mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
fb7799bdf6
A continuation frame has the same type as the first frame, but that information wasn't used nor kept, resulting payload of continuation frames not being forwarded. The pcap was created with a fake Python server and a bit of message crafting.
23 lines
713 B
Text
23 lines
713 B
Text
# @TEST-DOC: Test a HTTP request tunneled within WebSocket where the HTTP reply is fragmented. This wasn't handled properly in the first iteration.
|
|
#
|
|
# @TEST-EXEC: zeek -b -r $TRACES/websocket/fragmented-http-reply.pcap %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/websocket
|
|
|
|
# Only print http_headers after the websocket_established() event
|
|
# to reduce the noise. There' a HTTP request within the WebSocket
|
|
# tunnel.
|
|
global ws = F;
|
|
|
|
event websocket_established(c: connection, aid: count)
|
|
{
|
|
ws = T;
|
|
print "websocket_established";
|
|
}
|
|
|
|
event http_header(c: connection, is_orig: bool, original_name: string, name: string, val: string)
|
|
{
|
|
if ( ws )
|
|
print "http_header", is_orig, name, val;
|
|
}
|