feat(ebpf): add Apache httpd HTTP capture via kretprobe recvfrom

- Add uprobe_apache.c with kretprobe on __x64_sys_recvfrom for Apache HTTP capture
- Update loader.go to support unified "servers" configuration instead of separate nginx_bin_path/apache_enabled
- Add consumeApacheHTTPEvents() function to process Apache HTTP events
- Update bpf_types.h to add Apache-specific BPF maps and structs
- Fix perf event array value_size for pb_apache_http (must be sizeof(__u32) not struct size)
- Add NGINX_APACHE_GUIDE.md documentation for HTTP capture from both servers

Validation results:
- nginx HTTP capture:  Working (57 headers captured, no truncation)
- Apache HTTP capture: ⚠️ Under investigation (kretprobe not triggering on CentOS 8 kernel 4.18)

Configuration:
- JA4EBPF_UPROBES_ENABLED=true
- JA4EBPF_UPROBES_SERVERS=nginx,apache (or "both")

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-20 14:11:56 +02:00
parent cba1cca180
commit a2e0cfa2f3
5 changed files with 342 additions and 88 deletions

View File

@ -1289,9 +1289,6 @@ func attachApacheUprobesWithRetry(ctx context.Context, l *loader.Loader, cfg *Co
retryInterval := time.Duration(cfg.Uprobes.RetryIntervalSec) * time.Second
maxRetries := cfg.Uprobes.MaxRetries
retryInterval := time.Duration(cfg.Uprobes.RetryIntervalSec) * time.Second
log.Printf("[uprobes] tentative d'attachement Apache httpd tracepoints (max_retries=%d, interval=%v)",
maxRetries, retryInterval)
@ -1554,4 +1551,3 @@ func consumeApacheHTTPEvents(ctx context.Context, rd *perf.Reader, mgr *correlat
pidTgid>>32, fd, httpMethod, uri, len(req.HeaderOrder))
}
}
}