|
| 1 | +package dnsmanager |
| 2 | + |
| 3 | +import ( |
| 4 | + "net" |
| 5 | + "strings" |
| 6 | + "time" |
| 7 | + |
| 8 | + mapset "github.com/deckarep/golang-set/v2" |
| 9 | + "github.com/goradd/maps" |
| 10 | + containercollection "github.com/inspektor-gadget/inspektor-gadget/pkg/container-collection" |
| 11 | + tracerdnstype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/dns/types" |
| 12 | + "istio.io/pkg/cache" |
| 13 | +) |
| 14 | + |
| 15 | +// DNSManager is used to manage DNS events and save IP resolutions. |
| 16 | +type DNSManager struct { |
| 17 | + addressToDomainMap maps.SafeMap[string, string] |
| 18 | + lookupCache cache.ExpiringCache // Cache for DNS lookups |
| 19 | + failureCache cache.ExpiringCache // Cache for failed lookups |
| 20 | + containerToCloudServices maps.SafeMap[string, mapset.Set[string]] // key: containerId, value: set of cloud services |
| 21 | +} |
| 22 | + |
| 23 | +type cacheEntry struct { |
| 24 | + addresses []string |
| 25 | +} |
| 26 | + |
| 27 | +const ( |
| 28 | + defaultPositiveTTL = 1 * time.Minute // Default TTL for successful lookups |
| 29 | + defaultNegativeTTL = 5 * time.Second // Default TTL for failed lookups |
| 30 | + maxServiceCacheSize = 50 // Maximum number of cloud services to cache per container |
| 31 | +) |
| 32 | + |
| 33 | +var _ DNSManagerClient = (*DNSManager)(nil) |
| 34 | +var _ DNSResolver = (*DNSManager)(nil) |
| 35 | + |
| 36 | +func CreateDNSManager() *DNSManager { |
| 37 | + return &DNSManager{ |
| 38 | + // Create TTL caches with their respective expiration times |
| 39 | + lookupCache: cache.NewTTL(defaultPositiveTTL, defaultPositiveTTL), |
| 40 | + failureCache: cache.NewTTL(defaultNegativeTTL, defaultNegativeTTL), |
| 41 | + } |
| 42 | +} |
| 43 | + |
| 44 | +func (dm *DNSManager) ContainerCallback(notif containercollection.PubSubEvent) { |
| 45 | + switch notif.Type { |
| 46 | + case containercollection.EventTypeAddContainer: |
| 47 | + dm.containerToCloudServices.Set(notif.Container.Runtime.ContainerID, mapset.NewSet[string]()) |
| 48 | + case containercollection.EventTypeRemoveContainer: |
| 49 | + dm.containerToCloudServices.Delete(notif.Container.Runtime.ContainerID) |
| 50 | + } |
| 51 | +} |
| 52 | + |
| 53 | +func (dm *DNSManager) ReportEvent(dnsEvent tracerdnstype.Event) { |
| 54 | + if isCloudService(dnsEvent.DNSName) { |
| 55 | + if dm.containerToCloudServices.Has(dnsEvent.Runtime.ContainerID) { |
| 56 | + // Guard against cache size getting too large by checking the cardinality per container |
| 57 | + if dm.containerToCloudServices.Get(dnsEvent.Runtime.ContainerID).Cardinality() < maxServiceCacheSize { |
| 58 | + dm.containerToCloudServices.Get(dnsEvent.Runtime.ContainerID).Add(dnsEvent.DNSName) |
| 59 | + } |
| 60 | + } |
| 61 | + } |
| 62 | + |
| 63 | + if len(dnsEvent.Addresses) > 0 { |
| 64 | + for _, address := range dnsEvent.Addresses { |
| 65 | + dm.addressToDomainMap.Set(address, dnsEvent.DNSName) |
| 66 | + } |
| 67 | + |
| 68 | + // Update the cache with these known good addresses |
| 69 | + dm.lookupCache.Set(dnsEvent.DNSName, cacheEntry{ |
| 70 | + addresses: dnsEvent.Addresses, |
| 71 | + }) |
| 72 | + return |
| 73 | + } |
| 74 | + |
| 75 | + // Check if we've recently failed to look up this domain |
| 76 | + if _, found := dm.failureCache.Get(dnsEvent.DNSName); found { |
| 77 | + return |
| 78 | + } |
| 79 | + |
| 80 | + // Check if we have a cached result |
| 81 | + if cached, found := dm.lookupCache.Get(dnsEvent.DNSName); found { |
| 82 | + entry := cached.(cacheEntry) |
| 83 | + // Use cached addresses |
| 84 | + for _, addr := range entry.addresses { |
| 85 | + dm.addressToDomainMap.Set(addr, dnsEvent.DNSName) |
| 86 | + } |
| 87 | + return |
| 88 | + } |
| 89 | + |
| 90 | + // Only perform lookup if we don't have cached results |
| 91 | + addresses, err := net.LookupIP(dnsEvent.DNSName) |
| 92 | + if err != nil { |
| 93 | + // Cache the failure - we just need to store something, using empty struct |
| 94 | + dm.failureCache.Set(dnsEvent.DNSName, struct{}{}) |
| 95 | + return |
| 96 | + } |
| 97 | + |
| 98 | + // Convert addresses to strings and store them |
| 99 | + addrStrings := make([]string, 0, len(addresses)) |
| 100 | + for _, addr := range addresses { |
| 101 | + addrStr := addr.String() |
| 102 | + addrStrings = append(addrStrings, addrStr) |
| 103 | + dm.addressToDomainMap.Set(addrStr, dnsEvent.DNSName) |
| 104 | + } |
| 105 | + |
| 106 | + // Cache the successful lookup |
| 107 | + dm.lookupCache.Set(dnsEvent.DNSName, cacheEntry{ |
| 108 | + addresses: addrStrings, |
| 109 | + }) |
| 110 | +} |
| 111 | + |
| 112 | +func (dm *DNSManager) ResolveIPAddress(ipAddr string) (string, bool) { |
| 113 | + domain := dm.addressToDomainMap.Get(ipAddr) |
| 114 | + return domain, domain != "" |
| 115 | +} |
| 116 | + |
| 117 | +func (dm *DNSManager) ResolveContainerToCloudServices(containerId string) mapset.Set[string] { |
| 118 | + if services, found := dm.containerToCloudServices.Load(containerId); found { |
| 119 | + return services |
| 120 | + } |
| 121 | + return nil |
| 122 | +} |
| 123 | + |
| 124 | +func isCloudService(domain string) bool { |
| 125 | + domain = strings.ToLower(domain) |
| 126 | + // Common cloud service domains |
| 127 | + awsDomains := []string{ |
| 128 | + "amazonaws.com.", |
| 129 | + "cloudfront.net.", |
| 130 | + "aws.amazon.com.", |
| 131 | + "elasticbeanstalk.com.", |
| 132 | + } |
| 133 | + |
| 134 | + azureDomains := []string{ |
| 135 | + "azure.com.", |
| 136 | + "azurewebsites.net.", |
| 137 | + "cloudapp.net.", |
| 138 | + "azure-api.net.", |
| 139 | + } |
| 140 | + |
| 141 | + gcpDomains := []string{ |
| 142 | + "googleapis.com.", |
| 143 | + "appspot.com.", |
| 144 | + "cloudfunctions.net.", |
| 145 | + "run.app.", |
| 146 | + } |
| 147 | + |
| 148 | + // Combine all cloud domains |
| 149 | + allCloudDomains := append(awsDomains, azureDomains...) |
| 150 | + allCloudDomains = append(allCloudDomains, gcpDomains...) |
| 151 | + |
| 152 | + // Check if the input domain ends with any of the cloud domains |
| 153 | + for _, cloudDomain := range allCloudDomains { |
| 154 | + if strings.HasSuffix(domain, cloudDomain) { |
| 155 | + return true |
| 156 | + } |
| 157 | + } |
| 158 | + |
| 159 | + return false |
| 160 | +} |
0 commit comments