The ConnTrack struct in pkg/tcpip/stack/conntrack.go is +stateify savable. seed is a 32-bit value used in conntrack bucket index hashing via jenkins.Sum32 at conntrack.go:613. It does not carry the state:nosave tag, so stateify codegen treats it as a serializable field and emits Save/Load calls in stack_state_autogen.go. Sibling fields in the same struct already carry the tag (rand at conntrack.go:232, mu at conntrack.go:234). The absence of the tag on seed is an omission against the established convention. Today the leak is contingent: Stack.tables is itself tagged state:nosave at stack.go:120 with TODO gvisor.dev/issue/4595, so an end-to-end checkpoint never reaches ConnTrack. When issue google#4595 lands and IPTables becomes savable, every unsaved field on ConnTrack will start flowing into checkpoint state, and a reader of the checkpoint blob will recover the seed and predict bucket assignment in the restored sandbox until the stack is destroyed. Tag seed state:nosave. The post-restore regeneration is NOT implemented in this commit: bucket_index = jenkins.Sum32(seed) % len(buckets) couples the seed value to bucket layout, so redrawing seed without rehashing entries leaves restored entries unreachable by Lookup. The rehash strategy is deferred to the implementer of issue google#4595, who will make ConnTrack savable and decide whether to rehash entries or preserve the seed value. A TODO comment in (*Stack).afterLoad in save_restore.go documents the requirement. Stateify codegen diff after the change (verbatim): ConnTrack.StateFields() pre-patch: [seed, clock, buckets] ConnTrack.StateFields() post-patch: [clock, buckets] 82-byte reduction in pkg/tcpip/stack/stack_state_autogen.go. Adds one regression test in save_restore_test.go: a reflection check that the tag is present. Tested: bazelisk build //pkg/tcpip/stack:stack bazelisk test //pkg/tcpip/stack:stack_test --test_filter='TestConnTrackSeedHasNosaveTag' Related: commit b027f39 "tcp: mark ISN and timestamp-offset secrets nosave for checkpoint" closed the equivalent gap for the TCP transport protocol secrets. Same pattern applied here. Review: addresses nybidari@ feedback on the original PR. The afterLoad regen line is dropped because the bucket-seed coupling makes a standalone redraw incorrect once entries are present in checkpoint state. The state:"nosave" tag remains as a safety contract so the seed cannot accidentally land in checkpoint bytes when google#4595 is implemented.

Restore netstack state on save/restore #4595

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions