Skip to content

Conversation

@mike-jumper
Copy link
Contributor

The build is currently broken on CentOS 7 with EPEL, where libwebsockets is available but at version 1.7.5. Several differences are in play which needed to be addressed here:

  • SSL client initialization flags do not exist. Instead, a set of documented integer values is used for no SSL (0), SSL with verification of certificate (1), and SSL which allows self-signed certificates (2). The latter is unfortunately very specific to self-signed certificates, leading to verification failures in other cases - more on that below.
  • The lws_callback_http_dummy() function which must be invoked within the event callback to perform some sort of housekeeping tasks internal to libwebsockets is not defined. The event callback is instead expected to simply return 0.
  • The pwsi member of the lws_client_connect_info structure does not exist. This can safely be removed - our original purpose for using it, exposing the guac_client to the event callback, no longer exists as the guac_client is exposed through a static variable instead.
  • The SSL verification of server certificates is explicitly bypassed if requested, but the error result is still checked in all cases and still fails the connection for all but extremely specific verification errors related to self-signed certificates. This is addressed through neutering the certificate verification entirely when ignore_cert is set, rather than just asking nicely.
  • Older libwebsockets will not fire LWS_CALLBACK_CLOSED events under some circumstances, instead only firing LWS_CALLBACK_WSI_DESTROY for the destruction of the WebSocket structure. Both need to be handled for the connection to close cleanly in all cases.

The pwsi member was previously used to ensure the lws structure was made
available to invocations of the event callback early in the connection
lifecycle such that the underlyin guac_client could always be retrieved.
Since the migration to guac_kubernetes_lws_current_client, this is not
necessary, and isn't supported in older versions of libwebsockets
anyway.
For older versions of libwebsockets, simply requesting that OpenSSL
ignore the verification result is insufficient, as libwebsockets
manually checks and confirms the verification result, producing an error
in all but specific cases.
…erlying WebSocket.

Older versions of libwebsockets will not necessarily invoke close events
under all circumstances, and will instead sometimes summarily destroy
the WebSocket. Thankfully there is another event for that, and newer
versions of libwebsockets continue to define that event. We can hook
into both to handle disconnect.
@asfgit asfgit merged commit 9c593bd into apache:master Sep 27, 2018
@mike-jumper mike-jumper deleted the fix-old-libwebsockets branch September 28, 2018 04:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants