From 7dac9f7a4b43307e56a707bac3ed612bcb747f20 Mon Sep 17 00:00:00 2001 From: Anubhab Majumdar Date: Thu, 30 May 2024 17:28:16 -0700 Subject: [PATCH] fix: correctly assign the subtype value in flow for drop reason (#413) # Description The `subType` field for flows of type Drop needs to be the DropReason, not the point of observation. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/contributing). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [x] I have updated the documentation, if necessary. - [x] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed Checked the flows through debug logging to make sure the SubType is set correctly. --- Please refer to the [CONTRIBUTING.md](../CONTRIBUTING.md) file for more information on how to contribute to this project. Signed-off-by: Anubhab Majumdar --- pkg/utils/flow_utils.go | 9 +++++---- pkg/utils/utils_linux_test.go | 1 + 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/pkg/utils/flow_utils.go b/pkg/utils/flow_utils.go index 2c43d438ab5..bb8c1038488 100644 --- a/pkg/utils/flow_utils.go +++ b/pkg/utils/flow_utils.go @@ -266,10 +266,6 @@ func AddDropReason(f *flow.Flow, meta *RetinaMetadata, dropReason uint32) { meta.DropReason = DropReason(dropReason) f.Verdict = flow.Verdict_DROPPED - f.EventType = &flow.CiliumEventType{ - Type: int32(api.MessageTypeDrop), - SubType: int32(api.TraceToNetwork), // This is a drop event and direction is determined later. - } // Set the drop reason. // Retina drop reasons are different from the drop reasons available in flow library. @@ -285,6 +281,11 @@ func AddDropReason(f *flow.Flow, meta *RetinaMetadata, dropReason uint32) { default: f.DropReasonDesc = flow.DropReason_DROP_REASON_UNKNOWN } + + f.EventType = &flow.CiliumEventType{ + Type: int32(api.MessageTypeDrop), + SubType: int32(f.GetDropReasonDesc()), // This is the drop reason. + } } func DropReasonDescription(f *flow.Flow) string { diff --git a/pkg/utils/utils_linux_test.go b/pkg/utils/utils_linux_test.go index 0a0f5477809..520a30d5338 100644 --- a/pkg/utils/utils_linux_test.go +++ b/pkg/utils/utils_linux_test.go @@ -158,6 +158,7 @@ func TestAddDropReason(t *testing.T) { assert.Equal(t, f.DropReasonDesc, tc.expectedDesc) assert.Equal(t, f.Verdict, flow.Verdict_DROPPED) assert.NotNil(t, f.EventType.Type, 1) + assert.EqualValues(t, f.EventType.GetSubType(), int32(tc.expectedDesc)) assert.NotNil(t, DropReasonDescription(f), DropReason_name[int32(tc.dropReason)]) }) }