From e494fb5d1970703feac68ed8be55787569d74f18 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@corelight.com>
Date: Wed, 28 May 2025 12:20:44 +0200
Subject: [PATCH] Bump Spicy to pull in fix.

Includes a new regression test.

Closes #4501.
---
 auxil/spicy                                   |  2 +-
 .../spicy.tcp-eod-behavior-on-destroy/output  |  8 ++++
 .../spicy/tcp-eod-behavior-on-destroy.zeek    | 39 +++++++++++++++++++
 3 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 testing/btest/Baseline/spicy.tcp-eod-behavior-on-destroy/output
 create mode 100644 testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek

diff --git a/auxil/spicy b/auxil/spicy
index 4fe22b915e..9924442281 160000
--- a/auxil/spicy
+++ b/auxil/spicy
@@ -1 +1 @@
-Subproject commit 4fe22b915e5f1ac26c08412fed2bfc2dbc36bfb3
+Subproject commit 992444228151b193379e93403f8d486a6bf37878
diff --git a/testing/btest/Baseline/spicy.tcp-eod-behavior-on-destroy/output b/testing/btest/Baseline/spicy.tcp-eod-behavior-on-destroy/output
new file mode 100644
index 0000000000..2ddebedb7a
--- /dev/null
+++ b/testing/btest/Baseline/spicy.tcp-eod-behavior-on-destroy/output
@@ -0,0 +1,8 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+INIT, (192.168.72.14, 3254/tcp, 65.54.95.206, 80/tcp), True
+INIT, (192.168.72.14, 3254/tcp, 65.54.95.206, 80/tcp), False
+DONE, (192.168.72.14, 3254/tcp, 65.54.95.206, 80/tcp), False
+INIT, (192.168.72.14, 3257/tcp, 65.54.95.14, 80/tcp), True
+INIT, (192.168.72.14, 3257/tcp, 65.54.95.14, 80/tcp), False
+DONE, (192.168.72.14, 3257/tcp, 65.54.95.14, 80/tcp), False
+DONE, (192.168.72.14, 3257/tcp, 65.54.95.14, 80/tcp), True
diff --git a/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek b/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek
new file mode 100644
index 0000000000..516522557f
--- /dev/null
+++ b/testing/btest/spicy/tcp-eod-behavior-on-destroy.zeek
@@ -0,0 +1,39 @@
+# @TEST-REQUIRES: have-spicy
+#
+# @TEST-EXEC: spicyz -d foo.spicy foo.evt -o foo.hlto
+# @TEST-EXEC: zeek -Cr ${TRACES}/http/206_example_b.pcap foo.hlto "Spicy::enable_print=T" >output 2>&1
+# @TEST-EXEC: btest-diff output
+#
+# @TEST-DOC: Exercise &eod behavior when processing is aborted without a regular connection shutdown; regression test for Zeek #4501.
+#
+# @TEST-START-FILE foo.spicy
+module foo;
+
+import zeek;
+
+public type X = unit {
+    : bytes &eod;
+
+    on %init() {
+        print "INIT", zeek::conn_id(), zeek::is_orig();
+    }
+
+    on %done() {
+        print "DONE", zeek::conn_id(), zeek::is_orig(); # should not be called for instance not reaching &eod
+    }
+
+    on %error(e: string) {
+        print "ERROR: %s - should not show up" % e;
+    }
+
+};
+
+# @TEST-END-FILE
+
+# @TEST-START-FILE foo.evt
+import foo;
+
+protocol analyzer X over TCP:
+    parse with foo::X,
+    port 0/tcp-65535/tcp;
+# @TEST-END-FILE