Skip to content

QUIC eBPF packet tracker #867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
msherif1234 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

QUIC eBPF packet tracker #867

msherif1234 wants to merge 4 commits into from

Conversation

@msherif1234
Copy link
Contributor

@msherif1234 msherif1234 commented Jan 13, 2026 •
edited
Loading

Description

Add RFC9312-friendly QUIC detection on any UDP port (opt-in via QUIC_TRACK_ANY_PORT; default remains UDP/443 only).
Harden eBPF QUIC long-header parsing with CID length sanity checks to reduce false positives in any-port mode.
Update docs/manifest and add the QUIC validation test and extent unit-test coverage.

Testing

./examples/test-quic.sh

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Will this change affect NetObserv / Network Observability operator? If not, you can ignore the rest of this checklist.
  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
    • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
    • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
    • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
    • Standard QE validation, with pre-merge tests unless stated otherwise.
    • Regression tests only (e.g. refactoring with no user-facing change).
    • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

To run a perfscale test, comment with: /test ebpf-node-density-heavy-25nodes

@openshift-ci
Copy link

openshift-ci bot commented Jan 13, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stleerh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@msherif1234 msherif1234 force-pushed the quic_parsing branch 6 times, most recently from 0f6f24f to d39e240 Compare January 14, 2026 12:53
@red-hat-konflux @msherif1234
fix(deps): update module github.com/netobserv/flowlogs-pipeline to v1…
e1b021b 
….8.0-crc0 (#590)

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux @msherif1234
fix(deps): update module github.com/vmware/go-ipfix to v0.13.0 (#592)
dd5bb92 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@msherif1234 msherif1234 force-pushed the quic_parsing branch 8 times, most recently from 9916554 to b3d3cf5 Compare January 17, 2026 12:38
@msherif1234 msherif1234 changed the title WIP: Quic packet tracker inspired by TLS tracker Quic eBPF packet tracker Jan 17, 2026
@msherif1234 msherif1234 changed the title Quic eBPF packet tracker QUIC eBPF packet tracker Jan 17, 2026
@msherif1234 msherif1234 force-pushed the quic_parsing branch 4 times, most recently from 06b1324 to 8e53fae Compare January 20, 2026 14:50
@msherif1234
Copy link
Contributor Author

msherif1234 commented Jan 20, 2026

/ok-to-test

@openshift-ci openshift-ci bot added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Jan 20, 2026
@github-actions
Copy link

github-actions bot commented Jan 20, 2026

New images:
quay.io/netobserv/ebpf-bytecode:34c8c71
quay.io/netobserv/netobserv-ebpf-agent:34c8c71

These will expire after two weeks.

To deploy this build, run from the operator repo, assuming the operator is running:

USER=netobserv VERSION=34c8c71 make set-agent-image

@github-actions github-actions bot removed the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Jan 20, 2026
@msherif1234
Copy link
Contributor Author

msherif1234 commented Jan 20, 2026

Hi @jotak this PR is ready for review, while keeping a simple inline QUIC tracker I tried to mini false/positive as much as possible, pls. lmk ur thoughts.

@msherif1234
Quic packet tracker inspired by TLS tracker
6651c87 
Signed-off-by: Mohamed S. Mahmoud <mmahmoud2201@gmail.com>
@msherif1234
extend unit-test and modify make test to run in container for macOS
db57cdd 
Signed-off-by: Mohamed S. Mahmoud <mmahmoud2201@gmail.com>
@openshift-ci
Copy link

openshift-ci bot commented Jan 21, 2026

@msherif1234: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/netobserv-cli-tests db57cdd link false /test netobserv-cli-tests
ci/prow/qe-e2e-tests db57cdd link false /test qe-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jotak jotak Awaiting requested review from jotak

@jpinsonneau jpinsonneau Awaiting requested review from jpinsonneau

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@msherif1234