WebSockets improvements

 - validate more HTTP stuff, use the newer RFC
 - validate the base64 key

1 files changed, 352 insertions, 66 deletions

diff --git a/demo-json-rpc-server.c b/demo-json-rpc-server.c
index 0cae4a0..06f0fc4 100644
--- a/demo-json-rpc-server.c
+++ b/demo-json-rpc-server.c
@@ -136,8 +136,93 @@ strcasecmp_ascii (const char *a, const char *b)
 	return *a - *b;
 }
 
+static bool
+isspace_ascii (int c)
+{
+	return c == '\f' || c == '\n' || c == '\r' || c == '\t' || c == '\v';
+}
+
 // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
+static uint8_t g_base64_table[256] =
+{
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 62, 64, 64, 64, 63,
+	52, 53, 54, 55, 56, 57, 58, 59,  60, 61, 64, 64, 64,  0, 64, 64,
+	64,  0,  1,  2,  3,  4,  5,  6,   7,  8,  9, 10, 11, 12, 13, 14,
+	15, 16, 17, 18, 19, 20, 21, 22,  23, 24, 25, 64, 64, 64, 64, 64,
+	64, 26, 27, 28, 29, 30, 31, 32,  33, 34, 35, 36, 37, 38, 39, 40,
+	41, 42, 43, 44, 45, 46, 47, 48,  49, 50, 51, 64, 64, 64, 64, 64,
+
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+	64, 64, 64, 64, 64, 64, 64, 64,  64, 64, 64, 64, 64, 64, 64, 64,
+};
+
+static inline bool
+base64_decode_group (const char **s, struct str *output)
+{
+	uint8_t input[4];
+	size_t loaded = 0;
+	for (; loaded < 4; (*s)++)
+	{
+		if (!**s)
+			return loaded == 0;
+		if (!isspace_ascii (**s))
+			input[loaded++] = **s;
+	}
+
+	size_t len = 3;
+	if (input[0] == '=' || input[1] == '=')
+		return false;
+	if (input[2] == '=' && input[3] != '=')
+		return false;
+	if (input[2] == '=')
+		len--;
+	if (input[3] == '=')
+		len--;
+
+	uint8_t a = g_base64_table[input[0]];
+	uint8_t b = g_base64_table[input[1]];
+	uint8_t c = g_base64_table[input[2]];
+	uint8_t d = g_base64_table[input[3]];
+
+	if (((a | b) | (c | d)) & 0x40)
+		return false;
+
+	uint32_t block = a << 18 | b << 12 | c << 6 | d;
+	switch (len)
+	{
+	case 1:
+		str_append_c (output, block >> 16);
+		break;
+	case 2:
+		str_append_c (output, block >> 16);
+		str_append_c (output, block >> 8);
+		break;
+	case 3:
+		str_append_c (output, block >> 16);
+		str_append_c (output, block >> 8);
+		str_append_c (output, block);
+	}
+	return true;
+}
+
+static bool
+base64_decode (const char *s, struct str *output)
+{
+	while (*s)
+		if (!base64_decode_group (&s, output))
+			return false;
+	return true;
+}
+
 static void
 base64_encode (const void *data, size_t len, struct str *output)
 {
@@ -178,37 +263,73 @@ base64_encode (const void *data, size_t len, struct str *output)
 	}
 }
 
-// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+// --- HTTP parsing ------------------------------------------------------------
 
-// Basic tokenizer for HTTP headers, to be used in various parsers.
+// Basic tokenizer for HTTP header field values, to be used in various parsers.
 // The input should already be unwrapped.
 
-enum http_tokenizer_field
+// Recommended literature:
+//   http://tools.ietf.org/html/rfc7230#section-3.2.6
+//   http://tools.ietf.org/html/rfc7230#appendix-B
+//   http://tools.ietf.org/html/rfc5234#appendix-B.1
+
+#define HTTP_TOKENIZER_CLASS(name, definition)                                 \
+	static inline bool                                                         \
+	http_tokenizer_is_ ## name (int c)                                         \
+	{                                                                          \
+		return (definition);                                                   \
+	}
+
+HTTP_TOKENIZER_CLASS (vchar, c >= 0x21 && c <= 0x7E)
+HTTP_TOKENIZER_CLASS (delimiter, !!strchr ("\"(),/:;<=>?@[\\]{}", c))
+HTTP_TOKENIZER_CLASS (whitespace, c == '\t' || c == ' ')
+HTTP_TOKENIZER_CLASS (obs_text, c >= 0x80 && c <= 0xFF)
+
+HTTP_TOKENIZER_CLASS (tchar,
+	http_tokenizer_is_vchar (c) && !http_tokenizer_is_delimiter (c))
+
+HTTP_TOKENIZER_CLASS (qdtext,
+	c == '\t' || c == ' ' || c == '!'
+	|| (c >= 0x23 && c <= 0x5B)
+	|| (c >= 0x5D && c <= 0x7E)
+	|| http_tokenizer_is_obs_text (c))
+
+HTTP_TOKENIZER_CLASS (quoted_pair,
+	c == '\t' || c == ' '
+	|| http_tokenizer_is_vchar (c)
+	|| http_tokenizer_is_obs_text (c))
+
+#undef HTTP_TOKENIZER_CLASS
+
+// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+enum http_tokenizer_token
 {
 	HTTP_T_EOF,                         ///< Input error
 	HTTP_T_ERROR,                       ///< End of input
 
 	HTTP_T_TOKEN,                       ///< "token"
 	HTTP_T_QUOTED_STRING,               ///< "quoted-string"
-	HTTP_T_SEPARATOR                    ///< "separators"
+	HTTP_T_DELIMITER,                   ///< "delimiters"
+	HTTP_T_WHITESPACE                   ///< RWS/OWS/BWS
 };
 
 struct http_tokenizer
 {
-	const char *input;                  ///< The input string
+	const unsigned char *input;         ///< The input string
 	size_t input_len;                   ///< Length of the input
 	size_t offset;                      ///< Position in the input
 
-	char separator;                     ///< The separator character
+	char delimiter;                     ///< The delimiter character
 	struct str string;                  ///< "token" / "quoted-string" content
 };
 
 static void
-http_tokenizer_init (struct http_tokenizer *self, const char *input)
+http_tokenizer_init (struct http_tokenizer *self, const char *input, size_t len)
 {
 	memset (self, 0, sizeof *self);
-	self->input = input;
-	self->input_len = strlen (input);
+	self->input = (const unsigned char *) input;
+	self->input_len = len;
 
 	str_init (&self->string);
 }
@@ -219,19 +340,7 @@ http_tokenizer_free (struct http_tokenizer *self)
 	str_free (&self->string);
 }
 
-static bool
-http_tokenizer_is_ctl (int c)
-{
-	return (c >= 0 && c <= 31) || c == 127;
-}
-
-static bool
-http_tokenizer_is_char (int c)
-{
-	return c >= 0 && c <= 127;
-}
-
-static enum http_tokenizer_field
+static enum http_tokenizer_token
 http_tokenizer_quoted_string (struct http_tokenizer *self)
 {
 	bool quoted_pair = false;
@@ -240,7 +349,7 @@ http_tokenizer_quoted_string (struct http_tokenizer *self)
 		int c = self->input[self->offset++];
 		if (quoted_pair)
 		{
-			if (!http_tokenizer_is_char (c))
+			if (!http_tokenizer_is_quoted_pair (c))
 				return HTTP_T_ERROR;
 
 			str_append_c (&self->string, c);
@@ -250,29 +359,27 @@ http_tokenizer_quoted_string (struct http_tokenizer *self)
 			quoted_pair = true;
 		else if (c == '"')
 			return HTTP_T_QUOTED_STRING;
-		else if (http_tokenizer_is_ctl (c))
-			return HTTP_T_ERROR;
-		else
+		else if (http_tokenizer_is_qdtext (c))
 			str_append_c (&self->string, c);
+		else
+			return HTTP_T_ERROR;
 	}
 
 	// Premature end of input
 	return HTTP_T_ERROR;
 }
 
-static enum http_tokenizer_field
-http_tokenizer_next (struct http_tokenizer *self, bool skip_lws)
+static enum http_tokenizer_token
+http_tokenizer_next (struct http_tokenizer *self, bool skip_ows)
 {
-	const char *separators = "()<>@.;:\\\"/[]?={} \t";
-
 	str_reset (&self->string);
 	if (self->offset >= self->input_len)
 		return HTTP_T_EOF;
 
 	int c = self->input[self->offset++];
 
-	if (skip_lws)
-		while (c == ' ' || c == '\t')
+	if (skip_ows)
+		while (http_tokenizer_is_whitespace (c))
 		{
 			if (self->offset >= self->input_len)
 				return HTTP_T_EOF;
@@ -282,29 +389,38 @@ http_tokenizer_next (struct http_tokenizer *self, bool skip_lws)
 	if (c == '"')
 		return http_tokenizer_quoted_string (self);
 
-	if (strchr (separators, c))
+	if (http_tokenizer_is_delimiter (c))
 	{
-		self->separator = c;
-		return HTTP_T_SEPARATOR;
+		self->delimiter = c;
+		return HTTP_T_DELIMITER;
 	}
 
-	if (!http_tokenizer_is_char (c)
-	 || http_tokenizer_is_ctl (c))
+	// Simple variable-length tokens
+	enum http_tokenizer_token result;
+	bool (*eater) (int c) = NULL;
+	if (http_tokenizer_is_whitespace (c))
+	{
+		eater = http_tokenizer_is_whitespace;
+		result = HTTP_T_WHITESPACE;
+	}
+	else if (http_tokenizer_is_tchar (c))
+	{
+		eater = http_tokenizer_is_tchar;
+		result = HTTP_T_TOKEN;
+	}
+	else
 		return HTTP_T_ERROR;
 
 	str_append_c (&self->string, c);
 	while (self->offset < self->input_len)
 	{
-		c = self->input[self->offset];
-		if (!http_tokenizer_is_char (c)
-		 || http_tokenizer_is_ctl (c)
-		 || strchr (separators, c))
+		if (!eater (c = self->input[self->offset]))
 			break;
 
 		str_append_c (&self->string, c);
 		self->offset++;
 	}
-	return HTTP_T_TOKEN;
+	return result;
 }
 
 // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -320,8 +436,8 @@ http_parse_media_type_parameter
 		goto end;
 	attribute = xstrdup (t->string.str);
 
-	if (http_tokenizer_next (t, false) != HTTP_T_SEPARATOR
-	 || t->separator != '=')
+	if (http_tokenizer_next (t, false) != HTTP_T_DELIMITER
+	 || t->delimiter != '=')
 		goto end;
 
 	switch (http_tokenizer_next (t, false))
@@ -339,24 +455,22 @@ end:
 	return result;
 }
 
-/// Parser for Accept and Content-Type.  @a type and @a subtype may be non-NULL
+/// Parser for "Content-Type".  @a type and @a subtype may be non-NULL
 /// even if the function fails.  @a parameters should be case-insensitive.
 static bool
 http_parse_media_type (const char *media_type,
 	char **type, char **subtype, struct str_map *parameters)
 {
-	// The parsing is strict wrt. LWS as per RFC 2616 section 3.7
-
 	bool result = false;
 	struct http_tokenizer t;
-	http_tokenizer_init (&t, media_type);
+	http_tokenizer_init (&t, media_type, strlen (media_type));
 
 	if (http_tokenizer_next (&t, true) != HTTP_T_TOKEN)
 		goto end;
 	*type = xstrdup (t.string.str);
 
-	if (http_tokenizer_next (&t, false) != HTTP_T_SEPARATOR
-	 || t.separator != '/')
+	if (http_tokenizer_next (&t, false) != HTTP_T_DELIMITER
+	 || t.delimiter != '/')
 		goto end;
 
 	if (http_tokenizer_next (&t, false) != HTTP_T_TOKEN)
@@ -366,8 +480,8 @@ http_parse_media_type (const char *media_type,
 	while (true)
 	switch (http_tokenizer_next (&t, true))
 	{
-	case HTTP_T_SEPARATOR:
-		if (t.separator != ';')
+	case HTTP_T_DELIMITER:
+		if (t.delimiter != ';')
 			goto end;
 		if (!http_parse_media_type_parameter (&t, parameters))
 			goto end;
@@ -383,6 +497,125 @@ end:
 	return result;
 }
 
+// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+struct http_protocol
+{
+	LIST_HEADER (struct http_protocol)
+
+	char *name;                         ///< The protocol to upgrade to
+	char *version;                      ///< Version of the protocol, if any
+};
+
+static void
+http_protocol_destroy (struct http_protocol *self)
+{
+	free (self->name);
+	free (self->version);
+	free (self);
+}
+
+static bool
+http_parse_upgrade (const char *upgrade, struct http_protocol **out)
+{
+	// HTTP grammar makes this more complicated than it should be
+
+	bool result = false;
+	struct http_protocol *list = NULL;
+	struct http_protocol *tail = NULL;
+
+	struct http_tokenizer t;
+	http_tokenizer_init (&t, upgrade, strlen (upgrade));
+
+	enum {
+		STATE_PROTOCOL_NAME,
+		STATE_SLASH,
+		STATE_PROTOCOL_VERSION,
+		STATE_EXPECT_COMMA
+	} state = STATE_PROTOCOL_NAME;
+	struct http_protocol *proto = NULL;
+
+	while (true)
+	switch (state)
+	{
+	case STATE_PROTOCOL_NAME:
+		switch (http_tokenizer_next (&t, false))
+		{
+		case HTTP_T_DELIMITER:
+			if (t.delimiter != ',')
+				goto end;
+		case HTTP_T_WHITESPACE:
+			break;
+		case HTTP_T_TOKEN:
+			proto = xcalloc (1, sizeof *proto);
+			proto->name = xstrdup (t.string.str);
+			LIST_APPEND_WITH_TAIL (list, tail, proto);
+			state = STATE_SLASH;
+			break;
+		case HTTP_T_EOF:
+			result = true;
+		default:
+			goto end;
+		}
+		break;
+	case STATE_SLASH:
+		switch (http_tokenizer_next (&t, false))
+		{
+		case HTTP_T_DELIMITER:
+			if (t.delimiter == '/')
+				state = STATE_PROTOCOL_VERSION;
+			else if (t.delimiter == ',')
+				state = STATE_PROTOCOL_NAME;
+			else
+				goto end;
+			break;
+		case HTTP_T_WHITESPACE:
+			state = STATE_EXPECT_COMMA;
+			break;
+		case HTTP_T_EOF:
+			result = true;
+		default:
+			goto end;
+		}
+		break;
+	case STATE_PROTOCOL_VERSION:
+		switch (http_tokenizer_next (&t, false))
+		{
+		case HTTP_T_TOKEN:
+			proto->version = xstrdup (t.string.str);
+			state = STATE_EXPECT_COMMA;
+			break;
+		default:
+			goto end;
+		}
+		break;
+	case STATE_EXPECT_COMMA:
+		switch (http_tokenizer_next (&t, false))
+		{
+		case HTTP_T_DELIMITER:
+			if (t.delimiter != ',')
+				goto end;
+			state = STATE_PROTOCOL_NAME;
+		case HTTP_T_WHITESPACE:
+			break;
+		case HTTP_T_EOF:
+			result = true;
+		default:
+			goto end;
+		}
+	}
+
+end:
+	if (result)
+		*out = list;
+	else
+		LIST_FOR_EACH (struct http_protocol, iter, list)
+			http_protocol_destroy (iter);
+
+	http_tokenizer_free (&t);
+	return result;
+}
+
 // --- libev helpers -----------------------------------------------------------
 
 static bool
@@ -1765,16 +1998,38 @@ ws_handler_free (struct ws_handler *self)
 	ev_timer_stop (EV_DEFAULT_ &self->ping_timer);
 }
 
+static bool
+ws_handler_header_field_is_a_list (const char *name)
+{
+	// This must contain all header fields we use for anything
+	static const char *concatenable[] =
+		{ SEC_WS_PROTOCOL, SEC_WS_EXTENSIONS, "Connection", "Upgrade" };
+
+	for (size_t i = 0; i < N_ELEMENTS (concatenable); i++)
+		if (!strcasecmp_ascii (name, concatenable[i]))
+			return true;
+	return false;
+}
+
 static void
 ws_handler_on_header_read (struct ws_handler *self)
 {
-	const char *field = self->field.str;
-	bool can_concat =
-		!strcasecmp_ascii (field, SEC_WS_PROTOCOL) ||
-		!strcasecmp_ascii (field, SEC_WS_EXTENSIONS);
+	// The HTTP parser unfolds values and removes preceding whitespace, but
+	// otherwise doesn't touch the values or the following whitespace.
 
+	// RFC 7230 states that trailing whitespace is not part of a field value
+	char *value = self->field.str;
+	size_t len = self->field.len;
+	while (len--)
+		if (value[len] == '\t' || value[len] == ' ')
+			value[len] = '\0';
+		else
+			break;
+	self->field.len = len;
+
+	const char *field = self->field.str;
 	const char *current = str_map_find (&self->headers, field);
-	if (can_concat && current)
+	if (ws_handler_header_field_is_a_list (field) && current)
 		str_map_set (&self->headers, field,
 			xstrdup_printf ("%s, %s", current, self->value.str));
 	else
@@ -1828,6 +2083,7 @@ ws_handler_on_url (http_parser *parser, const char *at, size_t len)
 #define HTTP_101_SWITCHING_PROTOCOLS    "101 Switching Protocols"
 #define HTTP_400_BAD_REQUEST            "400 Bad Request"
 #define HTTP_405_METHOD_NOT_ALLOWED     "405 Method Not Allowed"
+#define HTTP_417_EXPECTATION_FAILED     "407 Expectation Failed"
 #define HTTP_505_VERSION_NOT_SUPPORTED  "505 HTTP Version Not Supported"
 
 static void
@@ -1877,24 +2133,57 @@ ws_handler_http_response (struct ws_handler *self, const char *status, ...)
 static bool
 ws_handler_finish_handshake (struct ws_handler *self)
 {
-	if (self->hp.http_major != 1 || self->hp.http_minor != 1)
+	// XXX: we probably shouldn't use 505 to reject the minor version but w/e
+	if (self->hp.http_major != 1 || self->hp.http_minor < 1)
 		FAIL_HANDSHAKE (HTTP_505_VERSION_NOT_SUPPORTED, NULL);
 	if (self->hp.method != HTTP_GET)
 		FAIL_HANDSHAKE (HTTP_405_METHOD_NOT_ALLOWED, "Allow: GET", NULL);
 
-	// Reject weird URLs specifying the schema and the host
+	// Your expectations are way too high
+	if (str_map_find (&self->headers, "Expect"))
+		FAIL_HANDSHAKE (HTTP_417_EXPECTATION_FAILED, NULL);
+
+	// Reject URLs specifying the schema and host; we're not parsing that
+	// TODO: actually do parse this and let our user decide if it matches
 	struct http_parser_url url;
 	if (http_parser_parse_url (self->url.str, self->url.len, false, &url)
-	 || (url.field_set & (1 << UF_SCHEMA | 1 << UF_HOST | 1 << UF_PORT)))
+	 || (url.field_set & (1 << UF_SCHEMA | 1 << UF_HOST | 1 << UF_PORT))
+	 || !str_map_find (&self->headers, "Host"))
 		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, NULL);
 
-	const char *upgrade  = str_map_find (&self->headers, "Upgrade");
-	// TODO: we should ideally check that this is a 16-byte base64-encoded value
+	const char *connection = str_map_find (&self->headers, "Connection");
+	if (!connection || strcasecmp_ascii (connection, "Upgrade"))
+		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, NULL);
+
+	// Check if we can actually upgrade the protocol to WebSockets
+	const char *upgrade = str_map_find (&self->headers, "Upgrade");
+	struct http_protocol *offered_upgrades = NULL;
+	bool can_upgrade = false;
+	if (upgrade && http_parse_upgrade (upgrade, &offered_upgrades))
+		// Case-insensitive according to RFC 6455; neither RFC 2616 nor 7230
+		// say anything at all about case-sensitivity for this field
+		LIST_FOR_EACH (struct http_protocol, iter, offered_upgrades)
+		{
+			if (!iter->version && !strcasecmp_ascii (iter->name, "websocket"))
+				can_upgrade = true;
+			http_protocol_destroy (iter);
+		}
+	if (!can_upgrade)
+		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, NULL);
+
+	// Okay, we've finally got past basic HTTP/1.1 stuff
 	const char *key      = str_map_find (&self->headers, SEC_WS_KEY);
 	const char *version  = str_map_find (&self->headers, SEC_WS_VERSION);
 	const char *protocol = str_map_find (&self->headers, SEC_WS_PROTOCOL);
 
-	if (!upgrade || strcmp (upgrade, "websocket") || !version)
+	struct str tmp;
+	str_init (&tmp);
+	bool key_is_valid = base64_decode (key, &tmp) && tmp.len == 16;
+	str_free (&tmp);
+	if (!key_is_valid)
+		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, NULL);
+
+	if (!version)
 		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, NULL);
 	if (strcmp (version, "13"))
 		FAIL_HANDSHAKE (HTTP_400_BAD_REQUEST, SEC_WS_VERSION ": 13", NULL);
@@ -1947,9 +2236,6 @@ ws_handler_push (struct ws_handler *self, const void *data, size_t len)
 		.on_url              = ws_handler_on_url,
 	};
 
-	// NOTE: the HTTP parser unfolds values and removes preceeding whitespace,
-	//   but otherwise doesn't touch the values or the following whitespace;
-	//   we might want to strip at least the trailing whitespace
 	size_t n_parsed = http_parser_execute (&self->hp,
 		&http_settings, data, len);