Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

websocket: Address review feedback for BinPac code

Browse source 
* Rename mask_ to masking_key_
* Fold FrameHeaderFixed into FrameHeader directly
* Drop WebSocket_FramePayloadUnmask type

Thanks a bunch @ckreibich!
This commit is contained in:
Arne Welzel 2024-01-22 15:01:35 +01:00
parent 1775b01b58
commit 015a7c5fbc
5 changed files with 60 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

41
src/analyzer/protocol/websocket/websocket-analyzer.pac
View file

@ -27,30 +27,15 @@ refine flow WebSocket_Flow += {
zeek::BifEvent::enqueue_websocket_frame(connection()->zeek_analyzer(), zeek::BifEvent::enqueue_websocket_frame(connection()->zeek_analyzer(),
connection()->zeek_analyzer()->Conn(), connection()->zeek_analyzer()->Conn(),
is_orig(), is_orig(),
${hdr.b.fin}, ${hdr.fin},
${hdr.b.reserved}, ${hdr.reserved},
${hdr.b.opcode}, ${hdr.opcode},
${hdr.payload_len}); ${hdr.payload_len});
} }
return true; return true;
%} %}
function process_payload_unmask(chunk: WebSocket_FramePayloadUnmask): bool
%{
auto& data = ${chunk.data};
// In-place unmasking if frame payload is masked.
if ( has_mask_ )
{
auto *d = data.data();
for ( int i = 0; i < data.length(); i++ )
d[i] = d[i] ^ mask_[mask_idx_++ % mask_.size()];
}
return true;
%}
function process_payload_close(close: WebSocket_FramePayloadClose): bool function process_payload_close(close: WebSocket_FramePayloadClose): bool
%{ %{
if ( websocket_close ) if ( websocket_close )
@ -84,7 +69,15 @@ refine flow WebSocket_Flow += {
function process_payload_chunk(chunk: WebSocket_FramePayloadChunk): bool function process_payload_chunk(chunk: WebSocket_FramePayloadChunk): bool
%{ %{
auto& data = ${chunk.unmask.data}; auto& data = ${chunk.data};
// In-place unmasking if frame payload is masked.
if ( has_mask_ )
{
auto *d = data.data();
for ( int i = 0; i < data.length(); i++ )
d[i] = d[i] ^ masking_key_[masking_key_idx_++ % masking_key_.size()];
}
if ( websocket_frame_data ) if ( websocket_frame_data )
{ {
@ -96,7 +89,7 @@ refine flow WebSocket_Flow += {
} }
// Forward text and binary data to downstream analyzers. // Forward text and binary data to downstream analyzers.
if ( ${chunk.hdr.b.opcode} == OPCODE_TEXT|| ${chunk.hdr.b.opcode} == OPCODE_BINARY) if ( ${chunk.hdr.opcode} == OPCODE_TEXT|| ${chunk.hdr.opcode} == OPCODE_BINARY)
connection()->zeek_analyzer()->ForwardStream(data.length(), connection()->zeek_analyzer()->ForwardStream(data.length(),
data.data(), data.data(),
is_orig()); is_orig());
@ -113,14 +106,6 @@ refine typeattr WebSocket_FrameHeader += &let {
proc_header = $context.flow.process_header(this); proc_header = $context.flow.process_header(this);
}; };
refine typeattr WebSocket_FramePayloadUnmask += &let {
proc_payload_unmask = $context.flow.process_payload_unmask(this);
};
refine typeattr WebSocket_FramePayloadClose += &let { refine typeattr WebSocket_FramePayloadClose += &let {
proc_payload_close = $context.flow.process_payload_close(this); proc_payload_close = $context.flow.process_payload_close(this);
}; };
refine typeattr WebSocket_FramePayloadChunk += &let {
proc_payload_chunk = $context.flow.process_payload_chunk(this);
};

79
src/analyzer/protocol/websocket/websocket-protocol.pac
View file

@ -13,54 +13,47 @@ enum Opcodes {
OPCODE_PONG = 0x0a, OPCODE_PONG = 0x0a,
} }
type WebSocket_FrameHeaderFixed(first_frame: bool) = record { type WebSocket_FrameHeader(first_frame: bool) = record {
# First frame in message cannot be continuation, following first2: uint16 &enforce((first_frame && opcode != 0) || (!first_frame && opcode == 0));
# frames are only expected to be continuations. maybe_more_len: case payload_len1 of {
b: uint16 &enforce((first_frame && opcode != 0) || (!first_frame && opcode == 0));
} &let {
fin: bool = (b & 0x8000) ? true : false;
reserved: uint8 = ((b & 0x7000) >> 12);
opcode: uint8 = (b & 0x0f00) >> 8;
has_mask: bool = (b & 0x0080) ? true : false;
payload_len1: uint8 = (b & 0x007f);
rest_header_len: uint64 = (has_mask ? 4 : 0) + (payload_len1 < 126 ? 0 : (payload_len1 == 126 ? 2 : 8));
} &length=2;
type WebSocket_FrameHeader(b: WebSocket_FrameHeaderFixed) = record {
maybe_more_len: case b.payload_len1 of {
126 -> payload_len2: uint16; 126 -> payload_len2: uint16;
127 -> payload_len8: uint64; 127 -> payload_len8: uint64;
default -> short_len: empty; default -> short_len: empty;
}; };
maybe_mask: case b.has_mask of { maybe_masking_key: case has_mask of {
true -> mask: bytestring &length=4; true -> masking_key: bytestring &length=4;
false -> no_mask: empty; false -> no_masking_key: empty;
}; };
} &let { } &let {
payload_len: uint64 = b.payload_len1 < 126 ? b.payload_len1 : (b.payload_len1 == 126 ? payload_len2 : payload_len8); fin: bool = (first2 & 0x8000) ? true : false;
new_frame_payload = $context.flow.new_frame_payload(this); reserved: uint8 = ((first2 & 0x7000) >> 12);
} &length=b.rest_header_len; opcode: uint8 = (first2 & 0x0f00) >> 8;
payload_len1: uint8 = (first2 & 0x007f);
has_mask: bool = (first2 & 0x0080) ? true : false;
type WebSocket_FramePayloadClose(hdr: WebSocket_FrameHeader) = record { # Derived fields.
rest_header_len: uint64 = (has_mask ? 4 : 0) + (payload_len1 < 126 ? 0 : (payload_len1 == 126 ? 2 : 8));
payload_len: uint64 = payload_len1 < 126 ? payload_len1 : (payload_len1 == 126 ? payload_len2 : payload_len8);
new_frame_payload = $context.flow.new_frame_payload(this);
} &length=2+rest_header_len;
type WebSocket_FramePayloadClose = record {
status: uint16; status: uint16;
reason: bytestring &restofdata; reason: bytestring &restofdata;
} &byteorder=bigendian; } &byteorder=bigendian;
type WebSocket_FramePayloadUnmask(hdr: WebSocket_FrameHeader) = record {
data: bytestring &restofdata;
};
type WebSocket_FramePayloadChunk(len: uint64, hdr: WebSocket_FrameHeader) = record { type WebSocket_FramePayloadChunk(len: uint64, hdr: WebSocket_FrameHeader) = record {
unmask: WebSocket_FramePayloadUnmask(hdr); data: bytestring &restofdata;
} &let { } &let {
consumed_payload = $context.flow.consumed_chunk(len); consumed_payload = $context.flow.consumed_chunk_len(len);
close_payload: WebSocket_FramePayloadClose(hdr) withinput unmask.data &length=len &if(hdr.b.opcode == OPCODE_CLOSE); payload_chunk = $context.flow.process_payload_chunk(this); # unmasks if needed
close_payload: WebSocket_FramePayloadClose withinput data &length=len &if(hdr.opcode == OPCODE_CLOSE);
} &length=len; } &length=len;
type WebSocket_Frame(first_frame: bool, msg: WebSocket_Message) = record { type WebSocket_Frame(first_frame: bool, msg: WebSocket_Message) = record {
b: WebSocket_FrameHeaderFixed(first_frame); hdr: WebSocket_FrameHeader(first_frame);
hdr: WebSocket_FrameHeader(b);
# This is implementing frame payload chunking so that we do not # This is implementing frame payload chunking so that we do not
# attempt to buffer huge frames and forward data to downstream # attempt to buffer huge frames and forward data to downstream
@ -73,17 +66,17 @@ type WebSocket_Frame(first_frame: bool, msg: WebSocket_Message) = record {
} &let { } &let {
# If we find a close frame without payload, raise the event here # If we find a close frame without payload, raise the event here
# as the close won't have been parsed via chunks. # as the close won't have been parsed via chunks.
empty_close = $context.flow.process_empty_close(hdr) &if(b.opcode == OPCODE_CLOSE) && hdr.payload_len == 0; empty_close = $context.flow.process_empty_close(hdr) &if(hdr.opcode == OPCODE_CLOSE) && hdr.payload_len == 0;
}; };
type WebSocket_Message = record { type WebSocket_Message = record {
first_frame: WebSocket_Frame(true, this); first_frame: WebSocket_Frame(true, this);
optional_more_frames: case first_frame.hdr.b.fin of { optional_more_frames: case first_frame.hdr.fin of {
true -> no_more_frames: empty; true -> no_more_frames: empty;
false -> more_frames: WebSocket_Frame(false, this)[] &until($element.hdr.b.fin); false -> more_frames: WebSocket_Frame(false, this)[] &until($element.hdr.fin);
}; };
} &let { } &let {
opcode = first_frame.hdr.b.opcode; opcode = first_frame.hdr.opcode;
} &byteorder=bigendian; } &byteorder=bigendian;
flow WebSocket_Flow(is_orig: bool) { flow WebSocket_Flow(is_orig: bool) {
@ -91,14 +84,14 @@ flow WebSocket_Flow(is_orig: bool) {
%member{ %member{
bool has_mask_; bool has_mask_;
uint64_t mask_idx_; uint64_t masking_key_idx_;
uint64_t frame_payload_len_; uint64_t frame_payload_len_;
std::array<uint8_t, 4> mask_; std::array<uint8_t, 4> masking_key_;
%} %}
%init{ %init{
has_mask_ = false; has_mask_ = false;
mask_idx_ = 0; masking_key_idx_ = 0;
frame_payload_len_ = 0; frame_payload_len_ = 0;
%} %}
@ -108,11 +101,11 @@ flow WebSocket_Flow(is_orig: bool) {
connection()->zeek_analyzer()->Weird("websocket_frame_not_consumed"); connection()->zeek_analyzer()->Weird("websocket_frame_not_consumed");
frame_payload_len_ = ${hdr.payload_len}; frame_payload_len_ = ${hdr.payload_len};
has_mask_ = ${hdr.b.has_mask}; has_mask_ = ${hdr.has_mask};
mask_idx_ = 0; masking_key_idx_ = 0;
if ( has_mask_ ) { if ( has_mask_ ) {
assert(${hdr.mask}.length() == static_cast<int>(mask_.size())); assert(${hdr.masking_key}.length() == static_cast<int>(masking_key_.size()));
memcpy(mask_.data(), ${hdr.mask}.data(), mask_.size()); memcpy(masking_key_.data(), ${hdr.masking_key}.data(), masking_key_.size());
} }
return frame_payload_len_; return frame_payload_len_;
%} %}
@ -122,7 +115,7 @@ flow WebSocket_Flow(is_orig: bool) {
return frame_payload_len_; return frame_payload_len_;
%} %}
function consumed_chunk(len: uint64): uint64 function consumed_chunk_len(len: uint64): uint64
%{ %{
if ( len > frame_payload_len_ ) { if ( len > frame_payload_len_ ) {
connection()->zeek_analyzer()->Weird("websocket_frame_consuming_too_much"); connection()->zeek_analyzer()->Weird("websocket_frame_consuming_too_much");

4
testing/btest/Baseline/scripts.base.protocols.websocket.coalesced-reply-ping/out-coalesced
View file

@ -9,8 +9,8 @@ websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 11, data, Hello Zeek!
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, text, payload_len, 12 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, text, payload_len, 12
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 12, data, Hello there! websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 12, data, Hello there!
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,

4
testing/btest/Baseline/scripts.base.protocols.websocket.coalesced-reply-ping/out-separate
View file

@ -9,8 +9,8 @@ websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 11, data, Hello Zeek!
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, text, payload_len, 12 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, text, payload_len, 12
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 12, data, Hello there! websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 12, data, Hello there!
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,

14
testing/btest/Baseline/scripts.base.protocols.websocket.events/out
View file

@ -52,12 +52,12 @@ websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, binary, payload_l
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 409, data, HTTP/1.1 301 Moved Permanently\x0d\x0aServer: nginx\x0d\x0aDate: Fri, 12 Jan 2024 17:15:32 GMT\x0d\x0aContent-Type: text/html\x0d\x0aContent-Len websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 409, data, HTTP/1.1 301 Moved Permanently\x0d\x0aServer: nginx\x0d\x0aDate: Fri, 12 Jan 2024 17:15:32 GMT\x0d\x0aContent-Type: text/html\x0d\x0aContent-Len
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, binary websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, binary
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close
broker-websocket.pcap broker-websocket.pcap
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=38776/tcp, resp_h=127.0.0.1, resp_p=27599/tcp], host=localhost:27599, uri=/v1/messages/json, user_agent=Python/3.10 websockets/12.0, subprotocol=<uninitialized>, client_protocols=<uninitialized>, server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=E58pVwft35HPkD/MFCjtEA==, server_accept=HxOmr1a2nvOOc4Qiv7Ou3wrCsJc=] websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=38776/tcp, resp_h=127.0.0.1, resp_p=27599/tcp], host=localhost:27599, uri=/v1/messages/json, user_agent=Python/3.10 websockets/12.0, subprotocol=<uninitialized>, client_protocols=<uninitialized>, server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=E58pVwft35HPkD/MFCjtEA==, server_accept=HxOmr1a2nvOOc4Qiv7Ou3wrCsJc=]
@ -86,8 +86,8 @@ websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, text, payload_len
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 361, data, {"type": "data-message", "topic": "/zeek/event/my_topic", "@data-type": "vector", "data": [{"@data-type": "count", "data websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 361, data, {"type": "data-message", "topic": "/zeek/event/my_topic", "@data-type": "vector", "data": [{"@data-type": "count", "data
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, text websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, text
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close
message-too-big-status.pcap message-too-big-status.pcap
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=60956/tcp, resp_h=127.0.0.1, resp_p=8080/tcp], host=localhost:8080, uri=/, user_agent=Python/3.10 websockets/12.0, subprotocol=v1, client_protocols=[v1], server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=iTel1Ova5Nhz/G7VlI2qKg==, server_accept=YsQYYLj7ZCpzTLsVLb+w/ydy79E=] websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=60956/tcp, resp_h=127.0.0.1, resp_p=8080/tcp], host=localhost:8080, uri=/, user_agent=Python/3.10 websockets/12.0, subprotocol=v1, client_protocols=[v1], server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=iTel1Ova5Nhz/G7VlI2qKg==, server_accept=YsQYYLj7ZCpzTLsVLb+w/ydy79E=]
@ -95,12 +95,12 @@ websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, ping, payload_len
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 4, data, Zeek websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 4, data, Zeek
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, ping websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, ping
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 31 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 31
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1009, reason, over size limit (4 > 2 bytes)
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 31, data, \x03\xf1over size limit (4 > 2 bytes) websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 31, data, \x03\xf1over size limit (4 > 2 bytes)
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1009, reason, over size limit (4 > 2 bytes)
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close
two-binary-fragments.pcap two-binary-fragments.pcap
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=50198/tcp, resp_h=127.0.0.1, resp_p=8080/tcp], host=localhost:8080, uri=/, user_agent=Python/3.10 websockets/12.0, subprotocol=v1, client_protocols=[v1], server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=cQGA5Z1nvyUJ9XOVIaLaQA==, server_accept=zWaHVUKxEGPDs+xJeKtzkE1bm54=] websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=50198/tcp, resp_h=127.0.0.1, resp_p=8080/tcp], host=localhost:8080, uri=/, user_agent=Python/3.10 websockets/12.0, subprotocol=v1, client_protocols=[v1], server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=cQGA5Z1nvyUJ9XOVIaLaQA==, server_accept=zWaHVUKxEGPDs+xJeKtzkE1bm54=]
@ -119,10 +119,10 @@ websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, continuation, pay
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 7, data, there! websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 7, data, there!
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, binary websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, binary
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, T, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, close
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2 websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_len, 2
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8 websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close