test ebpf

setup_database.sh

@@ -31,29 +31,33 @@ echo "[4] Restarting PostgreSQL…"
 sudo systemctl restart postgresql
 
 echo "[5] Creating database + user (idempotent)…"
-sudo -u postgres psql <<EOF
-DO \$\$
-BEGIN
-    IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$DB_USER') THEN
-        CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';
-    END IF;
+if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname = '$DB_USER'" | grep -q 1; then
+    sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
+fi
 
-    IF NOT EXISTS (SELECT FROM pg_database WHERE datname = '$DB_NAME') THEN
-        CREATE DATABASE $DB_NAME OWNER $DB_USER;
-    END IF;
-END
-\$\$;
-EOF
+if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname = '$DB_NAME'" | grep -q 1; then
+    sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER;"
+fi
 
 echo "[6] Creating packets table (idempotent)…"
 sudo -u postgres psql -d "$DB_NAME" <<EOF
 CREATE TABLE IF NOT EXISTS packets (
     id BIGSERIAL PRIMARY KEY,
     timestamp TIMESTAMPTZ DEFAULT NOW(),
+    packet_uid TEXT UNIQUE,
 
     -- Interface metadata
     iface VARCHAR(64),
+    ingress_if VARCHAR(64),
+    egress_if VARCHAR(64),
+    observed_ifaces TEXT[],
     direction VARCHAR(64),
+    verdict VARCHAR(32),
+    verdict_reason VARCHAR(128),
+    verdict_confidence VARCHAR(32),
+    ingress_seen_at TIMESTAMPTZ,
+    egress_seen_at TIMESTAMPTZ,
+    verdict_seen_at TIMESTAMPTZ,
 
     -- Ethernet
     src_mac MACADDR,
@@ -84,11 +88,13 @@ CREATE TABLE IF NOT EXISTS packets (
     app_is_encrypted BOOLEAN,
     app_risk_score INTEGER,
     dpi_metadata JSONB,
+    telemetry_metadata JSONB,
 
     -- Full packet dump
     raw BYTEA
 );
 
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS packet_uid TEXT;
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_protocol VARCHAR(128);
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_master_protocol VARCHAR(128);
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_category VARCHAR(128);
@@ -97,6 +103,17 @@ ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_hostname VARCHAR(255);
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_is_encrypted BOOLEAN;
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS app_risk_score INTEGER;
 ALTER TABLE packets ADD COLUMN IF NOT EXISTS dpi_metadata JSONB;
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS ingress_if VARCHAR(64);
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS egress_if VARCHAR(64);
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS observed_ifaces TEXT[];
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS verdict VARCHAR(32);
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS verdict_reason VARCHAR(128);
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS verdict_confidence VARCHAR(32);
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS ingress_seen_at TIMESTAMPTZ;
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS egress_seen_at TIMESTAMPTZ;
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS verdict_seen_at TIMESTAMPTZ;
+ALTER TABLE packets ADD COLUMN IF NOT EXISTS telemetry_metadata JSONB;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_packets_packet_uid ON packets(packet_uid);
 EOF
 
 
@@ -121,6 +138,7 @@ CREATE INDEX IF NOT EXISTS idx_packets_timestamp ON packets(timestamp DESC);
 CREATE INDEX IF NOT EXISTS idx_packets_src_ip ON packets(src_ip);
 CREATE INDEX IF NOT EXISTS idx_packets_app_protocol ON packets(app_protocol);
 CREATE INDEX IF NOT EXISTS idx_packets_app_hostname ON packets(app_hostname);
+CREATE INDEX IF NOT EXISTS idx_packets_verdict ON packets(verdict);
 EOF
 
 echo "Done. PostgreSQL is ready for LAN + localhost connections."