85d3b95b7b
Complete implementation of HTTP/2 passive fingerprinting per thesis §2.5.3: mod-reqin-log (C module): - Replace connection-level filter with ap_hook_process_connection (APR_HOOK_FIRST) to capture H2 preface before mod_http2 takes over the connection - AP_MODE_SPECULATIVE read of 512 bytes from c->input_filters - Parse SETTINGS, WINDOW_UPDATE, PRIORITY flags, pseudo-header order - Output individual SETTINGS params as separate JSON fields (IDs 1-6, 8) - Read H2 notes from c1 (master connection) for mod_http2 secondary conns - Fix header_order_signature JSON length bug (26→strlen) ClickHouse schema: - Add 8 new columns to http_logs: h2_has_priority, h2_header_table_size, h2_enable_push, h2_max_concurrent_streams, h2_initial_window_size, h2_max_frame_size, h2_max_header_list_size, h2_enable_connect_protocol - Use Int32/Int64 with DEFAULT -1 to distinguish absent vs zero - Update mv_http_logs to extract individual fields via JSONHas/JSONExtractInt - Migration 04_http2_fields.sql updated for existing deployments Correlator: - Accept both timestamp_ns and timestamp field names (backward compat) Integration: - Enable HTTP/2 in Apache: Protocols h2 http/1.1 in httpd-integration.conf Validated end-to-end via Playwright: H2 curl traffic → mod-reqin-log → correlator → ClickHouse with all 12 H2 columns populated correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
41 lines
1.4 KiB
Plaintext
41 lines
1.4 KiB
Plaintext
# Integration test Apache config — HTTPS + mod-reqin-log
|
|
|
|
# Load mod-reqin-log
|
|
LoadModule reqin_log_module modules/mod_reqin_log.so
|
|
|
|
# Enable HTTP/2 negotiation (mod_http2 loaded by default on Rocky 9)
|
|
Protocols h2 http/1.1
|
|
|
|
# mod_remoteip: trust X-Forwarded-For from Docker internal subnets.
|
|
# mod_reqin_log reads r->useragent_ip which mod_remoteip updates,
|
|
# so the XFF IP appears as src_ip in the correlated logs.
|
|
LoadModule remoteip_module modules/mod_remoteip.so
|
|
RemoteIPHeader X-Forwarded-For
|
|
RemoteIPInternalProxy 172.0.0.0/8
|
|
RemoteIPInternalProxy 192.168.0.0/16
|
|
RemoteIPInternalProxy 10.0.0.0/8
|
|
|
|
# Enable mod-reqin-log with correlator socket
|
|
JsonSockLogEnabled On
|
|
JsonSockLogSocket "/var/run/logcorrelator/http.socket"
|
|
JsonSockLogHeaders X-Request-Id User-Agent Referer X-Forwarded-For \
|
|
Sec-CH-UA Sec-CH-UA-Mobile Sec-CH-UA-Platform \
|
|
Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site \
|
|
Accept Accept-Language Accept-Encoding Content-Type
|
|
JsonSockLogMaxHeaders 25
|
|
JsonSockLogMaxHeaderValueLen 256
|
|
JsonSockLogReconnectInterval 5
|
|
JsonSockLogErrorReportInterval 5
|
|
JsonSockLogLevel DEBUG
|
|
|
|
# HTTPS virtual host (port 443 already configured by mod_ssl)
|
|
<VirtualHost *:80>
|
|
ServerName platform.test
|
|
DocumentRoot /var/www/html
|
|
|
|
# Simple test pages
|
|
<Location /health>
|
|
Require all granted
|
|
</Location>
|
|
</VirtualHost>
|