Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: pcap filter not work as expected #680

Merged
merged 1 commit into from
Dec 4, 2024
Merged

fix: pcap filter not work as expected #680

merged 1 commit into from
Dec 4, 2024

Conversation

yuweizzz
Copy link
Contributor

@yuweizzz yuweizzz commented Dec 4, 2024

The pcap filter now doesn't take effect for packet protocols that are not IP or IPv6, such as ARP.

bin/ecapture gnutls -m pcap -i enp0s3  port 443 and not arp
2024-12-04T14:30:59+08:00 INF AppName="eCapture(旁观者)"
2024-12-04T14:30:59+08:00 INF HomePage=https://ecapture.cc
2024-12-04T14:30:59+08:00 INF Repository=https://github.com/gojue/ecapture
2024-12-04T14:30:59+08:00 INF Author="CFC4N <[email protected]>"
2024-12-04T14:30:59+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-04T14:30:59+08:00 INF Version=linux_amd64:-20241202-b231985:6.1.0-22-amd64
2024-12-04T14:30:59+08:00 INF Listen=localhost:28256
2024-12-04T14:30:59+08:00 INF eCapture running logs logger=
2024-12-04T14:30:59+08:00 INF the file handler that receives the captured event eventCollector=
2024-12-04T14:30:59+08:00 WRN ========== module starting. ==========
2024-12-04T14:30:59+08:00 INF listen=localhost:28256
2024-12-04T14:30:59+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-12-04T14:30:59+08:00 INF Kernel Info=6.1.0 Pid=411712
2024-12-04T14:30:59+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-12-04T14:30:59+08:00 INF GnuTlsProbe init eBPFProgramType=PcapNG model=PcapNG
2024-12-04T14:30:59+08:00 INF module initialization. isReload=false moduleName=EBPFProbeGNUTLS
2024-12-04T14:30:59+08:00 INF Module.Run()
2024-12-04T14:30:59+08:00 INF GnuTLS version found Version=3.7.9
2024-12-04T14:30:59+08:00 INF GnuTLS binary path binaryPath=/lib/x86_64-linux-gnu/libgnutls.so.30 elfType=2
2024-12-04T14:30:59+08:00 INF BPF bytecode loaded bytecode filename=user/bytecode/gnutls_3_7_7_kern_core.o
2024-12-04T14:30:59+08:00 INF Hook type: Gnutls elf ElfType=2 IFindex=2 IFname=enp0s3 PcapFilter="port 443 and not arp" binrayPath=/lib/x86_64-linux-gnu/libgnutls.so.30
2024-12-04T14:30:59+08:00 INF Hook masterKey function: gnutls_handshake
2024-12-04T14:30:59+08:00 INF target all process.
2024-12-04T14:30:59+08:00 INF packets saved into pcapng file. pcapng path=/usr/local/src/ecapture/save.pcapng
2024-12-04T14:30:59+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-04T14:30:59+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-04T14:30:59+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeGNUTLS
2024-12-04T14:31:05+08:00 INF CLIENT_RANDOM save success ClientRandom=c0c59329aaed4a5bcad60c18defab6bbeb9fa741648700fcb0e19cd2b6157549 TlsVersion=GNUTLS_TLS1_2 eBPFProgramType=PcapNG
2024-12-04T14:31:05+08:00 INF packets saved into pcapng file. count=26
2024-12-04T14:31:11+08:00 INF packets saved into pcapng file. count=2 ----- arp packet
2024-12-04T14:31:13+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
2024-12-04T14:31:15+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
2024-12-04T14:31:17+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
^C2024-12-04T14:31:20+08:00 INF packets saved into pcapng file. count=40
curl https://xxx.com
arping x.x.x.x

reason:
In #586, the inject function migrated, not work for all packet anymore.

should fix #673

@Asphaltt
Copy link
Member

Asphaltt commented Dec 4, 2024

Could you please improve commit title and commit message?

@cfc4n cfc4n added 🐞 bug Something isn't working fix bug fix PR labels Dec 4, 2024
kern/tc.h Outdated Show resolved Hide resolved
The pcap filter now doesn't take effect for packet protocols that are not IP or IPv6, such as ARP, because In gojue#586, the inject function migrated, it doesn't not work for all packet anymore.
Copy link
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, Thanks.

@cfc4n cfc4n merged commit 10717d9 into gojue:master Dec 4, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working fix bug fix PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

arp packet found in pcap file on tls -m pcap mode
3 participants