MyFavMirrors/moonfire-nvr
1
0
Fork 0
mirror of https://github.com/scottlamb/moonfire-nvr.git synced 2025-03-13 21:12:55 -04:00
Code Issues Packages Projects Releases Wiki Activity
moonfire-nvr/server/src/web/websocket.rs

151 lines
5.4 KiB
Rust
Raw Normal View History

rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
// This file is part of Moonfire NVR, a security camera network video recorder.
// Copyright (C) 2021 The Moonfire NVR Authors; see AUTHORS and LICENSE.txt.
// SPDX-License-Identifier: GPL-v3.0-or-later WITH GPL-3.0-linking-exception.
//! Common code for WebSockets, including the live view WebSocket and a future
//! WebSocket for watching database changes.
use std::pin::Pin;
use crate::body::Body;
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
use base::{bail, err};
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
use futures::{Future, SinkExt};
use http::{header, Request, Response};
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
use tokio_tungstenite::tungstenite;
switch from `log` to `tracing` I think this is a big improvement in readability. I removed the `lnav` config, which is a little sad, but I don't think it supports this structured logging format well. Still seems worthwhile on balance.
2023-02-15 23:14:54 -08:00
use tracing::Instrument;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
pub type WebSocketStream =
tokio_tungstenite::WebSocketStream<hyper_util::rt::TokioIo<hyper::upgrade::Upgraded>>;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
/// Upgrades to WebSocket and runs the supplied stream handler in a separate tokio task.
///
/// Fails on `Origin` mismatch with an HTTP-level error. If the handler returns
/// an error, tries to send it to the client before dropping the stream.
log error messages in web paths HTTP requests were only returning the error message to the caller, not logging locally. In most cases the problem could be understood client-side, but there are some exceptions. E.g. if Moonfire returns a 403 on WebSocket update, even in the Chrome debug tools's network tab the HTTP response body seems to be unavailable. And in general, it's nice to have more context server-side. Logging a `response::Body` isn't practical (it could be a stream), so convert all the web stuff to use `base::Error` err returns. Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a bit lame but punts on having some way of plumbing an explicit/overridden status code in `base::Error`, as no gRPC error kind cleanly maps to that. Also convert `db::auth`, rather than making up an error kind in the web layer. This is also a small step toward getting rid of `failure::Error`.
2023-07-09 07:45:41 -07:00
pub(super) fn upgrade<H>(
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
req: Request<::hyper::body::Incoming>,
log error messages in web paths HTTP requests were only returning the error message to the caller, not logging locally. In most cases the problem could be understood client-side, but there are some exceptions. E.g. if Moonfire returns a 403 on WebSocket update, even in the Chrome debug tools's network tab the HTTP response body seems to be unavailable. And in general, it's nice to have more context server-side. Logging a `response::Body` isn't practical (it could be a stream), so convert all the web stuff to use `base::Error` err returns. Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a bit lame but punts on having some way of plumbing an explicit/overridden status code in `base::Error`, as no gRPC error kind cleanly maps to that. Also convert `db::auth`, rather than making up an error kind in the web layer. This is also a small step toward getting rid of `failure::Error`.
2023-07-09 07:45:41 -07:00
handler: H,
) -> Result<Response<Body>, base::Error>
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
where
for<'a> H: FnOnce(
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
&'a mut WebSocketStream,
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
) -> Pin<Box<dyn Future<Output = Result<(), base::Error>> + Send + 'a>>
+ Send
+ 'static,
{
// An `Origin` mismatch should be a HTTP-level error; this is likely a cross-site attack,
// and using HTTP-level errors avoids giving any information to the Javascript running in
// the browser.
check_origin(req.headers())?;
// Otherwise, upgrade and handle the rest in a separate task.
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
let response = tungstenite::handshake::server::create_response_with_body(&req, Body::empty)
.map_err(|e| err!(InvalidArgument, source(e)))?;
switch from `log` to `tracing` I think this is a big improvement in readability. I removed the `lnav` config, which is a little sad, but I don't think it supports this structured logging format well. Still seems worthwhile on balance.
2023-02-15 23:14:54 -08:00
let span = tracing::info_span!("websocket");
tokio::spawn(
async move {
let upgraded = match hyper::upgrade::on(req).await {
Ok(u) => u,
Err(err) => {
tracing::error!(%err, "upgrade failed");
return;
}
};
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
let upgraded = hyper_util::rt::TokioIo::new(upgraded);
let mut ws = WebSocketStream::from_raw_socket(
switch from `log` to `tracing` I think this is a big improvement in readability. I removed the `lnav` config, which is a little sad, but I don't think it supports this structured logging format well. Still seems worthwhile on balance.
2023-02-15 23:14:54 -08:00
upgraded,
tungstenite::protocol::Role::Server,
None,
)
.await;
if let Err(err) = handler(&mut ws).await {
// TODO: use a nice JSON message format for errors.
tracing::error!(%err, "closing with error");
let _ = ws.send(tungstenite::Message::Text(err.to_string())).await;
} else {
tracing::info!("closing");
};
let _ = ws.close(None).await;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
}
switch from `log` to `tracing` I think this is a big improvement in readability. I removed the `lnav` config, which is a little sad, but I don't think it supports this structured logging format well. Still seems worthwhile on balance.
2023-02-15 23:14:54 -08:00
.instrument(span),
);
upgrade to hyper/http 1.0 In the process, no longer wait for pending HTTP requests on shutdown. This just extended the time Moonfire was running without streaming.
2024-08-23 20:56:40 -07:00
Ok(response)
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
}
/// Checks the `Host` and `Origin` headers match, if the latter is supplied.
///
/// Web browsers must supply origin, according to [RFC 6455 section
/// 4.1](https://datatracker.ietf.org/doc/html/rfc6455#section-4.1).
/// It's not required for non-browser HTTP clients.
///
/// If present, verify it. Chrome doesn't honor the `s=` cookie's
/// `SameSite=Lax` setting for WebSocket requests, so this is the sole
/// protection against [CSWSH](https://christian-schneider.net/CrossSiteWebSocketHijacking.html).
log error messages in web paths HTTP requests were only returning the error message to the caller, not logging locally. In most cases the problem could be understood client-side, but there are some exceptions. E.g. if Moonfire returns a 403 on WebSocket update, even in the Chrome debug tools's network tab the HTTP response body seems to be unavailable. And in general, it's nice to have more context server-side. Logging a `response::Body` isn't practical (it could be a stream), so convert all the web stuff to use `base::Error` err returns. Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a bit lame but punts on having some way of plumbing an explicit/overridden status code in `base::Error`, as no gRPC error kind cleanly maps to that. Also convert `db::auth`, rather than making up an error kind in the web layer. This is also a small step toward getting rid of `failure::Error`.
2023-07-09 07:45:41 -07:00
fn check_origin(headers: &header::HeaderMap) -> Result<(), base::Error> {
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
let origin_hdr = match headers.get(http::header::ORIGIN) {
None => return Ok(()),
Some(o) => o,
};
log error messages in web paths HTTP requests were only returning the error message to the caller, not logging locally. In most cases the problem could be understood client-side, but there are some exceptions. E.g. if Moonfire returns a 403 on WebSocket update, even in the Chrome debug tools's network tab the HTTP response body seems to be unavailable. And in general, it's nice to have more context server-side. Logging a `response::Body` isn't practical (it could be a stream), so convert all the web stuff to use `base::Error` err returns. Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a bit lame but punts on having some way of plumbing an explicit/overridden status code in `base::Error`, as no gRPC error kind cleanly maps to that. Also convert `db::auth`, rather than making up an error kind in the web layer. This is also a small step toward getting rid of `failure::Error`.
2023-07-09 07:45:41 -07:00
let Some(host_hdr) = headers.get(header::HOST) else {
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
bail!(InvalidArgument, msg("missing Host header"));
log error messages in web paths HTTP requests were only returning the error message to the caller, not logging locally. In most cases the problem could be understood client-side, but there are some exceptions. E.g. if Moonfire returns a 403 on WebSocket update, even in the Chrome debug tools's network tab the HTTP response body seems to be unavailable. And in general, it's nice to have more context server-side. Logging a `response::Body` isn't practical (it could be a stream), so convert all the web stuff to use `base::Error` err returns. Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a bit lame but punts on having some way of plumbing an explicit/overridden status code in `base::Error`, as no gRPC error kind cleanly maps to that. Also convert `db::auth`, rather than making up an error kind in the web layer. This is also a small step toward getting rid of `failure::Error`.
2023-07-09 07:45:41 -07:00
};
let host_str = host_hdr
.to_str()
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
.map_err(|_| err!(InvalidArgument, msg("bad Host header")))?;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
// Currently this ignores the port number. This is easiest and I think matches the browser's
// rules for when it sends a cookie, so it probably doesn't cause great security problems.
let host = match host_str.split_once(':') {
Some((host, _port)) => host,
None => host_str,
};
let origin_url = origin_hdr
.to_str()
.ok()
.and_then(|o| url::Url::parse(o).ok())
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
.ok_or_else(|| err!(InvalidArgument, msg("bad Origin header")))?;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
let origin_host = origin_url
.host_str()
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
.ok_or_else(|| err!(InvalidArgument, msg("bad Origin header")))?;
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
if host != origin_host {
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
bail!(
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
PermissionDenied,
massive error overhaul * fully stop using ancient `failure` crate in favor of own error type * set an `ErrorKind` on everything
2023-07-09 22:04:17 -07:00
msg(
"cross-origin request forbidden (request host {host_hdr:?}, origin {origin_hdr:?})"
),
rework WebSocket error return protocol This gives much better information to the UI layer, getting rid of a whole troubleshooting guide entry. See #119 #132 #218 #219 I also restructured the code in anticipation of a new WebSocket event stream (#40).
2023-02-15 07:04:50 -08:00
);
}
Ok(())
}
#[cfg(test)]
mod tests {
use std::convert::TryInto;
use super::*;
#[test]
fn origin_port_8080_okay() {
// By default, Moonfire binds to port 8080. Make sure that specifying a port number works.
let mut hdrs = header::HeaderMap::new();
hdrs.insert(header::HOST, "nvr:8080".try_into().unwrap());
hdrs.insert(header::ORIGIN, "http://nvr:8080/".try_into().unwrap());
assert!(check_origin(&hdrs).is_ok());
}
#[test]
fn origin_missing_okay() {
let mut hdrs = header::HeaderMap::new();
hdrs.insert(header::HOST, "nvr".try_into().unwrap());
assert!(check_origin(&hdrs).is_ok());
}
#[test]
fn origin_mismatch_fails() {
let mut hdrs = header::HeaderMap::new();
hdrs.insert(header::HOST, "nvr".try_into().unwrap());
hdrs.insert(header::ORIGIN, "http://evil/".try_into().unwrap());
assert!(check_origin(&hdrs).is_err());
}
}
Reference in New Issue Copy Permalink