diff --git a/.github/workflows/e2e-test-event-writer.yml b/.github/workflows/e2e-test-event-writer.yml index 6184d463f8..df272b59b8 100644 --- a/.github/workflows/e2e-test-event-writer.yml +++ b/.github/workflows/e2e-test-event-writer.yml @@ -15,6 +15,8 @@ permissions: env: EVENT_WRITER_PATH: "${{ github.workspace }}/test/e2e/tools/event-writer/" + EBPF_VERSION: "1.1.0" + XDP_SDK_VERSION: "1.3.0" jobs: retina-win-e2e-bpf-images: @@ -33,3 +35,103 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Azure Login + uses: azure/login@v2 + if: ${{ env.IS_MERGE_GROUP == 'true' }} + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + + - name: Ensure Docker daemon is running + shell: pwsh + run: | + $timeout = 120 + $timer = [Diagnostics.Stopwatch]::StartNew() + while ($timer.Elapsed.TotalSeconds -lt $timeout) { + $svc = Get-Service docker -ErrorAction SilentlyContinue + if ($svc -and $svc.Status -ne 'Running') { + Start-Service docker -ErrorAction SilentlyContinue + } + $result = docker info 2>&1 + if ($LASTEXITCODE -eq 0) { + Write-Host "Docker daemon is ready" + return + } + Write-Host "Waiting for Docker daemon to start..." + Start-Sleep -Seconds 5 + } + throw "Docker daemon failed to start within $timeout seconds" + + - name: Docker Login to ghcr.io + uses: docker/login-action@v3 + if: ${{ env.IS_MERGE_GROUP != 'true' }} + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set MSBuild path + run: | + echo "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append + + - name: Install LLVM 18.1.8 + shell: pwsh + run: | + # Install LLVM 18.1.8 to ensure consistent version across runners + try { + choco install llvm --version=18.1.8 --allow-downgrade -y --force + # Add installed LLVM to PATH first so it takes precedence + echo "C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append + Write-Host "Successfully installed LLVM 18.1.8" + } catch { + Write-Warning "Failed to install LLVM 18.1.8 via chocolatey: $($_.Exception.Message)" + Write-Host "Continuing with pre-installed LLVM version" + } + + - name: Nuget Restore + shell: cmd + run: | + nuget restore .\event_writer.sln + working-directory: ${{ env.EVENT_WRITER_PATH }} + + - name: Configure eBPF store + shell: cmd + run: | + .\export_program_info.exe --clear + .\export_program_info.exe + working-directory: ${{ env.EVENT_WRITER_PATH }}\packages\eBPF-for-Windows.x64.${{ env.EBPF_VERSION }}\build\native\bin + + - name: Build Event-Writer + shell: cmd + run: | + msbuild /m /t:Clean /p:Configuration=Release /p:Platform=x64 /restore event_writer.sln + msbuild /m /p:Configuration=Release /p:Platform=x64 /restore /v:detailed event_writer.sln + working-directory: ${{ env.EVENT_WRITER_PATH }} + + - name: Determine Docker tag + id: tag + shell: pwsh + run: | + $TAG = $(git tag --points-at HEAD) + if (-not $TAG) { + $TAG = $(git rev-parse --short HEAD) + } + echo "tag=$TAG" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append + + - name: Build and push images + shell: pwsh + working-directory: ${{ env.EVENT_WRITER_PATH }} + run: | + $isMergeGroup = "${{ env.IS_MERGE_GROUP }}" -eq "true" + if (-not $isMergeGroup) { + $image = "ghcr.io/${{ github.repository }}/test/e2e-test-event-writer".ToLower() + } else { + $image = "${{ vars.ACR_NAME }}/${{ github.repository }}/test/e2e-test-event-writer".ToLower() + } + + $tag = "${{ steps.tag.outputs.tag }}" + docker build -f "./Dockerfile" -t "${image}:${tag}" -t "${image}:latest" . + docker push "${image}:${tag}" + docker push "${image}:latest" diff --git a/.github/workflows/images.yaml b/.github/workflows/images.yaml index f66a0fb6bd..78a972d605 100644 --- a/.github/workflows/images.yaml +++ b/.github/workflows/images.yaml @@ -2,7 +2,9 @@ name: Build Images on: pull_request: - branches: [main] + branches: + - main + - "dev/**" merge_group: types: [checks_requested] workflow_dispatch: @@ -18,6 +20,8 @@ concurrency: jobs: get-tag: name: Get Image Tag + retina-images: + name: Build Agent Images - Linux runs-on: ubuntu-latest timeout-minutes: 5 outputs: @@ -66,7 +70,7 @@ jobs: run: | set -euo pipefail echo "TAG=$(make version)" >> $GITHUB_ENV - if [ "$IS_MERGE_GROUP" == "true" ]; then + if [ "$SHOULD_PUSH_IMAGE" == "true" ]; then az acr login -n ${{ vars.ACR_NAME }} make retina-image \ IMAGE_NAMESPACE=${{ github.repository }} \ @@ -80,7 +84,7 @@ jobs: PLATFORM=${{ matrix.platform }}/${{ matrix.arch }} fi env: - IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }} + SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} build-windows-binaries: name: Build Windows Binaries @@ -165,7 +169,6 @@ jobs: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }} - - name: Build Images shell: bash run: | @@ -192,7 +195,7 @@ jobs: REPO_PATH=. fi env: - IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }} + SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} operator-images: name: Build Operator Images @@ -231,7 +234,7 @@ jobs: run: | set -euo pipefail echo "TAG=$(make version)" >> $GITHUB_ENV - if [ "$IS_MERGE_GROUP" == "true" ]; then + if [ "$SHOULD_PUSH_IMAGE" == "true" ]; then az acr login -n ${{ vars.ACR_NAME }} make retina-operator-image \ IMAGE_NAMESPACE=${{ github.repository }} \ @@ -245,7 +248,7 @@ jobs: PLATFORM=${{ matrix.platform }}/${{ matrix.arch }} fi env: - IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }} + SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} retina-shell-images: name: Build Retina Shell Images (${{ matrix.platform }}, ${{ matrix.arch }}) @@ -284,7 +287,7 @@ jobs: run: | set -euo pipefail echo "TAG=$(make version)" >> $GITHUB_ENV - if [ "$IS_MERGE_GROUP" == "true" ]; then + if [ "$SHOULD_PUSH_IMAGE" == "true" ]; then az acr login -n ${{ vars.ACR_NAME }} make retina-shell-image \ IMAGE_NAMESPACE=${{ github.repository }} \ @@ -297,7 +300,7 @@ jobs: PLATFORM=${{ matrix.platform }}/${{ matrix.arch }} fi env: - IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }} + SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} kubectl-retina-images: name: Build Kubectl Retina Images @@ -336,7 +339,7 @@ jobs: run: | set -euo pipefail echo "TAG=$(make version)" >> $GITHUB_ENV - if [ "$IS_MERGE_GROUP" == "true" ]; then + if [ "$SHOULD_PUSH_IMAGE" == "true" ]; then az acr login -n ${{ vars.ACR_NAME }} make kubectl-retina-image \ IMAGE_NAMESPACE=${{ github.repository }} \ @@ -349,11 +352,11 @@ jobs: PLATFORM=${{ matrix.platform }}/${{ matrix.arch }} fi env: - IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }} + SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} manifests: name: Generate Manifests - if: ${{ github.event_name == 'merge_group' }} + if: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} runs-on: ubuntu-latest timeout-minutes: 30 needs: @@ -393,7 +396,7 @@ jobs: e2e: name: Run E2E Tests - if: ${{ github.event_name == 'merge_group' }} + if: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }} needs: [manifests] runs-on: ubuntu-latest timeout-minutes: 90 @@ -457,7 +460,7 @@ jobs: azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} azure-app-insights-key: ${{ secrets.AZURE_APP_INSIGHTS_KEY }} - + perf-test-advanced: if: ${{ github.event_name == 'merge_group'}} needs: [manifests, get-tag, e2e] diff --git a/.github/workflows/release-images.yaml b/.github/workflows/release-images.yaml index 84848d3e45..4850a92630 100644 --- a/.github/workflows/release-images.yaml +++ b/.github/workflows/release-images.yaml @@ -66,6 +66,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 + strategy: + matrix: + platform: ["windows"] + arch: ["amd64"] + year: ["2022"] + steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/release-validation.yaml b/.github/workflows/release-validation.yaml index 4158a8dae0..13a805981c 100644 --- a/.github/workflows/release-validation.yaml +++ b/.github/workflows/release-validation.yaml @@ -47,23 +47,6 @@ jobs: - name: Setup kind cluster uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 - # krew does not support installing a specific verison - # so if this step fails it means there was something wrong - # with the krew index update as part of the release - - name: Test krew install retina - run: | - ( - set -x; cd "$(mktemp -d)" && - OS="$(uname | tr '[:upper:]' '[:lower:]')" && - ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" && - KREW="krew-${OS}_${ARCH}" && - curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" && - tar zxvf "${KREW}.tar.gz" && - ./"${KREW}" install krew - export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH" - kubectl krew install retina - ) - - name: Check Go package version run: | TAG=${{ env.TAG }} diff --git a/Makefile b/Makefile index 190157f7fe..909c6552cd 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ .DEFAULT_GOAL := help -# Default platform commands +# Default platform commands RMDIR := rm -rf ## Globals @@ -361,6 +361,20 @@ kubectl-retina-shell-image: TARGET=shell-target \ EXTRA_BUILD_ARGS=$(EXTRA_BUILD_ARGS) +kubectl-retina-shell-image: + echo "Building shell-enabled kubectl-retina for $(PLATFORM)" + set -e ; \ + $(MAKE) container-$(CONTAINER_BUILDER) \ + PLATFORM=$(PLATFORM) \ + DOCKERFILE=cli/Dockerfile \ + REGISTRY=$(IMAGE_REGISTRY) \ + IMAGE=$(KUBECTL_RETINA_SHELL_IMAGE) \ + VERSION=$(TAG) \ + TAG=$(RETINA_PLATFORM_TAG) \ + CONTEXT_DIR=$(REPO_ROOT) \ + TARGET=shell-target \ + EXTRA_BUILD_ARGS=$(EXTRA_BUILD_ARGS) + kapinger-image: docker buildx build --builder retina --platform windows/amd64 --target windows-amd64 -t $(IMAGE_REGISTRY)/$(KAPINGER_IMAGE):$(TAG)-windows-amd64 ./hack/tools/kapinger/ --push docker buildx build --builder retina --platform linux/amd64 --target linux-amd64 -t $(IMAGE_REGISTRY)/$(KAPINGER_IMAGE):$(TAG)-linux-amd64 ./hack/tools/kapinger/ --push diff --git a/cli/Dockerfile b/cli/Dockerfile index 212c1b0cf9..7df57b03b6 100644 --- a/cli/Dockerfile +++ b/cli/Dockerfile @@ -44,6 +44,7 @@ WORKDIR / COPY --from=builder /workspace/kubectl-retina . # Target 2: Shell-enabled (operational, init container support) + # skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}" # Final image must be $TARGETPLATFORM (default), not $BUILDPLATFORM — the # kubectl-retina binary is cross-compiled for the target arch and would fail diff --git a/cli/cmd/capture/download_test.go b/cli/cmd/capture/download_test.go index 77e3ffcad4..6a24de65b7 100644 --- a/cli/cmd/capture/download_test.go +++ b/cli/cmd/capture/download_test.go @@ -945,7 +945,6 @@ func resetDownloadGlobals(t *testing.T) { func TestDownloadAllCapturesGracefulErrorHandling(t *testing.T) { resetDownloadGlobals(t) - // Test the graceful error handling by testing individual components // that are used in downloadAllCaptures diff --git a/controller/Dockerfile b/controller/Dockerfile index 432b30d5db..e9f4b76b83 100644 --- a/controller/Dockerfile +++ b/controller/Dockerfile @@ -8,10 +8,22 @@ FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang:1.26.5-2-azurelinux3.0@sha256:1c77c1cbb5de52db3f119fe2efe7a938e734c08196bbe3ad94b3bdadbab926f9 AS golang # skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}" +<<<<<<< HEAD FROM mcr.microsoft.com/azurelinux/base/core:3.0.20260711@sha256:4d0522bb656cfe2bc567c254bb87c2b086a002db6cba51f71870eb5c6630195c AS azurelinux-core +# skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2019 --override-os windows --format "{{.Name}}@{{.Digest}}" +FROM mcr.microsoft.com/windows/servercore@sha256:cd96c9b4873aba2f63716934ed5e535ec21c8d3dc32d29d9bc778be28f19cbfa AS ltsc2019 + +# skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}" +FROM mcr.microsoft.com/windows/servercore@sha256:86da395cfd2b35dbfc2e9d08719550c51b0570c394bff8f92622a19234766185 AS ltsc2022 # skopeo inspect docker://mcr.microsoft.com/azurelinux/distroless/minimal:3.0 --format "{{.Name}}@{{.Digest}}" FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0.20260706@sha256:576d9769c0146cbf0cf7946bacf536c5758464c29eadfa03ef5090ae708e641f AS azurelinux-distroless +======= +FROM mcr.microsoft.com/azurelinux/base/core:3.0@sha256:35149ae8dd179684f969944f54a337c665a64e702486154eb44253fb39c2505b AS azurelinux-core + +# skopeo inspect docker://mcr.microsoft.com/azurelinux/distroless/minimal:3.0 --format "{{.Name}}@{{.Digest}}" +FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0@sha256:5a66f9f16ac675db2a8229dac72d83811b73b502d6ad192d8b374c7f3be498af AS azurelinux-distroless +>>>>>>> dc127f0e (Laksh/cherry pick specific (#2425)) # build stages @@ -50,6 +62,10 @@ ARG GOARCH=amd64 # default to amd64 ARG GOOS=linux # default to linux ENV GOARCH=${GOARCH} ENV GOOS=${GOOS} +RUN if [ "$GOOS" = "linux" ] ; then \ + tdnf install -y clang lld bpftool libbpf-devel; \ + fi +COPY ./pkg/plugin /go/src/github.com/microsoft/retina/pkg/plugin WORKDIR /go/src/github.com/microsoft/retina # eBPF .o files were built in the bpf-gen stage (at $TARGETPLATFORM). Import # the tarball here and extract after `COPY . .` so bpf-gen's outputs replace @@ -62,6 +78,7 @@ RUN if [ "$GOOS" = "linux" ] ; then \ rm -rf ./pkg/plugin && tar xvf /gen.tar.gz ./pkg/plugin; \ fi + # capture binary FROM intermediate AS capture-bin ARG APP_INSIGHTS_ID # set to enable AI telemetry @@ -80,7 +97,7 @@ ARG GOOS=linux # default to linux ARG VERSION ENV GOARCH=${GOARCH} ENV GOOS=${GOOS} -RUN --mount=type=cache,target="/root/.cache/go-build" go build -x -v -o /go/bin/retina/controller -ldflags "-X github.com/microsoft/retina/internal/buildinfo.Version="$VERSION" -X github.com/microsoft/retina/internal/buildinfo.ApplicationInsightsID="$APP_INSIGHTS_ID"" controller/main.go +RUN --mount=type=cache,target="/root/.cache/go-build" go build -x -v -o /go/bin/retina/controller -ldflags "-X github.com/microsoft/retina/internal/buildinfo.Version="$VERSION" -X github.com/microsoft/retina/internal/buildinfo.ApplicationInsightsID="$APP_INSIGHTS_ID"" controller/main.go # init binary FROM intermediate AS init-bin @@ -149,4 +166,16 @@ COPY --from=capture-bin /go/bin/retina/captureworkload /retina/captureworkload COPY --from=tools /usr/local/hubble /bin/hubble # Set Hubble server. ENV HUBBLE_SERVER=unix:///var/run/cilium/hubble.sock -ENTRYPOINT ["./retina/controller"] \ No newline at end of file +ENTRYPOINT ["./retina/controller"] +<<<<<<< HEAD + +# agent final image for windows +FROM ${OS_VERSION} AS agent-win +COPY --from=controller-bin /go/src/github.com/microsoft/retina/windows/kubeconfigtemplate.yaml kubeconfigtemplate.yaml +COPY --from=controller-bin /go/src/github.com/microsoft/retina/windows/setkubeconfigpath.ps1 setkubeconfigpath.ps1 +COPY --from=controller-bin /go/bin/retina/controller controller.exe +COPY --from=capture-bin /go/bin/retina/captureworkload captureworkload.exe +ADD https://github.com/microsoft/etl2pcapng/releases/download/v1.10.0/etl2pcapng.exe /etl2pcapng.exe +CMD ["controller.exe", "start", "--kubeconfig=.\\kubeconfig"] +======= +>>>>>>> dc127f0e (Laksh/cherry pick specific (#2425)) diff --git a/controller/Dockerfile.windows-2022 b/controller/Dockerfile.windows-2022 index edda345041..e2db403f82 100644 --- a/controller/Dockerfile.windows-2022 +++ b/controller/Dockerfile.windows-2022 @@ -1,5 +1,6 @@ # pinned base image # skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}" + FROM mcr.microsoft.com/windows/servercore:ltsc2022@sha256:b841bb042e13a079f68fc82461f15abcefe8063fb9a3072120348252f13a6ce3 AS ltsc2022 FROM ltsc2022 AS agent-win diff --git a/controller/Dockerfile.windows-native b/controller/Dockerfile.windows-native index 20ad8522f9..159263f149 100644 --- a/controller/Dockerfile.windows-native +++ b/controller/Dockerfile.windows-native @@ -23,8 +23,17 @@ RUN go build -v -o captureworkload.exe -ldflags="-X github.com/microsoft/retina/ FROM --platform=windows/amd64 ${BUILDER_IMAGE} as pktmon-builder WORKDIR C:\\retina -# skopeo inspect docker://mcr.microsoft.com/windows/nanoserver:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}" + skopeo inspect docker://mcr.microsoft.com/windows/nanoserver:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}" FROM --platform=windows/amd64 mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:93efcae2cbb2f9f0d26481035ad00c807f877c7a4d3aa59c9b26342d30d60592 AS final +FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:5341a0010ecff114ee2f11f5eaa4f73b721b54142954041523f3e785d5c4b978 AS golang +FROM golang AS eBPFRetinaStage +WORKDIR /tmp +RUN tdnf install -y unzip && \ + curl -L -o eBPFRetina.zip https://www.nuget.org/api/v2/package/Microsoft.Wcn.Observability.eBPF.Retina.x64/0.1.0-prerelease.11 && \ + unzip -d eBPFRetina eBPFRetina.zip || exit 0 && \ + if [ ! -d "eBPFRetina" ]; then echo "eBPFRetina directory not found after unzip!" && exit 1; fi + +FROM --platform=windows/amd64 mcr.microsoft.com/windows/nanoserver:ltsc2022 AS final ADD https://github.com/microsoft/etl2pcapng/releases/download/v1.10.0/etl2pcapng.exe /etl2pcapng.exe SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'Continue';"] COPY --from=builder C:\\retina\\windows\\kubeconfigtemplate.yaml kubeconfigtemplate.yaml @@ -32,4 +41,4 @@ COPY --from=builder C:\\retina\\windows\\setkubeconfigpath.ps1 setkubeconfigpath COPY --from=builder C:\\retina\\controller.exe controller.exe COPY --from=pktmon-builder C:\\pktmon\\controller-pktmon.exe controller-pktmon.exe COPY --from=builder C:\\retina\\captureworkload.exe captureworkload.exe -CMD ["controller.exe"] +CMD ["controller.exe"] \ No newline at end of file diff --git a/controller/Dockerfile.windows-retina-oss-build b/controller/Dockerfile.windows-retina-oss-build index 521e77fdb4..5cc8c8ec10 100644 --- a/controller/Dockerfile.windows-retina-oss-build +++ b/controller/Dockerfile.windows-retina-oss-build @@ -2,6 +2,13 @@ ARG OS_VERSION=ltsc2022 # pinned base images + +# mcr.microsoft.com/windows/servercore:ltsc2019 +FROM mcr.microsoft.com/windows/servercore@sha256:cd96c9b4873aba2f63716934ed5e535ec21c8d3dc32d29d9bc778be28f19cbfa AS ltsc2019 + +# mcr.microsoft.com/windows/servercore:ltsc2022 +FROM mcr.microsoft.com/windows/servercore@sha256:86da395cfd2b35dbfc2e9d08719550c51b0570c394bff8f92622a19234766185 AS ltsc2022 + # skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}" FROM mcr.microsoft.com/windows/servercore:ltsc2022@sha256:b841bb042e13a079f68fc82461f15abcefe8063fb9a3072120348252f13a6ce3 AS ltsc2022 diff --git a/deploy/standard/manifests/controller/helm/retina/templates/configmap.yaml b/deploy/standard/manifests/controller/helm/retina/templates/configmap.yaml index a421ce07a9..843b0faabb 100644 --- a/deploy/standard/manifests/controller/helm/retina/templates/configmap.yaml +++ b/deploy/standard/manifests/controller/helm/retina/templates/configmap.yaml @@ -53,9 +53,9 @@ data: metricsInterval: {{ .Values.metricsInterval }} metricsIntervalDuration: {{ .Values.metricsIntervalDuration }} enableTelemetry: {{ .Values.enableTelemetry }} + enableAnnotations: {{ .Values.enableAnnotations }} enablePodLevel: {{ .Values.enablePodLevel }} remoteContext: {{ .Values.remoteContext }} - enableAnnotations: {{ .Values.enableAnnotations }} telemetryInterval: {{ .Values.daemonset.telemetryInterval }} {{- end}} diff --git a/deploy/standard/manifests/controller/helm/retina/values.yaml b/deploy/standard/manifests/controller/helm/retina/values.yaml index 9ae88d8d75..86647ecb89 100644 --- a/deploy/standard/manifests/controller/helm/retina/values.yaml +++ b/deploy/standard/manifests/controller/helm/retina/values.yaml @@ -52,9 +52,9 @@ image: enableConntrackMetrics: false conntrackReportInterval: 30s -enablePodLevel: false +enablePodLevel: true remoteContext: false -enableAnnotations: false +enableAnnotations: true bypassLookupIPOfInterest: false dataAggregationLevel: "low" dataSamplingRate: 1 @@ -96,7 +96,7 @@ apiServer: logLevel: debug enabledPlugin_linux: '["dropreason","packetforward","linuxutil","dns"]' -enabledPlugin_win: '["hnsstats"]' +enabledPlugin_win: '["hnsstats", "ebpfwindows"]' enableTelemetry: false @@ -312,7 +312,7 @@ metrics: tlsConfig: {} ## @param metrics.serviceMonitor.relabelings [array] Prometheus relabeling rules to apply to samples before scraping ## - relabelings: + relabelings: - sourceLabels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] separator: ":" diff --git a/go.mod b/go.mod index b3c582030c..98d12743e6 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,6 @@ module github.com/microsoft/retina + go 1.26.0 require ( diff --git a/pkg/plugin/common/common_windows.go b/pkg/plugin/common/common_windows.go new file mode 100644 index 0000000000..151f7fb792 --- /dev/null +++ b/pkg/plugin/common/common_windows.go @@ -0,0 +1,40 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT license. + +// package common contains common functions and types used by all Retina Windows plugins. +package common + +import ( + "golang.org/x/sys/windows/registry" +) + +const ( + // KeyPath is the registry key path where the CiliumOnWindows value is stored. + // This key is used to determine if Cilium is enabled on Windows. + KeyPath = `SYSTEM\CurrentControlSet\Services\hns\State` + // CiliumOnWindows is the registry value name that indicates if Cilium is enabled on Windows. + // If this value is set to 1, Cilium is enabled on Windows. If this value is not set or set to 0, Cilium is not enabled. + ValueName = "CiliumOnWindows" +) + +// IsCiliumOnWindowsEnabled checks if the CiliumOnWindows registry value is set to 1. +// Returns (true, nil) if set to 1, (false, nil) if not set or not exist, (false, err) for other errors. +func IsCiliumOnWindowsEnabled() (bool, error) { + k, err := registry.OpenKey(registry.LOCAL_MACHINE, KeyPath, registry.QUERY_VALUE) + if err != nil { + if err == registry.ErrNotExist { + return false, nil + } + return false, err + } + defer k.Close() + + val, _, err := k.GetIntegerValue(ValueName) + if err != nil { + if err == registry.ErrNotExist { + return false, nil + } + return false, err + } + return val == 1, nil +} diff --git a/pkg/plugin/ebpfwindows/datapath_drop_windows.go b/pkg/plugin/ebpfwindows/datapath_drop_windows.go new file mode 100644 index 0000000000..a98fccbe21 --- /dev/null +++ b/pkg/plugin/ebpfwindows/datapath_drop_windows.go @@ -0,0 +1,195 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright Authors of Cilium + +package ebpfwindows + +import ( + "errors" + "fmt" + + "github.com/cilium/cilium/pkg/byteorder" + "github.com/cilium/cilium/pkg/identity" +) + +const ( + DropNotifyVersion0 = iota + DropNotifyVersion1 + DropNotifyVersion2 +) + +const ( + // dropNotifyV1Len is the amount of packet data provided in a v0/v1 drop notification. + dropNotifyV1Len = 36 + dropPktmonNotifyV1Len = 57 +) + +var dropNotifyLengthFromVersion = map[uint16]uint{ + DropNotifyVersion0: dropNotifyV1Len, // retain backwards compatibility for testing. + DropNotifyVersion1: dropNotifyV1Len, +} + +var pktmonDropNotifyLengthFromVersion = map[uint16]uint{ + DropNotifyVersion1: dropPktmonNotifyV1Len, +} + +var ( + errUnexpectedDropNotifyLength = errors.New("unexpected DropNotify data length") + errInvalidDropNotifyVersion = errors.New("invalid DropNotify version") + errInvalidPktmonDropNotifyVersion = errors.New("invalid Pktmon DropNotify version") +) + +// DropNotify is the message format of a drop notification in the BPF ring buffer +type DropNotify struct { + Type uint8 + SubType uint8 + Source uint16 + Hash uint32 + OrigLen uint32 + CapLen uint16 + Version uint16 + SrcLabel identity.NumericIdentity + DstLabel identity.NumericIdentity + DstID uint32 + Line uint16 + File uint8 + ExtError int8 + Ifindex uint32 +} + +type NetEventDataHeader struct { + Type uint8 + Version uint16 +} + +type PktmonEvtStreamPacketDescriptor struct { + PacketOriginalLength uint32 + PacketLoggedLength uint32 + PacketMetadataLength uint32 +} + +type PktmonEvtStreamMetadata struct { + PktGroupID uint64 + PktCount uint16 + AppearanceCount uint16 + DirectionName uint16 + PacketType uint16 + ComponentID uint16 + EdgeID uint16 + FilterID uint16 + DropReason uint32 + DropLocation uint32 + ProcNum uint16 + Timestamp uint64 +} + +type PktmonEvtStreamPacketHeader struct { + EventID uint8 + PacketDescriptor PktmonEvtStreamPacketDescriptor + Metadata PktmonEvtStreamMetadata +} + +type PktmonDropNotify struct { + VersionHeader NetEventDataHeader + PktmonHeader PktmonEvtStreamPacketHeader +} + +// DecodePktmonDrop will decode 'data' into the provided DropNotify structure +func DecodePktmonDrop(data []byte, pdn *PktmonDropNotify) error { + if err := pdn.decodePktmonDrop(data); err != nil { + return err + } + return nil +} + +// DataOffset returns the offset from the beginning of PktmonDropNotify where the +// notification data begins. +func (n *PktmonDropNotify) DataOffset() uint { + return pktmonDropNotifyLengthFromVersion[n.VersionHeader.Version] +} + +func (n *PktmonDropNotify) decodePktmonDrop(data []byte) error { + if l := len(data); l < dropPktmonNotifyV1Len { + return fmt.Errorf("%w: expected at least %d but got %d", errUnexpectedDropNotifyLength, dropPktmonNotifyV1Len, l) + } + version := byteorder.Native.Uint16(data[2:4]) + + // Check against max version. + if version > DropNotifyVersion1 { + return fmt.Errorf("%w: Unrecognized drop event version %d", errInvalidPktmonDropNotifyVersion, version) + } + + // Decode logic for version = v1. + n.VersionHeader.Type = data[0] + n.VersionHeader.Version = version + n.PktmonHeader.EventID = data[4] + n.PktmonHeader.PacketDescriptor.PacketOriginalLength = byteorder.Native.Uint32(data[5:9]) + n.PktmonHeader.PacketDescriptor.PacketLoggedLength = byteorder.Native.Uint32(data[9:13]) + n.PktmonHeader.PacketDescriptor.PacketMetadataLength = byteorder.Native.Uint32(data[13:17]) + n.PktmonHeader.Metadata.PktGroupID = byteorder.Native.Uint64(data[17:25]) + n.PktmonHeader.Metadata.PktCount = byteorder.Native.Uint16(data[25:27]) + n.PktmonHeader.Metadata.AppearanceCount = byteorder.Native.Uint16(data[27:29]) + n.PktmonHeader.Metadata.DirectionName = byteorder.Native.Uint16(data[29:31]) + n.PktmonHeader.Metadata.PacketType = byteorder.Native.Uint16(data[31:33]) + n.PktmonHeader.Metadata.ComponentID = byteorder.Native.Uint16(data[33:35]) + n.PktmonHeader.Metadata.EdgeID = byteorder.Native.Uint16(data[35:37]) + n.PktmonHeader.Metadata.FilterID = byteorder.Native.Uint16(data[37:39]) + n.PktmonHeader.Metadata.DropReason = byteorder.Native.Uint32(data[39:43]) + n.PktmonHeader.Metadata.DropLocation = byteorder.Native.Uint32(data[43:47]) + n.PktmonHeader.Metadata.ProcNum = byteorder.Native.Uint16(data[47:49]) + n.PktmonHeader.Metadata.Timestamp = byteorder.Native.Uint64(data[49:57]) + return nil +} + +// DecodeDropNotify will decode 'data' into the provided DropNotify structure +func DecodeDropNotify(data []byte, dn *DropNotify) error { + return dn.decodeDropNotify(data) +} + +func (n *DropNotify) decodeDropNotify(data []byte) error { + if l := len(data); l < dropNotifyV1Len { + return fmt.Errorf("%w: expected at least %d but got %d", errUnexpectedDropNotifyLength, dropNotifyV1Len, l) + } + + version := byteorder.Native.Uint16(data[14:16]) + + // Check against max version. + if version > DropNotifyVersion1 { + return fmt.Errorf("%w: Unrecognized drop event version %d", errInvalidDropNotifyVersion, version) + } + + // Decode logic for version >= v0/v1. + n.Type = data[0] + n.SubType = data[1] + n.Source = byteorder.Native.Uint16(data[2:4]) + n.Hash = byteorder.Native.Uint32(data[4:8]) + n.OrigLen = byteorder.Native.Uint32(data[8:12]) + n.CapLen = byteorder.Native.Uint16(data[12:14]) + n.Version = version + n.SrcLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[16:20])) + n.DstLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[20:24])) + n.DstID = byteorder.Native.Uint32(data[24:28]) + n.Line = byteorder.Native.Uint16(data[28:30]) + n.File = data[30] + n.ExtError = int8(data[31]) + n.Ifindex = byteorder.Native.Uint32(data[32:36]) + + return nil +} + +// IsL3Device returns true if the trace comes from an L3 device. +func (n *DropNotify) IsL3Device() bool { + return false +} + +// IsIPv6 returns true if the trace refers to an IPv6 packet. +func (n *DropNotify) IsIPv6() bool { + return false +} + +// DataOffset returns the offset from the beginning of DropNotify where the +// notification data begins. +// +// Returns zero for invalid or unknown DropNotify messages. +func (n *DropNotify) DataOffset() uint { + return dropNotifyLengthFromVersion[n.Version] +} diff --git a/pkg/plugin/ebpfwindows/datapath_trace_windows.go b/pkg/plugin/ebpfwindows/datapath_trace_windows.go new file mode 100644 index 0000000000..05847be72d --- /dev/null +++ b/pkg/plugin/ebpfwindows/datapath_trace_windows.go @@ -0,0 +1,190 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright Authors of Cilium + +package ebpfwindows + +import ( + "errors" + "fmt" + "net" + + "github.com/cilium/cilium/pkg/byteorder" + "github.com/cilium/cilium/pkg/identity" + "github.com/cilium/cilium/pkg/types" +) + +const ( + // traceNotifyV0Len is the amount of packet data provided in a trace notification v0. + traceNotifyV0Len = 32 + // traceNotifyV1Len is the amount of packet data provided in a trace notification v1. + traceNotifyV1Len = 48 +) + +const ( + // TraceNotifyFlagIsIPv6 is set in TraceNotify.Flags when the + // notification refers to an IPv6 flow + TraceNotifyFlagIsIPv6 uint8 = 1 << iota + // TraceNotifyFlagIsL3Device is set in TraceNotify.Flags when the + // notification refers to a L3 device. + TraceNotifyFlagIsL3Device +) + +const ( + TraceNotifyVersion0 = iota + TraceNotifyVersion1 +) + +var ( + errTraceNotifyLength = errors.New("unexpected TraceNotify data length") + errUnrecognizedTraceEvent = errors.New("unrecognized trace event") +) + +// TraceNotify is the message format of a trace notification in the BPF ring buffer +type TraceNotify struct { + Type uint8 + ObsPoint uint8 + Source uint16 + Hash uint32 + OrigLen uint32 + CapLen uint16 + Version uint16 + SrcLabel identity.NumericIdentity + DstLabel identity.NumericIdentity + DstID uint16 + Reason uint8 + Flags uint8 + Ifindex uint32 + OrigIP types.IPv6 + // data +} + +// decodeTraceNotify decodes the trace notify message in 'data' into the struct. +func (tn *TraceNotify) decodeTraceNotify(data []byte) error { + if l := len(data); l < traceNotifyV0Len { + return fmt.Errorf("%w: expected at least %d but got %d", errTraceNotifyLength, traceNotifyV0Len, l) + } + + version := byteorder.Native.Uint16(data[14:16]) + + // Check against max version. + if version > TraceNotifyVersion1 { + return fmt.Errorf("%w: version %d", errUnrecognizedTraceEvent, version) + } + + // Decode logic for version >= v1. + if version >= TraceNotifyVersion1 { + if l := len(data); l < traceNotifyV1Len { + return fmt.Errorf("%w (version %d): expected at least %d but got %d", errTraceNotifyLength, version, traceNotifyV1Len, l) + } + copy(tn.OrigIP[:], data[32:48]) + } + + // Decode logic for version >= v0. + tn.Type = data[0] + tn.ObsPoint = data[1] + tn.Source = byteorder.Native.Uint16(data[2:4]) + tn.Hash = byteorder.Native.Uint32(data[4:8]) + tn.OrigLen = byteorder.Native.Uint32(data[8:12]) + tn.CapLen = byteorder.Native.Uint16(data[12:14]) + tn.Version = version + tn.SrcLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[16:20])) + tn.DstLabel = identity.NumericIdentity(byteorder.Native.Uint32(data[20:24])) + tn.DstID = byteorder.Native.Uint16(data[24:26]) + tn.Reason = data[26] + tn.Flags = data[27] + tn.Ifindex = byteorder.Native.Uint32(data[28:32]) + + return nil +} + +// IsEncrypted returns true when the notification has the encrypt flag set, +// false otherwise. +func (tn *TraceNotify) IsEncrypted() bool { + return (tn.Reason & TraceReasonEncryptMask) != 0 +} + +// TraceReason returns the trace reason for this notification, see the +// TraceReason* constants. +func (tn *TraceNotify) TraceReason() uint8 { + return tn.Reason & ^TraceReasonEncryptMask +} + +// TraceReasonIsKnown returns false when the trace reason is unknown, true +// otherwise. +func (tn *TraceNotify) TraceReasonIsKnown() bool { + return tn.TraceReason() != TraceReasonUnknown +} + +// TraceReasonIsReply returns true when the trace reason is TraceReasonCtReply, +// false otherwise. +func (tn *TraceNotify) TraceReasonIsReply() bool { + return tn.TraceReason() == TraceReasonCtReply +} + +// TraceReasonIsEncap returns true when the trace reason is encapsulation +// related, false otherwise. +func (tn *TraceNotify) TraceReasonIsEncap() bool { + switch tn.TraceReason() { + case TraceReasonSRv6Encap, TraceReasonEncryptOverlay: + return true + } + return false +} + +// TraceReasonIsDecap returns true when the trace reason is decapsulation +// related, false otherwise. +func (tn *TraceNotify) TraceReasonIsDecap() bool { + return tn.TraceReason() == TraceReasonSRv6Decap +} + +var traceNotifyLength = map[uint16]uint{ + TraceNotifyVersion0: traceNotifyV0Len, + TraceNotifyVersion1: traceNotifyV1Len, +} + +/* Reasons for forwarding a packet, keep in sync with api/v1/flow/flow.proto */ +const ( + TraceReasonPolicy = iota + TraceReasonCtEstablished + TraceReasonCtReply + TraceReasonCtRelated + TraceReasonCtDeprecatedReopened + TraceReasonUnknown + TraceReasonSRv6Encap + TraceReasonSRv6Decap + TraceReasonEncryptOverlay + // TraceReasonEncryptMask is the bit used to indicate encryption or not. + TraceReasonEncryptMask = uint8(0x80) +) + +// DecodeTraceNotify will decode 'data' into the provided TraceNotify structure +func DecodeTraceNotify(data []byte, tn *TraceNotify) error { + return tn.decodeTraceNotify(data) +} + +// IsL3Device returns true if the trace comes from an L3 device. +func (tn *TraceNotify) IsL3Device() bool { + return tn.Flags&TraceNotifyFlagIsL3Device != 0 +} + +// IsIPv6 returns true if the trace refers to an IPv6 packet. +func (tn *TraceNotify) IsIPv6() bool { + return tn.Flags&TraceNotifyFlagIsIPv6 != 0 +} + +// OriginalIP returns the original source IP if reverse NAT was performed on +// the flow +func (tn *TraceNotify) OriginalIP() net.IP { + if tn.IsIPv6() { + return tn.OrigIP[:] + } + return tn.OrigIP[:4] +} + +// DataOffset returns the offset from the beginning of TraceNotify where the +// trace notify data begins. +// +// Returns zero for invalid or unknown TraceNotify messages. +func (tn *TraceNotify) DataOffset() uint { + return traceNotifyLength[tn.Version] +} diff --git a/pkg/plugin/ebpfwindows/dropreasons_windows.go b/pkg/plugin/ebpfwindows/dropreasons_windows.go new file mode 100644 index 0000000000..e715b2c196 --- /dev/null +++ b/pkg/plugin/ebpfwindows/dropreasons_windows.go @@ -0,0 +1,164 @@ +package ebpfwindows + +import ( + "fmt" + + metrics "github.com/microsoft/retina/pkg/metrics" +) + +// DropMin numbers less than this are non-drop reason codes +var DropMin uint8 = 130 + +// DropInvalid is the Invalid packet reason. +var DropInvalid uint8 = 2 + +// Packet Monitor drop reason +var DropPacketMonitor uint8 = 220 + +// These values are shared with bpf/lib/common.h and api/v1/flow/flow.proto. +var dropErrors = map[uint8]string{ + 0: "Reason_Success", + 2: "Reason_InvalidPacket", + 3: "Reason_PlainText", + 4: "Reason_InterfaceDecrypted", + 5: "Reason_LbNoBackendSlot", + 6: "Reason_LbNoBackend", + 7: "Reason_LbReverseNatUpdate", + 8: "Resaon_LbReverseNatStale", + 9: "Reason_FragmentedPacket", + 10: "Reason_FragmentedPacketUpdated", + 11: "Reason_MissedCustomCall", + 132: "DropReason_InvalidSIP", + 133: "DropReason_Policy", + 134: "DropReason_Invalid", + 135: "DropReason_CTInvalidHdr", + 136: "DropReason_FragNeeded", + 137: "DropReason_CTUnknownProto", + 138: "DropReason_UnknownL3", + 139: "DropReason_MissedTailCall", + 140: "DropReason_WriteError", + 141: "DropReason_UnknownL4", + 142: "DropReason_UnknownICMPCode", + 143: "DropReason_UnknownICMPType", + 144: "DropReason_UnknownICMP6Code", + 145: "DropReason_UnknownICMP6Type", + 146: "DropReason_UnknownICMP6Type", + 147: "DropReason_NoTunnelKey", + 148: "DropReason_Unknown", + 149: "DropReason_Unknown", + 150: "DropReason_UnknownTarget", + 151: "DropReason_Unroutable", + 152: "DropReason_Unknown", + 153: "DropReason_CSUM_L3", + 154: "DropReason_CSUM_L4", + 155: "DropReason_CTCreateFailed", + 156: "DropReason_InvalidExthdr", + 157: "DropReason_FragNoSupport", + 158: "DropReason_NoService", + 159: "DropReason_UnsuppServiceProto", + 160: "DropReason_NoTunnelEndpoint", + 161: "DropReason_NAT46X64Disabled", + 162: "DropReason_EDTHorizon", + 163: "DropReason_UnknownCT", + 164: "DropReason_HostUnreachable", + 165: "DropReason_NoConfig", + 166: "DropReason_UnsupportedL2", + 167: "DropReason_NatNoMapping", + 168: "DropReason_NatUnsuppProto", + 169: "DropReason_NoFIB", + 170: "DropReason_EncapProhibited", + 171: "DropReason_InvalidIdentity", + 172: "DropReason_UnknownSender", + 173: "DropReason_NatNotNeeded", + 174: "DropReason_IsClusterIP", + 175: "DropReason_FragNotFound", + 176: "DropReason_ForbiddenICMP6", + 177: "DropReason_NotInSrcRange", + 178: "DropReason_ProxyLookupFailed", + 179: "DropReason_ProxySetFailed", + 180: "DropReason_ProxyUnknownProto", + 181: "DropReason_PolicyDeny", + 182: "DropReason_VlanFiltered", + 183: "DropReason_InvalidVNI", + 184: "DropReason_InvalidTCBuffer", + 185: "DropReason_NoSID", + 186: "DropReason_MissingSRv6State", + 187: "DropReason_NAT46", + 188: "DropReason_NAT64", + 189: "DropReason_PolicyAuthRequired", + 190: "DropReason_CTNoMapFound", + 191: "DropReason_SNATNoMapFound", + 192: "DropReason_InvalidClusterID", + 193: "DropReason_DSR_ENCAP_UNSUPP_PROTO", + 194: "DropReason_NoEgressGateway", + 195: "DropReason_UnencryptedTraffic", + 196: "DropReason_TTLExceeded", + 197: "DropReason_NoNodeID", + 198: "DropReason_RateLimited", + 199: "DropReason_IGMPHandled", + 200: "DropReason_IGMPSubscribed", + 201: "DropReason_MulticastHandled", + 202: "DropReason_HostNotReady", + 203: "DropReason_EpNotReady", + 220: "DropReason_PacketMonitor", +} + +// Keep in sync with __id_for_file in bpf/lib/source_info.h. +var files = map[uint8]string{ + // source files from bpf/ + 1: "bpf_host.c", + 2: "bpf_lxc.c", + 3: "bpf_overlay.c", + 4: "bpf_xdp.c", + 5: "bpf_sock.c", + 6: "bpf_network.c", + + // header files from bpf/lib/ + 101: "arp.h", + 102: "drop.h", + 103: "srv6.h", + 104: "icmp6.h", + 105: "nodeport.h", + 106: "lb.h", + 107: "mcast.h", + 108: "ipv4.h", + 109: "conntrack.h", + 110: "l3.h", + 111: "trace.h", + 112: "encap.h", + 113: "encrypt.h", +} + +// BPFFileName returns the file name for the given BPF file id. +func BPFFileName(id uint8) string { + if name, ok := files[id]; ok { + return name + } + return fmt.Sprintf("unknown(%d)", id) +} + +func extendedReason(extError uint32) string { + if extError == 0 { + return "" + } + + // Check if the extended error is a known drop reason + dropReason := metrics.GetDropReason(extError) + return dropReason.String() +} + +func DropReasonExt(reason uint8, extError uint32) string { + var ext string + if err, ok := dropErrors[reason]; ok { + if ext = extendedReason(extError); ext == "" { + return err + } + return err + ", " + ext + } + return fmt.Sprintf("%d, %d", reason, extError) +} + +// DropReason prints the drop reason in a human readable string +func DropReason(reason uint8) string { + return DropReasonExt(reason, uint32(0)) +} diff --git a/pkg/plugin/ebpfwindows/ebpf_windows.go b/pkg/plugin/ebpfwindows/ebpf_windows.go new file mode 100644 index 0000000000..bc12fcbd38 --- /dev/null +++ b/pkg/plugin/ebpfwindows/ebpf_windows.go @@ -0,0 +1,362 @@ +package ebpfwindows + +import ( + "context" + "errors" + "fmt" + "log/slog" + "os" + "strings" + "time" + "unsafe" + + plugincommon "github.com/microsoft/retina/pkg/plugin/common" + + v1 "github.com/cilium/cilium/pkg/hubble/api/v1" + observer "github.com/cilium/cilium/pkg/hubble/observer/types" + monitorAPI "github.com/cilium/cilium/pkg/monitor/api" + kcfg "github.com/microsoft/retina/pkg/config" + "github.com/microsoft/retina/pkg/enricher" + "github.com/microsoft/retina/pkg/log" + metrics "github.com/microsoft/retina/pkg/metrics" + "github.com/microsoft/retina/pkg/plugin/registry" + "github.com/microsoft/retina/pkg/utils" + "go.uber.org/zap" +) + +const ( + // name of the ebpfwindows plugin + name string = "ebpfwindows" + // metrics direction + ingressLabel = "ingress" + egressLabel = "egress" +) + +var ( + errInvalidSize = errors.New("invalid size") + errNilHandleTraceEventData = errors.New("handleTraceEvent data received is nil") + errNilDropNotifyFlow = errors.New("dropnotify flow object is nil") + errNilDropNotifyEvent = errors.New("dropnotify event type is nil") + errInvalidDropNotifySize = errors.New("invalid size for DropNotify") + errInvalidTraceNotifySize = errors.New("invalid size for TraceNotify") + errNilTraceNotifyFlow = errors.New("tracenotify flow object is nil") + isCiliumOnWindowsEnabled = plugincommon.IsCiliumOnWindowsEnabled +) + +// Plugin is the ebpfwindows plugin +type Plugin struct { + l *log.ZapLogger + cfg *kcfg.Config + enricher enricher.EnricherInterface + externalChannel chan *v1.Event + parser *Parser +} + +func init() { + registry.Add(name, New) +} + +func New(cfg *kcfg.Config) registry.Plugin { + return &Plugin{ + l: log.Logger().Named(name), + cfg: cfg, + } +} + +// Init is a no-op for the ebpfwindows plugin +func (p *Plugin) Init() error { + parser, err := NewParser(slog.Default().With("WindowsEbpf", "parser")) + if err != nil { + p.l.Error("Failed to create parser", zap.Error(err)) + return fmt.Errorf("failed to create parser: %w", err) + } + + p.parser = parser + return nil +} + +// Name returns the name of the ebpfwindows plugin +func (p *Plugin) Name() string { + return name +} + +// Start the plugin by starting a periodic timer. +func (p *Plugin) Start(ctx context.Context) error { + p.l.Info("Start ebpfWindows plugin...") + + ciliumEnabled, err := isCiliumOnWindowsEnabled() + + if err != nil { + p.l.Error("Error while checking if Cilium is enabled on Windows", zap.Error(err)) + return fmt.Errorf("Failed to check if Cilium is enabled on Windows: %w", err) + } + + if !ciliumEnabled { + p.l.Warn("Cilium is not enabled on Windows, skipping ebpfWindows plugin initialization") + return nil + } + + if err := p.ensureRetinaEbpfAPIAvailable(); err != nil { + p.l.Warn("retinaebpfapi.dll is unavailable, skipping ebpfWindows plugin initialization", zap.Error(err)) + return nil + } + + p.l.Info("Cilium is enabled on Windows, proceeding with ebpfWindows plugin initialization") + p.pullMetricsAndEvents(ctx) + p.l.Info("Complete ebpfWindows plugin...") + return nil +} + +func (p *Plugin) ensureRetinaEbpfAPIAvailable() error { + if err := p.addEbpfToPath(); err != nil { + return err + } + + if err := loadRetinaEbpfAPI(); err != nil { + return fmt.Errorf("loading retinaebpfapi.dll or required exports: %w", err) + } + + return nil +} + +// metricsMapIterateCallback is the callback function that is called for each key-value pair in the metrics map. +func (p *Plugin) metricsMapIterateCallback(key *MetricsKey, value *MetricsValue) { + if key == nil { + p.l.Error("MetricsMapIterateCallback key is nil") + return + } + if value == nil { + p.l.Error("MetricsMapIterateCallback value is nil") + return + } + if key.IsDrop() { + p.l.Debug("MetricsMapIterateCallback Drop", zap.String("key", key.String())) + if key.IsEgress() { + metrics.DropBytesGauge.WithLabelValues(key.DropForwardReason(), egressLabel).Set(float64(value.Bytes)) + metrics.DropPacketsGauge.WithLabelValues(key.DropForwardReason(), egressLabel).Set(float64(value.Count)) + } else if key.IsIngress() { + metrics.DropBytesGauge.WithLabelValues(key.DropForwardReason(), ingressLabel).Set(float64(value.Bytes)) + metrics.DropPacketsGauge.WithLabelValues(key.DropForwardReason(), ingressLabel).Set(float64(value.Count)) + } else { + p.l.Error("MetricsMapIterateCallback drop key is neither ingress nor egress", zap.String("key", key.String())) + } + } else { + p.l.Debug("MetricsMapIterateCallback Forward", zap.String("key", key.String())) + if key.IsEgress() { + metrics.ForwardPacketsGauge.WithLabelValues(egressLabel).Set(float64(value.Count)) + metrics.ForwardBytesGauge.WithLabelValues(egressLabel).Set(float64(value.Bytes)) + } else if key.IsIngress() { + metrics.ForwardPacketsGauge.WithLabelValues(ingressLabel).Set(float64(value.Count)) + metrics.ForwardBytesGauge.WithLabelValues(ingressLabel).Set(float64(value.Bytes)) + } else { + p.l.Error("MetricsMapIterateCallback forward key is neither ingress nor egress", zap.String("key", key.String())) + } + } +} + +// eventsMapCallback is the callback function that is called for each value in the events map. +func (p *Plugin) eventsMapCallback(data unsafe.Pointer, size uint32) { + err := p.handleTraceEvent(data, size) + if err != nil { + p.l.Error("Error handling trace event", zap.Error(err)) + } +} + +func (p *Plugin) addEbpfToPath() error { + currPath := os.Getenv("PATH") + if strings.Contains(currPath, "ebpf-for-windows") { + return nil + } + programFiles := os.Getenv("ProgramFiles") + ebpfWindowsPath := programFiles + "\\ebpf-for-windows\\" + newPath := currPath + ";" + ebpfWindowsPath + if err := os.Setenv("PATH", newPath); err != nil { + p.l.Error("Error setting PATH environment variable", zap.Error(err)) + return fmt.Errorf("failed to set PATH environment variable: %w", err) + } + + return nil +} + +func (p *Plugin) pullMetricsAndEvents(ctx context.Context) { + eventsMap := NewEventsMap() + metricsMap := NewMetricsMap() + prevLostEventsCount := uint64(0) + + if enricher.IsInitialized() && p.cfg.EnablePodLevel { + p.enricher = enricher.Instance() + } else { + p.l.Warn("retina enricher is not initialized") + } + + if p.enricher != nil { + err := eventsMap.RegisterForCallback(p.l, p.eventsMapCallback) + if err != nil { + p.l.Error("Error registering for events map callback", zap.Error(err)) + return + } + + defer func() { + p.l.Error("ebpfwindows plugin canceling", zap.Error(ctx.Err())) + err := eventsMap.UnregisterForCallback() + if err != nil { + p.l.Error("Error unregistering events map callback", zap.Error(err)) + } + }() + } + + ticker := time.NewTicker(p.cfg.MetricsInterval) + defer ticker.Stop() + for { + select { + case <-ticker.C: + err := metricsMap.IterateWithCallback(p.l, p.metricsMapIterateCallback) + if err != nil { + p.l.Error("Error iterating metrics map", zap.Error(err)) + } + + lostEventsCount, err := GetLostEventsCount() + + if err != nil { + p.l.Error("Error getting lost events count", zap.Error(err)) + } else { + // The lost events count is cumulative, so we need to calculate the difference + if lostEventsCount > prevLostEventsCount { + counterToAdd := lostEventsCount - prevLostEventsCount + metrics.LostEventsCounter.WithLabelValues(utils.Kernel, name).Add(float64(counterToAdd)) + prevLostEventsCount = lostEventsCount + } + } + + case <-ctx.Done(): + p.l.Error("ebpfwindows plugin canceling", zap.Error(ctx.Err())) + err := eventsMap.UnregisterForCallback() + if err != nil { + p.l.Error("Error Unregistering Events Map callback", zap.Error(err)) + } + return + } + } +} + +// SetupChannel saves the external channel to which the plugin will send events. +func (p *Plugin) SetupChannel(ch chan *v1.Event) error { + p.externalChannel = ch + return nil +} + +// Stop the plugin by cancelling the periodic timer. +func (p *Plugin) Stop() error { + p.l.Info("Stop ebpfWindows plugin...") + return nil +} + +// Compile is a no-op for the ebpfwindows plugin +func (p *Plugin) Compile(context.Context) error { + return nil +} + +// Generate is a no-op for the ebpfwindows plugin +func (p *Plugin) Generate(context.Context) error { + return nil +} + +func (p *Plugin) handleTraceEvent(data unsafe.Pointer, size uint32) error { + if uintptr(size) < unsafe.Sizeof(uint8(0)) { + return fmt.Errorf("%w: %d", errInvalidSize, size) + } + + if data == nil { + return fmt.Errorf("%w", errNilHandleTraceEventData) + } + perfData := unsafe.Slice((*byte)(data), size) + eventType := perfData[0] + switch eventType { + case monitorAPI.MessageTypeDrop: + if size <= uint32(unsafe.Sizeof(DropNotify{})) { + return fmt.Errorf("%w: %d", errInvalidDropNotifySize, size) + } + + e, err := p.parser.Decode(&observer.MonitorEvent{ + Payload: &observer.PerfEvent{ + Data: perfData, + }, + }) + if err != nil { + return fmt.Errorf("could not convert dropnotify event to flow: %w", err) + } + ext := utils.NewExtensions() + utils.AddPacketSize(ext, size-uint32(unsafe.Sizeof(DropNotify{}))) + fl := e.GetFlow() + if fl == nil { + return fmt.Errorf("%w", errNilDropNotifyFlow) + } + if fl.GetEventType() == nil { + return fmt.Errorf("%w", errNilDropNotifyEvent) + } + if fl.GetIP() == nil { + return fmt.Errorf("%w; perfdata: %v;", errNilDropNotifyEvent, perfData) + } + // Set the drop reason. + eventType := fl.GetEventType().GetSubType() + utils.AddDropReason(fl, ext, uint16(eventType)) + utils.SetExtensions(fl, ext) + p.enricher.Write(e) + case monitorAPI.MessageTypeTrace: + e := &v1.Event{} + if size <= uint32(unsafe.Sizeof(TraceNotify{})) { + return fmt.Errorf("%w: %d", errInvalidTraceNotifySize, size) + } + e, err := p.parser.Decode(&observer.MonitorEvent{ + Payload: &observer.PerfEvent{ + Data: perfData, + }, + }) + if err != nil { + return fmt.Errorf("could not convert tracenotify event to flow: %w", err) + } + ext := utils.NewExtensions() + utils.AddPacketSize(ext, size-uint32(unsafe.Sizeof(TraceNotify{}))) + fl := e.GetFlow() + if fl == nil { + return fmt.Errorf("%w", errNilTraceNotifyFlow) + } + if fl.GetIP() == nil { + return fmt.Errorf("%w; perfdata: %v;", errNilDropNotifyEvent, perfData) + } + utils.SetExtensions(fl, ext) + p.enricher.Write(e) + + case MessageTypePktmonDrop: + if size <= uint32(unsafe.Sizeof(PktmonDropNotify{})) { + return fmt.Errorf("%w: %d", errInvalidDropNotifySize, size) + } + + e, err := p.parser.Decode(&observer.MonitorEvent{ + Payload: &observer.PerfEvent{ + Data: perfData, + }, + }) + if err != nil { + return fmt.Errorf("could not convert pktmon dropnotify event to flow: %w", err) + } + ext := utils.NewExtensions() + utils.AddPacketSize(ext, size-uint32(unsafe.Sizeof(DropNotify{}))) + fl := e.GetFlow() + if fl == nil { + return fmt.Errorf("%w", errNilDropNotifyFlow) + } + if fl.GetEventType() == nil { + return fmt.Errorf("%w", errNilDropNotifyEvent) + } + if fl.GetIP() == nil { + return fmt.Errorf("%w; perfdata: %v;", errNilDropNotifyEvent, perfData) + } + // Set the drop reason. + eventType := fl.GetEventType().GetSubType() + utils.AddDropReason(fl, ext, uint16(eventType)) + utils.SetExtensions(fl, ext) + p.enricher.Write(e) + } + return nil +} diff --git a/pkg/plugin/ebpfwindows/ebpf_windows_test.go b/pkg/plugin/ebpfwindows/ebpf_windows_test.go new file mode 100644 index 0000000000..798ff41d51 --- /dev/null +++ b/pkg/plugin/ebpfwindows/ebpf_windows_test.go @@ -0,0 +1,960 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT license. +// nolint + +package ebpfwindows + +import ( + "bytes" + "context" + "encoding/binary" + "errors" + "fmt" + "log/slog" + "net" + "testing" + "time" + "unsafe" + + "github.com/cilium/cilium/api/v1/flow" + v1 "github.com/cilium/cilium/pkg/hubble/api/v1" + monitorapi "github.com/cilium/cilium/pkg/monitor/api" + "github.com/cilium/cilium/pkg/types" + "github.com/google/gopacket" + "github.com/google/gopacket/layers" + kcfg "github.com/microsoft/retina/pkg/config" + "github.com/microsoft/retina/pkg/enricher" + "github.com/microsoft/retina/pkg/log" + "github.com/microsoft/retina/pkg/metrics" + "go.uber.org/mock/gomock" +) + +const ( + pktSizeBytes = 100 +) + +var errTestFailure = errors.New("test failure") + +func makeMockEthernetIPv4TCPPacket() []byte { + eth := &layers.Ethernet{ + SrcMAC: net.HardwareAddr{0xde, 0xad, 0xbe, 0xef, 0x00, 0x02}, + DstMAC: net.HardwareAddr{0xde, 0xad, 0xbe, 0xef, 0x00, 0x01}, + EthernetType: layers.EthernetTypeIPv4, + } + ip := &layers.IPv4{ + Version: 4, + IHL: 5, + TTL: 64, + Protocol: layers.IPProtocolTCP, + SrcIP: net.IP{192, 168, 1, 1}, + DstIP: net.IP{192, 168, 1, 2}, + } + tcp := &layers.TCP{ + SrcPort: 12345, + DstPort: 80, + SYN: true, + Window: 65535, + } + + err := tcp.SetNetworkLayerForChecksum(ip) + if err != nil { + panic(fmt.Sprintf("failed to set network layer for TCP: %v", err)) + } + + buf := gopacket.NewSerializeBuffer() + opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true} + err = gopacket.SerializeLayers(buf, opts, eth, ip, tcp, gopacket.Payload([]byte{0x01, 0x02, 0x03})) + if err != nil { + panic(fmt.Sprintf("failed to serialize layers: %v", err)) + } + + return buf.Bytes() +} + +func makeMockIPv4TCPPacket() []byte { + ip := &layers.IPv4{ + Version: 4, + IHL: 5, + TTL: 64, + Protocol: layers.IPProtocolTCP, + SrcIP: net.IP{192, 168, 1, 1}, + DstIP: net.IP{192, 168, 1, 2}, + } + tcp := &layers.TCP{ + SrcPort: 12345, + DstPort: 80, + SYN: true, + Window: 65535, + } + + err := tcp.SetNetworkLayerForChecksum(ip) + if err != nil { + panic(fmt.Sprintf("failed to set network layer for TCP: %v", err)) + } + + buf := gopacket.NewSerializeBuffer() + opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true} + err = gopacket.SerializeLayers(buf, opts, ip, tcp, gopacket.Payload([]byte{0x01, 0x02, 0x03})) + if err != nil { + panic(fmt.Sprintf("failed to serialize layers: %v", err)) + } + + return buf.Bytes() +} + +func CheckPacketFields(fl *flow.Flow, t *testing.T, checkEthFields bool) { + if checkEthFields { + if fl.GetEthernet().GetSource() != "de:ad:be:ef:00:02" { + t.Errorf("expected source MAC to be de:ad:be:ef:00:02, got %v", fl.GetEthernet().GetSource()) + } + + if fl.GetEthernet().GetDestination() != "de:ad:be:ef:00:01" { + t.Errorf("expected destination MAC to be de:ad:be:ef:00:01, got %v", fl.GetEthernet().GetDestination()) + } + } + + if fl.GetIP().GetIpVersion() != flow.IPVersion_IPv4 { + t.Errorf("expected IP version IPv4, got %v", fl.GetIP().GetIpVersion()) + } + + if fl.GetIP().GetSource() != "192.168.1.1" { + t.Errorf("expected source IP to be 192.168.1.1, got %v", fl.GetIP().GetSource()) + } + if fl.GetIP().GetDestination() != "192.168.1.2" { + t.Errorf("expected destination IP to be 192.168.1.2, got %v", fl.GetIP().GetDestination()) + } + + if fl.GetL4().GetTCP().GetSourcePort() != 12345 { + t.Errorf("expected source port to be 12345, got %v", fl.GetL4().GetTCP().GetSourcePort()) + } + if fl.GetL4().GetTCP().GetDestinationPort() != 80 { + t.Errorf("expected destination port to be 80, got %v", fl.GetL4().GetTCP().GetDestinationPort()) + } +} + +// TestHandleTraceEvent_TraceNotify invokes the handleTraceEvent function for a valid TraceNotify event +// and check if the flow object is created correctly. +func TestHandleTraceEvent_TraceNotify(t *testing.T) { + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + mockEnricher := enricher.NewMockEnricherInterface(ctrl) + mockEnricher.EXPECT(). + Write(gomock.Any()). + DoAndReturn(func(event *v1.Event) error { + fl := event.GetFlow() + if fl == nil { + t.Error("expected a flow object, got nil") + } + eventType := fl.GetEventType().GetType() + if eventType != monitorapi.MessageTypeTrace { + t.Errorf("expected event type %v, got %v", monitorapi.MessageTypeTrace, eventType) + } + + if fl.GetType() != flow.FlowType_L3_L4 { + t.Errorf("expected flow type L3_L4, got %v", fl.GetType()) + } + CheckPacketFields(fl, t, true) + // Add more assertions as needed + return nil + }) + _, err := log.SetupZapLogger(log.GetDefaultLogOpts()) + if err != nil { + t.Fatalf("failed to setup logger: %v", err) + } + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err = p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + p.enricher = mockEnricher + tn := TraceNotify{ + Type: monitorapi.MessageTypeTrace, + Version: TraceNotifyVersion1, + OrigIP: types.IPv6{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}, // example IPv6 + } + + var buf bytes.Buffer + if err = binary.Write(&buf, binary.LittleEndian, tn); err != nil { + t.Fatalf("failed to serialize TraceNotify: %v", err) + } + + // Append mock TCP packet as payload + packet := makeMockEthernetIPv4TCPPacket() + buf.Write(packet) + data := buf.Bytes() + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err != nil { + t.Fatalf("expected no error for handleTraceEvent, got: %v", err) + } +} + +// TestHandleTraceEvent_DropNotify invokes the handleTraceEvent function for a valid DropNotify event +// and check if the flow object is created correctly. +func TestHandleTraceEvent_DropNotify(t *testing.T) { + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + mockEnricher := enricher.NewMockEnricherInterface(ctrl) + mockEnricher.EXPECT(). + Write(gomock.Any()). + DoAndReturn(func(event *v1.Event) error { + fl := event.GetFlow() + if fl == nil { + t.Error("expected a flow object, got nil") + } + subType := fl.GetEventType().GetType() + if subType != monitorapi.MessageTypeDrop { + t.Errorf("expected event type %v, got %v", monitorapi.MessageTypeDrop, subType) + } + + if fl.GetType() != flow.FlowType_L3_L4 { + t.Errorf("expected flow type L3_L4, got %v", fl.GetType()) + } + + CheckPacketFields(fl, t, true) + // Add more assertions as needed + return nil + }) + + _, err := log.SetupZapLogger(log.GetDefaultLogOpts()) + if err != nil { + t.Fatalf("failed to setup logger: %v", err) + } + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + + err = p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + p.enricher = mockEnricher + + dn := DropNotify{ + Type: monitorapi.MessageTypeDrop, + Version: DropNotifyVersion1, + } + var buf bytes.Buffer + if err = binary.Write(&buf, binary.LittleEndian, dn); err != nil { + t.Fatalf("failed to serialize DropNotify: %v", err) + } + + // Append mock TCP packet as payload + packet := makeMockEthernetIPv4TCPPacket() + buf.Write(packet) + + data := buf.Bytes() + + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err != nil { + t.Fatalf("expected no error for handleTraceEvent, got: %v", err) + } +} + +// TestHandleTraceEvent_UnknownEventType_NoError tests the behavior of the handleTraceEvent function +// when an unknown event type is received. +func TestHandleTraceEvent_UnknownEventType_NoError(t *testing.T) { + _, err := log.SetupZapLogger(log.GetDefaultLogOpts()) + if err != nil { + t.Fatalf("failed to setup logger: %v", err) + } + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err = p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + // Create a byte array with one byte set to 4 (Unknown event type) + data := []byte{8} // Neither TraceNotify nor DropNotify + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err != nil { + t.Fatalf("expected no error for unknown event type, got: %v", err) + } +} + +// TestHandleTraceEvent_InvalidTraceNotify tests the behavior of the handleTraceEvent function +// when an invalid TraceNotify event is received. +func TestHandleTraceEvent_InvalidTraceNotify(t *testing.T) { + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err := p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + data := []byte{monitorapi.MessageTypeTrace, 0} // Invalid TraceNotify + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err == nil { + t.Fatalf("expected error for invalid TraceNotify, got none") + } else if err.Error() != "invalid size for TraceNotify: 2" { + t.Fatalf("expected error - invalid size for TraceNotify: 2, got: %v", err) + } +} + +// TestHandleTraceEvent_InvalidDropNotify tests the behavior of the handleTraceEvent function +// when an invalid DropNotify event is received. +func TestHandleTraceEvent_InvalidDropNotify(t *testing.T) { + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err := p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + data := []byte{monitorapi.MessageTypeDrop, 0} // Invalid DropNotify + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err == nil { + t.Fatalf("expected error for invalid DropNotify, got none") + } else if err.Error() != "invalid size for DropNotify: 2" { + t.Fatalf("expected error - invalid size for DropNotify: 2, got: %v", err) + } +} + +// TestHandleTraceEvent_DataNil_SizeNonZero tests the behavior of the handleTraceEvent function +// when the data pointer is nil and size is non-zero. +func TestHandleTraceEvent_DataNil_SizeNonZero(t *testing.T) { + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err := p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + var mockCiliumEventSize uint32 = 100 + err = p.handleTraceEvent(nil, mockCiliumEventSize) + if err == nil { + t.Fatalf("expected error - handleTraceEvent data received is nil") + } else if err.Error() != "handleTraceEvent data received is nil" { + t.Fatalf("expected error - handleTraceEvent data received is nil, got %v", err) + } +} + +// TestHandleTraceEvent_InvalidSizeZero tests the behavior of the handleTraceEvent function +// when the size is zero. +func TestHandleTraceEvent_InvalidSizeZero(t *testing.T) { + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + err := p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + err = p.handleTraceEvent(nil, 0) + if err == nil { + t.Fatalf("expected error - invalid size 0") + } else if err.Error() != "invalid size: 0" { + t.Fatalf("expected error - invalid size: 0, got %v", err) + } +} + +// TestMetricsMapIterateCallback_DropEgress tests the behavior of the metricsMapIterateCallback function +// when a drop event is received for egress traffic. +func TestMetricsMapIterateCallback_DropEgress(t *testing.T) { + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + keyDrop := &MetricsKey{ + Version: 1, + Reason: 2, + Direction: dirEgress, + ExtendedReason: 0, // Extended reason is not used in this test + } + val := &MetricsValue{Count: 1, Bytes: pktSizeBytes} + p.metricsMapIterateCallback(keyDrop, val) + _, err := metrics.DropBytesGauge.GetMetricWithLabelValues("Reason_InvalidPacket", "egress") + if err != nil { + t.Fatalf("expected a dropbyteguage metric with label Reason_InvalidPacket and egress, but got error %v", err) + } + _, err = metrics.DropPacketsGauge.GetMetricWithLabelValues("Reason_InvalidPacket", "egress") + if err != nil { + t.Fatalf("expected a droppktguage metrics with label Reason_InvalidPacket and egress, but got error %v", err) + } +} + +// TestMetricsMapIterateCallback_DropIngress tests the behavior of the metricsMapIterateCallback function +// when a drop event is received for ingress traffic. +func TestMetricsMapIterateCallback_DropIngress(t *testing.T) { + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + keyDrop := &MetricsKey{ + Version: 1, + Reason: 2, + Direction: dirIngress, + ExtendedReason: 0, // Extended reason is not used in this test + } + val := &MetricsValue{Count: 1, Bytes: pktSizeBytes} + p.metricsMapIterateCallback(keyDrop, val) + _, err := metrics.DropBytesGauge.GetMetricWithLabelValues("Reason_InvalidPacket", "ingress") + if err != nil { + t.Fatalf("expected a dropbyteguage metric with label Reason_InvalidPacket and ingress, but got error %v", err) + } + _, err = metrics.DropPacketsGauge.GetMetricWithLabelValues("Reason_InvalidPacket", "ingress") + if err != nil { + t.Fatalf("expected a droppktguage metrics with label Reason_InvalidPacket and ingress, but got error %v", err) + } +} + +// TestMetricsMapIterateCallback_ForwardEgress tests the behavior of the metricsMapIterateCallback function +// when a forward event is received for egress traffic. +func TestMetricsMapIterateCallback_ForwardEgress(t *testing.T) { + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + keyFwd := &MetricsKey{ + Version: 1, + Reason: 0, + Direction: dirEgress, + ExtendedReason: 0, // Extended reason is not used in this test + } + val := &MetricsValue{Count: 1, Bytes: pktSizeBytes} + p.metricsMapIterateCallback(keyFwd, val) + _, err := metrics.ForwardBytesGauge.GetMetricWithLabelValues("egress") + if err != nil { + t.Fatalf("expected a fwdbyteguage metric with label egress, but got error %v", err) + } + _, err = metrics.ForwardPacketsGauge.GetMetricWithLabelValues("egress") + if err != nil { + t.Fatalf("expected a fwdpktguage metrics with label egress, but got error %v", err) + } +} + +// TestMetricsMapIterateCallback_ForwardIngress tests the behavior of the metricsMapIterateCallback function +// when a forward event is received for ingress traffic. +func TestMetricsMapIterateCallback_ForwardIngress(t *testing.T) { + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + keyFwd := &MetricsKey{ + Version: 1, + Reason: 0, + Direction: dirIngress, + ExtendedReason: 0, // Extended reason is not used in this test + } + val := &MetricsValue{Count: 1, Bytes: pktSizeBytes} + p.metricsMapIterateCallback(keyFwd, val) + _, err := metrics.ForwardBytesGauge.GetMetricWithLabelValues("ingress") + if err != nil { + t.Fatalf("expected a fwdbyteguage with label ingress, but got error %v", err) + } + _, err = metrics.ForwardPacketsGauge.GetMetricWithLabelValues("ingress") + if err != nil { + t.Fatalf("expected a fwdpktguage with label ingress, but got error %v", err) + } +} + +// TestMetricsMapIterateCallback_NilKey tests the behavior of the metricsMapIterateCallback function +// when the key is nil and value is non-nil. +func TestMetricsMapIterateCallback_NilKey(t *testing.T) { + // it should not panic + defer func() { + if r := recover(); r != nil { + t.Fatalf("unexpected panic: %v", r) + } + }() + + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + fakeValues := &MetricsValue{} + p.metricsMapIterateCallback(nil, fakeValues) +} + +// TestMetricsMapIterateCallback_NilValue tests the behavior of the metricsMapIterateCallback function +// when the value is nil. +func TestMetricsMapIterateCallback_NilValue(t *testing.T) { + // it should not panic + defer func() { + if r := recover(); r != nil { + t.Fatalf("unexpected panic: %v", r) + } + }() + + metrics.InitializeMetrics(slog.Default()) + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + key := &MetricsKey{} + p.metricsMapIterateCallback(key, nil) +} + +// TestIterateWithCallback_Error_NilMetricsValue tests the behavior of the IterateWithCallback function +// when retinaEBPFAPI invokes enumCallBack with nil value. +func TestIterateWithCallback_Error_NilMetricsValue(t *testing.T) { + // Mock the function variable to simulate a successful Windows API call + orig := callEnumMetricsMap + callEnumMetricsMap = func(_ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil + } + defer func() { callEnumMetricsMap = orig }() + + m := NewMetricsMap() + logger := log.Logger().Named("test-ebpf") + + called := false + err := m.IterateWithCallback(logger, func(_ *MetricsKey, _ *MetricsValue) { + called = true + }) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + fakeKey := &MetricsKey{} + enumCallBack(unsafe.Pointer(fakeKey), nil) + if called { + t.Errorf("expected callback not to be called") + } +} + +// TestIterateWithCallback_Error_NilMetricsKey tests the behavior of the IterateWithCallback function +// when retinaEBPFAPI invokes enumCallBack with nil key. +func TestIterateWithCallback_Error_NilMetricsKey(t *testing.T) { + // Mock the function variable to simulate a successful Windows API call + orig := callEnumMetricsMap + callEnumMetricsMap = func(_ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil + } + defer func() { callEnumMetricsMap = orig }() + + m := NewMetricsMap() + logger := log.Logger().Named("test-ebpf") + + called := false + err := m.IterateWithCallback(logger, func(_ *MetricsKey, _ *MetricsValue) { + called = true + }) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + fakeValues := &MetricsValue{} + enumCallBack(unsafe.Pointer(nil), unsafe.Pointer(fakeValues)) + if called { + t.Errorf("expected callback not to be called") + } +} + +// TestIterateWithCallback_Error_NilKeyAndValue tests the behavior of the IterateWithCallback function +// when retinaEBPFAPI invokes enumCallBack with nil value. +func TestIterateWithCallback_Error_NilMetricValue(t *testing.T) { + // Mock the function variable to simulate a successful Windows API call + orig := callEnumMetricsMap + callEnumMetricsMap = func(_ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil + } + defer func() { callEnumMetricsMap = orig }() + + m := NewMetricsMap() + logger := log.Logger().Named("test-ebpf") + + called := false + err := m.IterateWithCallback(logger, func(_ *MetricsKey, _ *MetricsValue) { + called = true + }) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + fakeKey := &MetricsKey{} + enumCallBack(unsafe.Pointer(fakeKey), unsafe.Pointer(nil)) + if called { + t.Errorf("expected callback not to be called") + } +} + +// TestIterateWithCallback_Success tests the behavior of the IterateWithCallback function +// when retinaEBPFAPI invokes enumCallBack with valid key and value. +func TestIterateWithCallback_Success(t *testing.T) { + // Mock the function variable to simulate a successful Windows API call + orig := callEnumMetricsMap + callEnumMetricsMap = func(_ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil + } + defer func() { callEnumMetricsMap = orig }() + + m := NewMetricsMap() + logger := log.Logger().Named("test-ebpf") + + called := false + err := m.IterateWithCallback(logger, func(_ *MetricsKey, _ *MetricsValue) { + called = true + }) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + fakeKey := &MetricsKey{} + fakeValues := &MetricsValue{} + enumCallBack(unsafe.Pointer(fakeKey), unsafe.Pointer(fakeValues)) + if !called { + t.Errorf("expected callback to be called") + } +} + +// TestUnregisterForCallback_Success tests the behavior of the UnregisterForCallback function +// when retinaEBPFAPI successfully unregisters the callback. +func TestUnregisterForCallback_Success(t *testing.T) { + // Mock the function variable + orig := callUnregisterEventsMapCallback + callUnregisterEventsMapCallback = func(_ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil // Simulate success + } + defer func() { callUnregisterEventsMapCallback = orig }() + + em := NewEventsMap() + + err := em.UnregisterForCallback() + if err != nil { + t.Fatalf("expected no error when unregistering callback with eventmap, got %v", err) + } +} + +// TestUnregisterForCallback_Error tests the behavior of the UnregisterForCallback function +// when retinaEBPFAPI fails to unregister the callback. +func TestUnregisterForCallback_Error(t *testing.T) { + // Mock the function variable to simulate an error + orig := callUnregisterEventsMapCallback + callUnregisterEventsMapCallback = func(_ uintptr) (uintptr, uintptr, error) { + return 1, 0, fmt.Errorf("%w", errTestFailure) + } + defer func() { callUnregisterEventsMapCallback = orig }() + + em := NewEventsMap() + + err := em.UnregisterForCallback() + if err == nil { + t.Fatalf("expected error when unregistering callback with eventmap, got nothing") + } +} + +// TestRegisterForCallback_Success tests the behavior of the RegisterForCallback function +// when retinaEBPFAPI successfully registers the callback. +func TestRegisterForCallback_Success(t *testing.T) { + // Mock the function variable, not the LazyProc + orig := callRegisterEventsMapCallback + callRegisterEventsMapCallback = func(_, _ uintptr) (uintptr, uintptr, error) { + return 0, 0, nil // Simulate success + } + defer func() { callRegisterEventsMapCallback = orig }() + + logger := log.Logger().Named("test-ebpf") + em := NewEventsMap() + + called := false + cb := func(_ unsafe.Pointer, _ uint32) { + called = true + } + + err := em.RegisterForCallback(logger, cb) + if err != nil { + t.Fatalf("expected no error when registering callback with eventsmap, got %v", err) + } + // Simulate callback + eventsCallback(nil, 0) + if !called { + t.Errorf("expected callback to be called from eventsmap") + } +} + +// TestRegisterForCallback_Error tests the behavior of the RegisterForCallback function +// when retinaEBPFAPI fails to register the callback. +func TestRegisterForCallback_Error(t *testing.T) { + // Mock the function variable to simulate an error + orig := callRegisterEventsMapCallback + callRegisterEventsMapCallback = func(_, _ uintptr) (uintptr, uintptr, error) { + return 1, 0, fmt.Errorf("%w", errTestFailure) + } + defer func() { callRegisterEventsMapCallback = orig }() + + logger := log.Logger().Named("test-ebpf") + em := NewEventsMap() + + cb := func(_ unsafe.Pointer, _ uint32) { + // nop + } + + err := em.RegisterForCallback(logger, cb) + if err == nil { + t.Fatalf("expected error when registering callback with eventsmap, got nothing") + } +} + +func TestStart_GracefullySkipsWhenRetinaEbpfAPIMissing(t *testing.T) { + origIsCiliumOnWindowsEnabled := isCiliumOnWindowsEnabled + origLoadRetinaEbpfAPI := loadRetinaEbpfAPI + isCiliumOnWindowsEnabled = func() (bool, error) { + return true, nil + } + loadRetinaEbpfAPI = func() error { + return fmt.Errorf("module not found") + } + defer func() { + isCiliumOnWindowsEnabled = origIsCiliumOnWindowsEnabled + loadRetinaEbpfAPI = origLoadRetinaEbpfAPI + }() + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + + if err := p.Start(context.Background()); err != nil { + t.Fatalf("expected plugin to skip gracefully when retinaebpfapi.dll is missing, got %v", err) + } +} + +// TestHandleTraceEventWithEthPacket_PktmonDropNotify invokes the handleTraceEvent function for a valid DropNotify event +// and check if the flow object is created correctly. +func TestHandleTraceEventWithEthPacket_PktmonDropNotify(t *testing.T) { + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + mockEnricher := enricher.NewMockEnricherInterface(ctrl) + mockEnricher.EXPECT(). + Write(gomock.Any()). + DoAndReturn(func(event *v1.Event) error { + fl := event.GetFlow() + if fl == nil { + t.Error("expected a flow object, got nil") + } + eventType := fl.GetEventType().GetType() + if eventType != MessageTypePktmonDrop { + t.Errorf("expected event type %v, got %v", MessageTypePktmonDrop, eventType) + } + + var testDropReason int32 = 2 + testDropReason |= (1 << 30) + eventSubType := fl.GetEventType().GetSubType() + if eventSubType != testDropReason { + t.Errorf("expected event type %v, got %v", testDropReason, eventSubType) + } + + if fl.GetType() != flow.FlowType_L3_L4 { + t.Errorf("expected flow type L3_L4, got %v", fl.GetType()) + } + + CheckPacketFields(fl, t, true) + // Add more assertions as needed + return nil + }) + + _, err := log.SetupZapLogger(log.GetDefaultLogOpts()) + if err != nil { + t.Fatalf("failed to setup logger: %v", err) + } + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + + err = p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + p.enricher = mockEnricher + + pdn := [57]uint8{} + // type 100 + pdn[0] = 0x64 + // version 1 + pdn[2] = 0x01 + pdn[3] = 0x00 + // PacketType 1 + pdn[31] = 0x01 + pdn[32] = 0x00 + + // DropReason 0x000003E9 + pdn[39] = 0x02 + pdn[40] = 0x00 + pdn[41] = 0x00 + pdn[42] = 0x00 + var buf bytes.Buffer + if err = binary.Write(&buf, binary.LittleEndian, pdn); err != nil { + t.Fatalf("failed to serialize DropNotify: %v", err) + } + + // Append mock TCP packet as payload + packet := makeMockEthernetIPv4TCPPacket() + buf.Write(packet) + + data := buf.Bytes() + + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err != nil { + t.Fatalf("expected no error for handleTraceEvent, got: %v", err) + } +} + +// TestHandleTraceEventWithIpPacket_PktmonDropNotify invokes the handleTraceEvent function for a valid DropNotify event +// and check if the flow object is created correctly. +func TestHandleTraceEventWithIpPacket_PktmonDropNotify(t *testing.T) { + ctrl := gomock.NewController(t) + defer ctrl.Finish() + + mockEnricher := enricher.NewMockEnricherInterface(ctrl) + mockEnricher.EXPECT(). + Write(gomock.Any()). + DoAndReturn(func(event *v1.Event) error { + fl := event.GetFlow() + if fl == nil { + t.Error("expected a flow object, got nil") + } + eventType := fl.GetEventType().GetType() + if eventType != MessageTypePktmonDrop { + t.Errorf("expected event type %v, got %v", MessageTypePktmonDrop, eventType) + } + + var testDropReason int32 = 2 + testDropReason |= (1 << 30) + eventSubType := fl.GetEventType().GetSubType() + if eventSubType != testDropReason { + t.Errorf("expected event type %v, got %v", testDropReason, eventSubType) + } + + if fl.GetType() != flow.FlowType_L3_L4 { + t.Errorf("expected flow type L3_L4, got %v", fl.GetType()) + } + + CheckPacketFields(fl, t, false) + // Add more assertions as needed + return nil + }) + + _, err := log.SetupZapLogger(log.GetDefaultLogOpts()) + if err != nil { + t.Fatalf("failed to setup logger: %v", err) + } + + p := &Plugin{ + cfg: &kcfg.Config{ + MetricsInterval: 100 * time.Second, + EnablePodLevel: true, + }, + l: log.Logger().Named("test-ebpf"), + } + + err = p.Init() + if err != nil { + t.Fatalf("failed to initialize plugin: %v", err) + } + + p.enricher = mockEnricher + + // Pktmon events use packed structs for the packet headers, manually constructing test packet + pdn := [57]uint8{} + // type 100 + pdn[0] = 0x64 + // version 1 + pdn[2] = 0x01 + pdn[3] = 0x00 + // PacketType 3 + pdn[31] = 0x03 + pdn[32] = 0x00 + + // DropReason 0x00000002 + pdn[39] = 0x02 + pdn[40] = 0x00 + pdn[41] = 0x00 + pdn[42] = 0x00 + var buf bytes.Buffer + if err = binary.Write(&buf, binary.LittleEndian, pdn); err != nil { + t.Fatalf("failed to serialize DropNotify: %v", err) + } + + // Append mock TCP packet as payload + packet := makeMockIPv4TCPPacket() + buf.Write(packet) + + data := buf.Bytes() + + //nolint:gosec // ignore G115 -- data length is guaranteed to be within uint32 bounds in test context + err = p.handleTraceEvent(unsafe.Pointer(&data[0]), uint32(len(data))) + if err != nil { + t.Fatalf("expected no error for handleTraceEvent, got: %v", err) + } +} diff --git a/pkg/plugin/ebpfwindows/endpoint_windows.go b/pkg/plugin/ebpfwindows/endpoint_windows.go new file mode 100644 index 0000000000..bf0fda9460 --- /dev/null +++ b/pkg/plugin/ebpfwindows/endpoint_windows.go @@ -0,0 +1,51 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright Authors of Hubble + +package ebpfwindows + +import ( + "log/slog" + "net/netip" + + pb "github.com/cilium/cilium/api/v1/flow" + "github.com/cilium/cilium/pkg/logging" + "github.com/cilium/cilium/pkg/time" +) + +type DatapathContext struct { + SrcIP netip.Addr + SrcLabelID uint32 + DstIP netip.Addr + DstLabelID uint32 + TraceObservationPoint pb.TraceObservationPoint +} + +type EndpointResolver struct { + log *slog.Logger + logLimiter logging.Limiter +} + +func NewEndpointResolver( + log *slog.Logger, +) *EndpointResolver { + return &EndpointResolver{ + log: log, + logLimiter: logging.NewLimiter(30*time.Second, 1), + } +} + +func (r *EndpointResolver) ResolveEndpoint(_ netip.Addr, datapathSecurityIdentity uint32, _ DatapathContext) *pb.Endpoint { + // for remote endpoints, assemble the information via ip and identity + numericIdentity := datapathSecurityIdentity + var namespace, podName string + var labels []string + var clusterName string + + return &pb.Endpoint{ + Identity: numericIdentity, + ClusterName: clusterName, + Namespace: namespace, + Labels: labels, + PodName: podName, + } +} diff --git a/pkg/plugin/ebpfwindows/eventsmap_windows.go b/pkg/plugin/ebpfwindows/eventsmap_windows.go new file mode 100644 index 0000000000..51c66de8b3 --- /dev/null +++ b/pkg/plugin/ebpfwindows/eventsmap_windows.go @@ -0,0 +1,81 @@ +package ebpfwindows + +import ( + "syscall" + "unsafe" + + "github.com/microsoft/retina/pkg/log" +) + +var ( + registerEventsMapCallback = retinaEbpfAPI.NewProc("RetinaRegisterEventsMapCallback") + unregisterEventsMapCallback = retinaEbpfAPI.NewProc("RetinaUnregisterEventsMapCallback") +) + +type eventsMapCallback func(data unsafe.Pointer, size uint32) + +// Callbacks in Go can only be passed as functions with specific signatures and often need to be wrapped in a syscall-compatible function. +var eventsCallback eventsMapCallback + +// This function will be passed to the Windows API +func eventsMapSysCallCallback(data unsafe.Pointer, size uint32) int { + if eventsCallback != nil { + eventsCallback(data, size) + } + + return 0 +} + +// EventsMap interface represents a events map +type EventsMap interface { + RegisterForCallback(*log.ZapLogger, eventsMapCallback) error + UnregisterForCallback() error +} + +type eventsMap struct { + perfBuffer uintptr +} + +// NewEventsMap creates a new metrics map +func NewEventsMap() EventsMap { + return &eventsMap{perfBuffer: 0} +} + +// RegisterForCallback registers a callback function to be called when a new event is added to the events map +var callRegisterEventsMapCallback = func(callback, perfBuffer uintptr) (uintptr, uintptr, error) { + return registerEventsMapCallback.Call(callback, perfBuffer) +} + +func (e *eventsMap) RegisterForCallback(l *log.ZapLogger, cb eventsMapCallback) error { + eventsCallback = cb + + l.Info("Attempting to register") + // Convert the Go function into a syscall-compatible function + callback := syscall.NewCallback(eventsMapSysCallCallback) + + // Call the API + ret, _, err := callRegisterEventsMapCallback(uintptr(callback), uintptr(unsafe.Pointer(&e.perfBuffer))) + + if ret != 0 { + l.Error("Error registering for events map callback") + return err + } + + return nil +} + +// UnregisterForCallback unregisters the callback function +var callUnregisterEventsMapCallback = func(perfBuffer uintptr) (uintptr, uintptr, error) { + return unregisterEventsMapCallback.Call(perfBuffer) +} + +func (e *eventsMap) UnregisterForCallback() error { + // Call the API + ret, _, err := callUnregisterEventsMapCallback(e.perfBuffer) + + if ret != 0 { + return err + } + + return nil +} diff --git a/pkg/plugin/ebpfwindows/metricsmap_windows.go b/pkg/plugin/ebpfwindows/metricsmap_windows.go new file mode 100644 index 0000000000..78734bec20 --- /dev/null +++ b/pkg/plugin/ebpfwindows/metricsmap_windows.go @@ -0,0 +1,202 @@ +package ebpfwindows + +import ( + "fmt" + "syscall" + "unsafe" + + "github.com/microsoft/retina/pkg/log" + "golang.org/x/sys/windows" +) + +const ( + dirUnknown = 0 + dirIngress = 1 + dirEgress = 2 + dirService = 3 +) + +// direction is the metrics direction i.e ingress (to an endpoint), +// egress (from an endpoint) or service (NodePort service being accessed from +// outside or a ClusterIP service being accessed from inside the cluster). +// If it's none of the above, we return UNKNOWN direction. +var direction = map[uint8]string{ + dirUnknown: "UNKNOWN", + dirIngress: "INGRESS", + dirEgress: "EGRESS", + dirService: "SERVICE", +} + +type MetricsKey struct { + Version uint8 + Reason uint8 + Direction uint8 + ExtendedReason uint16 +} + +type MetricsValue struct { + Count uint64 + Bytes uint64 +} + +// IterateCallback represents the signature of the callback function expected by +// the IterateWithCallback method, which in turn is used to iterate all the +// keys/values of a metrics map. +type IterateCallback func(*MetricsKey, *MetricsValue) + +// MetricsMap interface represents a metrics map, and can be reused to implement +// mock maps for unit tests. +type MetricsMap interface { + IterateWithCallback(*log.ZapLogger, IterateCallback) error +} + +type metricsMap struct{} + +var ( + // Load retinaebpfapi.dll from the system directory + retinaEbpfAPI = windows.NewLazyDLL(`C:\Windows\system32\retinaebpfapi.dll`) + // Load the RetinaEnumerateMetrics function + enumMetricsMap = retinaEbpfAPI.NewProc("RetinaEnumerateMetrics") + // Load the RetinaGetLostEventsCount function + lostEventCount = retinaEbpfAPI.NewProc("RetinaGetLostEventsCount") +) + +// ringBufferEventCallback type definition in Go +type enumMetricsCallback = func(key, value unsafe.Pointer) int + +// Callbacks in Go can only be passed as functions with specific signatures and often need to be wrapped in a syscall-compatible function. +var enumCallBack enumMetricsCallback + +// This function will be passed to the Windows API +func enumMetricsSysCallCallback(key, value unsafe.Pointer) uintptr { + if enumCallBack != nil { + return uintptr(enumCallBack(key, value)) + } + + return 0 +} + +// NewMetricsMap creates a new metrics map +func NewMetricsMap() MetricsMap { + return &metricsMap{} +} + +var callEnumMetricsMap = func(callback uintptr) (uintptr, uintptr, error) { + return enumMetricsMap.Call(callback) +} + +var loadRetinaEbpfAPI = func() error { + if err := retinaEbpfAPI.Load(); err != nil { + return err + } + + for _, proc := range []*windows.LazyProc{ + enumMetricsMap, + lostEventCount, + registerEventsMapCallback, + unregisterEventsMapCallback, + } { + if err := proc.Find(); err != nil { + return err + } + } + + return nil +} + +// IterateWithCallback iterates through all the keys/values of a metrics map, +// passing each key/value pair to the cb callback +func (m metricsMap) IterateWithCallback(l *log.ZapLogger, cb IterateCallback) error { + // Define the callback function in Go + enumCallBack = func(key unsafe.Pointer, value unsafe.Pointer) int { + if key == nil { + l.Error("MetricsKey is nil") + return 1 + } + + if value == nil { + l.Error("Metrics Value is nil") + return 1 + } + + metricsValue := (*MetricsValue)(value) + metricsKey := (*MetricsKey)(key) + cb(metricsKey, metricsValue) + return 0 + } + + // Convert the Go function into a syscall-compatible function + callback := syscall.NewCallback(enumMetricsSysCallCallback) + + // Call the API + ret, _, err := callEnumMetricsMap(uintptr(callback)) + + if ret != 0 { + return err + } + + return nil +} + +// MetricDirection gets the direction in human readable string format +func MetricDirection(dir uint8) string { + if desc, ok := direction[dir]; ok { + return desc + } + return direction[dirUnknown] +} + +// DirectionString gets the direction in human readable string format +func (k *MetricsKey) DirectionString() string { + // The direction field is a 2-bit field in the C struct, so mask the lower 2 bits + direction := k.Direction & 0x03 + return MetricDirection(direction) +} + +// String returns the key in human readable string format +func (k *MetricsKey) String() string { + return fmt.Sprintf("Direction: %s, Reason: %s", k.DirectionString(), k.DropForwardReason()) +} + +// DropForwardReason gets the forwarded/dropped reason in human readable string format +func (k *MetricsKey) DropForwardReason() string { + if k.Reason == DropPacketMonitor { + return k.DropPacketMonitorReason() + } + return DropReason(k.Reason) +} + +// DropPacketMonitorReason gets the Packer Monitor dropped reason in human readable string format +func (k *MetricsKey) DropPacketMonitorReason() string { + if k.Reason == DropPacketMonitor { + return DropReasonExt(k.Reason, uint32(k.ExtendedReason)) + } + panic("The reason is not DropPacketMonitor") +} + +// IsDrop checks if the reason is drop or not. +func (k *MetricsKey) IsDrop() bool { + return k.Reason == DropInvalid || k.Reason >= DropMin +} + +// IsIngress checks if the direction is ingress or not. +func (k *MetricsKey) IsIngress() bool { + // The direction field is a 2-bit field in the C struct, so mask the lower 2 bits + direction := k.Direction & 0x03 + return direction == dirIngress +} + +// IsEgress checks if the direction is egress or not. +func (k *MetricsKey) IsEgress() bool { + // The direction field is a 2-bit field in the C struct, so mask the lower 2 bits + direction := k.Direction & 0x03 + return direction == dirEgress +} + +func GetLostEventsCount() (uint64, error) { + ret, _, err := lostEventCount.Call() + if err != nil && err != syscall.Errno(0) { + return 0, fmt.Errorf("RetinaGetLostEventsCount call failed: %w", err) + } + return uint64(ret), nil +} diff --git a/pkg/plugin/ebpfwindows/parser_windows.go b/pkg/plugin/ebpfwindows/parser_windows.go new file mode 100644 index 0000000000..06cc5b8280 --- /dev/null +++ b/pkg/plugin/ebpfwindows/parser_windows.go @@ -0,0 +1,659 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright Authors of Hubble + +package ebpfwindows + +import ( + errorTypes "errors" + "fmt" + "log/slog" + "math" + "net/netip" + "strings" + + pb "github.com/cilium/cilium/api/v1/flow" + v1 "github.com/cilium/cilium/pkg/hubble/api/v1" + observerTypes "github.com/cilium/cilium/pkg/hubble/observer/types" + "github.com/cilium/cilium/pkg/hubble/parser/errors" + "github.com/cilium/cilium/pkg/lock" + monitorAPI "github.com/cilium/cilium/pkg/monitor/api" + "github.com/gopacket/gopacket" + "github.com/gopacket/gopacket/layers" + "go4.org/netipx" + "google.golang.org/protobuf/types/known/timestamppb" + "google.golang.org/protobuf/types/known/wrapperspb" +) + +const MaxInt = int(^uint(0) >> 1) +const MessageTypePktmonDrop = 100 + +type PktmonPacketType uint8 + +// pktmon packet types +const ( + PktMonPayloadUnknown PktmonPacketType = iota + PktMonPayloadEthernet + PktMonPayloadWiFi + PktMonPayloadIP + PktMonPayloadHTTP + PktMonPayloadTCP + PktMonPayloadUDP + PktMonPayloadARP + PktMonPayloadICMP + PktMonPayloadESP + PktMonPayloadAH + PktMonPayloadL4Payload +) + +// Parser is a parser for L3/L4 payloads +type Parser struct { + log *slog.Logger + epResolver *EndpointResolver + packet *packet +} + +var ( + errDataOffsetTooLarge = errorTypes.New("data offset too large") + errNotEnoughBytes = errorTypes.New("not enough bytes to decode") + errDropReasonOverflow = errorTypes.New("drop reason exceeds int32 range") +) + +// re-usable packet to avoid reallocating gopacket datastructures +type packet struct { + lock.Mutex + decLayerL2Dev *gopacket.DecodingLayerParser + decLayerL3Dev struct { + IPv4 *gopacket.DecodingLayerParser + IPv6 *gopacket.DecodingLayerParser + } + + Layers []gopacket.LayerType + layers.Ethernet + layers.IPv4 + layers.IPv6 + layers.ICMPv4 + layers.ICMPv6 + layers.TCP + layers.UDP + layers.SCTP +} + +// New returns a new L3/L4 parser +func NewParser( + log *slog.Logger, +) (*Parser, error) { + packet := &packet{} + decoders := []gopacket.DecodingLayer{ + &packet.Ethernet, + &packet.IPv4, &packet.IPv6, + &packet.ICMPv4, &packet.ICMPv6, + &packet.TCP, &packet.UDP, &packet.SCTP, + } + packet.decLayerL2Dev = gopacket.NewDecodingLayerParser(layers.LayerTypeEthernet, decoders...) + packet.decLayerL3Dev.IPv4 = gopacket.NewDecodingLayerParser(layers.LayerTypeIPv4, decoders...) + packet.decLayerL3Dev.IPv6 = gopacket.NewDecodingLayerParser(layers.LayerTypeIPv6, decoders...) + // Let packet.decLayer.DecodeLayers return a nil error when it + // encounters a layer it doesn't have a parser for, instead of returning + // an UnsupportedLayerType error. + packet.decLayerL2Dev.IgnoreUnsupported = true + packet.decLayerL3Dev.IPv4.IgnoreUnsupported = true + packet.decLayerL3Dev.IPv6.IgnoreUnsupported = true + + return &Parser{ + log: log, + epResolver: NewEndpointResolver(log), + packet: packet, + }, nil +} + +// Decode decodes a cilium monitor 'payload' and returns a v1.Event with +// the Event field populated. +func (p *Parser) Decode(monitorEvent *observerTypes.MonitorEvent) (*v1.Event, error) { + if monitorEvent == nil { + return nil, errors.ErrEmptyData + } + + // TODO: Pool decoded flows instead of allocating new objects each time. + ts := timestamppb.New(monitorEvent.Timestamp) + ev := &v1.Event{ + Timestamp: ts, + } + + switch payload := monitorEvent.Payload.(type) { + case *observerTypes.PerfEvent: + if len(payload.Data) == 0 { + return nil, errors.ErrEmptyData + } + + flow := &pb.Flow{} + switch payload.Data[0] { + case monitorAPI.MessageTypeDebug: + return nil, errors.ErrUnknownEventType + case monitorAPI.MessageTypeTraceSock: + return nil, errors.ErrUnknownEventType + default: + if err := p.decode(payload.Data, flow); err != nil { + return nil, err + } + } + flow.Uuid = monitorEvent.UUID.String() + // FIXME: Time and NodeName are now part of GetFlowsResponse. We + // populate these fields for compatibility with old clients. + flow.Time = ts + flow.NodeName = monitorEvent.NodeName + ev.Event = flow + return ev, nil + case nil: + return ev, errors.ErrEmptyData + default: + return nil, errors.ErrUnknownEventType + } +} + +// Decode decodes the data from 'data' into 'decoded' +func (p *Parser) decode(data []byte, decoded *pb.Flow) error { + if len(data) == 0 { + return errors.ErrEmptyData + } + + eventType := data[0] + + var packetOffset int + var offset uint + var dn *DropNotify + var tn *TraceNotify + var eventSubType uint32 + var authType pb.AuthType + var pdn *PktmonDropNotify + + switch eventType { + case monitorAPI.MessageTypeDrop: + dn = &DropNotify{} + if err := DecodeDropNotify(data, dn); err != nil { + return fmt.Errorf("failed to parse drop: %w", err) + } + eventSubType = uint32(dn.SubType) + offset = dn.DataOffset() + if offset > uint(MaxInt) { + return fmt.Errorf("%w: %d", errDataOffsetTooLarge, offset) + } + packetOffset = int(offset) + case monitorAPI.MessageTypeTrace: + tn = &TraceNotify{} + if err := DecodeTraceNotify(data, tn); err != nil { + return fmt.Errorf("failed to parse trace: %w", err) + } + eventSubType = uint32(tn.ObsPoint) + + if tn.ObsPoint != 0 { + decoded.TraceObservationPoint = pb.TraceObservationPoint(tn.ObsPoint) + } else { + // specifically handle the zero value in the observation enum so the json + // export and the API don't carry extra meaning with the zero value + decoded.TraceObservationPoint = pb.TraceObservationPoint_TO_ENDPOINT + } + + offset = tn.DataOffset() + if offset > uint(MaxInt) { + return fmt.Errorf("%w: %d", errDataOffsetTooLarge, offset) + } + + packetOffset = int(offset) + + case MessageTypePktmonDrop: + pdn = &PktmonDropNotify{} + if err := DecodePktmonDrop(data, pdn); err != nil { + return fmt.Errorf("failed to parse pktmon drop: %w", err) + } + offset = pdn.DataOffset() + + // Second highest bit is set for pktmon drop reasons to avoid overlap with cilium drop reasons. + // Note: The highest bit cannot be used because the protoc compiler gives an "integer out of range" error + // when compiling proto files with enum values that have the highest bit set. + eventSubType = pdn.PktmonHeader.Metadata.DropReason | (1 << 30) + if offset > uint(MaxInt) { + return fmt.Errorf("%w: %d", errDataOffsetTooLarge, offset) + } + packetOffset = int(offset) + + default: + return fmt.Errorf("invalid event type: %w", errors.NewErrInvalidType(eventType)) + } + + if len(data) < packetOffset { + return fmt.Errorf("%w: %d", errNotEnoughBytes, data) + } + + p.packet.Lock() + defer p.packet.Unlock() + + // Since v1.1.18, DecodeLayers returns a non-nil error for an empty packet, see + // https://github.com/google/gopacket/issues/846 + // TODO: reconsider this check if the issue is fixed upstream + if len(data[packetOffset:]) > 0 { + + var err error + if pdn != nil { + switch pdn.PktmonHeader.Metadata.PacketType { + case uint16(PktMonPayloadEthernet): + err = p.packet.decLayerL2Dev.DecodeLayers(data[packetOffset:], &p.packet.Layers) + case uint16(PktMonPayloadIP): + switch data[packetOffset] >> 4 { + case 0x4: + err = p.packet.decLayerL3Dev.IPv4.DecodeLayers(data[packetOffset:], &p.packet.Layers) + case 0x6: + err = p.packet.decLayerL3Dev.IPv6.DecodeLayers(data[packetOffset:], &p.packet.Layers) + default: + return fmt.Errorf("decode layers failed for unsupported IP packet type starting with %d, data: %v", data[packetOffset], data[packetOffset:]) + } + default: + return fmt.Errorf("decode layers failed for unsupported packet type %d, data: %v", pdn.PktmonHeader.Metadata.PacketType, data[packetOffset:]) + } + } else { + var isL3Device, isIPv6 bool + if (tn != nil && tn.IsL3Device()) || (dn != nil && dn.IsL3Device()) { + isL3Device = true + } + if tn != nil && tn.IsIPv6() || (dn != nil && dn.IsIPv6()) { + isIPv6 = true + } + switch { + case !isL3Device: + err = p.packet.decLayerL2Dev.DecodeLayers(data[packetOffset:], &p.packet.Layers) + case isIPv6: + err = p.packet.decLayerL3Dev.IPv6.DecodeLayers(data[packetOffset:], &p.packet.Layers) + default: + err = p.packet.decLayerL3Dev.IPv4.DecodeLayers(data[packetOffset:], &p.packet.Layers) + } + } + + if err != nil { + return fmt.Errorf("decode layers failed: %w", err) + } + } else { + // Truncate layers to avoid accidental re-use. + p.packet.Layers = p.packet.Layers[:0] + } + + decodedpacket := decodeLayers(p.packet) + srcIP := decodedpacket.SourceIP + ip := decodedpacket.IP + + if tn != nil && decodedpacket.IP != nil { + if !tn.OriginalIP().IsUnspecified() { + // Ignore invalid IP - getters will handle invalid value. + srcIP, _ = netipx.FromStdIP(tn.OriginalIP()) + // On SNAT the trace notification has OrigIP set to the pre + // translation IP and the source IP parsed from the header is the + // post translation IP. The check is here because sometimes we get + // trace notifications with OrigIP set to the header's IP + // (pre-translation events?) + if ip.GetSource() != srcIP.String() { + ip.SourceXlated = ip.GetSource() + ip.Source = srcIP.String() + } + } + + ip.Encrypted = tn.IsEncrypted() + } + + srcLabelID, dstLabelID := decodeSecurityIdentities(dn, tn) + datapathContext := DatapathContext{ + SrcIP: srcIP, + SrcLabelID: srcLabelID, + DstIP: decodedpacket.DestinationIP, + DstLabelID: dstLabelID, + TraceObservationPoint: decoded.GetTraceObservationPoint(), + } + srcEndpoint := p.epResolver.ResolveEndpoint(srcIP, srcLabelID, datapathContext) + dstEndpoint := p.epResolver.ResolveEndpoint(decodedpacket.DestinationIP, dstLabelID, datapathContext) + + decoded.Verdict = decodeVerdict(dn, tn, pdn) + decoded.AuthType = authType + //nolint:staticcheck // SA1019 - temporary assignment for backward compatibility + decoded.DropReason = decodeDropReason(dn, pdn) + //nolint:staticcheck // SA1019 - temporary assignment for backward compatibility + dropReason := decoded.GetDropReason() + if dropReason > math.MaxInt32 { + return fmt.Errorf("%w: %d", errDropReasonOverflow, dropReason) + } + decoded.DropReasonDesc = pb.DropReason(int32(dropReason)) + decoded.File = decodeFileInfo(dn) + decoded.Ethernet = decodedpacket.Ethernet + decoded.IP = decodedpacket.IP + decoded.L4 = decodedpacket.L4 + decoded.Source = srcEndpoint + decoded.Destination = dstEndpoint + decoded.Type = pb.FlowType_L3_L4 + decoded.L7 = nil + decoded.IsReply = decodeIsReply(tn) + //nolint:staticcheck // SA1019 - temporary assignment for backward compatibility + decoded.Reply = decoded.GetIsReply().GetValue() // false if GetIsReply() is nil + decoded.EventType = decodeCiliumEventType(eventType, eventSubType) + decoded.TraceReason = decodeTraceReason(tn) + decoded.Interface = p.decodeNetworkInterface(tn) + decoded.ProxyPort = decodeProxyPort(tn) + //nolint:staticcheck // SA1019 - temporary assignment for backward compatibility + decoded.Summary = decodedpacket.Summary + + return nil +} + +type DecodedPacket struct { + Ethernet *pb.Ethernet + IP *pb.IP + L4 *pb.Layer4 + SourceIP netip.Addr + DestinationIP netip.Addr + SourcePort uint16 + DestinationPort uint16 + Summary string +} + +func decodeLayers(packet *packet) *DecodedPacket { + var ( + ethernet *pb.Ethernet + ip *pb.IP + l4 *pb.Layer4 + sourceIP netip.Addr + destinationIP netip.Addr + sourcePort uint16 + destinationPort uint16 + summary string + ) + + for _, typ := range packet.Layers { + summary = typ.String() + switch typ { + case layers.LayerTypeEthernet: + ethernet = decodeEthernet(&packet.Ethernet) + case layers.LayerTypeIPv4: + ip, sourceIP, destinationIP = decodeIPv4(&packet.IPv4) + case layers.LayerTypeIPv6: + ip, sourceIP, destinationIP = decodeIPv6(&packet.IPv6) + case layers.LayerTypeTCP: + l4, sourcePort, destinationPort = decodeTCP(&packet.TCP) + summary = "TCP Flags: " + getTCPFlags(packet.TCP) + case layers.LayerTypeUDP: + l4, sourcePort, destinationPort = decodeUDP(&packet.UDP) + case layers.LayerTypeSCTP: + l4, sourcePort, destinationPort = decodeSCTP(&packet.SCTP) + case layers.LayerTypeICMPv4: + l4 = decodeICMPv4(&packet.ICMPv4) + summary = "ICMPv4 " + packet.ICMPv4.TypeCode.String() + case layers.LayerTypeICMPv6: + l4 = decodeICMPv6(&packet.ICMPv6) + summary = "ICMPv6 " + packet.ICMPv6.TypeCode.String() + } + } + + return &DecodedPacket{ + Ethernet: ethernet, + IP: ip, + L4: l4, + SourceIP: sourceIP, + DestinationIP: destinationIP, + SourcePort: sourcePort, + DestinationPort: destinationPort, + Summary: summary, + } +} + +func decodeVerdict(dn *DropNotify, tn *TraceNotify, pdn *PktmonDropNotify) pb.Verdict { + switch { + case dn != nil || pdn != nil: + return pb.Verdict_DROPPED + case tn != nil: + return pb.Verdict_FORWARDED + } + return pb.Verdict_VERDICT_UNKNOWN +} + +func decodeDropReason(dn *DropNotify, pdn *PktmonDropNotify) uint32 { + if dn != nil { + return uint32(dn.SubType) + } + if pdn != nil { + return uint32(pdn.PktmonHeader.Metadata.DropReason) + } + return 0 +} + +func decodeFileInfo(dn *DropNotify) *pb.FileInfo { + if dn != nil { + return &pb.FileInfo{ + Name: monitorAPI.BPFFileName(dn.File), + Line: uint32(dn.Line), + } + } + return nil +} + +func decodeEthernet(ethernet *layers.Ethernet) *pb.Ethernet { + return &pb.Ethernet{ + Source: ethernet.SrcMAC.String(), + Destination: ethernet.DstMAC.String(), + } +} + +func decodeIPv4(ipv4 *layers.IPv4) (ip *pb.IP, src, dst netip.Addr) { + // Ignore invalid IPs - getters will handle invalid values. + // IPs can be empty for Ethernet-only packets. + src, _ = netipx.FromStdIP(ipv4.SrcIP) + dst, _ = netipx.FromStdIP(ipv4.DstIP) + return &pb.IP{ + Source: ipv4.SrcIP.String(), + Destination: ipv4.DstIP.String(), + IpVersion: pb.IPVersion_IPv4, + }, src, dst +} + +func decodeIPv6(ipv6 *layers.IPv6) (ip *pb.IP, src, dst netip.Addr) { + // Ignore invalid IPs - getters will handle invalid values. + // IPs can be empty for Ethernet-only packets. + src, _ = netipx.FromStdIP(ipv6.SrcIP) + dst, _ = netipx.FromStdIP(ipv6.DstIP) + return &pb.IP{ + Source: ipv6.SrcIP.String(), + Destination: ipv6.DstIP.String(), + IpVersion: pb.IPVersion_IPv6, + }, src, dst +} + +func decodeTCP(tcp *layers.TCP) (l4 *pb.Layer4, src, dst uint16) { + return &pb.Layer4{ + Protocol: &pb.Layer4_TCP{ + TCP: &pb.TCP{ + SourcePort: uint32(tcp.SrcPort), + DestinationPort: uint32(tcp.DstPort), + Flags: &pb.TCPFlags{ + FIN: tcp.FIN, SYN: tcp.SYN, RST: tcp.RST, + PSH: tcp.PSH, ACK: tcp.ACK, URG: tcp.URG, + ECE: tcp.ECE, CWR: tcp.CWR, NS: tcp.NS, + }, + }, + }, + }, uint16(tcp.SrcPort), uint16(tcp.DstPort) +} + +func decodeSCTP(sctp *layers.SCTP) (l4 *pb.Layer4, src, dst uint16) { + return &pb.Layer4{ + Protocol: &pb.Layer4_SCTP{ + SCTP: &pb.SCTP{ + SourcePort: uint32(sctp.SrcPort), + DestinationPort: uint32(sctp.DstPort), + }, + }, + }, uint16(sctp.SrcPort), uint16(sctp.DstPort) +} + +func decodeUDP(udp *layers.UDP) (l4 *pb.Layer4, src, dst uint16) { + return &pb.Layer4{ + Protocol: &pb.Layer4_UDP{ + UDP: &pb.UDP{ + SourcePort: uint32(udp.SrcPort), + DestinationPort: uint32(udp.DstPort), + }, + }, + }, uint16(udp.SrcPort), uint16(udp.DstPort) +} + +func decodeICMPv4(icmp *layers.ICMPv4) *pb.Layer4 { + return &pb.Layer4{ + Protocol: &pb.Layer4_ICMPv4{ICMPv4: &pb.ICMPv4{ + Type: uint32(icmp.TypeCode.Type()), + Code: uint32(icmp.TypeCode.Code()), + }}, + } +} + +func decodeICMPv6(icmp *layers.ICMPv6) *pb.Layer4 { + return &pb.Layer4{ + Protocol: &pb.Layer4_ICMPv6{ICMPv6: &pb.ICMPv6{ + Type: uint32(icmp.TypeCode.Type()), + Code: uint32(icmp.TypeCode.Code()), + }}, + } +} + +func decodeIsReply(tn *TraceNotify) *wrapperspb.BoolValue { + switch { + case tn != nil && tn.TraceReasonIsKnown(): + if tn.TraceReasonIsEncap() || tn.TraceReasonIsDecap() { + return nil + } + // Reason was specified by the datapath, just reuse it. + return &wrapperspb.BoolValue{ + Value: tn.TraceReasonIsReply(), + } + default: + // For other events, such as drops, we simply do not know if they were + // replies or not. + return nil + } +} + +func decodeCiliumEventType(eventType uint8, eventSubType uint32) *pb.CiliumEventType { + return &pb.CiliumEventType{ + Type: int32(eventType), + SubType: int32(eventSubType), + } +} + +func decodeTraceReason(tn *TraceNotify) pb.TraceReason { + if tn == nil { + return pb.TraceReason_TRACE_REASON_UNKNOWN + } + // The Hubble protobuf enum values aren't 1:1 mapped with Cilium's datapath + // because we want pb.TraceReason_TRACE_REASON_UNKNOWN = 0 while in + // datapath monitor.TraceReasonUnknown = 5. The mapping works as follow: + switch { + // monitor.TraceReasonUnknown is mapped to pb.TraceReason_TRACE_REASON_UNKNOWN + case tn.TraceReason() == TraceReasonUnknown: + return pb.TraceReason_TRACE_REASON_UNKNOWN + // values before monitor.TraceReasonUnknown are "offset by one", e.g. + // TraceReasonCtEstablished = 1 → TraceReason_ESTABLISHED = 2 to make room + // for the zero value. + case tn.TraceReason() < TraceReasonUnknown: + return pb.TraceReason(tn.TraceReason()) + 1 + // all values greater than monitor.TraceReasonUnknown are mapped 1:1 with + // the datapath values. + default: + return pb.TraceReason(tn.TraceReason()) + } +} + +func decodeSecurityIdentities(dn *DropNotify, tn *TraceNotify) ( + sourceSecurityIdentiy, destinationSecurityIdentity uint32, +) { + switch { + case dn != nil: + sourceSecurityIdentiy = uint32(dn.SrcLabel) + destinationSecurityIdentity = uint32(dn.DstLabel) + case tn != nil: + sourceSecurityIdentiy = uint32(tn.SrcLabel) + destinationSecurityIdentity = uint32(tn.DstLabel) + } + + return +} + +func getTCPFlags(tcp layers.TCP) string { + const ( + syn = "SYN" + ack = "ACK" + rst = "RST" + fin = "FIN" + psh = "PSH" + urg = "URG" + ece = "ECE" + cwr = "CWR" + ns = "NS" + maxTCPFlags = 9 + comma = ", " + ) + + info := make([]string, 0, maxTCPFlags) + + if tcp.SYN { + info = append(info, syn) + } + + if tcp.ACK { + info = append(info, ack) + } + + if tcp.RST { + info = append(info, rst) + } + + if tcp.FIN { + info = append(info, fin) + } + + if tcp.PSH { + info = append(info, psh) + } + + if tcp.URG { + info = append(info, urg) + } + + if tcp.ECE { + info = append(info, ece) + } + + if tcp.CWR { + info = append(info, cwr) + } + + if tcp.NS { + info = append(info, ns) + } + + return strings.Join(info, comma) +} + +func (p *Parser) decodeNetworkInterface(tn *TraceNotify) *pb.NetworkInterface { + ifIndex := uint32(0) + if tn != nil { + ifIndex = tn.Ifindex + } + + if ifIndex == 0 { + return nil + } + + var name string + return &pb.NetworkInterface{ + Index: ifIndex, + Name: name, + } +} + +func decodeProxyPort(tn *TraceNotify) uint32 { + if tn != nil && tn.ObsPoint == monitorAPI.TraceToProxy { + return uint32(tn.DstID) + } + return 0 +} diff --git a/pkg/plugin/hnsstats/hnsstats_windows.go b/pkg/plugin/hnsstats/hnsstats_windows.go index dd93db438f..b376ac4e54 100644 --- a/pkg/plugin/hnsstats/hnsstats_windows.go +++ b/pkg/plugin/hnsstats/hnsstats_windows.go @@ -7,6 +7,7 @@ package hnsstats import ( "context" "encoding/json" + "fmt" "time" "github.com/Microsoft/hcsshim" @@ -15,6 +16,7 @@ import ( kcfg "github.com/microsoft/retina/pkg/config" "github.com/microsoft/retina/pkg/log" "github.com/microsoft/retina/pkg/metrics" + plugincommon "github.com/microsoft/retina/pkg/plugin/common" "github.com/microsoft/retina/pkg/plugin/registry" "github.com/microsoft/retina/pkg/utils" "go.uber.org/zap" @@ -210,7 +212,22 @@ func notifyHnsStats(h *hnsstats, stats *HnsStatsData) { func (h *hnsstats) Start(ctx context.Context) error { h.l.Info("Start hnsstats plugin...") + h.state = start + + ciliumEnabled, err := plugincommon.IsCiliumOnWindowsEnabled() + + if err != nil { + h.l.Error("Error while checking if Cilium is enabled on Windows", zap.Error(err)) + return fmt.Errorf("Failed to check if Cilium is enabled on Windows: %w", err) + } + + if ciliumEnabled { + h.l.Warn("Cilium is enabled on Windows, skipping hnsstats plugin initialization") + return nil + } + + h.l.Info("Cilium is not enabled on Windows, proceeding with hnsstats plugin initialization") return pullHnsStats(ctx, h) } diff --git a/pkg/plugin/include_windows.go b/pkg/plugin/include_windows.go index 1cbb240eca..06c0c758fa 100644 --- a/pkg/plugin/include_windows.go +++ b/pkg/plugin/include_windows.go @@ -3,6 +3,7 @@ package plugin // Plugins self-register via their init() funcs as long as they are imported. import ( + _ "github.com/microsoft/retina/pkg/plugin/ebpfwindows" _ "github.com/microsoft/retina/pkg/plugin/hnsstats" _ "github.com/microsoft/retina/pkg/plugin/pktmon" ) diff --git a/pkg/utils/metadata_windows.pb.go b/pkg/utils/metadata_windows.pb.go index c6b45e6dfb..625e4890a4 100644 --- a/pkg/utils/metadata_windows.pb.go +++ b/pkg/utils/metadata_windows.pb.go @@ -7,10 +7,12 @@ package utils import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" reflect "reflect" sync "sync" + unsafe "unsafe" + + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" ) const ( @@ -72,1236 +74,1487 @@ func (DNSType) EnumDescriptor() ([]byte, []int) { type DropReason int32 const ( - DropReason_Drop_Unknown DropReason = 0 - DropReason_Drop_InvalidData DropReason = 1 - DropReason_Drop_InvalidPacket DropReason = 2 - DropReason_Drop_Resources DropReason = 3 - DropReason_Drop_NotReady DropReason = 4 - DropReason_Drop_Disconnected DropReason = 5 - DropReason_Drop_NotAccepted DropReason = 6 - DropReason_Drop_Busy DropReason = 7 - DropReason_Drop_Filtered DropReason = 8 - DropReason_Drop_FilteredVLAN DropReason = 9 - DropReason_Drop_UnauthorizedVLAN DropReason = 10 - DropReason_Drop_UnauthorizedMAC DropReason = 11 - DropReason_Drop_FailedSecurityPolicy DropReason = 12 - DropReason_Drop_FailedPvlanSetting DropReason = 13 - DropReason_Drop_Qos DropReason = 14 - DropReason_Drop_Ipsec DropReason = 15 - DropReason_Drop_MacSpoofing DropReason = 16 - DropReason_Drop_DhcpGuard DropReason = 17 - DropReason_Drop_RouterGuard DropReason = 18 - DropReason_Drop_BridgeReserved DropReason = 19 - DropReason_Drop_VirtualSubnetId DropReason = 20 - DropReason_Drop_RequiredExtensionMissing DropReason = 21 - DropReason_Drop_InvalidConfig DropReason = 22 - DropReason_Drop_MTUMismatch DropReason = 23 - DropReason_Drop_NativeFwdingReq DropReason = 24 - DropReason_Drop_InvalidVlanFormat DropReason = 25 - DropReason_Drop_InvalidDestMac DropReason = 26 - DropReason_Drop_InvalidSourceMac DropReason = 27 - DropReason_Drop_InvalidFirstNBTooSmall DropReason = 28 - DropReason_Drop_Wnv DropReason = 29 - DropReason_Drop_StormLimit DropReason = 30 - DropReason_Drop_InjectedIcmp DropReason = 31 - DropReason_Drop_FailedDestinationListUpdate DropReason = 32 - DropReason_Drop_NicDisabled DropReason = 33 - DropReason_Drop_FailedPacketFilter DropReason = 34 - DropReason_Drop_SwitchDataFlowDisabled DropReason = 35 - DropReason_Drop_FilteredIsolationUntagged DropReason = 36 - DropReason_Drop_InvalidPDQueue DropReason = 37 - DropReason_Drop_LowPower DropReason = 38 + // Cilium drop reasons + DropReason_Reason_Success DropReason = 0 + DropReason_Reason_InvalidPacket DropReason = 2 + DropReason_Reason_PlainText DropReason = 3 + DropReason_Reason_InterfaceDecrypted DropReason = 4 + DropReason_Reason_LbNoBackendSlot DropReason = 5 + DropReason_Reason_LbNoBackend DropReason = 6 + DropReason_Reason_LbReverseNatUpdate DropReason = 7 + DropReason_Resaon_LbReverseNatStale DropReason = 8 + DropReason_Reason_FragmentedPacket DropReason = 9 + DropReason_Reason_FragmentedPacketUpdated DropReason = 10 + DropReason_Reason_MissedCustomCall DropReason = 11 + DropReason_DropReason_InvalidSIP DropReason = 132 + DropReason_DropReason_Policy DropReason = 133 + DropReason_DropReason_Invalid DropReason = 134 + DropReason_DropReason_CTInvalidHdr DropReason = 135 + DropReason_DropReason_FragNeeded DropReason = 136 + DropReason_DropReason_CTUnknownProto DropReason = 137 + DropReason_DropReason_UnknownL3 DropReason = 138 + DropReason_DropReason_MissedTailCall DropReason = 139 + DropReason_DropReason_WriteError DropReason = 140 + DropReason_DropReason_UnknownL4 DropReason = 141 + DropReason_DropReason_UnknownICMPCode DropReason = 142 + DropReason_DropReason_UnknownICMPType DropReason = 143 + DropReason_DropReason_UnknownICMP6Code DropReason = 144 + DropReason_DropReason_UnknownICMP6Type DropReason = 145 + DropReason_DropReason_UnknownICMP6Type_2 DropReason = 146 + DropReason_DropReason_NoTunnelKey DropReason = 147 + DropReason_DropReason_Unknown_1 DropReason = 148 + DropReason_DropReason_Unknown_2 DropReason = 149 + DropReason_DropReason_UnknownTarget DropReason = 150 + DropReason_DropReason_Unroutable DropReason = 151 + DropReason_DropReason_Unknown_3 DropReason = 152 + DropReason_DropReason_CSUM_L3 DropReason = 153 + DropReason_DropReason_CSUM_L4 DropReason = 154 + DropReason_DropReason_CTCreateFailed DropReason = 155 + DropReason_DropReason_InvalidExthdr DropReason = 156 + DropReason_DropReason_FragNoSupport DropReason = 157 + DropReason_DropReason_NoService DropReason = 158 + DropReason_DropReason_UnsuppServiceProto DropReason = 159 + DropReason_DropReason_NoTunnelEndpoint DropReason = 160 + DropReason_DropReason_NAT46X64Disabled DropReason = 161 + DropReason_DropReason_EDTHorizon DropReason = 162 + DropReason_DropReason_UnknownCT DropReason = 163 + DropReason_DropReason_HostUnreachable DropReason = 164 + DropReason_DropReason_NoConfig DropReason = 165 + DropReason_DropReason_UnsupportedL2 DropReason = 166 + DropReason_DropReason_NatNoMapping DropReason = 167 + DropReason_DropReason_NatUnsuppProto DropReason = 168 + DropReason_DropReason_NoFIB DropReason = 169 + DropReason_DropReason_EncapProhibited DropReason = 170 + DropReason_DropReason_InvalidIdentity DropReason = 171 + DropReason_DropReason_UnknownSender DropReason = 172 + DropReason_DropReason_NatNotNeeded DropReason = 173 + DropReason_DropReason_IsClusterIP DropReason = 174 + DropReason_DropReason_FragNotFound DropReason = 175 + DropReason_DropReason_ForbiddenICMP6 DropReason = 176 + DropReason_DropReason_NotInSrcRange DropReason = 177 + DropReason_DropReason_ProxyLookupFailed DropReason = 178 + DropReason_DropReason_ProxySetFailed DropReason = 179 + DropReason_DropReason_ProxyUnknownProto DropReason = 180 + DropReason_DropReason_PolicyDeny DropReason = 181 + DropReason_DropReason_VlanFiltered DropReason = 182 + DropReason_DropReason_InvalidVNI DropReason = 183 + DropReason_DropReason_InvalidTCBuffer DropReason = 184 + DropReason_DropReason_NoSID DropReason = 185 + DropReason_DropReason_MissingSRv6State DropReason = 186 + DropReason_DropReason_NAT46 DropReason = 187 + DropReason_DropReason_NAT64 DropReason = 188 + DropReason_DropReason_PolicyAuthRequired DropReason = 189 + DropReason_DropReason_CTNoMapFound DropReason = 190 + DropReason_DropReason_SNATNoMapFound DropReason = 191 + DropReason_DropReason_InvalidClusterID DropReason = 192 + DropReason_DropReason_DSR_ENCAP_UNSUPP_PROTO DropReason = 193 + DropReason_DropReason_NoEgressGateway DropReason = 194 + DropReason_DropReason_UnencryptedTraffic DropReason = 195 + DropReason_DropReason_TTLExceeded DropReason = 196 + DropReason_DropReason_NoNodeID DropReason = 197 + DropReason_DropReason_RateLimited DropReason = 198 + DropReason_DropReason_IGMPHandled DropReason = 199 + DropReason_DropReason_IGMPSubscribed DropReason = 200 + DropReason_DropReason_MulticastHandled DropReason = 201 + DropReason_DropReason_HostNotReady DropReason = 202 + DropReason_DropReason_EpNotReady DropReason = 203 + DropReason_DropReason_PacketMonitor DropReason = 220 + // Matching VMS_PACKET_DROP_REASON + DropReason_Drop_InvalidData DropReason = 1073741825 + DropReason_Drop_InvalidPacket DropReason = 1073741826 + DropReason_Drop_Resources DropReason = 1073741827 + DropReason_Drop_NotReady DropReason = 1073741828 + DropReason_Drop_Disconnected DropReason = 1073741829 + DropReason_Drop_NotAccepted DropReason = 1073741830 + DropReason_Drop_Busy DropReason = 1073741831 + DropReason_Drop_Filtered DropReason = 1073741832 + DropReason_Drop_FilteredVLAN DropReason = 1073741833 + DropReason_Drop_UnauthorizedVLAN DropReason = 1073741834 + DropReason_Drop_UnauthorizedMAC DropReason = 1073741835 + DropReason_Drop_FailedSecurityPolicy DropReason = 1073741836 + DropReason_Drop_FailedPvlanSetting DropReason = 1073741837 + DropReason_Drop_Qos DropReason = 1073741838 + DropReason_Drop_Ipsec DropReason = 1073741839 + DropReason_Drop_MacSpoofing DropReason = 1073741840 + DropReason_Drop_DhcpGuard DropReason = 1073741841 + DropReason_Drop_RouterGuard DropReason = 1073741842 + DropReason_Drop_BridgeReserved DropReason = 1073741843 + DropReason_Drop_VirtualSubnetId DropReason = 1073741844 + DropReason_Drop_RequiredExtensionMissing DropReason = 1073741845 + DropReason_Drop_InvalidConfig DropReason = 1073741846 + DropReason_Drop_MTUMismatch DropReason = 1073741847 + DropReason_Drop_NativeFwdingReq DropReason = 1073741848 + DropReason_Drop_InvalidVlanFormat DropReason = 1073741849 + DropReason_Drop_InvalidDestMac DropReason = 1073741850 + DropReason_Drop_InvalidSourceMac DropReason = 1073741851 + DropReason_Drop_InvalidFirstNBTooSmall DropReason = 1073741852 + DropReason_Drop_Wnv DropReason = 1073741853 + DropReason_Drop_StormLimit DropReason = 1073741854 + DropReason_Drop_InjectedIcmp DropReason = 1073741855 + DropReason_Drop_FailedDestinationListUpdate DropReason = 1073741856 + DropReason_Drop_NicDisabled DropReason = 1073741857 + DropReason_Drop_FailedPacketFilter DropReason = 1073741858 + DropReason_Drop_SwitchDataFlowDisabled DropReason = 1073741859 + DropReason_Drop_FilteredIsolationUntagged DropReason = 1073741860 + DropReason_Drop_InvalidPDQueue DropReason = 1073741861 + DropReason_Drop_LowPower DropReason = 1073741862 // General errors - DropReason_Drop_Pause DropReason = 201 - DropReason_Drop_Reset DropReason = 202 - DropReason_Drop_SendAborted DropReason = 203 - DropReason_Drop_ProtocolNotBound DropReason = 204 - DropReason_Drop_Failure DropReason = 205 - DropReason_Drop_InvalidLength DropReason = 206 - DropReason_Drop_HostOutOfMemory DropReason = 207 - DropReason_Drop_FrameTooLong DropReason = 208 - DropReason_Drop_FrameTooShort DropReason = 209 - DropReason_Drop_FrameLengthError DropReason = 210 - DropReason_Drop_CrcError DropReason = 211 - DropReason_Drop_BadFrameChecksum DropReason = 212 - DropReason_Drop_FcsError DropReason = 213 - DropReason_Drop_SymbolError DropReason = 214 - DropReason_Drop_HeadQTimeout DropReason = 215 - DropReason_Drop_StalledDiscard DropReason = 216 - DropReason_Drop_RxQFull DropReason = 217 - DropReason_Drop_PhysLayerError DropReason = 218 - DropReason_Drop_DmaError DropReason = 219 - DropReason_Drop_FirmwareError DropReason = 220 - DropReason_Drop_DecryptionFailed DropReason = 221 - DropReason_Drop_BadSignature DropReason = 222 - DropReason_Drop_CoalescingError DropReason = 223 - DropReason_Drop_VlanSpoofing DropReason = 225 - DropReason_Drop_UnallowedEtherType DropReason = 226 - DropReason_Drop_VportDown DropReason = 227 - DropReason_Drop_SteeringMismatch DropReason = 228 + DropReason_Drop_Pause DropReason = 1073742025 + DropReason_Drop_Reset DropReason = 1073742026 + DropReason_Drop_SendAborted DropReason = 1073742027 + DropReason_Drop_ProtocolNotBound DropReason = 1073742028 + DropReason_Drop_Failure DropReason = 1073742029 + DropReason_Drop_InvalidLength DropReason = 1073742030 + DropReason_Drop_HostOutOfMemory DropReason = 1073742031 + DropReason_Drop_FrameTooLong DropReason = 1073742032 + DropReason_Drop_FrameTooShort DropReason = 1073742033 + DropReason_Drop_FrameLengthError DropReason = 1073742034 + DropReason_Drop_CrcError DropReason = 1073742035 + DropReason_Drop_BadFrameChecksum DropReason = 1073742036 + DropReason_Drop_FcsError DropReason = 1073742037 + DropReason_Drop_SymbolError DropReason = 1073742038 + DropReason_Drop_HeadQTimeout DropReason = 1073742039 + DropReason_Drop_StalledDiscard DropReason = 1073742040 + DropReason_Drop_RxQFull DropReason = 1073742041 + DropReason_Drop_PhysLayerError DropReason = 1073742042 + DropReason_Drop_DmaError DropReason = 1073742043 + DropReason_Drop_FirmwareError DropReason = 1073742044 + DropReason_Drop_DecryptionFailed DropReason = 1073742045 + DropReason_Drop_BadSignature DropReason = 1073742046 + DropReason_Drop_CoalescingError DropReason = 1073742047 + DropReason_Drop_VlanSpoofing DropReason = 1073742049 + DropReason_Drop_UnallowedEtherType DropReason = 1073742050 + DropReason_Drop_VportDown DropReason = 1073742051 + DropReason_Drop_SteeringMismatch DropReason = 1073742052 // NetVsc errors - DropReason_Drop_MicroportError DropReason = 401 - DropReason_Drop_VfNotReady DropReason = 402 - DropReason_Drop_MicroportNotReady DropReason = 403 - DropReason_Drop_VMBusError DropReason = 404 + DropReason_Drop_MicroportError DropReason = 1073742225 + DropReason_Drop_VfNotReady DropReason = 1073742226 + DropReason_Drop_MicroportNotReady DropReason = 1073742227 + DropReason_Drop_VMBusError DropReason = 1073742228 // Tcpip FL errors - DropReason_Drop_FL_LoopbackPacket DropReason = 601 - DropReason_Drop_FL_InvalidSnapHeader DropReason = 602 - DropReason_Drop_FL_InvalidEthernetType DropReason = 603 - DropReason_Drop_FL_InvalidPacketLength DropReason = 604 - DropReason_Drop_FL_HeaderNotContiguous DropReason = 605 - DropReason_Drop_FL_InvalidDestinationType DropReason = 606 - DropReason_Drop_FL_InterfaceNotReady DropReason = 607 - DropReason_Drop_FL_ProviderNotReady DropReason = 608 - DropReason_Drop_FL_InvalidLsoInfo DropReason = 609 - DropReason_Drop_FL_InvalidUsoInfo DropReason = 610 - DropReason_Drop_FL_InvalidMedium DropReason = 611 - DropReason_Drop_FL_InvalidArpHeader DropReason = 612 - DropReason_Drop_FL_NoClientInterface DropReason = 613 - DropReason_Drop_FL_TooManyNetBuffers DropReason = 614 - DropReason_Drop_FL_FlsNpiClientDrop DropReason = 615 + DropReason_Drop_FL_LoopbackPacket DropReason = 1073742425 + DropReason_Drop_FL_InvalidSnapHeader DropReason = 1073742426 + DropReason_Drop_FL_InvalidEthernetType DropReason = 1073742427 + DropReason_Drop_FL_InvalidPacketLength DropReason = 1073742428 + DropReason_Drop_FL_HeaderNotContiguous DropReason = 1073742429 + DropReason_Drop_FL_InvalidDestinationType DropReason = 1073742430 + DropReason_Drop_FL_InterfaceNotReady DropReason = 1073742431 + DropReason_Drop_FL_ProviderNotReady DropReason = 1073742432 + DropReason_Drop_FL_InvalidLsoInfo DropReason = 1073742433 + DropReason_Drop_FL_InvalidUsoInfo DropReason = 1073742434 + DropReason_Drop_FL_InvalidMedium DropReason = 1073742435 + DropReason_Drop_FL_InvalidArpHeader DropReason = 1073742436 + DropReason_Drop_FL_NoClientInterface DropReason = 1073742437 + DropReason_Drop_FL_TooManyNetBuffers DropReason = 1073742438 + DropReason_Drop_FL_FlsNpiClientDrop DropReason = 1073742439 // VFP errors - DropReason_Drop_ArpGuard DropReason = 701 - DropReason_Drop_ArpLimiter DropReason = 702 - DropReason_Drop_DhcpLimiter DropReason = 703 - DropReason_Drop_BlockBroadcast DropReason = 704 - DropReason_Drop_BlockNonIp DropReason = 705 - DropReason_Drop_ArpFilter DropReason = 706 - DropReason_Drop_Ipv4Guard DropReason = 707 - DropReason_Drop_Ipv6Guard DropReason = 708 - DropReason_Drop_MacGuard DropReason = 709 - DropReason_Drop_BroadcastNoDestinations DropReason = 710 - DropReason_Drop_UnicastNoDestination DropReason = 711 - DropReason_Drop_UnicastPortNotReady DropReason = 712 - DropReason_Drop_SwitchCallbackFailed DropReason = 713 - DropReason_Drop_Icmpv6Limiter DropReason = 714 - DropReason_Drop_Intercept DropReason = 715 - DropReason_Drop_InterceptBlock DropReason = 716 - DropReason_Drop_NDPGuard DropReason = 717 - DropReason_Drop_PortBlocked DropReason = 718 - DropReason_Drop_NicSuspended DropReason = 719 + DropReason_Drop_ArpGuard DropReason = 1073742525 + DropReason_Drop_ArpLimiter DropReason = 1073742526 + DropReason_Drop_DhcpLimiter DropReason = 1073742527 + DropReason_Drop_BlockBroadcast DropReason = 1073742528 + DropReason_Drop_BlockNonIp DropReason = 1073742529 + DropReason_Drop_ArpFilter DropReason = 1073742530 + DropReason_Drop_Ipv4Guard DropReason = 1073742531 + DropReason_Drop_Ipv6Guard DropReason = 1073742532 + DropReason_Drop_MacGuard DropReason = 1073742533 + DropReason_Drop_BroadcastNoDestinations DropReason = 1073742534 + DropReason_Drop_UnicastNoDestination DropReason = 1073742535 + DropReason_Drop_UnicastPortNotReady DropReason = 1073742536 + DropReason_Drop_SwitchCallbackFailed DropReason = 1073742537 + DropReason_Drop_Icmpv6Limiter DropReason = 1073742538 + DropReason_Drop_Intercept DropReason = 1073742539 + DropReason_Drop_InterceptBlock DropReason = 1073742540 + DropReason_Drop_NDPGuard DropReason = 1073742541 + DropReason_Drop_PortBlocked DropReason = 1073742542 + DropReason_Drop_NicSuspended DropReason = 1073742543 // Tcpip NL errors - DropReason_Drop_NL_BadSourceAddress DropReason = 901 - DropReason_Drop_NL_NotLocallyDestined DropReason = 902 - DropReason_Drop_NL_ProtocolUnreachable DropReason = 903 - DropReason_Drop_NL_PortUnreachable DropReason = 904 - DropReason_Drop_NL_BadLength DropReason = 905 - DropReason_Drop_NL_MalformedHeader DropReason = 906 - DropReason_Drop_NL_NoRoute DropReason = 907 - DropReason_Drop_NL_BeyondScope DropReason = 908 - DropReason_Drop_NL_InspectionDrop DropReason = 909 - DropReason_Drop_NL_TooManyDecapsulations DropReason = 910 - DropReason_Drop_NL_AdministrativelyProhibited DropReason = 911 - DropReason_Drop_NL_BadChecksum DropReason = 912 - DropReason_Drop_NL_ReceivePathMax DropReason = 913 - DropReason_Drop_NL_HopLimitExceeded DropReason = 914 - DropReason_Drop_NL_AddressUnreachable DropReason = 915 - DropReason_Drop_NL_RscPacket DropReason = 916 - DropReason_Drop_NL_ForwardPathMax DropReason = 917 - DropReason_Drop_NL_ArbitrationUnhandled DropReason = 918 - DropReason_Drop_NL_InspectionAbsorb DropReason = 919 - DropReason_Drop_NL_DontFragmentMtuExceeded DropReason = 920 - DropReason_Drop_NL_BufferLengthExceeded DropReason = 921 - DropReason_Drop_NL_AddressResolutionTimeout DropReason = 922 - DropReason_Drop_NL_AddressResolutionFailure DropReason = 923 - DropReason_Drop_NL_IpsecFailure DropReason = 924 - DropReason_Drop_NL_ExtensionHeadersFailure DropReason = 925 - DropReason_Drop_NL_IpsnpiClientDrop DropReason = 926 - DropReason_Drop_NL_UnsupportedOffload DropReason = 927 - DropReason_Drop_NL_RoutingFailure DropReason = 928 - DropReason_Drop_NL_AncillaryDataFailure DropReason = 929 - DropReason_Drop_NL_RawDataFailure DropReason = 930 - DropReason_Drop_NL_SessionStateFailure DropReason = 931 - DropReason_Drop_NL_IpsnpiModifiedButNotForwarded DropReason = 932 - DropReason_Drop_NL_IpsnpiNoNextHop DropReason = 933 - DropReason_Drop_NL_IpsnpiNoCompartment DropReason = 934 - DropReason_Drop_NL_IpsnpiNoInterface DropReason = 935 - DropReason_Drop_NL_IpsnpiNoSubInterface DropReason = 936 - DropReason_Drop_NL_IpsnpiInterfaceDisabled DropReason = 937 - DropReason_Drop_NL_IpsnpiSegmentationFailed DropReason = 938 - DropReason_Drop_NL_IpsnpiNoEthernetHeader DropReason = 939 - DropReason_Drop_NL_IpsnpiUnexpectedFragment DropReason = 940 - DropReason_Drop_NL_IpsnpiUnsupportedInterfaceType DropReason = 941 - DropReason_Drop_NL_IpsnpiInvalidLsoInfo DropReason = 942 - DropReason_Drop_NL_IpsnpiInvalidUsoInfo DropReason = 943 - DropReason_Drop_NL_InternalError DropReason = 944 - DropReason_Drop_NL_AdministrativelyConfigured DropReason = 945 - DropReason_Drop_NL_BadOption DropReason = 946 - DropReason_Drop_NL_LoopbackDisallowed DropReason = 947 - DropReason_Drop_NL_SmallerScope DropReason = 948 - DropReason_Drop_NL_QueueFull DropReason = 949 - DropReason_Drop_NL_InterfaceDisabled DropReason = 950 - DropReason_Drop_NL_IcmpGeneric DropReason = 951 - DropReason_Drop_NL_IcmpTruncatedHeader DropReason = 952 - DropReason_Drop_NL_IcmpInvalidChecksum DropReason = 953 - DropReason_Drop_NL_IcmpInspection DropReason = 954 - DropReason_Drop_NL_IcmpNeighborDiscoveryLoopback DropReason = 955 - DropReason_Drop_NL_IcmpUnknownType DropReason = 956 - DropReason_Drop_NL_IcmpTruncatedIpHeader DropReason = 957 - DropReason_Drop_NL_IcmpOversizedIpHeader DropReason = 958 - DropReason_Drop_NL_IcmpNoHandler DropReason = 959 - DropReason_Drop_NL_IcmpRespondingToError DropReason = 960 - DropReason_Drop_NL_IcmpInvalidSource DropReason = 961 - DropReason_Drop_NL_IcmpInterfaceRateLimit DropReason = 962 - DropReason_Drop_NL_IcmpPathRateLimit DropReason = 963 - DropReason_Drop_NL_IcmpNoRoute DropReason = 964 - DropReason_Drop_NL_IcmpMatchingRequestNotFound DropReason = 965 - DropReason_Drop_NL_IcmpBufferTooSmall DropReason = 966 - DropReason_Drop_NL_IcmpAncillaryDataQuery DropReason = 967 - DropReason_Drop_NL_IcmpIncorrectHopLimit DropReason = 968 - DropReason_Drop_NL_IcmpUnknownCode DropReason = 969 - DropReason_Drop_NL_IcmpSourceNotLinkLocal DropReason = 970 - DropReason_Drop_NL_IcmpTruncatedNdHeader DropReason = 971 - DropReason_Drop_NL_IcmpInvalidNdOptSourceLinkAddr DropReason = 972 - DropReason_Drop_NL_IcmpInvalidNdOptMtu DropReason = 973 - DropReason_Drop_NL_IcmpInvalidNdOptPrefixInformation DropReason = 974 - DropReason_Drop_NL_IcmpInvalidNdOptRouteInformation DropReason = 975 - DropReason_Drop_NL_IcmpInvalidNdOptRdnss DropReason = 976 - DropReason_Drop_NL_IcmpInvalidNdOptDnssl DropReason = 977 - DropReason_Drop_NL_IcmpPacketParsingFailure DropReason = 978 - DropReason_Drop_NL_IcmpDisallowed DropReason = 979 - DropReason_Drop_NL_IcmpInvalidRouterAdvertisement DropReason = 980 - DropReason_Drop_NL_IcmpSourceFromDifferentLink DropReason = 981 - DropReason_Drop_NL_IcmpInvalidRedirectDestinationOrTarget DropReason = 982 - DropReason_Drop_NL_IcmpInvalidNdTarget DropReason = 983 - DropReason_Drop_NL_IcmpNaMulticastAndSolicited DropReason = 984 - DropReason_Drop_NL_IcmpNdLinkLayerAddressIsLocal DropReason = 985 - DropReason_Drop_NL_IcmpDuplicateEchoRequest DropReason = 986 - DropReason_Drop_NL_IcmpNotAPotentialRouter DropReason = 987 - DropReason_Drop_NL_IcmpInvalidMldQuery DropReason = 988 - DropReason_Drop_NL_IcmpInvalidMldReport DropReason = 989 - DropReason_Drop_NL_IcmpLocallySourcedMldReport DropReason = 990 - DropReason_Drop_NL_IcmpNotLocallyDestined DropReason = 991 - DropReason_Drop_NL_ArpInvalidSource DropReason = 992 - DropReason_Drop_NL_ArpInvalidTarget DropReason = 993 - DropReason_Drop_NL_ArpDlSourceIsLocal DropReason = 994 - DropReason_Drop_NL_ArpNotLocallyDestined DropReason = 995 - DropReason_Drop_NL_NlClientDiscard DropReason = 996 - DropReason_Drop_NL_IpsnpiUroSegmentSizeExceedsMtu DropReason = 997 - DropReason_Drop_NL_IcmpFragmentedPacket DropReason = 998 - DropReason_Drop_NL_FirstFragmentIncomplete DropReason = 999 - DropReason_Drop_NL_SourceViolation DropReason = 1000 - DropReason_Drop_NL_IcmpJumbogram DropReason = 1001 - DropReason_Drop_NL_SwUsoFailure DropReason = 1002 + DropReason_Drop_NL_BadSourceAddress DropReason = 1073742725 + DropReason_Drop_NL_NotLocallyDestined DropReason = 1073742726 + DropReason_Drop_NL_ProtocolUnreachable DropReason = 1073742727 + DropReason_Drop_NL_PortUnreachable DropReason = 1073742728 + DropReason_Drop_NL_BadLength DropReason = 1073742729 + DropReason_Drop_NL_MalformedHeader DropReason = 1073742730 + DropReason_Drop_NL_NoRoute DropReason = 1073742731 + DropReason_Drop_NL_BeyondScope DropReason = 1073742732 + DropReason_Drop_NL_InspectionDrop DropReason = 1073742733 + DropReason_Drop_NL_TooManyDecapsulations DropReason = 1073742734 + DropReason_Drop_NL_AdministrativelyProhibited DropReason = 1073742735 + DropReason_Drop_NL_BadChecksum DropReason = 1073742736 + DropReason_Drop_NL_ReceivePathMax DropReason = 1073742737 + DropReason_Drop_NL_HopLimitExceeded DropReason = 1073742738 + DropReason_Drop_NL_AddressUnreachable DropReason = 1073742739 + DropReason_Drop_NL_RscPacket DropReason = 1073742740 + DropReason_Drop_NL_ForwardPathMax DropReason = 1073742741 + DropReason_Drop_NL_ArbitrationUnhandled DropReason = 1073742742 + DropReason_Drop_NL_InspectionAbsorb DropReason = 1073742743 + DropReason_Drop_NL_DontFragmentMtuExceeded DropReason = 1073742744 + DropReason_Drop_NL_BufferLengthExceeded DropReason = 1073742745 + DropReason_Drop_NL_AddressResolutionTimeout DropReason = 1073742746 + DropReason_Drop_NL_AddressResolutionFailure DropReason = 1073742747 + DropReason_Drop_NL_IpsecFailure DropReason = 1073742748 + DropReason_Drop_NL_ExtensionHeadersFailure DropReason = 1073742749 + DropReason_Drop_NL_IpsnpiClientDrop DropReason = 1073742750 + DropReason_Drop_NL_UnsupportedOffload DropReason = 1073742751 + DropReason_Drop_NL_RoutingFailure DropReason = 1073742752 + DropReason_Drop_NL_AncillaryDataFailure DropReason = 1073742753 + DropReason_Drop_NL_RawDataFailure DropReason = 1073742754 + DropReason_Drop_NL_SessionStateFailure DropReason = 1073742755 + DropReason_Drop_NL_IpsnpiModifiedButNotForwarded DropReason = 1073742756 + DropReason_Drop_NL_IpsnpiNoNextHop DropReason = 1073742757 + DropReason_Drop_NL_IpsnpiNoCompartment DropReason = 1073742758 + DropReason_Drop_NL_IpsnpiNoInterface DropReason = 1073742759 + DropReason_Drop_NL_IpsnpiNoSubInterface DropReason = 1073742760 + DropReason_Drop_NL_IpsnpiInterfaceDisabled DropReason = 1073742761 + DropReason_Drop_NL_IpsnpiSegmentationFailed DropReason = 1073742762 + DropReason_Drop_NL_IpsnpiNoEthernetHeader DropReason = 1073742763 + DropReason_Drop_NL_IpsnpiUnexpectedFragment DropReason = 1073742764 + DropReason_Drop_NL_IpsnpiUnsupportedInterfaceType DropReason = 1073742765 + DropReason_Drop_NL_IpsnpiInvalidLsoInfo DropReason = 1073742766 + DropReason_Drop_NL_IpsnpiInvalidUsoInfo DropReason = 1073742767 + DropReason_Drop_NL_InternalError DropReason = 1073742768 + DropReason_Drop_NL_AdministrativelyConfigured DropReason = 1073742769 + DropReason_Drop_NL_BadOption DropReason = 1073742770 + DropReason_Drop_NL_LoopbackDisallowed DropReason = 1073742771 + DropReason_Drop_NL_SmallerScope DropReason = 1073742772 + DropReason_Drop_NL_QueueFull DropReason = 1073742773 + DropReason_Drop_NL_InterfaceDisabled DropReason = 1073742774 + DropReason_Drop_NL_IcmpGeneric DropReason = 1073742775 + DropReason_Drop_NL_IcmpTruncatedHeader DropReason = 1073742776 + DropReason_Drop_NL_IcmpInvalidChecksum DropReason = 1073742777 + DropReason_Drop_NL_IcmpInspection DropReason = 1073742778 + DropReason_Drop_NL_IcmpNeighborDiscoveryLoopback DropReason = 1073742779 + DropReason_Drop_NL_IcmpUnknownType DropReason = 1073742780 + DropReason_Drop_NL_IcmpTruncatedIpHeader DropReason = 1073742781 + DropReason_Drop_NL_IcmpOversizedIpHeader DropReason = 1073742782 + DropReason_Drop_NL_IcmpNoHandler DropReason = 1073742783 + DropReason_Drop_NL_IcmpRespondingToError DropReason = 1073742784 + DropReason_Drop_NL_IcmpInvalidSource DropReason = 1073742785 + DropReason_Drop_NL_IcmpInterfaceRateLimit DropReason = 1073742786 + DropReason_Drop_NL_IcmpPathRateLimit DropReason = 1073742787 + DropReason_Drop_NL_IcmpNoRoute DropReason = 1073742788 + DropReason_Drop_NL_IcmpMatchingRequestNotFound DropReason = 1073742789 + DropReason_Drop_NL_IcmpBufferTooSmall DropReason = 1073742790 + DropReason_Drop_NL_IcmpAncillaryDataQuery DropReason = 1073742791 + DropReason_Drop_NL_IcmpIncorrectHopLimit DropReason = 1073742792 + DropReason_Drop_NL_IcmpUnknownCode DropReason = 1073742793 + DropReason_Drop_NL_IcmpSourceNotLinkLocal DropReason = 1073742794 + DropReason_Drop_NL_IcmpTruncatedNdHeader DropReason = 1073742795 + DropReason_Drop_NL_IcmpInvalidNdOptSourceLinkAddr DropReason = 1073742796 + DropReason_Drop_NL_IcmpInvalidNdOptMtu DropReason = 1073742797 + DropReason_Drop_NL_IcmpInvalidNdOptPrefixInformation DropReason = 1073742798 + DropReason_Drop_NL_IcmpInvalidNdOptRouteInformation DropReason = 1073742799 + DropReason_Drop_NL_IcmpInvalidNdOptRdnss DropReason = 1073742800 + DropReason_Drop_NL_IcmpInvalidNdOptDnssl DropReason = 1073742801 + DropReason_Drop_NL_IcmpPacketParsingFailure DropReason = 1073742802 + DropReason_Drop_NL_IcmpDisallowed DropReason = 1073742803 + DropReason_Drop_NL_IcmpInvalidRouterAdvertisement DropReason = 1073742804 + DropReason_Drop_NL_IcmpSourceFromDifferentLink DropReason = 1073742805 + DropReason_Drop_NL_IcmpInvalidRedirectDestinationOrTarget DropReason = 1073742806 + DropReason_Drop_NL_IcmpInvalidNdTarget DropReason = 1073742807 + DropReason_Drop_NL_IcmpNaMulticastAndSolicited DropReason = 1073742808 + DropReason_Drop_NL_IcmpNdLinkLayerAddressIsLocal DropReason = 1073742809 + DropReason_Drop_NL_IcmpDuplicateEchoRequest DropReason = 1073742810 + DropReason_Drop_NL_IcmpNotAPotentialRouter DropReason = 1073742811 + DropReason_Drop_NL_IcmpInvalidMldQuery DropReason = 1073742812 + DropReason_Drop_NL_IcmpInvalidMldReport DropReason = 1073742813 + DropReason_Drop_NL_IcmpLocallySourcedMldReport DropReason = 1073742814 + DropReason_Drop_NL_IcmpNotLocallyDestined DropReason = 1073742815 + DropReason_Drop_NL_ArpInvalidSource DropReason = 1073742816 + DropReason_Drop_NL_ArpInvalidTarget DropReason = 1073742817 + DropReason_Drop_NL_ArpDlSourceIsLocal DropReason = 1073742818 + DropReason_Drop_NL_ArpNotLocallyDestined DropReason = 1073742819 + DropReason_Drop_NL_NlClientDiscard DropReason = 1073742820 + DropReason_Drop_NL_IpsnpiUroSegmentSizeExceedsMtu DropReason = 1073742821 + DropReason_Drop_NL_IcmpFragmentedPacket DropReason = 1073742822 + DropReason_Drop_NL_FirstFragmentIncomplete DropReason = 1073742823 + DropReason_Drop_NL_SourceViolation DropReason = 1073742824 + DropReason_Drop_NL_IcmpJumbogram DropReason = 1073742825 + DropReason_Drop_NL_SwUsoFailure DropReason = 1073742826 // INET discard reasons - DropReason_Drop_INET_SourceUnspecified DropReason = 1200 - DropReason_Drop_INET_DestinationMulticast DropReason = 1201 - DropReason_Drop_INET_HeaderInvalid DropReason = 1202 - DropReason_Drop_INET_ChecksumInvalid DropReason = 1203 - DropReason_Drop_INET_EndpointNotFound DropReason = 1204 - DropReason_Drop_INET_ConnectedPath DropReason = 1205 - DropReason_Drop_INET_SessionState DropReason = 1206 - DropReason_Drop_INET_ReceiveInspection DropReason = 1207 - DropReason_Drop_INET_AckInvalid DropReason = 1208 - DropReason_Drop_INET_ExpectedSyn DropReason = 1209 - DropReason_Drop_INET_Rst DropReason = 1210 - DropReason_Drop_INET_SynRcvdSyn DropReason = 1211 - DropReason_Drop_INET_SimultaneousConnect DropReason = 1212 - DropReason_Drop_INET_PawsFailed DropReason = 1213 - DropReason_Drop_INET_LandAttack DropReason = 1214 - DropReason_Drop_INET_MissedReset DropReason = 1215 - DropReason_Drop_INET_OutsideWindow DropReason = 1216 - DropReason_Drop_INET_DuplicateSegment DropReason = 1217 - DropReason_Drop_INET_ClosedWindow DropReason = 1218 - DropReason_Drop_INET_TcbRemoved DropReason = 1219 - DropReason_Drop_INET_FinWait2 DropReason = 1220 - DropReason_Drop_INET_ReassemblyConflict DropReason = 1221 - DropReason_Drop_INET_FinReceived DropReason = 1222 - DropReason_Drop_INET_ListenerInvalidFlags DropReason = 1223 - DropReason_Drop_INET_TcbNotInTcbTable DropReason = 1224 - DropReason_Drop_INET_TimeWaitTcbReceivedRstOutsideWindow DropReason = 1225 - DropReason_Drop_INET_TimeWaitTcbSynAndOtherFlags DropReason = 1226 - DropReason_Drop_INET_TimeWaitTcb DropReason = 1227 - DropReason_Drop_INET_SynAckWithFastopenCookieRequest DropReason = 1228 - DropReason_Drop_INET_PauseAccept DropReason = 1229 - DropReason_Drop_INET_SynAttack DropReason = 1230 - DropReason_Drop_INET_AcceptInspection DropReason = 1231 - DropReason_Drop_INET_AcceptRedirection DropReason = 1232 + DropReason_Drop_INET_SourceUnspecified DropReason = 1073743024 + DropReason_Drop_INET_DestinationMulticast DropReason = 1073743025 + DropReason_Drop_INET_HeaderInvalid DropReason = 1073743026 + DropReason_Drop_INET_ChecksumInvalid DropReason = 1073743027 + DropReason_Drop_INET_EndpointNotFound DropReason = 1073743028 + DropReason_Drop_INET_ConnectedPath DropReason = 1073743029 + DropReason_Drop_INET_SessionState DropReason = 1073743030 + DropReason_Drop_INET_ReceiveInspection DropReason = 1073743031 + DropReason_Drop_INET_AckInvalid DropReason = 1073743032 + DropReason_Drop_INET_ExpectedSyn DropReason = 1073743033 + DropReason_Drop_INET_Rst DropReason = 1073743034 + DropReason_Drop_INET_SynRcvdSyn DropReason = 1073743035 + DropReason_Drop_INET_SimultaneousConnect DropReason = 1073743036 + DropReason_Drop_INET_PawsFailed DropReason = 1073743037 + DropReason_Drop_INET_LandAttack DropReason = 1073743038 + DropReason_Drop_INET_MissedReset DropReason = 1073743039 + DropReason_Drop_INET_OutsideWindow DropReason = 1073743040 + DropReason_Drop_INET_DuplicateSegment DropReason = 1073743041 + DropReason_Drop_INET_ClosedWindow DropReason = 1073743042 + DropReason_Drop_INET_TcbRemoved DropReason = 1073743043 + DropReason_Drop_INET_FinWait2 DropReason = 1073743044 + DropReason_Drop_INET_ReassemblyConflict DropReason = 1073743045 + DropReason_Drop_INET_FinReceived DropReason = 1073743046 + DropReason_Drop_INET_ListenerInvalidFlags DropReason = 1073743047 + DropReason_Drop_INET_TcbNotInTcbTable DropReason = 1073743048 + DropReason_Drop_INET_TimeWaitTcbReceivedRstOutsideWindow DropReason = 1073743049 + DropReason_Drop_INET_TimeWaitTcbSynAndOtherFlags DropReason = 1073743050 + DropReason_Drop_INET_TimeWaitTcb DropReason = 1073743051 + DropReason_Drop_INET_SynAckWithFastopenCookieRequest DropReason = 1073743052 + DropReason_Drop_INET_PauseAccept DropReason = 1073743053 + DropReason_Drop_INET_SynAttack DropReason = 1073743054 + DropReason_Drop_INET_AcceptInspection DropReason = 1073743055 + DropReason_Drop_INET_AcceptRedirection DropReason = 1073743056 // Slbmux Error - DropReason_Drop_SlbMux_ParsingFailure DropReason = 1301 - DropReason_Drop_SlbMux_FirstFragmentMiss DropReason = 1302 - DropReason_Drop_SlbMux_ICMPErrorPayloadValidationFailure DropReason = 1303 - DropReason_Drop_SlbMux_ICMPErrorPacketMatchNoSession DropReason = 1304 - DropReason_Drop_SlbMux_ExternalHairpinNexthopLookupFailure DropReason = 1305 - DropReason_Drop_SlbMux_NoMatchingStaticMapping DropReason = 1306 - DropReason_Drop_SlbMux_NexthopReferenceFailure DropReason = 1307 - DropReason_Drop_SlbMux_CloningFailure DropReason = 1308 - DropReason_Drop_SlbMux_TranslationFailure DropReason = 1309 - DropReason_Drop_SlbMux_HopLimitExceeded DropReason = 1310 - DropReason_Drop_SlbMux_PacketBiggerThanMTU DropReason = 1311 - DropReason_Drop_SlbMux_UnexpectedRouteLookupFailure DropReason = 1312 - DropReason_Drop_SlbMux_NoRoute DropReason = 1313 - DropReason_Drop_SlbMux_SessionCreationFailure DropReason = 1314 - DropReason_Drop_SlbMux_NexthopNotOverExternalInterface DropReason = 1315 - DropReason_Drop_SlbMux_NexthopExternalInterfaceMissNATInstance DropReason = 1316 - DropReason_Drop_SlbMux_NATItselfCantBeInternalNexthop DropReason = 1317 - DropReason_Drop_SlbMux_PacketRoutableInItsArrivalCompartment DropReason = 1318 - DropReason_Drop_SlbMux_PacketTransportProtocolNotSupported DropReason = 1319 - DropReason_Drop_SlbMux_PacketIsDestinedLocally DropReason = 1320 - DropReason_Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT DropReason = 1321 - DropReason_Drop_SlbMux_MuxReject DropReason = 1322 - DropReason_Drop_SlbMux_DipLookupFailure DropReason = 1323 - DropReason_Drop_SlbMux_MuxEncapsulationFailure DropReason = 1324 - DropReason_Drop_SlbMux_InvalidDiagPacketEncapType DropReason = 1325 - DropReason_Drop_SlbMux_DiagPacketIsRedirect DropReason = 1326 - DropReason_Drop_SlbMux_UnableToHandleRedirect DropReason = 1327 + DropReason_Drop_SlbMux_ParsingFailure DropReason = 1073743125 + DropReason_Drop_SlbMux_FirstFragmentMiss DropReason = 1073743126 + DropReason_Drop_SlbMux_ICMPErrorPayloadValidationFailure DropReason = 1073743127 + DropReason_Drop_SlbMux_ICMPErrorPacketMatchNoSession DropReason = 1073743128 + DropReason_Drop_SlbMux_ExternalHairpinNexthopLookupFailure DropReason = 1073743129 + DropReason_Drop_SlbMux_NoMatchingStaticMapping DropReason = 1073743130 + DropReason_Drop_SlbMux_NexthopReferenceFailure DropReason = 1073743131 + DropReason_Drop_SlbMux_CloningFailure DropReason = 1073743132 + DropReason_Drop_SlbMux_TranslationFailure DropReason = 1073743133 + DropReason_Drop_SlbMux_HopLimitExceeded DropReason = 1073743134 + DropReason_Drop_SlbMux_PacketBiggerThanMTU DropReason = 1073743135 + DropReason_Drop_SlbMux_UnexpectedRouteLookupFailure DropReason = 1073743136 + DropReason_Drop_SlbMux_NoRoute DropReason = 1073743137 + DropReason_Drop_SlbMux_SessionCreationFailure DropReason = 1073743138 + DropReason_Drop_SlbMux_NexthopNotOverExternalInterface DropReason = 1073743139 + DropReason_Drop_SlbMux_NexthopExternalInterfaceMissNATInstance DropReason = 1073743140 + DropReason_Drop_SlbMux_NATItselfCantBeInternalNexthop DropReason = 1073743141 + DropReason_Drop_SlbMux_PacketRoutableInItsArrivalCompartment DropReason = 1073743142 + DropReason_Drop_SlbMux_PacketTransportProtocolNotSupported DropReason = 1073743143 + DropReason_Drop_SlbMux_PacketIsDestinedLocally DropReason = 1073743144 + DropReason_Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT DropReason = 1073743145 + DropReason_Drop_SlbMux_MuxReject DropReason = 1073743146 + DropReason_Drop_SlbMux_DipLookupFailure DropReason = 1073743147 + DropReason_Drop_SlbMux_MuxEncapsulationFailure DropReason = 1073743148 + DropReason_Drop_SlbMux_InvalidDiagPacketEncapType DropReason = 1073743149 + DropReason_Drop_SlbMux_DiagPacketIsRedirect DropReason = 1073743150 + DropReason_Drop_SlbMux_UnableToHandleRedirect DropReason = 1073743151 // Ipsec Errors - DropReason_Drop_Ipsec_BadSpi DropReason = 1401 - DropReason_Drop_Ipsec_SALifetimeExpired DropReason = 1402 - DropReason_Drop_Ipsec_WrongSA DropReason = 1403 - DropReason_Drop_Ipsec_ReplayCheckFailed DropReason = 1404 - DropReason_Drop_Ipsec_InvalidPacket DropReason = 1405 - DropReason_Drop_Ipsec_IntegrityCheckFailed DropReason = 1406 - DropReason_Drop_Ipsec_ClearTextDrop DropReason = 1407 - DropReason_Drop_Ipsec_AuthFirewallDrop DropReason = 1408 - DropReason_Drop_Ipsec_ThrottleDrop DropReason = 1409 - DropReason_Drop_Ipsec_Dosp_Block DropReason = 1410 - DropReason_Drop_Ipsec_Dosp_ReceivedMulticast DropReason = 1411 - DropReason_Drop_Ipsec_Dosp_InvalidPacket DropReason = 1412 - DropReason_Drop_Ipsec_Dosp_StateLookupFailed DropReason = 1413 - DropReason_Drop_Ipsec_Dosp_MaxEntries DropReason = 1414 - DropReason_Drop_Ipsec_Dosp_KeymodNotAllowed DropReason = 1415 - DropReason_Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues DropReason = 1416 - DropReason_Drop_Ipsec_NoMemory DropReason = 1417 - DropReason_Drop_Ipsec_Unsuccessful DropReason = 1418 + DropReason_Drop_Ipsec_BadSpi DropReason = 1073743225 + DropReason_Drop_Ipsec_SALifetimeExpired DropReason = 1073743226 + DropReason_Drop_Ipsec_WrongSA DropReason = 1073743227 + DropReason_Drop_Ipsec_ReplayCheckFailed DropReason = 1073743228 + DropReason_Drop_Ipsec_InvalidPacket DropReason = 1073743229 + DropReason_Drop_Ipsec_IntegrityCheckFailed DropReason = 1073743230 + DropReason_Drop_Ipsec_ClearTextDrop DropReason = 1073743231 + DropReason_Drop_Ipsec_AuthFirewallDrop DropReason = 1073743232 + DropReason_Drop_Ipsec_ThrottleDrop DropReason = 1073743233 + DropReason_Drop_Ipsec_Dosp_Block DropReason = 1073743234 + DropReason_Drop_Ipsec_Dosp_ReceivedMulticast DropReason = 1073743235 + DropReason_Drop_Ipsec_Dosp_InvalidPacket DropReason = 1073743236 + DropReason_Drop_Ipsec_Dosp_StateLookupFailed DropReason = 1073743237 + DropReason_Drop_Ipsec_Dosp_MaxEntries DropReason = 1073743238 + DropReason_Drop_Ipsec_Dosp_KeymodNotAllowed DropReason = 1073743239 + DropReason_Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues DropReason = 1073743240 + DropReason_Drop_Ipsec_NoMemory DropReason = 1073743241 + DropReason_Drop_Ipsec_Unsuccessful DropReason = 1073743242 // NetCx Drop Reasons - DropReason_Drop_NetCx_NetPacketLayoutParseFailure DropReason = 1501 - DropReason_Drop_NetCx_SoftwareChecksumFailure DropReason = 1502 - DropReason_Drop_NetCx_NicQueueStop DropReason = 1503 - DropReason_Drop_NetCx_InvalidNetBufferLength DropReason = 1504 - DropReason_Drop_NetCx_LSOFailure DropReason = 1505 - DropReason_Drop_NetCx_USOFailure DropReason = 1506 - DropReason_Drop_NetCx_BufferBounceFailureAndPacketIgnore DropReason = 1507 + DropReason_Drop_NetCx_NetPacketLayoutParseFailure DropReason = 1073743325 + DropReason_Drop_NetCx_SoftwareChecksumFailure DropReason = 1073743326 + DropReason_Drop_NetCx_NicQueueStop DropReason = 1073743327 + DropReason_Drop_NetCx_InvalidNetBufferLength DropReason = 1073743328 + DropReason_Drop_NetCx_LSOFailure DropReason = 1073743329 + DropReason_Drop_NetCx_USOFailure DropReason = 1073743330 + DropReason_Drop_NetCx_BufferBounceFailureAndPacketIgnore DropReason = 1073743331 // Http errors 3000 - 4000. // These must be in sync with cmd\resource.h - DropReason_Drop_Http_Begin DropReason = 3000 + DropReason_Drop_Http_Begin DropReason = 1073744824 // UlErrors - DropReason_Drop_Http_UlError_Begin DropReason = 3001 - DropReason_Drop_Http_UlError DropReason = 3002 - DropReason_Drop_Http_UlErrorVerb DropReason = 3003 - DropReason_Drop_Http_UlErrorUrl DropReason = 3004 - DropReason_Drop_Http_UlErrorHeader DropReason = 3005 - DropReason_Drop_Http_UlErrorHost DropReason = 3006 - DropReason_Drop_Http_UlErrorNum DropReason = 3007 - DropReason_Drop_Http_UlErrorFieldLength DropReason = 3008 - DropReason_Drop_Http_UlErrorRequestLength DropReason = 3009 - DropReason_Drop_Http_UlErrorUnauthorized DropReason = 3010 - DropReason_Drop_Http_UlErrorForbiddenUrl DropReason = 3011 - DropReason_Drop_Http_UlErrorNotFound DropReason = 3012 - DropReason_Drop_Http_UlErrorContentLength DropReason = 3013 - DropReason_Drop_Http_UlErrorPreconditionFailed DropReason = 3014 - DropReason_Drop_Http_UlErrorEntityTooLarge DropReason = 3015 - DropReason_Drop_Http_UlErrorUrlLength DropReason = 3016 - DropReason_Drop_Http_UlErrorRangeNotSatisfiable DropReason = 3017 - DropReason_Drop_Http_UlErrorMisdirectedRequest DropReason = 3018 - DropReason_Drop_Http_UlErrorInternalServer DropReason = 3019 - DropReason_Drop_Http_UlErrorNotImplemented DropReason = 3020 - DropReason_Drop_Http_UlErrorUnavailable DropReason = 3021 - DropReason_Drop_Http_UlErrorConnectionLimit DropReason = 3022 - DropReason_Drop_Http_UlErrorRapidFailProtection DropReason = 3023 - DropReason_Drop_Http_UlErrorRequestQueueFull DropReason = 3024 - DropReason_Drop_Http_UlErrorDisabledByAdmin DropReason = 3025 - DropReason_Drop_Http_UlErrorDisabledByApp DropReason = 3026 - DropReason_Drop_Http_UlErrorJobObjectFired DropReason = 3027 - DropReason_Drop_Http_UlErrorAppPoolBusy DropReason = 3028 - DropReason_Drop_Http_UlErrorVersion DropReason = 3029 - DropReason_Drop_Http_UlError_End DropReason = 3030 - DropReason_Drop_Http_UxDuoFaultBegin DropReason = 3400 - DropReason_Drop_Http_UxDuoFaultUserAbort DropReason = 3401 - DropReason_Drop_Http_UxDuoFaultCollection DropReason = 3402 - DropReason_Drop_Http_UxDuoFaultClientResetStream DropReason = 3403 - DropReason_Drop_Http_UxDuoFaultMethodNotFound DropReason = 3404 - DropReason_Drop_Http_UxDuoFaultSchemeMismatch DropReason = 3405 - DropReason_Drop_Http_UxDuoFaultSchemeNotFound DropReason = 3406 - DropReason_Drop_Http_UxDuoFaultDataAfterEnd DropReason = 3407 - DropReason_Drop_Http_UxDuoFaultPathNotFound DropReason = 3408 - DropReason_Drop_Http_UxDuoFaultHalfClosedLocal DropReason = 3409 - DropReason_Drop_Http_UxDuoFaultIncompatibleAuth DropReason = 3410 - DropReason_Drop_Http_UxDuoFaultDeprecated3 DropReason = 3411 - DropReason_Drop_Http_UxDuoFaultClientCertBlocked DropReason = 3412 - DropReason_Drop_Http_UxDuoFaultHeaderNameEmpty DropReason = 3413 - DropReason_Drop_Http_UxDuoFaultIllegalSend DropReason = 3414 - DropReason_Drop_Http_UxDuoFaultPushUpperAttach DropReason = 3415 - DropReason_Drop_Http_UxDuoFaultStreamUpperAttach DropReason = 3416 - DropReason_Drop_Http_UxDuoFaultActiveStreamLimit DropReason = 3417 - DropReason_Drop_Http_UxDuoFaultAuthorityNotFound DropReason = 3418 - DropReason_Drop_Http_UxDuoFaultUnexpectedTail DropReason = 3419 - DropReason_Drop_Http_UxDuoFaultTruncated DropReason = 3420 - DropReason_Drop_Http_UxDuoFaultResponseHold DropReason = 3421 - DropReason_Drop_Http_UxDuoFaultRequestChunked DropReason = 3422 - DropReason_Drop_Http_UxDuoFaultRequestContentLength DropReason = 3423 - DropReason_Drop_Http_UxDuoFaultResponseChunked DropReason = 3424 - DropReason_Drop_Http_UxDuoFaultResponseContentLength DropReason = 3425 - DropReason_Drop_Http_UxDuoFaultResponseTransferEncoding DropReason = 3426 - DropReason_Drop_Http_UxDuoFaultResponseLine DropReason = 3427 - DropReason_Drop_Http_UxDuoFaultResponseHeader DropReason = 3428 - DropReason_Drop_Http_UxDuoFaultConnect DropReason = 3429 - DropReason_Drop_Http_UxDuoFaultChunkStart DropReason = 3430 - DropReason_Drop_Http_UxDuoFaultChunkLength DropReason = 3431 - DropReason_Drop_Http_UxDuoFaultChunkStop DropReason = 3432 - DropReason_Drop_Http_UxDuoFaultHeadersAfterTrailers DropReason = 3433 - DropReason_Drop_Http_UxDuoFaultHeadersAfterEnd DropReason = 3434 - DropReason_Drop_Http_UxDuoFaultEndlessTrailer DropReason = 3435 - DropReason_Drop_Http_UxDuoFaultTransferEncoding DropReason = 3436 - DropReason_Drop_Http_UxDuoFaultMultipleTransferCodings DropReason = 3437 - DropReason_Drop_Http_UxDuoFaultPushBody DropReason = 3438 - DropReason_Drop_Http_UxDuoFaultStreamAbandoned DropReason = 3439 - DropReason_Drop_Http_UxDuoFaultMalformedHost DropReason = 3440 - DropReason_Drop_Http_UxDuoFaultDecompressionOverflow DropReason = 3441 - DropReason_Drop_Http_UxDuoFaultIllegalHeaderName DropReason = 3442 - DropReason_Drop_Http_UxDuoFaultIllegalHeaderValue DropReason = 3443 - DropReason_Drop_Http_UxDuoFaultConnHeaderDisallowed DropReason = 3444 - DropReason_Drop_Http_UxDuoFaultConnHeaderMalformed DropReason = 3445 - DropReason_Drop_Http_UxDuoFaultCookieReassembly DropReason = 3446 - DropReason_Drop_Http_UxDuoFaultStatusHeader DropReason = 3447 - DropReason_Drop_Http_UxDuoFaultSchemeDisallowed DropReason = 3448 - DropReason_Drop_Http_UxDuoFaultPathDisallowed DropReason = 3449 - DropReason_Drop_Http_UxDuoFaultPushHost DropReason = 3450 - DropReason_Drop_Http_UxDuoFaultGoawayReceived DropReason = 3451 - DropReason_Drop_Http_UxDuoFaultAbortLegacyApp DropReason = 3452 - DropReason_Drop_Http_UxDuoFaultUpgradeHeaderDisallowed DropReason = 3453 - DropReason_Drop_Http_UxDuoFaultResponseUpgradeHeader DropReason = 3454 - DropReason_Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed DropReason = 3455 - DropReason_Drop_Http_UxDuoFaultResponseKeepAliveHeader DropReason = 3456 - DropReason_Drop_Http_UxDuoFaultProxyConnHeaderDisallowed DropReason = 3457 - DropReason_Drop_Http_UxDuoFaultResponseProxyConnHeader DropReason = 3458 - DropReason_Drop_Http_UxDuoFaultConnectionGoingAway DropReason = 3459 - DropReason_Drop_Http_UxDuoFaultTransferEncodingDisallowed DropReason = 3460 - DropReason_Drop_Http_UxDuoFaultContentLengthDisallowed DropReason = 3461 - DropReason_Drop_Http_UxDuoFaultTrailerDisallowed DropReason = 3462 - DropReason_Drop_Http_UxDuoFaultEnd DropReason = 3463 + DropReason_Drop_Http_UlError_Begin DropReason = 1073744825 + DropReason_Drop_Http_UlError DropReason = 1073744826 + DropReason_Drop_Http_UlErrorVerb DropReason = 1073744827 + DropReason_Drop_Http_UlErrorUrl DropReason = 1073744828 + DropReason_Drop_Http_UlErrorHeader DropReason = 1073744829 + DropReason_Drop_Http_UlErrorHost DropReason = 1073744830 + DropReason_Drop_Http_UlErrorNum DropReason = 1073744831 + DropReason_Drop_Http_UlErrorFieldLength DropReason = 1073744832 + DropReason_Drop_Http_UlErrorRequestLength DropReason = 1073744833 + DropReason_Drop_Http_UlErrorUnauthorized DropReason = 1073744834 + DropReason_Drop_Http_UlErrorForbiddenUrl DropReason = 1073744835 + DropReason_Drop_Http_UlErrorNotFound DropReason = 1073744836 + DropReason_Drop_Http_UlErrorContentLength DropReason = 1073744837 + DropReason_Drop_Http_UlErrorPreconditionFailed DropReason = 1073744838 + DropReason_Drop_Http_UlErrorEntityTooLarge DropReason = 1073744839 + DropReason_Drop_Http_UlErrorUrlLength DropReason = 1073744840 + DropReason_Drop_Http_UlErrorRangeNotSatisfiable DropReason = 1073744841 + DropReason_Drop_Http_UlErrorMisdirectedRequest DropReason = 1073744842 + DropReason_Drop_Http_UlErrorInternalServer DropReason = 1073744843 + DropReason_Drop_Http_UlErrorNotImplemented DropReason = 1073744844 + DropReason_Drop_Http_UlErrorUnavailable DropReason = 1073744845 + DropReason_Drop_Http_UlErrorConnectionLimit DropReason = 1073744846 + DropReason_Drop_Http_UlErrorRapidFailProtection DropReason = 1073744847 + DropReason_Drop_Http_UlErrorRequestQueueFull DropReason = 1073744848 + DropReason_Drop_Http_UlErrorDisabledByAdmin DropReason = 1073744849 + DropReason_Drop_Http_UlErrorDisabledByApp DropReason = 1073744850 + DropReason_Drop_Http_UlErrorJobObjectFired DropReason = 1073744851 + DropReason_Drop_Http_UlErrorAppPoolBusy DropReason = 1073744852 + DropReason_Drop_Http_UlErrorVersion DropReason = 1073744853 + DropReason_Drop_Http_UlError_End DropReason = 1073744854 + DropReason_Drop_Http_UxDuoFaultBegin DropReason = 1073745224 + DropReason_Drop_Http_UxDuoFaultUserAbort DropReason = 1073745225 + DropReason_Drop_Http_UxDuoFaultCollection DropReason = 1073745226 + DropReason_Drop_Http_UxDuoFaultClientResetStream DropReason = 1073745227 + DropReason_Drop_Http_UxDuoFaultMethodNotFound DropReason = 1073745228 + DropReason_Drop_Http_UxDuoFaultSchemeMismatch DropReason = 1073745229 + DropReason_Drop_Http_UxDuoFaultSchemeNotFound DropReason = 1073745230 + DropReason_Drop_Http_UxDuoFaultDataAfterEnd DropReason = 1073745231 + DropReason_Drop_Http_UxDuoFaultPathNotFound DropReason = 1073745232 + DropReason_Drop_Http_UxDuoFaultHalfClosedLocal DropReason = 1073745233 + DropReason_Drop_Http_UxDuoFaultIncompatibleAuth DropReason = 1073745234 + DropReason_Drop_Http_UxDuoFaultDeprecated3 DropReason = 1073745235 + DropReason_Drop_Http_UxDuoFaultClientCertBlocked DropReason = 1073745236 + DropReason_Drop_Http_UxDuoFaultHeaderNameEmpty DropReason = 1073745237 + DropReason_Drop_Http_UxDuoFaultIllegalSend DropReason = 1073745238 + DropReason_Drop_Http_UxDuoFaultPushUpperAttach DropReason = 1073745239 + DropReason_Drop_Http_UxDuoFaultStreamUpperAttach DropReason = 1073745240 + DropReason_Drop_Http_UxDuoFaultActiveStreamLimit DropReason = 1073745241 + DropReason_Drop_Http_UxDuoFaultAuthorityNotFound DropReason = 1073745242 + DropReason_Drop_Http_UxDuoFaultUnexpectedTail DropReason = 1073745243 + DropReason_Drop_Http_UxDuoFaultTruncated DropReason = 1073745244 + DropReason_Drop_Http_UxDuoFaultResponseHold DropReason = 1073745245 + DropReason_Drop_Http_UxDuoFaultRequestChunked DropReason = 1073745246 + DropReason_Drop_Http_UxDuoFaultRequestContentLength DropReason = 1073745247 + DropReason_Drop_Http_UxDuoFaultResponseChunked DropReason = 1073745248 + DropReason_Drop_Http_UxDuoFaultResponseContentLength DropReason = 1073745249 + DropReason_Drop_Http_UxDuoFaultResponseTransferEncoding DropReason = 1073745250 + DropReason_Drop_Http_UxDuoFaultResponseLine DropReason = 1073745251 + DropReason_Drop_Http_UxDuoFaultResponseHeader DropReason = 1073745252 + DropReason_Drop_Http_UxDuoFaultConnect DropReason = 1073745253 + DropReason_Drop_Http_UxDuoFaultChunkStart DropReason = 1073745254 + DropReason_Drop_Http_UxDuoFaultChunkLength DropReason = 1073745255 + DropReason_Drop_Http_UxDuoFaultChunkStop DropReason = 1073745256 + DropReason_Drop_Http_UxDuoFaultHeadersAfterTrailers DropReason = 1073745257 + DropReason_Drop_Http_UxDuoFaultHeadersAfterEnd DropReason = 1073745258 + DropReason_Drop_Http_UxDuoFaultEndlessTrailer DropReason = 1073745259 + DropReason_Drop_Http_UxDuoFaultTransferEncoding DropReason = 1073745260 + DropReason_Drop_Http_UxDuoFaultMultipleTransferCodings DropReason = 1073745261 + DropReason_Drop_Http_UxDuoFaultPushBody DropReason = 1073745262 + DropReason_Drop_Http_UxDuoFaultStreamAbandoned DropReason = 1073745263 + DropReason_Drop_Http_UxDuoFaultMalformedHost DropReason = 1073745264 + DropReason_Drop_Http_UxDuoFaultDecompressionOverflow DropReason = 1073745265 + DropReason_Drop_Http_UxDuoFaultIllegalHeaderName DropReason = 1073745266 + DropReason_Drop_Http_UxDuoFaultIllegalHeaderValue DropReason = 1073745267 + DropReason_Drop_Http_UxDuoFaultConnHeaderDisallowed DropReason = 1073745268 + DropReason_Drop_Http_UxDuoFaultConnHeaderMalformed DropReason = 1073745269 + DropReason_Drop_Http_UxDuoFaultCookieReassembly DropReason = 1073745270 + DropReason_Drop_Http_UxDuoFaultStatusHeader DropReason = 1073745271 + DropReason_Drop_Http_UxDuoFaultSchemeDisallowed DropReason = 1073745272 + DropReason_Drop_Http_UxDuoFaultPathDisallowed DropReason = 1073745273 + DropReason_Drop_Http_UxDuoFaultPushHost DropReason = 1073745274 + DropReason_Drop_Http_UxDuoFaultGoawayReceived DropReason = 1073745275 + DropReason_Drop_Http_UxDuoFaultAbortLegacyApp DropReason = 1073745276 + DropReason_Drop_Http_UxDuoFaultUpgradeHeaderDisallowed DropReason = 1073745277 + DropReason_Drop_Http_UxDuoFaultResponseUpgradeHeader DropReason = 1073745278 + DropReason_Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed DropReason = 1073745279 + DropReason_Drop_Http_UxDuoFaultResponseKeepAliveHeader DropReason = 1073745280 + DropReason_Drop_Http_UxDuoFaultProxyConnHeaderDisallowed DropReason = 1073745281 + DropReason_Drop_Http_UxDuoFaultResponseProxyConnHeader DropReason = 1073745282 + DropReason_Drop_Http_UxDuoFaultConnectionGoingAway DropReason = 1073745283 + DropReason_Drop_Http_UxDuoFaultTransferEncodingDisallowed DropReason = 1073745284 + DropReason_Drop_Http_UxDuoFaultContentLengthDisallowed DropReason = 1073745285 + DropReason_Drop_Http_UxDuoFaultTrailerDisallowed DropReason = 1073745286 + DropReason_Drop_Http_UxDuoFaultEnd DropReason = 1073745287 // WSK layer drops - DropReason_Drop_Http_ReceiveSuppressed DropReason = 3600 + DropReason_Drop_Http_ReceiveSuppressed DropReason = 1073745424 // Http/SSL layer drops - DropReason_Drop_Http_Generic DropReason = 3800 - DropReason_Drop_Http_InvalidParameter DropReason = 3801 - DropReason_Drop_Http_InsufficientResources DropReason = 3802 - DropReason_Drop_Http_InvalidHandle DropReason = 3803 - DropReason_Drop_Http_NotSupported DropReason = 3804 - DropReason_Drop_Http_BadNetworkPath DropReason = 3805 - DropReason_Drop_Http_InternalError DropReason = 3806 - DropReason_Drop_Http_NoSuchPackage DropReason = 3807 - DropReason_Drop_Http_PrivilegeNotHeld DropReason = 3808 - DropReason_Drop_Http_CannotImpersonate DropReason = 3809 - DropReason_Drop_Http_LogonFailure DropReason = 3810 - DropReason_Drop_Http_NoSuchLogonSession DropReason = 3811 - DropReason_Drop_Http_AccessDenied DropReason = 3812 - DropReason_Drop_Http_NoLogonServers DropReason = 3813 - DropReason_Drop_Http_TimeDifferenceAtDc DropReason = 3814 - DropReason_Drop_Http_End DropReason = 4000 + DropReason_Drop_Http_Generic DropReason = 1073745624 + DropReason_Drop_Http_InvalidParameter DropReason = 1073745625 + DropReason_Drop_Http_InsufficientResources DropReason = 1073745626 + DropReason_Drop_Http_InvalidHandle DropReason = 1073745627 + DropReason_Drop_Http_NotSupported DropReason = 1073745628 + DropReason_Drop_Http_BadNetworkPath DropReason = 1073745629 + DropReason_Drop_Http_InternalError DropReason = 1073745630 + DropReason_Drop_Http_NoSuchPackage DropReason = 1073745631 + DropReason_Drop_Http_PrivilegeNotHeld DropReason = 1073745632 + DropReason_Drop_Http_CannotImpersonate DropReason = 1073745633 + DropReason_Drop_Http_LogonFailure DropReason = 1073745634 + DropReason_Drop_Http_NoSuchLogonSession DropReason = 1073745635 + DropReason_Drop_Http_AccessDenied DropReason = 1073745636 + DropReason_Drop_Http_NoLogonServers DropReason = 1073745637 + DropReason_Drop_Http_TimeDifferenceAtDc DropReason = 1073745638 + DropReason_Drop_Http_End DropReason = 1073745824 ) // Enum value maps for DropReason. var ( DropReason_name = map[int32]string{ - 0: "Drop_Unknown", - 1: "Drop_InvalidData", - 2: "Drop_InvalidPacket", - 3: "Drop_Resources", - 4: "Drop_NotReady", - 5: "Drop_Disconnected", - 6: "Drop_NotAccepted", - 7: "Drop_Busy", - 8: "Drop_Filtered", - 9: "Drop_FilteredVLAN", - 10: "Drop_UnauthorizedVLAN", - 11: "Drop_UnauthorizedMAC", - 12: "Drop_FailedSecurityPolicy", - 13: "Drop_FailedPvlanSetting", - 14: "Drop_Qos", - 15: "Drop_Ipsec", - 16: "Drop_MacSpoofing", - 17: "Drop_DhcpGuard", - 18: "Drop_RouterGuard", - 19: "Drop_BridgeReserved", - 20: "Drop_VirtualSubnetId", - 21: "Drop_RequiredExtensionMissing", - 22: "Drop_InvalidConfig", - 23: "Drop_MTUMismatch", - 24: "Drop_NativeFwdingReq", - 25: "Drop_InvalidVlanFormat", - 26: "Drop_InvalidDestMac", - 27: "Drop_InvalidSourceMac", - 28: "Drop_InvalidFirstNBTooSmall", - 29: "Drop_Wnv", - 30: "Drop_StormLimit", - 31: "Drop_InjectedIcmp", - 32: "Drop_FailedDestinationListUpdate", - 33: "Drop_NicDisabled", - 34: "Drop_FailedPacketFilter", - 35: "Drop_SwitchDataFlowDisabled", - 36: "Drop_FilteredIsolationUntagged", - 37: "Drop_InvalidPDQueue", - 38: "Drop_LowPower", - 201: "Drop_Pause", - 202: "Drop_Reset", - 203: "Drop_SendAborted", - 204: "Drop_ProtocolNotBound", - 205: "Drop_Failure", - 206: "Drop_InvalidLength", - 207: "Drop_HostOutOfMemory", - 208: "Drop_FrameTooLong", - 209: "Drop_FrameTooShort", - 210: "Drop_FrameLengthError", - 211: "Drop_CrcError", - 212: "Drop_BadFrameChecksum", - 213: "Drop_FcsError", - 214: "Drop_SymbolError", - 215: "Drop_HeadQTimeout", - 216: "Drop_StalledDiscard", - 217: "Drop_RxQFull", - 218: "Drop_PhysLayerError", - 219: "Drop_DmaError", - 220: "Drop_FirmwareError", - 221: "Drop_DecryptionFailed", - 222: "Drop_BadSignature", - 223: "Drop_CoalescingError", - 225: "Drop_VlanSpoofing", - 226: "Drop_UnallowedEtherType", - 227: "Drop_VportDown", - 228: "Drop_SteeringMismatch", - 401: "Drop_MicroportError", - 402: "Drop_VfNotReady", - 403: "Drop_MicroportNotReady", - 404: "Drop_VMBusError", - 601: "Drop_FL_LoopbackPacket", - 602: "Drop_FL_InvalidSnapHeader", - 603: "Drop_FL_InvalidEthernetType", - 604: "Drop_FL_InvalidPacketLength", - 605: "Drop_FL_HeaderNotContiguous", - 606: "Drop_FL_InvalidDestinationType", - 607: "Drop_FL_InterfaceNotReady", - 608: "Drop_FL_ProviderNotReady", - 609: "Drop_FL_InvalidLsoInfo", - 610: "Drop_FL_InvalidUsoInfo", - 611: "Drop_FL_InvalidMedium", - 612: "Drop_FL_InvalidArpHeader", - 613: "Drop_FL_NoClientInterface", - 614: "Drop_FL_TooManyNetBuffers", - 615: "Drop_FL_FlsNpiClientDrop", - 701: "Drop_ArpGuard", - 702: "Drop_ArpLimiter", - 703: "Drop_DhcpLimiter", - 704: "Drop_BlockBroadcast", - 705: "Drop_BlockNonIp", - 706: "Drop_ArpFilter", - 707: "Drop_Ipv4Guard", - 708: "Drop_Ipv6Guard", - 709: "Drop_MacGuard", - 710: "Drop_BroadcastNoDestinations", - 711: "Drop_UnicastNoDestination", - 712: "Drop_UnicastPortNotReady", - 713: "Drop_SwitchCallbackFailed", - 714: "Drop_Icmpv6Limiter", - 715: "Drop_Intercept", - 716: "Drop_InterceptBlock", - 717: "Drop_NDPGuard", - 718: "Drop_PortBlocked", - 719: "Drop_NicSuspended", - 901: "Drop_NL_BadSourceAddress", - 902: "Drop_NL_NotLocallyDestined", - 903: "Drop_NL_ProtocolUnreachable", - 904: "Drop_NL_PortUnreachable", - 905: "Drop_NL_BadLength", - 906: "Drop_NL_MalformedHeader", - 907: "Drop_NL_NoRoute", - 908: "Drop_NL_BeyondScope", - 909: "Drop_NL_InspectionDrop", - 910: "Drop_NL_TooManyDecapsulations", - 911: "Drop_NL_AdministrativelyProhibited", - 912: "Drop_NL_BadChecksum", - 913: "Drop_NL_ReceivePathMax", - 914: "Drop_NL_HopLimitExceeded", - 915: "Drop_NL_AddressUnreachable", - 916: "Drop_NL_RscPacket", - 917: "Drop_NL_ForwardPathMax", - 918: "Drop_NL_ArbitrationUnhandled", - 919: "Drop_NL_InspectionAbsorb", - 920: "Drop_NL_DontFragmentMtuExceeded", - 921: "Drop_NL_BufferLengthExceeded", - 922: "Drop_NL_AddressResolutionTimeout", - 923: "Drop_NL_AddressResolutionFailure", - 924: "Drop_NL_IpsecFailure", - 925: "Drop_NL_ExtensionHeadersFailure", - 926: "Drop_NL_IpsnpiClientDrop", - 927: "Drop_NL_UnsupportedOffload", - 928: "Drop_NL_RoutingFailure", - 929: "Drop_NL_AncillaryDataFailure", - 930: "Drop_NL_RawDataFailure", - 931: "Drop_NL_SessionStateFailure", - 932: "Drop_NL_IpsnpiModifiedButNotForwarded", - 933: "Drop_NL_IpsnpiNoNextHop", - 934: "Drop_NL_IpsnpiNoCompartment", - 935: "Drop_NL_IpsnpiNoInterface", - 936: "Drop_NL_IpsnpiNoSubInterface", - 937: "Drop_NL_IpsnpiInterfaceDisabled", - 938: "Drop_NL_IpsnpiSegmentationFailed", - 939: "Drop_NL_IpsnpiNoEthernetHeader", - 940: "Drop_NL_IpsnpiUnexpectedFragment", - 941: "Drop_NL_IpsnpiUnsupportedInterfaceType", - 942: "Drop_NL_IpsnpiInvalidLsoInfo", - 943: "Drop_NL_IpsnpiInvalidUsoInfo", - 944: "Drop_NL_InternalError", - 945: "Drop_NL_AdministrativelyConfigured", - 946: "Drop_NL_BadOption", - 947: "Drop_NL_LoopbackDisallowed", - 948: "Drop_NL_SmallerScope", - 949: "Drop_NL_QueueFull", - 950: "Drop_NL_InterfaceDisabled", - 951: "Drop_NL_IcmpGeneric", - 952: "Drop_NL_IcmpTruncatedHeader", - 953: "Drop_NL_IcmpInvalidChecksum", - 954: "Drop_NL_IcmpInspection", - 955: "Drop_NL_IcmpNeighborDiscoveryLoopback", - 956: "Drop_NL_IcmpUnknownType", - 957: "Drop_NL_IcmpTruncatedIpHeader", - 958: "Drop_NL_IcmpOversizedIpHeader", - 959: "Drop_NL_IcmpNoHandler", - 960: "Drop_NL_IcmpRespondingToError", - 961: "Drop_NL_IcmpInvalidSource", - 962: "Drop_NL_IcmpInterfaceRateLimit", - 963: "Drop_NL_IcmpPathRateLimit", - 964: "Drop_NL_IcmpNoRoute", - 965: "Drop_NL_IcmpMatchingRequestNotFound", - 966: "Drop_NL_IcmpBufferTooSmall", - 967: "Drop_NL_IcmpAncillaryDataQuery", - 968: "Drop_NL_IcmpIncorrectHopLimit", - 969: "Drop_NL_IcmpUnknownCode", - 970: "Drop_NL_IcmpSourceNotLinkLocal", - 971: "Drop_NL_IcmpTruncatedNdHeader", - 972: "Drop_NL_IcmpInvalidNdOptSourceLinkAddr", - 973: "Drop_NL_IcmpInvalidNdOptMtu", - 974: "Drop_NL_IcmpInvalidNdOptPrefixInformation", - 975: "Drop_NL_IcmpInvalidNdOptRouteInformation", - 976: "Drop_NL_IcmpInvalidNdOptRdnss", - 977: "Drop_NL_IcmpInvalidNdOptDnssl", - 978: "Drop_NL_IcmpPacketParsingFailure", - 979: "Drop_NL_IcmpDisallowed", - 980: "Drop_NL_IcmpInvalidRouterAdvertisement", - 981: "Drop_NL_IcmpSourceFromDifferentLink", - 982: "Drop_NL_IcmpInvalidRedirectDestinationOrTarget", - 983: "Drop_NL_IcmpInvalidNdTarget", - 984: "Drop_NL_IcmpNaMulticastAndSolicited", - 985: "Drop_NL_IcmpNdLinkLayerAddressIsLocal", - 986: "Drop_NL_IcmpDuplicateEchoRequest", - 987: "Drop_NL_IcmpNotAPotentialRouter", - 988: "Drop_NL_IcmpInvalidMldQuery", - 989: "Drop_NL_IcmpInvalidMldReport", - 990: "Drop_NL_IcmpLocallySourcedMldReport", - 991: "Drop_NL_IcmpNotLocallyDestined", - 992: "Drop_NL_ArpInvalidSource", - 993: "Drop_NL_ArpInvalidTarget", - 994: "Drop_NL_ArpDlSourceIsLocal", - 995: "Drop_NL_ArpNotLocallyDestined", - 996: "Drop_NL_NlClientDiscard", - 997: "Drop_NL_IpsnpiUroSegmentSizeExceedsMtu", - 998: "Drop_NL_IcmpFragmentedPacket", - 999: "Drop_NL_FirstFragmentIncomplete", - 1000: "Drop_NL_SourceViolation", - 1001: "Drop_NL_IcmpJumbogram", - 1002: "Drop_NL_SwUsoFailure", - 1200: "Drop_INET_SourceUnspecified", - 1201: "Drop_INET_DestinationMulticast", - 1202: "Drop_INET_HeaderInvalid", - 1203: "Drop_INET_ChecksumInvalid", - 1204: "Drop_INET_EndpointNotFound", - 1205: "Drop_INET_ConnectedPath", - 1206: "Drop_INET_SessionState", - 1207: "Drop_INET_ReceiveInspection", - 1208: "Drop_INET_AckInvalid", - 1209: "Drop_INET_ExpectedSyn", - 1210: "Drop_INET_Rst", - 1211: "Drop_INET_SynRcvdSyn", - 1212: "Drop_INET_SimultaneousConnect", - 1213: "Drop_INET_PawsFailed", - 1214: "Drop_INET_LandAttack", - 1215: "Drop_INET_MissedReset", - 1216: "Drop_INET_OutsideWindow", - 1217: "Drop_INET_DuplicateSegment", - 1218: "Drop_INET_ClosedWindow", - 1219: "Drop_INET_TcbRemoved", - 1220: "Drop_INET_FinWait2", - 1221: "Drop_INET_ReassemblyConflict", - 1222: "Drop_INET_FinReceived", - 1223: "Drop_INET_ListenerInvalidFlags", - 1224: "Drop_INET_TcbNotInTcbTable", - 1225: "Drop_INET_TimeWaitTcbReceivedRstOutsideWindow", - 1226: "Drop_INET_TimeWaitTcbSynAndOtherFlags", - 1227: "Drop_INET_TimeWaitTcb", - 1228: "Drop_INET_SynAckWithFastopenCookieRequest", - 1229: "Drop_INET_PauseAccept", - 1230: "Drop_INET_SynAttack", - 1231: "Drop_INET_AcceptInspection", - 1232: "Drop_INET_AcceptRedirection", - 1301: "Drop_SlbMux_ParsingFailure", - 1302: "Drop_SlbMux_FirstFragmentMiss", - 1303: "Drop_SlbMux_ICMPErrorPayloadValidationFailure", - 1304: "Drop_SlbMux_ICMPErrorPacketMatchNoSession", - 1305: "Drop_SlbMux_ExternalHairpinNexthopLookupFailure", - 1306: "Drop_SlbMux_NoMatchingStaticMapping", - 1307: "Drop_SlbMux_NexthopReferenceFailure", - 1308: "Drop_SlbMux_CloningFailure", - 1309: "Drop_SlbMux_TranslationFailure", - 1310: "Drop_SlbMux_HopLimitExceeded", - 1311: "Drop_SlbMux_PacketBiggerThanMTU", - 1312: "Drop_SlbMux_UnexpectedRouteLookupFailure", - 1313: "Drop_SlbMux_NoRoute", - 1314: "Drop_SlbMux_SessionCreationFailure", - 1315: "Drop_SlbMux_NexthopNotOverExternalInterface", - 1316: "Drop_SlbMux_NexthopExternalInterfaceMissNATInstance", - 1317: "Drop_SlbMux_NATItselfCantBeInternalNexthop", - 1318: "Drop_SlbMux_PacketRoutableInItsArrivalCompartment", - 1319: "Drop_SlbMux_PacketTransportProtocolNotSupported", - 1320: "Drop_SlbMux_PacketIsDestinedLocally", - 1321: "Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT", - 1322: "Drop_SlbMux_MuxReject", - 1323: "Drop_SlbMux_DipLookupFailure", - 1324: "Drop_SlbMux_MuxEncapsulationFailure", - 1325: "Drop_SlbMux_InvalidDiagPacketEncapType", - 1326: "Drop_SlbMux_DiagPacketIsRedirect", - 1327: "Drop_SlbMux_UnableToHandleRedirect", - 1401: "Drop_Ipsec_BadSpi", - 1402: "Drop_Ipsec_SALifetimeExpired", - 1403: "Drop_Ipsec_WrongSA", - 1404: "Drop_Ipsec_ReplayCheckFailed", - 1405: "Drop_Ipsec_InvalidPacket", - 1406: "Drop_Ipsec_IntegrityCheckFailed", - 1407: "Drop_Ipsec_ClearTextDrop", - 1408: "Drop_Ipsec_AuthFirewallDrop", - 1409: "Drop_Ipsec_ThrottleDrop", - 1410: "Drop_Ipsec_Dosp_Block", - 1411: "Drop_Ipsec_Dosp_ReceivedMulticast", - 1412: "Drop_Ipsec_Dosp_InvalidPacket", - 1413: "Drop_Ipsec_Dosp_StateLookupFailed", - 1414: "Drop_Ipsec_Dosp_MaxEntries", - 1415: "Drop_Ipsec_Dosp_KeymodNotAllowed", - 1416: "Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues", - 1417: "Drop_Ipsec_NoMemory", - 1418: "Drop_Ipsec_Unsuccessful", - 1501: "Drop_NetCx_NetPacketLayoutParseFailure", - 1502: "Drop_NetCx_SoftwareChecksumFailure", - 1503: "Drop_NetCx_NicQueueStop", - 1504: "Drop_NetCx_InvalidNetBufferLength", - 1505: "Drop_NetCx_LSOFailure", - 1506: "Drop_NetCx_USOFailure", - 1507: "Drop_NetCx_BufferBounceFailureAndPacketIgnore", - 3000: "Drop_Http_Begin", - 3001: "Drop_Http_UlError_Begin", - 3002: "Drop_Http_UlError", - 3003: "Drop_Http_UlErrorVerb", - 3004: "Drop_Http_UlErrorUrl", - 3005: "Drop_Http_UlErrorHeader", - 3006: "Drop_Http_UlErrorHost", - 3007: "Drop_Http_UlErrorNum", - 3008: "Drop_Http_UlErrorFieldLength", - 3009: "Drop_Http_UlErrorRequestLength", - 3010: "Drop_Http_UlErrorUnauthorized", - 3011: "Drop_Http_UlErrorForbiddenUrl", - 3012: "Drop_Http_UlErrorNotFound", - 3013: "Drop_Http_UlErrorContentLength", - 3014: "Drop_Http_UlErrorPreconditionFailed", - 3015: "Drop_Http_UlErrorEntityTooLarge", - 3016: "Drop_Http_UlErrorUrlLength", - 3017: "Drop_Http_UlErrorRangeNotSatisfiable", - 3018: "Drop_Http_UlErrorMisdirectedRequest", - 3019: "Drop_Http_UlErrorInternalServer", - 3020: "Drop_Http_UlErrorNotImplemented", - 3021: "Drop_Http_UlErrorUnavailable", - 3022: "Drop_Http_UlErrorConnectionLimit", - 3023: "Drop_Http_UlErrorRapidFailProtection", - 3024: "Drop_Http_UlErrorRequestQueueFull", - 3025: "Drop_Http_UlErrorDisabledByAdmin", - 3026: "Drop_Http_UlErrorDisabledByApp", - 3027: "Drop_Http_UlErrorJobObjectFired", - 3028: "Drop_Http_UlErrorAppPoolBusy", - 3029: "Drop_Http_UlErrorVersion", - 3030: "Drop_Http_UlError_End", - 3400: "Drop_Http_UxDuoFaultBegin", - 3401: "Drop_Http_UxDuoFaultUserAbort", - 3402: "Drop_Http_UxDuoFaultCollection", - 3403: "Drop_Http_UxDuoFaultClientResetStream", - 3404: "Drop_Http_UxDuoFaultMethodNotFound", - 3405: "Drop_Http_UxDuoFaultSchemeMismatch", - 3406: "Drop_Http_UxDuoFaultSchemeNotFound", - 3407: "Drop_Http_UxDuoFaultDataAfterEnd", - 3408: "Drop_Http_UxDuoFaultPathNotFound", - 3409: "Drop_Http_UxDuoFaultHalfClosedLocal", - 3410: "Drop_Http_UxDuoFaultIncompatibleAuth", - 3411: "Drop_Http_UxDuoFaultDeprecated3", - 3412: "Drop_Http_UxDuoFaultClientCertBlocked", - 3413: "Drop_Http_UxDuoFaultHeaderNameEmpty", - 3414: "Drop_Http_UxDuoFaultIllegalSend", - 3415: "Drop_Http_UxDuoFaultPushUpperAttach", - 3416: "Drop_Http_UxDuoFaultStreamUpperAttach", - 3417: "Drop_Http_UxDuoFaultActiveStreamLimit", - 3418: "Drop_Http_UxDuoFaultAuthorityNotFound", - 3419: "Drop_Http_UxDuoFaultUnexpectedTail", - 3420: "Drop_Http_UxDuoFaultTruncated", - 3421: "Drop_Http_UxDuoFaultResponseHold", - 3422: "Drop_Http_UxDuoFaultRequestChunked", - 3423: "Drop_Http_UxDuoFaultRequestContentLength", - 3424: "Drop_Http_UxDuoFaultResponseChunked", - 3425: "Drop_Http_UxDuoFaultResponseContentLength", - 3426: "Drop_Http_UxDuoFaultResponseTransferEncoding", - 3427: "Drop_Http_UxDuoFaultResponseLine", - 3428: "Drop_Http_UxDuoFaultResponseHeader", - 3429: "Drop_Http_UxDuoFaultConnect", - 3430: "Drop_Http_UxDuoFaultChunkStart", - 3431: "Drop_Http_UxDuoFaultChunkLength", - 3432: "Drop_Http_UxDuoFaultChunkStop", - 3433: "Drop_Http_UxDuoFaultHeadersAfterTrailers", - 3434: "Drop_Http_UxDuoFaultHeadersAfterEnd", - 3435: "Drop_Http_UxDuoFaultEndlessTrailer", - 3436: "Drop_Http_UxDuoFaultTransferEncoding", - 3437: "Drop_Http_UxDuoFaultMultipleTransferCodings", - 3438: "Drop_Http_UxDuoFaultPushBody", - 3439: "Drop_Http_UxDuoFaultStreamAbandoned", - 3440: "Drop_Http_UxDuoFaultMalformedHost", - 3441: "Drop_Http_UxDuoFaultDecompressionOverflow", - 3442: "Drop_Http_UxDuoFaultIllegalHeaderName", - 3443: "Drop_Http_UxDuoFaultIllegalHeaderValue", - 3444: "Drop_Http_UxDuoFaultConnHeaderDisallowed", - 3445: "Drop_Http_UxDuoFaultConnHeaderMalformed", - 3446: "Drop_Http_UxDuoFaultCookieReassembly", - 3447: "Drop_Http_UxDuoFaultStatusHeader", - 3448: "Drop_Http_UxDuoFaultSchemeDisallowed", - 3449: "Drop_Http_UxDuoFaultPathDisallowed", - 3450: "Drop_Http_UxDuoFaultPushHost", - 3451: "Drop_Http_UxDuoFaultGoawayReceived", - 3452: "Drop_Http_UxDuoFaultAbortLegacyApp", - 3453: "Drop_Http_UxDuoFaultUpgradeHeaderDisallowed", - 3454: "Drop_Http_UxDuoFaultResponseUpgradeHeader", - 3455: "Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed", - 3456: "Drop_Http_UxDuoFaultResponseKeepAliveHeader", - 3457: "Drop_Http_UxDuoFaultProxyConnHeaderDisallowed", - 3458: "Drop_Http_UxDuoFaultResponseProxyConnHeader", - 3459: "Drop_Http_UxDuoFaultConnectionGoingAway", - 3460: "Drop_Http_UxDuoFaultTransferEncodingDisallowed", - 3461: "Drop_Http_UxDuoFaultContentLengthDisallowed", - 3462: "Drop_Http_UxDuoFaultTrailerDisallowed", - 3463: "Drop_Http_UxDuoFaultEnd", - 3600: "Drop_Http_ReceiveSuppressed", - 3800: "Drop_Http_Generic", - 3801: "Drop_Http_InvalidParameter", - 3802: "Drop_Http_InsufficientResources", - 3803: "Drop_Http_InvalidHandle", - 3804: "Drop_Http_NotSupported", - 3805: "Drop_Http_BadNetworkPath", - 3806: "Drop_Http_InternalError", - 3807: "Drop_Http_NoSuchPackage", - 3808: "Drop_Http_PrivilegeNotHeld", - 3809: "Drop_Http_CannotImpersonate", - 3810: "Drop_Http_LogonFailure", - 3811: "Drop_Http_NoSuchLogonSession", - 3812: "Drop_Http_AccessDenied", - 3813: "Drop_Http_NoLogonServers", - 3814: "Drop_Http_TimeDifferenceAtDc", - 4000: "Drop_Http_End", + 0: "Reason_Success", + 2: "Reason_InvalidPacket", + 3: "Reason_PlainText", + 4: "Reason_InterfaceDecrypted", + 5: "Reason_LbNoBackendSlot", + 6: "Reason_LbNoBackend", + 7: "Reason_LbReverseNatUpdate", + 8: "Resaon_LbReverseNatStale", + 9: "Reason_FragmentedPacket", + 10: "Reason_FragmentedPacketUpdated", + 11: "Reason_MissedCustomCall", + 132: "DropReason_InvalidSIP", + 133: "DropReason_Policy", + 134: "DropReason_Invalid", + 135: "DropReason_CTInvalidHdr", + 136: "DropReason_FragNeeded", + 137: "DropReason_CTUnknownProto", + 138: "DropReason_UnknownL3", + 139: "DropReason_MissedTailCall", + 140: "DropReason_WriteError", + 141: "DropReason_UnknownL4", + 142: "DropReason_UnknownICMPCode", + 143: "DropReason_UnknownICMPType", + 144: "DropReason_UnknownICMP6Code", + 145: "DropReason_UnknownICMP6Type", + 146: "DropReason_UnknownICMP6Type_2", + 147: "DropReason_NoTunnelKey", + 148: "DropReason_Unknown_1", + 149: "DropReason_Unknown_2", + 150: "DropReason_UnknownTarget", + 151: "DropReason_Unroutable", + 152: "DropReason_Unknown_3", + 153: "DropReason_CSUM_L3", + 154: "DropReason_CSUM_L4", + 155: "DropReason_CTCreateFailed", + 156: "DropReason_InvalidExthdr", + 157: "DropReason_FragNoSupport", + 158: "DropReason_NoService", + 159: "DropReason_UnsuppServiceProto", + 160: "DropReason_NoTunnelEndpoint", + 161: "DropReason_NAT46X64Disabled", + 162: "DropReason_EDTHorizon", + 163: "DropReason_UnknownCT", + 164: "DropReason_HostUnreachable", + 165: "DropReason_NoConfig", + 166: "DropReason_UnsupportedL2", + 167: "DropReason_NatNoMapping", + 168: "DropReason_NatUnsuppProto", + 169: "DropReason_NoFIB", + 170: "DropReason_EncapProhibited", + 171: "DropReason_InvalidIdentity", + 172: "DropReason_UnknownSender", + 173: "DropReason_NatNotNeeded", + 174: "DropReason_IsClusterIP", + 175: "DropReason_FragNotFound", + 176: "DropReason_ForbiddenICMP6", + 177: "DropReason_NotInSrcRange", + 178: "DropReason_ProxyLookupFailed", + 179: "DropReason_ProxySetFailed", + 180: "DropReason_ProxyUnknownProto", + 181: "DropReason_PolicyDeny", + 182: "DropReason_VlanFiltered", + 183: "DropReason_InvalidVNI", + 184: "DropReason_InvalidTCBuffer", + 185: "DropReason_NoSID", + 186: "DropReason_MissingSRv6State", + 187: "DropReason_NAT46", + 188: "DropReason_NAT64", + 189: "DropReason_PolicyAuthRequired", + 190: "DropReason_CTNoMapFound", + 191: "DropReason_SNATNoMapFound", + 192: "DropReason_InvalidClusterID", + 193: "DropReason_DSR_ENCAP_UNSUPP_PROTO", + 194: "DropReason_NoEgressGateway", + 195: "DropReason_UnencryptedTraffic", + 196: "DropReason_TTLExceeded", + 197: "DropReason_NoNodeID", + 198: "DropReason_RateLimited", + 199: "DropReason_IGMPHandled", + 200: "DropReason_IGMPSubscribed", + 201: "DropReason_MulticastHandled", + 202: "DropReason_HostNotReady", + 203: "DropReason_EpNotReady", + 220: "DropReason_PacketMonitor", + 1073741825: "Drop_InvalidData", + 1073741826: "Drop_InvalidPacket", + 1073741827: "Drop_Resources", + 1073741828: "Drop_NotReady", + 1073741829: "Drop_Disconnected", + 1073741830: "Drop_NotAccepted", + 1073741831: "Drop_Busy", + 1073741832: "Drop_Filtered", + 1073741833: "Drop_FilteredVLAN", + 1073741834: "Drop_UnauthorizedVLAN", + 1073741835: "Drop_UnauthorizedMAC", + 1073741836: "Drop_FailedSecurityPolicy", + 1073741837: "Drop_FailedPvlanSetting", + 1073741838: "Drop_Qos", + 1073741839: "Drop_Ipsec", + 1073741840: "Drop_MacSpoofing", + 1073741841: "Drop_DhcpGuard", + 1073741842: "Drop_RouterGuard", + 1073741843: "Drop_BridgeReserved", + 1073741844: "Drop_VirtualSubnetId", + 1073741845: "Drop_RequiredExtensionMissing", + 1073741846: "Drop_InvalidConfig", + 1073741847: "Drop_MTUMismatch", + 1073741848: "Drop_NativeFwdingReq", + 1073741849: "Drop_InvalidVlanFormat", + 1073741850: "Drop_InvalidDestMac", + 1073741851: "Drop_InvalidSourceMac", + 1073741852: "Drop_InvalidFirstNBTooSmall", + 1073741853: "Drop_Wnv", + 1073741854: "Drop_StormLimit", + 1073741855: "Drop_InjectedIcmp", + 1073741856: "Drop_FailedDestinationListUpdate", + 1073741857: "Drop_NicDisabled", + 1073741858: "Drop_FailedPacketFilter", + 1073741859: "Drop_SwitchDataFlowDisabled", + 1073741860: "Drop_FilteredIsolationUntagged", + 1073741861: "Drop_InvalidPDQueue", + 1073741862: "Drop_LowPower", + 1073742025: "Drop_Pause", + 1073742026: "Drop_Reset", + 1073742027: "Drop_SendAborted", + 1073742028: "Drop_ProtocolNotBound", + 1073742029: "Drop_Failure", + 1073742030: "Drop_InvalidLength", + 1073742031: "Drop_HostOutOfMemory", + 1073742032: "Drop_FrameTooLong", + 1073742033: "Drop_FrameTooShort", + 1073742034: "Drop_FrameLengthError", + 1073742035: "Drop_CrcError", + 1073742036: "Drop_BadFrameChecksum", + 1073742037: "Drop_FcsError", + 1073742038: "Drop_SymbolError", + 1073742039: "Drop_HeadQTimeout", + 1073742040: "Drop_StalledDiscard", + 1073742041: "Drop_RxQFull", + 1073742042: "Drop_PhysLayerError", + 1073742043: "Drop_DmaError", + 1073742044: "Drop_FirmwareError", + 1073742045: "Drop_DecryptionFailed", + 1073742046: "Drop_BadSignature", + 1073742047: "Drop_CoalescingError", + 1073742049: "Drop_VlanSpoofing", + 1073742050: "Drop_UnallowedEtherType", + 1073742051: "Drop_VportDown", + 1073742052: "Drop_SteeringMismatch", + 1073742225: "Drop_MicroportError", + 1073742226: "Drop_VfNotReady", + 1073742227: "Drop_MicroportNotReady", + 1073742228: "Drop_VMBusError", + 1073742425: "Drop_FL_LoopbackPacket", + 1073742426: "Drop_FL_InvalidSnapHeader", + 1073742427: "Drop_FL_InvalidEthernetType", + 1073742428: "Drop_FL_InvalidPacketLength", + 1073742429: "Drop_FL_HeaderNotContiguous", + 1073742430: "Drop_FL_InvalidDestinationType", + 1073742431: "Drop_FL_InterfaceNotReady", + 1073742432: "Drop_FL_ProviderNotReady", + 1073742433: "Drop_FL_InvalidLsoInfo", + 1073742434: "Drop_FL_InvalidUsoInfo", + 1073742435: "Drop_FL_InvalidMedium", + 1073742436: "Drop_FL_InvalidArpHeader", + 1073742437: "Drop_FL_NoClientInterface", + 1073742438: "Drop_FL_TooManyNetBuffers", + 1073742439: "Drop_FL_FlsNpiClientDrop", + 1073742525: "Drop_ArpGuard", + 1073742526: "Drop_ArpLimiter", + 1073742527: "Drop_DhcpLimiter", + 1073742528: "Drop_BlockBroadcast", + 1073742529: "Drop_BlockNonIp", + 1073742530: "Drop_ArpFilter", + 1073742531: "Drop_Ipv4Guard", + 1073742532: "Drop_Ipv6Guard", + 1073742533: "Drop_MacGuard", + 1073742534: "Drop_BroadcastNoDestinations", + 1073742535: "Drop_UnicastNoDestination", + 1073742536: "Drop_UnicastPortNotReady", + 1073742537: "Drop_SwitchCallbackFailed", + 1073742538: "Drop_Icmpv6Limiter", + 1073742539: "Drop_Intercept", + 1073742540: "Drop_InterceptBlock", + 1073742541: "Drop_NDPGuard", + 1073742542: "Drop_PortBlocked", + 1073742543: "Drop_NicSuspended", + 1073742725: "Drop_NL_BadSourceAddress", + 1073742726: "Drop_NL_NotLocallyDestined", + 1073742727: "Drop_NL_ProtocolUnreachable", + 1073742728: "Drop_NL_PortUnreachable", + 1073742729: "Drop_NL_BadLength", + 1073742730: "Drop_NL_MalformedHeader", + 1073742731: "Drop_NL_NoRoute", + 1073742732: "Drop_NL_BeyondScope", + 1073742733: "Drop_NL_InspectionDrop", + 1073742734: "Drop_NL_TooManyDecapsulations", + 1073742735: "Drop_NL_AdministrativelyProhibited", + 1073742736: "Drop_NL_BadChecksum", + 1073742737: "Drop_NL_ReceivePathMax", + 1073742738: "Drop_NL_HopLimitExceeded", + 1073742739: "Drop_NL_AddressUnreachable", + 1073742740: "Drop_NL_RscPacket", + 1073742741: "Drop_NL_ForwardPathMax", + 1073742742: "Drop_NL_ArbitrationUnhandled", + 1073742743: "Drop_NL_InspectionAbsorb", + 1073742744: "Drop_NL_DontFragmentMtuExceeded", + 1073742745: "Drop_NL_BufferLengthExceeded", + 1073742746: "Drop_NL_AddressResolutionTimeout", + 1073742747: "Drop_NL_AddressResolutionFailure", + 1073742748: "Drop_NL_IpsecFailure", + 1073742749: "Drop_NL_ExtensionHeadersFailure", + 1073742750: "Drop_NL_IpsnpiClientDrop", + 1073742751: "Drop_NL_UnsupportedOffload", + 1073742752: "Drop_NL_RoutingFailure", + 1073742753: "Drop_NL_AncillaryDataFailure", + 1073742754: "Drop_NL_RawDataFailure", + 1073742755: "Drop_NL_SessionStateFailure", + 1073742756: "Drop_NL_IpsnpiModifiedButNotForwarded", + 1073742757: "Drop_NL_IpsnpiNoNextHop", + 1073742758: "Drop_NL_IpsnpiNoCompartment", + 1073742759: "Drop_NL_IpsnpiNoInterface", + 1073742760: "Drop_NL_IpsnpiNoSubInterface", + 1073742761: "Drop_NL_IpsnpiInterfaceDisabled", + 1073742762: "Drop_NL_IpsnpiSegmentationFailed", + 1073742763: "Drop_NL_IpsnpiNoEthernetHeader", + 1073742764: "Drop_NL_IpsnpiUnexpectedFragment", + 1073742765: "Drop_NL_IpsnpiUnsupportedInterfaceType", + 1073742766: "Drop_NL_IpsnpiInvalidLsoInfo", + 1073742767: "Drop_NL_IpsnpiInvalidUsoInfo", + 1073742768: "Drop_NL_InternalError", + 1073742769: "Drop_NL_AdministrativelyConfigured", + 1073742770: "Drop_NL_BadOption", + 1073742771: "Drop_NL_LoopbackDisallowed", + 1073742772: "Drop_NL_SmallerScope", + 1073742773: "Drop_NL_QueueFull", + 1073742774: "Drop_NL_InterfaceDisabled", + 1073742775: "Drop_NL_IcmpGeneric", + 1073742776: "Drop_NL_IcmpTruncatedHeader", + 1073742777: "Drop_NL_IcmpInvalidChecksum", + 1073742778: "Drop_NL_IcmpInspection", + 1073742779: "Drop_NL_IcmpNeighborDiscoveryLoopback", + 1073742780: "Drop_NL_IcmpUnknownType", + 1073742781: "Drop_NL_IcmpTruncatedIpHeader", + 1073742782: "Drop_NL_IcmpOversizedIpHeader", + 1073742783: "Drop_NL_IcmpNoHandler", + 1073742784: "Drop_NL_IcmpRespondingToError", + 1073742785: "Drop_NL_IcmpInvalidSource", + 1073742786: "Drop_NL_IcmpInterfaceRateLimit", + 1073742787: "Drop_NL_IcmpPathRateLimit", + 1073742788: "Drop_NL_IcmpNoRoute", + 1073742789: "Drop_NL_IcmpMatchingRequestNotFound", + 1073742790: "Drop_NL_IcmpBufferTooSmall", + 1073742791: "Drop_NL_IcmpAncillaryDataQuery", + 1073742792: "Drop_NL_IcmpIncorrectHopLimit", + 1073742793: "Drop_NL_IcmpUnknownCode", + 1073742794: "Drop_NL_IcmpSourceNotLinkLocal", + 1073742795: "Drop_NL_IcmpTruncatedNdHeader", + 1073742796: "Drop_NL_IcmpInvalidNdOptSourceLinkAddr", + 1073742797: "Drop_NL_IcmpInvalidNdOptMtu", + 1073742798: "Drop_NL_IcmpInvalidNdOptPrefixInformation", + 1073742799: "Drop_NL_IcmpInvalidNdOptRouteInformation", + 1073742800: "Drop_NL_IcmpInvalidNdOptRdnss", + 1073742801: "Drop_NL_IcmpInvalidNdOptDnssl", + 1073742802: "Drop_NL_IcmpPacketParsingFailure", + 1073742803: "Drop_NL_IcmpDisallowed", + 1073742804: "Drop_NL_IcmpInvalidRouterAdvertisement", + 1073742805: "Drop_NL_IcmpSourceFromDifferentLink", + 1073742806: "Drop_NL_IcmpInvalidRedirectDestinationOrTarget", + 1073742807: "Drop_NL_IcmpInvalidNdTarget", + 1073742808: "Drop_NL_IcmpNaMulticastAndSolicited", + 1073742809: "Drop_NL_IcmpNdLinkLayerAddressIsLocal", + 1073742810: "Drop_NL_IcmpDuplicateEchoRequest", + 1073742811: "Drop_NL_IcmpNotAPotentialRouter", + 1073742812: "Drop_NL_IcmpInvalidMldQuery", + 1073742813: "Drop_NL_IcmpInvalidMldReport", + 1073742814: "Drop_NL_IcmpLocallySourcedMldReport", + 1073742815: "Drop_NL_IcmpNotLocallyDestined", + 1073742816: "Drop_NL_ArpInvalidSource", + 1073742817: "Drop_NL_ArpInvalidTarget", + 1073742818: "Drop_NL_ArpDlSourceIsLocal", + 1073742819: "Drop_NL_ArpNotLocallyDestined", + 1073742820: "Drop_NL_NlClientDiscard", + 1073742821: "Drop_NL_IpsnpiUroSegmentSizeExceedsMtu", + 1073742822: "Drop_NL_IcmpFragmentedPacket", + 1073742823: "Drop_NL_FirstFragmentIncomplete", + 1073742824: "Drop_NL_SourceViolation", + 1073742825: "Drop_NL_IcmpJumbogram", + 1073742826: "Drop_NL_SwUsoFailure", + 1073743024: "Drop_INET_SourceUnspecified", + 1073743025: "Drop_INET_DestinationMulticast", + 1073743026: "Drop_INET_HeaderInvalid", + 1073743027: "Drop_INET_ChecksumInvalid", + 1073743028: "Drop_INET_EndpointNotFound", + 1073743029: "Drop_INET_ConnectedPath", + 1073743030: "Drop_INET_SessionState", + 1073743031: "Drop_INET_ReceiveInspection", + 1073743032: "Drop_INET_AckInvalid", + 1073743033: "Drop_INET_ExpectedSyn", + 1073743034: "Drop_INET_Rst", + 1073743035: "Drop_INET_SynRcvdSyn", + 1073743036: "Drop_INET_SimultaneousConnect", + 1073743037: "Drop_INET_PawsFailed", + 1073743038: "Drop_INET_LandAttack", + 1073743039: "Drop_INET_MissedReset", + 1073743040: "Drop_INET_OutsideWindow", + 1073743041: "Drop_INET_DuplicateSegment", + 1073743042: "Drop_INET_ClosedWindow", + 1073743043: "Drop_INET_TcbRemoved", + 1073743044: "Drop_INET_FinWait2", + 1073743045: "Drop_INET_ReassemblyConflict", + 1073743046: "Drop_INET_FinReceived", + 1073743047: "Drop_INET_ListenerInvalidFlags", + 1073743048: "Drop_INET_TcbNotInTcbTable", + 1073743049: "Drop_INET_TimeWaitTcbReceivedRstOutsideWindow", + 1073743050: "Drop_INET_TimeWaitTcbSynAndOtherFlags", + 1073743051: "Drop_INET_TimeWaitTcb", + 1073743052: "Drop_INET_SynAckWithFastopenCookieRequest", + 1073743053: "Drop_INET_PauseAccept", + 1073743054: "Drop_INET_SynAttack", + 1073743055: "Drop_INET_AcceptInspection", + 1073743056: "Drop_INET_AcceptRedirection", + 1073743125: "Drop_SlbMux_ParsingFailure", + 1073743126: "Drop_SlbMux_FirstFragmentMiss", + 1073743127: "Drop_SlbMux_ICMPErrorPayloadValidationFailure", + 1073743128: "Drop_SlbMux_ICMPErrorPacketMatchNoSession", + 1073743129: "Drop_SlbMux_ExternalHairpinNexthopLookupFailure", + 1073743130: "Drop_SlbMux_NoMatchingStaticMapping", + 1073743131: "Drop_SlbMux_NexthopReferenceFailure", + 1073743132: "Drop_SlbMux_CloningFailure", + 1073743133: "Drop_SlbMux_TranslationFailure", + 1073743134: "Drop_SlbMux_HopLimitExceeded", + 1073743135: "Drop_SlbMux_PacketBiggerThanMTU", + 1073743136: "Drop_SlbMux_UnexpectedRouteLookupFailure", + 1073743137: "Drop_SlbMux_NoRoute", + 1073743138: "Drop_SlbMux_SessionCreationFailure", + 1073743139: "Drop_SlbMux_NexthopNotOverExternalInterface", + 1073743140: "Drop_SlbMux_NexthopExternalInterfaceMissNATInstance", + 1073743141: "Drop_SlbMux_NATItselfCantBeInternalNexthop", + 1073743142: "Drop_SlbMux_PacketRoutableInItsArrivalCompartment", + 1073743143: "Drop_SlbMux_PacketTransportProtocolNotSupported", + 1073743144: "Drop_SlbMux_PacketIsDestinedLocally", + 1073743145: "Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT", + 1073743146: "Drop_SlbMux_MuxReject", + 1073743147: "Drop_SlbMux_DipLookupFailure", + 1073743148: "Drop_SlbMux_MuxEncapsulationFailure", + 1073743149: "Drop_SlbMux_InvalidDiagPacketEncapType", + 1073743150: "Drop_SlbMux_DiagPacketIsRedirect", + 1073743151: "Drop_SlbMux_UnableToHandleRedirect", + 1073743225: "Drop_Ipsec_BadSpi", + 1073743226: "Drop_Ipsec_SALifetimeExpired", + 1073743227: "Drop_Ipsec_WrongSA", + 1073743228: "Drop_Ipsec_ReplayCheckFailed", + 1073743229: "Drop_Ipsec_InvalidPacket", + 1073743230: "Drop_Ipsec_IntegrityCheckFailed", + 1073743231: "Drop_Ipsec_ClearTextDrop", + 1073743232: "Drop_Ipsec_AuthFirewallDrop", + 1073743233: "Drop_Ipsec_ThrottleDrop", + 1073743234: "Drop_Ipsec_Dosp_Block", + 1073743235: "Drop_Ipsec_Dosp_ReceivedMulticast", + 1073743236: "Drop_Ipsec_Dosp_InvalidPacket", + 1073743237: "Drop_Ipsec_Dosp_StateLookupFailed", + 1073743238: "Drop_Ipsec_Dosp_MaxEntries", + 1073743239: "Drop_Ipsec_Dosp_KeymodNotAllowed", + 1073743240: "Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues", + 1073743241: "Drop_Ipsec_NoMemory", + 1073743242: "Drop_Ipsec_Unsuccessful", + 1073743325: "Drop_NetCx_NetPacketLayoutParseFailure", + 1073743326: "Drop_NetCx_SoftwareChecksumFailure", + 1073743327: "Drop_NetCx_NicQueueStop", + 1073743328: "Drop_NetCx_InvalidNetBufferLength", + 1073743329: "Drop_NetCx_LSOFailure", + 1073743330: "Drop_NetCx_USOFailure", + 1073743331: "Drop_NetCx_BufferBounceFailureAndPacketIgnore", + 1073744824: "Drop_Http_Begin", + 1073744825: "Drop_Http_UlError_Begin", + 1073744826: "Drop_Http_UlError", + 1073744827: "Drop_Http_UlErrorVerb", + 1073744828: "Drop_Http_UlErrorUrl", + 1073744829: "Drop_Http_UlErrorHeader", + 1073744830: "Drop_Http_UlErrorHost", + 1073744831: "Drop_Http_UlErrorNum", + 1073744832: "Drop_Http_UlErrorFieldLength", + 1073744833: "Drop_Http_UlErrorRequestLength", + 1073744834: "Drop_Http_UlErrorUnauthorized", + 1073744835: "Drop_Http_UlErrorForbiddenUrl", + 1073744836: "Drop_Http_UlErrorNotFound", + 1073744837: "Drop_Http_UlErrorContentLength", + 1073744838: "Drop_Http_UlErrorPreconditionFailed", + 1073744839: "Drop_Http_UlErrorEntityTooLarge", + 1073744840: "Drop_Http_UlErrorUrlLength", + 1073744841: "Drop_Http_UlErrorRangeNotSatisfiable", + 1073744842: "Drop_Http_UlErrorMisdirectedRequest", + 1073744843: "Drop_Http_UlErrorInternalServer", + 1073744844: "Drop_Http_UlErrorNotImplemented", + 1073744845: "Drop_Http_UlErrorUnavailable", + 1073744846: "Drop_Http_UlErrorConnectionLimit", + 1073744847: "Drop_Http_UlErrorRapidFailProtection", + 1073744848: "Drop_Http_UlErrorRequestQueueFull", + 1073744849: "Drop_Http_UlErrorDisabledByAdmin", + 1073744850: "Drop_Http_UlErrorDisabledByApp", + 1073744851: "Drop_Http_UlErrorJobObjectFired", + 1073744852: "Drop_Http_UlErrorAppPoolBusy", + 1073744853: "Drop_Http_UlErrorVersion", + 1073744854: "Drop_Http_UlError_End", + 1073745224: "Drop_Http_UxDuoFaultBegin", + 1073745225: "Drop_Http_UxDuoFaultUserAbort", + 1073745226: "Drop_Http_UxDuoFaultCollection", + 1073745227: "Drop_Http_UxDuoFaultClientResetStream", + 1073745228: "Drop_Http_UxDuoFaultMethodNotFound", + 1073745229: "Drop_Http_UxDuoFaultSchemeMismatch", + 1073745230: "Drop_Http_UxDuoFaultSchemeNotFound", + 1073745231: "Drop_Http_UxDuoFaultDataAfterEnd", + 1073745232: "Drop_Http_UxDuoFaultPathNotFound", + 1073745233: "Drop_Http_UxDuoFaultHalfClosedLocal", + 1073745234: "Drop_Http_UxDuoFaultIncompatibleAuth", + 1073745235: "Drop_Http_UxDuoFaultDeprecated3", + 1073745236: "Drop_Http_UxDuoFaultClientCertBlocked", + 1073745237: "Drop_Http_UxDuoFaultHeaderNameEmpty", + 1073745238: "Drop_Http_UxDuoFaultIllegalSend", + 1073745239: "Drop_Http_UxDuoFaultPushUpperAttach", + 1073745240: "Drop_Http_UxDuoFaultStreamUpperAttach", + 1073745241: "Drop_Http_UxDuoFaultActiveStreamLimit", + 1073745242: "Drop_Http_UxDuoFaultAuthorityNotFound", + 1073745243: "Drop_Http_UxDuoFaultUnexpectedTail", + 1073745244: "Drop_Http_UxDuoFaultTruncated", + 1073745245: "Drop_Http_UxDuoFaultResponseHold", + 1073745246: "Drop_Http_UxDuoFaultRequestChunked", + 1073745247: "Drop_Http_UxDuoFaultRequestContentLength", + 1073745248: "Drop_Http_UxDuoFaultResponseChunked", + 1073745249: "Drop_Http_UxDuoFaultResponseContentLength", + 1073745250: "Drop_Http_UxDuoFaultResponseTransferEncoding", + 1073745251: "Drop_Http_UxDuoFaultResponseLine", + 1073745252: "Drop_Http_UxDuoFaultResponseHeader", + 1073745253: "Drop_Http_UxDuoFaultConnect", + 1073745254: "Drop_Http_UxDuoFaultChunkStart", + 1073745255: "Drop_Http_UxDuoFaultChunkLength", + 1073745256: "Drop_Http_UxDuoFaultChunkStop", + 1073745257: "Drop_Http_UxDuoFaultHeadersAfterTrailers", + 1073745258: "Drop_Http_UxDuoFaultHeadersAfterEnd", + 1073745259: "Drop_Http_UxDuoFaultEndlessTrailer", + 1073745260: "Drop_Http_UxDuoFaultTransferEncoding", + 1073745261: "Drop_Http_UxDuoFaultMultipleTransferCodings", + 1073745262: "Drop_Http_UxDuoFaultPushBody", + 1073745263: "Drop_Http_UxDuoFaultStreamAbandoned", + 1073745264: "Drop_Http_UxDuoFaultMalformedHost", + 1073745265: "Drop_Http_UxDuoFaultDecompressionOverflow", + 1073745266: "Drop_Http_UxDuoFaultIllegalHeaderName", + 1073745267: "Drop_Http_UxDuoFaultIllegalHeaderValue", + 1073745268: "Drop_Http_UxDuoFaultConnHeaderDisallowed", + 1073745269: "Drop_Http_UxDuoFaultConnHeaderMalformed", + 1073745270: "Drop_Http_UxDuoFaultCookieReassembly", + 1073745271: "Drop_Http_UxDuoFaultStatusHeader", + 1073745272: "Drop_Http_UxDuoFaultSchemeDisallowed", + 1073745273: "Drop_Http_UxDuoFaultPathDisallowed", + 1073745274: "Drop_Http_UxDuoFaultPushHost", + 1073745275: "Drop_Http_UxDuoFaultGoawayReceived", + 1073745276: "Drop_Http_UxDuoFaultAbortLegacyApp", + 1073745277: "Drop_Http_UxDuoFaultUpgradeHeaderDisallowed", + 1073745278: "Drop_Http_UxDuoFaultResponseUpgradeHeader", + 1073745279: "Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed", + 1073745280: "Drop_Http_UxDuoFaultResponseKeepAliveHeader", + 1073745281: "Drop_Http_UxDuoFaultProxyConnHeaderDisallowed", + 1073745282: "Drop_Http_UxDuoFaultResponseProxyConnHeader", + 1073745283: "Drop_Http_UxDuoFaultConnectionGoingAway", + 1073745284: "Drop_Http_UxDuoFaultTransferEncodingDisallowed", + 1073745285: "Drop_Http_UxDuoFaultContentLengthDisallowed", + 1073745286: "Drop_Http_UxDuoFaultTrailerDisallowed", + 1073745287: "Drop_Http_UxDuoFaultEnd", + 1073745424: "Drop_Http_ReceiveSuppressed", + 1073745624: "Drop_Http_Generic", + 1073745625: "Drop_Http_InvalidParameter", + 1073745626: "Drop_Http_InsufficientResources", + 1073745627: "Drop_Http_InvalidHandle", + 1073745628: "Drop_Http_NotSupported", + 1073745629: "Drop_Http_BadNetworkPath", + 1073745630: "Drop_Http_InternalError", + 1073745631: "Drop_Http_NoSuchPackage", + 1073745632: "Drop_Http_PrivilegeNotHeld", + 1073745633: "Drop_Http_CannotImpersonate", + 1073745634: "Drop_Http_LogonFailure", + 1073745635: "Drop_Http_NoSuchLogonSession", + 1073745636: "Drop_Http_AccessDenied", + 1073745637: "Drop_Http_NoLogonServers", + 1073745638: "Drop_Http_TimeDifferenceAtDc", + 1073745824: "Drop_Http_End", } DropReason_value = map[string]int32{ - "Drop_Unknown": 0, - "Drop_InvalidData": 1, - "Drop_InvalidPacket": 2, - "Drop_Resources": 3, - "Drop_NotReady": 4, - "Drop_Disconnected": 5, - "Drop_NotAccepted": 6, - "Drop_Busy": 7, - "Drop_Filtered": 8, - "Drop_FilteredVLAN": 9, - "Drop_UnauthorizedVLAN": 10, - "Drop_UnauthorizedMAC": 11, - "Drop_FailedSecurityPolicy": 12, - "Drop_FailedPvlanSetting": 13, - "Drop_Qos": 14, - "Drop_Ipsec": 15, - "Drop_MacSpoofing": 16, - "Drop_DhcpGuard": 17, - "Drop_RouterGuard": 18, - "Drop_BridgeReserved": 19, - "Drop_VirtualSubnetId": 20, - "Drop_RequiredExtensionMissing": 21, - "Drop_InvalidConfig": 22, - "Drop_MTUMismatch": 23, - "Drop_NativeFwdingReq": 24, - "Drop_InvalidVlanFormat": 25, - "Drop_InvalidDestMac": 26, - "Drop_InvalidSourceMac": 27, - "Drop_InvalidFirstNBTooSmall": 28, - "Drop_Wnv": 29, - "Drop_StormLimit": 30, - "Drop_InjectedIcmp": 31, - "Drop_FailedDestinationListUpdate": 32, - "Drop_NicDisabled": 33, - "Drop_FailedPacketFilter": 34, - "Drop_SwitchDataFlowDisabled": 35, - "Drop_FilteredIsolationUntagged": 36, - "Drop_InvalidPDQueue": 37, - "Drop_LowPower": 38, - "Drop_Pause": 201, - "Drop_Reset": 202, - "Drop_SendAborted": 203, - "Drop_ProtocolNotBound": 204, - "Drop_Failure": 205, - "Drop_InvalidLength": 206, - "Drop_HostOutOfMemory": 207, - "Drop_FrameTooLong": 208, - "Drop_FrameTooShort": 209, - "Drop_FrameLengthError": 210, - "Drop_CrcError": 211, - "Drop_BadFrameChecksum": 212, - "Drop_FcsError": 213, - "Drop_SymbolError": 214, - "Drop_HeadQTimeout": 215, - "Drop_StalledDiscard": 216, - "Drop_RxQFull": 217, - "Drop_PhysLayerError": 218, - "Drop_DmaError": 219, - "Drop_FirmwareError": 220, - "Drop_DecryptionFailed": 221, - "Drop_BadSignature": 222, - "Drop_CoalescingError": 223, - "Drop_VlanSpoofing": 225, - "Drop_UnallowedEtherType": 226, - "Drop_VportDown": 227, - "Drop_SteeringMismatch": 228, - "Drop_MicroportError": 401, - "Drop_VfNotReady": 402, - "Drop_MicroportNotReady": 403, - "Drop_VMBusError": 404, - "Drop_FL_LoopbackPacket": 601, - "Drop_FL_InvalidSnapHeader": 602, - "Drop_FL_InvalidEthernetType": 603, - "Drop_FL_InvalidPacketLength": 604, - "Drop_FL_HeaderNotContiguous": 605, - "Drop_FL_InvalidDestinationType": 606, - "Drop_FL_InterfaceNotReady": 607, - "Drop_FL_ProviderNotReady": 608, - "Drop_FL_InvalidLsoInfo": 609, - "Drop_FL_InvalidUsoInfo": 610, - "Drop_FL_InvalidMedium": 611, - "Drop_FL_InvalidArpHeader": 612, - "Drop_FL_NoClientInterface": 613, - "Drop_FL_TooManyNetBuffers": 614, - "Drop_FL_FlsNpiClientDrop": 615, - "Drop_ArpGuard": 701, - "Drop_ArpLimiter": 702, - "Drop_DhcpLimiter": 703, - "Drop_BlockBroadcast": 704, - "Drop_BlockNonIp": 705, - "Drop_ArpFilter": 706, - "Drop_Ipv4Guard": 707, - "Drop_Ipv6Guard": 708, - "Drop_MacGuard": 709, - "Drop_BroadcastNoDestinations": 710, - "Drop_UnicastNoDestination": 711, - "Drop_UnicastPortNotReady": 712, - "Drop_SwitchCallbackFailed": 713, - "Drop_Icmpv6Limiter": 714, - "Drop_Intercept": 715, - "Drop_InterceptBlock": 716, - "Drop_NDPGuard": 717, - "Drop_PortBlocked": 718, - "Drop_NicSuspended": 719, - "Drop_NL_BadSourceAddress": 901, - "Drop_NL_NotLocallyDestined": 902, - "Drop_NL_ProtocolUnreachable": 903, - "Drop_NL_PortUnreachable": 904, - "Drop_NL_BadLength": 905, - "Drop_NL_MalformedHeader": 906, - "Drop_NL_NoRoute": 907, - "Drop_NL_BeyondScope": 908, - "Drop_NL_InspectionDrop": 909, - "Drop_NL_TooManyDecapsulations": 910, - "Drop_NL_AdministrativelyProhibited": 911, - "Drop_NL_BadChecksum": 912, - "Drop_NL_ReceivePathMax": 913, - "Drop_NL_HopLimitExceeded": 914, - "Drop_NL_AddressUnreachable": 915, - "Drop_NL_RscPacket": 916, - "Drop_NL_ForwardPathMax": 917, - "Drop_NL_ArbitrationUnhandled": 918, - "Drop_NL_InspectionAbsorb": 919, - "Drop_NL_DontFragmentMtuExceeded": 920, - "Drop_NL_BufferLengthExceeded": 921, - "Drop_NL_AddressResolutionTimeout": 922, - "Drop_NL_AddressResolutionFailure": 923, - "Drop_NL_IpsecFailure": 924, - "Drop_NL_ExtensionHeadersFailure": 925, - "Drop_NL_IpsnpiClientDrop": 926, - "Drop_NL_UnsupportedOffload": 927, - "Drop_NL_RoutingFailure": 928, - "Drop_NL_AncillaryDataFailure": 929, - "Drop_NL_RawDataFailure": 930, - "Drop_NL_SessionStateFailure": 931, - "Drop_NL_IpsnpiModifiedButNotForwarded": 932, - "Drop_NL_IpsnpiNoNextHop": 933, - "Drop_NL_IpsnpiNoCompartment": 934, - "Drop_NL_IpsnpiNoInterface": 935, - "Drop_NL_IpsnpiNoSubInterface": 936, - "Drop_NL_IpsnpiInterfaceDisabled": 937, - "Drop_NL_IpsnpiSegmentationFailed": 938, - "Drop_NL_IpsnpiNoEthernetHeader": 939, - "Drop_NL_IpsnpiUnexpectedFragment": 940, - "Drop_NL_IpsnpiUnsupportedInterfaceType": 941, - "Drop_NL_IpsnpiInvalidLsoInfo": 942, - "Drop_NL_IpsnpiInvalidUsoInfo": 943, - "Drop_NL_InternalError": 944, - "Drop_NL_AdministrativelyConfigured": 945, - "Drop_NL_BadOption": 946, - "Drop_NL_LoopbackDisallowed": 947, - "Drop_NL_SmallerScope": 948, - "Drop_NL_QueueFull": 949, - "Drop_NL_InterfaceDisabled": 950, - "Drop_NL_IcmpGeneric": 951, - "Drop_NL_IcmpTruncatedHeader": 952, - "Drop_NL_IcmpInvalidChecksum": 953, - "Drop_NL_IcmpInspection": 954, - "Drop_NL_IcmpNeighborDiscoveryLoopback": 955, - "Drop_NL_IcmpUnknownType": 956, - "Drop_NL_IcmpTruncatedIpHeader": 957, - "Drop_NL_IcmpOversizedIpHeader": 958, - "Drop_NL_IcmpNoHandler": 959, - "Drop_NL_IcmpRespondingToError": 960, - "Drop_NL_IcmpInvalidSource": 961, - "Drop_NL_IcmpInterfaceRateLimit": 962, - "Drop_NL_IcmpPathRateLimit": 963, - "Drop_NL_IcmpNoRoute": 964, - "Drop_NL_IcmpMatchingRequestNotFound": 965, - "Drop_NL_IcmpBufferTooSmall": 966, - "Drop_NL_IcmpAncillaryDataQuery": 967, - "Drop_NL_IcmpIncorrectHopLimit": 968, - "Drop_NL_IcmpUnknownCode": 969, - "Drop_NL_IcmpSourceNotLinkLocal": 970, - "Drop_NL_IcmpTruncatedNdHeader": 971, - "Drop_NL_IcmpInvalidNdOptSourceLinkAddr": 972, - "Drop_NL_IcmpInvalidNdOptMtu": 973, - "Drop_NL_IcmpInvalidNdOptPrefixInformation": 974, - "Drop_NL_IcmpInvalidNdOptRouteInformation": 975, - "Drop_NL_IcmpInvalidNdOptRdnss": 976, - "Drop_NL_IcmpInvalidNdOptDnssl": 977, - "Drop_NL_IcmpPacketParsingFailure": 978, - "Drop_NL_IcmpDisallowed": 979, - "Drop_NL_IcmpInvalidRouterAdvertisement": 980, - "Drop_NL_IcmpSourceFromDifferentLink": 981, - "Drop_NL_IcmpInvalidRedirectDestinationOrTarget": 982, - "Drop_NL_IcmpInvalidNdTarget": 983, - "Drop_NL_IcmpNaMulticastAndSolicited": 984, - "Drop_NL_IcmpNdLinkLayerAddressIsLocal": 985, - "Drop_NL_IcmpDuplicateEchoRequest": 986, - "Drop_NL_IcmpNotAPotentialRouter": 987, - "Drop_NL_IcmpInvalidMldQuery": 988, - "Drop_NL_IcmpInvalidMldReport": 989, - "Drop_NL_IcmpLocallySourcedMldReport": 990, - "Drop_NL_IcmpNotLocallyDestined": 991, - "Drop_NL_ArpInvalidSource": 992, - "Drop_NL_ArpInvalidTarget": 993, - "Drop_NL_ArpDlSourceIsLocal": 994, - "Drop_NL_ArpNotLocallyDestined": 995, - "Drop_NL_NlClientDiscard": 996, - "Drop_NL_IpsnpiUroSegmentSizeExceedsMtu": 997, - "Drop_NL_IcmpFragmentedPacket": 998, - "Drop_NL_FirstFragmentIncomplete": 999, - "Drop_NL_SourceViolation": 1000, - "Drop_NL_IcmpJumbogram": 1001, - "Drop_NL_SwUsoFailure": 1002, - "Drop_INET_SourceUnspecified": 1200, - "Drop_INET_DestinationMulticast": 1201, - "Drop_INET_HeaderInvalid": 1202, - "Drop_INET_ChecksumInvalid": 1203, - "Drop_INET_EndpointNotFound": 1204, - "Drop_INET_ConnectedPath": 1205, - "Drop_INET_SessionState": 1206, - "Drop_INET_ReceiveInspection": 1207, - "Drop_INET_AckInvalid": 1208, - "Drop_INET_ExpectedSyn": 1209, - "Drop_INET_Rst": 1210, - "Drop_INET_SynRcvdSyn": 1211, - "Drop_INET_SimultaneousConnect": 1212, - "Drop_INET_PawsFailed": 1213, - "Drop_INET_LandAttack": 1214, - "Drop_INET_MissedReset": 1215, - "Drop_INET_OutsideWindow": 1216, - "Drop_INET_DuplicateSegment": 1217, - "Drop_INET_ClosedWindow": 1218, - "Drop_INET_TcbRemoved": 1219, - "Drop_INET_FinWait2": 1220, - "Drop_INET_ReassemblyConflict": 1221, - "Drop_INET_FinReceived": 1222, - "Drop_INET_ListenerInvalidFlags": 1223, - "Drop_INET_TcbNotInTcbTable": 1224, - "Drop_INET_TimeWaitTcbReceivedRstOutsideWindow": 1225, - "Drop_INET_TimeWaitTcbSynAndOtherFlags": 1226, - "Drop_INET_TimeWaitTcb": 1227, - "Drop_INET_SynAckWithFastopenCookieRequest": 1228, - "Drop_INET_PauseAccept": 1229, - "Drop_INET_SynAttack": 1230, - "Drop_INET_AcceptInspection": 1231, - "Drop_INET_AcceptRedirection": 1232, - "Drop_SlbMux_ParsingFailure": 1301, - "Drop_SlbMux_FirstFragmentMiss": 1302, - "Drop_SlbMux_ICMPErrorPayloadValidationFailure": 1303, - "Drop_SlbMux_ICMPErrorPacketMatchNoSession": 1304, - "Drop_SlbMux_ExternalHairpinNexthopLookupFailure": 1305, - "Drop_SlbMux_NoMatchingStaticMapping": 1306, - "Drop_SlbMux_NexthopReferenceFailure": 1307, - "Drop_SlbMux_CloningFailure": 1308, - "Drop_SlbMux_TranslationFailure": 1309, - "Drop_SlbMux_HopLimitExceeded": 1310, - "Drop_SlbMux_PacketBiggerThanMTU": 1311, - "Drop_SlbMux_UnexpectedRouteLookupFailure": 1312, - "Drop_SlbMux_NoRoute": 1313, - "Drop_SlbMux_SessionCreationFailure": 1314, - "Drop_SlbMux_NexthopNotOverExternalInterface": 1315, - "Drop_SlbMux_NexthopExternalInterfaceMissNATInstance": 1316, - "Drop_SlbMux_NATItselfCantBeInternalNexthop": 1317, - "Drop_SlbMux_PacketRoutableInItsArrivalCompartment": 1318, - "Drop_SlbMux_PacketTransportProtocolNotSupported": 1319, - "Drop_SlbMux_PacketIsDestinedLocally": 1320, - "Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT": 1321, - "Drop_SlbMux_MuxReject": 1322, - "Drop_SlbMux_DipLookupFailure": 1323, - "Drop_SlbMux_MuxEncapsulationFailure": 1324, - "Drop_SlbMux_InvalidDiagPacketEncapType": 1325, - "Drop_SlbMux_DiagPacketIsRedirect": 1326, - "Drop_SlbMux_UnableToHandleRedirect": 1327, - "Drop_Ipsec_BadSpi": 1401, - "Drop_Ipsec_SALifetimeExpired": 1402, - "Drop_Ipsec_WrongSA": 1403, - "Drop_Ipsec_ReplayCheckFailed": 1404, - "Drop_Ipsec_InvalidPacket": 1405, - "Drop_Ipsec_IntegrityCheckFailed": 1406, - "Drop_Ipsec_ClearTextDrop": 1407, - "Drop_Ipsec_AuthFirewallDrop": 1408, - "Drop_Ipsec_ThrottleDrop": 1409, - "Drop_Ipsec_Dosp_Block": 1410, - "Drop_Ipsec_Dosp_ReceivedMulticast": 1411, - "Drop_Ipsec_Dosp_InvalidPacket": 1412, - "Drop_Ipsec_Dosp_StateLookupFailed": 1413, - "Drop_Ipsec_Dosp_MaxEntries": 1414, - "Drop_Ipsec_Dosp_KeymodNotAllowed": 1415, - "Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues": 1416, - "Drop_Ipsec_NoMemory": 1417, - "Drop_Ipsec_Unsuccessful": 1418, - "Drop_NetCx_NetPacketLayoutParseFailure": 1501, - "Drop_NetCx_SoftwareChecksumFailure": 1502, - "Drop_NetCx_NicQueueStop": 1503, - "Drop_NetCx_InvalidNetBufferLength": 1504, - "Drop_NetCx_LSOFailure": 1505, - "Drop_NetCx_USOFailure": 1506, - "Drop_NetCx_BufferBounceFailureAndPacketIgnore": 1507, - "Drop_Http_Begin": 3000, - "Drop_Http_UlError_Begin": 3001, - "Drop_Http_UlError": 3002, - "Drop_Http_UlErrorVerb": 3003, - "Drop_Http_UlErrorUrl": 3004, - "Drop_Http_UlErrorHeader": 3005, - "Drop_Http_UlErrorHost": 3006, - "Drop_Http_UlErrorNum": 3007, - "Drop_Http_UlErrorFieldLength": 3008, - "Drop_Http_UlErrorRequestLength": 3009, - "Drop_Http_UlErrorUnauthorized": 3010, - "Drop_Http_UlErrorForbiddenUrl": 3011, - "Drop_Http_UlErrorNotFound": 3012, - "Drop_Http_UlErrorContentLength": 3013, - "Drop_Http_UlErrorPreconditionFailed": 3014, - "Drop_Http_UlErrorEntityTooLarge": 3015, - "Drop_Http_UlErrorUrlLength": 3016, - "Drop_Http_UlErrorRangeNotSatisfiable": 3017, - "Drop_Http_UlErrorMisdirectedRequest": 3018, - "Drop_Http_UlErrorInternalServer": 3019, - "Drop_Http_UlErrorNotImplemented": 3020, - "Drop_Http_UlErrorUnavailable": 3021, - "Drop_Http_UlErrorConnectionLimit": 3022, - "Drop_Http_UlErrorRapidFailProtection": 3023, - "Drop_Http_UlErrorRequestQueueFull": 3024, - "Drop_Http_UlErrorDisabledByAdmin": 3025, - "Drop_Http_UlErrorDisabledByApp": 3026, - "Drop_Http_UlErrorJobObjectFired": 3027, - "Drop_Http_UlErrorAppPoolBusy": 3028, - "Drop_Http_UlErrorVersion": 3029, - "Drop_Http_UlError_End": 3030, - "Drop_Http_UxDuoFaultBegin": 3400, - "Drop_Http_UxDuoFaultUserAbort": 3401, - "Drop_Http_UxDuoFaultCollection": 3402, - "Drop_Http_UxDuoFaultClientResetStream": 3403, - "Drop_Http_UxDuoFaultMethodNotFound": 3404, - "Drop_Http_UxDuoFaultSchemeMismatch": 3405, - "Drop_Http_UxDuoFaultSchemeNotFound": 3406, - "Drop_Http_UxDuoFaultDataAfterEnd": 3407, - "Drop_Http_UxDuoFaultPathNotFound": 3408, - "Drop_Http_UxDuoFaultHalfClosedLocal": 3409, - "Drop_Http_UxDuoFaultIncompatibleAuth": 3410, - "Drop_Http_UxDuoFaultDeprecated3": 3411, - "Drop_Http_UxDuoFaultClientCertBlocked": 3412, - "Drop_Http_UxDuoFaultHeaderNameEmpty": 3413, - "Drop_Http_UxDuoFaultIllegalSend": 3414, - "Drop_Http_UxDuoFaultPushUpperAttach": 3415, - "Drop_Http_UxDuoFaultStreamUpperAttach": 3416, - "Drop_Http_UxDuoFaultActiveStreamLimit": 3417, - "Drop_Http_UxDuoFaultAuthorityNotFound": 3418, - "Drop_Http_UxDuoFaultUnexpectedTail": 3419, - "Drop_Http_UxDuoFaultTruncated": 3420, - "Drop_Http_UxDuoFaultResponseHold": 3421, - "Drop_Http_UxDuoFaultRequestChunked": 3422, - "Drop_Http_UxDuoFaultRequestContentLength": 3423, - "Drop_Http_UxDuoFaultResponseChunked": 3424, - "Drop_Http_UxDuoFaultResponseContentLength": 3425, - "Drop_Http_UxDuoFaultResponseTransferEncoding": 3426, - "Drop_Http_UxDuoFaultResponseLine": 3427, - "Drop_Http_UxDuoFaultResponseHeader": 3428, - "Drop_Http_UxDuoFaultConnect": 3429, - "Drop_Http_UxDuoFaultChunkStart": 3430, - "Drop_Http_UxDuoFaultChunkLength": 3431, - "Drop_Http_UxDuoFaultChunkStop": 3432, - "Drop_Http_UxDuoFaultHeadersAfterTrailers": 3433, - "Drop_Http_UxDuoFaultHeadersAfterEnd": 3434, - "Drop_Http_UxDuoFaultEndlessTrailer": 3435, - "Drop_Http_UxDuoFaultTransferEncoding": 3436, - "Drop_Http_UxDuoFaultMultipleTransferCodings": 3437, - "Drop_Http_UxDuoFaultPushBody": 3438, - "Drop_Http_UxDuoFaultStreamAbandoned": 3439, - "Drop_Http_UxDuoFaultMalformedHost": 3440, - "Drop_Http_UxDuoFaultDecompressionOverflow": 3441, - "Drop_Http_UxDuoFaultIllegalHeaderName": 3442, - "Drop_Http_UxDuoFaultIllegalHeaderValue": 3443, - "Drop_Http_UxDuoFaultConnHeaderDisallowed": 3444, - "Drop_Http_UxDuoFaultConnHeaderMalformed": 3445, - "Drop_Http_UxDuoFaultCookieReassembly": 3446, - "Drop_Http_UxDuoFaultStatusHeader": 3447, - "Drop_Http_UxDuoFaultSchemeDisallowed": 3448, - "Drop_Http_UxDuoFaultPathDisallowed": 3449, - "Drop_Http_UxDuoFaultPushHost": 3450, - "Drop_Http_UxDuoFaultGoawayReceived": 3451, - "Drop_Http_UxDuoFaultAbortLegacyApp": 3452, - "Drop_Http_UxDuoFaultUpgradeHeaderDisallowed": 3453, - "Drop_Http_UxDuoFaultResponseUpgradeHeader": 3454, - "Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed": 3455, - "Drop_Http_UxDuoFaultResponseKeepAliveHeader": 3456, - "Drop_Http_UxDuoFaultProxyConnHeaderDisallowed": 3457, - "Drop_Http_UxDuoFaultResponseProxyConnHeader": 3458, - "Drop_Http_UxDuoFaultConnectionGoingAway": 3459, - "Drop_Http_UxDuoFaultTransferEncodingDisallowed": 3460, - "Drop_Http_UxDuoFaultContentLengthDisallowed": 3461, - "Drop_Http_UxDuoFaultTrailerDisallowed": 3462, - "Drop_Http_UxDuoFaultEnd": 3463, - "Drop_Http_ReceiveSuppressed": 3600, - "Drop_Http_Generic": 3800, - "Drop_Http_InvalidParameter": 3801, - "Drop_Http_InsufficientResources": 3802, - "Drop_Http_InvalidHandle": 3803, - "Drop_Http_NotSupported": 3804, - "Drop_Http_BadNetworkPath": 3805, - "Drop_Http_InternalError": 3806, - "Drop_Http_NoSuchPackage": 3807, - "Drop_Http_PrivilegeNotHeld": 3808, - "Drop_Http_CannotImpersonate": 3809, - "Drop_Http_LogonFailure": 3810, - "Drop_Http_NoSuchLogonSession": 3811, - "Drop_Http_AccessDenied": 3812, - "Drop_Http_NoLogonServers": 3813, - "Drop_Http_TimeDifferenceAtDc": 3814, - "Drop_Http_End": 4000, + "Reason_Success": 0, + "Reason_InvalidPacket": 2, + "Reason_PlainText": 3, + "Reason_InterfaceDecrypted": 4, + "Reason_LbNoBackendSlot": 5, + "Reason_LbNoBackend": 6, + "Reason_LbReverseNatUpdate": 7, + "Resaon_LbReverseNatStale": 8, + "Reason_FragmentedPacket": 9, + "Reason_FragmentedPacketUpdated": 10, + "Reason_MissedCustomCall": 11, + "DropReason_InvalidSIP": 132, + "DropReason_Policy": 133, + "DropReason_Invalid": 134, + "DropReason_CTInvalidHdr": 135, + "DropReason_FragNeeded": 136, + "DropReason_CTUnknownProto": 137, + "DropReason_UnknownL3": 138, + "DropReason_MissedTailCall": 139, + "DropReason_WriteError": 140, + "DropReason_UnknownL4": 141, + "DropReason_UnknownICMPCode": 142, + "DropReason_UnknownICMPType": 143, + "DropReason_UnknownICMP6Code": 144, + "DropReason_UnknownICMP6Type": 145, + "DropReason_UnknownICMP6Type_2": 146, + "DropReason_NoTunnelKey": 147, + "DropReason_Unknown_1": 148, + "DropReason_Unknown_2": 149, + "DropReason_UnknownTarget": 150, + "DropReason_Unroutable": 151, + "DropReason_Unknown_3": 152, + "DropReason_CSUM_L3": 153, + "DropReason_CSUM_L4": 154, + "DropReason_CTCreateFailed": 155, + "DropReason_InvalidExthdr": 156, + "DropReason_FragNoSupport": 157, + "DropReason_NoService": 158, + "DropReason_UnsuppServiceProto": 159, + "DropReason_NoTunnelEndpoint": 160, + "DropReason_NAT46X64Disabled": 161, + "DropReason_EDTHorizon": 162, + "DropReason_UnknownCT": 163, + "DropReason_HostUnreachable": 164, + "DropReason_NoConfig": 165, + "DropReason_UnsupportedL2": 166, + "DropReason_NatNoMapping": 167, + "DropReason_NatUnsuppProto": 168, + "DropReason_NoFIB": 169, + "DropReason_EncapProhibited": 170, + "DropReason_InvalidIdentity": 171, + "DropReason_UnknownSender": 172, + "DropReason_NatNotNeeded": 173, + "DropReason_IsClusterIP": 174, + "DropReason_FragNotFound": 175, + "DropReason_ForbiddenICMP6": 176, + "DropReason_NotInSrcRange": 177, + "DropReason_ProxyLookupFailed": 178, + "DropReason_ProxySetFailed": 179, + "DropReason_ProxyUnknownProto": 180, + "DropReason_PolicyDeny": 181, + "DropReason_VlanFiltered": 182, + "DropReason_InvalidVNI": 183, + "DropReason_InvalidTCBuffer": 184, + "DropReason_NoSID": 185, + "DropReason_MissingSRv6State": 186, + "DropReason_NAT46": 187, + "DropReason_NAT64": 188, + "DropReason_PolicyAuthRequired": 189, + "DropReason_CTNoMapFound": 190, + "DropReason_SNATNoMapFound": 191, + "DropReason_InvalidClusterID": 192, + "DropReason_DSR_ENCAP_UNSUPP_PROTO": 193, + "DropReason_NoEgressGateway": 194, + "DropReason_UnencryptedTraffic": 195, + "DropReason_TTLExceeded": 196, + "DropReason_NoNodeID": 197, + "DropReason_RateLimited": 198, + "DropReason_IGMPHandled": 199, + "DropReason_IGMPSubscribed": 200, + "DropReason_MulticastHandled": 201, + "DropReason_HostNotReady": 202, + "DropReason_EpNotReady": 203, + "DropReason_PacketMonitor": 220, + "Drop_InvalidData": 1073741825, + "Drop_InvalidPacket": 1073741826, + "Drop_Resources": 1073741827, + "Drop_NotReady": 1073741828, + "Drop_Disconnected": 1073741829, + "Drop_NotAccepted": 1073741830, + "Drop_Busy": 1073741831, + "Drop_Filtered": 1073741832, + "Drop_FilteredVLAN": 1073741833, + "Drop_UnauthorizedVLAN": 1073741834, + "Drop_UnauthorizedMAC": 1073741835, + "Drop_FailedSecurityPolicy": 1073741836, + "Drop_FailedPvlanSetting": 1073741837, + "Drop_Qos": 1073741838, + "Drop_Ipsec": 1073741839, + "Drop_MacSpoofing": 1073741840, + "Drop_DhcpGuard": 1073741841, + "Drop_RouterGuard": 1073741842, + "Drop_BridgeReserved": 1073741843, + "Drop_VirtualSubnetId": 1073741844, + "Drop_RequiredExtensionMissing": 1073741845, + "Drop_InvalidConfig": 1073741846, + "Drop_MTUMismatch": 1073741847, + "Drop_NativeFwdingReq": 1073741848, + "Drop_InvalidVlanFormat": 1073741849, + "Drop_InvalidDestMac": 1073741850, + "Drop_InvalidSourceMac": 1073741851, + "Drop_InvalidFirstNBTooSmall": 1073741852, + "Drop_Wnv": 1073741853, + "Drop_StormLimit": 1073741854, + "Drop_InjectedIcmp": 1073741855, + "Drop_FailedDestinationListUpdate": 1073741856, + "Drop_NicDisabled": 1073741857, + "Drop_FailedPacketFilter": 1073741858, + "Drop_SwitchDataFlowDisabled": 1073741859, + "Drop_FilteredIsolationUntagged": 1073741860, + "Drop_InvalidPDQueue": 1073741861, + "Drop_LowPower": 1073741862, + "Drop_Pause": 1073742025, + "Drop_Reset": 1073742026, + "Drop_SendAborted": 1073742027, + "Drop_ProtocolNotBound": 1073742028, + "Drop_Failure": 1073742029, + "Drop_InvalidLength": 1073742030, + "Drop_HostOutOfMemory": 1073742031, + "Drop_FrameTooLong": 1073742032, + "Drop_FrameTooShort": 1073742033, + "Drop_FrameLengthError": 1073742034, + "Drop_CrcError": 1073742035, + "Drop_BadFrameChecksum": 1073742036, + "Drop_FcsError": 1073742037, + "Drop_SymbolError": 1073742038, + "Drop_HeadQTimeout": 1073742039, + "Drop_StalledDiscard": 1073742040, + "Drop_RxQFull": 1073742041, + "Drop_PhysLayerError": 1073742042, + "Drop_DmaError": 1073742043, + "Drop_FirmwareError": 1073742044, + "Drop_DecryptionFailed": 1073742045, + "Drop_BadSignature": 1073742046, + "Drop_CoalescingError": 1073742047, + "Drop_VlanSpoofing": 1073742049, + "Drop_UnallowedEtherType": 1073742050, + "Drop_VportDown": 1073742051, + "Drop_SteeringMismatch": 1073742052, + "Drop_MicroportError": 1073742225, + "Drop_VfNotReady": 1073742226, + "Drop_MicroportNotReady": 1073742227, + "Drop_VMBusError": 1073742228, + "Drop_FL_LoopbackPacket": 1073742425, + "Drop_FL_InvalidSnapHeader": 1073742426, + "Drop_FL_InvalidEthernetType": 1073742427, + "Drop_FL_InvalidPacketLength": 1073742428, + "Drop_FL_HeaderNotContiguous": 1073742429, + "Drop_FL_InvalidDestinationType": 1073742430, + "Drop_FL_InterfaceNotReady": 1073742431, + "Drop_FL_ProviderNotReady": 1073742432, + "Drop_FL_InvalidLsoInfo": 1073742433, + "Drop_FL_InvalidUsoInfo": 1073742434, + "Drop_FL_InvalidMedium": 1073742435, + "Drop_FL_InvalidArpHeader": 1073742436, + "Drop_FL_NoClientInterface": 1073742437, + "Drop_FL_TooManyNetBuffers": 1073742438, + "Drop_FL_FlsNpiClientDrop": 1073742439, + "Drop_ArpGuard": 1073742525, + "Drop_ArpLimiter": 1073742526, + "Drop_DhcpLimiter": 1073742527, + "Drop_BlockBroadcast": 1073742528, + "Drop_BlockNonIp": 1073742529, + "Drop_ArpFilter": 1073742530, + "Drop_Ipv4Guard": 1073742531, + "Drop_Ipv6Guard": 1073742532, + "Drop_MacGuard": 1073742533, + "Drop_BroadcastNoDestinations": 1073742534, + "Drop_UnicastNoDestination": 1073742535, + "Drop_UnicastPortNotReady": 1073742536, + "Drop_SwitchCallbackFailed": 1073742537, + "Drop_Icmpv6Limiter": 1073742538, + "Drop_Intercept": 1073742539, + "Drop_InterceptBlock": 1073742540, + "Drop_NDPGuard": 1073742541, + "Drop_PortBlocked": 1073742542, + "Drop_NicSuspended": 1073742543, + "Drop_NL_BadSourceAddress": 1073742725, + "Drop_NL_NotLocallyDestined": 1073742726, + "Drop_NL_ProtocolUnreachable": 1073742727, + "Drop_NL_PortUnreachable": 1073742728, + "Drop_NL_BadLength": 1073742729, + "Drop_NL_MalformedHeader": 1073742730, + "Drop_NL_NoRoute": 1073742731, + "Drop_NL_BeyondScope": 1073742732, + "Drop_NL_InspectionDrop": 1073742733, + "Drop_NL_TooManyDecapsulations": 1073742734, + "Drop_NL_AdministrativelyProhibited": 1073742735, + "Drop_NL_BadChecksum": 1073742736, + "Drop_NL_ReceivePathMax": 1073742737, + "Drop_NL_HopLimitExceeded": 1073742738, + "Drop_NL_AddressUnreachable": 1073742739, + "Drop_NL_RscPacket": 1073742740, + "Drop_NL_ForwardPathMax": 1073742741, + "Drop_NL_ArbitrationUnhandled": 1073742742, + "Drop_NL_InspectionAbsorb": 1073742743, + "Drop_NL_DontFragmentMtuExceeded": 1073742744, + "Drop_NL_BufferLengthExceeded": 1073742745, + "Drop_NL_AddressResolutionTimeout": 1073742746, + "Drop_NL_AddressResolutionFailure": 1073742747, + "Drop_NL_IpsecFailure": 1073742748, + "Drop_NL_ExtensionHeadersFailure": 1073742749, + "Drop_NL_IpsnpiClientDrop": 1073742750, + "Drop_NL_UnsupportedOffload": 1073742751, + "Drop_NL_RoutingFailure": 1073742752, + "Drop_NL_AncillaryDataFailure": 1073742753, + "Drop_NL_RawDataFailure": 1073742754, + "Drop_NL_SessionStateFailure": 1073742755, + "Drop_NL_IpsnpiModifiedButNotForwarded": 1073742756, + "Drop_NL_IpsnpiNoNextHop": 1073742757, + "Drop_NL_IpsnpiNoCompartment": 1073742758, + "Drop_NL_IpsnpiNoInterface": 1073742759, + "Drop_NL_IpsnpiNoSubInterface": 1073742760, + "Drop_NL_IpsnpiInterfaceDisabled": 1073742761, + "Drop_NL_IpsnpiSegmentationFailed": 1073742762, + "Drop_NL_IpsnpiNoEthernetHeader": 1073742763, + "Drop_NL_IpsnpiUnexpectedFragment": 1073742764, + "Drop_NL_IpsnpiUnsupportedInterfaceType": 1073742765, + "Drop_NL_IpsnpiInvalidLsoInfo": 1073742766, + "Drop_NL_IpsnpiInvalidUsoInfo": 1073742767, + "Drop_NL_InternalError": 1073742768, + "Drop_NL_AdministrativelyConfigured": 1073742769, + "Drop_NL_BadOption": 1073742770, + "Drop_NL_LoopbackDisallowed": 1073742771, + "Drop_NL_SmallerScope": 1073742772, + "Drop_NL_QueueFull": 1073742773, + "Drop_NL_InterfaceDisabled": 1073742774, + "Drop_NL_IcmpGeneric": 1073742775, + "Drop_NL_IcmpTruncatedHeader": 1073742776, + "Drop_NL_IcmpInvalidChecksum": 1073742777, + "Drop_NL_IcmpInspection": 1073742778, + "Drop_NL_IcmpNeighborDiscoveryLoopback": 1073742779, + "Drop_NL_IcmpUnknownType": 1073742780, + "Drop_NL_IcmpTruncatedIpHeader": 1073742781, + "Drop_NL_IcmpOversizedIpHeader": 1073742782, + "Drop_NL_IcmpNoHandler": 1073742783, + "Drop_NL_IcmpRespondingToError": 1073742784, + "Drop_NL_IcmpInvalidSource": 1073742785, + "Drop_NL_IcmpInterfaceRateLimit": 1073742786, + "Drop_NL_IcmpPathRateLimit": 1073742787, + "Drop_NL_IcmpNoRoute": 1073742788, + "Drop_NL_IcmpMatchingRequestNotFound": 1073742789, + "Drop_NL_IcmpBufferTooSmall": 1073742790, + "Drop_NL_IcmpAncillaryDataQuery": 1073742791, + "Drop_NL_IcmpIncorrectHopLimit": 1073742792, + "Drop_NL_IcmpUnknownCode": 1073742793, + "Drop_NL_IcmpSourceNotLinkLocal": 1073742794, + "Drop_NL_IcmpTruncatedNdHeader": 1073742795, + "Drop_NL_IcmpInvalidNdOptSourceLinkAddr": 1073742796, + "Drop_NL_IcmpInvalidNdOptMtu": 1073742797, + "Drop_NL_IcmpInvalidNdOptPrefixInformation": 1073742798, + "Drop_NL_IcmpInvalidNdOptRouteInformation": 1073742799, + "Drop_NL_IcmpInvalidNdOptRdnss": 1073742800, + "Drop_NL_IcmpInvalidNdOptDnssl": 1073742801, + "Drop_NL_IcmpPacketParsingFailure": 1073742802, + "Drop_NL_IcmpDisallowed": 1073742803, + "Drop_NL_IcmpInvalidRouterAdvertisement": 1073742804, + "Drop_NL_IcmpSourceFromDifferentLink": 1073742805, + "Drop_NL_IcmpInvalidRedirectDestinationOrTarget": 1073742806, + "Drop_NL_IcmpInvalidNdTarget": 1073742807, + "Drop_NL_IcmpNaMulticastAndSolicited": 1073742808, + "Drop_NL_IcmpNdLinkLayerAddressIsLocal": 1073742809, + "Drop_NL_IcmpDuplicateEchoRequest": 1073742810, + "Drop_NL_IcmpNotAPotentialRouter": 1073742811, + "Drop_NL_IcmpInvalidMldQuery": 1073742812, + "Drop_NL_IcmpInvalidMldReport": 1073742813, + "Drop_NL_IcmpLocallySourcedMldReport": 1073742814, + "Drop_NL_IcmpNotLocallyDestined": 1073742815, + "Drop_NL_ArpInvalidSource": 1073742816, + "Drop_NL_ArpInvalidTarget": 1073742817, + "Drop_NL_ArpDlSourceIsLocal": 1073742818, + "Drop_NL_ArpNotLocallyDestined": 1073742819, + "Drop_NL_NlClientDiscard": 1073742820, + "Drop_NL_IpsnpiUroSegmentSizeExceedsMtu": 1073742821, + "Drop_NL_IcmpFragmentedPacket": 1073742822, + "Drop_NL_FirstFragmentIncomplete": 1073742823, + "Drop_NL_SourceViolation": 1073742824, + "Drop_NL_IcmpJumbogram": 1073742825, + "Drop_NL_SwUsoFailure": 1073742826, + "Drop_INET_SourceUnspecified": 1073743024, + "Drop_INET_DestinationMulticast": 1073743025, + "Drop_INET_HeaderInvalid": 1073743026, + "Drop_INET_ChecksumInvalid": 1073743027, + "Drop_INET_EndpointNotFound": 1073743028, + "Drop_INET_ConnectedPath": 1073743029, + "Drop_INET_SessionState": 1073743030, + "Drop_INET_ReceiveInspection": 1073743031, + "Drop_INET_AckInvalid": 1073743032, + "Drop_INET_ExpectedSyn": 1073743033, + "Drop_INET_Rst": 1073743034, + "Drop_INET_SynRcvdSyn": 1073743035, + "Drop_INET_SimultaneousConnect": 1073743036, + "Drop_INET_PawsFailed": 1073743037, + "Drop_INET_LandAttack": 1073743038, + "Drop_INET_MissedReset": 1073743039, + "Drop_INET_OutsideWindow": 1073743040, + "Drop_INET_DuplicateSegment": 1073743041, + "Drop_INET_ClosedWindow": 1073743042, + "Drop_INET_TcbRemoved": 1073743043, + "Drop_INET_FinWait2": 1073743044, + "Drop_INET_ReassemblyConflict": 1073743045, + "Drop_INET_FinReceived": 1073743046, + "Drop_INET_ListenerInvalidFlags": 1073743047, + "Drop_INET_TcbNotInTcbTable": 1073743048, + "Drop_INET_TimeWaitTcbReceivedRstOutsideWindow": 1073743049, + "Drop_INET_TimeWaitTcbSynAndOtherFlags": 1073743050, + "Drop_INET_TimeWaitTcb": 1073743051, + "Drop_INET_SynAckWithFastopenCookieRequest": 1073743052, + "Drop_INET_PauseAccept": 1073743053, + "Drop_INET_SynAttack": 1073743054, + "Drop_INET_AcceptInspection": 1073743055, + "Drop_INET_AcceptRedirection": 1073743056, + "Drop_SlbMux_ParsingFailure": 1073743125, + "Drop_SlbMux_FirstFragmentMiss": 1073743126, + "Drop_SlbMux_ICMPErrorPayloadValidationFailure": 1073743127, + "Drop_SlbMux_ICMPErrorPacketMatchNoSession": 1073743128, + "Drop_SlbMux_ExternalHairpinNexthopLookupFailure": 1073743129, + "Drop_SlbMux_NoMatchingStaticMapping": 1073743130, + "Drop_SlbMux_NexthopReferenceFailure": 1073743131, + "Drop_SlbMux_CloningFailure": 1073743132, + "Drop_SlbMux_TranslationFailure": 1073743133, + "Drop_SlbMux_HopLimitExceeded": 1073743134, + "Drop_SlbMux_PacketBiggerThanMTU": 1073743135, + "Drop_SlbMux_UnexpectedRouteLookupFailure": 1073743136, + "Drop_SlbMux_NoRoute": 1073743137, + "Drop_SlbMux_SessionCreationFailure": 1073743138, + "Drop_SlbMux_NexthopNotOverExternalInterface": 1073743139, + "Drop_SlbMux_NexthopExternalInterfaceMissNATInstance": 1073743140, + "Drop_SlbMux_NATItselfCantBeInternalNexthop": 1073743141, + "Drop_SlbMux_PacketRoutableInItsArrivalCompartment": 1073743142, + "Drop_SlbMux_PacketTransportProtocolNotSupported": 1073743143, + "Drop_SlbMux_PacketIsDestinedLocally": 1073743144, + "Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT": 1073743145, + "Drop_SlbMux_MuxReject": 1073743146, + "Drop_SlbMux_DipLookupFailure": 1073743147, + "Drop_SlbMux_MuxEncapsulationFailure": 1073743148, + "Drop_SlbMux_InvalidDiagPacketEncapType": 1073743149, + "Drop_SlbMux_DiagPacketIsRedirect": 1073743150, + "Drop_SlbMux_UnableToHandleRedirect": 1073743151, + "Drop_Ipsec_BadSpi": 1073743225, + "Drop_Ipsec_SALifetimeExpired": 1073743226, + "Drop_Ipsec_WrongSA": 1073743227, + "Drop_Ipsec_ReplayCheckFailed": 1073743228, + "Drop_Ipsec_InvalidPacket": 1073743229, + "Drop_Ipsec_IntegrityCheckFailed": 1073743230, + "Drop_Ipsec_ClearTextDrop": 1073743231, + "Drop_Ipsec_AuthFirewallDrop": 1073743232, + "Drop_Ipsec_ThrottleDrop": 1073743233, + "Drop_Ipsec_Dosp_Block": 1073743234, + "Drop_Ipsec_Dosp_ReceivedMulticast": 1073743235, + "Drop_Ipsec_Dosp_InvalidPacket": 1073743236, + "Drop_Ipsec_Dosp_StateLookupFailed": 1073743237, + "Drop_Ipsec_Dosp_MaxEntries": 1073743238, + "Drop_Ipsec_Dosp_KeymodNotAllowed": 1073743239, + "Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues": 1073743240, + "Drop_Ipsec_NoMemory": 1073743241, + "Drop_Ipsec_Unsuccessful": 1073743242, + "Drop_NetCx_NetPacketLayoutParseFailure": 1073743325, + "Drop_NetCx_SoftwareChecksumFailure": 1073743326, + "Drop_NetCx_NicQueueStop": 1073743327, + "Drop_NetCx_InvalidNetBufferLength": 1073743328, + "Drop_NetCx_LSOFailure": 1073743329, + "Drop_NetCx_USOFailure": 1073743330, + "Drop_NetCx_BufferBounceFailureAndPacketIgnore": 1073743331, + "Drop_Http_Begin": 1073744824, + "Drop_Http_UlError_Begin": 1073744825, + "Drop_Http_UlError": 1073744826, + "Drop_Http_UlErrorVerb": 1073744827, + "Drop_Http_UlErrorUrl": 1073744828, + "Drop_Http_UlErrorHeader": 1073744829, + "Drop_Http_UlErrorHost": 1073744830, + "Drop_Http_UlErrorNum": 1073744831, + "Drop_Http_UlErrorFieldLength": 1073744832, + "Drop_Http_UlErrorRequestLength": 1073744833, + "Drop_Http_UlErrorUnauthorized": 1073744834, + "Drop_Http_UlErrorForbiddenUrl": 1073744835, + "Drop_Http_UlErrorNotFound": 1073744836, + "Drop_Http_UlErrorContentLength": 1073744837, + "Drop_Http_UlErrorPreconditionFailed": 1073744838, + "Drop_Http_UlErrorEntityTooLarge": 1073744839, + "Drop_Http_UlErrorUrlLength": 1073744840, + "Drop_Http_UlErrorRangeNotSatisfiable": 1073744841, + "Drop_Http_UlErrorMisdirectedRequest": 1073744842, + "Drop_Http_UlErrorInternalServer": 1073744843, + "Drop_Http_UlErrorNotImplemented": 1073744844, + "Drop_Http_UlErrorUnavailable": 1073744845, + "Drop_Http_UlErrorConnectionLimit": 1073744846, + "Drop_Http_UlErrorRapidFailProtection": 1073744847, + "Drop_Http_UlErrorRequestQueueFull": 1073744848, + "Drop_Http_UlErrorDisabledByAdmin": 1073744849, + "Drop_Http_UlErrorDisabledByApp": 1073744850, + "Drop_Http_UlErrorJobObjectFired": 1073744851, + "Drop_Http_UlErrorAppPoolBusy": 1073744852, + "Drop_Http_UlErrorVersion": 1073744853, + "Drop_Http_UlError_End": 1073744854, + "Drop_Http_UxDuoFaultBegin": 1073745224, + "Drop_Http_UxDuoFaultUserAbort": 1073745225, + "Drop_Http_UxDuoFaultCollection": 1073745226, + "Drop_Http_UxDuoFaultClientResetStream": 1073745227, + "Drop_Http_UxDuoFaultMethodNotFound": 1073745228, + "Drop_Http_UxDuoFaultSchemeMismatch": 1073745229, + "Drop_Http_UxDuoFaultSchemeNotFound": 1073745230, + "Drop_Http_UxDuoFaultDataAfterEnd": 1073745231, + "Drop_Http_UxDuoFaultPathNotFound": 1073745232, + "Drop_Http_UxDuoFaultHalfClosedLocal": 1073745233, + "Drop_Http_UxDuoFaultIncompatibleAuth": 1073745234, + "Drop_Http_UxDuoFaultDeprecated3": 1073745235, + "Drop_Http_UxDuoFaultClientCertBlocked": 1073745236, + "Drop_Http_UxDuoFaultHeaderNameEmpty": 1073745237, + "Drop_Http_UxDuoFaultIllegalSend": 1073745238, + "Drop_Http_UxDuoFaultPushUpperAttach": 1073745239, + "Drop_Http_UxDuoFaultStreamUpperAttach": 1073745240, + "Drop_Http_UxDuoFaultActiveStreamLimit": 1073745241, + "Drop_Http_UxDuoFaultAuthorityNotFound": 1073745242, + "Drop_Http_UxDuoFaultUnexpectedTail": 1073745243, + "Drop_Http_UxDuoFaultTruncated": 1073745244, + "Drop_Http_UxDuoFaultResponseHold": 1073745245, + "Drop_Http_UxDuoFaultRequestChunked": 1073745246, + "Drop_Http_UxDuoFaultRequestContentLength": 1073745247, + "Drop_Http_UxDuoFaultResponseChunked": 1073745248, + "Drop_Http_UxDuoFaultResponseContentLength": 1073745249, + "Drop_Http_UxDuoFaultResponseTransferEncoding": 1073745250, + "Drop_Http_UxDuoFaultResponseLine": 1073745251, + "Drop_Http_UxDuoFaultResponseHeader": 1073745252, + "Drop_Http_UxDuoFaultConnect": 1073745253, + "Drop_Http_UxDuoFaultChunkStart": 1073745254, + "Drop_Http_UxDuoFaultChunkLength": 1073745255, + "Drop_Http_UxDuoFaultChunkStop": 1073745256, + "Drop_Http_UxDuoFaultHeadersAfterTrailers": 1073745257, + "Drop_Http_UxDuoFaultHeadersAfterEnd": 1073745258, + "Drop_Http_UxDuoFaultEndlessTrailer": 1073745259, + "Drop_Http_UxDuoFaultTransferEncoding": 1073745260, + "Drop_Http_UxDuoFaultMultipleTransferCodings": 1073745261, + "Drop_Http_UxDuoFaultPushBody": 1073745262, + "Drop_Http_UxDuoFaultStreamAbandoned": 1073745263, + "Drop_Http_UxDuoFaultMalformedHost": 1073745264, + "Drop_Http_UxDuoFaultDecompressionOverflow": 1073745265, + "Drop_Http_UxDuoFaultIllegalHeaderName": 1073745266, + "Drop_Http_UxDuoFaultIllegalHeaderValue": 1073745267, + "Drop_Http_UxDuoFaultConnHeaderDisallowed": 1073745268, + "Drop_Http_UxDuoFaultConnHeaderMalformed": 1073745269, + "Drop_Http_UxDuoFaultCookieReassembly": 1073745270, + "Drop_Http_UxDuoFaultStatusHeader": 1073745271, + "Drop_Http_UxDuoFaultSchemeDisallowed": 1073745272, + "Drop_Http_UxDuoFaultPathDisallowed": 1073745273, + "Drop_Http_UxDuoFaultPushHost": 1073745274, + "Drop_Http_UxDuoFaultGoawayReceived": 1073745275, + "Drop_Http_UxDuoFaultAbortLegacyApp": 1073745276, + "Drop_Http_UxDuoFaultUpgradeHeaderDisallowed": 1073745277, + "Drop_Http_UxDuoFaultResponseUpgradeHeader": 1073745278, + "Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed": 1073745279, + "Drop_Http_UxDuoFaultResponseKeepAliveHeader": 1073745280, + "Drop_Http_UxDuoFaultProxyConnHeaderDisallowed": 1073745281, + "Drop_Http_UxDuoFaultResponseProxyConnHeader": 1073745282, + "Drop_Http_UxDuoFaultConnectionGoingAway": 1073745283, + "Drop_Http_UxDuoFaultTransferEncodingDisallowed": 1073745284, + "Drop_Http_UxDuoFaultContentLengthDisallowed": 1073745285, + "Drop_Http_UxDuoFaultTrailerDisallowed": 1073745286, + "Drop_Http_UxDuoFaultEnd": 1073745287, + "Drop_Http_ReceiveSuppressed": 1073745424, + "Drop_Http_Generic": 1073745624, + "Drop_Http_InvalidParameter": 1073745625, + "Drop_Http_InsufficientResources": 1073745626, + "Drop_Http_InvalidHandle": 1073745627, + "Drop_Http_NotSupported": 1073745628, + "Drop_Http_BadNetworkPath": 1073745629, + "Drop_Http_InternalError": 1073745630, + "Drop_Http_NoSuchPackage": 1073745631, + "Drop_Http_PrivilegeNotHeld": 1073745632, + "Drop_Http_CannotImpersonate": 1073745633, + "Drop_Http_LogonFailure": 1073745634, + "Drop_Http_NoSuchLogonSession": 1073745635, + "Drop_Http_AccessDenied": 1073745636, + "Drop_Http_NoLogonServers": 1073745637, + "Drop_Http_TimeDifferenceAtDc": 1073745638, + "Drop_Http_End": 1073745824, } ) @@ -1333,11 +1586,8 @@ func (DropReason) EnumDescriptor() ([]byte, []int) { } type RetinaMetadata struct { - state protoimpl.MessageState - sizeCache protoimpl.SizeCache - unknownFields protoimpl.UnknownFields - - Bytes uint32 `protobuf:"varint,1,opt,name=bytes,proto3" json:"bytes,omitempty"` + state protoimpl.MessageState `protogen:"open.v1"` + Bytes uint32 `protobuf:"varint,1,opt,name=bytes,proto3" json:"bytes,omitempty"` // DNS metadata. DnsType DNSType `protobuf:"varint,2,opt,name=dns_type,json=dnsType,proto3,enum=utils.DNSType" json:"dns_type,omitempty"` NumResponses uint32 `protobuf:"varint,3,opt,name=num_responses,json=numResponses,proto3" json:"num_responses,omitempty"` @@ -1415,7 +1665,7 @@ func (x *RetinaMetadata) GetDropReason() DropReason { if x != nil { return x.DropReason } - return DropReason_Drop_Unknown + return DropReason_Reason_Success } func (x *RetinaMetadata) GetPreviouslyObservedPackets() uint32 { @@ -2344,6 +2594,525 @@ func file_pkg_utils_metadata_windows_proto_rawDescGZIP() []byte { return file_pkg_utils_metadata_windows_proto_rawDescData } +const file_metadata_windows_proto_rawDesc = "" + + "\n" + + "\x16metadata_windows.proto\x12\x05utils\"\xc1\x01\n" + + "\x0eRetinaMetadata\x12\x14\n" + + "\x05bytes\x18\x01 \x01(\rR\x05bytes\x12)\n" + + "\bdns_type\x18\x02 \x01(\x0e2\x0e.utils.DNSTypeR\adnsType\x12#\n" + + "\rnum_responses\x18\x03 \x01(\rR\fnumResponses\x12\x15\n" + + "\x06tcp_id\x18\x04 \x01(\x04R\x05tcpId\x122\n" + + "\vdrop_reason\x18\x05 \x01(\x0e2\x11.utils.DropReasonR\n" + + "dropReason*/\n" + + "\aDNSType\x12\v\n" + + "\aUNKNOWN\x10\x00\x12\t\n" + + "\x05QUERY\x10\x01\x12\f\n" + + "\bRESPONSE\x10\x02*\xfb\x86\x01\n" + + "\n" + + "DropReason\x12\x12\n" + + "\x0eReason_Success\x10\x00\x12\x18\n" + + "\x14Reason_InvalidPacket\x10\x02\x12\x14\n" + + "\x10Reason_PlainText\x10\x03\x12\x1d\n" + + "\x19Reason_InterfaceDecrypted\x10\x04\x12\x1a\n" + + "\x16Reason_LbNoBackendSlot\x10\x05\x12\x16\n" + + "\x12Reason_LbNoBackend\x10\x06\x12\x1d\n" + + "\x19Reason_LbReverseNatUpdate\x10\a\x12\x1c\n" + + "\x18Resaon_LbReverseNatStale\x10\b\x12\x1b\n" + + "\x17Reason_FragmentedPacket\x10\t\x12\"\n" + + "\x1eReason_FragmentedPacketUpdated\x10\n" + + "\x12\x1b\n" + + "\x17Reason_MissedCustomCall\x10\v\x12\x1a\n" + + "\x15DropReason_InvalidSIP\x10\x84\x01\x12\x16\n" + + "\x11DropReason_Policy\x10\x85\x01\x12\x17\n" + + "\x12DropReason_Invalid\x10\x86\x01\x12\x1c\n" + + "\x17DropReason_CTInvalidHdr\x10\x87\x01\x12\x1a\n" + + "\x15DropReason_FragNeeded\x10\x88\x01\x12\x1e\n" + + "\x19DropReason_CTUnknownProto\x10\x89\x01\x12\x19\n" + + "\x14DropReason_UnknownL3\x10\x8a\x01\x12\x1e\n" + + "\x19DropReason_MissedTailCall\x10\x8b\x01\x12\x1a\n" + + "\x15DropReason_WriteError\x10\x8c\x01\x12\x19\n" + + "\x14DropReason_UnknownL4\x10\x8d\x01\x12\x1f\n" + + "\x1aDropReason_UnknownICMPCode\x10\x8e\x01\x12\x1f\n" + + "\x1aDropReason_UnknownICMPType\x10\x8f\x01\x12 \n" + + "\x1bDropReason_UnknownICMP6Code\x10\x90\x01\x12 \n" + + "\x1bDropReason_UnknownICMP6Type\x10\x91\x01\x12\"\n" + + "\x1dDropReason_UnknownICMP6Type_2\x10\x92\x01\x12\x1b\n" + + "\x16DropReason_NoTunnelKey\x10\x93\x01\x12\x19\n" + + "\x14DropReason_Unknown_1\x10\x94\x01\x12\x19\n" + + "\x14DropReason_Unknown_2\x10\x95\x01\x12\x1d\n" + + "\x18DropReason_UnknownTarget\x10\x96\x01\x12\x1a\n" + + "\x15DropReason_Unroutable\x10\x97\x01\x12\x19\n" + + "\x14DropReason_Unknown_3\x10\x98\x01\x12\x17\n" + + "\x12DropReason_CSUM_L3\x10\x99\x01\x12\x17\n" + + "\x12DropReason_CSUM_L4\x10\x9a\x01\x12\x1e\n" + + "\x19DropReason_CTCreateFailed\x10\x9b\x01\x12\x1d\n" + + "\x18DropReason_InvalidExthdr\x10\x9c\x01\x12\x1d\n" + + "\x18DropReason_FragNoSupport\x10\x9d\x01\x12\x19\n" + + "\x14DropReason_NoService\x10\x9e\x01\x12\"\n" + + "\x1dDropReason_UnsuppServiceProto\x10\x9f\x01\x12 \n" + + "\x1bDropReason_NoTunnelEndpoint\x10\xa0\x01\x12 \n" + + "\x1bDropReason_NAT46X64Disabled\x10\xa1\x01\x12\x1a\n" + + "\x15DropReason_EDTHorizon\x10\xa2\x01\x12\x19\n" + + "\x14DropReason_UnknownCT\x10\xa3\x01\x12\x1f\n" + + "\x1aDropReason_HostUnreachable\x10\xa4\x01\x12\x18\n" + + "\x13DropReason_NoConfig\x10\xa5\x01\x12\x1d\n" + + "\x18DropReason_UnsupportedL2\x10\xa6\x01\x12\x1c\n" + + "\x17DropReason_NatNoMapping\x10\xa7\x01\x12\x1e\n" + + "\x19DropReason_NatUnsuppProto\x10\xa8\x01\x12\x15\n" + + "\x10DropReason_NoFIB\x10\xa9\x01\x12\x1f\n" + + "\x1aDropReason_EncapProhibited\x10\xaa\x01\x12\x1f\n" + + "\x1aDropReason_InvalidIdentity\x10\xab\x01\x12\x1d\n" + + "\x18DropReason_UnknownSender\x10\xac\x01\x12\x1c\n" + + "\x17DropReason_NatNotNeeded\x10\xad\x01\x12\x1b\n" + + "\x16DropReason_IsClusterIP\x10\xae\x01\x12\x1c\n" + + "\x17DropReason_FragNotFound\x10\xaf\x01\x12\x1e\n" + + "\x19DropReason_ForbiddenICMP6\x10\xb0\x01\x12\x1d\n" + + "\x18DropReason_NotInSrcRange\x10\xb1\x01\x12!\n" + + "\x1cDropReason_ProxyLookupFailed\x10\xb2\x01\x12\x1e\n" + + "\x19DropReason_ProxySetFailed\x10\xb3\x01\x12!\n" + + "\x1cDropReason_ProxyUnknownProto\x10\xb4\x01\x12\x1a\n" + + "\x15DropReason_PolicyDeny\x10\xb5\x01\x12\x1c\n" + + "\x17DropReason_VlanFiltered\x10\xb6\x01\x12\x1a\n" + + "\x15DropReason_InvalidVNI\x10\xb7\x01\x12\x1f\n" + + "\x1aDropReason_InvalidTCBuffer\x10\xb8\x01\x12\x15\n" + + "\x10DropReason_NoSID\x10\xb9\x01\x12 \n" + + "\x1bDropReason_MissingSRv6State\x10\xba\x01\x12\x15\n" + + "\x10DropReason_NAT46\x10\xbb\x01\x12\x15\n" + + "\x10DropReason_NAT64\x10\xbc\x01\x12\"\n" + + "\x1dDropReason_PolicyAuthRequired\x10\xbd\x01\x12\x1c\n" + + "\x17DropReason_CTNoMapFound\x10\xbe\x01\x12\x1e\n" + + "\x19DropReason_SNATNoMapFound\x10\xbf\x01\x12 \n" + + "\x1bDropReason_InvalidClusterID\x10\xc0\x01\x12&\n" + + "!DropReason_DSR_ENCAP_UNSUPP_PROTO\x10\xc1\x01\x12\x1f\n" + + "\x1aDropReason_NoEgressGateway\x10\xc2\x01\x12\"\n" + + "\x1dDropReason_UnencryptedTraffic\x10\xc3\x01\x12\x1b\n" + + "\x16DropReason_TTLExceeded\x10\xc4\x01\x12\x18\n" + + "\x13DropReason_NoNodeID\x10\xc5\x01\x12\x1b\n" + + "\x16DropReason_RateLimited\x10\xc6\x01\x12\x1b\n" + + "\x16DropReason_IGMPHandled\x10\xc7\x01\x12\x1e\n" + + "\x19DropReason_IGMPSubscribed\x10\xc8\x01\x12 \n" + + "\x1bDropReason_MulticastHandled\x10\xc9\x01\x12\x1c\n" + + "\x17DropReason_HostNotReady\x10\xca\x01\x12\x1a\n" + + "\x15DropReason_EpNotReady\x10\xcb\x01\x12\x1d\n" + + "\x18DropReason_PacketMonitor\x10\xdc\x01\x12\x18\n" + + "\x10Drop_InvalidData\x10\x81\x80\x80\x80\x04\x12\x1a\n" + + "\x12Drop_InvalidPacket\x10\x82\x80\x80\x80\x04\x12\x16\n" + + "\x0eDrop_Resources\x10\x83\x80\x80\x80\x04\x12\x15\n" + + "\rDrop_NotReady\x10\x84\x80\x80\x80\x04\x12\x19\n" + + "\x11Drop_Disconnected\x10\x85\x80\x80\x80\x04\x12\x18\n" + + "\x10Drop_NotAccepted\x10\x86\x80\x80\x80\x04\x12\x11\n" + + "\tDrop_Busy\x10\x87\x80\x80\x80\x04\x12\x15\n" + + "\rDrop_Filtered\x10\x88\x80\x80\x80\x04\x12\x19\n" + + "\x11Drop_FilteredVLAN\x10\x89\x80\x80\x80\x04\x12\x1d\n" + + "\x15Drop_UnauthorizedVLAN\x10\x8a\x80\x80\x80\x04\x12\x1c\n" + + "\x14Drop_UnauthorizedMAC\x10\x8b\x80\x80\x80\x04\x12!\n" + + "\x19Drop_FailedSecurityPolicy\x10\x8c\x80\x80\x80\x04\x12\x1f\n" + + "\x17Drop_FailedPvlanSetting\x10\x8d\x80\x80\x80\x04\x12\x10\n" + + "\bDrop_Qos\x10\x8e\x80\x80\x80\x04\x12\x12\n" + + "\n" + + "Drop_Ipsec\x10\x8f\x80\x80\x80\x04\x12\x18\n" + + "\x10Drop_MacSpoofing\x10\x90\x80\x80\x80\x04\x12\x16\n" + + "\x0eDrop_DhcpGuard\x10\x91\x80\x80\x80\x04\x12\x18\n" + + "\x10Drop_RouterGuard\x10\x92\x80\x80\x80\x04\x12\x1b\n" + + "\x13Drop_BridgeReserved\x10\x93\x80\x80\x80\x04\x12\x1c\n" + + "\x14Drop_VirtualSubnetId\x10\x94\x80\x80\x80\x04\x12%\n" + + "\x1dDrop_RequiredExtensionMissing\x10\x95\x80\x80\x80\x04\x12\x1a\n" + + "\x12Drop_InvalidConfig\x10\x96\x80\x80\x80\x04\x12\x18\n" + + "\x10Drop_MTUMismatch\x10\x97\x80\x80\x80\x04\x12\x1c\n" + + "\x14Drop_NativeFwdingReq\x10\x98\x80\x80\x80\x04\x12\x1e\n" + + "\x16Drop_InvalidVlanFormat\x10\x99\x80\x80\x80\x04\x12\x1b\n" + + "\x13Drop_InvalidDestMac\x10\x9a\x80\x80\x80\x04\x12\x1d\n" + + "\x15Drop_InvalidSourceMac\x10\x9b\x80\x80\x80\x04\x12#\n" + + "\x1bDrop_InvalidFirstNBTooSmall\x10\x9c\x80\x80\x80\x04\x12\x10\n" + + "\bDrop_Wnv\x10\x9d\x80\x80\x80\x04\x12\x17\n" + + "\x0fDrop_StormLimit\x10\x9e\x80\x80\x80\x04\x12\x19\n" + + "\x11Drop_InjectedIcmp\x10\x9f\x80\x80\x80\x04\x12(\n" + + " Drop_FailedDestinationListUpdate\x10\xa0\x80\x80\x80\x04\x12\x18\n" + + "\x10Drop_NicDisabled\x10\xa1\x80\x80\x80\x04\x12\x1f\n" + + "\x17Drop_FailedPacketFilter\x10\xa2\x80\x80\x80\x04\x12#\n" + + "\x1bDrop_SwitchDataFlowDisabled\x10\xa3\x80\x80\x80\x04\x12&\n" + + "\x1eDrop_FilteredIsolationUntagged\x10\xa4\x80\x80\x80\x04\x12\x1b\n" + + "\x13Drop_InvalidPDQueue\x10\xa5\x80\x80\x80\x04\x12\x15\n" + + "\rDrop_LowPower\x10\xa6\x80\x80\x80\x04\x12\x12\n" + + "\n" + + "Drop_Pause\x10Ɂ\x80\x80\x04\x12\x12\n" + + "\n" + + "Drop_Reset\x10ʁ\x80\x80\x04\x12\x18\n" + + "\x10Drop_SendAborted\x10ˁ\x80\x80\x04\x12\x1d\n" + + "\x15Drop_ProtocolNotBound\x10́\x80\x80\x04\x12\x14\n" + + "\fDrop_Failure\x10́\x80\x80\x04\x12\x1a\n" + + "\x12Drop_InvalidLength\x10\u0381\x80\x80\x04\x12\x1c\n" + + "\x14Drop_HostOutOfMemory\x10ρ\x80\x80\x04\x12\x19\n" + + "\x11Drop_FrameTooLong\x10Ё\x80\x80\x04\x12\x1a\n" + + "\x12Drop_FrameTooShort\x10с\x80\x80\x04\x12\x1d\n" + + "\x15Drop_FrameLengthError\x10ҁ\x80\x80\x04\x12\x15\n" + + "\rDrop_CrcError\x10Ӂ\x80\x80\x04\x12\x1d\n" + + "\x15Drop_BadFrameChecksum\x10ԁ\x80\x80\x04\x12\x15\n" + + "\rDrop_FcsError\x10Ձ\x80\x80\x04\x12\x18\n" + + "\x10Drop_SymbolError\x10ց\x80\x80\x04\x12\x19\n" + + "\x11Drop_HeadQTimeout\x10ׁ\x80\x80\x04\x12\x1b\n" + + "\x13Drop_StalledDiscard\x10\u0601\x80\x80\x04\x12\x14\n" + + "\fDrop_RxQFull\x10ف\x80\x80\x04\x12\x1b\n" + + "\x13Drop_PhysLayerError\x10ځ\x80\x80\x04\x12\x15\n" + + "\rDrop_DmaError\x10ہ\x80\x80\x04\x12\x1a\n" + + "\x12Drop_FirmwareError\x10܁\x80\x80\x04\x12\x1d\n" + + "\x15Drop_DecryptionFailed\x10݁\x80\x80\x04\x12\x19\n" + + "\x11Drop_BadSignature\x10ށ\x80\x80\x04\x12\x1c\n" + + "\x14Drop_CoalescingError\x10߁\x80\x80\x04\x12\x19\n" + + "\x11Drop_VlanSpoofing\x10၀\x80\x04\x12\x1f\n" + + "\x17Drop_UnallowedEtherType\x10⁀\x80\x04\x12\x16\n" + + "\x0eDrop_VportDown\x10\u3040\x80\x04\x12\x1d\n" + + "\x15Drop_SteeringMismatch\x10䁀\x80\x04\x12\x1b\n" + + "\x13Drop_MicroportError\x10\x91\x83\x80\x80\x04\x12\x17\n" + + "\x0fDrop_VfNotReady\x10\x92\x83\x80\x80\x04\x12\x1e\n" + + "\x16Drop_MicroportNotReady\x10\x93\x83\x80\x80\x04\x12\x17\n" + + "\x0fDrop_VMBusError\x10\x94\x83\x80\x80\x04\x12\x1e\n" + + "\x16Drop_FL_LoopbackPacket\x10ل\x80\x80\x04\x12!\n" + + "\x19Drop_FL_InvalidSnapHeader\x10ڄ\x80\x80\x04\x12#\n" + + "\x1bDrop_FL_InvalidEthernetType\x10ۄ\x80\x80\x04\x12#\n" + + "\x1bDrop_FL_InvalidPacketLength\x10܄\x80\x80\x04\x12#\n" + + "\x1bDrop_FL_HeaderNotContiguous\x10݄\x80\x80\x04\x12&\n" + + "\x1eDrop_FL_InvalidDestinationType\x10ބ\x80\x80\x04\x12!\n" + + "\x19Drop_FL_InterfaceNotReady\x10߄\x80\x80\x04\x12 \n" + + "\x18Drop_FL_ProviderNotReady\x10\xe0\x84\x80\x80\x04\x12\x1e\n" + + "\x16Drop_FL_InvalidLsoInfo\x10ᄀ\x80\x04\x12\x1e\n" + + "\x16Drop_FL_InvalidUsoInfo\x10℀\x80\x04\x12\x1d\n" + + "\x15Drop_FL_InvalidMedium\x10\u3100\x80\x04\x12 \n" + + "\x18Drop_FL_InvalidArpHeader\x10䄀\x80\x04\x12!\n" + + "\x19Drop_FL_NoClientInterface\x10儀\x80\x04\x12!\n" + + "\x19Drop_FL_TooManyNetBuffers\x10愀\x80\x04\x12 \n" + + "\x18Drop_FL_FlsNpiClientDrop\x10焀\x80\x04\x12\x15\n" + + "\rDrop_ArpGuard\x10\xbd\x85\x80\x80\x04\x12\x17\n" + + "\x0fDrop_ArpLimiter\x10\xbe\x85\x80\x80\x04\x12\x18\n" + + "\x10Drop_DhcpLimiter\x10\xbf\x85\x80\x80\x04\x12\x1b\n" + + "\x13Drop_BlockBroadcast\x10\xc0\x85\x80\x80\x04\x12\x17\n" + + "\x0fDrop_BlockNonIp\x10\xc1\x85\x80\x80\x04\x12\x16\n" + + "\x0eDrop_ArpFilter\x10\u0085\x80\x80\x04\x12\x16\n" + + "\x0eDrop_Ipv4Guard\x10Å\x80\x80\x04\x12\x16\n" + + "\x0eDrop_Ipv6Guard\x10ą\x80\x80\x04\x12\x15\n" + + "\rDrop_MacGuard\x10Ņ\x80\x80\x04\x12$\n" + + "\x1cDrop_BroadcastNoDestinations\x10ƅ\x80\x80\x04\x12!\n" + + "\x19Drop_UnicastNoDestination\x10Dž\x80\x80\x04\x12 \n" + + "\x18Drop_UnicastPortNotReady\x10ȅ\x80\x80\x04\x12!\n" + + "\x19Drop_SwitchCallbackFailed\x10Ʌ\x80\x80\x04\x12\x1a\n" + + "\x12Drop_Icmpv6Limiter\x10ʅ\x80\x80\x04\x12\x16\n" + + "\x0eDrop_Intercept\x10˅\x80\x80\x04\x12\x1b\n" + + "\x13Drop_InterceptBlock\x10̅\x80\x80\x04\x12\x15\n" + + "\rDrop_NDPGuard\x10ͅ\x80\x80\x04\x12\x18\n" + + "\x10Drop_PortBlocked\x10΅\x80\x80\x04\x12\x19\n" + + "\x11Drop_NicSuspended\x10υ\x80\x80\x04\x12 \n" + + "\x18Drop_NL_BadSourceAddress\x10\x85\x87\x80\x80\x04\x12\"\n" + + "\x1aDrop_NL_NotLocallyDestined\x10\x86\x87\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_ProtocolUnreachable\x10\x87\x87\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NL_PortUnreachable\x10\x88\x87\x80\x80\x04\x12\x19\n" + + "\x11Drop_NL_BadLength\x10\x89\x87\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NL_MalformedHeader\x10\x8a\x87\x80\x80\x04\x12\x17\n" + + "\x0fDrop_NL_NoRoute\x10\x8b\x87\x80\x80\x04\x12\x1b\n" + + "\x13Drop_NL_BeyondScope\x10\x8c\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_InspectionDrop\x10\x8d\x87\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_TooManyDecapsulations\x10\x8e\x87\x80\x80\x04\x12*\n" + + "\"Drop_NL_AdministrativelyProhibited\x10\x8f\x87\x80\x80\x04\x12\x1b\n" + + "\x13Drop_NL_BadChecksum\x10\x90\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_ReceivePathMax\x10\x91\x87\x80\x80\x04\x12 \n" + + "\x18Drop_NL_HopLimitExceeded\x10\x92\x87\x80\x80\x04\x12\"\n" + + "\x1aDrop_NL_AddressUnreachable\x10\x93\x87\x80\x80\x04\x12\x19\n" + + "\x11Drop_NL_RscPacket\x10\x94\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_ForwardPathMax\x10\x95\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_ArbitrationUnhandled\x10\x96\x87\x80\x80\x04\x12 \n" + + "\x18Drop_NL_InspectionAbsorb\x10\x97\x87\x80\x80\x04\x12'\n" + + "\x1fDrop_NL_DontFragmentMtuExceeded\x10\x98\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_BufferLengthExceeded\x10\x99\x87\x80\x80\x04\x12(\n" + + " Drop_NL_AddressResolutionTimeout\x10\x9a\x87\x80\x80\x04\x12(\n" + + " Drop_NL_AddressResolutionFailure\x10\x9b\x87\x80\x80\x04\x12\x1c\n" + + "\x14Drop_NL_IpsecFailure\x10\x9c\x87\x80\x80\x04\x12'\n" + + "\x1fDrop_NL_ExtensionHeadersFailure\x10\x9d\x87\x80\x80\x04\x12 \n" + + "\x18Drop_NL_IpsnpiClientDrop\x10\x9e\x87\x80\x80\x04\x12\"\n" + + "\x1aDrop_NL_UnsupportedOffload\x10\x9f\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_RoutingFailure\x10\xa0\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_AncillaryDataFailure\x10\xa1\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_RawDataFailure\x10\xa2\x87\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_SessionStateFailure\x10\xa3\x87\x80\x80\x04\x12-\n" + + "%Drop_NL_IpsnpiModifiedButNotForwarded\x10\xa4\x87\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NL_IpsnpiNoNextHop\x10\xa5\x87\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IpsnpiNoCompartment\x10\xa6\x87\x80\x80\x04\x12!\n" + + "\x19Drop_NL_IpsnpiNoInterface\x10\xa7\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_IpsnpiNoSubInterface\x10\xa8\x87\x80\x80\x04\x12'\n" + + "\x1fDrop_NL_IpsnpiInterfaceDisabled\x10\xa9\x87\x80\x80\x04\x12(\n" + + " Drop_NL_IpsnpiSegmentationFailed\x10\xaa\x87\x80\x80\x04\x12&\n" + + "\x1eDrop_NL_IpsnpiNoEthernetHeader\x10\xab\x87\x80\x80\x04\x12(\n" + + " Drop_NL_IpsnpiUnexpectedFragment\x10\xac\x87\x80\x80\x04\x12.\n" + + "&Drop_NL_IpsnpiUnsupportedInterfaceType\x10\xad\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_IpsnpiInvalidLsoInfo\x10\xae\x87\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_IpsnpiInvalidUsoInfo\x10\xaf\x87\x80\x80\x04\x12\x1d\n" + + "\x15Drop_NL_InternalError\x10\xb0\x87\x80\x80\x04\x12*\n" + + "\"Drop_NL_AdministrativelyConfigured\x10\xb1\x87\x80\x80\x04\x12\x19\n" + + "\x11Drop_NL_BadOption\x10\xb2\x87\x80\x80\x04\x12\"\n" + + "\x1aDrop_NL_LoopbackDisallowed\x10\xb3\x87\x80\x80\x04\x12\x1c\n" + + "\x14Drop_NL_SmallerScope\x10\xb4\x87\x80\x80\x04\x12\x19\n" + + "\x11Drop_NL_QueueFull\x10\xb5\x87\x80\x80\x04\x12!\n" + + "\x19Drop_NL_InterfaceDisabled\x10\xb6\x87\x80\x80\x04\x12\x1b\n" + + "\x13Drop_NL_IcmpGeneric\x10\xb7\x87\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IcmpTruncatedHeader\x10\xb8\x87\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IcmpInvalidChecksum\x10\xb9\x87\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_IcmpInspection\x10\xba\x87\x80\x80\x04\x12-\n" + + "%Drop_NL_IcmpNeighborDiscoveryLoopback\x10\xbb\x87\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NL_IcmpUnknownType\x10\xbc\x87\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpTruncatedIpHeader\x10\xbd\x87\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpOversizedIpHeader\x10\xbe\x87\x80\x80\x04\x12\x1d\n" + + "\x15Drop_NL_IcmpNoHandler\x10\xbf\x87\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpRespondingToError\x10\xc0\x87\x80\x80\x04\x12!\n" + + "\x19Drop_NL_IcmpInvalidSource\x10\xc1\x87\x80\x80\x04\x12&\n" + + "\x1eDrop_NL_IcmpInterfaceRateLimit\x10\u0087\x80\x80\x04\x12!\n" + + "\x19Drop_NL_IcmpPathRateLimit\x10Ç\x80\x80\x04\x12\x1b\n" + + "\x13Drop_NL_IcmpNoRoute\x10ć\x80\x80\x04\x12+\n" + + "#Drop_NL_IcmpMatchingRequestNotFound\x10Ň\x80\x80\x04\x12\"\n" + + "\x1aDrop_NL_IcmpBufferTooSmall\x10Ƈ\x80\x80\x04\x12&\n" + + "\x1eDrop_NL_IcmpAncillaryDataQuery\x10LJ\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpIncorrectHopLimit\x10ȇ\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NL_IcmpUnknownCode\x10ɇ\x80\x80\x04\x12&\n" + + "\x1eDrop_NL_IcmpSourceNotLinkLocal\x10ʇ\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpTruncatedNdHeader\x10ˇ\x80\x80\x04\x12.\n" + + "&Drop_NL_IcmpInvalidNdOptSourceLinkAddr\x10̇\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IcmpInvalidNdOptMtu\x10͇\x80\x80\x04\x121\n" + + ")Drop_NL_IcmpInvalidNdOptPrefixInformation\x10·\x80\x80\x04\x120\n" + + "(Drop_NL_IcmpInvalidNdOptRouteInformation\x10χ\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpInvalidNdOptRdnss\x10Ї\x80\x80\x04\x12%\n" + + "\x1dDrop_NL_IcmpInvalidNdOptDnssl\x10ч\x80\x80\x04\x12(\n" + + " Drop_NL_IcmpPacketParsingFailure\x10҇\x80\x80\x04\x12\x1e\n" + + "\x16Drop_NL_IcmpDisallowed\x10Ӈ\x80\x80\x04\x12.\n" + + "&Drop_NL_IcmpInvalidRouterAdvertisement\x10ԇ\x80\x80\x04\x12+\n" + + "#Drop_NL_IcmpSourceFromDifferentLink\x10Շ\x80\x80\x04\x126\n" + + ".Drop_NL_IcmpInvalidRedirectDestinationOrTarget\x10և\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IcmpInvalidNdTarget\x10ׇ\x80\x80\x04\x12+\n" + + "#Drop_NL_IcmpNaMulticastAndSolicited\x10؇\x80\x80\x04\x12-\n" + + "%Drop_NL_IcmpNdLinkLayerAddressIsLocal\x10ه\x80\x80\x04\x12(\n" + + " Drop_NL_IcmpDuplicateEchoRequest\x10ڇ\x80\x80\x04\x12'\n" + + "\x1fDrop_NL_IcmpNotAPotentialRouter\x10ۇ\x80\x80\x04\x12#\n" + + "\x1bDrop_NL_IcmpInvalidMldQuery\x10܇\x80\x80\x04\x12$\n" + + "\x1cDrop_NL_IcmpInvalidMldReport\x10݇\x80\x80\x04\x12+\n" + + "#Drop_NL_IcmpLocallySourcedMldReport\x10އ\x80\x80\x04\x12&\n" + + "\x1eDrop_NL_IcmpNotLocallyDestined\x10߇\x80\x80\x04\x12 \n" + + "\x18Drop_NL_ArpInvalidSource\x10\xe0\x87\x80\x80\x04\x12 \n" + + "\x18Drop_NL_ArpInvalidTarget\x10ᇀ\x80\x04\x12\"\n" + + "\x1aDrop_NL_ArpDlSourceIsLocal\x10⇀\x80\x04\x12%\n" + + "\x1dDrop_NL_ArpNotLocallyDestined\x10㇀\x80\x04\x12\x1f\n" + + "\x17Drop_NL_NlClientDiscard\x10䇀\x80\x04\x12.\n" + + "&Drop_NL_IpsnpiUroSegmentSizeExceedsMtu\x10净\x80\x04\x12$\n" + + "\x1cDrop_NL_IcmpFragmentedPacket\x10懀\x80\x04\x12'\n" + + "\x1fDrop_NL_FirstFragmentIncomplete\x10燀\x80\x04\x12\x1f\n" + + "\x17Drop_NL_SourceViolation\x10臀\x80\x04\x12\x1d\n" + + "\x15Drop_NL_IcmpJumbogram\x10釀\x80\x04\x12\x1c\n" + + "\x14Drop_NL_SwUsoFailure\x10ꇀ\x80\x04\x12#\n" + + "\x1bDrop_INET_SourceUnspecified\x10\xb0\x89\x80\x80\x04\x12&\n" + + "\x1eDrop_INET_DestinationMulticast\x10\xb1\x89\x80\x80\x04\x12\x1f\n" + + "\x17Drop_INET_HeaderInvalid\x10\xb2\x89\x80\x80\x04\x12!\n" + + "\x19Drop_INET_ChecksumInvalid\x10\xb3\x89\x80\x80\x04\x12\"\n" + + "\x1aDrop_INET_EndpointNotFound\x10\xb4\x89\x80\x80\x04\x12\x1f\n" + + "\x17Drop_INET_ConnectedPath\x10\xb5\x89\x80\x80\x04\x12\x1e\n" + + "\x16Drop_INET_SessionState\x10\xb6\x89\x80\x80\x04\x12#\n" + + "\x1bDrop_INET_ReceiveInspection\x10\xb7\x89\x80\x80\x04\x12\x1c\n" + + "\x14Drop_INET_AckInvalid\x10\xb8\x89\x80\x80\x04\x12\x1d\n" + + "\x15Drop_INET_ExpectedSyn\x10\xb9\x89\x80\x80\x04\x12\x15\n" + + "\rDrop_INET_Rst\x10\xba\x89\x80\x80\x04\x12\x1c\n" + + "\x14Drop_INET_SynRcvdSyn\x10\xbb\x89\x80\x80\x04\x12%\n" + + "\x1dDrop_INET_SimultaneousConnect\x10\xbc\x89\x80\x80\x04\x12\x1c\n" + + "\x14Drop_INET_PawsFailed\x10\xbd\x89\x80\x80\x04\x12\x1c\n" + + "\x14Drop_INET_LandAttack\x10\xbe\x89\x80\x80\x04\x12\x1d\n" + + "\x15Drop_INET_MissedReset\x10\xbf\x89\x80\x80\x04\x12\x1f\n" + + "\x17Drop_INET_OutsideWindow\x10\xc0\x89\x80\x80\x04\x12\"\n" + + "\x1aDrop_INET_DuplicateSegment\x10\xc1\x89\x80\x80\x04\x12\x1e\n" + + "\x16Drop_INET_ClosedWindow\x10\u0089\x80\x80\x04\x12\x1c\n" + + "\x14Drop_INET_TcbRemoved\x10É\x80\x80\x04\x12\x1a\n" + + "\x12Drop_INET_FinWait2\x10ĉ\x80\x80\x04\x12$\n" + + "\x1cDrop_INET_ReassemblyConflict\x10ʼn\x80\x80\x04\x12\x1d\n" + + "\x15Drop_INET_FinReceived\x10Ɖ\x80\x80\x04\x12&\n" + + "\x1eDrop_INET_ListenerInvalidFlags\x10lj\x80\x80\x04\x12\"\n" + + "\x1aDrop_INET_TcbNotInTcbTable\x10ȉ\x80\x80\x04\x125\n" + + "-Drop_INET_TimeWaitTcbReceivedRstOutsideWindow\x10ɉ\x80\x80\x04\x12-\n" + + "%Drop_INET_TimeWaitTcbSynAndOtherFlags\x10ʉ\x80\x80\x04\x12\x1d\n" + + "\x15Drop_INET_TimeWaitTcb\x10ˉ\x80\x80\x04\x121\n" + + ")Drop_INET_SynAckWithFastopenCookieRequest\x10̉\x80\x80\x04\x12\x1d\n" + + "\x15Drop_INET_PauseAccept\x10͉\x80\x80\x04\x12\x1b\n" + + "\x13Drop_INET_SynAttack\x10Ή\x80\x80\x04\x12\"\n" + + "\x1aDrop_INET_AcceptInspection\x10ω\x80\x80\x04\x12#\n" + + "\x1bDrop_INET_AcceptRedirection\x10Љ\x80\x80\x04\x12\"\n" + + "\x1aDrop_SlbMux_ParsingFailure\x10\x95\x8a\x80\x80\x04\x12%\n" + + "\x1dDrop_SlbMux_FirstFragmentMiss\x10\x96\x8a\x80\x80\x04\x125\n" + + "-Drop_SlbMux_ICMPErrorPayloadValidationFailure\x10\x97\x8a\x80\x80\x04\x121\n" + + ")Drop_SlbMux_ICMPErrorPacketMatchNoSession\x10\x98\x8a\x80\x80\x04\x127\n" + + "/Drop_SlbMux_ExternalHairpinNexthopLookupFailure\x10\x99\x8a\x80\x80\x04\x12+\n" + + "#Drop_SlbMux_NoMatchingStaticMapping\x10\x9a\x8a\x80\x80\x04\x12+\n" + + "#Drop_SlbMux_NexthopReferenceFailure\x10\x9b\x8a\x80\x80\x04\x12\"\n" + + "\x1aDrop_SlbMux_CloningFailure\x10\x9c\x8a\x80\x80\x04\x12&\n" + + "\x1eDrop_SlbMux_TranslationFailure\x10\x9d\x8a\x80\x80\x04\x12$\n" + + "\x1cDrop_SlbMux_HopLimitExceeded\x10\x9e\x8a\x80\x80\x04\x12'\n" + + "\x1fDrop_SlbMux_PacketBiggerThanMTU\x10\x9f\x8a\x80\x80\x04\x120\n" + + "(Drop_SlbMux_UnexpectedRouteLookupFailure\x10\xa0\x8a\x80\x80\x04\x12\x1b\n" + + "\x13Drop_SlbMux_NoRoute\x10\xa1\x8a\x80\x80\x04\x12*\n" + + "\"Drop_SlbMux_SessionCreationFailure\x10\xa2\x8a\x80\x80\x04\x123\n" + + "+Drop_SlbMux_NexthopNotOverExternalInterface\x10\xa3\x8a\x80\x80\x04\x12;\n" + + "3Drop_SlbMux_NexthopExternalInterfaceMissNATInstance\x10\xa4\x8a\x80\x80\x04\x122\n" + + "*Drop_SlbMux_NATItselfCantBeInternalNexthop\x10\xa5\x8a\x80\x80\x04\x129\n" + + "1Drop_SlbMux_PacketRoutableInItsArrivalCompartment\x10\xa6\x8a\x80\x80\x04\x127\n" + + "/Drop_SlbMux_PacketTransportProtocolNotSupported\x10\xa7\x8a\x80\x80\x04\x12+\n" + + "#Drop_SlbMux_PacketIsDestinedLocally\x10\xa8\x8a\x80\x80\x04\x12=\n" + + "5Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT\x10\xa9\x8a\x80\x80\x04\x12\x1d\n" + + "\x15Drop_SlbMux_MuxReject\x10\xaa\x8a\x80\x80\x04\x12$\n" + + "\x1cDrop_SlbMux_DipLookupFailure\x10\xab\x8a\x80\x80\x04\x12+\n" + + "#Drop_SlbMux_MuxEncapsulationFailure\x10\xac\x8a\x80\x80\x04\x12.\n" + + "&Drop_SlbMux_InvalidDiagPacketEncapType\x10\xad\x8a\x80\x80\x04\x12(\n" + + " Drop_SlbMux_DiagPacketIsRedirect\x10\xae\x8a\x80\x80\x04\x12*\n" + + "\"Drop_SlbMux_UnableToHandleRedirect\x10\xaf\x8a\x80\x80\x04\x12\x19\n" + + "\x11Drop_Ipsec_BadSpi\x10\xf9\x8a\x80\x80\x04\x12$\n" + + "\x1cDrop_Ipsec_SALifetimeExpired\x10\xfa\x8a\x80\x80\x04\x12\x1a\n" + + "\x12Drop_Ipsec_WrongSA\x10\xfb\x8a\x80\x80\x04\x12$\n" + + "\x1cDrop_Ipsec_ReplayCheckFailed\x10\xfc\x8a\x80\x80\x04\x12 \n" + + "\x18Drop_Ipsec_InvalidPacket\x10\xfd\x8a\x80\x80\x04\x12'\n" + + "\x1fDrop_Ipsec_IntegrityCheckFailed\x10\xfe\x8a\x80\x80\x04\x12 \n" + + "\x18Drop_Ipsec_ClearTextDrop\x10\xff\x8a\x80\x80\x04\x12#\n" + + "\x1bDrop_Ipsec_AuthFirewallDrop\x10\x80\x8b\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Ipsec_ThrottleDrop\x10\x81\x8b\x80\x80\x04\x12\x1d\n" + + "\x15Drop_Ipsec_Dosp_Block\x10\x82\x8b\x80\x80\x04\x12)\n" + + "!Drop_Ipsec_Dosp_ReceivedMulticast\x10\x83\x8b\x80\x80\x04\x12%\n" + + "\x1dDrop_Ipsec_Dosp_InvalidPacket\x10\x84\x8b\x80\x80\x04\x12)\n" + + "!Drop_Ipsec_Dosp_StateLookupFailed\x10\x85\x8b\x80\x80\x04\x12\"\n" + + "\x1aDrop_Ipsec_Dosp_MaxEntries\x10\x86\x8b\x80\x80\x04\x12(\n" + + " Drop_Ipsec_Dosp_KeymodNotAllowed\x10\x87\x8b\x80\x80\x04\x12/\n" + + "'Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues\x10\x88\x8b\x80\x80\x04\x12\x1b\n" + + "\x13Drop_Ipsec_NoMemory\x10\x89\x8b\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Ipsec_Unsuccessful\x10\x8a\x8b\x80\x80\x04\x12.\n" + + "&Drop_NetCx_NetPacketLayoutParseFailure\x10\u074b\x80\x80\x04\x12*\n" + + "\"Drop_NetCx_SoftwareChecksumFailure\x10ދ\x80\x80\x04\x12\x1f\n" + + "\x17Drop_NetCx_NicQueueStop\x10ߋ\x80\x80\x04\x12)\n" + + "!Drop_NetCx_InvalidNetBufferLength\x10\xe0\x8b\x80\x80\x04\x12\x1d\n" + + "\x15Drop_NetCx_LSOFailure\x10ዀ\x80\x04\x12\x1d\n" + + "\x15Drop_NetCx_USOFailure\x10⋀\x80\x04\x125\n" + + "-Drop_NetCx_BufferBounceFailureAndPacketIgnore\x10㋀\x80\x04\x12\x17\n" + + "\x0fDrop_Http_Begin\x10\xb8\x97\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_UlError_Begin\x10\xb9\x97\x80\x80\x04\x12\x19\n" + + "\x11Drop_Http_UlError\x10\xba\x97\x80\x80\x04\x12\x1d\n" + + "\x15Drop_Http_UlErrorVerb\x10\xbb\x97\x80\x80\x04\x12\x1c\n" + + "\x14Drop_Http_UlErrorUrl\x10\xbc\x97\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_UlErrorHeader\x10\xbd\x97\x80\x80\x04\x12\x1d\n" + + "\x15Drop_Http_UlErrorHost\x10\xbe\x97\x80\x80\x04\x12\x1c\n" + + "\x14Drop_Http_UlErrorNum\x10\xbf\x97\x80\x80\x04\x12$\n" + + "\x1cDrop_Http_UlErrorFieldLength\x10\xc0\x97\x80\x80\x04\x12&\n" + + "\x1eDrop_Http_UlErrorRequestLength\x10\xc1\x97\x80\x80\x04\x12%\n" + + "\x1dDrop_Http_UlErrorUnauthorized\x10\u0097\x80\x80\x04\x12%\n" + + "\x1dDrop_Http_UlErrorForbiddenUrl\x10×\x80\x80\x04\x12!\n" + + "\x19Drop_Http_UlErrorNotFound\x10ė\x80\x80\x04\x12&\n" + + "\x1eDrop_Http_UlErrorContentLength\x10ŗ\x80\x80\x04\x12+\n" + + "#Drop_Http_UlErrorPreconditionFailed\x10Ɨ\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UlErrorEntityTooLarge\x10Ǘ\x80\x80\x04\x12\"\n" + + "\x1aDrop_Http_UlErrorUrlLength\x10ȗ\x80\x80\x04\x12,\n" + + "$Drop_Http_UlErrorRangeNotSatisfiable\x10ɗ\x80\x80\x04\x12+\n" + + "#Drop_Http_UlErrorMisdirectedRequest\x10ʗ\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UlErrorInternalServer\x10˗\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UlErrorNotImplemented\x10̗\x80\x80\x04\x12$\n" + + "\x1cDrop_Http_UlErrorUnavailable\x10͗\x80\x80\x04\x12(\n" + + " Drop_Http_UlErrorConnectionLimit\x10Η\x80\x80\x04\x12,\n" + + "$Drop_Http_UlErrorRapidFailProtection\x10ϗ\x80\x80\x04\x12)\n" + + "!Drop_Http_UlErrorRequestQueueFull\x10З\x80\x80\x04\x12(\n" + + " Drop_Http_UlErrorDisabledByAdmin\x10ї\x80\x80\x04\x12&\n" + + "\x1eDrop_Http_UlErrorDisabledByApp\x10җ\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UlErrorJobObjectFired\x10ӗ\x80\x80\x04\x12$\n" + + "\x1cDrop_Http_UlErrorAppPoolBusy\x10ԗ\x80\x80\x04\x12 \n" + + "\x18Drop_Http_UlErrorVersion\x10\u0557\x80\x80\x04\x12\x1d\n" + + "\x15Drop_Http_UlError_End\x10֗\x80\x80\x04\x12!\n" + + "\x19Drop_Http_UxDuoFaultBegin\x10Ț\x80\x80\x04\x12%\n" + + "\x1dDrop_Http_UxDuoFaultUserAbort\x10ɚ\x80\x80\x04\x12&\n" + + "\x1eDrop_Http_UxDuoFaultCollection\x10ʚ\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultClientResetStream\x10˚\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultMethodNotFound\x10̚\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultSchemeMismatch\x10͚\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultSchemeNotFound\x10Κ\x80\x80\x04\x12(\n" + + " Drop_Http_UxDuoFaultDataAfterEnd\x10Ϛ\x80\x80\x04\x12(\n" + + " Drop_Http_UxDuoFaultPathNotFound\x10К\x80\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultHalfClosedLocal\x10њ\x80\x80\x04\x12,\n" + + "$Drop_Http_UxDuoFaultIncompatibleAuth\x10Қ\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UxDuoFaultDeprecated3\x10Ӛ\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultClientCertBlocked\x10Ԛ\x80\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultHeaderNameEmpty\x10՚\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_UxDuoFaultIllegalSend\x10֚\x80\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultPushUpperAttach\x10ך\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultStreamUpperAttach\x10ؚ\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultActiveStreamLimit\x10ٚ\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultAuthorityNotFound\x10ښ\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultUnexpectedTail\x10ۚ\x80\x80\x04\x12%\n" + + "\x1dDrop_Http_UxDuoFaultTruncated\x10ܚ\x80\x80\x04\x12(\n" + + " Drop_Http_UxDuoFaultResponseHold\x10ݚ\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultRequestChunked\x10ޚ\x80\x80\x04\x120\n" + + "(Drop_Http_UxDuoFaultRequestContentLength\x10ߚ\x80\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultResponseChunked\x10\xe0\x9a\x80\x80\x04\x121\n" + + ")Drop_Http_UxDuoFaultResponseContentLength\x10\u1680\x80\x04\x124\n" + + ",Drop_Http_UxDuoFaultResponseTransferEncoding\x10⚀\x80\x04\x12(\n" + + " Drop_Http_UxDuoFaultResponseLine\x10㚀\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultResponseHeader\x10䚀\x80\x04\x12#\n" + + "\x1bDrop_Http_UxDuoFaultConnect\x10嚀\x80\x04\x12&\n" + + "\x1eDrop_Http_UxDuoFaultChunkStart\x10暀\x80\x04\x12'\n" + + "\x1fDrop_Http_UxDuoFaultChunkLength\x10皀\x80\x04\x12%\n" + + "\x1dDrop_Http_UxDuoFaultChunkStop\x10蚀\x80\x04\x120\n" + + "(Drop_Http_UxDuoFaultHeadersAfterTrailers\x10隀\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultHeadersAfterEnd\x10Ꚁ\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultEndlessTrailer\x10뚀\x80\x04\x12,\n" + + "$Drop_Http_UxDuoFaultTransferEncoding\x10욀\x80\x04\x123\n" + + "+Drop_Http_UxDuoFaultMultipleTransferCodings\x10횀\x80\x04\x12$\n" + + "\x1cDrop_Http_UxDuoFaultPushBody\x10\ue680\x80\x04\x12+\n" + + "#Drop_Http_UxDuoFaultStreamAbandoned\x10\uf680\x80\x04\x12)\n" + + "!Drop_Http_UxDuoFaultMalformedHost\x10\U0001a000\x04\x121\n" + + ")Drop_Http_UxDuoFaultDecompressionOverflow\x10\U0005a000\x04\x12-\n" + + "%Drop_Http_UxDuoFaultIllegalHeaderName\x10\U0009a000\x04\x12.\n" + + "&Drop_Http_UxDuoFaultIllegalHeaderValue\x10\U000da000\x04\x120\n" + + "(Drop_Http_UxDuoFaultConnHeaderDisallowed\x10\xf4\x9a\x80\x80\x04\x12/\n" + + "'Drop_Http_UxDuoFaultConnHeaderMalformed\x10\xf5\x9a\x80\x80\x04\x12,\n" + + "$Drop_Http_UxDuoFaultCookieReassembly\x10\xf6\x9a\x80\x80\x04\x12(\n" + + " Drop_Http_UxDuoFaultStatusHeader\x10\xf7\x9a\x80\x80\x04\x12,\n" + + "$Drop_Http_UxDuoFaultSchemeDisallowed\x10\xf8\x9a\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultPathDisallowed\x10\xf9\x9a\x80\x80\x04\x12$\n" + + "\x1cDrop_Http_UxDuoFaultPushHost\x10\xfa\x9a\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultGoawayReceived\x10\xfb\x9a\x80\x80\x04\x12*\n" + + "\"Drop_Http_UxDuoFaultAbortLegacyApp\x10\xfc\x9a\x80\x80\x04\x123\n" + + "+Drop_Http_UxDuoFaultUpgradeHeaderDisallowed\x10\xfd\x9a\x80\x80\x04\x121\n" + + ")Drop_Http_UxDuoFaultResponseUpgradeHeader\x10\xfe\x9a\x80\x80\x04\x125\n" + + "-Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed\x10\xff\x9a\x80\x80\x04\x123\n" + + "+Drop_Http_UxDuoFaultResponseKeepAliveHeader\x10\x80\x9b\x80\x80\x04\x125\n" + + "-Drop_Http_UxDuoFaultProxyConnHeaderDisallowed\x10\x81\x9b\x80\x80\x04\x123\n" + + "+Drop_Http_UxDuoFaultResponseProxyConnHeader\x10\x82\x9b\x80\x80\x04\x12/\n" + + "'Drop_Http_UxDuoFaultConnectionGoingAway\x10\x83\x9b\x80\x80\x04\x126\n" + + ".Drop_Http_UxDuoFaultTransferEncodingDisallowed\x10\x84\x9b\x80\x80\x04\x123\n" + + "+Drop_Http_UxDuoFaultContentLengthDisallowed\x10\x85\x9b\x80\x80\x04\x12-\n" + + "%Drop_Http_UxDuoFaultTrailerDisallowed\x10\x86\x9b\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_UxDuoFaultEnd\x10\x87\x9b\x80\x80\x04\x12#\n" + + "\x1bDrop_Http_ReceiveSuppressed\x10\x90\x9c\x80\x80\x04\x12\x19\n" + + "\x11Drop_Http_Generic\x10؝\x80\x80\x04\x12\"\n" + + "\x1aDrop_Http_InvalidParameter\x10ٝ\x80\x80\x04\x12'\n" + + "\x1fDrop_Http_InsufficientResources\x10ڝ\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_InvalidHandle\x10\u06dd\x80\x80\x04\x12\x1e\n" + + "\x16Drop_Http_NotSupported\x10ܝ\x80\x80\x04\x12 \n" + + "\x18Drop_Http_BadNetworkPath\x10ݝ\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_InternalError\x10ޝ\x80\x80\x04\x12\x1f\n" + + "\x17Drop_Http_NoSuchPackage\x10ߝ\x80\x80\x04\x12\"\n" + + "\x1aDrop_Http_PrivilegeNotHeld\x10\xe0\x9d\x80\x80\x04\x12#\n" + + "\x1bDrop_Http_CannotImpersonate\x10ᝀ\x80\x04\x12\x1e\n" + + "\x16Drop_Http_LogonFailure\x10❀\x80\x04\x12$\n" + + "\x1cDrop_Http_NoSuchLogonSession\x10㝀\x80\x04\x12\x1e\n" + + "\x16Drop_Http_AccessDenied\x10䝀\x80\x04\x12 \n" + + "\x18Drop_Http_NoLogonServers\x10址\x80\x04\x12$\n" + + "\x1cDrop_Http_TimeDifferenceAtDc\x10杀\x80\x04\x12\x15\n" + + "\rDrop_Http_End\x10\xa0\x9f\x80\x80\x04B'Z%github.com/microsoft/retina/pkg/utilsb\x06proto3" + +var ( + file_metadata_windows_proto_rawDescOnce sync.Once + file_metadata_windows_proto_rawDescData []byte +) + +func file_metadata_windows_proto_rawDescGZIP() []byte { + file_metadata_windows_proto_rawDescOnce.Do(func() { + file_metadata_windows_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metadata_windows_proto_rawDesc), len(file_metadata_windows_proto_rawDesc))) + }) + return file_pkg_utils_metadata_windows_proto_rawDescData +} + var file_pkg_utils_metadata_windows_proto_enumTypes = make([]protoimpl.EnumInfo, 2) var file_pkg_utils_metadata_windows_proto_msgTypes = make([]protoimpl.MessageInfo, 2) var file_pkg_utils_metadata_windows_proto_goTypes = []any{ @@ -2368,25 +3137,11 @@ func file_pkg_utils_metadata_windows_proto_init() { if File_pkg_utils_metadata_windows_proto != nil { return } - if !protoimpl.UnsafeEnabled { - file_pkg_utils_metadata_windows_proto_msgTypes[0].Exporter = func(v any, i int) any { - switch v := v.(*RetinaMetadata); i { - case 0: - return &v.state - case 1: - return &v.sizeCache - case 2: - return &v.unknownFields - default: - return nil - } - } - } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: file_pkg_utils_metadata_windows_proto_rawDesc, + RawDescriptor: unsafe.Slice(unsafe.StringData(file_metadata_windows_proto_rawDesc), len(file_metadata_windows_proto_rawDesc)), NumEnums: 2, NumMessages: 2, NumExtensions: 0, diff --git a/pkg/utils/metadata_windows.proto b/pkg/utils/metadata_windows.proto index 2139f3721e..9c7a730827 100644 --- a/pkg/utils/metadata_windows.proto +++ b/pkg/utils/metadata_windows.proto @@ -29,474 +29,564 @@ enum DNSType { } enum DropReason { - Drop_Unknown = 0; - Drop_InvalidData = 1; - Drop_InvalidPacket = 2; - Drop_Resources = 3; - Drop_NotReady = 4; - Drop_Disconnected = 5; - Drop_NotAccepted = 6; - Drop_Busy = 7; - Drop_Filtered = 8; - Drop_FilteredVLAN = 9; - Drop_UnauthorizedVLAN = 10; - Drop_UnauthorizedMAC = 11; - Drop_FailedSecurityPolicy = 12; - Drop_FailedPvlanSetting = 13; - Drop_Qos = 14; - Drop_Ipsec = 15; - Drop_MacSpoofing = 16; - Drop_DhcpGuard = 17; - Drop_RouterGuard = 18; - Drop_BridgeReserved = 19; - Drop_VirtualSubnetId = 20; - Drop_RequiredExtensionMissing = 21; - Drop_InvalidConfig = 22; - Drop_MTUMismatch = 23; - Drop_NativeFwdingReq = 24; - Drop_InvalidVlanFormat = 25; - Drop_InvalidDestMac = 26; - Drop_InvalidSourceMac = 27; - Drop_InvalidFirstNBTooSmall = 28; - Drop_Wnv = 29; - Drop_StormLimit = 30; - Drop_InjectedIcmp = 31; - Drop_FailedDestinationListUpdate = 32; - Drop_NicDisabled = 33; - Drop_FailedPacketFilter = 34; - Drop_SwitchDataFlowDisabled = 35; - Drop_FilteredIsolationUntagged = 36; - Drop_InvalidPDQueue = 37; - Drop_LowPower = 38; + // + // Cilium drop reasons + // + Reason_Success = 0; + Reason_InvalidPacket = 2; + Reason_PlainText = 3; + Reason_InterfaceDecrypted = 4; + Reason_LbNoBackendSlot = 5; + Reason_LbNoBackend = 6; + Reason_LbReverseNatUpdate = 7; + Resaon_LbReverseNatStale = 8; + Reason_FragmentedPacket = 9; + Reason_FragmentedPacketUpdated = 10; + Reason_MissedCustomCall = 11; + DropReason_InvalidSIP = 132; + DropReason_Policy = 133; + DropReason_Invalid = 134; + DropReason_CTInvalidHdr = 135; + DropReason_FragNeeded = 136; + DropReason_CTUnknownProto = 137; + DropReason_UnknownL3 = 138; + DropReason_MissedTailCall = 139; + DropReason_WriteError = 140; + DropReason_UnknownL4 = 141; + DropReason_UnknownICMPCode = 142; + DropReason_UnknownICMPType = 143; + DropReason_UnknownICMP6Code = 144; + DropReason_UnknownICMP6Type = 145; + DropReason_UnknownICMP6Type_2 = 146; + DropReason_NoTunnelKey = 147; + DropReason_Unknown_1 = 148; + DropReason_Unknown_2 = 149; + DropReason_UnknownTarget = 150; + DropReason_Unroutable = 151; + DropReason_Unknown_3 = 152; + DropReason_CSUM_L3 = 153; + DropReason_CSUM_L4 = 154; + DropReason_CTCreateFailed = 155; + DropReason_InvalidExthdr = 156; + DropReason_FragNoSupport = 157; + DropReason_NoService = 158; + DropReason_UnsuppServiceProto = 159; + DropReason_NoTunnelEndpoint = 160; + DropReason_NAT46X64Disabled = 161; + DropReason_EDTHorizon = 162; + DropReason_UnknownCT = 163; + DropReason_HostUnreachable = 164; + DropReason_NoConfig = 165; + DropReason_UnsupportedL2 = 166; + DropReason_NatNoMapping = 167; + DropReason_NatUnsuppProto = 168; + DropReason_NoFIB = 169; + DropReason_EncapProhibited = 170; + DropReason_InvalidIdentity = 171; + DropReason_UnknownSender = 172; + DropReason_NatNotNeeded = 173; + DropReason_IsClusterIP = 174; + DropReason_FragNotFound = 175; + DropReason_ForbiddenICMP6 = 176; + DropReason_NotInSrcRange = 177; + DropReason_ProxyLookupFailed = 178; + DropReason_ProxySetFailed = 179; + DropReason_ProxyUnknownProto = 180; + DropReason_PolicyDeny = 181; + DropReason_VlanFiltered = 182; + DropReason_InvalidVNI = 183; + DropReason_InvalidTCBuffer = 184; + DropReason_NoSID = 185; + DropReason_MissingSRv6State = 186; + DropReason_NAT46 = 187; + DropReason_NAT64 = 188; + DropReason_PolicyAuthRequired = 189; + DropReason_CTNoMapFound = 190; + DropReason_SNATNoMapFound = 191; + DropReason_InvalidClusterID = 192; + DropReason_DSR_ENCAP_UNSUPP_PROTO = 193; + DropReason_NoEgressGateway = 194; + DropReason_UnencryptedTraffic = 195; + DropReason_TTLExceeded = 196; + DropReason_NoNodeID = 197; + DropReason_RateLimited = 198; + DropReason_IGMPHandled = 199; + DropReason_IGMPSubscribed = 200; + DropReason_MulticastHandled = 201; + DropReason_HostNotReady = 202; + DropReason_EpNotReady = 203; + DropReason_PacketMonitor = 220; + + // + // Matching VMS_PACKET_DROP_REASON + // + Drop_InvalidData = 0x40000001; + Drop_InvalidPacket = 0x40000002; + Drop_Resources = 0x40000003; + Drop_NotReady = 0x40000004; + Drop_Disconnected = 0x40000005; + Drop_NotAccepted = 0x40000006; + Drop_Busy = 0x40000007; + Drop_Filtered = 0x40000008; + Drop_FilteredVLAN = 0x40000009; + Drop_UnauthorizedVLAN = 0x4000000A; + Drop_UnauthorizedMAC = 0x4000000B; + Drop_FailedSecurityPolicy = 0x4000000C; + Drop_FailedPvlanSetting = 0x4000000D; + Drop_Qos = 0x4000000E; + Drop_Ipsec = 0x4000000F; + Drop_MacSpoofing = 0x40000010; + Drop_DhcpGuard = 0x40000011; + Drop_RouterGuard = 0x40000012; + Drop_BridgeReserved = 0x40000013; + Drop_VirtualSubnetId = 0x40000014; + Drop_RequiredExtensionMissing = 0x40000015; + Drop_InvalidConfig = 0x40000016; + Drop_MTUMismatch = 0x40000017; + Drop_NativeFwdingReq = 0x40000018; + Drop_InvalidVlanFormat = 0x40000019; + Drop_InvalidDestMac = 0x4000001A; + Drop_InvalidSourceMac = 0x4000001B; + Drop_InvalidFirstNBTooSmall = 0x4000001C; + Drop_Wnv = 0x4000001D; + Drop_StormLimit = 0x4000001E; + Drop_InjectedIcmp = 0x4000001F; + Drop_FailedDestinationListUpdate = 0x40000020; + Drop_NicDisabled = 0x40000021; + Drop_FailedPacketFilter = 0x40000022; + Drop_SwitchDataFlowDisabled = 0x40000023; + Drop_FilteredIsolationUntagged = 0x40000024; + Drop_InvalidPDQueue = 0x40000025; + Drop_LowPower = 0x40000026; // // General errors // - Drop_Pause = 201; - Drop_Reset = 202; - Drop_SendAborted = 203; - Drop_ProtocolNotBound = 204; - Drop_Failure = 205; - Drop_InvalidLength = 206; - Drop_HostOutOfMemory = 207; - Drop_FrameTooLong = 208; - Drop_FrameTooShort = 209; - Drop_FrameLengthError = 210; - Drop_CrcError = 211; - Drop_BadFrameChecksum = 212; - Drop_FcsError = 213; - Drop_SymbolError = 214; - Drop_HeadQTimeout = 215; - Drop_StalledDiscard = 216; - Drop_RxQFull = 217; - Drop_PhysLayerError = 218; - Drop_DmaError = 219; - Drop_FirmwareError = 220; - Drop_DecryptionFailed = 221; - Drop_BadSignature = 222; - Drop_CoalescingError = 223; - Drop_VlanSpoofing = 225; - Drop_UnallowedEtherType = 226; - Drop_VportDown = 227; - Drop_SteeringMismatch = 228; + Drop_Pause = 0x400000C9; + Drop_Reset = 0x400000CA; + Drop_SendAborted = 0x400000CB; + Drop_ProtocolNotBound = 0x400000CC; + Drop_Failure = 0x400000CD; + Drop_InvalidLength = 0x400000CE; + Drop_HostOutOfMemory = 0x400000CF; + Drop_FrameTooLong = 0x400000D0; + Drop_FrameTooShort = 0x400000D1; + Drop_FrameLengthError = 0x400000D2; + Drop_CrcError = 0x400000D3; + Drop_BadFrameChecksum = 0x400000D4; + Drop_FcsError = 0x400000D5; + Drop_SymbolError = 0x400000D6; + Drop_HeadQTimeout = 0x400000D7; + Drop_StalledDiscard = 0x400000D8; + Drop_RxQFull = 0x400000D9; + Drop_PhysLayerError = 0x400000DA; + Drop_DmaError = 0x400000DB; + Drop_FirmwareError = 0x400000DC; + Drop_DecryptionFailed = 0x400000DD; + Drop_BadSignature = 0x400000DE; + Drop_CoalescingError = 0x400000DF; + Drop_VlanSpoofing = 0x400000E1; + Drop_UnallowedEtherType = 0x400000E2; + Drop_VportDown = 0x400000E3; + Drop_SteeringMismatch = 0x400000E4; // // NetVsc errors // - Drop_MicroportError = 401; - Drop_VfNotReady = 402; - Drop_MicroportNotReady = 403; - Drop_VMBusError = 404; + Drop_MicroportError = 0x40000191; + Drop_VfNotReady = 0x40000192; + Drop_MicroportNotReady = 0x40000193; + Drop_VMBusError = 0x40000194; // // Tcpip FL errors // - Drop_FL_LoopbackPacket = 601; - Drop_FL_InvalidSnapHeader = 602; - Drop_FL_InvalidEthernetType = 603; - Drop_FL_InvalidPacketLength = 604; - Drop_FL_HeaderNotContiguous = 605; - Drop_FL_InvalidDestinationType = 606; - Drop_FL_InterfaceNotReady = 607; - Drop_FL_ProviderNotReady = 608; - Drop_FL_InvalidLsoInfo = 609; - Drop_FL_InvalidUsoInfo = 610; - Drop_FL_InvalidMedium = 611; - Drop_FL_InvalidArpHeader = 612; - Drop_FL_NoClientInterface = 613; - Drop_FL_TooManyNetBuffers = 614; - Drop_FL_FlsNpiClientDrop = 615; + Drop_FL_LoopbackPacket = 0x40000259; + Drop_FL_InvalidSnapHeader = 0x4000025A; + Drop_FL_InvalidEthernetType = 0x4000025B; + Drop_FL_InvalidPacketLength = 0x4000025C; + Drop_FL_HeaderNotContiguous = 0x4000025D; + Drop_FL_InvalidDestinationType = 0x4000025E; + Drop_FL_InterfaceNotReady = 0x4000025F; + Drop_FL_ProviderNotReady = 0x40000260; + Drop_FL_InvalidLsoInfo = 0x40000261; + Drop_FL_InvalidUsoInfo = 0x40000262; + Drop_FL_InvalidMedium = 0x40000263; + Drop_FL_InvalidArpHeader = 0x40000264; + Drop_FL_NoClientInterface = 0x40000265; + Drop_FL_TooManyNetBuffers = 0x40000266; + Drop_FL_FlsNpiClientDrop = 0x40000267; // // VFP errors // - Drop_ArpGuard = 701; - Drop_ArpLimiter = 702; - Drop_DhcpLimiter = 703; - Drop_BlockBroadcast = 704; - Drop_BlockNonIp = 705; - Drop_ArpFilter = 706; - Drop_Ipv4Guard = 707; - Drop_Ipv6Guard = 708; - Drop_MacGuard = 709; - Drop_BroadcastNoDestinations = 710; - Drop_UnicastNoDestination = 711; - Drop_UnicastPortNotReady = 712; - Drop_SwitchCallbackFailed = 713; - Drop_Icmpv6Limiter = 714; - Drop_Intercept = 715; - Drop_InterceptBlock = 716; - Drop_NDPGuard = 717; - Drop_PortBlocked = 718; - Drop_NicSuspended = 719; + Drop_ArpGuard = 0x400002BD; + Drop_ArpLimiter = 0x400002BE; + Drop_DhcpLimiter = 0x400002BF; + Drop_BlockBroadcast = 0x400002C0; + Drop_BlockNonIp = 0x400002C1; + Drop_ArpFilter = 0x400002C2; + Drop_Ipv4Guard = 0x400002C3; + Drop_Ipv6Guard = 0x400002C4; + Drop_MacGuard = 0x400002C5; + Drop_BroadcastNoDestinations = 0x400002C6; + Drop_UnicastNoDestination = 0x400002C7; + Drop_UnicastPortNotReady = 0x400002C8; + Drop_SwitchCallbackFailed = 0x400002C9; + Drop_Icmpv6Limiter = 0x400002CA; + Drop_Intercept = 0x400002CB; + Drop_InterceptBlock = 0x400002CC; + Drop_NDPGuard = 0x400002CD; + Drop_PortBlocked = 0x400002CE; + Drop_NicSuspended = 0x400002CF; // // Tcpip NL errors // - Drop_NL_BadSourceAddress = 901; - Drop_NL_NotLocallyDestined = 902; - Drop_NL_ProtocolUnreachable = 903; - Drop_NL_PortUnreachable = 904; - Drop_NL_BadLength = 905; - Drop_NL_MalformedHeader = 906; - Drop_NL_NoRoute = 907; - Drop_NL_BeyondScope = 908; - Drop_NL_InspectionDrop = 909; - Drop_NL_TooManyDecapsulations = 910; - Drop_NL_AdministrativelyProhibited = 911; - Drop_NL_BadChecksum = 912; - Drop_NL_ReceivePathMax = 913; - Drop_NL_HopLimitExceeded = 914; - Drop_NL_AddressUnreachable = 915; - Drop_NL_RscPacket = 916; - Drop_NL_ForwardPathMax = 917; - Drop_NL_ArbitrationUnhandled = 918; - Drop_NL_InspectionAbsorb = 919; - Drop_NL_DontFragmentMtuExceeded = 920; - Drop_NL_BufferLengthExceeded = 921; - Drop_NL_AddressResolutionTimeout = 922; - Drop_NL_AddressResolutionFailure = 923; - Drop_NL_IpsecFailure = 924; - Drop_NL_ExtensionHeadersFailure = 925; - Drop_NL_IpsnpiClientDrop = 926; - Drop_NL_UnsupportedOffload = 927; - Drop_NL_RoutingFailure = 928; - Drop_NL_AncillaryDataFailure = 929; - Drop_NL_RawDataFailure = 930; - Drop_NL_SessionStateFailure = 931; - Drop_NL_IpsnpiModifiedButNotForwarded = 932; - Drop_NL_IpsnpiNoNextHop = 933; - Drop_NL_IpsnpiNoCompartment = 934; - Drop_NL_IpsnpiNoInterface = 935; - Drop_NL_IpsnpiNoSubInterface = 936; - Drop_NL_IpsnpiInterfaceDisabled = 937; - Drop_NL_IpsnpiSegmentationFailed = 938; - Drop_NL_IpsnpiNoEthernetHeader = 939; - Drop_NL_IpsnpiUnexpectedFragment = 940; - Drop_NL_IpsnpiUnsupportedInterfaceType = 941; - Drop_NL_IpsnpiInvalidLsoInfo = 942; - Drop_NL_IpsnpiInvalidUsoInfo = 943; - Drop_NL_InternalError = 944; - Drop_NL_AdministrativelyConfigured = 945; - Drop_NL_BadOption = 946; - Drop_NL_LoopbackDisallowed = 947; - Drop_NL_SmallerScope = 948; - Drop_NL_QueueFull = 949; - Drop_NL_InterfaceDisabled = 950; - - Drop_NL_IcmpGeneric = 951; - Drop_NL_IcmpTruncatedHeader = 952; - Drop_NL_IcmpInvalidChecksum = 953; - Drop_NL_IcmpInspection = 954; - Drop_NL_IcmpNeighborDiscoveryLoopback = 955; - Drop_NL_IcmpUnknownType = 956; - Drop_NL_IcmpTruncatedIpHeader = 957; - Drop_NL_IcmpOversizedIpHeader = 958; - Drop_NL_IcmpNoHandler = 959; - Drop_NL_IcmpRespondingToError = 960; - Drop_NL_IcmpInvalidSource = 961; - Drop_NL_IcmpInterfaceRateLimit = 962; - Drop_NL_IcmpPathRateLimit = 963; - Drop_NL_IcmpNoRoute = 964; - Drop_NL_IcmpMatchingRequestNotFound = 965; - Drop_NL_IcmpBufferTooSmall = 966; - Drop_NL_IcmpAncillaryDataQuery = 967; - Drop_NL_IcmpIncorrectHopLimit = 968; - Drop_NL_IcmpUnknownCode = 969; - Drop_NL_IcmpSourceNotLinkLocal = 970; - Drop_NL_IcmpTruncatedNdHeader = 971; - Drop_NL_IcmpInvalidNdOptSourceLinkAddr = 972; - Drop_NL_IcmpInvalidNdOptMtu = 973; - Drop_NL_IcmpInvalidNdOptPrefixInformation = 974; - Drop_NL_IcmpInvalidNdOptRouteInformation = 975; - Drop_NL_IcmpInvalidNdOptRdnss = 976; - Drop_NL_IcmpInvalidNdOptDnssl = 977; - Drop_NL_IcmpPacketParsingFailure = 978; - Drop_NL_IcmpDisallowed = 979; - Drop_NL_IcmpInvalidRouterAdvertisement = 980; - Drop_NL_IcmpSourceFromDifferentLink = 981; - Drop_NL_IcmpInvalidRedirectDestinationOrTarget = 982; - Drop_NL_IcmpInvalidNdTarget = 983; - Drop_NL_IcmpNaMulticastAndSolicited = 984; - Drop_NL_IcmpNdLinkLayerAddressIsLocal = 985; - Drop_NL_IcmpDuplicateEchoRequest = 986; - Drop_NL_IcmpNotAPotentialRouter = 987; - Drop_NL_IcmpInvalidMldQuery = 988; - Drop_NL_IcmpInvalidMldReport = 989; - Drop_NL_IcmpLocallySourcedMldReport = 990; - Drop_NL_IcmpNotLocallyDestined = 991; - - Drop_NL_ArpInvalidSource = 992; - Drop_NL_ArpInvalidTarget = 993; - Drop_NL_ArpDlSourceIsLocal = 994; - Drop_NL_ArpNotLocallyDestined = 995; - - Drop_NL_NlClientDiscard = 996; - - Drop_NL_IpsnpiUroSegmentSizeExceedsMtu = 997; - - Drop_NL_IcmpFragmentedPacket = 998; - Drop_NL_FirstFragmentIncomplete = 999; - Drop_NL_SourceViolation = 1000; - Drop_NL_IcmpJumbogram = 1001; - Drop_NL_SwUsoFailure = 1002; + Drop_NL_BadSourceAddress = 0x40000385; + Drop_NL_NotLocallyDestined = 0x40000386; + Drop_NL_ProtocolUnreachable = 0x40000387; + Drop_NL_PortUnreachable = 0x40000388; + Drop_NL_BadLength = 0x40000389; + Drop_NL_MalformedHeader = 0x4000038A; + Drop_NL_NoRoute = 0x4000038B; + Drop_NL_BeyondScope = 0x4000038C; + Drop_NL_InspectionDrop = 0x4000038D; + Drop_NL_TooManyDecapsulations = 0x4000038E; + Drop_NL_AdministrativelyProhibited = 0x4000038F; + Drop_NL_BadChecksum = 0x40000390; + Drop_NL_ReceivePathMax = 0x40000391; + Drop_NL_HopLimitExceeded = 0x40000392; + Drop_NL_AddressUnreachable = 0x40000393; + Drop_NL_RscPacket = 0x40000394; + Drop_NL_ForwardPathMax = 0x40000395; + Drop_NL_ArbitrationUnhandled = 0x40000396; + Drop_NL_InspectionAbsorb = 0x40000397; + Drop_NL_DontFragmentMtuExceeded = 0x40000398; + Drop_NL_BufferLengthExceeded = 0x40000399; + Drop_NL_AddressResolutionTimeout = 0x4000039A; + Drop_NL_AddressResolutionFailure = 0x4000039B; + Drop_NL_IpsecFailure = 0x4000039C; + Drop_NL_ExtensionHeadersFailure = 0x4000039D; + Drop_NL_IpsnpiClientDrop = 0x4000039E; + Drop_NL_UnsupportedOffload = 0x4000039F; + Drop_NL_RoutingFailure = 0x400003A0; + Drop_NL_AncillaryDataFailure = 0x400003A1; + Drop_NL_RawDataFailure = 0x400003A2; + Drop_NL_SessionStateFailure = 0x400003A3; + Drop_NL_IpsnpiModifiedButNotForwarded = 0x400003A4; + Drop_NL_IpsnpiNoNextHop = 0x400003A5; + Drop_NL_IpsnpiNoCompartment = 0x400003A6; + Drop_NL_IpsnpiNoInterface = 0x400003A7; + Drop_NL_IpsnpiNoSubInterface = 0x400003A8; + Drop_NL_IpsnpiInterfaceDisabled = 0x400003A9; + Drop_NL_IpsnpiSegmentationFailed = 0x400003AA; + Drop_NL_IpsnpiNoEthernetHeader = 0x400003AB; + Drop_NL_IpsnpiUnexpectedFragment = 0x400003AC; + Drop_NL_IpsnpiUnsupportedInterfaceType = 0x400003AD; + Drop_NL_IpsnpiInvalidLsoInfo = 0x400003AE; + Drop_NL_IpsnpiInvalidUsoInfo = 0x400003AF; + Drop_NL_InternalError = 0x400003B0; + Drop_NL_AdministrativelyConfigured = 0x400003B1; + Drop_NL_BadOption = 0x400003B2; + Drop_NL_LoopbackDisallowed = 0x400003B3; + Drop_NL_SmallerScope = 0x400003B4; + Drop_NL_QueueFull = 0x400003B5; + Drop_NL_InterfaceDisabled = 0x400003B6; + + Drop_NL_IcmpGeneric = 0x400003B7; + Drop_NL_IcmpTruncatedHeader = 0x400003B8; + Drop_NL_IcmpInvalidChecksum = 0x400003B9; + Drop_NL_IcmpInspection = 0x400003BA; + Drop_NL_IcmpNeighborDiscoveryLoopback = 0x400003BB; + Drop_NL_IcmpUnknownType = 0x400003BC; + Drop_NL_IcmpTruncatedIpHeader = 0x400003BD; + Drop_NL_IcmpOversizedIpHeader = 0x400003BE; + Drop_NL_IcmpNoHandler = 0x400003BF; + Drop_NL_IcmpRespondingToError = 0x400003C0; + Drop_NL_IcmpInvalidSource = 0x400003C1; + Drop_NL_IcmpInterfaceRateLimit = 0x400003C2; + Drop_NL_IcmpPathRateLimit = 0x400003C3; + Drop_NL_IcmpNoRoute = 0x400003C4; + Drop_NL_IcmpMatchingRequestNotFound = 0x400003C5; + Drop_NL_IcmpBufferTooSmall = 0x400003C6; + Drop_NL_IcmpAncillaryDataQuery = 0x400003C7; + Drop_NL_IcmpIncorrectHopLimit = 0x400003C8; + Drop_NL_IcmpUnknownCode = 0x400003C9; + Drop_NL_IcmpSourceNotLinkLocal = 0x400003CA; + Drop_NL_IcmpTruncatedNdHeader = 0x400003CB; + Drop_NL_IcmpInvalidNdOptSourceLinkAddr = 0x400003CC; + Drop_NL_IcmpInvalidNdOptMtu = 0x400003CD; + Drop_NL_IcmpInvalidNdOptPrefixInformation = 0x400003CE; + Drop_NL_IcmpInvalidNdOptRouteInformation = 0x400003CF; + Drop_NL_IcmpInvalidNdOptRdnss = 0x400003D0; + Drop_NL_IcmpInvalidNdOptDnssl = 0x400003D1; + Drop_NL_IcmpPacketParsingFailure = 0x400003D2; + Drop_NL_IcmpDisallowed = 0x400003D3; + Drop_NL_IcmpInvalidRouterAdvertisement = 0x400003D4; + Drop_NL_IcmpSourceFromDifferentLink = 0x400003D5; + Drop_NL_IcmpInvalidRedirectDestinationOrTarget = 0x400003D6; + Drop_NL_IcmpInvalidNdTarget = 0x400003D7; + Drop_NL_IcmpNaMulticastAndSolicited = 0x400003D8; + Drop_NL_IcmpNdLinkLayerAddressIsLocal = 0x400003D9; + Drop_NL_IcmpDuplicateEchoRequest = 0x400003DA; + Drop_NL_IcmpNotAPotentialRouter = 0x400003DB; + Drop_NL_IcmpInvalidMldQuery = 0x400003DC; + Drop_NL_IcmpInvalidMldReport = 0x400003DD; + Drop_NL_IcmpLocallySourcedMldReport = 0x400003DE; + Drop_NL_IcmpNotLocallyDestined = 0x400003DF; + + Drop_NL_ArpInvalidSource = 0x400003E0; + Drop_NL_ArpInvalidTarget = 0x400003E1; + Drop_NL_ArpDlSourceIsLocal = 0x400003E2; + Drop_NL_ArpNotLocallyDestined = 0x400003E3; + + Drop_NL_NlClientDiscard = 0x400003E4; + + Drop_NL_IpsnpiUroSegmentSizeExceedsMtu = 0x400003E5; + + Drop_NL_IcmpFragmentedPacket = 0x400003E6; + Drop_NL_FirstFragmentIncomplete = 0x400003E7; + Drop_NL_SourceViolation = 0x400003E8; + Drop_NL_IcmpJumbogram = 0x400003E9; + Drop_NL_SwUsoFailure = 0x400003EA; // // INET discard reasons // - Drop_INET_SourceUnspecified = 1200; - Drop_INET_DestinationMulticast = 1201; - Drop_INET_HeaderInvalid = 1202; - Drop_INET_ChecksumInvalid = 1203; - Drop_INET_EndpointNotFound = 1204; - Drop_INET_ConnectedPath = 1205; - Drop_INET_SessionState = 1206; - Drop_INET_ReceiveInspection = 1207; - Drop_INET_AckInvalid = 1208; - Drop_INET_ExpectedSyn = 1209; - Drop_INET_Rst = 1210; - Drop_INET_SynRcvdSyn = 1211; - Drop_INET_SimultaneousConnect = 1212; - Drop_INET_PawsFailed = 1213; - Drop_INET_LandAttack = 1214; - Drop_INET_MissedReset = 1215; - Drop_INET_OutsideWindow = 1216; - Drop_INET_DuplicateSegment = 1217; - Drop_INET_ClosedWindow = 1218; - Drop_INET_TcbRemoved = 1219; - Drop_INET_FinWait2 = 1220; - Drop_INET_ReassemblyConflict = 1221; - Drop_INET_FinReceived = 1222; - Drop_INET_ListenerInvalidFlags = 1223; - Drop_INET_TcbNotInTcbTable = 1224; - Drop_INET_TimeWaitTcbReceivedRstOutsideWindow = 1225; - Drop_INET_TimeWaitTcbSynAndOtherFlags = 1226; - Drop_INET_TimeWaitTcb = 1227; - Drop_INET_SynAckWithFastopenCookieRequest = 1228; - Drop_INET_PauseAccept = 1229; - Drop_INET_SynAttack = 1230; - Drop_INET_AcceptInspection = 1231; - Drop_INET_AcceptRedirection = 1232; + Drop_INET_SourceUnspecified = 0x400004B0; + Drop_INET_DestinationMulticast = 0x400004B1; + Drop_INET_HeaderInvalid = 0x400004B2; + Drop_INET_ChecksumInvalid = 0x400004B3; + Drop_INET_EndpointNotFound = 0x400004B4; + Drop_INET_ConnectedPath = 0x400004B5; + Drop_INET_SessionState = 0x400004B6; + Drop_INET_ReceiveInspection = 0x400004B7; + Drop_INET_AckInvalid = 0x400004B8; + Drop_INET_ExpectedSyn = 0x400004B9; + Drop_INET_Rst = 0x400004BA; + Drop_INET_SynRcvdSyn = 0x400004BB; + Drop_INET_SimultaneousConnect = 0x400004BC; + Drop_INET_PawsFailed = 0x400004BD; + Drop_INET_LandAttack = 0x400004BE; + Drop_INET_MissedReset = 0x400004BF; + Drop_INET_OutsideWindow = 0x400004C0; + Drop_INET_DuplicateSegment = 0x400004C1; + Drop_INET_ClosedWindow = 0x400004C2; + Drop_INET_TcbRemoved = 0x400004C3; + Drop_INET_FinWait2 = 0x400004C4; + Drop_INET_ReassemblyConflict = 0x400004C5; + Drop_INET_FinReceived = 0x400004C6; + Drop_INET_ListenerInvalidFlags = 0x400004C7; + Drop_INET_TcbNotInTcbTable = 0x400004C8; + Drop_INET_TimeWaitTcbReceivedRstOutsideWindow = 0x400004C9; + Drop_INET_TimeWaitTcbSynAndOtherFlags = 0x400004CA; + Drop_INET_TimeWaitTcb = 0x400004CB; + Drop_INET_SynAckWithFastopenCookieRequest = 0x400004CC; + Drop_INET_PauseAccept = 0x400004CD; + Drop_INET_SynAttack = 0x400004CE; + Drop_INET_AcceptInspection = 0x400004CF; + Drop_INET_AcceptRedirection = 0x400004D0; // // Slbmux Error // - Drop_SlbMux_ParsingFailure = 1301; - Drop_SlbMux_FirstFragmentMiss = 1302; - Drop_SlbMux_ICMPErrorPayloadValidationFailure = 1303; - Drop_SlbMux_ICMPErrorPacketMatchNoSession = 1304; - Drop_SlbMux_ExternalHairpinNexthopLookupFailure = 1305; - Drop_SlbMux_NoMatchingStaticMapping = 1306; - Drop_SlbMux_NexthopReferenceFailure = 1307; - Drop_SlbMux_CloningFailure = 1308; - Drop_SlbMux_TranslationFailure = 1309; - Drop_SlbMux_HopLimitExceeded = 1310; - Drop_SlbMux_PacketBiggerThanMTU = 1311; - Drop_SlbMux_UnexpectedRouteLookupFailure = 1312; - Drop_SlbMux_NoRoute = 1313; - Drop_SlbMux_SessionCreationFailure = 1314; - Drop_SlbMux_NexthopNotOverExternalInterface = 1315; - Drop_SlbMux_NexthopExternalInterfaceMissNATInstance = 1316; - Drop_SlbMux_NATItselfCantBeInternalNexthop = 1317; - Drop_SlbMux_PacketRoutableInItsArrivalCompartment = 1318; - Drop_SlbMux_PacketTransportProtocolNotSupported = 1319; - Drop_SlbMux_PacketIsDestinedLocally = 1320; - Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT = 1321; - Drop_SlbMux_MuxReject = 1322; - Drop_SlbMux_DipLookupFailure = 1323; - Drop_SlbMux_MuxEncapsulationFailure = 1324; - Drop_SlbMux_InvalidDiagPacketEncapType = 1325; - Drop_SlbMux_DiagPacketIsRedirect = 1326; - Drop_SlbMux_UnableToHandleRedirect = 1327; + Drop_SlbMux_ParsingFailure = 0x40000515; + Drop_SlbMux_FirstFragmentMiss = 0x40000516; + Drop_SlbMux_ICMPErrorPayloadValidationFailure = 0x40000517; + Drop_SlbMux_ICMPErrorPacketMatchNoSession = 0x40000518; + Drop_SlbMux_ExternalHairpinNexthopLookupFailure = 0x40000519; + Drop_SlbMux_NoMatchingStaticMapping = 0x4000051A; + Drop_SlbMux_NexthopReferenceFailure = 0x4000051B; + Drop_SlbMux_CloningFailure = 0x4000051C; + Drop_SlbMux_TranslationFailure = 0x4000051D; + Drop_SlbMux_HopLimitExceeded = 0x4000051E; + Drop_SlbMux_PacketBiggerThanMTU = 0x4000051F; + Drop_SlbMux_UnexpectedRouteLookupFailure = 0x40000520; + Drop_SlbMux_NoRoute = 0x40000521; + Drop_SlbMux_SessionCreationFailure = 0x40000522; + Drop_SlbMux_NexthopNotOverExternalInterface = 0x40000523; + Drop_SlbMux_NexthopExternalInterfaceMissNATInstance = 0x40000524; + Drop_SlbMux_NATItselfCantBeInternalNexthop = 0x40000525; + Drop_SlbMux_PacketRoutableInItsArrivalCompartment = 0x40000526; + Drop_SlbMux_PacketTransportProtocolNotSupported = 0x40000527; + Drop_SlbMux_PacketIsDestinedLocally = 0x40000528; + Drop_SlbMux_PacketDestinationIPandPortNotSubjectToNAT = 0x40000529; + Drop_SlbMux_MuxReject = 0x4000052A; + Drop_SlbMux_DipLookupFailure = 0x4000052B; + Drop_SlbMux_MuxEncapsulationFailure = 0x4000052C; + Drop_SlbMux_InvalidDiagPacketEncapType = 0x4000052D; + Drop_SlbMux_DiagPacketIsRedirect = 0x4000052E; + Drop_SlbMux_UnableToHandleRedirect = 0x4000052F; // // Ipsec Errors // - Drop_Ipsec_BadSpi = 1401; - Drop_Ipsec_SALifetimeExpired = 1402; - Drop_Ipsec_WrongSA = 1403; - Drop_Ipsec_ReplayCheckFailed = 1404; - Drop_Ipsec_InvalidPacket = 1405; - Drop_Ipsec_IntegrityCheckFailed = 1406; - Drop_Ipsec_ClearTextDrop = 1407; - Drop_Ipsec_AuthFirewallDrop = 1408; - Drop_Ipsec_ThrottleDrop = 1409; - Drop_Ipsec_Dosp_Block = 1410; - Drop_Ipsec_Dosp_ReceivedMulticast = 1411; - Drop_Ipsec_Dosp_InvalidPacket = 1412; - Drop_Ipsec_Dosp_StateLookupFailed = 1413; - Drop_Ipsec_Dosp_MaxEntries = 1414; - Drop_Ipsec_Dosp_KeymodNotAllowed = 1415; - Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues = 1416; - Drop_Ipsec_NoMemory = 1417; - Drop_Ipsec_Unsuccessful = 1418; + Drop_Ipsec_BadSpi = 0x40000579; + Drop_Ipsec_SALifetimeExpired = 0x4000057A; + Drop_Ipsec_WrongSA = 0x4000057B; + Drop_Ipsec_ReplayCheckFailed = 0x4000057C; + Drop_Ipsec_InvalidPacket = 0x4000057D; + Drop_Ipsec_IntegrityCheckFailed = 0x4000057E; + Drop_Ipsec_ClearTextDrop = 0x4000057F; + Drop_Ipsec_AuthFirewallDrop = 0x40000580; + Drop_Ipsec_ThrottleDrop = 0x40000581; + Drop_Ipsec_Dosp_Block = 0x40000582; + Drop_Ipsec_Dosp_ReceivedMulticast = 0x40000583; + Drop_Ipsec_Dosp_InvalidPacket = 0x40000584; + Drop_Ipsec_Dosp_StateLookupFailed = 0x40000585; + Drop_Ipsec_Dosp_MaxEntries = 0x40000586; + Drop_Ipsec_Dosp_KeymodNotAllowed = 0x40000587; + Drop_Ipsec_Dosp_MaxPerIpRateLimitQueues = 0x40000588; + Drop_Ipsec_NoMemory = 0x40000589; + Drop_Ipsec_Unsuccessful = 0x4000058A; // // NetCx Drop Reasons // - Drop_NetCx_NetPacketLayoutParseFailure = 1501; - Drop_NetCx_SoftwareChecksumFailure = 1502; - Drop_NetCx_NicQueueStop = 1503; - Drop_NetCx_InvalidNetBufferLength = 1504; - Drop_NetCx_LSOFailure = 1505; - Drop_NetCx_USOFailure = 1506; - Drop_NetCx_BufferBounceFailureAndPacketIgnore = 1507; + Drop_NetCx_NetPacketLayoutParseFailure = 0x400005DD; + Drop_NetCx_SoftwareChecksumFailure = 0x400005DE; + Drop_NetCx_NicQueueStop = 0x400005DF; + Drop_NetCx_InvalidNetBufferLength = 0x400005E0; + Drop_NetCx_LSOFailure = 0x400005E1; + Drop_NetCx_USOFailure = 0x400005E2; + Drop_NetCx_BufferBounceFailureAndPacketIgnore = 0x400005E3; // // Http errors 3000 - 4000. // These must be in sync with cmd\resource.h // - Drop_Http_Begin = 3000; + Drop_Http_Begin = 0x40000BB8; // // UlErrors // - Drop_Http_UlError_Begin = 3001; - Drop_Http_UlError = 3002; - Drop_Http_UlErrorVerb = 3003; - Drop_Http_UlErrorUrl = 3004; - Drop_Http_UlErrorHeader = 3005; - Drop_Http_UlErrorHost = 3006; - Drop_Http_UlErrorNum = 3007; - Drop_Http_UlErrorFieldLength = 3008; - Drop_Http_UlErrorRequestLength = 3009; - Drop_Http_UlErrorUnauthorized = 3010; - - Drop_Http_UlErrorForbiddenUrl = 3011; - Drop_Http_UlErrorNotFound = 3012; - Drop_Http_UlErrorContentLength = 3013; - Drop_Http_UlErrorPreconditionFailed = 3014; - Drop_Http_UlErrorEntityTooLarge = 3015; - Drop_Http_UlErrorUrlLength = 3016; - Drop_Http_UlErrorRangeNotSatisfiable = 3017; - Drop_Http_UlErrorMisdirectedRequest = 3018; - - Drop_Http_UlErrorInternalServer = 3019; - Drop_Http_UlErrorNotImplemented = 3020; - Drop_Http_UlErrorUnavailable = 3021; - Drop_Http_UlErrorConnectionLimit = 3022; - Drop_Http_UlErrorRapidFailProtection = 3023; - Drop_Http_UlErrorRequestQueueFull = 3024; - Drop_Http_UlErrorDisabledByAdmin = 3025; - Drop_Http_UlErrorDisabledByApp = 3026; - Drop_Http_UlErrorJobObjectFired = 3027; - Drop_Http_UlErrorAppPoolBusy = 3028; - - Drop_Http_UlErrorVersion = 3029; - Drop_Http_UlError_End = 3030; + Drop_Http_UlError_Begin = 0x40000BB9; + Drop_Http_UlError = 0x40000BBA; + Drop_Http_UlErrorVerb = 0x40000BBB; + Drop_Http_UlErrorUrl = 0x40000BBC; + Drop_Http_UlErrorHeader = 0x40000BBD; + Drop_Http_UlErrorHost = 0x40000BBE; + Drop_Http_UlErrorNum = 0x40000BBF; + Drop_Http_UlErrorFieldLength = 0x40000BC0; + Drop_Http_UlErrorRequestLength = 0x40000BC1; + Drop_Http_UlErrorUnauthorized = 0x40000BC2; + + Drop_Http_UlErrorForbiddenUrl = 0x40000BC3; + Drop_Http_UlErrorNotFound = 0x40000BC4; + Drop_Http_UlErrorContentLength = 0x40000BC5; + Drop_Http_UlErrorPreconditionFailed = 0x40000BC6; + Drop_Http_UlErrorEntityTooLarge = 0x40000BC7; + Drop_Http_UlErrorUrlLength = 0x40000BC8; + Drop_Http_UlErrorRangeNotSatisfiable = 0x40000BC9; + Drop_Http_UlErrorMisdirectedRequest = 0x40000BCA; + + Drop_Http_UlErrorInternalServer = 0x40000BCB; + Drop_Http_UlErrorNotImplemented = 0x40000BCC; + Drop_Http_UlErrorUnavailable = 0x40000BCD; + Drop_Http_UlErrorConnectionLimit = 0x40000BCE; + Drop_Http_UlErrorRapidFailProtection = 0x40000BCF; + Drop_Http_UlErrorRequestQueueFull = 0x40000BD0; + Drop_Http_UlErrorDisabledByAdmin = 0x40000BD1; + Drop_Http_UlErrorDisabledByApp = 0x40000BD2; + Drop_Http_UlErrorJobObjectFired = 0x40000BD3; + Drop_Http_UlErrorAppPoolBusy = 0x40000BD4; + + Drop_Http_UlErrorVersion = 0x40000BD5; + Drop_Http_UlError_End = 0x40000BD6; // // Stream-specific fault codes. // - Drop_Http_UxDuoFaultBegin = 3400; - Drop_Http_UxDuoFaultUserAbort = 3401; - Drop_Http_UxDuoFaultCollection = 3402; - Drop_Http_UxDuoFaultClientResetStream = 3403; - Drop_Http_UxDuoFaultMethodNotFound = 3404; - Drop_Http_UxDuoFaultSchemeMismatch = 3405; - Drop_Http_UxDuoFaultSchemeNotFound = 3406; - Drop_Http_UxDuoFaultDataAfterEnd = 3407; - Drop_Http_UxDuoFaultPathNotFound = 3408; - Drop_Http_UxDuoFaultHalfClosedLocal = 3409; - Drop_Http_UxDuoFaultIncompatibleAuth = 3410; - Drop_Http_UxDuoFaultDeprecated3 = 3411; - Drop_Http_UxDuoFaultClientCertBlocked = 3412; - Drop_Http_UxDuoFaultHeaderNameEmpty = 3413; - Drop_Http_UxDuoFaultIllegalSend = 3414; - Drop_Http_UxDuoFaultPushUpperAttach = 3415; - Drop_Http_UxDuoFaultStreamUpperAttach = 3416; - Drop_Http_UxDuoFaultActiveStreamLimit = 3417; - Drop_Http_UxDuoFaultAuthorityNotFound = 3418; - Drop_Http_UxDuoFaultUnexpectedTail = 3419; - Drop_Http_UxDuoFaultTruncated = 3420; - Drop_Http_UxDuoFaultResponseHold = 3421; - Drop_Http_UxDuoFaultRequestChunked = 3422; - Drop_Http_UxDuoFaultRequestContentLength = 3423; - Drop_Http_UxDuoFaultResponseChunked = 3424; - Drop_Http_UxDuoFaultResponseContentLength = 3425; - Drop_Http_UxDuoFaultResponseTransferEncoding = 3426; - Drop_Http_UxDuoFaultResponseLine = 3427; - Drop_Http_UxDuoFaultResponseHeader = 3428; - Drop_Http_UxDuoFaultConnect = 3429; - Drop_Http_UxDuoFaultChunkStart = 3430; - Drop_Http_UxDuoFaultChunkLength = 3431; - Drop_Http_UxDuoFaultChunkStop = 3432; - Drop_Http_UxDuoFaultHeadersAfterTrailers = 3433; - Drop_Http_UxDuoFaultHeadersAfterEnd = 3434; - Drop_Http_UxDuoFaultEndlessTrailer = 3435; - Drop_Http_UxDuoFaultTransferEncoding = 3436; - Drop_Http_UxDuoFaultMultipleTransferCodings = 3437; - Drop_Http_UxDuoFaultPushBody = 3438; - Drop_Http_UxDuoFaultStreamAbandoned = 3439; - Drop_Http_UxDuoFaultMalformedHost = 3440; - Drop_Http_UxDuoFaultDecompressionOverflow = 3441; - Drop_Http_UxDuoFaultIllegalHeaderName = 3442; - Drop_Http_UxDuoFaultIllegalHeaderValue = 3443; - Drop_Http_UxDuoFaultConnHeaderDisallowed = 3444; - Drop_Http_UxDuoFaultConnHeaderMalformed = 3445; - Drop_Http_UxDuoFaultCookieReassembly = 3446; - Drop_Http_UxDuoFaultStatusHeader = 3447; - Drop_Http_UxDuoFaultSchemeDisallowed = 3448; - Drop_Http_UxDuoFaultPathDisallowed = 3449; - Drop_Http_UxDuoFaultPushHost = 3450; - Drop_Http_UxDuoFaultGoawayReceived = 3451; - Drop_Http_UxDuoFaultAbortLegacyApp = 3452; - Drop_Http_UxDuoFaultUpgradeHeaderDisallowed = 3453; - Drop_Http_UxDuoFaultResponseUpgradeHeader = 3454; - Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed = 3455; - Drop_Http_UxDuoFaultResponseKeepAliveHeader = 3456; - Drop_Http_UxDuoFaultProxyConnHeaderDisallowed = 3457; - Drop_Http_UxDuoFaultResponseProxyConnHeader = 3458; - Drop_Http_UxDuoFaultConnectionGoingAway = 3459; - Drop_Http_UxDuoFaultTransferEncodingDisallowed = 3460; - Drop_Http_UxDuoFaultContentLengthDisallowed = 3461; - Drop_Http_UxDuoFaultTrailerDisallowed = 3462; - Drop_Http_UxDuoFaultEnd = 3463; + Drop_Http_UxDuoFaultBegin = 0x40000D48; + Drop_Http_UxDuoFaultUserAbort = 0x40000D49; + Drop_Http_UxDuoFaultCollection = 0x40000D4A; + Drop_Http_UxDuoFaultClientResetStream = 0x40000D4B; + Drop_Http_UxDuoFaultMethodNotFound = 0x40000D4C; + Drop_Http_UxDuoFaultSchemeMismatch = 0x40000D4D; + Drop_Http_UxDuoFaultSchemeNotFound = 0x40000D4E; + Drop_Http_UxDuoFaultDataAfterEnd = 0x40000D4F; + Drop_Http_UxDuoFaultPathNotFound = 0x40000D50; + Drop_Http_UxDuoFaultHalfClosedLocal = 0x40000D51; + Drop_Http_UxDuoFaultIncompatibleAuth = 0x40000D52; + Drop_Http_UxDuoFaultDeprecated3 = 0x40000D53; + Drop_Http_UxDuoFaultClientCertBlocked = 0x40000D54; + Drop_Http_UxDuoFaultHeaderNameEmpty = 0x40000D55; + Drop_Http_UxDuoFaultIllegalSend = 0x40000D56; + Drop_Http_UxDuoFaultPushUpperAttach = 0x40000D57; + Drop_Http_UxDuoFaultStreamUpperAttach = 0x40000D58; + Drop_Http_UxDuoFaultActiveStreamLimit = 0x40000D59; + Drop_Http_UxDuoFaultAuthorityNotFound = 0x40000D5A; + Drop_Http_UxDuoFaultUnexpectedTail = 0x40000D5B; + Drop_Http_UxDuoFaultTruncated = 0x40000D5C; + Drop_Http_UxDuoFaultResponseHold = 0x40000D5D; + Drop_Http_UxDuoFaultRequestChunked = 0x40000D5E; + Drop_Http_UxDuoFaultRequestContentLength = 0x40000D5F; + Drop_Http_UxDuoFaultResponseChunked = 0x40000D60; + Drop_Http_UxDuoFaultResponseContentLength = 0x40000D61; + Drop_Http_UxDuoFaultResponseTransferEncoding = 0x40000D62; + Drop_Http_UxDuoFaultResponseLine = 0x40000D63; + Drop_Http_UxDuoFaultResponseHeader = 0x40000D64; + Drop_Http_UxDuoFaultConnect = 0x40000D65; + Drop_Http_UxDuoFaultChunkStart = 0x40000D66; + Drop_Http_UxDuoFaultChunkLength = 0x40000D67; + Drop_Http_UxDuoFaultChunkStop = 0x40000D68; + Drop_Http_UxDuoFaultHeadersAfterTrailers = 0x40000D69; + Drop_Http_UxDuoFaultHeadersAfterEnd = 0x40000D6A; + Drop_Http_UxDuoFaultEndlessTrailer = 0x40000D6B; + Drop_Http_UxDuoFaultTransferEncoding = 0x40000D6C; + Drop_Http_UxDuoFaultMultipleTransferCodings = 0x40000D6D; + Drop_Http_UxDuoFaultPushBody = 0x40000D6E; + Drop_Http_UxDuoFaultStreamAbandoned = 0x40000D6F; + Drop_Http_UxDuoFaultMalformedHost = 0x40000D70; + Drop_Http_UxDuoFaultDecompressionOverflow = 0x40000D71; + Drop_Http_UxDuoFaultIllegalHeaderName = 0x40000D72; + Drop_Http_UxDuoFaultIllegalHeaderValue = 0x40000D73; + Drop_Http_UxDuoFaultConnHeaderDisallowed = 0x40000D74; + Drop_Http_UxDuoFaultConnHeaderMalformed = 0x40000D75; + Drop_Http_UxDuoFaultCookieReassembly = 0x40000D76; + Drop_Http_UxDuoFaultStatusHeader = 0x40000D77; + Drop_Http_UxDuoFaultSchemeDisallowed = 0x40000D78; + Drop_Http_UxDuoFaultPathDisallowed = 0x40000D79; + Drop_Http_UxDuoFaultPushHost = 0x40000D7A; + Drop_Http_UxDuoFaultGoawayReceived = 0x40000D7B; + Drop_Http_UxDuoFaultAbortLegacyApp = 0x40000D7C; + Drop_Http_UxDuoFaultUpgradeHeaderDisallowed = 0x40000D7D; + Drop_Http_UxDuoFaultResponseUpgradeHeader = 0x40000D7E; + Drop_Http_UxDuoFaultKeepAliveHeaderDisallowed = 0x40000D7F; + Drop_Http_UxDuoFaultResponseKeepAliveHeader = 0x40000D80; + Drop_Http_UxDuoFaultProxyConnHeaderDisallowed = 0x40000D81; + Drop_Http_UxDuoFaultResponseProxyConnHeader = 0x40000D82; + Drop_Http_UxDuoFaultConnectionGoingAway = 0x40000D83; + Drop_Http_UxDuoFaultTransferEncodingDisallowed = 0x40000D84; + Drop_Http_UxDuoFaultContentLengthDisallowed = 0x40000D85; + Drop_Http_UxDuoFaultTrailerDisallowed = 0x40000D86; + Drop_Http_UxDuoFaultEnd = 0x40000D87; // // WSK layer drops // - Drop_Http_ReceiveSuppressed = 3600; + Drop_Http_ReceiveSuppressed = 0x40000E10; // // Http/SSL layer drops // - Drop_Http_Generic = 3800; - Drop_Http_InvalidParameter = 3801; - Drop_Http_InsufficientResources = 3802; - Drop_Http_InvalidHandle = 3803; - Drop_Http_NotSupported = 3804; - Drop_Http_BadNetworkPath = 3805; - Drop_Http_InternalError = 3806; - Drop_Http_NoSuchPackage = 3807; - Drop_Http_PrivilegeNotHeld = 3808; - Drop_Http_CannotImpersonate = 3809; - Drop_Http_LogonFailure = 3810; - Drop_Http_NoSuchLogonSession = 3811; - Drop_Http_AccessDenied = 3812; - Drop_Http_NoLogonServers = 3813; - Drop_Http_TimeDifferenceAtDc = 3814; - - Drop_Http_End = 4000; + Drop_Http_Generic = 0x40000ED8; + Drop_Http_InvalidParameter = 0x40000ED9; + Drop_Http_InsufficientResources = 0x40000EDA; + Drop_Http_InvalidHandle = 0x40000EDB; + Drop_Http_NotSupported = 0x40000EDC; + Drop_Http_BadNetworkPath = 0x40000EDD; + Drop_Http_InternalError = 0x40000EDE; + Drop_Http_NoSuchPackage = 0x40000EDF; + Drop_Http_PrivilegeNotHeld = 0x40000EE0; + Drop_Http_CannotImpersonate = 0x40000EE1; + Drop_Http_LogonFailure = 0x40000EE2; + Drop_Http_NoSuchLogonSession = 0x40000EE3; + Drop_Http_AccessDenied = 0x40000EE4; + Drop_Http_NoLogonServers = 0x40000EE5; + Drop_Http_TimeDifferenceAtDc = 0x40000EE6; + + Drop_Http_End = 0x40000FA0; } diff --git a/test/e2e/framework/kubernetes/apply-yaml-config.go b/test/e2e/framework/kubernetes/apply-yaml-config.go new file mode 100644 index 0000000000..ee98cd2b99 --- /dev/null +++ b/test/e2e/framework/kubernetes/apply-yaml-config.go @@ -0,0 +1,107 @@ +package kubernetes + +import ( + "bytes" + "context" + "fmt" + "log" + "os" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/util/yaml" + "k8s.io/client-go/discovery" + "k8s.io/client-go/dynamic" + "k8s.io/client-go/restmapper" + "k8s.io/client-go/tools/clientcmd" +) + +const ( + applyTimeout = 10 * time.Minute +) + +type ApplyYamlConfig struct { + KubeConfigFilePath string + YamlFilePath string +} + +func (a *ApplyYamlConfig) Run() error { + ctx, cancel := context.WithTimeout(context.Background(), applyTimeout) + defer cancel() + + config, err := clientcmd.BuildConfigFromFlags("", a.KubeConfigFilePath) + if err != nil { + return fmt.Errorf("error building kubeconfig: %w", err) + } + + dynamicClient, err := dynamic.NewForConfig(config) + if err != nil { + return fmt.Errorf("error creating dynamic client: %w", err) + } + + discoveryClient, err := discovery.NewDiscoveryClientForConfig(config) + if err != nil { + return fmt.Errorf("error creating discovery client: %w", err) + } + + resources, err := restmapper.GetAPIGroupResources(discoveryClient) + if err != nil { + return fmt.Errorf("error getting API group resources: %w", err) + } + + mapper := restmapper.NewDiscoveryRESTMapper(resources) + + yamlFile, err := os.ReadFile(a.YamlFilePath) + if err != nil { + return fmt.Errorf("error reading YAML file: %w", err) + } + + reader := bytes.NewReader(yamlFile) + decoder := yaml.NewYAMLOrJSONDecoder(reader, 100) + var rawObj unstructured.Unstructured + if err := decoder.Decode(&rawObj); err != nil { + return fmt.Errorf("error decoding YAML file: %w", err) + } + + // Get GroupVersionResource to invoke the dynamic client + gvk := rawObj.GroupVersionKind() + restMapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version) + if err != nil { + return fmt.Errorf("error getting REST mapping: %w", err) + } + gvr := restMapping.Resource + + // Apply the YAML document + namespace := rawObj.GetNamespace() + if len(namespace) == 0 { + namespace = "default" + } + applyOpts := metav1.ApplyOptions{FieldManager: "kube-apply"} + _, err = dynamicClient.Resource(gvr).Namespace(namespace).Apply(ctx, rawObj.GetName(), &rawObj, applyOpts) + if err != nil { + return fmt.Errorf("apply error: %w", err) + } + + log.Printf("applied YAML file: %s\n", a.YamlFilePath) + return nil +} + +func (a *ApplyYamlConfig) Prevalidate() error { + _, err := os.Stat(a.YamlFilePath) + if os.IsNotExist(err) { + cwd, err := os.Getwd() + if err != nil { + return fmt.Errorf("failed to get current working directory %s: %w", cwd, err) + } + log.Printf("the current working directory %s", cwd) + return fmt.Errorf("YAML file not found at %s: working directory: %s: %w", a.YamlFilePath, cwd, err) + } + log.Printf("found YAML file at %s", a.YamlFilePath) + + return nil +} + +func (a *ApplyYamlConfig) Stop() error { + return nil +} diff --git a/test/e2e/framework/kubernetes/load-winbpf.go b/test/e2e/framework/kubernetes/load-winbpf.go new file mode 100644 index 0000000000..2cd718b21a --- /dev/null +++ b/test/e2e/framework/kubernetes/load-winbpf.go @@ -0,0 +1,125 @@ +package kubernetes + +import ( + "context" + "fmt" + "strings" + "time" + + retry "github.com/microsoft/retina/test/retry" + v1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "k8s.io/client-go/kubernetes" + "k8s.io/client-go/tools/clientcmd" +) + +type LoadAndPinWinBPF struct { + KubeConfigFilePath string + LoadAndPinWinBPFDeamonSetNamespace string + LoadAndPinWinBPFDeamonSetName string +} + +func WaitForPodReadyWithTimeOut(ctx context.Context, kubeConfigFilePath, namespace, labelSelector string, timeout time.Duration) error { + + config, _ := clientcmd.BuildConfigFromFlags("", kubeConfigFilePath) + clientset, _ := kubernetes.NewForConfig(config) + + timeoutCtx, cancelFunc := context.WithTimeout(ctx, timeout) + defer cancelFunc() + + return WaitForPodReady(timeoutCtx, clientset, namespace, labelSelector) +} + +func ExecCommandInWinPod(KubeConfigFilePath string, cmd string, Namespace string, LabelSelector string, expecNonEmptyOutput bool) (string, error) { + defaultRetrier = retry.Retrier{Attempts: 15, Delay: 5 * time.Second} + // Create a context with a timeout (e.g., 120 seconds) + ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second) + defer cancel() + config, err := clientcmd.BuildConfigFromFlags("", KubeConfigFilePath) + if err != nil { + return "", fmt.Errorf("error building kubeconfig: %w", err) + } + + clientset, err := kubernetes.NewForConfig(config) + if err != nil { + return "", fmt.Errorf("error creating Kubernetes client: %w", err) + } + + pods, err := clientset.CoreV1().Pods(Namespace).List(ctx, metav1.ListOptions{ + LabelSelector: LabelSelector, + }) + if err != nil { + return "", fmt.Errorf("error listing pods: %w", err) + } + + var windowsPod *v1.Pod + for i := range pods.Items { + pod := &pods.Items[i] + if pod.Spec.NodeSelector["kubernetes.io/os"] == "windows" && + pod.Status.Phase == v1.PodRunning { + // Optionally, check for Ready condition here + windowsPod = pod + break + } + } + + if windowsPod == nil { + return "", fmt.Errorf("no Windows Pod found in label %s", LabelSelector) + } + + var outputBytes []byte + err = defaultRetrier.Do(ctx, func() error { + outputBytes, err = ExecPod(ctx, clientset, config, windowsPod.Namespace, windowsPod.Name, cmd) + if err != nil { + fmt.Printf("error executing command in windows pod: %v\n", err) + return fmt.Errorf("error executing command in windows pod: %w", err) + } + + if len(outputBytes) == 0 && expecNonEmptyOutput { + return fmt.Errorf("no output from command") + } + + return nil + }) + + if err != nil { + return "", err + } + + return string(outputBytes), nil +} + +func (a *LoadAndPinWinBPF) Run() error { + // Copy Event Writer into Node + LoadAndPinWinBPFDLabelSelector := fmt.Sprintf("name=%s", a.LoadAndPinWinBPFDeamonSetName) + _, err := ExecCommandInWinPod(a.KubeConfigFilePath, "copy /Y .\\event-writer-helper.bat C:\\event-writer-helper.bat", a.LoadAndPinWinBPFDeamonSetNamespace, LoadAndPinWinBPFDLabelSelector, true) + if err != nil { + return err + } + + _, err = ExecCommandInWinPod(a.KubeConfigFilePath, "C:\\event-writer-helper.bat EventWriter-Setup", a.LoadAndPinWinBPFDeamonSetNamespace, LoadAndPinWinBPFDLabelSelector, true) + if err != nil { + return err + } + + // pin maps + output, err := ExecCommandInWinPod(a.KubeConfigFilePath, "C:\\event-writer-helper.bat EventWriter-LoadAndPinPrgAndMaps", a.LoadAndPinWinBPFDeamonSetNamespace, LoadAndPinWinBPFDLabelSelector, false) + if err != nil { + return err + } + + fmt.Println(output) + if strings.Contains(output, "error") || strings.Contains(output, "failed") || strings.Contains(output, "existing") { + return fmt.Errorf("error in loading and pinning BPF maps and program: %s", output) + } + return nil +} + +func (a *LoadAndPinWinBPF) Prevalidate() error { + return nil +} + +func (a *LoadAndPinWinBPF) Stop() error { + return nil +} diff --git a/test/e2e/framework/kubernetes/unload-winbpf.go b/test/e2e/framework/kubernetes/unload-winbpf.go new file mode 100644 index 0000000000..fa6a6be122 --- /dev/null +++ b/test/e2e/framework/kubernetes/unload-winbpf.go @@ -0,0 +1,37 @@ +package kubernetes + +import ( + "fmt" + "strings" +) + +type UnLoadAndPinWinBPF struct { + KubeConfigFilePath string + UnLoadAndPinWinBPFDeamonSetNamespace string + UnLoadAndPinWinBPFDeamonSetName string +} + +func (a *UnLoadAndPinWinBPF) Run() error { + UnLoadAndPinWinBPFDLabelSelector := fmt.Sprintf("name=%s", a.UnLoadAndPinWinBPFDeamonSetName) + output, err := ExecCommandInWinPod(a.KubeConfigFilePath, "C:\\event-writer-helper.bat EventWriter-UnPinPrgAndMaps", a.UnLoadAndPinWinBPFDeamonSetNamespace, UnLoadAndPinWinBPFDLabelSelector, false) + if err != nil { + return err + } + + // Failure to unpin the maps and program is not a failure of the test, so we just log it + // and continue. + // This is because the test may have already unpinned them during a retry + fmt.Println(output) + if strings.Contains(output, "error") || strings.Contains(output, "failed") { + fmt.Printf("error in UnLoading and pinning BPF maps and program: %s", output) + } + return nil +} + +func (a *UnLoadAndPinWinBPF) Prevalidate() error { + return nil +} + +func (a *UnLoadAndPinWinBPF) Stop() error { + return nil +} diff --git a/test/e2e/framework/prometheus/prometheus.go b/test/e2e/framework/prometheus/prometheus.go index ebd0cb185c..a2d1ef081f 100644 --- a/test/e2e/framework/prometheus/prometheus.go +++ b/test/e2e/framework/prometheus/prometheus.go @@ -66,6 +66,31 @@ func CheckMetric(promAddress, metricName string, validMetric map[string]string, return nil } +func GetMetricGuageValueFromBuffer(prometheusMetricData []byte, metricName string, expectedLabels map[string]string) (float64, error) { + metrics, err := getAllPrometheusMetricsFromBuffer(prometheusMetricData) + if err != nil { + return 0, fmt.Errorf("failed to parse prometheus metrics: %w", err) + } + + for _, metric := range metrics { + if metric.GetName() == metricName { + for _, metric := range metric.GetMetric() { + // get all labels and values on the metric + metricLabels := map[string]string{} + for _, label := range metric.GetLabel() { + metricLabels[label.GetName()] = label.GetValue() + } + if reflect.DeepEqual(metricLabels, expectedLabels) { + return *metric.GetGauge().Value, nil + } + + } + } + } + + return 0, fmt.Errorf("metric not found %s", metricName) +} + func CheckMetricFromBuffer(prometheusMetricData []byte, metricName string, validMetric map[string]string) error { metrics, err := getAllPrometheusMetricsFromBuffer(prometheusMetricData) if err != nil { @@ -177,12 +202,10 @@ func ParseReaderPrometheusMetrics(input io.Reader) (map[string]*promclient.Metri // When capturing promethus output via curl and exect, there's a lot // of garbage at the front -func stripExecGarbage(s string) string { +func StripExecGarbage(s string) string { index := strings.Index(s, "#") if index == -1 { - // If there's no `#`, return the original string return s } - // Slice the string up to the character before the first `#` - return s[:index] + return s[index:] } diff --git a/test/e2e/jobs/jobs.go b/test/e2e/jobs/jobs.go index c54ab1f8a4..274a6a973d 100644 --- a/test/e2e/jobs/jobs.go +++ b/test/e2e/jobs/jobs.go @@ -133,6 +133,18 @@ func UninstallRetina(kubeConfigFilePath, chartPath string) *types.Job { return job } +func InstallEbpfXdp(kubeConfigFilePath string) *types.Job { + job := types.NewJob("Install EBPF and XDP") + job.AddStep(&kubernetes.CreateNamespace{ + KubeConfigFilePath: kubeConfigFilePath, + Namespace: "install-ebpf-xdp"}, nil) + + job.AddStep(&kubernetes.ApplyYamlConfig{ + YamlFilePath: "yaml/windows/install-ebpf-xdp.yaml", + }, nil) + return job +} + func InstallAndTestRetinaBasicMetrics(kubeConfigFilePath, chartPath string, testPodNamespace string) *types.Job { job := types.NewJob("Install and test Retina with basic metrics") @@ -193,10 +205,10 @@ func InstallAndTestRetinaBasicMetrics(kubeConfigFilePath, chartPath string, test name := scenario.name + " - Arch: " + arch job.AddScenario(dns.ValidateBasicDNSMetrics(name, scenario.req, scenario.resp, testPodNamespace, arch)) } - - job.AddScenario(windows.ValidateWindowsBasicMetric()) } + job.AddScenario(windows.ValidateWindowsBasicMetric()) + job.AddStep(&kubernetes.EnsureStableComponent{ PodNamespace: common.KubeSystemNamespace, LabelSelector: "k8s-app=retina", @@ -208,6 +220,7 @@ func InstallAndTestRetinaBasicMetrics(kubeConfigFilePath, chartPath string, test func UpgradeAndTestRetinaAdvancedMetrics(kubeConfigFilePath, chartPath, valuesFilePath string, testPodNamespace string) *types.Job { job := types.NewJob("Upgrade and test Retina with advanced metrics") + // enable advanced metrics job.AddStep(&kubernetes.UpgradeRetinaHelmChart{ Namespace: common.KubeSystemNamespace, @@ -259,6 +272,11 @@ func UpgradeAndTestRetinaAdvancedMetrics(kubeConfigFilePath, chartPath, valuesFi }, } + // Validate Windows BPF Metrics + job.AddStep(&kubernetes.ApplyYamlConfig{ + YamlFilePath: "yaml/windows/non-hpc-pod.yaml", + }, nil) + for _, arch := range common.Architectures { for _, scenario := range dnsScenarios { name := scenario.name + " - Arch: " + arch @@ -266,6 +284,7 @@ func UpgradeAndTestRetinaAdvancedMetrics(kubeConfigFilePath, chartPath, valuesFi } } + job.AddScenario(windows.ValidateWinBpfMetricScenario()) job.AddScenario(latency.ValidateLatencyMetric(testPodNamespace)) job.AddStep(&kubernetes.EnsureStableComponent{ @@ -338,3 +357,25 @@ func LoadGenericFlags() *types.Job { return job } + +func LoadAndPinWinBPFJob(kubeConfigFilePath string) *types.Job { + job := types.NewJob("Load Windows BPF Maps") + job.AddStep(&kubernetes.LoadAndPinWinBPF{ + KubeConfigFilePath: kubeConfigFilePath, + LoadAndPinWinBPFDeamonSetNamespace: "install-ebpf-xdp", + LoadAndPinWinBPFDeamonSetName: "install-ebpf-xdp", + }, nil) + + return job +} + +func UnLoadAndPinWinBPFJob(kubeConfigFilePath string) *types.Job { + job := types.NewJob("Unload Windows BPF Maps") + job.AddStep(&kubernetes.UnLoadAndPinWinBPF{ + KubeConfigFilePath: kubeConfigFilePath, + UnLoadAndPinWinBPFDeamonSetNamespace: "install-ebpf-xdp", + UnLoadAndPinWinBPFDeamonSetName: "install-ebpf-xdp", + }, nil) + + return job +} diff --git a/test/e2e/retina_e2e_test.go b/test/e2e/retina_e2e_test.go index d9e70f270d..94943bb6f5 100644 --- a/test/e2e/retina_e2e_test.go +++ b/test/e2e/retina_e2e_test.go @@ -3,12 +3,15 @@ package retina import ( + "context" "os" "path/filepath" "testing" + "time" "github.com/microsoft/retina/test/e2e/common" "github.com/microsoft/retina/test/e2e/framework/helpers" + "github.com/microsoft/retina/test/e2e/framework/kubernetes" "github.com/microsoft/retina/test/e2e/framework/types" "github.com/microsoft/retina/test/e2e/infra" jobs "github.com/microsoft/retina/test/e2e/jobs" @@ -33,7 +36,20 @@ func TestE2ERetina(t *testing.T) { *common.KubeConfig = infra.CreateAzureTempK8sInfra(ctx, t, rootDir) } + // Install Ebpf and XDP + installEbpfAndXDP := types.NewRunner(t, jobs.InstallEbpfXdp(common.KubeConfigFilePath(rootDir))) + installEbpfAndXDP.Run(ctx) + + // Wait for the HPC pod to be ready. Maximum wait time is 15 minutes in case the Pods are very slow to come up. + err = kubernetes.WaitForPodReadyWithTimeOut(context.TODO(), common.KubeConfigFilePath(rootDir), "install-ebpf-xdp", "name=install-ebpf-xdp", 15*time.Minute) + require.NoError(t, err) + + // Load and pin BPF Maps + loadAndPinWinBPFJob := types.NewRunner(t, jobs.LoadAndPinWinBPFJob(common.KubeConfigFilePath(rootDir))) + loadAndPinWinBPFJob.Run(ctx) + // Install and test Retina basic metrics + basicMetricsE2E := types.NewRunner(t, jobs.InstallAndTestRetinaBasicMetrics( common.KubeConfigFilePath(rootDir), @@ -59,6 +75,13 @@ func TestE2ERetina(t *testing.T) { // Install Retina basic and test captures captureE2E := types.NewRunner(t, jobs.ValidateCapture( + // unpin BPF Maps + unloadAndPinWinBPFJob := types.NewRunner(t, jobs.UnLoadAndPinWinBPFJob(common.KubeConfigFilePath(rootDir))) + unloadAndPinWinBPFJob.Run(ctx) + + // Install and test Hubble basic metrics + validatehubble := types.NewRunner(t, + jobs.ValidateHubble( common.KubeConfigFilePath(rootDir), "default"), ) diff --git a/test/e2e/scenarios/drop/scenario.go b/test/e2e/scenarios/drop/scenario.go index 014d067113..ef3053c4b8 100644 --- a/test/e2e/scenarios/drop/scenario.go +++ b/test/e2e/scenarios/drop/scenario.go @@ -48,7 +48,7 @@ func ValidateDropMetric(namespace, arch string) *types.Scenario { Step: &kubernetes.ExecInPod{ PodNamespace: namespace, PodName: podName, - Command: "curl -s -m 5 bing.com", + Command: "curl -s -m 5 www.bing.com", }, Opts: &types.StepOptions{ ExpectError: true, @@ -64,7 +64,7 @@ func ValidateDropMetric(namespace, arch string) *types.Scenario { Step: &kubernetes.ExecInPod{ PodNamespace: namespace, PodName: podName, - Command: "curl -s -m 5 bing.com", + Command: "curl -s -m 5 www.bing.com", }, Opts: &types.StepOptions{ ExpectError: true, diff --git a/test/e2e/scenarios/windows/scenario.go b/test/e2e/scenarios/windows/scenario.go index a452a04010..e2c081fb3e 100644 --- a/test/e2e/scenarios/windows/scenario.go +++ b/test/e2e/scenarios/windows/scenario.go @@ -5,6 +5,25 @@ import ( "github.com/microsoft/retina/test/e2e/framework/types" ) +func ValidateWinBpfMetricScenario() *types.Scenario { + name := "Validate Windows BPF Basic and Advanced Metrics" + steps := []*types.StepWrapper{ + { + Step: &ValidateWinBpfMetric{ + KubeConfigFilePath: "./test.pem", + RetinaDaemonSetNamespace: common.KubeSystemNamespace, + RetinaDaemonSetName: "retina-agent-win", + EbpfXdpDeamonSetNamespace: "install-ebpf-xdp", + EbpfXdpDeamonSetName: "install-ebpf-xdp", + NonHpcAppNamespace: "default", + NonHpcAppName: "non-hpc", + NonHpcPodName: "non-hpc-pod", + }, + }, + } + return types.NewScenario(name, steps...) +} + func ValidateWindowsBasicMetric() *types.Scenario { name := "Windows Metrics" steps := []*types.StepWrapper{ diff --git a/test/e2e/scenarios/windows/validate-winbpf-metrics.go b/test/e2e/scenarios/windows/validate-winbpf-metrics.go new file mode 100644 index 0000000000..c509a30a61 --- /dev/null +++ b/test/e2e/scenarios/windows/validate-winbpf-metrics.go @@ -0,0 +1,574 @@ +package windows + +import ( + "context" + "errors" + "fmt" + "log/slog" + "strings" + "time" + + kubernetes "github.com/microsoft/retina/test/e2e/framework/kubernetes" + prom "github.com/microsoft/retina/test/e2e/framework/prometheus" +) + +var ( + // ErrForwardBytesZero indicates forward bytes metric is zero + ErrForwardBytesZero = errors.New("forward bytes metric is zero, expected non-zero value") + // ErrForwardCountZero indicates forward count metric is zero + ErrForwardCountZero = errors.New("forward count metric is zero, expected non-zero value") + // ErrDropBytesZero indicates drop bytes metric is zero + ErrDropBytesZero = errors.New("drop bytes metric is zero, expected non-zero value") + // ErrDropCountZero indicates drop count metric is zero + ErrDropCountZero = errors.New("drop count metric is zero, expected non-zero value") + // ErrWindowsDropBytesZero indicates windows drop bytes metric is zero + ErrWindowsDropBytesZero = errors.New("windows drop bytes metric is zero, expected non-zero value") + // ErrWindowsDropCountZero indicates windows drop count metric is zero + ErrWindowsDropCountZero = errors.New("windows drop count metric is zero, expected non-zero value") +) + +const ( + // TestExternalIpAddress is the IP address used for testing purposes. + // It should be a valid external IP address that can be used for testing + // network observability metrics. + // This IP address is used in the EventWriter-SetFilter command to generate trace and + // drop events. + // Example.com - 23.192.228.84 + TestExternalIpAddress = "23.192.228.84" +) + +type ValidateWinBpfMetric struct { + KubeConfigFilePath string + EbpfXdpDeamonSetNamespace string + EbpfXdpDeamonSetName string + RetinaDaemonSetNamespace string + RetinaDaemonSetName string + NonHpcAppNamespace string + NonHpcAppName string + NonHpcPodName string +} + +func (v *ValidateWinBpfMetric) GetPromMetrics() (string, error) { + retinaLabelSelector := "k8s-app=retina" + var promOutput string + var err error + attempts := 10 + + for range attempts { + promOutput, err = kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + "C:\\event-writer-helper.bat EventWriter-GetRetinaPromMetrics", + v.RetinaDaemonSetNamespace, + retinaLabelSelector, + false) + + promOutput = prom.StripExecGarbage(promOutput) + if err == nil && promOutput != "" { + break + } + time.Sleep(3 * time.Second) + } + + if err != nil { + return "", err + } + return promOutput, nil +} + +func (v *ValidateWinBpfMetric) getNonHpcPodIpAddress() (string, error) { + + slog.Info("Executing EventWriter-GetPodIpAddress") + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + + slog.Info("Executing EventWriter-GetPodIpAddress") + nonHpcIpAddr, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + "C:\\event-writer-helper.bat EventWriter-GetPodIpAddress", + v.NonHpcAppNamespace, + nonHpcLabelSelector, + true) + + if err != nil { + return "", err + } + + nonHpcIpAddr = strings.TrimSpace(nonHpcIpAddr) + + if strings.Contains(nonHpcIpAddr, "failed") || strings.Contains(nonHpcIpAddr, "error") { + return "", fmt.Errorf("failed to get nonHpcIpAddr") + } + slog.Info("Non HPC IP Addr", "ip", nonHpcIpAddr) + + return nonHpcIpAddr, nil +} + +func (v *ValidateWinBpfMetric) getNonHpcPodIfIndex() (string, error) { + slog.Info("Executing EventWriter-GetPodIfIndex") + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + + nonHpcIfIndex, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + "C:\\event-writer-helper.bat EventWriter-GetPodIfIndex", + v.NonHpcAppNamespace, + nonHpcLabelSelector, + true) + + if err != nil { + return "", err + } + + if strings.Contains(nonHpcIfIndex, "failed") || strings.Contains(nonHpcIfIndex, "error") { + return "", fmt.Errorf("failed to get nonHpcIfIndex") + } + slog.Info("Non HPC Interface Index", "InterfaceIndex", nonHpcIfIndex) + + return nonHpcIfIndex, nil +} + +func (v *ValidateWinBpfMetric) attachEventWriter(nonHpcIfIndex string) (string, error) { + slog.Info("Attaching Event Writer to Non HPC Pod") + ebpfLabelSelector := fmt.Sprintf("name=%s", v.EbpfXdpDeamonSetName) + + // Attach to the non HPC pod + output, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-Attach %s", nonHpcIfIndex), + v.EbpfXdpDeamonSetNamespace, + ebpfLabelSelector, + true) + + if err != nil { + return "", err + } + + if strings.Contains(output, "failed") || strings.Contains(output, "error") || strings.Contains(output, "exiting") { + return "", fmt.Errorf("failed to attach to non HPC pod interface %s", output) + } + + return output, nil +} + +func (v *ValidateWinBpfMetric) generateTraceEvents() error { + + slog.Info("Generating Trace Events") + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + ebpfLabelSelector := fmt.Sprintf("name=%s", v.EbpfXdpDeamonSetName) + + // TRACE + output, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-SetFilter -event 4 -srcIP %s", TestExternalIpAddress), + v.EbpfXdpDeamonSetNamespace, + ebpfLabelSelector, + true) + + if err != nil { + return err + } + + if strings.Contains(output, "failed") || strings.Contains(output, "error") || strings.Contains(output, "exiting") { + return fmt.Errorf("failed to set filter for event writer") + } + + numcurls := 10 + for numcurls > 0 { + _, err = kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-Curl %s", TestExternalIpAddress), + v.NonHpcAppNamespace, + nonHpcLabelSelector, + false) + if err != nil { + return err + } + numcurls-- + } + + return nil +} + +func (v *ValidateWinBpfMetric) generateDropEvents() error { + slog.Info("Generating Drop Events") + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + ebpfLabelSelector := fmt.Sprintf("name=%s", v.EbpfXdpDeamonSetName) + + output, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-SetFilter -event 1 -srcIP %s", TestExternalIpAddress), + v.EbpfXdpDeamonSetNamespace, + ebpfLabelSelector, + true) + + if err != nil { + return err + } + + if strings.Contains(output, "failed") || strings.Contains(output, "error") || strings.Contains(output, "exiting") { + return fmt.Errorf("failed to start event writer") + } + + numcurls := 10 + for numcurls > 0 { + _, err = kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-Curl %s", TestExternalIpAddress), + v.NonHpcAppNamespace, + nonHpcLabelSelector, + false) + if err != nil { + return err + } + numcurls-- + } + + return nil +} + +func (v *ValidateWinBpfMetric) generatePktmonDropEvents() error { + slog.Info("Generating Drop Events") + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + ebpfLabelSelector := fmt.Sprintf("name=%s", v.EbpfXdpDeamonSetName) + + output, err := kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-SetFilter -event 100 -srcIP %s", TestExternalIpAddress), + v.EbpfXdpDeamonSetNamespace, + ebpfLabelSelector, + true) + + if err != nil { + return err + } + + if strings.Contains(output, "failed") || strings.Contains(output, "error") || strings.Contains(output, "exiting") { + return fmt.Errorf("failed to start event writer") + } + + numcurls := 10 + for numcurls > 0 { + _, err = kubernetes.ExecCommandInWinPod( + v.KubeConfigFilePath, + fmt.Sprintf("C:\\event-writer-helper.bat EventWriter-Curl %s", TestExternalIpAddress), + v.NonHpcAppNamespace, + nonHpcLabelSelector, + false) + if err != nil { + return err + } + numcurls-- + } + + return nil +} + +func (v *ValidateWinBpfMetric) verifyBasicMetrics(promOutput string) error { + + var fwdBytes float64 + var drpBytes float64 + var windowsDrpBytes float64 + var fwdCount float64 + var drpCount float64 + var windowsDrpCount float64 + + fwdLabels := map[string]string{ + "direction": "ingress", + } + + drpLabels := map[string]string{ + "direction": "ingress", + "reason": "130, 0", + } + + windowsDrpLabels := map[string]string{ + "direction": "ingress", + "reason": "DropReason_PacketMonitor, Drop_FL_InterfaceNotReady", + } + + if promOutput == "" { + slog.Info("No Prometheus metrics found, skipping validation") + } else { + // Forward event + err := prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_forward_bytes", fwdLabels) + if err != nil { + return fmt.Errorf("failed to verify prometheus metrics: %w", err) + } + + fwdBytes, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_forward_bytes", fwdLabels) + if err != nil { + return fmt.Errorf("failed to get forward bytes metric: %w", err) + } + slog.Info("networkobservability_forward_bytes value", "value", fwdBytes, "labels", fwdLabels) + if fwdBytes == 0 { + return ErrForwardBytesZero + } + + fwdCount, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_forward_count", fwdLabels) + if err != nil { + return fmt.Errorf("failed to get forward count metric: %w", err) + } + slog.Info("networkobservability_forward_count value", "value", fwdCount, "labels", fwdLabels) + if fwdCount == 0 { + return ErrForwardCountZero + } + + // Drop event + drpBytes, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_drop_bytes", drpLabels) + if err != nil { + return fmt.Errorf("failed to get drop bytes metric: %w", err) + } + slog.Info("networkobservability_drop_bytes value", "value", drpBytes, "labels", drpLabels) + if drpBytes == 0 { + return ErrDropBytesZero + } + + drpCount, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_drop_count", drpLabels) + if err != nil { + return fmt.Errorf("failed to get drop count metric: %w", err) + } + slog.Info("networkobservability_drop_count value", "value", drpCount, "labels", drpLabels) + if drpCount == 0 { + return ErrDropCountZero + } + + // Windows drop event + windowsDrpBytes, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_drop_bytes", windowsDrpLabels) + if err != nil { + return fmt.Errorf("failed to get windows drop bytes metric: %w", err) + } + slog.Info("networkobservability_drop_bytes (windows) value", "value", windowsDrpBytes, "labels", windowsDrpLabels) + if windowsDrpBytes == 0 { + return ErrWindowsDropBytesZero + } + + windowsDrpCount, err = prom.GetMetricGuageValueFromBuffer([]byte(promOutput), "networkobservability_drop_count", windowsDrpLabels) + if err != nil { + return fmt.Errorf("failed to get windows drop count metric: %w", err) + } + slog.Info("networkobservability_drop_count (windows) value", "value", windowsDrpCount, "labels", windowsDrpLabels) + if windowsDrpCount == 0 { + return ErrWindowsDropCountZero + } + } + + return nil + +} + +func (v *ValidateWinBpfMetric) verifyAdvancedMetrics(nonHpcIpAddr, promOutput string) error { + + // Advanced Metrics + adv_fwd_count_labels := map[string]string{ + "direction": "egress", + "ip": "23.192.228.84", + "namespace": "", + "podname": "", + "workload_kind": "unknown", + "workload_name": "unknown", + } + err := prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_forward_count", adv_fwd_count_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_forward_count") + } + + tcpFlags := []string{"ACK", "FIN", "PSH"} + for _, flag := range tcpFlags { + tcpFlagLabels := map[string]string{ + "flag": flag, + "ip": "23.192.228.84", + "namespace": "", + "podname": "", + "workload_kind": "unknown", + "workload_name": "unknown", + } + + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_tcpflags_count", tcpFlagLabels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_tcpflags_count for flag %s: %w", flag, err) + } + slog.Info("Found TCP flag metric", "flag", flag) + } + + adv_drop_byte_labels := map[string]string{ + "direction": "egress", + "ip": "23.192.228.84", + "namespace": "", + "podname": "", + "reason": "Reason_LbNoBackend", + "workload_kind": "unknown", + "workload_name": "unknown", + } + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_drop_bytes", adv_drop_byte_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_drop_bytes") + } + + adv_drop_count_labels := map[string]string{ + "direction": "egress", + "ip": "23.192.228.84", + "namespace": "", + "podname": "", + "reason": "Reason_LbNoBackend", + "workload_kind": "unknown", + "workload_name": "unknown", + } + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_drop_count", adv_drop_count_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_drop_count") + } + + adv_pktmon_drop_count_labels := map[string]string{ + "direction": "egress", + "ip": "23.192.228.84", + "namespace": "", + "podname": "", + "reason": "Drop_Busy", + "workload_kind": "unknown", + "workload_name": "unknown", + } + + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_drop_count", adv_pktmon_drop_count_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_drop_count") + } + + adv_fwd_count_labels = map[string]string{ + "direction": "ingress", + "ip": nonHpcIpAddr, + "namespace": v.NonHpcAppNamespace, + "podname": v.NonHpcPodName, + "workload_kind": "unknown", + "workload_name": "unknown", + } + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_forward_count", adv_fwd_count_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_forward_count") + } + + for _, flag := range tcpFlags { + tcpFlagLabels := map[string]string{ + "flag": flag, + "ip": nonHpcIpAddr, + "namespace": v.NonHpcAppNamespace, + "podname": v.NonHpcPodName, + "workload_kind": "unknown", + "workload_name": "unknown", + } + + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_tcpflags_count", tcpFlagLabels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_tcpflags_count for flag %s: %w", flag, err) + } + slog.Info("Found TCP flag metric", "flag", flag) + } + + adv_drop_byte_labels = map[string]string{ + "direction": "ingress", + "ip": nonHpcIpAddr, + "namespace": v.NonHpcAppNamespace, + "podname": v.NonHpcPodName, + "reason": "Reason_LbNoBackend", + "workload_kind": "unknown", + "workload_name": "unknown", + } + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_drop_bytes", adv_drop_byte_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_drop_bytes with ingress label") + } + + adv_drop_count_labels = map[string]string{ + "direction": "ingress", + "ip": nonHpcIpAddr, + "namespace": v.NonHpcAppNamespace, + "podname": v.NonHpcPodName, + "reason": "Reason_LbNoBackend", + "workload_kind": "unknown", + "workload_name": "unknown", + } + err = prom.CheckMetricFromBuffer([]byte(promOutput), "networkobservability_adv_drop_count", adv_drop_count_labels) + if err != nil { + return fmt.Errorf("failed to find networkobservability_adv_drop_count with ingress label") + } + return nil +} + +func (v *ValidateWinBpfMetric) Run() error { + + nonHpcLabelSelector := fmt.Sprintf("app=%s", v.NonHpcAppName) + slog.Info("Waiting for Non HPC Pod to come up") + // Wait for the non HPC pod to be ready. Maximum wait time is 15 minutes in case the Pods are very slow to come up. + kubernetes.WaitForPodReadyWithTimeOut(context.TODO(), v.KubeConfigFilePath, v.NonHpcAppNamespace, nonHpcLabelSelector, 15*time.Minute) + slog.Info("Non HPC Pod is ready") + + nonHpcIpAddr, err := v.getNonHpcPodIpAddress() + + if err != nil { + return err + } + + nonHpcIfIndex, err := v.getNonHpcPodIfIndex() + + if err != nil { + return err + } + + // Attach to the non HPC pod + _, err = v.attachEventWriter(nonHpcIfIndex) + + if err != nil { + return err + } + + // Generate trace events + err = v.generateTraceEvents() + + if err != nil { + return err + } + + // generate drop events + err = v.generateDropEvents() + + if err != nil { + return err + } + + // generate pktmon drop events + err = v.generatePktmonDropEvents() + + if err != nil { + return err + } + + slog.Info("Waiting for basic metrics to be updated as part of next polling cycle") + time.Sleep(12 * time.Second) + promOutput, err := v.GetPromMetrics() + + if err != nil { + return err + } + + slog.Info("Prometheus metrics output", "output", promOutput) + + err = v.verifyBasicMetrics(promOutput) + if err != nil { + + return fmt.Errorf("failed to verify basic metrics: %w", err) + } + slog.Info("Basic metrics verified successfully") + + err = v.verifyAdvancedMetrics(nonHpcIpAddr, promOutput) + if err != nil { + return fmt.Errorf("failed to verify advanced metrics: %w", err) + } + slog.Info("Advanced metrics verified successfully") + + return nil +} + +func (v *ValidateWinBpfMetric) Prevalidate() error { + return nil +} + +func (v *ValidateWinBpfMetric) Stop() error { + return nil +} diff --git a/test/e2e/tools/event-writer/Dockerfile b/test/e2e/tools/event-writer/Dockerfile new file mode 100644 index 0000000000..dc3c5ef705 --- /dev/null +++ b/test/e2e/tools/event-writer/Dockerfile @@ -0,0 +1,6 @@ +FROM mcr.microsoft.com/windows/servercore:ltsc2022 As base + +COPY ./install-ebpf-xdp.ps1 ./install-ebpf-xdp.ps1 +COPY ./x64/Release/bpf_event_writer.sys ./bpf_event_writer.sys +COPY ./x64/Release/event_writer.exe ./event_writer.exe +COPY ./event-writer-helper.bat ./event-writer-helper.bat \ No newline at end of file diff --git a/test/e2e/tools/event-writer/bpf_event_writer.c b/test/e2e/tools/event-writer/bpf_event_writer.c new file mode 100644 index 0000000000..1274acf6d3 --- /dev/null +++ b/test/e2e/tools/event-writer/bpf_event_writer.c @@ -0,0 +1,319 @@ +#include "bpf_helpers.h" +#include "bpf_helper_defs.h" +#include "bpf_endian.h" +#include "xdp/ebpfhook.h" +#include "event_writer.h" + +SEC (".maps") +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, struct five_tuple); + __type(value, uint8_t); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 512 * 4096); +} five_tuple_map; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, uint8_t); + __type(value, struct filter); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 1); +} filter_map; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, uint32_t); + __type(value, struct trace_notify); + __uint(max_entries, 1); +} trc_buffer; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, uint32_t); + __type(value, struct drop_notify); + __uint(max_entries, 1); +} drp_buffer; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, uint32_t); + __type(value, struct pktmon_notify); + __uint(max_entries, 1); +} pktmon_buffer; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 64 * 1024); +} cilium_events; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_HASH); + __type(key, struct metrics_key); + __type(value, struct metrics_value); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 512 * 4096); +} cilium_metrics; + +SEC(".maps") +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_HASH); + __type(key, struct windows_metrics_key); + __type(value, struct metrics_value); + __uint(pinning, LIBBPF_PIN_BY_NAME); + __uint(max_entries, 512 * 4096); +} windows_metrics; + +void update_metrics(uint64_t bytes, uint8_t direction, + uint8_t reason, uint16_t line, uint8_t file) +{ + struct metrics_value *entry, new_entry = {}; + struct metrics_key key = {}; + + key.reason = reason; + key.dir = direction; + key.line = line; + key.file = file; + + entry = bpf_map_lookup_elem(&cilium_metrics, &key); + if (entry) { + entry->count += 1; + entry->bytes += bytes; + } else { + new_entry.count = 1; + new_entry.bytes = bytes; + bpf_map_update_elem(&cilium_metrics, &key, &new_entry, 0); + } +} + +void create_trace_ntfy_event(struct trace_notify* trc_elm) +{ + memset(trc_elm, 0, sizeof(struct trace_notify)); + trc_elm->type = CILIUM_NOTIFY_TRACE; + trc_elm->subtype = 0; + trc_elm->source = 10; // random source + trc_elm->hash = 0; + trc_elm->len_orig = 128; + trc_elm->len_cap = 128; + trc_elm->version = 1; + trc_elm->src_label = 0; + trc_elm->dst_label = 0; + trc_elm->dst_id = 0; + trc_elm->reason = 0; + trc_elm->ifindex = 0; +} + +void create_drop_event(struct drop_notify* drp_elm) +{ + memset(drp_elm, 0, sizeof(struct drop_notify)); + drp_elm->type = CILIUM_NOTIFY_DROP; + drp_elm->subtype = 6; + drp_elm->source = 10; // random source + drp_elm->hash = 0; + drp_elm->len_orig = 128; + drp_elm->len_cap = 128; + drp_elm->version = 1; + drp_elm->src_label = 0; + drp_elm->dst_label = 0; + drp_elm->dst_id = 0; + drp_elm->line = 0; + drp_elm->file = 0; + drp_elm->ext_error = 0; + drp_elm->ifindex = 0; +} + +void create_pktmon_drop_event(pktmon_notify_t* pktmon_drp_elm) +{ + memset(pktmon_drp_elm, 0, sizeof(pktmon_notify_t)); + pktmon_drp_elm->version_header.type = PKTMON_NOTIFY_DROP; + pktmon_drp_elm->version_header.version = 1; + pktmon_drp_elm->pktmon_header.metadata.drop_reason = 7; + pktmon_drp_elm->pktmon_header.metadata.packet_type = 1; +} + +int +check_filter(struct filter* flt, struct five_tuple* tup) { + + if (flt->srcIP != 0 && flt->srcIP != tup->srcIP) { + return 1; + } + + if (flt->dstIP != 0 && flt->dstIP != tup->dstIP) { + return 1; + } + + if (flt->srcprt != 0 && flt->srcprt != tup->srcprt) { + return 1; + } + + if (flt->dstprt != 0 && flt->dstprt != tup->dstprt) { + return 1; + } + + return 0; +} + +int extract_five_tuple_info(void* data, int bytes_to_copy, struct five_tuple* tup) { + struct ethhdr *eth; + uint8_t present = 1; + + if (bytes_to_copy < sizeof(struct ethhdr)) { + return 1; + } + + eth = data; + if (eth->ethertype != htons(0x0800)) { + return 1; + } + + if (bytes_to_copy < sizeof(struct ethhdr) + sizeof(struct iphdr)) { + return 1; + } + + struct iphdr *iph = data + sizeof(struct ethhdr); + + // Only process TCP or UDP packets + if (iph->protocol != 6 && iph->protocol != 17) { + return 1; + } + + tup->srcIP = htonl(iph->saddr); + tup->dstIP = htonl(iph->daddr); + tup->proto = iph->protocol; + + if (tup->proto == 6) { + if (bytes_to_copy < sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct tcphdr)) { + return 1; + } + + struct tcphdr *tcph = data + sizeof(struct ethhdr) + sizeof(struct iphdr); + tup->srcprt = htons(tcph->source); + tup->dstprt = htons(tcph->dest); + } + else if (tup->proto == 17) { + if (bytes_to_copy < sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr)) { + return 1; + } + + struct udphdr *udph = data + sizeof(struct ethhdr) + sizeof(struct iphdr); + tup->srcprt = htons(udph->source); + tup->dstprt = htons(udph->dest); + } + return 0; +} + +SEC("xdp") +int +event_writer(xdp_md_t* ctx) { + uint8_t flt_key = 0; + uint32_t buf_key = 0; + struct filter* flt; + struct five_tuple tup; + uint32_t size_to_copy = 128; + uint8_t flt_evttype, present = 1; + uint8_t reason = 0; + + if ((uintptr_t)ctx->data + size_to_copy > (uintptr_t)ctx->data_end) { + size_to_copy = (uintptr_t)ctx->data_end - (uintptr_t)ctx->data; + } + + memset(&tup, 0, sizeof(tup)); + if (extract_five_tuple_info(ctx->data, size_to_copy, &tup) != 0) { + return XDP_PASS; + } + + flt = (struct filter*) bpf_map_lookup_elem(&filter_map, &flt_key); + if (flt == NULL) { + return XDP_PASS; + } + + if (check_filter(flt, &tup) != 0) { + return XDP_PASS; + } + + if (bpf_map_update_elem(&five_tuple_map, &tup, &present, BPF_ANY) != 0) { + return XDP_PASS; + } + + flt_evttype = flt->event; + if (flt_evttype == CILIUM_NOTIFY_TRACE) { + struct trace_notify* trc_elm; + + //Create a Mock Trace Event + trc_elm = (struct trace_notify *) bpf_map_lookup_elem(&trc_buffer, &buf_key); + if (trc_elm == NULL) { + return XDP_PASS; + } + create_trace_ntfy_event(trc_elm); + memset(trc_elm->data, 0, sizeof(trc_elm->data)); + memcpy(trc_elm->data, ctx->data, size_to_copy); + bpf_perf_event_output(ctx, &cilium_events, EBPF_MAP_FLAG_CURRENT_CPU , trc_elm, sizeof(struct trace_notify)); + } + else if (flt_evttype == CILIUM_NOTIFY_DROP) { + struct drop_notify* drp_elm; + + //Create a Mock Drop Event + drp_elm = (struct drop_notify *) bpf_map_lookup_elem(&drp_buffer, &buf_key); + if (drp_elm == NULL) { + return XDP_PASS; + } + reason = 130; + create_drop_event(drp_elm); + memset(drp_elm->data, 0, sizeof(drp_elm->data)); + memcpy(drp_elm->data, ctx->data, size_to_copy); + bpf_perf_event_output(ctx, &cilium_events, EBPF_MAP_FLAG_CURRENT_CPU , drp_elm, sizeof(struct drop_notify)); + } + else if (flt_evttype == PKTMON_NOTIFY_DROP) { + struct pktmon_notify* pkt_drp_elm; + + uint64_t pktmon_size = sizeof(struct pktmon_notify); + uint64_t drop_size = sizeof(struct drop_notify); + + //Create a Mock Drop Event + pkt_drp_elm = (struct pktmon_notify *) bpf_map_lookup_elem(&pktmon_buffer, &buf_key); + if (pkt_drp_elm == NULL) { + return XDP_PASS; + } + reason = 130; + create_pktmon_drop_event(pkt_drp_elm); + memset(pkt_drp_elm->data, 0, sizeof(pkt_drp_elm->data)); + memcpy(pkt_drp_elm->data, ctx->data, size_to_copy); + + bpf_printk("PKTMON_NOTIFY_DROP event: reason=%d, size_to_copy=%d \n", reason, size_to_copy); + bpf_printk("PKTMON_NOTIFY_DROP sizes : pktmon_struct_size=%llu, drop_struct_size=%llu \n", pktmon_size, drop_size); + + bpf_perf_event_output(ctx, &cilium_events, EBPF_MAP_FLAG_CURRENT_CPU , pkt_drp_elm, sizeof(struct pktmon_notify)); + + // Create Windows specific drop event with hardcoded reason code + { + struct metrics_value *win_entry, win_new_entry = {}; + struct windows_metrics_key win_key = {}; + + win_key.type = -DROP_PKTMON; + win_key.reason = Drop_FL_InterfaceNotReady; + win_key.dir = METRIC_INGRESS; + win_key.line = 0; + win_key.file = 0; + + win_entry = bpf_map_lookup_elem(&windows_metrics, &win_key); + if (win_entry) { + win_entry->count += 1; + win_entry->bytes += size_to_copy; + } else { + win_new_entry.count = 1; + win_new_entry.bytes = size_to_copy; + bpf_map_update_elem(&windows_metrics, &win_key, &win_new_entry, 0); + } + } + } + update_metrics(size_to_copy, METRIC_INGRESS, reason, 0, 0); + + return XDP_PASS; +} \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event-writer-helper.bat b/test/e2e/tools/event-writer/event-writer-helper.bat new file mode 100644 index 0000000000..e3b2028a4e --- /dev/null +++ b/test/e2e/tools/event-writer/event-writer-helper.bat @@ -0,0 +1,62 @@ +@echo off +REM Add logic to call a specific function based on the argument +if "%1"=="EventWriter-Setup" goto EventWriter-Setup +if "%1"=="EventWriter-SetFilter" goto EventWriter-SetFilter +if "%1"=="EventWriter-GetRetinaPromMetrics" goto EventWriter-GetRetinaPromMetrics +if "%1"=="EventWriter-Curl" goto EventWriter-Curl +if "%1"=="EventWriter-LoadAndPinPrgAndMaps" goto EventWriter-LoadAndPinPrgAndMaps +if "%1"=="EventWriter-UnPinPrgAndMaps" goto EventWriter-UnPinPrgAndMaps +if "%1"=="EventWriter-Attach" goto EventWriter-Attach +if "%1"=="EventWriter-GetRetinaPromMetrics" goto EventWriter-GetPodIpAddress +if "%1"=="EventWriter-GetPodIpAddress" goto EventWriter-GetPodIpAddress +if "%1"=="EventWriter-GetPodIfIndex" goto EventWriter-GetPodIfIndex +goto :EOF + +:EventWriter-Setup + copy .\event_writer.exe C:\event_writer.exe + copy .\bpf_event_writer.sys C:\bpf_event_writer.sys + goto :EOF + +:EventWriter-SetFilter + set PREV_DIR=%CD% + cd C:\ + .\event_writer.exe -set-filter -event %3 -srcIP %5 -ifindx %7 + cd /d %PREV_DIR% + goto :EOF + +:EventWriter-Attach + set PREV_DIR=%CD% + cd C:\ + .\event_writer.exe -attach -ifindx %2 + cd /d %PREV_DIR% + goto :EOF + +:EventWriter-LoadAndPinPrgAndMaps + set PREV_DIR=%CD% + cd C:\ + .\event_writer.exe -load-pin + cd /d %PREV_DIR% + goto :EOF + +:EventWriter-UnPinPrgAndMaps + set PREV_DIR=%CD% + cd C:\ + .\event_writer.exe -unpin + cd /d %PREV_DIR% + goto :EOF + +:EventWriter-GetRetinaPromMetrics + curl -s http://localhost:10093/metrics + goto :EOF + +:EventWriter-Curl + curl http://%2 + goto :EOF + +:EventWriter-GetPodIpAddress + powershell -command "Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object -ExpandProperty IPAddress" + goto :EOF + +:EventWriter-GetPodIfIndex + powershell -command "Get-NetAdapter | Where-Object { $_.InterfaceDescription -like '*Hyper-V Virtual Ethernet Container*' } | ForEach-Object { Write-Output $_.ifIndex }" + goto :EOF \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event_writer.cpp b/test/e2e/tools/event-writer/event_writer.cpp new file mode 100644 index 0000000000..73412786fc --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.cpp @@ -0,0 +1,353 @@ +#include +#include +#include +#include + +#include +#include "event_writer.h" +#include + +bpf_object *obj = NULL; +bpf_link* link = NULL; + +int +set_filter(struct filter* flt) { + uint8_t key = 0; + int map_flt_fd = 0; + + // Attempt to open the pinned map + map_flt_fd = bpf_obj_get(FILTER_MAP_PIN_PATH); + if (map_flt_fd < 0) { + fprintf(stderr, "%s - failed to lookup filter_map\n", __FUNCTION__); + return 1; + } + if (bpf_map_update_elem(map_flt_fd, &key, flt, 0) != 0) { + fprintf(stderr, "%s - failed to update filter\n", __FUNCTION__); + return 1; + } + return 0; +} + +int _pin(const char* pin_path, int fd, bool is_map) { + if (bpf_obj_get(pin_path) < 0) { + if (bpf_obj_pin(fd, pin_path) < 0) { + fprintf(stderr, "%s - failed to pin %s to %s\n", __FUNCTION__, + is_map ? "map" : "prog", pin_path); + return 1; + } + + printf("%s - %s successfully pinned at %s\n", __FUNCTION__, + is_map ? "map" : "prog", + pin_path); + } else { + printf("%s - pinned %s found %s\n", __FUNCTION__, + is_map ? "map" : "prog", + pin_path); + } + return 0; +} + +int +attach_program_to_interface(int ifindx) { + int evt_wrt_fd = 0; + evt_wrt_fd = bpf_obj_get(EVENT_WRITER_PIN_PATH); + if (evt_wrt_fd < 0) { + fprintf(stderr, "%s - failed to lookup event_writer at %s\n", __FUNCTION__, EVENT_WRITER_PIN_PATH); + return 1; + } + + // Verify there's no program attached to the specified ifindex. + uint32_t program_id; + if (bpf_xdp_query_id(ifindx, 0, &program_id) < 0) { + if (bpf_xdp_attach(ifindx, evt_wrt_fd, 0, nullptr) != 0) { + fprintf(stderr, "%s - failed to attach to interface with ifindex %d\n", __FUNCTION__, ifindx); + return 1; + } + printf("%s - Attached program %s to interface with ifindex %d\n", __FUNCTION__, EVENT_WRITER_PIN_PATH, ifindx); + } else { + if (program_id == evt_wrt_fd) { + printf("%s - program alteady attached %s to interface with ifindex %d\n", __FUNCTION__, EVENT_WRITER_PIN_PATH, ifindx); + } else { + if (bpf_xdp_attach(ifindx, evt_wrt_fd, XDP_FLAGS_REPLACE, nullptr) != 0) { + fprintf(stderr, "%s - failed to attach to interface with ifindex %d\n", __FUNCTION__, ifindx); + return 1; + } + } + } + + printf("%s - Attached program %s to interface with ifindex %d\n", __FUNCTION__, EVENT_WRITER_PIN_PATH, ifindx); + return 0; +} + +int +load_pin(void) { + struct bpf_program* prg = NULL; + struct bpf_map *map_ev = NULL, *map_met = NULL, *map_win_met = NULL, *map_fvt = NULL, *map_flt = NULL; + int prg_fd = 0; + + // Load the BPF object file + obj = bpf_object__open("bpf_event_writer.sys"); + if (obj == NULL) { + fprintf(stderr, "%s - failed to open BPF object\n", __FUNCTION__); + goto fail; + } + + if (EBPF_SUCCESS != ebpf_object_set_execution_type(obj, EBPF_EXECUTION_NATIVE)) { + fprintf(stderr, "%s - failed to set execution type to native\n", __FUNCTION__); + goto fail; + } + + // Load cilium_events map and event_writer bpf program + if (bpf_object__load(obj) < 0) { + fprintf(stderr, "%s - failed to load BPF sys\n", __FUNCTION__); + goto fail; + } + + // Find the program by its name + prg = bpf_object__find_program_by_name(obj, "event_writer"); + if (prg == NULL) { + fprintf(stderr, "%s - failed to find event_writer program", __FUNCTION__); + goto fail; + } + + if (_pin(EVENT_WRITER_PIN_PATH, bpf_program__fd(prg), false) != 0) { + goto fail; + } + + // Find the map by its name + map_ev = bpf_object__find_map_by_name(obj, "cilium_events"); + if (map_ev == NULL) { + fprintf(stderr, "%s - failed to find cilium_events by name\n", __FUNCTION__); + goto fail; + } + if (_pin(EVENTS_MAP_PIN_PATH, bpf_map__fd(map_ev), true) != 0) { + goto fail; + } + + // Find the map by its name + map_met = bpf_object__find_map_by_name(obj, "cilium_metrics"); + if (map_met == NULL) { + fprintf(stderr, "%s - failed to find cilium_metrics by name\n", __FUNCTION__); + goto fail; + } + if (_pin(METRICS_MAP_PIN_PATH, bpf_map__fd(map_met), true) != 0) { + goto fail; + } + + map_win_met = bpf_object__find_map_by_name(obj, "windows_metrics"); + if (map_win_met == NULL) { + fprintf(stderr, "%s - failed to find windows_metrics by name\n", __FUNCTION__); + goto fail; + } + if (_pin(WINDOWS_METRICS_MAP_PIN_PATH, bpf_map__fd(map_win_met), true) != 0) { + goto fail; + } + + // Find the map by its name + map_fvt = bpf_object__find_map_by_name(obj, "five_tuple_map"); + if (map_fvt == NULL) { + fprintf(stderr, "%s - failed to find five_tuple_map by name\n", __FUNCTION__); + goto fail; + } + if (_pin(FIVE_TUPLE_MAP_PIN_PATH, bpf_map__fd(map_fvt), true) != 0) { + goto fail; + } + + // Find the map by its name + map_flt = bpf_object__find_map_by_name(obj, "filter_map"); + if (map_flt == NULL) { + fprintf(stderr, "%s - failed to lookup filter_map\n", __FUNCTION__); + goto fail; + } + if (_pin(FILTER_MAP_PIN_PATH, bpf_map__fd(map_flt), true) != 0) { + goto fail; + } + + printf("%s - event-writer loaded successfully\n", __FUNCTION__); + bpf_object__close(obj); + return 0; // Return success + +fail: + if (prg != NULL) { + bpf_program__unpin(prg, EVENT_WRITER_PIN_PATH); + } + + if (map_ev != NULL) { + bpf_map__unpin(map_ev, EVENTS_MAP_PIN_PATH); + } + + if (map_flt != NULL) { + bpf_map__unpin(map_flt, FILTER_MAP_PIN_PATH); + } + + if (map_fvt != NULL) { + bpf_map__unpin(map_fvt, FIVE_TUPLE_MAP_PIN_PATH); + } + + if (map_met != NULL) { + bpf_map__unpin(map_met, METRICS_MAP_PIN_PATH); + } + + if (map_win_met != NULL) { + bpf_map__unpin(map_win_met, WINDOWS_METRICS_MAP_PIN_PATH); + } + + if (obj != NULL) { + bpf_object__close(obj); + } + return 1; +} + +int +unpin(void) { + if (bpf_obj_get(EVENT_WRITER_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup event_writer at %s\n", __FUNCTION__, EVENT_WRITER_PIN_PATH); + } else { + ebpf_object_unpin(EVENT_WRITER_PIN_PATH); + } + + if (bpf_obj_get(FILTER_MAP_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup filter_map at %s\n", __FUNCTION__, FILTER_MAP_PIN_PATH); + } else { + ebpf_object_unpin(FILTER_MAP_PIN_PATH); + } + + if (bpf_obj_get(EVENTS_MAP_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup cilium_events at %s\n", __FUNCTION__, EVENTS_MAP_PIN_PATH); + } else { + ebpf_object_unpin(EVENTS_MAP_PIN_PATH); + } + + if (bpf_obj_get(METRICS_MAP_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup cilium_metrics at %s\n", __FUNCTION__, METRICS_MAP_PIN_PATH); + } else { + ebpf_object_unpin(METRICS_MAP_PIN_PATH); + } + + if (bpf_obj_get(WINDOWS_METRICS_MAP_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup windows_metrics at %s\n", __FUNCTION__, WINDOWS_METRICS_MAP_PIN_PATH); + } else { + ebpf_object_unpin(WINDOWS_METRICS_MAP_PIN_PATH); + } + + if (bpf_obj_get(FIVE_TUPLE_MAP_PIN_PATH) < 0) { + fprintf(stderr, "%s - failed to lookup five_tuple_map at %s\n", __FUNCTION__, FIVE_TUPLE_MAP_PIN_PATH); + } else { + ebpf_object_unpin(FIVE_TUPLE_MAP_PIN_PATH); + } + + return 0; + } + +uint32_t _ipStrToUint(const char* ipStr) { + uint32_t ip = 0; + int part = 0; + int parts = 0; + const char *p = ipStr; + char c; + + while ((c = *p++) != '\0') { + if (c >= '0' && c <= '9') { + part = part * 10 + (c - '0'); + } else if (c == '.') { + ip = (ip << 8) | (part & 0xFF); + part = 0; + parts++; + } else { + // Invalid character in IP string. + return 0; + } + } + + // Process the last octet. + ip = (ip << 8) | (part & 0xFF); + parts++; + + // Ensure we have exactly four parts + if (parts != 4) { + return 0; + } + + return ip; +} + +int main(int argc, char* argv[]) { + setvbuf(stdout, NULL, _IONBF, 0); + // Parse the command-line arguments (flags) + if (argc < 2) { + fprintf(stderr, "valid arguments are required. Exiting..\n"); + return 1; + } + + if (strcmp(argv[1], "-load-pin") == 0) { + if (load_pin() != 0) { + return 1; + } + } else if (strcmp(argv[1], "-set-filter") == 0) { + struct filter flt; + memset(&flt, 0, sizeof(flt)); + + for (int i = 2; i < argc; i++) { + if (strcmp(argv[i], "-event") == 0) { + if (i + 1 < argc) + flt.event = static_cast(atoi(argv[++i])); + } else if (strcmp(argv[i], "-srcIP") == 0) { + if (i + 1 < argc) + flt.srcIP = _ipStrToUint(argv[++i]); + } else if (strcmp(argv[i], "-dstIP") == 0) { + if (i + 1 < argc) + flt.dstIP = _ipStrToUint(argv[++i]); + } else if (strcmp(argv[i], "-srcprt") == 0) { + if (i + 1 < argc) + flt.srcprt = static_cast(atoi(argv[++i])); + } else if (strcmp(argv[i], "-dstprt") == 0) { + if (i + 1 < argc) + flt.dstprt = static_cast(atoi(argv[++i])); + } + } + printf("Parsed Values:\n"); + printf("Event: %d\n", flt.event); + printf("Source IP: %u.%u.%u.%u\n", + (flt.srcIP >> 24) & 0xFF, (flt.srcIP >> 16) & 0xFF, + (flt.srcIP >> 8) & 0xFF, flt.srcIP & 0xFF); + printf("Destination IP: %u.%u.%u.%u\n", + (flt.dstIP >> 24) & 0xFF, (flt.dstIP >> 16) & 0xFF, + (flt.dstIP >> 8) & 0xFF, flt.dstIP & 0xFF); + printf("Source Port: %u\n", flt.srcprt); + printf("Destination Port: %u\n", flt.dstprt); + + if (set_filter(&flt) != 0) { + return 1; + } else { + printf("filter updated successfully\n"); + } + + } else if (strcmp(argv[1], "-attach") == 0) { + int ifindx = 0; + for (int i = 2; i < argc; i++) { + if (strcmp(argv[i], "-ifindx") == 0) { + if (i + 1 < argc) + ifindx = static_cast(atoi(argv[++i])); + } + } + + printf("Interface Index: %d\n", ifindx); + if (ifindx <= 0) { + fprintf(stderr, "valid ifindx is required. Exiting..\n"); + return 1; + } + + if (attach_program_to_interface(ifindx) != 0) { + return 1; + } + } else if (strcmp(argv[1], "-unpin") == 0) { + if (unpin() != 0) { + return 1; + } + } else { + fprintf(stderr, "invalid arguments. Exiting..\n"); + return 1; + } + + return 0; +} \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event_writer.h b/test/e2e/tools/event-writer/event_writer.h new file mode 100644 index 0000000000..8454218d33 --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.h @@ -0,0 +1,241 @@ +/* Copyright (c) Microsoft Corporation */ +/* SPDX-License-Identifier: MIT */ + +#ifndef _EVENT_WRITER__ +#define _EVENT_WRITER__ + + +#define EVENTS_MAP_PIN_PATH \ + "/ebpf/global/cilium_events" + +#define METRICS_MAP_PIN_PATH \ + "/ebpf/global/cilium_metrics" + +#define WINDOWS_METRICS_MAP_PIN_PATH \ + "/ebpf/global/windows_metrics" + +#define FILTER_MAP_PIN_PATH \ + "/ebpf/global/filter_map" + +#define FIVE_TUPLE_MAP_PIN_PATH \ + "/ebpf/global/five_tuple_map" + +#define EVENT_WRITER_PIN_PATH \ + "/ebpf/global/event_writer" + +#define DROP_PKTMON -220 +#define Drop_FL_InterfaceNotReady 607 + +enum { + CILIUM_NOTIFY_UNSPEC = 0, + CILIUM_NOTIFY_DROP, + CILIUM_NOTIFY_DBG_MSG, + CILIUM_NOTIFY_DBG_CAPTURE, + CILIUM_NOTIFY_TRACE, + CILIUM_NOTIFY_POLICY_VERDICT, + CILIUM_NOTIFY_CAPTURE, + CILIUM_NOTIFY_TRACE_SOCK, + PKTMON_NOTIFY_DROP = 100, +}; + +enum { + METRIC_INGRESS = 1, + METRIC_EGRESS, +}; + +struct ethhdr { + uint8_t dst_mac[6]; + uint8_t src_mac[6]; + uint16_t ethertype; +}; + +struct iphdr { + uint8_t ihl : 4, + version : 4; + uint8_t tos; + uint16_t tot_len; + uint16_t id; + uint16_t frag_off; + uint8_t ttl; + uint8_t protocol; + uint16_t check; + uint32_t saddr; + uint32_t daddr; +}; + +struct tcphdr { + uint16_t source; // Source port + uint16_t dest; // Destination port + uint32_t seq; // Sequence number + uint32_t ack_seq; // Acknowledgment number + uint8_t doff; // Data offset + uint8_t res1:4; // Reserved + uint8_t fin:1, + syn:1, + rst:1, + psh:1, + ack:1, + urg:1, + ece:1, + cwr:1, + ns:1; + uint16_t window; // Window size + uint16_t check; // Checksum + uint16_t urg_ptr; // Urgent pointer +}; + +struct udphdr { + uint16_t source; // Source port + uint16_t dest; // Destination port + uint16_t len; // Length of the UDP packet (header + data) + uint16_t check; // Checksum +}; + +union v6addr { + struct { + uint32_t p1; + uint32_t p2; + uint32_t p3; + uint32_t p4; + }; + struct { + __u64 d1; + __u64 d2; + }; + uint8_t addr[16]; +}__packed; + +struct five_tuple { + uint8_t proto; + uint32_t srcIP; + uint32_t dstIP; + uint16_t srcprt; + uint16_t dstprt; +}; + +struct filter { + uint8_t event; + uint32_t srcIP; + uint32_t dstIP; + uint16_t srcprt; + uint16_t dstprt; +}; + +struct trace_notify { + uint8_t type; + uint8_t subtype; + uint16_t source; + uint32_t hash; + uint32_t len_orig; + uint16_t len_cap; + uint16_t version; + uint32_t src_label; + uint32_t dst_label; + uint16_t dst_id; + uint8_t reason; + uint8_t ipv6:1; + uint8_t pad:7; + uint32_t ifindex; + union { + struct { + uint32_t orig_ip4; + uint32_t orig_pad1; + uint32_t orig_pad2; + uint32_t orig_pad3; + }; + union v6addr orig_ip6; + }; + uint8_t data[128]; +}; + +struct drop_notify { + uint8_t type; + uint8_t subtype; + uint16_t source; + uint32_t hash; + uint32_t len_orig; + uint16_t len_cap; + uint16_t version; + uint32_t src_label; + uint32_t dst_label; + uint32_t dst_id; /* 0 for egress */ + uint16_t line; + uint8_t file; + int8_t ext_error; + uint32_t ifindex; + uint8_t data[128]; +}; + +struct metrics_key { + uint8_t reason; /* 0: forwarded, >0 dropped */ + uint8_t dir:2, /* 1: ingress 2: egress */ + pad:6; + uint16_t line; /* __MAGIC_LINE__ */ + uint8_t file; /* __MAGIC_FILE__, needs to fit __source_file_name_to_id */ + uint8_t reserved[3]; /* reserved for future extension */ +}; + +struct windows_metrics_key { + uint8_t type; + uint16_t reason; /* 0: forwarded, >0 dropped */ + uint8_t dir : 2, /* 1: ingress 2: egress */ + pad : 6; + uint16_t line; /* __MAGIC_LINE__ */ + uint8_t file; /* __MAGIC_FILE__, needs to fit __source_file_name_to_id */ +}; + +struct metrics_value { + uint64_t count; + uint64_t bytes; +}; + +typedef struct _netevent_data_header +{ + uint8_t type; + uint16_t version; +} netevent_data_header_t; + +#pragma pack(push, 1) + +/* packet descriptor used for event streaming */ +typedef struct _pktmon_evt_stream_packet_descriptor +{ + uint32_t packet_original_length; + uint32_t packet_logged_length; + uint32_t packet_metadata_length; +} pktmon_evt_stream_packet_descriptor; + +/* metadata information used for event streaming */ +typedef struct _pktmon_evt_stream_metadata +{ + uint64_t pkt_groupid; + uint16_t pkt_count; + uint16_t appearance_count; + uint16_t direction_name; + uint16_t packet_type; + uint16_t component_id; + uint16_t edge_id; + uint16_t filter_id; + uint32_t drop_reason; + uint32_t drop_location; + uint16_t proc_num; + uint64_t timestamp; +} pktmon_evt_stream_metadata; + +/* packet header used for event streaming */ +typedef struct _pktmon_evt_stream_packet_header +{ + uint8_t eventid; + pktmon_evt_stream_packet_descriptor packet_descriptor; + pktmon_evt_stream_metadata metadata; +} pktmon_evt_stream_packet_header; + +typedef struct pktmon_notify { + netevent_data_header_t version_header; + pktmon_evt_stream_packet_header pktmon_header; + uint8_t data[128]; +} pktmon_notify_t; + +#pragma pack(pop) + +#endif /* _EVENT_WRITER__ */ \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event_writer.sln b/test/e2e/tools/event-writer/event_writer.sln new file mode 100644 index 0000000000..b8cd6f295c --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.11.35431.28 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "event_writer", "event_writer.vcxproj", "{A12E2603-25A2-4A9C-9B9D-9156C9520789}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {A12E2603-25A2-4A9C-9B9D-9156C9520789}.Release|x64.ActiveCfg = Release|x64 + {A12E2603-25A2-4A9C-9B9D-9156C9520789}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {1B17387E-FD19-4848-96B1-6A0F1322EE37} + EndGlobalSection +EndGlobal diff --git a/test/e2e/tools/event-writer/event_writer.vcxproj b/test/e2e/tools/event-writer/event_writer.vcxproj new file mode 100644 index 0000000000..a4d572c359 --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.vcxproj @@ -0,0 +1,113 @@ + + + + 1.1.0 + 1.3.0 + + + + + + + + 10.0.26100.2454 + + + + Release + x64 + + + + 17.0 + Win32Proj + {A12E2603-25A2-4A9C-9B9D-9156C9520789} + event_writer + 10.0.26100.0 + $(SolutionDir)packages\eBPF-for-Windows.x64.$(EbpfVersion)\build\native\ + $(SolutionDir)packages\Microsoft.XDP-for-Windows.Sdk.$(XdpSdkVersion)\build\native\ + + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + event_writer + + + + Level3 + true + true + true + NDEBUG;_WINDOWS;%(PreprocessorDefinitions) + true + $(SolutionDir)packages\Microsoft.Windows.SDK.CPP.10.0.26100.2454\c\Include\10.0.26100.0\um;$(SolutionDir)packages\eBPF-for-Windows.x64.$(EbpfVersion)\build\native\include;$(SolutionDir)packages\Microsoft.XDP-for-Windows.Sdk.$(XdpSdkVersion)\build\native\include;%(AdditionalIncludeDirectories) + stdcpp20 + + + Console + true + true + true + false + $(SolutionDir)packages\Microsoft.Windows.SDK.CPP.x64.10.0.26100.2454\c\um\x64;$(SolutionDir)packages\eBPF-for-Windows.x64.$(EbpfVersion)\build\native\lib;$(SolutionDir)packages\Microsoft.XDP-for-Windows.Sdk.$(XdpSdkVersion)\build\native\lib;%(AdditionalLibraryDirectories) + ebpfapi.lib;iphlpapi.lib;%(AdditionalDependencies) + + + + + + + + + + + $(Platform)\$(Configuration)\bpf_event_writer.sys + + set PATH=$(EbpfPackagePath)bin;%PATH% + $(XdpPackagePath)bin\$(Platform)\xdpbpfexport.exe --clear + $(XdpPackagePath)bin\$(Platform)\xdpbpfexport.exe + clang -g -target bpf -O2 -Werror -I$(EbpfPackagePath)include -I$(XdpPackagePath)include -c bpf_event_writer.c -o $(Platform)\$(Configuration)\bpf_event_writer.o + pushd $(OutDir) + powershell -NonInteractive -ExecutionPolicy Unrestricted $(EbpfPackagePath)bin\Convert-BpfToNative.ps1 -FileName bpf_event_writer -IncludeDir $(EbpfPackagePath)include -Platform $(Platform) -Configuration $(Configuration) -KernelMode $true + popd + + + + + + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + + + + + \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event_writer.vcxproj.filters b/test/e2e/tools/event-writer/event_writer.vcxproj.filters new file mode 100644 index 0000000000..a433b610b7 --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + + + + + + + + {75e6b9b2-c419-46ce-adb9-38f5a0454ea8} + + + + + + + + + + \ No newline at end of file diff --git a/test/e2e/tools/event-writer/event_writer.vcxproj.user b/test/e2e/tools/event-writer/event_writer.vcxproj.user new file mode 100644 index 0000000000..88a550947e --- /dev/null +++ b/test/e2e/tools/event-writer/event_writer.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/test/e2e/tools/event-writer/install-ebpf-xdp.ps1 b/test/e2e/tools/event-writer/install-ebpf-xdp.ps1 new file mode 100644 index 0000000000..f3b2f65b44 --- /dev/null +++ b/test/e2e/tools/event-writer/install-ebpf-xdp.ps1 @@ -0,0 +1,957 @@ +#Requires -RunAsAdministrator + +# This script performs Windows node setup required for Retina e2e tests. + +# Version configuration +$Script:eBPFVersion = "1.1.0" +$Script:RetinaEbpfAPIVersion = "1.6.0" +$Script:XDPRuntimeVersion = "1.3.0" + +Function Assert-SoftwareInstalled +{ + [cmdletbinding(DefaultParameterSetName='Software')] + + Param + ( + [Parameter(ParameterSetName='Service',Mandatory=$true)] + [ValidateScript({-Not [String]::IsNullOrWhiteSpace($_)})] + [String] $ServiceName, + + [Parameter(ParameterSetName='Service',Mandatory=$false)] + [ValidateSet($null,'Running','Stopped')] + [String] $ServiceState, + + [Parameter(ParameterSetName='Software',Mandatory=$true)] + [ValidateScript({-Not [String]::IsNullOrWhiteSpace($_)})] + [String] $SoftwareName, + + [Parameter(ParameterSetName='Software',Mandatory=$false)] + [String] $SoftwareVersion, + + [Parameter(ParameterSetName='Service',Mandatory=$false)] + [Parameter(ParameterSetName='Software',Mandatory=$false)] + [Switch] $Silent + ) + + [String] $name = If($ServiceName) {"$($ServiceName)"}Else{"$($SoftwareName)"} + + If(-Not $Silent.IsPresent) + { + Write-Host -Object:"Checking if $($name) is installed ..." + } + + [Boolean] $isInstalled = $false + + Try + { + If($SoftwareName) + { + $software = Get-WmiObject -Class:'Win32_Product' | Where-Object -Property:'Name' -like "*$($SoftwareName)*" + + If($software -And + (-Not [String]::IsNullOrWhiteSpace($SoftwareVersion))) + { + $software = $software | Where-Object -Property:'Version' -like "*$($SoftwareVersion)*" + } + + If($software) + { + $isInstalled = $true + } + } + ElseIF($ServiceName) + { + [Object] $state = Get-Service -Name:"$($ServiceName)" -ErrorAction:'SilentlyContinue' + If($state) + { + $isInstalled = $true + + If($ServiceState -And + -Not ($state.Status -INE $ServiceState)) + { + Write-Warning -Message:"`t$ServiceName is $$(state.Status)" + } + } + } + } + Catch + { + + } + + If(-Not $Silent.IsPresent) + { + If($isInstalled) + { + Write-Host -Object:"`t$($name) is installed" + } + Else + { + Write-Host -Object:"`t$($name) is not installed" + } + } + + Return $isInstalled +} + +<# + .Name + Assert-TestSigningIsEnabled + + .Synopsis + Internal cmdlet to check if testsigning is enabled in the boot loader. + + .Description + Returns TRUE if test signing is enabled, otherwise FALSE. + + .Parameter Silent + Optional switch used to suppress output messages + + .Example + # Check if test signing is enabled + Assert-TestSigningIsEnabled +#> +Function Assert-TestSigningIsEnabled +{ + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [Switch] $Silent + ) + + [Boolean] $isEnabled = $false + [String] $state = 'Disabled' + + Try + { + [Boolean] $current = $false + + If(-Not ($Silent.IsPresent)) + { + Write-Host -Object:"`tAssert Test Signing is Enabled" + } + + [Object[]] $entries = BCDEdit.exe /enum + If($entries.Count -ILT 3) + { + Write-Error -Message:"$entries" + + Throw + } + + ForEach($entry in $entries) + { + If($entry.StartsWith('identifier')) + { + If($entry -ILike '*{current}*') + { + $current = $true + } + Else + { + $current = $false + } + } + Else + { + If($current) + { + If($entry -ILike '*testsigning*Yes*') + { + $state = 'Enabled' + + $isEnabled = $true + + Break + } + } + } + } + } + Catch + { + $isEnabled = $false + + $state = 'Unknown' + } + + If(-Not ($Silent.IsPresent)) + { + Write-Host -Object:"`t`t$($state)" + } + + Return $isEnabled +} + +<# + .Name + Disable-TestSigning + + .Synopsis + Internal cmdlet to turn off Test Signing in the Windows Boot Loader. + + .Description + Returns TRUE if test signing is disabled, otherwise FALSE. + If set, the setting does not take effect until a reboot + + .Parameter Reboot + Optional parameter which will trigger a reboot if needed + + .Example + # Disable test signing + Disable-TestSigning +#> +Function Disable-TestSigning +{ + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [Switch] $Reboot + ) + + [Boolean] $isSuccess = $true + + Try + { + [Boolean] $current = $false + [Boolean] $found = $false + + Write-Host -Object:"`tDisabling Test Signing" + + If(Assert-TestSigningIsEnabled -Silent) + { + Start-Process -FilePath:"$($env:WinDir)\System32\BCDEdit.exe" -ArgumentList @('/Set TestSigning Off') -PassThru | Wait-Process + + If(Assert-TestSigningIsEnabled -Silent) + { + Write-Error -Message:"`t`tFailed" + + Throw + } + + $script:RequiresReboot = $true + } + + Write-Host -Object:"`t`tDisabled" + } + Catch + { + $isSuccess = $false + } + + If($Reboot.IsPresent -and + $script:RequiresReboot) + { + Write-Host -Object:'Restarting' + + Start-Sleep -Seconds:5 + + Restart-Computer + Start-Sleep -Seconds:60 + } + + Return $isSuccess +} + +<# + .Name + Enable-TestSigning + + .Synopsis + Internal cmdlet to turn on Test Signing in the Windows Boot Loader. + + .Description + Returns TRUE if test signing is enabled, otherwise FALSE. + + .Parameter Reboot + Optional parameter which will trigger a reboot if needed + + .Example + # Enable test signing + Enable-TestSigning +#> +Function Enable-TestSigning +{ + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [Switch] $Reboot + ) + + [Boolean] $isSuccess = $true + + Try + { + [Boolean] $current = $false + [Boolean] $found = $false + + Write-Host -Object:"`tEnabling Test Signing" + + If(-Not (Assert-TestSigningIsEnabled -Silent)) + { + Start-Process -FilePath:"$($env:WinDir)\System32\BCDEdit.exe" -ArgumentList @('/Set TestSigning On') -PassThru | Wait-Process + + If(-Not (Assert-TestSigningIsEnabled -Silent)) + { + Write-Error -Message:"`t`tFailed" + + Throw + } + + $script:RequiresReboot = $true + } + + Write-Host -Object:"`t`tEnabled" + + } + Catch + { + Write-Host "Enable-TestSigning : $_" + $isSuccess = $false + } + + If($Reboot.IsPresent -and + $script:RequiresReboot) + { + Write-Host -Object:'Restarting' + + Start-Sleep -Seconds:5 + + Restart-Computer + Start-Sleep -Seconds:60 + } + + Return $isSuccess +} + +#endregion PrivateFns + +#region Public + +<# + .Name + Assert-WindowsEbpfXdpIsReady + + .Synopsis + Check if EBPF and XDP for Windows is ready + + .Description + Returns TRUE if EBPF and XDP for Windows is ready, otherwise FALSE. + + .Example + # Check if EBPF and XDP for Windows is ready + Assert-WindowsCiliumFunctions +#> +Function Assert-WindowsEbpfXdpIsReady +{ + Write-Host -Object:'Validating EBPF and XDP for Windows is ready' + + [Boolean] $isReady = $true + [String[]] $services = @( + 'eBPFCore', + 'NetEbpfExt', + 'XDP' + ) + ForEach($service in $services) + { + If(-Not (Assert-SoftwareInstalled -ServiceName:"$($service)" -ServiceState:'Running')) + { + $isReady = $false + + Write-Warning -Message:"`t$($service) is not ready" + } + } + + # Verify VC++ Runtime DLLs + $requiredDlls = @("MSVCP140.dll", "VCRUNTIME140.dll", "VCRUNTIME140_1.dll") + ForEach($dll in $requiredDlls) + { + If(-Not (Test-Path "$env:WinDir\System32\$dll")) + { + $isReady = $false + Write-Warning -Message:"`t$dll is not present in System32" + } + } + + # Verify EbpfApi.dll in System32 + If(-Not (Test-Path "$env:WinDir\System32\EbpfApi.dll")) + { + $isReady = $false + Write-Warning -Message:"`tEbpfApi.dll is not present in System32" + } + + # Verify retinaebpfapi.dll in System32 + If(-Not (Test-Path "$env:WinDir\System32\retinaebpfapi.dll")) + { + $isReady = $false + Write-Warning -Message:"`tretinaebpfapi.dll is not present in System32" + } + + Return $isReady +} + +<# + .Name + Install-eBPF + + .Synopsis + Installs extended Berkley Packet Filter for Windows. + + .Description + Returns TRUE if extended Berkley Packet Filter for Windows is installed successfully, otherwise FALSE. + Function requires that Test Signing is enabled. + + .Parameter LocalPath + Local directory to the eBPF for Windows binaries. + Default location is $env:LocalAppData\Temp + + .Example + # Install eBPF for Windows + Install-eBPF -LocalPath:"$env:TEMP" +#> +Function Install-eBPF +{ + [cmdletbinding(DefaultParameterSetName='Default')] + + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [ValidateScript({Test-Path $_ -PathType:'Container'})] + [String] $LocalPath = "$env:TEMP" + ) + + [Boolean] $isSuccess = $true + + Try + { + Write-Host 'Installing extended Berkley Packet Filter for Windows' + If(-Not (Assert-TestSigningIsEnabled)) + { + If(-Not (Enable-TestSigning -Reboot)) { Throw } + } + + If(Assert-SoftwareInstalled -ServiceName:"eBPFCore") + { + Write-Host 'extended Berkley Packet Filter for Windows is already installed' + return $isSuccess + } + + Write-Host 'Installing extended Berkley Packet Filter for Windows' + # Download eBPF-for-Windows. + $packageEbpfUrl = "https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v$Script:eBPFVersion/ebpf-for-windows.x64.$Script:eBPFVersion.msi" + Invoke-WebRequest -Uri $packageEbpfUrl -OutFile "$LocalPath\ebpf-for-windows.x64.$Script:eBPFVersion.msi" + + Start-Process -FilePath "$($env:WinDir)\System32\MSIExec.exe" -ArgumentList @("/i", "$LocalPath\ebpf-for-windows.x64.$Script:eBPFVersion.msi", "/qn", "INSTALLFOLDER=`"$($env:ProgramFiles)\ebpf-for-windows`"", "ADDLOCAL=eBPF_Runtime_Components") -PassThru | Wait-Process + If(-Not (Assert-SoftwareInstalled -ServiceName:'eBPFCore' -Silent) -Or + -Not (Assert-SoftwareInstalled -ServiceName:'NetEbpfExt' -Silent)) + { + Write-Error -Message:"`eBPF service failed to install" + Throw + } + + $isSuccess = Assert-SoftwareInstalled -ServiceName:"eBPFCore" + + # TODO : Remove this once retinaebpfapi.dll can find EbpfApi.dll from the install location. + # Copy EbpfApi.dll to System32 so dependent DLLs can find it + $ebpfApiSource = "$($env:ProgramFiles)\ebpf-for-windows\EbpfApi.dll" + $ebpfApiDest = "$env:WinDir\System32\EbpfApi.dll" + If((Test-Path $ebpfApiSource) -And -Not (Test-Path $ebpfApiDest)) + { + Copy-Item -Path $ebpfApiSource -Destination $ebpfApiDest -Force + Write-Host "EbpfApi.dll copied to $ebpfApiDest" + } + } + Catch + { + $isSuccess = $false + Write-Host "EBPF install failed : $_" + Uninstall-eBPF + } + + Return $isSuccess +} + +<# + .Name + Install-VCRuntime + + .Synopsis + Installs the Visual C++ Runtime redistributable. + + .Description + Downloads and installs the Microsoft Visual C++ Redistributable (x64) which provides + MSVCP140.dll, VCRUNTIME140.dll, and VCRUNTIME140_1.dll in C:\Windows\System32. retinaebpfapi.dll + depends on these DLLs. Returns TRUE if successful, otherwise FALSE. +#> +Function Install-VCRuntime +{ + [Boolean] $isSuccess = $true + + Try + { + $requiredDlls = @("MSVCP140.dll", "VCRUNTIME140.dll", "VCRUNTIME140_1.dll") + $allPresent = $true + + ForEach($dll in $requiredDlls) + { + If(-Not (Test-Path "$env:WinDir\System32\$dll")) + { + $allPresent = $false + Break + } + } + + If($allPresent) + { + Write-Host 'Visual C++ Runtime DLLs are already installed' + return $isSuccess + } + + Write-Host 'Installing Visual C++ Redistributable (x64)' + + $vcRedistUrl = "https://aka.ms/vs/17/release/vc_redist.x64.exe" + $vcRedistPath = "$env:TEMP\vc_redist.x64.exe" + + Invoke-WebRequest -Uri $vcRedistUrl -OutFile $vcRedistPath + Start-Process -FilePath $vcRedistPath -ArgumentList @("/install", "/quiet", "/norestart") -Wait + + # Verify installation + ForEach($dll in $requiredDlls) + { + If(-Not (Test-Path "$env:WinDir\System32\$dll")) + { + Write-Error "$dll not found after VC++ Redistributable install" + Throw + } + } + + Write-Host 'Visual C++ Runtime DLLs installed successfully' + } + Catch + { + $isSuccess = $false + Write-Host "Visual C++ Runtime install failed: $_" + } + Finally + { + Remove-Item -Path "$env:TEMP\vc_redist.x64.exe" -Force -ErrorAction SilentlyContinue + } + + Return $isSuccess +} + +<# + .Name + Install-RetinaEbpfAPI + + .Synopsis + Downloads and installs retinaebpfapi.dll from the NuGet gallery. + + .Description + Downloads the Microsoft.Wcn.Observability.eBPF.Retina.x64 NuGet package and + copies retinaebpfapi.dll to C:\Windows\System32. + Returns TRUE if successful, otherwise FALSE. +#> +Function Install-RetinaEbpfAPI +{ + [Boolean] $isSuccess = $true + + Try + { + $dllDest = "$env:WinDir\System32\retinaebpfapi.dll" + + If(Test-Path $dllDest) + { + Write-Host 'retinaebpfapi.dll is already installed' + return $isSuccess + } + + Write-Host 'Installing retinaebpfapi.dll from NuGet' + + $nugetUrl = "https://www.nuget.org/api/v2/package/Microsoft.Wcn.Observability.eBPF.Retina.x64/$Script:RetinaEbpfAPIVersion" + $zipPath = "$env:TEMP\eBPFRetina.zip" + $extractPath = "$env:TEMP\eBPFRetina" + + Invoke-WebRequest -Uri $nugetUrl -OutFile $zipPath + Expand-Archive -Path $zipPath -DestinationPath $extractPath -Force + + $dllSource = "$extractPath\build\native\bin\retinaebpfapi.dll" + If(-Not (Test-Path $dllSource)) + { + Write-Error "retinaebpfapi.dll not found in NuGet package at $dllSource" + Throw + } + + Copy-Item -Path $dllSource -Destination $dllDest -Force + Write-Host "retinaebpfapi.dll installed to $dllDest" + } + Catch + { + $isSuccess = $false + Write-Host "retinaebpfapi.dll install failed: $_" + } + Finally + { + # Cleanup + Remove-Item -Path "$env:TEMP\eBPFRetina.zip" -Force -ErrorAction SilentlyContinue + Remove-Item -Path "$env:TEMP\eBPFRetina" -Recurse -Force -ErrorAction SilentlyContinue + } + + Return $isSuccess +} + +<# + .Name + Install-XDP + + .Synopsis + Installs the eXpress Data Path for Windows service. + + .Description + Returns TRUE if the eXpress Data Path for Windows service is installed successfully, otherwise FALSE. + + .Parameter LocalPath + Local directory to the eXpress Data Path for Windows service binaries. + Default location is $env:LocalAppData\Temp + + .Example + # Install the eXpress Data Path service + Install-XDP -LocalPath:"$env:TEMP" +#> +Function Install-XDP +{ + [cmdletbinding(DefaultParameterSetName='Default')] + + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [ValidateScript({Test-Path $_ -PathType:'Container'})] + [String] $LocalPath = "$env:TEMP" + ) + + [Boolean] $isSuccess = $true + + Try + { + If(Assert-SoftwareInstalled -ServiceName:'XDP' -Silent) + { + Write-Host 'XDP for Windows is already installed' + return $isSuccess + } + + # Download and extract the XDP runtime NuGet package. + Write-Host 'Installing eXpress Data Path for Windows' + $xdpRuntimeVersion = $Script:XDPRuntimeVersion + $xdpNupkgUrl = "https://www.nuget.org/api/v2/package/Microsoft.XDP-for-Windows.Runtime.x64/$xdpRuntimeVersion" + $xdpZipPath = "$LocalPath\Microsoft.XDP-for-Windows.Runtime.x64.$xdpRuntimeVersion.zip" + $xdpExtractPath = "$LocalPath\xdp-runtime" + + Invoke-WebRequest -Uri $xdpNupkgUrl -OutFile $xdpZipPath + Expand-Archive -Path $xdpZipPath -DestinationPath $xdpExtractPath -Force + Remove-Item -Path $xdpZipPath -Force + + # Install XDP using xdp-setup.ps1 from the runtime package + $xdpSetupScript = Get-ChildItem -Path $xdpExtractPath -Recurse -Filter "xdp-setup.ps1" | Select-Object -First 1 + If($null -eq $xdpSetupScript) { + Write-Error -Message:"xdp-setup.ps1 not found in the runtime package" + Throw + } + + # Trust the certificate from xdp.sys so Windows allows the driver to load + $xdpSys = Get-ChildItem -Path $xdpExtractPath -Recurse -Filter "xdp.sys" | Select-Object -First 1 + If($null -ne $xdpSys) { + $xdpCert = (Get-AuthenticodeSignature $xdpSys.FullName).SignerCertificate + If($null -ne $xdpCert) { + $xdpCertPath = "$LocalPath\xdp.cer" + Export-Certificate -Cert $xdpCert -FilePath $xdpCertPath -Type CERT -Force + certutil -f -addstore Root $xdpCertPath + certutil -f -addstore TrustedPublisher $xdpCertPath + Remove-Item -Path $xdpCertPath -Force + } Else { + Write-Warning "xdp.sys is not signed, skipping certificate trust" + } + } Else { + Write-Warning "xdp.sys not found in the runtime package, skipping certificate trust" + } + + & $xdpSetupScript.FullName -Install xdp + & $xdpSetupScript.FullName -Install xdpebpf + + reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\xdp\Parameters" /v XdpEbpfEnabled /d 1 /t REG_DWORD /f + net.exe stop xdp + net.exe start xdp + + If(-Not (Assert-SoftwareInstalled -ServiceName:'XDP' -Silent)) { + Throw + } + + } + Catch + { + $isSuccess = $false + Write-Host "XDP install failed : $_" + Uninstall-XDP + } + + Return $isSuccess +} + +<# + .Name + Install-EbpfXdp + + .Synopsis + Installs EBPF and XDP for Windows + + .Description + Returns TRUE if EBPF and XDP for Windows is installed successfully, otherwise FALSE. + + .Example + # Install EBPF and XDP for Windows + Install-EbpfXdp +#> +Function Install-EbpfXdp +{ + Try + { + If(Assert-WindowsEbpfXdpIsReady) { + Write-Host 'eBPF and XDP for Windows is installed successfully' + write-Host 'Create the probe ready file' + # Create the probe ready file + New-Item -Path "C:\install-ebpf-xdp-probe-ready" -ItemType File -Force + return + } + + If(-Not (Assert-TestSigningIsEnabled -Silent)) + { + If(-Not (Enable-TestSigning -Reboot)) {Throw} + } + + $hnsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\hns\State" + $valueName = "CiliumOnWindows" + + if (-not (Test-Path $hnsPath)) { + New-Item -Path $hnsPath -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $hnsPath -Name $valueName -ErrorAction SilentlyContinue + + If ($null -eq $existing) { + Write-Host "CiliumOnWindows not found, creating it" + New-ItemProperty -Path $hnsPath -Name $valueName -PropertyType DWORD -Value 1 -Force + } else { + If ($existing.CiliumOnWindows -ne 1) { + Write-Host "Setting CiliumOnWindows to 1" + Set-ItemProperty -Path $hnsPath -Name $valueName -PropertyType DWORD -Value 1 -Force + } + } + + If(-Not (Install-eBPF)) {Throw} + + If(-Not (Install-XDP)) {Throw} + + If(-Not (Install-VCRuntime)) {Throw} + + If(-Not (Install-RetinaEbpfAPI)) {Throw} + + Write-Host 'eBPF and XDP for Windows is installed successfully' + write-Host 'Create the probe ready file' + # Create the probe ready file + New-Item -Path "C:\install-ebpf-xdp-probe-ready" -ItemType File -Force + } + Catch + { + $isSuccess = $false + } + + return $isSuccess +} + +<# + .Name + Uninstall-eBPF + + .Synopsis + Uninstalls the extended Berkley Packet Filter for Windows. + + .Description + Returns TRUE if the extended Berkley Packet Filter for Windows is uninstalled successfully, otherwise FALSE. + + .Parameter LocalPath + Local directory to the extended Berkley Packet Filter for Windows binaries. + Default location is $env:LocalAppData\Temp + + .Example + # Uninstall the extended Berkley Packet Filter for Windows + Uninstall-eBPF -LocalPath:"$(env:LocalAppData)\Temp" +#> +Function Uninstall-eBPF +{ + [cmdletbinding(DefaultParameterSetName='Default')] + + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [ValidateScript({Test-Path $_ -PathType:'Container'})] + [String] $LocalPath = "$env:TEMP" + ) + + Write-Host 'Uninstalling the extended Berkley Packet Filter for Windows' + + [Boolean] $isSuccess = $true + + Try + { + [String[]] $services = @('eBPFCore', + 'NetEbpfExt' + ) + + ForEach($service in $services) + { + [Object] $state = Get-Service -Name:$($service) -ErrorAction:'SilentlyContinue' + If($state) + { + For([Byte]$i = 0; + $i -ILE 5; + $i++) + { + If($state.Status -IEQ 'Stopped') + { + Break + } + Else + { + If($state.Status -IEQ 'Running') + { + Stop-Service -Name:"$($service)" -Force + } + ElseIf($state.Status -IEQ 'StopPending') + { + Start-Sleep -Seconds:5 + } + Else + { + Write-Error -Message:"$($service) service is $($state.status)" + + Throw + } + } + + $state = Get-Service -Name:"$($service)" + } + } + + Start-Process -FilePath:"$($env:WinDir)\System32\MSIExec.exe" -ArgumentList @("/x $($LocalPath)\ebpf-for-windows.x64.$Script:eBPFVersion.msi", '/qn') -PassThru | Wait-Process + } + + If((Assert-SoftwareInstalled -ServiceName:'eBPFCore' -Silent) -or + (Assert-SoftwareInstalled -ServiceName:'NetEbpfExt' -Silent) -or + (Assert-SoftwareInstalled -SoftwareName:'eBPF for Windows' -Silent)) + { + Write-Error -Message:"eBPF for Windows is still installed" + + Throw + } + } + Catch + { + $isSuccess = $false + } + + Return $isSuccess +} + +<# + .Name + Uninstall-XDP + + .Synopsis + Uninstalls the express Data Path for Windows service + + .Description + Returns TRUE if the eXpress Data Path for Windows service is uninstalled successfully, otherwise FALSE. + + .Parameter LocalPath + Local directory to the eXpress Data Path for Windows service binaries. + Default location is $env:LocalAppData\Temp + + .Example + # Uninstall the eXpress Data Path for Windows service + Uninstall-XDP -LocalPath:"$($env:LocalAppData)\Temp" +#> +Function Uninstall-XDP +{ + [cmdletbinding(DefaultParameterSetName='Default')] + + Param + ( + [Parameter(ParameterSetName='Default',Mandatory=$false)] + [ValidateScript({Test-Path $_ -PathType:'Container'})] + [String] $LocalPath = "$env:TEMP" + ) + + Write-Host 'Uninstalling eXpress Data Path for Windows' + + [Boolean] $isSuccess = $true + + Try + { + [Object] $state = Get-Service -Name:'XDP' -ErrorAction:'SilentlyContinue' + If($state) + { + For([Byte]$i = 0; + $i -ILE 5; + $i++) + { + If($state.Status -IEQ 'Stopped') + { + Break + } + Else + { + If($state.Status -IEQ 'Running') + { + Stop-Service -Name:'XDP' -Force + } + ElseIf($state.Status -IEQ 'StopPending') + { + Start-Sleep -Seconds:5 + } + Else + { + Write-Error -Message:"XDP service is $($state.status)" + + Throw + } + } + + $state = Get-Service -Name:'XDP' + } + + # Uninstall using xdp-setup.ps1 from the extracted runtime package + $xdpExtractPath = "$LocalPath\xdp-runtime" + $xdpSetupScript = Get-ChildItem -Path $xdpExtractPath -Recurse -Filter "xdp-setup.ps1" -ErrorAction SilentlyContinue | Select-Object -First 1 + If($null -ne $xdpSetupScript) { + & $xdpSetupScript.FullName -Uninstall xdpebpf + & $xdpSetupScript.FullName -Uninstall xdp + } + } + + If((Assert-SoftwareInstalled -ServiceName:'XDP' -Silent)) + { + Write-Error -Message:"XDP for Windows is still installed" + + Throw + } + } + Catch + { + $isSuccess = $false + } + + Return $isSuccess +} + + +#Script Start +exit $(Install-EbpfXdp) \ No newline at end of file diff --git a/test/e2e/tools/event-writer/packages.config b/test/e2e/tools/event-writer/packages.config new file mode 100644 index 0000000000..435345404c --- /dev/null +++ b/test/e2e/tools/event-writer/packages.config @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/test/e2e/yaml/windows/install-ebpf-xdp.yaml b/test/e2e/yaml/windows/install-ebpf-xdp.yaml new file mode 100644 index 0000000000..9b43a056a7 --- /dev/null +++ b/test/e2e/yaml/windows/install-ebpf-xdp.yaml @@ -0,0 +1,37 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: install-ebpf-xdp + namespace: install-ebpf-xdp # Ensure this namespace exists +spec: + selector: + matchLabels: + name: install-ebpf-xdp + template: + metadata: + labels: + name: install-ebpf-xdp + spec: + containers: + - name: install-ebpf-xdp-container + image: ghcr.io/microsoft/retina/test/e2e-test-event-writer:latest + imagePullPolicy: Always + command: + - powershell.exe + - -command + - '& .\install-ebpf-xdp.ps1 ; while ($true) { Start-Sleep -Seconds 300; }' + readinessProbe: + exec: + command: + - powershell.exe + - -command + - if (!(Test-Path C:\install-ebpf-xdp-probe-ready)) { exit 1 } + initialDelaySeconds: 10 + periodSeconds: 5 + hostNetwork: true + nodeSelector: + kubernetes.io/os: windows + securityContext: + windowsOptions: + hostProcess: true + runAsUserName: "NT AUTHORITY\\SYSTEM" \ No newline at end of file diff --git a/test/e2e/yaml/windows/non-hpc-pod.yaml b/test/e2e/yaml/windows/non-hpc-pod.yaml new file mode 100644 index 0000000000..1bdcf5dbe6 --- /dev/null +++ b/test/e2e/yaml/windows/non-hpc-pod.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Pod +metadata: + name: non-hpc-pod + labels: + app: non-hpc +spec: + nodeSelector: + "kubernetes.io/os": windows + containers: + - name: non-hpc-container + image: ghcr.io/microsoft/retina/test/e2e-test-event-writer:latest + command: ["powershell", "-Command", "while ($true) { Start-Sleep -Seconds 3600 }"] + securityContext: + windowsOptions: + runAsUserName: "NT AUTHORITY\\SYSTEM" \ No newline at end of file diff --git a/windows/manifests/windows.yaml b/windows/manifests/windows.yaml index 62c78ba49c..8b990aef34 100644 --- a/windows/manifests/windows.yaml +++ b/windows/manifests/windows.yaml @@ -69,5 +69,5 @@ data: host: "0.0.0.0" port: 10093 logLevel: info - enabledPlugin: ["hnsstats"] + enabledPlugin: ["hnsstats","ebpfwindows"] metricsIntervalDuration: "10s"