eBPF tracer: additional invalidation of the connection timestamp for the case when the new connection is not a TCP one (Unix socket)

containers/container.go

@@ -469,7 +469,7 @@ func (c *Container) onL7Request(pid uint32, fd uint64, timestamp uint64, r *ebpf
 	c.lock.Lock()
 	defer c.lock.Unlock()
 	for dest, conn := range c.connectionsActive {
-		if conn.Pid == pid && conn.Fd == fd && (timestamp == 0 || conn.Timestamp == timestamp) {
+		if conn.Pid == pid && conn.Fd == fd && (conn.Timestamp == 0 || conn.Timestamp == timestamp) {
 			key := AddrPair{src: dest.dst, dst: conn.ActualDest}
 			stats := c.l7Stats[r.Protocol]
 			if stats == nil {

ebpftracer/ebpf/tcp/state.c

@@ -163,6 +163,10 @@ int sys_enter_connect(void *ctx) {
     }
     __u64 id = bpf_get_current_pid_tgid();
     bpf_map_update_elem(&fd_by_pid_tgid, &id, &args.fd, BPF_ANY);
+    struct sk_info k = {};
+    k.pid = id >> 32;
+    k.fd = args.fd;
+    bpf_map_delete_elem(&connection_timestamps, &k);
     return 0;
 }