optimize filter sampling logic when filtering not enabled

Signed-off-by: Mohamed Mahmoud <[email protected]>

bpf/flows.c

@@ -79,6 +79,17 @@ static inline void update_dns(additional_metrics *extra_metrics, pkt_info *pkt,
 }
 
 static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
+    u32 filter_sampling = 0;
+
+    if (!is_filter_enabled()) {
+        if (sampling > 1 && (bpf_get_prandom_u32() % sampling) != 0) {
+            do_sampling = 0;
+            return TC_ACT_OK;
+        }
+        filter_sampling = sampling;
+        do_sampling = 1;
+    }
+
     u16 eth_protocol = 0;
     pkt_info pkt;
     __builtin_memset(&pkt, 0, sizeof(pkt));
@@ -103,21 +114,21 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
     id.direction = direction;
 
     // check if this packet need to be filtered if filtering feature is enabled
-    u32 filter_sampling = 0;
-    bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0, eth_protocol, &filter_sampling);
-    if (skip) {
-        return TC_ACT_OK;
-    }
-    if (filter_sampling == 0) {
-        filter_sampling = sampling;
-    }
-
-    // If sampling is defined, will only parse 1 out of "sampling" flows
-    if (filter_sampling > 1 && (bpf_get_prandom_u32() % filter_sampling) != 0) {
-        do_sampling = 0;
-        return TC_ACT_OK;
+    if (is_filter_enabled()) {
+        bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0, eth_protocol, &filter_sampling);
+        if (skip) {
+            return TC_ACT_OK;
+        }
+        if (filter_sampling == 0) {
+            filter_sampling = sampling;
+        }
+        // If sampling is defined, will only parse 1 out of "sampling" flows
+        if (filter_sampling > 1 && (bpf_get_prandom_u32() % filter_sampling) != 0) {
+            do_sampling = 0;
+            return TC_ACT_OK;
+        }
+        do_sampling = 1;
     }
-    do_sampling = 1;
 
     int dns_errno = 0;
     if (enable_dns_tracking) {

bpf/flows_filter.h

@@ -192,7 +192,6 @@ static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_
                 result++;
             } else {
                 result = 0;
-                goto end;
             }
         }
         u32 sample = rule->sample;

bpf/utils.h

@@ -174,13 +174,20 @@ static inline int fill_ethhdr(struct ethhdr *eth, void *data_end, pkt_info *pkt,
     return SUBMIT;
 }
 
+static inline bool is_filter_enabled() {
+    if (enable_flows_filtering || enable_pca) {
+        return true;
+    }
+    return false;
+}
+
 /*
  * check if flow filter is enabled and if we need to continue processing the packet or not
  */
 static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags, u32 drop_reason,
                                                u16 eth_protocol, u32 *sampling) {
     // check if this packet need to be filtered if filtering feature is enabled
-    if (enable_flows_filtering || enable_pca) {
+    if (is_filter_enabled()) {
         filter_action action = ACCEPT;
         if (is_flow_filtered(id, &action, flags, drop_reason, eth_protocol, sampling) != 0 &&
             action != MAX_FILTER_ACTIONS) {
@@ -210,7 +217,8 @@ static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags, u32 drop_
         } else {
             // we have no matching rules so we update global counter for flows that are not matched by any rule
             increase_counter(FILTER_NOMATCH);
-            // we have accept rule but no match so we can't let mismatched flows in the hashmap table.
+            // we have accept rule but no match so we can't let mismatched flows in the hashmap table or
+            // we have no match at all and the action is the default value MAX_FILTER_ACTIONS.
             if (action == ACCEPT || action == MAX_FILTER_ACTIONS) {
                 return true;
             } else {