Add bidirectional packet capture #6882

AryanBakliwal · 2024-12-23T04:18:38Z

fixes: #6862

Added bidirectional field in packet capture CR spec.
For testing, I created two pods and pinged one from the other.

Screenshot of the .pcapng output file.

Signed-off-by: Aryan Bakliwal <[email protected]>

AryanBakliwal · 2024-12-23T04:20:04Z

@hangyan please let me know what you think about this

pkg/agent/packetcapture/packetcapture_controller.go

pkg/apis/crd/v1alpha1/types.go

…antrea-io#6877) Bumps the golang-org-x group with 1 update: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.32.0 to 0.33.0 - [Commits](golang/net@v0.32.0...v0.33.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-org-x ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…oup (antrea-io#6880) Bumps the ginkgo group with 1 update: [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo). Updates `github.com/onsi/ginkgo/v2` from 2.22.0 to 2.22.1 - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.22.0...v2.22.1) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ginkgo ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Aryan Bakliwal <[email protected]>

AryanBakliwal · 2025-01-01T13:13:56Z

Hey @hangyan @antoninbas, I made the changes in the bpf code according to the one generated by tcpdump.

When I try to test the bidirectional packet capture, it fails with this log

E1229 11:44:58.723258       1 packetcapture_controller.go:424] "PacketCapture failed capturing packets" err="invalid argument" name="pc-test"

Could you please take a look and help me identify what might be going wrong?

Also, golangci-lint is giving me this error even though I have changed the Capture method everywhere.

===> Running golangci (linux) <===
===> Running golangci (windows) <===
cmd/antrea-agent/agent.go:64:2: could not import antrea.io/antrea/pkg/agent/packetcapture (-: # antrea.io/antrea/pkg/agent/packetcapture
pkg/agent/packetcapture/packetcapture_controller.go:170:23: cannot use capture (variable of type *capture.pcapCapture) as PacketCapturer value in assignment: *capture.pcapCapture does not implement PacketCapturer (wrong type for method Capture)
                have Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet) (chan gopacket.Packet, error)
                want Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet, bool) (chan gopacket.Packet, error)) (typecheck)
        "antrea.io/antrea/pkg/agent/packetcapture"
        ^
pkg/agent/packetcapture/capture_interface.go:1: : # antrea.io/antrea/pkg/agent/packetcapture [antrea.io/antrea/pkg/agent/packetcapture.test]
pkg/agent/packetcapture/packetcapture_controller.go:170:23: cannot use capture (variable of type *capture.pcapCapture) as PacketCapturer value in assignment: *capture.pcapCapture does not implement PacketCapturer (wrong type for method Capture)
                have Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet) (chan gopacket.Packet, error)
                want Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet, bool) (chan gopacket.Packet, error) (typecheck)
// Copyright 2024 Antrea Authors.
make: *** [Makefile:329: golangci] Error 1

hangyan · 2025-01-02T02:29:30Z

Hey @hangyan @antoninbas, I made the changes in the bpf code according to the one generated by tcpdump.

When I try to test the bidirectional packet capture, it fails with this log

E1229 11:44:58.723258       1 packetcapture_controller.go:424] "PacketCapture failed capturing packets" err="invalid argument" name="pc-test"

Could you please take a look and help me identify what might be going wrong?

Also, golangci-lint is giving me this error even though I have changed the Capture method everywhere.

===> Running golangci (linux) <===
===> Running golangci (windows) <===
cmd/antrea-agent/agent.go:64:2: could not import antrea.io/antrea/pkg/agent/packetcapture (-: # antrea.io/antrea/pkg/agent/packetcapture
pkg/agent/packetcapture/packetcapture_controller.go:170:23: cannot use capture (variable of type *capture.pcapCapture) as PacketCapturer value in assignment: *capture.pcapCapture does not implement PacketCapturer (wrong type for method Capture)
                have Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet) (chan gopacket.Packet, error)
                want Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet, bool) (chan gopacket.Packet, error)) (typecheck)
        "antrea.io/antrea/pkg/agent/packetcapture"
        ^
pkg/agent/packetcapture/capture_interface.go:1: : # antrea.io/antrea/pkg/agent/packetcapture [antrea.io/antrea/pkg/agent/packetcapture.test]
pkg/agent/packetcapture/packetcapture_controller.go:170:23: cannot use capture (variable of type *capture.pcapCapture) as PacketCapturer value in assignment: *capture.pcapCapture does not implement PacketCapturer (wrong type for method Capture)
                have Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet) (chan gopacket.Packet, error)
                want Capture(context.Context, string, int, "net".IP, "net".IP, *"antrea.io/antrea/pkg/apis/crd/v1alpha1".Packet, bool) (chan gopacket.Packet, error) (typecheck)
// Copyright 2024 Antrea Authors.
make: *** [Makefile:329: golangci] Error 1

this error was reported by golangci on windows, we have a pcap_unsupported.go for windows/... interface, it's an non-op since we didn't support this on windows yet, you should change that too.

pkg/agent/packetcapture/capture/bpf.go

Signed-off-by: Aryan Bakliwal <[email protected]>

AryanBakliwal · 2025-01-05T18:52:56Z

I’ve added the direction field with enum values (SourceToDestination, DestinationToSource, and Both) and set the default to SourceToDestination. Additionally, I’ve updated the YAML manifests, packet capture guide and tests accordingly.

Please let me know if any adjustments are needed or if there's anything else I should update or add.

Captured packets

ICMP (SourceToDestination)

ICMP (DestinationToSource)

ICMP (Both)

TCP (SourceToDestination)

TCP (DestinationToSource)

TCP (Both)

hangyan · 2025-01-08T08:28:58Z

pkg/agent/packetcapture/capture/bpf.go

+// (006) ld       [30]									   # Load 4B at 30 (dest address)
+// (007) jeq      #0xaf40103       jt 8	jf 26			   # If bytes match(10.244.0.3), goto #8, else #26
+// (008) ldh      [20]									   # Load 2B at 20 (13b Fragment Offset)
+// (009) jset     #0x1fff          jt 26	jf 10	   # Use 0x1fff as a mask for fragment offset; If fragment offset != 0, #10, else #26


maybe align the comments after #.

hangyan · 2025-01-08T09:02:13Z

pkg/agent/packetcapture/capture/bpf.go

@@ -134,18 +122,96 @@ func compilePacketFilter(packetSpec *crdv1alpha1.Packet, srcIP, dstIP net.IP) []
 		}
 	}

+	// source ip


In the future we may also support tcp flags and other layer4 configs, if that happens, we should consider make the current code structure more modularized, or it would be extremely hard to extend this function . This won't be easy but i suggest to review this part and see if we can do better.

not sure if we can separate the ip section and ports section apart, call sub functions to calculate their instruments size and sums up.

I'll try my best to improve the code structure and explore separating the IP and port sections as suggested

hangyan · 2025-01-08T09:06:56Z

pkg/agent/packetcapture/capture/bpf_test.go

+		},
+		{
+			name:  "with-proto-port-and-Both",
+			srcIP: net.ParseIP("127.0.0.1"),


better to add a test case for only have dstPort and Both, that's the real world case as client port is always random.

makes sense, will add this test case

pkg/apis/crd/v1alpha1/types.go

antoninbas

could we add an e2e test with the Both direction?

antoninbas · 2025-01-08T21:22:23Z

pkg/agent/packetcapture/capture/bpf.go

+	srcAddrVal := binary.BigEndian.Uint32(srcIP[len(srcIP)-4:])
+	dstAddrVal := binary.BigEndian.Uint32(dstIP[len(dstIP)-4:])


I am not sure I understand this change. Isn't it possible for srcIP and dstIP to be nil?

I think the current spec enforced srcIP and dstIP both cannot be nil, because either Pod or IP will present. It cloud be pretty easy to remove the restrictions in the crd spec and do a little tweak to make this work.(no the target of the PR)

antoninbas · 2025-01-08T21:29:52Z

pkg/apis/crd/v1alpha1/types.go

+const (
+	SourceToDestination CaptureDirection = "SourceToDestination"
+	DestinationToSource CaptureDirection = "DestinationToSource"
+	Both                CaptureDirection = "Both"
+)


Suggested change

const (

SourceToDestination CaptureDirection = "SourceToDestination"

DestinationToSource CaptureDirection = "DestinationToSource"

Both CaptureDirection = "Both"

)

const (

CaptureDirectionSourceToDestination CaptureDirection = "SourceToDestination"

CaptureDirectionDestinationToSource CaptureDirection = "DestinationToSource"

CaptureDirectionBoth CaptureDirection = "Both"

)

antoninbas · 2025-01-08T21:33:34Z

build/yamls/antrea.yml

+                direction:
+                  type: string
+                  enum: ["SourceToDestination", "DestinationToSource", "Both"]
+                  default: "SourceToDestination"


you seem to have made that change manually, which is not correct
the source of truth is build/charts/antrea/crds/packetcapture.yaml. You need to edit that file and run make manifest.

Thanks for the clarification, I'll make the changes in the correct files and regenerate the manifests.

pkg/apis/crd/v1alpha1/types.go

AryanBakliwal added 2 commits December 23, 2024 00:26

add bidirection flag

875dde4

Signed-off-by: Aryan Bakliwal <[email protected]>

add bidirectional capture

1307c17

Signed-off-by: Aryan Bakliwal <[email protected]>

antoninbas reviewed Dec 23, 2024

View reviewed changes

pkg/agent/packetcapture/packetcapture_controller.go Outdated Show resolved Hide resolved

pkg/apis/crd/v1alpha1/types.go Outdated Show resolved Hide resolved

dependabot bot and others added 3 commits January 1, 2025 18:39

update code and tests

79a26c0

Signed-off-by: Aryan Bakliwal <[email protected]>

hangyan reviewed Jan 2, 2025

View reviewed changes

pkg/agent/packetcapture/capture/bpf.go Outdated Show resolved Hide resolved

AryanBakliwal added 2 commits January 5, 2025 19:42

Merge branch 'main' into bidirection

6e5898c

add enum, tests and docs

e5ef842

Signed-off-by: Aryan Bakliwal <[email protected]>

AryanBakliwal requested review from antoninbas, hangyan and tnqn January 5, 2025 18:53

hangyan reviewed Jan 8, 2025

View reviewed changes

antoninbas reviewed Jan 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add bidirectional packet capture #6882

Add bidirectional packet capture #6882

AryanBakliwal commented Dec 23, 2024 •

edited

Loading

AryanBakliwal commented Dec 23, 2024

AryanBakliwal commented Jan 1, 2025

hangyan commented Jan 2, 2025

AryanBakliwal commented Jan 5, 2025

hangyan Jan 8, 2025

AryanBakliwal Jan 8, 2025

hangyan Jan 8, 2025

AryanBakliwal Jan 8, 2025

hangyan Jan 8, 2025

AryanBakliwal Jan 8, 2025

antoninbas left a comment

antoninbas Jan 8, 2025

hangyan Jan 9, 2025

antoninbas Jan 8, 2025

antoninbas Jan 8, 2025

AryanBakliwal Jan 9, 2025

		srcAddrVal := binary.BigEndian.Uint32(srcIP[len(srcIP)-4:])
		dstAddrVal := binary.BigEndian.Uint32(dstIP[len(dstIP)-4:])

Add bidirectional packet capture #6882

Are you sure you want to change the base?

Add bidirectional packet capture #6882

Conversation

AryanBakliwal commented Dec 23, 2024 • edited Loading

AryanBakliwal commented Dec 23, 2024

AryanBakliwal commented Jan 1, 2025

hangyan commented Jan 2, 2025

AryanBakliwal commented Jan 5, 2025

Captured packets

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AryanBakliwal commented Dec 23, 2024 •

edited

Loading