[BPF] Conntrack entry cleaned up by TCP RSTs with unexpected sequence numbers

[ioworker0]

In eBPF mode, there is an issue where TCP RSTs with unexpected sequence numbers can trigger conntrack state to be torn down. In turn the conntrack entry will be cleaned up (on a 10s timer) so after that the TCP flow will die. However, the flow should have remained alive because the kernel on the receiving side will drop/discard out-of-window RSTs.

Perhaps, we need to find a way to adjust the conntrack tracking to drop/discard out-of-window RSTs, similar to how the kernel does, ensuring that the conntrack entry would survive.

BTW, everything is working as expected in iptables mode, as out-of-window TCP RSTs have no impact on conntrack entries and will be dropped by iptables.

It's related to https://calicousers.slack.com/archives/CUKP5S64R/p1734009200633879

Your Environment

• Calico version: v3.27.3
• Calico dataplane: eBPF

[ioworker0]

CC @tomastigera @fasaxc