bpf_host: emit '-> network' traces for egress packets#16082
bpf_host: emit '-> network' traces for egress packets#16082aanm merged 2 commits intocilium:masterfrom
Conversation
74da421 to
6e02e2b
Compare
5d03a1c to
a58c86c
Compare
pchaigno
left a comment
There was a problem hiding this comment.
This is a bit hard to review as is. Could you separate in multiple logical commits? For example, the changes to take monitor into account in existing traces (what #12561 is about) could be one commit, new traces would be another commit, and general cleanups (e.g., new comments) would be a last commit.
a58c86c to
e5dbe84
Compare
Thank you for you comments. Sorry, but I did not understand you. What do you mean by new traces? AFAIU, the issue is related to this comment, right? So, UPDATE: I believe I got your point now. You refer UPDATE: Done! Sorry about the misunderstood. Let me know if I am aligned with what you have suggested! |
c74e442 to
72cad26
Compare
pchaigno
left a comment
There was a problem hiding this comment.
I think we should exclude the second commit for now. The other two commits look 👍 to me.
Please don't forget to add Timo has a coauthor of the last commit (via Signed-off-by, Co-authored-by, or both).
72cad26 to
6eba8ab
Compare
|
@navarrothiago Could you also fix the second commit's title? Right now, I doesn't provide any useful/actionable information. |
6eba8ab to
5a1b385
Compare
See the issue below for the full context. The caveat is, this program is only attached to the native device egress if the host firewall is enabled, so there still won't be any TRACE_TO_NETWORK visibility if that's not the case. bpf_host: emit '-> network' traces for packets leaving the node when Host Firewall are enabled Based on: cilium#13485 Fixes: cilium#12561 Co-authored-by: Thiago Navarro <navarro@accuknox.com> Signed-off-by: Timo Beckers <timo@isovalent.com> Signed-off-by: Thiago Navarro <navarro@accuknox.com>
5a1b385 to
9758957
Compare
Besides, cleans up with some comments and applies code style Co-authored-by: Thiago Navarro <navarro@accuknox.com> Signed-off-by: Timo Beckers <timo@isovalent.com> Signed-off-by: Thiago Navarro <navarro@accuknox.com>
9758957 to
84f7f14
Compare
|
test-me-please The checkpatch failure can be ignored. |
|
@pchaigno, should we re-trigger the jobs? |
|
test-runtime |
|
Team reviews are covered and tests are passing. Marking as ready to merge. |
bpf_host: emit '-> network' traces for egress packets
See the issue below for the full context. The caveat is, this program is only attached to the native device egress if the host firewall is enabled, so there still won't be any TRACE_TO_NETWORK visibility if that's not the case.
I've also added handle_to_netdev_ipv4() to clean up to_netdev() a bit, to bring it on par with the ipv6 handling.
bpf_host: emit '-> network' traces for packets leaving the node when Host Firewall are enabled
Based on: #13485
Fixes: #12561
Co-authored-by: Thiago Navarro navarro@accuknox.com
Signed-off-by: Timo Beckers timo@isovalent.com
Signed-off-by: Thiago Navarro navarro@accuknox.com