NETOBSERV-1198: drop_cause enum in vmlinux are based off old kernel (#161)

* allow tracing more drops and avoid early return

sometimes we can don't have socket struct valid
which we use to populate TCP state in that case
we keep state as 0 and we proceed generating drop
flow

Signed-off-by: msherif1234 <mmahmoud@redhat.com>

* NETOBSERV-1198: drop_cause enum in vmlinux

Signed-off-by: msherif1234 <mmahmoud@redhat.com>

---------

Signed-off-by: msherif1234 <mmahmoud@redhat.com>

bpf/headers/vmlinux.h

@@ -35484,71 +35484,82 @@ struct phc_vclocks_reply_data {
 enum skb_drop_reason {
 	SKB_NOT_DROPPED_YET = 0,
-	SKB_DROP_REASON_NOT_SPECIFIED = 1,
-	SKB_DROP_REASON_NO_SOCKET = 2,
-	SKB_DROP_REASON_PKT_TOO_SMALL = 3,
-	SKB_DROP_REASON_TCP_CSUM = 4,
-	SKB_DROP_REASON_SOCKET_FILTER = 5,
-	SKB_DROP_REASON_UDP_CSUM = 6,
-	SKB_DROP_REASON_NETFILTER_DROP = 7,
-	SKB_DROP_REASON_OTHERHOST = 8,
-	SKB_DROP_REASON_IP_CSUM = 9,
-	SKB_DROP_REASON_IP_INHDR = 10,
-	SKB_DROP_REASON_IP_RPFILTER = 11,
-	SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 12,
-	SKB_DROP_REASON_XFRM_POLICY = 13,
-	SKB_DROP_REASON_IP_NOPROTO = 14,
-	SKB_DROP_REASON_SOCKET_RCVBUFF = 15,
-	SKB_DROP_REASON_PROTO_MEM = 16,
-	SKB_DROP_REASON_TCP_MD5NOTFOUND = 17,
-	SKB_DROP_REASON_TCP_MD5UNEXPECTED = 18,
-	SKB_DROP_REASON_TCP_MD5FAILURE = 19,
-	SKB_DROP_REASON_SOCKET_BACKLOG = 20,
-	SKB_DROP_REASON_TCP_FLAGS = 21,
-	SKB_DROP_REASON_TCP_ZEROWINDOW = 22,
-	SKB_DROP_REASON_TCP_OLD_DATA = 23,
-	SKB_DROP_REASON_TCP_OVERWINDOW = 24,
-	SKB_DROP_REASON_TCP_OFOMERGE = 25,
-	SKB_DROP_REASON_TCP_RFC7323_PAWS = 26,
-	SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 27,
-	SKB_DROP_REASON_TCP_RESET = 28,
-	SKB_DROP_REASON_TCP_INVALID_SYN = 29,
-	SKB_DROP_REASON_TCP_CLOSE = 30,
-	SKB_DROP_REASON_TCP_FASTOPEN = 31,
-	SKB_DROP_REASON_TCP_OLD_ACK = 32,
-	SKB_DROP_REASON_TCP_TOO_OLD_ACK = 33,
-	SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 34,
-	SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 35,
-	SKB_DROP_REASON_TCP_OFO_DROP = 36,
-	SKB_DROP_REASON_IP_OUTNOROUTES = 37,
-	SKB_DROP_REASON_BPF_CGROUP_EGRESS = 38,
-	SKB_DROP_REASON_IPV6DISABLED = 39,
-	SKB_DROP_REASON_NEIGH_CREATEFAIL = 40,
-	SKB_DROP_REASON_NEIGH_FAILED = 41,
-	SKB_DROP_REASON_NEIGH_QUEUEFULL = 42,
-	SKB_DROP_REASON_NEIGH_DEAD = 43,
-	SKB_DROP_REASON_TC_EGRESS = 44,
-	SKB_DROP_REASON_QDISC_DROP = 45,
-	SKB_DROP_REASON_CPU_BACKLOG = 46,
-	SKB_DROP_REASON_XDP = 47,
-	SKB_DROP_REASON_TC_INGRESS = 48,
-	SKB_DROP_REASON_UNHANDLED_PROTO = 49,
-	SKB_DROP_REASON_SKB_CSUM = 50,
-	SKB_DROP_REASON_SKB_GSO_SEG = 51,
-	SKB_DROP_REASON_SKB_UCOPY_FAULT = 52,
-	SKB_DROP_REASON_DEV_HDR = 53,
-	SKB_DROP_REASON_DEV_READY = 54,
-	SKB_DROP_REASON_FULL_RING = 55,
-	SKB_DROP_REASON_NOMEM = 56,
-	SKB_DROP_REASON_HDR_TRUNC = 57,
-	SKB_DROP_REASON_TAP_FILTER = 58,
-	SKB_DROP_REASON_TAP_TXFILTER = 59,
-	SKB_DROP_REASON_ICMP_CSUM = 60,
-	SKB_DROP_REASON_INVALID_PROTO = 61,
-	SKB_DROP_REASON_IP_INADDRERRORS = 62,
-	SKB_DROP_REASON_IP_INNOROUTES = 63,
-	SKB_DROP_REASON_PKT_TOO_BIG = 64,
-	SKB_DROP_REASON_MAX = 65,
+	SKB_CONSUMED = 1,
+	SKB_DROP_REASON_NOT_SPECIFIED = 2,
+	SKB_DROP_REASON_NO_SOCKET = 3,
+	SKB_DROP_REASON_PKT_TOO_SMALL = 4,
+	SKB_DROP_REASON_TCP_CSUM = 5,
+	SKB_DROP_REASON_SOCKET_FILTER = 6,
+	SKB_DROP_REASON_UDP_CSUM = 7,
+	SKB_DROP_REASON_NETFILTER_DROP = 8,
+	SKB_DROP_REASON_OTHERHOST = 9,
+	SKB_DROP_REASON_IP_CSUM = 10,
+	SKB_DROP_REASON_IP_INHDR = 11,
+	SKB_DROP_REASON_IP_RPFILTER = 12,
+	SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 13,
+	SKB_DROP_REASON_XFRM_POLICY = 14,
+	SKB_DROP_REASON_IP_NOPROTO = 15,
+	SKB_DROP_REASON_SOCKET_RCVBUFF = 16,
+	SKB_DROP_REASON_PROTO_MEM = 17,
+	SKB_DROP_REASON_TCP_MD5NOTFOUND = 18,
+	SKB_DROP_REASON_TCP_MD5UNEXPECTED = 19,
+	SKB_DROP_REASON_TCP_MD5FAILURE = 20,
+	SKB_DROP_REASON_SOCKET_BACKLOG = 21,
+	SKB_DROP_REASON_TCP_FLAGS = 22,
+	SKB_DROP_REASON_TCP_ZEROWINDOW = 23,
+	SKB_DROP_REASON_TCP_OLD_DATA = 24,
+	SKB_DROP_REASON_TCP_OVERWINDOW = 25,
+	SKB_DROP_REASON_TCP_OFOMERGE = 26,
+	SKB_DROP_REASON_TCP_RFC7323_PAWS = 27,
+	SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 28,
+	SKB_DROP_REASON_TCP_RESET = 29,
+	SKB_DROP_REASON_TCP_INVALID_SYN = 30,
+	SKB_DROP_REASON_TCP_CLOSE = 31,
+	SKB_DROP_REASON_TCP_FASTOPEN = 32,
+	SKB_DROP_REASON_TCP_OLD_ACK = 33,
+	SKB_DROP_REASON_TCP_TOO_OLD_ACK = 34,
+	SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 35,
+	SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 36,
+	SKB_DROP_REASON_TCP_OFO_DROP = 37,
+	SKB_DROP_REASON_IP_OUTNOROUTES = 38,
+	SKB_DROP_REASON_BPF_CGROUP_EGRESS = 39,
+	SKB_DROP_REASON_IPV6DISABLED = 40,
+	SKB_DROP_REASON_NEIGH_CREATEFAIL = 41,
+	SKB_DROP_REASON_NEIGH_FAILED = 42,
+	SKB_DROP_REASON_NEIGH_QUEUEFULL = 43,
+	SKB_DROP_REASON_NEIGH_DEAD = 44,
+	SKB_DROP_REASON_TC_EGRESS = 45,
+	SKB_DROP_REASON_QDISC_DROP = 46,
+	SKB_DROP_REASON_CPU_BACKLOG = 47,
+	SKB_DROP_REASON_XDP = 48,
+	SKB_DROP_REASON_TC_INGRESS = 49,
+	SKB_DROP_REASON_UNHANDLED_PROTO = 50,
+	SKB_DROP_REASON_SKB_CSUM = 51,
+	SKB_DROP_REASON_SKB_GSO_SEG = 52,
+	SKB_DROP_REASON_SKB_UCOPY_FAULT = 53,
+	SKB_DROP_REASON_DEV_HDR = 54,
+	SKB_DROP_REASON_DEV_READY = 55,
+	SKB_DROP_REASON_FULL_RING = 56,
+	SKB_DROP_REASON_NOMEM = 57,
+	SKB_DROP_REASON_HDR_TRUNC = 58,
+	SKB_DROP_REASON_TAP_FILTER = 59,
+	SKB_DROP_REASON_TAP_TXFILTER = 60,
+	SKB_DROP_REASON_ICMP_CSUM = 61,
+	SKB_DROP_REASON_INVALID_PROTO = 62,
+	SKB_DROP_REASON_IP_INADDRERRORS = 63,
+	SKB_DROP_REASON_IP_INNOROUTES = 64,
+	SKB_DROP_REASON_PKT_TOO_BIG = 65,
+	SKB_DROP_REASON_DUP_FRAG = 66,
+	SKB_DROP_REASON_FRAG_REASM_TIMEOUT = 67,
+	SKB_DROP_REASON_FRAG_TOO_FAR = 68,
+	SKB_DROP_REASON_TCP_MINTTL = 69,
+	SKB_DROP_REASON_IPV6_BAD_EXTHDR = 70,
+	SKB_DROP_REASON_IPV6_NDISC_FRAG = 71,
+	SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT = 72,
+	SKB_DROP_REASON_IPV6_NDISC_BAD_CODE = 73,
+	SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS = 74,
+	SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST = 75,
+	SKB_DROP_REASON_MAX = 76,
 };
 typedef struct bio_vec skb_frag_t;

bpf/pkt_drops.h

@@ -7,21 +7,15 @@
 
 #include "utils.h"
 
-static inline int trace_pkt_drop(void *ctx, struct sock *sk,
+static inline int trace_pkt_drop(void *ctx, u8 state,
                                  struct sk_buff *skb,
                                  enum skb_drop_reason reason) {
-    if (sk == NULL)
-        return 0;
-
     flow_id id;
     __builtin_memset(&id, 0, sizeof(id));
 
-    u8 state = 0, protocol = 0;
+    u8 protocol = 0;
     u16 family = 0,flags = 0;
 
-    // pull in details from the packet headers and the sock struct
-    bpf_probe_read(&state, sizeof(u8), (u8 *)&sk->__sk_common.skc_state);
-
     id.if_index = skb->skb_iif;
 
     // read L2 info
@@ -93,7 +87,12 @@ int kfree_skb(struct trace_event_raw_kfree_skb *args) {
     // SKB_CONSUMED,
     // SKB_DROP_REASON_NOT_SPECIFIED,
     if (reason > SKB_DROP_REASON_NOT_SPECIFIED) {
-        return trace_pkt_drop(args, sk, &skb, reason);
+        u8 state = 0;
+        if (sk) {
+         // pull in details from the packet headers and the sock struct
+            bpf_probe_read(&state, sizeof(u8), (u8 *)&sk->__sk_common.skc_state);
+        }
+        return trace_pkt_drop(args, state, &skb, reason);
     }
     return 0;
 }