|
| 1 | +## websockify: WebSockets support for any application/server |
| 2 | + |
| 3 | +websockify was formerly named wsproxy and was part of the |
| 4 | +[noVNC](https://github.com/kanaka/noVNC) project. |
| 5 | + |
| 6 | +At the most basic level, websockify just translates WebSockets traffic |
| 7 | +to normal socket traffic. Websockify accepts the WebSockets handshake, |
| 8 | +parses it, and then begins forwarding traffic between the client and |
| 9 | +the target in both directions. |
| 10 | + |
| 11 | +### News/help/contact |
| 12 | + |
| 13 | +Notable commits, announcements and news are posted to |
| 14 | +<a href="http://www.twitter.com/noVNC">@noVNC</a> |
| 15 | + |
| 16 | +If you are a websockify developer/integrator/user (or want to be) |
| 17 | +please join the <a |
| 18 | +href="https://groups.google.com/forum/?fromgroups#!forum/novnc">noVNC/websockify |
| 19 | +discussion group</a> |
| 20 | + |
| 21 | +Bugs and feature requests can be submitted via [github |
| 22 | +issues](https://github.com/kanaka/websockify/issues). |
| 23 | + |
| 24 | +If you want to show appreciation for websockify you could donate to a great |
| 25 | +non-profits such as: [Compassion |
| 26 | +International](http://www.compassion.com/), [SIL](http://www.sil.org), |
| 27 | +[Habitat for Humanity](http://www.habitat.org), [Electronic Frontier |
| 28 | +Foundation](https://www.eff.org/), [Against Malaria |
| 29 | +Foundation](http://www.againstmalaria.com/), [Nothing But |
| 30 | +Nets](http://www.nothingbutnets.net/), etc. Please tweet <a |
| 31 | +href="http://www.twitter.com/noVNC">@noVNC</a> if you do. |
| 32 | + |
| 33 | +### WebSockets binary data |
| 34 | + |
| 35 | +Starting with websockify 0.5.0, only the HyBi / IETF |
| 36 | +6455 WebSocket protocol is supported. |
| 37 | + |
| 38 | +Websockify negotiates whether to base64 encode traffic to and from the |
| 39 | +client via the subprotocol header (Sec-WebSocket-Protocol). The valid |
| 40 | +subprotocol values are 'binary' and 'base64' and if the client sends |
| 41 | +both then the server (the python implementation) will prefer 'binary'. |
| 42 | +The 'binary' subprotocol indicates that the data will be sent raw |
| 43 | +using binary WebSocket frames. Some HyBi clients (such as the Flash |
| 44 | +fallback and older Chrome and iOS versions) do not support binary data |
| 45 | +which is why the negotiation is necessary. |
| 46 | + |
| 47 | + |
| 48 | +### Encrypted WebSocket connections (wss://) |
| 49 | + |
| 50 | +To encrypt the traffic using the WebSocket 'wss://' URI scheme you |
| 51 | +need to generate a certificate for websockify to load. By default websockify |
| 52 | +loads a certificate file name `self.pem` but the `--cert=CERT` option can |
| 53 | +override the file name. You can generate a self-signed certificate using |
| 54 | +openssl. When asked for the common name, use the hostname of the server where |
| 55 | +the proxy will be running: |
| 56 | + |
| 57 | +``` |
| 58 | +openssl req -new -x509 -days 365 -nodes -out self.pem -keyout self.pem |
| 59 | +``` |
| 60 | + |
| 61 | + |
| 62 | +### Websock Javascript library |
| 63 | + |
| 64 | + |
| 65 | +The `include/websock.js` Javascript library library provides a Websock |
| 66 | +object that is similar to the standard WebSocket object but Websock |
| 67 | +enables communication with raw TCP sockets (i.e. the binary stream) |
| 68 | +via websockify. This is accomplished by base64 encoding the data |
| 69 | +stream between Websock and websockify. |
| 70 | + |
| 71 | +Websock has built-in receive queue buffering; the message event |
| 72 | +does not contain actual data but is simply a notification that |
| 73 | +there is new data available. Several rQ* methods are available to |
| 74 | +read binary data off of the receive queue. |
| 75 | + |
| 76 | +The Websock API is documented on the [websock.js API wiki page](https://github.com/kanaka/websockify/wiki/websock.js) |
| 77 | + |
| 78 | +See the "Wrap a Program" section below for an example of using Websock |
| 79 | +and websockify as a browser telnet client (`wstelnet.html`). |
| 80 | + |
| 81 | + |
| 82 | +### Additional websockify features |
| 83 | + |
| 84 | +These are not necessary for the basic operation. |
| 85 | + |
| 86 | +* Daemonizing: When the `-D` option is specified, websockify runs |
| 87 | + in the background as a daemon process. |
| 88 | + |
| 89 | +* SSL (the wss:// WebSockets URI): This is detected automatically by |
| 90 | + websockify by sniffing the first byte sent from the client and then |
| 91 | + wrapping the socket if the data starts with '\x16' or '\x80' |
| 92 | + (indicating SSL). |
| 93 | + |
| 94 | +* Flash security policy: websockify detects flash security policy |
| 95 | + requests (again by sniffing the first packet) and answers with an |
| 96 | + appropriate flash security policy response (and then closes the |
| 97 | + port). This means no separate flash security policy server is needed |
| 98 | + for supporting the flash WebSockets fallback emulator. |
| 99 | + |
| 100 | +* Session recording: This feature that allows recording of the traffic |
| 101 | + sent and received from the client to a file using the `--record` |
| 102 | + option. |
| 103 | + |
| 104 | +* Mini-webserver: websockify can detect and respond to normal web |
| 105 | + requests on the same port as the WebSockets proxy and Flash security |
| 106 | + policy. This functionality is activate with the `--web DIR` option |
| 107 | + where DIR is the root of the web directory to serve. |
| 108 | + |
| 109 | +* Wrap a program: see the "Wrap a Program" section below. |
| 110 | + |
| 111 | + |
| 112 | +### Implementations of websockify |
| 113 | + |
| 114 | +The primary implementation of websockify is in python. There are |
| 115 | +several alternate implementations in other languages (C, Node.js, |
| 116 | +Clojure, Ruby) in the `other/` subdirectory (with varying levels of |
| 117 | +functionality). |
| 118 | + |
| 119 | +In addition there are several other external projects that implement |
| 120 | +the websockify "protocol". See the alternate implementation [Feature |
| 121 | +Matrix](https://github.com/kanaka/websockify/wiki/Feature_Matrix) for |
| 122 | +more information. |
| 123 | + |
| 124 | + |
| 125 | +### Wrap a Program |
| 126 | + |
| 127 | +In addition to proxying from a source address to a target address |
| 128 | +(which may be on a different system), websockify has the ability to |
| 129 | +launch a program on the local system and proxy WebSockets traffic to |
| 130 | +a normal TCP port owned/bound by the program. |
| 131 | + |
| 132 | +The is accomplished with a small LD_PRELOAD library (`rebind.so`) |
| 133 | +which intercepts bind() system calls by the program. The specified |
| 134 | +port is moved to a new localhost/loopback free high port. websockify |
| 135 | +then proxies WebSockets traffic directed to the original port to the |
| 136 | +new (moved) port of the program. |
| 137 | + |
| 138 | +The program wrap mode is invoked by replacing the target with `--` |
| 139 | +followed by the program command line to wrap. |
| 140 | + |
| 141 | + `./run 2023 -- PROGRAM ARGS` |
| 142 | + |
| 143 | +The `--wrap-mode` option can be used to indicate what action to take |
| 144 | +when the wrapped program exits or daemonizes. |
| 145 | + |
| 146 | +Here is an example of using websockify to wrap the vncserver command |
| 147 | +(which backgrounds itself) for use with |
| 148 | +[noVNC](https://github.com/kanaka/noVNC): |
| 149 | + |
| 150 | + `./run 5901 --wrap-mode=ignore -- vncserver -geometry 1024x768 :1` |
| 151 | + |
| 152 | +Here is an example of wrapping telnetd (from krb5-telnetd). telnetd |
| 153 | +exits after the connection closes so the wrap mode is set to respawn |
| 154 | +the command: |
| 155 | + |
| 156 | + `sudo ./run 2023 --wrap-mode=respawn -- telnetd -debug 2023` |
| 157 | + |
| 158 | +The `wstelnet.html` page demonstrates a simple WebSockets based telnet |
| 159 | +client (use 'localhost' and '2023' for the host and port |
| 160 | +respectively). |
| 161 | + |
| 162 | + |
| 163 | +### Building the Python ssl module (for python 2.5 and older) |
| 164 | + |
| 165 | +* Install the build dependencies. On Ubuntu use this command: |
| 166 | + |
| 167 | + `sudo aptitude install python-dev bluetooth-dev` |
| 168 | + |
| 169 | +* At the top level of the websockify repostory, download, build and |
| 170 | + symlink the ssl module: |
| 171 | + |
| 172 | + `wget --no-check-certificate http://pypi.python.org/packages/source/s/ssl/ssl-1.15.tar.gz` |
| 173 | + |
| 174 | + `tar xvzf ssl-1.15.tar.gz` |
| 175 | + |
| 176 | + `cd ssl-1.15` |
| 177 | + |
| 178 | + `make` |
| 179 | + |
| 180 | + `cd ../` |
| 181 | + |
| 182 | + `ln -sf ssl-1.15/build/lib.linux-*/ssl ssl` |
| 183 | + |
0 commit comments