Need to differentiate between cached dns response vs incomplete ones [BP] (#402)

* Need to differentiate between cached dns response vs incomplete ones

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>
(cherry picked from commit 1f10618b0359889c854bd29c1edd712b05de0b12)
Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>

* fix issue with protocol matching

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>

---------

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>

bpf/flows_filter.h

@@ -140,6 +140,9 @@ static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_
                 }
                 break;
             }
+        } else {
+            result = 0;
+            goto end;
         }
 
         if (!is_zero_ip(rule->ip, len)) {

pkg/flow/deduper.go

@@ -88,6 +88,7 @@ func (c *deduperCache) checkDupe(r *Record, justMark, mergeDup bool, fwd *[]*Rec
 			fEntry.dnsRecord.Flags = r.Metrics.DnsRecord.Flags
 			fEntry.dnsRecord.Id = r.Metrics.DnsRecord.Id
 			fEntry.dnsRecord.Latency = r.Metrics.DnsRecord.Latency
+			fEntry.dnsRecord.Errno = r.Metrics.DnsRecord.Errno
 		}
 		// If the new flow has flowRTT then enrich the flow in the case with the same RTT and mark it duplicate
 		if r.Metrics.FlowRtt != 0 && *fEntry.flowRTT == 0 {

pkg/flow/record.go

@@ -105,7 +105,6 @@ func Accumulate(r *ebpf.BpfFlowMetrics, src *ebpf.BpfFlowMetrics) {
 	r.DnsRecord.Flags |= src.DnsRecord.Flags
 	if src.DnsRecord.Id != 0 {
 		r.DnsRecord.Id = src.DnsRecord.Id
-		r.DnsRecord.Errno = src.DnsRecord.Errno
 	}
 	if r.DnsRecord.Errno != src.DnsRecord.Errno {
 		r.DnsRecord.Errno = src.DnsRecord.Errno