efd4481729
Nouveaux modules: - cmd/ja4sentinel/main.go : point d'entrée avec pipeline capture→parse→fingerprint→output - internal/config/loader.go : chargement YAML + env (JA4SENTINEL_*) + validation - internal/tlsparse/parser.go : extraction ClientHello avec suivi d'état de flux (NEW/WAIT_CLIENT_HELLO/JA4_DONE) - internal/fingerprint/engine.go : génération JA4/JA3 via psanford/tlsfingerprint - internal/output/writers.go : StdoutWriter, FileWriter, UnixSocketWriter, MultiWriter Infrastructure: - Dockerfile (multi-stage), Dockerfile.dev, Dockerfile.test-server - Makefile (build, test, lint, docker-build-*) - docker-compose.test.yml pour tests d'intégration - README.md (276 lignes) avec architecture, config, exemples API (api/types.go): - Ajout Close() aux interfaces Capture et Parser - Ajout FlowTimeoutSec dans Config (défaut: 30s, env: JA4SENTINEL_FLOW_TIMEOUT) - ServiceLog: +Timestamp, +TraceID, +ConnID - LogRecord: champs flatten (ip_meta_*, tcp_meta_*, ja4*) - Helper NewLogRecord() pour conversion TLSClientHello+Fingerprints→LogRecord Architecture (architecture.yml): - Documentation module logging + interfaces LoggerFactory/Logger - Section service.systemd complète (unit, security, capabilities) - Section logging.strategy (JSON lines, champs, règles) - api.Config: +FlowTimeoutSec documenté Fixes/cleanup: - Suppression internal/api/types.go (consolidé dans api/types.go) - Correction imports logging (ja4sentinel/api) - .dockerignore / .gitignore - config.yml.example Tests: - Tous les modules ont leurs tests (*_test.go) - Tests unitaires : capture, config, fingerprint, output, tlsparse - Tests d'intégration via docker-compose.test.yml Build: - Binaires dans dist/ (make build → dist/ja4sentinel) - Docker runtime avec COPY --from=builder /app/dist/ Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
65 lines
1.8 KiB
Go
65 lines
1.8 KiB
Go
// Package fingerprint provides JA4/JA3 fingerprint generation for TLS ClientHello
|
|
package fingerprint
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"ja4sentinel/api"
|
|
|
|
tlsfingerprint "github.com/psanford/tlsfingerprint"
|
|
)
|
|
|
|
// EngineImpl implements the api.Engine interface for fingerprint generation
|
|
type EngineImpl struct{}
|
|
|
|
// NewEngine creates a new fingerprint engine
|
|
func NewEngine() *EngineImpl {
|
|
return &EngineImpl{}
|
|
}
|
|
|
|
// FromClientHello generates JA4 (and optionally JA3) fingerprints from a TLS ClientHello
|
|
func (e *EngineImpl) FromClientHello(ch api.TLSClientHello) (*api.Fingerprints, error) {
|
|
if len(ch.Payload) == 0 {
|
|
return nil, fmt.Errorf("empty ClientHello payload")
|
|
}
|
|
|
|
// Parse the ClientHello using tlsfingerprint
|
|
fp, err := tlsfingerprint.ParseClientHello(ch.Payload)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse ClientHello: %w", err)
|
|
}
|
|
|
|
// Generate JA4 fingerprint
|
|
// Note: JA4 string format already includes the hash portion
|
|
// e.g., "t13d1516h2_8daaf6152771_02cb136f2775" where the last part is the SHA256 hash
|
|
ja4 := fp.JA4String()
|
|
|
|
// Generate JA3 fingerprint and its MD5 hash
|
|
ja3 := fp.JA3String()
|
|
ja3Hash := fp.JA3Hash()
|
|
|
|
// Extract JA4 hash portion (last segment after underscore)
|
|
// JA4 format: <tls_ver><ciphers><extensions>_<sni_hash>_<cipher_extension_hash>
|
|
ja4Hash := extractJA4Hash(ja4)
|
|
|
|
return &api.Fingerprints{
|
|
JA4: ja4,
|
|
JA4Hash: ja4Hash,
|
|
JA3: ja3,
|
|
JA3Hash: ja3Hash,
|
|
}, nil
|
|
}
|
|
|
|
// extractJA4Hash extracts the hash portion from a JA4 string
|
|
// JA4 format: <base>_<sni_hash>_<cipher_hash> -> returns "<sni_hash>_<cipher_hash>"
|
|
func extractJA4Hash(ja4 string) string {
|
|
// JA4 string format: t13d1516h2_8daaf6152771_02cb136f2775
|
|
// We extract everything after the first underscore as the "hash" portion
|
|
for i, c := range ja4 {
|
|
if c == '_' {
|
|
return ja4[i+1:]
|
|
}
|
|
}
|
|
return ""
|
|
}
|