Skip to content

Commit 0d1c8fa

Browse files
FarnaHerryFarnaHerry
committed
feat(websocket): add opt-in WSS support through OpenSSL
Add independent feature to compat.websocket. It follows upstream IXWebSocket's USE_TLS + USE_OPEN_SSL branch: compile IXSocketOpenSSL.cpp, define IXWEBSOCKET_USE_TLS/IXWEBSOCKET_USE_OPEN_SSL, and resolve compat.openssl 3.5.1. The default remains a zero-external-dependency ws:// client; tls, server, and zlib compose independently. Add websocket-tls workspace member. It runs an offline loopback wss://localhost echo with IXWebSocket's own WebSocketServer, an embedded test-only self-signed PEM (localhost + 127.0.0.1 SAN), explicit client CA, and hostname verification still enabled. The test covers handshake, text, and binary round trips without public network access or a host CA. Windows gains shlwapi because upstream's OpenSSL socket backend imports it. Validated: mcpp test -p websocket; websocket-features; websocket-tls.
1 parent b1f7c0f commit 0d1c8fa

4 files changed

Lines changed: 404 additions & 12 deletions

File tree

‎mcpp.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ members = [
9090
"tests/examples/uwebsockets",
9191
"tests/examples/wil",
9292
"tests/examples/websocket-features",
93+
"tests/examples/websocket-tls",
9394
"tests/examples/tray",
9495
"tests/examples/xxhash",
9596
"tests/examples/yyjson",

‎pkgs/c/compat.websocket.lua‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,21 @@
1414
-- stays clean. IXGetFreePort.cpp IS included: it is a standalone utility and
1515
-- part of the client-side lib.
1616
--
17-
-- ZERO external dependencies, all three knobs turned off:
17+
-- ZERO external dependencies by default, with the optional TLS, zlib and
18+
-- server features below all turned off:
1819
--
1920
-- * No IXWEBSOCKET_USE_TLS — the TLS socket TUs (OpenSSL / MbedTLS /
2021
-- AppleSSL) are not compiled and the public headers that reach consumers
2122
-- never include them; IXSocketFactory.cpp only pulls the TLS headers under
22-
-- `#ifdef IXWEBSOCKET_USE_TLS`.
23+
-- `#ifdef IXWEBSOCKET_USE_TLS`. The opt-in `tls` feature consistently uses
24+
-- OpenSSL across Linux, macOS and Windows through compat.openssl.
2325
-- * No IXWEBSOCKET_USE_ZLIB — IXGzipCodec.cpp and the per-message-deflate
2426
-- codec guard every zlib call behind that macro, so they compile to
2527
-- pass-through no-ops. Per-message-deflate negotiation is then inert on
2628
-- the wire (clients offer no compression extension), which is exactly the
2729
-- conservative default.
28-
-- * No server feature — there is no compilable optional component worth
29-
-- gating here; the server side is deliberately not offered.
30+
-- * No server feature — the base is a client-only library; the optional
31+
-- `server` feature adds the four upstream server translation units.
3032
--
3133
-- The 32 sources below transcribe upstream CMake's `IXWEBSOCKET_SOURCES` minus
3234
-- the four server TUs above. All names are unique within the index, so the
@@ -118,14 +120,23 @@ package = {
118120
targets = { ["websocket"] = { kind = "lib" } },
119121

120122
-- ── Optional components ──────────────────────────────────────────
121-
-- The base build is the zero-dependency client above; two components
123+
-- The base build is the zero-dependency client above; three components
122124
-- can be enabled on top. mcpp features only ADD, so a consumer naming
123125
-- one keeps everything else:
124126
--
125-
-- websocket = "12.0.1" -> client only
127+
-- websocket = "12.0.1" -> ws:// client only
128+
-- websocket = { …, features = ["tls"] } -> + wss:// via OpenSSL
126129
-- websocket = { …, features = ["server"] } -> + the server (implies zlib)
127130
-- websocket = { …, features = ["zlib"] } -> + compression
128-
-- websocket = { …, features = ["server", "zlib"] } -> + both
131+
-- websocket = { …, features = ["tls", "server", "zlib"] } -> all three
132+
--
133+
-- `tls` is deliberately independent: TLS is client transport support,
134+
-- while server and compression are separately useful choices. IXSocket-
135+
-- Factory.cpp is already in the base sources and switches to
136+
-- SocketOpenSSL only when BOTH definitions below are set; this feature
137+
-- adds the one OpenSSL backend TU upstream CMake adds for USE_OPEN_SSL.
138+
-- compat.openssl is source-built/static across all declared platforms,
139+
-- so the consumer never falls through to a host libssl.
129140
--
130141
-- `server` brings the four TUs the base build leaves out. It needs
131142
-- nothing external: every IX* header it touches is already compiled
@@ -148,6 +159,13 @@ package = {
148159
-- enablePerMessageDeflate() on their client (and the server enables it
149160
-- by default).
150161
features = {
162+
["tls"] = {
163+
-- CMake USE_TLS + USE_OPEN_SSL: IXSocketFactory.cpp selects
164+
-- SocketOpenSSL and this is its one optional source.
165+
defines = { "IXWEBSOCKET_USE_TLS=1", "IXWEBSOCKET_USE_OPEN_SSL=1" },
166+
sources = { "*/ixwebsocket/IXSocketOpenSSL.cpp" },
167+
deps = { ["compat.openssl"] = "3.5.1" },
168+
},
151169
["server"] = {
152170
implies = { "zlib" },
153171
sources = {
@@ -165,10 +183,11 @@ package = {
165183

166184
-- ── Platform-specific ──────────────────────────────────────────────
167185
-- Upstream: Threads::Threads on UNIX, wsock32/ws2_32/shlwapi +
168-
-- _CRT_SECURE_NO_WARNINGS on Windows. shlwapi is only reached from the
169-
-- excluded IXSocketOpenSSL.cpp (its PathFileExists helpers), so it is
170-
-- dropped here; wsock32 is kept alongside ws2_32 exactly as upstream
171-
-- lists it.
186+
-- _CRT_SECURE_NO_WARNINGS on Windows. `tls` compiles
187+
-- IXSocketOpenSSL.cpp, which includes shlwapi's PathMatchSpecA; keep
188+
-- that system import library unconditional on Windows because mcpp's
189+
-- feature shape has no platform-local ldflags and it is harmless for
190+
-- the default ws:// build.
172191
linux = {
173192
ldflags = { "-lpthread" },
174193
},
@@ -177,7 +196,7 @@ package = {
177196
},
178197
windows = {
179198
cxxflags = { "-D_CRT_SECURE_NO_WARNINGS" },
180-
ldflags = { "-lws2_32", "-lwsock32" },
199+
ldflags = { "-lws2_32", "-lwsock32", "-lshlwapi" },
181200
},
182201
},
183202
}

‎tests/examples/websocket-tls/mcpp.toml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# websocket-tls test project: proves compat.websocket's opt-in `tls` feature
2+
# makes a real certificate-validated wss:// client/server usable. The fixture
3+
# is entirely offline (127.0.0.1 + test-only PEM files), so CI neither reaches
4+
# a public WSS endpoint nor weakens IXWebSocket's normal peer/hostname checks.
5+
#
6+
# This is separate from `websocket` (strict zero-dependency ws:// client) and
7+
# `websocket-features` (server + zlib): mcpp resolves one feature set per
8+
# consuming project, so a separate member preserves those assertions.
9+
[package]
10+
name = "websocket-tls-tests"
11+
version = "0.1.0"
12+
13+
[target.'cfg(linux)'.dependencies.compat]
14+
websocket = { version = "12.0.1", features = ["tls", "server"] }
15+
16+
[target.'cfg(linux)'.build]
17+
cxxflags = ["-DHAVE_WEBSOCKET_TLS=1"]
18+
19+
[target.'cfg(macos)'.dependencies.compat]
20+
websocket = { version = "12.0.1", features = ["tls", "server"] }
21+
22+
[target.'cfg(macos)'.build]
23+
cxxflags = ["-DHAVE_WEBSOCKET_TLS=1"]
24+
25+
[target.'cfg(windows)'.dependencies.compat]
26+
websocket = { version = "12.0.1", features = ["tls", "server"] }
27+
28+
[target.'cfg(windows)'.build]
29+
cxxflags = ["-DHAVE_WEBSOCKET_TLS=1"]

0 commit comments

Comments
 (0)