresses.

A later change will update Source Address Selection to follow rules 4-8.

Tests:
Rule 1 & 2: stack.TestIPv6SourceAddressSelectionScopeAndSameAddress,
Rule 3:     stack.TestAutoGenAddrTimerDeprecation,
            stack.TestAutoGenAddrDeprecateFromPI
PiperOrigin-RevId: 289559373
2020-01-13 17:58:28 -08:00
Kevin Krakauer bd29289409 Protocol filtering works. 2020-01-13 16:10:00 -08:00
Kevin Krakauer d51eaa59c0 Merge branch 'iptables-write-input-drop' into iptables-write-filter-proto 2020-01-13 16:06:29 -08:00
Kevin Krakauer 1c3d3c70b9 Fix test building. 2020-01-13 14:54:32 -08:00
Tamir Duberstein debd213da6 Allow dual stack sockets to operate on AF_INET
Fixes #1490
Fixes #1495

PiperOrigin-RevId: 289523250
2020-01-13 14:47:22 -08:00
Kevin Krakauer 31e49f4b19 Merge branch 'master' into iptables-write-input-drop 2020-01-13 12:22:15 -08:00
gVisor bot b30cfb1df7 Merge pull request #1528 from kevinGC:iptables-write
PiperOrigin-RevId: 289479774
2020-01-13 11:26:26 -08:00
Kevin Krakauer d793677cd4 I think INPUT works with protocol 2020-01-10 18:07:15 -08:00
Ghanan Gowripalan d27208463e Automated rollback of changelist 288990597
PiperOrigin-RevId: 289169518
2020-01-10 14:58:47 -08:00
Ghanan Gowripalan bcedf6a8e4 Put CancellableTimer tests in the tcpip_test package
CancellableTimer tests were in a timer_test package but lived within the
tcpip directory. This caused issues with go tools.

PiperOrigin-RevId: 289166345
2020-01-10 14:32:17 -08:00
Kevin Krakauer d147e6d1b2 Cleaned up logs. 2020-01-10 13:58:46 -08:00
Bhasker Hariharan dacd349d6f panic fix in retransmitTimerExpired.
This is a band-aid fix for now to prevent panics.

PiperOrigin-RevId: 289078453
2020-01-10 06:03:02 -08:00
Ian Gudger 27500d529f New sync package.
* Rename syncutil to sync.
* Add aliases to sync types.
* Replace existing usage of standard library sync package.

This will make it easier to swap out synchronization primitives. For example,
this will allow us to use primitives from github.com/sasha-s/go-deadlock to
check for lock ordering violations.

Updates #1472

PiperOrigin-RevId: 289033387
2020-01-09 22:02:24 -08:00
gVisor bot b08da42285 Merge pull request #1523 from majek:fix-1522-silly-window-rx
PiperOrigin-RevId: 289019953
2020-01-09 19:35:27 -08:00
Ghanan Gowripalan 26c5653bb5 Inform NDPDispatcher when Stack learns about available configurations via DHCPv6
Inform the Stack's NDPDispatcher when it receives an NDP Router Advertisement
that updates the available configurations via DHCPv6. The Stack makes sure that
its NDPDispatcher isn't informed unless the avaiable configurations via DHCPv6
for a NIC is updated.

Tests: Test that a Stack's NDPDispatcher is informed when it receives an NDP
Router Advertisement that informs it of new configurations available via DHCPv6.
PiperOrigin-RevId: 289001283
2020-01-09 16:56:28 -08:00
Ghanan Gowripalan 8fafd3142e Separate NDP tests into its own package
Internal tools timeout after 60s during tests that are required to pass before
changes can be submitted. Separate out NDP tests into its own package to help
prevent timeouts when testing.

PiperOrigin-RevId: 288990597
2020-01-09 15:56:44 -08:00
Kevin Krakauer ff719159be Confirmed that it works if I hardcode 17 in for pkt.Protocol. Need to address parsing the packet early :( 2020-01-09 15:38:21 -08:00
Kevin Krakauer 89d11b4d96 Added a test that we don't pass yet 2020-01-09 13:41:52 -08:00
Eyal Soha 8643933d6e Change BindToDeviceOption to store NICID
This makes it possible to call the sockopt from go even when the NIC has no
name.

PiperOrigin-RevId: 288955236
2020-01-09 13:07:53 -08:00
Bert Muthalaly e752ddbb72 Allow clients to store an opaque NICContext with NICs
...retrievable later via stack.NICInfo().

Clients of this library can use it to add metadata that should be tracked
alongside a NIC, to avoid having to keep a map[tcpip.NICID]metadata mirroring
stack.Stack's nic map.

PiperOrigin-RevId: 288924900
2020-01-09 10:46:01 -08:00