NETOBSERV-1676: make ebpf sampling global and visible to all hooks (#346)

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>

bpf/flows.c

@@ -45,9 +45,10 @@
 static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
     // If sampling is defined, will only parse 1 out of "sampling" flows
     if (sampling > 1 && (bpf_get_prandom_u32() % sampling) != 0) {
+        do_sampling = 0;
         return TC_ACT_OK;
     }
-
+    do_sampling = 1;
     pkt_info pkt;
     __builtin_memset(&pkt, 0, sizeof(pkt));
 

bpf/pkt_drops.h

@@ -85,6 +85,11 @@ static inline int trace_pkt_drop(void *ctx, u8 state, struct sk_buff *skb,
 SEC("tracepoint/skb/kfree_skb")
 int kfree_skb(struct trace_event_raw_kfree_skb *args) {
     struct sk_buff skb;
+
+    if (do_sampling == 0) {
+        return 0;
+    }
+
     __builtin_memset(&skb, 0, sizeof(skb));
 
     bpf_probe_read(&skb, sizeof(struct sk_buff), args->skbaddr);

bpf/rtt_tracker.h

@@ -157,7 +157,7 @@ static inline int calculate_flow_rtt_tcp(struct sock *sk, struct sk_buff *skb) {
 
 SEC("fentry/tcp_rcv_established")
 int BPF_PROG(tcp_rcv_fentry, struct sock *sk, struct sk_buff *skb) {
-    if (sk == NULL || skb == NULL) {
+    if (sk == NULL || skb == NULL || do_sampling == 0) {
         return 0;
     }
     return calculate_flow_rtt_tcp(sk, skb);
@@ -165,7 +165,7 @@ int BPF_PROG(tcp_rcv_fentry, struct sock *sk, struct sk_buff *skb) {
 
 SEC("kprobe/tcp_rcv_established")
 int BPF_KPROBE(tcp_rcv_kprobe, struct sock *sk, struct sk_buff *skb) {
-    if (sk == NULL || skb == NULL) {
+    if (sk == NULL || skb == NULL || do_sampling == 0) {
         return 0;
     }
     return calculate_flow_rtt_tcp(sk, skb);

bpf/utils.h

@@ -5,6 +5,8 @@
 #include "maps_definition.h"
 #include "flows_filter.h"
 
+static u8 do_sampling = 0;
+
 // sets the TCP header flags for connection information
 static inline void set_flags(struct tcphdr *th, u16 *flags) {
     //If both ACK and SYN are set, then it is server -> client communication during 3-way handshake.