client: protect against possible NULL deref path
[platform/upstream/libwebsockets.git] / lib / output.c
index 5bf0404..0d850eb 100644 (file)
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2010-2013 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2010-2015 Andy Green <andy@warmcat.com>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
 
 #include "private-libwebsockets.h"
 
-#ifdef WIN32
-#include <io.h>
-#endif
-
 static int
-libwebsocket_0405_frame_mask_generate(struct libwebsocket *wsi)
+lws_0405_frame_mask_generate(struct lws *wsi)
 {
+#if 0
+       wsi->u.ws.mask[0] = 0;
+       wsi->u.ws.mask[1] = 0;
+       wsi->u.ws.mask[2] = 0;
+       wsi->u.ws.mask[3] = 0;
+#else
        int n;
-
        /* fetch the per-frame nonce */
 
-       n = libwebsockets_get_random(wsi->protocol->owning_server,
-                                               wsi->u.ws.frame_masking_nonce_04, 4);
+       n = lws_get_random(lws_get_context(wsi), wsi->u.ws.mask, 4);
        if (n != 4) {
                lwsl_parser("Unable to read from random device %s %d\n",
-                                                    SYSTEM_RANDOM_FILEPATH, n);
+                           SYSTEM_RANDOM_FILEPATH, n);
                return 1;
        }
-
+#endif
        /* start masking from first byte of masking key buffer */
-       wsi->u.ws.frame_mask_index = 0;
+       wsi->u.ws.mask_idx = 0;
 
        return 0;
 }
 
 #ifdef _DEBUG
 
-void lwsl_hexdump(void *vbuf, size_t len)
+LWS_VISIBLE void lwsl_hexdump(void *vbuf, size_t len)
 {
-       int n;
-       int m;
-       int start;
        unsigned char *buf = (unsigned char *)vbuf;
+       unsigned int n, m, start;
        char line[80];
        char *p;
 
@@ -90,172 +88,125 @@ void lwsl_hexdump(void *vbuf, size_t len)
 
 #endif
 
-int lws_issue_raw(struct libwebsocket *wsi, unsigned char *buf, size_t len)
+/*
+ * notice this returns number of bytes consumed, or -1
+ */
+
+int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 {
-       int n;
-#ifndef LWS_NO_EXTENSIONS
-       int m;
+       struct lws_context *context = lws_get_context(wsi);
+       size_t real_len = len;
+       int n, m;
 
-       /*
-        * one of the extensions is carrying our data itself?  Like mux?
-        */
+       if (!len)
+               return 0;
+       /* just ignore sends after we cleared the truncation buffer */
+       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
+           !wsi->trunc_len)
+               return len;
+
+       if (wsi->trunc_len && (buf < wsi->trunc_alloc ||
+           buf > (wsi->trunc_alloc + wsi->trunc_len +
+                  wsi->trunc_offset))) {
+               lwsl_err("****** %x Sending new, pending truncated ...\n", wsi);
+               assert(0);
+       }
 
-       for (n = 0; n < wsi->count_active_extensions; n++) {
-               /*
-                * there can only be active extensions after handshake completed
-                * so we can rely on protocol being set already in here
-                */
-               m = wsi->active_extensions[n]->callback(
-                               wsi->protocol->owning_server,
-                               wsi->active_extensions[n], wsi,
-                               LWS_EXT_CALLBACK_PACKET_TX_DO_SEND,
-                                    wsi->active_extensions_user[n], &buf, len);
-               if (m < 0) {
-                       lwsl_ext("Extension reports fatal error\n");
-                       return -1;
-               }
-               if (m) /* handled */ {
-/*                     lwsl_ext("ext sent it\n"); */
-                       return 0;
-               }
+       m = lws_ext_cb_active(wsi, LWS_EXT_CB_PACKET_TX_DO_SEND, &buf, len);
+       if (m < 0)
+               return -1;
+       if (m) /* handled */ {
+               n = m;
+               goto handle_truncated_send;
        }
-#endif
-       if (!wsi->sock)
-               lwsl_warn("** error 0 sock but expected to send\n");
 
-       /*
-        * nope, send it on the socket directly
-        */
+       if (!lws_socket_is_valid(wsi->sock))
+               lwsl_warn("** error invalid sock but expected to send\n");
 
-#if 0
-       lwsl_debug("  TX: ");
-       lws_hexdump(buf, len);
-#endif
+       /* nope, send it on the socket directly */
+       lws_latency_pre(context, wsi);
+       n = lws_ssl_capable_write(wsi, buf, len);
+       lws_latency(context, wsi, "send lws_issue_raw", n,
+                   (unsigned int)n == len);
 
-#ifdef LWS_OPENSSL_SUPPORT
-       if (wsi->ssl) {
-               n = SSL_write(wsi->ssl, buf, len);
-               if (n < 0) {
-                       lwsl_debug("ERROR writing to socket\n");
-                       return -1;
-               }
-       } else {
-#endif
-               n = send(wsi->sock, buf, len, MSG_NOSIGNAL);
-               if (n != len) {
-                       lwsl_debug("ERROR writing len %d to socket %d\n", len, n);
-                       return -1;
-               }
-#ifdef LWS_OPENSSL_SUPPORT
+       switch (n) {
+       case LWS_SSL_CAPABLE_ERROR:
+               /* we're going to close, let close know sends aren't possible */
+               wsi->socket_is_permanently_unusable = 1;
+               return -1;
+       case LWS_SSL_CAPABLE_MORE_SERVICE:
+               /* nothing got sent, not fatal, retry the whole thing later */
+               n = 0;
+               break;
        }
-#endif
-       return 0;
-}
-
-#ifdef LWS_NO_EXTENSIONS
-int
-lws_issue_raw_ext_access(struct libwebsocket *wsi,
-                                                unsigned char *buf, size_t len)
-{
-       return lws_issue_raw(wsi, buf, len);
-}
-#else
-int
-lws_issue_raw_ext_access(struct libwebsocket *wsi,
-                                                unsigned char *buf, size_t len)
-{
-       int ret;
-       struct lws_tokens eff_buf;
-       int m;
-       int n;
-
-       eff_buf.token = (char *)buf;
-       eff_buf.token_len = len;
 
+handle_truncated_send:
        /*
-        * while we have original buf to spill ourselves, or extensions report
-        * more in their pipeline
+        * we were already handling a truncated send?
         */
-
-       ret = 1;
-       while (ret == 1) {
-
-               /* default to nobody has more to spill */
-
-               ret = 0;
-
-               /* show every extension the new incoming data */
-
-               for (n = 0; n < wsi->count_active_extensions; n++) {
-                       m = wsi->active_extensions[n]->callback(
-                                       wsi->protocol->owning_server,
-                                       wsi->active_extensions[n], wsi,
-                                       LWS_EXT_CALLBACK_PACKET_TX_PRESEND,
-                                  wsi->active_extensions_user[n], &eff_buf, 0);
-                       if (m < 0) {
-                               lwsl_ext("Extension: fatal error\n");
-                               return -1;
+       if (wsi->trunc_len) {
+               lwsl_info("%p partial adv %d (vs %d)\n", wsi, n, real_len);
+               wsi->trunc_offset += n;
+               wsi->trunc_len -= n;
+
+               if (!wsi->trunc_len) {
+                       lwsl_info("***** %x partial send completed\n", wsi);
+                       /* done with it, but don't free it */
+                       n = real_len;
+                       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
+                               lwsl_info("***** %x signalling to close now\n", wsi);
+                               return -1; /* retry closing now */
                        }
-                       if (m)
-                               /*
-                                * at least one extension told us he has more
-                                * to spill, so we will go around again after
-                                */
-                               ret = 1;
                }
+               /* always callback on writeable */
+               lws_callback_on_writable(wsi);
 
-               /* assuming they left us something to send, send it */
-
-               if (eff_buf.token_len)
-                       if (lws_issue_raw(wsi, (unsigned char *)eff_buf.token,
-                                                           eff_buf.token_len))
-                               return -1;
-
-               lwsl_parser("written %d bytes to client\n", eff_buf.token_len);
-
-               /* no extension has more to spill */
-
-               if (!ret)
-                       break;
-
-               /* we used up what we had */
-
-               eff_buf.token = NULL;
-               eff_buf.token_len = 0;
-
-               /*
-                * Did that leave the pipe choked?
-                */
+               return n;
+       }
 
-               if (!lws_send_pipe_choked(wsi))
-                       /* no we could add more */
-                       continue;
+       if ((unsigned int)n == real_len)
+               /* what we just sent went out cleanly */
+               return n;
 
-               lwsl_debug("choked\n");
+       /*
+        * Newly truncated send.  Buffer the remainder (it will get
+        * first priority next time the socket is writable)
+        */
+       lwsl_info("%p new partial sent %d from %d total\n", wsi, n, real_len);
 
-               /*
-                * Yes, he's choked.  Don't spill the rest now get a callback
-                * when he is ready to send and take care of it there
-                */
-               libwebsocket_callback_on_writable(
-                                            wsi->protocol->owning_server, wsi);
-               wsi->extension_data_pending = 1;
-               ret = 0;
+       /*
+        *  - if we still have a suitable malloc lying around, use it
+        *  - or, if too small, reallocate it
+        *  - or, if no buffer, create it
+        */
+       if (!wsi->trunc_alloc || real_len - n > wsi->trunc_alloc_len) {
+               lws_free(wsi->trunc_alloc);
+
+               wsi->trunc_alloc_len = real_len - n;
+               wsi->trunc_alloc = lws_malloc(real_len - n);
+               if (!wsi->trunc_alloc) {
+                       lwsl_err("truncated send: unable to malloc %d\n",
+                                real_len - n);
+                       return -1;
+               }
        }
+       wsi->trunc_offset = 0;
+       wsi->trunc_len = real_len - n;
+       memcpy(wsi->trunc_alloc, buf + n, real_len - n);
 
-       return 0;
+       /* since something buffered, force it to get another chance to send */
+       lws_callback_on_writable(wsi);
+
+       return real_len;
 }
-#endif
 
 /**
- * libwebsocket_write() - Apply protocol then write data to client
+ * lws_write() - Apply protocol then write data to client
  * @wsi:       Websocket instance (available from user callback)
  * @buf:       The data to send.  For data being sent on a websocket
  *             connection (ie, not default http), this buffer MUST have
- *             LWS_SEND_BUFFER_PRE_PADDING bytes valid BEFORE the pointer
- *             and an additional LWS_SEND_BUFFER_POST_PADDING bytes valid
- *             in the buffer after (buf + len).  This is so the protocol
- *             header and trailer data can be added in-situ.
+ *             LWS_PRE bytes valid BEFORE the pointer.
+ *             This is so the protocol header data can be added in-situ.
  * @len:       Count of the data bytes in the payload starting from buf
  * @protocol:  Use LWS_WRITE_HTTP to reply to an http connection, and one
  *             of LWS_WRITE_BINARY or LWS_WRITE_TEXT to send appropriate
@@ -270,61 +221,145 @@ lws_issue_raw_ext_access(struct libwebsocket *wsi,
  *     valid storage before and after buf as explained above.  This scheme
  *     allows maximum efficiency of sending data and protocol in a single
  *     packet while not burdening the user code with any protocol knowledge.
+ *
+ *     Return may be -1 for a fatal error needing connection close, or a
+ *     positive number reflecting the amount of bytes actually sent.  This
+ *     can be less than the requested number of bytes due to OS memory
+ *     pressure at any given time.
  */
 
-int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
-                         size_t len, enum libwebsocket_write_protocol protocol)
+LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf, size_t len,
+                         enum lws_write_protocol wp)
 {
-       int n;
-       int pre = 0;
-       int post = 0;
-       int masked7 = wsi->mode == LWS_CONNMODE_WS_CLIENT;
-       unsigned char *dropmask = NULL;
+       struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+       int masked7 = (wsi->mode == LWSCM_WS_CLIENT);
        unsigned char is_masked_bit = 0;
-#ifndef LWS_NO_EXTENSIONS
+       unsigned char *dropmask = NULL;
        struct lws_tokens eff_buf;
-       int m;
-#endif
+       int pre = 0, n;
+       size_t orig_len = len;
+
+       if (wsi->state == LWSS_ESTABLISHED && wsi->u.ws.tx_draining_ext) {
+               /* remove us from the list */
+               struct lws **w = &pt->tx_draining_ext_list;
+               lwsl_debug("%s: TX EXT DRAINING: Remove from list\n", __func__);
+               wsi->u.ws.tx_draining_ext = 0;
+               /* remove us from context draining ext list */
+               while (*w) {
+                       if (*w == wsi) {
+                               *w = wsi->u.ws.tx_draining_ext_list;
+                               break;
+                       }
+                       w = &((*w)->u.ws.tx_draining_ext_list);
+               }
+               wsi->u.ws.tx_draining_ext_list = NULL;
+               wp = (wsi->u.ws.tx_draining_stashed_wp & 0xc0) |
+                               LWS_WRITE_CONTINUATION;
 
-       if (len == 0 && protocol != LWS_WRITE_CLOSE) {
-               lwsl_warn("zero length libwebsocket_write attempt\n");
-               return 0;
+               lwsl_ext("FORCED draining wp to 0x%02X\n", wp);
        }
 
-       if (protocol == LWS_WRITE_HTTP)
+       if (wp == LWS_WRITE_HTTP ||
+           wp == LWS_WRITE_HTTP_FINAL ||
+           wp == LWS_WRITE_HTTP_HEADERS)
                goto send_raw;
 
-       /* websocket protocol, either binary or text */
+       /* if not in a state to send stuff, then just send nothing */
 
-       if (wsi->state != WSI_STATE_ESTABLISHED)
-               return -1;
+       if (wsi->state != LWSS_ESTABLISHED &&
+           ((wsi->state != LWSS_RETURNED_CLOSE_ALREADY &&
+             wsi->state != LWSS_AWAITING_CLOSE_ACK) ||
+                           wp != LWS_WRITE_CLOSE))
+               return 0;
+
+       /* if we are continuing a frame that already had its header done */
+
+       if (wsi->u.ws.inside_frame) {
+               lwsl_debug("INSIDE FRAME\n");
+               goto do_more_inside_frame;
+       }
 
-#ifndef LWS_NO_EXTENSIONS
-       /* give a change to the extensions to modify payload */
+       wsi->u.ws.clean_buffer = 1;
+
+       /*
+        * give a chance to the extensions to modify payload
+        * the extension may decide to produce unlimited payload erratically
+        * (eg, compression extension), so we require only that if he produces
+        * something, it will be a complete fragment of the length known at
+        * the time (just the fragment length known), and if he has
+        * more we will come back next time he is writeable and allow him to
+        * produce more fragments until he's drained.
+        *
+        * This allows what is sent each time it is writeable to be limited to
+        * a size that can be sent without partial sends or blocking, allows
+        * interleaving of control frames and other connection service.
+        */
        eff_buf.token = (char *)buf;
        eff_buf.token_len = len;
 
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_PING:
        case LWS_WRITE_PONG:
        case LWS_WRITE_CLOSE:
                break;
        default:
+               n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_TX, &eff_buf, wp);
+               if (n < 0)
+                       return -1;
 
-               for (n = 0; n < wsi->count_active_extensions; n++) {
-                       m = wsi->active_extensions[n]->callback(
-                               wsi->protocol->owning_server,
-                               wsi->active_extensions[n], wsi,
-                               LWS_EXT_CALLBACK_PAYLOAD_TX,
-                               wsi->active_extensions_user[n], &eff_buf, 0);
-                       if (m < 0)
-                               return -1;
+               if (n && eff_buf.token_len) {
+                       /* extension requires further draining */
+                       wsi->u.ws.tx_draining_ext = 1;
+                       wsi->u.ws.tx_draining_ext_list = pt->tx_draining_ext_list;
+                       pt->tx_draining_ext_list = wsi;
+                       /* we must come back to do more */
+                       lws_callback_on_writable(wsi);
+                       /*
+                        * keep a copy of the write type for the overall
+                        * action that has provoked generation of these
+                        * fragments, so the last guy can use its FIN state.
+                        */
+                       wsi->u.ws.tx_draining_stashed_wp = wp;
+                       /* this is definitely not actually the last fragment
+                        * because the extension asserted he has more coming
+                        * So make sure this intermediate one doesn't go out
+                        * with a FIN.
+                        */
+                       wp |= LWS_WRITE_NO_FIN;
+               }
+
+               if (eff_buf.token_len && wsi->u.ws.stashed_write_pending) {
+                       wsi->u.ws.stashed_write_pending = 0;
+                       wp = (wp &0xc0) | (int)wsi->u.ws.stashed_write_type;
                }
        }
 
+       /*
+        * an extension did something we need to keep... for example, if
+        * compression extension, it has already updated its state according
+        * to this being issued
+        */
+       if ((char *)buf != eff_buf.token) {
+               /*
+                * ext might eat it, but no have anything to issue yet
+                * in that case we have to follow his lead, but stash and
+                * replace the write type that was lost here the first time.
+                */
+               if (len && !eff_buf.token_len) {
+                       if (!wsi->u.ws.stashed_write_pending)
+                               wsi->u.ws.stashed_write_type = (char)wp & 0x3f;
+                       wsi->u.ws.stashed_write_pending = 1;
+                       return len;
+               }
+               /*
+                * extension recreated it:
+                * need to buffer this if not all sent
+                */
+               wsi->u.ws.clean_buffer = 0;
+       }
+
        buf = (unsigned char *)eff_buf.token;
        len = eff_buf.token_len;
-#endif
 
        switch (wsi->ietf_spec_revision) {
        case 13:
@@ -334,60 +369,45 @@ int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
                        is_masked_bit = 0x80;
                }
 
-               switch (protocol & 0xf) {
+               switch (wp & 0xf) {
                case LWS_WRITE_TEXT:
-                       n = LWS_WS_OPCODE_07__TEXT_FRAME;
+                       n = LWSWSOPC_TEXT_FRAME;
                        break;
                case LWS_WRITE_BINARY:
-                       n = LWS_WS_OPCODE_07__BINARY_FRAME;
+                       n = LWSWSOPC_BINARY_FRAME;
                        break;
                case LWS_WRITE_CONTINUATION:
-                       n = LWS_WS_OPCODE_07__CONTINUATION;
+                       n = LWSWSOPC_CONTINUATION;
                        break;
 
                case LWS_WRITE_CLOSE:
-                       n = LWS_WS_OPCODE_07__CLOSE;
-
-                       /*
-                        * 06+ has a 2-byte status code in network order
-                        * we can do this because we demand post-buf
-                        */
-
-                       if (wsi->u.ws.close_reason) {
-                               /* reason codes count as data bytes */
-                               buf -= 2;
-                               buf[0] = wsi->u.ws.close_reason >> 8;
-                               buf[1] = wsi->u.ws.close_reason;
-                               len += 2;
-                       }
+                       n = LWSWSOPC_CLOSE;
                        break;
                case LWS_WRITE_PING:
-                       n = LWS_WS_OPCODE_07__PING;
-                       wsi->u.ws.pings_vs_pongs++;
+                       n = LWSWSOPC_PING;
                        break;
                case LWS_WRITE_PONG:
-                       n = LWS_WS_OPCODE_07__PONG;
+                       n = LWSWSOPC_PONG;
                        break;
                default:
-                       lwsl_warn("libwebsocket_write: unknown write "
-                                                        "opcode / protocol\n");
+                       lwsl_warn("lws_write: unknown write opc / wp\n");
                        return -1;
                }
 
-               if (!(protocol & LWS_WRITE_NO_FIN))
+               if (!(wp & LWS_WRITE_NO_FIN))
                        n |= 1 << 7;
 
                if (len < 126) {
                        pre += 2;
                        buf[-pre] = n;
-                       buf[-pre + 1] = len | is_masked_bit;
+                       buf[-pre + 1] = (unsigned char)(len | is_masked_bit);
                } else {
                        if (len < 65536) {
                                pre += 4;
                                buf[-pre] = n;
                                buf[-pre + 1] = 126 | is_masked_bit;
-                               buf[-pre + 2] = len >> 8;
-                               buf[-pre + 3] = len;
+                               buf[-pre + 2] = (unsigned char)(len >> 8);
+                               buf[-pre + 3] = (unsigned char)len;
                        } else {
                                pre += 10;
                                buf[-pre] = n;
@@ -403,58 +423,85 @@ int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
                                        buf[-pre + 4] = 0;
                                        buf[-pre + 5] = 0;
 #endif
-                               buf[-pre + 6] = len >> 24;
-                               buf[-pre + 7] = len >> 16;
-                               buf[-pre + 8] = len >> 8;
-                               buf[-pre + 9] = len;
+                               buf[-pre + 6] = (unsigned char)(len >> 24);
+                               buf[-pre + 7] = (unsigned char)(len >> 16);
+                               buf[-pre + 8] = (unsigned char)(len >> 8);
+                               buf[-pre + 9] = (unsigned char)len;
                        }
                }
                break;
        }
 
+do_more_inside_frame:
+
        /*
         * Deal with masking if we are in client -> server direction and
-        * the protocol demands it
+        * the wp demands it
         */
 
-       if (wsi->mode == LWS_CONNMODE_WS_CLIENT) {
-
-               if (libwebsocket_0405_frame_mask_generate(wsi)) {
-                       lwsl_err("libwebsocket_write: "
-                                     "frame mask generation failed\n");
-                       return 1;
-               }
+       if (masked7) {
+               if (!wsi->u.ws.inside_frame)
+                       if (lws_0405_frame_mask_generate(wsi)) {
+                               lwsl_err("frame mask generation failed\n");
+                               return -1;
+                       }
 
                /*
                 * in v7, just mask the payload
                 */
-               for (n = 4; n < (int)len + 4; n++)
-                       dropmask[n] = dropmask[n] ^ wsi->u.ws.frame_masking_nonce_04[(wsi->u.ws.frame_mask_index++) & 3];
+               if (dropmask) { /* never set if already inside frame */
+                       for (n = 4; n < (int)len + 4; n++)
+                               dropmask[n] = dropmask[n] ^ wsi->u.ws.mask[
+                                       (wsi->u.ws.mask_idx++) & 3];
 
-               if (dropmask)
                        /* copy the frame nonce into place */
-                       memcpy(dropmask,
-                                      wsi->u.ws.frame_masking_nonce_04, 4);
+                       memcpy(dropmask, wsi->u.ws.mask, 4);
+               }
        }
 
 send_raw:
-
-#if 0
-       lwsl_debug("send %ld: ", len + post);
-       lwsl_hexdump(&buf[-pre], len + post);
-#endif
-
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_CLOSE:
-//             lwsl_hexdump(&buf[-pre], len + post);
+/*             lwsl_hexdump(&buf[-pre], len); */
        case LWS_WRITE_HTTP:
+       case LWS_WRITE_HTTP_FINAL:
+       case LWS_WRITE_HTTP_HEADERS:
        case LWS_WRITE_PONG:
        case LWS_WRITE_PING:
-               if (lws_issue_raw(wsi, (unsigned char *)buf - pre,
-                                                             len + pre + post))
-                       return -1;
+#ifdef LWS_USE_HTTP2
+               if (wsi->mode == LWSCM_HTTP2_SERVING) {
+                       unsigned char flags = 0;
+
+                       n = LWS_HTTP2_FRAME_TYPE_DATA;
+                       if (wp == LWS_WRITE_HTTP_HEADERS) {
+                               n = LWS_HTTP2_FRAME_TYPE_HEADERS;
+                               flags = LWS_HTTP2_FLAG_END_HEADERS;
+                               if (wsi->u.http2.send_END_STREAM)
+                                       flags |= LWS_HTTP2_FLAG_END_STREAM;
+                       }
 
-               return 0;
+                       if ((wp == LWS_WRITE_HTTP ||
+                            wp == LWS_WRITE_HTTP_FINAL) &&
+                           wsi->u.http.content_length) {
+                               wsi->u.http.content_remain -= len;
+                               lwsl_info("%s: content_remain = %lu\n", __func__,
+                                         wsi->u.http.content_remain);
+                               if (!wsi->u.http.content_remain) {
+                                       lwsl_info("%s: selecting final write mode\n", __func__);
+                                       wp = LWS_WRITE_HTTP_FINAL;
+                               }
+                       }
+
+                       if (wp == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
+                               lwsl_info("%s: setting END_STREAM\n", __func__);
+                               flags |= LWS_HTTP2_FLAG_END_STREAM;
+                       }
+
+                       return lws_http2_frame_write(wsi, n, flags,
+                                       wsi->u.http2.my_stream_id, len, buf);
+               }
+#endif
+               return lws_issue_raw(wsi, (unsigned char *)buf - pre, len + pre);
        default:
                break;
        }
@@ -471,154 +518,156 @@ send_raw:
         * used then so it is efficient.
         *
         * callback returns 1 in case it wants to spill more buffers
+        *
+        * This takes care of holding the buffer if send is incomplete, ie,
+        * if wsi->u.ws.clean_buffer is 0 (meaning an extension meddled with
+        * the buffer).  If wsi->u.ws.clean_buffer is 1, it will instead
+        * return to the user code how much OF THE USER BUFFER was consumed.
         */
 
-       return lws_issue_raw_ext_access(wsi, buf - pre, len + pre + post);
-}
+       n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre);
+       wsi->u.ws.inside_frame = 1;
+       if (n <= 0)
+               return n;
 
+       if (n == (int)len + pre) {
+               /* everything in the buffer was handled (or rebuffered...) */
+               wsi->u.ws.inside_frame = 0;
+               return orig_len;
+       }
 
-/**
- * libwebsockets_serve_http_file() - Send a file back to the client using http
- * @context:           libwebsockets context
- * @wsi:               Websocket instance (available from user callback)
- * @file:              The file to issue over http
- * @content_type:      The http content type, eg, text/html
- *
- *     This function is intended to be called from the callback in response
- *     to http requests from the client.  It allows the callback to issue
- *     local files down the http link in a single step.
- */
+       /*
+        * it is how many bytes of user buffer got sent... may be < orig_len
+        * in which case callback when writable has already been arranged
+        * and user code can call lws_write() again with the rest
+        * later.
+        */
 
-int libwebsockets_serve_http_file(struct libwebsocket_context *context,
-                       struct libwebsocket *wsi, const char *file,
-                                                      const char *content_type)
+       return n - pre;
+}
+
+LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
 {
-       int fd;
-       struct stat stat_buf;
-       char buf[1400];
-       char *p = buf;
+       struct lws_context *context = wsi->context;
+       struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
+       unsigned long amount;
        int n, m;
 
-       strncpy(wsi->u.http.filepath, file, sizeof wsi->u.http.filepath);
-       wsi->u.http.filepath[sizeof(wsi->u.http.filepath) - 1] = '\0';
-
-#ifdef WIN32
-       fd = open(wsi->u.http.filepath, O_RDONLY | _O_BINARY);
-#else
-       fd = open(wsi->u.http.filepath, O_RDONLY);
-#endif
-       if (fd < 1) {
-               p += sprintf(p, "HTTP/1.0 400 Bad\x0d\x0a"
-                       "Server: libwebsockets\x0d\x0a"
-                       "\x0d\x0a"
-               );
-               libwebsocket_write(wsi, (unsigned char *)buf, p - buf,
-                                                               LWS_WRITE_HTTP);
-
-               return -1;
-       }
-
-       fstat(fd, &stat_buf);
-       wsi->u.http.filelen = stat_buf.st_size;
-       p += sprintf(p, "HTTP/1.0 200 OK\x0d\x0a"
-                       "Server: libwebsockets\x0d\x0a"
-                       "Content-Type: %s\x0d\x0a"
-                       "Content-Length: %u\x0d\x0a"
-                       "\x0d\x0a", content_type,
-                                       (unsigned int)stat_buf.st_size);
-
-       n = libwebsocket_write(wsi, (unsigned char *)buf, p - buf, LWS_WRITE_HTTP);
-       if (n) {
-               close(fd);
-               return n;
-       }
-
-       wsi->u.http.filepos = 0;
-       wsi->state = WSI_STATE_HTTP_ISSUING_FILE;
-
        while (!lws_send_pipe_choked(wsi)) {
-
-               n = read(fd, buf, sizeof buf);
-               if (n > 0) {
-                       wsi->u.http.filepos += n;
-                       m = libwebsocket_write(wsi, (unsigned char *)buf, n, LWS_WRITE_HTTP);
-                       if (m) {
-                               close(fd);
-                               return m;
+               if (wsi->trunc_len) {
+                       if (lws_issue_raw(wsi, wsi->trunc_alloc +
+                                         wsi->trunc_offset,
+                                         wsi->trunc_len) < 0) {
+                               lwsl_info("%s: closing\n", __func__);
+                               return -1;
                        }
+                       continue;
                }
 
-               if (n < 0) {
-                       close(fd);
-                       return -1;
-               }
+               if (wsi->u.http.filepos == wsi->u.http.filelen)
+                       goto all_sent;
 
-               if (n < sizeof(buf) || wsi->u.http.filepos == wsi->u.http.filelen) {
-                       /* oh, we were able to finish here! */
-                       wsi->state = WSI_STATE_HTTP;
-                       close(fd);
+               if (lws_plat_file_read(wsi, wsi->u.http.fd, &amount,
+                                      pt->serv_buf,
+                                      LWS_MAX_SOCKET_IO_BUF) < 0)
+                       return -1; /* caller will close */
 
-                       if (wsi->protocol->callback(context, wsi, LWS_CALLBACK_HTTP_FILE_COMPLETION, wsi->user_space,
-                                                       wsi->u.http.filepath, wsi->u.http.filepos)) {
-                               lwsl_info("closing connecton after file_completion returned nonzero\n");
-                               libwebsocket_close_and_free_session(context, wsi, LWS_CLOSE_STATUS_NOSTATUS);
-                       }
+               n = (int)amount;
+               if (n) {
+                       lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_CONTENT,
+                                       context->timeout_secs);
+                       wsi->u.http.filepos += n;
+                       m = lws_write(wsi, pt->serv_buf, n,
+                                     wsi->u.http.filepos == wsi->u.http.filelen ?
+                                       LWS_WRITE_HTTP_FINAL : LWS_WRITE_HTTP);
+                       if (m < 0)
+                               return -1;
 
-                       return 0;
+                       if (m != n)
+                               /* adjust for what was not sent */
+                               if (lws_plat_file_seek_cur(wsi, wsi->u.http.fd,
+                                                          m - n) ==
+                                                            (unsigned long)-1)
+                                       return -1;
+               }
+all_sent:
+               if (!wsi->trunc_len && wsi->u.http.filepos == wsi->u.http.filelen) {
+                       wsi->state = LWSS_HTTP;
+
+                       /* we might be in keepalive, so close it off here */
+                       lws_plat_file_close(wsi, wsi->u.http.fd);
+                       wsi->u.http.fd = LWS_INVALID_FILE;
+
+                       if (wsi->protocol->callback)
+                               /* ignore callback returned value */
+                               if (user_callback_handle_rxflow(
+                                    wsi->protocol->callback, wsi,
+                                    LWS_CALLBACK_HTTP_FILE_COMPLETION,
+                                    wsi->user_space, NULL, 0) < 0)
+                                       return -1;
+                       return 1;  /* >0 indicates completed */
                }
        }
 
-       /* we choked, no worries schedule service for the rest of it */
-
-       libwebsocket_callback_on_writable(context, wsi);
+       lwsl_info("choked before able to send whole file (post)\n");
+       lws_callback_on_writable(wsi);
 
-       close(fd);
-
-       return 0;
+       return 0; /* indicates further processing must be done */
 }
 
-int libwebsockets_serve_http_file_fragment(struct libwebsocket_context *context,
-                                                       struct libwebsocket *wsi)
+#if LWS_POSIX
+LWS_VISIBLE int
+lws_ssl_capable_read_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 {
-       int fd;
-       int ret = 0;
-       char buf[1400];
        int n;
 
-#ifdef WIN32
-       fd = open(wsi->u.http.filepath, O_RDONLY | _O_BINARY);
-#else
-       fd = open(wsi->u.http.filepath, O_RDONLY);
+       n = recv(wsi->sock, (char *)buf, len, 0);
+       if (n >= 0)
+               return n;
+#if LWS_POSIX
+       if (LWS_ERRNO == LWS_EAGAIN ||
+           LWS_ERRNO == LWS_EWOULDBLOCK ||
+           LWS_ERRNO == LWS_EINTR)
+               return LWS_SSL_CAPABLE_MORE_SERVICE;
 #endif
-       if (fd < 1)
-               return -1;
+       lwsl_warn("error on reading from skt\n");
+       return LWS_SSL_CAPABLE_ERROR;
+}
 
-       lseek(fd, wsi->u.http.filepos, SEEK_SET);
+LWS_VISIBLE int
+lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
+{
+       int n = 0;
 
-       while (!lws_send_pipe_choked(wsi)) {
-               n = read(fd, buf, sizeof buf);
-               if (n > 0) {
-                       libwebsocket_write(wsi, (unsigned char *)buf, n, LWS_WRITE_HTTP);
-                       wsi->u.http.filepos += n;
-               }
+#if LWS_POSIX
+       n = send(wsi->sock, (char *)buf, len, MSG_NOSIGNAL);
+//     lwsl_info("%s: sent len %d result %d", __func__, len, n);
+       if (n >= 0)
+               return n;
 
-               if (n < 0) {
-                       close(fd);
-                       return -1;
-               }
+       if (LWS_ERRNO == LWS_EAGAIN ||
+           LWS_ERRNO == LWS_EWOULDBLOCK ||
+           LWS_ERRNO == LWS_EINTR) {
+               if (LWS_ERRNO == LWS_EWOULDBLOCK)
+                       lws_set_blocking_send(wsi);
 
-               if (n < sizeof(buf) || wsi->u.http.filepos == wsi->u.http.filelen) {
-                       wsi->state = WSI_STATE_HTTP;
-                       close(fd);
-                       return 0;
-               }
+               return LWS_SSL_CAPABLE_MORE_SERVICE;
        }
+#else
+       (void)n;
+       (void)wsi;
+       (void)buf;
+       (void)len;
+       // !!!
+#endif
 
-       libwebsocket_callback_on_writable(context, wsi);
-
-       close(fd);
-
-       return ret;
+       lwsl_debug("ERROR writing len %d to skt fd %d err %d / errno %d\n", len, wsi->sock, n, LWS_ERRNO);
+       return LWS_SSL_CAPABLE_ERROR;
+}
+#endif
+LWS_VISIBLE int
+lws_ssl_pending_no_ssl(struct lws *wsi)
+{
+       (void)wsi;
+       return 0;
 }
-
-