Merge pull request #31 from LakshK98/fix-generation

padding fix

Author: lakshk98

pkg/plugin/ebpfwindows/datapath_drop_windows.go

@@ -96,22 +96,22 @@ func (n *PktmonDropNotify) decodePktmonDrop(data []byte) error {
 	if l := len(data); l < dropNotifyV1Len {
 		return fmt.Errorf("%w: expected at least %d but got %d", errUnexpectedDropNotifyLength, dropNotifyV1Len, l)
 	}
-	version := byteorder.Native.Uint16(data[1:3])
+	version := byteorder.Native.Uint16(data[2:4])
 
 	// Check against max version.
 	if version > DropNotifyVersion1 {
 		return fmt.Errorf("%w: Unrecognized pktmon drop event version %d\nRaw data bytes: %v\nType: %d\nVersion (bytes 1-2): %v (uint16: %d)\nSubType: %d\nSource (bytes 4-5): %v (uint16: %d)\nHash (bytes 6-9): %v (uint32: %d)\nOrigLen (bytes 10-13): %v (uint32: %d)\nCapLen (bytes 14-15): %v (uint16: %d)\nSrcLabel (bytes 16-19): %v (uint32: %d)\nDstLabel (bytes 20-23): %v (uint32: %d)\nDstID (bytes 24-27): %v (uint32: %d)\nLine (bytes 28-29): %v (uint16: %d)\nFile (byte 30): %d\nExtError (byte 31): %d\nIfindex (bytes 32-35): %v (uint32: %d)",
 			errInvalidDropNotifyVersion, version,
 			data,
 			data[0],
-			data[1:3], version,
-			data[3],
-			data[4:6], byteorder.Native.Uint16(data[4:6]),
-			data[6:10], byteorder.Native.Uint32(data[6:10]),
-			data[10:14], byteorder.Native.Uint32(data[10:14]),
-			data[14:16], byteorder.Native.Uint16(data[14:16]),
-			data[16:20], byteorder.Native.Uint32(data[16:20]),
-			data[20:24], byteorder.Native.Uint32(data[20:24]),
+			data[2:4], version,
+			data[4],
+			data[6:8], byteorder.Native.Uint16(data[6:8]),
+			data[8:12], byteorder.Native.Uint32(data[8:12]),
+			data[12:16], byteorder.Native.Uint32(data[12:16]),
+			data[16:18], byteorder.Native.Uint16(data[16:18]),
+			data[18:22], byteorder.Native.Uint32(data[18:22]),
+			data[22:26], byteorder.Native.Uint32(data[22:26]),
 			data[24:28], byteorder.Native.Uint32(data[24:28]),
 			data[28:30], byteorder.Native.Uint16(data[28:30]),
 			data[30],
@@ -122,11 +122,11 @@ func (n *PktmonDropNotify) decodePktmonDrop(data []byte) error {
 
 	// Decode logic for version >= v0/v1.
 	n.Type = data[0]
-	n.SubType = data[3]
-	n.Source = byteorder.Native.Uint16(data[4:6])
-	n.Hash = byteorder.Native.Uint32(data[6:10])
-	n.OrigLen = byteorder.Native.Uint32(data[10:14])
-	n.CapLen = byteorder.Native.Uint16(data[14:16])
+	n.SubType = data[4]
+	n.Source = byteorder.Native.Uint16(data[6:8])
+	n.Hash = byteorder.Native.Uint32(data[8:12])
+	n.OrigLen = byteorder.Native.Uint32(data[12:16])
+	n.CapLen = byteorder.Native.Uint16(data[16:18])
 	n.Version = version
 	n.SrcLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[16:20]))
 	n.DstLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[20:24]))

pkg/plugin/ebpfwindows/parser_windows.go

@@ -203,6 +203,7 @@ func (p *Parser) decode(data []byte, decoded *pb.Flow) error {
 		if err := DecodePktmonDrop(data, dn); err != nil {
 			return fmt.Errorf("failed to parse pktmon drop here: %w", err)
 		}
+		slog.Info("Pktmon DropNotify", "DropNotify", dn)
 		eventSubType = dn.SubType
 		offset = dn.DataOffset()
 		if offset > uint(MaxInt) {

test/e2e/tools/event-writer/bpf_event_writer.c

@@ -139,13 +139,13 @@ void create_pktmon_drop_event(struct pktmon_notify* drp_elm)
 	drp_elm->len_orig   = 128;
 	drp_elm->len_cap    = 128;
 	drp_elm->version    = 1;
-	drp_elm->src_label	= 0;
-	drp_elm->dst_label	= 0;
-	drp_elm->dst_id		= 0;
-	drp_elm->line		= 0;
-    drp_elm->file		= 0;
-    drp_elm->ext_error	= 0;
-	drp_elm->ifindex	= 0;
+	drp_elm->src_label	= 5;
+	drp_elm->dst_label	= 257;
+	drp_elm->dst_id		= 3;
+	drp_elm->line		= 14;
+    drp_elm->file		= 22;
+    drp_elm->ext_error	= 2;
+	drp_elm->ifindex	= 12;
 }
 
 int