From e03b725ce161697f64c7e5b7ded70a134adf5430 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 26 Mar 2026 15:36:33 +0100
Subject: [PATCH] websocket: add test with control frame in reassembly

Ticket: 8413
---
 tests/websocket-control-frag/README.md  |  11 +++++++++++
 tests/websocket-control-frag/input.pcap | Bin 0 -> 1441 bytes
 tests/websocket-control-frag/test.rules |   1 +
 tests/websocket-control-frag/test.yaml  |  12 ++++++++++++
 4 files changed, 24 insertions(+)
 create mode 100644 tests/websocket-control-frag/README.md
 create mode 100644 tests/websocket-control-frag/input.pcap
 create mode 100644 tests/websocket-control-frag/test.rules
 create mode 100644 tests/websocket-control-frag/test.yaml

diff --git a/tests/websocket-control-frag/README.md b/tests/websocket-control-frag/README.md
new file mode 100644
index 000000000..5ec6777b6
--- /dev/null
+++ b/tests/websocket-control-frag/README.md
@@ -0,0 +1,11 @@
+# Description
+
+Test websocket reassembly with control frame injected
+
+# PCAP
+
+The pcap was crafted by a script supplied by wooseokdotkim
+
+# Ticket
+
+https://redmine.openinfosecfoundation.org/issues/8413
diff --git a/tests/websocket-control-frag/input.pcap b/tests/websocket-control-frag/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..854964894e452f2d9c4483df80b85f9167a693c2
GIT binary patch
literal 1441
zcmbV~PfQb05XNUqk-At#OoXU})r0gPElVwdidrS4L?T&OXd8^ucDv99=+<@-ki?K+
zO!VZzc!C7wK#ZCgV`72_{}7{%7f85x^C;dtYqHK8C~nt=gOf}<?Y{lJZ@!t0)t8TK
zV245&1^~x?{FGJp<=;+LgN;5p2Xq3Q0xkf7Jty-#zJO`l5J3Vc`_9fpZHDo51^={{
zzhb1S1`CO<0NXanMx@V-!e}5N3o6!-wi&H9jHR!CNkR`m3*Nwz!mP;!WkmX7(X@%Q
zb*aiQ-aN#2P*2kY0OBeCp?m;4QJP9pY7OK35<sxCU+^f&m@ahn_e&npEjsxwEvNeh
zbt*QV8B^VgHtysHG9%eoLiG!iYCNYYqpI%YJG69KRrHjW_6yt3oxH3njbSw|)0xI@
zb=of|-q3U`+>=ZMJM}~`bTiQ*W(OmqN$cT|n#~bR^g4Mb&-x3@TU;{x?Sk^1$(j9L
z2e8jEmsWmnxg@OuyvC9xg_-gM_7Ej#nc5ZwU8=7ID0m}?O`;%ArgSBlN{<LqR?{^_
z8_WH-K^GK7&7j#S&)~3EZfo->A>Etyjg4Q<cFDP{ulxGw*@79-9~Lu;SEhp6_*6V>
z`y7CykIb0C*3r_;LEK9$SyGrO7r{Z4XC*0UhOZL$`a$*S(A3bx5sy54s3A1NwOpI2
zX>SgnImY<2tz7Y9o6UB?UgCd5zG-BRJ{;Kssf?i}q}(6kAb=%H3bV>);EA$gQMo|9
zqRPg{0C#UQmGP^s^^CW8XIE8~#9J+)YME4pQ3Fz5Jm(;SB})pks!OnsD2o<V%LP^I
zhXH2inX2|)cU|*QUnG9zcwIDjuI^Uk#=zvDFCtIWw6S~MZS1PnN%y=jp*BxyeW(p7
zYri;X$C4$5c@l2ezvH2G5_t(d?8TYfvuAM48SC2#Tk%xQox9)wvEEub&tvBiQse>n
E166__7ytkO

literal 0
HcmV?d00001

diff --git a/tests/websocket-control-frag/test.rules b/tests/websocket-control-frag/test.rules
new file mode 100644
index 000000000..da666b912
--- /dev/null
+++ b/tests/websocket-control-frag/test.rules
@@ -0,0 +1 @@
+alert websocket any any -> any any (msg:"MALWARE"; websocket.payload; content:"MALWARE_DOWNLOAD cmd.exe /c powershell"; sid:1; rev:1;)
diff --git a/tests/websocket-control-frag/test.yaml b/tests/websocket-control-frag/test.yaml
new file mode 100644
index 000000000..6ed8cfa97
--- /dev/null
+++ b/tests/websocket-control-frag/test.yaml
@@ -0,0 +1,12 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1