d75825278e
ja4ebpf: - Refactor BPF TC capture with improved SYN offset handling and TCP option parsing - Enhance TLS uprobe SSL hooking for better key extraction - Add ClickHouse writer improvements for HTTP log materialized views - Update RPM spec for Rocky Linux 8/9/10, fix systemd service - Simplify loader with cleaner bpf2go integration bot-detector: - Add H2 SETTINGS per-parameter comparison in browser_matcher - Enhance browser signatures and scoring pipeline - Improve preprocessing and cycle detection infra: - Multi-distro Vagrantfile (centos8, rocky9, rocky10) with per-distro provisioning - New Makefile targets: vm-up-all, test-vm-matrix, test-vm-centos8/rocky10 - Add debug helpers and run-test-from-host.sh for host-driven VM testing - Update run-tests-vm.sh for cross-distro compatibility - Remove accidental binary blob (\004) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
136 lines
5.3 KiB
Bash
Executable File
136 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# provision.sh — Provisionnement de la VM Rocky Linux 9 pour ja4ebpf
|
|
#
|
|
# Installe :
|
|
# - Toolchain eBPF : clang, llvm, bpftool, libbpf-devel, kernel-devel
|
|
# - Go 1.24
|
|
# - Docker (pour ClickHouse)
|
|
# - nginx + openssl (serveur web cible)
|
|
# - Outils de test : python3, httpx
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
log() { echo "[provision] $(date +%H:%M:%S) $*"; }
|
|
|
|
# ── 1. Mise à jour système + dépôts ──────────────────────────────────────────
|
|
log "Mise à jour des dépôts..."
|
|
dnf install -y epel-release dnf-plugins-core
|
|
dnf config-manager --enable crb
|
|
dnf update -y --quiet
|
|
|
|
# ── 2. Toolchain eBPF ────────────────────────────────────────────────────────
|
|
log "Installation toolchain eBPF (clang, bpftool, libbpf)..."
|
|
dnf install -y \
|
|
clang \
|
|
llvm \
|
|
bpftool \
|
|
libbpf-devel \
|
|
kernel-devel-$(uname -r) \
|
|
make \
|
|
git
|
|
|
|
# ── 3. Go (version récente) ──────────────────────────────────────────────────
|
|
log "Installation de Go..."
|
|
GO_VERSION="1.24.3"
|
|
if ! command -v go &>/dev/null || [[ "$(go version 2>/dev/null | awk '{print $3}')" != "go${GO_VERSION}" ]]; then
|
|
curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o /tmp/go.tar.gz
|
|
rm -rf /usr/local/go
|
|
tar -C /usr/local -xzf /tmp/go.tar.gz
|
|
rm /tmp/go.tar.gz
|
|
fi
|
|
export PATH="/usr/local/go/bin:$PATH"
|
|
# Persister dans le PATH
|
|
cat > /etc/profile.d/go.sh << 'EOF'
|
|
export PATH="/usr/local/go/bin:$PATH"
|
|
export GOPATH="/home/vagrant/go"
|
|
EOF
|
|
|
|
# ── 4. Docker (pour ClickHouse) ───────────────────────────────────────────────
|
|
log "Installation de Docker..."
|
|
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
|
|
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
|
|
# Sur el10+ (kernel 6.12+), nf_tables a des incompatibilités avec iptables-nft.
|
|
# Désactiver la gestion iptables par Docker pour éviter l'échec au démarrage.
|
|
if ! systemctl start docker 2>/dev/null; then
|
|
log "Docker: fallback iptables=false pour kernel $(uname -r)"
|
|
mkdir -p /etc/docker
|
|
echo '{"iptables": false}' > /etc/docker/daemon.json
|
|
fi
|
|
|
|
systemctl enable --now docker
|
|
usermod -aG docker vagrant
|
|
# Accès sans sudo pour vagrant
|
|
chmod 666 /var/run/docker.sock || true
|
|
|
|
# ── 5. Serveurs web (nginx + httpd) + TLS + hitch + varnish ─────────────────────
|
|
log "Installation des serveurs web et reverse proxy..."
|
|
dnf install -y nginx openssl curl
|
|
dnf install -y httpd mod_ssl
|
|
dnf install -y hitch varnish
|
|
|
|
# Ouvrir les ports HTTP/HTTPS dans le firewall
|
|
log "Configuration firewall..."
|
|
firewall-cmd --add-service=http --add-service=https --permanent 2>/dev/null || true
|
|
firewall-cmd --add-port=80/tcp --add-port=443/tcp --permanent 2>/dev/null || true
|
|
firewall-cmd --reload 2>/dev/null || true
|
|
|
|
# ── 6. Python3 + outils de test ──────────────────────────────────────────────
|
|
log "Installation Python3 et outils de test..."
|
|
dnf install -y python3 python3-pip
|
|
pip3 install --quiet "httpx[http2]" requests
|
|
|
|
# ── 7. Outils de debug eBPF ──────────────────────────────────────────────────
|
|
log "Installation outils de debug eBPF..."
|
|
dnf install -y perf strace
|
|
|
|
# ── 8. Montage tracefs + debugfs au démarrage ─────────────────────────────────
|
|
log "Configuration des pseudo-systèmes de fichiers eBPF..."
|
|
cat > /etc/systemd/system/tracefs.mount << 'EOF'
|
|
[Unit]
|
|
Description=Mount tracefs
|
|
DefaultDependencies=no
|
|
After=local-fs.target
|
|
|
|
[Mount]
|
|
What=tracefs
|
|
Where=/sys/kernel/tracing
|
|
Type=tracefs
|
|
Options=defaults
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
cat > /etc/systemd/system/debugfs.mount << 'EOF'
|
|
[Unit]
|
|
Description=Mount debugfs
|
|
DefaultDependencies=no
|
|
After=local-fs.target
|
|
|
|
[Mount]
|
|
What=debugfs
|
|
Where=/sys/kernel/debug
|
|
Type=debugfs
|
|
Options=defaults
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl enable tracefs.mount debugfs.mount
|
|
mount -t tracefs tracefs /sys/kernel/tracing 2>/dev/null || true
|
|
mount -t debugfs debugfs /sys/kernel/debug 2>/dev/null || true
|
|
|
|
# ── 9. Build ja4ebpf depuis les sources ──────────────────────────────────────
|
|
log "Build initial de ja4ebpf..."
|
|
export PATH="/usr/local/go/bin:$PATH"
|
|
cd /ja4-platform/services/ja4ebpf
|
|
GOWORK=off go generate ./internal/loader/ 2>&1 | tail -5 || log "go generate: erreur (normal si vmlinux.h absent)"
|
|
GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -ldflags="-s -w" -o /usr/local/bin/ja4ebpf ./cmd/ja4ebpf/ 2>&1 | tail -5
|
|
|
|
log "Provisionnement terminé !"
|
|
log "Lancer 'make test-vm-nginx' depuis le host pour démarrer les tests."
|