Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
zeek/testing/btest/spicy
History
Exact
Benjamin Bannier d6c22295bd
[Spicy] Let zeek::protocol_handle_close() send a TCP EOF. 
Zeek's analyzer API makes it hard to determine during analyzer
shutdown whether a regular end-of-data has been reached, or if we're
aborting in the middle of a session (e.g., because Zeek missed the
remaining packets): the corresponding analyzer method, `EndOfData()`
gets called in both cases.

In an earlier change, we had stopped signaling Spicy analyzers a
regular finish when that `EndOfData()` method executes, because doing
so could trigger a parse error if it wasn't a regular shutdown—-which
isn't desired, a user request was to just silently stop processing in
this case.

However, that behavior now seems unfortunate in the case that one
deliberately calls `zeek::protocol_handle_close()` to terminate an
analyzer: this feels like a regular shutdown that should just
immediately happen. We achieve this now in this function by
additionally signaling the shutdown at the TCP layer as an "end of
file", which, for Spicy analyzers, happens to run the final, orderly
tear-down.

Not exactly great, but ti seems to thread the needle to achieve the
desired semantics in both cases.
2025-07-09 17:28:19 +02:00
..
analyzer-id.zeek Require spicy for spicy.analyzer-id btest 2024-12-20 14:25:04 -07:00
analyzer-tag.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
availability.zeek Integrate the Spicy plugin into Zeek proper. 2023-05-16 10:17:45 +02:00
conn-id.spicy btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
context.spicy btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
decline_input.spicy dpd->analyzer.log change - rename files 2025-06-03 16:32:52 +01:00
double-event.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
double-type-registration.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
double-types.zeek Bump Spicy. 2024-06-14 13:10:47 +02:00
event-args-fail.evt Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
event-args-mismatch.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
event-args.zeek Make Spicy hook execution order deterministic in test 2024-11-06 09:42:33 +01:00
event-cond.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
event-unit-type-fail.evt testing/btest/*evt: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
event-user-type Revert "Remove deprecated port/ports fields for spicy analyzers" 2024-08-19 09:57:04 +02:00
export-bitfield.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
export-enum.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
export-protocol-enum.zeek Bump Spicy. 2024-06-14 13:10:47 +02:00
export-switch.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
export-type-ambigious-fail.spicy [Spicy] Extend functionality of export in EVT files. 2023-08-21 10:26:25 +02:00
export-type-collision-with-global.spicy Fix handling of module scope when checking exported Spicy types for collisions 2023-09-13 16:33:07 +02:00
export-type-e2e.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
export-type-fail.spicy Integrate the Spicy plugin into Zeek proper. 2023-05-16 10:17:45 +02:00
export-type-with-fields-fail.spicy [Spicy] Extend functionality of export in EVT files. 2023-08-21 10:26:25 +02:00
export-type-with-fields.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
export-types.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
file-analysis-data-in-concurrent.zeek Spicy: Query Zeek scriptland for file handles. 2024-05-06 09:20:38 +02:00
file-analysis-data-in.zeek Spicy: Query Zeek scriptland for file handles. 2024-05-06 09:20:38 +02:00
file-analyzer-nested.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
file-analyzer-property.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
file-analyzer.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
file-data-in-at-offset.zeek Spicy: Query Zeek scriptland for file handles. 2024-05-06 09:20:38 +02:00
file-replaces.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
gap-recovery.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
get-values.spicy Spicy: Provide runtime API to access Zeek-side globals. 2024-06-20 12:02:54 +02:00
hook-priority.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
import-from.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
list-conversion.zeek testing/btest/*zeek: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
module-path.spicy Do not automatically load Spicy modules in dot paths. 2023-09-26 11:56:52 +02:00
multiple-enum.zeek Bump Spicy. 2024-06-14 13:10:47 +02:00
network-time.spicy btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
optional.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
packet-analyzer-on-ip.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
packet-analyzer-replaces.zeek Fix packet analyzer replacement. 2024-05-06 09:45:11 +02:00
packet-analyzer-violation.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
packet-analyzer.zeek Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
parse-error.zeek Settle on analyzer.log for the dpd.log replacement 2025-06-03 17:33:36 +01:00
port-fail.evt testing/btest/*evt: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
port-range-one-port.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
port.zeek Spicy: Register well-known ports through an event handler. 2024-08-22 10:24:55 +02:00
preprocessor-fail.evt Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
preprocessor-spicy.spicy Integrate the Spicy plugin into Zeek proper. 2023-05-16 10:17:45 +02:00
preprocessor.evt Speed up Spicy-related tests. 2023-05-25 14:59:10 +02:00
profiling.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
protocol-analyzer-data-in-from-tcp-to-udp.zeek Spicy: Support UDP in Spicy's protocol_* runtime functions. 2024-05-07 18:19:46 +02:00
protocol-analyzer-data-in-udp.zeek Spicy: Support UDP in Spicy's protocol_* runtime functions. 2024-05-07 18:19:46 +02:00
protocol-analyzer-data-in.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
protocol-analyzer-explicit-forwarding.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
protocol-analyzer-tcp-over-udp.spicy btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
replaces-conflicts.evt btest/spicy: Make replaces-conflicts trigger replaces code path 2024-08-06 11:52:52 +02:00
replaces-mismatch.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
replaces.zeek Spicy: Fix service reporting for replaced analyzers. 2024-05-08 14:01:46 +02:00
resource-usage.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
reuse-parser-across-hltos.zeek Integrate the Spicy plugin into Zeek proper. 2023-05-16 10:17:45 +02:00
skip-input-file.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
skip-input-protocol.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
spicy-dump.spicy Move Spicy submodule a layer up. 2023-05-16 12:09:12 +02:00
spicyz-version.test Normalize version strings in test 2023-10-30 10:42:12 +01:00
spicyz.test btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
ssh-banner.zeek dpd->analyzer.log change - rename files 2025-06-03 16:32:52 +01:00
tcp-eod-behavior-child.zeek [Spicy] Let zeek::protocol_handle_close() send a TCP EOF. 2025-07-09 17:28:19 +02:00
tcp-eod-behavior-on-destroy.zeek Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
tcp-eod-behavior.zeek dpd->analyzer.log change - rename files 2025-06-03 16:32:52 +01:00
terminate-session.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
toggle-protocol-analyzer.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
tuple-arg.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
tuple-enum.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
type-converter.zeek testing/btest/*zeek: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
udp.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
zeekygen-enum-zeek-side.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00
zeekygen.zeek btest/spicy: Remove most port usages 2024-03-15 17:36:11 +01:00