[client] Improve TCP conn tracking

[lixmal]

Describe your changes

• Handle Rst in both directions properly
• Remove IsEstablished
• Eliminate mutex
• Fix first state for inbound conns
• Update counters before terminating conns
• Create new conns for packets with Syn flag only
• Add more tests

Issue ticket number and link

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• Extended the README / documentation, if necessary

[Copilot]

Pull Request Overview

This PR improves TCP connection tracking by enhancing state management, handling RST packets bidirectionally, and eliminating the mutex for more efficient atomic operations. Key changes include updating the TCP state transitions with atomic operations, refining the logic for outbound and inbound packet tracking, and adding benchmark tests to assess performance.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
client/firewall/uspfilter/conntrack/tcp_bench_test.go	Added benchmark tests for tracking and cleanup operations
client/firewall/uspfilter/conntrack/tcp.go	Modified TCP state management, updated state transitions, and removed the established flag and mutex

Comments suppressed due to low confidence (1)

client/firewall/uspfilter/conntrack/tcp.go:308

• For outbound connections in TCPStateFinWait1, when both TCPFin and TCPAck flags are set, the first case is entered but newState is not assigned due to the '!isOutbound' check. Consider handling outbound transitions explicitly (e.g., setting newState = TCPStateFinWait2) to avoid stalling state transitions.

case flags&TCPFin != 0 && flags&TCPAck != 0:

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.9% Duplication on New Code

See analysis details on SonarQube Cloud