diff --git a/pkg/pipeline/decode/decode_protobuf.go b/pkg/pipeline/decode/decode_protobuf.go index 756d6cebe..07503b388 100644 --- a/pkg/pipeline/decode/decode_protobuf.go +++ b/pkg/pipeline/decode/decode_protobuf.go @@ -13,6 +13,13 @@ import ( "google.golang.org/protobuf/proto" ) +const ( + skbDropReasonSubsystemShift = 16 + skbDropReasonValueMask = 0xFFFF + skbDropReasonSubSysCore = 0 + skbDropReasonSubSysOpenVSwitch = 3 +) + // Protobuf decodes protobuf flow records definitions, as forwarded by // ingest.NetObservAgent, into a Generic Map that follows the same naming conventions // as the IPFIX flows from ingest.IngestCollector @@ -153,155 +160,191 @@ func tcpStateToStr(state uint32) string { // pktDropCauseToStr is based on kernel drop cause definition // https://elixir.bootlin.com/linux/latest/source/include/net/dropreason.h#L88 func pktDropCauseToStr(dropCause uint32) string { - switch dropCause { - case 2: - return "SKB_DROP_REASON_NOT_SPECIFIED" - case 3: - return "SKB_DROP_REASON_NO_SOCKET" - case 4: - return "SKB_DROP_REASON_PKT_TOO_SMALL" - case 5: - return "SKB_DROP_REASON_TCP_CSUM" - case 6: - return "SKB_DROP_REASON_SOCKET_FILTER" - case 7: - return "SKB_DROP_REASON_UDP_CSUM" - case 8: - return "SKB_DROP_REASON_NETFILTER_DROP" - case 9: - return "SKB_DROP_REASON_OTHERHOST" - case 10: - return "SKB_DROP_REASON_IP_CSUM" - case 11: - return "SKB_DROP_REASON_IP_INHDR" - case 12: - return "SKB_DROP_REASON_IP_RPFILTER" - case 13: - return "SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST" - case 14: - return "SKB_DROP_REASON_XFRM_POLICY" - case 15: - return "SKB_DROP_REASON_IP_NOPROTO" - case 16: - return "SKB_DROP_REASON_SOCKET_RCVBUFF" - case 17: - return "SKB_DROP_REASON_PROTO_MEM" - case 18: - return "SKB_DROP_REASON_TCP_MD5NOTFOUND" - case 19: - return "SKB_DROP_REASON_TCP_MD5UNEXPECTED" - case 20: - return "SKB_DROP_REASON_TCP_MD5FAILURE" - case 21: - return "SKB_DROP_REASON_SOCKET_BACKLOG" - case 22: - return "SKB_DROP_REASON_TCP_FLAGS" - case 23: - return "SKB_DROP_REASON_TCP_ZEROWINDOW" - case 24: - return "SKB_DROP_REASON_TCP_OLD_DATA" - case 25: - return "SKB_DROP_REASON_TCP_OVERWINDOW" - case 26: - return "SKB_DROP_REASON_TCP_OFOMERGE" - case 27: - return "SKB_DROP_REASON_TCP_RFC7323_PAWS" - case 28: - return "SKB_DROP_REASON_TCP_INVALID_SEQUENCE" - case 29: - return "SKB_DROP_REASON_TCP_RESET" - case 30: - return "SKB_DROP_REASON_TCP_INVALID_SYN" - case 31: - return "SKB_DROP_REASON_TCP_CLOSE" - case 32: - return "SKB_DROP_REASON_TCP_FASTOPEN" - case 33: - return "SKB_DROP_REASON_TCP_OLD_ACK" - case 34: - return "SKB_DROP_REASON_TCP_TOO_OLD_ACK" - case 35: - return "SKB_DROP_REASON_TCP_ACK_UNSENT_DATA" - case 36: - return "SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE" - case 37: - return "SKB_DROP_REASON_TCP_OFO_DROP" - case 38: - return "SKB_DROP_REASON_IP_OUTNOROUTES" - case 39: - return "SKB_DROP_REASON_BPF_CGROUP_EGRESS" - case 40: - return "SKB_DROP_REASON_IPV6DISABLED" - case 41: - return "SKB_DROP_REASON_NEIGH_CREATEFAIL" - case 42: - return "SKB_DROP_REASON_NEIGH_FAILED" - case 43: - return "SKB_DROP_REASON_NEIGH_QUEUEFULL" - case 44: - return "SKB_DROP_REASON_NEIGH_DEAD" - case 45: - return "SKB_DROP_REASON_TC_EGRESS" - case 46: - return "SKB_DROP_REASON_QDISC_DROP" - case 47: - return "SKB_DROP_REASON_CPU_BACKLOG" - case 48: - return "SKB_DROP_REASON_XDP" - case 49: - return "SKB_DROP_REASON_TC_INGRESS" - case 50: - return "SKB_DROP_REASON_UNHANDLED_PROTO" - case 51: - return "SKB_DROP_REASON_SKB_CSUM" - case 52: - return "SKB_DROP_REASON_SKB_GSO_SEG" - case 53: - return "SKB_DROP_REASON_SKB_UCOPY_FAULT" - case 54: - return "SKB_DROP_REASON_DEV_HDR" - case 55: - return "SKB_DROP_REASON_DEV_READY" - case 56: - return "SKB_DROP_REASON_FULL_RING" - case 57: - return "SKB_DROP_REASON_NOMEM" - case 58: - return "SKB_DROP_REASON_HDR_TRUNC" - case 59: - return "SKB_DROP_REASON_TAP_FILTER" - case 60: - return "SKB_DROP_REASON_TAP_TXFILTER" - case 61: - return "SKB_DROP_REASON_ICMP_CSUM" - case 62: - return "SKB_DROP_REASON_INVALID_PROTO" - case 63: - return "SKB_DROP_REASON_IP_INADDRERRORS" - case 64: - return "SKB_DROP_REASON_IP_INNOROUTES" - case 65: - return "SKB_DROP_REASON_PKT_TOO_BIG" - case 66: - return "SKB_DROP_REASON_DUP_FRAG" - case 67: - return "SKB_DROP_REASON_FRAG_REASM_TIMEOUT" - case 68: - return "SKB_DROP_REASON_FRAG_TOO_FAR" - case 69: - return "SKB_DROP_REASON_TCP_MINTTL" - case 70: - return "SKB_DROP_REASON_IPV6_BAD_EXTHDR" - case 71: - return "SKB_DROP_REASON_IPV6_NDISC_FRAG" - case 72: - return "SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT" - case 73: - return "SKB_DROP_REASON_IPV6_NDISC_BAD_CODE" - case 74: - return "SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS" - case 75: - return "SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST" + dropReasonSubSys := dropCause >> skbDropReasonSubsystemShift + switch dropReasonSubSys { + case skbDropReasonSubSysCore: + { + switch dropCause & skbDropReasonValueMask { + case 2: + return "SKB_DROP_REASON_NOT_SPECIFIED" + case 3: + return "SKB_DROP_REASON_NO_SOCKET" + case 4: + return "SKB_DROP_REASON_PKT_TOO_SMALL" + case 5: + return "SKB_DROP_REASON_TCP_CSUM" + case 6: + return "SKB_DROP_REASON_SOCKET_FILTER" + case 7: + return "SKB_DROP_REASON_UDP_CSUM" + case 8: + return "SKB_DROP_REASON_NETFILTER_DROP" + case 9: + return "SKB_DROP_REASON_OTHERHOST" + case 10: + return "SKB_DROP_REASON_IP_CSUM" + case 11: + return "SKB_DROP_REASON_IP_INHDR" + case 12: + return "SKB_DROP_REASON_IP_RPFILTER" + case 13: + return "SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST" + case 14: + return "SKB_DROP_REASON_XFRM_POLICY" + case 15: + return "SKB_DROP_REASON_IP_NOPROTO" + case 16: + return "SKB_DROP_REASON_SOCKET_RCVBUFF" + case 17: + return "SKB_DROP_REASON_PROTO_MEM" + case 18: + return "SKB_DROP_REASON_TCP_MD5NOTFOUND" + case 19: + return "SKB_DROP_REASON_TCP_MD5UNEXPECTED" + case 20: + return "SKB_DROP_REASON_TCP_MD5FAILURE" + case 21: + return "SKB_DROP_REASON_SOCKET_BACKLOG" + case 22: + return "SKB_DROP_REASON_TCP_FLAGS" + case 23: + return "SKB_DROP_REASON_TCP_ZEROWINDOW" + case 24: + return "SKB_DROP_REASON_TCP_OLD_DATA" + case 25: + return "SKB_DROP_REASON_TCP_OVERWINDOW" + case 26: + return "SKB_DROP_REASON_TCP_OFOMERGE" + case 27: + return "SKB_DROP_REASON_TCP_RFC7323_PAWS" + case 28: + return "SKB_DROP_REASON_TCP_INVALID_SEQUENCE" + case 29: + return "SKB_DROP_REASON_TCP_RESET" + case 30: + return "SKB_DROP_REASON_TCP_INVALID_SYN" + case 31: + return "SKB_DROP_REASON_TCP_CLOSE" + case 32: + return "SKB_DROP_REASON_TCP_FASTOPEN" + case 33: + return "SKB_DROP_REASON_TCP_OLD_ACK" + case 34: + return "SKB_DROP_REASON_TCP_TOO_OLD_ACK" + case 35: + return "SKB_DROP_REASON_TCP_ACK_UNSENT_DATA" + case 36: + return "SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE" + case 37: + return "SKB_DROP_REASON_TCP_OFO_DROP" + case 38: + return "SKB_DROP_REASON_IP_OUTNOROUTES" + case 39: + return "SKB_DROP_REASON_BPF_CGROUP_EGRESS" + case 40: + return "SKB_DROP_REASON_IPV6DISABLED" + case 41: + return "SKB_DROP_REASON_NEIGH_CREATEFAIL" + case 42: + return "SKB_DROP_REASON_NEIGH_FAILED" + case 43: + return "SKB_DROP_REASON_NEIGH_QUEUEFULL" + case 44: + return "SKB_DROP_REASON_NEIGH_DEAD" + case 45: + return "SKB_DROP_REASON_TC_EGRESS" + case 46: + return "SKB_DROP_REASON_QDISC_DROP" + case 47: + return "SKB_DROP_REASON_CPU_BACKLOG" + case 48: + return "SKB_DROP_REASON_XDP" + case 49: + return "SKB_DROP_REASON_TC_INGRESS" + case 50: + return "SKB_DROP_REASON_UNHANDLED_PROTO" + case 51: + return "SKB_DROP_REASON_SKB_CSUM" + case 52: + return "SKB_DROP_REASON_SKB_GSO_SEG" + case 53: + return "SKB_DROP_REASON_SKB_UCOPY_FAULT" + case 54: + return "SKB_DROP_REASON_DEV_HDR" + case 55: + return "SKB_DROP_REASON_DEV_READY" + case 56: + return "SKB_DROP_REASON_FULL_RING" + case 57: + return "SKB_DROP_REASON_NOMEM" + case 58: + return "SKB_DROP_REASON_HDR_TRUNC" + case 59: + return "SKB_DROP_REASON_TAP_FILTER" + case 60: + return "SKB_DROP_REASON_TAP_TXFILTER" + case 61: + return "SKB_DROP_REASON_ICMP_CSUM" + case 62: + return "SKB_DROP_REASON_INVALID_PROTO" + case 63: + return "SKB_DROP_REASON_IP_INADDRERRORS" + case 64: + return "SKB_DROP_REASON_IP_INNOROUTES" + case 65: + return "SKB_DROP_REASON_PKT_TOO_BIG" + case 66: + return "SKB_DROP_REASON_DUP_FRAG" + case 67: + return "SKB_DROP_REASON_FRAG_REASM_TIMEOUT" + case 68: + return "SKB_DROP_REASON_FRAG_TOO_FAR" + case 69: + return "SKB_DROP_REASON_TCP_MINTTL" + case 70: + return "SKB_DROP_REASON_IPV6_BAD_EXTHDR" + case 71: + return "SKB_DROP_REASON_IPV6_NDISC_FRAG" + case 72: + return "SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT" + case 73: + return "SKB_DROP_REASON_IPV6_NDISC_BAD_CODE" + case 74: + return "SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS" + case 75: + return "SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST" + + } + } + // ovs drop causes + // https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/net/openvswitch/drop.h + case skbDropReasonSubSysOpenVSwitch: + { + switch dropCause & skbDropReasonValueMask { + case 0: + return "OVS_DROP_LAST_ACTION" + case 1: + return "OVS_DROP_ACTION_ERROR" + case 2: + return "OVS_DROP_EXPLICIT" + case 3: + return "OVS_DROP_EXPLICIT_WITH_ERROR" + case 4: + return "OVS_DROP_METER" + case 5: + return "OVS_DROP_RECURSION_LIMIT" + case 6: + return "OVS_DROP_DEFERRED_LIMIT" + case 7: + return "OVS_DROP_FRAG_L2_TOO_LONG" + case 8: + return "OVS_DROP_FRAG_INVALID_PROTO" + case 9: + return "OVS_DROP_CONNTRACK" + case 10: + return "OVS_DROP_IP_TTL" + } + } } return "SKB_DROP_UNKNOWN_CAUSE" }