Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Packetbeat] Fix BPF filter setting not being applied to sniffers #35484

Merged
merged 2 commits into from
May 17, 2023

Conversation

taylor-swanson
Copy link
Contributor

@taylor-swanson taylor-swanson commented May 16, 2023

What does this PR do?

  • Ensures that the BPF filter setting is applied to sniffers

Why is it important?

BPF filters were not being applied to pcap and af_packet sniffers and were processing packets that were supposed to be filtered out.

Checklist

  • My code follows the style guidelines of this project
  • [ ] I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

  • Configure packetbeat to sniff an interface with either the pcap or af_packet (Linux only) type and configure a BPF filter. Turning on debug logging will either show packets being handled or the sniffer timing out. If you configured the BPF filter to handle traffic known to not exist, then you should see the sniffer time out. If the BPF filter had not applied properly, then it would be picking other traffic (this is especially the case if you connect to the test host using SSH).

Related issues

@taylor-swanson taylor-swanson self-assigned this May 16, 2023
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 16, 2023
@taylor-swanson taylor-swanson force-pushed the bug/packetbeat-bpf-filter branch from 4d7c95c to 27c6eba Compare May 16, 2023 15:03
@mergify
Copy link
Contributor

mergify bot commented May 16, 2023

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @taylor-swanson? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

- Ensure that the BPF filter setting is applied to sniffers
@taylor-swanson taylor-swanson force-pushed the bug/packetbeat-bpf-filter branch from 27c6eba to 47bb850 Compare May 16, 2023 15:04
@taylor-swanson taylor-swanson added backport-v8.6.0 Automated backport with mergify backport-v8.7.0 Automated backport with mergify backport-v8.8.0 Automated backport with mergify and removed backport-v8.6.0 Automated backport with mergify labels May 16, 2023
@taylor-swanson taylor-swanson marked this pull request as ready for review May 16, 2023 15:43
@taylor-swanson taylor-swanson requested a review from a team as a code owner May 16, 2023 15:43
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Collaborator

elasticmachine commented May 16, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-05-16T15:43:58.816+0000

  • Duration: 51 min 48 sec

Test stats 🧪

Test Results
Failed 0
Passed 1748
Skipped 19
Total 1767

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@taylor-swanson taylor-swanson merged commit fb25982 into elastic:main May 17, 2023
@taylor-swanson taylor-swanson deleted the bug/packetbeat-bpf-filter branch May 17, 2023 12:50
mergify bot pushed a commit that referenced this pull request May 17, 2023
…5484)

- Ensure that the BPF filter setting is applied to sniffers

(cherry picked from commit fb25982)
mergify bot pushed a commit that referenced this pull request May 17, 2023
…5484)

- Ensure that the BPF filter setting is applied to sniffers

(cherry picked from commit fb25982)
taylor-swanson added a commit that referenced this pull request May 17, 2023
…5484) (#35493)

- Ensure that the BPF filter setting is applied to sniffers

(cherry picked from commit fb25982)

Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com>
taylor-swanson added a commit that referenced this pull request May 17, 2023
…applied to sniffers (#35494)

- Ensure that the BPF filter setting is applied to sniffers

(cherry picked from commit fb25982)

---------

Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com>
Co-authored-by: Taylor Swanson <taylor.swanson@elastic.co>
chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023
…5484)

- Ensure that the BPF filter setting is applied to sniffers
@reakaleek reakaleek mentioned this pull request Jul 19, 2023
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-v8.7.0 Automated backport with mergify backport-v8.8.0 Automated backport with mergify bug Packetbeat
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Packetbeat] bpf_filter setting does not work in packetbeat 8.x.
3 participants