Merge pull request #106 from netfoundry/v0.9.22-release-candidate

V0.9.22 release candidate

Author: r-caamano

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file. The format
 ---
 ###
 
+# [0.9.22] - 2025-8-5
+
+- Fixed an issue where TCP rst received from tcp a server does not remove the ingress
+  state when egressing the interface facing the client due to incorrect map lookup.
+  This then caused the connection to be be cleaned up after idle time rather than immediately.
+
+###
+
 # [0.9.21] - 2025-7-18
 
 - Refactored port_extension_key.pad to  port_extension_key.type to differentiate ipv4 from ipv6

src/zfw.c

@@ -278,7 +278,7 @@ char *direction_string;
 char *masq_interface;
 char check_alt[IF_NAMESIZE];
 
-const char *argp_program_version = "0.9.21";
+const char *argp_program_version = "0.9.22";
 struct ring_buffer *ring_buffer;
 
 __u32 if_list[MAX_IF_LIST_ENTRIES];

src/zfw_monitor.c

@@ -93,7 +93,7 @@ char check_alt[IF_NAMESIZE];
 char doc[] = "zfw_monitor -- ebpf firewall monitor tool";
 const char *rb_map_path = "/sys/fs/bpf/tc/globals/rb_map";
 const char *tproxy_map_path = "/sys/fs/bpf/tc/globals/zt_tproxy_map";
-const char *argp_program_version = "0.9.21";
+const char *argp_program_version = "0.9.22";
 union bpf_attr rb_map;
 int rb_fd = -1;
 

src/zfw_tc_outbound_track.c

@@ -1286,7 +1286,7 @@ int bpf_sk_splice(struct __sk_buff *skb){
                         }
                     }
                     else if(tcph->rst){
-                        del_tcp(tcp_state_key);
+                        del_ingress_tcp(tcp_state_key);
                         tstate = get_ingress_tcp(tcp_state_key);
                         if(!tstate){
                             if(local_diag->verbose){