Merge pull request #41 from LakshK98/actual-stuff

Actual Pktmon struct

Author: lakshk98

pkg/plugin/ebpfwindows/datapath_drop_windows.go

@@ -19,14 +19,19 @@ const (
 
 const (
 	// dropNotifyV1Len is the amount of packet data provided in a v0/v1 drop notification.
-	dropNotifyV1Len = 36
+	dropNotifyV1Len       = 36
+	dropPktmonNotifyV1Len = 57
 )
 
 var dropNotifyLengthFromVersion = map[uint16]uint{
 	DropNotifyVersion0: dropNotifyV1Len, // retain backwards compatibility for testing.
 	DropNotifyVersion1: dropNotifyV1Len,
 }
 
+// var PktmonDropNotifyLengthFromVersion = map[uint16]uint{
+// 	DropNotifyVersion0: dropPktmonNotifyV1Len, // retain backwards compatibility for testing.
+// }
+
 var (
 	errUnexpectedDropNotifyLength = errors.New("unexpected DropNotify data length")
 	errInvalidDropNotifyVersion   = errors.New("invalid DropNotify version")
@@ -50,21 +55,41 @@ type DropNotify struct {
 	Ifindex  uint32
 }
 
+type NetEventDataHeader struct {
+	Type    uint8  // uint8_t type
+	Version uint16 // uint16_t version
+}
+
+type PktmonEvtStreamPacketDescriptor struct {
+	PacketOriginalLength uint32 // uint32_t packet_original_length
+	PacketLoggedLength   uint32 // uint32_t packet_logged_length
+	PacketMetadataLength uint32 // uint32_t packet_metadata_length
+}
+
+type PktmonEvtStreamMetadata struct {
+	PktGroupID      uint64 // uint64_t pkt_groupid
+	PktCount        uint16 // uint16_t pkt_count
+	AppearanceCount uint16 // uint16_t appearance_count
+	DirectionName   uint16 // uint16_t direction_name
+	PacketType      uint16 // uint16_t packet_type
+	ComponentID     uint16 // uint16_t component_id
+	EdgeID          uint16 // uint16_t edge_id
+	FilterID        uint16 // uint16_t filter_id
+	DropReason      uint32 // uint32_t drop_reason
+	DropLocation    uint32 // uint32_t drop_location
+	ProcNum         uint16 // uint16_t proc_num
+	Timestamp       uint64 // uint64_t timestamp
+}
+
+type PktmonEvtStreamPacketHeader struct {
+	EventID          uint8                           // uint8_t eventid
+	PacketDescriptor PktmonEvtStreamPacketDescriptor // pktmon_evt_stream_packet_descriptor
+	Metadata         PktmonEvtStreamMetadata         // pktmon_evt_stream_metadata
+}
+
 type PktmonDropNotify struct {
-	Type     uint8
-	Version  uint16
-	SubType  uint8
-	Source   uint16
-	Hash     uint32
-	OrigLen  uint32
-	CapLen   uint16
-	SrcLabel identity.NumericIdentity
-	DstLabel identity.NumericIdentity
-	DstID    uint32
-	Line     uint16
-	File     uint8
-	ExtError int8
-	Ifindex  uint32
+	VersionHeader NetEventDataHeader          // netevent_data_header_t version_header
+	PktmonHeader  PktmonEvtStreamPacketHeader // pktmon_evt_stream_packet_header pktmon_header
 }
 
 // DecodeDropNotify will decode 'data' into the provided DropNotify structure
@@ -73,69 +98,47 @@ func DecodePktmonDrop(data []byte, dn *DropNotify) error {
 	if err := pdn.decodePktmonDrop(data); err != nil {
 		return err
 	}
-	pdn.Type = 1
-	dn.Type = pdn.Type
-	dn.SubType = pdn.SubType
-	dn.Source = pdn.Source
-	dn.Hash = pdn.Hash
-	dn.OrigLen = pdn.OrigLen
-	dn.CapLen = pdn.CapLen
-	dn.Version = pdn.Version
-	dn.SrcLabel = pdn.SrcLabel
-	dn.DstLabel = pdn.DstLabel
-	dn.DstID = pdn.DstID
-	dn.Line = pdn.Line
-	dn.File = pdn.File
-	dn.ExtError = pdn.ExtError
-	dn.Ifindex = pdn.Ifindex
+	dn.Type = 1
+	dn.SubType = uint8(pdn.PktmonHeader.Metadata.DropReason)
+	dn.OrigLen = 128
+	dn.CapLen = 128
+	dn.Version = pdn.VersionHeader.Version
 	return nil
 }
 
 func (n *PktmonDropNotify) decodePktmonDrop(data []byte) error {
-	if l := len(data); l < dropNotifyV1Len {
-		return fmt.Errorf("%w: expected at least %d but got %d", errUnexpectedDropNotifyLength, dropNotifyV1Len, l)
+	if l := len(data); l < dropPktmonNotifyV1Len {
+		return fmt.Errorf("%w: expected at least %d but got %d", errUnexpectedDropNotifyLength, dropPktmonNotifyV1Len, l)
 	}
 	version := byteorder.Native.Uint16(data[2:4])
 
 	// Check against max version.
 	if version > DropNotifyVersion1 {
-		return fmt.Errorf("%w: Unrecognized pktmon drop event version %d\nRaw data bytes: %v\nData size: %d\nType: %d\nVersion (bytes 1-2): %v (uint16: %d)\nSubType: %d\nSource (bytes 4-5): %v (uint16: %d)\nHash (bytes 6-9): %v (uint32: %d)\nOrigLen (bytes 10-13): %v (uint32: %d)\nCapLen (bytes 14-15): %v (uint16: %d)\nSrcLabel (bytes 16-19): %v (uint32: %d)\nDstLabel (bytes 20-23): %v (uint32: %d)\nDstID (bytes 24-27): %v (uint32: %d)\nLine (bytes 28-29): %v (uint16: %d)\nFile (byte 30): %d\nExtError (byte 31): %d\nIfindex (bytes 32-35): %v (uint32: %d)",
+		return fmt.Errorf("%w: Unrecognized pktmon drop event version %d\nRaw data bytes: %v\nData size: %d\nType: %d\n",
 			errInvalidDropNotifyVersion, version,
 			data,
-			len(data),
-			data[0],
-			data[2:4], version,
-			data[4],
-			data[6:8], byteorder.Native.Uint16(data[6:8]),
-			data[8:12], byteorder.Native.Uint32(data[8:12]),
-			data[12:16], byteorder.Native.Uint32(data[12:16]),
-			data[16:18], byteorder.Native.Uint16(data[16:18]),
-			data[18:22], byteorder.Native.Uint32(data[20:24]),
-			data[22:26], byteorder.Native.Uint32(data[24:28]),
-			data[26:30], byteorder.Native.Uint32(data[28:32]),
-			data[30:32], byteorder.Native.Uint16(data[32:34]),
-			data[32],
-			int8(data[33]),
-			data[34:38], byteorder.Native.Uint32(data[34:38]),
-		)
+			len(data))
 	}
 
 	// Decode logic for version >= v0/v1.
-	n.Type = data[0]
-	n.SubType = data[4]
-	n.Source = byteorder.Native.Uint16(data[6:8])
-	n.Hash = byteorder.Native.Uint32(data[8:12])
-	n.OrigLen = byteorder.Native.Uint32(data[12:16])
-	n.CapLen = byteorder.Native.Uint16(data[16:18])
-	n.Version = version
-	n.SrcLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[20:24]))
-	n.DstLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[24:28]))
-	n.DstID = byteorder.Native.Uint32(data[28:32])
-	n.Line = byteorder.Native.Uint16(data[32:34])
-	n.File = data[34]
-	n.ExtError = int8(data[35])
-	n.Ifindex = byteorder.Native.Uint32(data[36:40])
-
+	n.VersionHeader.Type = data[0]
+	n.VersionHeader.Version = version
+	n.PktmonHeader.EventID = data[4]
+	n.PktmonHeader.PacketDescriptor.PacketOriginalLength = byteorder.Native.Uint32(data[6:10])
+	n.PktmonHeader.PacketDescriptor.PacketLoggedLength = byteorder.Native.Uint32(data[10:14])
+	n.PktmonHeader.PacketDescriptor.PacketMetadataLength = byteorder.Native.Uint32(data[14:18])
+	n.PktmonHeader.Metadata.PktGroupID = byteorder.Native.Uint64(data[18:26])
+	n.PktmonHeader.Metadata.PktCount = byteorder.Native.Uint16(data[26:28])
+	n.PktmonHeader.Metadata.AppearanceCount = byteorder.Native.Uint16(data[28:30])
+	n.PktmonHeader.Metadata.DirectionName = byteorder.Native.Uint16(data[30:32])
+	n.PktmonHeader.Metadata.PacketType = byteorder.Native.Uint16(data[32:34])
+	n.PktmonHeader.Metadata.ComponentID = byteorder.Native.Uint16(data[34:36])
+	n.PktmonHeader.Metadata.EdgeID = byteorder.Native.Uint16(data[36:38])
+	n.PktmonHeader.Metadata.FilterID = byteorder.Native.Uint16(data[38:40])
+	n.PktmonHeader.Metadata.DropReason = byteorder.Native.Uint32(data[40:44])
+	n.PktmonHeader.Metadata.DropLocation = byteorder.Native.Uint32(data[44:48])
+	n.PktmonHeader.Metadata.ProcNum = byteorder.Native.Uint16(data[48:50])
+	n.PktmonHeader.Metadata.Timestamp = byteorder.Native.Uint64(data[50:58])
 	return nil
 }
 

pkg/plugin/ebpfwindows/parser_windows.go

@@ -205,7 +205,7 @@ func (p *Parser) decode(data []byte, decoded *pb.Flow) error {
 		}
 		slog.Info("Pktmon DropNotify", "DropNotify", dn)
 		eventSubType = dn.SubType
-		offset = 40
+		offset = 57
 		if offset > uint(MaxInt) {
 			return fmt.Errorf("%w: %d", errDataOffsetTooLarge, offset)
 		}

test/e2e/tools/event-writer/bpf_event_writer.c

@@ -129,23 +129,11 @@ void create_drop_event(struct drop_notify* drp_elm)
 	drp_elm->ifindex	= 0;
 }
 
-void create_pktmon_drop_event(struct pktmon_notify* drp_elm)
+void create_pktmon_drop_event(pktmon_notify_t* pktmon_drp_elm)
 {
-    memset(drp_elm, 0, sizeof(struct pktmon_notify));
-    drp_elm->type       = PKTMON_NOTIFY_DROP;
-	drp_elm->subtype    = 7;
-	drp_elm->source     = 11; // random source
-	drp_elm->hash       = 0;
-	drp_elm->len_orig   = 128;
-	drp_elm->len_cap    = 128;
-	drp_elm->version    = 1;
-	drp_elm->src_label	= 0;
-	drp_elm->dst_label	= 0;
-	drp_elm->dst_id		= 0;
-	drp_elm->line		= 0;
-    drp_elm->file		= 0;
-    drp_elm->ext_error	= 0;
-	drp_elm->ifindex	= 1;
+    memset(pktmon_drp_elm, 0, sizeof(pktmon_notify_t));
+    pktmon_drp_elm->version_header.type       = PKTMON_NOTIFY_DROP;
+    pktmon_drp_elm->pktmon_header.metadata.drop_reason = 7;
 }
 
 int

test/e2e/tools/event-writer/event_writer.h

@@ -167,23 +167,23 @@ struct drop_notify {
 };
 
 
-struct pktmon_notify {
-	uint8_t		type;
-    uint16_t    version;
-    uint8_t		subtype;
-	uint16_t		source;
-	uint32_t		hash;
-    uint32_t		len_orig;
-	uint16_t		len_cap;
-	uint32_t		src_label;
-	uint32_t		dst_label;
-	uint32_t		dst_id; /* 0 for egress */
-	uint16_t		line;
-	uint8_t		file;
-	int8_t		ext_error;
-	uint32_t		ifindex;
-	uint8_t        data[128];
-};
+// struct pktmon_notify {
+// 	uint8_t		type;
+//     uint16_t    version;
+//     uint8_t		subtype;
+// 	uint16_t		source;
+// 	uint32_t		hash;
+//     uint32_t		len_orig;
+// 	uint16_t		len_cap;
+// 	uint32_t		src_label;
+// 	uint32_t		dst_label;
+// 	uint32_t		dst_id; /* 0 for egress */
+// 	uint16_t		line;
+// 	uint8_t		file;
+// 	int8_t		ext_error;
+// 	uint32_t		ifindex;
+// 	uint8_t        data[128];
+// };
 
 // _Static_assert(sizeof(struct pktmon_notify) == 168, "pktmon_notify struct size must be 168 bytes");
 
@@ -223,45 +223,52 @@ enum _PKTMON_DIRECTION_TAG
     PktMonDirTag_Egress
 } PKTMON_DIRECTION_TAG;
 
+typedef struct _netevent_data_header
+{
+    uint8_t type;
+    uint16_t version;
+} netevent_data_header_t;
+
 #pragma pack(push, 1)
 
-/* Packet descriptor used for event streaming */
-typedef struct _PKTMON_EVT_STREAM_PACKET_DESCRIPTOR
+/* packet descriptor used for event streaming */
+typedef struct _pktmon_evt_stream_packet_descriptor
 {
-    uint32_t PacketOriginalLength;
-    uint32_t PacketLoggedLength;
-    uint32_t PacketMetaDataLength;
-} PKTMON_EVT_STREAM_PACKET_DESCRIPTOR;
+    uint32_t packet_original_length;
+    uint32_t packet_logged_length;
+    uint32_t packet_metadata_length;
+} pktmon_evt_stream_packet_descriptor;
 
-/* Metadata information used for event streaming */
-typedef struct _PKTMON_EVT_STREAM_METADATA
+/* metadata information used for event streaming */
+typedef struct _pktmon_evt_stream_metadata
 {
-    uint64_t PktGroupId;
-    uint16_t PktCount;
-    uint16_t AppearanceCount;
-    uint16_t DirectionName;
-    uint16_t PacketType;
-    uint16_t ComponentId;
-    uint16_t EdgeId;
-    uint16_t FilterId;
-    uint32_t DropReason;
-    uint32_t DropLocation;
-    uint16_t ProcNum;
-    uint64_t TimeStamp;
-} PKTMON_EVT_STREAM_METADATA;
-
-/* Packet header used for event streaming */
-typedef struct _PKTMON_EVT_STREAM_PACKET_HEADER
+    uint64_t pkt_groupid;
+    uint16_t pkt_count;
+    uint16_t appearance_count;
+    uint16_t direction_name;
+    uint16_t packet_type;
+    uint16_t component_id;
+    uint16_t edge_id;
+    uint16_t filter_id;
+    uint32_t drop_reason;
+    uint32_t drop_location;
+    uint16_t proc_num;
+    uint64_t timestamp;
+} pktmon_evt_stream_metadata;
+
+/* packet header used for event streaming */
+typedef struct _pktmon_evt_stream_packet_header
 {
-    uint8_t EventId;
-    PKTMON_EVT_STREAM_PACKET_DESCRIPTOR PacketDescriptor;
-    PKTMON_EVT_STREAM_METADATA Metadata;
-} PKTMON_EVT_STREAM_PACKET_HEADER;
-
-// typedef struct pktmon_notify {
-//     PKTMON_EVT_STREAM_PACKET_HEADER  header;
-//     uint8_t                           data[128];
-// } pktmon_notify_t;
+    uint8_t eventid;
+    pktmon_evt_stream_packet_descriptor packet_descriptor;
+    pktmon_evt_stream_metadata metadata;
+} pktmon_evt_stream_packet_header;
+
+typedef struct pktmon_notify {
+    netevent_data_header_t version_header;
+    pktmon_evt_stream_packet_header  pktmon_header;
+    uint8_t                           data[128];
+} pktmon_notify_t;
 
 #pragma pack(pop)