Fixes #309

stix2/test/v21/test_observed_data.py

@@ -1117,6 +1117,20 @@ def test_network_traffic_socket_example():
     assert nt.extensions['socket-ext'].socket_type == "SOCK_STREAM"
 
 
+def test_correct_socket_options():
+    se1 = stix2.v21.SocketExt(
+        is_listening=True,
+        address_family="AF_INET",
+        protocol_family="PF_INET",
+        socket_type="SOCK_STREAM",
+        options={"ICMP6_RCVTIMEO": 100},
+    )
+
+    assert se1.address_family == "AF_INET"
+    assert se1.socket_type == "SOCK_STREAM"
+    assert se1.options == {"ICMP6_RCVTIMEO": 100}
+
+
 def test_incorrect_socket_options():
     with pytest.raises(ValueError) as excinfo:
         stix2.v21.SocketExt(

stix2/v21/observables.py

@@ -598,8 +598,9 @@ class SocketExt(_Extension):
         options = self.get('options')
 
         if options is not None:
+            acceptable_prefixes = ["SO", "ICMP", "ICMP6", "IP", "IPV6", "MCAST", "TCP", "IRLMP"]
             for key, val in options.items():
-                if key[:3] != "SO_":
+                if key[:key.find('_')] not in acceptable_prefixes:
                     raise ValueError("Incorrect options key")
                 if not isinstance(val, int):
                     raise ValueError("Options value must be an integer")