From 0fa8b5e5c7d29f2f83ebc0416e554369938cb81e Mon Sep 17 00:00:00 2001
From: Julien Pinsonneau <jpinsonn@redhat.com>
Date: Wed, 26 Feb 2025 15:17:08 +0100
Subject: [PATCH] add drop informations on drop events

---
 pkg/decode/decode_protobuf.go      |  8 +++++
 pkg/decode/decode_protobuf_test.go | 58 ++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/pkg/decode/decode_protobuf.go b/pkg/decode/decode_protobuf.go
index efb723f1b..280af6158 100644
--- a/pkg/decode/decode_protobuf.go
+++ b/pkg/decode/decode_protobuf.go
@@ -149,6 +149,14 @@ func RecordToMap(fr *model.Record) config.GenericMap {
 
 	if len(fr.NetworkMonitorEventsMD) != 0 {
 		out["NetworkEvents"] = fr.NetworkMonitorEventsMD
+		for _, event := range fr.NetworkMonitorEventsMD {
+			// override drop fields when network event action is dropped
+			if event["Action"] == "drop" {
+				out["PktDropBytes"] = fr.Metrics.Bytes
+				out["PktDropPackets"] = fr.Metrics.Packets
+				out["PktDropLatestDropCause"] = "OVS_DROP_EXPLICIT"
+			}
+		}
 	}
 
 	return out
diff --git a/pkg/decode/decode_protobuf_test.go b/pkg/decode/decode_protobuf_test.go
index 391b42ec7..0d426437a 100644
--- a/pkg/decode/decode_protobuf_test.go
+++ b/pkg/decode/decode_protobuf_test.go
@@ -153,3 +153,61 @@ func TestPBFlowToMap(t *testing.T) {
 		"ZoneId":      uint16(100),
 	}, out)
 }
+
+func TestPBFlowToMapDropEvent(t *testing.T) {
+	someTime := time.Now()
+	flow := &pbflow.Record{
+		EthProtocol:   2048,
+		Bytes:         12,
+		Packets:       34,
+		TimeFlowStart: timestamppb.New(someTime),
+		TimeFlowEnd:   timestamppb.New(someTime),
+		Network:       &pbflow.Network{},
+		Transport:     &pbflow.Transport{},
+		NetworkEventsMetadata: []*pbflow.NetworkEvent{
+			{
+				Events: map[string]string{
+					"Action":    "drop",
+					"Actor":     "AdminNetworkPolicy",
+					"Direction": "ingress",
+					"Name":      "my-policy",
+				},
+			},
+		},
+	}
+
+	out := PBFlowToMap(flow)
+	assert.NotZero(t, out["TimeReceived"])
+	delete(out, "TimeReceived")
+
+	var nilIntArr []int
+	var nilStrArr []string
+
+	assert.Equal(t, config.GenericMap{
+		"Bytes":                  uint64(12),
+		"SrcAddr":                "0.0.0.0",
+		"DstAddr":                "0.0.0.0",
+		"Dscp":                   uint8(0),
+		"DstMac":                 "00:00:00:00:00:00",
+		"SrcMac":                 "00:00:00:00:00:00",
+		"Packets":                uint32(34),
+		"Proto":                  uint8(0),
+		"TimeFlowStartMs":        someTime.UnixMilli(),
+		"TimeFlowEndMs":          someTime.UnixMilli(),
+		"AgentIP":                "0.0.0.0",
+		"PktDropBytes":           uint64(12),
+		"PktDropPackets":         uint32(34),
+		"PktDropLatestDropCause": "OVS_DROP_EXPLICIT",
+		"Etype":                  uint16(2048),
+		"IfDirections":           nilIntArr,
+		"Interfaces":             nilStrArr,
+		"NetworkEvents": []map[string]string{
+			{
+				"Action":    "drop",
+				"Actor":     "AdminNetworkPolicy",
+				"Direction": "ingress",
+				"Name":      "my-policy",
+			},
+		},
+	}, out)
+}