lib/parsers.c

   1 /*
   2  * libwebsockets - small server side websockets and web server implementation
   3  *
   4  * Copyright (C) 2010-2013 Andy Green <andy@warmcat.com>
   5  *
   6  *  This library is free software; you can redistribute it and/or
   7  *  modify it under the terms of the GNU Lesser General Public
   8  *  License as published by the Free Software Foundation:
   9  *  version 2.1 of the License.
  10  *
  11  *  This library is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  *  Lesser General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Lesser General Public
  17  *  License along with this library; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  19  *  MA  02110-1301  USA
  20  */
  21
  22 #include "private-libwebsockets.h"
  23
  24 const unsigned char lextable[] = {
  25         #include "lextable.h"
  26 };
  27
  28 #define FAIL_CHAR 0x08
  29
  30 int LWS_WARN_UNUSED_RESULT
  31 lextable_decode(int pos, char c)
  32 {
  33         if (c >= 'A' && c <= 'Z')
  34                 c += 'a' - 'A';
  35
  36         while (1) {
  37                 if (lextable[pos] & (1 << 7)) { /* 1-byte, fail on mismatch */
  38                         if ((lextable[pos] & 0x7f) != c)
  39                                 return -1;
  40                         /* fall thru */
  41                         pos++;
  42                         if (lextable[pos] == FAIL_CHAR)
  43                                 return -1;
  44                         return pos;
  45                 }
  46
  47                 if (lextable[pos] == FAIL_CHAR)
  48                         return -1;
  49
  50                 /* b7 = 0, end or 3-byte */
  51                 if (lextable[pos] < FAIL_CHAR) /* terminal marker */
  52                         return pos;
  53
  54                 if (lextable[pos] == c) /* goto */
  55                         return pos + (lextable[pos + 1]) +
  56                                                 (lextable[pos + 2] << 8);
  57                 /* fall thru goto */
  58                 pos += 3;
  59                 /* continue */
  60         }
  61 }
  62
  63 void
  64 _lws_header_table_reset(struct allocated_headers *ah)
  65 {
  66         /* init the ah to reflect no headers or data have appeared yet */
  67         memset(ah->frag_index, 0, sizeof(ah->frag_index));
  68         ah->nfrag = 0;
  69         ah->pos = 0;
  70         ah->http_response = 0;
  71 }
  72
  73 // doesn't scrub the ah rxbuffer by default, parent must do if needed
  74
  75 void
  76 lws_header_table_reset(struct lws *wsi, int autoservice)
  77 {
  78         struct allocated_headers *ah = wsi->u.hdr.ah;
  79         struct lws_context_per_thread *pt;
  80         struct lws_pollfd *pfd;
  81
  82         /* if we have the idea we're resetting 'our' ah, must be bound to one */
  83         assert(ah);
  84         /* ah also concurs with ownership */
  85         assert(ah->wsi == wsi);
  86
  87         _lws_header_table_reset(ah);
  88
  89         wsi->u.hdr.parser_state = WSI_TOKEN_NAME_PART;
  90         wsi->u.hdr.lextable_pos = 0;
  91
  92         /* since we will restart the ah, our new headers are not completed */
  93         wsi->hdr_parsing_completed = 0;
  94
  95         /*
  96          * if we inherited pending rx (from socket adoption deferred
  97          * processing), apply and free it.
  98          */
  99         if (wsi->u.hdr.preamble_rx) {
 100                 memcpy(ah->rx, wsi->u.hdr.preamble_rx,
 101                        wsi->u.hdr.preamble_rx_len);
 102                 ah->rxlen = wsi->u.hdr.preamble_rx_len;
 103                 lws_free_set_NULL(wsi->u.hdr.preamble_rx);
 104
 105                 if (autoservice) {
 106                         lwsl_notice("%s: calling service on readbuf ah\n", __func__);
 107
 108                         pt = &wsi->context->pt[(int)wsi->tsi];
 109
 110                         /* unlike a normal connect, we have the headers already
 111                          * (or the first part of them anyway)
 112                          */
 113                         pfd = &pt->fds[wsi->position_in_fds_table];
 114                         pfd->revents |= LWS_POLLIN;
 115                         lwsl_err("%s: calling service\n", __func__);
 116                         lws_service_fd_tsi(wsi->context, pfd, wsi->tsi);
 117                 }
 118         }
 119 }
 120
 121 int LWS_WARN_UNUSED_RESULT
 122 lws_header_table_attach(struct lws *wsi, int autoservice)
 123 {
 124         struct lws_context *context = wsi->context;
 125         struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 126         struct lws_pollargs pa;
 127         struct lws **pwsi;
 128         int n;
 129
 130         lwsl_info("%s: wsi %p: ah %p (tsi %d, count = %d) in\n", __func__, (void *)wsi,
 131                  (void *)wsi->u.hdr.ah, wsi->tsi, pt->ah_count_in_use);
 132
 133         /* if we are already bound to one, just clear it down */
 134         if (wsi->u.hdr.ah) {
 135                 lwsl_info("cleardown\n");
 136                 goto reset;
 137         }
 138
 139         lws_pt_lock(pt);
 140         pwsi = &pt->ah_wait_list;
 141         while (*pwsi) {
 142                 if (*pwsi == wsi) {
 143                         /* if already waiting on list, if no new ah just ret */
 144                         if (pt->ah_count_in_use ==
 145                             context->max_http_header_pool) {
 146                                 lwsl_notice("%s: no free ah to attach\n", __func__);
 147                                 goto bail;
 148                         }
 149                         /* new ah.... remove ourselves from waiting list */
 150                         *pwsi = wsi->u.hdr.ah_wait_list; /* set our prev to our next */
 151                         wsi->u.hdr.ah_wait_list = NULL; /* no next any more */
 152                         pt->ah_wait_list_length--;
 153                         break;
 154                 }
 155                 pwsi = &(*pwsi)->u.hdr.ah_wait_list;
 156         }
 157         /*
 158          * pool is all busy... add us to waiting list and return that we
 159          * weren't able to deliver it right now
 160          */
 161         if (pt->ah_count_in_use == context->max_http_header_pool) {
 162                 lwsl_info("%s: adding %p to ah waiting list\n", __func__, wsi);
 163                 wsi->u.hdr.ah_wait_list = pt->ah_wait_list;
 164                 pt->ah_wait_list = wsi;
 165                 pt->ah_wait_list_length++;
 166
 167                 /* we cannot accept input then */
 168
 169                 _lws_change_pollfd(wsi, LWS_POLLIN, 0, &pa);
 170                 goto bail;
 171         }
 172
 173         for (n = 0; n < context->max_http_header_pool; n++)
 174                 if (!pt->ah_pool[n].in_use)
 175                         break;
 176
 177         /* if the count of in use said something free... */
 178         assert(n != context->max_http_header_pool);
 179
 180         wsi->u.hdr.ah = &pt->ah_pool[n];
 181         wsi->u.hdr.ah->in_use = 1;
 182         pt->ah_pool[n].wsi = wsi; /* mark our owner */
 183         pt->ah_count_in_use++;
 184
 185         _lws_change_pollfd(wsi, 0, LWS_POLLIN, &pa);
 186
 187         lwsl_info("%s: did attach wsi %p: ah %p: count %d (on exit)\n", __func__,
 188                   (void *)wsi, (void *)wsi->u.hdr.ah, pt->ah_count_in_use);
 189
 190         lws_pt_unlock(pt);
 191
 192 reset:
 193
 194         /* and reset the rx state */
 195         wsi->u.hdr.ah->rxpos = 0;
 196         wsi->u.hdr.ah->rxlen = 0;
 197
 198         lws_header_table_reset(wsi, autoservice);
 199         time(&wsi->u.hdr.ah->assigned);
 200
 201 #ifndef LWS_NO_CLIENT
 202         if (wsi->state == LWSS_CLIENT_UNCONNECTED)
 203                 if (!lws_client_connect_via_info2(wsi))
 204                         /* our client connect has failed, the wsi
 205                          * has been closed
 206                          */
 207                         return -1;
 208 #endif
 209
 210         return 0;
 211
 212 bail:
 213         lws_pt_unlock(pt);
 214
 215         return 1;
 216 }
 217
 218 void
 219 lws_header_table_force_to_detachable_state(struct lws *wsi)
 220 {
 221         if (wsi->u.hdr.ah) {
 222                 wsi->u.hdr.ah->rxpos = -1;
 223                 wsi->u.hdr.ah->rxlen = -1;
 224                 wsi->hdr_parsing_completed = 1;
 225         }
 226 }
 227
 228 int
 229 lws_header_table_is_in_detachable_state(struct lws *wsi)
 230 {
 231         struct allocated_headers *ah = wsi->u.hdr.ah;
 232
 233         return ah && ah->rxpos == ah->rxlen && wsi->hdr_parsing_completed;
 234 }
 235
 236 int lws_header_table_detach(struct lws *wsi, int autoservice)
 237 {
 238         struct lws_context *context = wsi->context;
 239         struct allocated_headers *ah = wsi->u.hdr.ah;
 240         struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 241         struct lws_pollargs pa;
 242         struct lws **pwsi;
 243         time_t now;
 244
 245         if (!ah)
 246                 return 0;
 247
 248         lwsl_info("%s: wsi %p: ah %p (tsi=%d, count = %d)\n", __func__,
 249                   (void *)wsi, (void *)ah, wsi->tsi,
 250                   pt->ah_count_in_use);
 251
 252         if (wsi->u.hdr.preamble_rx)
 253                 lws_free_set_NULL(wsi->u.hdr.preamble_rx);
 254
 255         /* may not be detached while he still has unprocessed rx */
 256         if (!lws_header_table_is_in_detachable_state(wsi)) {
 257                 lwsl_err("%s: %p: CANNOT DETACH rxpos:%d, rxlen:%d, wsi->hdr_parsing_completed = %d\n", __func__, wsi,
 258                                 ah->rxpos, ah->rxlen, wsi->hdr_parsing_completed);
 259                 return 0;
 260         }
 261
 262         lws_pt_lock(pt);
 263
 264         pwsi = &pt->ah_wait_list;
 265         if (!ah) { /* remove from wait list if none attached */
 266                 while (*pwsi) {
 267                         if (*pwsi == wsi) {
 268                                 lwsl_info("%s: wsi %p, remv wait\n",
 269                                           __func__, wsi);
 270                                 *pwsi = wsi->u.hdr.ah_wait_list;
 271                                 wsi->u.hdr.ah_wait_list = NULL;
 272                                 pt->ah_wait_list_length--;
 273                                 goto bail;
 274                         }
 275                         pwsi = &(*pwsi)->u.hdr.ah_wait_list;
 276                 }
 277                 /* no ah, not on list... no more business here */
 278                 goto bail;
 279         }
 280         /* we did have an ah attached */
 281         time(&now);
 282         if (ah->assigned && now - ah->assigned > 3) {
 283                 /*
 284                  * we're detaching the ah, but it was held an
 285                  * unreasonably long time
 286                  */
 287                 lwsl_notice("%s: wsi %p: ah held %ds, "
 288                             "ah.rxpos %d, ah.rxlen %d, mode/state %d %d,"
 289                             "wsi->more_rx_waiting %d\n", __func__, wsi,
 290                             (int)(now - ah->assigned),
 291                             ah->rxpos, ah->rxlen, wsi->mode, wsi->state,
 292                             wsi->more_rx_waiting);
 293         }
 294
 295         ah->assigned = 0;
 296
 297         /* if we think we're detaching one, there should be one in use */
 298         assert(pt->ah_count_in_use > 0);
 299         /* and this specific one should have been in use */
 300         assert(ah->in_use);
 301         wsi->u.hdr.ah = NULL;
 302         ah->wsi = NULL; /* no owner */
 303
 304         /* oh there is nobody on the waiting list... leave it at that then */
 305         if (!*pwsi) {
 306                 ah->in_use = 0;
 307                 pt->ah_count_in_use--;
 308
 309                 goto bail;
 310         }
 311
 312         /* somebody else on same tsi is waiting, give it to oldest guy */
 313
 314         lwsl_info("pt wait list %p\n", *pwsi);
 315         while ((*pwsi)->u.hdr.ah_wait_list)
 316                 pwsi = &(*pwsi)->u.hdr.ah_wait_list;
 317
 318         wsi = *pwsi;
 319         lwsl_info("last wsi in wait list %p\n", wsi);
 320
 321         wsi->u.hdr.ah = ah;
 322         ah->wsi = wsi; /* new owner */
 323         /* and reset the rx state */
 324         ah->rxpos = 0;
 325         ah->rxlen = 0;
 326         lws_header_table_reset(wsi, autoservice);
 327         time(&wsi->u.hdr.ah->assigned);
 328
 329         /* clients acquire the ah and then insert themselves in fds table... */
 330         if (wsi->position_in_fds_table != -1) {
 331                 lwsl_info("%s: Enabling %p POLLIN\n", __func__, wsi);
 332
 333                 /* he has been stuck waiting for an ah, but now his wait is over,
 334                  * let him progress
 335                  */
 336                 _lws_change_pollfd(wsi, 0, LWS_POLLIN, &pa);
 337         }
 338
 339         /* point prev guy to next guy in list instead */
 340         *pwsi = wsi->u.hdr.ah_wait_list;
 341         /* the guy who got one is out of the list */
 342         wsi->u.hdr.ah_wait_list = NULL;
 343         pt->ah_wait_list_length--;
 344
 345 #ifndef LWS_NO_CLIENT
 346         if (wsi->state == LWSS_CLIENT_UNCONNECTED) {
 347                 lws_pt_unlock(pt);
 348
 349                 if (!lws_client_connect_via_info2(wsi)) {
 350                         /* our client connect has failed, the wsi
 351                          * has been closed
 352                          */
 353
 354                         return -1;
 355                 }
 356                 return 0;
 357         }
 358 #endif
 359
 360         assert(!!pt->ah_wait_list_length == !!(lws_intptr_t)pt->ah_wait_list);
 361 bail:
 362         lwsl_info("%s: wsi %p: ah %p (tsi=%d, count = %d)\n", __func__,
 363           (void *)wsi, (void *)ah, wsi->tsi,
 364           pt->ah_count_in_use);
 365         lws_pt_unlock(pt);
 366
 367         return 0;
 368 }
 369
 370 LWS_VISIBLE int
 371 lws_hdr_fragment_length(struct lws *wsi, enum lws_token_indexes h, int frag_idx)
 372 {
 373         int n;
 374
 375         n = wsi->u.hdr.ah->frag_index[h];
 376         if (!n)
 377                 return 0;
 378         do {
 379                 if (!frag_idx)
 380                         return wsi->u.hdr.ah->frags[n].len;
 381                 n = wsi->u.hdr.ah->frags[n].nfrag;
 382         } while (frag_idx-- && n);
 383
 384         return 0;
 385 }
 386
 387 LWS_VISIBLE int lws_hdr_total_length(struct lws *wsi, enum lws_token_indexes h)
 388 {
 389         int n;
 390         int len = 0;
 391
 392         n = wsi->u.hdr.ah->frag_index[h];
 393         if (!n)
 394                 return 0;
 395         do {
 396                 len += wsi->u.hdr.ah->frags[n].len;
 397                 n = wsi->u.hdr.ah->frags[n].nfrag;
 398         } while (n);
 399
 400         return len;
 401 }
 402
 403 LWS_VISIBLE int lws_hdr_copy_fragment(struct lws *wsi, char *dst, int len,
 404                                       enum lws_token_indexes h, int frag_idx)
 405 {
 406         int n = 0;
 407         int f = wsi->u.hdr.ah->frag_index[h];
 408
 409         if (!f)
 410                 return -1;
 411
 412         while (n < frag_idx) {
 413                 f = wsi->u.hdr.ah->frags[f].nfrag;
 414                 if (!f)
 415                         return -1;
 416                 n++;
 417         }
 418
 419         if (wsi->u.hdr.ah->frags[f].len >= len)
 420                 return -1;
 421
 422         memcpy(dst, wsi->u.hdr.ah->data + wsi->u.hdr.ah->frags[f].offset,
 423                wsi->u.hdr.ah->frags[f].len);
 424         dst[wsi->u.hdr.ah->frags[f].len] = '\0';
 425
 426         return wsi->u.hdr.ah->frags[f].len;
 427 }
 428
 429 LWS_VISIBLE int lws_hdr_copy(struct lws *wsi, char *dst, int len,
 430                              enum lws_token_indexes h)
 431 {
 432         int toklen = lws_hdr_total_length(wsi, h);
 433         int n;
 434
 435         if (toklen >= len)
 436                 return -1;
 437
 438         n = wsi->u.hdr.ah->frag_index[h];
 439         if (!n)
 440                 return 0;
 441
 442         do {
 443                 strcpy(dst, &wsi->u.hdr.ah->data[wsi->u.hdr.ah->frags[n].offset]);
 444                 dst += wsi->u.hdr.ah->frags[n].len;
 445                 n = wsi->u.hdr.ah->frags[n].nfrag;
 446         } while (n);
 447
 448         return toklen;
 449 }
 450
 451 char *lws_hdr_simple_ptr(struct lws *wsi, enum lws_token_indexes h)
 452 {
 453         int n;
 454
 455         n = wsi->u.hdr.ah->frag_index[h];
 456         if (!n)
 457                 return NULL;
 458
 459         return wsi->u.hdr.ah->data + wsi->u.hdr.ah->frags[n].offset;
 460 }
 461
 462 int LWS_WARN_UNUSED_RESULT
 463 lws_pos_in_bounds(struct lws *wsi)
 464 {
 465         if (wsi->u.hdr.ah->pos < (unsigned int)wsi->context->max_http_header_data)
 466                 return 0;
 467
 468         if (wsi->u.hdr.ah->pos == wsi->context->max_http_header_data) {
 469                 lwsl_err("Ran out of header data space\n");
 470                 return 1;
 471         }
 472
 473         /*
 474          * with these tests everywhere, it should never be able to exceed
 475          * the limit, only meet the limit
 476          */
 477
 478         lwsl_err("%s: pos %d, limit %d\n", __func__, wsi->u.hdr.ah->pos,
 479                  wsi->context->max_http_header_data);
 480         assert(0);
 481
 482         return 1;
 483 }
 484
 485 int LWS_WARN_UNUSED_RESULT
 486 lws_hdr_simple_create(struct lws *wsi, enum lws_token_indexes h, const char *s)
 487 {
 488         wsi->u.hdr.ah->nfrag++;
 489         if (wsi->u.hdr.ah->nfrag == ARRAY_SIZE(wsi->u.hdr.ah->frags)) {
 490                 lwsl_warn("More hdr frags than we can deal with, dropping\n");
 491                 return -1;
 492         }
 493
 494         wsi->u.hdr.ah->frag_index[h] = wsi->u.hdr.ah->nfrag;
 495
 496         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].offset = wsi->u.hdr.ah->pos;
 497         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len = 0;
 498         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].nfrag = 0;
 499
 500         do {
 501                 if (lws_pos_in_bounds(wsi))
 502                         return -1;
 503
 504                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = *s;
 505                 if (*s)
 506                         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len++;
 507         } while (*s++);
 508
 509         return 0;
 510 }
 511
 512 signed char char_to_hex(const char c)
 513 {
 514         if (c >= '0' && c <= '9')
 515                 return c - '0';
 516
 517         if (c >= 'a' && c <= 'f')
 518                 return c - 'a' + 10;
 519
 520         if (c >= 'A' && c <= 'F')
 521                 return c - 'A' + 10;
 522
 523         return -1;
 524 }
 525
 526 static int LWS_WARN_UNUSED_RESULT
 527 issue_char(struct lws *wsi, unsigned char c)
 528 {
 529         unsigned short frag_len;
 530
 531         if (lws_pos_in_bounds(wsi))
 532                 return -1;
 533
 534         frag_len = wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len;
 535         /*
 536          * If we haven't hit the token limit, just copy the character into
 537          * the header
 538          */
 539         if (frag_len < wsi->u.hdr.current_token_limit) {
 540                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = c;
 541                 if (c)
 542                         wsi->u.hdr.ah->frags[wsi->u.hdr.ah->nfrag].len++;
 543                 return 0;
 544         }
 545
 546         /* Insert a null character when we *hit* the limit: */
 547         if (frag_len == wsi->u.hdr.current_token_limit) {
 548                 if (lws_pos_in_bounds(wsi))
 549                         return -1;
 550                 wsi->u.hdr.ah->data[wsi->u.hdr.ah->pos++] = '\0';
 551                 lwsl_warn("header %i exceeds limit %d\n",
 552                           wsi->u.hdr.parser_state,
 553                           wsi->u.hdr.current_token_limit);
 554         }
 555
 556         return 1;
 557 }
 558
 559 int LWS_WARN_UNUSED_RESULT
 560 lws_parse(struct lws *wsi, unsigned char c)
 561 {
 562         static const unsigned char methods[] = {
 563                 WSI_TOKEN_GET_URI,
 564                 WSI_TOKEN_POST_URI,
 565                 WSI_TOKEN_OPTIONS_URI,
 566                 WSI_TOKEN_PUT_URI,
 567                 WSI_TOKEN_PATCH_URI,
 568                 WSI_TOKEN_DELETE_URI,
 569                 WSI_TOKEN_CONNECT,
 570         };
 571         struct allocated_headers *ah = wsi->u.hdr.ah;
 572         struct lws_context *context = wsi->context;
 573         unsigned int n, m, enc = 0;
 574
 575         assert(wsi->u.hdr.ah);
 576
 577         switch (wsi->u.hdr.parser_state) {
 578         default:
 579
 580                 lwsl_parser("WSI_TOK_(%d) '%c'\n", wsi->u.hdr.parser_state, c);
 581
 582                 /* collect into malloc'd buffers */
 583                 /* optional initial space swallow */
 584                 if (!ah->frags[ah->frag_index[wsi->u.hdr.parser_state]].len &&
 585                     c == ' ')
 586                         break;
 587
 588                 for (m = 0; m < ARRAY_SIZE(methods); m++)
 589                         if (wsi->u.hdr.parser_state == methods[m])
 590                                 break;
 591                 if (m == ARRAY_SIZE(methods))
 592                         /* it was not any of the methods */
 593                         goto check_eol;
 594
 595                 /* special URI processing... end at space */
 596
 597                 if (c == ' ') {
 598                         /* enforce starting with / */
 599                         if (!ah->frags[ah->nfrag].len)
 600                                 if (issue_char(wsi, '/') < 0)
 601                                         return -1;
 602
 603                         if (wsi->u.hdr.ups == URIPS_SEEN_SLASH_DOT_DOT) {
 604                                 /*
 605                                  * back up one dir level if possible
 606                                  * safe against header fragmentation because
 607                                  * the method URI can only be in 1 fragment
 608                                  */
 609                                 if (ah->frags[ah->nfrag].len > 2) {
 610                                         ah->pos--;
 611                                         ah->frags[ah->nfrag].len--;
 612                                         do {
 613                                                 ah->pos--;
 614                                                 ah->frags[ah->nfrag].len--;
 615                                         } while (ah->frags[ah->nfrag].len > 1 &&
 616                                                  ah->data[ah->pos] != '/');
 617                                 }
 618                         }
 619
 620                         /* begin parsing HTTP version: */
 621                         if (issue_char(wsi, '\0') < 0)
 622                                 return -1;
 623                         wsi->u.hdr.parser_state = WSI_TOKEN_HTTP;
 624                         goto start_fragment;
 625                 }
 626
 627                 /*
 628                  * PRIORITY 1
 629                  * special URI processing... convert %xx
 630                  */
 631
 632                 switch (wsi->u.hdr.ues) {
 633                 case URIES_IDLE:
 634                         if (c == '%') {
 635                                 wsi->u.hdr.ues = URIES_SEEN_PERCENT;
 636                                 goto swallow;
 637                         }
 638                         break;
 639                 case URIES_SEEN_PERCENT:
 640                         if (char_to_hex(c) < 0)
 641                                 /* illegal post-% char */
 642                                 goto forbid;
 643
 644                         wsi->u.hdr.esc_stash = c;
 645                         wsi->u.hdr.ues = URIES_SEEN_PERCENT_H1;
 646                         goto swallow;
 647
 648                 case URIES_SEEN_PERCENT_H1:
 649                         if (char_to_hex(c) < 0)
 650                                 /* illegal post-% char */
 651                                 goto forbid;
 652
 653                         c = (char_to_hex(wsi->u.hdr.esc_stash) << 4) |
 654                                         char_to_hex(c);
 655                         enc = 1;
 656                         wsi->u.hdr.ues = URIES_IDLE;
 657                         break;
 658                 }
 659
 660                 /*
 661                  * PRIORITY 2
 662                  * special URI processing...
 663                  *  convert /.. or /... or /../ etc to /
 664                  *  convert /./ to /
 665                  *  convert // or /// etc to /
 666                  *  leave /.dir or whatever alone
 667                  */
 668
 669                 switch (wsi->u.hdr.ups) {
 670                 case URIPS_IDLE:
 671                         if (!c)
 672                                 return -1;
 673                         /* genuine delimiter */
 674                         if ((c == '&' || c == ';') && !enc) {
 675                                 if (issue_char(wsi, c) < 0)
 676                                         return -1;
 677                                 /* swallow the terminator */
 678                                 ah->frags[ah->nfrag].len--;
 679                                 /* link to next fragment */
 680                                 ah->frags[ah->nfrag].nfrag = ah->nfrag + 1;
 681                                 ah->nfrag++;
 682                                 if (ah->nfrag >= ARRAY_SIZE(ah->frags))
 683                                         goto excessive;
 684                                 /* start next fragment after the & */
 685                                 wsi->u.hdr.post_literal_equal = 0;
 686                                 ah->frags[ah->nfrag].offset = ah->pos;
 687                                 ah->frags[ah->nfrag].len = 0;
 688                                 ah->frags[ah->nfrag].nfrag = 0;
 689                                 goto swallow;
 690                         }
 691                         /* uriencoded = in the name part, disallow */
 692                         if (c == '=' && enc &&
 693                             ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS] &&
 694                             !wsi->u.hdr.post_literal_equal)
 695                                 c = '_';
 696
 697                         /* after the real =, we don't care how many = */
 698                         if (c == '=' && !enc)
 699                                 wsi->u.hdr.post_literal_equal = 1;
 700
 701                         /* + to space */
 702                         if (c == '+' && !enc)
 703                                 c = ' ';
 704                         /* issue the first / always */
 705                         if (c == '/' && !ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS])
 706                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 707                         break;
 708                 case URIPS_SEEN_SLASH:
 709                         /* swallow subsequent slashes */
 710                         if (c == '/')
 711                                 goto swallow;
 712                         /* track and swallow the first . after / */
 713                         if (c == '.') {
 714                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH_DOT;
 715                                 goto swallow;
 716                         }
 717                         wsi->u.hdr.ups = URIPS_IDLE;
 718                         break;
 719                 case URIPS_SEEN_SLASH_DOT:
 720                         /* swallow second . */
 721                         if (c == '.') {
 722                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH_DOT_DOT;
 723                                 goto swallow;
 724                         }
 725                         /* change /./ to / */
 726                         if (c == '/') {
 727                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 728                                 goto swallow;
 729                         }
 730                         /* it was like /.dir ... regurgitate the . */
 731                         wsi->u.hdr.ups = URIPS_IDLE;
 732                         if (issue_char(wsi, '.') < 0)
 733                                 return -1;
 734                         break;
 735
 736                 case URIPS_SEEN_SLASH_DOT_DOT:
 737
 738                         /* /../ or /..[End of URI] --> backup to last / */
 739                         if (c == '/' || c == '?') {
 740                                 /*
 741                                  * back up one dir level if possible
 742                                  * safe against header fragmentation because
 743                                  * the method URI can only be in 1 fragment
 744                                  */
 745                                 if (ah->frags[ah->nfrag].len > 2) {
 746                                         ah->pos--;
 747                                         ah->frags[ah->nfrag].len--;
 748                                         do {
 749                                                 ah->pos--;
 750                                                 ah->frags[ah->nfrag].len--;
 751                                         } while (ah->frags[ah->nfrag].len > 1 &&
 752                                                  ah->data[ah->pos] != '/');
 753                                 }
 754                                 wsi->u.hdr.ups = URIPS_SEEN_SLASH;
 755                                 if (ah->frags[ah->nfrag].len > 1)
 756                                         break;
 757                                 goto swallow;
 758                         }
 759
 760                         /*  /..[^/] ... regurgitate and allow */
 761
 762                         if (issue_char(wsi, '.') < 0)
 763                                 return -1;
 764                         if (issue_char(wsi, '.') < 0)
 765                                 return -1;
 766                         wsi->u.hdr.ups = URIPS_IDLE;
 767                         break;
 768                 }
 769
 770                 if (c == '?' && !enc &&
 771                     !ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS]) { /* start of URI arguments */
 772                         if (wsi->u.hdr.ues != URIES_IDLE)
 773                                 goto forbid;
 774
 775                         /* seal off uri header */
 776                         if (issue_char(wsi, '\0') < 0)
 777                                 return -1;
 778
 779                         /* move to using WSI_TOKEN_HTTP_URI_ARGS */
 780                         ah->nfrag++;
 781                         if (ah->nfrag >= ARRAY_SIZE(ah->frags))
 782                                 goto excessive;
 783                         ah->frags[ah->nfrag].offset = ah->pos;
 784                         ah->frags[ah->nfrag].len = 0;
 785                         ah->frags[ah->nfrag].nfrag = 0;
 786
 787                         wsi->u.hdr.post_literal_equal = 0;
 788                         ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS] = ah->nfrag;
 789                         wsi->u.hdr.ups = URIPS_IDLE;
 790                         goto swallow;
 791                 }
 792
 793 check_eol:
 794                 /* bail at EOL */
 795                 if (wsi->u.hdr.parser_state != WSI_TOKEN_CHALLENGE &&
 796                     c == '\x0d') {
 797                         if (wsi->u.hdr.ues != URIES_IDLE)
 798                                 goto forbid;
 799
 800                         c = '\0';
 801                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING_SAW_CR;
 802                         lwsl_parser("*\n");
 803                 }
 804
 805                 n = issue_char(wsi, c);
 806                 if ((int)n < 0)
 807                         return -1;
 808                 if (n > 0)
 809                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 810
 811 swallow:
 812                 /* per-protocol end of headers management */
 813
 814                 if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE)
 815                         goto set_parsing_complete;
 816                 break;
 817
 818                 /* collecting and checking a name part */
 819         case WSI_TOKEN_NAME_PART:
 820                 lwsl_parser("WSI_TOKEN_NAME_PART '%c' (mode=%d)\n", c, wsi->mode);
 821
 822                 wsi->u.hdr.lextable_pos =
 823                                 lextable_decode(wsi->u.hdr.lextable_pos, c);
 824                 /*
 825                  * Server needs to look out for unknown methods...
 826                  */
 827                 if (wsi->u.hdr.lextable_pos < 0 &&
 828                     wsi->mode == LWSCM_HTTP_SERVING) {
 829                         /* this is not a header we know about */
 830                         for (m = 0; m < ARRAY_SIZE(methods); m++)
 831                                 if (ah->frag_index[methods[m]]) {
 832                                         /*
 833                                          * already had the method, no idea what
 834                                          * this crap from the client is, ignore
 835                                          */
 836                                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 837                                         break;
 838                                 }
 839                         /*
 840                          * hm it's an unknown http method from a client in fact,
 841                          * it cannot be valid http
 842                          */
 843                         if (m == ARRAY_SIZE(methods)) {
 844                                 /*
 845                                  * are we set up to accept raw in these cases?
 846                                  */
 847                                 if (lws_check_opt(wsi->vhost->options,
 848                                            LWS_SERVER_OPTION_FALLBACK_TO_RAW))
 849                                         return 2; /* transition to raw */
 850
 851                                 lwsl_info("Unknown method - dropping\n");
 852                                 goto forbid;
 853                         }
 854                         break;
 855                 }
 856                 /*
 857                  * ...otherwise for a client, let him ignore unknown headers
 858                  * coming from the server
 859                  */
 860                 if (wsi->u.hdr.lextable_pos < 0) {
 861                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 862                         break;
 863                 }
 864
 865                 if (lextable[wsi->u.hdr.lextable_pos] < FAIL_CHAR) {
 866                         /* terminal state */
 867
 868                         n = ((unsigned int)lextable[wsi->u.hdr.lextable_pos] << 8) |
 869                                         lextable[wsi->u.hdr.lextable_pos + 1];
 870
 871                         lwsl_parser("known hdr %d\n", n);
 872                         for (m = 0; m < ARRAY_SIZE(methods); m++)
 873                                 if (n == methods[m] &&
 874                                     ah->frag_index[methods[m]]) {
 875                                         lwsl_warn("Duplicated method\n");
 876                                         return -1;
 877                                 }
 878
 879                         /*
 880                          * WSORIGIN is protocol equiv to ORIGIN,
 881                          * JWebSocket likes to send it, map to ORIGIN
 882                          */
 883                         if (n == WSI_TOKEN_SWORIGIN)
 884                                 n = WSI_TOKEN_ORIGIN;
 885
 886                         wsi->u.hdr.parser_state = (enum lws_token_indexes)
 887                                                         (WSI_TOKEN_GET_URI + n);
 888
 889                         if (context->token_limits)
 890                                 wsi->u.hdr.current_token_limit =
 891                                         context->token_limits->token_limit[
 892                                                        wsi->u.hdr.parser_state];
 893                         else
 894                                 wsi->u.hdr.current_token_limit =
 895                                         wsi->context->max_http_header_data;
 896
 897                         if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE)
 898                                 goto set_parsing_complete;
 899
 900                         goto start_fragment;
 901                 }
 902                 break;
 903
 904 start_fragment:
 905                 ah->nfrag++;
 906 excessive:
 907                 if (ah->nfrag == ARRAY_SIZE(ah->frags)) {
 908                         lwsl_warn("More hdr frags than we can deal with\n");
 909                         return -1;
 910                 }
 911
 912                 ah->frags[ah->nfrag].offset = ah->pos;
 913                 ah->frags[ah->nfrag].len = 0;
 914                 ah->frags[ah->nfrag].nfrag = 0;
 915
 916                 n = ah->frag_index[wsi->u.hdr.parser_state];
 917                 if (!n) { /* first fragment */
 918                         ah->frag_index[wsi->u.hdr.parser_state] = ah->nfrag;
 919                         break;
 920                 }
 921                 /* continuation */
 922                 while (ah->frags[n].nfrag)
 923                         n = ah->frags[n].nfrag;
 924                 ah->frags[n].nfrag = ah->nfrag;
 925
 926                 if (issue_char(wsi, ' ') < 0)
 927                         return -1;
 928                 break;
 929
 930                 /* skipping arg part of a name we didn't recognize */
 931         case WSI_TOKEN_SKIPPING:
 932                 lwsl_parser("WSI_TOKEN_SKIPPING '%c'\n", c);
 933
 934                 if (c == '\x0d')
 935                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING_SAW_CR;
 936                 break;
 937
 938         case WSI_TOKEN_SKIPPING_SAW_CR:
 939                 lwsl_parser("WSI_TOKEN_SKIPPING_SAW_CR '%c'\n", c);
 940                 if (wsi->u.hdr.ues != URIES_IDLE)
 941                         goto forbid;
 942                 if (c == '\x0a') {
 943                         wsi->u.hdr.parser_state = WSI_TOKEN_NAME_PART;
 944                         wsi->u.hdr.lextable_pos = 0;
 945                 } else
 946                         wsi->u.hdr.parser_state = WSI_TOKEN_SKIPPING;
 947                 break;
 948                 /* we're done, ignore anything else */
 949
 950         case WSI_PARSING_COMPLETE:
 951                 lwsl_parser("WSI_PARSING_COMPLETE '%c'\n", c);
 952                 break;
 953         }
 954
 955         return 0;
 956
 957 set_parsing_complete:
 958         if (wsi->u.hdr.ues != URIES_IDLE)
 959                 goto forbid;
 960         if (lws_hdr_total_length(wsi, WSI_TOKEN_UPGRADE)) {
 961                 if (lws_hdr_total_length(wsi, WSI_TOKEN_VERSION))
 962                         wsi->ietf_spec_revision =
 963                                atoi(lws_hdr_simple_ptr(wsi, WSI_TOKEN_VERSION));
 964
 965                 lwsl_parser("v%02d hdrs completed\n", wsi->ietf_spec_revision);
 966         }
 967         wsi->u.hdr.parser_state = WSI_PARSING_COMPLETE;
 968         wsi->hdr_parsing_completed = 1;
 969
 970         return 0;
 971
 972 forbid:
 973         lwsl_notice(" forbidding on uri sanitation\n");
 974         lws_return_http_status(wsi, HTTP_STATUS_FORBIDDEN, NULL);
 975         return -1;
 976 }
 977
 978 LWS_VISIBLE int lws_frame_is_binary(struct lws *wsi)
 979 {
 980         return wsi->u.ws.frame_is_binary;
 981 }
 982
 983 void
 984 lws_add_wsi_to_draining_ext_list(struct lws *wsi)
 985 {
 986         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 987
 988         if (wsi->u.ws.rx_draining_ext)
 989                 return;
 990
 991         lwsl_ext("%s: RX EXT DRAINING: Adding to list\n", __func__);
 992
 993         wsi->u.ws.rx_draining_ext = 1;
 994         wsi->u.ws.rx_draining_ext_list = pt->rx_draining_ext_list;
 995         pt->rx_draining_ext_list = wsi;
 996 }
 997
 998 void
 999 lws_remove_wsi_from_draining_ext_list(struct lws *wsi)
1000 {
1001         struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
1002         struct lws **w = &pt->rx_draining_ext_list;
1003
1004         if (!wsi->u.ws.rx_draining_ext)
1005                 return;
1006
1007         lwsl_ext("%s: RX EXT DRAINING: Removing from list\n", __func__);
1008
1009         wsi->u.ws.rx_draining_ext = 0;
1010
1011         /* remove us from context draining ext list */
1012         while (*w) {
1013                 if (*w == wsi) {
1014                         /* if us, point it instead to who we were pointing to */
1015                         *w = wsi->u.ws.rx_draining_ext_list;
1016                         break;
1017                 }
1018                 w = &((*w)->u.ws.rx_draining_ext_list);
1019         }
1020         wsi->u.ws.rx_draining_ext_list = NULL;
1021 }
1022
1023 /*
1024  * client-parser.c: lws_client_rx_sm() needs to be roughly kept in
1025  *   sync with changes here, esp related to ext draining
1026  */
1027
1028 int
1029 lws_rx_sm(struct lws *wsi, unsigned char c)
1030 {
1031         int callback_action = LWS_CALLBACK_RECEIVE;
1032         int ret = 0, n, rx_draining_ext = 0;
1033         struct lws_tokens eff_buf;
1034
1035         eff_buf.token = NULL;
1036         eff_buf.token_len = 0;
1037         if (wsi->socket_is_permanently_unusable)
1038                 return -1;
1039
1040         switch (wsi->lws_rx_parse_state) {
1041         case LWS_RXPS_NEW:
1042                 if (wsi->u.ws.rx_draining_ext) {
1043                         eff_buf.token = NULL;
1044                         eff_buf.token_len = 0;
1045                         lws_remove_wsi_from_draining_ext_list(wsi);
1046                         rx_draining_ext = 1;
1047                         lwsl_debug("%s: doing draining flow\n", __func__);
1048
1049                         goto drain_extension;
1050                 }
1051                 switch (wsi->ietf_spec_revision) {
1052                 case 13:
1053                         /*
1054                          * no prepended frame key any more
1055                          */
1056                         wsi->u.ws.all_zero_nonce = 1;
1057                         goto handle_first;
1058
1059                 default:
1060                         lwsl_warn("lws_rx_sm: unknown spec version %d\n",
1061                                                        wsi->ietf_spec_revision);
1062                         break;
1063                 }
1064                 break;
1065         case LWS_RXPS_04_mask_1:
1066                 wsi->u.ws.mask[1] = c;
1067                 if (c)
1068                         wsi->u.ws.all_zero_nonce = 0;
1069                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_2;
1070                 break;
1071         case LWS_RXPS_04_mask_2:
1072                 wsi->u.ws.mask[2] = c;
1073                 if (c)
1074                         wsi->u.ws.all_zero_nonce = 0;
1075                 wsi->lws_rx_parse_state = LWS_RXPS_04_mask_3;
1076                 break;
1077         case LWS_RXPS_04_mask_3:
1078                 wsi->u.ws.mask[3] = c;
1079                 if (c)
1080                         wsi->u.ws.all_zero_nonce = 0;
1081
1082                 /*
1083                  * start from the zero'th byte in the XOR key buffer since
1084                  * this is the start of a frame with a new key
1085                  */
1086
1087                 wsi->u.ws.mask_idx = 0;
1088
1089                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_1;
1090                 break;
1091
1092         /*
1093          *  04 logical framing from the spec (all this is masked when incoming
1094          *  and has to be unmasked)
1095          *
1096          * We ignore the possibility of extension data because we don't
1097          * negotiate any extensions at the moment.
1098          *
1099          *    0                   1                   2                   3
1100          *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1101          *   +-+-+-+-+-------+-+-------------+-------------------------------+
1102          *   |F|R|R|R| opcode|R| Payload len |    Extended payload length    |
1103          *   |I|S|S|S|  (4)  |S|     (7)     |             (16/63)           |
1104          *   |N|V|V|V|       |V|             |   (if payload len==126/127)   |
1105          *   | |1|2|3|       |4|             |                               |
1106          *   +-+-+-+-+-------+-+-------------+ - - - - - - - - - - - - - - - +
1107          *   |     Extended payload length continued, if payload len == 127  |
1108          *   + - - - - - - - - - - - - - - - +-------------------------------+
1109          *   |                               |         Extension data        |
1110          *   +-------------------------------+ - - - - - - - - - - - - - - - +
1111          *   :                                                               :
1112          *   +---------------------------------------------------------------+
1113          *   :                       Application data                        :
1114          *   +---------------------------------------------------------------+
1115          *
1116          *  We pass payload through to userland as soon as we get it, ignoring
1117          *  FIN.  It's up to userland to buffer it up if it wants to see a
1118          *  whole unfragmented block of the original size (which may be up to
1119          *  2^63 long!)
1120          */
1121
1122         case LWS_RXPS_04_FRAME_HDR_1:
1123 handle_first:
1124
1125                 wsi->u.ws.opcode = c & 0xf;
1126                 wsi->u.ws.rsv = c & 0x70;
1127                 wsi->u.ws.final = !!((c >> 7) & 1);
1128
1129                 switch (wsi->u.ws.opcode) {
1130                 case LWSWSOPC_TEXT_FRAME:
1131                 case LWSWSOPC_BINARY_FRAME:
1132                         wsi->u.ws.rsv_first_msg = (c & 0x70);
1133                         wsi->u.ws.frame_is_binary =
1134                              wsi->u.ws.opcode == LWSWSOPC_BINARY_FRAME;
1135                         break;
1136                 case 3:
1137                 case 4:
1138                 case 5:
1139                 case 6:
1140                 case 7:
1141                 case 0xb:
1142                 case 0xc:
1143                 case 0xd:
1144                 case 0xe:
1145                 case 0xf:
1146                         lwsl_info("illegal opcode\n");
1147                         return -1;
1148                 }
1149                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN;
1150                 break;
1151
1152         case LWS_RXPS_04_FRAME_HDR_LEN:
1153
1154                 wsi->u.ws.this_frame_masked = !!(c & 0x80);
1155
1156                 switch (c & 0x7f) {
1157                 case 126:
1158                         /* control frames are not allowed to have big lengths */
1159                         if (wsi->u.ws.opcode & 8)
1160                                 goto illegal_ctl_length;
1161
1162                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_2;
1163                         break;
1164                 case 127:
1165                         /* control frames are not allowed to have big lengths */
1166                         if (wsi->u.ws.opcode & 8)
1167                                 goto illegal_ctl_length;
1168
1169                         wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_8;
1170                         break;
1171                 default:
1172                         wsi->u.ws.rx_packet_length = c & 0x7f;
1173                         if (wsi->u.ws.this_frame_masked)
1174                                 wsi->lws_rx_parse_state =
1175                                                 LWS_RXPS_07_COLLECT_FRAME_KEY_1;
1176                         else
1177                                 if (wsi->u.ws.rx_packet_length)
1178                                         wsi->lws_rx_parse_state =
1179                                         LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
1180                                 else {
1181                                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
1182                                         goto spill;
1183                                 }
1184                         break;
1185                 }
1186                 break;
1187
1188         case LWS_RXPS_04_FRAME_HDR_LEN16_2:
1189                 wsi->u.ws.rx_packet_length = c << 8;
1190                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN16_1;
1191                 break;
1192
1193         case LWS_RXPS_04_FRAME_HDR_LEN16_1:
1194                 wsi->u.ws.rx_packet_length |= c;
1195                 if (wsi->u.ws.this_frame_masked)
1196                         wsi->lws_rx_parse_state =
1197                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
1198                 else
1199                         wsi->lws_rx_parse_state =
1200                                 LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
1201                 break;
1202
1203         case LWS_RXPS_04_FRAME_HDR_LEN64_8:
1204                 if (c & 0x80) {
1205                         lwsl_warn("b63 of length must be zero\n");
1206                         /* kill the connection */
1207                         return -1;
1208                 }
1209 #if defined __LP64__
1210                 wsi->u.ws.rx_packet_length = ((size_t)c) << 56;
1211 #else
1212                 wsi->u.ws.rx_packet_length = 0;
1213 #endif
1214                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_7;
1215                 break;
1216
1217         case LWS_RXPS_04_FRAME_HDR_LEN64_7:
1218 #if defined __LP64__
1219                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 48;
1220 #endif
1221                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_6;
1222                 break;
1223
1224         case LWS_RXPS_04_FRAME_HDR_LEN64_6:
1225 #if defined __LP64__
1226                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 40;
1227 #endif
1228                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_5;
1229                 break;
1230
1231         case LWS_RXPS_04_FRAME_HDR_LEN64_5:
1232 #if defined __LP64__
1233                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 32;
1234 #endif
1235                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_4;
1236                 break;
1237
1238         case LWS_RXPS_04_FRAME_HDR_LEN64_4:
1239                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 24;
1240                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_3;
1241                 break;
1242
1243         case LWS_RXPS_04_FRAME_HDR_LEN64_3:
1244                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 16;
1245                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_2;
1246                 break;
1247
1248         case LWS_RXPS_04_FRAME_HDR_LEN64_2:
1249                 wsi->u.ws.rx_packet_length |= ((size_t)c) << 8;
1250                 wsi->lws_rx_parse_state = LWS_RXPS_04_FRAME_HDR_LEN64_1;
1251                 break;
1252
1253         case LWS_RXPS_04_FRAME_HDR_LEN64_1:
1254                 wsi->u.ws.rx_packet_length |= ((size_t)c);
1255                 if (wsi->u.ws.this_frame_masked)
1256                         wsi->lws_rx_parse_state =
1257                                         LWS_RXPS_07_COLLECT_FRAME_KEY_1;
1258                 else
1259                         wsi->lws_rx_parse_state =
1260                                 LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
1261                 break;
1262
1263         case LWS_RXPS_07_COLLECT_FRAME_KEY_1:
1264                 wsi->u.ws.mask[0] = c;
1265                 if (c)
1266                         wsi->u.ws.all_zero_nonce = 0;
1267                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_2;
1268                 break;
1269
1270         case LWS_RXPS_07_COLLECT_FRAME_KEY_2:
1271                 wsi->u.ws.mask[1] = c;
1272                 if (c)
1273                         wsi->u.ws.all_zero_nonce = 0;
1274                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_3;
1275                 break;
1276
1277         case LWS_RXPS_07_COLLECT_FRAME_KEY_3:
1278                 wsi->u.ws.mask[2] = c;
1279                 if (c)
1280                         wsi->u.ws.all_zero_nonce = 0;
1281                 wsi->lws_rx_parse_state = LWS_RXPS_07_COLLECT_FRAME_KEY_4;
1282                 break;
1283
1284         case LWS_RXPS_07_COLLECT_FRAME_KEY_4:
1285                 wsi->u.ws.mask[3] = c;
1286                 if (c)
1287                         wsi->u.ws.all_zero_nonce = 0;
1288                 wsi->lws_rx_parse_state =
1289                                         LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED;
1290                 wsi->u.ws.mask_idx = 0;
1291                 if (wsi->u.ws.rx_packet_length == 0) {
1292                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
1293                         goto spill;
1294                 }
1295                 break;
1296
1297
1298         case LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED:
1299                 assert(wsi->u.ws.rx_ubuf);
1300
1301                 if (wsi->u.ws.rx_draining_ext)
1302                         goto drain_extension;
1303
1304                 if (wsi->u.ws.rx_ubuf_head + LWS_PRE >=
1305                     wsi->u.ws.rx_ubuf_alloc) {
1306                         lwsl_err("Attempted overflow \n");
1307                         return -1;
1308                 }
1309                 if (wsi->u.ws.all_zero_nonce)
1310                         wsi->u.ws.rx_ubuf[LWS_PRE +
1311                                          (wsi->u.ws.rx_ubuf_head++)] = c;
1312                 else
1313                         wsi->u.ws.rx_ubuf[LWS_PRE +
1314                                (wsi->u.ws.rx_ubuf_head++)] =
1315                                    c ^ wsi->u.ws.mask[
1316                                             (wsi->u.ws.mask_idx++) & 3];
1317
1318                 if (--wsi->u.ws.rx_packet_length == 0) {
1319                         /* spill because we have the whole frame */
1320                         wsi->lws_rx_parse_state = LWS_RXPS_NEW;
1321                         goto spill;
1322                 }
1323
1324                 /*
1325                  * if there's no protocol max frame size given, we are
1326                  * supposed to default to context->pt_serv_buf_size
1327                  */
1328
1329                 if (!wsi->protocol->rx_buffer_size &&
1330                     wsi->u.ws.rx_ubuf_head != wsi->context->pt_serv_buf_size)
1331                         break;
1332                 else
1333                         if (wsi->protocol->rx_buffer_size &&
1334                                         wsi->u.ws.rx_ubuf_head !=
1335                                                   wsi->protocol->rx_buffer_size)
1336                         break;
1337
1338                 /* spill because we filled our rx buffer */
1339 spill:
1340                 /*
1341                  * is this frame a control packet we should take care of at this
1342                  * layer?  If so service it and hide it from the user callback
1343                  */
1344
1345                 lwsl_parser("spill on %s\n", wsi->protocol->name);
1346
1347                 switch (wsi->u.ws.opcode) {
1348                 case LWSWSOPC_CLOSE:
1349
1350                         /* is this an acknowledgement of our close? */
1351                         if (wsi->state == LWSS_AWAITING_CLOSE_ACK) {
1352                                 /*
1353                                  * fine he has told us he is closing too, let's
1354                                  * finish our close
1355                                  */
1356                                 lwsl_parser("seen client close ack\n");
1357                                 return -1;
1358                         }
1359                         if (wsi->state == LWSS_RETURNED_CLOSE_ALREADY)
1360                                 /* if he sends us 2 CLOSE, kill him */
1361                                 return -1;
1362
1363                         if (lws_partial_buffered(wsi)) {
1364                                 /*
1365                                  * if we're in the middle of something,
1366                                  * we can't do a normal close response and
1367                                  * have to just close our end.
1368                                  */
1369                                 wsi->socket_is_permanently_unusable = 1;
1370                                 lwsl_parser("Closing on peer close due to Pending tx\n");
1371                                 return -1;
1372                         }
1373
1374                         if (user_callback_handle_rxflow(
1375                                         wsi->protocol->callback, wsi,
1376                                         LWS_CALLBACK_WS_PEER_INITIATED_CLOSE,
1377                                         wsi->user_space,
1378                                         &wsi->u.ws.rx_ubuf[LWS_PRE],
1379                                         wsi->u.ws.rx_ubuf_head))
1380                                 return -1;
1381
1382                         lwsl_parser("server sees client close packet\n");
1383                         wsi->state = LWSS_RETURNED_CLOSE_ALREADY;
1384                         /* deal with the close packet contents as a PONG */
1385                         wsi->u.ws.payload_is_close = 1;
1386                         goto process_as_ping;
1387
1388                 case LWSWSOPC_PING:
1389                         lwsl_info("received %d byte ping, sending pong\n",
1390                                                  wsi->u.ws.rx_ubuf_head);
1391
1392                         if (wsi->u.ws.ping_pending_flag) {
1393                                 /*
1394                                  * there is already a pending ping payload
1395                                  * we should just log and drop
1396                                  */
1397                                 lwsl_parser("DROP PING since one pending\n");
1398                                 goto ping_drop;
1399                         }
1400 process_as_ping:
1401                         /* control packets can only be < 128 bytes long */
1402                         if (wsi->u.ws.rx_ubuf_head > 128 - 3) {
1403                                 lwsl_parser("DROP PING payload too large\n");
1404                                 goto ping_drop;
1405                         }
1406
1407                         /* stash the pong payload */
1408                         memcpy(wsi->u.ws.ping_payload_buf + LWS_PRE,
1409                                &wsi->u.ws.rx_ubuf[LWS_PRE],
1410                                 wsi->u.ws.rx_ubuf_head);
1411
1412                         wsi->u.ws.ping_payload_len = wsi->u.ws.rx_ubuf_head;
1413                         wsi->u.ws.ping_pending_flag = 1;
1414
1415                         /* get it sent as soon as possible */
1416                         lws_callback_on_writable(wsi);
1417 ping_drop:
1418                         wsi->u.ws.rx_ubuf_head = 0;
1419                         return 0;
1420
1421                 case LWSWSOPC_PONG:
1422                         lwsl_info("received pong\n");
1423                         lwsl_hexdump(&wsi->u.ws.rx_ubuf[LWS_PRE],
1424                                      wsi->u.ws.rx_ubuf_head);
1425
1426                         if (wsi->pending_timeout == PENDING_TIMEOUT_WS_PONG_CHECK_GET_PONG) {
1427                                 lwsl_info("received expected PONG on wsi %p\n", wsi);
1428                                 lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
1429                         }
1430
1431                         /* issue it */
1432                         callback_action = LWS_CALLBACK_RECEIVE_PONG;
1433                         break;
1434
1435                 case LWSWSOPC_TEXT_FRAME:
1436                 case LWSWSOPC_BINARY_FRAME:
1437                 case LWSWSOPC_CONTINUATION:
1438                         break;
1439
1440                 default:
1441                         lwsl_parser("passing opc %x up to exts\n",
1442                                     wsi->u.ws.opcode);
1443                         /*
1444                          * It's something special we can't understand here.
1445                          * Pass the payload up to the extension's parsing
1446                          * state machine.
1447                          */
1448
1449                         eff_buf.token = &wsi->u.ws.rx_ubuf[LWS_PRE];
1450                         eff_buf.token_len = wsi->u.ws.rx_ubuf_head;
1451
1452                         if (lws_ext_cb_active(wsi, LWS_EXT_CB_EXTENDED_PAYLOAD_RX,
1453                                               &eff_buf, 0) <= 0)
1454                                 /* not handle or fail */
1455                                 lwsl_ext("ext opc opcode 0x%x unknown\n",
1456                                          wsi->u.ws.opcode);
1457
1458                         wsi->u.ws.rx_ubuf_head = 0;
1459                         return 0;
1460                 }
1461
1462                 /*
1463                  * No it's real payload, pass it up to the user callback.
1464                  * It's nicely buffered with the pre-padding taken care of
1465                  * so it can be sent straight out again using lws_write
1466                  */
1467
1468                 eff_buf.token = &wsi->u.ws.rx_ubuf[LWS_PRE];
1469                 eff_buf.token_len = wsi->u.ws.rx_ubuf_head;
1470
1471 drain_extension:
1472                 lwsl_ext("%s: passing %d to ext\n", __func__, eff_buf.token_len);
1473
1474                 if (wsi->state == LWSS_RETURNED_CLOSE_ALREADY ||
1475                     wsi->state == LWSS_AWAITING_CLOSE_ACK)
1476                         goto already_done;
1477
1478                 n = lws_ext_cb_active(wsi, LWS_EXT_CB_PAYLOAD_RX, &eff_buf, 0);
1479                 /* eff_buf may be pointing somewhere completely different now,
1480                  * it's the output
1481                  */
1482                 if (n < 0) {
1483                         /*
1484                          * we may rely on this to get RX, just drop connection
1485                          */
1486                         wsi->socket_is_permanently_unusable = 1;
1487                         return -1;
1488                 }
1489
1490                 if (rx_draining_ext && eff_buf.token_len == 0)
1491                         goto already_done;
1492
1493                 if (n && eff_buf.token_len) {
1494                         /* extension had more... main loop will come back */
1495                         lws_add_wsi_to_draining_ext_list(wsi);
1496                 } else
1497                         lws_remove_wsi_from_draining_ext_list(wsi);
1498
1499                 if (eff_buf.token_len > 0 ||
1500                     callback_action == LWS_CALLBACK_RECEIVE_PONG) {
1501                         eff_buf.token[eff_buf.token_len] = '\0';
1502
1503                         if (wsi->protocol->callback) {
1504
1505                                 if (callback_action == LWS_CALLBACK_RECEIVE_PONG)
1506                                         lwsl_info("Doing pong callback\n");
1507
1508                                 ret = user_callback_handle_rxflow(
1509                                                 wsi->protocol->callback,
1510                                                 wsi,
1511                                                 (enum lws_callback_reasons)callback_action,
1512                                                 wsi->user_space,
1513                                                 eff_buf.token,
1514                                                 eff_buf.token_len);
1515                         }
1516                         else
1517                                 lwsl_err("No callback on payload spill!\n");
1518                 }
1519
1520 already_done:
1521                 wsi->u.ws.rx_ubuf_head = 0;
1522                 break;
1523         }
1524
1525         return ret;
1526
1527 illegal_ctl_length:
1528
1529         lwsl_warn("Control frame with xtended length is illegal\n");
1530         /* kill the connection */
1531         return -1;
1532 }
1533
1534 LWS_VISIBLE size_t
1535 lws_remaining_packet_payload(struct lws *wsi)
1536 {
1537         return wsi->u.ws.rx_packet_length;
1538 }
1539
1540 /* Once we reach LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED, we know how much
1541  * to expect in that state and can deal with it in bulk more efficiently.
1542  */
1543
1544 int
1545 lws_payload_until_length_exhausted(struct lws *wsi, unsigned char **buf,
1546                                    size_t *len)
1547 {
1548         unsigned char *buffer = *buf, mask[4];
1549         int buffer_size, n;
1550         unsigned int avail;
1551         char *rx_ubuf;
1552
1553         if (wsi->protocol->rx_buffer_size)
1554                 buffer_size = wsi->protocol->rx_buffer_size;
1555         else
1556                 buffer_size = wsi->context->pt_serv_buf_size;
1557         avail = buffer_size - wsi->u.ws.rx_ubuf_head;
1558
1559         /* do not consume more than we should */
1560         if (avail > wsi->u.ws.rx_packet_length)
1561                 avail = wsi->u.ws.rx_packet_length;
1562
1563         /* do not consume more than what is in the buffer */
1564         if (avail > *len)
1565                 avail = *len;
1566
1567         /* we want to leave 1 byte for the parser to handle properly */
1568         if (avail <= 1)
1569                 return 0;
1570
1571         avail--;
1572         rx_ubuf = wsi->u.ws.rx_ubuf + LWS_PRE + wsi->u.ws.rx_ubuf_head;
1573         if (wsi->u.ws.all_zero_nonce)
1574                 memcpy(rx_ubuf, buffer, avail);
1575         else {
1576
1577                 for (n = 0; n < 4; n++)
1578                         mask[n] = wsi->u.ws.mask[(wsi->u.ws.mask_idx + n) & 3];
1579
1580                 /* deal with 4-byte chunks using unwrapped loop */
1581                 n = avail >> 2;
1582                 while (n--) {
1583                         *(rx_ubuf++) = *(buffer++) ^ mask[0];
1584                         *(rx_ubuf++) = *(buffer++) ^ mask[1];
1585                         *(rx_ubuf++) = *(buffer++) ^ mask[2];
1586                         *(rx_ubuf++) = *(buffer++) ^ mask[3];
1587                 }
1588                 /* and the remaining bytes bytewise */
1589                 for (n = 0; n < (int)(avail & 3); n++)
1590                         *(rx_ubuf++) = *(buffer++) ^ mask[n];
1591
1592                 wsi->u.ws.mask_idx = (wsi->u.ws.mask_idx + avail) & 3;
1593         }
1594
1595         (*buf) += avail;
1596         wsi->u.ws.rx_ubuf_head += avail;
1597         wsi->u.ws.rx_packet_length -= avail;
1598         *len -= avail;
1599
1600         return avail;
1601 }