2011-01-13 00:09:54 +00:00
|
|
|
## websockify: WebSockets support for any application/server
|
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
websockify was formerly named wsproxy and was part of the
|
2011-01-13 00:09:54 +00:00
|
|
|
[noVNC](https://github.com/kanaka/noVNC) project.
|
|
|
|
|
|
|
|
At the most basic level, websockify just translates WebSockets traffic
|
|
|
|
to normal socket traffic. websockify accepts the WebSockets handshake,
|
|
|
|
parses it, and then begins forwarding traffic between the client and
|
|
|
|
the target in both directions. WebSockets payload data is UTF-8
|
|
|
|
encoded so in order to transport binary data it must use an encoding
|
|
|
|
that can be encapsulated within UTF-8. websockify uses base64 to encode
|
|
|
|
all traffic to and from the client. Also, WebSockets traffic starts
|
|
|
|
with '\0' (0) and ends with '\xff' (255). Some buffering is done in
|
|
|
|
case the data from the client is not a full WebSockets frame (i.e.
|
|
|
|
does not end in 255).
|
|
|
|
|
|
|
|
|
2011-01-13 06:17:01 +00:00
|
|
|
### Websock Javascript library
|
|
|
|
|
|
|
|
The `include/websock.js` Javascript library library provides a Websock
|
|
|
|
object that is similar to the standard WebSocket object but Websock
|
|
|
|
enables communication with raw TCP sockets (i.e. the binary stream)
|
|
|
|
via websockify. This is accomplished by base64 encoding the data
|
|
|
|
stream between Websock and websockify.
|
|
|
|
|
|
|
|
Websock has built-in receive queue buffering; the message event
|
|
|
|
does not contain actual data but is simply a notification that
|
|
|
|
there is new data available. Several rQ* methods are available to
|
|
|
|
read binary data off of the receive queue.
|
|
|
|
|
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Additional websockify features
|
|
|
|
|
|
|
|
These are not necessary for the basic operation.
|
|
|
|
|
|
|
|
* Daemonizing: When the `-D` option is specified, websockify runs
|
|
|
|
in the background as a daemon process.
|
|
|
|
|
|
|
|
* SSL (the wss:// WebSockets URI): This is detected automatically by
|
|
|
|
websockify by sniffing the first byte sent from the client and then
|
|
|
|
wrapping the socket if the data starts with '\x16' or '\x80'
|
|
|
|
(indicating SSL).
|
|
|
|
|
|
|
|
* Flash security policy: websockify detects flash security policy
|
|
|
|
requests (again by sniffing the first packet) and answers with an
|
|
|
|
appropriate flash security policy response (and then closes the
|
|
|
|
port). This means no separate flash security policy server is needed
|
|
|
|
for supporting the flash WebSockets fallback emulator.
|
|
|
|
|
|
|
|
* Session recording: This feature that allows recording of the traffic
|
|
|
|
sent and received from the client to a file using the `--record`
|
|
|
|
option.
|
|
|
|
|
|
|
|
* Mini-webserver: websockify can detect and respond to normal web
|
|
|
|
requests on the same port as the WebSockets proxy and Flash security
|
|
|
|
policy. This functionality is activate with the `--web DIR` option
|
|
|
|
where DIR is the root of the web directory to serve.
|
|
|
|
|
|
|
|
* Wrap a program: see the "Wrap a Program" section below.
|
|
|
|
|
|
|
|
|
|
|
|
### Implementations of websockify
|
|
|
|
|
|
|
|
The primary implementation of websockify is in python. There are two
|
|
|
|
other implementations of websockify in C, and Node (node.js) in the
|
2011-01-13 06:17:01 +00:00
|
|
|
`other/` subdirectory.
|
2011-01-13 00:09:54 +00:00
|
|
|
|
|
|
|
Here is the feature support matrix for the the websockify
|
|
|
|
implementations:
|
|
|
|
|
|
|
|
<table>
|
|
|
|
<tr>
|
|
|
|
<th>Program</th>
|
|
|
|
<th>Language</th>
|
|
|
|
<th>Multiprocess</th>
|
|
|
|
<th>Daemonize</th>
|
|
|
|
<th>SSL/wss</th>
|
|
|
|
<th>Flash Policy Server</th>
|
|
|
|
<th>Session Record</th>
|
|
|
|
<th>Web Server</th>
|
|
|
|
<th>Program Wrap</th>
|
|
|
|
</tr> <tr>
|
|
|
|
<td>websockify</td>
|
|
|
|
<td>python</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes 1</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
</tr> <tr>
|
|
|
|
<td>other/websockify</td>
|
|
|
|
<td>C</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
</tr>
|
|
|
|
</tr> <tr>
|
|
|
|
<td>other/websockify.js</td>
|
|
|
|
<td>Node (node.js)</td>
|
|
|
|
<td>yes</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
<td>no</td>
|
|
|
|
</tr>
|
|
|
|
</table>
|
2010-04-07 03:34:56 +01:00
|
|
|
|
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
* Note 1: to use SSL/wss with python 2.5 or older, see the following
|
|
|
|
section on *Building the Python ssl module*.
|
2010-04-07 03:34:56 +01:00
|
|
|
|
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Wrap a Program
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
In addition to proxying from a source address to a target address
|
|
|
|
(which may be on a different system), websockify has the ability to
|
|
|
|
launch a program on the local system and proxy WebSockets traffic to
|
|
|
|
a normal TCP port owned/bound by the program.
|
2010-07-23 18:30:31 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The is accomplished with a small LD_PRELOAD library (`rebind.so`)
|
|
|
|
which intercepts bind() system calls by the program. The specified
|
|
|
|
port is moved to a new localhost/loopback free high port. websockify
|
|
|
|
then proxies WebSockets traffic directed to the original port to the
|
|
|
|
new (moved) port of the program.
|
2010-07-23 18:30:31 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The program wrap mode is invoked by replacing the target with `--`
|
|
|
|
followed by the program command line to wrap.
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`./websockify 2023 -- PROGRAM ARGS`
|
2010-07-09 16:52:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The `--wrap-mode` option can be used to indicate what action to take
|
|
|
|
when the wrapped program exits or daemonizes.
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
Here is an example of using websockify to wrap the vncserver command
|
|
|
|
(which backgrounds itself) for use with
|
|
|
|
[noVNC](https://github.com/kanaka/noVNC):
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`./websockify 5901 --wrap-mode=ignore -- vncserver -geometry 1024x768 :1`
|
2010-07-09 17:41:36 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
Here is an example of wrapping telnetd (from krb5-telnetd).telnetd
|
|
|
|
exits after the connection closes so the wrap mode is set to respawn
|
|
|
|
the command:
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`sudo ./websockify 2023 --wrap-mode=respawn -- telnetd -debug 2023`
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
The `wstelnet.html` page demonstrates a simple WebSockets based telnet
|
|
|
|
client.
|
2011-01-04 18:19:54 +00:00
|
|
|
|
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
### Building the Python ssl module (for python 2.5 and older)
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
* Install the build dependencies. On Ubuntu use this command:
|
2011-01-04 18:19:54 +00:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`sudo aptitude install python-dev bluetooth-dev`
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
* Download, build the ssl module and symlink to it:
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`cd websockify/`
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`wget http://pypi.python.org/packages/source/s/ssl/ssl-1.15.tar.gz`
|
2010-09-24 16:29:42 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`tar xvzf ssl-1.15.tar.gz`
|
2010-09-24 16:45:33 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`cd ssl-1.15`
|
2010-09-24 16:45:33 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`make`
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`cd ../`
|
2010-04-07 03:34:56 +01:00
|
|
|
|
2011-01-13 00:09:54 +00:00
|
|
|
`ln -sf ssl-1.15/build/lib.linux-*/ssl ssl`
|
2010-04-07 03:34:56 +01:00
|
|
|
|