mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
377fd711bd
When Zeek flips roles of a HTTP connection subsequent to the HTTP analyzer being attached, that analyzer would not update its own ContentLine analyzer state, resulting in the wrong ContentLine analyzer being switched into plain delivery mode. In debug builds, this would result in assertion failures, in production builds, the HTTP analyzer would receive HTTP bodies as individual header lines, or conversely, individual header lines would be delivered as a large chunk from the ContentLine analyzer. PCAPs were generated locally using tcprewrite to select well-known-http ports for both endpoints, then editcap to drop the first SYN packet. Kudos to @JordanBarnartt for keeping at it. Closes #3789 |
||
|---|---|---|
| .. | ||
| benchmark/broker | ||
| btest | ||
| builtin-plugins | ||
| coverage | ||
| external | ||
| scripts | ||
| .gitignore | ||
| CMakeLists.txt | ||
| Makefile | ||
| README | ||
This directory contains suites for testing for Zeek's correct
operation:
btest/
An ever-growing set of small unit tests testing Zeek's
functionality.
external/
A framework for downloading additional test sets that run more
complex Zeek configuration on larger traces files. Due to their
size, these are not included directly. See the README for more
information.
scripts/
Helpers scripts used by some tests.