fix: tests intégration matrix — procps-ng, varnish h2, hitch ALPN, pgrep→ps
- Ajout de procps-ng dans les 4 Dockerfiles runtime (ps/pgrep disponibles) - Remplacement de pgrep par ps -C dans tous les run-tests.sh - Correction entrypoint nginx-varnish : pgrep nginx → cat nginx.pid (exit 127) - Activation HTTP/2 dans Varnish : ajout de -p feature=+http2 dans les entrypoints nginx-varnish et hitch-varnish - Restauration ALPN h2,http/1.1 dans hitch.conf (varnish supporte maintenant h2) - Correction healthcheck hitch-varnish : curl sans --http1.1 (h2 fonctionnel) - Correction requêtes phase_verify : http_logs_raw → http_logs, colonnes correctes - Correction writer clickhouse.go : noms JSON alignés avec la MV (ip_meta_*, tls_sni…) - Fix toStartOfSecond(DateTime) → toStartOfSecond(toDateTime64(col, 3)) - Retrait du SKIP el8/nginx-varnish (varnish s'installe bien sur AlmaLinux 8) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
toto
@ -7,6 +7,7 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/ClickHouse/clickhouse-go/v2"
|
||||
@ -24,34 +25,41 @@ type ClickHouseWriter struct {
|
||||
}
|
||||
|
||||
// sessionRecord est la représentation JSON d'une session pour http_logs_raw.
|
||||
// Les noms de champs JSON correspondent exactement aux clés attendues par le MV mv_http_logs.
|
||||
type sessionRecord struct {
|
||||
Timestamp time.Time `json:"timestamp"`
|
||||
SrcIP string `json:"src_ip"`
|
||||
SrcPort int `json:"src_port"`
|
||||
Correlated int `json:"correlated"`
|
||||
Time time.Time `json:"time"`
|
||||
SrcIP string `json:"src_ip"`
|
||||
SrcPort int `json:"src_port"`
|
||||
DstIP string `json:"dst_ip"`
|
||||
DstPort int `json:"dst_port"`
|
||||
Correlated int `json:"correlated"`
|
||||
|
||||
// L3/L4
|
||||
TTL *uint8 `json:"ttl,omitempty"`
|
||||
DFBit *bool `json:"df_bit,omitempty"`
|
||||
IPID *uint16 `json:"ip_id,omitempty"`
|
||||
WindowSize *uint16 `json:"window_size,omitempty"`
|
||||
WindowScale *uint8 `json:"window_scale,omitempty"`
|
||||
MSS *uint16 `json:"mss,omitempty"`
|
||||
// Métadonnées IP (noms attendus par le MV)
|
||||
IPMetaDF *bool `json:"ip_meta_df,omitempty"`
|
||||
IPMetaID *uint16 `json:"ip_meta_id,omitempty"`
|
||||
IPMetaTTL *uint8 `json:"ip_meta_ttl,omitempty"`
|
||||
IPMetaTotalLength *uint16 `json:"ip_meta_total_length,omitempty"`
|
||||
|
||||
// TLS
|
||||
JA4Hash string `json:"ja4,omitempty"`
|
||||
SNI string `json:"sni,omitempty"`
|
||||
ALPN []string `json:"alpn,omitempty"`
|
||||
TLSVersion *uint16 `json:"tls_version,omitempty"`
|
||||
// Métadonnées TCP (noms attendus par le MV)
|
||||
TCPMetaWindowSize *uint16 `json:"tcp_meta_window_size,omitempty"`
|
||||
TCPMetaWindowScale *uint8 `json:"tcp_meta_window_scale,omitempty"`
|
||||
TCPMetaMSS *uint16 `json:"tcp_meta_mss,omitempty"`
|
||||
TCPMetaOptions string `json:"tcp_meta_options,omitempty"`
|
||||
|
||||
// TLS (noms attendus par le MV)
|
||||
JA4Hash string `json:"ja4,omitempty"`
|
||||
TLSSNI string `json:"tls_sni,omitempty"`
|
||||
TLSALPN string `json:"tls_alpn,omitempty"`
|
||||
TLSVersion string `json:"tls_version,omitempty"`
|
||||
|
||||
// HTTP
|
||||
Method string `json:"method,omitempty"`
|
||||
Path string `json:"path,omitempty"`
|
||||
QueryString string `json:"query_string,omitempty"`
|
||||
StatusCode *int `json:"status_code,omitempty"`
|
||||
ResponseSize *int64 `json:"response_size,omitempty"`
|
||||
Method string `json:"method,omitempty"`
|
||||
Path string `json:"path,omitempty"`
|
||||
QueryString string `json:"query_string,omitempty"`
|
||||
StatusCode *int `json:"status_code,omitempty"`
|
||||
ResponseSize *int64 `json:"response_size,omitempty"`
|
||||
DurationMS *float64 `json:"duration_ms,omitempty"`
|
||||
KeepAlives int `json:"keepalives,omitempty"`
|
||||
KeepAlives int `json:"keepalives,omitempty"`
|
||||
}
|
||||
|
||||
// NewClickHouseWriter crée un writer et établit la connexion ClickHouse.
|
||||
@ -179,41 +187,59 @@ func sessionToRecord(s *correlation.SessionState) sessionRecord {
|
||||
}
|
||||
|
||||
rec := sessionRecord{
|
||||
Timestamp: s.FirstSeen,
|
||||
Time: s.FirstSeen,
|
||||
SrcIP: srcIP,
|
||||
SrcPort: int(s.Key.SrcPort),
|
||||
DstIP: "0.0.0.0", // destination non capturée par les sondes eBPF actuelles
|
||||
DstPort: 0,
|
||||
Correlated: correlated,
|
||||
KeepAlives: len(s.Requests),
|
||||
}
|
||||
|
||||
// Champs L3/L4
|
||||
// Champs métadonnées IP/TCP
|
||||
if s.L3L4 != nil {
|
||||
rec.TTL = &s.L3L4.TTL
|
||||
rec.DFBit = &s.L3L4.DFBit
|
||||
rec.IPID = &s.L3L4.IPID
|
||||
rec.WindowSize = &s.L3L4.WindowSize
|
||||
rec.WindowScale = &s.L3L4.WindowScale
|
||||
rec.MSS = &s.L3L4.MSS
|
||||
rec.IPMetaDF = &s.L3L4.DFBit
|
||||
rec.IPMetaID = &s.L3L4.IPID
|
||||
rec.IPMetaTTL = &s.L3L4.TTL
|
||||
rec.TCPMetaWindowSize = &s.L3L4.WindowSize
|
||||
rec.TCPMetaWindowScale = &s.L3L4.WindowScale
|
||||
rec.TCPMetaMSS = &s.L3L4.MSS
|
||||
}
|
||||
|
||||
// Champs TLS
|
||||
if s.TLS != nil {
|
||||
rec.JA4Hash = s.TLS.JA4Hash
|
||||
rec.SNI = s.TLS.SNI
|
||||
rec.ALPN = s.TLS.ALPN
|
||||
rec.TLSVersion = &s.TLS.TLSVersion
|
||||
rec.TLSSNI = s.TLS.SNI
|
||||
rec.TLSALPN = strings.Join(s.TLS.ALPN, ",")
|
||||
rec.TLSVersion = formatTLSVersion(s.TLS.TLSVersion)
|
||||
}
|
||||
|
||||
// Champs HTTP (dernière requête)
|
||||
if len(s.Requests) > 0 {
|
||||
last := &s.Requests[len(s.Requests)-1]
|
||||
rec.Method = last.Method
|
||||
rec.Path = last.Path
|
||||
rec.QueryString = last.QueryString
|
||||
rec.StatusCode = &last.StatusCode
|
||||
rec.Method = last.Method
|
||||
rec.Path = last.Path
|
||||
rec.QueryString = last.QueryString
|
||||
rec.StatusCode = &last.StatusCode
|
||||
rec.ResponseSize = &last.ResponseSize
|
||||
rec.DurationMS = &last.DurationMS
|
||||
rec.DurationMS = &last.DurationMS
|
||||
}
|
||||
|
||||
return rec
|
||||
}
|
||||
|
||||
// formatTLSVersion convertit la valeur numérique TLS en chaîne lisible.
|
||||
func formatTLSVersion(v uint16) string {
|
||||
switch v {
|
||||
case 0x0301:
|
||||
return "TLSv1.0"
|
||||
case 0x0302:
|
||||
return "TLSv1.1"
|
||||
case 0x0303:
|
||||
return "TLSv1.2"
|
||||
case 0x0304:
|
||||
return "TLSv1.3"
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user