Leave eBPF socket storage to the kernel on close

[vincent10400094]

Problem

In eBPF packet-counter mode (enforcement_mode: ebpf), every guest Close of a counted socket failed with close_tcp: delete: bad file descriptor, so the run ended "debuglet failed" although its output had been delivered. Reproduced on v0.3.0-rc.1 on the Docker Desktop kernel for TCP (http_get) and UDP (DNS).

Cause

BpfConn.Close closed the socket and then called DebugletSkMap.Delete(fd) with the descriptor number it had just closed. debuglet_sk_map is a BPF_MAP_TYPE_SK_STORAGE map, and its key is a descriptor that the kernel resolves to a socket at call time. After the close, that number names nothing (EBADF). If it had been reused in between, it would have named another socket, and that socket's entry could have been deleted.

Fix

Close no longer deletes the entry. An SK_STORAGE entry belongs to the socket, not the fd number, and the kernel frees it when the socket is destroyed. Close still closes the socket before calling Detach, runs once (sync.Once) and returns the close error first. BpfConn no longer stores socketID.

Why the explicit delete was removed rather than moved before close

The first version of this PR deleted the entry while the fd was still open, then closed. Review found that this is a rate-limit and accounting bypass. Everything a TCP socket still sends after close(2) (the unsent send buffer, the FIN, retransmissions) no longer has the run's UUID. The egress hook therefore returns TCX_NEXT, so that data is neither throttled nor counted. A guest can fill a send buffer, close, and repeat on fresh sockets. The kernel test below measured it: under a 16 KiB/s limit, the delete-first order delivered 454,999 bytes in the second after Close, with no extra drops.

With the entry left in place, that tail keeps the UUID and is dropped once Detach removes the run's rate entry: 0 bytes delivered after Close, and egress drops rise. This also removes the fd-reuse hazard, because nothing is ever deleted by fd number.

Audit: DebugletSkMap is used only by BpfCount.Attach (Update). Every counted socket goes through hostconn.NewConnection → Attach: dialed TCP and UDP, and TCP accepted by accept_tcp. All of them close through BpfConn.Close. Listening sockets are never attached.

Tests

• TestBpfConnCloseLeavesSocketStorageToTheKernel (TCP, UDP; unprivileged): runs Close against a counter with no maps, so any map access panics and fails the test. It checks that the socket is closed once, Detach runs once, and a second Close does nothing.
• TestBpfConnClosePrefersCloseError: Close returns the close error, and a repeated Close returns the first result.
• TestKernelCounterClosesCountedConns (kernel; added to the required set in scripts/ci-kernel.sh): loads the counter on lo.
  • It attaches a dialed TCP connection, an accepted TCP connection and a dialed UDP socket, and checks their entries. Each must exchange data and close cleanly. Its rate entry must be gone. The other socket's entry must survive. A new socket that reuses the closed fd number must have no entry (ErrKeyNotExist). Counting the map's entries is not possible here, because SK_STORAGE maps cannot be iterated by key.
  • Write-then-close tail: a TCP client with a 16 KiB/s limit and a large send buffer writes for 500 ms, then closes. At most one 64 KiB burst may arrive after Close, and egress drops must increase (the tail stays attributed). The test refuses to pass if fewer than 128 KiB were left unsent at Close.

Results (linux/arm64 test binary, Docker Desktop kernel, container with the kernel lane's capabilities BPF NET_ADMIN NET_RAW PERFMON SYS_RESOURCE, no --privileged):

• This branch: the whole ratelimit/ebpf package passes with -count=3. The tail check logged written 487740, delivered 32741 before Close, 0 after; egress drops 17 -> 24 on every run.
• Unprivileged container: unit tests pass; kernel tests skip, as designed.
• Same tests against main's code: the unit test fails ("Close touched a counter map"). The kernel test fails with delete: bad file descriptor for TCP, UDP and the tail case.
• Same tests against the delete-before-close order: the tail check fails with 454999 bytes left the closed socket after Close, and egress drops stay at 13 -> 13.
• go build (darwin and GOOS=linux, excluding the wasm-only examples/), go vet (darwin and GOOS=linux) and go test ./internal/executor/ratelimit/... on darwin are clean.

Fixes #412

🤖 Generated with Claude Code