d75825278e
ja4ebpf: - Refactor BPF TC capture with improved SYN offset handling and TCP option parsing - Enhance TLS uprobe SSL hooking for better key extraction - Add ClickHouse writer improvements for HTTP log materialized views - Update RPM spec for Rocky Linux 8/9/10, fix systemd service - Simplify loader with cleaner bpf2go integration bot-detector: - Add H2 SETTINGS per-parameter comparison in browser_matcher - Enhance browser signatures and scoring pipeline - Improve preprocessing and cycle detection infra: - Multi-distro Vagrantfile (centos8, rocky9, rocky10) with per-distro provisioning - New Makefile targets: vm-up-all, test-vm-matrix, test-vm-centos8/rocky10 - Add debug helpers and run-test-from-host.sh for host-driven VM testing - Update run-tests-vm.sh for cross-distro compatibility - Remove accidental binary blob (\004) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
29 lines
783 B
Plaintext
29 lines
783 B
Plaintext
# Configuration de l'agent ja4ebpf
|
|
# Copiez ce fichier en config.yml et adaptez les valeurs.
|
|
|
|
# Interface réseau à surveiller (XDP ingress)
|
|
interface: eth0
|
|
|
|
# Chemin vers libssl pour les uprobes SSL_read/SSL_write
|
|
ssl_lib_path: "/usr/lib64/libssl.so.3"
|
|
|
|
# Mode debug : dump compteurs BPF + événements consommés toutes les 5s
|
|
# ClickHouse optionnel en mode debug
|
|
debug: false
|
|
|
|
# Paramètres de connexion ClickHouse
|
|
clickhouse:
|
|
dsn: "clickhouse://default:@127.0.0.1:9000/ja4_logs"
|
|
batch_size: 500
|
|
flush_secs: 1
|
|
|
|
# Délais de corrélation et de détection
|
|
correlation:
|
|
timeout_ms: 500 # expiration session TCP (ms)
|
|
slowloris_ms: 10000 # seuil Slowloris (ms)
|
|
|
|
# Journalisation
|
|
log:
|
|
level: "info" # debug | info | warn | error
|
|
format: "json" # json | text
|