2 Commits

Author	SHA1	Message	Date
Jacquin Antoine	a2e0cfa2f3	feat(ebpf): add Apache httpd HTTP capture via kretprobe recvfrom ... - Add uprobe_apache.c with kretprobe on __x64_sys_recvfrom for Apache HTTP capture - Update loader.go to support unified "servers" configuration instead of separate nginx_bin_path/apache_enabled - Add consumeApacheHTTPEvents() function to process Apache HTTP events - Update bpf_types.h to add Apache-specific BPF maps and structs - Fix perf event array value_size for pb_apache_http (must be sizeof(__u32) not struct size) - Add NGINX_APACHE_GUIDE.md documentation for HTTP capture from both servers Validation results: - nginx HTTP capture: ✅ Working (57 headers captured, no truncation) - Apache HTTP capture: ⚠️ Under investigation (kretprobe not triggering on CentOS 8 kernel 4.18) Configuration: - JA4EBPF_UPROBES_ENABLED=true - JA4EBPF_UPROBES_SERVERS=nginx,apache (or "both") Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-20 14:11:56 +02:00
Jacquin Antoine	7dfe640003	feat(ebpf): add Apache httpd HTTP capture via read() syscall ... Add support for capturing HTTP traffic from Apache httpd using tracepoint/kretprobe on read() syscall. Changes: - bpf/uprobe_apache.c: New BPF program for Apache httpd capture - Uses tp/syscalls/sys_enter_read to save arguments - Uses kretprobe/__x64_sys_read to capture data (avoids tracepoint exit issues) - bpf/bpf_types.h: Add Apache-specific structures and maps - struct apache_http_event (same structure as nginx_http_event) - struct read_args (shared between enter/exit) - apache_pid_map for filtering by PID - apache_read_args_map for argument storage - pb_apache_http perf buffer - internal/loader/loader.go: Add Apache support - Add Ja4ApacheObjects, apachePidMap, ApacheHTTPReader - Add go:generate directive for uprobe_apache.c - Add AttachUprobesApache(), AddApachePid(), RemoveApachePid() - Add findApachePIDs() to discover Apache httpd processes - cmd/ja4ebpf/main.go: Add Apache runtime support - Add ApacheEnabled config option - Add attachApacheUprobesWithRetry() with automatic retry - Add consumeApacheHTTPEvents() to process Apache HTTP events - Add apache counter to eventCounters - Update debugStatsDumper to show apache events Configuration: - Enable with: uprobes.apache_enabled=true or JA4EBPF_APACHE_ENABLED=1 - Automatically discovers httpd/apache2 processes via /proc/[pid]/cmdline Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-20 13:38:58 +02:00