Hi,

I would like know, is this library under the GPL license or LGPL license? Because there's 2 license files in the project..

Thank you.

Kind regards, Sungtae

Just found out when going to open an issue on the original libwebsock repository that the author's dead. Since it seems like you're taking over... here's a few fixes.

        frame->state = sw_loaded_mask;
        frame->size = frame->payload_offset + frame->payload_len;
        if (frame->size > frame->rawdata_sz) {
            new_size = frame->size;
            new_size--;
            new_size |= new_size >> 1;
            new_size |= new_size >> 2;
            new_size |= new_size >> 4;
            new_size |= new_size >> 8;
            new_size |= new_size >> 16;
            new_size++;
            frame->rawdata_sz = new_size;
            frame->rawdata = (char *) lws_realloc(frame->rawdata, new_size);
        }

This portion of code would allow an attacker to set the packet header size far above the actual size of data being sent to the server, and the server would then allocate new memory based off of that information.

If the purported payload length is different than the raw length, I suggest structuring the code around the assumption that the raw length is correct.

libwebsock is failing the valgrind leak checks. I'm seeing it leak roughly 80kb per a connection. Obviously some allocated memory is not being freed up appropriately at the time of connect and disconnect. Need to dig through, find all the memory leaks and straighten them out.

It's already known that there are a few compile issues. The workaround is in the docs/INSTALL.txt file. I'll be working on them to try and straighten it out once I correct the memory leaks and add a little additional functionality. Right now, it's not stable for production use.

https://github.com/JonnyWhatshisface/libwebsock/blob/69127150f9685bf2a69b8b353375e202f7b240e1/src/websock.c#L207

Before i figured out that there is a newer libwebsocket2 ;-) i ran into a crash immediately after establishment of a secure connection. It occured every time i connected with chrome or firefox. After some hours i figured out, that in the mentioned line the increment won't work in case the previous loop ran into the lws_free(current) command. So i changed it into the following and it works fine.

*tinfo=state->tlist;
while (tinfo != NULL) 
{
    ...
    if (pthread_equal(current_thread, wrapper->thread)) {
        ...
        // increment to next before free!!!
        tinfo = tinfo->next;
        lws_free(current);
    } else {
        tinfo = tinfo->next;
    }
}

Maybe this info could save someone the day. Next of course i'll have a look on libwebsocket2.

Hello, I plan to compile and use this project under Windows, are there any know issues or library uncompatibilities? (So far I'm testing in Linux so I would like to prevent issues when I migrate and compile in Windows).

Thank you.

Building on macOS requires a number of extra steps that aren't documented.

1. Use Homebrew to install autoconf, glibtool, openssl, libevent.
2. Edit autogen.sh and change libtoolize to glibtoolize. (Necessary because the OS already includes a different tool called libtool, so when Homebrew installs GNU libtool it prefixes its commands with a g to avoid mixups.)
3. Now you can run autogen.sh.
4. Some more compiler flags need to be specified when configuring and building, so the compiler and linker can find the packages installed by Homebrew. Use CFLAGS="-I/usr/local/include -L/usr/local/lib -I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib -lpthread -levent" ./configure && make

After this is done, if you need to rebuild you should just be able to run make.

Hi JonnyWhatshisface, I would like to use libwebsock for my C program. Cloning the git and running autogen worked just fine. However when I try CFLAGS="-lpthread -levent" ./configure following error lands in my config.log:

This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.

It was created by libwebsock configure 1.0.7, which was
generated by GNU Autoconf 2.69.  Invocation command line was

  $ ./configure 

## --------- ##
## Platform. ##
## --------- ##

hostname = COMPUTESTICK
uname -m = x86_64
uname -r = 4.4.0-21-linuxium
uname -s = Linux
uname -v = #37+ics SMP Mon Apr 25 19:39:09 AEST 2016

/usr/bin/uname -p = unknown
/bin/uname -X     = unknown

/bin/arch              = unknown
/usr/bin/arch -k       = unknown
/usr/convex/getsysinfo = unknown
/usr/bin/hostinfo      = unknown
/bin/machine           = unknown
/usr/bin/oslevel       = unknown
/bin/universe          = unknown

PATH: /usr/local/sbin
PATH: /usr/local/bin
PATH: /usr/sbin
PATH: /usr/bin
PATH: /sbin
PATH: /bin
PATH: /usr/games
PATH: /usr/local/games


## ----------- ##
## Core tests. ##
## ----------- ##

configure:2328: checking for a BSD-compatible install
configure:2396: result: /usr/bin/install -c
configure:2407: checking whether build environment is sane
configure:2462: result: yes
configure:2613: checking for a thread-safe mkdir -p
configure:2652: result: /bin/mkdir -p
configure:2659: checking for gawk
configure:2675: found /usr/bin/gawk
configure:2686: result: gawk
configure:2697: checking whether make sets $(MAKE)
configure:2719: result: yes
configure:2748: checking whether make supports nested variables
configure:2765: result: yes
configure:2975: checking for gcc
configure:2991: found /usr/bin/gcc
configure:3002: result: gcc
configure:3231: checking for C compiler version
configure:3240: gcc --version >&5
gcc (Ubuntu 5.3.1-14ubuntu2.1) 5.3.1 20160413
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

configure:3251: $? = 0
configure:3240: gcc -v >&5
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/5/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 5.3.1-14ubuntu2.1' --with-bugurl=file:///usr/share/doc/gcc-5/README.Bugs --enable-languages=c,ada,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-5 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-5-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-5-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-5-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 5.3.1 20160413 (Ubuntu 5.3.1-14ubuntu2.1) 
configure:3251: $? = 0
configure:3240: gcc -V >&5
gcc: error: unrecognized command line option '-V'
gcc: fatal error: no input files
compilation terminated.
configure:3251: $? = 1
configure:3240: gcc -qversion >&5
gcc: error: unrecognized command line option '-qversion'
gcc: fatal error: no input files
compilation terminated.
configure:3251: $? = 1
configure:3271: checking whether the C compiler works
configure:3293: gcc -lpthread -levent   conftest.c  >&5
/usr/bin/ld: cannot find -levent
collect2: error: ld returned 1 exit status
configure:3297: $? = 1
configure:3335: result: no
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME "libwebsock"
| #define PACKAGE_TARNAME "libwebsock"
| #define PACKAGE_VERSION "1.0.7"
| #define PACKAGE_STRING "libwebsock 1.0.7"
| #define PACKAGE_BUGREPORT "[email protected]"
| #define PACKAGE_URL ""
| #define PACKAGE "libwebsock"
| #define VERSION "1.0.7"
| /* end confdefs.h.  */
| 
| int
| main ()
| {
| 
|   ;
|   return 0;
| }
configure:3340: error: in `/opt/libwebsock-code':
configure:3342: error: C compiler cannot create executables
See `config.log' for more details

## ---------------- ##
## Cache variables. ##
## ---------------- ##

ac_cv_env_CC_set=
ac_cv_env_CC_value=
ac_cv_env_CFLAGS_set=set
ac_cv_env_CFLAGS_value='-lpthread -levent'
ac_cv_env_CPPFLAGS_set=
ac_cv_env_CPPFLAGS_value=
ac_cv_env_CPP_set=
ac_cv_env_CPP_value=
ac_cv_env_LDFLAGS_set=
ac_cv_env_LDFLAGS_value=
ac_cv_env_LIBS_set=
ac_cv_env_LIBS_value=
ac_cv_env_LT_SYS_LIBRARY_PATH_set=
ac_cv_env_LT_SYS_LIBRARY_PATH_value=
ac_cv_env_build_alias_set=
ac_cv_env_build_alias_value=
ac_cv_env_host_alias_set=
ac_cv_env_host_alias_value=
ac_cv_env_target_alias_set=
ac_cv_env_target_alias_value=
ac_cv_path_install='/usr/bin/install -c'
ac_cv_path_mkdir=/bin/mkdir
ac_cv_prog_AWK=gawk
ac_cv_prog_ac_ct_CC=gcc
ac_cv_prog_make_make_set=yes
am_cv_make_support_nested_variables=yes

## ----------------- ##
## Output variables. ##
## ----------------- ##

ACLOCAL='${SHELL} /opt/libwebsock-code/missing aclocal-1.15'
AMDEPBACKSLASH=''
AMDEP_FALSE=''
AMDEP_TRUE=''
AMTAR='$${TAR-tar}'
AM_BACKSLASH='\'
AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'
AM_DEFAULT_VERBOSITY='1'
AM_V='$(V)'
AR=''
AUTOCONF='${SHELL} /opt/libwebsock-code/missing autoconf'
AUTOHEADER='${SHELL} /opt/libwebsock-code/missing autoheader'
AUTOMAKE='${SHELL} /opt/libwebsock-code/missing automake-1.15'
AWK='gawk'
CC='gcc'
CCDEPMODE=''
CFLAGS='-lpthread -levent'
CPP=''
CPPFLAGS=''
CYGPATH_W='echo'
DEFS=''
DEPDIR=''
DLLTOOL=''
DSYMUTIL=''
DUMPBIN=''
ECHO_C=''
ECHO_N='-n'
ECHO_T=''
EGREP=''
EXEEXT=''
FGREP=''
GREP=''
HAVE_SSL_FALSE=''
HAVE_SSL_TRUE=''
INSTALL_DATA='${INSTALL} -m 644'
INSTALL_PROGRAM='${INSTALL}'
INSTALL_SCRIPT='${INSTALL}'
INSTALL_STRIP_PROGRAM='$(install_sh) -c -s'
LD=''
LDFLAGS=''
LIBOBJS=''
LIBS=''
LIBTOOL=''
LIPO=''
LN_S=''
LTLIBOBJS=''
LT_SYS_LIBRARY_PATH=''
MAKEINFO='${SHELL} /opt/libwebsock-code/missing makeinfo'
MANIFEST_TOOL=''
MKDIR_P='/bin/mkdir -p'
NM=''
NMEDIT=''
OBJDUMP=''
OBJEXT=''
OTOOL64=''
OTOOL=''
PACKAGE='libwebsock'
PACKAGE_BUGREPORT='[email protected]'
PACKAGE_NAME='libwebsock'
PACKAGE_STRING='libwebsock 1.0.7'
PACKAGE_TARNAME='libwebsock'
PACKAGE_URL=''
PACKAGE_VERSION='1.0.7'
PATH_SEPARATOR=':'
RANLIB=''
SED=''
SET_MAKE=''
SHELL='/bin/bash'
STRIP=''
VERSION='1.0.7'
ac_ct_AR=''
ac_ct_CC='gcc'
ac_ct_DUMPBIN=''
am__EXEEXT_FALSE=''
am__EXEEXT_TRUE=''
am__fastdepCC_FALSE=''
am__fastdepCC_TRUE=''
am__include=''
am__isrc=''
am__leading_dot='.'
am__nodep=''
am__quote=''
am__tar='$${TAR-tar} chof - "$$tardir"'
am__untar='$${TAR-tar} xf -'
bindir='${exec_prefix}/bin'
build=''
build_alias=''
build_cpu=''
build_os=''
build_vendor=''
datadir='${datarootdir}'
datarootdir='${prefix}/share'
docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
dvidir='${docdir}'
exec_prefix='NONE'
host=''
host_alias=''
host_cpu=''
host_os=''
host_vendor=''
htmldir='${docdir}'
includedir='${prefix}/include'
infodir='${datarootdir}/info'
install_sh='${SHELL} /opt/libwebsock-code/install-sh'
libdir='${exec_prefix}/lib'
libexecdir='${exec_prefix}/libexec'
localedir='${datarootdir}/locale'
localstatedir='${prefix}/var'
mandir='${datarootdir}/man'
mkdir_p='$(MKDIR_P)'
oldincludedir='/usr/include'
pdfdir='${docdir}'
prefix='NONE'
program_transform_name='s,x,x,'
psdir='${docdir}'
runstatedir='${localstatedir}/run'
sbindir='${exec_prefix}/sbin'
sharedstatedir='${prefix}/com'
sysconfdir='${prefix}/etc'
target_alias=''

## ----------- ##
## confdefs.h. ##
## ----------- ##

/* confdefs.h */
#define PACKAGE_NAME "libwebsock"
#define PACKAGE_TARNAME "libwebsock"
#define PACKAGE_VERSION "1.0.7"
#define PACKAGE_STRING "libwebsock 1.0.7"
#define PACKAGE_BUGREPORT "[email protected]"
#define PACKAGE_URL ""
#define PACKAGE "libwebsock"
#define VERSION "1.0.7"

configure: exit 77

I hope you can help me fixing that issue. If you need further information, please let me know.

Best regards,

Sunacni

I started the initiative quite some time ago to completely re-write libwebsock after Payden's passing. An unexpected international move set me back a bit, but I'm finally settled in across the globe and back in to production. A majority of the core of libwebsock has been entirely re-written, and progress continues to be made on a daily basis. I'm working on it a few hours per a night and have gotten the bulk of it done. I'm anticipating a couple more weeks before a full on beta of 2.0.0 is available for hammering.

Let me be clear: The rewrite was to add more functionality and clean up the code base to make it "production worthy." Some of the enhancements, and their status, are as follows:

• Cleaner code base, more organized - One single header is now installed in /usr/local/include (websock.h) - making only the libwebsock API's available to the user. This reduces the overall footprint of the library, and also reduces the amount of crud loaded in to the user code. [ DONE ]
• libwebsock now has a scheduler - That's right, folks. The original method libwebsock used of spawning a thread per connection and thread per a message would not scale very well. Imagine 200k users connected to the current version of libwebsock all sending multiple messages... That would mean a pthread_create call per a message sent, which could be a little chaotic on the CPU cycles. The scheduler implementation has three separate schedulers now: a connection scheduler to handle incoming connection requests, a dispatcher scheduler to handle dispatching of messages and a control frame scheduler to handle any incoming control frames. Each scheduler has a user defined amount of workers with a default value of 16 (at least, during my testing as my dev box has sixteen cores available to it). [ DONE ]
• Each client connection now gets tied to an event base on one of the scheduler agent threads. Each thread has its own event base. [ DONE ]
• Listenserver context addition - libwebsock now easily allows the user to bind the library to their own socket implementation, making integration of libwebsock even simpler in to existing projects. For those who choose, the ability to have libwebsock create a non-blocking port and listen on it is still an option, and has been named a "listen server." [ DONE ]
• Improved memory management - A GC is under way and in the works for libwebsock to ensure proper memory allocation, tracking and cleanup, allowing future work on libwebsock to reduce the focus on memory management. If a free() is forgotten somewhere, the GC will take care of it. [ In Progress ]
• Client "tags" - One thing I've seen a lack of understanding in the community on is how to track the sockets to specific clients in a useful manner. It has been required to track and associate connections to specific "people," if you would, within user-land. This is still a feasible option, but libwebsock2 introduces a new "tag" on the client structure. libwebsocket did something similar, but didn't include a way to do anything useful from directly within the library with that tag. libwebsock2 introduces the new libwebsock_send_text_by_tag(); function, as well as a libwebsock_send_binary_by_tag(); function, which will allow you to send to the specific session(s) that have the specified tag. example: libwebsock_send_text_by_tag("jonnywhatshisface", "Private message for Jonny Whatshisface!"); [ DONE ]
• Memory used per connection greatly reduced - libwebsock pre-2.0 held a LOT of things within the client state context that wasn't really required with the way libwebsock2 is laid out. For instance, the ssl state... The truth is that if SSL is enabled from the context-level, you aren't going to have some clients using SSL and some not. Either you use it, or you don't. [ DONE ]
• Geared towards threaded applications - The old libwebsock was really intended for use in single threaded applications. The new libwebsock opens up doors for implementation in threaded apps. The contexts now take assignment of the lws_listenserver struct holding the fd and port number of the listen server, be it yours or the built-in one of libwebsock. Please note that the introduction of this new structure serves multiple purposes, one of which is the new type (lws_sockfd) which eliminates issues with pointer truncation on WIN32 platforms. (did I mention more support for WIN32 is under way?) [ DONE ]
• non-deprecated OpenSSL code - The old version worked fine with SSL, but I'm not a fan of seeing warnings when I compile anything. The OpenSSL implementation caused an endless stream of gawking from my GCC due to deprecated functions. This is no more. [ In Progress ]
• Support for Sec-WebSocket-Protocol - This was added in and a pull request generated by another user. His addition made it in to libwebsock2, and he has been given credit for it. [ DONE ]
• uri Support - Yet another contribution from another user in their fork that a PR was generated for. Again, credit was given where credit is due. [ DONE ]
• Examples - The library is only as good as the examples provided with it for its use. The new release will come with multiple examples, showing usage in the form of chats, instant messaging, file uploads and even use in multi-threaded applications. [ In Progress ]
• MAN pages! - Yep, there's now libwebsock man pages. They look pretty, too. They outline all the goodies about libwebsock, and all the API calls anyone will ever need. [ In Progress ]
• Documentation, documentation and more documentation - It's turning in to a real project now. I really wish Payden could be here to see it, but massive contribution to the initial development is heading towards the growth of something great. [ In Progress ]

Completion Status: All together, it's about 65% complete, and I'm anticipating about another three weeks or so until it's ready for beta testing.