retis-org / retis

Tracing packets in the Linux networking stack & friends
https://retis.readthedocs.io/en/stable/
100 stars 14 forks source link

module: skb: fix (again) skb hook for old kernels #311

Closed atenart closed 11 months ago

atenart commented 11 months ago

Same as 1bb047ba166b ("module: skb: bpf: fix verifier issue on older kernels") but that had a flaw and was broken by a recent change that fixed it.

Could not find a better way. If not using &= no size check works. This has the downside of limiting the capture size of L3-only packets to 0x7f; but that is not that bad. Many packets headers should be within that limit. Another working solution would be to increase our buffer size to PACKET_CAPTURE_SIZE + sizeof(ethhdr), which allows to capture up to PACKET_CAPTURE_SIZE of data in each case.

Fixes: 3afddf5ef4fa ("module: skb: fix raw packet retrieval for max capture size")