Skip to content

Repository files navigation

$ tree -L 1
.
├── angie
└── nginx-ja4-ebpf-module

1.
sudo apt install clang

2.
cd angie
./configure --with-debug --add-module=$(pwd)/../nginx-ja4-ebpf-module --prefix=$(pwd)/build
make -j

3.
cat <<E > build/conf/nginx.conf
daemon off;
events {
}
worker_processes 2;
http {
    error_log /dev/stdout debug;
    ja4_ebpf_module on;
    ja4_ebpf_endpoint 127.0.0.1 8080;
    server {
        listen       127.0.0.1:8080;
        location / {
            add_header Content-Type text/plain;
            return 200 "http_bpf_ja4t = $http_bpf_ja4t\r\n";
        }
    }
}
E

4.
sudo ./objs/angie -c nginx.conf ; echo

5.
From another console run:
curl 127.0.0.1:8080

6.
Directive `ja4_ebpf_xdp_if` supports:

- Single interface (default behavior):
  `ja4_ebpf_xdp_if lo;`

- All active interfaces:
  `ja4_ebpf_xdp_if all;`

- Comma-separated list of interfaces:
  `ja4_ebpf_xdp_if eth0,ens3,wlan0;`

Notes:
- If `ja4_ebpf_xdp_if` is not set, module uses `lo`.
- For comma-separated values, spaces around names are allowed.

7.
Directive `ja4_ebpf_endpoint` precedence with `listen` autofill:

- Module may autofill endpoint maps from `listen` directives.
- If there is an explicit `ja4_ebpf_endpoint` for the same port,
  autofill entries from `listen` for that port are skipped.
- This avoids mixing specific IP endpoints and wildcard (`any`) endpoints
  for the same port in `target4` / `target6`.

About

Fingerprints ja4+ with ebpf technology

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages