Initial payload export from bpf using skb_o/p

bpf/flow.h

@@ -51,4 +51,9 @@ typedef struct flow_record_t {
     flow_id id;
     flow_metrics metrics;
 } __attribute__((packed)) flow_record;
+
+typedef struct payload_meta_t {
+	u32 if_index;
+	u32 pkt_len;
+} __attribute__((packed)) payload_meta;
 #endif

bpf/flows.c

@@ -48,6 +48,14 @@ struct {
     __uint(max_entries, 1 << 24);
 } direct_flows SEC(".maps");
 
+
+// Perf Buffer to submit packet payloads to userspace
+struct {
+    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+    __uint(key_size, sizeof(int));
+    __uint(value_size, sizeof(int));
+} packet_payloads SEC(".maps");
+
 // Key: the flow identifier. Value: the flow metrics for that identifier.
 // The userspace will aggregate them into a single flow.
 struct {
@@ -58,7 +66,9 @@ struct {
 
 // Constant definitions, to be overridden by the invoker
 volatile const u32 sampling = 0;
-volatile const u8 trace_messages = 0;
+volatile const u8  trace_messages = 0;
+volatile const u32 payload_size = 64;
+
 
 const u8 ip4in6[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
 
@@ -232,6 +242,28 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
     return TC_ACT_OK;
 
 }
+
+static inline int export_packet_payload (struct __sk_buff *skb) {
+    void *data_end = (void *)(long)skb->data_end;
+    void *data = (void *)(long)skb->data;
+    payload_meta meta;
+
+    meta.if_index = skb->ifindex;
+    meta.pkt_len = data_end - data;
+    bpf_skb_output(skb, &packet_payloads, ((u64) meta.pkt_len << 32) | BPF_F_CURRENT_CPU, &meta, sizeof(meta));
+    return TC_ACT_OK;
+}
+
+SEC("pano_ingress")
+int pano_ingress_parse (struct __sk_buff *skb) {
+    return export_packet_payload(skb);
+}
+
+SEC("pano_egress")
+int pano_egress_parse (struct __sk_buff *skb) {
+    return export_packet_payload(skb);
+}
+
 SEC("tc_ingress")
 int ingress_flow_parse (struct __sk_buff *skb) {
     return flow_monitor(skb, INGRESS);

pkg/ebpf/bpf_bpfeb.go

@@ -56,6 +56,8 @@ type bpfSpecs struct {
 type bpfProgramSpecs struct {
 	EgressFlowParse  *ebpf.ProgramSpec `ebpf:"egress_flow_parse"`
 	IngressFlowParse *ebpf.ProgramSpec `ebpf:"ingress_flow_parse"`
+	PanoEgressParse  *ebpf.ProgramSpec `ebpf:"pano_egress_parse"`
+	PanoIngressParse *ebpf.ProgramSpec `ebpf:"pano_ingress_parse"`
 }
 
 // bpfMapSpecs contains maps before they are loaded into the kernel.
@@ -64,6 +66,7 @@ type bpfProgramSpecs struct {
 type bpfMapSpecs struct {
 	AggregatedFlows *ebpf.MapSpec `ebpf:"aggregated_flows"`
 	DirectFlows     *ebpf.MapSpec `ebpf:"direct_flows"`
+	PacketPayloads  *ebpf.MapSpec `ebpf:"packet_payloads"`
 }
 
 // bpfObjects contains all objects after they have been loaded into the kernel.
@@ -87,12 +90,14 @@ func (o *bpfObjects) Close() error {
 type bpfMaps struct {
 	AggregatedFlows *ebpf.Map `ebpf:"aggregated_flows"`
 	DirectFlows     *ebpf.Map `ebpf:"direct_flows"`
+	PacketPayloads  *ebpf.Map `ebpf:"packet_payloads"`
 }
 
 func (m *bpfMaps) Close() error {
 	return _BpfClose(
 		m.AggregatedFlows,
 		m.DirectFlows,
+		m.PacketPayloads,
 	)
 }
 
@@ -102,12 +107,16 @@ func (m *bpfMaps) Close() error {
 type bpfPrograms struct {
 	EgressFlowParse  *ebpf.Program `ebpf:"egress_flow_parse"`
 	IngressFlowParse *ebpf.Program `ebpf:"ingress_flow_parse"`
+	PanoEgressParse  *ebpf.Program `ebpf:"pano_egress_parse"`
+	PanoIngressParse *ebpf.Program `ebpf:"pano_ingress_parse"`
 }
 
 func (p *bpfPrograms) Close() error {
 	return _BpfClose(
 		p.EgressFlowParse,
 		p.IngressFlowParse,
+		p.PanoEgressParse,
+		p.PanoIngressParse,
 	)
 }
 

pkg/ebpf/bpf_bpfel.go

@@ -56,6 +56,8 @@ type bpfSpecs struct {
 type bpfProgramSpecs struct {
 	EgressFlowParse  *ebpf.ProgramSpec `ebpf:"egress_flow_parse"`
 	IngressFlowParse *ebpf.ProgramSpec `ebpf:"ingress_flow_parse"`
+	PanoEgressParse  *ebpf.ProgramSpec `ebpf:"pano_egress_parse"`
+	PanoIngressParse *ebpf.ProgramSpec `ebpf:"pano_ingress_parse"`
 }
 
 // bpfMapSpecs contains maps before they are loaded into the kernel.
@@ -64,6 +66,7 @@ type bpfProgramSpecs struct {
 type bpfMapSpecs struct {
 	AggregatedFlows *ebpf.MapSpec `ebpf:"aggregated_flows"`
 	DirectFlows     *ebpf.MapSpec `ebpf:"direct_flows"`
+	PacketPayloads  *ebpf.MapSpec `ebpf:"packet_payloads"`
 }
 
 // bpfObjects contains all objects after they have been loaded into the kernel.
@@ -87,12 +90,14 @@ func (o *bpfObjects) Close() error {
 type bpfMaps struct {
 	AggregatedFlows *ebpf.Map `ebpf:"aggregated_flows"`
 	DirectFlows     *ebpf.Map `ebpf:"direct_flows"`
+	PacketPayloads  *ebpf.Map `ebpf:"packet_payloads"`
 }
 
 func (m *bpfMaps) Close() error {
 	return _BpfClose(
 		m.AggregatedFlows,
 		m.DirectFlows,
+		m.PacketPayloads,
 	)
 }
 
@@ -102,12 +107,16 @@ func (m *bpfMaps) Close() error {
 type bpfPrograms struct {
 	EgressFlowParse  *ebpf.Program `ebpf:"egress_flow_parse"`
 	IngressFlowParse *ebpf.Program `ebpf:"ingress_flow_parse"`
+	PanoEgressParse  *ebpf.Program `ebpf:"pano_egress_parse"`
+	PanoIngressParse *ebpf.Program `ebpf:"pano_ingress_parse"`
 }
 
 func (p *bpfPrograms) Close() error {
 	return _BpfClose(
 		p.EgressFlowParse,
 		p.IngressFlowParse,
+		p.PanoEgressParse,
+		p.PanoIngressParse,
 	)
 }