Commit graph

8 commits

Author SHA1 Message Date
Johanna Amann
e228061f1d X509 caching API change: callback gets entry directly
Suggestion from Jon: now the callback is passed the table-entry
directly. This allows us to skip one lookup.
2020-03-12 11:31:13 -07:00
Johanna Amann
3ed9379b9e Address feedback
Smaller fixes. I split out the API change of the fallback function into
a separate commit.
2020-03-12 11:21:39 -07:00
Johanna Amann
0a7b358985 Small default updates & external baselines.
Update default caching time to be slightly more than a minute - to catch
cases that happen once a minute.

Also update external baselines.
2020-03-12 10:52:39 -07:00
Johanna Amann
4b09947f41 X509 caching: small API changes, tests & test updates
Changed some configuration defaults to potentially more same values.

The callback function is now a hook to allow costomization of the events
that are raised.

Tests now exist. Test baselines are updated.
2020-03-11 13:27:56 -07:00
Johanna Amann
65e99bafed Certificate caching - now working in principle.
I moved the replay function to a callback - which now means that the replayed
functions are called before file_state remove. Which makes this virtually
identical with the events raised by the core.

Currently this is mostly missing tests, leak-testing and performance-tests.
2020-03-09 14:40:10 -07:00
Johanna Amann
0829164a3e First (sadly not completely working) approach at caching X509 certificates
This approach mostly relies on script-level changes. In scriptland, we track
which certificates should be cached - and also perform the caching and the
replaying of events there.

This actually is probably nearly functional - the problem is the fact that now
the event ordering is wrong - and file_state_remove is called before the x509
events are thrown.

The fix probably is to move to a callback from the core - which can execute
things in the right order again. (Or just write the whole event-raising inside
the core - but that is both less flexible and a lot more cumbersome).
2020-03-06 15:21:45 -08:00
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Renamed from scripts/base/files/x509/main.bro (Browse further)