Bugfix:
- Use unixgram (DGRAM) instead of unix (STREAM) for socket output
- Fixes "protocol wrong type for socket" error
- DGRAM sockets are connectionless, better suited for log shipping
Packaging:
- Update RPM spec to version 1.1.5
- Update changelog
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- config.yml.example: Unix socket enabled by default, stdout commented out
- internal/output/writers.go: Remove all internal logging from UnixSocketWriter
and FileWriter - only LogRecord JSON data is sent to outputs
- architecture.yml: Update description to mention 'socket UNIX par défaut'
- packaging/rpm/ja4sentinel.spec: Bump version to 1.1.1, update changelog
Diagnostic logs (error, debug, warning) now only go to stdout when enabled.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add Reopenable interface in api/types.go for log rotation support
- Add FileWriter.Reopen() method to reopen log files after rotation
- Add MultiWriter.Reopen() method to propagate rotation to all writers
- Update main.go to handle SIGHUP signal for systemctl reload
- Add logrotate configuration file (packaging/logrotate/ja4sentinel)
- Update systemd service with ExecReload for graceful rotation
- Update architecture.yml with logrotate documentation
- Update RPM spec and Dockerfile.package to include logrotate files
- Bump version to 1.1.0
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
New features:
- Extract SNI (Server Name Indication) from TLS ClientHello
- Extract ALPN (Application-Layer Protocol Negotiation) protocols
- Detect TLS version from ClientHello using tlsfingerprint library
- Add ConnID field for TCP flow correlation
- Add SensorID field for multi-sensor deployments
- Add SynToCHMs timing field for behavioral detection
- Add AsyncBuffer configuration for output queue sizing
Architecture changes:
- Remove JA4Hash from LogRecord (JA4 format includes its own hash portions)
- Update api.TLSClientHello with new TLS metadata fields
- Update api.LogRecord with correlation, TLS, and timing fields
- Ensure 100% compliance with architecture.yml specification
Tests:
- Add unit tests for TLS extension extraction (SNI, ALPN, Version)
- Update tests for new LogRecord schema without JA4Hash
- Add tests for AsyncBuffer configuration
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
The %{spec_version} macro was being referenced in the Version field
before it was defined, causing RPM packages to show literal '%{spec_version}'
instead of the actual version number.
Moving the macro definition to the top of the spec file ensures it's
expanded correctly during rpmbuild.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Bump version from 1.0.2 to 1.0.4
- Add changelog entry for sdnotify integration
- Author: Jacquin Antoine <rpm@arkel.fr>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Update Makefile to extract PKG_VERSION from spec file
Reads '%define spec_version 1.0.2' as default version
- Update spec file with proper version macro logic
Version field now uses %{spec_version}
Supports override via --define 'build_version X.Y.Z'
Falls back to 1.0.2 when build_version is not defined
This ensures RPM packages are built with the correct version
defined in the spec file (1.0.2) instead of hardcoded 1.0.0.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Change systemd service to run as root instead of ja4sentinel user
- Remove user/group creation from RPM spec (%pre script)
- Update %post to set root:root ownership on directories
- Adjust security hardening for root execution (ProtectSystem=strict)
- Add ReadWritePaths for writable directories
Fixes: systemd error 'Failed at step USER spawning /usr/bin/ja4sentinel: No such process'
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Version: 1.0.1 → 1.0.2
- libpcap >= 1.9.0 (suppression support CentOS 7)
- Mise à jour du changelog RPM
- Description mise à jour (Rocky/Alma/RHEL 8+)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Suppression complète du support DEB (Debian/Ubuntu)
- Builder Rocky Linux 9 pour compatibilité binaire maximale
- Compilation dynamique avec libpcap comme dépendance runtime
- Activation du dépôt CRB pour libpcap-devel
- RPM générés pour el7, el8, el9, el10
- Mise à jour documentation et workflows GitHub Actions
Fix: erreur 'libpcap.so.0.8: cannot open shared object file' sur Rocky Linux 9
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Ajout des cibles make ci, ci-test, ci-build, ci-package, ci-package-test
- Correction des chemins de sortie des packages (build/deb, build/rpm)
- Build RPM sur Rocky Linux 9 pour dépendances correctes (libpcap.so.1)
- Fix tests RPM (command -v au lieu de which, fallback libpcap)
- Tous les tests passent (11/11 DEB, 11/11 RPM)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Cible: Rocky Linux 9 (compatible RHEL/CentOS)
Changes:
- packaging/Dockerfile.rpm: Build pour Rocky Linux
- packaging/build-rpm.sh: Ajout paramètre distribution (rocky/rhel/centos)
- packaging/rpm/ja4sentinel.spec:
* Condition %if 0%{?rhel} >= 8 pour compatibilité RHEL
* Description mise à jour avec Rocky Linux
- packaging/test/Dockerfile.rpm: Test sur Rocky Linux 9
- packaging/test/test-*.sh: Tests spécifiques Rocky Linux
- .github/workflows/build-rpm.yml:
* Nom du job: 'Build RPM Package (Rocky Linux)'
* TARGET_DIST: rockylinux:9
* Simplification du build via Docker
Documentation:
- README.md: Instructions d'installation pour .rpm (Rocky/RHEL) et .deb (Debian/Ubuntu)
- Remplacement des instructions de build par installation via packages
Compatibilité:
- Rocky Linux 8.x et 9.x
- RHEL 8.x et 9.x
- CentOS Stream 8 et 9
- AlmaLinux 8.x et 9.x
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
