Implementation of XDP support

[huseyinsaatci]

Implementation of XDP support for issue #208.

[bobrik]

I updated the PR to make it match the rest of the repo a bit better.

The biggest change is the example, where consolidated multiple metrics into one, added IPv6 support and made it's cardinality lower by not including actual addresses.

Here's how the metric loos like now:

# HELP ebpf_exporter_xdp_incoming_packets_total Incoming packets going through xdp by protocol and port
# TYPE ebpf_exporter_xdp_incoming_packets_total counter
ebpf_exporter_xdp_incoming_packets_total{dst_port="0",ip="ipv4",protocol="icmp"} 5
ebpf_exporter_xdp_incoming_packets_total{dst_port="53",ip="ipv4",protocol="udp"} 3
ebpf_exporter_xdp_incoming_packets_total{dst_port="9435",ip="ipv4",protocol="tcp"} 3
ebpf_exporter_xdp_incoming_packets_total{dst_port="9435",ip="ipv6",protocol="tcp"} 7

Let me know if it looks good to you.

[huseyinsaatci]

It seems all great but I just have one question.
If I define a SEC part that has one invalid interface before the others like SEC("xdp/enp8s0,asdsd,lo"), the others won't be attached because of the early error. In this scenario, enp8s0 and lo are valid, enp8s0 will be attached but lo won't be because of the invalid one asdsd. Would not it be better if we solved this problem and attach all valid interfaces?

[bobrik]

That's a good concern.

I think we shouldn't allow attaching to multiple interfaces in one SEC, because it makes xdp special.

For any other program we would export a metric like this when it fails to attach:

# HELP ebpf_exporter_ebpf_program_attached Whether a program is attached
# TYPE ebpf_exporter_ebpf_program_attached gauge
ebpf_exporter_ebpf_program_attached{id="329"} 0

# HELP ebpf_exporter_ebpf_program_info Info about ebpf programs
# TYPE ebpf_exporter_ebpf_program_info gauge
ebpf_exporter_ebpf_program_info{config="something",id="329",program="trace_something",tag="bd45628e0edfd896"} 1

For xdp we can have partial failures and that's not great.

I added a commit to only allow a single interface in SEC("xdp"). This way a user can have multiple SECs:

SEC("xdp/lo")
int trace_lo(struct xdp_md *ctx) {
    return xdp_trace(ctx);
}

SEC("xdp/lol")
int trace_lol(struct xdp_md *ctx) {
    return xdp_trace(ctx);
}

And they will know which one of them fails to attach, if any:

# HELP ebpf_exporter_ebpf_program_attached Whether a program is attached
# TYPE ebpf_exporter_ebpf_program_attached gauge
ebpf_exporter_ebpf_program_attached{id="329"} 1
ebpf_exporter_ebpf_program_attached{id="330"} 0

# HELP ebpf_exporter_ebpf_program_info Info about ebpf programs
# TYPE ebpf_exporter_ebpf_program_info gauge
ebpf_exporter_ebpf_program_info{config="xdp",id="329",program="trace_lo",tag="bd45628e0edfd896"} 1
ebpf_exporter_ebpf_program_info{config="xdp",id="330",program="trace_eth0",tag="bd45628e0edfd896"} 0

It's less concise, but it's consistent with how other things work.

Does this make sense?

[huseyinsaatci]

It's clearer to separate interfaces when I think it this way. It seems all good, we can roll it out.