Increase max interfaces..

... and ignore direction for duplicate interface checks (tradeoff to minimize loss of data in case of max reached) Also some padding optimisation
netobserv · Jan 16, 2025 · 16a542e · 16a542e
1 parent 0921905
commit 16a542e
Show file tree

Hide file tree

Showing 14 changed files with 43 additions and 57 deletions.
diff --git a/bpf/flows.c b/bpf/flows.c
@@ -57,14 +57,14 @@ static inline void add_observed_intf(flow_metrics *value, pkt_info *pkt, u32 if_
     u8 nb_observed_intf = value->nb_observed_intf;
     if (nb_observed_intf < MAX_OBSERVED_INTERFACES) {
         for (u8 i = 0; i < nb_observed_intf; i++) {
-            if (value->observed_intf[i].if_index == if_index &&
-                value->observed_intf[i].direction == direction) {
+            if (value->observed_intf[i] == if_index) {
+                // Interface already seen -> skip (we don't check for direction to avoid reaching the max too frequently, as a tradeoff)
                 return;
             }
         }
         bpf_spin_lock(&value->lock);
-        value->observed_intf[nb_observed_intf].if_index = if_index;
-        value->observed_intf[nb_observed_intf].direction = direction;
+        value->observed_intf[nb_observed_intf] = if_index;
+        value->observed_direction[nb_observed_intf] = direction;
         value->nb_observed_intf++;
         // We can also update end time / flags regardless of which interface is used
         value->end_mono_time_ts = pkt->current_ts;

diff --git a/bpf/types.h b/bpf/types.h
@@ -66,7 +66,7 @@ typedef __u64 u64;
 #define MAX_FILTER_ENTRIES 16
 #define MAX_EVENT_MD 8
 #define MAX_NETWORK_EVENTS 4
-#define MAX_OBSERVED_INTERFACES 4
+#define MAX_OBSERVED_INTERFACES 6
 
 // according to field 61 in https://www.iana.org/assignments/ipfix/ipfix.xhtml
 typedef enum direction_t {
@@ -105,10 +105,8 @@ typedef struct flow_metrics_t {
     u8 errno;
     u8 dscp;
     u8 nb_observed_intf;
-    struct observed_intf_t {
-        u8 direction;
-        u32 if_index;
-    } observed_intf[MAX_OBSERVED_INTERFACES];
+    u8 observed_direction[MAX_OBSERVED_INTERFACES];
+    u32 observed_intf[MAX_OBSERVED_INTERFACES];
 } flow_metrics;
 
 // Force emitting enums/structs into the ELF

diff --git a/pkg/agent/agent_test.go b/pkg/agent/agent_test.go
@@ -62,15 +62,17 @@ func TestFlowsAgent_Decoration(t *testing.T) {
 			IfIndexFirstSeen:   1,
 			DirectionFirstSeen: 1,
 			NbObservedIntf:     1,
-			ObservedIntf:       [model.MaxObservedInterfaces]ebpf.BpfObservedIntfT{{IfIndex: 3, Direction: 0}},
+			ObservedIntf:       [model.MaxObservedInterfaces]uint32{3},
+			ObservedDirection:  [model.MaxObservedInterfaces]uint8{0},
 		},
 	}
 	metrics2 := model.BpfFlowContent{
 		BpfFlowMetrics: &ebpf.BpfFlowMetrics{Packets: 7, Bytes: 33, StartMonoTimeTs: now, EndMonoTimeTs: now + 2_000_000_000,
 			IfIndexFirstSeen:   4,
 			DirectionFirstSeen: 0,
 			NbObservedIntf:     2,
-			ObservedIntf:       [model.MaxObservedInterfaces]ebpf.BpfObservedIntfT{{IfIndex: 1, Direction: 1}, {IfIndex: 99, Direction: 1}},
+			ObservedIntf:       [model.MaxObservedInterfaces]uint32{1, 99},
+			ObservedDirection:  [model.MaxObservedInterfaces]uint8{1, 1},
 		},
 	}
 	flows := map[ebpf.BpfFlowId]model.BpfFlowContent{

diff --git a/pkg/ebpf/bpf_arm64_bpfel.go b/pkg/ebpf/bpf_arm64_bpfel.go
diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.go b/pkg/ebpf/bpf_powerpc_bpfel.go
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o
diff --git a/pkg/ebpf/bpf_s390_bpfeb.go b/pkg/ebpf/bpf_s390_bpfeb.go
diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o
diff --git a/pkg/ebpf/bpf_x86_bpfel.go b/pkg/ebpf/bpf_x86_bpfel.go
diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o
diff --git a/pkg/ebpf/gen.go b/pkg/ebpf/gen.go
@@ -1,4 +1,4 @@
 package ebpf
 
 // $BPF_CLANG and $BPF_CFLAGS are set by the Makefile.
-//go:generate bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS -target amd64,arm64,ppc64le,s390x -type flow_metrics_t -type flow_id_t -type flow_record_t -type pkt_drops_t -type dns_record_t -type global_counters_key_t -type direction_t -type filter_action_t -type tcp_flags_t -type translated_flow_t -type observed_intf_t Bpf ../../bpf/flows.c -- -I../../bpf/headers
+//go:generate bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS -target amd64,arm64,ppc64le,s390x -type flow_metrics_t -type flow_id_t -type flow_record_t -type pkt_drops_t -type dns_record_t -type global_counters_key_t -type direction_t -type filter_action_t -type tcp_flags_t -type translated_flow_t Bpf ../../bpf/flows.c -- -I../../bpf/headers
diff --git a/pkg/model/record.go b/pkg/model/record.go
@@ -21,7 +21,7 @@ const (
 	IPv6Type                 = 0x86DD
 	NetworkEventsMaxEventsMD = 8
 	MaxNetworkEvents         = 4
-	MaxObservedInterfaces    = 4
+	MaxObservedInterfaces    = 6
 )
 
 type HumanBytes uint64
@@ -85,8 +85,8 @@ func NewRecord(
 	}
 	for i := uint8(0); i < record.Metrics.NbObservedIntf; i++ {
 		record.Interfaces = append(record.Interfaces, NewIntfDir(
-			interfaceNamer(int(metrics.ObservedIntf[i].IfIndex)),
-			int(metrics.ObservedIntf[i].Direction),
+			interfaceNamer(int(metrics.ObservedIntf[i])),
+			int(metrics.ObservedDirection[i]),
 		))
 	}
 	if metrics.AdditionalMetrics != nil {

diff --git a/pkg/model/record_test.go b/pkg/model/record_test.go
@@ -36,16 +36,20 @@ func TestRecordBinaryEncoding(t *testing.T) {
 		0x13, 0x14, 0x15, 0x16, // u32 if_index_first_seen
 		0x00, 0x00, 0x00, 0x00, // u32 lock
 		0x02, 0x00, 0x00, 0x00, // u32 sampling
-		0x03, // u8 direction_first_seen
-		0x33, // u8 errno
-		0x60, // u8 dscp
-		0x02, // u8 nb_observed_intf
-		// observed_intf_t[4]
-		0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, // [0]: u8 direction + 3 bytes padding + u32 if_index
-		0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, // [1]: u8 direction + 3 bytes padding + u32 if_index
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // [2]: u8 direction + 3 bytes padding + u32 if_index
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // [3]: u8 direction + 3 bytes padding + u32 if_index
-		0x00, 0x00, 0x00, 0x00, 0x00, // 5 bytes padding
+		0x03,                               // u8 direction_first_seen
+		0x33,                               // u8 errno
+		0x60,                               // u8 dscp
+		0x02,                               // u8 nb_observed_intf
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, // observed_direction[6]
+		0x00, 0x00, // 2 bytes padding
+		// observed_intf[6]
+		0x07, 0x00, 0x00, 0x00,
+		0x08, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, // 4 bytes padding
 	}))
 	require.NoError(t, err)
 
@@ -74,10 +78,8 @@ func TestRecordBinaryEncoding(t *testing.T) {
 			Dscp:               0x60,
 			Sampling:           0x02,
 			NbObservedIntf:     2,
-			ObservedIntf: [MaxObservedInterfaces]ebpf.BpfObservedIntfT{
-				{Direction: 1, IfIndex: 7},
-				{Direction: 0, IfIndex: 8},
-			},
+			ObservedIntf:       [MaxObservedInterfaces]uint32{7, 8},
+			ObservedDirection:  [MaxObservedInterfaces]uint8{1, 0},
 		},
 	}, *fr)
 	// assert that IP addresses are interpreted as IPv4 addresses