Fix for High Mempool Drops on UDP Connections

core/Cargo.toml

@@ -5,7 +5,7 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [build-dependencies]
-bindgen = "0.69.4" 
+bindgen = "0.69.4"
 cc = "1.0.79"
 
 [dependencies]

core/src/conntrack/conn/conn_info.rs

@@ -1,6 +1,7 @@
 use crate::conntrack::conn_id::FiveTuple;
 use crate::conntrack::pdu::L4Pdu;
 use crate::filter::FilterResult;
+use crate::protocols::packet::udp::UDP_PROTOCOL;
 use crate::protocols::stream::{
     ConnData, ParseResult, ParserRegistry, ProbeRegistryResult, Session,
 };
@@ -47,7 +48,7 @@ where
             ConnState::Tracking => {
                 self.on_track(pdu, subscription);
             }
-            ConnState::Remove => {
+            ConnState::Remove | ConnState::Dropped => {
                 drop(pdu);
             }
         }
@@ -69,7 +70,7 @@ where
                         self.on_parse(pdu, subscription);
                     }
                     FilterResult::NoMatch => {
-                        self.state = ConnState::Remove;
+                        self.state = self.get_drop_state();
                     }
                 }
             }
@@ -82,10 +83,10 @@ where
                         self.state = self.get_match_state(0);
                     }
                     FilterResult::MatchNonTerminal(_idx) => {
-                        self.state = ConnState::Remove;
+                        self.state = self.get_drop_state();
                     }
                     FilterResult::NoMatch => {
-                        self.state = ConnState::Remove;
+                        self.state = self.get_drop_state();
                     }
                 }
             }
@@ -108,7 +109,7 @@ where
                     }
                 } else {
                     log::error!("Done parse but no mru");
-                    self.state = ConnState::Remove;
+                    self.state = self.get_drop_state();
                 }
             }
             ParseResult::Continue(id) => {
@@ -134,11 +135,18 @@ where
 
     fn get_nomatch_state(&self, session_id: usize) -> ConnState {
         if session_id == 0 && T::Subscribed::level() == Level::Connection {
-            ConnState::Remove
+            self.get_drop_state()
         } else {
             self.cdata.conn_parser.session_nomatch_state()
         }
     }
+
+    fn get_drop_state(&self) -> ConnState {
+        if self.cdata.five_tuple.proto == UDP_PROTOCOL {
+            return ConnState::Dropped;
+        }
+        ConnState::Remove
+    }
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Copy)]
@@ -151,4 +159,7 @@ pub enum ConnState {
     Tracking,
     /// Connection will be removed
     Remove,
+    /// Unmatched UDP connection; waiting to be aged out by timerwheel.
+    /// Prevents dropped UDP conns from being re-inserted in table
+    Dropped,
 }

core/src/conntrack/conn/mod.rs

@@ -160,7 +160,7 @@ where
             ConnState::Tracking => {
                 self.info.sdata.on_terminate(subscription);
             }
-            ConnState::Remove => {
+            ConnState::Remove | ConnState::Dropped => {
                 // do nothing
             }
         }

core/src/conntrack/mod.rs

@@ -83,8 +83,14 @@ where
         match self.table.raw_entry_mut().from_key(&conn_id) {
             RawEntryMut::Occupied(mut occupied) => {
                 let conn = occupied.get_mut();
-                let dir = conn.packet_dir(&ctxt);
                 conn.last_seen_ts = Instant::now();
+                if conn.state() == ConnState::Dropped {
+                    // Allow connection to age out.
+                    // last_seen_ts is updated to avoid aging out long-lived UDP
+                    // connections prematurely
+                    return;
+                }
+                let dir = conn.packet_dir(&ctxt);
                 conn.inactivity_window = match &conn.l4conn {
                     L4Conn::Tcp(_) => self.config.tcp_inactivity_timeout,
                     L4Conn::Udp(_) => self.config.udp_inactivity_timeout,