Architecture

High-level view: HTTP/TLS traffic goes through Huginn Proxy to your backends. For TCP SYN signatures, a separate agent loads an eBPF capture program (XDP or TC) and pins maps; the proxy only reads those maps (it does not load eBPF itself).

Client

→TLS / HTTP

Huginn ProxyRouting · TLS · fingerprints · limits

→Proxy

Backends

TCP SYN fingerprint (Linux, optional)

huginn-ebpf-agentLoads XDP/TC · pins maps

→

Kernel (XDP/TC)SYN capture

→

Pinned BPF mapsbpffs

lookup per connection

The proxy opens these maps read-only and adds x-tcp-p0f when tcp_enabled is on.

The library crate (huginn-proxy-lib) stays free of huginn-ebpf; the binary wires a small SynProbe callback when the feature is enabled.