code_public/ja4-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: maximize data completeness across L3/L4/TLS/HTTP layers and add E2E test infra

Browse Source 
Add SSL_write uprobe for HTTP response capture, HPACK decoder for HTTP/2
header extraction, and AcceptCache for reliable SSL/TC session correlation.
Populate all ClickHouse fields including tcp_meta_options, ip_meta_total_length,
syn_to_clienthello_ms, client_headers, TLS cipher suites/extensions, and
h2_enable_connect_protocol. Increase BPF capture buffers (HTTP 512B, TLS 1024B).
Add distributed E2E testing infrastructure with multi-VM Vagrant setup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-15 03:34:33 +02:00
parent e25caa85da
commit a02423fd18
4 changed files with 386 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/ja4ebpf/bpf/tc_capture.c
View File

@ -153,6 +153,7 @@ int capture_tc(struct __sk_buff *ctx)
evt.ttl = ttl;
evt.df_bit = df_bit;
evt.ip_id = ip_id;
evt.ip_total_length = bpf_ntohs(iph.tot_len);
evt.window_size = window;
evt.window_scale = 0xFF;
evt.mss = 0;
@ -218,17 +219,17 @@ int capture_tc(struct __sk_buff *ctx)
/* Copie via bpf_skb_load_bytes avec tailles constantes en cascade.
* Kernel 4.18 ne supporte pas les tailles variables vers map values.
* On essaie 512 puis 256 puis 128 pour capturer SNI et extensions.
* On essaie 1024 puis 512 puis 256 pour capturer SNI et extensions.
* La taille réellement copiée est stockée dans payload_len. */
if (payload_off + 512 <= pkt_len) {
if (payload_off + 1024 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, tls_evt, 1024);
tls_evt->payload_len = 1024;
} else if (payload_off + 512 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, tls_evt, 512);
tls_evt->payload_len = 512;
} else if (payload_off + 256 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, tls_evt, 256);
tls_evt->payload_len = 256;
} else if (payload_off + 128 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, tls_evt, 128);
tls_evt->payload_len = 128;
} else {
return TC_ACT_OK;
}
@ -281,16 +282,16 @@ int capture_tc(struct __sk_buff *ctx)
h_evt->timestamp_ns = bpf_ktime_get_ns();
/* Copie via bpf_skb_load_bytes avec tailles constantes en cascade.
* Les requêtes HTTP sont souvent < 256 octets, on descend à 128 puis 64. */
if (payload_off + 256 <= pkt_len) {
* Les requêtes HTTP sont souvent < 512 octets, on descend à 256 puis 128. */
if (payload_off + 512 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, h_evt, 512);
h_evt->payload_len = 512;
} else if (payload_off + 256 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, h_evt, 256);
h_evt->payload_len = 256;
} else if (payload_off + 128 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, h_evt, 128);
h_evt->payload_len = 128;
} else if (payload_off + 64 <= pkt_len) {
bpf_skb_load_bytes(ctx, payload_off, h_evt, 64);
h_evt->payload_len = 64;
} else {
return TC_ACT_OK;
}