Fixed tcp outbound tracking session closing and format issues in zfw_xdp_ingress.c

Author: r-caamano

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file. The format
 ---
 ###
 
+# [0.9.18] - 2025-5-28
+###
+
+- Fixed issue where outbound tcp passthrough tracking will stop packet ingress forwarding prematurely when
+  fin received from client and server.
+
+- Fixed format error in zfw_xdp_ingress.c where several statements had double ; termination.
+
 # [0.9.17] - 2025-5-1
 
 - Refactored GENEVE inbound termination to continue to filter processing as non GENEVE if the GENEVE version and

src/zfw.c

@@ -278,7 +278,7 @@ char *direction_string;
 char *masq_interface;
 char check_alt[IF_NAMESIZE];
 
-const char *argp_program_version = "0.9.17";
+const char *argp_program_version = "0.9.18";
 struct ring_buffer *ring_buffer;
 
 __u32 if_list[MAX_IF_LIST_ENTRIES];

src/zfw_monitor.c

@@ -93,7 +93,7 @@ char check_alt[IF_NAMESIZE];
 char doc[] = "zfw_monitor -- ebpf firewall monitor tool";
 const char *rb_map_path = "/sys/fs/bpf/tc/globals/rb_map";
 const char *tproxy_map_path = "/sys/fs/bpf/tc/globals/zt_tproxy_map";
-const char *argp_program_version = "0.9.17";
+const char *argp_program_version = "0.9.18";
 union bpf_attr rb_map;
 int rb_fd = -1;
 

src/zfw_tc_ingress.c

@@ -2299,7 +2299,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
                 unsigned long long tstamp = bpf_ktime_get_ns();
                 struct tcp_state *tstate = get_tcp(tcp_state_key);
                 /*check tcp state and timeout if greater than 60 minutes without traffic*/
-                if(tstate && (tstamp < (tstate->tstamp + 3600000000000))){ 
+                if(tstate && (tstamp < (tstate->tstamp + 3600000000000)))
+                { 
                     /*Filter modbus responses that do not match outstanding requests*/  
                     if(local_diag->ot_filtering && (tuple->ipv4.sport == bpf_ntohs(502)) && (tuple->ipv4.dport >= bpf_ntohs(1024)) && payload_len > 0){
                         unsigned short *modbus_ti = (unsigned short*)((unsigned long)tcph + (tcph->doff * 4));
@@ -2456,6 +2457,7 @@ int bpf_sk_splice(struct __sk_buff *skb){
                                     }
                                 }
                             }
+                            return TC_ACT_OK;
                         }
                         else if((tstate->est) && (tstate->cfin == 1) && (bpf_htonl(tcph->ack_seq) == (bpf_htonl(tstate->cfseq) + 1))){
                             tstate->sfack = 1;

src/zfw_xdp_tun_ingress.c

@@ -200,7 +200,7 @@ int xdp_redirect_prog(struct xdp_md *ctx)
             }
             event.dport = tcph->dest;
             event.sport = tcph->source;
-            tun_state_key.sport = tcph->dest;;
+            tun_state_key.sport = tcph->dest;
             tun_state_key.dport =  tcph->source;  
         }else if (protocol == IPPROTO_UDP){
             struct udphdr *udph = (struct udphdr *)((unsigned long)iph + sizeof(*iph));
@@ -209,7 +209,7 @@ int xdp_redirect_prog(struct xdp_md *ctx)
             }
             event.dport = udph->dest;
             event.sport = udph->source;
-            tun_state_key.sport = udph->dest;;
+            tun_state_key.sport = udph->dest;
             tun_state_key.dport =  udph->source;
         }
         tun_state_key.type = 4;
@@ -256,7 +256,7 @@ int xdp_redirect_prog(struct xdp_md *ctx)
             }
             event.dport = tcph->dest;
             event.sport = tcph->source;
-            tun_state_key.sport = tcph->dest;;
+            tun_state_key.sport = tcph->dest;
             tun_state_key.dport =  tcph->source; 
         }else if (protocol == IPPROTO_UDP){
             struct udphdr *udph = (struct udphdr *)((unsigned long)ip6h + sizeof(*ip6h));
@@ -265,7 +265,7 @@ int xdp_redirect_prog(struct xdp_md *ctx)
             }
             event.dport = udph->dest;
             event.sport = udph->source;
-            tun_state_key.sport = udph->dest;;
+            tun_state_key.sport = udph->dest;
             tun_state_key.dport =  udph->source; 
         }
         struct tun_state *tus = get_tun(tun_state_key);