114 lines
4.4 KiB
Rust
114 lines
4.4 KiB
Rust
//! The opening handshake (RFC 6455, section 4.1) and the base64 it needs.
|
|
|
|
use std::io::{Read, Write};
|
|
|
|
use crate::http::{Head, read_head};
|
|
use crate::ws::WsError;
|
|
|
|
/// RFC 6455's magic string, appended to the key before hashing.
|
|
pub const GUID: &str = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
|
|
|
|
const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
|
|
|
|
/// Standard base64 with padding (RFC 4648, section 4).
|
|
pub fn base64(bytes: &[u8]) -> String {
|
|
// Standard alphabet (ALPHABET), "=" padding: each 3 bytes become 4 characters; a last group of
|
|
// 1 or 2 bytes becomes 2 or 3 characters and 2 or 1 "=". No indexing that can go out of bounds.
|
|
let mut out = String::new();
|
|
for chunk in bytes.chunks(3) {
|
|
let b0 = chunk.first().copied().unwrap_or(0);
|
|
let b1 = chunk.get(1).copied().unwrap_or(0);
|
|
let b2 = chunk.get(2).copied().unwrap_or(0);
|
|
let n = ((b0 as u32) << 16) | ((b1 as u32) << 8) | (b2 as u32);
|
|
out.push(ALPHABET[((n >> 18) & 0x3f) as usize] as char);
|
|
out.push(ALPHABET[((n >> 12) & 0x3f) as usize] as char);
|
|
out.push(if chunk.len() > 1 {
|
|
ALPHABET[((n >> 6) & 0x3f) as usize] as char
|
|
} else {
|
|
'='
|
|
});
|
|
out.push(if chunk.len() > 2 {
|
|
ALPHABET[(n & 0x3f) as usize] as char
|
|
} else {
|
|
'='
|
|
});
|
|
}
|
|
out
|
|
}
|
|
|
|
/// The `Sec-WebSocket-Accept` a server must send for `key`.
|
|
pub fn accept_for(key: &str) -> String {
|
|
// base64(sha1(key + GUID)), with `proto::sha1::sha1`.
|
|
let mut data = Vec::with_capacity(key.len() + GUID.len());
|
|
data.extend_from_slice(key.as_bytes());
|
|
data.extend_from_slice(GUID.as_bytes());
|
|
base64(&proto::sha1::sha1(&data))
|
|
}
|
|
|
|
/// A fresh key: 16 bytes from `random` (in `gatewayd`, `/dev/urandom`), in base64.
|
|
pub fn new_key(random: &mut dyn Read) -> std::io::Result<String> {
|
|
// 16 bytes read from `random` with read_exact, then base64.
|
|
let mut key = [0u8; 16];
|
|
random.read_exact(&mut key)?;
|
|
Ok(base64(&key))
|
|
}
|
|
|
|
/// The request, exactly.
|
|
pub fn request_text(host: &str, path: &str, key: &str, token: &str) -> String {
|
|
format!(
|
|
"GET {path} HTTP/1.1\r\nHost: {host}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\
|
|
Sec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\nAuthorization: Bearer {token}\r\n\r\n"
|
|
)
|
|
}
|
|
|
|
/// Is `head` a server's acceptance of `key`? Status 101, `Upgrade: websocket`, a `Connection`
|
|
/// holding the token `upgrade`, and the right `Sec-WebSocket-Accept` (case matters there).
|
|
pub fn check_response(head: &Head, key: &str) -> Result<(), WsError> {
|
|
// In this order, each a Handshake error: status is not 101 ("status <n>"); no Upgrade header
|
|
// equal to "websocket" ignoring case; no Connection header with a comma-separated token equal
|
|
// to "upgrade" ignoring case; Sec-WebSocket-Accept missing, or not exactly `accept_for(key)`.
|
|
if head.status != 101 {
|
|
return Err(WsError::Handshake(format!("status {}", head.status)));
|
|
}
|
|
if !head
|
|
.header("Upgrade")
|
|
.is_some_and(|v| v.eq_ignore_ascii_case("websocket"))
|
|
{
|
|
return Err(WsError::Handshake(
|
|
"the Upgrade header is not websocket".to_string(),
|
|
));
|
|
}
|
|
let upgraded = head.header("Connection").is_some_and(|v| {
|
|
v.split(',')
|
|
.any(|tok| tok.trim().eq_ignore_ascii_case("upgrade"))
|
|
});
|
|
if !upgraded {
|
|
return Err(WsError::Handshake(
|
|
"the Connection header has no upgrade token".to_string(),
|
|
));
|
|
}
|
|
match head.header("Sec-WebSocket-Accept") {
|
|
Some(got) if got == accept_for(key) => Ok(()),
|
|
_ => Err(WsError::Handshake(
|
|
"the Sec-WebSocket-Accept is missing or wrong".to_string(),
|
|
)),
|
|
}
|
|
}
|
|
|
|
/// The whole handshake on `stream`. Nothing after the server's head is read.
|
|
pub fn handshake(
|
|
stream: &mut (impl Read + Write),
|
|
host: &str,
|
|
path: &str,
|
|
token: &str,
|
|
random: &mut dyn Read,
|
|
) -> Result<(), WsError> {
|
|
// A new key; write `request_text` and flush; `read_head` (its error is a Handshake error); then
|
|
// `check_response`. Read nothing after the head.
|
|
let key = new_key(random)?;
|
|
stream.write_all(request_text(host, path, &key, token).as_bytes())?;
|
|
stream.flush()?;
|
|
let head = read_head(stream).map_err(|e| WsError::Handshake(e.to_string()))?;
|
|
check_response(&head, &key)
|
|
}
|