corelight / zeekjs

ZeekJS - Experimental JavaScript support for Zeek.
BSD 3-Clause "New" or "Revised" License
9 stars 4 forks source link

JA3 re-implementation and related perf improvements #51

Closed awelzel closed 1 year ago

awelzel commented 1 year ago

Re-implementing JA3 with JavaScript and staring at flamegraphs and fixing some things.

Types: Avoid stringifcation of properties Types: Do not externalize "short" strings Nodejs: Remove some extra HandleScopes Nodejs: No extra context scopes Types: Cache the first 2^16 BigInts as persistent Plugin: Do not Process() when processing a packet Plugin: Disable drain event hook when no JavaScript files exist Types: Instantiate FixedArray for vector Types: Cache Record::FieldOffset() calls Types: Cache wrapped objects Types: Handle empty string special Types: Put private on record_template, not on instances