2 Commits

Author	SHA1	Message	Date
Jacquin Antoine	24306ef390	feat(ja4ebpf): add SSL_write uprobe, HPACK decoder, and AcceptCache for session correlation ... Add uprobe_ssl_write_entry/uretprobe_ssl_write_exit to capture server HTTP responses via SSL_write with direction=1. Implement full HPACK decoder (RFC 7541 static table, multi-byte integers, literal representations) for HTTP/2 header extraction. Add AcceptCache mapping {tgid,fd}→SessionKey from accept4 events as authoritative source for SSL correlation when BPF ssl_conn_map has src_ip=0. Add ip_total_length to tcp_syn_event BPF struct. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-15 03:34:43 +02:00
toto	a1e4c1dad5	feat: add ja4ebpf service — eBPF-based TLS/TCP fingerprinting daemon ... - TC ingress hook captures TCP SYN (L3/L4) and TLS ClientHello - Uprobes on SSL_read/SSL_set_fd capture decrypted TLS data - Kprobes on accept4 correlate socket FDs to client IP:port - JA4 fingerprint computed from parsed TLS ClientHello - HTTP/2 SETTINGS and WINDOW_UPDATE extracted from decrypted streams - Session manager with sharded map (256 shards) and GC goroutine - Slowloris detection: sessions with no requests after 10s threshold - ClickHouse batch writer to ja4_logs.http_logs_raw (raw_json) - All tests pass: 17 parser + 10 correlation tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-11 22:43:26 +02:00