8000 Merge pull request #93 from jjssoftware/HttpHeaderEvents · robokoding/arduinoWebSockets@ab51930 · GitHub
[go: up one dir, main page]
Skip to content
8000

Commit ab51930

Browse files
Links2004Links2004
authored
Merge pull request Links2004#93 from jjssoftware/HttpHeaderEvents
custom http header validation implementation
2 parents 26130dc + 1ed734e commit ab51930

File tree

5 files changed

+201
-16
lines changed

5 files changed

+201
-16
lines changed

‎examples/WebSocketServer/WebSocketServerHttpHeaderValidation.ino

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* WebSocketServerHttpHeaderValidation.ino
3+
*
4+
* Created on: 08.06.2016
5+
*
6+
*/
7+
8+
#include <Arduino.h>
9+
10+
#include <ESP8266WiFi.h>
11+
#include <ESP8266WiFiMulti.h>
12+
#include <WebSocketsServer.h>
13+
#include <Hash.h>
14+
15+
ESP8266WiFiMulti WiFiMulti;
16+
17+
WebSocketsServer webSocket = WebSocketsServer(81);
18+
19+
#define USE_SERIAL Serial1
20+
21+
const unsigned long int validSessionId = 12345; //some arbitrary value to act as a valid sessionId
22+
23+
/*
24+
* Returns a bool value as an indicator to describe whether a user is allowed to initiate a websocket upgrade
25+
* based on the value of a cookie. This function expects the rawCookieHeaderValue to look like this "sessionId=<someSessionIdNumberValue>|"
26+
*/
27+
bool isCookieValid(String rawCookieHeaderValue) {
28+
29+
if (rawCookieHeaderValue.indexOf("sessionId") != -1) {
30+
String sessionIdStr = rawCookieHeaderValue.substring(rawCookieHeaderValue.indexOf("sessionId=") + 10, rawCookieHeaderValue.indexOf("|"));
31+
unsigned long int sessionId = strtoul(sessionIdStr.c_str(), NULL, 10);
32+
return sessionId == validSessionId;
33+
}
34+
return false;
35+
}
36+
37+
/*
38+
* The WebSocketServerHttpHeaderValFunc delegate passed to webSocket.onValidateHttpHeader
39+
*/
40+
bool validateHttpHeader(String headerName, String headerValue) {
41+
42+
//assume a true response for any headers not handled by this validator
43+
bool valid = true;
44+
45+
if(headerName.equalsIgnoreCase("Cookie")) {
46+
//if the header passed is the Cookie header, validate it according to the rules in 'isCookieValid' function
47+
valid = isCookieValid(headerValue);
48+
}
49+
50+
return valid;
51+
}
52+
53+
void setup() {
54+
// USE_SERIAL.begin(921600);
55+
USE_SERIAL.begin(115200);
56+
57+
//Serial.setDebugOutput(true);
58+
USE_SERIAL.setDebugOutput(true);
59+
60+
USE_SERIAL.println();
61+
USE_SERIAL.println();
62+
USE_SERIAL.println();
63+
64+
for(uint8_t t = 4; t > 0; t--) {
65+
USE_SERIAL.printf("[SETUP] BOOT WAIT %d...\n", t);
66+
USE_SERIAL.flush();
67+
delay(1000);
68+
}
69+
70+
WiFiMulti.addAP("SSID", "passpasspass");
71+
72+
while(WiFiMulti.run() != WL_CONNECTED) {
73+
delay(100);
74+
}
75+
76+
//connecting clients must supply a valid session cookie at websocket upgrade handshake negotiation time
77+
const char * headerkeys[] = { "Cookie" };
78+
size_t headerKeyCount = sizeof(headerkeys) / sizeof(char*);
79+
webSocket.onValidateHttpHeader(validateHttpHeader, headerkeys, headerKeyCount);
80+
webSocket.begin();
81+
}
82+
83+
void loop() {
84+
webSocket.loop();
85+
}
86+

‎src/WebSockets.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,7 @@ void WebSockets::handleWebsocketPayloadCb(WSclient_t * client, bool ok, uint8_t
426426
DEBUG_WEBSOCKETS("[WS][%d][handleWebsocket] text: %s\n", client->num, payload);
427427
// no break here!
428428
case WSop_binary:
429-
messageRecived(client, header->opCode, payload, header->payloadLen);
429+
messageReceived(client, header->opCode, payload, header->payloadLen);
430430
break;
431431
case WSop_ping:
432432
// send pong back

‎src/WebSockets.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,9 @@ typedef struct {
183183
String base64Authorization; ///< Base64 encoded Auth request
184184
String plainAuthorization; ///< Base64 encoded Auth request
185185

186+
bool cHttpHeadersValid; ///< non-websocket http header validity indicator
187+
size_t cMandatoryHeadersCount; ///< non-websocket mandatory http headers present count
188+
186189
#if (WEBSOCKETS_NETWORK_TYPE == NETWORK_ESP8266_ASYNC)
187190
String cHttpLine; ///< HTTP header lines
188191
#endif
@@ -202,7 +205,7 @@ class WebSockets {
202205
virtual void clientDisconnect(WSclient_t * client);
203206
virtual bool clientIsConnected(WSclient_t * client);
204207

205-
virtual void messageRecived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t length);
208+
virtual void messageReceived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t length);
206209

207210
void clientDisconnect(WSclient_t * client, uint16_t code, char * reason = NULL, size_t reasonLen = 0);
208211
bool sendFrame(WSclient_t * client, WSopcode_t opcode, uint8_t * payload = NULL, size_t length = 0, bool mask = false, bool fin = true, bool headerToPayload = false);

‎src/WebSocketsServer.cpp

Lines changed: 76 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ WebSocketsServer::WebSocketsServer(uint16_t port, String origin, String protocol
4040

4141
_cbEvent = NULL;
4242

43+
_httpHeaderValidationFunc = NULL;
44+
_mandatoryHttpHeaders = NULL;
45+
_mandatoryHttpHeaderCount = 0;
4346
}
4447

4548

@@ -53,10 +56,14 @@ WebSocketsServer::~WebSocketsServer() {
5356
// TODO how to close server?
5457
#endif
5558

59+
if (_mandatoryHttpHeaders)
60+
delete[] _mandatoryHttpHeaders;
61+
62+
_mandatoryHttpHeaderCount = 0;
5663
}
5764

5865
/**
59-
* calles to init the Websockets server
66+
* called to initialize the Websocket server
6067
*/
6168
void WebSocketsServer::begin(void) {
6269
WSclient_t * client;
@@ -83,6 +90,7 @@ void WebSocketsServer::begin(void) {
8390
client->base64Authorization = "";
8491

8592
client->cWsRXsize = 0;
93+
8694
#if (WEBSOCKETS_NETWORK_TYPE == NETWORK_ESP8266_ASYNC)
8795
client->cHttpLine = "";
8896
#endif
@@ -118,7 +126,31 @@ void WebSocketsServer::onEvent(WebSocketServerEvent cbEvent) {
118126
_cbEvent = cbEvent;
119127
}
120128

121-
/**
129+
/*
130+
* Sets the custom http header validator function
131+
* @param httpHeaderValidationFunc WebSocketServerHttpHeaderValFunc ///< pointer to the custom http header validation function
132+
* @param mandatoryHttpHeaders[] const char* ///< the array of named http headers considered to be mandatory / must be present in order for websocket upgrade to succeed
133+
* @param mandatoryHttpHeaderCount size_t ///< the number of items in the mandatoryHttpHeaders array
134+
*/
135+
void WebSocketsServer::onValidateHttpHeader(
136+
WebSocketServerHttpHeaderValFunc validationFunc,
137+
const char* mandatoryHttpHeaders[],
138+
size_t mandatoryHttpHeaderCount)
139+
{
140+
_httpHeaderValidationFunc = validationFunc;
141+
142+
if (_mandatoryHttpHeaders)
143+
delete[] _mandatoryHttpHeaders;
144+
145+
_mandatoryHttpHeaderCount = mandatoryHttpHeaderCount;
146+
_mandatoryHttpHeaders = new String[_mandatoryHttpHeaderCount];
147+
148+
for (size_t i = 0; i < _mandatoryHttpHeaderCount; i++) {
149+
_mandatoryHttpHeaders[i] = mandatoryHttpHeaders[i];
150+
}
151+
}
152+
153+
/*
122154
* send text data to client
123155
* @param num uint8_t client id
124156
* @param payload uint8_t *
@@ -279,9 +311,8 @@ void WebSocketsServer::disconnect(uint8_t num) {
279311
}
280312

281313

282-
283-
/**
284-
* set the Authorizatio for the http request
314+
/*
315+
* set the Authorization for the http request
285316
* @param user const char *
286317
* @param password const char *
287318
*/
@@ -388,7 +419,7 @@ bool WebSocketsServer::newClient(WEBSOCKETS_NETWORK_CLASS * TCPclient) {
388419
* @param payload uint8_t *
389420
* @param lenght size_t
390421
*/
391-
void WebSocketsServer::messageRecived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t lenght) {
422+
void WebSocketsServer::messageReceived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t lenght) {
392423
WStype_t type = WStype_ERROR;
393424

394425
switch(opcode) {
@@ -446,6 +477,7 @@ void WebSocketsServer::clientDisconnect(WSclient_t * client) {
446477
client->cIsWebsocket = false;
447478

448479
client->cWsRXsize = 0;
480+
449481
#if (WEBSOCKETS_NETWORK_TYPE == NETWORK_ESP8266_ASYNC)
450482
client->cHttpLine = "";
451483
#endif
@@ -461,7 +493,7 @@ void WebSocketsServer::clientDisconnect(WSclient_t * client) {
461493
/**
462494
* get client state
463495
* @param client WSclient_t * ptr to the client struct
464-
* @return true = conneted
496+
* @return true = connected
465497
*/
466498
bool WebSocketsServer::clientIsConnected(WSclient_t * client) {
467499

@@ -492,7 +524,7 @@ bool WebSocketsServer::clientIsConnected(WSclient_t * client) {
492524
}
493525
#if (WEBSOCKETS_NETWORK_TYPE != NETWORK_ESP8266_ASYNC)
494526
/**
495-
* Handle incomming Connection Request
527+
* Handle incoming Connection Request
496528
*/
497529
void WebSocketsServer::handleNewClients(void) {
498530

@@ -569,10 +601,22 @@ void WebSocketsServer::handleClientData(void) {
569601
}
570602
#endif
571603

604+
/*
605+
* returns an indicator whether the given named header exists in the configured _mandatoryHttpHeaders collection
606+
* @param headerName String ///< the name of the header being checked
607+
*/
608+
bool WebSocketsServer::hasMandatoryHeader(String headerName) {
609+
for (size_t i = 0; i < _mandatoryHttpHeaderCount; i++) {
610+
if (_mandatoryHttpHeaders[i].equalsIgnoreCase(headerName))
611+
return true;
612+
}
613+
return false;
614+
}
572615

573616
/**
574-
* handle the WebSocket header reading
575-
* @param client WSclient_t * ptr to the client struct
617+
* handles http header reading for WebSocket upgrade
618+
* @param client WSclient_t * ///< pointer to the client struct
619+
* @param headerLine String ///< the header being read / processed
576620
*/
577621
void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
578622

@@ -581,10 +625,16 @@ void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
581625
if(headerLine->length() > 0) {
582626
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] RX: %s\n", client->num, headerLine->c_str());
583627

584-
// websocket request starts allways with GET see rfc6455
628+
// websocket requests always start with GET see rfc6455
585629
if(headerLine->startsWith("GET ")) {
630+
586631
// cut URL out
587632
client->cUrl = headerLine->substring(4, headerLine->indexOf(' ', 4));
633+
634+
//reset non-websocket http header validation state for this client
635+
client->cHttpHeadersValid = true;
636+
client->cMandatoryHeadersCount = 0;
637+
588638
} else if(headerLine->indexOf(':')) {
589639
String headerName = headerLine->substring(0, headerLine->indexOf(':'));
590640
String headerValue = headerLine->substring(headerLine->indexOf(':') + 2);
@@ -609,7 +659,13 @@ void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
609659
client->cExtensions = headerValue;
610660
} else if(headerName.equalsIgnoreCase("Authorization")) {
611661
client->base64Authorization = headerValue;
662+
} else {
663+
client->cHttpHeadersValid &= execHttpHeaderValidation(headerName, headerValue);
664+
if (_mandatoryHttpHeaderCount > 0 && hasMandatoryHeader(headerName)) {
665+
client->cMandatoryHeadersCount++;
666+
}
612667
}
668+
613669
} else {
614670
DEBUG_WEBSOCKETS("[WS-Client][handleHeader] Header error (%s)\n", headerLine->c_str());
615671
}
@@ -619,8 +675,8 @@ void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
619675
client->tcp->readStringUntil('\n', &(client->cHttpLine), std::bind(&WebSocketsServer::handleHeader, this, client, &(client->cHttpLine)));
620676
#endif
621677
} else {
622-
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] Header read fin.\n", client->num);
623678

679+
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] Header read fin.\n", client->num);
624680
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cURL: %s\n", client->num, client->cUrl.c_str());
625681
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cIsUpgrade: %d\n", client->num, client->cIsUpgrade);
626682
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cIsWebsocket: %d\n", client->num, client->cIsWebsocket);
@@ -629,6 +685,8 @@ void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
629685
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cExtensions: %s\n", client->num, client->cExtensions.c_str());
630686
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cVersion: %d\n", client->num, client->cVersion);
631687
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - base64Authorization: %s\n", client->num, client->base64Authorization.c_str());
688+
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cHttpHeadersValid: %d\n", client->num, client->cHttpHeadersValid);
689+
DEBUG_WEBSOCKETS("[WS-Server][%d][handleHeader] - cMandatoryHeadersCount: %d\n", client->num, client->cMandatoryHeadersCount);
632690

633691
bool ok = (client->cIsUpgrade && client->cIsWebsocket);
634692

@@ -642,6 +700,12 @@ void WebSocketsServer::handleHeader(WSclient_t * client, String * headerLine) {
642700
if(client->cVersion != 13) {
643701
ok = false;
644702
}
703+
if(!client->cHttpHeadersValid) {
704+
ok = false;
705+
}
706+
if (client->cMandatoryHeadersCount != _mandatoryHttpHeaderCount) {
707+
ok = false;
708+
}
645709
}
646710

647711
if(_base64Authorization.length() > 0) {

‎src/WebSocketsServer.h

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,10 @@ class WebSocketsServer: private WebSockets {
3838

3939
#ifdef __AVR__
4040
typedef void (*WebSocketServerEvent)(uint8_t num, WStype_t type, uint8_t * payload, size_t length);
41+
typedef bool (*WebSocketServerHttpHeaderValFunc)(String headerName, String headerValue);
4142
#else
4243
typedef std::function<void (uint8_t num, WStype_t type, uint8_t * payload, size_t length)> WebSocketServerEvent;
44+
typedef std::function<bool (String headerName, String headerValue)> WebSocketServerHttpHeaderValFunc;
4345
#endif
4446

4547
WebSocketsServer(uint16_t port, String origin = "", String protocol = "arduino");
@@ -55,6 +57,10 @@ class WebSocketsServer: private WebSockets {
5557
#endif
5658

5759
void onEvent(WebSocketServerEvent cbEvent);
60+
void onValidateHttpHeader(
61+
WebSocketServerHttpHeaderValFunc validationFunc,
62+
const char* mandatoryHttpHeaders[],
63+
size_t mandatoryHttpHeaderCount);
5864

5965

6066
bool sendTXT(uint8_t num, uint8_t * payload, size_t length = 0, bool headerToPayload = false);
@@ -90,16 +96,19 @@ class WebSocketsServer: private WebSockets {
9096
String _origin;
9197
String _protocol;
9298
String _base64Authorization; ///< Base64 encoded Auth request
99+
String * _mandatoryHttpHeaders;
100+
size_t _mandatoryHttpHeaderCount;
93101

94102
WEBSOCKETS_NETWORK_SERVER_CLASS * _server;
95103

96104
WSclient_t _clients[WEBSOCKETS_SERVER_CLIENT_MAX];
97105

98106
WebSocketServerEvent _cbEvent;
107+
WebSocketServerHttpHeaderValFunc _httpHeaderValidationFunc;
99108

100109
bool newClient(WEBSOCKETS_NETWORK_CLASS * TCPclient);
101110

102-
void messageRecived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t length);
111+
void messageReceived(WSclient_t * client, WSopcode_t opcode, uint8_t * payload, size_t length);
103112

104113
void clientDisconnect(WSclient_t * client);
105114
bool clientIsConnected(WSclient_t * client);
@@ -111,7 +120,6 @@ class WebSocketsServer: private WebSockets {
111120

112121
void handleHeader(WSclient_t * client, String * headerLine);
113122

114-
115123
/**
116124
* called if a non Websocket connection is coming in.
117125
* Note: can be override
@@ -162,6 +170,30 @@ class WebSocketsServer: private WebSockets {
162170
}
163171
}
164172

173+
/*
174+
* Called at client socket connect handshake negotiation time for each http header that is not
175+
* a websocket specific http header (not Connection, Upgrade, Sec-WebSocket-*)
176+
* If the custom httpHeaderValidationFunc returns false for any headerName / headerValue passed, the
177+
* socket negotiation is considered invalid and the upgrade to websockets request is denied / rejected
178+
* This mechanism can be used to enable custom authentication schemes e.g. test the value
179+
* of a session cookie to determine if a user is logged on / authenticated
180+
*/
181+
virtual bool execHttpHeaderValidation(String headerName, String headerValue) {
182+
if(_httpHeaderValidationFunc) {
183+
//return the value of the custom http header validation function
184+
return _httpHeaderValidationFunc(headerName, headerValue);
185+
}
186+
//no custom http header validation so just assume all is good
187+
return true;
188+
}
189+
190+
private:
191+
/*
192+
* returns an indicator whether the given named header exists in the configured _mandatoryHttpHeaders collection
193+
* @param headerName String ///< the name of the header being checked
194+
*/
195+
bool hasMandatoryHeader(String headerName);
196+
165197
};
166198

167199

0 commit comments

Comments
 (0)
0