aboutsummaryrefslogtreecommitdiff
path: root/third_party/websockify/other
diff options
context:
space:
mode:
Diffstat (limited to 'third_party/websockify/other')
-rw-r--r--third_party/websockify/other/Makefile14
-rw-r--r--third_party/websockify/other/README.md51
-rwxr-xr-xthird_party/websockify/other/launch.sh108
-rw-r--r--third_party/websockify/other/project.clj13
-rw-r--r--third_party/websockify/other/websocket.c802
-rw-r--r--third_party/websockify/other/websocket.h84
-rw-r--r--third_party/websockify/other/websocket.rb456
-rw-r--r--third_party/websockify/other/websockify.c385
-rw-r--r--third_party/websockify/other/websockify.clj233
-rw-r--r--third_party/websockify/other/websockify.js141
-rwxr-xr-xthird_party/websockify/other/websockify.rb171
-rwxr-xr-xthird_party/websockify/other/wswrap22
12 files changed, 2480 insertions, 0 deletions
diff --git a/third_party/websockify/other/Makefile b/third_party/websockify/other/Makefile
new file mode 100644
index 00000000..f8d28645
--- /dev/null
+++ b/third_party/websockify/other/Makefile
@@ -0,0 +1,14 @@
+TARGETS=websockify
+CFLAGS += -fPIC
+
+all: $(TARGETS)
+
+websockify: websockify.o websocket.o
+ $(CC) $(LDFLAGS) $^ -lssl -lcrypto -lresolv -o $@
+
+websocket.o: websocket.c websocket.h
+websockify.o: websockify.c websocket.h
+
+clean:
+ rm -f websockify *.o
+
diff --git a/third_party/websockify/other/README.md b/third_party/websockify/other/README.md
new file mode 100644
index 00000000..1851e2aa
--- /dev/null
+++ b/third_party/websockify/other/README.md
@@ -0,0 +1,51 @@
+This directory contain alternate implementations of
+WebSockets-to-TCP-Socket proxies (for noVNC).
+
+## websockify.c (C)
+
+### Description
+
+This is a C version of the original websockify. It is more limited in
+functionality than the original.
+
+
+## websockify.js
+
+### Description
+
+This is a Node.JS (server-side event driven Javascript) implementation
+of websockify.
+
+
+## kumina.c (C)
+
+### Description
+
+The upstream source of the kumina proxy is [here](https://github.com/kumina/wsproxy).
+
+[This article](http://blog.kumina.nl/2011/06/proxying-and-multiplexing-novnc-using-wsproxy/)
+describes the kumina proxy.
+
+kumina is an application that is run from inetd, which allows noVNC
+to connect to an unmodified VNC server. Furthermore, it makes use of
+the recently added support in noVNC for file names. The file name is
+used to denote the port number. Say, you connect to:
+
+ ws://host:41337/25900
+
+The kumina proxy opens a connection to:
+
+ vnc://host:25900/
+
+The address to which kumina connects, is the same as the address to
+which the client connected (using getsockname()).
+
+### Configuration
+
+kumina can be enabled by adding the following line to inetd.conf:
+
+ 41337 stream tcp nowait nobody /usr/sbin/kumina kumina 25900 25909
+
+The two parameters of kumina denote the minimum and the maximum allowed
+port numbers. This allows a single kumina instance to multiplex
+connections to multiple VNC servers.
diff --git a/third_party/websockify/other/launch.sh b/third_party/websockify/other/launch.sh
new file mode 100755
index 00000000..613250c6
--- /dev/null
+++ b/third_party/websockify/other/launch.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+
+usage() {
+ if [ "$*" ]; then
+ echo "$*"
+ echo
+ fi
+ echo "Usage: ${NAME} [--listen PORT] [--vnc VNC_HOST:PORT] [--cert CERT]"
+ echo
+ echo "Starts the WebSockets proxy and a mini-webserver and "
+ echo "provides a cut-and-paste URL to go to."
+ echo
+ echo " --listen PORT Port for proxy/webserver to listen on"
+ echo " Default: 6080"
+ echo " --vnc VNC_HOST:PORT VNC server host:port proxy target"
+ echo " Default: localhost:5900"
+ echo " --cert CERT Path to combined cert/key file"
+ echo " Default: self.pem"
+ exit 2
+}
+
+NAME="$(basename $0)"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+PORT="6080"
+VNC_DEST="localhost:5900"
+CERT=""
+proxy_pid=""
+
+die() {
+ echo "$*"
+ exit 1
+}
+
+cleanup() {
+ trap - TERM QUIT INT EXIT
+ trap "true" CHLD # Ignore cleanup messages
+ echo
+ if [ -n "${proxy_pid}" ]; then
+ echo "Terminating WebSockets proxy (${proxy_pid})"
+ kill ${proxy_pid}
+ fi
+}
+
+# Process Arguments
+
+# Arguments that only apply to chrooter itself
+while [ "$*" ]; do
+ param=$1; shift; OPTARG=$1
+ case $param in
+ --listen) PORT="${OPTARG}"; shift ;;
+ --vnc) VNC_DEST="${OPTARG}"; shift ;;
+ --cert) CERT="${OPTARG}"; shift ;;
+ -h|--help) usage ;;
+ -*) usage "Unknown chrooter option: ${param}" ;;
+ *) break ;;
+ esac
+done
+
+# Sanity checks
+which netstat >/dev/null 2>&1 \
+ || die "Must have netstat installed"
+
+netstat -ltn | grep -qs "${PORT}.*LISTEN" \
+ && die "Port ${PORT} in use. Try --listen PORT"
+
+trap "cleanup" TERM QUIT INT EXIT
+
+# Find vnc.html
+if [ -e "$(pwd)/vnc.html" ]; then
+ WEB=$(pwd)
+elif [ -e "${HERE}/../vnc.html" ]; then
+ WEB=${HERE}/../
+elif [ -e "${HERE}/vnc.html" ]; then
+ WEB=${HERE}
+else
+ die "Could not find vnc.html"
+fi
+
+# Find self.pem
+if [ -n "${CERT}" ]; then
+ if [ ! -e "${CERT}" ]; then
+ die "Could not find ${CERT}"
+ fi
+elif [ -e "$(pwd)/self.pem" ]; then
+ CERT="$(pwd)/self.pem"
+elif [ -e "${HERE}/../self.pem" ]; then
+ CERT="${HERE}/../self.pem"
+elif [ -e "${HERE}/self.pem" ]; then
+ CERT="${HERE}/self.pem"
+else
+ echo "Warning: could not find self.pem"
+fi
+
+echo "Starting webserver and WebSockets proxy on port ${PORT}"
+${HERE}/wsproxy.py --web ${WEB} ${CERT:+--cert ${CERT}} ${PORT} ${VNC_DEST} &
+proxy_pid="$!"
+sleep 1
+if ! ps -p ${proxy_pid} >/dev/null; then
+ proxy_pid=
+ echo "Failed to start WebSockets proxy"
+ exit 1
+fi
+
+echo -e "\n\nNavigate to to this URL:\n"
+echo -e " http://$(hostname):${PORT}/vnc.html?host=$(hostname)&port=${PORT}\n"
+echo -e "Press Ctrl-C to exit\n\n"
+
+wait ${proxy_pid}
diff --git a/third_party/websockify/other/project.clj b/third_party/websockify/other/project.clj
new file mode 100644
index 00000000..fb2c0ba5
--- /dev/null
+++ b/third_party/websockify/other/project.clj
@@ -0,0 +1,13 @@
+(defproject websockify "1.0.0-SNAPSHOT"
+ :description "Clojure implementation of Websockify"
+ :url "https://github.com/kanaka/websockify"
+ :dependencies [[org.clojure/clojure "1.2.1"]
+ [org.clojure/tools.cli "0.2.1"]
+ [ring/ring-jetty-adapter "1.0.0-beta2"]
+ [org.eclipse.jetty/jetty-websocket "7.5.4.v20111024"]
+ [org.eclipse.jetty/jetty-server "7.5.4.v20111024"]
+ [org.eclipse.jetty/jetty-servlet "7.5.4.v20111024"]
+ [org.jboss.netty/netty "3.2.5.Final"]]
+ ;:dev-dependencies [[swank-clojure "1.3.0-SNAPSHOT"]]
+ :main websockify
+ )
diff --git a/third_party/websockify/other/websocket.c b/third_party/websockify/other/websocket.c
new file mode 100644
index 00000000..c365409c
--- /dev/null
+++ b/third_party/websockify/other/websocket.c
@@ -0,0 +1,802 @@
+/*
+ * WebSocket lib with support for "wss://" encryption.
+ * Copyright 2010 Joel Martin
+ * Licensed under LGPL version 3 (see docs/LICENSE.LGPL-3)
+ *
+ * You can make a cert/key with openssl using:
+ * openssl req -new -x509 -days 365 -nodes -out self.pem -keyout self.pem
+ * as taken from http://docs.python.org/dev/library/ssl.html#certificates
+ */
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <strings.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <signal.h> // daemonizing
+#include <fcntl.h> // daemonizing
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <resolv.h> /* base64 encode/decode */
+#include <openssl/md5.h> /* md5 hash */
+#include <openssl/sha.h> /* sha1 hash */
+#include "websocket.h"
+
+/*
+ * Global state
+ *
+ * Warning: not thread safe
+ */
+int ssl_initialized = 0;
+int pipe_error = 0;
+settings_t settings;
+
+
+void traffic(char * token) {
+ if ((settings.verbose) && (! settings.daemon)) {
+ fprintf(stdout, "%s", token);
+ fflush(stdout);
+ }
+}
+
+void error(char *msg)
+{
+ perror(msg);
+}
+
+void fatal(char *msg)
+{
+ perror(msg);
+ exit(1);
+}
+
+/* resolve host with also IP address parsing */
+int resolve_host(struct in_addr *sin_addr, const char *hostname)
+{
+ if (!inet_aton(hostname, sin_addr)) {
+ struct addrinfo *ai, *cur;
+ struct addrinfo hints;
+ memset(&hints, 0, sizeof(hints));
+ hints.ai_family = AF_INET;
+ if (getaddrinfo(hostname, NULL, &hints, &ai))
+ return -1;
+ for (cur = ai; cur; cur = cur->ai_next) {
+ if (cur->ai_family == AF_INET) {
+ *sin_addr = ((struct sockaddr_in *)cur->ai_addr)->sin_addr;
+ freeaddrinfo(ai);
+ return 0;
+ }
+ }
+ freeaddrinfo(ai);
+ return -1;
+ }
+ return 0;
+}
+
+
+/*
+ * SSL Wrapper Code
+ */
+
+ssize_t ws_recv(ws_ctx_t *ctx, void *buf, size_t len) {
+ if (ctx->ssl) {
+ //handler_msg("SSL recv\n");
+ return SSL_read(ctx->ssl, buf, len);
+ } else {
+ return recv(ctx->sockfd, buf, len, 0);
+ }
+}
+
+ssize_t ws_send(ws_ctx_t *ctx, const void *buf, size_t len) {
+ if (ctx->ssl) {
+ //handler_msg("SSL send\n");
+ return SSL_write(ctx->ssl, buf, len);
+ } else {
+ return send(ctx->sockfd, buf, len, 0);
+ }
+}
+
+ws_ctx_t *alloc_ws_ctx() {
+ ws_ctx_t *ctx;
+ if (! (ctx = malloc(sizeof(ws_ctx_t))) )
+ { fatal("malloc()"); }
+
+ if (! (ctx->cin_buf = malloc(BUFSIZE)) )
+ { fatal("malloc of cin_buf"); }
+ if (! (ctx->cout_buf = malloc(BUFSIZE)) )
+ { fatal("malloc of cout_buf"); }
+ if (! (ctx->tin_buf = malloc(BUFSIZE)) )
+ { fatal("malloc of tin_buf"); }
+ if (! (ctx->tout_buf = malloc(BUFSIZE)) )
+ { fatal("malloc of tout_buf"); }
+
+ ctx->headers = malloc(sizeof(headers_t));
+ ctx->ssl = NULL;
+ ctx->ssl_ctx = NULL;
+ return ctx;
+}
+
+int free_ws_ctx(ws_ctx_t *ctx) {
+ free(ctx->cin_buf);
+ free(ctx->cout_buf);
+ free(ctx->tin_buf);
+ free(ctx->tout_buf);
+ free(ctx);
+}
+
+ws_ctx_t *ws_socket(ws_ctx_t *ctx, int socket) {
+ ctx->sockfd = socket;
+}
+
+ws_ctx_t *ws_socket_ssl(ws_ctx_t *ctx, int socket, char * certfile, char * keyfile) {
+ int ret;
+ char msg[1024];
+ char * use_keyfile;
+ ws_socket(ctx, socket);
+
+ if (keyfile && (keyfile[0] != '\0')) {
+ // Separate key file
+ use_keyfile = keyfile;
+ } else {
+ // Combined key and cert file
+ use_keyfile = certfile;
+ }
+
+ // Initialize the library
+ if (! ssl_initialized) {
+ SSL_library_init();
+ OpenSSL_add_all_algorithms();
+ SSL_load_error_strings();
+ ssl_initialized = 1;
+
+ }
+
+ ctx->ssl_ctx = SSL_CTX_new(TLSv1_server_method());
+ if (ctx->ssl_ctx == NULL) {
+ ERR_print_errors_fp(stderr);
+ fatal("Failed to configure SSL context");
+ }
+
+ if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, use_keyfile,
+ SSL_FILETYPE_PEM) <= 0) {
+ sprintf(msg, "Unable to load private key file %s\n", use_keyfile);
+ fatal(msg);
+ }
+
+ if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, certfile,
+ SSL_FILETYPE_PEM) <= 0) {
+ sprintf(msg, "Unable to load certificate file %s\n", certfile);
+ fatal(msg);
+ }
+
+// if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, "DEFAULT") != 1) {
+// sprintf(msg, "Unable to set cipher\n");
+// fatal(msg);
+// }
+
+ // Associate socket and ssl object
+ ctx->ssl = SSL_new(ctx->ssl_ctx);
+ SSL_set_fd(ctx->ssl, socket);
+
+ ret = SSL_accept(ctx->ssl);
+ if (ret < 0) {
+ ERR_print_errors_fp(stderr);
+ return NULL;
+ }
+
+ return ctx;
+}
+
+int ws_socket_free(ws_ctx_t *ctx) {
+ if (ctx->ssl) {
+ SSL_free(ctx->ssl);
+ ctx->ssl = NULL;
+ }
+ if (ctx->ssl_ctx) {
+ SSL_CTX_free(ctx->ssl_ctx);
+ ctx->ssl_ctx = NULL;
+ }
+ if (ctx->sockfd) {
+ shutdown(ctx->sockfd, SHUT_RDWR);
+ close(ctx->sockfd);
+ ctx->sockfd = 0;
+ }
+}
+
+/* ------------------------------------------------------- */
+
+
+int encode_hixie(u_char const *src, size_t srclength,
+ char *target, size_t targsize) {
+ int sz = 0, len = 0;
+ target[sz++] = '\x00';
+ len = b64_ntop(src, srclength, target+sz, targsize-sz);
+ if (len < 0) {
+ return len;
+ }
+ sz += len;
+ target[sz++] = '\xff';
+ return sz;
+}
+
+int decode_hixie(char *src, size_t srclength,
+ u_char *target, size_t targsize,
+ unsigned int *opcode, unsigned int *left) {
+ char *start, *end, cntstr[4];
+ int i, len, framecount = 0, retlen = 0;
+ unsigned char chr;
+ if ((src[0] != '\x00') || (src[srclength-1] != '\xff')) {
+ handler_emsg("WebSocket framing error\n");
+ return -1;
+ }
+ *left = srclength;
+
+ if (srclength == 2 &&
+ (src[0] == '\xff') &&
+ (src[1] == '\x00')) {
+ // client sent orderly close frame
+ *opcode = 0x8; // Close frame
+ return 0;
+ }
+ *opcode = 0x1; // Text frame
+
+ start = src+1; // Skip '\x00' start
+ do {
+ /* We may have more than one frame */
+ end = (char *)memchr(start, '\xff', srclength);
+ *end = '\x00';
+ len = b64_pton(start, target+retlen, targsize-retlen);
+ if (len < 0) {
+ return len;
+ }
+ retlen += len;
+ start = end + 2; // Skip '\xff' end and '\x00' start
+ framecount++;
+ } while (end < (src+srclength-1));
+ if (framecount > 1) {
+ snprintf(cntstr, 3, "%d", framecount);
+ traffic(cntstr);
+ }
+ *left = 0;
+ return retlen;
+}
+
+int encode_hybi(u_char const *src, size_t srclength,
+ char *target, size_t targsize, unsigned int opcode)
+{
+ unsigned long long b64_sz, len_offset = 1, payload_offset = 2, len = 0;
+
+ if ((int)srclength <= 0)
+ {
+ return 0;
+ }
+
+ b64_sz = ((srclength - 1) / 3) * 4 + 4;
+
+ target[0] = (char)(opcode & 0x0F | 0x80);
+
+ if (b64_sz <= 125) {
+ target[1] = (char) b64_sz;
+ payload_offset = 2;
+ } else if ((b64_sz > 125) && (b64_sz < 65536)) {
+ target[1] = (char) 126;
+ *(u_short*)&(target[2]) = htons(b64_sz);
+ payload_offset = 4;
+ } else {
+ handler_emsg("Sending frames larger than 65535 bytes not supported\n");
+ return -1;
+ //target[1] = (char) 127;
+ //*(u_long*)&(target[2]) = htonl(b64_sz);
+ //payload_offset = 10;
+ }
+
+ len = b64_ntop(src, srclength, target+payload_offset, targsize-payload_offset);
+
+ if (len < 0) {
+ return len;
+ }
+
+ return len + payload_offset;
+}
+
+int decode_hybi(unsigned char *src, size_t srclength,
+ u_char *target, size_t targsize,
+ unsigned int *opcode, unsigned int *left)
+{
+ unsigned char *frame, *mask, *payload, save_char, cntstr[4];;
+ int masked = 0;
+ int i = 0, len, framecount = 0;
+ size_t remaining;
+ unsigned int target_offset = 0, hdr_length = 0, payload_length = 0;
+
+ *left = srclength;
+ frame = src;
+
+ //printf("Deocde new frame\n");
+ while (1) {
+ // Need at least two bytes of the header
+ // Find beginning of next frame. First time hdr_length, masked and
+ // payload_length are zero
+ frame += hdr_length + 4*masked + payload_length;
+ //printf("frame[0..3]: 0x%x 0x%x 0x%x 0x%x (tot: %d)\n",
+ // (unsigned char) frame[0],
+ // (unsigned char) frame[1],
+ // (unsigned char) frame[2],
+ // (unsigned char) frame[3], srclength);
+
+ if (frame > src + srclength) {
+ //printf("Truncated frame from client, need %d more bytes\n", frame - (src + srclength) );
+ break;
+ }
+ remaining = (src + srclength) - frame;
+ if (remaining < 2) {
+ //printf("Truncated frame header from client\n");
+ break;
+ }
+ framecount ++;
+
+ *opcode = frame[0] & 0x0f;
+ masked = (frame[1] & 0x80) >> 7;
+
+ if (*opcode == 0x8) {
+ // client sent orderly close frame
+ break;
+ }
+
+ payload_length = frame[1] & 0x7f;
+ if (payload_length < 126) {
+ hdr_length = 2;
+ //frame += 2 * sizeof(char);
+ } else if (payload_length == 126) {
+ payload_length = (frame[2] << 8) + frame[3];
+ hdr_length = 4;
+ } else {
+ handler_emsg("Receiving frames larger than 65535 bytes not supported\n");
+ return -1;
+ }
+ if ((hdr_length + 4*masked + payload_length) > remaining) {
+ continue;
+ }
+ //printf(" payload_length: %u, raw remaining: %u\n", payload_length, remaining);
+ payload = frame + hdr_length + 4*masked;
+
+ if (*opcode != 1 && *opcode != 2) {
+ handler_msg("Ignoring non-data frame, opcode 0x%x\n", *opcode);
+ continue;
+ }
+
+ if (payload_length == 0) {
+ handler_msg("Ignoring empty frame\n");
+ continue;
+ }
+
+ if ((payload_length > 0) && (!masked)) {
+ handler_emsg("Received unmasked payload from client\n");
+ return -1;
+ }
+
+ // Terminate with a null for base64 decode
+ save_char = payload[payload_length];
+ payload[payload_length] = '\0';
+
+ // unmask the data
+ mask = payload - 4;
+ for (i = 0; i < payload_length; i++) {
+ payload[i] ^= mask[i%4];
+ }
+
+ // base64 decode the data
+ len = b64_pton((const char*)payload, target+target_offset, targsize);
+
+ // Restore the first character of the next frame
+ payload[payload_length] = save_char;
+ if (len < 0) {
+ handler_emsg("Base64 decode error code %d", len);
+ return len;
+ }
+ target_offset += len;
+
+ //printf(" len %d, raw %s\n", len, frame);
+ }
+
+ if (framecount > 1) {
+ snprintf(cntstr, 3, "%d", framecount);
+ traffic(cntstr);
+ }
+
+ *left = remaining;
+ return target_offset;
+}
+
+
+
+int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
+ char *start, *end;
+ headers_t *headers = ws_ctx->headers;
+
+ headers->key1[0] = '\0';
+ headers->key2[0] = '\0';
+ headers->key3[0] = '\0';
+
+ if ((strlen(handshake) < 92) || (bcmp(handshake, "GET ", 4) != 0)) {
+ return 0;
+ }
+ start = handshake+4;
+ end = strstr(start, " HTTP/1.1");
+ if (!end) { return 0; }
+ strncpy(headers->path, start, end-start);
+ headers->path[end-start] = '\0';
+
+ start = strstr(handshake, "\r\nHost: ");
+ if (!start) { return 0; }
+ start += 8;
+ end = strstr(start, "\r\n");
+ strncpy(headers->host, start, end-start);
+ headers->host[end-start] = '\0';
+
+ headers->origin[0] = '\0';
+ start = strstr(handshake, "\r\nOrigin: ");
+ if (start) {
+ start += 10;
+ } else {
+ start = strstr(handshake, "\r\nSec-WebSocket-Origin: ");
+ if (!start) { return 0; }
+ start += 24;
+ }
+ end = strstr(start, "\r\n");
+ strncpy(headers->origin, start, end-start);
+ headers->origin[end-start] = '\0';
+
+ start = strstr(handshake, "\r\nSec-WebSocket-Version: ");
+ if (start) {
+ // HyBi/RFC 6455
+ start += 25;
+ end = strstr(start, "\r\n");
+ strncpy(headers->version, start, end-start);
+ headers->version[end-start] = '\0';
+ ws_ctx->hixie = 0;
+ ws_ctx->hybi = strtol(headers->version, NULL, 10);
+
+ start = strstr(handshake, "\r\nSec-WebSocket-Key: ");
+ if (!start) { return 0; }
+ start += 21;
+ end = strstr(start, "\r\n");
+ strncpy(headers->key1, start, end-start);
+ headers->key1[end-start] = '\0';
+
+ start = strstr(handshake, "\r\nConnection: ");
+ if (!start) { return 0; }
+ start += 14;
+ end = strstr(start, "\r\n");
+ strncpy(headers->connection, start, end-start);
+ headers->connection[end-start] = '\0';
+
+ start = strstr(handshake, "\r\nSec-WebSocket-Protocol: ");
+ if (!start) { return 0; }
+ start += 26;
+ end = strstr(start, "\r\n");
+ strncpy(headers->protocols, start, end-start);
+ headers->protocols[end-start] = '\0';
+ } else {
+ // Hixie 75 or 76
+ ws_ctx->hybi = 0;
+
+ start = strstr(handshake, "\r\n\r\n");
+ if (!start) { return 0; }
+ start += 4;
+ if (strlen(start) == 8) {
+ ws_ctx->hixie = 76;
+ strncpy(headers->key3, start, 8);
+ headers->key3[8] = '\0';
+
+ start = strstr(handshake, "\r\nSec-WebSocket-Key1: ");
+ if (!start) { return 0; }
+ start += 22;
+ end = strstr(start, "\r\n");
+ strncpy(headers->key1, start, end-start);
+ headers->key1[end-start] = '\0';
+
+ start = strstr(handshake, "\r\nSec-WebSocket-Key2: ");
+ if (!start) { return 0; }
+ start += 22;
+ end = strstr(start, "\r\n");
+ strncpy(headers->key2, start, end-start);
+ headers->key2[end-start] = '\0';
+ } else {
+ ws_ctx->hixie = 75;
+ }
+
+ }
+
+ return 1;
+}
+
+int parse_hixie76_key(char * key) {
+ unsigned long i, spaces = 0, num = 0;
+ for (i=0; i < strlen(key); i++) {
+ if (key[i] == ' ') {
+ spaces += 1;
+ }
+ if ((key[i] >= 48) && (key[i] <= 57)) {
+ num = num * 10 + (key[i] - 48);
+ }
+ }
+ return num / spaces;
+}
+
+int gen_md5(headers_t *headers, char *target) {
+ unsigned long key1 = parse_hixie76_key(headers->key1);
+ unsigned long key2 = parse_hixie76_key(headers->key2);
+ char *key3 = headers->key3;
+
+ MD5_CTX c;
+ char in[HIXIE_MD5_DIGEST_LENGTH] = {
+ key1 >> 24, key1 >> 16, key1 >> 8, key1,
+ key2 >> 24, key2 >> 16, key2 >> 8, key2,
+ key3[0], key3[1], key3[2], key3[3],
+ key3[4], key3[5], key3[6], key3[7]
+ };
+
+ MD5_Init(&c);
+ MD5_Update(&c, (void *)in, sizeof in);
+ MD5_Final((void *)target, &c);
+
+ target[HIXIE_MD5_DIGEST_LENGTH] = '\0';
+
+ return 1;
+}
+
+static void gen_sha1(headers_t *headers, char *target) {
+ SHA_CTX c;
+ unsigned char hash[SHA_DIGEST_LENGTH];
+ int r;
+
+ SHA1_Init(&c);
+ SHA1_Update(&c, headers->key1, strlen(headers->key1));
+ SHA1_Update(&c, HYBI_GUID, 36);
+ SHA1_Final(hash, &c);
+
+ r = b64_ntop(hash, sizeof hash, target, HYBI10_ACCEPTHDRLEN);
+ //assert(r == HYBI10_ACCEPTHDRLEN - 1);
+}
+
+
+ws_ctx_t *do_handshake(int sock) {
+ char handshake[4096], response[4096], sha1[29], trailer[17];
+ char *scheme, *pre;
+ headers_t *headers;
+ int len, ret, i, offset;
+ ws_ctx_t * ws_ctx;
+
+ // Peek, but don't read the data
+ len = recv(sock, handshake, 1024, MSG_PEEK);
+ handshake[len] = 0;
+ if (len == 0) {
+ handler_msg("ignoring empty handshake\n");
+ return NULL;
+ } else if (bcmp(handshake, "<policy-file-request/>", 22) == 0) {
+ len = recv(sock, handshake, 1024, 0);
+ handshake[len] = 0;
+ handler_msg("sending flash policy response\n");
+ send(sock, POLICY_RESPONSE, sizeof(POLICY_RESPONSE), 0);
+ return NULL;
+ } else if ((bcmp(handshake, "\x16", 1) == 0) ||
+ (bcmp(handshake, "\x80", 1) == 0)) {
+ // SSL
+ if (!settings.cert) {
+ handler_msg("SSL connection but no cert specified\n");
+ return NULL;
+ } else if (access(settings.cert, R_OK) != 0) {
+ handler_msg("SSL connection but '%s' not found\n",
+ settings.cert);
+ return NULL;
+ }
+ ws_ctx = alloc_ws_ctx();
+ ws_socket_ssl(ws_ctx, sock, settings.cert, settings.key);
+ if (! ws_ctx) { return NULL; }
+ scheme = "wss";
+ handler_msg("using SSL socket\n");
+ } else if (settings.ssl_only) {
+ handler_msg("non-SSL connection disallowed\n");
+ return NULL;
+ } else {
+ ws_ctx = alloc_ws_ctx();
+ ws_socket(ws_ctx, sock);
+ if (! ws_ctx) { return NULL; }
+ scheme = "ws";
+ handler_msg("using plain (not SSL) socket\n");
+ }
+ offset = 0;
+ for (i = 0; i < 10; i++) {
+ len = ws_recv(ws_ctx, handshake+offset, 4096);
+ if (len == 0) {
+ handler_emsg("Client closed during handshake\n");
+ return NULL;
+ }
+ offset += len;
+ handshake[offset] = 0;
+ if (strstr(handshake, "\r\n\r\n")) {
+ break;
+ }
+ usleep(10);
+ }
+
+ //handler_msg("handshake: %s\n", handshake);
+ if (!parse_handshake(ws_ctx, handshake)) {
+ handler_emsg("Invalid WS request\n");
+ return NULL;
+ }
+
+ headers = ws_ctx->headers;
+ if (ws_ctx->hybi > 0) {
+ handler_msg("using protocol HyBi/IETF 6455 %d\n", ws_ctx->hybi);
+ gen_sha1(headers, sha1);
+ sprintf(response, SERVER_HANDSHAKE_HYBI, sha1, "base64");
+ } else {
+ if (ws_ctx->hixie == 76) {
+ handler_msg("using protocol Hixie 76\n");
+ gen_md5(headers, trailer);
+ pre = "Sec-";
+ } else {
+ handler_msg("using protocol Hixie 75\n");
+ trailer[0] = '\0';
+ pre = "";
+ }
+ sprintf(response, SERVER_HANDSHAKE_HIXIE, pre, headers->origin, pre, scheme,
+ headers->host, headers->path, pre, "base64", trailer);
+ }
+
+ //handler_msg("response: %s\n", response);
+ ws_send(ws_ctx, response, strlen(response));
+
+ return ws_ctx;
+}
+
+void signal_handler(sig) {
+ switch (sig) {
+ case SIGHUP: break; // ignore for now
+ case SIGPIPE: pipe_error = 1; break; // handle inline
+ case SIGTERM: exit(0); break;
+ }
+}
+
+void daemonize(int keepfd) {
+ int pid, i;
+
+ umask(0);
+ chdir("/");
+ setgid(getgid());
+ setuid(getuid());
+
+ /* Double fork to daemonize */
+ pid = fork();
+ if (pid<0) { fatal("fork error"); }
+ if (pid>0) { exit(0); } // parent exits
+ setsid(); // Obtain new process group
+ pid = fork();
+ if (pid<0) { fatal("fork error"); }
+ if (pid>0) { exit(0); } // parent exits
+
+ /* Signal handling */
+ signal(SIGHUP, signal_handler); // catch HUP
+ signal(SIGTERM, signal_handler); // catch kill
+
+ /* Close open files */
+ for (i=getdtablesize(); i>=0; --i) {
+ if (i != keepfd) {
+ close(i);
+ } else if (settings.verbose) {
+ printf("keeping fd %d\n", keepfd);
+ }
+ }
+ i=open("/dev/null", O_RDWR); // Redirect stdin
+ dup(i); // Redirect stdout
+ dup(i); // Redirect stderr
+}
+
+
+void start_server() {
+ int lsock, csock, pid, clilen, sopt = 1, i;
+ struct sockaddr_in serv_addr, cli_addr;
+ ws_ctx_t *ws_ctx;
+
+
+ /* Initialize buffers */
+ lsock = socket(AF_INET, SOCK_STREAM, 0);
+ if (lsock < 0) { error("ERROR creating listener socket"); }
+ bzero((char *) &serv_addr, sizeof(serv_addr));
+ serv_addr.sin_family = AF_INET;
+ serv_addr.sin_port = htons(settings.listen_port);
+
+ /* Resolve listen address */
+ if (settings.listen_host && (settings.listen_host[0] != '\0')) {
+ if (resolve_host(&serv_addr.sin_addr, settings.listen_host) < -1) {
+ fatal("Could not resolve listen address");
+ }
+ } else {
+ serv_addr.sin_addr.s_addr = INADDR_ANY;
+ }
+
+ setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, (char *)&sopt, sizeof(sopt));
+ if (bind(lsock, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) {
+ fatal("ERROR on binding listener socket");
+ }
+ listen(lsock,100);
+
+ signal(SIGPIPE, signal_handler); // catch pipe
+
+ if (settings.daemon) {
+ daemonize(lsock);
+ }
+
+
+ // Reep zombies
+ signal(SIGCHLD, SIG_IGN);
+
+ printf("Waiting for connections on %s:%d\n",
+ settings.listen_host, settings.listen_port);
+
+ while (1) {
+ clilen = sizeof(cli_addr);
+ pipe_error = 0;
+ pid = 0;
+ csock = accept(lsock,
+ (struct sockaddr *) &cli_addr,
+ &clilen);
+ if (csock < 0) {
+ error("ERROR on accept");
+ continue;
+ }
+ handler_msg("got client connection from %s\n",
+ inet_ntoa(cli_addr.sin_addr));
+
+ if (!settings.run_once) {
+ handler_msg("forking handler process\n");
+ pid = fork();
+ }
+
+ if (pid == 0) { // handler process
+ ws_ctx = do_handshake(csock);
+ if (settings.run_once) {
+ if (ws_ctx == NULL) {
+ // Not a real WebSocket connection
+ continue;
+ } else {
+ // Successful connection, stop listening for new
+ // connections
+ close(lsock);
+ }
+ }
+ if (ws_ctx == NULL) {
+ handler_msg("No connection after handshake\n");
+ break; // Child process exits
+ }
+
+ settings.handler(ws_ctx);
+ if (pipe_error) {
+ handler_emsg("Closing due to SIGPIPE\n");
+ }
+ break; // Child process exits
+ } else { // parent process
+ settings.handler_id += 1;
+ }
+ }
+ if (pid == 0) {
+ if (ws_ctx) {
+ ws_socket_free(ws_ctx);
+ free_ws_ctx(ws_ctx);
+ } else {
+ shutdown(csock, SHUT_RDWR);
+ close(csock);
+ }
+ handler_msg("handler exit\n");
+ } else {
+ handler_msg("wsproxy exit\n");
+ }
+
+}
+
diff --git a/third_party/websockify/other/websocket.h b/third_party/websockify/other/websocket.h
new file mode 100644
index 00000000..7da52757
--- /dev/null
+++ b/third_party/websockify/other/websocket.h
@@ -0,0 +1,84 @@
+#include <openssl/ssl.h>
+
+#define BUFSIZE 65536
+#define DBUFSIZE (BUFSIZE * 3) / 4 - 20
+
+#define SERVER_HANDSHAKE_HIXIE "HTTP/1.1 101 Web Socket Protocol Handshake\r\n\
+Upgrade: WebSocket\r\n\
+Connection: Upgrade\r\n\
+%sWebSocket-Origin: %s\r\n\
+%sWebSocket-Location: %s://%s%s\r\n\
+%sWebSocket-Protocol: %s\r\n\
+\r\n%s"
+
+#define SERVER_HANDSHAKE_HYBI "HTTP/1.1 101 Switching Protocols\r\n\
+Upgrade: websocket\r\n\
+Connection: Upgrade\r\n\
+Sec-WebSocket-Accept: %s\r\n\
+Sec-WebSocket-Protocol: %s\r\n\
+\r\n"
+
+#define HYBI_GUID "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
+
+#define HYBI10_ACC