Skip to content

Commit ef17f5d

Browse files
msherif1234msherif1234
committed
IPsec userspace to enable ipsec tracker
Signed-off-by: Mohamed Mahmoud <[email protected]>
1 parent 71dd68c commit ef17f5d

File tree

10 files changed

+278
-85
lines changed

10 files changed

+278
-85
lines changed

‎pkg/agent/agent.go

+1
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,7 @@ func FlowsAgent(cfg *Config) (*Flows, error) {
237237
EnablePktTranslation: cfg.EnablePktTranslationTracking,
238238
UseEbpfManager: cfg.EbpfProgramManagerMode,
239239
BpfManBpfFSPath: cfg.BpfManBpfFSPath,
240+
EnableIPsecTracker: cfg.EnableIPsecTracking,
240241
FilterConfig: filterRules,
241242
}
242243

‎pkg/agent/config.go

+2
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,8 @@ type Config struct {
236236
BpfManBpfFSPath string `env:"BPFMAN_BPF_FS_PATH" envDefault:"/run/netobserv/maps"`
237237
// EnableUDNMapping to allow mapping pod's interface to udn label
238238
EnableUDNMapping bool `env:"ENABLE_UDN_MAPPING" envDefault:"false"`
239+
// EnableIPsecTracking enable tracking IPsec flows encryption
240+
EnableIPsecTracking bool `env:"ENABLE_IPSEC_TRACKING" envDefault:"false"`
239241
/* Deprecated configs are listed below this line
240242
* See manageDeprecatedConfigs function for details
241243
*/

‎pkg/decode/decode_protobuf.go

+4
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ func RecordToMap(fr *model.Record) config.GenericMap {
141141
out["XlatSrcAddr"] = model.IP(fr.Metrics.AdditionalMetrics.TranslatedFlow.Saddr).String()
142142
out["XlatDstAddr"] = model.IP(fr.Metrics.AdditionalMetrics.TranslatedFlow.Daddr).String()
143143
}
144+
if fr.Metrics.AdditionalMetrics.FlowEncrypted || fr.Metrics.AdditionalMetrics.FlowEncryptedRet != 0 {
145+
out["EncryptedFlow"] = fr.Metrics.AdditionalMetrics.FlowEncrypted
146+
out["EncryptedFlowRet"] = fr.Metrics.AdditionalMetrics.FlowEncryptedRet
147+
}
144148
}
145149

146150
if fr.TimeFlowRtt != 0 {

‎pkg/decode/decode_protobuf_test.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ func TestPBFlowToMap(t *testing.T) {
9696
DstPort: 2,
9797
ZoneId: 100,
9898
},
99+
FlowEncrypted: 1,
100+
FlowEncryptedRet: 0,
99101
}
100102

101103
out := PBFlowToMap(flow)
@@ -146,10 +148,12 @@ func TestPBFlowToMap(t *testing.T) {
146148
"Direction": "egress",
147149
},
148150
},
149-
"XlatSrcAddr": "1.2.3.4",
150-
"XlatDstAddr": "5.6.7.8",
151-
"XlatSrcPort": uint16(1),
152-
"XlatDstPort": uint16(2),
153-
"ZoneId": uint16(100),
151+
"XlatSrcAddr": "1.2.3.4",
152+
"XlatDstAddr": "5.6.7.8",
153+
"XlatSrcPort": uint16(1),
154+
"XlatDstPort": uint16(2),
155+
"ZoneId": uint16(100),
156+
"EncryptedFlow": true,
157+
"EncryptedFlowRet": uint8(0),
154158
}, out)
155159
}

‎pkg/exporter/converters_test.go

+46-37
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ func TestConversions(t *testing.T) {
5353
DnsRecord: ebpf.BpfDnsRecordT{
5454
Errno: 0,
5555
},
56+
FlowEncrypted: true,
5657
},
5758
},
5859
Interfaces: []model.IntfDirUdn{model.NewIntfDirUdn("eth0", model.DirectionEgress, nil)},
@@ -61,25 +62,27 @@ func TestConversions(t *testing.T) {
6162
AgentIP: net.IPv4(0x0a, 0x0b, 0x0c, 0x0d),
6263
},
6364
expected: &config.GenericMap{
64-
"IfDirections": []int{1},
65-
"Bytes": 456,
66-
"SrcAddr": "6.7.8.9",
67-
"DstAddr": "10.11.12.13",
68-
"Dscp": 64,
69-
"DstMac": "0A:0B:0C:0D:0E:0F",
70-
"SrcMac": "04:05:06:07:08:09",
71-
"Etype": 2048,
72-
"Packets": 123,
73-
"Proto": 6,
74-
"SrcPort": 23000,
75-
"DstPort": 443,
76-
"Flags": 0x100,
77-
"Sampling": 1,
78-
"TimeFlowStartMs": someTime.UnixMilli(),
79-
"TimeFlowEndMs": someTime.UnixMilli(),
80-
"Interfaces": []string{"eth0"},
81-
"Udns": []string{""},
82-
"AgentIP": "10.11.12.13",
65+
"IfDirections": []int{1},
66+
"Bytes": 456,
67+
"SrcAddr": "6.7.8.9",
68+
"DstAddr": "10.11.12.13",
69+
"Dscp": 64,
70+
"DstMac": "0A:0B:0C:0D:0E:0F",
71+
"SrcMac": "04:05:06:07:08:09",
72+
"Etype": 2048,
73+
"Packets": 123,
74+
"Proto": 6,
75+
"SrcPort": 23000,
76+
"DstPort": 443,
77+
"Flags": 0x100,
78+
"Sampling": 1,
79+
"TimeFlowStartMs": someTime.UnixMilli(),
80+
"TimeFlowEndMs": someTime.UnixMilli(),
81+
"Interfaces": []string{"eth0"},
82+
"Udns": []string{""},
83+
"AgentIP": "10.11.12.13",
84+
"EncryptedFlow": true,
85+
"EncryptedFlowRet": 0,
8386
},
8487
},
8588
{
@@ -345,6 +348,7 @@ func TestConversions(t *testing.T) {
345348
LatestState: 6,
346349
LatestDropCause: 5,
347350
},
351+
FlowEncrypted: true,
348352
},
349353
},
350354
Interfaces: []model.IntfDirUdn{model.NewIntfDirUdn("eth0", model.DirectionEgress, nil)},
@@ -383,6 +387,8 @@ func TestConversions(t *testing.T) {
383387
"DnsFlags": 0x8001,
384388
"DnsFlagsResponseCode": "FormErr",
385389
"TimeFlowRttNs": someDuration.Nanoseconds(),
390+
"EncryptedFlow": true,
391+
"EncryptedFlowRet": 0,
386392
},
387393
},
388394
{
@@ -409,6 +415,7 @@ func TestConversions(t *testing.T) {
409415
DnsRecord: ebpf.BpfDnsRecordT{
410416
Errno: 0,
411417
},
418+
FlowEncrypted: true,
412419
},
413420
},
414421
Interfaces: []model.IntfDirUdn{
@@ -420,24 +427,26 @@ func TestConversions(t *testing.T) {
420427
AgentIP: net.IPv4(0x0a, 0x0b, 0x0c, 0x0d),
421428
},
422429
expected: &config.GenericMap{
423-
"IfDirections": []int{0, 1},
424-
"Bytes": 64,
425-
"SrcAddr": "6.7.8.9",
426-
"DstAddr": "10.11.12.13",
427-
"Dscp": 64,
428-
"DstMac": "0A:0B:0C:0D:0E:0F",
429-
"SrcMac": "04:05:06:07:08:09",
430-
"Etype": 2048,
431-
"Packets": 1,
432-
"Proto": 6,
433-
"SrcPort": 23000,
434-
"DstPort": 443,
435-
"Flags": 0x100,
436-
"TimeFlowStartMs": someTime.UnixMilli(),
437-
"TimeFlowEndMs": someTime.UnixMilli(),
438-
"Interfaces": []string{"5e6e92caa1d51cf", "eth0"},
439-
"Udns": []string{"", ""},
440-
"AgentIP": "10.11.12.13",
430+
"IfDirections": []int{0, 1},
431+
"Bytes": 64,
432+
"SrcAddr": "6.7.8.9",
433+
"DstAddr": "10.11.12.13",
434+
"Dscp": 64,
435+
"DstMac": "0A:0B:0C:0D:0E:0F",
436+
"SrcMac": "04:05:06:07:08:09",
437+
"Etype": 2048,
438+
"Packets": 1,
439+
"Proto": 6,
440+
"SrcPort": 23000,
441+
"DstPort": 443,
442+
"Flags": 0x100,
443+
"TimeFlowStartMs": someTime.UnixMilli(),
444+
"TimeFlowEndMs": someTime.UnixMilli(),
445+
"Interfaces": []string{"5e6e92caa1d51cf", "eth0"},
446+
"Udns": []string{"", ""},
447+
"AgentIP": "10.11.12.13",
448+
"EncryptedFlow": true,
449+
"EncryptedFlowRet": 0,
441450
},
442451
},
443452
}

‎pkg/model/flow_content.go

+7
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,13 @@ func (p *BpfFlowContent) AccumulateAdditional(other *ebpf.BpfAdditionalMetrics)
117117
if !AllZeroIP(IP(other.TranslatedFlow.Saddr)) && !AllZeroIP(IP(other.TranslatedFlow.Daddr)) {
118118
p.AdditionalMetrics.TranslatedFlow = other.TranslatedFlow
119119
}
120+
// Encryption
121+
if other.FlowEncrypted {
122+
p.AdditionalMetrics.FlowEncrypted = other.FlowEncrypted
123+
}
124+
if p.AdditionalMetrics.FlowEncryptedRet != other.FlowEncryptedRet {
125+
p.AdditionalMetrics.FlowEncryptedRet = other.FlowEncryptedRet
126+
}
120127
}
121128

122129
func allZerosMac(s [6]uint8) bool {

‎pkg/pbflow/flow.pb.go

+62-40
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/pbflow/proto.go

+8-1
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ func FlowToPB(fr *model.Record) *Record {
8484
DstPort: uint32(fr.Metrics.AdditionalMetrics.TranslatedFlow.Dport),
8585
ZoneId: uint32(fr.Metrics.AdditionalMetrics.TranslatedFlow.ZoneId),
8686
}
87+
pbflowRecord.FlowEncryptedRet = uint32(fr.Metrics.AdditionalMetrics.FlowEncryptedRet)
88+
if fr.Metrics.AdditionalMetrics.FlowEncrypted {
89+
pbflowRecord.FlowEncrypted = uint32(1)
90+
}
8791
}
8892
pbflowRecord.DupList = make([]*DupMapEntry, 0)
8993
for _, intf := range fr.Interfaces {
@@ -166,6 +170,7 @@ func PBToFlow(pb *Record) *model.Record {
166170
Dport: uint16(pb.Xlat.GetDstPort()),
167171
ZoneId: uint16(pb.Xlat.GetZoneId()),
168172
},
173+
FlowEncryptedRet: uint8(pb.FlowEncryptedRet),
169174
},
170175
},
171176
TimeFlowStart: pb.TimeFlowStart.AsTime(),
@@ -174,7 +179,9 @@ func PBToFlow(pb *Record) *model.Record {
174179
TimeFlowRtt: pb.TimeFlowRtt.AsDuration(),
175180
DNSLatency: pb.DnsLatency.AsDuration(),
176181
}
177-
182+
if pb.FlowEncrypted != 0 {
183+
out.Metrics.AdditionalMetrics.FlowEncrypted = true
184+
}
178185
if len(pb.GetDupList()) != 0 {
179186
for _, entry := range pb.GetDupList() {
180187
out.Interfaces = append(out.Interfaces, model.IntfDirUdn{

0 commit comments

Comments
 (0)