mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
0829164a3e
This approach mostly relies on script-level changes. In scriptland, we track which certificates should be cached - and also perform the caching and the replaying of events there. This actually is probably nearly functional - the problem is the fact that now the event ordering is wrong - and file_state_remove is called before the x509 events are thrown. The fix probably is to move to a callback from the core - which can execute things in the right order again. (Or just write the whole event-raising inside the core - but that is both less flexible and a lot more cumbersome). |
||
|---|---|---|
| .. | ||
| extract | ||
| hash | ||
| pe | ||
| x509 | ||