zeek/testing/btest/scripts/base/protocols
Arne Welzel efc2681152 WebSocket: Introduce new analyzer and log
This adds a new WebSocket analyzer that is enabled with the HTTP upgrade
mechanism introduced previously. It is a first implementation in BinPac with
manual chunking of frame payload. Configuration of the analyzer is sketched
via the new websocket_handshake() event and a configuration BiF called
WebSocket::__configure_analyzer(). In short, script land collects WebSocket
related HTTP headers and can forward these to the analyzer to change its
parsing behavior at websocket_handshake() time. For now, however, there's
no actual logic that would change behavior based on agreed upon extensions
exchanged via HTTP headers (e.g. frame compression). WebSocket::Configure()
simply attaches a PIA_TCP analyzer to the WebSocket analyzer for dynamic
protocol detection (or a custom analyzer if set). The added pcaps show this
in action for tunneled ssh, http and https using wstunnel. One test pcap is
Broker's WebSocket traffic from our own test suite, the other is the
Jupyter websocket traffic from the ticket/discussion.

This commit further adds a basic websocket.log that aggregates the WebSocket
specific headers (Sec-WebSocket-*) headers into a single log.

Closes #3424
2024-01-22 18:54:38 +01:00
..
arp Initial implementation of Lower-Level analyzers 2020-09-23 11:13:25 -07:00
bittorrent Adding test for BitTorrent tracker. 2021-12-21 17:48:26 +01:00
conn GH-1252: rename files with colons for Windows compatibility 2020-11-04 10:29:52 -08:00
dce-rpc dce-rpc: Test cases for unbounded state growth 2023-06-30 15:14:35 +02:00
dhcp dhcp: Handle is_orig=T for connections from server to 255.255.255.255 2023-08-28 12:15:55 +02:00
dnp3 General btest cleanup 2020-08-11 11:26:22 -07:00
dns DNS: Add Ed25519 and Ed448 enum values to parser 2023-11-17 19:56:47 +01:00
finger Provide infrastructure to migrate legacy analyzers to Spicy. 2023-02-01 11:33:48 +01:00
ftp ftp/main: Skip get_pending_command() for intermediate reply lines 2023-03-23 13:50:36 +01:00
http MIME: Cap nested MIME analysis depth to 100 2024-01-17 10:18:13 -07:00
icmp Remove deprecated ICMP events 2021-01-27 10:52:40 -07:00
imap Remove @load base/frameworks/dpd from tests 2022-08-31 17:00:55 +02:00
irc Add irc_dcc_send_ack event and fix missing fields 2023-04-24 07:29:51 +00:00
krb krb/smb2_krb_nokeytab: Register get_file_handle() to avoid warnings 2023-02-06 18:09:11 +01:00
ldap ldap: Fix substring filter parsing and rendering 2024-01-05 16:06:23 +01:00
modbus Pass parsed file record information with ReadFile/WriteFile events 2023-08-07 13:44:38 -07:00
mount GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev. 2019-05-01 21:43:45 +00:00
mqtt Remove full scripts marked as 6.1 deprecations 2023-06-14 10:07:22 -07:00
mysql mysql: Recognize when client/server negotiate SSL 2023-01-27 12:42:19 +01:00
ncp General btest cleanup 2020-08-11 11:26:22 -07:00
nfs GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev. 2019-05-01 21:43:45 +00:00
ntp NTP: Detect out-of-order packets 2023-05-04 19:44:02 +02:00
pop3 Remove @load base/frameworks/dpd from tests 2022-08-31 17:00:55 +02:00
portmap GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors 2019-11-13 13:14:14 -08:00
quic quic: Handle and log unhandled_version 2024-01-09 17:10:11 +01:00
radius Convert pcapng test suite files to pcap format 2019-11-08 13:08:06 -08:00
rdp RDP: add some enforcement to required values based on MS-RDPBCGR docs 2023-03-24 10:33:21 -07:00
rfb regularize test suite names to avoid custom/outdated suffices 2022-05-12 13:32:49 -07:00
sip GH-1507: Tolerate junk data before SIP requests 2021-04-14 15:34:07 -07:00
smb scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state() 2023-05-03 11:22:01 +02:00
smtp SMTP: No state update for bad BDAT commands 2024-01-15 18:25:41 +01:00
snap Add basic LLC, SNAP, and Novell 802.3 packet analyzers 2023-04-25 12:29:54 -07:00
snmp General btest cleanup 2020-08-11 11:26:22 -07:00
socks socks/dpd: Fix socks5_server side signature 2023-06-05 13:54:47 +02:00
ssh Added several events for detailed info on the SSH2 key init directions 2022-12-05 12:35:05 +01:00
ssl SSL: Add new extension types and ECH test 2023-10-30 14:19:16 +00:00
syslog General btest cleanup 2020-08-11 11:26:22 -07:00
tcp Add testcase for TCP segment offloading. 2021-11-23 12:37:55 +00:00
websocket WebSocket: Introduce new analyzer and log 2024-01-22 18:54:38 +01:00
xmpp Remove @load base/frameworks/dpd from tests 2022-08-31 17:00:55 +02:00
bdat-chunk-size-overflow.test SMTP/BDAT: Fix int/int64_t/uint64_t confusion 2024-01-19 13:05:26 +01:00
bdat-chunk-size-overflow2.test SMTP/BDAT: Use strtoull and bail on UULONG_MAX values 2024-01-19 13:24:07 +01:00
bdat-negative-chunk-size.test SMTP/BDAT: Fix int/int64_t/uint64_t confusion 2024-01-19 13:05:26 +01:00