[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] io: fully parse & validate HTTP headers for web
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] [PATCH] io: fully parse & validate HTTP headers for websocket protocol handshake |
Date: |
Tue, 28 Feb 2017 13:51:39 +0000 |
User-agent: |
Mutt/1.7.1 (2016-10-04) |
On Tue, Feb 28, 2017 at 01:48:23PM +0000, Marc-André Lureau wrote:
> Hi
>
> On Tue, Feb 28, 2017 at 4:11 PM Daniel P. Berrange <address@hidden>
> wrote:
>
> > The current websockets protocol handshake code is very relaxed, just
> > doing crude string searching across the HTTP header data. This causes
> > it to both reject valid connections and fail to reject invalid
> > connections. For example, according to the RFC 6455 it:
> >
> > - MUST reject any method other than "GET"
> > - MUST reject any HTTP version less than "HTTP/1.1"
> > - MUST reject Connection header without "Upgrade" listed
> > - MUST reject Upgrade header which is not 'websocket'
> > - MUST reject missing Host header
> > - MUST treat HTTP header names as case insensitive
> >
> > To do all this validation correctly requires that we fully parse the
> > HTTP headers, populating a data structure containing the header
> > fields.
> >
> > After this change, we also reject any path other than '/'
>
>
> > Signed-off-by: Daniel P. Berrange <address@hidden>
> > ---
> > io/channel-websock.c | 236
> > ++++++++++++++++++++++++++++++++++++++++++---------
> > 1 file changed, 194 insertions(+), 42 deletions(-)
> >
>
> Looks good, but tests would be welcome, do you have plans for it?
It is a todo item but I've not had time to work on it. All the other
I/O channel implementations share a generall purpose test framework,
but I couldn't wire up websockets to that because we only have an
impl of the server side, not the client. So doing testing for this
will be a bit more involved, but it is certainly something we need
coverage for.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|