Skip to content

OCPBUGS-76699: ebpf: consolidate packet event logs into single line #706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rameshsahoo11 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

OCPBUGS-76699: ebpf: consolidate packet event logs into single line #706

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
34b3fcb
ebpf: consolidate packet event logs into single line
rameshsahoo11 Apr 29, 2026
89ac802
test: update E2E event regex for consolidated log format
rameshsahoo11 Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 28 additions & 49 deletions pkg/ebpf/ingress_node_firewall_events.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (
"net"
"os"
"os/signal"
"strings"
"syscall"
"time"
"unsafe"
Expand Down Expand Up @@ -104,66 +105,44 @@ func (infc *IngNodeFwController) ingressNodeFwEvents() error {
log.Printf("lookup network iface %d: %s", eventHdr.IfId, err)
continue
}
if err := eventsLogger.Info(fmt.Sprintf("ruleId %d action %s len %d if %s\n",
eventHdr.RuleId, convertXdpActionToString(eventHdr.Action), eventHdr.PktLength, iface.Name)); err != nil {
log.Printf("syslog event logging failed %q", err)
}
// Build a complete log message with all packet details
var logMsg strings.Builder
fmt.Fprintf(&logMsg, "ruleId %d action %s len %d if %s",
eventHdr.RuleId, convertXdpActionToString(eventHdr.Action), eventHdr.PktLength, iface.Name)

decodePacket := gopacket.NewPacket(packet, layers.LayerTypeEthernet, gopacket.Default)
// check for IPv4

// Append IP layer information
if ip4Layer := decodePacket.Layer(layers.LayerTypeIPv4); ip4Layer != nil {
ip, _ := ip4Layer.(*layers.IPv4)
if err := eventsLogger.Info(fmt.Sprintf("\tipv4 src addr %s dst addr %s\n", ip.SrcIP.String(), ip.DstIP.String())); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
// check for IPv6
if ip6Layer := decodePacket.Layer(layers.LayerTypeIPv6); ip6Layer != nil {
fmt.Fprintf(&logMsg, " | ipv4 src %s dst %s", ip.SrcIP.String(), ip.DstIP.String())
} else if ip6Layer := decodePacket.Layer(layers.LayerTypeIPv6); ip6Layer != nil {
Copy link
Copy Markdown

@meinali566 meinali566 Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here you shouldn't use else if, it will cause ipv6 logs lost in dualtsack cluster

ip, _ := ip6Layer.(*layers.IPv6)
if err := eventsLogger.Info(fmt.Sprintf("\tipv6 src addr %s dst addr %s\n", ip.SrcIP.String(), ip.DstIP.String())); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
fmt.Fprintf(&logMsg, " | ipv6 src %s dst %s", ip.SrcIP.String(), ip.DstIP.String())
}
// check for TCP

// Append protocol-specific information
if tcpLayer := decodePacket.Layer(layers.LayerTypeTCP); tcpLayer != nil {
tcp, _ := tcpLayer.(*layers.TCP)
if err := eventsLogger.Info(fmt.Sprintf("\ttcp srcPort %d dstPort %d\n", tcp.SrcPort, tcp.DstPort)); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
// check for UDP
if udpLayer := decodePacket.Layer(layers.LayerTypeUDP); udpLayer != nil {
fmt.Fprintf(&logMsg, " | tcp srcPort %d dstPort %d", tcp.SrcPort, tcp.DstPort)
} else if udpLayer := decodePacket.Layer(layers.LayerTypeUDP); udpLayer != nil {
Copy link
Copy Markdown

@meinali566 meinali566 Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

udp, _ := udpLayer.(*layers.UDP)
if err := eventsLogger.Info(fmt.Sprintf("\tudp srcPort %d dstPort %d\n", udp.SrcPort, udp.DstPort)); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
// check fo SCTP
if sctpLayer := decodePacket.Layer(layers.LayerTypeSCTP); sctpLayer != nil {
fmt.Fprintf(&logMsg, " | udp srcPort %d dstPort %d", udp.SrcPort, udp.DstPort)
} else if sctpLayer := decodePacket.Layer(layers.LayerTypeSCTP); sctpLayer != nil {
sctp, _ := sctpLayer.(*layers.SCTP)
if err := eventsLogger.Info(fmt.Sprintf("\tsctp srcPort %d dstPort %d\n", sctp.SrcPort, sctp.DstPort)); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
// check for ICMPv4
if icmpv4Layer := decodePacket.Layer(layers.LayerTypeICMPv4); icmpv4Layer != nil {
fmt.Fprintf(&logMsg, " | sctp srcPort %d dstPort %d", sctp.SrcPort, sctp.DstPort)
} else if icmpv4Layer := decodePacket.Layer(layers.LayerTypeICMPv4); icmpv4Layer != nil {
icmp, _ := icmpv4Layer.(*layers.ICMPv4)
if err := eventsLogger.Info(fmt.Sprintf("\ticmpv4 type %d code %d\n", icmp.TypeCode.Type(), icmp.TypeCode.Code())); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
// check for ICMPV6
if icmpv6Layer := decodePacket.Layer(layers.LayerTypeICMPv6); icmpv6Layer != nil {
fmt.Fprintf(&logMsg, " | icmpv4 type %d code %d", icmp.TypeCode.Type(), icmp.TypeCode.Code())
} else if icmpv6Layer := decodePacket.Layer(layers.LayerTypeICMPv6); icmpv6Layer != nil {
icmp, _ := icmpv6Layer.(*layers.ICMPv6)
if err := eventsLogger.Info(fmt.Sprintf("\ticmpv6 type %d code %d\n", icmp.TypeCode.Type(), icmp.TypeCode.Code())); err != nil {
log.Printf("syslog event logging for ruleId %d on intrerface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
fmt.Fprintf(&logMsg, " | icmpv6 type %d code %d", icmp.TypeCode.Type(), icmp.TypeCode.Code())
}

// Log the complete message as a single line
if err := eventsLogger.Info(logMsg.String()); err != nil {
log.Printf("syslog event logging for ruleId %d on interface %s failed err: %q",
eventHdr.RuleId, iface.Name, err)
}
}
}()
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/events/events.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ func extractEventsFromString(str string) ([]TestEvent, error) {
// Transport regular expression
// Match for each drop.
// If any change to the event output in pkg/ebpf/ingress_node_firewall_events.go, an update is required here.
transportEventRE := "ruleId\\s([0-9]+)\\saction\\s(?P<action>\\w+).*if\\s(?P<inf>\\w+)\n.*\\ssrc\\saddr\\s(?P<srcaddr>[0-9.:a-z]+)\\sdst\\saddr\\s(?P<dstaddr>[0-9.:a-z]+)\n.*(?P<proto>tcp|udp|sctp)\\ssrcPort\\s\\d+\\sdstPort\\s(?P<dstport>\\d+)"
transportEventRE := `ruleId\s([0-9]+)\saction\s(?P<action>\w+).*if\s(?P<inf>\w+)\s\|\s(?:ipv4|ipv6)\ssrc\s(?P<srcaddr>[0-9.:a-z]+)\sdst\s(?P<dstaddr>[0-9.:a-z]+)\s\|\s(?P<proto>tcp|udp|sctp)\ssrcPort\s\d+\sdstPort\s(?P<dstport>\d+)`
transportEventPattern := regexp.MustCompile(transportEventRE)
for _, match := range transportEventPattern.FindAllStringSubmatch(str, -1) { // -1 for unlimited matches
var te TestEvent
Expand Down Expand Up @@ -94,7 +94,7 @@ func extractEventsFromString(str string) ([]TestEvent, error) {
// ICMP regular expression
// Match for each drop.
// If any change to the event output in pkg/ebpf/ingress_node_firewall_events.go, an update is required here.
icmpEventRE := "ruleId\\s([0-9]+)\\saction\\s(?P<action>\\w+).*if\\s(?P<inf>\\w+)\\n.*\\s(ipv4|ipv6)\\ssrc\\saddr\\s(?P<srcaddr>[0-9.:a-z]+)\\sdst\\saddr\\s(?P<dstaddr>[0-9.:a-z]+)\\n.*(?P<proto>icmpv4|icmpv6)\\stype\\s(?P<type>\\d+)\\scode\\s(?P<code>\\d+)"
icmpEventRE := `ruleId\s([0-9]+)\saction\s(?P<action>\w+).*if\s(?P<inf>\w+)\s\|\s(?:ipv4|ipv6)\ssrc\s(?P<srcaddr>[0-9.:a-z]+)\sdst\s(?P<dstaddr>[0-9.:a-z]+)\s\|\s(?P<proto>icmpv4|icmpv6)\stype\s(?P<type>\d+)\scode\s(?P<code>\d+)`
icmpEventPattern := regexp.MustCompile(icmpEventRE)
for _, match := range icmpEventPattern.FindAllStringSubmatch(str, -1) {
var te TestEvent
Expand Down