feat(ebpf): add nginx HTTP capture infrastructure via kretprobe recvfrom

Add supporting infrastructure for nginx HTTP capture using kretprobe
on __x64_sys_recvfrom to replace the blocked tracepoint sys_exit_recvfrom.

Changes:
- bpf/bpf_types.h: Add nginx_pid_map for filtering recvfrom by PID
- cmd/ja4ebpf/main.go: Add Uprobes configuration section
- Makefile: Add test targets for recvfrom validation
- internal/loader: Generate nginx HTTP event structures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-20 13:30:41 +02:00
parent bb2160efbc
commit 382683710a
5 changed files with 336 additions and 56 deletions

View File

@ -28,6 +28,15 @@ test:
## docker-build: Alias combiné generate + build
docker-build: build
## test-recvfrom-vm: Teste les alternatives recvfrom sur VM Rocky 9
test-recvfrom-vm:
@bash scripts/test-vm-recvfrom.sh rocky9
## test-recvfrom-docker: Teste les alternatives recvfrom dans Docker
test-recvfrom-docker:
@docker build -f Dockerfile.test-recvfrom -t ja4-recvfrom-test ../../
@docker run --rm --privileged ja4-recvfrom-test
## help: Affiche cette aide
help:
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \