client: protect against possible NULL deref path
[platform/upstream/libwebsockets.git] / lib / output.c
index b914f28..0d850eb 100644 (file)
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2010-2014 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2010-2015 Andy Green <andy@warmcat.com>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
 #include "private-libwebsockets.h"
 
 static int
-libwebsocket_0405_frame_mask_generate(struct libwebsocket *wsi)
+lws_0405_frame_mask_generate(struct lws *wsi)
 {
+#if 0
+       wsi->u.ws.mask[0] = 0;
+       wsi->u.ws.mask[1] = 0;
+       wsi->u.ws.mask[2] = 0;
+       wsi->u.ws.mask[3] = 0;
+#else
        int n;
-
        /* fetch the per-frame nonce */
 
-       n = libwebsockets_get_random(wsi->protocol->owning_server,
-                                          wsi->u.ws.frame_masking_nonce_04, 4);
+       n = lws_get_random(lws_get_context(wsi), wsi->u.ws.mask, 4);
        if (n != 4) {
                lwsl_parser("Unable to read from random device %s %d\n",
-                                                    SYSTEM_RANDOM_FILEPATH, n);
+                           SYSTEM_RANDOM_FILEPATH, n);
                return 1;
        }
-
+#endif
        /* start masking from first byte of masking key buffer */
-       wsi->u.ws.frame_mask_index = 0;
+       wsi->u.ws.mask_idx = 0;
 
        return 0;
 }
@@ -46,10 +50,8 @@ libwebsocket_0405_frame_mask_generate(struct libwebsocket *wsi)
 
 LWS_VISIBLE void lwsl_hexdump(void *vbuf, size_t len)
 {
-       int n;
-       int m;
-       int start;
        unsigned char *buf = (unsigned char *)vbuf;
+       unsigned int n, m, start;
        char line[80];
        char *p;
 
@@ -90,45 +92,42 @@ LWS_VISIBLE void lwsl_hexdump(void *vbuf, size_t len)
  * notice this returns number of bytes consumed, or -1
  */
 
-int lws_issue_raw(struct libwebsocket *wsi, unsigned char *buf, size_t len)
+int lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 {
-       struct libwebsocket_context *context = wsi->protocol->owning_server;
-       int n;
+       struct lws_context *context = lws_get_context(wsi);
        size_t real_len = len;
-       int m;
-       
+       int n, m;
+
        if (!len)
                return 0;
        /* just ignore sends after we cleared the truncation buffer */
-       if (wsi->state == WSI_STATE_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
-                                               !wsi->truncated_send_len)
+       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
+           !wsi->trunc_len)
                return len;
 
-       if (wsi->truncated_send_len && (buf < wsi->truncated_send_malloc ||
-                       buf > (wsi->truncated_send_malloc +
-                               wsi->truncated_send_len +
-                               wsi->truncated_send_offset))) {
+       if (wsi->trunc_len && (buf < wsi->trunc_alloc ||
+           buf > (wsi->trunc_alloc + wsi->trunc_len +
+                  wsi->trunc_offset))) {
                lwsl_err("****** %x Sending new, pending truncated ...\n", wsi);
                assert(0);
        }
 
-       m = lws_ext_callback_for_each_active(wsi,
-                       LWS_EXT_CALLBACK_PACKET_TX_DO_SEND, &buf, len);
+       m = lws_ext_cb_active(wsi, LWS_EXT_CB_PACKET_TX_DO_SEND, &buf, len);
        if (m < 0)
                return -1;
        if (m) /* handled */ {
                n = m;
                goto handle_truncated_send;
        }
-       if (wsi->sock < 0)
+
+       if (!lws_socket_is_valid(wsi->sock))
                lwsl_warn("** error invalid sock but expected to send\n");
 
-       /*
-        * nope, send it on the socket directly
-        */
+       /* nope, send it on the socket directly */
        lws_latency_pre(context, wsi);
        n = lws_ssl_capable_write(wsi, buf, len);
-       lws_latency(context, wsi, "send lws_issue_raw", n, n == len);
+       lws_latency(context, wsi, "send lws_issue_raw", n,
+                   (unsigned int)n == len);
 
        switch (n) {
        case LWS_SSL_CAPABLE_ERROR:
@@ -145,85 +144,69 @@ handle_truncated_send:
        /*
         * we were already handling a truncated send?
         */
-       if (wsi->truncated_send_len) {
-               lwsl_info("***** %x partial send moved on by %d (vs %d)\n",
-                                                            wsi, n, real_len);
-               wsi->truncated_send_offset += n;
-               wsi->truncated_send_len -= n;
+       if (wsi->trunc_len) {
+               lwsl_info("%p partial adv %d (vs %d)\n", wsi, n, real_len);
+               wsi->trunc_offset += n;
+               wsi->trunc_len -= n;
 
-               if (!wsi->truncated_send_len) {
+               if (!wsi->trunc_len) {
                        lwsl_info("***** %x partial send completed\n", wsi);
                        /* done with it, but don't free it */
                        n = real_len;
-                       if (wsi->state == WSI_STATE_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
+                       if (wsi->state == LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
                                lwsl_info("***** %x signalling to close now\n", wsi);
                                return -1; /* retry closing now */
                        }
                }
                /* always callback on writeable */
-               libwebsocket_callback_on_writable(
-                                            wsi->protocol->owning_server, wsi);
+               lws_callback_on_writable(wsi);
 
                return n;
        }
 
-       if (n == real_len)
+       if ((unsigned int)n == real_len)
                /* what we just sent went out cleanly */
                return n;
 
-       if (n && wsi->u.ws.clean_buffer)
-               /*
-                * This buffer unaffected by extension rewriting.
-                * It means the user code is expected to deal with
-                * partial sends.  (lws knows the header was already
-                * sent, so on next send will just resume sending
-                * payload)
-                */
-                return n;
-
        /*
         * Newly truncated send.  Buffer the remainder (it will get
         * first priority next time the socket is writable)
         */
-       lwsl_info("***** %x new partial sent %d from %d total\n",
-                                                     wsi, n, real_len);
+       lwsl_info("%p new partial sent %d from %d total\n", wsi, n, real_len);
 
        /*
         *  - if we still have a suitable malloc lying around, use it
         *  - or, if too small, reallocate it
         *  - or, if no buffer, create it
         */
-       if (!wsi->truncated_send_malloc ||
-                       real_len - n > wsi->truncated_send_allocation) {
-               lws_free(wsi->truncated_send_malloc);
+       if (!wsi->trunc_alloc || real_len - n > wsi->trunc_alloc_len) {
+               lws_free(wsi->trunc_alloc);
 
-               wsi->truncated_send_allocation = real_len - n;
-               wsi->truncated_send_malloc = lws_malloc(real_len - n);
-               if (!wsi->truncated_send_malloc) {
+               wsi->trunc_alloc_len = real_len - n;
+               wsi->trunc_alloc = lws_malloc(real_len - n);
+               if (!wsi->trunc_alloc) {
                        lwsl_err("truncated send: unable to malloc %d\n",
-                                                         real_len - n);
+                                real_len - n);
                        return -1;
                }
        }
-       wsi->truncated_send_offset = 0;
-       wsi->truncated_send_len = real_len - n;
-       memcpy(wsi->truncated_send_malloc, buf + n, real_len - n);
+       wsi->trunc_offset = 0;
+       wsi->trunc_len = real_len - n;
+       memcpy(wsi->trunc_alloc, buf + n, real_len - n);
 
        /* since something buffered, force it to get another chance to send */
-       libwebsocket_callback_on_writable(wsi->protocol->owning_server, wsi);
+       lws_callback_on_writable(wsi);
 
        return real_len;
 }
 
 /**
- * libwebsocket_write() - Apply protocol then write data to client
+ * lws_write() - Apply protocol then write data to client
  * @wsi:       Websocket instance (available from user callback)
  * @buf:       The data to send.  For data being sent on a websocket
  *             connection (ie, not default http), this buffer MUST have
- *             LWS_SEND_BUFFER_PRE_PADDING bytes valid BEFORE the pointer
- *             and an additional LWS_SEND_BUFFER_POST_PADDING bytes valid
- *             in the buffer after (buf + len).  This is so the protocol
- *             header and trailer data can be added in-situ.
+ *             LWS_PRE bytes valid BEFORE the pointer.
+ *             This is so the protocol header data can be added in-situ.
  * @len:       Count of the data bytes in the payload starting from buf
  * @protocol:  Use LWS_WRITE_HTTP to reply to an http connection, and one
  *             of LWS_WRITE_BINARY or LWS_WRITE_TEXT to send appropriate
@@ -245,57 +228,110 @@ handle_truncated_send:
  *     pressure at any given time.
  */
 
-LWS_VISIBLE int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
-                         size_t len, enum libwebsocket_write_protocol protocol)
+LWS_VISIBLE int lws_write(struct lws *wsi, unsigned char *buf, size_t len,
+                         enum lws_write_protocol wp)
 {
-       int n;
-       int pre = 0;
-       int post = 0;
-       int masked7 = wsi->mode == LWS_CONNMODE_WS_CLIENT;
-       unsigned char *dropmask = NULL;
+       struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+       int masked7 = (wsi->mode == LWSCM_WS_CLIENT);
        unsigned char is_masked_bit = 0;
-       size_t orig_len = len;
+       unsigned char *dropmask = NULL;
        struct lws_tokens eff_buf;
+       int pre = 0, n;
+       size_t orig_len = len;
 
-       if (len == 0 && protocol != LWS_WRITE_CLOSE &&
-                    protocol != LWS_WRITE_PING && protocol != LWS_WRITE_PONG) {
-               lwsl_warn("zero length libwebsocket_write attempt\n");
-               return 0;
+       if (wsi->state == LWSS_ESTABLISHED && wsi->u.ws.tx_draining_ext) {
+               /* remove us from the list */
+               struct lws **w = &pt->tx_draining_ext_list;
+               lwsl_debug("%s: TX EXT DRAINING: Remove from list\n", __func__);
+               wsi->u.ws.tx_draining_ext = 0;
+               /* remove us from context draining ext list */
+               while (*w) {
+                       if (*w == wsi) {
+                               *w = wsi->u.ws.tx_draining_ext_list;
+                               break;
+                       }
+                       w = &((*w)->u.ws.tx_draining_ext_list);
+               }
+               wsi->u.ws.tx_draining_ext_list = NULL;
+               wp = (wsi->u.ws.tx_draining_stashed_wp & 0xc0) |
+                               LWS_WRITE_CONTINUATION;
+
+               lwsl_ext("FORCED draining wp to 0x%02X\n", wp);
        }
 
-       if (protocol == LWS_WRITE_HTTP ||
-           protocol == LWS_WRITE_HTTP_FINAL ||
-           protocol == LWS_WRITE_HTTP_HEADERS)
+       if (wp == LWS_WRITE_HTTP ||
+           wp == LWS_WRITE_HTTP_FINAL ||
+           wp == LWS_WRITE_HTTP_HEADERS)
                goto send_raw;
 
-       /* websocket protocol, either binary or text */
+       /* if not in a state to send stuff, then just send nothing */
 
-       if (wsi->state != WSI_STATE_ESTABLISHED)
-               return -1;
+       if (wsi->state != LWSS_ESTABLISHED &&
+           ((wsi->state != LWSS_RETURNED_CLOSE_ALREADY &&
+             wsi->state != LWSS_AWAITING_CLOSE_ACK) ||
+                           wp != LWS_WRITE_CLOSE))
+               return 0;
 
        /* if we are continuing a frame that already had its header done */
 
-       if (wsi->u.ws.inside_frame)
+       if (wsi->u.ws.inside_frame) {
+               lwsl_debug("INSIDE FRAME\n");
                goto do_more_inside_frame;
+       }
 
        wsi->u.ws.clean_buffer = 1;
 
        /*
         * give a chance to the extensions to modify payload
-        * pre-TX mangling is not allowed to truncate
+        * the extension may decide to produce unlimited payload erratically
+        * (eg, compression extension), so we require only that if he produces
+        * something, it will be a complete fragment of the length known at
+        * the time (just the fragment length known), and if he has
+        * more we will come back next time he is writeable and allow him to
+        * produce more fragments until he's drained.
+        *
+        * This allows what is sent each time it is writeable to be limited to
+        * a size that can be sent without partial sends or blocking, allows
+        * interleaving of control frames and other connection service.
         */
        eff_buf.token = (char *)buf;
        eff_buf.token_len = len;
 
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_PING:
        case LWS_WRITE_PONG:
        case LWS_WRITE_CLOSE:
                break;
        default:
-               if (lws_ext_callback_for_each_active(wsi,
-                              LWS_EXT_CALLBACK_PAYLOAD_TX, &eff_buf, 0) < 0)
+               n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_TX, &eff_buf, wp);
+               if (n < 0)
                        return -1;
+
+               if (n && eff_buf.token_len) {
+                       /* extension requires further draining */
+                       wsi->u.ws.tx_draining_ext = 1;
+                       wsi->u.ws.tx_draining_ext_list = pt->tx_draining_ext_list;
+                       pt->tx_draining_ext_list = wsi;
+                       /* we must come back to do more */
+                       lws_callback_on_writable(wsi);
+                       /*
+                        * keep a copy of the write type for the overall
+                        * action that has provoked generation of these
+                        * fragments, so the last guy can use its FIN state.
+                        */
+                       wsi->u.ws.tx_draining_stashed_wp = wp;
+                       /* this is definitely not actually the last fragment
+                        * because the extension asserted he has more coming
+                        * So make sure this intermediate one doesn't go out
+                        * with a FIN.
+                        */
+                       wp |= LWS_WRITE_NO_FIN;
+               }
+
+               if (eff_buf.token_len && wsi->u.ws.stashed_write_pending) {
+                       wsi->u.ws.stashed_write_pending = 0;
+                       wp = (wp &0xc0) | (int)wsi->u.ws.stashed_write_type;
+               }
        }
 
        /*
@@ -303,77 +339,75 @@ LWS_VISIBLE int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
         * compression extension, it has already updated its state according
         * to this being issued
         */
-       if ((char *)buf != eff_buf.token)
+       if ((char *)buf != eff_buf.token) {
+               /*
+                * ext might eat it, but no have anything to issue yet
+                * in that case we have to follow his lead, but stash and
+                * replace the write type that was lost here the first time.
+                */
+               if (len && !eff_buf.token_len) {
+                       if (!wsi->u.ws.stashed_write_pending)
+                               wsi->u.ws.stashed_write_type = (char)wp & 0x3f;
+                       wsi->u.ws.stashed_write_pending = 1;
+                       return len;
+               }
                /*
                 * extension recreated it:
                 * need to buffer this if not all sent
                 */
                wsi->u.ws.clean_buffer = 0;
+       }
 
        buf = (unsigned char *)eff_buf.token;
        len = eff_buf.token_len;
 
        switch (wsi->ietf_spec_revision) {
        case 13:
-
                if (masked7) {
                        pre += 4;
                        dropmask = &buf[0 - pre];
                        is_masked_bit = 0x80;
                }
 
-               switch (protocol & 0xf) {
+               switch (wp & 0xf) {
                case LWS_WRITE_TEXT:
-                       n = LWS_WS_OPCODE_07__TEXT_FRAME;
+                       n = LWSWSOPC_TEXT_FRAME;
                        break;
                case LWS_WRITE_BINARY:
-                       n = LWS_WS_OPCODE_07__BINARY_FRAME;
+                       n = LWSWSOPC_BINARY_FRAME;
                        break;
                case LWS_WRITE_CONTINUATION:
-                       n = LWS_WS_OPCODE_07__CONTINUATION;
+                       n = LWSWSOPC_CONTINUATION;
                        break;
 
                case LWS_WRITE_CLOSE:
-                       n = LWS_WS_OPCODE_07__CLOSE;
-
-                       /*
-                        * 06+ has a 2-byte status code in network order
-                        * we can do this because we demand post-buf
-                        */
-
-                       if (wsi->u.ws.close_reason) {
-                               /* reason codes count as data bytes */
-                               buf -= 2;
-                               buf[0] = wsi->u.ws.close_reason >> 8;
-                               buf[1] = wsi->u.ws.close_reason;
-                               len += 2;
-                       }
+                       n = LWSWSOPC_CLOSE;
                        break;
                case LWS_WRITE_PING:
-                       n = LWS_WS_OPCODE_07__PING;
+                       n = LWSWSOPC_PING;
                        break;
                case LWS_WRITE_PONG:
-                       n = LWS_WS_OPCODE_07__PONG;
+                       n = LWSWSOPC_PONG;
                        break;
                default:
-                       lwsl_warn("lws_write: unknown write opc / protocol\n");
+                       lwsl_warn("lws_write: unknown write opc / wp\n");
                        return -1;
                }
 
-               if (!(protocol & LWS_WRITE_NO_FIN))
+               if (!(wp & LWS_WRITE_NO_FIN))
                        n |= 1 << 7;
 
                if (len < 126) {
                        pre += 2;
                        buf[-pre] = n;
-                       buf[-pre + 1] = len | is_masked_bit;
+                       buf[-pre + 1] = (unsigned char)(len | is_masked_bit);
                } else {
                        if (len < 65536) {
                                pre += 4;
                                buf[-pre] = n;
                                buf[-pre + 1] = 126 | is_masked_bit;
-                               buf[-pre + 2] = len >> 8;
-                               buf[-pre + 3] = len;
+                               buf[-pre + 2] = (unsigned char)(len >> 8);
+                               buf[-pre + 3] = (unsigned char)len;
                        } else {
                                pre += 10;
                                buf[-pre] = n;
@@ -389,10 +423,10 @@ LWS_VISIBLE int libwebsocket_write(struct libwebsocket *wsi, unsigned char *buf,
                                        buf[-pre + 4] = 0;
                                        buf[-pre + 5] = 0;
 #endif
-                               buf[-pre + 6] = len >> 24;
-                               buf[-pre + 7] = len >> 16;
-                               buf[-pre + 8] = len >> 8;
-                               buf[-pre + 9] = len;
+                               buf[-pre + 6] = (unsigned char)(len >> 24);
+                               buf[-pre + 7] = (unsigned char)(len >> 16);
+                               buf[-pre + 8] = (unsigned char)(len >> 8);
+                               buf[-pre + 9] = (unsigned char)len;
                        }
                }
                break;
@@ -402,13 +436,12 @@ do_more_inside_frame:
 
        /*
         * Deal with masking if we are in client -> server direction and
-        * the protocol demands it
+        * the wp demands it
         */
 
-       if (wsi->mode == LWS_CONNMODE_WS_CLIENT) {
-
+       if (masked7) {
                if (!wsi->u.ws.inside_frame)
-                       if (libwebsocket_0405_frame_mask_generate(wsi)) {
+                       if (lws_0405_frame_mask_generate(wsi)) {
                                lwsl_err("frame mask generation failed\n");
                                return -1;
                        }
@@ -418,61 +451,61 @@ do_more_inside_frame:
                 */
                if (dropmask) { /* never set if already inside frame */
                        for (n = 4; n < (int)len + 4; n++)
-                               dropmask[n] = dropmask[n] ^
-                               wsi->u.ws.frame_masking_nonce_04[
-                                       (wsi->u.ws.frame_mask_index++) & 3];
+                               dropmask[n] = dropmask[n] ^ wsi->u.ws.mask[
+                                       (wsi->u.ws.mask_idx++) & 3];
 
                        /* copy the frame nonce into place */
-                       memcpy(dropmask, wsi->u.ws.frame_masking_nonce_04, 4);
+                       memcpy(dropmask, wsi->u.ws.mask, 4);
                }
        }
 
 send_raw:
-       switch (protocol) {
+       switch ((int)wp) {
        case LWS_WRITE_CLOSE:
-/*             lwsl_hexdump(&buf[-pre], len + post); */
+/*             lwsl_hexdump(&buf[-pre], len); */
        case LWS_WRITE_HTTP:
        case LWS_WRITE_HTTP_FINAL:
        case LWS_WRITE_HTTP_HEADERS:
        case LWS_WRITE_PONG:
        case LWS_WRITE_PING:
 #ifdef LWS_USE_HTTP2
-               if (wsi->mode == LWS_CONNMODE_HTTP2_SERVING) {
+               if (wsi->mode == LWSCM_HTTP2_SERVING) {
                        unsigned char flags = 0;
 
                        n = LWS_HTTP2_FRAME_TYPE_DATA;
-                       if (protocol == LWS_WRITE_HTTP_HEADERS) {
+                       if (wp == LWS_WRITE_HTTP_HEADERS) {
                                n = LWS_HTTP2_FRAME_TYPE_HEADERS;
                                flags = LWS_HTTP2_FLAG_END_HEADERS;
                                if (wsi->u.http2.send_END_STREAM)
                                        flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
-                       
-                       if ((protocol == LWS_WRITE_HTTP || protocol == LWS_WRITE_HTTP_FINAL) && wsi->u.http.content_length) {
+
+                       if ((wp == LWS_WRITE_HTTP ||
+                            wp == LWS_WRITE_HTTP_FINAL) &&
+                           wsi->u.http.content_length) {
                                wsi->u.http.content_remain -= len;
-                               lwsl_info("%s: content_remain = %lu\n", __func__, wsi->u.http.content_remain);
+                               lwsl_info("%s: content_remain = %lu\n", __func__,
+                                         wsi->u.http.content_remain);
                                if (!wsi->u.http.content_remain) {
                                        lwsl_info("%s: selecting final write mode\n", __func__);
-                                       protocol = LWS_WRITE_HTTP_FINAL;
+                                       wp = LWS_WRITE_HTTP_FINAL;
                                }
                        }
-                       
-                       if (protocol == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
+
+                       if (wp == LWS_WRITE_HTTP_FINAL && wsi->u.http2.END_STREAM) {
                                lwsl_info("%s: setting END_STREAM\n", __func__);
                                flags |= LWS_HTTP2_FLAG_END_STREAM;
                        }
 
-                       return lws_http2_frame_write(wsi, n, flags, wsi->u.http2.my_stream_id, len, buf);
+                       return lws_http2_frame_write(wsi, n, flags,
+                                       wsi->u.http2.my_stream_id, len, buf);
                }
 #endif
-               return lws_issue_raw(wsi, (unsigned char *)buf - pre,
-                                                             len + pre + post);
+               return lws_issue_raw(wsi, (unsigned char *)buf - pre, len + pre);
        default:
                break;
        }
 
-       wsi->u.ws.inside_frame = 1;
-
        /*
         * give any active extensions a chance to munge the buffer
         * before send.  We pass in a pointer to an lws_tokens struct
@@ -492,11 +525,12 @@ send_raw:
         * return to the user code how much OF THE USER BUFFER was consumed.
         */
 
-       n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre + post);
+       n = lws_issue_raw_ext_access(wsi, buf - pre, len + pre);
+       wsi->u.ws.inside_frame = 1;
        if (n <= 0)
                return n;
 
-       if (n == len + pre + post) {
+       if (n == (int)len + pre) {
                /* everything in the buffer was handled (or rebuffered...) */
                wsi->u.ws.inside_frame = 0;
                return orig_len;
@@ -505,26 +539,26 @@ send_raw:
        /*
         * it is how many bytes of user buffer got sent... may be < orig_len
         * in which case callback when writable has already been arranged
-        * and user code can call libwebsocket_write() again with the rest
+        * and user code can call lws_write() again with the rest
         * later.
         */
 
-       return n - (pre + post);
+       return n - pre;
 }
 
-LWS_VISIBLE int libwebsockets_serve_http_file_fragment(
-               struct libwebsocket_context *context, struct libwebsocket *wsi)
+LWS_VISIBLE int lws_serve_http_file_fragment(struct lws *wsi)
 {
-       int n;
-       int m;
+       struct lws_context *context = wsi->context;
+       struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
+       unsigned long amount;
+       int n, m;
 
        while (!lws_send_pipe_choked(wsi)) {
-
-               if (wsi->truncated_send_len) {
-                       if (lws_issue_raw(wsi, wsi->truncated_send_malloc +
-                                       wsi->truncated_send_offset,
-                                                      wsi->truncated_send_len) < 0) {
-                               lwsl_info("closing from libwebsockets_serve_http_file_fragment\n");
+               if (wsi->trunc_len) {
+                       if (lws_issue_raw(wsi, wsi->trunc_alloc +
+                                         wsi->trunc_offset,
+                                         wsi->trunc_len) < 0) {
+                               lwsl_info("%s: closing\n", __func__);
                                return -1;
                        }
                        continue;
@@ -533,63 +567,81 @@ LWS_VISIBLE int libwebsockets_serve_http_file_fragment(
                if (wsi->u.http.filepos == wsi->u.http.filelen)
                        goto all_sent;
 
-               compatible_file_read(n, wsi->u.http.fd, context->service_buffer,
-                                              sizeof(context->service_buffer));
-               if (n < 0)
+               if (lws_plat_file_read(wsi, wsi->u.http.fd, &amount,
+                                      pt->serv_buf,
+                                      LWS_MAX_SOCKET_IO_BUF) < 0)
                        return -1; /* caller will close */
+
+               n = (int)amount;
                if (n) {
+                       lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_CONTENT,
+                                       context->timeout_secs);
                        wsi->u.http.filepos += n;
-                       m = libwebsocket_write(wsi, context->service_buffer, n,
-                                              wsi->u.http.filepos == wsi->u.http.filelen ? LWS_WRITE_HTTP_FINAL : LWS_WRITE_HTTP);
+                       m = lws_write(wsi, pt->serv_buf, n,
+                                     wsi->u.http.filepos == wsi->u.http.filelen ?
+                                       LWS_WRITE_HTTP_FINAL : LWS_WRITE_HTTP);
                        if (m < 0)
                                return -1;
 
                        if (m != n)
                                /* adjust for what was not sent */
-                               if (compatible_file_seek_cur(wsi->u.http.fd, m - n) < 0)
+                               if (lws_plat_file_seek_cur(wsi, wsi->u.http.fd,
+                                                          m - n) ==
+                                                            (unsigned long)-1)
                                        return -1;
                }
 all_sent:
-               if (!wsi->truncated_send_len &&
-                               wsi->u.http.filepos == wsi->u.http.filelen) {
-                       wsi->state = WSI_STATE_HTTP;
+               if (!wsi->trunc_len && wsi->u.http.filepos == wsi->u.http.filelen) {
+                       wsi->state = LWSS_HTTP;
+
+                       /* we might be in keepalive, so close it off here */
+                       lws_plat_file_close(wsi, wsi->u.http.fd);
+                       wsi->u.http.fd = LWS_INVALID_FILE;
 
                        if (wsi->protocol->callback)
                                /* ignore callback returned value */
-                               user_callback_handle_rxflow(
-                                       wsi->protocol->callback, context, wsi,
-                                       LWS_CALLBACK_HTTP_FILE_COMPLETION,
-                                       wsi->user_space, NULL, 0);
+                               if (user_callback_handle_rxflow(
+                                    wsi->protocol->callback, wsi,
+                                    LWS_CALLBACK_HTTP_FILE_COMPLETION,
+                                    wsi->user_space, NULL, 0) < 0)
+                                       return -1;
                        return 1;  /* >0 indicates completed */
                }
        }
 
        lwsl_info("choked before able to send whole file (post)\n");
-       libwebsocket_callback_on_writable(context, wsi);
+       lws_callback_on_writable(wsi);
 
        return 0; /* indicates further processing must be done */
 }
 
+#if LWS_POSIX
 LWS_VISIBLE int
-lws_ssl_capable_read_no_ssl(struct libwebsocket_context *context,
-                           struct libwebsocket *wsi, unsigned char *buf, int len)
+lws_ssl_capable_read_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 {
        int n;
 
-       n = recv(wsi->sock, buf, len, 0);
+       n = recv(wsi->sock, (char *)buf, len, 0);
        if (n >= 0)
                return n;
-
+#if LWS_POSIX
+       if (LWS_ERRNO == LWS_EAGAIN ||
+           LWS_ERRNO == LWS_EWOULDBLOCK ||
+           LWS_ERRNO == LWS_EINTR)
+               return LWS_SSL_CAPABLE_MORE_SERVICE;
+#endif
        lwsl_warn("error on reading from skt\n");
        return LWS_SSL_CAPABLE_ERROR;
 }
 
 LWS_VISIBLE int
-lws_ssl_capable_write_no_ssl(struct libwebsocket *wsi, unsigned char *buf, int len)
+lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 {
-       int n;
-       
-       n = send(wsi->sock, buf, len, 0);
+       int n = 0;
+
+#if LWS_POSIX
+       n = send(wsi->sock, (char *)buf, len, MSG_NOSIGNAL);
+//     lwsl_info("%s: sent len %d result %d", __func__, len, n);
        if (n >= 0)
                return n;
 
@@ -601,6 +653,21 @@ lws_ssl_capable_write_no_ssl(struct libwebsocket *wsi, unsigned char *buf, int l
 
                return LWS_SSL_CAPABLE_MORE_SERVICE;
        }
-       lwsl_debug("ERROR writing len %d to skt %d\n", len, n);
+#else
+       (void)n;
+       (void)wsi;
+       (void)buf;
+       (void)len;
+       // !!!
+#endif
+
+       lwsl_debug("ERROR writing len %d to skt fd %d err %d / errno %d\n", len, wsi->sock, n, LWS_ERRNO);
        return LWS_SSL_CAPABLE_ERROR;
 }
+#endif
+LWS_VISIBLE int
+lws_ssl_pending_no_ssl(struct lws *wsi)
+{
+       (void)wsi;
+       return 0;
+}