mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 01:28:20 +00:00
![]() So far, when Zeek didn't see a connection's regular tear-down (e.g., because its state timed-out before we got to the end), we'd still signal a regular end-of-data to Spicy parsers. As a result, they would then typically raise a parse error because they were probably still expecting data and would now declare it missing. That's not very useful because semantically it's not really a protocol issue if the data just doesn't make it over to us; it's a transport-layer issue that Zeek already handles elsewhere. So we now switch to signaling end-of-data to Spicy analyzers only if the connection indeed shuts down regularly. This is also matches how BinPAC handles it. This also comes with a test exercising various combinations of end-of-data behavior so that we ensure consistent/desired behavior. Closes #4007. |
||
---|---|---|
.. | ||
output-16-fins | ||
output-16-no-fins | ||
output-136-fins | ||
output-136-no-fins | ||
output-1024-fins | ||
output-1024-no-fins | ||
output-eod-fins | ||
output-eod-no-fins |