user: fixed #542, masterkey being written to pcapng multiple times. (#…

…546) Signed-off-by: CFC4N <[email protected]>
gojue · May 19, 2024 · 11a498a · 11a498a
1 parent 5e666ac
commit 11a498a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/user/module/probe_openssl.go b/user/module/probe_openssl.go
@@ -388,7 +388,7 @@ func (m *MOpenSSLProbe) saveMasterSecret(secretEvent *event.MasterSecretEvent) {
  }
 
  // save to file
- var b *bytes.Buffer
+ var b = bytes.NewBuffer(nil)
  switch secretEvent.Version {
  case event.Tls12Version:
  length := event.MasterSecretMaxLen
@@ -636,7 +636,6 @@ func (m *MOpenSSLProbe) Dispatcher(eventStruct event.IEventStruct) {
  case *event.SSLDataEvent:
  m.dumpSslData(eventStruct.(*event.SSLDataEvent))
  }
- m.logger.Debug().Msg("Dispatcher eventStruct")
 }
 
 func (m *MOpenSSLProbe) dumpSslData(eventStruct *event.SSLDataEvent) {

diff --git a/user/module/probe_pcap.go b/user/module/probe_pcap.go
@@ -97,7 +97,7 @@ func (t *MTCProbe) dumpTcSkb(tcEvent *event.TcSkbEvent) error {
  err, p := t.writePid(tcEvent)
  if err == nil {
  payload = p
- t.logger.Debug().Uint32("pid", tcEvent.Pid).Str("comm", fmt.Sprintf("%s", tcEvent.Comm)).Str("cmdline", fmt.Sprintf("%s", tcEvent.Cmdline)).Msg("dumpTcSkb")
+ //t.logger.Debug().Uint32("pid", tcEvent.Pid).Str("comm", fmt.Sprintf("%s", tcEvent.Comm)).Str("cmdline", fmt.Sprintf("%s", tcEvent.Cmdline)).Msg("dumpTcSkb")
  }
  }
  return t.writePacket(uint32(len(payload)), time.Unix(0, int64(timeStamp)), payload)
@@ -153,6 +153,9 @@ func (t *MTCProbe) savePcapng() (i int, err error) {
  if err != nil {
  return
  }
+
+ // reset master key buffer, fix issue #542
+ t.masterKeyBuffer.Reset()
  t.tcPacketLocker.Lock()
  defer func() {
  t.tcPacketLocker.Unlock()