lib/roles/ws/ops-ws.c

   1 /*
   2  * libwebsockets - small server side websockets and web server implementation
   3  *
   4  * Copyright (C) 2010-2018 Andy Green <andy@warmcat.com>
   5  *
   6  *  This library is free software; you can redistribute it and/or
   7  *  modify it under the terms of the GNU Lesser General Public
   8  *  License as published by the Free Software Foundation:
   9  *  version 2.1 of the License.
  10  *
  11  *  This library is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  *  Lesser General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Lesser General Public
  17  *  License along with this library; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  19  *  MA  02110-1301  USA
  20  */
  21
  22 #include <core/private.h>
  23
  24 #define LWS_CPYAPP(ptr, str) { strcpy(ptr, str); ptr += strlen(str); }
  25
  26 /*
  27  * client-parser.c: lws_ws_client_rx_sm() needs to be roughly kept in
  28  *   sync with changes here, esp related to ext draining
  29  */
  30
  31 int
  32 lws_ws_rx_sm(struct lws *wsi, char already_processed, unsigned char c)
  33 {
  34         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
  35         int callback_action = LWS_CALLBACK_RECEIVE;
  36         struct lws_ext_pm_deflate_rx_ebufs pmdrx;
  37         unsigned short close_code;
  38         unsigned char *pp;
  39         int ret = 0;
  40         int n = 0;
  41 #if !defined(LWS_WITHOUT_EXTENSIONS)
  42         int rx_draining_ext = 0;
  43         int lin;
  44 #endif
  45
  46         pmdrx.eb_in.token = NULL;
  47         pmdrx.eb_in.len = 0;
  48         pmdrx.eb_out.token = NULL;
  49         pmdrx.eb_out.len = 0;
  50
  51         if (wsi->socket_is_permanently_unusable)
  52                 return -1;
  53
  54         switch (wsi->lws_rx_parse_state) {
  55         case LWS_RXPS_NEW:
  56 #if !defined(LWS_WITHOUT_EXTENSIONS)
  57                 if (wsi->ws->rx_draining_ext) {
  58                         pmdrx.eb_in.token = NULL;
  59                         pmdrx.eb_in.len = 0;
  60                         pmdrx.eb_out.token = NULL;
  61                         pmdrx.eb_out.len = 0;
  62                         lws_remove_wsi_from_draining_ext_list(wsi);
  63                         rx_draining_ext = 1;
  64                         lwsl_debug("%s: doing draining flow\n", __func__);
  65
  66                         goto drain_extension;
  67                 }
  68 #endif
  69                 switch (wsi->ws->ietf_spec_revision) {
  70                 case 13:
  71                         /*
  72                          * no prepended frame key any more
  73                          */
  74                         wsi->ws->all_zero_nonce = 1;
  75                         goto handle_first;
  76
  77                 default:
  78                         lwsl_warn("lws_ws_rx_sm: unknown spec version %d\n",
  79                                   wsi->ws->ietf_spec_revision);
  80                         break;
  81                 }
  82                 break;
  83         case LWS_RXPS_04_mask_1:
  84                 wsi->ws->mask[1] = c;
  85                 if (c)
  86                         wsi->ws->all_zero_nonce = 0;
  87                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_2;
  88                 break;
  89         case LWS_RXPS_04_mask_2:
  90                 wsi->ws->mask[2] = c;
  91                 if (c)
  92                         wsi->ws->all_zero_nonce = 0;
  93                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_3;
  94                 break;
  95         case LWS_RXPS_04_mask_3:
  96                 wsi->ws->mask[3] = c;
  97                 if (c)
  98                         wsi->ws->all_zero_nonce = 0;
  99
 100                 /*
 101                  * start from the zero'th byte in the XOR key buffer since
 102                  * this is the start of a frame with a new key
 103                  */
 104
 105                 wsi->ws->mask_idx = 0;
 106
 107                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_1;
 108                 break;
 109
 110         /*
 111          *  04 logical framing from the spec (all this is masked when incoming
 112          *  and has to be unmasked)
 113          *
 114          * We ignore the possibility of extension data because we don't
 115          * negotiate any extensions at the moment.
 116          *
 117          *    0                   1                   2                   3
 118          *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 119          *   +-+-+-+-+-------+-+-------------+-------------------------------+
 120          *   |F|R|R|R| opcode|R| Payload len |    Extended payload length    |
 121          *   |I|S|S|S|  (4)  |S|     (7)     |             (16/63)           |
 122          *   |N|V|V|V|       |V|             |   (if payload len==126/127)   |
 123          *   | |1|2|3|       |4|             |                               |
 124          *   +-+-+-+-+-------+-+-------------+ - - - - - - - - - - - - - - - +
 125          *   |     Extended payload length continued, if payload len == 127  |
 126          *   + - - - - - - - - - - - - - - - +-------------------------------+
 127          *   |                               |         Extension data        |
 128          *   +-------------------------------+ - - - - - - - - - - - - - - - +
 129          *   :                                                               :
 130          *   +---------------------------------------------------------------+
 131          *   :                       Application data                        :
 132          *   +---------------------------------------------------------------+
 133          *
 134          *  We pass payload through to userland as soon as we get it, ignoring
 135          *  FIN.  It's up to userland to buffer it up if it wants to see a
 136          *  whole unfragmented block of the original size (which may be up to
 137          *  2^63 long!)
 138          */
 139
 140         case LWS_RXPS_04_FRAME_HDR_1:
 141 handle_first:
 142
 143                 wsi->ws->opcode = c & 0xf;
 144                 wsi->ws->rsv = c & 0x70;
 145                 wsi->ws->final = !!((c >> 7) & 1);
 146                 wsi->ws->defeat_check_utf8 = 0;
 147
 148                 if (((wsi->ws->opcode) & 8) && !wsi->ws->final) {
 149                         lws_close_reason(wsi, LWS_CLOSE_STATUS_PROTOCOL_ERR,
 150                                         (uint8_t *)"frag ctl", 8);
 151                         return -1;
 152                 }
 153
 154                 switch (wsi->ws->opcode) {
 155                 case LWSWSOPC_TEXT_FRAME:
 156                         wsi->ws->check_utf8 = lws_check_opt(
 157                                 wsi->context->options,
 158                                 LWS_SERVER_OPTION_VALIDATE_UTF8);
 159                         /* fallthru */
 160                 case LWSWSOPC_BINARY_FRAME:
 161                         if (wsi->ws->opcode == LWSWSOPC_BINARY_FRAME)
 162                                 wsi->ws->check_utf8 = 0;
 163                         if (wsi->ws->continuation_possible) {
 164                                 lws_close_reason(wsi,
 165                                         LWS_CLOSE_STATUS_PROTOCOL_ERR,
 166                                         (uint8_t *)"bad cont", 8);
 167                                 return -1;
 168                         }
 169                         wsi->ws->rsv_first_msg = (c & 0x70);
 170 #if !defined(LWS_WITHOUT_EXTENSIONS)
 171                         /*
 172                          *  set the expectation that we will have to
 173                          * fake up the zlib trailer to the inflator for this
 174                          * frame
 175                          */
 176                         wsi->ws->pmd_trailer_application = !!(c & 0x40);
 177 #endif
 178                         wsi->ws->frame_is_binary =
 179                              wsi->ws->opcode == LWSWSOPC_BINARY_FRAME;
 180                         wsi->ws->first_fragment = 1;
 181                         wsi->ws->continuation_possible = !wsi->ws->final;
 182                         break;
 183                 case LWSWSOPC_CONTINUATION:
 184                         if (!wsi->ws->continuation_possible) {
 185                                 lws_close_reason(wsi,
 186                                         LWS_CLOSE_STATUS_PROTOCOL_ERR,
 187                                         (uint8_t *)"bad cont", 8);
 188                                 return -1;
 189                         }
 190                         break;
 191                 case LWSWSOPC_CLOSE:
 192                         wsi->ws->check_utf8 = 0;
 193                         wsi->ws->utf8 = 0;
 194                         break;
 195                 case 3:
 196                 case 4:
 197                 case 5:
 198                 case 6:
 199                 case 7:
 200                 case 0xb:
 201                 case 0xc:
 202                 case 0xd:
 203                 case 0xe:
 204                 case 0xf:
 205                         lws_close_reason(wsi, LWS_CLOSE_STATUS_PROTOCOL_ERR,
 206                                         (uint8_t *)"bad opc", 7);
 207                         lwsl_info("illegal opcode\n");
 208                         return -1;
 209                 }
 210
 211                 if (wsi->ws->owed_a_fin &&
 212                     (wsi->ws->opcode == LWSWSOPC_TEXT_FRAME ||
 213                      wsi->ws->opcode == LWSWSOPC_BINARY_FRAME)) {
 214                         lwsl_info("hey you owed us a FIN\n");
 215                         lws_close_reason(wsi, LWS_CLOSE_STATUS_PROTOCOL_ERR,
 216                                         (uint8_t *)"bad fin", 7);
 217                         return -1;
 218                 }
 219                 if ((!(wsi->ws->opcode & 8)) && wsi->ws->final) {
 220                         wsi->ws->continuation_possible = 0;
 221                         wsi->ws->owed_a_fin = 0;
 222                 }
 223
 224                 if (!wsi->ws->final)
 225                         wsi->ws->owed_a_fin = 1;
 226
 227                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN;
 228                 if (wsi->ws->rsv &&
 229                     (
 230 #if !defined(LWS_WITHOUT_EXTENSIONS)
 231                                     !wsi->ws->count_act_ext ||
 232 #endif
 233                                     (wsi->ws->rsv & ~0x40))) {
 234                         lws_close_reason(wsi, LWS_CLOSE_STATUS_PROTOCOL_ERR,
 235                                          (uint8_t *)"rsv bits", 8);
 236                         return -1;
 237                 }
 238                 break;
 239
 240         case LWS_RXPS_04_FRAME_HDR_LEN:
 241
 242                 wsi->ws->this_frame_masked = !!(c & 0x80);
 243
 244                 switch (c & 0x7f) {
 245                 case 126:
 246                         /* control frames are not allowed to have big lengths */
 247                         if (wsi->ws->opcode & 8)
 248                                 goto illegal_ctl_length;
 249
 250                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_2;
 251                         break;
 252                 case 127:
 253                         /* control frames are not allowed to have big lengths */
 254                         if (wsi->ws->opcode & 8)
 255                                 goto illegal_ctl_length;
 256
 257                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_8;
 258                         break;
 259                 default:
 260                         wsi->ws->rx_packet_length = c & 0x7f;
 261
 262
 263                         if (wsi->ws->this_frame_masked)
 264                                 wsi->lws_rx_parse_state =
 265                                                 LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 266                         else
 267                                 if (wsi->ws->rx_packet_length) {
 268                                         wsi->lws_rx_parse_state =
 269                                         LWS_RXPS_WS_FRAME_PAYLOAD;
 270                                 } else {
 271                                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
 272                                         goto spill;
 273                                 }
 274                         break;
 275                 }
 276                 break;
 277
 278         case LWS_RXPS_04_FRAME_HDR_LEN16_2:
 279                 wsi->ws->rx_packet_length = c << 8;
 280                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_1;
 281                 break;
 282
 283         case LWS_RXPS_04_FRAME_HDR_LEN16_1:
 284                 wsi->ws->rx_packet_length |= c;
 285                 if (wsi->ws->this_frame_masked)
 286                         wsi->lws_rx_parse_state =
 287                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 288                 else {
 289                         wsi->lws_rx_parse_state =
 290                                 LWS_RXPS_WS_FRAME_PAYLOAD;
 291                 }
 292                 break;
 293
 294         case LWS_RXPS_04_FRAME_HDR_LEN64_8:
 295                 if (c & 0x80) {
 296                         lwsl_warn("b63 of length must be zero\n");
 297                         /* kill the connection */
 298                         return -1;
 299                 }
 300 #if defined __LP64__
 301                 wsi->ws->rx_packet_length = ((size_t)c) << 56;
 302 #else
 303                 wsi->ws->rx_packet_length = 0;
 304 #endif
 305                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_7;
 306                 break;
 307
 308         case LWS_RXPS_04_FRAME_HDR_LEN64_7:
 309 #if defined __LP64__
 310                 wsi->ws->rx_packet_length |= ((size_t)c) << 48;
 311 #endif
 312                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_6;
 313                 break;
 314
 315         case LWS_RXPS_04_FRAME_HDR_LEN64_6:
 316 #if defined __LP64__
 317                 wsi->ws->rx_packet_length |= ((size_t)c) << 40;
 318 #endif
 319                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_5;
 320                 break;
 321
 322         case LWS_RXPS_04_FRAME_HDR_LEN64_5:
 323 #if defined __LP64__
 324                 wsi->ws->rx_packet_length |= ((size_t)c) << 32;
 325 #endif
 326                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_4;
 327                 break;
 328
 329         case LWS_RXPS_04_FRAME_HDR_LEN64_4:
 330                 wsi->ws->rx_packet_length |= ((size_t)c) << 24;
 331                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_3;
 332                 break;
 333
 334         case LWS_RXPS_04_FRAME_HDR_LEN64_3:
 335                 wsi->ws->rx_packet_length |= ((size_t)c) << 16;
 336                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_2;
 337                 break;
 338
 339         case LWS_RXPS_04_FRAME_HDR_LEN64_2:
 340                 wsi->ws->rx_packet_length |= ((size_t)c) << 8;
 341                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_1;
 342                 break;
 343
 344         case LWS_RXPS_04_FRAME_HDR_LEN64_1:
 345                 wsi->ws->rx_packet_length |= ((size_t)c);
 346                 if (wsi->ws->this_frame_masked)
 347                         wsi->lws_rx_parse_state =
 348                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
 349                 else
 350                         wsi->lws_rx_parse_state = LWS_RXPS_WS_FRAME_PAYLOAD;
 351                 break;
 352
 353         case LWS_RXPS_07_COLLECT_FRAME_KEY_1:
 354                 wsi->ws->mask[0] = c;
 355                 if (c)
 356                         wsi->ws->all_zero_nonce = 0;
 357                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_2;
 358                 break;
 359
 360         case LWS_RXPS_07_COLLECT_FRAME_KEY_2:
 361                 wsi->ws->mask[1] = c;
 362                 if (c)
 363                         wsi->ws->all_zero_nonce = 0;
 364                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_3;
 365                 break;
 366
 367         case LWS_RXPS_07_COLLECT_FRAME_KEY_3:
 368                 wsi->ws->mask[2] = c;
 369                 if (c)
 370                         wsi->ws->all_zero_nonce = 0;
 371                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_4;
 372                 break;
 373
 374         case LWS_RXPS_07_COLLECT_FRAME_KEY_4:
 375                 wsi->ws->mask[3] = c;
 376                 if (c)
 377                         wsi->ws->all_zero_nonce = 0;
 378                 wsi->lws_rx_parse_state = LWS_RXPS_WS_FRAME_PAYLOAD;
 379                 wsi->ws->mask_idx = 0;
 380                 if (wsi->ws->rx_packet_length == 0) {
 381                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
 382                         goto spill;
 383                 }
 384                 break;
 385
 386
 387         case LWS_RXPS_WS_FRAME_PAYLOAD:
 388                 assert(wsi->ws->rx_ubuf);
 389
 390                 if (wsi->ws->rx_ubuf_head + LWS_PRE >= wsi->ws->rx_ubuf_alloc) {
 391                         lwsl_err("Attempted overflow \n");
 392                         return -1;
 393                 }
 394                 if (!(already_processed & ALREADY_PROCESSED_IGNORE_CHAR)) {
 395                         if (wsi->ws->all_zero_nonce)
 396                                 wsi->ws->rx_ubuf[LWS_PRE +
 397                                                  (wsi->ws->rx_ubuf_head++)] = c;
 398                         else
 399                                 wsi->ws->rx_ubuf[LWS_PRE +
 400                                                  (wsi->ws->rx_ubuf_head++)] =
 401                                    c ^ wsi->ws->mask[(wsi->ws->mask_idx++) & 3];
 402
 403                         --wsi->ws->rx_packet_length;
 404                 }
 405
 406                 if (!wsi->ws->rx_packet_length) {
 407                         lwsl_debug("%s: ws fragment length exhausted\n",
 408                                    __func__);
 409                         /* spill because we have the whole frame */
 410                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
 411                         goto spill;
 412                 }
 413 #if !defined(LWS_WITHOUT_EXTENSIONS)
 414                 if (wsi->ws->rx_draining_ext) {
 415                         lwsl_debug("%s: UNTIL_EXHAUSTED draining\n", __func__);
 416                         goto drain_extension;
 417                 }
 418 #endif
 419                 /*
 420                  * if there's no protocol max frame size given, we are
 421                  * supposed to default to context->pt_serv_buf_size
 422                  */
 423                 if (!wsi->protocol->rx_buffer_size &&
 424                     wsi->ws->rx_ubuf_head != wsi->context->pt_serv_buf_size)
 425                         break;
 426
 427                 if (wsi->protocol->rx_buffer_size &&
 428                     wsi->ws->rx_ubuf_head != wsi->protocol->rx_buffer_size)
 429                         break;
 430
 431                 /* spill because we filled our rx buffer */
 432 spill:
 433                 /*
 434                  * is this frame a control packet we should take care of at this
 435                  * layer?  If so service it and hide it from the user callback
 436                  */
 437
 438                 lwsl_parser("spill on %s\n", wsi->protocol->name);
 439
 440                 switch (wsi->ws->opcode) {
 441                 case LWSWSOPC_CLOSE:
 442
 443                         if (wsi->ws->peer_has_sent_close)
 444                                 break;
 445
 446                         wsi->ws->peer_has_sent_close = 1;
 447
 448                         pp = &wsi->ws->rx_ubuf[LWS_PRE];
 449                         if (lws_check_opt(wsi->context->options,
 450                                           LWS_SERVER_OPTION_VALIDATE_UTF8) &&
 451                             wsi->ws->rx_ubuf_head > 2 &&
 452                             lws_check_utf8(&wsi->ws->utf8, pp + 2,
 453                                            wsi->ws->rx_ubuf_head - 2))
 454                                 goto utf8_fail;
 455
 456                         /* is this an acknowledgment of our close? */
 457                         if (lwsi_state(wsi) == LRS_AWAITING_CLOSE_ACK) {
 458                                 /*
 459                                  * fine he has told us he is closing too, let's
 460                                  * finish our close
 461                                  */
 462                                 lwsl_parser("seen client close ack\n");
 463                                 return -1;
 464                         }
 465                         if (lwsi_state(wsi) == LRS_RETURNED_CLOSE)
 466                                 /* if he sends us 2 CLOSE, kill him */
 467                                 return -1;
 468
 469                         if (lws_partial_buffered(wsi)) {
 470                                 /*
 471                                  * if we're in the middle of something,
 472                                  * we can't do a normal close response and
 473                                  * have to just close our end.
 474                                  */
 475                                 wsi->socket_is_permanently_unusable = 1;
 476                                 lwsl_parser("Closing on peer close "
 477                                             "due to pending tx\n");
 478                                 return -1;
 479                         }
 480
 481                         if (wsi->ws->rx_ubuf_head >= 2) {
 482                                 close_code = (pp[0] << 8) | pp[1];
 483                                 if (close_code < 1000 ||
 484                                     close_code == 1004 ||
 485                                     close_code == 1005 ||
 486                                     close_code == 1006 ||
 487                                     close_code == 1012 ||
 488                                     close_code == 1013 ||
 489                                     close_code == 1014 ||
 490                                     close_code == 1015 ||
 491                                     (close_code >= 1016 && close_code < 3000)
 492                                 ) {
 493                                         pp[0] = (LWS_CLOSE_STATUS_PROTOCOL_ERR >> 8) & 0xff;
 494                                         pp[1] = LWS_CLOSE_STATUS_PROTOCOL_ERR & 0xff;
 495                                 }
 496                         }
 497
 498                         if (user_callback_handle_rxflow(
 499                                         wsi->protocol->callback, wsi,
 500                                         LWS_CALLBACK_WS_PEER_INITIATED_CLOSE,
 501                                         wsi->user_space,
 502                                         &wsi->ws->rx_ubuf[LWS_PRE],
 503                                         wsi->ws->rx_ubuf_head))
 504                                 return -1;
 505
 506                         lwsl_parser("server sees client close packet\n");
 507                         lwsi_set_state(wsi, LRS_RETURNED_CLOSE);
 508                         /* deal with the close packet contents as a PONG */
 509                         wsi->ws->payload_is_close = 1;
 510                         goto process_as_ping;
 511
 512                 case LWSWSOPC_PING:
 513                         lwsl_info("received %d byte ping, sending pong\n",
 514                                                  wsi->ws->rx_ubuf_head);
 515
 516                         if (wsi->ws->ping_pending_flag) {
 517                                 /*
 518                                  * there is already a pending ping payload
 519                                  * we should just log and drop
 520                                  */
 521                                 lwsl_parser("DROP PING since one pending\n");
 522                                 goto ping_drop;
 523                         }
 524 process_as_ping:
 525                         /* control packets can only be < 128 bytes long */
 526                         if (wsi->ws->rx_ubuf_head > 128 - 3) {
 527                                 lwsl_parser("DROP PING payload too large\n");
 528                                 goto ping_drop;
 529                         }
 530
 531                         /* stash the pong payload */
 532                         memcpy(wsi->ws->ping_payload_buf + LWS_PRE,
 533                                &wsi->ws->rx_ubuf[LWS_PRE],
 534                                 wsi->ws->rx_ubuf_head);
 535
 536                         wsi->ws->ping_payload_len = wsi->ws->rx_ubuf_head;
 537                         wsi->ws->ping_pending_flag = 1;
 538
 539                         /* get it sent as soon as possible */
 540                         lws_callback_on_writable(wsi);
 541 ping_drop:
 542                         wsi->ws->rx_ubuf_head = 0;
 543                         return 0;
 544
 545                 case LWSWSOPC_PONG:
 546                         lwsl_info("received pong\n");
 547                         lwsl_hexdump(&wsi->ws->rx_ubuf[LWS_PRE],
 548                                      wsi->ws->rx_ubuf_head);
 549
 550                         if (wsi->ws->await_pong) {
 551                                 lwsl_info("received expected PONG on wsi %p\n",
 552                                                 wsi);
 553                                 lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
 554                                 wsi->ws->await_pong = 0;
 555
 556                                 /*
 557                                  * prepare to send the ping again if nothing
 558                                  * sent to countermand it
 559                                  */
 560
 561                                 __lws_sul_insert(&pt->pt_sul_owner,
 562                                                  &wsi->sul_ping,
 563                                         (lws_usec_t)wsi->context->ws_ping_pong_interval *
 564                                          LWS_USEC_PER_SEC);
 565                         }
 566
 567                         /* issue it */
 568                         callback_action = LWS_CALLBACK_RECEIVE_PONG;
 569                         break;
 570
 571                 case LWSWSOPC_TEXT_FRAME:
 572                 case LWSWSOPC_BINARY_FRAME:
 573                 case LWSWSOPC_CONTINUATION:
 574                         break;
 575
 576                 default:
 577                         lwsl_parser("unknown opc %x\n", wsi->ws->opcode);
 578
 579                         return -1;
 580                 }
 581
 582                 /*
 583                  * No it's real payload, pass it up to the user callback.
 584                  *
 585                  * We have been statefully collecting it in the
 586                  * LWS_RXPS_WS_FRAME_PAYLOAD clause above.
 587                  *
 588                  * It's nicely buffered with the pre-padding taken care of
 589                  * so it can be sent straight out again using lws_write.
 590                  *
 591                  * However, now we have a chunk of it, we want to deal with it
 592                  * all here.  Since this may be input to permessage-deflate and
 593                  * there are block limits on that for input and output, we may
 594                  * need to iterate.
 595                  */
 596
 597                 pmdrx.eb_in.token = &wsi->ws->rx_ubuf[LWS_PRE];
 598                 pmdrx.eb_in.len = wsi->ws->rx_ubuf_head;
 599
 600                 /* for the non-pm-deflate case */
 601
 602                 pmdrx.eb_out = pmdrx.eb_in;
 603
 604                 if (wsi->ws->opcode == LWSWSOPC_PONG && !pmdrx.eb_in.len)
 605                         goto already_done;
 606 #if !defined(LWS_WITHOUT_EXTENSIONS)
 607 drain_extension:
 608 #endif
 609
 610                 do {
 611
 612 //                      lwsl_notice("%s: pmdrx.eb_in.len: %d\n", __func__,
 613 //                                      (int)pmdrx.eb_in.len);
 614
 615                         if (lwsi_state(wsi) == LRS_RETURNED_CLOSE ||
 616                             lwsi_state(wsi) == LRS_AWAITING_CLOSE_ACK)
 617                                 goto already_done;
 618
 619                         n = PMDR_DID_NOTHING;
 620
 621 #if !defined(LWS_WITHOUT_EXTENSIONS)
 622                         lin = pmdrx.eb_in.len;
 623                         //if (lin)
 624                         //      lwsl_hexdump_notice(ebuf.token, ebuf.len);
 625                         lwsl_ext("%s: +++ passing %d %p to ext\n", __func__,
 626                                         pmdrx.eb_in.len, pmdrx.eb_in.token);
 627
 628                         n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_RX, &pmdrx, 0);
 629                         lwsl_debug("%s: ext says %d / ebuf.len %d\n", __func__,
 630                                    n, pmdrx.eb_out.len);
 631                         if (wsi->ws->rx_draining_ext)
 632                                 already_processed &= ~ALREADY_PROCESSED_NO_CB;
 633 #endif
 634
 635                         /*
 636                          * ebuf may be pointing somewhere completely different
 637                          * now, it's the output
 638                          */
 639 #if !defined(LWS_WITHOUT_EXTENSIONS)
 640                         if (n < 0) {
 641                                 /*
 642                                  * we may rely on this to get RX, just drop
 643                                  * connection
 644                                  */
 645                                 wsi->socket_is_permanently_unusable = 1;
 646                                 return -1;
 647                         }
 648                         if (n == PMDR_DID_NOTHING)
 649                                 break;
 650 #endif
 651                         lwsl_debug("%s: post ext ret %d, ebuf in %d / out %d\n",
 652                                     __func__, n, pmdrx.eb_in.len,
 653                                     pmdrx.eb_out.len);
 654
 655 #if !defined(LWS_WITHOUT_EXTENSIONS)
 656                         if (rx_draining_ext && !pmdrx.eb_out.len) {
 657                                 lwsl_debug("   --- ending drain on 0 read\n");
 658                                 goto already_done;
 659                         }
 660
 661                         if (n == PMDR_HAS_PENDING)
 662                                 /*
 663                                  * extension had more...
 664                                  * main loop will come back
 665                                  */
 666                                 lws_add_wsi_to_draining_ext_list(wsi);
 667                         else
 668                                 lws_remove_wsi_from_draining_ext_list(wsi);
 669
 670                         rx_draining_ext = wsi->ws->rx_draining_ext;
 671 #endif
 672
 673                         if (pmdrx.eb_out.len &&
 674                             wsi->ws->check_utf8 && !wsi->ws->defeat_check_utf8) {
 675                                 if (lws_check_utf8(&wsi->ws->utf8,
 676                                                    pmdrx.eb_out.token,
 677                                                    pmdrx.eb_out.len)) {
 678                                         lws_close_reason(wsi,
 679                                                 LWS_CLOSE_STATUS_INVALID_PAYLOAD,
 680                                                 (uint8_t *)"bad utf8", 8);
 681                                         goto utf8_fail;
 682                                 }
 683
 684                                 /* we are ending partway through utf-8 character? */
 685                                 if (!wsi->ws->rx_packet_length &&
 686                                     wsi->ws->final && wsi->ws->utf8
 687 #if !defined(LWS_WITHOUT_EXTENSIONS)
 688                                     /* if ext not negotiated, going to be UNKNOWN */
 689                                     && (n == PMDR_EMPTY_FINAL || n == PMDR_UNKNOWN)
 690 #endif
 691                                 ) {
 692                                         lwsl_info("FINAL utf8 error\n");
 693                                         lws_close_reason(wsi,
 694                                                 LWS_CLOSE_STATUS_INVALID_PAYLOAD,
 695                                                 (uint8_t *)"partial utf8", 12);
 696 utf8_fail:
 697                                         lwsl_notice("utf8 error\n");
 698                                         lwsl_hexdump_notice(pmdrx.eb_out.token,
 699                                                             pmdrx.eb_out.len);
 700
 701                                         return -1;
 702                                 }
 703                         }
 704
 705                         /* if pmd not enabled, in == out */
 706
 707                         if (n == PMDR_DID_NOTHING
 708 #if !defined(LWS_WITHOUT_EXTENSIONS)
 709                                         ||
 710                             n == PMDR_UNKNOWN
 711 #endif
 712                             )
 713                                 pmdrx.eb_in.len -= pmdrx.eb_out.len;
 714
 715         if (!wsi->wsistate_pre_close &&
 716                             (pmdrx.eb_out.len >= 0 ||
 717                              callback_action == LWS_CALLBACK_RECEIVE_PONG ||
 718                                                        n == PMDR_EMPTY_FINAL)) {
 719                                 if (pmdrx.eb_out.len)
 720                                         pmdrx.eb_out.token[pmdrx.eb_out.len] = '\0';
 721
 722                                 if (wsi->protocol->callback &&
 723                                     !(already_processed & ALREADY_PROCESSED_NO_CB)) {
 724                                         if (callback_action ==
 725                                                       LWS_CALLBACK_RECEIVE_PONG)
 726                                                 lwsl_info("Doing pong callback\n");
 727
 728                                         ret = user_callback_handle_rxflow(
 729                                                 wsi->protocol->callback, wsi,
 730                                                 (enum lws_callback_reasons)
 731                                                              callback_action,
 732                                                 wsi->user_space,
 733                                                 pmdrx.eb_out.token,
 734                                                 pmdrx.eb_out.len);
 735                                 }
 736                                 wsi->ws->first_fragment = 0;
 737                         }
 738
 739 #if !defined(LWS_WITHOUT_EXTENSIONS)
 740                         if (!lin)
 741                                 break;
 742 #endif
 743
 744                 } while (pmdrx.eb_in.len
 745 #if !defined(LWS_WITHOUT_EXTENSIONS)
 746                                 || rx_draining_ext
 747 #endif
 748                 );
 749
 750 already_done:
 751                 wsi->ws->rx_ubuf_head = 0;
 752                 break;
 753         }
 754
 755         return ret;
 756
 757 illegal_ctl_length:
 758
 759         lwsl_warn("Control frame with xtended length is illegal\n");
 760         /* kill the connection */
 761         return -1;
 762 }
 763
 764
 765 LWS_VISIBLE size_t
 766 lws_remaining_packet_payload(struct lws *wsi)
 767 {
 768         return wsi->ws->rx_packet_length;
 769 }
 770
 771 LWS_VISIBLE int lws_frame_is_binary(struct lws *wsi)
 772 {
 773         return wsi->ws->frame_is_binary;
 774 }
 775
 776 void
 777 lws_add_wsi_to_draining_ext_list(struct lws *wsi)
 778 {
 779 #if !defined(LWS_WITHOUT_EXTENSIONS)
 780         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 781
 782         if (wsi->ws->rx_draining_ext)
 783                 return;
 784
 785         lwsl_debug("%s: RX EXT DRAINING: Adding to list\n", __func__);
 786
 787         wsi->ws->rx_draining_ext = 1;
 788         wsi->ws->rx_draining_ext_list = pt->ws.rx_draining_ext_list;
 789         pt->ws.rx_draining_ext_list = wsi;
 790 #endif
 791 }
 792
 793 void
 794 lws_remove_wsi_from_draining_ext_list(struct lws *wsi)
 795 {
 796 #if !defined(LWS_WITHOUT_EXTENSIONS)
 797         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 798         struct lws **w = &pt->ws.rx_draining_ext_list;
 799
 800         if (!wsi->ws->rx_draining_ext)
 801                 return;
 802
 803         lwsl_debug("%s: RX EXT DRAINING: Removing from list\n", __func__);
 804
 805         wsi->ws->rx_draining_ext = 0;
 806
 807         /* remove us from context draining ext list */
 808         while (*w) {
 809                 if (*w == wsi) {
 810                         /* if us, point it instead to who we were pointing to */
 811                         *w = wsi->ws->rx_draining_ext_list;
 812                         break;
 813                 }
 814                 w = &((*w)->ws->rx_draining_ext_list);
 815         }
 816         wsi->ws->rx_draining_ext_list = NULL;
 817 #endif
 818 }
 819
 820 static int
 821 lws_0405_frame_mask_generate(struct lws *wsi)
 822 {
 823         int n;
 824         /* fetch the per-frame nonce */
 825
 826         n = lws_get_random(lws_get_context(wsi), wsi->ws->mask, 4);
 827         if (n != 4) {
 828                 lwsl_parser("Unable to read from random device %s %d\n",
 829                             SYSTEM_RANDOM_FILEPATH, n);
 830                 return 1;
 831         }
 832
 833         /* start masking from first byte of masking key buffer */
 834         wsi->ws->mask_idx = 0;
 835
 836         return 0;
 837 }
 838
 839 void
 840 lws_sul_wsping_cb(lws_sorted_usec_list_t *sul)
 841 {
 842         struct lws *wsi = lws_container_of(sul, struct lws, sul_ping);
 843
 844         /*
 845          * The sul_ping timer came up... either it's time to send a PING
 846          * (!wsi->ws->send_check_ping), or we didn't get the PONG in time
 847          * (wsi->ws->send_check_ping)
 848          */
 849
 850         if (!wsi->ws->send_check_ping) {
 851                 lwsl_info("%s: req pp on wsi %p\n", __func__, wsi);
 852
 853                 wsi->ws->send_check_ping = 1;
 854                 lws_set_timeout(wsi, PENDING_TIMEOUT_WS_PONG_CHECK_SEND_PING,
 855                                 wsi->context->timeout_secs);
 856                 lws_callback_on_writable(wsi);
 857
 858                 return;
 859         }
 860
 861         if (wsi->ws->await_pong) {
 862                 /* it didn't return the PONG in time */
 863
 864                 lwsl_info("%s: wsi %p: failed to send PONG\n", __func__, wsi);
 865                 __lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS,
 866                                      "PONG timeout");
 867         }
 868 }
 869
 870 int
 871 lws_server_init_wsi_for_ws(struct lws *wsi)
 872 {
 873         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 874         int n;
 875
 876         lwsi_set_state(wsi, LRS_ESTABLISHED);
 877
 878         if (wsi->context->ws_ping_pong_interval && !wsi->http2_substream ) {
 879                 wsi->sul_ping.cb = lws_sul_wsping_cb;
 880                 __lws_sul_insert(&pt->pt_sul_owner, &wsi->sul_ping,
 881                                  (lws_usec_t)wsi->context->ws_ping_pong_interval *
 882                                  LWS_USEC_PER_SEC);
 883         }
 884
 885         /*
 886          * create the frame buffer for this connection according to the
 887          * size mentioned in the protocol definition.  If 0 there, use
 888          * a big default for compatibility
 889          */
 890
 891         n = (int)wsi->protocol->rx_buffer_size;
 892         if (!n)
 893                 n = wsi->context->pt_serv_buf_size;
 894         n += LWS_PRE;
 895         wsi->ws->rx_ubuf = lws_malloc(n + 4 /* 0x0000ffff zlib */, "rx_ubuf");
 896         if (!wsi->ws->rx_ubuf) {
 897                 lwsl_err("Out of Mem allocating rx buffer %d\n", n);
 898                 return 1;
 899         }
 900         wsi->ws->rx_ubuf_alloc = n;
 901         lwsl_debug("Allocating RX buffer %d\n", n);
 902
 903 #if !defined(LWS_WITH_ESP32)
 904         if (!wsi->h2_stream_carries_ws)
 905                 if (setsockopt(wsi->desc.sockfd, SOL_SOCKET, SO_SNDBUF,
 906                        (const char *)&n, sizeof n)) {
 907                         lwsl_warn("Failed to set SNDBUF to %d", n);
 908                         return 1;
 909                 }
 910 #endif
 911
 912         /* notify user code that we're ready to roll */
 913
 914         if (wsi->protocol->callback)
 915                 if (wsi->protocol->callback(wsi, LWS_CALLBACK_ESTABLISHED,
 916                                             wsi->user_space,
 917 #ifdef LWS_WITH_TLS
 918                                             wsi->tls.ssl,
 919 #else
 920                                             NULL,
 921 #endif
 922                                             wsi->h2_stream_carries_ws))
 923                         return 1;
 924
 925         lwsl_debug("ws established\n");
 926
 927         return 0;
 928 }
 929
 930
 931
 932 LWS_VISIBLE int
 933 lws_is_final_fragment(struct lws *wsi)
 934 {
 935 #if !defined(LWS_WITHOUT_EXTENSIONS)
 936         lwsl_debug("%s: final %d, rx pk length %ld, draining %ld\n", __func__,
 937                    wsi->ws->final, (long)wsi->ws->rx_packet_length,
 938                    (long)wsi->ws->rx_draining_ext);
 939         return wsi->ws->final && !wsi->ws->rx_packet_length &&
 940                !wsi->ws->rx_draining_ext;
 941 #else
 942         return wsi->ws->final && !wsi->ws->rx_packet_length;
 943 #endif
 944 }
 945
 946 LWS_VISIBLE int
 947 lws_is_first_fragment(struct lws *wsi)
 948 {
 949         return wsi->ws->first_fragment;
 950 }
 951
 952 LWS_VISIBLE unsigned char
 953 lws_get_reserved_bits(struct lws *wsi)
 954 {
 955         return wsi->ws->rsv;
 956 }
 957
 958 LWS_VISIBLE LWS_EXTERN int
 959 lws_get_close_length(struct lws *wsi)
 960 {
 961         return wsi->ws->close_in_ping_buffer_len;
 962 }
 963
 964 LWS_VISIBLE LWS_EXTERN unsigned char *
 965 lws_get_close_payload(struct lws *wsi)
 966 {
 967         return &wsi->ws->ping_payload_buf[LWS_PRE];
 968 }
 969
 970 LWS_VISIBLE LWS_EXTERN void
 971 lws_close_reason(struct lws *wsi, enum lws_close_status status,
 972                  unsigned char *buf, size_t len)
 973 {
 974         unsigned char *p, *start;
 975         int budget = sizeof(wsi->ws->ping_payload_buf) - LWS_PRE;
 976
 977         assert(lwsi_role_ws(wsi));
 978
 979         start = p = &wsi->ws->ping_payload_buf[LWS_PRE];
 980
 981         *p++ = (((int)status) >> 8) & 0xff;
 982         *p++ = ((int)status) & 0xff;
 983
 984         if (buf)
 985                 while (len-- && p < start + budget)
 986                         *p++ = *buf++;
 987
 988         wsi->ws->close_in_ping_buffer_len = lws_ptr_diff(p, start);
 989 }
 990
 991 static int
 992 lws_is_ws_with_ext(struct lws *wsi)
 993 {
 994 #if defined(LWS_WITHOUT_EXTENSIONS)
 995         return 0;
 996 #else
 997         return lwsi_role_ws(wsi) && !!wsi->ws->count_act_ext;
 998 #endif
 999 }
1000
1001 static int
1002 rops_handle_POLLIN_ws(struct lws_context_per_thread *pt, struct lws *wsi,
1003                        struct lws_pollfd *pollfd)
1004 {
1005         unsigned int pending = 0;
1006         struct lws_tokens ebuf;
1007         char buffered = 0;
1008         int n = 0, m;
1009 #if defined(LWS_WITH_HTTP2)
1010         struct lws *wsi1;
1011 #endif
1012
1013         if (!wsi->ws) {
1014                 lwsl_err("ws role wsi with no ws\n");
1015                 return LWS_HPI_RET_PLEASE_CLOSE_ME;
1016         }
1017
1018         // lwsl_notice("%s: %s\n", __func__, wsi->protocol->name);
1019
1020         //lwsl_info("%s: wsistate 0x%x, pollout %d\n", __func__,
1021         //         wsi->wsistate, pollfd->revents & LWS_POLLOUT);
1022
1023         /*
1024          * something went wrong with parsing the handshake, and
1025          * we ended up back in the event loop without completing it
1026          */
1027         if (lwsi_state(wsi) == LRS_PRE_WS_SERVING_ACCEPT) {
1028                 wsi->socket_is_permanently_unusable = 1;
1029                 return LWS_HPI_RET_PLEASE_CLOSE_ME;
1030         }
1031
1032         ebuf.token = NULL;
1033         ebuf.len = 0;
1034
1035         if (lwsi_state(wsi) == LRS_WAITING_CONNECT) {
1036 #if !defined(LWS_NO_CLIENT)
1037                 if ((pollfd->revents & LWS_POLLOUT) &&
1038                     lws_handle_POLLOUT_event(wsi, pollfd)) {
1039                         lwsl_debug("POLLOUT event closed it\n");
1040                         return LWS_HPI_RET_PLEASE_CLOSE_ME;
1041                 }
1042
1043                 n = lws_client_socket_service(wsi, pollfd, NULL);
1044                 if (n)
1045                         return LWS_HPI_RET_WSI_ALREADY_DIED;
1046 #endif
1047                 return LWS_HPI_RET_HANDLED;
1048         }
1049
1050         /* 1: something requested a callback when it was OK to write */
1051
1052         if ((pollfd->revents & LWS_POLLOUT) &&
1053             lwsi_state_can_handle_POLLOUT(wsi) &&
1054             lws_handle_POLLOUT_event(wsi, pollfd)) {
1055                 if (lwsi_state(wsi) == LRS_RETURNED_CLOSE)
1056                         lwsi_set_state(wsi, LRS_FLUSHING_BEFORE_CLOSE);
1057
1058                 return LWS_HPI_RET_PLEASE_CLOSE_ME;
1059         }
1060
1061         if (lwsi_state(wsi) == LRS_RETURNED_CLOSE ||
1062             lwsi_state(wsi) == LRS_WAITING_TO_SEND_CLOSE) {
1063                 /*
1064                  * we stopped caring about anything except control
1065                  * packets.  Force flow control off, defeat tx
1066                  * draining.
1067                  */
1068                 lws_rx_flow_control(wsi, 1);
1069 #if !defined(LWS_WITHOUT_EXTENSIONS)
1070                 if (wsi->ws)
1071                         wsi->ws->tx_draining_ext = 0;
1072 #endif
1073         }
1074 #if !defined(LWS_WITHOUT_EXTENSIONS)
1075         if (wsi->ws->tx_draining_ext) {
1076                 lws_handle_POLLOUT_event(wsi, pollfd);
1077                 //lwsl_notice("%s: tx drain\n", __func__);
1078                 /*
1079                  * We cannot deal with new RX until the TX ext path has
1080                  * been drained.  It's because new rx will, eg, crap on
1081                  * the wsi rx buf that may be needed to retain state.
1082                  *
1083                  * TX ext drain path MUST go through event loop to avoid
1084                  * blocking.
1085                  */
1086                 lws_callback_on_writable(wsi);
1087                 return LWS_HPI_RET_HANDLED;
1088         }
1089 #endif
1090         if ((pollfd->revents & LWS_POLLIN) && lws_is_flowcontrolled(wsi)) {
1091                 /* We cannot deal with any kind of new RX because we are
1092                  * RX-flowcontrolled.
1093                  */
1094                 lwsl_info("%s: flowcontrolled, ignoring rx\n", __func__);
1095
1096                 if (__lws_change_pollfd(wsi, LWS_POLLIN, 0))
1097                         return -1;
1098
1099                 return LWS_HPI_RET_HANDLED;
1100         }
1101
1102         if (lws_is_flowcontrolled(wsi))
1103                 return LWS_HPI_RET_HANDLED;
1104
1105 #if defined(LWS_WITH_HTTP2)
1106         if (wsi->http2_substream || wsi->upgraded_to_http2) {
1107                 wsi1 = lws_get_network_wsi(wsi);
1108                 if (wsi1 && lws_has_buffered_out(wsi1))
1109                         /* We cannot deal with any kind of new RX
1110                          * because we are dealing with a partial send
1111                          * (new RX may trigger new http_action() that
1112                          * expect to be able to send)
1113                          */
1114                         return LWS_HPI_RET_HANDLED;
1115         }
1116 #endif
1117
1118 #if !defined(LWS_WITHOUT_EXTENSIONS)
1119         /* 2: RX Extension needs to be drained
1120          */
1121
1122         if (wsi->ws->rx_draining_ext) {
1123
1124                 lwsl_debug("%s: RX EXT DRAINING: Service\n", __func__);
1125 #ifndef LWS_NO_CLIENT
1126                 if (lwsi_role_client(wsi)) {
1127                         n = lws_ws_client_rx_sm(wsi, 0);
1128                         if (n < 0)
1129                                 /* we closed wsi */
1130                                 return LWS_HPI_RET_PLEASE_CLOSE_ME;
1131                 } else
1132 #endif
1133                         n = lws_ws_rx_sm(wsi, ALREADY_PROCESSED_IGNORE_CHAR, 0);
1134
1135                 return LWS_HPI_RET_HANDLED;
1136         }
1137
1138         if (wsi->ws->rx_draining_ext)
1139                 /*
1140                  * We have RX EXT content to drain, but can't do it
1141                  * right now.  That means we cannot do anything lower
1142                  * priority either.
1143                  */
1144                 return LWS_HPI_RET_HANDLED;
1145 #endif
1146
1147         /* 3: buflist needs to be drained
1148          */
1149 read:
1150         //lws_buflist_describe(&wsi->buflist, wsi);
1151         ebuf.len = (int)lws_buflist_next_segment_len(&wsi->buflist,
1152                                                      &ebuf.token);
1153         if (ebuf.len) {
1154                 lwsl_info("draining buflist (len %d)\n", ebuf.len);
1155                 buffered = 1;
1156                 goto drain;
1157         }
1158
1159         if (!(pollfd->revents & pollfd->events & LWS_POLLIN) && !wsi->http.ah)
1160                 return LWS_HPI_RET_HANDLED;
1161
1162         if (lws_is_flowcontrolled(wsi)) {
1163                 lwsl_info("%s: %p should be rxflow (bm 0x%x)..\n",
1164                             __func__, wsi, wsi->rxflow_bitmap);
1165                 return LWS_HPI_RET_HANDLED;
1166         }
1167
1168         if (!(lwsi_role_client(wsi) &&
1169               (lwsi_state(wsi) != LRS_ESTABLISHED &&
1170                lwsi_state(wsi) != LRS_AWAITING_CLOSE_ACK &&
1171                lwsi_state(wsi) != LRS_H2_WAITING_TO_SEND_HEADERS))) {
1172                 /*
1173                  * In case we are going to react to this rx by scheduling
1174                  * writes, we need to restrict the amount of rx to the size
1175                  * the protocol reported for rx buffer.
1176                  *
1177                  * Otherwise we get a situation we have to absorb possibly a
1178                  * lot of reads before we get a chance to drain them by writing
1179                  * them, eg, with echo type tests in autobahn.
1180                  */
1181
1182                 buffered = 0;
1183                 ebuf.token = pt->serv_buf;
1184                 if (lwsi_role_ws(wsi))
1185                         ebuf.len = wsi->ws->rx_ubuf_alloc;
1186                 else
1187                         ebuf.len = wsi->context->pt_serv_buf_size;
1188
1189                 if ((unsigned int)ebuf.len > wsi->context->pt_serv_buf_size)
1190                         ebuf.len = wsi->context->pt_serv_buf_size;
1191
1192                 if ((int)pending > ebuf.len)
1193                         pending = ebuf.len;
1194
1195                 ebuf.len = lws_ssl_capable_read(wsi, ebuf.token,
1196                                                 pending ? (int)pending :
1197                                                 ebuf.len);
1198                 switch (ebuf.len) {
1199                 case 0:
1200                         lwsl_info("%s: zero length read\n",
1201                                   __func__);
1202                         return LWS_HPI_RET_PLEASE_CLOSE_ME;
1203                 case LWS_SSL_CAPABLE_MORE_SERVICE:
1204                         lwsl_info("SSL Capable more service\n");
1205                         return LWS_HPI_RET_HANDLED;
1206                 case LWS_SSL_CAPABLE_ERROR:
1207                         lwsl_info("%s: LWS_SSL_CAPABLE_ERROR\n",
1208                                         __func__);
1209                         return LWS_HPI_RET_PLEASE_CLOSE_ME;
1210                 }
1211
1212                 /*
1213                  * coverity thinks ssl_capable_read() may read over
1214                  * 2GB.  Dissuade it...
1215                  */
1216                 ebuf.len &= 0x7fffffff;
1217         }
1218
1219 drain:
1220
1221         /*
1222          * give any active extensions a chance to munge the buffer
1223          * before parse.  We pass in a pointer to an lws_tokens struct
1224          * prepared with the default buffer and content length that's in
1225          * there.  Rather than rewrite the default buffer, extensions
1226          * that expect to grow the buffer can adapt .token to
1227          * point to their own per-connection buffer in the extension
1228          * user allocation.  By default with no extensions or no
1229          * extension callback handling, just the normal input buffer is
1230          * used then so it is efficient.
1231          */
1232         m = 0;
1233         do {
1234
1235                 /* service incoming data */
1236                 //lws_buflist_describe(&wsi->buflist, wsi);
1237                 if (ebuf.len) {
1238 #if defined(LWS_ROLE_H2)
1239                         if (lwsi_role_h2(wsi) && lwsi_state(wsi) != LRS_BODY &&
1240                             lwsi_state(wsi) != LRS_DISCARD_BODY)
1241                                 n = lws_read_h2(wsi, ebuf.token,
1242                                              ebuf.len);
1243                         else
1244 #endif
1245                                 n = lws_read_h1(wsi, ebuf.token,
1246                                              ebuf.len);
1247
1248                         if (n < 0) {
1249                                 /* we closed wsi */
1250                                 n = 0;
1251                                 return LWS_HPI_RET_WSI_ALREADY_DIED;
1252                         }
1253                         //lws_buflist_describe(&wsi->buflist, wsi);
1254                         //lwsl_notice("%s: consuming %d / %d\n", __func__, n, ebuf.len);
1255                         if (lws_buflist_aware_consume(wsi, &ebuf, n, buffered))
1256                                 return LWS_HPI_RET_PLEASE_CLOSE_ME;
1257                 }
1258
1259                 ebuf.token = NULL;
1260                 ebuf.len = 0;
1261         } while (m);
1262
1263         if (wsi->http.ah
1264 #if !defined(LWS_NO_CLIENT)
1265                         && !wsi->client_h2_alpn
1266 #endif
1267                         ) {
1268                 lwsl_info("%s: %p: detaching ah\n", __func__, wsi);
1269                 lws_header_table_detach(wsi, 0);
1270         }
1271
1272         pending = lws_ssl_pending(wsi);
1273         if (pending) {
1274                 if (lws_is_ws_with_ext(wsi))
1275                         pending = pending > wsi->ws->rx_ubuf_alloc ?
1276                                 wsi->ws->rx_ubuf_alloc : pending;
1277                 else
1278                         pending = pending > wsi->context->pt_serv_buf_size ?
1279                                 wsi->context->pt_serv_buf_size : pending;
1280                 goto read;
1281         }
1282
1283         if (buffered && /* were draining, now nothing left */
1284             !lws_buflist_next_segment_len(&wsi->buflist, NULL)) {
1285                 lwsl_info("%s: %p flow buf: drained\n", __func__, wsi);
1286                 /* having drained the rxflow buffer, can rearm POLLIN */
1287 #ifdef LWS_NO_SERVER
1288                 n =
1289 #endif
1290                 __lws_rx_flow_control(wsi);
1291                 /* n ignored, needed for NO_SERVER case */
1292         }
1293
1294         /* n = 0 */
1295         return LWS_HPI_RET_HANDLED;
1296 }
1297
1298
1299 int rops_handle_POLLOUT_ws(struct lws *wsi)
1300 {
1301         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
1302         int write_type = LWS_WRITE_PONG;
1303 #if !defined(LWS_WITHOUT_EXTENSIONS)
1304         struct lws_ext_pm_deflate_rx_ebufs pmdrx;
1305         int ret, m;
1306 #endif
1307         int n;
1308
1309 #if !defined(LWS_WITHOUT_EXTENSIONS)
1310         lwsl_debug("%s: %s: wsi->ws->tx_draining_ext %d\n", __func__,
1311                         wsi->protocol->name, wsi->ws->tx_draining_ext);
1312 #endif
1313
1314         /* Priority 3: pending control packets (pong or close)
1315          *
1316          * 3a: close notification packet requested from close api
1317          */
1318
1319         if (lwsi_state(wsi) == LRS_WAITING_TO_SEND_CLOSE) {
1320                 lwsl_debug("sending close packet\n");
1321                 lwsl_hexdump_debug(&wsi->ws->ping_payload_buf[LWS_PRE],
1322                                    wsi->ws->close_in_ping_buffer_len);
1323                 wsi->waiting_to_send_close_frame = 0;
1324                 n = lws_write(wsi, &wsi->ws->ping_payload_buf[LWS_PRE],
1325                               wsi->ws->close_in_ping_buffer_len,
1326                               LWS_WRITE_CLOSE);
1327                 if (n >= 0) {
1328                         if (wsi->close_needs_ack) {
1329                                 lwsi_set_state(wsi, LRS_AWAITING_CLOSE_ACK);
1330                                 lws_set_timeout(wsi, PENDING_TIMEOUT_CLOSE_ACK,
1331                                                 5);
1332                                 lwsl_debug("sent close, await ack\n");
1333
1334                                 return LWS_HP_RET_BAIL_OK;
1335                         }
1336                         wsi->close_needs_ack = 0;
1337                         lwsi_set_state(wsi, LRS_RETURNED_CLOSE);
1338                 }
1339
1340                 return LWS_HP_RET_BAIL_DIE;
1341         }
1342
1343         /* else, the send failed and we should just hang up */
1344
1345         if ((lwsi_role_ws(wsi) && wsi->ws->ping_pending_flag) ||
1346             (lwsi_state(wsi) == LRS_RETURNED_CLOSE &&
1347              wsi->ws->payload_is_close)) {
1348
1349                 if (wsi->ws->payload_is_close)
1350                         write_type = LWS_WRITE_CLOSE;
1351                 else {
1352                         if (wsi->wsistate_pre_close) {
1353                                 /* we started close flow, forget pong */
1354                                 wsi->ws->ping_pending_flag = 0;
1355                                 return LWS_HP_RET_BAIL_OK;
1356                         }
1357                         lwsl_info("issuing pong %d on wsi %p\n",
1358                                   wsi->ws->ping_payload_len, wsi);
1359                 }
1360
1361                 n = lws_write(wsi, &wsi->ws->ping_payload_buf[LWS_PRE],
1362                               wsi->ws->ping_payload_len, write_type);
1363                 if (n < 0)
1364                         return LWS_HP_RET_BAIL_DIE;
1365
1366                 /* well he is sent, mark him done */
1367                 wsi->ws->ping_pending_flag = 0;
1368                 if (wsi->ws->payload_is_close) {
1369                         // assert(0);
1370                         /* oh... a close frame was it... then we are done */
1371                         return LWS_HP_RET_BAIL_DIE;
1372                 }
1373
1374                 /* otherwise for PING, leave POLLOUT active either way */
1375                 return LWS_HP_RET_BAIL_OK;
1376         }
1377
1378         if (!wsi->socket_is_permanently_unusable &&
1379             wsi->ws->send_check_ping && wsi->context->ws_ping_pong_interval) {
1380
1381                 lwsl_info("%s: issuing ping on wsi %p: %s %s h2: %d\n", __func__, wsi,
1382                                 wsi->role_ops->name, wsi->protocol->name,
1383                                 wsi->http2_substream);
1384                 wsi->ws->send_check_ping = 0;
1385                 wsi->ws->await_pong = 1;
1386                 n = lws_write(wsi, &wsi->ws->ping_payload_buf[LWS_PRE],
1387                               0, LWS_WRITE_PING);
1388                 if (n < 0)
1389                         return LWS_HP_RET_BAIL_DIE;
1390
1391                 /* give it a few seconds to respond with the PONG */
1392
1393                 __lws_sul_insert(&pt->pt_sul_owner, &wsi->sul_ping,
1394                                  (lws_usec_t)wsi->context->timeout_secs *
1395                                  LWS_USEC_PER_SEC);
1396
1397                 return LWS_HP_RET_BAIL_OK;
1398         }
1399
1400         /* Priority 4: if we are closing, not allowed to send more data frags
1401          *             which means user callback or tx ext flush banned now
1402          */
1403         if (lwsi_state(wsi) == LRS_RETURNED_CLOSE)
1404                 return LWS_HP_RET_USER_SERVICE;
1405
1406 #if !defined(LWS_WITHOUT_EXTENSIONS)
1407         /* Priority 5: Tx path extension with more to send
1408          *
1409          *             These are handled as new fragments each time around
1410          *             So while we must block new writeable callback to enforce
1411          *             payload ordering, but since they are always complete
1412          *             fragments control packets can interleave OK.
1413          */
1414         if (wsi->ws->tx_draining_ext) {
1415                 lwsl_ext("SERVICING TX EXT DRAINING\n");
1416                 if (lws_write(wsi, NULL, 0, LWS_WRITE_CONTINUATION) < 0)
1417                         return LWS_HP_RET_BAIL_DIE;
1418                 /* leave POLLOUT active */
1419                 return LWS_HP_RET_BAIL_OK;
1420         }
1421
1422         /* Priority 6: extensions
1423          */
1424         if (!wsi->ws->extension_data_pending && !wsi->ws->tx_draining_ext) {
1425                 lwsl_ext("%s: !wsi->ws->extension_data_pending\n", __func__);
1426                 return LWS_HP_RET_USER_SERVICE;
1427         }
1428
1429         /*
1430          * Check in on the active extensions, see if they had pending stuff to
1431          * spill... they need to get the first look-in otherwise sequence will
1432          * be disordered.
1433          *
1434          * coming here with a NULL, zero-length ebuf means just spill pending
1435          */
1436
1437         ret = 1;
1438         if (wsi->role_ops == &role_ops_raw_skt ||
1439             wsi->role_ops == &role_ops_raw_file)
1440                 ret = 0;
1441
1442         while (ret == 1) {
1443
1444                 /* default to nobody has more to spill */
1445
1446                 ret = 0;
1447                 pmdrx.eb_in.token = NULL;
1448                 pmdrx.eb_in.len = 0;
1449
1450                 /* give every extension a chance to spill */
1451
1452                 m = lws_ext_cb_active(wsi, LWS_EXT_CB_PACKET_TX_PRESEND,
1453                                       &pmdrx, 0);
1454                 if (m < 0) {
1455                         lwsl_err("ext reports fatal error\n");
1456                         return LWS_HP_RET_BAIL_DIE;
1457                 }
1458                 if (m)
1459                         /*
1460                          * at least one extension told us he has more
1461                          * to spill, so we will go around again after
1462                          */
1463                         ret = 1;
1464
1465                 /* assuming they gave us something to send, send it */
1466
1467                 if (pmdrx.eb_in.len) {
1468                         n = lws_issue_raw(wsi, (unsigned char *)pmdrx.eb_in.token,
1469                                         pmdrx.eb_in.len);
1470                         if (n < 0) {
1471                                 lwsl_info("closing from POLLOUT spill\n");
1472                                 return LWS_HP_RET_BAIL_DIE;
1473                         }
1474                         /*
1475                          * Keep amount spilled small to minimize chance of this
1476                          */
1477                         if (n != pmdrx.eb_in.len) {
1478                                 lwsl_err("Unable to spill ext %d vs %d\n",
1479                                                 pmdrx.eb_in.len, n);
1480                                 return LWS_HP_RET_BAIL_DIE;
1481                         }
1482                 } else
1483                         continue;
1484
1485                 /* no extension has more to spill */
1486
1487                 if (!ret)
1488                         continue;
1489
1490                 /*
1491                  * There's more to spill from an extension, but we just sent
1492                  * something... did that leave the pipe choked?
1493                  */
1494
1495                 if (!lws_send_pipe_choked(wsi))
1496                         /* no we could add more */
1497                         continue;
1498
1499                 lwsl_info("choked in POLLOUT service\n");
1500
1501                 /*
1502                  * Yes, he's choked.  Leave the POLLOUT masked on so we will
1503                  * come back here when he is unchoked.  Don't call the user
1504                  * callback to enforce ordering of spilling, he'll get called
1505                  * when we come back here and there's nothing more to spill.
1506                  */
1507
1508                 return LWS_HP_RET_BAIL_OK;
1509         }
1510
1511         wsi->ws->extension_data_pending = 0;
1512 #endif
1513
1514         return LWS_HP_RET_USER_SERVICE;
1515 }
1516
1517 static int
1518 rops_service_flag_pending_ws(struct lws_context *context, int tsi)
1519 {
1520 #if !defined(LWS_WITHOUT_EXTENSIONS)
1521         struct lws_context_per_thread *pt = &context->pt[tsi];
1522         struct lws *wsi;
1523         int forced = 0;
1524
1525         /* POLLIN faking (the pt lock is taken by the parent) */
1526
1527         /*
1528          * 1) For all guys with already-available ext data to drain, if they are
1529          * not flowcontrolled, fake their POLLIN status
1530          */
1531         wsi = pt->ws.rx_draining_ext_list;
1532         while (wsi && wsi->position_in_fds_table != LWS_NO_FDS_POS) {
1533                 pt->fds[wsi->position_in_fds_table].revents |=
1534                         pt->fds[wsi->position_in_fds_table].events & LWS_POLLIN;
1535                 if (pt->fds[wsi->position_in_fds_table].revents & LWS_POLLIN)
1536                         forced = 1;
1537
1538                 wsi = wsi->ws->rx_draining_ext_list;
1539         }
1540
1541         return forced;
1542 #else
1543         return 0;
1544 #endif
1545 }
1546
1547 static int
1548 rops_close_via_role_protocol_ws(struct lws *wsi, enum lws_close_status reason)
1549 {
1550         if (!wsi->ws)
1551                 return 0;
1552
1553         if (!wsi->ws->close_in_ping_buffer_len && /* already a reason */
1554              (reason == LWS_CLOSE_STATUS_NOSTATUS ||
1555               reason == LWS_CLOSE_STATUS_NOSTATUS_CONTEXT_DESTROY))
1556                 return 0;
1557
1558         lwsl_debug("%s: sending close indication...\n", __func__);
1559
1560         /* if no prepared close reason, use 1000 and no aux data */
1561
1562         if (!wsi->ws->close_in_ping_buffer_len) {
1563                 wsi->ws->close_in_ping_buffer_len = 2;
1564                 wsi->ws->ping_payload_buf[LWS_PRE] = (reason >> 8) & 0xff;
1565                 wsi->ws->ping_payload_buf[LWS_PRE + 1] = reason & 0xff;
1566         }
1567
1568         wsi->waiting_to_send_close_frame = 1;
1569         wsi->close_needs_ack = 1;
1570         lwsi_set_state(wsi, LRS_WAITING_TO_SEND_CLOSE);
1571         __lws_set_timeout(wsi, PENDING_TIMEOUT_CLOSE_SEND, 5);
1572
1573         lws_callback_on_writable(wsi);
1574
1575         return 1;
1576 }
1577
1578 static int
1579 rops_close_role_ws(struct lws_context_per_thread *pt, struct lws *wsi)
1580 {
1581         if (!wsi->ws)
1582                 return 0;
1583
1584 #if !defined(LWS_WITHOUT_EXTENSIONS)
1585
1586         if (wsi->ws->rx_draining_ext) {
1587                 struct lws **w = &pt->ws.rx_draining_ext_list;
1588
1589                 wsi->ws->rx_draining_ext = 0;
1590                 /* remove us from context draining ext list */
1591                 while (*w) {
1592                         if (*w == wsi) {
1593                                 *w = wsi->ws->rx_draining_ext_list;
1594                                 break;
1595                         }
1596                         w = &((*w)->ws->rx_draining_ext_list);
1597                 }
1598                 wsi->ws->rx_draining_ext_list = NULL;
1599         }
1600
1601         if (wsi->ws->tx_draining_ext) {
1602                 struct lws **w = &pt->ws.tx_draining_ext_list;
1603                 lwsl_ext("%s: CLEARING tx_draining_ext\n", __func__);
1604                 wsi->ws->tx_draining_ext = 0;
1605                 /* remove us from context draining ext list */
1606                 while (*w) {
1607                         if (*w == wsi) {
1608                                 *w = wsi->ws->tx_draining_ext_list;
1609                                 break;
1610                         }
1611                         w = &((*w)->ws->tx_draining_ext_list);
1612                 }
1613                 wsi->ws->tx_draining_ext_list = NULL;
1614         }
1615 #endif
1616         lws_free_set_NULL(wsi->ws->rx_ubuf);
1617
1618         wsi->ws->ping_payload_len = 0;
1619         wsi->ws->ping_pending_flag = 0;
1620
1621         /* deallocate any active extension contexts */
1622
1623         if (lws_ext_cb_active(wsi, LWS_EXT_CB_DESTROY, NULL, 0) < 0)
1624                 lwsl_warn("extension destruction failed\n");
1625
1626         return 0;
1627 }
1628
1629 static int
1630 rops_write_role_protocol_ws(struct lws *wsi, unsigned char *buf, size_t len,
1631                             enum lws_write_protocol *wp)
1632 {
1633         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
1634 #if !defined(LWS_WITHOUT_EXTENSIONS)
1635         enum lws_write_protocol wpt;
1636 #endif
1637         struct lws_ext_pm_deflate_rx_ebufs pmdrx;
1638         int masked7 = lwsi_role_client(wsi);
1639         unsigned char is_masked_bit = 0;
1640         unsigned char *dropmask = NULL;
1641         size_t orig_len = len;
1642         int pre = 0, n = 0;
1643
1644         // lwsl_err("%s: wp 0x%x len %d\n", __func__, *wp, (int)len);
1645 #if !defined(LWS_WITHOUT_EXTENSIONS)
1646         if (wsi->ws->tx_draining_ext) {
1647                 /* remove us from the list */
1648                 struct lws **w = &pt->ws.tx_draining_ext_list;
1649
1650                 lwsl_ext("%s: CLEARING tx_draining_ext\n", __func__);
1651                 wsi->ws->tx_draining_ext = 0;
1652                 /* remove us from context draining ext list */
1653                 while (*w) {
1654                         if (*w == wsi) {
1655                                 *w = wsi->ws->tx_draining_ext_list;
1656                                 break;
1657                         }
1658                         w = &((*w)->ws->tx_draining_ext_list);
1659                 }
1660                 wsi->ws->tx_draining_ext_list = NULL;
1661
1662                 wpt = *wp;
1663                 *wp = (wsi->ws->tx_draining_stashed_wp & 0xc0) |
1664                                 LWS_WRITE_CONTINUATION;
1665
1666                 /*
1667                  * When we are just flushing (len == 0), we can trust the
1668                  * stashed wp info completely.  Otherwise adjust it to the
1669                  * FIN status of the incoming packet.
1670                  */
1671
1672                 if (!(wpt & LWS_WRITE_NO_FIN) && len)
1673                         *wp &= ~LWS_WRITE_NO_FIN;
1674
1675                 lwsl_ext("FORCED draining wp to 0x%02X "
1676                          "(stashed 0x%02X, incoming 0x%02X)\n", *wp,
1677                          wsi->ws->tx_draining_stashed_wp, wpt);
1678                 // assert(0);
1679         }
1680 #endif
1681         /* reset the ping wait */
1682         if (wsi->context->ws_ping_pong_interval) {
1683                 wsi->sul_ping.cb = lws_sul_wsping_cb;
1684                 __lws_sul_insert(&pt->pt_sul_owner, &wsi->sul_ping,
1685                                 (lws_usec_t)wsi->context->ws_ping_pong_interval *
1686                                                                 LWS_USEC_PER_SEC);
1687         }
1688         if (((*wp) & 0x1f) == LWS_WRITE_HTTP ||
1689             ((*wp) & 0x1f) == LWS_WRITE_HTTP_FINAL ||
1690             ((*wp) & 0x1f) == LWS_WRITE_HTTP_HEADERS_CONTINUATION ||
1691             ((*wp) & 0x1f) == LWS_WRITE_HTTP_HEADERS)
1692                 goto send_raw;
1693
1694
1695
1696         /* if we are continuing a frame that already had its header done */
1697
1698         if (wsi->ws->inside_frame) {
1699                 lwsl_debug("INSIDE FRAME\n");
1700                 goto do_more_inside_frame;
1701         }
1702
1703         wsi->ws->clean_buffer = 1;
1704
1705         /*
1706          * give a chance to the extensions to modify payload
1707          * the extension may decide to produce unlimited payload erratically
1708          * (eg, compression extension), so we require only that if he produces
1709          * something, it will be a complete fragment of the length known at
1710          * the time (just the fragment length known), and if he has
1711          * more we will come back next time he is writeable and allow him to
1712          * produce more fragments until he's drained.
1713          *
1714          * This allows what is sent each time it is writeable to be limited to
1715          * a size that can be sent without partial sends or blocking, allows
1716          * interleaving of control frames and other connection service.
1717          */
1718
1719         pmdrx.eb_in.token = buf;
1720         pmdrx.eb_in.len = (int)len;
1721
1722         /* for the non-pm-deflate case */
1723
1724         pmdrx.eb_out = pmdrx.eb_in;
1725
1726         switch ((int)*wp) {
1727         case LWS_WRITE_PING:
1728         case LWS_WRITE_PONG:
1729         case LWS_WRITE_CLOSE:
1730                 break;
1731         default:
1732 #if !defined(LWS_WITHOUT_EXTENSIONS)
1733                 n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_TX, &pmdrx, *wp);
1734                 if (n < 0)
1735                         return -1;
1736                 lwsl_ext("%s: defl ext ret %d, ext in remaining %d, "
1737                             "out %d compressed (wp 0x%x)\n", __func__, n,
1738                             (int)pmdrx.eb_in.len, (int)pmdrx.eb_out.len, *wp);
1739
1740                 if (n == PMDR_HAS_PENDING) {
1741                         lwsl_ext("%s: HAS PENDING: write drain len %d "
1742                                     "(wp 0x%x) SETTING tx_draining_ext "
1743                                     "(remaining in %d)\n", __func__,
1744                                     (int)pmdrx.eb_out.len, *wp,
1745                                     (int)pmdrx.eb_in.len);
1746                         /* extension requires further draining */
1747                         wsi->ws->tx_draining_ext = 1;
1748                         wsi->ws->tx_draining_ext_list =
1749                                         pt->ws.tx_draining_ext_list;
1750                         pt->ws.tx_draining_ext_list = wsi;
1751                         /* we must come back to do more */
1752                         lws_callback_on_writable(wsi);
1753                         /*
1754                          * keep a copy of the write type for the overall
1755                          * action that has provoked generation of these
1756                          * fragments, so the last guy can use its FIN state.
1757                          */
1758                         wsi->ws->tx_draining_stashed_wp = *wp;
1759                         /*
1760                          * Despite what we may have thought, this is definitely
1761                          * NOT the last fragment, because the extension asserted
1762                          * he has more coming.  For example, the extension may
1763                          * be compressing, and has saved up everything until the
1764                          * end, where the output is larger than one chunk.
1765                          *
1766                          * Make sure this intermediate one doesn't actually
1767                          * go out with a FIN.
1768                          */
1769                         *wp |= LWS_WRITE_NO_FIN;
1770                 }
1771 #endif
1772                 if (pmdrx.eb_out.len && wsi->ws->stashed_write_pending) {
1773                         wsi->ws->stashed_write_pending = 0;
1774                         *wp = ((*wp) & 0xc0) | (int)wsi->ws->stashed_write_type;
1775                 }
1776         }
1777
1778         /*
1779          * an extension did something we need to keep... for example, if
1780          * compression extension, it has already updated its state according
1781          * to this being issued
1782          */
1783         if (buf != pmdrx.eb_out.token) {
1784                 /*
1785                  * ext might eat it, but not have anything to issue yet.
1786                  * In that case we have to follow his lead, but stash and
1787                  * replace the write type that was lost here the first time.
1788                  */
1789                 if (len && !pmdrx.eb_out.len) {
1790                         if (!wsi->ws->stashed_write_pending)
1791                                 wsi->ws->stashed_write_type =
1792                                                 (char)(*wp) & 0x3f;
1793                         wsi->ws->stashed_write_pending = 1;
1794                         return (int)len;
1795                 }
1796                 /*
1797                  * extension recreated it:
1798                  * need to buffer this if not all sent
1799                  */
1800                 wsi->ws->clean_buffer = 0;
1801         }
1802
1803         buf = pmdrx.eb_out.token;
1804         len = pmdrx.eb_out.len;
1805
1806         if (!buf) {
1807                 lwsl_err("null buf (%d)\n", (int)len);
1808                 return -1;
1809         }
1810
1811         switch (wsi->ws->ietf_spec_revision) {
1812         case 13:
1813                 if (masked7) {
1814                         pre += 4;
1815                         dropmask = &buf[0 - pre];
1816                         is_masked_bit = 0x80;
1817                 }
1818
1819                 switch ((*wp) & 0xf) {
1820                 case LWS_WRITE_TEXT:
1821                         n = LWSWSOPC_TEXT_FRAME;
1822                         break;
1823                 case LWS_WRITE_BINARY:
1824                         n = LWSWSOPC_BINARY_FRAME;
1825                         break;
1826                 case LWS_WRITE_CONTINUATION:
1827                         n = LWSWSOPC_CONTINUATION;
1828                         break;
1829
1830                 case LWS_WRITE_CLOSE:
1831                         n = LWSWSOPC_CLOSE;
1832                         break;
1833                 case LWS_WRITE_PING:
1834                         n = LWSWSOPC_PING;
1835                         break;
1836                 case LWS_WRITE_PONG:
1837                         n = LWSWSOPC_PONG;
1838                         break;
1839                 default:
1840                         lwsl_warn("lws_write: unknown write opc / wp\n");
1841                         return -1;
1842                 }
1843
1844                 if (!((*wp) & LWS_WRITE_NO_FIN))
1845                         n |= 1 << 7;
1846
1847                 if (len < 126) {
1848                         pre += 2;
1849                         buf[-pre] = n;
1850                         buf[-pre + 1] = (unsigned char)(len | is_masked_bit);
1851                 } else {
1852                         if (len < 65536) {
1853                                 pre += 4;
1854                                 buf[-pre] = n;
1855                                 buf[-pre + 1] = 126 | is_masked_bit;
1856                                 buf[-pre + 2] = (unsigned char)(len >> 8);
1857                                 buf[-pre + 3] = (unsigned char)len;
1858                         } else {
1859                                 pre += 10;
1860                                 buf[-pre] = n;
1861                                 buf[-pre + 1] = 127 | is_masked_bit;
1862 #if defined __LP64__
1863                                         buf[-pre + 2] = (len >> 56) & 0x7f;
1864                                         buf[-pre + 3] = len >> 48;
1865                                         buf[-pre + 4] = len >> 40;
1866                                         buf[-pre + 5] = len >> 32;
1867 #else
1868                                         buf[-pre + 2] = 0;
1869                                         buf[-pre + 3] = 0;
1870                                         buf[-pre + 4] = 0;
1871                                         buf[-pre + 5] = 0;
1872 #endif
1873                                 buf[-pre + 6] = (unsigned char)(len >> 24);
1874                                 buf[-pre + 7] = (unsigned char)(len >> 16);
1875                                 buf[-pre + 8] = (unsigned char)(len >> 8);
1876                                 buf[-pre + 9] = (unsigned char)len;
1877                         }
1878                 }
1879                 break;
1880         }
1881
1882 do_more_inside_frame:
1883
1884         /*
1885          * Deal with masking if we are in client -> server direction and
1886          * the wp demands it
1887          */
1888
1889         if (masked7) {
1890                 if (!wsi->ws->inside_frame)
1891                         if (lws_0405_frame_mask_generate(wsi)) {
1892                                 lwsl_err("frame mask generation failed\n");
1893                                 return -1;
1894                         }
1895
1896                 /*
1897                  * in v7, just mask the payload
1898                  */
1899                 if (dropmask) { /* never set if already inside frame */
1900                         for (n = 4; n < (int)len + 4; n++)
1901                                 dropmask[n] = dropmask[n] ^ wsi->ws->mask[
1902                                         (wsi->ws->mask_idx++) & 3];
1903
1904                         /* copy the frame nonce into place */
1905                         memcpy(dropmask, wsi->ws->mask, 4);
1906                 }
1907         }
1908
1909         if (lwsi_role_h2_ENCAPSULATION(wsi)) {
1910                 struct lws *encap = lws_get_network_wsi(wsi);
1911
1912                 assert(encap != wsi);
1913                 return encap->role_ops->write_role_protocol(wsi, buf - pre,
1914                                                             len + pre, wp);
1915         }
1916
1917         switch ((*wp) & 0x1f) {
1918         case LWS_WRITE_TEXT:
1919         case LWS_WRITE_BINARY:
1920         case LWS_WRITE_CONTINUATION:
1921                 if (!wsi->h2_stream_carries_ws) {
1922
1923                         /*
1924                          * give any active extensions a chance to munge the
1925                          * buffer before send.  We pass in a pointer to an
1926                          * lws_tokens struct prepared with the default buffer
1927                          * and content length that's in there.  Rather than
1928                          * rewrite the default buffer, extensions that expect
1929                          * to grow the buffer can adapt .token to point to their
1930                          * own per-connection buffer in the extension user
1931                          * allocation.  By default with no extensions or no
1932                          * extension callback handling, just the normal input
1933                          * buffer is used then so it is efficient.
1934                          *
1935                          * callback returns 1 in case it wants to spill more
1936                          * buffers
1937                          *
1938                          * This takes care of holding the buffer if send is
1939                          * incomplete, ie, if wsi->ws->clean_buffer is 0
1940                          * (meaning an extension meddled with the buffer).  If
1941                          * wsi->ws->clean_buffer is 1, it will instead return
1942                          * to the user code how much OF THE USER BUFFER was
1943                          * consumed.
1944                          */
1945
1946                         n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre);
1947                         wsi->ws->inside_frame = 1;
1948                         if (n <= 0)
1949                                 return n;
1950
1951                         if (n == (int)len + pre) {
1952                                 /* everything in the buffer was handled
1953                                  * (or rebuffered...) */
1954                                 wsi->ws->inside_frame = 0;
1955                                 return (int)orig_len;
1956                         }
1957
1958                         /*
1959                          * it is how many bytes of user buffer got sent... may
1960                          * be < orig_len in which case callback when writable
1961                          * has already been arranged and user code can call
1962                          * lws_write() again with the rest later.
1963                          */
1964
1965                         return n - pre;
1966                 }
1967                 break;
1968         default:
1969                 break;
1970         }
1971
1972 send_raw:
1973         return lws_issue_raw(wsi, (unsigned char *)buf - pre, len + pre);
1974 }
1975
1976 static int
1977 rops_close_kill_connection_ws(struct lws *wsi, enum lws_close_status reason)
1978 {
1979         lws_dll2_remove(&wsi->sul_ping.list);
1980         /* deal with ws encapsulation in h2 */
1981 #if defined(LWS_WITH_HTTP2)
1982         if (wsi->http2_substream && wsi->h2_stream_carries_ws)
1983                 return role_ops_h2.close_kill_connection(wsi, reason);
1984
1985         return 0;
1986 #else
1987         return 0;
1988 #endif
1989 }
1990
1991 static int
1992 rops_callback_on_writable_ws(struct lws *wsi)
1993 {
1994 #if defined(LWS_WITH_HTTP2)
1995         if (lwsi_role_h2_ENCAPSULATION(wsi)) {
1996                 /* we know then that it has an h2 parent */
1997                 struct lws *enc = role_ops_h2.encapsulation_parent(wsi);
1998
1999                 assert(enc);
2000                 if (enc->role_ops->callback_on_writable(wsi))
2001                         return 1;
2002         }
2003 #endif
2004         return 0;
2005 }
2006
2007 static int
2008 rops_init_vhost_ws(struct lws_vhost *vh,
2009                    const struct lws_context_creation_info *info)
2010 {
2011 #if !defined(LWS_WITHOUT_EXTENSIONS)
2012 #ifdef LWS_WITH_PLUGINS
2013         struct lws_plugin *plugin = vh->context->plugin_list;
2014         int m;
2015
2016         if (vh->context->plugin_extension_count) {
2017
2018                 m = 0;
2019                 while (info->extensions && info->extensions[m].callback)
2020                         m++;
2021
2022                 /*
2023                  * give the vhost a unified list of extensions including the
2024                  * ones that came from plugins
2025                  */
2026                 vh->ws.extensions = lws_zalloc(sizeof(struct lws_extension) *
2027                                      (m + vh->context->plugin_extension_count + 1),
2028                                      "extensions");
2029                 if (!vh->ws.extensions)
2030                         return 1;
2031
2032                 memcpy((struct lws_extension *)vh->ws.extensions, info->extensions,
2033                        sizeof(struct lws_extension) * m);
2034                 plugin = vh->context->plugin_list;
2035                 while (plugin) {
2036                         memcpy((struct lws_extension *)&vh->ws.extensions[m],
2037                                 plugin->caps.extensions,
2038                                sizeof(struct lws_extension) *
2039                                plugin->caps.count_extensions);
2040                         m += plugin->caps.count_extensions;
2041                         plugin = plugin->list;
2042                 }
2043         } else
2044 #endif
2045                 vh->ws.extensions = info->extensions;
2046 #endif
2047
2048         return 0;
2049 }
2050
2051 static int
2052 rops_destroy_vhost_ws(struct lws_vhost *vh)
2053 {
2054 #ifdef LWS_WITH_PLUGINS
2055 #if !defined(LWS_WITHOUT_EXTENSIONS)
2056         if (vh->context->plugin_extension_count)
2057                 lws_free((void *)vh->ws.extensions);
2058 #endif
2059 #endif
2060
2061         return 0;
2062 }
2063
2064 #if defined(LWS_WITH_HTTP_PROXY)
2065 static int
2066 ws_destroy_proxy_buf(struct lws_dll2 *d, void *user)
2067 {
2068         lws_free(d);
2069
2070         return 0;
2071 }
2072 #endif
2073
2074 static int
2075 rops_destroy_role_ws(struct lws *wsi)
2076 {
2077 #if defined(LWS_WITH_HTTP_PROXY)
2078         lws_dll2_foreach_safe(&wsi->ws->proxy_owner, NULL, ws_destroy_proxy_buf);
2079 #endif
2080
2081         lws_free_set_NULL(wsi->ws);
2082
2083         return 0;
2084 }
2085
2086 struct lws_role_ops role_ops_ws = {
2087         /* role name */                 "ws",
2088         /* alpn id */                   NULL,
2089         /* check_upgrades */            NULL,
2090         /* init_context */              NULL,
2091         /* init_vhost */                rops_init_vhost_ws,
2092         /* destroy_vhost */             rops_destroy_vhost_ws,
2093         /* periodic_checks */           NULL,
2094         /* service_flag_pending */      rops_service_flag_pending_ws,
2095         /* handle_POLLIN */             rops_handle_POLLIN_ws,
2096         /* handle_POLLOUT */            rops_handle_POLLOUT_ws,
2097         /* perform_user_POLLOUT */      NULL,
2098         /* callback_on_writable */      rops_callback_on_writable_ws,
2099         /* tx_credit */                 NULL,
2100         /* write_role_protocol */       rops_write_role_protocol_ws,
2101         /* encapsulation_parent */      NULL,
2102         /* alpn_negotiated */           NULL,
2103         /* close_via_role_protocol */   rops_close_via_role_protocol_ws,
2104         /* close_role */                rops_close_role_ws,
2105         /* close_kill_connection */     rops_close_kill_connection_ws,
2106         /* destroy_role */              rops_destroy_role_ws,
2107         /* adoption_bind */             NULL,
2108         /* client_bind */               NULL,
2109         /* adoption_cb clnt, srv */     { LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED,
2110                                           LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED },
2111         /* rx_cb clnt, srv */           { LWS_CALLBACK_CLIENT_RECEIVE,
2112                                           LWS_CALLBACK_RECEIVE },
2113         /* writeable cb clnt, srv */    { LWS_CALLBACK_CLIENT_WRITEABLE,
2114                                           LWS_CALLBACK_SERVER_WRITEABLE },
2115         /* close cb clnt, srv */        { LWS_CALLBACK_CLIENT_CLOSED,
2116                                           LWS_CALLBACK_CLOSED },
2117         /* protocol_bind cb c, srv */   { LWS_CALLBACK_WS_CLIENT_BIND_PROTOCOL,
2118                                           LWS_CALLBACK_WS_SERVER_BIND_PROTOCOL },
2119         /* protocol_unbind cb c, srv */ { LWS_CALLBACK_WS_CLIENT_DROP_PROTOCOL,
2120                                           LWS_CALLBACK_WS_SERVER_DROP_PROTOCOL },
2121         /* file handles */              0
2122 };