Need to differentiate between cached dns response vs incomplete ones

Signed-off-by: Mohamed Mahmoud <[email protected]>

Author: msherif1234

bpf/dns_tracker.h

@@ -9,6 +9,7 @@
 #define DNS_QR_FLAG 0x8000
 #define UDP_MAXMSG 512
 #define EINVAL 22
+#define ENOENT 2
 
 struct dns_header {
     u16 id;
@@ -66,6 +67,7 @@ static __always_inline u8 calc_dns_header_offset(pkt_info *pkt, void *data_end)
 
 static __always_inline int track_dns_packet(struct __sk_buff *skb, pkt_info *pkt) {
     void *data_end = (void *)(long)skb->data_end;
+    int ret = 0;
     if (pkt->id->dst_port == dns_port || pkt->id->src_port == dns_port) {
         dns_flow_id dns_req;
 
@@ -75,7 +77,6 @@ static __always_inline int track_dns_packet(struct __sk_buff *skb, pkt_info *pkt
         }
 
         struct dns_header dns;
-        int ret;
         u32 dns_offset = (long)pkt->l4_hdr - (long)skb->data + len;
 
         if ((ret = bpf_skb_load_bytes(skb, dns_offset, &dns, sizeof(dns))) < 0) {
@@ -97,12 +98,14 @@ static __always_inline int track_dns_packet(struct __sk_buff *skb, pkt_info *pkt
             if (value != NULL) {
                 pkt->dns_latency = ts - *value;
                 bpf_map_delete_elem(&dns_flows, &dns_req);
+            } else {
+                ret = ENOENT;
             }
             pkt->dns_id = dns_id;
             pkt->dns_flags = flags;
         } // end of dns response
     }
-    return 0;
+    return ret;
 }
 
 #endif // __DNS_TRACKER_H__

pkg/decode/decode_protobuf.go

@@ -120,11 +120,7 @@ func RecordToMap(fr *flow.Record) config.GenericMap {
 			out["DnsId"] = dnsID
 			out["DnsFlags"] = fr.Metrics.DnsRecord.Flags
 			out["DnsFlagsResponseCode"] = DNSRcodeToStr(uint32(fr.Metrics.DnsRecord.Flags) & 0xF)
-			if fr.Metrics.DnsRecord.Latency != 0 {
-				out["DnsLatencyMs"] = fr.DNSLatency.Milliseconds()
-			}
-			// Not sure about the logic here, why erasing errno?
-			out["DnsErrno"] = uint32(0)
+			out["DnsLatencyMs"] = fr.DNSLatency.Milliseconds()
 		}
 	}
 

pkg/decode/decode_protobuf_test.go

@@ -101,7 +101,7 @@ func TestPBFlowToMap(t *testing.T) {
 		"DnsId":                  uint16(1),
 		"DnsFlags":               uint16(0x80),
 		"DnsFlagsResponseCode":   "NoError",
-		"DnsErrno":               uint32(0),
+		"DnsErrno":               uint8(0),
 		"TimeFlowRttNs":          someDuration.Nanoseconds(),
 	}, out)
 

pkg/ebpf/bpf_arm64_bpfel.o

@@ -88,6 +88,7 @@ func (c *deduperCache) checkDupe(r *Record, justMark, mergeDup bool, fwd *[]*Rec
 			fEntry.dnsRecord.Flags = r.Metrics.DnsRecord.Flags
 			fEntry.dnsRecord.Id = r.Metrics.DnsRecord.Id
 			fEntry.dnsRecord.Latency = r.Metrics.DnsRecord.Latency
+			fEntry.dnsRecord.Errno = r.Metrics.DnsRecord.Errno
 		}
 		// If the new flow has flowRTT then enrich the flow in the case with the same RTT and mark it duplicate
 		if r.Metrics.FlowRtt != 0 && *fEntry.flowRTT == 0 {

pkg/ebpf/bpf_powerpc_bpfel.o

@@ -106,6 +106,9 @@ func Accumulate(r *ebpf.BpfFlowMetrics, src *ebpf.BpfFlowMetrics) {
 	if src.DnsRecord.Id != 0 {
 		r.DnsRecord.Id = src.DnsRecord.Id
 	}
+	if r.DnsRecord.Errno < src.DnsRecord.Errno {
+		r.DnsRecord.Errno = src.DnsRecord.Errno
+	}
 	if r.DnsRecord.Latency < src.DnsRecord.Latency {
 		r.DnsRecord.Latency = src.DnsRecord.Latency
 	}
@@ -117,10 +120,6 @@ func Accumulate(r *ebpf.BpfFlowMetrics, src *ebpf.BpfFlowMetrics) {
 	if src.Dscp != 0 {
 		r.Dscp = src.Dscp
 	}
-	// Accumulate DNSErrno
-	if src.DnsRecord.Errno != 0 {
-		r.DnsRecord.Errno = src.DnsRecord.Errno
-	}
 }
 
 // IP returns the net.IP equivalent object