From 85bfcddb3ff50550ba0445d95a82394df4c71bdd Mon Sep 17 00:00:00 2001 From: Tom Wilkie Date: Sun, 6 Sep 2015 16:26:57 +0000 Subject: [PATCH] Prevent short lived connections appearing as pseudo nodes in the applications view. --- probe/endpoint/reporter.go | 32 ++++++++++++++++++++++---------- render/mapping.go | 13 ++++++++++--- 2 files changed, 32 insertions(+), 13 deletions(-) diff --git a/probe/endpoint/reporter.go b/probe/endpoint/reporter.go index bd71224b7..81d4b78ec 100644 --- a/probe/endpoint/reporter.go +++ b/probe/endpoint/reporter.go @@ -14,8 +14,9 @@ import ( // Node metadata keys. const ( - Addr = "addr" // typically IPv4 - Port = "port" + Addr = "addr" // typically IPv4 + Port = "port" + Conntracked = "conntracked" ) // Reporter generates Reports containing the Endpoint topology. @@ -102,18 +103,27 @@ func (r *Reporter) Report() (report.Report, error) { localAddr = conn.LocalAddress.String() remoteAddr = conn.RemoteAddress.String() ) - r.addConnection(&rpt, localAddr, remoteAddr, localPort, remotePort, &conn.Proc) + extraNodeInfo := report.MakeNode() + if conn.Proc.PID > 0 { + extraNodeInfo = extraNodeInfo.WithMetadata(report.Metadata{ + process.PID: strconv.FormatUint(uint64(conn.Proc.PID), 10), + }) + } + r.addConnection(&rpt, localAddr, remoteAddr, localPort, remotePort, &extraNodeInfo, nil) } if r.conntracker != nil { + extraNodeInfo := report.MakeNode().WithMetadata(report.Metadata{ + Conntracked: "true", + }) r.conntracker.WalkFlows(func(f Flow) { var ( - localPort = f.Original.Layer4.SrcPort - remotePort = f.Original.Layer4.DstPort + localPort = uint16(f.Original.Layer4.SrcPort) + remotePort = uint16(f.Original.Layer4.DstPort) localAddr = f.Original.Layer3.SrcIP remoteAddr = f.Original.Layer3.DstIP ) - r.addConnection(&rpt, localAddr, remoteAddr, uint16(localPort), uint16(remotePort), nil) + r.addConnection(&rpt, localAddr, remoteAddr, localPort, remotePort, &extraNodeInfo, &extraNodeInfo) }) } @@ -124,7 +134,7 @@ func (r *Reporter) Report() (report.Report, error) { return rpt, err } -func (r *Reporter) addConnection(rpt *report.Report, localAddr, remoteAddr string, localPort, remotePort uint16, proc *procspy.Proc) { +func (r *Reporter) addConnection(rpt *report.Report, localAddr, remoteAddr string, localPort, remotePort uint16, extraLocalNode, extraRemoteNode *report.Node) { var ( localIsClient = int(localPort) > int(remotePort) hostNodeID = report.MakeHostNodeID(r.hostID) @@ -188,10 +198,12 @@ func (r *Reporter) addConnection(rpt *report.Report, localAddr, remoteAddr strin }) } - if proc != nil && proc.PID > 0 { - localNode.Metadata[process.PID] = strconv.FormatUint(uint64(proc.PID), 10) + if extraLocalNode != nil { + localNode = localNode.Merge(*extraLocalNode) + } + if extraRemoteNode != nil { + remoteNode = remoteNode.Merge(*extraRemoteNode) } - rpt.Endpoint = rpt.Endpoint.WithNode(localEndpointNodeID, localNode) rpt.Endpoint = rpt.Endpoint.WithNode(remoteEndpointNodeID, remoteNode) } diff --git a/render/mapping.go b/render/mapping.go index 6945abdc7..366a34bab 100644 --- a/render/mapping.go +++ b/render/mapping.go @@ -45,9 +45,16 @@ func MapEndpointIdentity(m RenderableNode, local report.Networks) RenderableNode return RenderableNodes{} } + // We need to filter out short lived connections from this view, + // if they don't also have a pid; see #447 + pid, pidOK := m.Metadata[process.PID] + _, conntracked := m.Metadata[endpoint.Conntracked] + if !pidOK && conntracked { + return RenderableNodes{} + } + // Nodes without a hostid are treated as psuedo nodes - _, ok = m.Metadata[report.HostNodeID] - if !ok { + if _, ok = m.Metadata[report.HostNodeID]; !ok { // If the dstNodeAddr is not in a network local to this report, we emit an // internet node if ip := net.ParseIP(addr); ip != nil && !local.Contains(ip) { @@ -80,7 +87,7 @@ func MapEndpointIdentity(m RenderableNode, local report.Networks) RenderableNode rank = major ) - if pid, ok := m.Metadata[process.PID]; ok { + if pidOK { minor = fmt.Sprintf("%s (%s)", minor, pid) }