mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Fix core.truncation unit test on macOS.
The pcap file format has a global header and a header per packet. The global header of the pcap in question had a snaplen of 1, but with packet headers indicating the full number of bytes saved within the file. It seems like the pcap file must of been artifically edited in order for it to be this way. When reporting the captured length of a packet, Apple's version of libpcap now seems to report the full number of bytes saved within the pcap's per-packet headers, but other versions seem to report the snaplen from the global pcap header. This caused the core.truncation test to behave differently on macOS from other platforms. I've manually hexedit'd the pcap so that the snaplen is still 1, but contains just a single packet with a pcap header indicating a length of 8, which is less than the size of the link layer header and so should still test the original code path that the unit test intended to exercise.
This commit is contained in:
parent
bb14765e08
commit
fcd735cecd
3 changed files with 9 additions and 1 deletions
8
CHANGES
8
CHANGES
|
@ -1,4 +1,12 @@
|
|||
|
||||
2.5-294 | 2017-08-11 13:51:49 -0500
|
||||
|
||||
* Fix core.truncation unit test on macOS. (Jon Siwek)
|
||||
|
||||
* Fix a netcontrol test that often fails (Daniel Thayer)
|
||||
|
||||
* Update install instructions for Fedora 26 (Daniel Thayer)
|
||||
|
||||
2.5-288 | 2017-08-04 14:17:10 -0700
|
||||
|
||||
* Fix field not being populated, which resulted in a reporter
|
||||
|
|
2
VERSION
2
VERSION
|
@ -1 +1 @@
|
|||
2.5-288
|
||||
2.5-294
|
||||
|
|
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue