Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding drop bytes and drop packets count metric #316

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
Open

adding drop bytes and drop packets count metric #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
29205bb
adding drop bytes metric
yash97 Oct 2, 2024
0a0e84e
changing data type
yash97 Oct 2, 2024
fff96b3
adding packet_Sz and direction in structs
yash97 Oct 2, 2024
2a98824
adding packet len to logs, struct data type change
yash97 Oct 3, 2024
8950d07
adding drop metric for ipv6
yash97 Dec 11, 2024
d50727f
make format
yash97 Dec 11, 2024
d2881ac
syntax correction
yash97 Dec 11, 2024
1beb111
minor change
yash97 Jan 11, 2025
5381e90
adding direction in log
yash97 Feb 6, 2025
e587f7c
Merge branch 'main' into drop_metric
yash97 Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion pkg/ebpf/c/tc.v4egress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
yash97 marked this conversation as resolved.
Show resolved Hide resolved
};

struct bpf_map_def_pvt SEC("maps") egress_map = {
Expand Down Expand Up @@ -163,7 +165,8 @@ int handle_egress(struct __sk_buff *skb)
evt.dest_ip = flow_key.dest_ip;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;

evt.is_egress = 1;
evt.packet_sz = skb->len;

//Check if it's an existing flow
flow_val = bpf_map_lookup_elem(&aws_conntrack_map, &flow_key);
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v4ingress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") ingress_map = {
Expand Down Expand Up @@ -170,6 +172,8 @@ int handle_ingress(struct __sk_buff *skb)
evt.dest_ip = flow_key.dest_ip;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.packet_sz = skb->len;
evt.is_egress = 0;

//Check for the reverse flow entry in the conntrack table
reverse_flow_key.src_ip = ip->daddr;
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v6egress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") egress_map = {
Expand Down Expand Up @@ -168,6 +170,8 @@ int handle_egress(struct __sk_buff *skb)
evt.src_port = flow_key.src_port;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.is_egress = 1;
evt.packet_sz = skb->len;

//Check for the reverse flow entry in the conntrack table
flow_key.daddr = ip->saddr;
Expand Down
4 changes: 4 additions & 0 deletions pkg/ebpf/c/tc.v6ingress.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct bpf_map_def_pvt SEC("maps") ingress_map = {
Expand Down Expand Up @@ -169,6 +171,8 @@ int handle_ingress(struct __sk_buff *skb)
evt.src_port = flow_key.src_port;
evt.dest_port = flow_key.dest_port;
evt.protocol = flow_key.protocol;
evt.packet_sz = skb->len;
evt.is_egress = 0;

//Swap to check reverse flow
flow_key.daddr = ip->saddr;
Expand Down
2 changes: 2 additions & 0 deletions pkg/ebpf/c/v4events.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct conntrack_key {
Expand Down
2 changes: 2 additions & 0 deletions pkg/ebpf/c/v6events.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ struct data_t {
__u32 dest_port;
__u32 protocol;
__u32 verdict;
__u32 packet_sz;
__u8 is_egress;
};

struct conntrack_key {
Expand Down
52 changes: 46 additions & 6 deletions pkg/ebpf/events/events.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"github.com/aws/aws-network-policy-agent/pkg/aws"
"github.com/aws/aws-network-policy-agent/pkg/aws/services"
"github.com/aws/aws-network-policy-agent/pkg/utils"
"github.com/prometheus/client_golang/prometheus"

goebpfevents "github.com/aws/aws-ebpf-sdk-go/pkg/events"
awssdk "github.com/aws/aws-sdk-go/aws"
Expand All @@ -31,13 +32,37 @@ var (
NON_EKS_CW_PATH = "/aws/"
)

var (
dropCountTotal = prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "network_policy_drop_count_total",
Help: "Total number of packets dropped by network policy agent",
},
[]string{"direction"},
)

dropBytesTotal = prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "network_policy_drop_bytes_total",
Help: "Total number of bytes dropped by network policy agent",
},
[]string{"direction"},
)
)

func init() {
prometheus.MustRegister(dropBytesTotal, dropCountTotal)
}

type ringBufferDataV4_t struct {
SourceIP uint32
SourcePort uint32
DestIP uint32
DestPort uint32
Protocol uint32
Verdict uint32
PacketSz uint32
IsEgress uint8
}

type ringBufferDataV6_t struct {
Expand All @@ -47,6 +72,8 @@ type ringBufferDataV6_t struct {
DestPort uint32
Protocol uint32
Verdict uint32
PacketSz uint32
IsEgress uint8
}

func ConfigurePolicyEventsLogging(logger logr.Logger, enableCloudWatchLogs bool, mapFD int, enableIPv6 bool) error {
Expand Down Expand Up @@ -162,35 +189,48 @@ func capturePolicyEvents(ringbufferdata <-chan []byte, log logr.Logger, enableCl
for record := range ringbufferdata {
var logQueue []*cloudwatchlogs.InputLogEvent
var message string
direction := "egress"
if enableIPv6 {
var rb ringBufferDataV6_t
buf := bytes.NewBuffer(record)
if err := binary.Read(buf, binary.LittleEndian, &rb); err != nil {
log.Info("Failed to read from Ring buf", err)
log.Info("Failed to read from Ring buf", "error", err)
continue
}

protocol := utils.GetProtocol(int(rb.Protocol))
verdict := getVerdict(int(rb.Verdict))

if rb.Verdict == uint32(0) {
if rb.IsEgress == 0 {
direction = "ingress"
}
dropCountTotal.WithLabelValues(direction).Add(float64(1))
dropBytesTotal.WithLabelValues(direction).Add(float64(rb.PacketSz))
}
log.Info("Flow Info: ", "Src IP", utils.ConvByteToIPv6(rb.SourceIP).String(), "Src Port", rb.SourcePort,
"Dest IP", utils.ConvByteToIPv6(rb.DestIP).String(), "Dest Port", rb.DestPort,
"Proto", protocol, "Verdict", verdict)
"Proto", protocol, "Verdict", verdict, "Direction", direction)

message = "Node: " + nodeName + ";" + "SIP: " + utils.ConvByteToIPv6(rb.SourceIP).String() + ";" + "SPORT: " + strconv.Itoa(int(rb.SourcePort)) + ";" + "DIP: " + utils.ConvByteToIPv6(rb.DestIP).String() + ";" + "DPORT: " + strconv.Itoa(int(rb.DestPort)) + ";" + "PROTOCOL: " + protocol + ";" + "PolicyVerdict: " + verdict
} else {
var rb ringBufferDataV4_t
buf := bytes.NewBuffer(record)
if err := binary.Read(buf, binary.LittleEndian, &rb); err != nil {
log.Info("Failed to read from Ring buf", err)
log.Info("Failed to read from Ring buf", "error", err)
continue
}
protocol := utils.GetProtocol(int(rb.Protocol))
verdict := getVerdict(int(rb.Verdict))

if rb.Verdict == uint32(0) {
if rb.IsEgress == 0 {
direction = "ingress"
}
dropCountTotal.WithLabelValues(direction).Add(float64(1))
dropBytesTotal.WithLabelValues(direction).Add(float64(rb.PacketSz))
}
log.Info("Flow Info: ", "Src IP", utils.ConvByteArrayToIP(rb.SourceIP), "Src Port", rb.SourcePort,
"Dest IP", utils.ConvByteArrayToIP(rb.DestIP), "Dest Port", rb.DestPort,
"Proto", protocol, "Verdict", verdict)
"Proto", protocol, "Verdict", verdict, "Direction", direction)

message = "Node: " + nodeName + ";" + "SIP: " + utils.ConvByteArrayToIP(rb.SourceIP) + ";" + "SPORT: " + strconv.Itoa(int(rb.SourcePort)) + ";" + "DIP: " + utils.ConvByteArrayToIP(rb.DestIP) + ";" + "DPORT: " + strconv.Itoa(int(rb.DestPort)) + ";" + "PROTOCOL: " + protocol + ";" + "PolicyVerdict: " + verdict
}
Expand Down
Loading