From b7bb81aa88a21619f9e4ff6c037ddb57a7224f40 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 6 Jun 2024 23:20:13 +0200 Subject: [PATCH] websocket: adds check for data frame Ticket: 7051 --- tests/websocket/test.rules | 3 ++- tests/websocket/test.yaml | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/websocket/test.rules b/tests/websocket/test.rules index 5165ca648..bfd1c4ca2 100644 --- a/tests/websocket/test.rules +++ b/tests/websocket/test.rules @@ -1,5 +1,6 @@ alert websocket any any -> any any (msg:"header frame"; flow:established,to_server; frame:websocket.header; content:"|81 88|"; sid:1;) -alert websocket any any -> any any (msg:"pdu frame"; flow:established,to_client; frame:websocket.pdu; content:"|81 15|version,hybi-draft-13"; sid:2;) +alert websocket any any -> any any (msg:"pdu frame"; flow:established,to_client; frame:websocket.pdu; content:"|81 15|version,hybi-draft-13"; startswith; endswith; sid:2;) +alert websocket any any -> any any (msg:"data frame"; flow:established,to_client; frame:websocket.data; content:"version,hybi-draft-13"; startswith; endswith; sid:21;) alert websocket any any -> any any (msg:"ws opcode"; flow:established,to_client; websocket.opcode:text; sid:3;) alert websocket any any -> any any (msg:"ws mask"; flow:established,to_server; websocket.mask:>0; sid:4;) alert websocket any any -> any any (msg:"ws fin"; flow:established,to_server; websocket.flags:fin; sid:5;) diff --git a/tests/websocket/test.yaml b/tests/websocket/test.yaml index 3f66ec652..4730555d2 100644 --- a/tests/websocket/test.yaml +++ b/tests/websocket/test.yaml @@ -16,6 +16,11 @@ checks: match: event_type: alert alert.signature_id: 2 +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 21 - filter: count: 1 match: -- 2.47.2