mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
9e1592d5c4
So far, when Zeek didn't see a connection's regular tear-down (e.g., because its state timed-out before we got to the end), we'd still signal a regular end-of-data to Spicy parsers. As a result, they would then typically raise a parse error because they were probably still expecting data and would now declare it missing. That's not very useful because semantically it's not really a protocol issue if the data just doesn't make it over to us; it's a transport-layer issue that Zeek already handles elsewhere. So we now switch to signaling end-of-data to Spicy analyzers only if the connection indeed shuts down regularly. This is also matches how BinPAC handles it. This also comes with a test exercising various combinations of end-of-data behavior so that we ensure consistent/desired behavior. Closes #4007.
107 lines
3.9 KiB
Text
107 lines
3.9 KiB
Text
# @TEST-REQUIRES: have-spicy
|
|
#
|
|
# @TEST-DOC: Exercise end-of-data behavior for combinations of units expected certain amounts and regular vs non-regular connection termination.
|
|
#
|
|
# @TEST-EXEC: spicyz -d -o foo-16.hlto test.spicy foo-16.evt
|
|
# @TEST-EXEC: spicyz -d -o foo-136.hlto test.spicy foo-136.evt
|
|
# @TEST-EXEC: spicyz -d -o foo-1024.hlto test.spicy foo-1024.evt
|
|
# @TEST-EXEC: spicyz -d -o foo-eod.hlto test.spicy foo-eod.evt
|
|
|
|
# @TEST-EXEC: echo "=== Too much data, regular FINs (expect event output)" >>output-16-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get.trace Zeek::Spicy foo-16.hlto %INPUT >>output-16-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-16-fins
|
|
|
|
# @TEST-EXEC: echo "=== Too much data, missing FINs (expect event output)" >>output-16-no-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get-without-fins.trace Zeek::Spicy foo-16.hlto %INPUT >>output-16-no-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-16-no-fins
|
|
|
|
# @TEST-EXEC: echo "=== Exact data, regular FINs (expect event output)" >>output-136-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get.trace Zeek::Spicy foo-136.hlto %INPUT >>output-136-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-136-fins
|
|
|
|
# @TEST-EXEC: echo "=== Exact data, missing FINs (expect event output)" >>output-136-no-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get-without-fins.trace Zeek::Spicy foo-136.hlto %INPUT >>output-136-no-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-136-no-fins
|
|
|
|
# @TEST-EXEC: echo "=== Not enough data, regular FINs (expect analyzer error)" >>output-1024-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get.trace Zeek::Spicy foo-1024.hlto %INPUT >>output-1024-fins
|
|
# @TEST-EXEC: test -f analyzer.log && zeek-cut cause failure_reason <analyzer.log | diff-remove-abspath >>output-1024-fins
|
|
# @TEST-EXEC: btest-diff output-1024-fins
|
|
|
|
# @TEST-EXEC: echo "=== Not enough data, missing FINs (expect no output)" >>output-1024-no-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get-without-fins.trace Zeek::Spicy foo-1024.hlto %INPUT >>output-1024-no-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-1024-no-fins
|
|
|
|
# @TEST-EXEC: echo "=== Until EOD, regular FINs (expect event output)" >>output-eod-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get.trace Zeek::Spicy foo-eod.hlto %INPUT >>output-eod-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-eod-fins
|
|
|
|
# @TEST-EXEC: echo "=== Until EOD, missing FINs (expect no output)" >>output-eod-no-fins
|
|
# @TEST-EXEC: rm -f analyzer.log && zeek -b -r ${TRACES}/http/get-without-fins.trace Zeek::Spicy foo-eod.hlto %INPUT >>output-eod-no-fins
|
|
# @TEST-EXEC: test '!' -f analyzer.log
|
|
# @TEST-EXEC: btest-diff output-eod-no-fins
|
|
|
|
event Test::foo() {
|
|
print "event foo()";
|
|
}
|
|
|
|
# @TEST-START-FILE test.spicy
|
|
module Test;
|
|
|
|
public type Foo16 = unit {
|
|
: bytes &size=16;
|
|
};
|
|
|
|
public type Foo136 = unit {
|
|
: bytes &size=136;
|
|
};
|
|
|
|
public type Foo1024 = unit {
|
|
: bytes &size=1024;
|
|
};
|
|
|
|
public type FooEOD = unit {
|
|
: bytes &eod;
|
|
};
|
|
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE foo-16.evt
|
|
|
|
protocol analyzer spicy::Foo over TCP:
|
|
parse originator with Test::Foo16,
|
|
port 80/tcp;
|
|
|
|
on Test::Foo16 -> event Test::foo();
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE foo-136.evt
|
|
protocol analyzer spicy::Foo over TCP:
|
|
parse originator with Test::Foo136,
|
|
port 80/tcp;
|
|
|
|
on Test::Foo136 -> event Test::foo();
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE foo-1024.evt
|
|
protocol analyzer spicy::Foo over TCP:
|
|
parse originator with Test::Foo1024,
|
|
port 80/tcp;
|
|
|
|
on Test::Foo1024 -> event Test::foo();
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE foo-eod.evt
|
|
protocol analyzer spicy::Foo over TCP:
|
|
parse originator with Test::FooEOD,
|
|
port 80/tcp;
|
|
|
|
on Test::FooEOD -> event Test::foo();
|
|
# @TEST-END-FILE
|
|
|