Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
Repository files navigation
$ tree -L 1
.
├── angie
└── nginx-ja4-ebpf-module
1.
sudo apt install clang
2.
cd angie
./configure --with-debug --add-module=$(pwd)/../nginx-ja4-ebpf-module --prefix=$(pwd)/build
make -j
3.
cat <<E > build/conf/nginx.conf
daemon off;
events {
}
worker_processes 2;
http {
error_log /dev/stdout debug;
ja4_ebpf_module on;
ja4_ebpf_endpoint 127.0.0.1 8080;
server {
listen 127.0.0.1:8080;
location / {
add_header Content-Type text/plain;
return 200 "http_bpf_ja4t = $http_bpf_ja4t\r\n";
}
}
}
E
4.
sudo ./objs/angie -c nginx.conf ; echo
5.
From another console run:
curl 127.0.0.1:8080
6.
Directive `ja4_ebpf_xdp_if` supports:
- Single interface (default behavior):
`ja4_ebpf_xdp_if lo;`
- All active interfaces:
`ja4_ebpf_xdp_if all;`
- Comma-separated list of interfaces:
`ja4_ebpf_xdp_if eth0,ens3,wlan0;`
Notes:
- If `ja4_ebpf_xdp_if` is not set, module uses `lo`.
- For comma-separated values, spaces around names are allowed.
7.
Directive `ja4_ebpf_endpoint` precedence with `listen` autofill:
- Module may autofill endpoint maps from `listen` directives.
- If there is an explicit `ja4_ebpf_endpoint` for the same port,
autofill entries from `listen` for that port are skipped.
- This avoids mixing specific IP endpoints and wildcard (`any`) endpoints
for the same port in `target4` / `target6`.