[Bro-Dev] [Bro-Commits] [git/bro] topic/bernhard/file-analysis-x509: Change x509 log - now certificates are only logged once per hour. (0d50b8b)

Seth Hall seth at icir.org
Thu Mar 13 07:37:05 PDT 2014


On Mar 13, 2014, at 10:30 AM, Robin Sommer <robin at icir.org> wrote:

> On Thu, Mar 13, 2014 at 00:17 -0700, Bernhard Amann wrote:
> 
>>    You apparently have to be very careful which EndOfFile function of
>>    the file analysis framework you call... otherwhise it might try
>>    to close another file id. This took me quite a while to find.
> 
> Can you elaborate? I sense an opportuntity to improve our API. :-)


I think he was running into the interplay between script land and the core.  Actually, I think that for the SSL/TLS analyzer, this is one of the times we don't need a file id generated in script land.  That's probably a better choice in this case.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20140313/c66d3ae1/attachment.bin 


More information about the bro-dev mailing list