2011-01-13 00:09:54 +00:00
|
|
|
## websockify: WebSockets support for any application/server
|
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
websockify was formerly named wsproxy and was part of the
|
2011-01-13 00:09:54 +00:00
|
|
|
[noVNC](https://github.com/kanaka/noVNC) project.
|
|
|
|
|
|
|
|
At the most basic level, websockify just translates WebSockets traffic
|
2011-10-06 16:56:36 +01:00
|
|
|
to normal socket traffic. Websockify accepts the WebSockets handshake,
|
2011-01-13 00:09:54 +00:00
|
|
|
parses it, and then begins forwarding traffic between the client and
|
2011-10-06 16:56:36 +01:00
|
|
|
the target in both directions.
|
2011-01-13 00:09:54 +00:00
|
|
|
|
2011-10-06 16:56:36 +01:00
|
|
|
### WebSockets binary data
|
|
|
|
|
2013-03-12 18:54:11 +00:00
|
|
|
Starting with websockify 0.5.0, only the HyBi / IETF
|
2013-03-12 18:46:45 +00:00
|
|
|
6455 WebSocket protocol is supported.
|
2012-10-29 22:17:56 +00:00
|
|
|
|
2013-03-12 18:54:11 +00:00
|
|
|
Websockify negotiates whether to base64 encode traffic to and from the
|
|
|
|
client via the subprotocol header (Sec-WebSocket-Protocol). The valid
|
|
|
|
subprotocol values are 'binary' and 'base64' and if the client sends
|
|
|
|
both then the server (the python implementation) will prefer 'binary'.
|
|
|
|
The 'binary' subprotocol indicates that the data will be sent raw
|
|
|
|
using binary WebSocket frames. Some HyBi clients (such as the Flash
|
|
|
|
fallback and older Chrome and iOS versions) do not support binary data
|
|
|
|
which is why the negotiation is necessary.
|
2012-10-29 22:17:56 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
|
2012-02-02 13:05:55 +00:00
|
|
|
### Encrypted WebSocket connections (wss://)
|
|
|
|
|
|
|
|
To encrypt the traffic using the WebSocket 'wss://' URI scheme you
|
|
|
|
need to generate a certificate for websockify to load. By default websockify
|
|
|
|
loads a certificate file name `self.pem` but the `--cert=CERT` option can
|
|
|
|
override the file name. You can generate a self-signed certificate using
|
|
|
|
openssl. When asked for the common name, use the hostname of the server where
|
|
|
|
the proxy will be running:
|
|
|
|
|
|
|
|
```
|
|
|
|
openssl req -new -x509 -days 365 -nodes -out self.pem -keyout self.pem
|
|
|
|
```
|
|
|
|
|
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
### Websock Javascript library
|
|
|
|
|
2011-10-06 22:55:10 +01:00
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
The `include/websock.js` Javascript library library provides a Websock
|
|
|
|
object that is similar to the standard WebSocket object but Websock
|
|
|
|
enables communication with raw TCP sockets (i.e. the binary stream)
|
|
|
|
via websockify. This is accomplished by base64 encoding the data
|
|
|
|
stream between Websock and websockify.
|
|
|
|
|
|
|
|
Websock has built-in receive queue buffering; the message event
|
|
|
|
does not contain actual data but is simply a notification that
|
|
|
|
there is new data available. Several rQ* methods are available to
|
|
|
|
read binary data off of the receive queue.
|
|
|
|
|
2011-10-06 22:55:10 +01:00
|
|
|
The Websock API is documented on the [websock.js API wiki page](https://github.com/kanaka/websockify/wiki/websock.js)
|
|
|
|
|
2011-01-13 06:53:08 +00:00
|
|
|
See the "Wrap a Program" section below for an example of using Websock
|
|
|
|
and websockify as a browser telnet client (`wstelnet.html`).
|
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Additional websockify features
|
|
|
|
|
|
|
|
These are not necessary for the basic operation.
|
|
|
|
|
|
|
|
* Daemonizing: When the `-D` option is specified, websockify runs
|
|
|
|
in the background as a daemon process.
|
|
|
|
|
|
|
|
* SSL (the wss:// WebSockets URI): This is detected automatically by
|
|
|
|
websockify by sniffing the first byte sent from the client and then
|
|
|
|
wrapping the socket if the data starts with '\x16' or '\x80'
|
|
|
|
(indicating SSL).
|
|
|
|
|
|
|
|
* Flash security policy: websockify detects flash security policy
|
|
|
|
requests (again by sniffing the first packet) and answers with an
|
|
|
|
appropriate flash security policy response (and then closes the
|
|
|
|
port). This means no separate flash security policy server is needed
|
|
|
|
for supporting the flash WebSockets fallback emulator.
|
|
|
|
|
|
|
|
* Session recording: This feature that allows recording of the traffic
|
|
|
|
sent and received from the client to a file using the `--record`
|
|
|
|
option.
|
|
|
|
|
|
|
|
* Mini-webserver: websockify can detect and respond to normal web
|
|
|
|
requests on the same port as the WebSockets proxy and Flash security
|
|
|
|
policy. This functionality is activate with the `--web DIR` option
|
|
|
|
where DIR is the root of the web directory to serve.
|
|
|
|
|
|
|
|
* Wrap a program: see the "Wrap a Program" section below.
|
|
|
|
|
|
|
|
|
|
|
|
### Implementations of websockify
|
|
|
|
|
2012-02-23 23:45:27 +00:00
|
|
|
The primary implementation of websockify is in python. There are
|
|
|
|
several alternate implementations in other languages (C, Node.js,
|
|
|
|
Clojure, Ruby) in the `other/` subdirectory (with varying levels of
|
|
|
|
functionality).
|
|
|
|
|
|
|
|
In addition there are several other external projects that implement
|
|
|
|
the websockify "protocol". See the alternate implementation [Feature
|
|
|
|
Matrix](https://github.com/kanaka/websockify/wiki/Feature_Matrix) for
|
|
|
|
more information.
|
2012-01-30 21:00:58 +00:00
|
|
|
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Wrap a Program
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
In addition to proxying from a source address to a target address
|
|
|
|
(which may be on a different system), websockify has the ability to
|
|
|
|
launch a program on the local system and proxy WebSockets traffic to
|
|
|
|
a normal TCP port owned/bound by the program.
|
2010-07-23 18:30:31 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The is accomplished with a small LD_PRELOAD library (`rebind.so`)
|
|
|
|
which intercepts bind() system calls by the program. The specified
|
|
|
|
port is moved to a new localhost/loopback free high port. websockify
|
|
|
|
then proxies WebSockets traffic directed to the original port to the
|
|
|
|
new (moved) port of the program.
|
2010-07-23 18:30:31 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The program wrap mode is invoked by replacing the target with `--`
|
|
|
|
followed by the program command line to wrap.
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2014-01-13 19:25:13 +00:00
|
|
|
`./run 2023 -- PROGRAM ARGS`
|
2010-07-09 16:52:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The `--wrap-mode` option can be used to indicate what action to take
|
|
|
|
when the wrapped program exits or daemonizes.
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
Here is an example of using websockify to wrap the vncserver command
|
|
|
|
(which backgrounds itself) for use with
|
|
|
|
[noVNC](https://github.com/kanaka/noVNC):
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2014-01-13 19:25:13 +00:00
|
|
|
`./run 5901 --wrap-mode=ignore -- vncserver -geometry 1024x768 :1`
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2014-01-13 19:25:13 +00:00
|
|
|
Here is an example of wrapping telnetd (from krb5-telnetd). telnetd
|
2011-01-13 00:09:54 +00:00
|
|
|
exits after the connection closes so the wrap mode is set to respawn
|
|
|
|
the command:
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2014-01-13 19:25:13 +00:00
|
|
|
`sudo ./run 2023 --wrap-mode=respawn -- telnetd -debug 2023`
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The `wstelnet.html` page demonstrates a simple WebSockets based telnet
|
2014-01-13 19:25:13 +00:00
|
|
|
client (use 'localhost' and '2023' for the host and port
|
|
|
|
respectively).
|
2011-01-04 18:19:54 +00:00
|
|
|
|
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Building the Python ssl module (for python 2.5 and older)
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
* Install the build dependencies. On Ubuntu use this command:
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`sudo aptitude install python-dev bluetooth-dev`
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2013-11-20 13:30:04 +00:00
|
|
|
* At the top level of the websockify repostory, download, build and
|
|
|
|
symlink the ssl module:
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2013-11-20 13:30:04 +00:00
|
|
|
`wget --no-check-certificate http://pypi.python.org/packages/source/s/ssl/ssl-1.15.tar.gz`
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`tar xvzf ssl-1.15.tar.gz`
|
2010-09-24 16:45:33 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`cd ssl-1.15`
|
2010-09-24 16:45:33 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`make`
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`cd ../`
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`ln -sf ssl-1.15/build/lib.linux-*/ssl ssl`
|
2010-04-07 03:34:56 +01:00
|
|
|
|