You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "JosiahWI (via GitHub)" <gi...@apache.org> on 2024/08/12 18:48:16 UTC

[PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

JosiahWI opened a new pull request, #11671:
URL: https://github.com/apache/trafficserver/pull/11671

   This is the beginning of a new experimental ja4_fingerprint plugin. This is just the part of the algorithm described by the JA4 specification that doesn't depend on OpenSSL. This includes thorough unit tests. I intend to do the plugin and OpenSSL logic in a separate PR with AuTests.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "moonchen (via GitHub)" <gi...@apache.org>.
moonchen commented on PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671#issuecomment-2289892538

   Thanks for making the contribution.  A suggestion if you're developing this plugin further in the future: perhaps it's worthwhile to use a struct to hold a JA4 signature, with its multiple fields of fixed length strings.  This should allow you to allocate all of those fixed length fields in one allocation and fill it out without additional allocations.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI merged PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "ywkaras (via GitHub)" <gi...@apache.org>.
ywkaras commented on PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671#issuecomment-2284905008

   A strategic issue involved here is whether we need to reduce per-transaction memory allocation/deallocation.  Are we assuming that newer allocators with per-thread arenas make it a non-issue?
   
   In a Yahoo internal plugin, I am using thread_local instances of this class to reduce memory allocation/deallocation:
   ```
   class GrowBuf
   {
   public:
     explicit GrowBuf(unsigned capacity = 0)
     {
       _v.reserve(capacity);
     }
   
     unsigned size() const { return _size; }
   
     const unsigned char * data() const { return _v.data(); }
   
     void clear() { _size = 0; }
   
     void push_back(unsigned char b)
     {
       if (_size < _v.size()) {
         _v[_size++] = b;
       } else {
         _v.push_back(b);
         ++_size;
       }
     }
   
     // No copy/move.
     GrowBuf(GrowBuf const &) = delete;
     GrowBuf & operator = (GrowBuf const &) = delete;
   
   private:
     std::vector<unsigned char> _v;
     unsigned _size{0};
   };
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671#issuecomment-2284932722

   I do want to reserve bytes for the strings in some cases because I know exactly how long they will be, so I'm glad you reminded me of that. For the other allocations, I would be hesitant to make any modifications to optimize allocations without benchmarking, and I'd prefer to do it in a separate PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671#issuecomment-2286737591

   The test Alternate_S_to_L_remove_S segfaulted on OSX.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add algorithm to calculate a JA4 fingerprint [trafficserver]

Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #11671:
URL: https://github.com/apache/trafficserver/pull/11671#issuecomment-2286784664

   [approve ci osx]


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org