Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

websocket: Fix opcode for continuation frames

Browse source 
A continuation frame has the same type as the first frame, but that
information wasn't used nor kept, resulting payload of continuation
frames not being forwarded. The pcap was created with a fake Python
server and a bit of message crafting.
This commit is contained in:
Arne Welzel 2024-01-24 22:23:19 +01:00
parent 45000e2ec8
commit fb7799bdf6
5 changed files with 36 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

23
testing/btest/scripts/base/protocols/websocket/fragmented-http-reply.zeek Normal file
View file

@ -0,0 +1,23 @@
# @TEST-DOC: Test a HTTP request tunneled within WebSocket where the HTTP reply is fragmented. This wasn't handled properly in the first iteration.
#
# @TEST-EXEC: zeek -b -r $TRACES/websocket/fragmented-http-reply.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load base/protocols/websocket
# Only print http_headers after the websocket_established() event
# to reduce the noise. There' a HTTP request within the WebSocket
# tunnel.
global ws = F;
event websocket_established(c: connection, aid: count)
{
ws = T;
print "websocket_established";
}
event http_header(c: connection, is_orig: bool, original_name: string, name: string, val: string)
{
if ( ws )
print "http_header", is_orig, name, val;
}