Re: [Qemu-devel] [PATCH] io: fully parse & validate HTTP headers for websocket protocol handshake

["Daniel P. Berrange" <berrange@redhat.com>]

On Tue, Feb 28, 2017 at 01:48:23PM +0000, Marc-André Lureau wrote:
> Hi
> 
> On Tue, Feb 28, 2017 at 4:11 PM Daniel P. Berrange <berrange@redhat.com>
> wrote:
> 
> > The current websockets protocol handshake code is very relaxed, just
> > doing crude string searching across the HTTP header data. This causes
> > it to both reject valid connections and fail to reject invalid
> > connections. For example, according to the RFC 6455 it:
> >
> >  - MUST reject any method other than "GET"
> >  - MUST reject any HTTP version less than "HTTP/1.1"
> >  - MUST reject Connection header without "Upgrade" listed
> >  - MUST reject Upgrade header which is not 'websocket'
> >  - MUST reject missing Host header
> >  - MUST treat HTTP header names as case insensitive
> >
> > To do all this validation correctly requires that we fully parse the
> > HTTP headers, populating a data structure containing the header
> > fields.
> >
> > After this change, we also reject any path other than '/'
> 
> 
> > Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> > ---
> >  io/channel-websock.c | 236
> > ++++++++++++++++++++++++++++++++++++++++++---------
> >  1 file changed, 194 insertions(+), 42 deletions(-)
> >
> 
> Looks good, but tests would be welcome, do you have plans for it?

It is a todo item but I've not had time to work on it. All the other
I/O channel implementations share a generall purpose test framework,
but I couldn't wire up websockets to that because we only have an
impl of the server side, not the client. So doing testing for this
will be a bit more involved, but it is certainly something we need
coverage for.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|