Skip to content
This repository was archived by the owner on Jun 17, 2023. It is now read-only.

Commit 843c632

Browse files
sergeymakinensergeymakinen
committed
Add reqid to child SA
1 parent bc0380b commit 843c632

File tree

6 files changed

+37
-29
lines changed

6 files changed

+37
-29
lines changed

‎README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,12 @@ make
3131
| ipsec_offline_pool_ips | Number of leases offline. | name, address
3232
| ipsec_ike_sa_state | IKE SA state. Created: 0, connecting: 1, established: 2, passive: 3, rekeying: 4, rekeyed: 5, deleting: 6, destroying: 7. | name, uid, version, local_host, local_id, remote_host, remote_id, remote_identity, vips
3333
| ipsec_ike_sa_established_seconds | Number of seconds since the IKE SA has been established. | name, uid, version, local_host, local_id, remote_host, remote_id, remote_identity, vips
34-
| ipsec_child_sa_state | Child SA state. Created: 0, routed: 1, installing: 2, installed: 3, updating: 4, rekeying: 5, rekeyed: 6, retrying: 7, deleting: 8, deleted: 9, destroying: 10. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
35-
| ipsec_child_sa_bytes_in | Number of input bytes processed. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
36-
| ipsec_child_sa_packets_in | Number of input packets processed. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
37-
| ipsec_child_sa_bytes_out | Number of output bytes processed. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
38-
| ipsec_child_sa_packets_out | Number of output packets processed. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
39-
| ipsec_child_sa_installed_seconds | Number of seconds since the child SA has been installed. | ike_sa_name, ike_sa_uid, name, uid, mode, protocol, local_ts, remote_ts
34+
| ipsec_child_sa_state | Child SA state. Created: 0, routed: 1, installing: 2, installed: 3, updating: 4, rekeying: 5, rekeyed: 6, retrying: 7, deleting: 8, deleted: 9, destroying: 10. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
35+
| ipsec_child_sa_bytes_in | Number of input bytes processed. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
36+
| ipsec_child_sa_packets_in | Number of input packets processed. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
37+
| ipsec_child_sa_bytes_out | Number of output bytes processed. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
38+
| ipsec_child_sa_packets_out | Number of output packets processed. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
39+
| ipsec_child_sa_installed_seconds | Number of seconds since the child SA has been installed. | ike_sa_name, ike_sa_uid, name, uid, reqid, mode, protocol, local_ts, remote_ts
4040

4141
### Flags
4242

‎exporter/exporter.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ var (
4242
reSAVersion = regexp.MustCompile(`^(.+) SPIs:`)
4343
reSARemoteIdentity = regexp.MustCompile(`^Remote (.+) identity: (.+)$`)
4444
reChildSAPrefix = regexp.MustCompile(`^\s*([^{]+){(\d+)}: `)
45-
reChildSAStatus = regexp.MustCompile(`^([^,]+), ([^,]+), reqid \d+, (.+) SPIs:.+`)
45+
reChildSAStatus = regexp.MustCompile(`^([^,]+), ([^,]+), reqid (\d+), (.+) SPIs:.+`)
4646
reChildSATraffic = regexp.MustCompile(`(\d+) bytes_i(?: \((\d+) pkts?[^)]*\))?, (\d+) bytes_o(?: \((\d+) pkts?[^)]*\))?`)
4747
reChildSATS = regexp.MustCompile(`^ (.+) === (.+)$`)
4848
)
@@ -66,6 +66,7 @@ var (
6666
"uid",
6767
"mode",
6868
"protocol",
69+
"reqid",
6970
"local_ts",
7071
"remote_ts",
7172
}
@@ -377,7 +378,9 @@ func (e *Exporter) scrapeIpsec() (m metrics, ok bool) {
377378
if matches != nil {
378379
childSA2.State = matches[1]
379380
childSA2.Mode = matches[2]
380-
childSA2.Protocol = matches[3]
381+
n, _ := strconv.ParseUint(matches[3], 10, 64)
382+
childSA2.ReqID = uint32(n)
383+
childSA2.Protocol = matches[4]
381384
continue
382385
}
383386
matches = reChildSATraffic.FindStringSubmatch(line)
@@ -455,6 +458,7 @@ func (e *Exporter) collect(m metrics, ch chan<- prometheus.Metric) {
455458
strconv.FormatUint(uint64(childSA.UID), 10),
456459
childSA.Mode,
457460
childSA.Protocol,
461+
strconv.FormatUint(uint64(childSA.ReqID), 10),
458462
strings.Join(childSA.LocalTS, ", "),
459463
strings.Join(childSA.RemoteTS, ", "),
460464
}

‎exporter/exporter_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ func TestExporter(t *testing.T) {
8080
"named-3": {
8181
Name: "named",
8282
UID: 3,
83+
ReqID: 4,
8384
State: "INSTALLED",
8485
Mode: "TUNNEL",
8586
Protocol: "AH",
@@ -93,6 +94,7 @@ func TestExporter(t *testing.T) {
9394
"named-4": {
9495
Name: "named",
9596
UID: 4,
97+
ReqID: 5,
9698
State: "INSTALLED",
9799
Mode: "TUNNEL",
98100
Protocol: "AH",
@@ -119,6 +121,7 @@ func TestExporter(t *testing.T) {
119121
"named-5": {
120122
Name: "named",
121123
UID: 5,
124+
ReqID: 6,
122125
State: "INSTALLED",
123126
Mode: "TUNNEL",
124127
Protocol: "AH",

‎exporter/metrics.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ type ikeSA struct {
6666
type childSA struct {
6767
Name string `vici:"name"`
6868
UID uint32 `vici:"uniqueid"`
69+
ReqID uint32 `vici:"reqid"`
6970
State string `vici:"state"`
7071
Mode string `vici:"mode"`
7172
Protocol string `vici:"protocol"`

‎exporter/testdata/metrics-1.txt‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,32 +3,32 @@
33
ipsec_active_workers 10
44
# HELP ipsec_child_sa_bytes_in Number of input bytes processed.
55
# TYPE ipsec_child_sa_bytes_in gauge
6-
ipsec_child_sa_bytes_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="3"} 123
7-
ipsec_child_sa_bytes_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 124
8-
ipsec_child_sa_bytes_in{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="5"} 125
6+
ipsec_child_sa_bytes_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="4",uid="3"} 123
7+
ipsec_child_sa_bytes_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 124
8+
ipsec_child_sa_bytes_in{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="6",uid="5"} 125
99
# HELP ipsec_child_sa_bytes_out Number of output bytes processed.
1010
# TYPE ipsec_child_sa_bytes_out gauge
11-
ipsec_child_sa_bytes_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="3"} 789
12-
ipsec_child_sa_bytes_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 790
13-
ipsec_child_sa_bytes_out{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="5"} 791
11+
ipsec_child_sa_bytes_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="4",uid="3"} 789
12+
ipsec_child_sa_bytes_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 790
13+
ipsec_child_sa_bytes_out{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="6",uid="5"} 791
1414
# HELP ipsec_child_sa_installed_seconds Number of seconds since the child SA has been installed.
1515
# TYPE ipsec_child_sa_installed_seconds gauge
16-
ipsec_child_sa_installed_seconds{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 123
16+
ipsec_child_sa_installed_seconds{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 123
1717
# HELP ipsec_child_sa_packets_in Number of input packets processed.
1818
# TYPE ipsec_child_sa_packets_in gauge
19-
ipsec_child_sa_packets_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="3"} 456
20-
ipsec_child_sa_packets_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 457
21-
ipsec_child_sa_packets_in{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="5"} 458
19+
ipsec_child_sa_packets_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="4",uid="3"} 456
20+
ipsec_child_sa_packets_in{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 457
21+
ipsec_child_sa_packets_in{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="6",uid="5"} 458
2222
# HELP ipsec_child_sa_packets_out Number of output packets processed.
2323
# TYPE ipsec_child_sa_packets_out gauge
24-
ipsec_child_sa_packets_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="3"} 901
25-
ipsec_child_sa_packets_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 902
26-
ipsec_child_sa_packets_out{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="5"} 903
24+
ipsec_child_sa_packets_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="4",uid="3"} 901
25+
ipsec_child_sa_packets_out{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 902
26+
ipsec_child_sa_packets_out{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="6",uid="5"} 903
2727
# HELP ipsec_child_sa_state Child SA state.
2828
# TYPE ipsec_child_sa_state gauge
29-
ipsec_child_sa_state{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="3"} 3
30-
ipsec_child_sa_state{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="4"} 3
31-
ipsec_child_sa_state{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",uid="5"} 3
29+
ipsec_child_sa_state{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="4",uid="3"} 3
30+
ipsec_child_sa_state{ike_sa_name="named-1",ike_sa_uid="1",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="5",uid="4"} 3
31+
ipsec_child_sa_state{ike_sa_name="named-2",ike_sa_uid="2",local_ts="192.168.0.0/24, 192.168.1.0/24",mode="TUNNEL",name="named",protocol="AH",remote_ts="192.168.2.0/24, 192.168.3.0/24",reqid="6",uid="5"} 3
3232
# HELP ipsec_half_open_ike_sas Number of IKE SAs in half-open state.
3333
# TYPE ipsec_half_open_ike_sas gauge
3434
ipsec_half_open_ike_sas 5

‎exporter/testdata/metrics-2.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
# HELP ipsec_child_sa_bytes_in Number of input bytes processed.
22
# TYPE ipsec_child_sa_bytes_in gauge
3-
ipsec_child_sa_bytes_in{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",uid="1"} 64
3+
ipsec_child_sa_bytes_in{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",reqid="1",uid="1"} 64
44
# HELP ipsec_child_sa_bytes_out Number of output bytes processed.
55
# TYPE ipsec_child_sa_bytes_out gauge
6-
ipsec_child_sa_bytes_out{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",uid="1"} 64
6+
ipsec_child_sa_bytes_out{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",reqid="1",uid="1"} 64
77
# HELP ipsec_child_sa_packets_in Number of input packets processed.
88
# TYPE ipsec_child_sa_packets_in gauge
9-
ipsec_child_sa_packets_in{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",uid="1"} 1
9+
ipsec_child_sa_packets_in{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",reqid="1",uid="1"} 1
1010
# HELP ipsec_child_sa_packets_out Number of output packets processed.
1111
# TYPE ipsec_child_sa_packets_out gauge
12-
ipsec_child_sa_packets_out{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",uid="1"} 1
12+
ipsec_child_sa_packets_out{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",reqid="1",uid="1"} 1
1313
# HELP ipsec_child_sa_state Child SA state.
1414
# TYPE ipsec_child_sa_state gauge
15-
ipsec_child_sa_state{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",uid="1"} 3
15+
ipsec_child_sa_state{ike_sa_name="host-host",ike_sa_uid="1",local_ts="172.31.0.1/32",mode="TRANSPORT",name="host-host",protocol="AH",remote_ts="172.31.0.2/32",reqid="1",uid="1"} 3
1616
# HELP ipsec_half_open_ike_sas Number of IKE SAs in half-open state.
1717
# TYPE ipsec_half_open_ike_sas gauge
1818
ipsec_half_open_ike_sas 0

0 commit comments

Comments
 (0)