client: protect against possible NULL deref path
[platform/upstream/libwebsockets.git] / lib / output.c
index 183b7ae..0d850eb 100644 (file)
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2010-2014 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2010-2015 Andy Green <andy@warmcat.com>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
 static int
 lws_0405_frame_mask_generate(struct lws *wsi)
 {
+#if 0
+       wsi->u.ws.mask[0] = 0;
+       wsi->u.ws.mask[1] = 0;
+       wsi->u.ws.mask[2] = 0;
+       wsi->u.ws.mask[3] = 0;
+#else
        int n;
-
        /* fetch the per-frame nonce */
 
-       n = lws_get_random(lws_get_ctx(wsi),
-                                          wsi->u.ws.frame_masking_nonce_04, 4);
+       n = lws_get_random(lws_get_context(wsi), wsi->u.ws.mask, 4);
        if (n != 4) {
                lwsl_parser("Unable to read from random device %s %d\n",
-                                                    SYSTEM_RANDOM_FILEPATH, n);
+                           SYSTEM_RANDOM_FILEPATH, n);
                return 1;
        }
-
+#endif
        /* start masking from first byte of masking key buffer */
-       wsi->u.ws.frame_mask_index = 0;
+       wsi->u.ws.mask_idx = 0;
 
        return 0;
 }
@@ -90,26 +94,25 @@ LWS_VISIBLE void lwsl_hexdump(void *vbuf, size_t len)
 
 int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 {
-       struct lws_context *context = lws_get_ctx(wsi);
+       struct lws_context *context = lws_get_context(wsi);
        size_t real_len = len;
        int n, m;
 
        if (!len)
                return 0;
        /* just ignore sends after we cleared the truncation buffer */
-       if (wsi->state == WSI_STATE_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
-           !wsi->truncated_send_len)
+       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
+           !wsi->trunc_len)
                return len;
 
-       if (wsi->truncated_send_len && (buf < wsi->truncated_send_malloc ||
-           buf > (wsi->truncated_send_malloc + wsi->truncated_send_len +
-                  wsi->truncated_send_offset))) {
+       if (wsi->trunc_len && (buf < wsi->trunc_alloc ||
+           buf > (wsi->trunc_alloc + wsi->trunc_len +
+                  wsi->trunc_offset))) {
                lwsl_err("****** %x Sending new, pending truncated ...\n", wsi);
                assert(0);
        }
 
-       m = lws_ext_callback_for_each_active(wsi,
-                       LWS_EXT_CALLBACK_PACKET_TX_DO_SEND, &buf, len);
+       m = lws_ext_cb_active(wsi, LWS_EXT_CB_PACKET_TX_DO_SEND, &buf, len);
        if (m < 0)
                return -1;
        if (m) /* handled */ {
@@ -123,11 +126,11 @@ int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
        /* nope, send it on the socket directly */
        lws_latency_pre(context, wsi);
        n = lws_ssl_capable_write(wsi, buf, len);
-       lws_latency(context, wsi, "send lws_issue_raw", n, (unsigned int)n == len);
+       lws_latency(context, wsi, "send lws_issue_raw", n,
+                   (unsigned int)n == len);
 
        switch (n) {
        case LWS_SSL_CAPABLE_ERROR:
-               lwsl_err("%s: wsi %p: LWS_SSL_CAPABLE_ERROR\n", __func__, (void *)wsi);
                /* we're going to close, let close know sends aren't possible */
                wsi->socket_is_permanently_unusable = 1;
                return -1;
@@ -141,17 +144,16 @@ handle_truncated_send:
        /*
         * we were already handling a truncated send?
         */
-       if (wsi->truncated_send_len) {
-               lwsl_info("***** %x partial send moved on by %d (vs %d)\n",
-                                                            wsi, n, real_len);
-               wsi->truncated_send_offset += n;
-               wsi->truncated_send_len -= n;
+       if (wsi->trunc_len) {
+               lwsl_info("%p partial adv %d (vs %d)\n", wsi, n, real_len);
+               wsi->trunc_offset += n;
+               wsi->trunc_len -= n;
 
-               if (!wsi->truncated_send_len) {
+               if (!wsi->trunc_len) {
                        lwsl_info("***** %x partial send completed\n", wsi);
                        /* done with it, but don't free it */
                        n = real_len;
-                       if (wsi->state == WSI_STATE_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
+                       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
                                lwsl_info("***** %x signalling to close now\n", wsi);
                                return -1; /* retry closing now */
                        }
@@ -166,43 +168,31 @@ handle_truncated_send:
                /* what we just sent went out cleanly */
                return n;
 
-       if (n && wsi->u.ws.clean_buffer)
-               /*
-                * This buffer unaffected by extension rewriting.
-                * It means the user code is expected to deal with
-                * partial sends.  (lws knows the header was already
-                * sent, so on next send will just resume sending
-                * payload)
-                */
-                return n;
-
        /*
         * Newly truncated send.  Buffer the remainder (it will get
         * first priority next time the socket is writable)
         */
-       lwsl_info("***** %x new partial sent %d from %d total\n",
-                 wsi, n, real_len);
+       lwsl_info("%p new partial sent %d from %d total\n", wsi, n, real_len);
 
        /*
         *  - if we still have a suitable malloc lying around, use it
         *  - or, if too small, reallocate it
         *  - or, if no buffer, create it
         */
-       if (!wsi->truncated_send_malloc ||
-           real_len - n > wsi->truncated_send_allocation) {
-               lws_free(wsi->truncated_send_malloc);
+       if (!wsi->trunc_alloc || real_len - n > wsi->trunc_alloc_len) {
+               lws_free(wsi->trunc_alloc);
 
-               wsi->truncated_send_allocation = real_len - n;
-               wsi->truncated_send_malloc = lws_malloc(real_len - n);
-               if (!wsi->truncated_send_malloc) {
+               wsi->trunc_alloc_len = real_len - n;
+               wsi->trunc_alloc = lws_malloc(real_len - n);
+               if (!wsi->trunc_alloc) {
                        lwsl_err("truncated send: unable to malloc %d\n",
                                 real_len - n);
                        return -1;
                }
        }
-       wsi->truncated_send_offset = 0;
-       wsi->truncated_send_len = real_len - n;
-       memcpy(wsi->truncated_send_malloc, buf + n, real_len - n);
+       wsi->trunc_offset = 0;
+       wsi->trunc_len = real_len - n;
+       memcpy(wsi->trunc_alloc, buf + n, real_len - n);
 
        /* since something buffered, force it to get another chance to send */
        lws_callback_on_writable(wsi);
@@ -215,10 +205,8 @@ handle_truncated_send:
  * @wsi:       Websocket instance (available from user callback)
  * @buf:       The data to send.  For data being sent on a websocket
  *             connection (ie, not default http), this buffer MUST have
- *             LWS_SEND_BUFFER_PRE_PADDING bytes valid BEFORE the pointer
- *             and an additional LWS_SEND_BUFFER_POST_PADDING bytes valid
- *             in the buffer after (buf + len).  This is so the protocol
- *             header and trailer data can be added in-situ.
+ *             LWS_PRE bytes valid BEFORE the pointer.
+ *             This is so the protocol header data can be added in-situ.
  * @len:       Count of the data bytes in the payload starting from buf
  * @protocol:  Use LWS_WRITE_HTTP to reply to an http connection, and one
  *             of LWS_WRITE_BINARY or LWS_WRITE_TEXT to send appropriate
@@ -240,57 +228,110 @@ handle_truncated_send:
  *     pressure at any given time.
  */
 
-LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
-                         size_t len, enum lws_write_protocol protocol)
+LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf, size_t len,
+                         enum lws_write_protocol wp)
 {
-       int masked7 = wsi->mode == LWS_CONNMODE_WS_CLIENT;
+       struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+       int masked7 = (wsi->mode == LWSCM_WS_CLIENT);
        unsigned char is_masked_bit = 0;
        unsigned char *dropmask = NULL;
        struct lws_tokens eff_buf;
-       int post = 0, pre = 0, n;
+       int pre = 0, n;
        size_t orig_len = len;
 
-       if (len == 0 && protocol != LWS_WRITE_CLOSE &&
-           protocol != LWS_WRITE_PING && protocol != LWS_WRITE_PONG) {
-               lwsl_warn("zero length lws_write attempt\n");
-               return 0;
+       if (wsi->state == LWSS_ESTABLISHED && wsi->u.ws.tx_draining_ext) {
+               /* remove us from the list */
+               struct lws **w = &pt->tx_draining_ext_list;
+               lwsl_debug("%s: TX EXT DRAINING: Remove from list\n", __func__);
+               wsi->u.ws.tx_draining_ext = 0;
+               /* remove us from context draining ext list */
+               while (*w) {
+                       if (*w == wsi) {
+                               *w = wsi->u.ws.tx_draining_ext_list;
+                               break;
+                       }
+                       w = &((*w)->u.ws.tx_draining_ext_list);
+               }
+               wsi->u.ws.tx_draining_ext_list = NULL;
+               wp = (wsi->u.ws.tx_draining_stashed_wp & 0xc0) |
+                               LWS_WRITE_CONTINUATION;
+
+               lwsl_ext("FORCED draining wp to 0x%02X\n", wp);
        }
 
-       if (protocol == LWS_WRITE_HTTP ||
-           protocol == LWS_WRITE_HTTP_FINAL ||
-           protocol == LWS_WRITE_HTTP_HEADERS)
+       if (wp == LWS_WRITE_HTTP ||
+           wp == LWS_WRITE_HTTP_FINAL ||
+           wp == LWS_WRITE_HTTP_HEADERS)
                goto send_raw;
 
-       /* websocket protocol, either binary or text */
+       /* if not in a state to send stuff, then just send nothing */
 
-       if (wsi->state != WSI_STATE_ESTABLISHED &&
-           !(wsi->state == WSI_STATE_RETURNED_CLOSE_ALREADY &&
-             protocol == LWS_WRITE_CLOSE))
-               return -1;
+       if (wsi->state != LWSS_ESTABLISHED &&
+           ((wsi->state != LWSS_RETURNED_CLOSE_ALREADY &&
+             wsi->state != LWSS_AWAITING_CLOSE_ACK) ||
+                           wp != LWS_WRITE_CLOSE))
+               return 0;
 
        /* if we are continuing a frame that already had its header done */
 
-       if (wsi->u.ws.inside_frame)
+       if (wsi->u.ws.inside_frame) {
+               lwsl_debug("INSIDE FRAME\n");
                goto do_more_inside_frame;
+       }
 
        wsi->u.ws.clean_buffer = 1;
 
        /*
         * give a chance to the extensions to modify payload
-        * pre-TX mangling is not allowed to truncate
+        * the extension may decide to produce unlimited payload erratically
+        * (eg, compression extension), so we require only that if he produces
+        * something, it will be a complete fragment of the length known at
+        * the time (just the fragment length known), and if he has
+        * more we will come back next time he is writeable and allow him to
+        * produce more fragments until he's drained.
+        *
+        * This allows what is sent each time it is writeable to be limited to
+        * a size that can be sent without partial sends or blocking, allows
+        * interleaving of control frames and other connection service.
         */
        eff_buf.token = (char *)buf;
        eff_buf.token_len = len;
 
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_PING:
        case LWS_WRITE_PONG:
        case LWS_WRITE_CLOSE:
                break;
        default:
-               if (lws_ext_callback_for_each_active(wsi,
-                              LWS_EXT_CALLBACK_PAYLOAD_TX, &eff_buf, 0) < 0)
+               n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_TX, &eff_buf, wp);
+               if (n < 0)
                        return -1;
+
+               if (n && eff_buf.token_len) {
+                       /* extension requires further draining */
+                       wsi->u.ws.tx_draining_ext = 1;
+                       wsi->u.ws.tx_draining_ext_list = pt->tx_draining_ext_list;
+                       pt->tx_draining_ext_list = wsi;
+                       /* we must come back to do more */
+                       lws_callback_on_writable(wsi);
+                       /*
+                        * keep a copy of the write type for the overall
+                        * action that has provoked generation of these
+                        * fragments, so the last guy can use its FIN state.
+                        */
+                       wsi->u.ws.tx_draining_stashed_wp = wp;
+                       /* this is definitely not actually the last fragment
+                        * because the extension asserted he has more coming
+                        * So make sure this intermediate one doesn't go out
+                        * with a FIN.
+                        */
+                       wp |= LWS_WRITE_NO_FIN;
+               }
+
+               if (eff_buf.token_len && wsi->u.ws.stashed_write_pending) {
+                       wsi->u.ws.stashed_write_pending = 0;
+                       wp = (wp &0xc0) | (int)wsi->u.ws.stashed_write_type;
+               }
        }
 
        /*
@@ -298,12 +339,24 @@ LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
         * compression extension, it has already updated its state according
         * to this being issued
         */
-       if ((char *)buf != eff_buf.token)
+       if ((char *)buf != eff_buf.token) {
+               /*
+                * ext might eat it, but no have anything to issue yet
+                * in that case we have to follow his lead, but stash and
+                * replace the write type that was lost here the first time.
+                */
+               if (len && !eff_buf.token_len) {
+                       if (!wsi->u.ws.stashed_write_pending)
+                               wsi->u.ws.stashed_write_type = (char)wp & 0x3f;
+                       wsi->u.ws.stashed_write_pending = 1;
+                       return len;
+               }
                /*
                 * extension recreated it:
                 * need to buffer this if not all sent
                 */
                wsi->u.ws.clean_buffer = 0;
+       }
 
        buf = (unsigned char *)eff_buf.token;
        len = eff_buf.token_len;
@@ -316,44 +369,32 @@ LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf,
                        is_masked_bit = 0x80;
                }
 
-               switch (protocol & 0xf) {
+               switch (wp & 0xf) {
                case LWS_WRITE_TEXT:
-                       n = LWS_WS_OPCODE_07__TEXT_FRAME;
+                       n = LWSWSOPC_TEXT_FRAME;
                        break;
                case LWS_WRITE_BINARY:
-                       n = LWS_WS_OPCODE_07__BINARY_FRAME;
+                       n = LWSWSOPC_BINARY_FRAME;
                        break;
                case LWS_WRITE_CONTINUATION:
-                       n = LWS_WS_OPCODE_07__CONTINUATION;
+                       n = LWSWSOPC_CONTINUATION;
                        break;
 
                case LWS_WRITE_CLOSE:
-                       n = LWS_WS_OPCODE_07__CLOSE;
-
-                       /*
-                        * 06+ has a 2-byte status code in network order
-                        * we can do this because we demand post-buf
-                        */
-
-                       if (wsi->u.ws.close_reason) {
-                               /* reason codes count as data bytes */
-                               buf[0] = (unsigned char)(wsi->u.ws.close_reason >> 8);
-                               buf[1] = (unsigned char)wsi->u.ws.close_reason;
-                               len += 2;
-                       }
+                       n = LWSWSOPC_CLOSE;
                        break;
                case LWS_WRITE_PING:
-                       n = LWS_WS_OPCODE_07__PING;
+                       n = LWSWSOPC_PING;
                        break;
                case LWS_WRITE_PONG:
-                       n = LWS_WS_OPCODE_07__PONG;
+                       n = LWSWSOPC_PONG;
                        break;
                default:
-                       lwsl_warn("lws_write: unknown write opc / protocol\n");
+                       lwsl_warn("lws_write: unknown write opc / wp\n");
                        return -1;
                }
 
-               if (!(protocol & LWS_WRITE_NO_FIN))
+               if (!(wp & LWS_WRITE_NO_FIN))
                        n |= 1 << 7;
 
                if (len < 126) {
@@ -395,11 +436,10 @@ do_more_inside_frame:
 
        /*
         * Deal with masking if we are in client -> server direction and
-        * the protocol demands it
+        * the wp demands it
         */
 
-       if (wsi->mode == LWS_CONNMODE_WS_CLIENT) {
-
+       if (masked7) {
                if (!wsi->u.ws.inside_frame)
                        if (lws_0405_frame_mask_generate(wsi)) {
                                lwsl_err("frame mask generation failed\n");
@@ -411,61 +451,61 @@ do_more_inside_frame:
                 */
                if (dropmask) { /* never set if already inside frame */
                        for (n = 4; n < (int)len + 4; n++)
-                               dropmask[n] = dropmask[n] ^
-                               wsi->u.ws.frame_masking_nonce_04[
-                                       (wsi->u.ws.frame_mask_index++) & 3];
+                               dropmask[n] = dropmask[n] ^ wsi->u.ws.mask[
+                                       (wsi->u.ws.mask_idx++) & 3];
 
                        /* copy the frame nonce into place */
-                       memcpy(dropmask, wsi->u.ws.frame_masking_nonce_04, 4);
+                       memcpy(dropmask, wsi->u.ws.mask, 4);
                }
        }
 
 send_raw:
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_CLOSE:
-/*             lwsl_hexdump(&buf[-pre], len + post); */
+/*             lwsl_hexdump(&buf[-pre], len); */
        case LWS_WRITE_HTTP:
        case LWS_WRITE_HTTP_FINAL:
        case LWS_WRITE_HTTP_HEADERS:
        case LWS_WRITE_PONG:
        case LWS_WRITE_PING:
 #ifdef LWS_USE_HTTP2
-               if (wsi->mode == LWS_CONNMODE_HTTP2_SERVING) {
+               if (wsi->mode == LWSCM_HTTP2_SERVING) {
                        unsigned char flags = 0;
 
                        n = LWS_HTTP2_FRAME_TYPE_DATA;
-                       if (protocol == LWS_WRITE_HTTP_HEADERS) {
+                       if (wp == LWS_WRITE_HTTP_HEADERS) {
                                n = LWS_HTTP2_FRAME_TYPE_HEADERS;
                                flags = LWS_HTTP2_FLAG_END_HEADERS;
                                if (wsi->u.http2.send_END_STREAM)
                                        flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
 
-                       if ((protocol == LWS_WRITE_HTTP || protocol == LWS_WRITE_HTTP_FINAL) && wsi->u.http.content_length) {
+                       if ((wp == LWS_WRITE_HTTP ||
+                            wp == LWS_WRITE_HTTP_FINAL) &&
+                           wsi->u.http.content_length) {
                                wsi->u.http.content_remain -= len;
-                               lwsl_info("%s: content_remain = %lu\n", __func__, wsi->u.http.content_remain);
+                               lwsl_info("%s: content_remain = %lu\n", __func__,
+                                         wsi->u.http.content_remain);
                                if (!wsi->u.http.content_remain) {
                                        lwsl_info("%s: selecting final write mode\n", __func__);
-                                       protocol = LWS_WRITE_HTTP_FINAL;
+                                       wp = LWS_WRITE_HTTP_FINAL;
                                }
                        }
 
-                       if (protocol == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
+                       if (wp == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
                                lwsl_info("%s: setting END_STREAM\n", __func__);
                                flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
 
-                       return lws_http2_frame_write(wsi, n, flags, wsi->u.http2.my_stream_id, len, buf);
+                       return lws_http2_frame_write(wsi, n, flags,
+                                       wsi->u.http2.my_stream_id, len, buf);
                }
 #endif
-               return lws_issue_raw(wsi, (unsigned char *)buf - pre,
-                                                             len + pre + post);
+               return lws_issue_raw(wsi, (unsigned char *)buf - pre, len + pre);
        default:
                break;
        }
 
-       wsi->u.ws.inside_frame = 1;
-
        /*
         * give any active extensions a chance to munge the buffer
         * before send.  We pass in a pointer to an lws_tokens struct
@@ -485,11 +525,12 @@ send_raw:
         * return to the user code how much OF THE USER BUFFER was consumed.
         */
 
-       n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre + post);
+       n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre);
+       wsi->u.ws.inside_frame = 1;
        if (n <= 0)
                return n;
 
-       if (n == (int)len + pre + post) {
+       if (n == (int)len + pre) {
                /* everything in the buffer was handled (or rebuffered...) */
                wsi->u.ws.inside_frame = 0;
                return orig_len;
@@ -502,21 +543,21 @@ send_raw:
         * later.
         */
 
-       return n - (pre + post);
+       return n - pre;
 }
 
 LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
 {
        struct lws_context *context = wsi->context;
+       struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
        unsigned long amount;
        int n, m;
 
        while (!lws_send_pipe_choked(wsi)) {
-
-               if (wsi->truncated_send_len) {
-                       if (lws_issue_raw(wsi, wsi->truncated_send_malloc +
-                                         wsi->truncated_send_offset,
-                                         wsi->truncated_send_len) < 0) {
+               if (wsi->trunc_len) {
+                       if (lws_issue_raw(wsi, wsi->trunc_alloc +
+                                         wsi->trunc_offset,
+                                         wsi->trunc_len) < 0) {
                                lwsl_info("%s: closing\n", __func__);
                                return -1;
                        }
@@ -527,16 +568,16 @@ LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
                        goto all_sent;
 
                if (lws_plat_file_read(wsi, wsi->u.http.fd, &amount,
-                                      context->service_buffer,
-                                      sizeof(context->service_buffer)) < 0)
+                                      pt->serv_buf,
+                                      LWS_MAX_SOCKET_IO_BUF) < 0)
                        return -1; /* caller will close */
 
                n = (int)amount;
                if (n) {
                        lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_CONTENT,
-                                       AWAITING_TIMEOUT);
+                                       context->timeout_secs);
                        wsi->u.http.filepos += n;
-                       m = lws_write(wsi, context->service_buffer, n,
+                       m = lws_write(wsi, pt->serv_buf, n,
                                      wsi->u.http.filepos == wsi->u.http.filelen ?
                                        LWS_WRITE_HTTP_FINAL : LWS_WRITE_HTTP);
                        if (m < 0)
@@ -544,16 +585,14 @@ LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
 
                        if (m != n)
                                /* adjust for what was not sent */
-                               if (lws_plat_file_seek_cur(wsi,
-                                                          wsi->u.http.fd,
+                               if (lws_plat_file_seek_cur(wsi, wsi->u.http.fd,
                                                           m - n) ==
                                                             (unsigned long)-1)
                                        return -1;
                }
 all_sent:
-               if (!wsi->truncated_send_len &&
-                    wsi->u.http.filepos == wsi->u.http.filelen) {
-                       wsi->state = WSI_STATE_HTTP;
+               if (!wsi->trunc_len && wsi->u.http.filepos == wsi->u.http.filelen) {
+                       wsi->state = LWSS_HTTP;
 
                        /* we might be in keepalive, so close it off here */
                        lws_plat_file_close(wsi, wsi->u.http.fd);
@@ -561,10 +600,11 @@ all_sent:
 
                        if (wsi->protocol->callback)
                                /* ignore callback returned value */
-                               user_callback_handle_rxflow(
-                                       wsi->protocol->callback, wsi,
-                                       LWS_CALLBACK_HTTP_FILE_COMPLETION,
-                                       wsi->user_space, NULL, 0);
+                               if (user_callback_handle_rxflow(
+                                    wsi->protocol->callback, wsi,
+                                    LWS_CALLBACK_HTTP_FILE_COMPLETION,
+                                    wsi->user_space, NULL, 0) < 0)
+                                       return -1;
                        return 1;  /* >0 indicates completed */
                }
        }
@@ -601,6 +641,7 @@ lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 
 #if LWS_POSIX
        n = send(wsi->sock, (char *)buf, len, MSG_NOSIGNAL);
+//     lwsl_info("%s: sent len %d result %d", __func__, len, n);
        if (n >= 0)
                return n;
 
@@ -620,7 +661,7 @@ lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
        // !!!
 #endif
 
-       lwsl_debug("ERROR writing len %d to skt %d\n", len, n);
+       lwsl_debug("ERROR writing len %d to skt fd %d err %d / errno %d\n", len, wsi->sock, n, LWS_ERRNO);
        return LWS_SSL_CAPABLE_ERROR;
 }
 #endif