From 2c058da4604f1325b36043df080b1dbb4b5c598f Mon Sep 17 00:00:00 2001
From: Joel Takvorian <joel.takvorian@qaraywa.net>
Date: Tue, 10 Jun 2025 16:41:55 +0200
Subject: [PATCH] [Trivial] Add config examples, + a link to RFC (#715)
* Add config examples, + a link to RFC
* regen bytecode
---
bpf/dns_tracker.h | 1 +
examples/direct-flp/README.md | 7 +++++++
examples/direct-flp/simple-stdout.json | 8 ++++++++
examples/filters/README.md | 7 +++++++
examples/filters/single-ip.json | 3 +++
pkg/ebpf/bpf_arm64_bpfel.o | Bin 290128 -> 290128 bytes
pkg/ebpf/bpf_powerpc_bpfel.o | Bin 288968 -> 288968 bytes
pkg/ebpf/bpf_s390_bpfeb.o | Bin 305480 -> 305480 bytes
pkg/ebpf/bpf_x86_bpfel.o | Bin 289872 -> 289872 bytes
9 files changed, 26 insertions(+)
create mode 100644 examples/direct-flp/README.md
create mode 100644 examples/direct-flp/simple-stdout.json
create mode 100644 examples/filters/README.md
create mode 100644 examples/filters/single-ip.json
diff --git a/bpf/dns_tracker.h b/bpf/dns_tracker.h
index 30a22a35..2da30153 100644
--- a/bpf/dns_tracker.h
+++ b/bpf/dns_tracker.h
@@ -10,6 +10,7 @@
#define DNS_QR_FLAG 0x8000
#define UDP_MAXMSG 512
+// See https://www.rfc-editor.org/rfc/rfc1035 4.1.1. Header section format
struct dns_header {
u16 id;
u16 flags;
diff --git a/examples/direct-flp/README.md b/examples/direct-flp/README.md
new file mode 100644
index 00000000..65d576f6
--- /dev/null
+++ b/examples/direct-flp/README.md
@@ -0,0 +1,7 @@
+## Simple example using direct-flp + stdout
+
+```bash
+export FLP_CONFIG=$(cat ./examples/direct-flp/simple-stdout.json)
+export EXPORT="direct-flp"
+sudo -E bin/netobserv-ebpf-agent
+```
diff --git a/examples/direct-flp/simple-stdout.json b/examples/direct-flp/simple-stdout.json
new file mode 100644
index 00000000..ceb3f9fe
--- /dev/null
+++ b/examples/direct-flp/simple-stdout.json
@@ -0,0 +1,8 @@
+{
+ "pipeline":[
+ {"name": "writer","follows": "preset-ingester"}
+ ],
+ "parameters":[
+ {"name": "writer","write": {"type": "stdout"}}
+ ]
+}
diff --git a/examples/filters/README.md b/examples/filters/README.md
new file mode 100644
index 00000000..6ba7b028
--- /dev/null
+++ b/examples/filters/README.md
@@ -0,0 +1,7 @@
+## Simple example filtering on a single IP
+
+```bash
+export ENABLE_FLOW_FILTER="true"
+export FLOW_FILTER_RULES=$(cat ./examples/filters/single-ip.json)
+sudo -E bin/netobserv-ebpf-agent
+```
diff --git a/examples/filters/single-ip.json b/examples/filters/single-ip.json
new file mode 100644
index 00000000..9fd14389
--- /dev/null
+++ b/examples/filters/single-ip.json
@@ -0,0 +1,3 @@
+[
+ {"ip_cidr":"192.168.1.20/32", "action": "Accept"}
+]
diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o
index 593ef10b5e8ac3017a291f05bba700e2ecfffee5..f646fb9de640d9d3719aaa921badfbc1fc276231 100644
GIT binary patch
delta 870
zcmca`OYp)i!G;#bElg);)Qd1Oyf9*5C@ElI=qX@e;FDow_<+P0l3`@{fy9@SVPp_6
zMyOYpVPud%;v35_GAJPN?PVAlG?4fnGK>r!Q2w<728Mc04Mv6vr~qFf1B2KS28IqK
zKI;+&h8a-4Wg!ED$r=WR1yFuTAp?WZ1_p)$Q2zEp1_qHm3=Aib`22eq7+yg6l0^&*
zCTAEJK0x^)MGW-}LKheqBupSanq0)dz<-B<K?BO)R>Z)d`GkSN0Lp(?#K55A!N_2N
z#JBWdWN<*@OL;IdL_qmQ#S9E00gMb2koZ0Uj0_8){FdT+1_sd-Murtofpx_U3}Ok4
z3>%>QYsCx<LK%z<JCOLi8H@}EpnRD66Hxwdkop7$h6_->SP27zTnYoj4J5uq3IoFj
zD8Hq?7~%j1Q%DH7moP9W7cepiK>3X&3=EtN3=9*X{G%X#3j@OhGl+W5QU(U$3Py$-
zP<})y1A}M{Bf|qIzXZf@U}O+5ho}efRT>x>G@yL3H6R5oj0_1-fp4V@41yig<7P9-
z*M~4NEPx6tmN77J<}ffQSU}841@Q|Q7z8XK{FP-43{o=~84RHOw`B|r;&T`oETDY8
zas~#?1&j<1NPLwAj0_$~eDwv43;{@dBc%n53>i=XyK)8w!6l3g9Z-H{IRk^t4n~Fv
XQ2yL<1_sG3?Rs;Vw(HGdR=NlPr5UhU
delta 870
zcmca`OYp)i!G;#bElg);)C({&yf9*5C@ElI=qX@e;FDlv_<+P0l3--`fy9@SU}O+5
zMyOYpU}TU$;u}jaGAJPN?Ijo)G?4fn5{wKUQ2w<728Mc06-I^%r~qFf1B2KC28IqK
zKI;Moh8a-4Wg!ED$qELB1yFuTAp?WZ8U}^~Q2zEp1_qHG3=Aib`20H<7+yg6l0^&*
zCMOseK0x^)MGW-}LT4BlBupSanq0)dz<+~*K?BO)R>Z)d`GA4J0Lp(?#K55A!pLBO
z#J6-|WN<*@OSv#IL_qmQ#S9E0K8y?#koZ16j0_8){FdT+1_sdtMurtofpx_U3}P{i
z3>%>QYsCx<LMe<4JCOLiDU1vUpnRD66Hxwdkop(~h6_->SP27zTml2b4J5uq0t3Sb
zD8Hq?7~%j1Q%DH7moP9W=P)t|K>3X&3=Et#3=9*X{G%X#0|UbZGl+W5QU(U$5=Mp_
zP<})y1A}M<Bf|qIzXZguVPp_6ho}efRcaU+G@yL3H6R5Ij0_1-fp4V@41z7w<7P9-
z*9R~%EPx6tmN77JW-u@)SU}841@Utj7z8XK{FP-43{q1V84RHOw`B|r;xiZ-ETDY8
zas~#?IgAVrNPLw!j0_$~eDyhu3;{@dBc(Zv3>i=XyK)8w!3B&A9Z-H{IRk^t7Dk2%
XQ2yL<1_sFu?Rs;Vw(HGdR=NlPIYO_2
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o
index be544c5f498f400c40dec632ba757df2d7350eef..b2ea70b789f53ee1cbd2ea0df307c05c9821ac90 100644
GIT binary patch
delta 870
zcmX?cQSih?!G;#bEliP9>O~kCUKlYjc;+)OB<3?P@X0VTd_dw0$uKhfK;p~EFfs@j
zBh;(QFfvFW@r`8|85EHC_A-nN8c2K(8Ab*VD1UW614BKh1|vfSRN!$w1B2KS28IqK
zKI;+&h8a*kUjYMy$r=WR1yH_c0Rw~31_p)$P<~GV1B1vO28I(zeEvNQ3@@PkcOd;|
z7#Kc4`I?0c^$bE67#Ji>AU?_{WMJUG!@!^c<#!h{FlatuU@(C44;L~p=y)(PSRnB&
zJs24rkoZy_j0_P_K6?=ZgGc})!vrM0PXHss0w_PSsGfmAG=-621yrE9h=D;YfstVY
zl)t)&fk7yPkzofCpErY%;Q*8mQ-1==zW`F7z`$?;%70zNz#x~xz;FYJFOkB)@Bzw?
ztS^E%fWZ_J0y4!649W$J3<6MoSTO?wX9EMn1So$Nh~L7%Fu@F>{$4QygKz~S!wo23
zw}gQ~w1$!40hI3v;x{ld2$)0EgZL^9j0_r3zE~qjK?@^80#x912?K**$MjdznB?n2
z7#S8og};?BFmUEDFeq3+%&{tEVBjoZU=Xl`@asw$7^G$}G8jPlhe{b3#OE+FSU~xY
zOBon67ceq7An{ceFfw=`@zobFG6W#;jg%HJGGssngv%Hh1eY)}bU^ujWef~5I~W-z
XK>0;w3=EQ6+ILN7+P-T#Gv7r3s7k6;
delta 870
zcmX?cQSih?!G;#bEliP9>IE1XUKlYjc;+)OB<3?P@JTQ-d_dw0NiZ_}K;p|uFfs@j
zBh;%)FfvFW@r@-I85EHC_7aQ?8c2K(2}TAFD1UW614BKh3L`@WRN!$w1B2KC28IqK
zKI;Moh8a*kUjYMy$qELB1yH_c0Rw~38U}^~P<~GV1B1v828I(zeEuB_3@@PkcOd;I
z7#Kc4`I?0c^$bF17#Ji>AU?_{WMJUG!N8ya<#!h{FlattU@(C44;L~p=(sR4SRnB&
zT^Jc0koZzAj0_P_K6?=ZgNP3!!vrM0j}Ifm0w_PSsGfmAG=Y&}1yrE9h=D;YhLK?d
zl)t)&fk7yRkzofCpEre(;Q*8mQ-1==zW`Dn!@zI>%70zNz#x~vz;FYJFOk5&@Bzw?
ztS^E%fWZ_J0y4!649Yo-3<6MoSTO?wXAJ|x1So$Nh~L1#Fu@F>{$4QygK!BW!wo23
zw}gQ~w1Sc00hI3v;@2=T2$)0EgZL^nj0_r3zE~qjK?5U00#x912?K**%k)>%nB?mN
z7#S8og};?BFmPrtFeq3+%&{tEVBpMQU=Xl`@asw$7^J2!G8jPlhe{b3#Ah%vSU~xY
zOBon6=P)ujAn{e^Ffw=`@zv)rG6W#;jg;mvGGssngv%Hh1Q#$ebU^ujWef~5TNoK8
XK>0;w3=EPR+ILN7+P-T#Gv7r3Jaegi
diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o
index 8b8fa5e4a98c4f5760d9bf267990682a467af265..21b413be52062b3afe38e9a8c5a6320dc7f51df4 100644
GIT binary patch
delta 886
zcmX?cN$A8Sp@tU5Elj^I*NbQ}Fc`gHU}z0tU}()@V3grwU@-cC#1~><F#3VSmt$Zs
z7C_>wGcXuSAn}bE7>pH=`1TA8#u`X`4+aKf4=8^dLp`GgCj*0V1ytZ21H%$A1_t8}
zBt9zxgYgUqzfF>XVT}m`gYg0=KZJo{gAfCQ@c}4*G6TaN5e5e16G(hX1_t8`NPK<<
z24kp)+rHK_Fq{Dy2=#Hh0RzJYAqEB$sE^w785r*HGccGyebhdQf#C@+1A__FM_|4t
z1A~bH#Dexy42&K+3=Ad~NPJ5M1``J)z7zw4Nd$!7QP0P~7$CyHU@`$J0OI>FFqlAn
z*pa}%m?Fx+V6p-#-^IX~AjZI8vH{B9#K4#Va_|l$KFER45b3ziz>olvhlWVUCkBQT
zIR*w3Xo%E<1tb_4OrSvmw-6fVoyrW11<DKzrW_CpI%63a8aNpkOrcTKxsZXOg_D87
z490)Tz*r&7z+eWopv#1Tu||}E!R!V^e^&qlV}mFIgE_=JH3qPN3Il^VG>E%87#LeX
z3ZOyMb%}woWBTlCO!D<1A`A@X(4^4ymw_RNlYzkk8dKel3=9RF3=EbKa~Zl@85n0s
zF)&y{W2*Zk1LGWV1_n!LOm)9vU|gWdz+efDDKKA!fx!|QQ((S21A`?rt#-d+Fk)Pw
x#K2&g0P#qV6a(WDK?VlP1}Hz2fpLcn1A`?rAbKhp7`L=%UuW8$eVzI4MF6>}ys!WO
delta 886
zcmX?cN$A8Sp@tU5Elj^I*9&MeFc`gHU}z0tU}()@V3govU@-cC#1~><F#3VSmt$Zs
z7C_>wGcXuSAn}bE7>pH=`1TA8#u`X`4+aKf4=8^dLp`GkCj*0V1ytZ21H%F_1_t8}
zBt9zxgYgUqzfF>XVTB0;gYg0=KZJo{jSvHa@c}4*G6Ta75e5e16G(hX1_t8`NPK<<
z24kp)+rHK_Fq{Ax2=#Hh0RzJsAqEB$sE^w785nNxGccGyebhdQf#Cr!1A__FM_|4t
z1A~bH#Dexy42&*13=Ad~NPJ5M1``J)z7zw4Nd$!7QP0P~=p(|wU@`$J0OI>FFqlAn
z*pa}%m>|l)V6p-#-^IWfBgVjBvH{B9#K4#Wa_|l$KFER45b3zizz_qHhlWVUCkBQD
zIR*w3Xo%E<1tb_4OrSvmw-6fVoyrW1Im!$SrW_CpI%63aYB(7fOrcTKxsZXOfs=v3
z490)Tz*r*8z+eWopv#1Tu|kxA!R!V^e^&qlV~r>SgE_=JH3qPN3Il^VG>E%87#JHs
z3ZOyMb%}woW%}%EO!D;sA`A@X(4^4ymw_RJlYzkk8dKel3=BD(3=EbKa~Zl@85pNX
zF)&y{W2*Zk1LF*F1_n!LOm)9vV4S1Lz+efDDKKA!fx!|QQ((S21A`?rt#-d+Fk+me
x#K2&g0P#qV6a(V|K?VlP1}Hz2fpLor1A`?rAbKhp7&o+MUuW8$eVzI4MF2oXyVL*x
diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o
index 2e37acbbcb1e5611cc30be63fe3512331663e226..af1b4637721579fdcbf00c1f317446f07ecad2b8 100644
GIT binary patch
delta 870
zcmca`L-4{4!G;#bElhW(*NZSRyf9*55G-I|&@5nJ;FDow_<+P0l3`@{fy9@SVPp_6
zMyOYpVPud%;v35_GAJPN?PVAlG?4fnGK>r!P=0X%14BKh1|vfSRA6-h1B2KS28IqK
zKI;+&h8a-)wE_kPlQj$s3!r?#LIwt*4Gatip!|?R1_qHm3=Aib`22eq7+yg6+X@*N
zOwKSce1P&l7BbW`2wh-ckT8Mx$e@UUf&UHzg9elzT*Sbj`GkSN0Lt$!VqnnmU}UgB
z;#+z!GB_adr92oJBB1>9MGOog0gMb2koZ0Uj0_8)e8u8=1_sd-Murto0q<f42C)Q2
zh7C}DaWMmfPzEEz4kSKr1|!1(C?BT&1e8Amq&|Ux;R2MuxtM`LE`@>N1`=N)g@NG%
zl&@G{3~>O1DI^4*6f-a=7cepiK>2bd3=EtN3=9*X{3H;+g@Iv$8AScE5(Wn03Py$-
zQ2y5v1_sd@MurDazF;W>gJ=UIgMc|iJ&3Q;z{sEh<%@ZO6tplhBtQiwmohL2c1+Kk
z#Ux)J!pN`yD!i|hfq^rJfkD9nVh&Ro0|RFP1A~Aigzr|yz#uh)k--4U?<!+p5TC=y
zU;*W?E@NQOT)@cSfW%i>z{uc%#8+Ry$Pj?UH&R-_$dCaQxLwA;Ah?8)p##bnD`#Mk
b*}=##0m`>3XJC-r(r!1KX}jHQW}%A!;(wYq
delta 870
zcmca`L-4{4!G;#bElhW(*9$N*yf9*55G-I|&@5nJ;FDlv_<+P0l3--`fy9@SU}O+5
zMyOYpU}TU$;u}jaGAJPN?Ijo)G?4fn5{wKUP=0X%14BKh3L`@WRA6-h1B2KC28IqK
zKI;Moh8a-)wE_kPlNAgM3!r?#LIwt*H4F>~p!|?R1_qHG3=Aib`20H<7+yg6+X@*N
zOinN`e1P&l7BbW`2%TYIkT8Mx$e@UUf&T^rg9elzT*Sbj`GA4J0Lt$!Vqnm5VPvpC
z;#;~fGB_adrCb;pBB1>9MGOogK8y?#koZ16j0_8)e8u8=1_sdtMurto0q<f42C*1M
zh7C}DaWMmfPzoc%4kSKr3M0b-C?BT&1e8Amq&|j$;R2MuxtM`LE`fpJ1`=N)fq~%z
zl&@G{3~>O1DI^4*6f-a==P)t|K>2bd3=Et#3=9*X{3H;+fq`Ly8AScE5(Wn05=Mp_
zQ2y5v1_sdzMurDazF;W>gJ=ySgMc|iJ&3PT!^ofk<%@ZO6f`h0BtQiwmohL2woK2P
z#Ux)Jz{s!wD!i|hfq^rFfkD9nVh&Ro0|RFc1A~Aigzr|yz#uh+k--4U?<!+p5TC)w
zU;*W?E@NQOoWscAfW%js!^q%)#8;og$Pj?UH&U9z$dCaQxLwA;Ah>{$p##bnD`#Mk
b*}}*$0m`>3XJC-r&~7)IX}jHQW}%A!cBq+O
--
GitLab