fix: correctly assign the subtype value in flow for drop reason (micr…

…osoft#413)

The `subType` field for flows of type Drop needs to be the DropReason,
not the point of observation.

- [x] I have read the [contributing
documentation](https://retina.sh/docs/contributing).
- [x] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [x] I have updated the documentation, if necessary.
- [x] I have added tests, if applicable.

Checked the flows through debug logging to make sure the SubType is set
correctly.

---

Please refer to the [CONTRIBUTING.md](../CONTRIBUTING.md) file for more
information on how to contribute to this project.

Signed-off-by: Anubhab Majumdar <[email protected]>

pkg/utils/flow_utils.go

@@ -281,12 +281,17 @@ func AddDropReason(f *flow.Flow, meta *RetinaMetadata, dropReason uint32) {
 	meta.DropReason = DropReason(dropReason)
 
 	f.Verdict = flow.Verdict_DROPPED
+
+	// Set the drop reason.
+	// Retina drop reasons are different from the drop reasons available in flow library.
+	// We map the ones available in flow library to the ones available in Retina.
+	// Rest are set to UNKNOWN. The details are added in the metadata.
+	f.DropReasonDesc = GetDropReasonDesc(meta.GetDropReason())
+
 	f.EventType = &flow.CiliumEventType{
 		Type:    int32(api.MessageTypeDrop),
-		SubType: int32(api.TraceToNetwork), // This is a drop event and direction is determined later.
+		SubType: int32(f.GetDropReasonDesc()), // This is the drop reason.
 	}
-
-	f.DropReasonDesc = GetDropReasonDesc(meta.GetDropReason())
 }
 
 func DropReasonDescription(f *flow.Flow) string {

pkg/utils/utils_linux_test.go

@@ -158,6 +158,7 @@ func TestAddDropReason(t *testing.T) {
 			assert.Equal(t, f.DropReasonDesc, tc.expectedDesc)
 			assert.Equal(t, f.Verdict, flow.Verdict_DROPPED)
 			assert.NotNil(t, f.EventType.Type, 1)
+			assert.EqualValues(t, f.EventType.GetSubType(), int32(tc.expectedDesc))
 			assert.NotNil(t, DropReasonDescription(f), DropReason_name[int32(tc.dropReason)])
 		})
 	}