Skip to content

Commit 539f368

Browse files
msherif1234msherif1234
committed
IPsec userspace to enable ipsec tracker
Signed-off-by: Mohamed Mahmoud <[email protected]>
1 parent 89b1cf6 commit 539f368

File tree

3 files changed

+56
-1
lines changed

3 files changed

+56
-1
lines changed

‎pkg/agent/agent.go

+1
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,7 @@ func FlowsAgent(cfg *Config) (*Flows, error) {
235235
EnablePktTranslation: cfg.EnablePktTranslationTracking,
236236
UseEbpfManager: cfg.EbpfProgramManagerMode,
237237
BpfManBpfFSPath: cfg.BpfManBpfFSPath,
238+
EnableIPsecTracker: cfg.EnableIPsecTracking,
238239
FilterConfig: filterRules,
239240
}
240241

‎pkg/agent/config.go

+2
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,8 @@ type Config struct {
236236
BpfManBpfFSPath string `env:"BPFMAN_BPF_FS_PATH" envDefault:"/run/netobserv/maps"`
237237
// EnableUDNMapping to allow mapping pod's interface to udn label
238238
EnableUDNMapping bool `env:"ENABLE_UDN_MAPPING" envDefault:"false"`
239+
// EnableIPsecTracking enable tracking IPsec flows encryption
240+
EnableIPsecTracking bool `env:"ENABLE_IPSEC_TRACKING" envDefault:"false"`
239241
/* Deprecated configs are listed below this line
240242
* See manageDeprecatedConfigs function for details
241243
*/

‎pkg/tracer/tracer.go

+53-1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ const (
6262
rhNetworkEventsMonitoringHook = "rh_psample_sample_packet"
6363
networkEventsMonitoringHook = "psample_sample_packet"
6464
defaultNetworkEventsGroupID = 10
65+
constEnableIPsec = "enable_ipsec"
6566
)
6667

6768
var log = logrus.WithField("component", "ebpf.FlowFetcher")
@@ -87,6 +88,8 @@ type FlowFetcher struct {
8788
ingressTCXLink map[ifaces.Interface]link.Link
8889
networkEventsMonitoringLink link.Link
8990
nfNatManIPLink link.Link
91+
xfrmInputLink link.Link
92+
xfrmOutputLink link.Link
9093
lookupAndDeleteSupported bool
9194
useEbpfManager bool
9295
pinDir string
@@ -109,6 +112,7 @@ type FlowFetcherConfig struct {
109112
EnablePktTranslation bool
110113
UseEbpfManager bool
111114
BpfManBpfFSPath string
115+
EnableIPsecTracker bool
112116
FilterConfig []*FilterConfig
113117
}
114118

@@ -120,7 +124,7 @@ type variablesMapping struct {
120124
// nolint:golint,cyclop
121125
func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
122126
var pktDropsLink, networkEventsMonitoringLink, rttFentryLink, rttKprobeLink link.Link
123-
var nfNatManIPLink link.Link
127+
var nfNatManIPLink, xfrmInputLink, xfrmOutputLink link.Link
124128
var err error
125129
objects := ebpf.BpfObjects{}
126130
var pinDir string
@@ -243,6 +247,19 @@ func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
243247
return nil, fmt.Errorf("failed to attach the BPF program to nat_manip kprobe: %w", err)
244248
}
245249
}
250+
251+
if cfg.EnableIPsecTracker {
252+
xfrmInputLink, err = link.Kretprobe("xfrm_input", objects.XfrmInputKprobe, nil)
253+
if err != nil {
254+
log.Warningf("failed to attach the BPF program to xfrm_input: %v", err)
255+
return nil, fmt.Errorf("failed to attach the BPF program to xfrm_input: %w", err)
256+
}
257+
xfrmOutputLink, err = link.Kretprobe("xfrm_output", objects.XfrmOutputKprobe, nil)
258+
if err != nil {
259+
log.Warningf("failed to attach the BPF program to xfrm_output: %v", err)
260+
return nil, fmt.Errorf("failed to attach the BPF program to xfrm_output: %w", err)
261+
}
262+
}
246263
} else {
247264
pinDir = cfg.BpfManBpfFSPath
248265
opts := &cilium.LoadPinOptions{
@@ -325,6 +342,8 @@ func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
325342
rttFentryLink: rttFentryLink,
326343
rttKprobeLink: rttKprobeLink,
327344
nfNatManIPLink: nfNatManIPLink,
345+
xfrmInputLink: xfrmInputLink,
346+
xfrmOutputLink: xfrmOutputLink,
328347
egressTCXLink: map[ifaces.Interface]link.Link{},
329348
ingressTCXLink: map[ifaces.Interface]link.Link{},
330349
networkEventsMonitoringLink: networkEventsMonitoringLink,
@@ -703,6 +722,18 @@ func (m *FlowFetcher) Close() error {
703722
errs = append(errs, err)
704723
}
705724
}
725+
726+
if m.xfrmInputLink != nil {
727+
if err := m.xfrmInputLink.Close(); err != nil {
728+
errs = append(errs, err)
729+
}
730+
}
731+
732+
if m.xfrmOutputLink != nil {
733+
if err := m.xfrmOutputLink.Close(); err != nil {
734+
errs = append(errs, err)
735+
}
736+
}
706737
// m.ringbufReader.Read is a blocking operation, so we need to close the ring buffer
707738
// from another goroutine to avoid the system not being able to exit if there
708739
// isn't traffic in a given interface
@@ -1063,6 +1094,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
10631094
TcxEgressPcaParse *cilium.Program `ebpf:"tcx_egress_pca_parse"`
10641095
TcxIngressPcaParse *cilium.Program `ebpf:"tcx_ingress_pca_parse"`
10651096
TrackNatManipPkt *cilium.Program `ebpf:"track_nat_manip_pkt"`
1097+
XfrmInputKprobe *cilium.Program `ebpf:"xfrm_input_kprobe"`
1098+
XfrmOutputKprobe *cilium.Program `ebpf:"xfrm_output_kprobe"`
10661099
}
10671100
type newBpfObjects struct {
10681101
newBpfPrograms
@@ -1088,6 +1121,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
10881121
TcxEgressPcaParse: newObjects.TcxEgressPcaParse,
10891122
TcxIngressPcaParse: newObjects.TcxIngressPcaParse,
10901123
TrackNatManipPkt: newObjects.TrackNatManipPkt,
1124+
XfrmInputKprobe: newObjects.XfrmInputKprobe,
1125+
XfrmOutputKprobe: newObjects.XfrmOutputKprobe,
10911126
TcpRcvKprobe: nil,
10921127
TcpRcvFentry: nil,
10931128
KfreeSkb: nil,
@@ -1116,6 +1151,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
11161151
TcxIngressPcaParse *cilium.Program `ebpf:"tcx_ingress_pca_parse"`
11171152
TCPRcvKprobe *cilium.Program `ebpf:"tcp_rcv_kprobe"`
11181153
TrackNatManipPkt *cilium.Program `ebpf:"track_nat_manip_pkt"`
1154+
XfrmInputKprobe *cilium.Program `ebpf:"xfrm_input_kprobe"`
1155+
XfrmOutputKprobe *cilium.Program `ebpf:"xfrm_output_kprobe"`
11191156
}
11201157
type newBpfObjects struct {
11211158
newBpfPrograms
@@ -1141,6 +1178,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
11411178
TcxIngressPcaParse: newObjects.TcxIngressPcaParse,
11421179
TcpRcvKprobe: newObjects.TCPRcvKprobe,
11431180
TrackNatManipPkt: newObjects.TrackNatManipPkt,
1181+
XfrmInputKprobe: newObjects.XfrmInputKprobe,
1182+
XfrmOutputKprobe: newObjects.XfrmOutputKprobe,
11441183
TcpRcvFentry: nil,
11451184
KfreeSkb: nil,
11461185
RhNetworkEventsMonitoring: nil,
@@ -1168,6 +1207,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
11681207
TcxIngressPcaParse *cilium.Program `ebpf:"tcx_ingress_pca_parse"`
11691208
TCPRcvFentry *cilium.Program `ebpf:"tcp_rcv_fentry"`
11701209
TrackNatManipPkt *cilium.Program `ebpf:"track_nat_manip_pkt"`
1210+
XfrmInputKprobe *cilium.Program `ebpf:"xfrm_input_kprobe"`
1211+
XfrmOutputKprobe *cilium.Program `ebpf:"xfrm_output_kprobe"`
11711212
}
11721213
type newBpfObjects struct {
11731214
newBpfPrograms
@@ -1193,6 +1234,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
11931234
TcxIngressPcaParse: newObjects.TcxIngressPcaParse,
11941235
TcpRcvFentry: newObjects.TCPRcvFentry,
11951236
TrackNatManipPkt: newObjects.TrackNatManipPkt,
1237+
XfrmInputKprobe: newObjects.XfrmInputKprobe,
1238+
XfrmOutputKprobe: newObjects.XfrmOutputKprobe,
11961239
TcpRcvKprobe: nil,
11971240
KfreeSkb: nil,
11981241
RhNetworkEventsMonitoring: nil,
@@ -1222,6 +1265,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
12221265
TCPRcvKprobe *cilium.Program `ebpf:"tcp_rcv_kprobe"`
12231266
KfreeSkb *cilium.Program `ebpf:"kfree_skb"`
12241267
TrackNatManipPkt *cilium.Program `ebpf:"track_nat_manip_pkt"`
1268+
XfrmInputKprobe *cilium.Program `ebpf:"xfrm_input_kprobe"`
1269+
XfrmOutputKprobe *cilium.Program `ebpf:"xfrm_output_kprobe"`
12251270
}
12261271
type newBpfObjects struct {
12271272
newBpfPrograms
@@ -1248,6 +1293,8 @@ func kernelSpecificLoadAndAssign(oldKernel, rtKernel, supportNetworkEvents bool,
12481293
TcpRcvKprobe: newObjects.TCPRcvKprobe,
12491294
KfreeSkb: newObjects.KfreeSkb,
12501295
TrackNatManipPkt: newObjects.TrackNatManipPkt,
1296+
XfrmInputKprobe: newObjects.XfrmInputKprobe,
1297+
XfrmOutputKprobe: newObjects.XfrmOutputKprobe,
12511298
RhNetworkEventsMonitoring: nil,
12521299
},
12531300
BpfMaps: ebpf.BpfMaps{
@@ -1838,6 +1885,10 @@ func configureFlowSpecVariables(spec *cilium.CollectionSpec, cfg *FlowFetcherCon
18381885
if cfg.EnablePktTranslation {
18391886
enablePktTranslation = 1
18401887
}
1888+
enableIPsec := 0
1889+
if cfg.EnableIPsecTracker {
1890+
enableIPsec = 1
1891+
}
18411892
// When adding constants here, remember to delete them in NewPacketFetcher
18421893
variables := []variablesMapping{
18431894
{constSampling, uint32(cfg.Sampling)},
@@ -1850,6 +1901,7 @@ func configureFlowSpecVariables(spec *cilium.CollectionSpec, cfg *FlowFetcherCon
18501901
{constEnableNetworkEventsMonitoring, uint8(enableNetworkEventsMonitoring)},
18511902
{constNetworkEventsMonitoringGroupID, uint8(networkEventsMonitoringGroupID)},
18521903
{constEnablePktTranslation, uint8(enablePktTranslation)},
1904+
{constEnableIPsec, uint8(enableIPsec)},
18531905
}
18541906

18551907
for _, mapping := range variables {

0 commit comments

Comments
 (0)