Seth Hall

Add filtered field for packet source stats

2

Right now there isn't a field for packets that were filtered from packet sources and all of the packet sources seem to not know what to do with the number...

Support arm64 on Linux?

4

https://github.com/zeek/spicy/blob/7bc152833075129ef1ddfba459021b336738b5d6/hilti/runtime/src/fiber.cc#L252 Robin and I talked about this a bit and I was thinking it could make sense to just generally support arm64. Most platforms these days seem to have their...

Look ahead switches combine the default pattern into the look ahead

1

Here's the minimal parser... ```module Test; import spicy; type Line = unit { switch { -> a : A; -> b : B; * -> unknown: /[^\n]*/; }; : /\n/;...

Apache or LGPL?

3

Why is the Apache license (COPYING.ASL20) included with liblognorm? It seems like most (all?) of the actual source files have LGPL license information in them.

The global that stores the certs can't be indexed into because the cert subject is included. Change it from set[addr, port, string] to table[addr, port] of string.

This is derived from the blog post by @AbdulRhmanAlfaifi at https://u0041.co/posts/articals/exploring-windows-artifacts-notepad-files/

decode() on bytes should support UTF-16

3

It looks like the current implementation only supports ASCII and UTF-8 to decode into a string and the current library being used is strictly for UTF-8. In order to support...

Allow &synchronized with static length fields and not just literals

6

Some protocols have static length fields before the literal where we might use the &synchronize attribute but currently spicy only allows literals before the literal where &synchronize is used. Here...