kazusa
/
skywalking
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support to analysis the ztunnel mTLS security policy (#12656)

This commit is contained in:
mrproliu 2024-09-27 16:09:40 +08:00 committed by GitHub
parent 29c1b8b457
commit 88f38a41e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 32 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apm-protocol/apm-network/src/main/proto

@ -1 +1 @@
Subproject commit 4f3b17e1b0b3c3dcc0e1ed3da86efaac785ea157
Subproject commit 5be4278b70f61423b481c17af9caa808e178eec3

2
docs/en/changes/changes.md
View File

@ -69,7 +69,7 @@
* Fix query `getGlobalTopology` throw exception when didn't find any services by the given Layer.
* Fix the previous analysis result missing in the ALS `k8s-mesh` analyzer.
* Fix `findEndpoint` query requires `keyword` when using BanyanDB.
* Support to analysis the ztunnel mapped IP address in eBPF Access Log Receiver.
* Support to analysis the ztunnel mapped IP address and mTLS mode in eBPF Access Log Receiver.
* Adapt BanyanDB Java Client 0.7.0.
* Add SkyWalking Java Agent self observability dashboard.
* Add Component ID(5022) for the GoFrame framework.

50
oap-server/server-receiver-plugin/skywalking-ebpf-receiver-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/ebpf/provider/handler/AccessLogServiceHandler.java
View File

@ -46,6 +46,7 @@ import org.apache.skywalking.apm.network.ebpf.accesslog.v3.EBPFTimestamp;
import org.apache.skywalking.apm.network.ebpf.accesslog.v3.IPAddress;
import org.apache.skywalking.apm.network.ebpf.accesslog.v3.KubernetesProcessAddress;
import org.apache.skywalking.apm.network.ebpf.accesslog.v3.ZTunnelAttachmentEnvironment;
import org.apache.skywalking.apm.network.ebpf.accesslog.v3.ZTunnelAttachmentSecurityPolicy;
import org.apache.skywalking.library.kubernetes.ObjectID;
import org.apache.skywalking.oap.meter.analyzer.k8s.K8sInfoRegistry;
import org.apache.skywalking.oap.server.core.Const;
@ -530,6 +531,34 @@ public class AccessLogServiceHandler extends EBPFAccessLogServiceGrpc.EBPFAccess
.build();
}
protected int buildConnectionComponentId(ConnectionInfo connectionInfo) {
final AccessLogConnection originalConnection = connectionInfo.getOriginalConnection();
if (originalConnection.hasAttachment() && originalConnection.getAttachment().hasZTunnel() &&
ZTunnelAttachmentSecurityPolicy.MTLS.equals(originalConnection.getAttachment().getZTunnel().getSecurityPolicy())) {
return 142; // mTLS
}
return buildProtocolComponentID(connectionInfo);
}
protected int buildProtocolComponentID(ConnectionInfo connectionInfo) {
boolean isTLS = connectionInfo.getTlsMode() == AccessLogConnectionTLSMode.TLS;
switch (connectionInfo.getProtocolType()) {
case HTTP_1:
case HTTP_2:
if (isTLS) {
return 129; // https
}
return 49; // http
case TCP:
if (isTLS) {
return 130; // tls
}
return 110; // tcp
}
return 0;
}
@Getter
public class ConnectionInfo {
private final AccessLogConnection originalConnection;
private final NamingControl namingControl;
@ -539,7 +568,6 @@ public class AccessLogServiceHandler extends EBPFAccessLogServiceGrpc.EBPFAccess
private final AccessLogConnectionTLSMode tlsMode;
private final AccessLogProtocolType protocolType;
private final NodeInfo nodeInfo;
@Getter
private final boolean valid;
public ConnectionInfo(NamingControl namingControl, NodeInfo nodeInfo, AccessLogConnection connection) {
@ -623,7 +651,7 @@ public class AccessLogServiceHandler extends EBPFAccessLogServiceGrpc.EBPFAccess
serviceRelation.setSourceLayer(Layer.K8S_SERVICE);
serviceRelation.setDetectPoint(parseToSourceRole());
serviceRelation.setComponentId(buildComponentId());
serviceRelation.setComponentId(buildConnectionComponentId(this));
serviceRelation.setTlsMode(tlsMode);
serviceRelation.setDestServiceName(destServiceName);
@ -682,24 +710,6 @@ public class AccessLogServiceHandler extends EBPFAccessLogServiceGrpc.EBPFAccess
return endpoint;
}
public int buildComponentId() {
boolean isTLS = tlsMode == AccessLogConnectionTLSMode.TLS;
switch (protocolType) {
case HTTP_1:
case HTTP_2:
if (isTLS) {
return 129; // https
}
return 49; // http
case TCP:
if (isTLS) {
return 130; // tls
}
return 110; // tcp
}
return 0;
}
public org.apache.skywalking.oap.server.core.source.DetectPoint parseToSourceRole() {
switch (role) {
case server: