mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00

So far, when Zeek didn't see a connection's regular tear-down (e.g., because its state timed-out before we got to the end), we'd still signal a regular end-of-data to Spicy parsers. As a result, they would then typically raise a parse error because they were probably still expecting data and would now declare it missing. That's not very useful because semantically it's not really a protocol issue if the data just doesn't make it over to us; it's a transport-layer issue that Zeek already handles elsewhere. So we now switch to signaling end-of-data to Spicy analyzers only if the connection indeed shuts down regularly. This is also matches how BinPAC handles it. This also comes with a test exercising various combinations of end-of-data behavior so that we ensure consistent/desired behavior. Closes #4007.
5.9 KiB
5.9 KiB