1 // Copyright 2012 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/websockets/websocket_frame.h"
6
7 #include <stddef.h>
8 #include <string.h>
9
10 #include <ostream>
11
12 #include "base/check.h"
13 #include "base/check_op.h"
14 #include "base/containers/span.h"
15 #include "base/containers/span_writer.h"
16 #include "base/numerics/safe_conversions.h"
17 #include "base/rand_util.h"
18 #include "base/ranges/algorithm.h"
19 #include "build/build_config.h"
20 #include "net/base/net_errors.h"
21
22 namespace net {
23
24 namespace {
25
26 // GCC (and Clang) can transparently use vector ops. Only try to do this on
27 // architectures where we know it works, otherwise gcc will attempt to emulate
28 // the vector ops, which is unlikely to be efficient.
29 #if defined(COMPILER_GCC) && \
30 (defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY))
31
32 using PackedMaskType = uint32_t __attribute__((vector_size(16)));
33
34 #else
35
36 using PackedMaskType = size_t;
37
38 #endif // defined(COMPILER_GCC) &&
39 // (defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY))
40
41 constexpr uint8_t kFinalBit = 0x80;
42 constexpr uint8_t kReserved1Bit = 0x40;
43 constexpr uint8_t kReserved2Bit = 0x20;
44 constexpr uint8_t kReserved3Bit = 0x10;
45 constexpr uint8_t kOpCodeMask = 0xF;
46 constexpr uint8_t kMaskBit = 0x80;
47 constexpr uint64_t kMaxPayloadLengthWithoutExtendedLengthField = 125;
48 constexpr uint64_t kPayloadLengthWithTwoByteExtendedLengthField = 126;
49 constexpr uint64_t kPayloadLengthWithEightByteExtendedLengthField = 127;
50
MaskWebSocketFramePayloadByBytes(const WebSocketMaskingKey & masking_key,size_t masking_key_offset,char * const begin,char * const end)51 inline void MaskWebSocketFramePayloadByBytes(
52 const WebSocketMaskingKey& masking_key,
53 size_t masking_key_offset,
54 char* const begin,
55 char* const end) {
56 for (char* masked = begin; masked != end; ++masked) {
57 *masked ^= masking_key.key[masking_key_offset++ %
58 WebSocketFrameHeader::kMaskingKeyLength];
59 }
60 }
61
62 } // namespace
63
Clone() const64 std::unique_ptr<WebSocketFrameHeader> WebSocketFrameHeader::Clone() const {
65 auto ret = std::make_unique<WebSocketFrameHeader>(opcode);
66 ret->CopyFrom(*this);
67 return ret;
68 }
69
CopyFrom(const WebSocketFrameHeader & source)70 void WebSocketFrameHeader::CopyFrom(const WebSocketFrameHeader& source) {
71 final = source.final;
72 reserved1 = source.reserved1;
73 reserved2 = source.reserved2;
74 reserved3 = source.reserved3;
75 opcode = source.opcode;
76 masked = source.masked;
77 masking_key = source.masking_key;
78 payload_length = source.payload_length;
79 }
80
WebSocketFrame(WebSocketFrameHeader::OpCode opcode)81 WebSocketFrame::WebSocketFrame(WebSocketFrameHeader::OpCode opcode)
82 : header(opcode) {}
83
84 WebSocketFrame::~WebSocketFrame() = default;
85
86 WebSocketFrameChunk::WebSocketFrameChunk() = default;
87
88 WebSocketFrameChunk::~WebSocketFrameChunk() = default;
89
GetWebSocketFrameHeaderSize(const WebSocketFrameHeader & header)90 size_t GetWebSocketFrameHeaderSize(const WebSocketFrameHeader& header) {
91 size_t extended_length_size = 0u;
92 if (header.payload_length > kMaxPayloadLengthWithoutExtendedLengthField &&
93 header.payload_length <= UINT16_MAX) {
94 extended_length_size = 2u;
95 } else if (header.payload_length > UINT16_MAX) {
96 extended_length_size = 8u;
97 }
98
99 return (WebSocketFrameHeader::kBaseHeaderSize + extended_length_size +
100 (header.masked ? WebSocketFrameHeader::kMaskingKeyLength : 0u));
101 }
102
WriteWebSocketFrameHeader(const WebSocketFrameHeader & header,const WebSocketMaskingKey * masking_key,char * buffer_ptr,int buffer_size)103 int WriteWebSocketFrameHeader(const WebSocketFrameHeader& header,
104 const WebSocketMaskingKey* masking_key,
105 char* buffer_ptr,
106 int buffer_size) {
107 base::span<uint8_t> buffer = base::as_writable_bytes(
108 // TODO(crbug.com/40284755): It's not possible to construct this span
109 // soundedly here. WriteWebSocketFrameHeader() should receive a span
110 // instead of a pointer and length.
111 UNSAFE_BUFFERS(
112 base::span(buffer_ptr, base::checked_cast<size_t>(buffer_size))));
113
114 DCHECK((header.opcode & kOpCodeMask) == header.opcode)
115 << "header.opcode must fit to kOpCodeMask.";
116 DCHECK(header.payload_length <= static_cast<uint64_t>(INT64_MAX))
117 << "WebSocket specification doesn't allow a frame longer than "
118 << "INT64_MAX (0x7FFFFFFFFFFFFFFF) bytes.";
119
120 // WebSocket frame format is as follows:
121 // - Common header (2 bytes)
122 // - Optional extended payload length
123 // (2 or 8 bytes, present if actual payload length is more than 125 bytes)
124 // - Optional masking key (4 bytes, present if MASK bit is on)
125 // - Actual payload (XOR masked with masking key if MASK bit is on)
126 //
127 // This function constructs frame header (the first three in the list
128 // above).
129
130 size_t header_size = GetWebSocketFrameHeaderSize(header);
131 if (header_size > buffer.size()) {
132 return ERR_INVALID_ARGUMENT;
133 }
134
135 base::SpanWriter writer(buffer);
136
137 uint8_t first_byte = 0u;
138 first_byte |= header.final ? kFinalBit : 0u;
139 first_byte |= header.reserved1 ? kReserved1Bit : 0u;
140 first_byte |= header.reserved2 ? kReserved2Bit : 0u;
141 first_byte |= header.reserved3 ? kReserved3Bit : 0u;
142 first_byte |= header.opcode & kOpCodeMask;
143 writer.WriteU8BigEndian(first_byte);
144
145 int extended_length_size = 0;
146 uint8_t second_byte = 0u;
147 second_byte |= header.masked ? kMaskBit : 0u;
148 if (header.payload_length <= kMaxPayloadLengthWithoutExtendedLengthField) {
149 second_byte |= header.payload_length;
150 } else if (header.payload_length <= UINT16_MAX) {
151 second_byte |= kPayloadLengthWithTwoByteExtendedLengthField;
152 extended_length_size = 2;
153 } else {
154 second_byte |= kPayloadLengthWithEightByteExtendedLengthField;
155 extended_length_size = 8;
156 }
157 writer.WriteU8BigEndian(second_byte);
158
159 // Writes "extended payload length" field.
160 if (extended_length_size == 2) {
161 writer.WriteU16BigEndian(static_cast<uint16_t>(header.payload_length));
162 } else if (extended_length_size == 8) {
163 writer.WriteU64BigEndian(header.payload_length);
164 }
165
166 // Writes "masking key" field, if needed.
167 if (header.masked) {
168 DCHECK(masking_key);
169 writer.Write(masking_key->key);
170 } else {
171 DCHECK(!masking_key);
172 }
173
174 // Verify we wrote the expected number of bytes.
175 DCHECK_EQ(header_size, writer.num_written());
176 return header_size;
177 }
178
GenerateWebSocketMaskingKey()179 WebSocketMaskingKey GenerateWebSocketMaskingKey() {
180 // Masking keys should be generated from a cryptographically secure random
181 // number generator, which means web application authors should not be able
182 // to guess the next value of masking key.
183 WebSocketMaskingKey masking_key;
184 base::RandBytes(masking_key.key, WebSocketFrameHeader::kMaskingKeyLength);
185 return masking_key;
186 }
187
MaskWebSocketFramePayload(const WebSocketMaskingKey & masking_key,uint64_t frame_offset,char * const data,int data_size)188 void MaskWebSocketFramePayload(const WebSocketMaskingKey& masking_key,
189 uint64_t frame_offset,
190 char* const data,
191 int data_size) {
192 static constexpr size_t kMaskingKeyLength =
193 WebSocketFrameHeader::kMaskingKeyLength;
194
195 DCHECK_GE(data_size, 0);
196
197 // Most of the masking is done in chunks of sizeof(PackedMaskType), except for
198 // the beginning and the end of the buffer which may be unaligned.
199 // PackedMaskType must be a multiple of kMaskingKeyLength in size.
200 PackedMaskType packed_mask_key;
201 static constexpr size_t kPackedMaskKeySize = sizeof(packed_mask_key);
202 static_assert((kPackedMaskKeySize >= kMaskingKeyLength &&
203 kPackedMaskKeySize % kMaskingKeyLength == 0),
204 "PackedMaskType size is not a multiple of mask length");
205 char* const end = data + data_size;
206 // If the buffer is too small for the vectorised version to be useful, revert
207 // to the byte-at-a-time implementation early.
208 if (data_size <= static_cast<int>(kPackedMaskKeySize * 2)) {
209 MaskWebSocketFramePayloadByBytes(
210 masking_key, frame_offset % kMaskingKeyLength, data, end);
211 return;
212 }
213 const size_t data_modulus =
214 reinterpret_cast<size_t>(data) % kPackedMaskKeySize;
215 char* const aligned_begin =
216 data_modulus == 0 ? data : (data + kPackedMaskKeySize - data_modulus);
217 // Guaranteed by the above check for small data_size.
218 DCHECK(aligned_begin < end);
219 MaskWebSocketFramePayloadByBytes(
220 masking_key, frame_offset % kMaskingKeyLength, data, aligned_begin);
221 const size_t end_modulus = reinterpret_cast<size_t>(end) % kPackedMaskKeySize;
222 char* const aligned_end = end - end_modulus;
223 // Guaranteed by the above check for small data_size.
224 DCHECK(aligned_end > aligned_begin);
225 // Create a version of the mask which is rotated by the appropriate offset
226 // for our alignment. The "trick" here is that 0 XORed with the mask will
227 // give the value of the mask for the appropriate byte.
228 char realigned_mask[kMaskingKeyLength] = {};
229 MaskWebSocketFramePayloadByBytes(
230 masking_key,
231 (frame_offset + aligned_begin - data) % kMaskingKeyLength,
232 realigned_mask,
233 realigned_mask + kMaskingKeyLength);
234
235 for (size_t i = 0; i < kPackedMaskKeySize; i += kMaskingKeyLength) {
236 // memcpy() is allegedly blessed by the C++ standard for type-punning.
237 memcpy(reinterpret_cast<char*>(&packed_mask_key) + i,
238 realigned_mask,
239 kMaskingKeyLength);
240 }
241
242 // The main loop.
243 for (char* merged = aligned_begin; merged != aligned_end;
244 merged += kPackedMaskKeySize) {
245 // This is not quite standard-compliant C++. However, the standard-compliant
246 // equivalent (using memcpy()) compiles to slower code using g++. In
247 // practice, this will work for the compilers and architectures currently
248 // supported by Chromium, and the tests are extremely unlikely to pass if a
249 // future compiler/architecture breaks it.
250 *reinterpret_cast<PackedMaskType*>(merged) ^= packed_mask_key;
251 }
252
253 MaskWebSocketFramePayloadByBytes(
254 masking_key,
255 (frame_offset + (aligned_end - data)) % kMaskingKeyLength,
256 aligned_end,
257 end);
258 }
259
260 } // namespace net
261