Johanna

I tried making some script-code backwards compatible and notices that this code... ```zeek function test() { local make_epoch_result = function(pass_name: string): function(ts: time) { @if ( Version::at_least("4.1") ) return function...

Cannot change columns in log-file after it is created

8

In #1634, it was mentioned that it would be nice to make an option that changes the log-fields configurable during run-time. Testing this showed that we currently cannot modify the...

I recently tried if spicy works on MacOs 10.14 - (which is currently specifically disabled in CMakeLists.txt). The surprising result is that it works without any problems - it basically...

inout does not work with basic types

1

According to the documentation at https://docs.zeek.org/projects/spicy/en/latest/programming/parsing.html?highlight=inout#unit-parameters, a string parameter should be able to be declared as inout. Trying this: ``` module TESTING; public type Handshake = unit(inout version: string) {...

It would be kind of neat if the following syntax worked: ``` type test = unit { a: uint16; b: uint16; on a, b { print "execute this"; } ```...

Persistent workers: support Dockerfile

2

Hi, I just wanted to check if there is a reason that persistent workers don't support a Dockerfile when using containers, but only specific images. For our use-case, being able...

inefficient store_event behavior for sets/tables

5

Hi, After playing around with it a bunch, I realized that the current behavior of store_events does not really mesh that greatly when combined with storing sets or tables in...

Test updates are necessary due to removed CT logs. Fixes GH-3620. This should make it into 6.2.0 if possible.

Provide access to Zeek script-land configuration options from spicy-plugin

1

Binpac analyzers have the ability to access script-level configuration options set in Zeek - examples are `zeek::BifConst::SSL::dtls_max_reported_version_errors` or `BifConst::FTP::max_command_length`. It would be neat to have a similar ability in Spicy...

See #3438. This PR is mostly here to run the test-cases; this won't be merged for a while :)