Merge pull request #89 from coroot/fix_dns_capturing

def · web-flow · commit eae516b03de8 · 2024-05-28T17:06:33.000+03:00
fix DNS request capturing
diff --git a/containers/container.go b/containers/container.go
@@ -582,10 +582,10 @@ func (c *Container) onDNSRequest(r *l7.RequestData) map[netaddr.IP]string {
 		dnsReq := L7Requests[l7.ProtocolDNS]
 		c.dnsStats.Requests = prometheus.NewCounterVec(
 			prometheus.CounterOpts{Name: dnsReq.Name, Help: dnsReq.Help},
-			[]string{"request_type", "status"},
+			[]string{"request_type", "domain", "status"},
 		)
 	}
-	if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, status); m != nil {
+	if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, fqdn, status); m != nil {
 		m.Inc()
 	}
 	if r.Duration != 0 {
diff --git a/ebpftracer/ebpf.go b/ebpftracer/ebpf.go
diff --git a/ebpftracer/ebpf/l7/dns.c b/ebpftracer/ebpf/l7/dns.c
@@ -45,7 +45,7 @@ int is_dns_response(char *buf, __u64 buf_size, __s16 *stream_id, __u32 *status)
     if (h.bits0 & DNS_OPCODE) {
        return 0;
     }
-    if (!(h.bits1 & DNS_Z)) {
+    if ((h.bits1 & DNS_Z)) {
         return 0;
     }
     h.qdcount = bpf_ntohs(h.qdcount);

Original file line number	Diff line number	Diff line change
`@@ -582,10 +582,10 @@ func (c Container) onDNSRequest(r l7.RequestData) map[netaddr.IP]string {`
`582`	`582`	`dnsReq := L7Requests[l7.ProtocolDNS]`
`583`	`583`	`c.dnsStats.Requests = prometheus.NewCounterVec(`
`584`	`584`	`prometheus.CounterOpts{Name: dnsReq.Name, Help: dnsReq.Help},`
`585`		`- []string{"request_type", "status"},`
	`585`	`+ []string{"request_type", "domain", "status"},`
`586`	`586`	`)`
`587`	`587`	`}`
`588`		`- if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, status); m != nil {`
	`588`	`+ if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, fqdn, status); m != nil {`
`589`	`589`	`m.Inc()`
`590`	`590`	`}`
`591`	`591`	`if r.Duration != 0 {`
Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ int is_dns_response(char buf, __u64 buf_size, __s16 stream_id, __u32 *status)`
`45`	`45`	`if (h.bits0 & DNS_OPCODE) {`
`46`	`46`	`return 0;`
`47`	`47`	`}`
`48`		`- if (!(h.bits1 & DNS_Z)) {`
	`48`	`+ if ((h.bits1 & DNS_Z)) {`
`49`	`49`	`return 0;`
`50`	`50`	`}`
`51`	`51`	`h.qdcount = bpf_ntohs(h.qdcount);`