Format, fix test, handle legacy mode

netobserv · Dec 19, 2024 · 6b3babd · 6b3babd
1 parent ec403e4
commit 6b3babd
Show file tree

Hide file tree

Showing 12 changed files with 24 additions and 16 deletions.
diff --git a/bpf/pkt_translation.h b/bpf/pkt_translation.h
@@ -171,7 +171,8 @@ static inline int trace_nat_manip_pkt(struct nf_conn *ct, struct sk_buff *skb) {
     BPF_PRINTK("Xlat: protocol %d flags 0x%x family %d dscp %d\n", protocol, flags, family, dscp);
 
     bpf_probe_read(&zone_id, sizeof(zone_id), &ct->zone.id);
-    ret = translate_lookup_and_update_flow(&id, flags, orig_tuple, reply_tuple, zone_id, family, eth_protocol);
+    ret = translate_lookup_and_update_flow(&id, flags, orig_tuple, reply_tuple, zone_id, family,
+                                           eth_protocol);
 
     return ret;
 }

diff --git a/bpf/types.h b/bpf/types.h
@@ -108,7 +108,6 @@ const struct flow_metrics_t *unused2 __attribute__((unused));
 typedef struct additional_metrics_t {
     u64 start_mono_time_ts;
     u64 end_mono_time_ts;
-    u16 eth_protocol;
     struct dns_record_t {
         u16 id;
         u16 flags;
@@ -125,6 +124,7 @@ typedef struct additional_metrics_t {
     u64 flow_rtt;
     u8 network_events_idx;
     u8 network_events[MAX_NETWORK_EVENTS][MAX_EVENT_MD];
+    u16 eth_protocol;
     struct translated_flow_t {
         u8 saddr[IP_MAX_LEN];
         u8 daddr[IP_MAX_LEN];

diff --git a/pkg/ebpf/bpf_arm64_bpfel.go b/pkg/ebpf/bpf_arm64_bpfel.go
diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.go b/pkg/ebpf/bpf_powerpc_bpfel.go
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o
diff --git a/pkg/ebpf/bpf_s390_bpfeb.go b/pkg/ebpf/bpf_s390_bpfeb.go
diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o
diff --git a/pkg/ebpf/bpf_x86_bpfel.go b/pkg/ebpf/bpf_x86_bpfel.go
diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o
diff --git a/pkg/model/record_test.go b/pkg/model/record_test.go
@@ -79,6 +79,8 @@ func TestAdditionalMetricsBinaryEncoding(t *testing.T) {
 	// Makes sure that we read the C *not packed* additional metrics structure according
 	// to the order defined in bpf/flow.h
 	b := []byte{
+		0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // u64 flow_start_time
+		0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // u64 flow_end_time
 		// dns_record structure
 		01, 00, // id
 		0x80, 00, // flags
@@ -103,7 +105,8 @@ func TestAdditionalMetricsBinaryEncoding(t *testing.T) {
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-		0x00, // 1 byte padding
+		0x00,       // 1 byte padding
+		0x03, 0x00, // u16 eth_protocol
 		// translated flow
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -119,6 +122,9 @@ func TestAdditionalMetricsBinaryEncoding(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t, ebpf.BpfAdditionalMetrics{
+		StartMonoTimeTs: 0x10,
+		EndMonoTimeTs:   0xFF,
+		EthProtocol:     3,
 		PktDrops: ebpf.BpfPktDropsT{
 			Packets:         0x13121110,
 			Bytes:           0x1b1a191817161514,

diff --git a/pkg/tracer/tracer.go b/pkg/tracer/tracer.go
@@ -891,9 +891,14 @@ func (m *FlowFetcher) LookupAndDeleteMap(met *metrics.Metrics) map[ebpf.BpfFlowI
 	}
 
 	countAdditional := 0
-	for _, id := range ids {
+	for i, id := range ids {
 		countAdditional++
 		if err := m.objects.AdditionalFlowMetrics.LookupAndDelete(&id, &additionalMetrics); err != nil {
+			if i == 0 && errors.Is(err, cilium.ErrNotSupported) {
+				log.WithError(err).Warnf("switching to legacy mode")
+				m.lookupAndDeleteSupported = false
+				return m.legacyLookupAndDeleteMap(met)
+			}
 			log.WithError(err).WithField("flowId", id).Warnf("couldn't lookup/delete additional metrics entry")
 			met.Errors.WithErrorName("flow-fetcher", "CannotDeleteAdditionalMetric").Inc()
 			continue