Skip to content

fix: pcap filter not work as expected#680

Merged
cfc4n merged 1 commit into
gojue:masterfrom
yuweizzz:l2
Dec 4, 2024
Merged

fix: pcap filter not work as expected#680
cfc4n merged 1 commit into
gojue:masterfrom
yuweizzz:l2

Conversation

@yuweizzz
Copy link
Copy Markdown
Contributor

@yuweizzz yuweizzz commented Dec 4, 2024

The pcap filter now doesn't take effect for packet protocols that are not IP or IPv6, such as ARP.

bin/ecapture gnutls -m pcap -i enp0s3  port 443 and not arp
2024-12-04T14:30:59+08:00 INF AppName="eCapture(旁观者)"
2024-12-04T14:30:59+08:00 INF HomePage=https://ecapture.cc
2024-12-04T14:30:59+08:00 INF Repository=https://github.com/gojue/ecapture
2024-12-04T14:30:59+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-12-04T14:30:59+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-04T14:30:59+08:00 INF Version=linux_amd64:-20241202-b231985:6.1.0-22-amd64
2024-12-04T14:30:59+08:00 INF Listen=localhost:28256
2024-12-04T14:30:59+08:00 INF eCapture running logs logger=
2024-12-04T14:30:59+08:00 INF the file handler that receives the captured event eventCollector=
2024-12-04T14:30:59+08:00 WRN ========== module starting. ==========
2024-12-04T14:30:59+08:00 INF listen=localhost:28256
2024-12-04T14:30:59+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-12-04T14:30:59+08:00 INF Kernel Info=6.1.0 Pid=411712
2024-12-04T14:30:59+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-12-04T14:30:59+08:00 INF GnuTlsProbe init eBPFProgramType=PcapNG model=PcapNG
2024-12-04T14:30:59+08:00 INF module initialization. isReload=false moduleName=EBPFProbeGNUTLS
2024-12-04T14:30:59+08:00 INF Module.Run()
2024-12-04T14:30:59+08:00 INF GnuTLS version found Version=3.7.9
2024-12-04T14:30:59+08:00 INF GnuTLS binary path binaryPath=/lib/x86_64-linux-gnu/libgnutls.so.30 elfType=2
2024-12-04T14:30:59+08:00 INF BPF bytecode loaded bytecode filename=user/bytecode/gnutls_3_7_7_kern_core.o
2024-12-04T14:30:59+08:00 INF Hook type: Gnutls elf ElfType=2 IFindex=2 IFname=enp0s3 PcapFilter="port 443 and not arp" binrayPath=/lib/x86_64-linux-gnu/libgnutls.so.30
2024-12-04T14:30:59+08:00 INF Hook masterKey function: gnutls_handshake
2024-12-04T14:30:59+08:00 INF target all process.
2024-12-04T14:30:59+08:00 INF packets saved into pcapng file. pcapng path=/usr/local/src/ecapture/save.pcapng
2024-12-04T14:30:59+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-04T14:30:59+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-04T14:30:59+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeGNUTLS
2024-12-04T14:31:05+08:00 INF CLIENT_RANDOM save success ClientRandom=c0c59329aaed4a5bcad60c18defab6bbeb9fa741648700fcb0e19cd2b6157549 TlsVersion=GNUTLS_TLS1_2 eBPFProgramType=PcapNG
2024-12-04T14:31:05+08:00 INF packets saved into pcapng file. count=26
2024-12-04T14:31:11+08:00 INF packets saved into pcapng file. count=2 ----- arp packet
2024-12-04T14:31:13+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
2024-12-04T14:31:15+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
2024-12-04T14:31:17+08:00 INF packets saved into pcapng file. count=4 ----- arp packet
^C2024-12-04T14:31:20+08:00 INF packets saved into pcapng file. count=40
curl https://xxx.com
arping x.x.x.x

reason:
In #586, the inject function migrated, not work for all packet anymore.

should fix #673

@Asphaltt
Copy link
Copy Markdown
Member

Asphaltt commented Dec 4, 2024

Could you please improve commit title and commit message?

@cfc4n cfc4n added 🐞 bug Something isn't working fix bug fix PR labels Dec 4, 2024
Comment thread kern/tc.h Outdated
@yuweizzz yuweizzz force-pushed the l2 branch 2 times, most recently from ca29841 to 85a91d0 Compare December 4, 2024 13:57
The pcap filter now doesn't take effect for packet protocols that are not IP or IPv6, such as ARP, because In gojue#586, the inject function migrated, it doesn't not work for all packet anymore.
Copy link
Copy Markdown
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, Thanks.

@cfc4n cfc4n merged commit 10717d9 into gojue:master Dec 4, 2024
@dosubot dosubot Bot mentioned this pull request May 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🐞 bug Something isn't working fix bug fix PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

arp packet found in pcap file on tls -m pcap mode

3 participants