NETOBSERV-1390: Flow RTT values are n/a (#245)

* update libbpf and update bpf headers

Signed-off-by: Mohamed Mahmoud <[email protected]>

* change rtt logic to use kprobe and get rtt from tcp socket

Signed-off-by: Mohamed Mahmoud <[email protected]>

* merge flow record RTT info in case of dup flows

Signed-off-by: Mohamed Mahmoud <[email protected]>

---------

Signed-off-by: Mohamed Mahmoud <[email protected]>

Author: msherif1234

Makefile

@@ -123,7 +123,7 @@ generate: prereqs ## Generate artifacts of the code repo (pkg/ebpf and pkg/proto
 .PHONY: docker-generate
 docker-generate: ## Create the container that generates the eBPF binaries
 	@echo "### Creating the container that generates the eBPF binaries"
-	$(OCI_BIN) build . -f scripts/generators.Dockerfile -t $(LOCAL_GENERATOR_IMAGE)
+	$(OCI_BIN) build . -f scripts/generators.Dockerfile -t $(LOCAL_GENERATOR_IMAGE) --build-arg EXTENSION="x86_64"
 	$(OCI_BIN) run --rm -v $(shell pwd):/src $(LOCAL_GENERATOR_IMAGE)
 
 .PHONY: compile

bpf/flows.c

@@ -66,12 +66,6 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
     id.if_index = skb->ifindex;
     id.direction = direction;
 
-    // We calculate the RTT before looking up aggregated_flows map because we want
-    // to keep the critical section between map lookup and update consume minimum time.
-    if (enable_rtt) {
-        // This is currently not to be enabled by default.
-        calculate_flow_rtt(&pkt, direction, data_end);
-    }
     int dns_errno = 0;
     if (enable_dns_tracking) {
         dns_errno = track_dns_packet(skb, &pkt);
@@ -90,10 +84,6 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
         }
         aggregate_flow->flags |= pkt.flags;
         aggregate_flow->dscp = pkt.dscp;
-        // Does not matter the gate. Will be zero if not enabled.
-        if (pkt.rtt > aggregate_flow->flow_rtt) {
-            aggregate_flow->flow_rtt = pkt.rtt;
-        }
         aggregate_flow->dns_record.id = pkt.dns_id;
         aggregate_flow->dns_record.flags = pkt.dns_flags;
         aggregate_flow->dns_record.latency = pkt.dns_latency;
@@ -109,18 +99,22 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) {
         }
     } else {
         // Key does not exist in the map, and will need to create a new entry.
+        u64 rtt = 0;
+        if (enable_rtt && id.transport_protocol == IPPROTO_TCP) {
+            rtt = MIN_RTT;
+        }
         flow_metrics new_flow = {
             .packets = 1,
             .bytes = skb->len,
             .start_mono_time_ts = pkt.current_ts,
             .end_mono_time_ts = pkt.current_ts,
             .flags = pkt.flags,
-            .flow_rtt = pkt.rtt,
             .dscp = pkt.dscp,
             .dns_record.id = pkt.dns_id,
             .dns_record.flags = pkt.dns_flags,
             .dns_record.latency = pkt.dns_latency,
             .dns_record.errno = dns_errno,
+            .flow_rtt = rtt,
         };
 
         // even if we know that the entry is new, another CPU might be concurrently inserting a flow