Skip to content

Commit

Permalink
packetbeat/beater: deduplicate interface configs (#36576)
Browse files Browse the repository at this point in the history
When a config is provided by fleet, it will contain multiple definitions
of the same interface, and in future we may allow individual datastreams
to specify their own interface, so allow multiple distinct interfaces,
but ensure that no interfaces have the same configuration by removing
duplicates.
  • Loading branch information
efd6 authored Sep 21, 2023
1 parent deef7ce commit edc9851
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 3 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]

*Packetbeat*

- Improve efficiency of sniffers by deduplicating interface configurations. {issue}36574[36574] {pull}36576[36576]

*Winlogbeat*

Expand Down
23 changes: 20 additions & 3 deletions packetbeat/beater/processor.go
Original file line number Diff line number Diff line change
Expand Up @@ -220,14 +220,31 @@ func setupSniffer(id string, cfg config.Config, protocols *protos.ProtocolsStruc
return nil, err
}

for i, iface := range cfg.Interfaces {
// Ensure interfaces are uniquely represented so we don't listen on the
// same interface with multiple sniffers.
interfaces := make([]config.InterfaceConfig, 0, len(cfg.Interfaces))
seen := make(map[uint64]bool)
for _, iface := range cfg.Interfaces {
// Currently we hash on all fields in the config. We can revise this in future.
h, err := hashstructure.Hash(iface, nil)
if err != nil {
return nil, fmt.Errorf("could not deduplicate interface configurations: %w", err)
}
if seen[h] {
continue
}
seen[h] = true
interfaces = append(interfaces, iface)
}

for i, iface := range interfaces {
if iface.BpfFilter != "" || cfg.Flows.IsEnabled() {
continue
}
cfg.Interfaces[i].BpfFilter = protocols.BpfFilter(iface.WithVlans, icmp.Enabled())
interfaces[i].BpfFilter = protocols.BpfFilter(iface.WithVlans, icmp.Enabled())
}

return sniffer.New(id, false, "", decoders, cfg.Interfaces)
return sniffer.New(id, false, "", decoders, interfaces)
}

// CheckConfig performs a dry-run creation of a Packetbeat pipeline based
Expand Down

0 comments on commit edc9851

Please sign in to comment.