Allow DNS tracking to use configurable port for tracking

Today DNS tracking uses only port 53 which is the port defined for DNS service and it get mapped to different port at the container level to avoid root access. This change wil allow tracking at the pod level as well Signed-off-by: Mohamed Mahmoud <[email protected]>
netobserv · Aug 6, 2024 · 45824dd · 45824dd
1 parent 7b7dc40
commit 45824dd
Show file tree

Hide file tree

Showing 11 changed files with 51 additions and 16 deletions.
diff --git a/bpf/configs.h b/bpf/configs.h
@@ -9,4 +9,5 @@ volatile const u8 enable_rtt = 0;
 volatile const u8 enable_pca = 0;
 volatile const u8 enable_dns_tracking = 0;
 volatile const u8 enable_flows_filtering = 0;
+volatile const u32 dns_port = 0;
 #endif //__CONFIGS_H__
diff --git a/bpf/dns_tracker.h b/bpf/dns_tracker.h
@@ -6,7 +6,6 @@
 #define __DNS_TRACKER_H__
 #include "utils.h"
 
-#define DNS_PORT 53
 #define DNS_QR_FLAG 0x8000
 #define UDP_MAXMSG 512
 #define EINVAL 22
@@ -67,7 +66,7 @@ static __always_inline u8 calc_dns_header_offset(pkt_info *pkt, void *data_end)
 
 static __always_inline int track_dns_packet(struct __sk_buff *skb, pkt_info *pkt) {
     void *data_end = (void *)(long)skb->data_end;
-    if (pkt->id->dst_port == DNS_PORT || pkt->id->src_port == DNS_PORT) {
+    if (pkt->id->dst_port == dns_port || pkt->id->src_port == dns_port) {
         dns_flow_id dns_req;
 
         u8 len = calc_dns_header_offset(pkt, data_end);

diff --git a/pkg/agent/agent.go b/pkg/agent/agent.go
@@ -185,6 +185,7 @@ func FlowsAgent(cfg *Config) (*Flows, error) {
 		CacheMaxSize:     cfg.CacheMaxFlows,
 		PktDrops:         cfg.EnablePktDrops,
 		DNSTracker:       cfg.EnableDNSTracking,
+		DNSTrackerPort:   cfg.DNSTrackingPort,
 		EnableRTT:        cfg.EnableRTT,
 		EnableFlowFilter: cfg.EnableFlowFilter,
 		FilterConfig: &ebpf.FilterConfig{

diff --git a/pkg/agent/config.go b/pkg/agent/config.go
@@ -161,6 +161,9 @@ type Config struct {
 	EnablePktDrops bool `env:"ENABLE_PKT_DROPS" envDefault:"false"`
 	// EnableDNSTracking enable DNS tracking eBPF hook to track dns query/response flows
 	EnableDNSTracking bool `env:"ENABLE_DNS_TRACKING" envDefault:"false"`
+	// DNSTrackingPort used to define which port the DNS service is mapped to at the pod level,
+	// so we can track DNS at the pod level
+	DNSTrackingPort int `env:"DNS_TRACKING_PORT" envDefault:"53"`
 	// StaleEntriesEvictTimeout specifies the maximum duration that stale entries are kept
 	// before being deleted, default is 5 seconds.
 	StaleEntriesEvictTimeout time.Duration `env:"STALE_ENTRIES_EVICT_TIMEOUT" envDefault:"5s"`

diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o
diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o
diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o
diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o
diff --git a/pkg/ebpf/tracer.go b/pkg/ebpf/tracer.go
@@ -39,6 +39,8 @@ const (
 	constTraceMessages       = "trace_messages"
 	constEnableRtt           = "enable_rtt"
 	constEnableDNSTracking   = "enable_dns_tracking"
+	constDNSTrackingPort     = "dns_port"
+	dnsDefaultPort           = 53
 	constEnableFlowFiltering = "enable_flows_filtering"
 	pktDropHook              = "kfree_skb"
 	constPcaEnable           = "enable_pca"
@@ -79,12 +81,14 @@ type FlowFetcherConfig struct {
 	CacheMaxSize     int
 	PktDrops         bool
 	DNSTracker       bool
+	DNSTrackerPort   int
 	EnableRTT        bool
 	EnableFlowFilter bool
 	EnablePCA        bool
 	FilterConfig     *FilterConfig
 }
 
+// nolint:cyclop
 func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
 	if err := rlimit.RemoveMemlock(); err != nil {
 		log.WithError(err).
@@ -110,8 +114,12 @@ func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
 	}
 
 	enableDNSTracking := 0
+	dnsTrackerPort := dnsDefaultPort
 	if cfg.DNSTracker {
 		enableDNSTracking = 1
+		if cfg.DNSTrackerPort != 0 {
+			dnsTrackerPort = cfg.DNSTrackerPort
+		}
 	}
 
 	if enableDNSTracking == 0 {
@@ -128,6 +136,7 @@ func NewFlowFetcher(cfg *FlowFetcherConfig) (*FlowFetcher, error) {
 		constTraceMessages:       uint8(traceMsgs),
 		constEnableRtt:           uint8(enableRtt),
 		constEnableDNSTracking:   uint8(enableDNSTracking),
+		constDNSTrackingPort:     uint32(dnsTrackerPort),
 		constEnableFlowFiltering: uint8(enableFlowFiltering),
 	}); err != nil {
 		return nil, fmt.Errorf("rewriting BPF constants definition: %w", err)

diff --git a/pkg/pbflow/flow_grpc.pb.go b/pkg/pbflow/flow_grpc.pb.go
diff --git a/pkg/pbpacket/packet_grpc.pb.go b/pkg/pbpacket/packet_grpc.pb.go