feat: implémentation complète du pipeline JA4 + Docker + tests

Nouveaux modules:
- cmd/ja4sentinel/main.go : point d'entrée avec pipeline capture→parse→fingerprint→output
- internal/config/loader.go : chargement YAML + env (JA4SENTINEL_*) + validation
- internal/tlsparse/parser.go : extraction ClientHello avec suivi d'état de flux (NEW/WAIT_CLIENT_HELLO/JA4_DONE)
- internal/fingerprint/engine.go : génération JA4/JA3 via psanford/tlsfingerprint
- internal/output/writers.go : StdoutWriter, FileWriter, UnixSocketWriter, MultiWriter

Infrastructure:
- Dockerfile (multi-stage), Dockerfile.dev, Dockerfile.test-server
- Makefile (build, test, lint, docker-build-*)
- docker-compose.test.yml pour tests d'intégration
- README.md (276 lignes) avec architecture, config, exemples

API (api/types.go):
- Ajout Close() aux interfaces Capture et Parser
- Ajout FlowTimeoutSec dans Config (défaut: 30s, env: JA4SENTINEL_FLOW_TIMEOUT)
- ServiceLog: +Timestamp, +TraceID, +ConnID
- LogRecord: champs flatten (ip_meta_*, tcp_meta_*, ja4*)
- Helper NewLogRecord() pour conversion TLSClientHello+Fingerprints→LogRecord

Architecture (architecture.yml):
- Documentation module logging + interfaces LoggerFactory/Logger
- Section service.systemd complète (unit, security, capabilities)
- Section logging.strategy (JSON lines, champs, règles)
- api.Config: +FlowTimeoutSec documenté

Fixes/cleanup:
- Suppression internal/api/types.go (consolidé dans api/types.go)
- Correction imports logging (ja4sentinel/api)
- .dockerignore / .gitignore
- config.yml.example

Tests:
- Tous les modules ont leurs tests (*_test.go)
- Tests unitaires : capture, config, fingerprint, output, tlsparse
- Tests d'intégration via docker-compose.test.yml

Build:
- Binaires dans dist/ (make build → dist/ja4sentinel)
- Docker runtime avec COPY --from=builder /app/dist/

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

internal/fingerprint/engine.go

@@ -0,0 +1,64 @@
+// Package fingerprint provides JA4/JA3 fingerprint generation for TLS ClientHello
+package fingerprint
+
+import (
+	"fmt"
+
+	"ja4sentinel/api"
+
+	tlsfingerprint "github.com/psanford/tlsfingerprint"
+)
+
+// EngineImpl implements the api.Engine interface for fingerprint generation
+type EngineImpl struct{}
+
+// NewEngine creates a new fingerprint engine
+func NewEngine() *EngineImpl {
+	return &EngineImpl{}
+}
+
+// FromClientHello generates JA4 (and optionally JA3) fingerprints from a TLS ClientHello
+func (e *EngineImpl) FromClientHello(ch api.TLSClientHello) (*api.Fingerprints, error) {
+	if len(ch.Payload) == 0 {
+		return nil, fmt.Errorf("empty ClientHello payload")
+	}
+
+	// Parse the ClientHello using tlsfingerprint
+	fp, err := tlsfingerprint.ParseClientHello(ch.Payload)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse ClientHello: %w", err)
+	}
+
+	// Generate JA4 fingerprint
+	// Note: JA4 string format already includes the hash portion
+	// e.g., "t13d1516h2_8daaf6152771_02cb136f2775" where the last part is the SHA256 hash
+	ja4 := fp.JA4String()
+
+	// Generate JA3 fingerprint and its MD5 hash
+	ja3 := fp.JA3String()
+	ja3Hash := fp.JA3Hash()
+
+	// Extract JA4 hash portion (last segment after underscore)
+	// JA4 format: <tls_ver><ciphers><extensions>_<sni_hash>_<cipher_extension_hash>
+	ja4Hash := extractJA4Hash(ja4)
+
+	return &api.Fingerprints{
+		JA4:     ja4,
+		JA4Hash: ja4Hash,
+		JA3:     ja3,
+		JA3Hash: ja3Hash,
+	}, nil
+}
+
+// extractJA4Hash extracts the hash portion from a JA4 string
+// JA4 format: <base>_<sni_hash>_<cipher_hash> -> returns "<sni_hash>_<cipher_hash>"
+func extractJA4Hash(ja4 string) string {
+	// JA4 string format: t13d1516h2_8daaf6152771_02cb136f2775
+	// We extract everything after the first underscore as the "hash" portion
+	for i, c := range ja4 {
+		if c == '_' {
+			return ja4[i+1:]
+		}
+	}
+	return ""
+}

internal/fingerprint/engine_test.go

@@ -0,0 +1,47 @@
+package fingerprint
+
+import (
+	"testing"
+
+	"ja4sentinel/api"
+)
+
+func TestFromClientHello(t *testing.T) {
+	tests := []struct {
+		name    string
+		ch      api.TLSClientHello
+		wantErr bool
+	}{
+		{
+			name: "empty payload",
+			ch: api.TLSClientHello{
+				Payload: []byte{},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid payload",
+			ch: api.TLSClientHello{
+				Payload: []byte{0x00, 0x01, 0x02},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			engine := NewEngine()
+			_, err := engine.FromClientHello(tt.ch)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("FromClientHello() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestNewEngine(t *testing.T) {
+	engine := NewEngine()
+	if engine == nil {
+		t.Error("NewEngine() returned nil")
+	}
+}