Merge branch 'main' into upgrade-grpc-go

collector/kernel/buffered_poller.cc

@@ -414,7 +414,7 @@ void BufferedPoller::handle_dns_message(message_metadata const &metadata, jb_age
 
     send_a_aaaa_response = 1;
     // truncate hostname */
-    sent_hostname_len = (hostname_len < MAX_ENCODED_DOMAIN_NAME) ? (u16)hostname_len : MAX_ENCODED_DOMAIN_NAME;
+    sent_hostname_len = (hostname_len < DNS_NAME_MAX_LENGTH) ? (u16)hostname_len : DNS_NAME_MAX_LENGTH;
     sent_hostname = hostname_out + hostname_len - sent_hostname_len;
   }
 
@@ -534,7 +534,7 @@ void BufferedPoller::timeout_dns_request(u64 timestamp_ns, const DnsRequests::Re
     const char *hostname_out = req->first.name.c_str();
     size_t hostname_len = req->first.name.size();
 
-    u16 sent_hostname_len = (hostname_len < MAX_ENCODED_DOMAIN_NAME) ? (u16)hostname_len : MAX_ENCODED_DOMAIN_NAME;
+    u16 sent_hostname_len = (hostname_len < DNS_NAME_MAX_LENGTH) ? (u16)hostname_len : DNS_NAME_MAX_LENGTH;
 
     const char *sent_hostname = hostname_out + hostname_len - sent_hostname_len;
 

collector/kernel/dns/dns.h

@@ -12,13 +12,11 @@ extern "C" {
 #endif /* __cplusplus */
 
 #define DNS_NAME_MAX_LENGTH 256
-
-#define MAX_ENCODED_DOMAIN_NAME 80
 #define MAX_ENCODED_IP_ADDRS 16
 
 #define MAX_ENCODED_DNS_MESSAGE                                                                                                \
   (/* timestamp */ sizeof(u64) + /* jb message */ jb_ingest__dns_response__data_size +                                         \
-   /* ip addrs */ (sizeof(u32) * MAX_ENCODED_IP_ADDRS) + /* DNS name */ MAX_ENCODED_DOMAIN_NAME)
+   /* ip addrs */ (sizeof(u32) * MAX_ENCODED_IP_ADDRS) + /* DNS name */ DNS_NAME_MAX_LENGTH)
 
 int dns_name_length(const unsigned char *encoded, const unsigned char *abuf, int alen);
 

dev/devbox/source/k8s/modify.sh

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 function print_help {
-  echo "usage: $0 [--ebfp-net|--otel-demo] <YAML_FILE>"
+  echo "usage: $0 [--ebpf-net|--otel-demo] <YAML_FILE>"
   echo "  --ebpf-net: modify previously deployed OpenTelementry eBPF component(s)"
   echo "  --ebpf-net-local-helm-chart | -C: use local helm chart to modify OpenTelementry eBPF component(s)"
   echo "                                    (default is to use public splunk-otel-collector-chart/splunk-otel-collector)"

docs/dns-and-http.md

@@ -10,7 +10,7 @@ This document describes how DNS collection and enrichment works.
 
 #### Kernel space
 
-Collector's eBFP code gathers DNS data by hooking into kernel UDP send functions \(for reference, see where `perf_check_and_submit_dns` function is called from\). Captured UDP send buffer data \(`skb->data`\) are relayed to the user space through perf ring messages. The maximum captured UDP data size is limited to 512 bytes \(maximum DNS UDP packet message size specified in the RFC\). We currently do not support DNS over HTTP.
+Collector's eBPF code gathers DNS data by hooking into kernel UDP send functions \(for reference, see where `perf_check_and_submit_dns` function is called from\). Captured UDP send buffer data \(`skb->data`\) are relayed to the user space through perf ring messages. The maximum captured UDP data size is limited to 512 bytes \(maximum DNS UDP packet message size specified in the RFC\). We currently do not support DNS over HTTP.
 
 #### User space
 

reducer/dns_cache.h

@@ -17,7 +17,7 @@ namespace reducer {
 namespace dns {
 struct hash_ipv6_address;
 struct eq_ipv6_address;
-static constexpr u32 max_len = 80;
+static constexpr u32 max_len = 256;
 typedef short_string<max_len> dns_record;
 } // namespace dns
 

render/ebpf_net.render

@@ -1041,7 +1041,7 @@ app ingest {
       description "DNS A/AAAA record query response, with name, response address(es), and latency information"
       severity 0
       1: u32 sk_id
-      2: u16 total_dn_len                 // Total length of domain name without truncation (MAX_ENCODED_DOMAIN_NAME)
+      2: u16 total_dn_len                 // Total length of domain name without truncation (DNS_NAME_MAX_LENGTH)
       3: string domain_name               // Domain name being queried (possibly truncated)
       4: string ipv4_addrs                // IPv4 addresses corresponding to domain name 'dn'
       5: string ipv6_addrs                // IPv6 addresses corresponding to domain name 'dn'
@@ -1051,7 +1051,7 @@ app ingest {
       description "A DNS A/AAAA record request timeout"
       severity 0
       1: u32 sk_id
-      2: u16 total_dn_len                 // Total length of domain name without truncation (MAX_ENCODED_DOMAIN_NAME)
+      2: u16 total_dn_len                 // Total length of domain name without truncation (DNS_NAME_MAX_LENGTH)
       3: string domain_name               // Domain name being queried (possibly truncated)
       4: u64 timeout_ns                   // Timeout duration for request (in ns)
     }
@@ -1065,7 +1065,7 @@ app ingest {
       description "DNS A/AAAA record query response, with name, response address(es), and latency information, with direction"
       severity 0
       1: u32 sk_id
-      2: u16 total_dn_len                 // Total length of domain name without truncation (MAX_ENCODED_DOMAIN_NAME)
+      2: u16 total_dn_len                 // Total length of domain name without truncation (DNS_NAME_MAX_LENGTH)
       3: string domain_name               // Domain name being queried (possibly truncated)
       4: string ipv4_addrs                // IPv4 addresses corresponding to domain name 'dn'
       5: string ipv6_addrs                // IPv6 addresses corresponding to domain name 'dn'
@@ -1329,7 +1329,7 @@ app matching {
     pool_size 4800000
     proxy aggregation.agg_root shard_by (role1, az1, role2, az2)
     string<80> role1
-    string<80> role2
+    string<256> role2
     string<32> az1
     string<32> az2
   }
@@ -1429,7 +1429,7 @@ app aggregation {
   span role {
     pool_size 70000
     index (s, version, env, ns, node_type, process, container)
-    string<80> s
+    string<256> s
     string<80> uid
     string<64> version
     string<32> env