Merge branch 'master' into fix-macos-build-warnings

cosminpolifronie · cosminpolifronie · commit fab3cdbc4985 · 2026-06-25T22:11:58.000+03:00
diff --git a/.github/workflows/unittest_linux.yml b/.github/workflows/unittest_linux.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   linux:
diff --git a/.github/workflows/unittest_linux_asan.yml b/.github/workflows/unittest_linux_asan.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   linux:
diff --git a/.github/workflows/unittest_mac_tsan_mbedtls.yml b/.github/workflows/unittest_mac_tsan_mbedtls.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   mac_tsan_mbedtls:
diff --git a/.github/workflows/unittest_mac_tsan_openssl.yml b/.github/workflows/unittest_mac_tsan_openssl.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   mac_tsan_openssl:
diff --git a/.github/workflows/unittest_mac_tsan_sectransport.yml b/.github/workflows/unittest_mac_tsan_sectransport.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   mac_tsan_sectransport:
diff --git a/.github/workflows/unittest_uwp.yml b/.github/workflows/unittest_uwp.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   uwp:
diff --git a/.github/workflows/unittest_windows_gcc.yml b/.github/workflows/unittest_windows_gcc.yml
@@ -3,7 +3,9 @@ on:
   push:
     paths-ignore:
     - 'docs/**'
+    branches: [ master ]   # CI on PRs targeting master
   pull_request:
+    branches: [ master ]   # CI on PRs targeting master
 
 jobs:
   windows:
diff --git a/ixwebsocket/IXHttpServer.cpp b/ixwebsocket/IXHttpServer.cpp
@@ -9,6 +9,7 @@
 #include "IXGzipCodec.h"
 #include "IXNetSystem.h"
 #include "IXSocketConnect.h"
+#include "IXStrCaseCompare.h"
 #include "IXUserAgent.h"
 #include <cstdint>
 #include <cstring>
@@ -98,7 +99,11 @@ namespace ix
         {
             auto request = std::get<2>(ret);
             std::shared_ptr<ix::HttpResponse> response;
-            if (request->headers["Upgrade"] == "websocket")
+            // The Upgrade header value is case-insensitive (RFC 6455 4.2.1);
+            // e.g. Chrome's remote-debugging proxy sends "Upgrade: WebSocket".
+            const std::string& upgradeHeader = request->headers["Upgrade"];
+            if (!CaseInsensitiveLess::cmp(upgradeHeader, "websocket") &&
+                !CaseInsensitiveLess::cmp("websocket", upgradeHeader))
             {
                 WebSocketServer::handleUpgrade(std::move(socket), connectionState, request);
             }
diff --git a/ixwebsocket/IXSocketMbedTLS.cpp b/ixwebsocket/IXSocketMbedTLS.cpp
@@ -42,18 +42,18 @@ namespace ix
 
         mbedtls_ssl_init(&_ssl);
         mbedtls_ssl_config_init(&_conf);
+#if MBEDTLS_VERSION_MAJOR < 4
         mbedtls_ctr_drbg_init(&_ctr_drbg);
         mbedtls_entropy_init(&_entropy);
+#endif
         mbedtls_x509_crt_init(&_cacert);
         mbedtls_x509_crt_init(&_cert);
         mbedtls_pk_init(&_pkey);
-        // Initialize the PSA Crypto API if required by the version of Mbed TLS (3.6.0).
-        // This allows the X.509/TLS libraries to use PSA for crypto operations.
+        // Initialize the PSA Crypto API for mbedTLS 3.6+ and all 4.x releases.
         // See: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/use-psa-crypto.md
-        if (MBEDTLS_VERSION_MAJOR >= 3 && MBEDTLS_VERSION_MINOR >= 6 && MBEDTLS_VERSION_PATCH >= 0)
-        {
-            psa_crypto_init();
-        }
+#if MBEDTLS_VERSION_MAJOR >= 4 || (MBEDTLS_VERSION_MAJOR == 3 && MBEDTLS_VERSION_MINOR >= 6)
+        psa_crypto_init();
+#endif
     }
 
     bool SocketMbedTLS::loadSystemCertificates(std::string& errorMsg)
@@ -112,6 +112,7 @@ namespace ix
 
         const char* pers = "IXSocketMbedTLS";
 
+#if MBEDTLS_VERSION_MAJOR < 4
         if (mbedtls_ctr_drbg_seed(&_ctr_drbg,
                                   mbedtls_entropy_func,
                                   &_entropy,
@@ -121,6 +122,7 @@ namespace ix
             errMsg = "Setting entropy seed failed";
             return false;
         }
+#endif
 
         if (mbedtls_ssl_config_defaults(&_conf,
                                         (isClient) ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER,
@@ -131,7 +133,9 @@ namespace ix
             return false;
         }
 
+#if MBEDTLS_VERSION_MAJOR < 4
         mbedtls_ssl_conf_rng(&_conf, mbedtls_ctr_drbg_random, &_ctr_drbg);
+#endif
 
         if (_tlsOptions.hasCertAndKey())
         {
@@ -140,7 +144,7 @@ namespace ix
                 errMsg = "Cannot parse cert file '" + _tlsOptions.certFile + "'";
                 return false;
             }
-#ifdef IXWEBSOCKET_USE_MBED_TLS_MIN_VERSION_3
+#if MBEDTLS_VERSION_MAJOR == 3
             if (mbedtls_pk_parse_keyfile(&_pkey, _tlsOptions.keyFile.c_str(), "", mbedtls_ctr_drbg_random, &_ctr_drbg) < 0)
 #else
             if (mbedtls_pk_parse_keyfile(&_pkey, _tlsOptions.keyFile.c_str(), "") < 0)
@@ -317,15 +321,16 @@ namespace ix
 
         mbedtls_ssl_free(&_ssl);
         mbedtls_ssl_config_free(&_conf);
+#if MBEDTLS_VERSION_MAJOR < 4
         mbedtls_ctr_drbg_free(&_ctr_drbg);
         mbedtls_entropy_free(&_entropy);
+#endif
         mbedtls_x509_crt_free(&_cacert);
         mbedtls_x509_crt_free(&_cert);
         mbedtls_pk_free(&_pkey);
-        if (MBEDTLS_VERSION_MAJOR >= 3 && MBEDTLS_VERSION_MINOR >= 6 && MBEDTLS_VERSION_PATCH >= 0)
-        {
-            mbedtls_psa_crypto_free();
-        }
+#if MBEDTLS_VERSION_MAJOR >= 4 || (MBEDTLS_VERSION_MAJOR == 3 && MBEDTLS_VERSION_MINOR >= 6)
+        mbedtls_psa_crypto_free();
+#endif
 
         Socket::close();
     }
diff --git a/ixwebsocket/IXSocketMbedTLS.h b/ixwebsocket/IXSocketMbedTLS.h
@@ -9,9 +9,12 @@
 
 #include "IXSocket.h"
 #include "IXSocketTLSOptions.h"
+#include <mbedtls/version.h>
+#if MBEDTLS_VERSION_MAJOR < 4
 #include <mbedtls/ctr_drbg.h>
-#include <mbedtls/debug.h>
 #include <mbedtls/entropy.h>
+#endif
+#include <mbedtls/debug.h>
 #include <mbedtls/error.h>
 #include <mbedtls/net_sockets.h>
 #include <mbedtls/platform.h>
@@ -41,8 +44,10 @@ namespace ix
     private:
         mbedtls_ssl_context _ssl;
         mbedtls_ssl_config _conf;
+#if MBEDTLS_VERSION_MAJOR < 4
         mbedtls_entropy_context _entropy;
         mbedtls_ctr_drbg_context _ctr_drbg;
+#endif
         mbedtls_x509_crt _cacert;
         mbedtls_x509_crt _cert;
         mbedtls_pk_context _pkey;
diff --git a/ixwebsocket/IXSocketOpenSSL.cpp b/ixwebsocket/IXSocketOpenSSL.cpp
@@ -9,6 +9,7 @@
 
 #include "IXSocketOpenSSL.h"
 
+#include "IXNetSystem.h"
 #include "IXSocketConnect.h"
 #include "IXUniquePtr.h"
 #include <cassert>
@@ -768,7 +769,21 @@ namespace ix
             if (!_tlsOptions.disable_hostname_validation)
             {
                 X509_VERIFY_PARAM* param = SSL_get0_param(_ssl_connection);
-                X509_VERIFY_PARAM_set1_host(param, host.c_str(), host.size());
+
+                // When the host is an IP address (literal IPv4 or IPv6), it must be
+                // validated against the certificate's iPAddress SAN entries rather
+                // than the dNSName ones. X509_VERIFY_PARAM_set1_host only checks
+                // dNSName / CN, so it would always fail for IP literals.
+                struct in6_addr addr;
+                if (ix::inet_pton(AF_INET, host.c_str(), &addr) == 1 ||
+                    ix::inet_pton(AF_INET6, host.c_str(), &addr) == 1)
+                {
+                    X509_VERIFY_PARAM_set1_ip_asc(param, host.c_str());
+                }
+                else
+                {
+                    X509_VERIFY_PARAM_set1_host(param, host.c_str(), host.size());
+                }
             }
 #endif
             handshakeSuccessful = openSSLClientHandshake(host, errMsg, isCancellationRequested);
diff --git a/ixwebsocket/IXSocketServer.cpp b/ixwebsocket/IXSocketServer.cpp
@@ -95,6 +95,7 @@ namespace ix
                << "at address " << _host << ":" << _port << " : " << strerror(Socket::getErrno());
 
             Socket::closeSocket(_serverFd);
+            _serverFd = -1;
             return std::make_pair(false, ss.str());
         }
 
@@ -113,6 +114,7 @@ namespace ix
                    << strerror(Socket::getErrno());
 
                 Socket::closeSocket(_serverFd);
+                _serverFd = -1;
                 return std::make_pair(false, ss.str());
             }
 
@@ -125,6 +127,7 @@ namespace ix
                    << strerror(Socket::getErrno());
 
                 Socket::closeSocket(_serverFd);
+                _serverFd = -1;
                 return std::make_pair(false, ss.str());
             }
         }
@@ -143,6 +146,7 @@ namespace ix
                    << strerror(Socket::getErrno());
 
                 Socket::closeSocket(_serverFd);
+                _serverFd = -1;
                 return std::make_pair(false, ss.str());
             }
 
@@ -155,6 +159,7 @@ namespace ix
                    << strerror(Socket::getErrno());
 
                 Socket::closeSocket(_serverFd);
+                _serverFd = -1;
                 return std::make_pair(false, ss.str());
             }
         }
@@ -169,6 +174,7 @@ namespace ix
                << "at address " << _host << ":" << _port << " : " << strerror(Socket::getErrno());
 
             Socket::closeSocket(_serverFd);
+            _serverFd = -1;
             return std::make_pair(false, ss.str());
         }
 
@@ -231,7 +237,16 @@ namespace ix
         }
 
         _conditionVariable.notify_one();
-        Socket::closeSocket(_serverFd);
+
+        // stop() runs again from ~WebSocketServer() and ~SocketServer(), so
+        // close the listening fd exactly once: a second close of the stale
+        // number would destroy whatever descriptor another thread has since
+        // opened with it.
+        if (_serverFd != -1)
+        {
+            Socket::closeSocket(_serverFd);
+            _serverFd = -1;
+        }
     }
 
     void SocketServer::setConnectionStateFactory(
diff --git a/ixwebsocket/IXWebSocket.cpp b/ixwebsocket/IXWebSocket.cpp
@@ -256,16 +256,17 @@ namespace ix
     WebSocketInitResult WebSocket::connectToSocket(std::unique_ptr<Socket> socket,
                                                    int timeoutSecs,
                                                    bool enablePerMessageDeflate,
-                                                   HttpRequestPtr request)
+                                                   HttpRequestPtr request,
+                                                   int sendTimeoutSecs)
     {
         {
             std::lock_guard<std::mutex> lock(_configMutex);
             _ws.configure(
                 _perMessageDeflateOptions, _socketTLSOptions, _enablePong, _pingIntervalSecs);
         }
 
-        WebSocketInitResult status =
-            _ws.connectToSocket(std::move(socket), timeoutSecs, enablePerMessageDeflate, request);
+        WebSocketInitResult status = _ws.connectToSocket(
+            std::move(socket), timeoutSecs, enablePerMessageDeflate, request, sendTimeoutSecs);
         if (!status.success)
         {
             return status;
diff --git a/ixwebsocket/IXWebSocket.h b/ixwebsocket/IXWebSocket.h
@@ -135,7 +135,8 @@ namespace ix
         WebSocketInitResult connectToSocket(std::unique_ptr<Socket>,
                                             int timeoutSecs,
                                             bool enablePerMessageDeflate,
-                                            HttpRequestPtr request = nullptr);
+                                            HttpRequestPtr request = nullptr,
+                                            int sendTimeoutSecs = -1);
 
         WebSocketTransport _ws;
 
diff --git a/ixwebsocket/IXWebSocketCloseConstants.cpp b/ixwebsocket/IXWebSocketCloseConstants.cpp
@@ -19,6 +19,7 @@ namespace ix
     const std::string WebSocketCloseConstants::kInternalErrorMessage("Internal error");
     const std::string WebSocketCloseConstants::kAbnormalCloseMessage("Abnormal closure");
     const std::string WebSocketCloseConstants::kPingTimeoutMessage("Ping timeout");
+    const std::string WebSocketCloseConstants::kSendTimeoutMessage("Send timeout");
     const std::string WebSocketCloseConstants::kProtocolErrorMessage("Protocol error");
     const std::string WebSocketCloseConstants::kNoStatusCodeErrorMessage("No status code");
     const std::string WebSocketCloseConstants::kProtocolErrorReservedBitUsed("Reserved bit used");
diff --git a/ixwebsocket/IXWebSocketCloseConstants.h b/ixwebsocket/IXWebSocketCloseConstants.h
@@ -24,6 +24,7 @@ namespace ix
         static const std::string kInternalErrorMessage;
         static const std::string kAbnormalCloseMessage;
         static const std::string kPingTimeoutMessage;
+        static const std::string kSendTimeoutMessage;
         static const std::string kProtocolErrorMessage;
         static const std::string kNoStatusCodeErrorMessage;
         static const std::string kProtocolErrorReservedBitUsed;
diff --git a/ixwebsocket/IXWebSocketHandshake.cpp b/ixwebsocket/IXWebSocketHandshake.cpp
@@ -36,7 +36,9 @@ namespace ix
 
     bool WebSocketHandshake::insensitiveStringCompare(const std::string& a, const std::string& b)
     {
-        return CaseInsensitiveLess::cmp(a, b) == 0;
+        // Equivalence under the case-insensitive strict weak ordering: neither
+        // string sorts below the other. (cmp(a, b) == 0 only checked a >= b.)
+        return !CaseInsensitiveLess::cmp(a, b) && !CaseInsensitiveLess::cmp(b, a);
     }
 
     std::string WebSocketHandshake::genRandomString(const int len)
diff --git a/ixwebsocket/IXWebSocketServer.cpp b/ixwebsocket/IXWebSocketServer.cpp
@@ -20,19 +20,22 @@ namespace ix
     const int WebSocketServer::kDefaultHandShakeTimeoutSecs(3); // 3 seconds
     const bool WebSocketServer::kDefaultEnablePong(true);
     const int WebSocketServer::kPingIntervalSeconds(-1); // disable heartbeat
+    const int WebSocketServer::kSendTimeoutSeconds(-1);
 
     WebSocketServer::WebSocketServer(int port,
                                      const std::string& host,
                                      int backlog,
                                      size_t maxConnections,
                                      int handshakeTimeoutSecs,
                                      int addressFamily,
-                                     int pingIntervalSeconds)
+                                     int pingIntervalSeconds,
+                                     int sendTimeoutSeconds)
         : SocketServer(port, host, backlog, maxConnections, addressFamily)
         , _handshakeTimeoutSecs(handshakeTimeoutSecs)
         , _enablePong(kDefaultEnablePong)
         , _enablePerMessageDeflate(true)
         , _pingIntervalSeconds(pingIntervalSeconds)
+        , _sendTimeoutSeconds(sendTimeoutSeconds)
     {
     }
 
@@ -144,8 +147,11 @@ namespace ix
             _clients.insert(webSocket);
         }
 
-        auto status = webSocket->connectToSocket(
-            std::move(socket), _handshakeTimeoutSecs, _enablePerMessageDeflate, request);
+        auto status = webSocket->connectToSocket(std::move(socket),
+                                                 _handshakeTimeoutSecs,
+                                                 _enablePerMessageDeflate,
+                                                 request,
+                                                 _sendTimeoutSeconds);
         if (status.success)
         {
             // Process incoming messages and execute callbacks
diff --git a/ixwebsocket/IXWebSocketServer.h b/ixwebsocket/IXWebSocketServer.h
diff --git a/ixwebsocket/IXWebSocketTransport.cpp b/ixwebsocket/IXWebSocketTransport.cpp
diff --git a/ixwebsocket/IXWebSocketTransport.h b/ixwebsocket/IXWebSocketTransport.h
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
diff --git a/test/IXWebSocketSendTimeoutTest.cpp b/test/IXWebSocketSendTimeoutTest.cpp
