Zeek script about WASM

Zeek
1

Using the zeek (.zeek) script language has a learning curve. Are there any plans to use WebAssembly technology to enable scripting plugins in other languages (such as Rust or)?

2

Integrating WebAssembly code is already possible today with the existing JavaScript bindings. I have used this to e.g., integrate async Rust functions into Zeek.

This still goes through the JavaScript plugin which should be fine for most applications. There are no immediate plans to directly support loading WebAssembly in the core. That said, applications which need to integrate WebAssembly can definitely implement the limited interface they require.

3

(such as Rust or)?

The link posted by Benjamin doesn’t make this overly clear, but today you can use JavaScript to handle Zeek events already:

For example, there’s a re-implementation of JA3 / JA3s in JavaScript handling Zeek’s SSL events:

https://github.com/corelight/zeekjs/blob/main/examples/ja3/ja3.js

[...]

zeek.on('ssl_server_hello', (c, version, record_version, possible_ts,
                             server_random, session_id, cipher, comp_method) => {
  let uid = c.uid;
  let ja3s_parts = [
    version,
    cipher,
    (ja3s_conn_ssl_exts.get(uid) || []).join('-'),
  ];

  let ja3s_string = ja3s_parts.join(',');
  let ja3sfp_1= crypto.createHash('md5').update(ja3s_string).digest('hex');

  c.ssl.js_ja3s = ja3sfp_1;

  ja3s_conn_ssl_exts.delete(uid);
});