/*
* mod_wstunnel originally based off https://github.com/nori0428/mod_websocket
* Portions of this module Copyright(c) 2017, Glenn Strauss, All rights reserved
* Portions of this module Copyright(c) 2010, Norio Kobota, All rights reserved.
*/
/*
* Copyright(c) 2010, Norio Kobota, All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* - Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* - Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* - Neither the name of the 'incremental' nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGE.
*/
/* NOTES:
*
* mod_wstunnel has been largely rewritten from Norio Kobota mod_websocket.
*
* highlighted differences from Norio Kobota mod_websocket
* - re-coded to use lighttpd 1.4.46 buffer, chunkqueue, and gw_backend APIs
* - websocket.server "ext" value is no longer regex;
* operates similar to mod_proxy for either path prefix or extension match
* - validation of "origins" value is no longer regex; operates as suffix match
* (admin could use lighttpd.conf regex on "Origin" or "Sec-WebSocket-Origin"
* and reject non-matches with mod_access if such regex validation required)
* - websocket transparent proxy mode removed; functionality is now in mod_proxy
* Backend server which responds to Connection: upgrade and Upgrade: websocket
* should check "Origin" and/or "Sec-WebSocket-Origin". lighttpd.conf could
* additionally be configured to check
* $REQUEST_HEADER["Sec-WebSocket-Origin"] !~ "..."
* with regex, and mod_access used to reject non-matches, if desired.
* - connections to backend no longer block, but only first address returned
* by getaddrinfo() is used; lighttpd does not cycle through all addresses
* returned by DNS resolution. Note: DNS resolution occurs once at startup.
* - directives renamed from websocket.* to wstunnel.*
* - directive websocket.ping_interval replaced with wstunnel.ping-interval
* (note the '_' changed to '-')
* - directive websocket.timeout should be replaced with server.max-read-idle
* - attribute "type" is an independent directive wstunnel.frame-type
* (default is "text" unless "binary" is specified)
* - attribute "origins" is an independent directive wstunnel.origins
* - attribute "proto" removed; mod_proxy can proxy to backend websocket server
* - attribute "subproto" should be replaced with mod_setenv directive
* setenv.set-response-header = ( "Sec-WebSocket-Protocol" => "..." )
* if header is required
*
* If mod_wstunnel is first to send websocket CLOSE frame, mod_wstunnel calls
* shutdown(fd, SHUT_WR) for HTTP/1.1 without waiting to receive websocket CLOSE
* frame from client. lighttpd continues to read and discard data from HTTP/1.1
* client for a short time before calling close() on the HTTP/1.1 client socket,
* but does not parse for websocket CLOSE frame from client. (RFC6455 suggests
* waiting to receive websocket CLOSE frame from peer before socket shutdown.)
*
* References:
* https://en.wikipedia.org/wiki/WebSocket
* https://tools.ietf.org/html/rfc6455
* https://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-00
*/
#include "first.h"
#include <sys/types.h>
#include <limits.h>
#include <string.h>
#include "gw_backend.h"
#include "base.h"
#include "array.h"
#include "buffer.h"
#include "chunk.h"
#include "fdevent.h"
#include "http_header.h"
#include "http_status.h"
#include "log.h"
#define MOD_WEBSOCKET_LOG_NONE 0
#define MOD_WEBSOCKET_LOG_ERR 1
#define MOD_WEBSOCKET_LOG_WARN 2
#define MOD_WEBSOCKET_LOG_INFO 3
#define MOD_WEBSOCKET_LOG_DEBUG 4
#define DEBUG_LOG_ERR(format, ...) \
if (hctx->gw.conf.debug >= MOD_WEBSOCKET_LOG_ERR) { log_error(hctx->gw.r->conf.errh, __FILE__, __LINE__, (format), __VA_ARGS__); }
#define DEBUG_LOG_WARN(format, ...) \
if (hctx->gw.conf.debug >= MOD_WEBSOCKET_LOG_WARN) { log_warn(hctx->gw.r->conf.errh, __FILE__, __LINE__, (format), __VA_ARGS__); }
#define DEBUG_LOG_INFO(format, ...) \
if (hctx->gw.conf.debug >= MOD_WEBSOCKET_LOG_INFO) { log_info(hctx->gw.r->conf.errh, __FILE__, __LINE__, (format), __VA_ARGS__); }
#define DEBUG_LOG_DEBUG(format, ...) \
if (hctx->gw.conf.debug >= MOD_WEBSOCKET_LOG_DEBUG) { log_debug(hctx->gw.r->conf.errh, __FILE__, __LINE__, (format), __VA_ARGS__); }
typedef struct {
gw_plugin_config gw; /* start must match layout of gw_plugin_config */
const array *origins;
unsigned int frame_type;
unsigned short int ping_interval;
} plugin_config;
typedef struct plugin_data {
PLUGIN_DATA;
pid_t srv_pid; /* must match layout of gw_plugin_data to defaults member */
plugin_config defaults;
} plugin_data;
typedef enum {
MOD_WEBSOCKET_FRAME_STATE_INIT,
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
MOD_WEBSOCKET_FRAME_STATE_READ_EX_LENGTH,
MOD_WEBSOCKET_FRAME_STATE_READ_MASK,
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
MOD_WEBSOCKET_FRAME_STATE_READ_PAYLOAD
} mod_wstunnel_frame_state_t;
typedef enum {
MOD_WEBSOCKET_FRAME_TYPE_TEXT,
MOD_WEBSOCKET_FRAME_TYPE_BIN,
MOD_WEBSOCKET_FRAME_TYPE_CLOSE,
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
MOD_WEBSOCKET_FRAME_TYPE_PING,
MOD_WEBSOCKET_FRAME_TYPE_PONG
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
} mod_wstunnel_frame_type_t;
/* map mod_wstunnel_frame_type_t to string */
static const char * const mod_wstunnel_frame_type_str[] = {
"text", "binary", "close", "ping", "pong"
};
typedef struct {
uint64_t siz;
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
uint32_t mask_off;
#define MOD_WEBSOCKET_MASK_CNT 4
unsigned char mask[MOD_WEBSOCKET_MASK_CNT];
/* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
} mod_wstunnel_frame_control_t;
typedef struct {
int8_t state;
int8_t type, type_cont, type_backend; /* mod_wstunnel_frame_type_t */
mod_wstunnel_frame_control_t ctl;
buffer *payload;
} mod_wstunnel_frame_t;
typedef struct {
gw_handler_ctx gw;
mod_wstunnel_frame_t frame;
int hybivers;
int subproto;
unix_time64_t ping_ts;
plugin_config conf;
} handler_ctx;
/* prototypes */
static handler_t mod_wstunnel_handshake_create_response(handler_ctx *);
static int mod_wstunnel_frame_send(handler_ctx *, mod_wstunnel_frame_type_t, const char *, size_t);
static int mod_wstunnel_frame_recv(handler_ctx *);
/*#define _MOD_WEBSOCKET_SPEC_IETF_00_*/ /* obsolete */
#define _MOD_WEBSOCKET_SPEC_RFC_6455_
INIT_FUNC(mod_wstunnel_init);
SETDEFAULTS_FUNC(mod_wstunnel_set_defaults);
REQUEST_FUNC(mod_wstunnel_check_extension);
TRIGGER_FUNC(mod_wstunnel_handle_trigger);
static const plugin mod_wstunnel_plugin = {
.name = "wstunnel",
.version = LIGHTTPD_VERSION_ID,
.init = mod_wstunnel_init,
.cleanup = gw_free,
.set_defaults = mod_wstunnel_set_defaults,
.handle_uri_clean = mod_wstunnel_check_extension,
.handle_subrequest = gw_handle_subrequest,
.handle_request_reset = gw_handle_request_reset,
.handle_trigger = mod_wstunnel_handle_trigger,
.handle_waitpid = gw_handle_waitpid_cb
};
INIT_FUNC(mod_wstunnel_init) {
plugin_data * const pd = ck_calloc(1, sizeof(plugin_data));
pd->self = &mod_wstunnel_plugin;
return pd;
}
__attribute_cold__
__declspec_dllexport__
int mod_wstunnel_plugin_init(plugin *p);
int mod_wstunnel_plugin_init(plugin *p) {
memcpy(p, &mod_wstunnel_plugin, sizeof(plugin));
return 0;
}
static void mod_wstunnel_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* wstunnel.server */
if (cpv->vtype == T_CONFIG_LOCAL) {
gw_plugin_config * const gw = cpv->v.v;
pconf->gw.exts = gw->exts;
pconf->gw.exts_auth = gw->exts_auth;
pconf->gw.exts_resp = gw->exts_resp;
}
break;
case 1: /* wstunnel.balance */
/*if (cpv->vtype == T_CONFIG_LOCAL)*//*always true here for this param*/
pconf->gw.balance = (int)cpv->v.u;
break;
case 2: /* wstunnel.debug */
pconf->gw.debug = (int)cpv->v.u;
break;
case 3: /* wstunnel.map-extensions */
pconf->gw.ext_mapping = cpv->v.a;
break;
case 4: /* wstunnel.frame-type */
pconf->frame_type = cpv->v.u;
break;
case 5: /* wstunnel.origins */
pconf->origins = cpv->v.a;
break;
case 6: /* wstunnel.ping-interval */
pconf->ping_interval = cpv->v.shrt;
break;
default:/* should not happen */
return;
}
}
static void mod_wstunnel_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_wstunnel_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
static void mod_wstunnel_patch_config(request_st * const r, const plugin_data * const p, plugin_config * const pconf) {
memcpy(pconf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(r, (uint32_t)p->cvlist[i].k_id))
mod_wstunnel_merge_config(pconf, p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_wstunnel_set_defaults) {
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("wstunnel.server"),
T_CONFIG_ARRAY_KVARRAY,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.balance"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.debug"),
T_CONFIG_INT,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.map-extensions"),
T_CONFIG_ARRAY_KVSTRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.frame-type"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.origins"),
T_CONFIG_ARRAY_VLIST,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("wstunnel.ping-interval"),
T_CONFIG_SHORT,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_wstunnel"))
return HANDLER_ERROR;
/* process and validate config directives
* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
gw_plugin_config *gw = NULL;
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* wstunnel.server */
gw = ck_calloc(1, sizeof(gw_plugin_config));
if (!gw_set_defaults_backend(srv, (gw_plugin_data *)p, cpv->v.a,
gw, 0, cpk[cpv->k_id].k)) {
gw_plugin_config_free(gw);
return HANDLER_ERROR;
}
/* error if "mode" = "authorizer";
* wstunnel can not act as authorizer */
/*(check after gw_set_defaults_backend())*/
if (gw->exts_auth && gw->exts_auth->used) {
log_error(srv->errh, __FILE__, __LINE__,
"%s must not define any hosts with "
"attribute \"mode\" = \"authorizer\"", cpk[cpv->k_id].k);
gw_plugin_config_free(gw);
return HANDLER_ERROR;
}
cpv->v.v = gw;
cpv->vtype = T_CONFIG_LOCAL;
break;
case 1: /* wstunnel.balance */
cpv->v.u = (unsigned int)gw_get_defaults_balance(srv, cpv->v.b);
break;
case 2: /* wstunnel.debug */
case 3: /* wstunnel.map-extensions */
break;
case 4: /* wstunnel.frame-type */
/*(default frame-type to "text" unless "binary" is specified)*/
cpv->v.u =
buffer_eq_icase_slen(cpv->v.b, CONST_STR_LEN("binary"));
break;
case 5: /* wstunnel.origins */
for (uint32_t j = 0; j < cpv->v.a->used; ++j) {
buffer *origin = &((data_string *)cpv->v.a->data[j])->value;
if (buffer_is_blank(origin)) {
log_error(srv->errh, __FILE__, __LINE__,
"unexpected empty string in %s", cpk[cpv->k_id].k);
return HANDLER_ERROR;
}
}
break;
case 6: /* wstunnel.ping-interval */
break;
default:/* should not happen */
break;
}
}
/* disable check-local for all exts (default enabled) */
if (gw && gw->exts) { /*(check after gw_set_defaults_backend())*/
gw_exts_clear_check_local(gw->exts);
}
}
/* default is 0 */
/*p->defaults.balance = (unsigned int)gw_get_defaults_balance(srv, NULL);*/
p->defaults.ping_interval = 0; /* do not send ping */
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_wstunnel_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
static handler_t wstunnel_create_env(gw_handler_ctx *gwhctx) {
handler_ctx *hctx = (handler_ctx *)gwhctx;
request_st * const r = hctx->gw.r;
handler_t rc;
if (0 != r->reqbody_length && r->http_version == HTTP_VERSION_1_1) {
/* Defer reading websocket protocol from HTTP/1.1 client until
* request body has been received, and then discarded.
* mod_wstunnel_check_extension() requires GET method for HTTP/1.1
* so (r->conf.http_parseopts & HTTP_PARSEOPT_METHOD_GET_BODY) if
* r->reqbody_length, which is not the default config */
if (r->state == CON_STATE_READ_POST) {
r->conf.stream_request_body &=
~(FDEVENT_STREAM_REQUEST | FDEVENT_STREAM_REQUEST_BUFMIN);
rc = r->con->reqbody_read(r);
if (rc != HANDLER_GO_ON) return rc;
}
chunkqueue_mark_written(&r->reqbody_queue, r->reqbody_length);
}
http_response_upgrade_read_body_unknown(r);
chunkqueue_append_chunkqueue(&r->reqbody_queue, &r->read_queue);
rc = mod_wstunnel_handshake_create_response(hctx);
if (rc != HANDLER_GO_ON) return rc;
r->http_status = (r->http_version > HTTP_VERSION_1_1)
? 200 /* OK (response status for CONNECT) */
: 101; /* Switching Protocols */
r->resp_body_started = 1;
hctx->ping_ts = log_monotonic_secs;
gw_set_transparent(&hctx->gw);
return HANDLER_GO_ON;
}
static handler_t wstunnel_stdin_append(gw_handler_ctx *gwhctx) {
/* prepare websocket frames to backend */
/* (caller should verify r->reqbody_queue) */
/*assert(!chunkqueue_is_empty(&r->reqbody_queue));*/
handler_ctx *hctx = (handler_ctx *)gwhctx;
if (0 == mod_wstunnel_frame_recv(hctx))
return HANDLER_GO_ON;
else {
gw_handle_request_reset(hctx->gw.r, hctx->gw.plugin_data);
return HANDLER_FINISHED;
}
}
static handler_t wstunnel_recv_parse(request_st * const r, http_response_opts * const opts, buffer * const b, size_t n) {
handler_ctx *hctx = (handler_ctx *)opts->pdata;
if (0 == n) return HANDLER_FINISHED;
if (mod_wstunnel_frame_send(hctx, hctx->frame.type_backend, b->ptr, n) < 0)
return HANDLER_ERROR;
buffer_clear(b);
UNUSED(r);
return HANDLER_GO_ON;
}
__attribute_cold__
__attribute_noinline__
static int
wstunnel_err (handler_ctx * const hctx, unsigned short wstatus, const char *err) {
if (err)
DEBUG_LOG_ERR("%s", err);
if (wstatus) {
char code[2] = { (char)(wstatus >> 8), (char)(wstatus & 0xff) };
hctx->subproto = wstatus; /* overload to flag CLOSE; wstatus >= 1000 */
mod_wstunnel_frame_send(hctx, MOD_WEBSOCKET_FRAME_TYPE_CLOSE, code, 2);
}
return -1;
}
static int wstunnel_is_allowed_origin(request_st * const r, handler_ctx * const hctx) {
/* If allowed origins is set (and not empty list), fail closed if no match.
* Note that origin provided in request header has not been normalized, so
* change in case or other non-normal forms might not match allowed list */
const array * const allowed_origins = hctx->conf.origins;
const buffer *origin = NULL;
size_t olen;
if (NULL == allowed_origins || 0 == allowed_origins->used)
return 0;
/* "Origin" header is preferred
* ("Sec-WebSocket-Origin" is from older drafts of websocket spec <= 10) */
origin = http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Origin"));
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
if (NULL == origin) {
origin =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Origin"));
}
#endif
olen = origin ? buffer_clen(origin) : 0;
if (0 == olen) {
wstunnel_err(hctx, 0, "Origin header is invalid");
return 400; /* Bad Request */
}
for (size_t i = 0; i < allowed_origins->used; ++i) {
buffer *b = &((data_string *)allowed_origins->data[i])->value;
size_t blen = buffer_clen(b);
if ((olen > blen ? origin->ptr[olen-blen-1] == '.' : olen == blen)
&& 0 == memcmp(origin->ptr+olen-blen, b->ptr, blen)) {
return 0;
}
}
DEBUG_LOG_INFO("%s does not match any allowed origins", origin->ptr);
return 403; /* Forbidden */
}
static int wstunnel_check_request(request_st * const r, handler_ctx * const hctx) {
/*(redundant since HTTP/1.1 required in mod_wstunnel_check_extension())*/
if (!r->http_host || buffer_is_blank(r->http_host))
return 400; /* Bad Request */
return wstunnel_is_allowed_origin(r, hctx);
}
static void wstunnel_backend_error(gw_handler_ctx *gwhctx) {
handler_ctx *hctx = (handler_ctx *)gwhctx;
if (hctx->gw.state == GW_STATE_WRITE || hctx->gw.state == GW_STATE_READ)
wstunnel_err(hctx, 1011, NULL); /* Internal Server Error */
}
static void wstunnel_handler_ctx_free(void *gwhctx) {
handler_ctx *hctx = (handler_ctx *)gwhctx;
if (hctx->subproto < 1000 /*(overloaded; CLOSE not yet sent)*/
/* CON_STATE_HANDLE_REQUEST || CON_STATE_WRITE */
&& hctx->gw.r->state < CON_STATE_RESPONSE_END /*!RESPONSE_END,!ERROR*/
&& (gw_plugin_data *)hctx->gw.r->handler_module
== hctx->gw.plugin_data /*(needed?)*/
&& ( hctx->gw.state == GW_STATE_WRITE
|| hctx->gw.state == GW_STATE_READ )) {
wstunnel_err(hctx, 1001, NULL);
}
chunk_buffer_release(hctx->frame.payload);
}
static handler_t wstunnel_handler_setup (request_st * const r, handler_ctx * const hctx, const plugin_config * const pconf) {
memcpy(&hctx->conf, pconf, sizeof(plugin_config));
int status = wstunnel_check_request(r, hctx);
if (status)
return http_status_set_err(r, status);
const buffer *vers =
http_header_request_get(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Version"));
hctx->hybivers = -1;
if (vers) {
const char *err;
const int64_t hybivers =
li_restricted_strtoint64(BUF_PTR_LEN(vers), &err);
if (hybivers == 13 && err == vers->ptr+buffer_clen(vers))
hctx->hybivers = (int)hybivers;
}
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
else
hctx->hybivers = 0;
#endif
if (hctx->hybivers < 0) {
http_header_response_set(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Version"),
CONST_STR_LEN("13"));
wstunnel_err(hctx, 0, "invalid Sec-WebSocket-Version");
return http_status_set_err(r, 400); /* Bad Request */
}
DEBUG_LOG_INFO("WebSocket Version = %d", hctx->hybivers);
hctx->gw.opts.backend = BACKEND_PROXY; /*(act proxy-like)*/
hctx->gw.opts.pdata = hctx;
hctx->gw.opts.headers = 0; /*(should not be necessary to unset)*/
hctx->gw.opts.parse = wstunnel_recv_parse;
hctx->gw.stdin_append = wstunnel_stdin_append;
hctx->gw.create_env = wstunnel_create_env;
hctx->gw.handler_ctx_free = wstunnel_handler_ctx_free;
hctx->gw.backend_error = wstunnel_backend_error;
hctx->gw.response = chunk_buffer_acquire();
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_INIT;
hctx->frame.ctl.siz = 0;
hctx->frame.payload = chunk_buffer_acquire();
unsigned int binary = hctx->conf.frame_type; /*(0 = "text"; 1 = "binary")*/
const buffer *vb =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Protocol"));
if (NULL != vb) {
if (http_header_str_contains_token(BUF_PTR_LEN(vb), CONST_STR_LEN("binary")))
hctx->subproto = binary = 1;
else if (http_header_str_contains_token(BUF_PTR_LEN(vb), CONST_STR_LEN("base64")))
hctx->subproto = -1;
}
if (binary) {
hctx->frame.type = MOD_WEBSOCKET_FRAME_TYPE_BIN;
hctx->frame.type_backend = MOD_WEBSOCKET_FRAME_TYPE_BIN;
}
#if 0 /*(already zero-inited)*/
else {
hctx->frame.type = MOD_WEBSOCKET_FRAME_TYPE_TEXT;
hctx->frame.type_backend = MOD_WEBSOCKET_FRAME_TYPE_TEXT;
}
#endif
return HANDLER_GO_ON;
}
static handler_t mod_wstunnel_check_extension(request_st * const r, void *p_d) {
if (NULL != r->handler_module)
return HANDLER_GO_ON;
if (r->http_version > HTTP_VERSION_1_1) {
if (!r->h2_connect_ext)
return HANDLER_GO_ON;
}
else {
if (r->http_method != HTTP_METHOD_GET)
return HANDLER_GO_ON;
if (r->http_version != HTTP_VERSION_1_1)
return HANDLER_GO_ON;
/*
* Connection: upgrade, keep-alive, ...
* Upgrade: WebSocket, ...
*/
const buffer *vb;
vb = http_header_request_get(r, HTTP_HEADER_UPGRADE, CONST_STR_LEN("Upgrade"));
if (NULL == vb
|| !http_header_str_contains_token(BUF_PTR_LEN(vb), CONST_STR_LEN("websocket")))
return HANDLER_GO_ON;
vb = http_header_request_get(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"));
if (NULL == vb
|| !http_header_str_contains_token(BUF_PTR_LEN(vb), CONST_STR_LEN("upgrade")))
return HANDLER_GO_ON;
}
plugin_config pconf;
mod_wstunnel_patch_config(r, p_d, &pconf);
if (NULL == pconf.gw.exts) return HANDLER_GO_ON;
pconf.gw.upgrade = 1;
handler_t rc =
gw_check_extension(r, (gw_plugin_config *)&pconf,
p_d, 1, sizeof(handler_ctx));
const plugin_data_base * const pd = p_d;
return (HANDLER_GO_ON == rc && r->handler_module == pd)
? wstunnel_handler_setup(r, r->plugin_ctx[pd->id], &pconf)
: rc;
}
TRIGGER_FUNC(mod_wstunnel_handle_trigger) {
gw_handle_trigger(srv, p_d);
plugin_data_base * const pd = p_d;
const unix_time64_t cur_ts = log_monotonic_secs + 1;
struct hxcon h1c;
h1c.rused = 1;
for (connection *con = srv->conns; con; con = con->next) {
hxcon * const hx = con->hx ? con->hx : (h1c.r[0] = &con->request, &h1c);
for (uint32_t i = 0, rused = hx->rused; i < rused; ++i) {
request_st * const r = hx->r[i];
handler_ctx * const hctx = r->plugin_ctx[pd->id];
if (NULL == hctx || r->handler_module != pd)
continue;
if (hctx->gw.state != GW_STATE_WRITE && hctx->gw.state != GW_STATE_READ)
continue;
/* attempt to cleanly close websocket if connection idle timeout
* (occurs 1 sec sooner than r->conf.max_read_idle due to +1 above)
* (note: >= HTTP/2 affected only if entire connection is idle) */
if (__builtin_expect(
(cur_ts - con->read_idle_ts > r->conf.max_read_idle), 0)) {
DEBUG_LOG_INFO("timeout client (fd=%d)", con->fd);
wstunnel_err(hctx, 1001, NULL);
gw_handle_request_reset(r, pd);
joblist_append(con);
continue;
}
if (0 != hctx->hybivers
&& hctx->conf.ping_interval > 0
&& (int32_t)hctx->conf.ping_interval + hctx->ping_ts < cur_ts) {
hctx->ping_ts = cur_ts;
mod_wstunnel_frame_send(hctx, MOD_WEBSOCKET_FRAME_TYPE_PING, CONST_STR_LEN("ping"));
joblist_append(con);
continue;
}
}
}
return HANDLER_GO_ON;
}
/*
* modified from Norio Kobota mod_websocket_handshake.c
*/
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
#include <stdlib.h> /* strtoul() free() */
#include "sys-crypto-md.h" /* lighttpd */
#include "sys-endian.h" /* lighttpd */
static int get_key3(request_st * const r, char *buf, uint32_t bytes) {
/* 8 bytes should have been sent with request
* for draft-ietf-hybi-thewebsocketprotocol-00 */
chunkqueue *cq = &r->reqbody_queue;
/*(caller should ensure bytes available prior to calling this routine)*/
/*assert(chunkqueue_length(cq) >= 8);*/
/*assert(8 == bytes);*/
return chunkqueue_read_data(cq, buf, bytes, r->conf.errh);
}
static int get_key_number(uint32_t *ret, const buffer *b) {
const char * const s = b->ptr;
size_t j = 0;
unsigned long n;
uint32_t sp = 0;
char tmp[10 + 1]; /* #define UINT32_MAX_STRLEN 10 */
for (size_t i = 0, used = buffer_clen(b); i < used; ++i) {
if (light_isdigit(s[i])) {
tmp[j] = s[i];
if (++j >= sizeof(tmp)) return -1;
}
else if (s[i] == ' ') ++sp; /* count num spaces */
}
tmp[j] = '\0';
n = strtoul(tmp, NULL, 10);
if (n > UINT32_MAX || 0 == sp || !light_isdigit(*tmp)) return -1;
*ret = (uint32_t)n / sp;
return 0;
}
static int create_MD5_sum(request_st * const r) {
uint32_t buf[4]; /* MD5 binary hash len */
const buffer *key1 =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Key1"));
const buffer *key2 =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Key2"));
if (NULL == key1 || get_key_number(buf+0, key1) < 0 ||
NULL == key2 || get_key_number(buf+1, key2) < 0 ||
get_key3(r, (char *)(buf+2), 2*sizeof(uint32_t)) < 0) {
return -1;
}
#ifdef __BIG_ENDIAN__
#define ws_htole32(s,u)\
(s)[0]=((u)>>24); \
(s)[1]=((u)>>16); \
(s)[2]=((u)>>8); \
(s)[3]=((u))
uint32_t u;
u = buf[0];
ws_htole32((unsigned char *)(buf+0), u);
u = buf[1];
ws_htole32((unsigned char *)(buf+1), u);
#endif
/*(overwrite buf[] with result)*/
MD5_once((unsigned char *)buf, buf, sizeof(buf));
chunkqueue_append_mem(&r->write_queue, (char *)buf, sizeof(buf));
return 0;
}
static int create_response_ietf_00(handler_ctx *hctx) {
request_st * const r = hctx->gw.r;
/* "Origin" header is preferred
* ("Sec-WebSocket-Origin" is from older drafts of websocket spec) */
const buffer *origin = http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Origin"));
if (NULL == origin) {
origin =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Origin"));
}
if (NULL == origin)
return wstunnel_err(hctx, 0, "Origin header is invalid");
/*(redundant since HTTP/1.1 required in mod_wstunnel_check_extension())*/
if (!r->http_host || buffer_is_blank(r->http_host))
return -1;
/* calc MD5 sum from keys */
if (create_MD5_sum(r) < 0)
return wstunnel_err(hctx, 0, "Sec-WebSocket-Key is invalid");
http_header_response_set(r, HTTP_HEADER_UPGRADE,
CONST_STR_LEN("Upgrade"),
CONST_STR_LEN("websocket"));
#if 0 /*(added later in http_response_write_header())*/
http_header_response_append(r, HTTP_HEADER_CONNECTION,
CONST_STR_LEN("Connection"),
CONST_STR_LEN("upgrade"));
#endif
#if 0 /*(Sec-WebSocket-Origin header is not required for hybi-00)*/
/* Note: it is insecure to simply reflect back origin provided by client
* (if admin did not configure restricted list of valid origins)
* (see wstunnel_check_request()) */
http_header_response_set(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Origin"),
BUF_PTR_LEN(origin));
#endif
buffer * const value =
http_header_response_set_ptr(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Location"));
if (buffer_is_equal_string(&r->uri.scheme, CONST_STR_LEN("https")))
buffer_copy_string_len(value, CONST_STR_LEN("wss://"));
else
buffer_copy_string_len(value, CONST_STR_LEN("ws://"));
buffer_append_str2(value, BUF_PTR_LEN(r->http_host),
BUF_PTR_LEN(&r->uri.path));
return 0;
}
#endif /* _MOD_WEBSOCKET_SPEC_IETF_00_ */
#ifdef _MOD_WEBSOCKET_SPEC_RFC_6455_
#include "sys-crypto-md.h" /* lighttpd */
#include "base64.h" /* lighttpd */
static int create_response_rfc_6455(handler_ctx *hctx) {
request_st * const r = hctx->gw.r;
if (r->http_version == HTTP_VERSION_1_1) {
SHA_CTX sha;
unsigned char sha_digest[SHA_DIGEST_LENGTH];
const buffer *value_wskey =
http_header_request_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Sec-WebSocket-Key"));
if (NULL == value_wskey)
return wstunnel_err(hctx, 0, "Sec-WebSocket-Key is invalid");
/* get SHA1 hash of key */
/* refer: RFC-6455 Sec.1.3 Opening Handshake */
SHA1_Init(&sha);
SHA1_Update(&sha, (const unsigned char *)BUF_PTR_LEN(value_wskey));
SHA1_Update(&sha, (const unsigned char *)CONST_STR_LEN("258EAFA5-E914-47DA-95CA-C5AB0DC85B11"));
SHA1_Final(sha_digest, &sha);
http_header_response_set(r, HTTP_HEADER_UPGRADE,
CONST_STR_LEN("Upgrade"),
CONST_STR_LEN("websocket"));
#if 0 /*(added later in http_response_write_header())*/
http_header_response_append(r, HTTP_HEADER_CONNECTION,
CONST_STR_LEN("Connection"),
CONST_STR_LEN("upgrade"));
#endif
buffer * const value =
http_header_response_set_ptr(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Accept"));
buffer_append_base64_encode(value, sha_digest, SHA_DIGEST_LENGTH, BASE64_STANDARD);
}
if (1 == hctx->subproto)
http_header_response_set(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Protocol"),
CONST_STR_LEN("binary"));
else if (-1 == hctx->subproto)
http_header_response_set(r, HTTP_HEADER_OTHER,
CONST_STR_LEN("Sec-WebSocket-Protocol"),
CONST_STR_LEN("base64"));
return 0;
}
#endif /* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
handler_t mod_wstunnel_handshake_create_response(handler_ctx *hctx) {
request_st * const r = hctx->gw.r;
#ifdef _MOD_WEBSOCKET_SPEC_RFC_6455_
if (hctx->hybivers >= 8) {
if (0 != create_response_rfc_6455(hctx)) {
r->http_status = 400; /* Bad Request */
return HANDLER_ERROR;
}
return HANDLER_GO_ON;
}
#endif /* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
if (hctx->hybivers == 0 && r->http_version == HTTP_VERSION_1_1) {
/* 8 bytes should have been sent with request
* for draft-ietf-hybi-thewebsocketprotocol-00 */
chunkqueue *cq = &r->reqbody_queue;
if (chunkqueue_length(cq) < 8)
return HANDLER_WAIT_FOR_EVENT;
if (0 != create_response_ietf_00(hctx)) {
r->http_status = 400; /* Bad Request */
return HANDLER_ERROR;
}
return HANDLER_GO_ON;
}
#endif /* _MOD_WEBSOCKET_SPEC_IETF_00_ */
wstunnel_err(hctx, 0, "unsupported WebSocket Version");
r->http_status = 503; /* Service Unavailable */
return HANDLER_ERROR;
}
/*
* modified from Norio Kobota mod_websocket_frame.c
*/
#include "base64.h" /* lighttpd */
#include "http_chunk.h" /* lighttpd */
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
static int send_ietf_00(handler_ctx *hctx, mod_wstunnel_frame_type_t type, const char *payload, size_t siz) {
static const char head = 0; /* 0x00 */
static const char tail = ~0; /* 0xff */
request_st * const r = hctx->gw.r;
char *mem;
size_t len;
switch (type) {
case MOD_WEBSOCKET_FRAME_TYPE_TEXT:
if (0 == siz) return 0;
http_chunk_append_mem(r, &head, 1);
http_chunk_append_mem(r, payload, siz);
http_chunk_append_mem(r, &tail, 1);
/*len = siz+2;*/
break;
case MOD_WEBSOCKET_FRAME_TYPE_BIN:
if (0 == siz) return 0;
http_chunk_append_mem(r, &head, 1);
len = 4*(siz/3)+4+1;
/* avoid accumulating too much data in memory; send to tmpfile */
mem = ck_malloc(len);
len=li_to_base64(mem,len,(unsigned char *)payload,siz,BASE64_STANDARD);
http_chunk_append_mem(r, mem, len);
free(mem);
http_chunk_append_mem(r, &tail, 1);
/*len += 2;*/
break;
case MOD_WEBSOCKET_FRAME_TYPE_CLOSE:
http_chunk_append_mem(r, &tail, 1);
http_chunk_append_mem(r, &head, 1);
/*len = 2;*/
break;
default:
return -1; /*(not reached)*/
}
return 0;
}
static int recv_ietf_00(handler_ctx *hctx) {
buffer_string_prepare_copy(hctx->gw.r->tmp_buf, 65535);
request_st * const r = hctx->gw.r;
chunkqueue *cq = &r->reqbody_queue;
while (!chunkqueue_is_empty(cq)) {
char *frame = r->tmp_buf->ptr;
uint32_t i, flen = buffer_string_space(r->tmp_buf);
if (0 != chunkqueue_peek_data(cq, &frame, &flen, r->conf.errh, 0))
return wstunnel_err(hctx, 1011, NULL); /* Internal Server Error */
for (i = 0; i < flen; ) {
if (hctx->frame.state == MOD_WEBSOCKET_FRAME_STATE_INIT) {
hctx->frame.ctl.siz = 0;
if (__builtin_expect( (frame[i] != 0x00), 0))
return (((unsigned char *)frame)[i] == 0xff) /* close */
? wstunnel_err(hctx, 1000, NULL) /* Normal Closure */
: wstunnel_err(hctx, 1002, "frame type invalid");
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_READ_PAYLOAD;
if (++i == flen)
break;
}
/* hctx->frame.state == MOD_WEBSOCKET_FRAME_STATE_READ_PAYLOAD */
/* MOD_WEBSOCKET_FRAME_TYPE_TEXT or MOD_WEBSOCKET_FRAME_TYPE_BIN */
if (chunkqueue_length(&hctx->gw.wb) > 65536 - 16384) {
flen = i; /* trigger for loop exit */
i += chunkqueue_length(cq) + 1;
break;
}
else {
uint32_t plen = flen - i;
char *mem = (char *)memchr(frame+i, 0xff, plen);
if (mem != NULL) {
plen = (uint32_t)(mem - (frame+i));
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_INIT;
}
hctx->frame.ctl.siz += plen;
#define MOD_WEBSOCKET_BUFMAX 0xfffff
if (hctx->frame.ctl.siz > MOD_WEBSOCKET_BUFMAX)
return wstunnel_err(hctx, 1002, "frame size has exceeded 0xfffff");
DEBUG_LOG_DEBUG("recv payload, size=%u", plen);
buffer * const payload = hctx->frame.payload;
buffer_append_string_len(payload, frame+i, plen);
i += plen + 1; /* +1 for 0xff, or flen fully consumed */
if (buffer_is_blank(payload))
continue;
if (hctx->frame.type == MOD_WEBSOCKET_FRAME_TYPE_TEXT) {
hctx->frame.ctl.siz = 0;
chunkqueue_append_buffer(&hctx->gw.wb, payload);
/*buffer_clear(payload);*//*chunkqueue_append_buffer clear*/
}
else { /* hctx->frame.type == MOD_WEBSOCKET_FRAME_TYPE_BIN */
/* base64 decode in groups of 4 bytes to avoid buffering
* in memory the entire frame, which could be up to 1 MB */
plen = buffer_clen(payload);
if (hctx->frame.state != MOD_WEBSOCKET_FRAME_STATE_INIT)
plen &= ~0x3; /* (plen -= (plen % 4)) */
size_t len = (plen+3)/4*3+1;
chunkqueue_get_memory(&hctx->gw.wb, &len);
buffer * const b = hctx->gw.wb.last->mem;
len = buffer_clen(b);
if (!buffer_append_base64_decode(b, payload->ptr, plen,
BASE64_STANDARD))
return wstunnel_err(hctx, 1007, "fail to base64-decode");
/*chunkqueue_use_memory()*/
hctx->gw.wb.bytes_in += buffer_clen(b)-len;
const uint32_t n = buffer_clen(payload) - plen;
if (0 == n)
buffer_clear(payload);
else {
memmove(payload->ptr, payload->ptr+plen, n);
buffer_truncate(payload, n);
}
}
}
}
chunkqueue_mark_written(cq, flen);
if (i > flen && i - flen > chunkqueue_length(cq))
break; /* flag to wait to receive more data */
}
return 0;
}
#endif /* _MOD_WEBSOCKET_SPEC_IETF_00_ */
#ifdef _MOD_WEBSOCKET_SPEC_RFC_6455_
#define MOD_WEBSOCKET_OPCODE_CONT 0x00
#define MOD_WEBSOCKET_OPCODE_TEXT 0x01
#define MOD_WEBSOCKET_OPCODE_BIN 0x02
#define MOD_WEBSOCKET_OPCODE_CLOSE 0x08
#define MOD_WEBSOCKET_OPCODE_PING 0x09
#define MOD_WEBSOCKET_OPCODE_PONG 0x0A
#define MOD_WEBSOCKET_FRAME_LEN16 0x7E
#define MOD_WEBSOCKET_FRAME_LEN63 0x7F
#define MOD_WEBSOCKET_FRAME_LEN16_CNT 2
#define MOD_WEBSOCKET_FRAME_LEN63_CNT 8
/* map mod_wstunnel_frame_type_t to rfc6455 opcode */
static const char mod_wstunnel_frame_type_op[] = {
MOD_WEBSOCKET_OPCODE_TEXT
,MOD_WEBSOCKET_OPCODE_BIN
,MOD_WEBSOCKET_OPCODE_CLOSE
,MOD_WEBSOCKET_OPCODE_PING
,MOD_WEBSOCKET_OPCODE_PONG
};
/* map rfc6455 opcode to mod_wstunnel_frame_type_t */
static const int8_t mod_wstunnel_op_frame_type[] = {
-1
,MOD_WEBSOCKET_FRAME_TYPE_TEXT
,MOD_WEBSOCKET_FRAME_TYPE_BIN
,-1
,-1
,-1
,-1
,-1
,MOD_WEBSOCKET_FRAME_TYPE_CLOSE
,MOD_WEBSOCKET_FRAME_TYPE_PING
,MOD_WEBSOCKET_FRAME_TYPE_PONG
,-1
,-1
,-1
,-1
,-1
};
static int send_rfc_6455(handler_ctx *hctx, mod_wstunnel_frame_type_t type, const char *payload, size_t siz) {
char mem[10];
size_t len;
/* allowed null payload for ping, pong, close frame */
if (payload == NULL && ( type == MOD_WEBSOCKET_FRAME_TYPE_TEXT
|| type == MOD_WEBSOCKET_FRAME_TYPE_BIN )) {
return -1;
}
mem[0] = (char)(0x80 | mod_wstunnel_frame_type_op[type]);
if (siz < MOD_WEBSOCKET_FRAME_LEN16) {
mem[1] = siz;
len = 2;
}
else if (siz <= UINT16_MAX) {
mem[1] = MOD_WEBSOCKET_FRAME_LEN16;
mem[2] = (siz >> 8) & 0xff;
mem[3] = siz & 0xff;
len = 1+MOD_WEBSOCKET_FRAME_LEN16_CNT+1;
}
else {
mem[1] = MOD_WEBSOCKET_FRAME_LEN63;
mem[2] = 0;
mem[3] = 0;
mem[4] = 0;
mem[5] = 0;
mem[6] = (siz >> 24) & 0xff;
mem[7] = (siz >> 16) & 0xff;
mem[8] = (siz >> 8) & 0xff;
mem[9] = siz & 0xff;
len = 1+MOD_WEBSOCKET_FRAME_LEN63_CNT+1;
}
request_st * const r = hctx->gw.r;
http_chunk_append_mem(r, mem, len);
#ifdef __COVERITY__
if (payload == NULL) ck_assert(0 == siz);
#endif
if (siz) http_chunk_append_mem(r, payload, siz);
return 0;
}
__attribute_hot__
__attribute_noinline__
static void unmask_payload(handler_ctx *hctx) {
/* For clients such as browsers running untrusted javascript, choosing
* a random, unpredictable mask is important to prevent a malicious
* application from selecting the bytes that appear on the wire,
* but mask might safely be 0 for non-browser clients */
if (UINT_MAX == hctx->frame.ctl.mask_off) return; /*(skip if mask all 0's)*/
unsigned char * restrict p = (unsigned char *)hctx->frame.payload->ptr;
const unsigned char * const restrict mask = hctx->frame.ctl.mask;
uint32_t used = buffer_clen(hctx->frame.payload);
uint32_t mask_off = hctx->frame.ctl.mask_off;
hctx->frame.ctl.mask_off = (mask_off + used) & 3;
#if 1 /* optimizations for faster unmasking using less CPU */
if (used > 8) { /*(arbitrarily chosen)*/
/* future: consider aligning to 32-byte cache line
* and unrolling Duff's device to 8 cases */
used -= (uint32_t)((uintptr_t)p & 3);
for (int n = (int)((uintptr_t)p & 3); n; --n)
*p++ ^= mask[mask_off++ & 3];
/* unmask in groups of 4 bytes (aligned) */
if (used >> 2) {
union { uint32_t u; char c[4]; } un;
for (int i = 0; i < 4; ++i) un.c[i] = mask[mask_off++ & 3];
#if 1
/* Duff's device */
register uint32_t n = ((used >> 2) + 3) / 4;
switch ((used >> 2) & 3) {
case 0: do { *(uint32_t*)p ^= un.u; p += 4;__attribute_fallthrough__
case 3: *(uint32_t*)p ^= un.u; p += 4;__attribute_fallthrough__
case 2: *(uint32_t*)p ^= un.u; p += 4;__attribute_fallthrough__
case 1: *(uint32_t*)p ^= un.u; p += 4;
} while (--n);
}
#else /*(alternative, if compiler does not like Duff's device)*/
for (uint32_t n = used >> 2; n; --n) {
*(uint32_t *)p ^= un.u;
p += 4;
}
#endif
}
used &= 3;
}
#endif
for (uint32_t i = 0; i < used; ++i)
p[i] ^= mask[mask_off++ & 3];
}
static int recv_rfc_6455(handler_ctx *hctx) {
buffer_string_prepare_copy(hctx->gw.r->tmp_buf, 65535);
request_st * const r = hctx->gw.r;
chunkqueue *cq = &r->reqbody_queue;
buffer *payload = hctx->frame.payload;
while (!chunkqueue_is_empty(cq)) {
char *frame = r->tmp_buf->ptr;
uint32_t i, flen = buffer_string_space(r->tmp_buf);
if (0 != chunkqueue_peek_data(cq, &frame, &flen, r->conf.errh, 0))
return wstunnel_err(hctx, 1011, NULL); /* Internal Server Error */
for (i = 0; i < flen; ) {
switch (hctx->frame.state) {
case MOD_WEBSOCKET_FRAME_STATE_INIT:
if (__builtin_expect( (flen - i < 2 + MOD_WEBSOCKET_MASK_CNT), 0)) {
/* yield to collect initial 2 bytes of frame + 4 byte mask*/
flen = i; /* trigger for loop exit */
i += 2 + MOD_WEBSOCKET_MASK_CNT;
continue;
}
hctx->frame.type = mod_wstunnel_op_frame_type[(frame[i] & 0xf)];
switch (frame[i] & 0xf) {
case MOD_WEBSOCKET_OPCODE_CONT:
if (0 == hctx->frame.type_cont)
return wstunnel_err(hctx, 1002, "stray continuation frame");
hctx->frame.type = mod_wstunnel_op_frame_type[hctx->frame.type_cont];
if (frame[i] & 0x80) /* fin bit 1 ends continuation */
hctx->frame.type_cont = 0;
break;
case MOD_WEBSOCKET_OPCODE_TEXT:
case MOD_WEBSOCKET_OPCODE_BIN:
if (hctx->frame.type_cont)
return wstunnel_err(hctx, 1002, "missing continuation frame with fin");
if (0 == (frame[i] & 0x80)) /* fin bit 0; continuation */
hctx->frame.type_cont = (frame[i] & 0xf);
break;
case MOD_WEBSOCKET_OPCODE_CLOSE:
return wstunnel_err(hctx, 1000, NULL); /* Normal Closure */
case MOD_WEBSOCKET_OPCODE_PING:
case MOD_WEBSOCKET_OPCODE_PONG:
if (0 == (frame[i] & 0x80))
return wstunnel_err(hctx, 1002, "control frame fragmented");
break;
default:
return wstunnel_err(hctx, 1002, "frame type invalid");
}
/* future: might add support: RFC7692 permessage-deflate */
if (frame[i] & 0x70)
return wstunnel_err(hctx, 1002, "reserved bits set");
if ((frame[i+1] & 0x80) != 0x80)
return wstunnel_err(hctx, 1002, "payload not masked");
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_READ_MASK;
const uint8_t siz = (((uint8_t *)frame)[i+1] & 0x7f);
if (siz < 0x7e)
hctx->frame.ctl.siz = siz;
else {
/* MOD_WEBSOCKET_FRAME_LEN16 0x7E */
/* MOD_WEBSOCKET_FRAME_LEN63 0x7F */
if (siz == MOD_WEBSOCKET_FRAME_LEN16) {
/*(already checked that we have at least 6 bytes)*/
/* unaligned (potentially) read of big-endian size */
/* modern compiler optimizers (gcc, clang) recognize these
* patterns and use more efficient instructions (e.g. bswap)
* when available */
hctx->frame.ctl.siz =
( ((uint64_t)((uint8_t *)frame)[i+2] << 8)
| (uint64_t)((uint8_t *)frame)[i+3] );
i += 2;
#if 0 /* pedantic adherence to RFC6455 */
if (hctx->frame.ctl.siz < 0x7e)
return wstunnel_err(hctx, 1002, "oversized length encoding");
#endif
}
else /* siz == MOD_WEBSOCKET_FRAME_LEN63 */
hctx->frame.state =
MOD_WEBSOCKET_FRAME_STATE_READ_EX_LENGTH;
if (frame[i] & 0x8) /* control frames (0x8-0xF) */
return wstunnel_err(hctx, 1002, "control frame size invalid");
}
i += 2;
break;
case MOD_WEBSOCKET_FRAME_STATE_READ_EX_LENGTH:
if (__builtin_expect( (flen - i < MOD_WEBSOCKET_FRAME_LEN63_CNT
+ MOD_WEBSOCKET_MASK_CNT), 0)) {
/* yield to collect extended length */
flen = i; /* trigger for loop exit */
i += MOD_WEBSOCKET_FRAME_LEN63_CNT + MOD_WEBSOCKET_MASK_CNT;
continue;
}
else {
/* unaligned (potentially) read of big-endian size */
/* modern compiler optimizers (gcc, clang) recognize these
* patterns and use more efficient instructions (e.g. bswap)
* when available */
hctx->frame.ctl.siz =
( ((uint64_t)((uint8_t *)frame)[i+0] << 56)
|((uint64_t)((uint8_t *)frame)[i+1] << 48)
|((uint64_t)((uint8_t *)frame)[i+2] << 40)
|((uint64_t)((uint8_t *)frame)[i+3] << 32)
|((uint64_t)((uint8_t *)frame)[i+4] << 24)
|((uint64_t)((uint8_t *)frame)[i+5] << 16)
|((uint64_t)((uint8_t *)frame)[i+6] << 8)
| (uint64_t)((uint8_t *)frame)[i+7] );
i += MOD_WEBSOCKET_FRAME_LEN63_CNT;
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_READ_MASK;
if (hctx->frame.ctl.siz >> 63)
return wstunnel_err(hctx, 1002, "frame size MSB is set");
#if 0 /* pedantic adherence to RFC6455 */
if (hctx->frame.ctl.siz < 0x10000)
return wstunnel_err(hctx, 1002, "oversized length encoding");
#endif
}
__attribute_fallthrough__
case MOD_WEBSOCKET_FRAME_STATE_READ_MASK:
if (__builtin_expect( (flen - i < MOD_WEBSOCKET_MASK_CNT), 0)) {
/* yield to collect extended length */
flen = i; /* trigger for loop exit */
i += MOD_WEBSOCKET_MASK_CNT;
continue;
}
if (hctx->frame.ctl.siz) {
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_READ_PAYLOAD;
hctx->frame.ctl.mask_off = /*-1 to skip if mask is all 0's*/
(frame[i]|frame[i+1]|frame[i+2]|frame[i+3]) ? 0 : UINT_MAX;
memcpy(hctx->frame.ctl.mask,frame+i,MOD_WEBSOCKET_MASK_CNT);
}
else {
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_INIT;
if (hctx->frame.type == MOD_WEBSOCKET_FRAME_TYPE_PING)
mod_wstunnel_frame_send(hctx,
MOD_WEBSOCKET_FRAME_TYPE_PONG,
NULL, 0);
}
DEBUG_LOG_DEBUG("frame type=%s, specified payload size=%llu",
mod_wstunnel_frame_type_str[hctx->frame.type],
(unsigned long long)hctx->frame.ctl.siz);
i += MOD_WEBSOCKET_MASK_CNT;
break;
case MOD_WEBSOCKET_FRAME_STATE_READ_PAYLOAD:
if (chunkqueue_length(&hctx->gw.wb) > 65536 - 16384
&& hctx->frame.type <= MOD_WEBSOCKET_FRAME_TYPE_BIN) {
/* MOD_WEBSOCKET_FRAME_TYPE_TEXT or
* MOD_WEBSOCKET_FRAME_TYPE_BIN */
flen = i; /* trigger for loop exit */
i += chunkqueue_length(cq) + 1;
continue;
}
else {
uint32_t n = flen - i;
if (hctx->frame.ctl.siz <= n) {
n = (uint32_t)hctx->frame.ctl.siz;
hctx->frame.state = MOD_WEBSOCKET_FRAME_STATE_INIT;
}
hctx->frame.ctl.siz -= n;
buffer_append_string_len(payload, frame+i, n);
i += n;
DEBUG_LOG_DEBUG(
"recv payload, size=%u; remaining payload size=%llu",
n, (unsigned long long)hctx->frame.ctl.siz);
}
switch (hctx->frame.type) {
case MOD_WEBSOCKET_FRAME_TYPE_TEXT:
/* pedantic adherence to RFC6455 would validate UTF-8
* payload, but would have to first reassemble message
* fragments, if websocket message is fragmented, since
* would want to handle messages with fragments
* (improperly) split in the middle of UTF-8 characters */
case MOD_WEBSOCKET_FRAME_TYPE_BIN:
unmask_payload(hctx);
chunkqueue_append_buffer(&hctx->gw.wb, payload);
/*buffer_clear(payload);*//*chunkqueue_append_buffer clear*/
break;
case MOD_WEBSOCKET_FRAME_TYPE_PING:
if (hctx->frame.ctl.siz == 0) {
unmask_payload(hctx);
mod_wstunnel_frame_send(hctx,
MOD_WEBSOCKET_FRAME_TYPE_PONG,
BUF_PTR_LEN(payload));
buffer_clear(payload);
}
break;
case MOD_WEBSOCKET_FRAME_TYPE_PONG:
buffer_clear(payload);
break;
/*case MOD_WEBSOCKET_FRAME_TYPE_CLOSE:*/
default:
return wstunnel_err(hctx, 1011, NULL);
}
break;
default:
return wstunnel_err(hctx, 1011, NULL); /*Internal Server Error*/
}
}
chunkqueue_mark_written(cq, flen);
if (i > flen && i - flen > chunkqueue_length(cq))
break; /* flag to wait to receive more data */
}
return 0;
}
#endif /* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
int mod_wstunnel_frame_send(handler_ctx *hctx, mod_wstunnel_frame_type_t type,
const char *payload, size_t siz) {
DEBUG_LOG_DEBUG("send to client (fd=%d), frame type=%s, payload size=%zu",
hctx->gw.r->con->fd,
mod_wstunnel_frame_type_str[type], siz);
#ifdef _MOD_WEBSOCKET_SPEC_RFC_6455_
if (hctx->hybivers >= 8) return send_rfc_6455(hctx, type, payload, siz);
#endif /* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
if (0 == hctx->hybivers) return send_ietf_00(hctx, type, payload, siz);
#endif /* _MOD_WEBSOCKET_SPEC_IETF_00_ */
return -1;
}
int mod_wstunnel_frame_recv(handler_ctx *hctx) {
DEBUG_LOG_DEBUG("recv from client (fd=%d), queue size=%llu",
hctx->gw.r->con->fd,
(long long)chunkqueue_length(&hctx->gw.r->reqbody_queue));
#ifdef _MOD_WEBSOCKET_SPEC_RFC_6455_
if (hctx->hybivers >= 8) return recv_rfc_6455(hctx);
#endif /* _MOD_WEBSOCKET_SPEC_RFC_6455_ */
#ifdef _MOD_WEBSOCKET_SPEC_IETF_00_
if (0 == hctx->hybivers) return recv_ietf_00(hctx);
#endif /* _MOD_WEBSOCKET_SPEC_IETF_00_ */
return -1; /*(not reached)*/
}
↑ V574 The 'p->cvlist' pointer is used simultaneously as an array and as a pointer to single object. Check lines: 306, 369.
↑ V574 The 'p->cvlist' pointer is used simultaneously as an array and as a pointer to single object. Check lines: 306, 370.
↑ V576 Incorrect format. Consider checking the sixth actual argument of the 'log_debug' function. The UNSIGNED integer type argument is expected.