Ws over h2 pmd fixes

.sai.json

@@ -65,6 +65,15 @@
                                 "cd build && SAI_CPACK=\"-G DEB\" ${cpack}"
 			]
 		},
+
+		"linux-debian13/x86_64-amd/gcc": {
+			"default": false,
+                        "build": [
+				"${cmake}"
+			]
+		},
+
+
 #                "netbsd/aarch64BE-bcm2837-a53/gcc": {
 #                        "default": false,
 #                        "build": [
@@ -309,6 +318,11 @@
 			"platforms":	"none, coverity/x86_64/gcc",
 			"cpack":	"export STAMP=`git log -1 --pretty=format:%h` && rm -f libwebsockets.tar.xz && tar cJvf libwebsockets.tar.xz cov-int && script -e -q -c \"cat /etc/coverity/secrets.sh | lws-minimal-http-client-post-form --h1 https://scan.coverity.com:443/builds?project=warmcat%2Flibwebsockets --form file=@libwebsockets.tar.xz --form version=${STAMP} --form 'description=lws qa'\" /dev/null",
 			"branches":	"coverity"
+		},
+
+		"qir": {
+			"cmake":    "cd /opt/quic-interop-runner ; source venv/bin/activate ; rm -rf logs_* ; export QIR_LWS_BRANCH=main ; cd /opt/quic-interop-runner/lws ; if [ \"`docker ps -q`\" ] ; then docker kill $(docker ps -q) ; fi ;  docker system prune -a --volumes -f && docker build --build-arg QIR_LWS_BRANCH=${QIR_LWS_BRANCH} -t lws-quic-interop . --no-cache && cd .. && python3 run.py -c lws -s lws --delete-successful-logs ; python3 run.py -p webtransport -c lws -s lws --delete-successful-logs -t handshake,transfer-unidirectional-receive,transfer-unidirectional-send,transfer-bidirectional-receive,transfer-bidirectional-send,transfer-datagram-receive,transfer-datagram-send",
+			"platforms":	"none, linux-debian13/x86_64-amd/gcc"
 		}
 
 #		,

CMakeLists-implied-options.txt

@@ -185,24 +185,40 @@ endif()
 
 if (LWS_WITH_WEBRTC_MIXER)
 	set(LWS_WITH_WEBRTC 1)
-	set(LWS_WITH_ALSA 1 CACHE BOOL "Enable alsa audio example" FORCE)
-	set(LWS_WITH_OPUS 1 CACHE BOOL "Enable opus audio codec" FORCE)
-	set(LWS_WITH_GSTREAMER 1 CACHE BOOL "Enable gstreamer" FORCE)
+	if (NOT DEFINED LWS_WITH_ALSA)
+		set(LWS_WITH_ALSA 1 CACHE BOOL "Enable alsa audio example" FORCE)
+	endif()
+	if (NOT DEFINED LWS_WITH_OPUS)
+		set(LWS_WITH_OPUS 1 CACHE BOOL "Enable opus audio codec" FORCE)
+	endif()
+	if (NOT DEFINED LWS_WITH_GSTREAMER)
+		set(LWS_WITH_GSTREAMER 1 CACHE BOOL "Enable gstreamer" FORCE)
+	endif()
 endif()
 
 if (LWS_WITH_WEBRTC)
 	set(LWS_WITH_UDP 1)
 	set(LWS_WITH_DTLS 1)
 	set(LWS_WITH_PLUGINS 1 CACHE BOOL "Enable plugins" FORCE)
-	set(LWS_WITH_V4L2 1)
-	set(LWS_WITH_LIBV4L2 1)
-	set(LWS_WITH_DRM 1)
+	if (NOT DEFINED LWS_WITH_V4L2)
+		set(LWS_WITH_V4L2 1)
+	endif()
+	if (NOT DEFINED LWS_WITH_LIBV4L2)
+		set(LWS_WITH_LIBV4L2 1)
+	endif()
+	if (NOT DEFINED LWS_WITH_DRM)
+		set(LWS_WITH_DRM 1)
+	endif()
 	set(LWS_WITH_GENCRYPTO 1)
 	set(LWS_WITH_JOSE 1)
 	set(LWS_WITH_NETWORK 1)
 	set(LWS_WITH_CLIENT 1)
-	set(LWS_WITH_ALSA 1)
-	set(LWS_WITH_OPUS 1)
+	if (NOT DEFINED LWS_WITH_ALSA)
+		set(LWS_WITH_ALSA 1)
+	endif()
+	if (NOT DEFINED LWS_WITH_OPUS)
+		set(LWS_WITH_OPUS 1)
+	endif()
 endif()
 
 

CMakeLists.txt

@@ -680,6 +680,20 @@ set(LWS_INSTALL_INCLUDE_DIR   ${CMAKE_INSTALL_INCLUDEDIR} CACHE PATH "Installati
 set(LWS_INSTALL_EXAMPLES_DIR  ${CMAKE_INSTALL_BINDIR} CACHE PATH "Installation directory for example files")
 set(LWS_INSTALL_PLUGIN_DIR    "${CMAKE_INSTALL_PREFIX}/share/libwebsockets-test-server/plugins" CACHE PATH "Installation directory for plugins")
 
+if(IS_ABSOLUTE "${LWS_INSTALL_LIB_DIR}")
+	set(LWS_ABSOLUTE_INSTALL_LIBDIR "${LWS_INSTALL_LIB_DIR}")
+	set(PKG_CONFIG_LIBDIR "${LWS_INSTALL_LIB_DIR}")
+else()
+	set(LWS_ABSOLUTE_INSTALL_LIBDIR "${CMAKE_INSTALL_PREFIX}/${LWS_INSTALL_LIB_DIR}")
+	set(PKG_CONFIG_LIBDIR "\${exec_prefix}/${LWS_INSTALL_LIB_DIR}")
+endif()
+
+if(IS_ABSOLUTE "${LWS_INSTALL_INCLUDE_DIR}")
+	set(PKG_CONFIG_INCLUDEDIR "${LWS_INSTALL_INCLUDE_DIR}")
+else()
+	set(PKG_CONFIG_INCLUDEDIR "\${prefix}/${LWS_INSTALL_INCLUDE_DIR}")
+endif()
+
 # if you gave LWS_WITH_MINIZ, point to MINIZ here if not found
 # automatically
 
@@ -1483,7 +1497,7 @@ file(RELATIVE_PATH
     "${LWS_ABSOLUTE_INSTALL_INCLUDE_DIR}") # Calculate the relative directory from the cmake dir.
 
 if (DEFINED REL_INCLUDE_DIR)
-    set(LWS__INCLUDE_DIRS "${LWS_CMAKE_DIR}/${REL_INCLUDE_DIR}")
+    set(LWS__INCLUDE_DIRS "\${LWS_CMAKE_DIR}/${REL_INCLUDE_DIR}")
 endif()
 
 set(STRIPPED_LIB_LIST_AT_END "")

README.md

@@ -4,8 +4,8 @@
 
 ** NEW features available on main **
 
- - Support for SChannel (windows native TLS, no need for OpenSSL build!), GnuTLS, and BearSSL added
- - QUIC + H3 + Webtranspoer implementation, using aws-lc, wolfssl, boringssl, libressl, gnutls, and schannel (OpenSSL is h1/h2 -only, mbedtls can do it via a patch)
+ - Support for SChannel (windows native TLS, no need for OpenSSL build!), GnuTLS, openHiTLS and BearSSL added
+ - QUIC + H3 + Webtransport implementation, using aws-lc, wolfssl, boringssl, libressl, gnutls, and schannel (OpenSSL is h1/h2 -only; mbedtls can do it via a patch)
 
 |LWS version|Platform|Protocols|Default TLS|
 |---|---|---|---|
@@ -33,7 +33,7 @@ quic/h3 is enabled for build by default... necessitating GnuTLS instead of OpenS
 | **openHiTLS** | **Yes** | **Yes** | **No** | **Yes** | **Yes** | **Yes** | Yes (not SRTP) | **Yes** | **Yes** | **Yes** |
 
 
-\* *Note: 1) Upstream OpenSSL does not provide the necessary QUIC TLS API (`SSL_set_quic_method`) to act as a cryptographic engine for LWS's QUIC transport. If you need QUIC/HTTP3 support, we recommend using BoringSSL, GnuTLS, WolfSSL, or the `quictls` fork of OpenSSL.*
+\* *Note: 1) Upstream OpenSSL does not provide the necessary QUIC TLS API (`SSL_set_quic_method`) to act as a cryptographic engine for LWS's QUIC transport. If you need QUIC/HTTP3 support, we recommend using BoringSSL or GnuTLS.*
 \* *Note: 2) openHiTLS does not provide the necessary QUIC TLS API *
 
  - DHT support built-in: `-DLWS_WITH_DHT=1`

READMEs/README.lwsws.md

@@ -217,6 +217,16 @@ to be selected using "raw": "1"
 
 See also "apply-listen-accept" below.
 
+## Care about redirecting the trailing /
+
+In lws the mount applies at the URL folder, so a mount at /myapp actually works starting from /myapp/.
+
+This means you often need to add an additional redirect mount to do the last step for the user who
+may have typed .../myapp, to get them to .../myapp/ where the app actually takes over.
+
+        "mountpoint": "/git",
+        "origin": ">https://warmcat.com/git/",
+
 ## Lwsws Other vhost options
 
  - If the three options `host-ssl-cert`, `host-ssl-ca` and `host-ssl-key` are given, then the vhost supports SSL.
@@ -479,7 +489,7 @@ Auth before the ws upgrade, this is also possible.  In this case, the
 
 The mounts in lws allow you to stack up other plugins that run "before" the main mountpoint.
 There are two "interceptor plugins" provided which can be useful for this,
-`lws_login` and `lws_captcha_ratelimit`
+`lws_login` and `lws_captcha_ratelimit`, you can create your own based on these.
 
 To indicate you want to use an interceptor plugin for a mount, you add an
 "interceptor-path" entry to the original mount definition, pointing to the

cmake/lws_config.h.in

@@ -7,7 +7,7 @@
 #endif
 
 #define LWS_INSTALL_DATADIR "${CMAKE_INSTALL_PREFIX}/share"
-#define LWS_INSTALL_LIBDIR "${CMAKE_INSTALL_PREFIX}/${LWS_INSTALL_LIB_DIR}"
+#define LWS_INSTALL_LIBDIR "${LWS_ABSOLUTE_INSTALL_LIBDIR}"
 #define LWS_PLUGIN_DIR "${LWS_INSTALL_PLUGIN_DIR}"
 #define LWS_LIBRARY_VERSION_MAJOR ${LWS_LIBRARY_VERSION_MAJOR}
 #define LWS_LIBRARY_VERSION_MINOR ${LWS_LIBRARY_VERSION_MINOR}

include/libwebsockets.h

@@ -869,6 +869,7 @@ lws_fx_string(const lws_fx_t *a, char *buf, size_t size);
 #include <libwebsockets/lws-http.h>
 #if defined(LWS_ROLE_H3)
 #include <libwebsockets/lws-qpack.h>
+#include <libwebsockets/lws-webtransport.h>
 #endif
 #include <libwebsockets/lws-spa.h>
 #include <libwebsockets/lws-async-ipc.h>

include/libwebsockets/lws-client.h

@@ -227,6 +227,10 @@ struct lws_client_connect_info {
 	 * to the client connection.
 	 */
 
+	struct lws      *quic_migrate_from_wsi;
+	/**< If set, this connection acts as a Make-Before-Break migration probe for
+	 * the existing QUIC network connection in quic_migrate_from_wsi. */
+
 	uint8_t		priority;
 	/**< 0 means normal priority... otherwise sets the IP priority on
 	 * packets coming from this connection, from 1 - 7.  Setting 7

include/libwebsockets/lws-context-vhost.h

@@ -221,6 +221,10 @@
 #define LWS_SERVER_OPTION_GLIB					 (1ll << 33)
 	/**< (CTX) Use glib event loop */
 
+#define LWS_SERVER_OPTION_QUIC_FORCE_RETRY			(1ll << 52)
+	/**< (VH) For QUIC, force the server to always send a Retry packet.
+	 * Normally used only for testing. */
+
 #define LWS_SERVER_OPTION_H2_PRIOR_KNOWLEDGE			 (1ll << 34)
 	/**< (VH) Tell the vhost to treat plain text http connections as
 	 * H2 with prior knowledge (no upgrade request involved)
@@ -284,6 +288,12 @@
 #define LWS_SERVER_OPTION_QUIC_PAD_CRYPTO                       (1ll << 49)
         /**< (VH) Pad the QUIC handshake crypto data to artificially hit anti-amplification limits */
 
+#define LWS_SERVER_OPTION_QUIC_EARLY_KEY_UPDATE                 (1ll << 51)
+	/**< CONTEXT: For testing. Trigger a QUIC early key update */
+
+#define LWS_SERVER_OPTION_QUIC_LATEST_VERSION                   (1ll << 50)
+        /**< (CTX) Force client to initiate QUIC connections using the latest supported version (e.g. v2) */
+
         /****** add new things just above ---^ ******/
 
 
@@ -1102,7 +1112,19 @@ struct lws_context_creation_info {
 	const struct lws_cc_ops		*quic_cc_ops;
 	/**< CONTEXT: QUIC congestion control algorithm ops to use. If NULL, defaults to &lws_cc_ops_newreno. */
 
+	const char                      *quic_preferred_addresses;
+	/**< VHOST: Comma-separated list of IPv4 and/or IPv6 preferred addresses (e.g., "1.2.3.4:443,[2001:db8::1]:443")
+	 * to send to the client during the handshake to facilitate Connection Migration. */
+
+	uint32_t			quic_initial_cwnd;
+	/**< CONTEXT: 0 for default (10 * MTU), or the desired initial congestion window in bytes */
+
+	uint32_t			quic_0rtt_max_size;
+	/**< CONTEXT: 0 for default (4096), or the desired max 0-RTT early data size */
+
+#if !defined(__STRICT_ANSI__)
 	void *_unused[1]; /**< dummy */
+#endif
 };
 
 /**

include/libwebsockets/lws-lecp.h

@@ -290,6 +290,7 @@ struct lecp_ctx {
 	uint8_t			pst_sp; /* parsing stack head */
 	uint8_t			outer_array;
 	uint8_t			cbor_pos;
+	uint8_t			cbor_len;
 	uint8_t			literal_cbor_report;
 	char			present; /* temp for cb reason to use */
 

include/libwebsockets/lws-misc.h

@@ -712,6 +712,15 @@ lws_get_library_version(void);
 LWS_VISIBLE LWS_EXTERN void *
 lws_wsi_user(struct lws *wsi);
 
+/**
+ * lws_ensure_user_space() - allocate user space for wsi if not already allocated
+ * \param wsi: lws connection
+ *
+ * returns 0 if user space exists or was allocated, else non-zero.
+ */
+LWS_VISIBLE LWS_EXTERN int
+lws_ensure_user_space(struct lws *wsi);
+
 /**
  * lws_wsi_tsi() - get the service thread index the wsi is bound to
  * \param wsi: lws connection

include/libwebsockets/lws-quic.h

@@ -159,6 +159,7 @@ struct lws_cc_ops {
 	void (*on_sent)(struct lws *nwsi, size_t bytes);
 	void (*on_ack)(struct lws *nwsi, size_t bytes_acked, lws_usec_t rtt);
 	void (*on_loss)(struct lws *nwsi, size_t bytes_lost);
+	void (*on_discard)(struct lws *nwsi, size_t bytes_discarded);
 	int  (*can_send)(struct lws *nwsi, size_t bytes);
 	lws_usec_t (*get_pacing_delay)(struct lws *nwsi, size_t bytes_to_send);
 };

include/libwebsockets/lws-webtransport.h

@@ -41,5 +41,14 @@ lws_wt_create_stream(struct lws *wsi_session, int unidi);
 LWS_VISIBLE LWS_EXTERN int
 lws_wt_is_session(struct lws *wsi);
 
+LWS_VISIBLE LWS_EXTERN int
+lws_wt_is_unidi(struct lws *wsi);
+
+LWS_VISIBLE LWS_EXTERN struct lws *
+lws_wt_create_stream_from_child(struct lws *child_wsi, int unidi);
+
+LWS_VISIBLE LWS_EXTERN struct lws *
+lws_wt_get_session_wsi(struct lws *wsi);
+
 #endif /* LWS_ROLE_WT */
 #endif /* _LWS_WEBTRANSPORT_H */

include/libwebsockets/lws-x509.h

@@ -240,6 +240,20 @@ LWS_VISIBLE LWS_EXTERN int
 lws_x509_info(struct lws_x509_cert *x509, enum lws_tls_cert_info type,
 	      union lws_tls_cert_info_results *buf, size_t len);
 
+/**
+ * lws_x509_cert_fingerprint() - Calculate the fingerprint of a certificate
+ *
+ * \param x509: the certificate to fingerprint
+ * \param type: the hash type (e.g., LWS_GENHASH_TYPE_SHA256)
+ * \param buf: buffer to receive the binary hash
+ * \param len: max length of the buffer
+ *
+ * Returns the hash length on success, or -1 on failure.
+ */
+LWS_VISIBLE LWS_EXTERN int
+lws_x509_cert_fingerprint(struct lws_x509_cert *x509, int type,
+			  uint8_t *buf, size_t len);
+
 /**
  * lws_tls_peer_cert_info() - get information from the peer's TLS cert
  *

lib/CMakeLists.txt

@@ -429,8 +429,8 @@ endif()
 file(WRITE "${PROJECT_BINARY_DIR}/libwebsockets.pc"
 "prefix=\"${CMAKE_INSTALL_PREFIX}\"
 exec_prefix=\${prefix}
-libdir=\${exec_prefix}/${LWS_INSTALL_LIB_DIR}
-includedir=\${prefix}/${LWS_INSTALL_INCLUDE_DIR}
+libdir=${PKG_CONFIG_LIBDIR}
+includedir=${PKG_CONFIG_INCLUDEDIR}
 
 Name: libwebsockets
 Description: Websockets server and client library
@@ -451,8 +451,8 @@ endif()
 file(WRITE "${PROJECT_BINARY_DIR}/libwebsockets_static.pc"
 "prefix=\"${CMAKE_INSTALL_PREFIX}\"
 exec_prefix=\${prefix}
-libdir=\${exec_prefix}/${LWS_INSTALL_LIB_DIR}
-includedir=\${prefix}/${LWS_INSTALL_INCLUDE_DIR}
+libdir=${PKG_CONFIG_LIBDIR}
+includedir=${PKG_CONFIG_INCLUDEDIR}
 
 Name: libwebsockets_static
 Description: Websockets server and client static library

lib/core-net/adopt.c

@@ -805,6 +805,16 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
 		if (sock.sockfd == LWS_SOCK_INVALID)
 			goto resume;
 
+		{
+			int opt = 4 * 1024 * 1024;
+			if (setsockopt(sock.sockfd, SOL_SOCKET, SO_RCVBUF, (const char *)&opt, sizeof(opt)) < 0) {
+				lwsl_wsi_warn(wsi, "Failed to set SO_RCVBUF");
+			}
+			if (setsockopt(sock.sockfd, SOL_SOCKET, SO_SNDBUF, (const char *)&opt, sizeof(opt)) < 0) {
+				lwsl_wsi_warn(wsi, "Failed to set SO_SNDBUF");
+			}
+		}
+
 		if (lws_plat_apply_FD_CLOEXEC((int)sock.sockfd) ||
 		    lws_plat_set_nonblocking(sock.sockfd)) {
 			compatible_close(sock.sockfd);
@@ -974,6 +984,16 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
 	if (sock.sockfd == LWS_SOCK_INVALID)
 		goto bail;
 
+	{
+		int opt = 4 * 1024 * 1024;
+		if (setsockopt(sock.sockfd, SOL_SOCKET, SO_RCVBUF, (const char *)&opt, sizeof(opt)) < 0) {
+			lwsl_wsi_warn(wsi, "Failed to set SO_RCVBUF");
+		}
+		if (setsockopt(sock.sockfd, SOL_SOCKET, SO_SNDBUF, (const char *)&opt, sizeof(opt)) < 0) {
+			lwsl_wsi_warn(wsi, "Failed to set SO_SNDBUF");
+		}
+	}
+
 	if (lws_plat_apply_FD_CLOEXEC((int)sock.sockfd) ||
 	    lws_plat_set_nonblocking(sock.sockfd)) {
 		compatible_close(sock.sockfd);

lib/core-net/client/connect.c

@@ -208,6 +208,10 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	wsi->client_proxy_onward = !!(i->ssl_connection & LCCSCF_SECSTREAM_PROXY_ONWARD);
 #endif
 
+#if defined(LWS_ROLE_QUIC)
+        wsi->quic.migrate_from_wsi = i->quic_migrate_from_wsi;
+#endif
+
 #if defined(LWS_WITH_SYS_FAULT_INJECTION)
 	wsi->fic.name = "wsi";
 	if (i->fic.fi_owner.count)
@@ -250,6 +254,8 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 		wsi->keep_warm_secs = 5;
 
 	wsi->flags = i->ssl_connection;
+	if (i->context->options & LWS_SERVER_OPTION_ALLOW_EARLY_DATA)
+		wsi->flags |= LCCSCF_ALLOW_EARLY_DATA;
 
 	wsi->c_pri = i->priority;
 
@@ -347,7 +353,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	}
 
 #if defined(LWS_WITH_TLS)
-	wsi->tls.use_ssl = (unsigned int)i->ssl_connection;
+	wsi->tls.use_ssl = (unsigned int)wsi->flags;
 #else
 	if (i->ssl_connection & LCCSCF_USE_SSL) {
 		lwsl_wsi_err(wsi, "lws not configured for tls");