wido opened a new pull request, #13767:
URL: https://github.com/apache/cloudstack/pull/13767
# Description
Adds root-admin-only APIs to capture the traffic of an Instance NIC on the
KVM host it is running on, for debugging and lawful interception:
* enablePacketCapture nicid=<uuid>
* disablePacketCapture nicid=<uuid>
* getPacketCaptureStatus nicid=<uuid>
Packet capture is a flag on the NIC (stored as a nic detail). When enabled,
the agent resolves the host-side tap device by MAC address, writes the NIC
context (VM name/UUID, NIC UUID/MAC, IPv4/IPv6, bridge, network UUID) to
/run/cloudstack/pcap-<dev>.env and starts the systemd template unit
cloudstack-pcap@<dev>.service. The flag follows the Instance: a VM state
listener restarts the capture after start and migration, and BindsTo= on the
tap device stops the unit when the VM stops, migrates away or the NIC is
unplugged.
The unit executes pcap-capture.sh, shipped between the other KVM scripts in
/usr/share/cloudstack-common as an example that runs tcpdump writing to /tmp
with 256 MB rotation. What to capture and what to do with the data differs too
much per environment for CloudStack to decide it, so operators run their own
script by copying the unit, pointing its ExecStart at it and naming their unit
in packet.capture.service.
New agent.properties keys:
- packet.capture.service (systemd template unit name)
- packet.capture.env.dir (environment file directory)
This is in no way a "fits all" solution as capturing traffic will really
differ per environment. I thought about storing it on Secondary Storage, but
that would add so many different API calls and logic to CloudStack while in
most cases every admin wants to do this differently. Therefor I have choosen
this option.
Admins can override the packet capture script with a version that suits
their environment.
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [x] Minor
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
