Skip to content

Commit 2039cb5

Browse files
r-caamanor-caamano
authored
Merge pull request #101 from netfoundry/v0.9.19-release-candidate
Fixed masqerade GC issue with long lived high bw sessions, tcp sessio…
2 parents b3e16aa + 4c2c983 commit 2039cb5

File tree

5 files changed

+114
-42
lines changed

5 files changed

+114
-42
lines changed

‎CHANGELOG.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file. The format
55
---
66
###
77

8+
# [0.9.19] - 2025-6-1
9+
###
10+
11+
- Fixed issue where in masquerade mode if sending at a high rate user space could not keep up with timestamps.
12+
- Additions to tcp tracking to work with varying tcp stack FIN acknowledgement handling.
13+
14+
###
15+
816
# [0.9.18] - 2025-5-28
917
###
1018

‎src/zfw.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ char *direction_string;
278278
char *masq_interface;
279279
char check_alt[IF_NAMESIZE];
280280

281-
const char *argp_program_version = "0.9.18";
281+
const char *argp_program_version = "0.9.19";
282282
struct ring_buffer *ring_buffer;
283283

284284
__u32 if_list[MAX_IF_LIST_ENTRIES];

‎src/zfw_monitor.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ char check_alt[IF_NAMESIZE];
9393
char doc[] = "zfw_monitor -- ebpf firewall monitor tool";
9494
const char *rb_map_path = "/sys/fs/bpf/tc/globals/rb_map";
9595
const char *tproxy_map_path = "/sys/fs/bpf/tc/globals/zt_tproxy_map";
96-
const char *argp_program_version = "0.9.18";
96+
const char *argp_program_version = "0.9.19";
9797
union bpf_attr rb_map;
9898
int rb_fd = -1;
9999

‎src/zfw_tc_ingress.c

Lines changed: 52 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2415,7 +2415,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
24152415
return TC_ACT_OK;
24162416
}
24172417
else if(tcph->ack){
2418-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
2418+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->cfack) &&
2419+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
24192420
if(local_diag->masquerade){
24202421
struct masq_reverse_key rk = {0};
24212422
rk.dport = tcp_state_key.dport;
@@ -2459,13 +2460,18 @@ int bpf_sk_splice(struct __sk_buff *skb){
24592460
}
24602461
return TC_ACT_OK;
24612462
}
2462-
else if((tstate->est) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
2463+
else if((tstate->est) && (tstate->cfin == 1) &&
2464+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
24632465
tstate->sfack = 1;
2464-
tstate->tstamp = tstamp;
2466+
if(tstamp >= tstate->tstamp + 250000000){
2467+
tstate->tstamp = tstamp;
2468+
}
24652469
return TC_ACT_OK;
24662470
}
24672471
else if(tstate->est){
2468-
tstate->tstamp = tstamp;
2472+
if(tstamp >= tstate->tstamp + 250000000){
2473+
tstate->tstamp = tstamp;
2474+
}
24692475
return TC_ACT_OK;
24702476
}
24712477
}
@@ -2672,7 +2678,9 @@ int bpf_sk_splice(struct __sk_buff *skb){
26722678
}
26732679
}
26742680
else{
2675-
ustate->tstamp = tstamp;
2681+
if(tstamp >= ustate->tstamp + 250000000){
2682+
ustate->tstamp = tstamp;
2683+
}
26762684
if(local_diag->verbose){
26772685
event.tracking_code = UDP_MATCHED_ACTIVE_STATE;
26782686
send_event(&event);
@@ -2903,7 +2911,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
29032911
return TC_ACT_OK;
29042912
}
29052913
else if(tcph->ack){
2906-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
2914+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->cfack) &&
2915+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
29072916
del_tcp(tcp_state_key);
29082917
tstate = get_tcp(tcp_state_key);
29092918
if(!tstate){
@@ -2914,13 +2923,18 @@ int bpf_sk_splice(struct __sk_buff *skb){
29142923
}
29152924

29162925
}
2917-
else if((tstate->est) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
2926+
else if((tstate->est) && (tstate->cfin == 1) &&
2927+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
29182928
tstate->sfack = 1;
2919-
tstate->tstamp = tstamp;
2929+
if(tstamp >= tstate->tstamp + 250000000){
2930+
tstate->tstamp = tstamp;
2931+
}
29202932
return TC_ACT_OK;
29212933
}
29222934
else if(tstate->est){
2923-
tstate->tstamp = tstamp;
2935+
if(tstamp >= tstate->tstamp + 250000000){
2936+
tstate->tstamp = tstamp;
2937+
}
29242938
return TC_ACT_OK;
29252939
}
29262940
}
@@ -3037,7 +3051,9 @@ int bpf_sk_splice(struct __sk_buff *skb){
30373051
event.tracking_code = UDP_MATCHED_ACTIVE_STATE;
30383052
send_event(&event);
30393053
}
3040-
ustate->tstamp = tstamp;
3054+
if(tstamp >= ustate->tstamp + 250000000){
3055+
ustate->tstamp = tstamp;
3056+
}
30413057
return TC_ACT_OK;
30423058
}
30433059
}
@@ -4052,7 +4068,9 @@ int bpf_sk_splice6(struct __sk_buff *skb){
40524068
}
40534069
}
40544070
else if(ustate){
4055-
ustate->tstamp = tstamp;
4071+
if(tstamp >= ustate->tstamp + 250000000){
4072+
ustate->tstamp = tstamp;
4073+
}
40564074
}
40574075
return TC_ACT_OK;
40584076
}
@@ -4127,7 +4145,8 @@ int bpf_sk_splice6(struct __sk_buff *skb){
41274145
tstate->syn = 0;
41284146
tstate->est = 1;
41294147
}
4130-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
4148+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) &&
4149+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
41314150
del_ingress_tcp(tcp_state_key);
41324151
tstate = get_ingress_tcp(tcp_state_key);
41334152
if(!tstate){
@@ -4137,12 +4156,17 @@ int bpf_sk_splice6(struct __sk_buff *skb){
41374156
}
41384157
}
41394158
}
4140-
else if((tstate->est) && (tstate->sfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
4159+
else if((tstate->est) && (tstate->sfin == 1) &&
4160+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
41414161
tstate->cfack = 1;
4142-
tstate->tstamp = tstamp;
4162+
if(tstamp >= tstate->tstamp + 250000000){
4163+
tstate->tstamp = tstamp;
4164+
}
41434165
}
41444166
else{
4145-
tstate->tstamp = tstamp;
4167+
if(tstamp >= tstate->tstamp + 250000000){
4168+
tstate->tstamp = tstamp;
4169+
}
41464170
}
41474171
}
41484172
}
@@ -4194,7 +4218,9 @@ int bpf_sk_splice6(struct __sk_buff *skb){
41944218
}
41954219
}
41964220
else if(ustate){
4197-
ustate->tstamp = tstamp;
4221+
if(tstamp >= ustate->tstamp + 250000000){
4222+
ustate->tstamp = tstamp;
4223+
}
41984224
}
41994225
return TC_ACT_OK;
42004226
}
@@ -4268,7 +4294,8 @@ int bpf_sk_splice6(struct __sk_buff *skb){
42684294
tstate->syn = 0;
42694295
tstate->est = 1;
42704296
}
4271-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
4297+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) &&
4298+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
42724299
del_ingress_tcp(tcp_state_key);
42734300
tstate = get_ingress_tcp(tcp_state_key);
42744301
if(!tstate){
@@ -4278,12 +4305,17 @@ int bpf_sk_splice6(struct __sk_buff *skb){
42784305
}
42794306
}
42804307
}
4281-
else if((tstate->est) && (tstate->sfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
4308+
else if((tstate->est) && (tstate->sfin == 1) &&
4309+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
42824310
tstate->cfack = 1;
4283-
tstate->tstamp = tstamp;
4311+
if(tstamp >= tstate->tstamp + 250000000){
4312+
tstate->tstamp = tstamp;
4313+
}
42844314
}
42854315
else{
4286-
tstate->tstamp = tstamp;
4316+
if(tstamp >= tstate->tstamp + 250000000){
4317+
tstate->tstamp = tstamp;
4318+
}
42874319
}
42884320
}
42894321
}

‎src/zfw_tc_outbound_track.c

Lines changed: 52 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1297,7 +1297,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
12971297
return TC_ACT_OK;
12981298
}
12991299
else if(tcph->ack){
1300-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
1300+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && tstate->cfack &&
1301+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
13011302
del_ingress_tcp(tcp_state_key);
13021303
tstate = get_ingress_tcp(tcp_state_key);
13031304
if(!tstate){
@@ -1308,13 +1309,18 @@ int bpf_sk_splice(struct __sk_buff *skb){
13081309
}
13091310

13101311
}
1311-
else if((tstate->est) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
1312+
else if((tstate->est) && (tstate->cfin == 1) &&
1313+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
13121314
tstate->sfack = 1;
1313-
tstate->tstamp = tstamp;
1315+
if(tstamp >= tstate->tstamp + 250000000){
1316+
tstate->tstamp = tstamp;
1317+
}
13141318
return TC_ACT_OK;
13151319
}
13161320
else if(tstate->est){
1317-
tstate->tstamp = tstamp;
1321+
if(tstamp >= tstate->tstamp + 250000000){
1322+
tstate->tstamp = tstamp;
1323+
}
13181324
return TC_ACT_OK;
13191325
}
13201326
}
@@ -1466,7 +1472,9 @@ int bpf_sk_splice(struct __sk_buff *skb){
14661472
event.tracking_code = INGRESS_UDP_MATCHED_ACTIVE_STATE;
14671473
send_event(&event);
14681474
}
1469-
ustate->tstamp = tstamp;
1475+
if(tstamp >= ustate->tstamp + 250000000){
1476+
ustate->tstamp = tstamp;
1477+
}
14701478
return TC_ACT_OK;
14711479
}
14721480
}
@@ -1601,7 +1609,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
16011609
return TC_ACT_OK;
16021610
}
16031611
else if(tcph->ack){
1604-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
1612+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && tstate->cfack &&
1613+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
16051614
del_ingress_tcp(tcp_state_key);
16061615
tstate = get_ingress_tcp(tcp_state_key);
16071616
if(!tstate){
@@ -1612,13 +1621,18 @@ int bpf_sk_splice(struct __sk_buff *skb){
16121621
}
16131622

16141623
}
1615-
else if((tstate->est) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
1624+
else if((tstate->est) && (tstate->cfin == 1) &&
1625+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->cfseq)))){
16161626
tstate->sfack = 1;
1617-
tstate->tstamp = tstamp;
1627+
if(tstamp >= tstate->tstamp + 250000000){
1628+
tstate->tstamp = tstamp;
1629+
}
16181630
return TC_ACT_OK;
16191631
}
16201632
else if(tstate->est){
1621-
tstate->tstamp = tstamp;
1633+
if(tstamp >= tstate->tstamp + 250000000){
1634+
tstate->tstamp = tstamp;
1635+
}
16221636
return TC_ACT_OK;
16231637
}
16241638
}
@@ -1656,7 +1670,9 @@ int bpf_sk_splice(struct __sk_buff *skb){
16561670
event.tracking_code = INGRESS_UDP_MATCHED_ACTIVE_STATE;
16571671
send_event(&event);
16581672
}
1659-
ustate->tstamp = tstamp;
1673+
if(tstamp >= ustate->tstamp + 250000000){
1674+
ustate->tstamp = tstamp;
1675+
}
16601676
return TC_ACT_OK;
16611677
}
16621678
}
@@ -2887,7 +2903,8 @@ int bpf_sk_splice6(struct __sk_buff *skb){
28872903
tstate->syn = 0;
28882904
tstate->est = 1;
28892905
}
2890-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
2906+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) &&
2907+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
28912908
if(local_diag->masquerade){
28922909
struct masq_reverse_key rk = {0};
28932910
rk.dport = tcp_state_key.dport;
@@ -2928,12 +2945,17 @@ int bpf_sk_splice6(struct __sk_buff *skb){
29282945
}
29292946

29302947
}
2931-
else if((tstate->est) && (tstate->sfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
2948+
else if((tstate->est) && (tstate->sfin == 1) &&
2949+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
29322950
tstate->cfack = 1;
2933-
tstate->tstamp = tstamp;
2951+
if(tstamp >= tstate->tstamp + 250000000){
2952+
tstate->tstamp = tstamp;
2953+
}
29342954
}
29352955
else{
2936-
tstate->tstamp = tstamp;
2956+
if(tstamp >= tstate->tstamp + 250000000){
2957+
tstate->tstamp = tstamp;
2958+
}
29372959
}
29382960
}
29392961
}
@@ -3114,7 +3136,9 @@ int bpf_sk_splice6(struct __sk_buff *skb){
31143136
}
31153137
}
31163138
else if(ustate){
3117-
ustate->tstamp = tstamp;
3139+
if(tstamp >= ustate->tstamp + 250000000){
3140+
ustate->tstamp = tstamp;
3141+
}
31183142
}
31193143
}
31203144
}
@@ -3263,7 +3287,8 @@ int bpf_sk_splice6(struct __sk_buff *skb){
32633287
tstate->syn = 0;
32643288
tstate->est = 1;
32653289
}
3266-
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
3290+
if((tstate->est) && (tstate->sfin == 1) && (tstate->cfin == 1) && (tstate->sfack) &&
3291+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
32673292
del_tcp(tcp_state_key);
32683293
tstate = get_tcp(tcp_state_key);
32693294
if(!tstate){
@@ -3273,12 +3298,17 @@ int bpf_sk_splice6(struct __sk_buff *skb){
32733298
}
32743299
}
32753300
}
3276-
else if((tstate->est) && (tstate->sfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1))){
3301+
else if((tstate->est) && (tstate->sfin == 1) &&
3302+
((bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->sfseq) + 1)) || (bpf_htonl(tcph->ack_seq) == bpf_htonl(tstate->sfseq)))){
32773303
tstate->cfack = 1;
3278-
tstate->tstamp = tstamp;
3304+
if(tstamp >= tstate->tstamp + 250000000){
3305+
tstate->tstamp = tstamp;
3306+
}
32793307
}
32803308
else{
3281-
tstate->tstamp = tstamp;
3309+
if(tstamp >= tstate->tstamp + 250000000){
3310+
tstate->tstamp = tstamp;
3311+
}
32823312
}
32833313
}
32843314
}
@@ -3351,7 +3381,9 @@ int bpf_sk_splice6(struct __sk_buff *skb){
33513381
}
33523382
}
33533383
else if(ustate){
3354-
ustate->tstamp = tstamp;
3384+
if(tstamp >= ustate->tstamp + 250000000){
3385+
ustate->tstamp = tstamp;
3386+
}
33553387
}
33563388
}
33573389
}

0 commit comments

Comments
 (0)