Method handleOutbound

core/engine/engine.go:160–228

(key conntrack.Tuple, parsed pkt, p platform.Packet)

}

func (e *Engine) handleOutbound(key conntrack.Tuple, parsed pkt, p platform.Packet) {
	switch {
	case parsed.isSYNOnly():
		fake, sni, err := e.newFakeClientHello()
		if err != nil {
			e.warnf("build fake ClientHello: %v", err)
			p.Verdict(platform.Accept)
			return
		}
		conn := conntrack.New(key, fake)
		conn.Mu.Lock()
		conn.SynSeq = parsed.seqNum
		conn.Stage = conntrack.StageSynSent
		conn.Mu.Unlock()

		fs := &flowState{
			sni:      sni,
			strategy: e.rnd.PickStrategy(e.cfg.Strategy),
			delta:    e.rnd.IPIDDelta(),
		}
		e.flows.Store(key, fs)

		if !e.table.Add(conn) {
			if existing, ok := e.table.Get(key); ok {
				existing.Mu.Lock()
				existing.SynSeq = parsed.seqNum
				existing.Mu.Unlock()
			}
		}
		p.Verdict(platform.Accept)
		return

	case parsed.isACKOnly() && !parsed.hasPayload():
		conn, ok := e.table.Get(key)
		if !ok {
			p.Verdict(platform.Accept)
			return
		}
		conn.Mu.Lock()
		doInject := conn.Stage == conntrack.StageSynAckSeen
		if doInject {
			conn.Stage = conntrack.StageAckSent
		}
		synSeq := conn.SynSeq
		fakeData := conn.FakePayload
		conn.Mu.Unlock()

		p.Verdict(platform.Accept)

		if doInject {
			fsAny, ok := e.flows.Load(key)
			if !ok {
				// Defensive: the flow entry should always exist because we
				// stored it on the SYN before allowing the handshake to
				// progress, but if it does not, skip injection rather than
				// panic. We intentionally do NOT Finish the conn here because
				// the handshake itself is still valid — the user just loses
				// bypass for this one flow.