github.com/elfadel/cilium@v1.6.12/pkg/proxy/accesslog/record.go (about) 1 // Copyright 2016-2018 Authors of Cilium 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package accesslog 16 17 import ( 18 "net" 19 "net/http" 20 "net/url" 21 ) 22 23 // FlowType is the type to indicate the flow direction 24 type FlowType string 25 26 const ( 27 // TypeRequest is a request message 28 TypeRequest FlowType = "Request" 29 30 // TypeResponse is a response to a request 31 TypeResponse FlowType = "Response" 32 33 // TypeSample is a packet sample 34 TypeSample FlowType = "Sample" 35 ) 36 37 // FlowVerdict is the verdict passed on the flow 38 type FlowVerdict string 39 40 const ( 41 // VerdictForwarded indicates that the flow was forwarded 42 VerdictForwarded FlowVerdict = "Forwarded" 43 44 // VerdictDenied indicates that the flow was denied 45 VerdictDenied = "Denied" 46 47 // VerdictError indicates that there was an error processing the flow 48 VerdictError = "Error" 49 ) 50 51 // ObservationPoint is the type used to describe point of observation 52 type ObservationPoint string 53 54 const ( 55 // Ingress indicates event was generated at ingress 56 Ingress ObservationPoint = "Ingress" 57 58 // Egress indicates event was generated at egress 59 Egress ObservationPoint = "Egress" 60 ) 61 62 // IPVersion indicates the flow's IP version 63 type IPVersion uint8 64 65 const ( 66 // VersionIPv4 indicates IPv4 67 VersionIPv4 IPVersion = iota 68 // VersionIPV6 indicates IPv6 69 VersionIPV6 70 ) 71 72 // EndpointInfo contains information about the sending (resp. receiving) endpoint. 73 // If the field using this struct is SourceEndpoint, all fields correspond to 74 // the sending endpoint, if the field using this struct is DestinationEndpoint, 75 // then all fields correspond to the receiving endpoint. 76 type EndpointInfo struct { 77 // ID is the endpoint id 78 ID uint64 79 80 // IPv4 is the IPv4 address of the endpoint 81 IPv4 string 82 83 // IPv6 is the IPv6 address of the endpoint 84 IPv6 string 85 86 // Port represents the source point for SourceEndpoint and the 87 // destination port for DestinationEndpoint 88 Port uint16 89 90 // Identity is the security identity of the endpoint 91 Identity uint64 92 93 // Labels is the list of security relevant labels of the endpoint 94 Labels []string 95 96 // LabelsSHA256 is the hex encoded SHA-256 signature over the Labels 97 // slice, 64 characters in length 98 LabelsSHA256 string 99 } 100 101 // ServiceInfo contains information about the Kubernetes service 102 type ServiceInfo struct { 103 // Name specifies the name of the service 104 Name string 105 106 // IPPort is the IP and transport port of the service 107 IPPort IPPort 108 } 109 110 // FlowEvent identifies the event type of an L4 log record 111 type FlowEvent string 112 113 const ( 114 // FlowAdded means that this is a new flow 115 FlowAdded FlowEvent = "FlowAdded" 116 117 // FlowRemoved means that a flow has been deleted 118 FlowRemoved FlowEvent = "FlowRemoved" 119 ) 120 121 // DropReason indicates the reason why the flow was dropped 122 type DropReason uint16 123 124 // TransportProtocol defines layer 4 protocols 125 type TransportProtocol uint16 126 127 // NodeAddressInfo holds addressing information of the node the agent runs on 128 type NodeAddressInfo struct { 129 IPv4 string 130 IPv6 string 131 } 132 133 // IPPort bundles an IP address and port number 134 type IPPort struct { 135 IP string 136 Port uint16 137 } 138 139 // LogRecord is the structure used to log individual request/response 140 // processing events or sampled packets 141 type LogRecord struct { 142 // Type is the type of the flow 143 Type FlowType 144 145 // Timestamp is the start of a request, the end of a response, or the time the packet has been sampled, 146 // depending on the flow type 147 Timestamp string 148 149 // NodeAddressInfo contains the IPs of the node where the event was generated 150 NodeAddressInfo NodeAddressInfo 151 152 // ObservationPoint indicates where the flow was observed 153 ObservationPoint ObservationPoint 154 155 // SourceEndpoint is information about the source endpoint, if available 156 SourceEndpoint EndpointInfo 157 158 // DestinationEndpoint is information about the destination endpoint, if available 159 DestinationEndpoint EndpointInfo 160 161 // IPVersion indicates the version of the IP protocol in use 162 IPVersion IPVersion 163 164 // Verdict is the verdict on the flow taken 165 Verdict FlowVerdict 166 167 // Info includes information about the rule that matched or the error 168 // that occurred 169 Info string 170 171 // Metadata is additional arbitrary metadata 172 Metadata []string 173 174 // TransportProtocol identifies the flow's transport layer (layer 4) protocol 175 TransportProtocol TransportProtocol 176 177 // FlowEvent identifies the flow event for L4 log record 178 FlowEvent FlowEvent 179 180 // ServiceInfo identifies the Kubernetes service this flow went through. It is set to 181 // nil if the flow did not go though any service. Note that this field is always set to 182 // nil if ObservationPoint is Ingress since currently Cilium cannot tell at ingress 183 // whether the packet went through a service before. 184 ServiceInfo *ServiceInfo 185 186 // DropReason indicates the reason of the drop. This field is set if and only if 187 // the Verdict field is set to VerdictDenied. Otherwise it's set to nil. 188 DropReason *DropReason 189 190 // The following are the protocol specific parts. Only one of the 191 // following should ever be set. Unused fields will be omitted 192 193 // HTTP contains information for HTTP request/responses 194 HTTP *LogRecordHTTP `json:"HTTP,omitempty"` 195 196 // Kafka contains information for Kafka request/responses 197 Kafka *LogRecordKafka `json:"Kafka,omitempty"` 198 199 // DNS contains information for DNS request/responses 200 DNS *LogRecordDNS `json:"DNS,omitempty"` 201 202 // L7 contains information about generic L7 protocols 203 L7 *LogRecordL7 `json:"L7,omitempty"` 204 } 205 206 // LogRecordHTTP contains the HTTP specific portion of a log record 207 type LogRecordHTTP struct { 208 // Code is the HTTP code being returned 209 Code int 210 211 // Method is the method of the request 212 Method string 213 214 // URL is the URL of the request 215 URL *url.URL 216 217 // Protocol is the HTTP protocol in use 218 Protocol string 219 220 // Headers are all HTTP headers present in the request 221 Headers http.Header 222 } 223 224 // KafkaTopic contains the topic for requests 225 type KafkaTopic struct { 226 Topic string `json:"Topic,omitempty"` 227 } 228 229 // LogRecordKafka contains the Kafka-specific portion of a log record 230 type LogRecordKafka struct { 231 // ErrorCode is the Kafka error code being returned 232 ErrorCode int 233 234 // APIVersion of the Kafka api used 235 APIVersion int16 236 237 // APIKey for Kafka message 238 // Reference: https://kafka.apache.org/protocol#protocol_api_keys 239 APIKey string 240 241 // CorrelationID is a user-supplied integer value that will be passed 242 // back with the response 243 CorrelationID int32 244 245 // Topic of the request, currently is a single topic 246 // Note that this string can be empty since not all messages use 247 // Topic. example: LeaveGroup, Heartbeat 248 Topic KafkaTopic 249 } 250 251 type DNSDataSource string 252 253 const ( 254 // DNSSourceAgentPoller indicates that the DNS record was created by a poll 255 // from cilium-agent. 256 DNSSourceAgentPoller DNSDataSource = "agent-poller" 257 258 // DNSSourceProxy indicates that the DNS record was created by a proxy 259 // intercepting a DNS request/response. 260 DNSSourceProxy DNSDataSource = "proxy" 261 ) 262 263 // LogRecordDNS contains the DNS specific portion of a log record 264 type LogRecordDNS struct { 265 // Query is the name in the original query 266 Query string `json:"Query,omitempty"` 267 268 // IPs are any IPs seen in this response. 269 // This field is filled only for DNS responses with IPs. 270 IPs []net.IP `json:"IPs,omitempty"` 271 272 // TTL is the lowest applicable TTL for this data 273 // This field is filled only for DNS responses. 274 TTL uint32 `json:"TTL,omitempty"` 275 276 // CNAMEs are any CNAME records seen in the response leading from Query 277 // to the IPs. 278 // This field is filled only for DNS responses with CNAMEs to IP data. 279 CNAMEs []string `json:"CNAMEs,omitempty"` 280 281 // ObservationSource represents the source of the data in this LogRecordDNS. 282 // Empty or undefined may indicate older cilium versions, as it is expected 283 // to be filled in. 284 ObservationSource DNSDataSource `json:"ObservationSource,omitempty"` 285 286 // RCode is the response code 287 // defined as per https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6 288 // Use github.com/miekg/dns.RcodeToString map to retrieve string representation 289 RCode int `json:"RCode,omitempty"` 290 291 // QTypes are question types in DNS message 292 // https://www.ietf.org/rfc/rfc1035.txt 293 // Use github.com/miekg/dns.TypeToString map to retrieve string representation 294 QTypes []uint16 `json:"QTypes,omitempty"` 295 296 // AnswerTypes are record types in the answer section 297 // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 298 // Use github.com/miekg/dns.TypeToString map to retrieve string representation 299 AnswerTypes []uint16 `json:"AnswerTypes,omitempty"` 300 } 301 302 // LogRecordL7 contains the generic L7 portion of a log record 303 type LogRecordL7 struct { 304 // Proto is the name of the protocol this record represents 305 Proto string `json:"Proto,omitempty"` 306 307 // Fields is a map of key-value pairs describing the protocol 308 Fields map[string]string 309 }