fix: resolve IP-based destinations to FQDN via HTTP headers

[mayankpande88]

Summary

• HTTP Host header resolution: When DNS capture fails (Go goroutine migration breaks pid-based eBPF tracking), use HTTP/1.1 Host header and HTTP/2 :authority pseudo-header to resolve IP-based DestinationKeys to FQDNs. Migrates both the key and connectionStats map entries, and populates ip_to_fqdn for future connections.
• eBPF dport extraction: Extract destination port from connect() sockaddr arguments so non-TCP connections (UDP DNS on port 53) get proper dport in active_connections, enabling DNS protocol detection.
• HTTP/2 :authority capture: Add Authority field to Http2Request struct and capture :authority pseudo-header during HPACK decoding.

Root Cause

61% of HTTP traffic had unresolved destination IPs because:

1. Go goroutines migrate between OS threads between connect() and write()/read(), breaking pid-based eBPF tracking of DNS requests
2. UDP DNS sockets had dport=0 in active_connections because sys_exit_connect didn't extract port from sockaddr
3. Only 2 out of 76 containers produced DNS metrics (C-based programs like nginx that don't exhibit goroutine migration)

Changed Files

File	Change
common/net.go	Add WithResolvedDomain() to create FQDN-based DestinationKey
containers/container.go	Add migrateConnectionKeyToFQDN(), resolve via Host/:authority headers
ebpftracer/ebpf/tcp/state.c	Extract dport from connect() sockaddr, add dport to struct connection
ebpftracer/l7/http2.go	Capture :authority pseudo-header in HTTP/2 parser
ebpftracer/ebpf.go	Regenerated eBPF bytecode (all 10 kernel/arch variants)

Test plan

• Deploy to staging cluster and verify ip_to_fqdn metric populates for previously unresolved IPs
• Verify destination_workload_name in HTTP/TCP metrics shows FQDNs instead of raw IPs for external destinations
• Verify DNS metrics appear for Go-based services (not just C-based ones)
• Verify no regression in existing connection tracking

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the accuracy of network traffic visibility by addressing challenges in resolving IP-based destinations to FQDNs. It introduces robust mechanisms to leverage HTTP headers for FQDN identification when DNS-based tracking is insufficient, and refines eBPF data collection to ensure correct destination port information for various protocols. These changes aim to provide a more complete and accurate picture of network connections, particularly for Go-based services that previously suffered from unresolved destination IPs.

Highlights

• HTTP Host Header Resolution: Implemented logic to resolve IP-based DestinationKeys to Fully Qualified Domain Names (FQDNs) using HTTP/1.1 Host headers and HTTP/2 :authority pseudo-headers, especially when traditional DNS capture fails. This includes migrating connection keys and associated statistics.
• eBPF Destination Port Extraction: Enhanced eBPF tracing to correctly extract the destination port from connect() sockaddr arguments for non-TCP connections (e.g., UDP DNS), ensuring accurate dport population in active_connections and enabling proper DNS protocol detection.
• HTTP/2 :authority Header Capture: Added functionality to capture the :authority pseudo-header during HTTP/2 HPACK decoding and included it in the Http2Request struct, facilitating FQDN resolution for HTTP/2 traffic.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• common/net.go
  • Added a new WithResolvedDomain() method to the DestinationKey struct to facilitate creating FQDN-based keys.
• containers/container.go
  • Imported the net package.
  • Added helper functions isIPAddress() and stripPort() for network address manipulation.
  • Introduced migrateConnectionKeyToFQDN() to update connection keys and migrate associated statistics when an FQDN is resolved.
  • Modified onL7Request() to incorporate FQDN resolution from the DNS cache and to use HTTP Host and HTTP/2 :authority headers for resolving IP-based DestinationKeys.
• ebpftracer/Dockerfile
  • Duplicated the FROM alpine:3.14 instruction.
• ebpftracer/ebpf/l7/http.c
  • Replaced bpf_probe_read_str with bpf_probe_read for HTTP request and response detection.
  • Implemented is_http_response_partial() to handle and detect incomplete HTTP responses.
• ebpftracer/ebpf/l7/http2.c
  • Defined a bpf_read macro for simplified eBPF probe reads.
  • Added is_http2_response_partial() to manage and identify partial HTTP/2 responses.
• ebpftracer/ebpf/l7/l7.c
  • Modified the COPY_PAYLOAD macro to include a size check before reading.
  • Introduced init_l7_event() to optimize the initialization of L7 event structures.
  • Refactored trace_enter_write() to include a fast path for common protocols and ensure protocol detection only occurs if the protocol is PROTOCOL_UNKNOWN.
  • Updated trace_exit_read() to use init_l7_event() and to handle partial HTTP and HTTP/2 responses by integrating the new partial response detection functions.
• ebpftracer/ebpf/tcp/state.c
  • Added protocol and dport fields to the struct connection.
  • Defined struct connect_args and connect_args_by_pid_tgid map to temporarily store connection arguments.
  • Modified sys_enter_connect() to extract the destination port from the sockaddr argument and store it.
  • Updated sys_exit_connect() to retrieve the stored destination port and populate it for non-TCP connections.
• ebpftracer/l7/http2.go
  • Added an Authority field to the Http2Request struct.
  • Modified the Parse method to capture the :authority pseudo-header during HTTP/2 frame processing.
• ebpftracer/tracer.go
  • Reduced the l7_events perf map buffer size and adjusted WakeupEvents for improved performance.
  • Added isValidHTTPData() and isResponseTruncated() functions for validating HTTP payload and response data.
  • Implemented payload size validation and sanity checks for indices within runEventsReader().
  • Integrated isValidHTTPData() for HTTP payloads and isResponseTruncated() for HTTP/HTTP2 responses to filter out garbage or incomplete data.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a mechanism to resolve IP-based destinations to FQDNs using HTTP Host and :authority headers, serving as a fallback when DNS capture fails, and includes eBPF optimizations for non-TCP connections. However, it introduces a high-severity Denial of Service (DoS) vulnerability due to cardinality explosion from using attacker-controlled HTTP headers for metric labels. Additionally, there's a critical bug in how DestinationKey is updated, leading to data loss, and the FQDN resolution for HTTP/2 traffic doesn't update the global cache. Further concerns include eBPF performance issues, potential verifier failures from large unrolled loops, and a medium-severity information leak in eBPF event buffers. A minor Dockerfile issue and a suggestion for code clarity were also noted.