Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding drop bytes and drop packets count metric #316

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
+67 −7
Open

adding drop bytes and drop packets count metric #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
0d45ed5
adding drop bytes metric
yash97 Oct 2, 2024
77d9673
changing data type
yash97 Oct 2, 2024
1c15d06
adding packet_Sz and direction in structs
yash97 Oct 2, 2024
1d1323e
adding packet len to logs, struct data type change
yash97 Oct 3, 2024
9f721c7
Merge branch 'main' into drop_metric
yash97 Oct 23, 2024
1ffc71a
adding drop metric for ipv6
yash97 Dec 11, 2024
4b2b189
Merge branch 'main' into drop_metric
yash97 Dec 11, 2024
01fd907
make format
yash97 Dec 11, 2024
4efaf67
syntax correction
yash97 Dec 11, 2024
83dc028
Merge branch 'main' into drop_metric
yash97 Jan 10, 2025
6dd124d
Merge branch 'main' into drop_metric
yash97 Jan 11, 2025
2e78d6a
minor change
yash97 Jan 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion pkg/ebpf/c/tc.v4egress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") egress_map = {
Expand Down Expand Up @@ -163,7 +165,8 @@ int handle_egress(struct __sk_buff *skb)
evt.dest_ip = flow_key.dest_ip;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;

evt.is_egress = 1;
evt.packet_sz = skb->len;

//Check if it's an existing flow
flow_val = bpf_map_lookup_elem(&aws_conntrack_map, &flow_key);
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v4ingress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") ingress_map = {
Expand Down Expand Up @@ -170,6 +172,8 @@ int handle_ingress(struct __sk_buff *skb)
evt.dest_ip = flow_key.dest_ip;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.packet_sz = skb->len;
evt.is_egress = 0;

//Check for the reverse flow entry in the conntrack table
reverse_flow_key.src_ip = ip->daddr;
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v6egress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") egress_map = {
Expand Down Expand Up @@ -168,6 +170,8 @@ int handle_egress(struct __sk_buff *skb)
evt.src_port = flow_key.src_port;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.is_egress = 1;
evt.packet_sz = skb->len;

//Check for the reverse flow entry in the conntrack table
flow_key.daddr = ip->saddr;
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v6ingress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") ingress_map = {
Expand Down Expand Up @@ -169,6 +171,8 @@ int handle_ingress(struct __sk_buff *skb)
evt.src_port = flow_key.src_port;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.packet_sz = skb->len;
evt.is_egress = 0;

//Swap to check reverse flow
flow_key.daddr = ip->saddr;
Expand Down
2 changes: 2 additions & 0 deletions pkg/ebpf/c/v4events.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct conntrack_key {
Expand Down
2 changes: 2 additions & 0 deletions pkg/ebpf/c/v6events.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct conntrack_key {
Expand Down
53 changes: 47 additions & 6 deletions pkg/ebpf/events/events.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"github.com/aws/aws-network-policy-agent/pkg/aws"
"github.com/aws/aws-network-policy-agent/pkg/aws/services"
"github.com/aws/aws-network-policy-agent/pkg/utils"
"github.com/prometheus/client_golang/prometheus"

goebpfevents "github.com/aws/aws-ebpf-sdk-go/pkg/events"
awssdk "github.com/aws/aws-sdk-go/aws"
Expand All @@ -31,13 +32,37 @@ var (
NON_EKS_CW_PATH = "/aws/"
)

var (
dropCountTotal = prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "network_policy_drop_count_total",
Help: "Total number of packets dropped by network policy agent",
},
[]string{"direction"},
)

dropBytesTotal = prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "network_policy_drop_bytes_total",
Help: "Total number of bytes dropped by network policy agent",
},
[]string{"direction"},
)
)

func init() {
prometheus.MustRegister(dropBytesTotal, dropCountTotal)
}

type ringBufferDataV4_t struct {
SourceIP uint32
SourcePort uint32
DestIP uint32
DestPort uint32
Protocol uint32
Verdict uint32
PacketSz uint32
IsEgress uint8
}

type ringBufferDataV6_t struct {
Expand All @@ -47,6 +72,8 @@ type ringBufferDataV6_t struct {
DestPort uint32
Protocol uint32
Verdict uint32
PacketSz uint32
IsEgress uint8
}

func ConfigurePolicyEventsLogging(logger logr.Logger, enableCloudWatchLogs bool, mapFD int, enableIPv6 bool) error {
Expand Down Expand Up @@ -168,31 +195,45 @@ func capturePolicyEvents(ringbufferdata <-chan []byte, log logr.Logger, enableCl
var rb ringBufferDataV6_t
buf := bytes.NewBuffer(record)
if err := binary.Read(buf, binary.LittleEndian, &rb); err != nil {
log.Info("Failed to read from Ring buf", err)
log.Info("Failed to read from Ring buf", "error", err)
continue
}

protocol := utils.GetProtocol(int(rb.Protocol))
verdict := getVerdict(int(rb.Verdict))

if rb.Verdict == uint32(0) {
direction := "egress"
if rb.IsEgress == 0 {
direction = "ingress"
}
dropCountTotal.WithLabelValues(direction).Add(float64(1))
dropBytesTotal.WithLabelValues(direction).Add(float64(rb.PacketSz))
}
log.Info("Flow Info: ", "Src IP", utils.ConvByteToIPv6(rb.SourceIP).String(), "Src Port", rb.SourcePort,
"Dest IP", utils.ConvByteToIPv6(rb.DestIP).String(), "Dest Port", rb.DestPort,
"Proto", protocol, "Verdict", verdict)
"Proto", protocol, "Verdict", verdict, "Packetlen", rb.PacketSz)

message = "Node: " + nodeName + ";" + "SIP: " + utils.ConvByteToIPv6(rb.SourceIP).String() + ";" + "SPORT: " + strconv.Itoa(int(rb.SourcePort)) + ";" + "DIP: " + utils.ConvByteToIPv6(rb.DestIP).String() + ";" + "DPORT: " + strconv.Itoa(int(rb.DestPort)) + ";" + "PROTOCOL: " + protocol + ";" + "PolicyVerdict: " + verdict
} else {
var rb ringBufferDataV4_t
buf := bytes.NewBuffer(record)
if err := binary.Read(buf, binary.LittleEndian, &rb); err != nil {
log.Info("Failed to read from Ring buf", err)
log.Info("Failed to read from Ring buf", "error", err)
continue
}
protocol := utils.GetProtocol(int(rb.Protocol))
verdict := getVerdict(int(rb.Verdict))

if rb.Verdict == uint32(0) {
direction := "egress"
if rb.IsEgress == 0 {
direction = "ingress"
}
dropCountTotal.WithLabelValues(direction).Add(float64(1))
dropBytesTotal.WithLabelValues(direction).Add(float64(rb.PacketSz))
}
log.Info("Flow Info: ", "Src IP", utils.ConvByteArrayToIP(rb.SourceIP), "Src Port", rb.SourcePort,
"Dest IP", utils.ConvByteArrayToIP(rb.DestIP), "Dest Port", rb.DestPort,
"Proto", protocol, "Verdict", verdict)
"Proto", protocol, "Verdict", verdict, "Packetlen", rb.PacketSz)

message = "Node: " + nodeName + ";" + "SIP: " + utils.ConvByteArrayToIP(rb.SourceIP) + ";" + "SPORT: " + strconv.Itoa(int(rb.SourcePort)) + ";" + "DIP: " + utils.ConvByteArrayToIP(rb.DestIP) + ";" + "DPORT: " + strconv.Itoa(int(rb.DestPort)) + ";" + "PROTOCOL: " + protocol + ";" + "PolicyVerdict: " + verdict
}
Expand Down
Loading