mozillazg / ptcpdump

73%

LAST BUILD ON BRANCH master

branch: master

CHANGE BRANCH

x

Reset

• master
• add-more-tests
• add-prefix
• backend-tp-btf
• coverage
• dependabot/go_modules/golang.org/x/net-0.38.0
• disable-reverse-match
• dynamic-link
• expression-file
• file-size
• fix-tcp-parse
• fix-timestamp-drift
• ignore-optinal-hooks-error
• improve-ifname
• improve-rotate
• more-socket-cookie
• mozillazg-patch-1
• output-http
• output-tls
• read-stdin
• renovate/all-github-action
• renovate/all-go-deps-master
• renovate/busybox-latest
• renovate/go-github.com-containerd-containerd-vulnerability
• renovate/go-github.com-docker-docker-vulnerability
• renovate/golang-1.23.7-bookworm
• renovate/golang-1.23.x
• renovate/golang-1.24.4-bookworm
• renovate/golang-1.24.5-bookworm
• renovate/golang-1.24.6-bookworm
• renovate/golang-1.24.x
• renovate/golang-1.x
• renovate/major-5-all-github-action
• renovate/migrate-config
• renovate/patch-all-github-action
• renovate/patch-all-go-deps-master
• renovate/patch-all-lvh-images-main
• renovate/quay.io-ptcpdump-develop-20250411.x
• renovate/quay.io-ptcpdump-develop-20250614.x
• renovate/quay.io-ptcpdump-develop-20250809.x
• socket-filter-backend
• support-arm32
• support-clone-process
• tttt
• unknown-event

Build # 17528012028

Build Type

push

github

Committed by web-flow

Commit Message

fix(bpf): Correctly parse IP headers with options (#337)

* feat(bpf): Improve PID attribution and IP parsing

This commit introduces several improvements to the eBPF probe to enhance robustness and feature completeness.

- feat: Add fallback for PID attribution
  Uses `bpf_get_current_task()` as a fallback mechanism to resolve the process ID for a packet. This significantly improves PID attribution for scenarios where the primary flow-based mapping might fail, such as with short-lived connections. Includes a check for kernel support to ensure backward compatibility.

- fix: Correctly parse IP headers with options
  The IP header length is now dynamically calculated based on the IHL (Internet Header Length) field. This fixes a bug where packets with IP options would be parsed incorrectly, leading to errors in L4 (TCP/UDP) header analysis.

- chore: Clean up debug logs
  Commented out several `debug_log` statements to reduce noise and performance overhead.

* refactor(bpf): Remove unsafe PID fallback

Removes the PID fallback mechanism that uses bpf_get_current_task().
This is unsafe without a reliable way to detect interrupt context (e.g., bpf_in_interrupt()),
as it can lead to incorrect PID association.
The explanatory comment is updated to reflect this.

Run Details

4907 of 6690 relevant lines covered (73.35%)

0.82 hits per line