Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

websocket: Verify Sec-WebSocket-Key/Accept headers and review feedback

Browse source 
Don't log them, they are random and arbitrary in the normal case. Users
can do the following to log them if wanted.

    redef += WebSocket::Info$client_key += { &log };
    redef += WebSocket::Info$server_accept += { &log };
This commit is contained in:
Arne Welzel 2024-01-19 17:32:06 +01:00
parent a6c1d12206
commit e17655be61
16 changed files with 100 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/base/protocols/websocket/coalesced-reply-ping.zeek
View file

@ -12,9 +12,9 @@
@load base/protocols/websocket
event websocket_handshake(c: connection, aid: count)
event websocket_established(c: connection, aid: count)
{
print "websocket_handshake", c$uid, aid;
print "websocket_established", c$uid, aid;
}
event websocket_frame(c: connection, is_orig: bool, fin: bool, rsv: count, opcode: count, payload_len: count)

4
testing/btest/scripts/base/protocols/websocket/events.zeek
View file

@ -12,9 +12,9 @@
@load base/protocols/websocket
event websocket_handshake(c: connection, aid: count)
event websocket_established(c: connection, aid: count)
{
print "websocket_handshake", c$uid, aid, c$websocket;
print "websocket_established", c$uid, aid, c$websocket;
}
event websocket_message(c: connection, is_orig: bool, opcode: count)

7
testing/btest/scripts/base/protocols/websocket/key-accept-wrong.zeek Normal file
View file

@ -0,0 +1,7 @@
# @TEST-DOC: Test weird generation when the Sec-WebSocket-Accept socket isn't as expected.
#
# @TEST-EXEC: zeek -b -r $TRACES/websocket/wrong-accept-header.pcap %INPUT
# @TEST-EXEC: btest-diff websocket.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/websocket