diff --git a/bpf/flows.c b/bpf/flows.c index f9977ba1..409fda20 100644 --- a/bpf/flows.c +++ b/bpf/flows.c @@ -79,6 +79,17 @@ static inline void update_dns(additional_metrics *extra_metrics, pkt_info *pkt, } static inline int flow_monitor(struct __sk_buff *skb, u8 direction) { + u32 filter_sampling = 0; + + if (!is_filter_enabled()) { + if (sampling > 1 && (bpf_get_prandom_u32() % sampling) != 0) { + do_sampling = 0; + return TC_ACT_OK; + } + filter_sampling = sampling; + do_sampling = 1; + } + u16 eth_protocol = 0; pkt_info pkt; __builtin_memset(&pkt, 0, sizeof(pkt)); @@ -103,21 +114,21 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) { id.direction = direction; // check if this packet need to be filtered if filtering feature is enabled - u32 filter_sampling = 0; - bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0, eth_protocol, &filter_sampling); - if (skip) { - return TC_ACT_OK; - } - if (filter_sampling == 0) { - filter_sampling = sampling; - } - - // If sampling is defined, will only parse 1 out of "sampling" flows - if (filter_sampling > 1 && (bpf_get_prandom_u32() % filter_sampling) != 0) { - do_sampling = 0; - return TC_ACT_OK; + if (is_filter_enabled()) { + bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0, eth_protocol, &filter_sampling); + if (skip) { + return TC_ACT_OK; + } + if (filter_sampling == 0) { + filter_sampling = sampling; + } + // If sampling is defined, will only parse 1 out of "sampling" flows + if (filter_sampling > 1 && (bpf_get_prandom_u32() % filter_sampling) != 0) { + do_sampling = 0; + return TC_ACT_OK; + } + do_sampling = 1; } - do_sampling = 1; int dns_errno = 0; if (enable_dns_tracking) { diff --git a/bpf/flows_filter.h b/bpf/flows_filter.h index 80410f47..7d16af65 100644 --- a/bpf/flows_filter.h +++ b/bpf/flows_filter.h @@ -192,7 +192,6 @@ static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_ result++; } else { result = 0; - goto end; } } u32 sample = rule->sample; diff --git a/bpf/utils.h b/bpf/utils.h index 6ffd3a9b..64b6a6ce 100644 --- a/bpf/utils.h +++ b/bpf/utils.h @@ -174,13 +174,20 @@ static inline int fill_ethhdr(struct ethhdr *eth, void *data_end, pkt_info *pkt, return SUBMIT; } +static inline bool is_filter_enabled() { + if (enable_flows_filtering || enable_pca) { + return true; + } + return false; +} + /* * check if flow filter is enabled and if we need to continue processing the packet or not */ static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags, u32 drop_reason, u16 eth_protocol, u32 *sampling) { // check if this packet need to be filtered if filtering feature is enabled - if (enable_flows_filtering || enable_pca) { + if (is_filter_enabled()) { filter_action action = ACCEPT; if (is_flow_filtered(id, &action, flags, drop_reason, eth_protocol, sampling) != 0 && action != MAX_FILTER_ACTIONS) { @@ -210,7 +217,8 @@ static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags, u32 drop_ } else { // we have no matching rules so we update global counter for flows that are not matched by any rule increase_counter(FILTER_NOMATCH); - // we have accept rule but no match so we can't let mismatched flows in the hashmap table. + // we have accept rule but no match so we can't let mismatched flows in the hashmap table or + // we have no match at all and the action is the default value MAX_FILTER_ACTIONS. if (action == ACCEPT || action == MAX_FILTER_ACTIONS) { return true; } else { diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o index 41235fbc..521eefa0 100644 Binary files a/pkg/ebpf/bpf_arm64_bpfel.o and b/pkg/ebpf/bpf_arm64_bpfel.o differ diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o index 206025b5..cc8bd1e7 100644 Binary files a/pkg/ebpf/bpf_powerpc_bpfel.o and b/pkg/ebpf/bpf_powerpc_bpfel.o differ diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o index 9c734170..1b1e66e2 100644 Binary files a/pkg/ebpf/bpf_s390_bpfeb.o and b/pkg/ebpf/bpf_s390_bpfeb.o differ diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o index b8688ec4..80f7f0c6 100644 Binary files a/pkg/ebpf/bpf_x86_bpfel.o and b/pkg/ebpf/bpf_x86_bpfel.o differ