TFE增加Policy Hit Intercept的监控指标v4.8.83-20240712

4 files changed, 62 insertions, 16 deletions

diff --git a/ci/travis.sh b/ci/travis.sh
index 63c4264..26071d5 100644
--- a/ci/travis.sh
+++ b/ci/travis.sh
@@ -33,7 +33,7 @@ env | sort
 : "${COMPILER_IS_GNUCXX:=OFF}"
 
 # Install dependency from YUM
-yum install -y mrzcpd numactl-devel zlib-devel librdkafka-devel systemd-devel
+yum install -y mrzcpd numactl-devel zlib-devel librdkafka-devel-1.2.2.1218b3c-1.el8.x86_64 librdkafka-1.2.2.1218b3c-1.el8.x86_64 systemd-devel
 yum install -y libcjson-devel libmaatframe-devel libMESA_field_stat2-devel libfieldstat3-devel libfieldstat4-devel libMESA_handle_logger-devel libelua-devel
 yum install -y libMESA_htable-devel libMESA_prof_load-devel libwiredcfg-devel libWiredLB-devel sapp-devel libbreakpad_mini-devel
 yum install -y libasan
diff --git a/common/include/tfe_packet_io_fs.h b/common/include/tfe_packet_io_fs.h
index 8749517..829383f 100644
--- a/common/include/tfe_packet_io_fs.h
+++ b/common/include/tfe_packet_io_fs.h
@@ -48,6 +48,14 @@ struct packet_io_fs
     uint64_t ctrl_pkt_resetall_num; // 累计值
     uint64_t ctrl_pkt_error_num;    // 累计值
 
+    uint64_t hit_intercept_num;     // 累计值
+    uint64_t hit_no_intercept_num;  // 累计值
+    uint64_t can_intercept_num;     // 累计值
+
+    uint64_t asymmetric_num;        // 累计值
+    uint64_t tunnel_num;            // 累计值
+    uint64_t tcp_pcy_inval_num;     // 累计值
+
     uint64_t session_num;   // 瞬时值
     uint64_t session_log;   // 瞬时值
 
diff --git a/common/src/tfe_packet_io.cpp b/common/src/tfe_packet_io.cpp
index 6d989b1..41bfd02 100644
--- a/common/src/tfe_packet_io.cpp
+++ b/common/src/tfe_packet_io.cpp
@@ -1142,17 +1142,20 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
         set_passthrough_reason(parser->cmsg, reason_invalid_intercept_param);
         goto passthrough;
     }
-    if (parser->intercpet_data == 0) {
-        tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_HIT_NO_INTERCEPT, (unsigned char *)&hit_no_intercept, sizeof(hit_no_intercept), &out_size);
-        if (hit_no_intercept == 1) {
-            is_passthrough = 1;
-            set_passthrough_reason(parser->cmsg, reason_no_intercept_param);
-            goto passthrough;
-        }
+    tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_HIT_NO_INTERCEPT, (unsigned char *)&hit_no_intercept, sizeof(hit_no_intercept), &out_size);
+    if (hit_no_intercept == 1) {
+        is_passthrough = 1;
+        __atomic_fetch_add(&packet_io_fs->hit_no_intercept_num, 1, __ATOMIC_RELAXED);
+        set_passthrough_reason(parser->cmsg, reason_no_intercept_param);
+        goto passthrough;
+    }
+    __atomic_fetch_add(&packet_io_fs->hit_intercept_num, 1, __ATOMIC_RELAXED);
 
+    if (parser->intercpet_data == 0) {
         ret = tcp_policy_enforce(thread->ref_proxy->tcp_ply_enforcer, parser->cmsg);
         if (ret != 0) {
             is_passthrough = 1;
+            __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
             set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
             goto passthrough;
         }
@@ -1166,6 +1169,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
 
         if (overwrite_tcp_mss(parser->cmsg, &restore_info, meta->session_id, logger)) {
             is_passthrough = 1;
+            __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
             set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
             goto passthrough;
         }
@@ -1176,6 +1180,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
         if (fd_upstream < 0) {
             TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(UPSTREAM)", LOG_TAG_PKTIO, meta->session_id);
             is_passthrough = 1;
+            __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
             set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
             goto passthrough;
         }
@@ -1186,6 +1191,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
         {
             TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(DOWNSTREAM)", LOG_TAG_PKTIO, meta->session_id);
             is_passthrough = 1;
+            __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
             set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
             goto passthrough;
         }
@@ -1202,6 +1208,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
             {
                 TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_c)", LOG_TAG_PKTIO, meta->session_id);
                 is_passthrough = 1;
+                __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
                 set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
                 goto passthrough;
             }
@@ -1211,6 +1218,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
             {
                 TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_s)", LOG_TAG_PKTIO, meta->session_id);
                 is_passthrough = 1;
+                __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
                 set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
                 goto passthrough;
             }
@@ -1227,13 +1235,21 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
         {
             TFE_LOG_ERROR(logger, "%s: session %lu Failed at tfe_proxy_fds_accept()", LOG_TAG_PKTIO, meta->session_id);
             is_passthrough = 1;
+            __atomic_fetch_add(&packet_io_fs->tcp_pcy_inval_num, 1, __ATOMIC_RELAXED);
             set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
             goto passthrough;
         }
+        __atomic_fetch_add(&packet_io_fs->can_intercept_num, 1, __ATOMIC_RELAXED);
     }
     else if (parser->intercpet_data & (IS_SINGLE | IS_TUNNEL)) {
         is_passthrough = 1;
         set_passthrough_reason(parser->cmsg, reason_underlying_stream_error);
+        if (parser->intercpet_data & IS_SINGLE) {
+            __atomic_fetch_add(&packet_io_fs->asymmetric_num, 1, __ATOMIC_RELAXED);
+        }
+        else if (parser->intercpet_data & IS_TUNNEL) {
+            __atomic_fetch_add(&packet_io_fs->tunnel_num, 1, __ATOMIC_RELAXED);
+        }
     }
 
 passthrough:
@@ -1357,6 +1373,7 @@ static int handle_control_packet(struct packet_io *handle, marsio_buff_t *rx_buf
     {
         TFE_LOG_ERROR(logger, "%s: unexpected control packet, unable to get metadata\n\tMETA={session_id: %lu, raw_len: %d, is_e2i_dir: %d, is_ctrl_pkt: %d, l7offset: %d, is_decrypted: %u, sids_num: %d}", 
                                 LOG_TAG_PKTIO, meta.session_id, meta.raw_len, meta.is_e2i_dir, meta.is_ctrl_pkt, meta.l7offset, meta.is_decrypted, meta.sids.num);
+        __atomic_fetch_add(&packet_io_fs->ctrl_pkt_error_num, 1, __ATOMIC_RELAXED);
         return -1;
     }
 
@@ -1365,12 +1382,14 @@ static int handle_control_packet(struct packet_io *handle, marsio_buff_t *rx_buf
     if (ctrl_packet_parser_parse(&ctrl_parser, meta.raw_data + meta.l7offset, meta.raw_len - meta.l7offset, logger) == -1)
     {
         TFE_LOG_ERROR(logger, "%s: unexpected control packet, metadata's session %lu unable to parse data", LOG_TAG_PKTIO, meta.session_id);
+        __atomic_fetch_add(&packet_io_fs->ctrl_pkt_error_num, 1, __ATOMIC_RELAXED);
         return -1;
     }
 
     if (ctrl_parser.session_id != meta.session_id)
     {
         TFE_LOG_ERROR(logger, "%s: unexpected control packet, metadata's session %lu != control packet's session %lu", LOG_TAG_PKTIO, meta.session_id, ctrl_parser.session_id);
+        __atomic_fetch_add(&packet_io_fs->ctrl_pkt_error_num, 1, __ATOMIC_RELAXED);
         ctrl_packet_cmsg_destroy(&ctrl_parser);
         return -1;
     }
@@ -1831,9 +1850,6 @@ int packet_io_polling_nf_interface(struct packet_io *handle, int thread_seq, voi
 
         if (is_downstream_keepalive_packet(rx_buff))
         {
-            throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
-            throughput_metrics_inc(&packet_io_fs->raw_pkt_tx, 1, raw_len);
-
             throughput_metrics_inc(&packet_io_fs->keepalived_pkt_rx, 1, raw_len);
             throughput_metrics_inc(&packet_io_fs->keepalived_pkt_tx, 1, raw_len);
 
@@ -1861,9 +1877,6 @@ int packet_io_polling_nf_interface(struct packet_io *handle, int thread_seq, voi
 
         if (marsio_buff_is_ctrlbuf(rx_buff))
         {
-            throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
-            throughput_metrics_inc(&packet_io_fs->raw_pkt_tx, 1, raw_len);
-
             throughput_metrics_inc(&packet_io_fs->ctrl_pkt_rx, 1, raw_len);
             throughput_metrics_inc(&packet_io_fs->ctrl_pkt_tx, 1, raw_len);
             // all control packet need bypass
@@ -1893,8 +1906,6 @@ void handle_decryption_packet_from_tap(const char *data, int len, void *args)
     packet_parse(&pkt, (const char *)data, len);
     packet_get_innermost_tuple4(&pkt, &inner_addr);
 
-    throughput_metrics_inc(&packet_io_fs->decrypt_rx, 1, len);
-
     struct session_node *node = session_table_search_by_addr(thread->session_table, &inner_addr);
     if (node == NULL) {
         if (thread->ref_acceptor_ctx->debug)
diff --git a/common/src/tfe_packet_io_fs.cpp b/common/src/tfe_packet_io_fs.cpp
index 602fac7..0b4ac58 100644
--- a/common/src/tfe_packet_io_fs.cpp
+++ b/common/src/tfe_packet_io_fs.cpp
@@ -8,6 +8,10 @@
 
 enum PACKET_IO_STAT_FIELD
 {
+    STAT_HIT_INTERCEPT_POLICY,
+    STAT_HIT_NO_INTERCEPT_POLICY,
+    STAT_CAN_INTERCEPT,
+
     // dev nf interface
     STAT_RAW_PKT_RX_PKT,
     STAT_RAW_PKT_RX_B,
@@ -45,6 +49,10 @@ enum PACKET_IO_STAT_FIELD
     STAT_TAP_S_TX_PKT,
     STAT_TAP_S_TX_B,
 
+    STAT_ASYMMETRIC_NUM,
+    STAT_TUNNEL_NUM,
+    STAT_TCP_PCY_INVAL_NUM,
+
     // keepalived packet
     STAT_KEEPALIVED_RX_PKT,
     STAT_KEEPALIVED_RX_B,
@@ -72,6 +80,13 @@ enum PACKET_IO_STAT_FIELD
 
 static const char *stat_map[] =
 {
+    // hit policy intercept
+    [STAT_HIT_INTERCEPT_POLICY] = "hit_incpt",
+    // hit policy no intercept
+    [STAT_HIT_NO_INTERCEPT_POLICY] = "hit_no_incpt",
+
+    [STAT_CAN_INTERCEPT] = "can_incpt",
+
     // dev nf interface
     [STAT_RAW_PKT_RX_PKT] = "raw_rx_pkt",
     [STAT_RAW_PKT_RX_B] = "raw_rx_B",
@@ -113,6 +128,10 @@ static const char *stat_map[] =
     [STAT_TAP_S_TX_PKT] = "tap_s_tx_pkt",
     [STAT_TAP_S_TX_B] = "tap_s_tx_B",
 
+    [STAT_ASYMMETRIC_NUM] = "asymmetric",
+    [STAT_TUNNEL_NUM] = "tunnel",
+    [STAT_TCP_PCY_INVAL_NUM] = "tcp_pcy_inval",
+
     // keepalived packet
     [STAT_KEEPALIVED_RX_PKT] = "keep_rx_pkt",
     [STAT_KEEPALIVED_RX_B] = "keep_rx_B",
@@ -181,6 +200,10 @@ void packet_io_fs_dump(struct packet_io_fs *handle)
     if (handle == NULL)
         return;
 
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_HIT_INTERCEPT_POLICY], 0, FS_OP_SET, __atomic_fetch_add(&(handle->hit_intercept_num), 0, __ATOMIC_RELAXED));
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_HIT_NO_INTERCEPT_POLICY], 0, FS_OP_SET, __atomic_fetch_add(&(handle->hit_no_intercept_num), 0, __ATOMIC_RELAXED));
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_CAN_INTERCEPT], 0, FS_OP_SET, __atomic_fetch_add(&(handle->can_intercept_num), 0, __ATOMIC_RELAXED));
+
     FS_operate(handle->fs_handle, handle->fs_id[STAT_RAW_PKT_RX_PKT], 0, FS_OP_SET, __atomic_fetch_add(&(handle->raw_pkt_rx.n_pkts), 0, __ATOMIC_RELAXED));
     FS_operate(handle->fs_handle, handle->fs_id[STAT_RAW_PKT_RX_B], 0, FS_OP_SET, __atomic_fetch_add(&(handle->raw_pkt_rx.n_bytes), 0, __ATOMIC_RELAXED));
     FS_operate(handle->fs_handle, handle->fs_id[STAT_RAW_PKT_TX_PKT], 0, FS_OP_SET, __atomic_fetch_add(&(handle->raw_pkt_tx.n_pkts), 0, __ATOMIC_RELAXED));
@@ -217,6 +240,10 @@ void packet_io_fs_dump(struct packet_io_fs *handle)
     FS_operate(handle->fs_handle, handle->fs_id[STAT_TAP_S_TX_PKT], 0, FS_OP_SET, __atomic_fetch_add(&(handle->tap_s_pkt_tx.n_pkts), 0, __ATOMIC_RELAXED));
     FS_operate(handle->fs_handle, handle->fs_id[STAT_TAP_S_TX_B], 0, FS_OP_SET, __atomic_fetch_add(&(handle->tap_s_pkt_tx.n_bytes), 0, __ATOMIC_RELAXED));
 
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_ASYMMETRIC_NUM], 0, FS_OP_SET, __atomic_fetch_add(&(handle->asymmetric_num), 0, __ATOMIC_RELAXED));
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_TUNNEL_NUM], 0, FS_OP_SET, __atomic_fetch_add(&(handle->tunnel_num), 0, __ATOMIC_RELAXED));
+    FS_operate(handle->fs_handle, handle->fs_id[STAT_TCP_PCY_INVAL_NUM], 0, FS_OP_SET, __atomic_fetch_add(&(handle->tcp_pcy_inval_num), 0, __ATOMIC_RELAXED));
+
     // keepalived packet
     FS_operate(handle->fs_handle, handle->fs_id[STAT_KEEPALIVED_RX_PKT], 0, FS_OP_SET, __atomic_fetch_add(&(handle->keepalived_pkt_rx.n_pkts), 0, __ATOMIC_RELAXED));
     FS_operate(handle->fs_handle, handle->fs_id[STAT_KEEPALIVED_RX_B], 0, FS_OP_SET, __atomic_fetch_add(&(handle->keepalived_pkt_rx.n_bytes), 0, __ATOMIC_RELAXED));