[roll] Roll fuchsia [netstack3] Cache direction in per-packet filter metadata

Currently, both conntrack and NAT logic independently attempt to
determine the direction of a packet with respect to its conntrack
connection. Because this check is stateless (i.e. is performed again at
every NAT hook), if a packet is rewritten due to NAT, it is likely to no
longer match either the original or reply tuple of its connection. This
results in the netstack being unable to correctly perform NAT on it.

Instead of recalculating it each time, have conntrack return the
direction along with the connection itself when a packet's connection is
looked up, and then stash it in the per-packet metadata that persists
throughout the IP layer. This allows NAT to correctly be performed in
all hooks that a packet traverses, and also allows slightly simplifying
some conntrack code.

Original-Fixed: 371017876
Test: netstack3-filter-test
Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1168458
Original-Revision: f1fbd4f9027eb267d785d9c1cc13d4afb91410ae
GitOrigin-RevId: 0ecf97942b63c7dda0a3c553687d1072117775eb
Change-Id: I7a75a07a2d4933d181bd8a247424b3b7646ae681
1 file changed
tree: 9950574f00400bcfa2ffc0fa41f603875f873d72
  1. ctf/
  2. git-hooks/
  3. infra/
  4. third_party/
  5. cts
  6. firmware
  7. flower
  8. jiri.lock
  9. MILESTONE
  10. minimal
  11. prebuilts
  12. README.md
  13. stem
  14. test_durations
  15. toolchain
README.md

Integration

This repository contains Fuchsia's Global Integration manifest files.

Making changes

All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.

Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.

Obtaining the source

First install Jiri.

Next run:

$ jiri init
$ jiri import minimal https://fuchsia.googlesource.com/integration
$ jiri update

Third party

Third party projects should have their own subdirectory in ./third_party.