[USMON-1319] usm: Add raw tracepoint for netif_receive_skb (#32496)

DataDog · Dec 26, 2024 · 2ae3236 · 2ae3236
1 parent cfcbb5a
commit 2ae3236
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 7 deletions.
diff --git a/pkg/network/ebpf/c/protocols/flush.h b/pkg/network/ebpf/c/protocols/flush.h
@@ -28,4 +28,12 @@ int tracepoint__net__netif_receive_skb(void *ctx) {
     return 0;
 }
 
+SEC("raw_tracepoint/net/netif_receive_skb")
+int BPF_PROG(raw_tracepoint__net__netif_receive_skb) {
+    CHECK_BPF_PROGRAM_BYPASSED()
+    log_debug("raw_tracepoint/net/netif_receive_skb");
+    flush(ctx);
+    return 0;
+}
+
 #endif
diff --git a/pkg/network/usm/ebpf_main.go b/pkg/network/usm/ebpf_main.go
@@ -14,10 +14,12 @@ import (
 	"slices"
 	"unsafe"
 
-	manager "github.com/DataDog/ebpf-manager"
 	"github.com/cilium/ebpf"
+	"github.com/cilium/ebpf/features"
 	"github.com/davecgh/go-spew/spew"
 
+	manager "github.com/DataDog/ebpf-manager"
+
 	ddebpf "github.com/DataDog/datadog-agent/pkg/ebpf"
 	"github.com/DataDog/datadog-agent/pkg/ebpf/bytecode"
 	"github.com/DataDog/datadog-agent/pkg/ebpf/prebuilt"
@@ -67,6 +69,9 @@ const (
 	sockFDLookup    = "kprobe__sockfd_lookup_light"
 	sockFDLookupRet = "kretprobe__sockfd_lookup_light"
 
+	netifReceiveSkbTp    = "tracepoint__net__netif_receive_skb"
+	netifReceiveSkbRawTp = "raw_tracepoint__net__netif_receive_skb"
+
 	tcpCloseProbe = "kprobe__tcp_close"
 
 	// maxActive configures the maximum number of instances of the
@@ -90,6 +95,23 @@ type ebpfProgram struct {
 }
 
 func newEBPFProgram(c *config.Config, connectionProtocolMap *ebpf.Map) (*ebpfProgram, error) {
+	netifProbe := manager.Probe{
+		ProbeIdentificationPair: manager.ProbeIdentificationPair{
+			EBPFFuncName: netifReceiveSkbTp,
+			UID:          probeUID,
+		},
+	}
+	if features.HaveProgramType(ebpf.RawTracepoint) == nil {
+		netifProbe = manager.Probe{
+			ProbeIdentificationPair: manager.ProbeIdentificationPair{
+				EBPFFuncName: netifReceiveSkbRawTp,
+				UID:          probeUID,
+			},
+			TracepointCategory: "net",
+			TracepointName:     "netif_receive_skb",
+		}
+	}
+
 	mgr := &manager.Manager{
 		Maps: []*manager.Map{
 			{Name: protocols.TLSDispatcherProgramsMap},
@@ -114,12 +136,7 @@ func newEBPFProgram(c *config.Config, connectionProtocolMap *ebpf.Map) (*ebpfPro
 					UID:          probeUID,
 				},
 			},
-			{
-				ProbeIdentificationPair: manager.ProbeIdentificationPair{
-					EBPFFuncName: "tracepoint__net__netif_receive_skb",
-					UID:          probeUID,
-				},
-			},
+			&netifProbe,
 			{
 				ProbeIdentificationPair: manager.ProbeIdentificationPair{
 					EBPFFuncName: protocolDispatcherSocketFilterFunction,
@@ -462,6 +479,13 @@ func (e *ebpfProgram) init(buf bytecode.AssetReader, options manager.Options) er
 		}
 	}
 
+	// exclude unused netif_receive_skb probe
+	if features.HaveProgramType(ebpf.RawTracepoint) == nil {
+		options.ExcludedFunctions = append(options.ExcludedFunctions, netifReceiveSkbTp)
+	} else {
+		options.ExcludedFunctions = append(options.ExcludedFunctions, netifReceiveSkbRawTp)
+	}
+
 	err := e.InitWithOptions(buf, &options)
 	if err != nil {
 		cleanup()