lib/parsers.c

   1 /*
   2  * libwebsockets - small server side websockets and web server implementation
   3  *
   4  * Copyright (C) 2010-2013 Andy Green <andy@warmcat.com>
   5  *
   6  *  This library is free software; you can redistribute it and/or
   7  *  modify it under the terms of the GNU Lesser General Public
   8  *  License as published by the Free Software Foundation:
   9  *  version 2.1 of the License.
  10  *
  11  *  This library is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  *  Lesser General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Lesser General Public
  17  *  License along with this library; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  19  *  MA  02110-1301  USA
  20  */
  21
  22 #include "private-libwebsockets.h"
  23
  24 unsigned char lextable[] = {
  25         #include "lextable.h"
  26 };
  27
  28 #define FAIL_CHAR 0x08
  29
  30 int lextable_decode(int pos, char c)
  31 {
  32         c = tolower(c);
  33
  34         while (1) {
  35                 if (lextable[pos] & (1 << 7)) { /* 1-byte, fail on mismatch */
  36                         if ((lextable[pos] & 0x7f) != c)
  37                                 return -1;
  38                         /* fall thru */
  39                         pos++;
  40                         if (lextable[pos] == FAIL_CHAR)
  41                                 return -1;
  42                         return pos;
  43                 }
  44
  45                 if (lextable[pos] == FAIL_CHAR)
  46                         return -1;
  47
  48                 /* b7 = 0, end or 3-byte */
  49                 if (lextable[pos] < FAIL_CHAR) /* terminal marker */
  50                         return pos;
  51
  52                 if (lextable[pos] == c) /* goto */
  53                         return pos + (lextable[pos + 1]) +
  54                                                 (lextable[pos + 2] << 8);
  55                 /* fall thru goto */
  56                 pos += 3;
  57                 /* continue */
  58         }
  59 }
  60
  61 int lws_allocate_header_table(struct lws *wsi)
  62 {
  63         struct lws_context *context = wsi->context;
  64         int n;
  65
  66         lwsl_debug("%s: wsi %p: ah %p\n", __func__, (void *)wsi,
  67                  (void *)wsi->u.hdr.ah);
  68
  69         /* if we are already bound to one, just clear it down */
  70         if (wsi->u.hdr.ah)
  71                 goto reset;
  72         /*
  73          * server should have suppressed the accept of a new wsi before this
  74          * became the case.  If initiating multiple client connects, make sure
  75          * the ah pool is big enough to cope, or be prepared to retry
  76          */
  77         if (context->ah_count_in_use == context->max_http_header_pool) {
  78                 lwsl_err("No free ah\n");
  79                 return -1;
  80         }
  81
  82         for (n = 0; n < context->max_http_header_pool; n++)
  83                 if (!context->ah_pool[n].in_use)
  84                         break;
  85
  86         /* if the count of in use said something free... */
  87         assert(n != context->max_http_header_pool);
  88
  89         wsi->u.hdr.ah = &context->ah_pool[n];
  90         wsi->u.hdr.ah->in_use = 1;
  91
  92         context->ah_count_in_use++;
  93         /* if we used up all the ah, defeat accepting new server connections */
  94         if (context->ah_count_in_use == context->max_http_header_pool)
  95                 if (_lws_server_listen_accept_flow_control(context, 0))
  96                         return 1;
  97
  98         lwsl_debug("%s: wsi %p: ah %p: count %d (on exit)\n",
  99                  __func__, (void *)wsi, (void *)wsi->u.hdr.ah,
 100                  context->ah_count_in_use);
 101
 102 reset:
 103         /* init the ah to reflect no headers or data have appeared yet */
 104         memset(wsi->u.hdr.ah->frag_index, 0, sizeof(wsi->u.hdr.ah->frag_index));
 105         wsi->u.hdr.ah->nfrag = 0;
 106         wsi->u.hdr.ah->pos = 0;
 107
 108         return 0;
 109 }
 110
 111 int lws_free_header_table(struct lws *wsi)
 112 {
 113         struct lws_context *context = wsi->context;
 114
 115         lwsl_debug("%s: wsi %p: ah %p (count = %d)\n", __func__, (void *)wsi,
 116                  (void *)wsi->u.hdr.ah, context->ah_count_in_use);
 117
 118         assert(wsi->u.hdr.ah);
 119         if (!wsi->u.hdr.ah)
 120                 return 0;
 121
 122         /* if we think we're freeing one, there should be one to free */
 123         assert(context->ah_count_in_use > 0);
 124
 125         assert(wsi->u.hdr.ah->in_use);
 126         wsi->u.hdr.ah->in_use = 0;
 127
 128         /* if we just freed up one ah, allow new server connection */
 129         if (context->ah_count_in_use == context->max_http_header_pool)
 130                 if (_lws_server_listen_accept_flow_control(context, 1))
 131                         return 1;
 132
 133         context->ah_count_in_use--;
 134         wsi->u.hdr.ah = NULL;
 135
 136         return 0;
 137 }
 138
 139 /**
 140  * lws_hdr_fragment_length: report length of a single fragment of a header
 141  *              The returned length does not include the space for a
 142  *              terminating '\0'
 143  *
 144  * @wsi: websocket connection
 145  * @h: which header index we are interested in
 146  * @frag_idx: which fragment of @h we want to get the length of
 147  */
 148
 149 LWS_VISIBLE int
 150 lws_hdr_fragment_length(struct lws *wsi, enum lws_token_indexes h, int frag_idx)
 151 {
 152         int n;
 153
 154         n = wsi->u.hdr.ah->frag_index[h];
 155         if (!n)
 156                 return 0;
 157         do {
 158                 if (!frag_idx)
 159                         return wsi->u.hdr.ah->frags[n].len;
 160                 n = wsi->u.hdr.ah->frags[n].nfrag;
 161         } while (frag_idx-- && n);
 162
 163         return 0;
 164 }
 165
 166 /**
 167  * lws_hdr_total_length: report length of all fragments of a header totalled up
 168  *              The returned length does not include the space for a
 169  *              terminating '\0'
 170  *
 171  * @wsi: websocket connection
 172  * @h: which header index we are interested in
 173  */
 174
 175 LWS_VISIBLE int lws_hdr_total_length(struct lws *wsi, enum lws_token_indexes h)
 176 {
 177         int n;
 178         int len = 0;
 179
 180         n = wsi->u.hdr.ah->frag_index[h];
 181         if (!n)
 182                 return 0;
 183         do {
 184                 len += wsi->u.hdr.ah->frags[n].len;
 185                 n = wsi->u.hdr.ah->frags[n].nfrag;
 186         } while (n);
 187
 188         return len;
 189 }
 190
 191 /**
 192  * lws_hdr_copy_fragment: copy a single fragment of the given header to a buffer
 193  *              The buffer length @len must include space for an additional
 194  *              terminating '\0', or it will fail returning -1.
 195  *              If the requested fragment index is not present, it fails
 196  *              returning -1.
 197  *
 198  * @wsi: websocket connection
 199  * @dst: destination buffer
 200  * @len: length of destination buffer
 201  * @h: which header index we are interested in
 202  * @frag_index: which fragment of @h we want to copy
 203  */
 204
 205 LWS_VISIBLE int lws_hdr_copy_fragment(struct lws *wsi, char *dst, int len,
 206                                       enum lws_token_indexes h, int frag_idx)
 207 {
 208         int n = 0;
 209         int f = wsi->u.hdr.ah->frag_index[h];
 210
 211         while (n < frag_idx) {
 212                 f = wsi->u.hdr.ah->frags[f].nfrag;
 213                 if (!f)
 214                         return -1;
 215                 n++;
 216         }
 217
 218         if (wsi->u.hdr.ah->frags[f].len >= len)
 219                 return -1;
 220
 221         memcpy(dst, wsi->u.hdr.ah->data + wsi->u.hdr.ah->frags[f].offset,
 222                wsi->u.hdr.ah->frags[f].len);
 223         dst[wsi->u.hdr.ah->frags[f].len] = '\0';
 224
 225         return wsi->u.hdr.ah->frags[f].len;
 226 }
 227
 228 /**
 229  * lws_hdr_copy: copy a single fragment of the given header to a buffer
 230  *              The buffer length @len must include space for an additional
 231  *              terminating '\0', or it will fail returning -1.
 232  *
 233  * @wsi: websocket connection
 234  * @dst: destination buffer
 235  * @len: length of destination buffer
 236  * @h: which header index we are interested in
 237  */
 238
 239 LWS_VISIBLE int lws_hdr_copy(struct lws *wsi, char *dst, int len,
 240                              enum lws_token_indexes h)
 241 {
 242         int toklen = lws_hdr_total_length(wsi, h);
 243         int n;
 244
 245         if (toklen >= len)
 246                 return -1;
 247
 248         n = wsi->u.hdr.ah->frag_index[h];
 249         if (!n)
 250                 return 0;
 251
 252         do {
 253                 strcpy(dst, &wsi->u.hdr.ah->data[wsi->u.hdr.ah->frags[n].offset]);
 254                 dst += wsi->u.hdr.ah->frags[n].len;
 255                 n = wsi->u.hdr.ah->frags[n].nfrag;
 256         } while (n);
 257
 258         return toklen;
 259 }
 260
 261 char *lws_hdr_simple_ptr(struct lws *wsi, enum lws_token_indexes h)
 262 {
 263         int n;
 264
 265         n = wsi->u.hdr.ah->frag_index[h];
 266         if (!n)
 267                 return NULL;
 268
 269         return wsi->u.hdr.ah->data + wsi->u.hdr.ah->frags[n].offset;
 270 }
 271
 272 int lws_hdr_simple_create(struct lws *wsi, enum lws_token_indexes h,
 273                           const char *s)
 274 {
 275         wsi->u.hdr.ah->nfrag++;
 276         if (wsi->u.hdr.ah->nfrag == ARRAY_SIZE(wsi->u.hdr.ah->frags)) {
 277                 lwsl_warn("More hdr frags than we can deal with, dropping\n");
 278                 return -1;
 279         }
 280
 281         wsi->u.hdr.ah->frag_index[h] = wsi->u.hdr.ah->nfrag;
 282
 283         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].offset = wsi->u.hdr.ah->pos;
 284         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len = 0;
 285         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].nfrag = 0;
 286
 287         do {
 288                 if (wsi->u.hdr.ah->pos == wsi->context->max_http_header_data) {
 289                         lwsl_err("Ran out of header data space\n");
 290                         return -1;
 291                 }
 292                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = *s;
 293                 if (*s)
 294                         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len++;
 295         } while (*s++);
 296
 297         return 0;
 298 }
 299
 300 static signed char char_to_hex(const char c)
 301 {
 302         if (c >= '0' && c <= '9')
 303                 return c - '0';
 304
 305         if (c >= 'a' && c <= 'f')
 306                 return c - 'a' + 10;
 307
 308         if (c >= 'A' && c <= 'F')
 309                 return c - 'A' + 10;
 310
 311         return -1;
 312 }
 313
 314 static int issue_char(struct lws *wsi, unsigned char c)
 315 {
 316         unsigned short frag_len;
 317
 318         if (wsi->u.hdr.ah->pos == wsi->context->max_http_header_data) {
 319                 lwsl_warn("excessive header content\n");
 320                 return -1;
 321         }
 322
 323         frag_len = wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len;
 324         /*
 325          * If we haven't hit the token limit, just copy the character into
 326          * the header
 327          */
 328         if (frag_len < wsi->u.hdr.current_token_limit) {
 329                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = c;
 330                 if (c)
 331                         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len++;
 332                 return 0;
 333         }
 334
 335         /* Insert a null character when we *hit* the limit: */
 336         if (frag_len == wsi->u.hdr.current_token_limit) {
 337                 if (wsi->u.hdr.ah->pos == wsi->context->max_http_header_data) {
 338                         lwsl_warn("excessive header content 2\n");
 339                         return -1;
 340                 }
 341                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = '\0';
 342                 lwsl_warn("header %i exceeds limit %d\n",
 343                           wsi->u.hdr.parser_state, wsi->u.hdr.current_token_limit);
 344         }
 345
 346         return 1;
 347 }
 348
 349 int lws_parse(struct lws *wsi, unsigned char c)
 350 {
 351         static const unsigned char methods[] = {
 352                 WSI_TOKEN_GET_URI,
 353                 WSI_TOKEN_POST_URI,
 354                 WSI_TOKEN_OPTIONS_URI,
 355                 WSI_TOKEN_PUT_URI,
 356                 WSI_TOKEN_PATCH_URI,
 357                 WSI_TOKEN_DELETE_URI,
 358         };
 359         struct allocated_headers *ah = wsi->u.hdr.ah;
 360         struct lws_context *context = wsi->context;
 361         unsigned int n, m, enc = 0;
 362
 363         switch (wsi->u.hdr.parser_state) {
 364         default:
 365
 366                 lwsl_parser("WSI_TOK_(%d) '%c'\n", wsi->u.hdr.parser_state, c);
 367
 368                 /* collect into malloc'd buffers */
 369                 /* optional initial space swallow */
 370                 if (!ah->frags[ah->frag_index[
 371                                       wsi->u.hdr.parser_state]].len && c == ' ')
 372                         break;
 373
 374                 for (m = 0; m < ARRAY_SIZE(methods); m++)
 375                         if (wsi->u.hdr.parser_state == methods[m])
 376                                 break;
 377                 if (m == ARRAY_SIZE(methods))
 378                         /* it was not any of the methods */
 379                         goto check_eol;
 380
 381                 /* special URI processing... end at space */
 382
 383                 if (c == ' ') {
 384                         /* enforce starting with / */
 385                         if (!ah->frags[ah->nfrag].len)
 386                                 if (issue_char(wsi, '/') < 0)
 387                                         return -1;
 388
 389                         /* begin parsing HTTP version: */
 390                         if (issue_char(wsi, '\0') < 0)
 391                                 return -1;
 392                         wsi->u.hdr.parser_state = WSI_TOKEN_HTTP;
 393                         goto start_fragment;
 394                 }
 395
 396                 /* special URI processing... convert %xx */
 397
 398                 switch (wsi->u.hdr.ues) {
 399                 case URIES_IDLE:
 400                         if (c == '%') {
 401                                 wsi->u.hdr.ues = URIES_SEEN_PERCENT;
 402                                 goto swallow;
 403                         }
 404                         break;
 405                 case URIES_SEEN_PERCENT:
 406                         if (char_to_hex(c) < 0) {
 407                                 /* regurgitate */
 408                                 if (issue_char(wsi, '%') < 0)
 409                                         return -1;
 410                                 wsi->u.hdr.ues = URIES_IDLE;
 411                                 /* continue on to assess c */
 412                                 break;
 413                         }
 414                         wsi->u.hdr.esc_stash = c;
 415                         wsi->u.hdr.ues = URIES_SEEN_PERCENT_H1;
 416                         goto swallow;
 417
 418                 case URIES_SEEN_PERCENT_H1:
 419                         if (char_to_hex(c) < 0) {
 420                                 /* regurgitate */
 421                                 issue_char(wsi, '%');
 422                                 wsi->u.hdr.ues = URIES_IDLE;
 423                                 /* regurgitate + assess */
 424                                 if (lws_parse(wsi, wsi->u.hdr.esc_stash) < 0)
 425                                         return -1;
 426                                 /* continue on to assess c */
 427                                 break;
 428                         }
 429                         c = (char_to_hex(wsi->u.hdr.esc_stash) << 4) |
 430                                         char_to_hex(c);
 431                         enc = 1;
 432                         wsi->u.hdr.ues = URIES_IDLE;
 433                         break;
 434                 }
 435
 436                 /*
 437                  * special URI processing...
 438                  *  convert /.. or /... or /../ etc to /
 439                  *  convert /./ to /
 440                  *  convert // or /// etc to /
 441                  *  leave /.dir or whatever alone
 442                  */
 443
 444                 switch (wsi->u.hdr.ups) {
 445                 case URIPS_IDLE:
 446                         if (!c)
 447                                 return -1;
 448                         /* genuine delimiter */
 449                         if ((c == '&' || c == ';') && !enc) {
 450                                 if (issue_char(wsi, c) < 0)
 451                                         return -1;
 452                                 /* swallow the terminator */
 453                                 ah->frags[ah->nfrag].len--;
 454                                 /* link to next fragment */
 455                                 ah->frags[ah->nfrag].nfrag = ah->nfrag + 1;
 456                                 ah->nfrag++;
 457                                 if (ah->nfrag >= ARRAY_SIZE(ah->frags))
 458                                         goto excessive;
 459                                 /* start next fragment after the & */
 460                                 wsi->u.hdr.post_literal_equal = 0;
 461                                 ah->frags[ah->nfrag].offset = ah->pos;
 462                                 ah->frags[ah->nfrag].len = 0;
 463                                 ah->frags[ah->nfrag].nfrag = 0;
 464                                 goto swallow;
 465                         }
 466                         /* uriencoded = in the name part, disallow */
 467                         if (c == '=' && enc && !wsi->u.hdr.post_literal_equal)
 468                                 c = '_';
 469
 470                         /* after the real =, we don't care how many = */
 471                         if (c == '=' && !enc)
 472                                 wsi->u.hdr.post_literal_equal = 1;
 473
 474                         /* + to space */
 475                         if (c == '+' && !enc)
 476                                 c = ' ';
 477                         /* issue the first / always */
 478                         if (c == '/' && !ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS])
 479                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 480                         break;
 481                 case URIPS_SEEN_SLASH:
 482                         /* swallow subsequent slashes */
 483                         if (c == '/')
 484                                 goto swallow;
 485                         /* track and swallow the first . after / */
 486                         if (c == '.') {
 487                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH_DOT;
 488                                 goto swallow;
 489                         }
 490                         wsi->u.hdr.ups = URIPS_IDLE;
 491                         break;
 492                 case URIPS_SEEN_SLASH_DOT:
 493                         /* swallow second . */
 494                         if (c == '.') {
 495                                 /*
 496                                  * back up one dir level if possible
 497                                  * safe against header fragmentation because
 498                                  * the method URI can only be in 1 fragment
 499                                  */
 500                                 if (ah->frags[ah->nfrag].len > 2) {
 501                                         ah->pos--;
 502                                         ah->frags[ah->nfrag].len--;
 503                                         do {
 504                                                 ah->pos--;
 505                                                 ah->frags[ah->nfrag].len--;
 506                                         } while (ah->frags[ah->nfrag].len > 1 &&
 507                                                  ah->data[ah->pos] != '/');
 508                                 }
 509                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH_DOT_DOT;
 510                                 goto swallow;
 511                         }
 512                         /* change /./ to / */
 513                         if (c == '/') {
 514                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 515                                 goto swallow;
 516                         }
 517                         /* it was like /.dir ... regurgitate the . */
 518                         wsi->u.hdr.ups = URIPS_IDLE;
 519                         if (issue_char(wsi, '.') < 0)
 520                                 return -1;
 521                         break;
 522
 523                 case URIPS_SEEN_SLASH_DOT_DOT:
 524                         /* swallow prior .. chars and any subsequent . */
 525                         if (c == '.')
 526                                 goto swallow;
 527                         /* last issued was /, so another / == // */
 528                         if (c == '/')
 529                                 goto swallow;
 530                         /* last we issued was / so SEEN_SLASH */
 531                         wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 532                         break;
 533                 }
 534
 535                 if (c == '?' && !enc &&
 536                     !ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS]) { /* start of URI arguments */
 537                         /* seal off uri header */
 538                         if (issue_char(wsi, '\0') < 0)
 539                                 return -1;
 540
 541                         /* move to using WSI_TOKEN_HTTP_URI_ARGS */
 542                         ah->nfrag++;
 543                         if (ah->nfrag >= ARRAY_SIZE(ah->frags))
 544                                 goto excessive;
 545                         ah->frags[ah->nfrag].offset = ah->pos;
 546                         ah->frags[ah->nfrag].len = 0;
 547                         ah->frags[ah->nfrag].nfrag = 0;
 548
 549                         wsi->u.hdr.post_literal_equal = 0;
 550                         ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS] = ah->nfrag;
 551                         wsi->u.hdr.ups = URIPS_IDLE;
 552                         goto swallow;
 553                 }
 554
 555 check_eol:
 556
 557                 /* bail at EOL */
 558                 if (wsi->u.hdr.parser_state != WSI_TOKEN_CHALLENGE &&
 559                                                                   c == '\x0d') {
 560                         c = '\0';
 561                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING_SAW_CR;
 562                         lwsl_parser("*\n");
 563                 }
 564
 565                 n = issue_char(wsi, c);
 566                 if ((int)n < 0)
 567                         return -1;
 568                 if (n > 0)
 569                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 570
 571 swallow:
 572                 /* per-protocol end of headers management */
 573
 574                 if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE)
 575                         goto set_parsing_complete;
 576                 break;
 577
 578                 /* collecting and checking a name part */
 579         case WSI_TOKEN_NAME_PART:
 580                 lwsl_parser("WSI_TOKEN_NAME_PART '%c' (mode=%d)\n", c, wsi->mode);
 581
 582                 wsi->u.hdr.lextable_pos =
 583                                 lextable_decode(wsi->u.hdr.lextable_pos, c);
 584                 /*
 585                  * Server needs to look out for unknown methods...
 586                  */
 587                 if (wsi->u.hdr.lextable_pos < 0 &&
 588                     wsi->mode == LWSCM_HTTP_SERVING) {
 589                         /* this is not a header we know about */
 590                         for (m = 0; m < ARRAY_SIZE(methods); m++)
 591                                 if (ah->frag_index[methods[m]]) {
 592                                         /*
 593                                          * already had the method, no idea what
 594                                          * this crap from the client is, ignore
 595                                          */
 596                                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 597                                         break;
 598                                 }
 599                         /*
 600                          * hm it's an unknown http method from a client in fact,
 601                          * treat as dangerous
 602                          */
 603                         if (m == ARRAY_SIZE(methods)) {
 604                                 lwsl_info("Unknown method - dropping\n");
 605                                 return -1;
 606                         }
 607                         break;
 608                 }
 609                 /*
 610                  * ...otherwise for a client, let him ignore unknown headers
 611                  * coming from the server
 612                  */
 613                 if (wsi->u.hdr.lextable_pos < 0) {
 614                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 615                         break;
 616                 }
 617
 618                 if (lextable[wsi->u.hdr.lextable_pos] < FAIL_CHAR) {
 619                         /* terminal state */
 620
 621                         n = ((unsigned int)lextable[wsi->u.hdr.lextable_pos] << 8) |
 622                                         lextable[wsi->u.hdr.lextable_pos + 1];
 623
 624                         lwsl_parser("known hdr %d\n", n);
 625                         for (m = 0; m < ARRAY_SIZE(methods); m++)
 626                                 if (n == methods[m] &&
 627                                                 ah->frag_index[
 628                                                         methods[m]]) {
 629                                         lwsl_warn("Duplicated method\n");
 630                                         return -1;
 631                                 }
 632
 633                         /*
 634                          * WSORIGIN is protocol equiv to ORIGIN,
 635                          * JWebSocket likes to send it, map to ORIGIN
 636                          */
 637                         if (n == WSI_TOKEN_SWORIGIN)
 638                                 n = WSI_TOKEN_ORIGIN;
 639
 640                         wsi->u.hdr.parser_state = (enum lws_token_indexes)
 641                                                         (WSI_TOKEN_GET_URI + n);
 642
 643                         if (context->token_limits)
 644                                 wsi->u.hdr.current_token_limit =
 645                                         context->token_limits->token_limit[
 646                                                        wsi->u.hdr.parser_state];
 647                         else
 648                                 wsi->u.hdr.current_token_limit =
 649                                         wsi->context->max_http_header_data;
 650
 651                         if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE)
 652                                 goto set_parsing_complete;
 653
 654                         goto start_fragment;
 655                 }
 656                 break;
 657
 658 start_fragment:
 659                 ah->nfrag++;
 660 excessive:
 661                 if (ah->nfrag == ARRAY_SIZE(ah->frags)) {
 662                         lwsl_warn("More hdr frags than we can deal with\n");
 663                         return -1;
 664                 }
 665
 666                 ah->frags[ah->nfrag].offset = ah->pos;
 667                 ah->frags[ah->nfrag].len = 0;
 668                 ah->frags[ ah->nfrag].nfrag = 0;
 669
 670                 n = ah->frag_index[wsi->u.hdr.parser_state];
 671                 if (!n) { /* first fragment */
 672                         ah->frag_index[wsi->u.hdr.parser_state] = ah->nfrag;
 673                         break;
 674                 }
 675                 /* continuation */
 676                 while (ah->frags[n].nfrag)
 677                                 n = ah->frags[n].nfrag;
 678                 ah->frags[n].nfrag = ah->nfrag;
 679
 680                 if (issue_char(wsi, ' ') < 0)
 681                         return -1;
 682                 break;
 683
 684                 /* skipping arg part of a name we didn't recognize */
 685         case WSI_TOKEN_SKIPPING:
 686                 lwsl_parser("WSI_TOKEN_SKIPPING '%c'\n", c);
 687
 688                 if (c == '\x0d')
 689                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING_SAW_CR;
 690                 break;
 691
 692         case WSI_TOKEN_SKIPPING_SAW_CR:
 693                 lwsl_parser("WSI_TOKEN_SKIPPING_SAW_CR '%c'\n", c);
 694                 if (c == '\x0a') {
 695                         wsi->u.hdr.parser_state = WSI_TOKEN_NAME_PART;
 696                         wsi->u.hdr.lextable_pos = 0;
 697                 } else
 698                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 699                 break;
 700                 /* we're done, ignore anything else */
 701
 702         case WSI_PARSING_COMPLETE:
 703                 lwsl_parser("WSI_PARSING_COMPLETE '%c'\n", c);
 704                 break;
 705         }
 706
 707         return 0;
 708
 709 set_parsing_complete:
 710
 711         if (lws_hdr_total_length(wsi, WSI_TOKEN_UPGRADE)) {
 712                 if (lws_hdr_total_length(wsi, WSI_TOKEN_VERSION))
 713                         wsi->ietf_spec_revision =
 714                                atoi(lws_hdr_simple_ptr(wsi, WSI_TOKEN_VERSION));
 715
 716                 lwsl_parser("v%02d hdrs completed\n", wsi->ietf_spec_revision);
 717         }
 718         wsi->u.hdr.parser_state = WSI_PARSING_COMPLETE;
 719         wsi->hdr_parsing_completed = 1;
 720
 721         return 0;
 722 }
 723
 724
 725 /**
 726  * lws_frame_is_binary: true if the current frame was sent in binary mode
 727  *
 728  * @wsi: the connection we are inquiring about
 729  *
 730  * This is intended to be called from the LWS_CALLBACK_RECEIVE callback if
 731  * it's interested to see if the frame it's dealing with was sent in binary
 732  * mode.
 733  */
 734
 735 LWS_VISIBLE int lws_frame_is_binary(struct lws *wsi)
 736 {
 737         return wsi->u.ws.frame_is_binary;
 738 }
 739
 740 int
 741 lws_rx_sm(struct lws *wsi, unsigned char c)
 742 {
 743         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 744         struct lws_tokens eff_buf;
 745         int ret = 0, n, rx_draining_ext = 0;
 746         int callback_action = LWS_CALLBACK_RECEIVE;
 747         if (wsi->socket_is_permanently_unusable)
 748                 return -1;
 749
 750         switch (wsi->lws_rx_parse_state) {
 751         case LWS_RXPS_NEW:
 752                 if (wsi->u.ws.rx_draining_ext) {
 753                         struct lws **w = &pt->rx_draining_ext_list;
 754
 755                         eff_buf.token = NULL;
 756                         eff_buf.token_len = 0;
 757                         wsi->u.ws.rx_draining_ext = 0;
 758                         /* remove us from context draining ext list */
 759                         while (*w) {
 760                                 if (*w == wsi) {
 761                                         *w = wsi->u.ws.rx_draining_ext_list;
 762                                         break;
 763                                 }
 764                                 w = &((*w)->u.ws.rx_draining_ext_list);
 765                         }
 766                         wsi->u.ws.rx_draining_ext_list = NULL;
 767                         rx_draining_ext = 1;
 768                         lwsl_err("%s: doing draining flow\n", __func__);
 769
 770                         goto drain_extension;
 771                 }
 772                 switch (wsi->ietf_spec_revision) {
 773                 case 13:
 774                         /*
 775                          * no prepended frame key any more
 776                          */
 777                         wsi->u.ws.all_zero_nonce = 1;
 778                         goto handle_first;
 779
 780                 default:
 781                         lwsl_warn("lws_rx_sm: unknown spec version %d\n",
 782                                                        wsi->ietf_spec_revision);
 783                         break;
 784                 }
 785                 break;
 786         case LWS_RXPS_04_mask_1:
 787                 wsi->u.ws.mask[1] = c;
 788                 if (c)
 789                         wsi->u.ws.all_zero_nonce = 0;
 790                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_2;
 791                 break;
 792         case LWS_RXPS_04_mask_2:
 793                 wsi->u.ws.mask[2] = c;
 794                 if (c)
 795                         wsi->u.ws.all_zero_nonce = 0;
 796                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_3;
 797                 break;
 798         case LWS_RXPS_04_mask_3:
 799                 wsi->u.ws.mask[3] = c;
 800                 if (c)
 801                         wsi->u.ws.all_zero_nonce = 0;
 802
 803                 /*
 804                  * start from the zero'th byte in the XOR key buffer since
 805                  * this is the start of a frame with a new key
 806                  */
 807
 808                 wsi->u.ws.mask_idx = 0;
 809
 810                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_1;
 811                 break;
 812
 813         /*
 814          *  04 logical framing from the spec (all this is masked when incoming
 815          *  and has to be unmasked)
 816          *
 817          * We ignore the possibility of extension data because we don't
 818          * negotiate any extensions at the moment.
 819          *
 820          *    0                   1                   2                   3
 821          *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 822          *   +-+-+-+-+-------+-+-------------+-------------------------------+
 823          *   |F|R|R|R| opcode|R| Payload len |    Extended payload length    |
 824          *   |I|S|S|S|  (4)  |S|     (7)     |             (16/63)           |
 825          *   |N|V|V|V|       |V|             |   (if payload len==126/127)   |
 826          *   | |1|2|3|       |4|             |                               |
 827          *   +-+-+-+-+-------+-+-------------+ - - - - - - - - - - - - - - - +
 828          *   |     Extended payload length continued, if payload len == 127  |
 829          *   + - - - - - - - - - - - - - - - +-------------------------------+
 830          *   |                               |         Extension data        |
 831          *   +-------------------------------+ - - - - - - - - - - - - - - - +
 832          *   :                                                               :
 833          *   +---------------------------------------------------------------+
 834          *   :                       Application data                        :
 835          *   +---------------------------------------------------------------+
 836          *
 837          *  We pass payload through to userland as soon as we get it, ignoring
 838          *  FIN.  It's up to userland to buffer it up if it wants to see a
 839          *  whole unfragmented block of the original size (which may be up to
 840          *  2^63 long!)
 841          */
 842
 843         case LWS_RXPS_04_FRAME_HDR_1:
 844 handle_first:
 845
 846                 wsi->u.ws.opcode = c & 0xf;
 847                 wsi->u.ws.rsv = c & 0x70;
 848                 wsi->u.ws.final = !!((c >> 7) & 1);
 849
 850                 switch (wsi->u.ws.opcode) {
 851                 case LWSWSOPC_TEXT_FRAME:
 852                 case LWSWSOPC_BINARY_FRAME:
 853                         wsi->u.ws.rsv_first_msg = (c & 0x70);
 854                         wsi->u.ws.frame_is_binary =
 855                              wsi->u.ws.opcode == LWSWSOPC_BINARY_FRAME;
 856                         break;
 857                 case 3:
 858                 case 4:
 859                 case 5:
 860                 case 6:
 861                 case 7:
 862                 case 0xb:
 863                 case 0xc:
 864                 case 0xd:
 865                 case 0xe:
 866                 case 0xf:
 867                         lwsl_info("illegal opcode\n");
 868                         return -1;
 869                 }
 870                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN;
 871                 break;
 872
 873         case LWS_RXPS_04_FRAME_HDR_LEN:
 874
 875                 wsi->u.ws.this_frame_masked = !!(c & 0x80);
 876
 877                 switch (c & 0x7f) {
 878                 case 126:
 879                         /* control frames are not allowed to have big lengths */
 880                         if (wsi->u.ws.opcode & 8)
 881                                 goto illegal_ctl_length;
 882
 883                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_2;
 884                         break;
 885                 case 127:
 886                         /* control frames are not allowed to have big lengths */
 887                         if (wsi->u.ws.opcode & 8)
 888                                 goto illegal_ctl_length;
 889
 890                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_8;
 891                         break;
 892                 default:
 893                         wsi->u.ws.rx_packet_length = c & 0x7f;
 894                         if (wsi->u.ws.this_frame_masked)
 895                                 wsi->lws_rx_parse_state =
 896                                                 LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 897                         else
 898                                 if (wsi->u.ws.rx_packet_length)
 899                                         wsi->lws_rx_parse_state =
 900                                         LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
 901                                 else {
 902                                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
 903                                         goto spill;
 904                                 }
 905                         break;
 906                 }
 907                 break;
 908
 909         case LWS_RXPS_04_FRAME_HDR_LEN16_2:
 910                 wsi->u.ws.rx_packet_length = c << 8;
 911                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_1;
 912                 break;
 913
 914         case LWS_RXPS_04_FRAME_HDR_LEN16_1:
 915                 wsi->u.ws.rx_packet_length |= c;
 916                 if (wsi->u.ws.this_frame_masked)
 917                         wsi->lws_rx_parse_state =
 918                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 919                 else
 920                         wsi->lws_rx_parse_state =
 921                                 LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
 922                 break;
 923
 924         case LWS_RXPS_04_FRAME_HDR_LEN64_8:
 925                 if (c & 0x80) {
 926                         lwsl_warn("b63 of length must be zero\n");
 927                         /* kill the connection */
 928                         return -1;
 929                 }
 930 #if defined __LP64__
 931                 wsi->u.ws.rx_packet_length = ((size_t)c) << 56;
 932 #else
 933                 wsi->u.ws.rx_packet_length = 0;
 934 #endif
 935                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_7;
 936                 break;
 937
 938         case LWS_RXPS_04_FRAME_HDR_LEN64_7:
 939 #if defined __LP64__
 940                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 48;
 941 #endif
 942                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_6;
 943                 break;
 944
 945         case LWS_RXPS_04_FRAME_HDR_LEN64_6:
 946 #if defined __LP64__
 947                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 40;
 948 #endif
 949                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_5;
 950                 break;
 951
 952         case LWS_RXPS_04_FRAME_HDR_LEN64_5:
 953 #if defined __LP64__
 954                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 32;
 955 #endif
 956                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_4;
 957                 break;
 958
 959         case LWS_RXPS_04_FRAME_HDR_LEN64_4:
 960                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 24;
 961                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_3;
 962                 break;
 963
 964         case LWS_RXPS_04_FRAME_HDR_LEN64_3:
 965                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 16;
 966                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_2;
 967                 break;
 968
 969         case LWS_RXPS_04_FRAME_HDR_LEN64_2:
 970                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 8;
 971                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_1;
 972                 break;
 973
 974         case LWS_RXPS_04_FRAME_HDR_LEN64_1:
 975                 wsi->u.ws.rx_packet_length |= ((size_t)c);
 976                 if (wsi->u.ws.this_frame_masked)
 977                         wsi->lws_rx_parse_state =
 978                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 979                 else
 980                         wsi->lws_rx_parse_state =
 981                                 LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
 982                 break;
 983
 984         case LWS_RXPS_07_COLLECT_FRAME_KEY_1:
 985                 wsi->u.ws.mask[0] = c;
 986                 if (c)
 987                         wsi->u.ws.all_zero_nonce = 0;
 988                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_2;
 989                 break;
 990
 991         case LWS_RXPS_07_COLLECT_FRAME_KEY_2:
 992                 wsi->u.ws.mask[1] = c;
 993                 if (c)
 994                         wsi->u.ws.all_zero_nonce = 0;
 995                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_3;
 996                 break;
 997
 998         case LWS_RXPS_07_COLLECT_FRAME_KEY_3:
 999                 wsi->u.ws.mask[2] = c;
1000                 if (c)
1001                         wsi->u.ws.all_zero_nonce = 0;
1002                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_4;
1003                 break;
1004
1005         case LWS_RXPS_07_COLLECT_FRAME_KEY_4:
1006                 wsi->u.ws.mask[3] = c;
1007                 if (c)
1008                         wsi->u.ws.all_zero_nonce = 0;
1009                 wsi->lws_rx_parse_state =
1010                                         LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
1011                 wsi->u.ws.mask_idx = 0;
1012                 if (wsi->u.ws.rx_packet_length == 0) {
1013                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
1014                         goto spill;
1015                 }
1016                 break;
1017
1018
1019         case LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED:
1020
1021                 assert(wsi->u.ws.rx_ubuf);
1022
1023                 if (wsi->u.ws.rx_ubuf_head + LWS_PRE >=
1024                     wsi->u.ws.rx_ubuf_alloc) {
1025                         lwsl_err("Attempted overflow \n");
1026                         return -1;
1027                 }
1028                 if (wsi->u.ws.all_zero_nonce)
1029                         wsi->u.ws.rx_ubuf[LWS_PRE +
1030                                          (wsi->u.ws.rx_ubuf_head++)] = c;
1031                 else
1032                         wsi->u.ws.rx_ubuf[LWS_PRE +
1033                                (wsi->u.ws.rx_ubuf_head++)] =
1034                                    c ^ wsi->u.ws.mask[
1035                                             (wsi->u.ws.mask_idx++) & 3];
1036
1037                 if (--wsi->u.ws.rx_packet_length == 0) {
1038                         /* spill because we have the whole frame */
1039                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
1040                         goto spill;
1041                 }
1042
1043                 /*
1044                  * if there's no protocol max frame size given, we are
1045                  * supposed to default to LWS_MAX_SOCKET_IO_BUF
1046                  */
1047
1048                 if (!wsi->protocol->rx_buffer_size &&
1049                                         wsi->u.ws.rx_ubuf_head !=
1050                                                           LWS_MAX_SOCKET_IO_BUF)
1051                         break;
1052                 else
1053                         if (wsi->protocol->rx_buffer_size &&
1054                                         wsi->u.ws.rx_ubuf_head !=
1055                                                   wsi->protocol->rx_buffer_size)
1056                         break;
1057
1058                 /* spill because we filled our rx buffer */
1059 spill:
1060                 /*
1061                  * is this frame a control packet we should take care of at this
1062                  * layer?  If so service it and hide it from the user callback
1063                  */
1064
1065                 lwsl_parser("spill on %s\n", wsi->protocol->name);
1066
1067                 switch (wsi->u.ws.opcode) {
1068                 case LWSWSOPC_CLOSE:
1069
1070                         /* is this an acknowledgement of our close? */
1071                         if (wsi->state == LWSS_AWAITING_CLOSE_ACK) {
1072                                 /*
1073                                  * fine he has told us he is closing too, let's
1074                                  * finish our close
1075                                  */
1076                                 lwsl_parser("seen client close ack\n");
1077                                 return -1;
1078                         }
1079                         if (wsi->state == LWSS_RETURNED_CLOSE_ALREADY)
1080                                 /* if he sends us 2 CLOSE, kill him */
1081                                 return -1;
1082
1083                         if (user_callback_handle_rxflow(
1084                                         wsi->protocol->callback, wsi,
1085                                         LWS_CALLBACK_WS_PEER_INITIATED_CLOSE,
1086                                         wsi->user_space,
1087                                         &wsi->u.ws.rx_ubuf[LWS_PRE],
1088                                         wsi->u.ws.rx_ubuf_head))
1089                                 return -1;
1090
1091                         lwsl_parser("server sees client close packet\n");
1092                         wsi->state = LWSS_RETURNED_CLOSE_ALREADY;
1093                         /* deal with the close packet contents as a PONG */
1094                         wsi->u.ws.payload_is_close = 1;
1095                         goto process_as_ping;
1096
1097                 case LWSWSOPC_PING:
1098                         lwsl_info("received %d byte ping, sending pong\n",
1099                                                  wsi->u.ws.rx_ubuf_head);
1100
1101                         if (wsi->u.ws.ping_pending_flag) {
1102                                 /*
1103                                  * there is already a pending ping payload
1104                                  * we should just log and drop
1105                                  */
1106                                 lwsl_parser("DROP PING since one pending\n");
1107                                 goto ping_drop;
1108                         }
1109 process_as_ping:
1110                         /* control packets can only be < 128 bytes long */
1111                         if (wsi->u.ws.rx_ubuf_head > 128 - 3) {
1112                                 lwsl_parser("DROP PING payload too large\n");
1113                                 goto ping_drop;
1114                         }
1115
1116                         /* stash the pong payload */
1117                         memcpy(wsi->u.ws.ping_payload_buf + LWS_PRE,
1118                                &wsi->u.ws.rx_ubuf[LWS_PRE],
1119                                 wsi->u.ws.rx_ubuf_head);
1120
1121                         wsi->u.ws.ping_payload_len = wsi->u.ws.rx_ubuf_head;
1122                         wsi->u.ws.ping_pending_flag = 1;
1123
1124                         /* get it sent as soon as possible */
1125                         lws_callback_on_writable(wsi);
1126 ping_drop:
1127                         wsi->u.ws.rx_ubuf_head = 0;
1128                         return 0;
1129
1130                 case LWSWSOPC_PONG:
1131                         lwsl_info("received pong\n");
1132                         lwsl_hexdump(&wsi->u.ws.rx_ubuf[LWS_PRE],
1133                                      wsi->u.ws.rx_ubuf_head);
1134
1135                         /* issue it */
1136                         callback_action = LWS_CALLBACK_RECEIVE_PONG;
1137                         break;
1138
1139                 case LWSWSOPC_TEXT_FRAME:
1140                 case LWSWSOPC_BINARY_FRAME:
1141                 case LWSWSOPC_CONTINUATION:
1142                         break;
1143
1144                 default:
1145                         lwsl_parser("passing opc %x up to exts\n",
1146                                     wsi->u.ws.opcode);
1147                         /*
1148                          * It's something special we can't understand here.
1149                          * Pass the payload up to the extension's parsing
1150                          * state machine.
1151                          */
1152
1153                         eff_buf.token = &wsi->u.ws.rx_ubuf[LWS_PRE];
1154                         eff_buf.token_len = wsi->u.ws.rx_ubuf_head;
1155
1156                         if (lws_ext_cb_active(wsi, LWS_EXT_CB_EXTENDED_PAYLOAD_RX,
1157                                         &eff_buf, 0) <= 0) /* not handle or fail */
1158                                 lwsl_ext("ext opc opcode 0x%x unknown\n",
1159                                                               wsi->u.ws.opcode);
1160
1161                         wsi->u.ws.rx_ubuf_head = 0;
1162                         return 0;
1163                 }
1164
1165                 /*
1166                  * No it's real payload, pass it up to the user callback.
1167                  * It's nicely buffered with the pre-padding taken care of
1168                  * so it can be sent straight out again using lws_write
1169                  */
1170
1171                 eff_buf.token = &wsi->u.ws.rx_ubuf[LWS_PRE];
1172                 eff_buf.token_len = wsi->u.ws.rx_ubuf_head;
1173
1174 drain_extension:
1175                 lwsl_ext("%s: passing %d to ext\n", __func__, eff_buf.token_len);
1176
1177                 if (wsi->state == LWSS_RETURNED_CLOSE_ALREADY ||
1178                     wsi->state == LWSS_AWAITING_CLOSE_ACK)
1179                         goto already_done;
1180
1181                 n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_RX, &eff_buf, 0);
1182                 if (n < 0) {
1183                         /*
1184                          * we may rely on this to get RX, just drop connection
1185                          */
1186                         wsi->socket_is_permanently_unusable = 1;
1187                         return -1;
1188                 }
1189
1190                 if (rx_draining_ext && eff_buf.token_len == 0)
1191                         goto already_done;
1192
1193                 if (n && eff_buf.token_len) {
1194                         /* extension had more... main loop will come back */
1195                         wsi->u.ws.rx_draining_ext = 1;
1196                         wsi->u.ws.rx_draining_ext_list = pt->rx_draining_ext_list;
1197                         pt->rx_draining_ext_list = wsi;
1198                 }
1199
1200                 if (eff_buf.token_len > 0 ||
1201                     callback_action == LWS_CALLBACK_RECEIVE_PONG) {
1202                         eff_buf.token[eff_buf.token_len] = '\0';
1203
1204                         if (wsi->protocol->callback) {
1205
1206                                 if (callback_action == LWS_CALLBACK_RECEIVE_PONG)
1207                                         lwsl_info("Doing pong callback\n");
1208
1209                                 ret = user_callback_handle_rxflow(
1210                                                 wsi->protocol->callback,
1211                                                 wsi,
1212                                                 (enum lws_callback_reasons)callback_action,
1213                                                 wsi->user_space,
1214                                                 eff_buf.token,
1215                                                 eff_buf.token_len);
1216                         }
1217                         else
1218                                 lwsl_err("No callback on payload spill!\n");
1219                 }
1220
1221 already_done:
1222                 wsi->u.ws.rx_ubuf_head = 0;
1223                 break;
1224         }
1225
1226         return ret;
1227
1228 illegal_ctl_length:
1229
1230         lwsl_warn("Control frame with xtended length is illegal\n");
1231         /* kill the connection */
1232         return -1;
1233 }
1234
1235
1236 /**
1237  * lws_remaining_packet_payload() - Bytes to come before "overall"
1238  *                                            rx packet is complete
1239  * @wsi:                Websocket instance (available from user callback)
1240  *
1241  *      This function is intended to be called from the callback if the
1242  *  user code is interested in "complete packets" from the client.
1243  *  libwebsockets just passes through payload as it comes and issues a buffer
1244  *  additionally when it hits a built-in limit.  The LWS_CALLBACK_RECEIVE
1245  *  callback handler can use this API to find out if the buffer it has just
1246  *  been given is the last piece of a "complete packet" from the client --
1247  *  when that is the case lws_remaining_packet_payload() will return
1248  *  0.
1249  *
1250  *  Many protocols won't care becuse their packets are always small.
1251  */
1252
1253 LWS_VISIBLE size_t
1254 lws_remaining_packet_payload(struct lws *wsi)
1255 {
1256         return wsi->u.ws.rx_packet_length;
1257 }