Architecture

High-level view: HTTP/TLS traffic goes through Huginn Proxy to your backends. For TCP SYN signatures, a separate agent loads XDP and pins maps; the proxy only reads those maps (it does not load eBPF itself).

Client

→ TLS / HTTP

Huginn Proxy Routing · TLS · fingerprints · limits

→ Proxy

Backends

TCP SYN fingerprint (Linux, optional)

huginn-ebpf-agent Loads XDP · pins maps

→

Kernel (XDP) SYN capture

→

Pinned BPF maps bpffs

lookup per connection

The proxy opens these maps read-only and adds x-huginn-net-tcp when tcp_enabled is on.

The library crate (huginn-proxy-lib) stays free of huginn-ebpf; the binary wires a small SynProbe callback when the feature is enabled.