microsoft / microsoft/ebpf-for-windows
Purge cached verdicts in sock_addr when the corrresponding filter_context is deleted.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
1. When a filter context is deleted, all the corresponding verdicts that were cached should be deleted.
2. `_net_ebpf_ext_purge_blocked_connect_contexts()` currently is called only when the verdict is BLOCK. It should be called even in allow case, as this will clean up the queue sooner.
Contributor guide
Research direction
Start by locating the sock_addr filter-context deletion path and _net_ebpf_ext_purge_blocked_connect_contexts(). Trace how cached verdicts and the BLOCK and allow paths are handled. Done means deleting all verdicts associated with a deleted filter context and invoking the purge in both verdict cases, with the relevant tests passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100