Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

websocket: Verify Sec-WebSocket-Key/Accept headers and review feedback

Browse source 
Don't log them, they are random and arbitrary in the normal case. Users
can do the following to log them if wanted.

    redef += WebSocket::Info$client_key += { &log };
    redef += WebSocket::Info$server_accept += { &log };
This commit is contained in:
Arne Welzel 2024-01-19 17:32:06 +01:00
parent a6c1d12206
commit e17655be61
16 changed files with 100 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/init-bare.zeek
View file

@ -470,10 +470,10 @@ export {
## Whether to enable DPD on WebSocket frame payload by default.
const use_dpd_default = T &redef;
## Record type that is passed to :zeek:see:`WebSocket::__configure_analyzer`.
## Record type that is passed to :zeek:see:`WebSocket::configure_analyzer`.
##
## This allows to configure the WebSocket analyzer given parameters
## collected from HTTP headers.
## This record allows to configure the WebSocket analyzer given
## parameters collected from HTTP headers.
type AnalyzerConfig: record {
## The analyzer to attach for analysis of the WebSocket
## frame payload. See *use_dpd* below for the behavior

2
scripts/base/protocols/websocket/consts.zeek
View file

@ -18,4 +18,6 @@ export {
[OPCODE_PING] = "ping",
[OPCODE_PONG] = "pong",
} &default=function(opcode: count): string { return fmt("unknown-%x", opcode); } &redef;
const HANDSHAKE_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
}

57
scripts/base/protocols/websocket/main.zeek
View file

@ -1,11 +1,13 @@
##! Implements base functionality for WebSocket analysis.
##!
##! Upon a websocket_handshake(), logs all gathered information into websocket.log
##! and then configures the WebSocket analyzer with the headers collected using
##! http events.
##! Upon a websocket_established() event, logs all gathered information into
##! websocket.log and configures the WebSocket analyzer with the headers
##! collected via http events.
@load base/protocols/http
@load ./consts
module WebSocket;
# Register the WebSocket analyzer as HTTP upgrade analyzer.
@ -38,6 +40,10 @@ export {
server_extensions: vector of string &log &optional;
## The extensions requested by the client, if any.
client_extensions: vector of string &log &optional;
## The Sec-WebSocket-Key header from the client.
client_key: string &optional;
## The Sec-WebSocket-Accept header from the server.
server_accept: string &optional;
};
## Event that can be handled to access the WebSocket record as it is
@ -71,6 +77,10 @@ function set_websocket(c: connection)
);
}
function expected_accept_for(key: string): string {
return encode_base64(hexstr_to_bytestring(sha1_hash(key + HANDSHAKE_GUID)));
}
event http_header(c: connection, is_orig: bool, name: string, value: string)
{
if ( ! starts_with(name, "SEC-WEBSOCKET-") )
@ -98,11 +108,21 @@ event http_header(c: connection, is_orig: bool, name: string, value: string)
ws$client_extensions += split_string(value, / *, */);
}
else if ( name == "SEC-WEBSOCKET-KEY" )
{
if ( ws?$client_key )
Reporter::conn_weird("websocket_multiple_key_headers", c, "", "WebSocket");
ws$client_key = value;
}
}
else
{
if ( name == "SEC-WEBSOCKET-PROTOCOL" )
{
if ( ws?$subprotocol )
Reporter::conn_weird("websocket_multiple_protocol_headers", c, "", "WebSocket");
ws$subprotocol = value;
}
else if ( name == "SEC-WEBSOCKET-EXTENSIONS" )
@ -112,6 +132,13 @@ event http_header(c: connection, is_orig: bool, name: string, value: string)
ws$server_extensions += split_string(value, / *, */);
}
else if ( name == "SEC-WEBSOCKET-ACCEPT" )
{
if ( ws?$server_accept )
Reporter::conn_weird("websocket_multiple_accept_headers", c, "", "WebSocket");
ws$server_accept = value;
}
}
}
@ -119,23 +146,39 @@ event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string)
{
# If we see a http_request and have websocket state, wipe it as
# we should've seen a websocket_handshake even on success and
# we should've seen a websocket_established even on success and
# likely no more http events.
if ( ! c?$websocket )
delete c$websocket;
}
event websocket_handshake(c: connection, aid: count) &priority=5
event websocket_established(c: connection, aid: count) &priority=5
{
if ( ! c?$websocket )
{
# This means we never saw a Sec-WebSocket-* header, weird.
Reporter::conn_weird("websocket_handshake_unexpected", c, "", "WebSocket");
Reporter::conn_weird("websocket_established_unexpected", c, "", "WebSocket");
set_websocket(c);
}
local ws = c$websocket;
if ( ! ws?$client_key )
Reporter::conn_weird("websocket_missing_key_header", c, "", "WebSocket");
if ( ! ws?$server_accept )
Reporter::conn_weird("websocket_missing_accept_header", c, "", "WebSocket");
# Verify the Sec-WebSocket-Accept header's value given the Sec-WebSocket-Key header's value.
if ( ws?$client_key && ws?$server_accept )
{
local expected_accept = expected_accept_for(ws$client_key);
if ( ws$server_accept != expected_accept )
Reporter::conn_weird("websocket_wrong_accept_header", c,
fmt("expected=%s, found=%s", expected_accept, ws$server_accept),
"WebSocket");
}
# Replicate some information from the HTTP.log
if ( c?$http )
{
@ -150,7 +193,7 @@ event websocket_handshake(c: connection, aid: count) &priority=5
}
}
event websocket_handshake(c: connection, aid: count) &priority=-5
event websocket_established(c: connection, aid: count) &priority=-5
{
local ws = c$websocket;

2
src/analyzer/protocol/websocket/WebSocket.cc
View file

@ -23,7 +23,7 @@ void WebSocket_Analyzer::Init() {
tcp::TCP_ApplicationAnalyzer::Init();
// This event calls back via Configure()
zeek::BifEvent::enqueue_websocket_handshake(this, Conn(), GetID());
zeek::BifEvent::enqueue_websocket_established(this, Conn(), GetID());
}
bool WebSocket_Analyzer::Configure(zeek::RecordValPtr config) {

2
src/analyzer/protocol/websocket/events.bif
View file

@ -11,7 +11,7 @@
##
## .. zeek:see:: WebSocket::configure_analyzer
##
event websocket_handshake%(c: connection, aid: count%);
event websocket_established%(c: connection, aid: count%);
## Generated for every WebSocket frame.
##

6
src/analyzer/protocol/websocket/functions.bif
View file

@ -6,19 +6,19 @@ module WebSocket;
## Configure the WebSocket analyzer.
##
## Called during :zeek:see:`websocket_handshake` to configure
## Called during :zeek:see:`websocket_established` to configure
## the WebSocket analyzer given the selected protocol and extension
## as chosen by the server.
##
## c: The WebSocket connection.
#
## aid: The identifier for the WebSocket analyzer as provided to :zeek:see:`websocket_handshake`.
## aid: The identifier for the WebSocket analyzer as provided to :zeek:see:`websocket_established`.
##
## server_protocol: The protocol as found in the server's Sec-WebSocket-Protocol HTTP header, or empty.
##
## server_extensions: The extension as selected by the server via the Sec-WebSocket-Extensions HTTP Header.
##
## .. zeek:see:: websocket_handshake
## .. zeek:see:: websocket_established
function __configure_analyzer%(c: connection, aid: count, config: WebSocket::AnalyzerConfig%): bool
%{
auto* analyzer = c->FindAnalyzer(aid);

2
testing/btest/Baseline/coverage.record-fields/out.default
View file

@ -887,10 +887,12 @@ connection {
* websocket: record WebSocket::Info, log=F, optional=T
WebSocket::Info {
* client_extensions: vector of string, log=T, optional=T
* client_key: string, log=F, optional=T
* client_protocols: vector of string, log=T, optional=T
* host: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* server_accept: string, log=F, optional=T
* server_extensions: vector of string, log=T, optional=T
* subprotocol: string, log=T, optional=T
* ts: time, log=T, optional=F

2
testing/btest/Baseline/scripts.base.protocols.websocket.coalesced-reply-ping/out-coalesced
View file

@ -1,5 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
websocket_handshake, CHhAvVGS1DHFjwGM9, 7
websocket_established, CHhAvVGS1DHFjwGM9, 7
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, ping, payload_len, 4
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 4, data, Zeek
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, pong, payload_len, 4

2
testing/btest/Baseline/scripts.base.protocols.websocket.coalesced-reply-ping/out-separate
View file

@ -1,5 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
websocket_handshake, CHhAvVGS1DHFjwGM9, 7
websocket_established, CHhAvVGS1DHFjwGM9, 7
websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, ping, payload_len, 4
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 4, data, Zeek
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, pong, payload_len, 4

6
testing/btest/Baseline/scripts.base.protocols.websocket.events/out
View file

@ -1,6 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
jupyter-websocket.pcap
websocket_handshake, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=40492/tcp, resp_h=127.0.0.1, resp_p=51185/tcp], host=192.168.122.182, uri=/user/christian/api/kernels/f8645ecd-0a76-4bb1-9e6e-cb464276bc69/channels?session_id=deeecee7-efc2-42a1-a7c1-e1c0569436e3, user_agent=Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0, subprotocol=v1.kernel.websocket.jupyter.org, client_protocols=[v1.kernel.websocket.jupyter.org], server_extensions=<uninitialized>, client_extensions=[permessage-deflate]]
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=40492/tcp, resp_h=127.0.0.1, resp_p=51185/tcp], host=192.168.122.182, uri=/user/christian/api/kernels/f8645ecd-0a76-4bb1-9e6e-cb464276bc69/channels?session_id=deeecee7-efc2-42a1-a7c1-e1c0569436e3, user_agent=Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0, subprotocol=v1.kernel.websocket.jupyter.org, client_protocols=[v1.kernel.websocket.jupyter.org], server_extensions=<uninitialized>, client_extensions=[permessage-deflate], client_key=7K5Qx7HwJUsja5KzBhGvfQ==, server_accept=USseDip1PofjB67M6I5CNkbYbp0=]
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, binary, payload_len, 262
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 262, data, \x06\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00=\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x02\x01\x00\x00\x00\x00\x00\x00\x04\x01\x00\x00\x00\x00\x00\x00\x06\x01\x00\x00\x00\x00\x00\x00shell{"date":"2023-09-29T23:25:05.568Z","msg_id":"5af8fd02-14a1-
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, binary
@ -44,7 +44,7 @@ websocket_frame, CHhAvVGS1DHFjwGM9, F, fin, T, rsv, 0, opcode, close, payload_le
websocket_close, CHhAvVGS1DHFjwGM9, F, status, 0, reason,
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close
wstunnel-http.pcap
websocket_handshake, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=51102/tcp, resp_h=127.0.0.1, resp_p=8888/tcp], host=localhost:8888, uri=/v1/events, user_agent=<uninitialized>, subprotocol=v1, client_protocols=[v1, authorization.bearer.eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjAxOGNmZWFiLWY5OWQtNzBmNy05NmFmLTBlOGJhNjk2YTFmNiIsInAiOiJUY3AiLCJyIjoiemVlay5vcmciLCJycCI6ODB9.FsquetBp_jsIDzBslWyyTPlS2hcMprVuWmbT2r57N0A], server_extensions=<uninitialized>, client_extensions=<uninitialized>]
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=51102/tcp, resp_h=127.0.0.1, resp_p=8888/tcp], host=localhost:8888, uri=/v1/events, user_agent=<uninitialized>, subprotocol=v1, client_protocols=[v1, authorization.bearer.eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjAxOGNmZWFiLWY5OWQtNzBmNy05NmFmLTBlOGJhNjk2YTFmNiIsInAiOiJUY3AiLCJyIjoiemVlay5vcmciLCJycCI6ODB9.FsquetBp_jsIDzBslWyyTPlS2hcMprVuWmbT2r57N0A], server_extensions=<uninitialized>, client_extensions=<uninitialized>, client_key=FdRecb4tsolqJgO+HrbUfg==, server_accept=PbXiEPoL5O2wxc6/MdNHnSOXy+c=]
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, binary, payload_len, 72
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 72, data, GET / HTTP/1.1\x0d\x0aHost: zeek.org\x0d\x0aUser-Agent: curl/7.81.0\x0d\x0aAccept: */*\x0d\x0a\x0d\x0a
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, binary
@ -60,7 +60,7 @@ websocket_close, CHhAvVGS1DHFjwGM9, F, status, 1000, reason,
websocket_frame_data, CHhAvVGS1DHFjwGM9, F, len, 2, data, \x03\xe8
websocket_message, CHhAvVGS1DHFjwGM9, F, opcode, close
broker-websocket.pcap
websocket_handshake, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=38776/tcp, resp_h=127.0.0.1, resp_p=27599/tcp], host=localhost:27599, uri=/v1/messages/json, user_agent=Python/3.10 websockets/12.0, subprotocol=<uninitialized>, client_protocols=<uninitialized>, server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits]]
websocket_established, CHhAvVGS1DHFjwGM9, 7, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=127.0.0.1, orig_p=38776/tcp, resp_h=127.0.0.1, resp_p=27599/tcp], host=localhost:27599, uri=/v1/messages/json, user_agent=Python/3.10 websockets/12.0, subprotocol=<uninitialized>, client_protocols=<uninitialized>, server_extensions=<uninitialized>, client_extensions=[permessage-deflate; client_max_window_bits], client_key=E58pVwft35HPkD/MFCjtEA==, server_accept=HxOmr1a2nvOOc4Qiv7Ou3wrCsJc=]
websocket_frame, CHhAvVGS1DHFjwGM9, T, fin, T, rsv, 0, opcode, text, payload_len, 24
websocket_frame_data, CHhAvVGS1DHFjwGM9, T, len, 24, data, ["/zeek/event/my_topic"]
websocket_message, CHhAvVGS1DHFjwGM9, T, opcode, text

11
testing/btest/Baseline/scripts.base.protocols.websocket.key-accept-wrong/websocket.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path websocket
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p host uri user_agent subprotocol client_protocols server_extensions client_extensions
#types time string addr port addr port string string string string vector[string] vector[string] vector[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 53654 127.0.0.1 8080 localhost:8080 / Python/3.10 websockets/12.0 v1 v1 - permessage-deflate; client_max_window_bits
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.websocket.key-accept-wrong/weird.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 53654 127.0.0.1 8080 websocket_wrong_accept_header expected=N8ntNYkX6Qerw4tK3s/CYzpSZNc=, found=N8ntNYkX6Qerw4tK3s/CYzpSZNc=-wrong F zeek WebSocket
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/websocket/wrong-accept-header.pcap Normal file
View file

Binary file not shown.

4
testing/btest/scripts/base/protocols/websocket/coalesced-reply-ping.zeek
View file

@ -12,9 +12,9 @@
@load base/protocols/websocket
event websocket_handshake(c: connection, aid: count)
event websocket_established(c: connection, aid: count)
{
print "websocket_handshake", c$uid, aid;
print "websocket_established", c$uid, aid;
}
event websocket_frame(c: connection, is_orig: bool, fin: bool, rsv: count, opcode: count, payload_len: count)

4
testing/btest/scripts/base/protocols/websocket/events.zeek
View file

@ -12,9 +12,9 @@
@load base/protocols/websocket
event websocket_handshake(c: connection, aid: count)
event websocket_established(c: connection, aid: count)
{
print "websocket_handshake", c$uid, aid, c$websocket;
print "websocket_established", c$uid, aid, c$websocket;
}
event websocket_message(c: connection, is_orig: bool, opcode: count)

7
testing/btest/scripts/base/protocols/websocket/key-accept-wrong.zeek Normal file
View file

@ -0,0 +1,7 @@
# @TEST-DOC: Test weird generation when the Sec-WebSocket-Accept socket isn't as expected.
#
# @TEST-EXEC: zeek -b -r $TRACES/websocket/wrong-accept-header.pcap %INPUT
# @TEST-EXEC: btest-diff websocket.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/websocket