Update Files

Kinc/Sources/kinc/libs/secure-streams/protocols/README.md

@@ -0,0 +1,38 @@
+# Lws Protocol bindings for Secure Streams
+
+This directory contains the code wiring up normal lws protocols
+to Secure Streams.
+
+## The lws_protocols callback
+
+This is the normal lws struct lws_protocols callback that handles events and
+traffic on the lws protocol being supported.
+
+The various events and traffic are converted into calls using the Secure
+Streams api, and Secure Streams events.
+
+## The connect_munge helper
+
+Different protocols have different semantics in the arguments to the client
+connect function, this protocol-specific helper is called to munge the
+connect_info struct to match the details of the protocol selected.
+
+The `ss->policy->aux` string is used to hold protocol-specific information
+passed in the from the policy, eg, the URL path or websockets subprotocol
+name.
+
+## The (library-private) ss_pcols export
+
+Each protocol binding exports two things to other parts of lws (they
+are not exported to user code)
+
+ - a struct lws_protocols, including a pointer to the callback
+
+ - a struct ss_pcols describing how secure_streams should use, including
+   a pointer to the related connect_munge helper.
+
+In ./lib/core-net/vhost.c, enabled protocols are added to vhost protcols
+lists so they may be used.  And in ./lib/secure-streams/secure-streams.c,
+enabled struct ss_pcols are listed and checked for matches when the user
+creates a new Secure Stream.
+

Kinc/Sources/kinc/libs/secure-streams/protocols/ss-h2.c

@@ -0,0 +1,226 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include <private-lib-core.h>
+
+extern int
+secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
+	     void *in, size_t len);
+
+static int
+secstream_h2(struct lws *wsi, enum lws_callback_reasons reason, void *user,
+	     void *in, size_t len)
+{
+	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
+	lws_ss_state_return_t r;
+	int n;
+
+	switch (reason) {
+
+	case LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP:
+
+		if (!h)
+			return -1;
+
+#if defined(LWS_WITH_SECURE_STREAMS_PROXY_API)
+		if (h->being_serialized) {
+			/*
+			 * We are the proxy-side SS for a remote client... we
+			 * need to inform the client about the initial tx credit
+			 * to write to it that the remote h2 server set up
+			 */
+			lwsl_info("%s: reporting initial tx cr from server %d\n",
+				  __func__, wsi->txc.tx_cr);
+			ss_proxy_onward_txcr((void *)(h + 1), wsi->txc.tx_cr);
+		}
+#endif
+
+		n = secstream_h1(wsi, reason, user, in, len);
+
+		if (!n && (h->policy->flags & LWSSSPOLF_LONG_POLL)) {
+			lwsl_notice("%s: h2 client %s entering LONG_POLL\n",
+					__func__, lws_wsi_tag(wsi));
+			lws_h2_client_stream_long_poll_rxonly(wsi);
+		}
+		return n;
+
+	case LWS_CALLBACK_CLOSED_CLIENT_HTTP:
+		/*
+		 * Only allow the wsi that the handle believes is representing
+		 * him to report closure up to h1
+		 */
+		if (!h || h->wsi != wsi)
+			return 0;
+
+		break;
+
+	case LWS_CALLBACK_COMPLETED_CLIENT_HTTP:
+
+		if (!h)
+			return -1;
+
+		// lwsl_err("%s: h2 COMPLETED_CLIENT_HTTP\n", __func__);
+		r = 0;
+		if (h->hanging_som)
+			r = h->info.rx(ss_to_userobj(h), NULL, 0, LWSSS_FLAG_EOM);
+
+		h->txn_ok = 1;
+		lws_cancel_service(lws_get_context(wsi)); /* abort poll wait */
+		if (h->hanging_som && r == LWSSSSRET_DESTROY_ME)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		h->hanging_som = 0;
+		break;
+
+	case LWS_CALLBACK_WSI_TX_CREDIT_GET:
+
+		if (!h)
+			return -1;
+
+		/*
+		 * The peer has sent us additional tx credit...
+		 */
+		lwsl_info("%s: LWS_CALLBACK_WSI_TX_CREDIT_GET: %d\n",
+			    __func__, (int)len);
+
+#if defined(LWS_WITH_SECURE_STREAMS_PROXY_API)
+		if (h->being_serialized)
+			/* we are the proxy-side SS for a remote client */
+			ss_proxy_onward_txcr((void *)(h + 1), (int)len);
+#endif
+		break;
+
+	default:
+		break;
+	}
+
+	return secstream_h1(wsi, reason, user, in, len);
+}
+
+const struct lws_protocols protocol_secstream_h2 = {
+	"lws-secstream-h2",
+	secstream_h2,
+	0, 0, 0, NULL, 0
+};
+
+/*
+ * Munge connect info according to protocol-specific considerations... this
+ * usually means interpreting aux in a protocol-specific way and using the
+ * pieces at connection setup time, eg, http url pieces.
+ *
+ * len bytes of buf can be used for things with scope until after the actual
+ * connect.
+ */
+
+int
+secstream_connect_munge_h2(lws_ss_handle_t *h, char *buf, size_t len,
+			   struct lws_client_connect_info *i,
+			   union lws_ss_contemp *ct)
+{
+	const char *pbasis = h->policy->u.http.url;
+	size_t used_in, used_out;
+	lws_strexp_t exp;
+
+	/* i.path on entry is used to override the policy urlpath if not "" */
+
+	if (i->path[0])
+		pbasis = i->path;
+
+	if (h->policy->flags & LWSSSPOLF_QUIRK_NGHTTP2_END_STREAM)
+		i->ssl_connection |= LCCSCF_H2_QUIRK_NGHTTP2_END_STREAM;
+
+	if (h->policy->flags & LWSSSPOLF_H2_QUIRK_OVERFLOWS_TXCR)
+		i->ssl_connection |= LCCSCF_H2_QUIRK_OVERFLOWS_TXCR;
+
+	if (h->policy->flags & LWSSSPOLF_HTTP_MULTIPART)
+		i->ssl_connection |= LCCSCF_HTTP_MULTIPART_MIME;
+
+	if (h->policy->flags & LWSSSPOLF_HTTP_X_WWW_FORM_URLENCODED)
+		i->ssl_connection |= LCCSCF_HTTP_X_WWW_FORM_URLENCODED;
+
+	if (h->policy->flags & LWSSSPOLF_HTTP_CACHE_COOKIES)
+		i->ssl_connection |= LCCSCF_CACHE_COOKIES;
+
+	i->ssl_connection |= LCCSCF_PIPELINE;
+
+	i->alpn = "h2";
+
+	/* initial peer tx credit */
+
+	if (h->info.manual_initial_tx_credit) {
+		i->ssl_connection |= LCCSCF_H2_MANUAL_RXFLOW;
+		i->manual_initial_tx_credit = h->info.manual_initial_tx_credit;
+		lwsl_info("%s: initial txcr %d\n", __func__,
+				i->manual_initial_tx_credit);
+	}
+
+	if (!pbasis)
+		return 0;
+
+	/* protocol aux is the path part */
+
+	i->path = buf;
+	buf[0] = '/';
+
+	lws_strexp_init(&exp, (void *)h, lws_ss_exp_cb_metadata, buf + 1, len - 1);
+
+	if (lws_strexp_expand(&exp, pbasis, strlen(pbasis),
+			      &used_in, &used_out) != LSTRX_DONE)
+		return 1;
+
+	return 0;
+}
+
+static int
+secstream_tx_credit_add_h2(lws_ss_handle_t *h, int add)
+{
+	lwsl_info("%s: %s: add %d\n", __func__, lws_ss_tag(h), add);
+	if (h->wsi)
+		return lws_h2_update_peer_txcredit(h->wsi, (unsigned int)LWS_H2_STREAM_SID, add);
+
+	return 0;
+}
+
+static int
+secstream_tx_credit_est_h2(lws_ss_handle_t *h)
+{
+	if (h->wsi) {
+		lwsl_info("%s: %s: est %d\n", __func__, lws_ss_tag(h),
+				lws_h2_get_peer_txcredit_estimate(h->wsi));
+
+		return lws_h2_get_peer_txcredit_estimate(h->wsi);
+	}
+
+	lwsl_info("%s: %s: Unknown (0)\n", __func__, lws_ss_tag(h));
+
+	return 0;
+}
+
+const struct ss_pcols ss_pcol_h2 = {
+	"h2",
+	"h2",
+	&protocol_secstream_h2,
+	secstream_connect_munge_h2,
+	secstream_tx_credit_add_h2,
+	secstream_tx_credit_est_h2
+};

Kinc/Sources/kinc/libs/secure-streams/protocols/ss-raw.c

@@ -0,0 +1,202 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * This is the glue that wires up raw-socket to Secure Streams.
+ */
+
+#include <private-lib-core.h>
+
+int
+secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
+	      void *in, size_t len)
+{
+#if defined(LWS_WITH_SERVER)
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
+#endif
+	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
+	uint8_t buf[LWS_PRE + 1520], *p = &buf[LWS_PRE],
+		*end = &buf[sizeof(buf) - 1];
+	lws_ss_state_return_t r;
+	size_t buflen;
+	int f = 0;
+
+	switch (reason) {
+
+	case LWS_CALLBACK_CLIENT_CONNECTION_ERROR:
+		assert(h);
+		assert(h->policy);
+		lwsl_info("%s: %s, %s CLIENT_CONNECTION_ERROR: %s\n", __func__,
+			  lws_ss_tag(h), h->policy->streamtype, in ? (char *)in : "(null)");
+
+#if defined(LWS_WITH_CONMON)
+		lws_conmon_ss_json(h);
+#endif
+
+		r = lws_ss_event_helper(h, LWSSSCS_UNREACHABLE);
+		if (r == LWSSSSRET_DESTROY_ME)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		h->wsi = NULL;
+		r = lws_ss_backoff(h);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		break;
+
+	case LWS_CALLBACK_RAW_CLOSE:
+		if (!h)
+			break;
+		lws_sul_cancel(&h->sul_timeout);
+
+#if defined(LWS_WITH_CONMON)
+		lws_conmon_ss_json(h);
+#endif
+
+		lwsl_info("%s: %s, %s RAW_CLOSE\n", __func__, lws_ss_tag(h),
+			  h->policy ? h->policy->streamtype : "no policy");
+		h->wsi = NULL;
+#if defined(LWS_WITH_SERVER)
+		lws_pt_lock(pt, __func__);
+		lws_dll2_remove(&h->cli_list);
+		lws_pt_unlock(pt);
+#endif
+
+		/* wsi is going down anyway */
+		r = lws_ss_event_helper(h, LWSSSCS_DISCONNECTED);
+		if (r == LWSSSSRET_DESTROY_ME)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		if (h->policy && !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
+#if defined(LWS_WITH_SERVER)
+			    !(h->info.flags & LWSSSINFLAGS_ACCEPTED) && /* not server */
+#endif
+		    !h->txn_ok && !wsi->a.context->being_destroyed) {
+			r = lws_ss_backoff(h);
+			if (r != LWSSSSRET_OK)
+				return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+			break;
+		}
+
+		break;
+
+	case LWS_CALLBACK_RAW_CONNECTED:
+		lwsl_info("%s: RAW_CONNECTED\n", __func__);
+
+		h->retry = 0;
+		h->seqstate = SSSEQ_CONNECTED;
+		lws_sul_cancel(&h->sul);
+#if defined(LWS_WITH_SYS_METRICS)
+		/*
+		 * If any hanging caliper measurement, dump it, and free any tags
+		 */
+		lws_metrics_caliper_report_hist(h->cal_txn, (struct lws *)NULL);
+#endif
+		r = lws_ss_event_helper(h, LWSSSCS_CONNECTED);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		lws_validity_confirmed(wsi);
+		break;
+
+	case LWS_CALLBACK_RAW_ADOPT:
+		lwsl_info("%s: RAW_ADOPT\n", __func__);
+		break;
+
+       /* chunks of chunked content, with header removed */
+       case LWS_CALLBACK_RAW_RX_FILE:
+               in = p;
+               f = (int)read((int)(intptr_t)wsi->desc.filefd, p, sizeof(buf) - LWS_PRE);
+               if (f < 0)
+                       return 0;
+               len = (unsigned int)f;
+
+               /* fallthru */
+
+	case LWS_CALLBACK_RAW_RX:
+		if (!h || !h->info.rx)
+			return 0;
+
+		r = h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, 0);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		return 0; /* don't passthru */
+
+	case LWS_CALLBACK_RAW_WRITEABLE:
+		lwsl_info("%s: RAW_WRITEABLE\n", __func__);
+		if (!h || !h->info.tx)
+			return 0;
+
+		buflen = lws_ptr_diff_size_t(end, p);
+		r = h->info.tx(ss_to_userobj(h),  h->txord++, p, &buflen, &f);
+		if (r == LWSSSSRET_TX_DONT_SEND)
+			return 0;
+		if (r < 0)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		/*
+		 * flags are ignored with raw, there are no protocol payload
+		 * boundaries, just an arbitrarily-fragmented bytestream
+		 */
+
+		p += buflen;
+		if (lws_write(wsi, buf + LWS_PRE, lws_ptr_diff_size_t(p, buf + LWS_PRE),
+			 LWS_WRITE_HTTP) != lws_ptr_diff(p, buf + LWS_PRE)) {
+			lwsl_err("%s: write failed\n", __func__);
+			return -1;
+		}
+
+		lws_set_timeout(wsi, 0, 0);
+		break;
+
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int
+secstream_connect_munge_raw(lws_ss_handle_t *h, char *buf, size_t len,
+			   struct lws_client_connect_info *i,
+			   union lws_ss_contemp *ct)
+{
+	i->method = "RAW";
+
+	return 0;
+}
+
+
+const struct lws_protocols protocol_secstream_raw = {
+	"lws-secstream-raw",
+	secstream_raw,
+	0,
+	0,
+	0, NULL, 0
+};
+
+const struct ss_pcols ss_pcol_raw = {
+	"raw",
+	"",
+	&protocol_secstream_raw,
+	secstream_connect_munge_raw,
+	NULL, NULL
+};

Kinc/Sources/kinc/libs/secure-streams/protocols/ss-ws.c

@@ -0,0 +1,249 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include <private-lib-core.h>
+
+static int
+secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
+	     void *in, size_t len)
+{
+#if defined(LWS_WITH_SERVER)
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
+#endif
+	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
+	uint8_t buf[LWS_PRE + 1400];
+	lws_ss_state_return_t r;
+	int f = 0, f1, n;
+	size_t buflen;
+
+	switch (reason) {
+
+	/* because we are protocols[0] ... */
+	case LWS_CALLBACK_CLIENT_CONNECTION_ERROR:
+		lwsl_info("%s: CLIENT_CONNECTION_ERROR: %s\n", __func__,
+			 in ? (char *)in : "(null)");
+		if (!h)
+			break;
+
+#if defined(LWS_WITH_CONMON)
+		lws_conmon_ss_json(h);
+#endif
+
+		r = lws_ss_event_helper(h, LWSSSCS_UNREACHABLE);
+		if (r == LWSSSSRET_DESTROY_ME)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		h->wsi = NULL;
+		r = lws_ss_backoff(h);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		break;
+
+	case LWS_CALLBACK_CLOSED: /* server */
+	case LWS_CALLBACK_CLIENT_CLOSED:
+		if (!h)
+			break;
+		lws_sul_cancel(&h->sul_timeout);
+
+#if defined(LWS_WITH_CONMON)
+		lws_conmon_ss_json(h);
+#endif
+
+		r = lws_ss_event_helper(h, LWSSSCS_DISCONNECTED);
+		if (r == LWSSSSRET_DESTROY_ME)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		if (h->wsi)
+			lws_set_opaque_user_data(h->wsi, NULL);
+		h->wsi = NULL;
+
+#if defined(LWS_WITH_SERVER)
+		lws_pt_lock(pt, __func__);
+		lws_dll2_remove(&h->cli_list);
+		lws_pt_unlock(pt);
+#endif
+
+		if (reason == LWS_CALLBACK_CLIENT_CLOSED) {
+			if (h->policy &&
+			    !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
+#if defined(LWS_WITH_SERVER)
+			    !(h->info.flags & LWSSSINFLAGS_ACCEPTED) && /* not server */
+#endif
+			    !wsi->a.context->being_destroyed) {
+				r = lws_ss_backoff(h);
+				if (r != LWSSSSRET_OK)
+					return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+				break;
+			}
+
+#if defined(LWS_WITH_SERVER)
+			if (h->info.flags & LWSSSINFLAGS_ACCEPTED) {
+				/*
+				 * was an accepted client connection to
+				 * our server, so the stream is over now
+				 */
+				lws_ss_destroy(&h);
+				return 0;
+			}
+#endif
+
+		}
+		break;
+
+	case LWS_CALLBACK_ESTABLISHED:
+	case LWS_CALLBACK_CLIENT_ESTABLISHED:
+		h->retry = 0;
+		h->seqstate = SSSEQ_CONNECTED;
+		lws_sul_cancel(&h->sul);
+#if defined(LWS_WITH_SYS_METRICS)
+		/*
+		 * If any hanging caliper measurement, dump it, and free any tags
+		 */
+		lws_metrics_caliper_report_hist(h->cal_txn, (struct lws *)NULL);
+#endif
+		r = lws_ss_event_helper(h, LWSSSCS_CONNECTED);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		break;
+
+	case LWS_CALLBACK_RECEIVE:
+	case LWS_CALLBACK_CLIENT_RECEIVE:
+		// lwsl_user("LWS_CALLBACK_CLIENT_RECEIVE: read %d\n", (int)len);
+		if (!h || !h->info.rx)
+			return 0;
+		if (lws_is_first_fragment(wsi))
+			f |= LWSSS_FLAG_SOM;
+		if (lws_is_final_fragment(wsi))
+			f |= LWSSS_FLAG_EOM;
+		// lws_frame_is_binary(wsi);
+
+		h->subseq = 1;
+
+		r = h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, f);
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		return 0; /* don't passthru */
+
+	case LWS_CALLBACK_SERVER_WRITEABLE:
+	case LWS_CALLBACK_CLIENT_WRITEABLE:
+		// lwsl_notice("%s: %s: WRITEABLE\n", __func__, lws_ss_tag(h));
+		if (!h || !h->info.tx)
+			return 0;
+
+		if (h->seqstate != SSSEQ_CONNECTED) {
+			lwsl_warn("%s: seqstate %d\n", __func__, h->seqstate);
+			break;
+		}
+
+		buflen = sizeof(buf) - LWS_PRE;
+		r = h->info.tx(ss_to_userobj(h),  h->txord++, buf + LWS_PRE,
+				  &buflen, &f);
+		if (r == LWSSSSRET_TX_DONT_SEND)
+			return 0;
+		if (r != LWSSSSRET_OK)
+			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+
+		f1 = lws_write_ws_flags(h->policy->u.http.u.ws.binary ?
+					   LWS_WRITE_BINARY : LWS_WRITE_TEXT,
+					!!(f & LWSSS_FLAG_SOM),
+					!!(f & LWSSS_FLAG_EOM));
+
+		n = lws_write(wsi, buf + LWS_PRE, buflen, (enum lws_write_protocol)f1);
+		if (n < (int)buflen) {
+			lwsl_info("%s: write failed %d %d\n", __func__,
+					n, (int)buflen);
+
+			return -1;
+		}
+
+		return 0;
+
+	default:
+		break;
+	}
+
+	return lws_callback_http_dummy(wsi, reason, user, in, len);
+}
+
+const struct lws_protocols protocol_secstream_ws = {
+	"lws-secstream-ws",
+	secstream_ws,
+	0, 0, 0, NULL, 0
+};
+/*
+ * Munge connect info according to protocol-specific considerations... this
+ * usually means interpreting aux in a protocol-specific way and using the
+ * pieces at connection setup time, eg, http url pieces.
+ *
+ * len bytes of buf can be used for things with scope until after the actual
+ * connect.
+ *
+ * For ws, protocol aux is <url path>;<ws subprotocol name>
+ */
+
+static int
+secstream_connect_munge_ws(lws_ss_handle_t *h, char *buf, size_t len,
+			   struct lws_client_connect_info *i,
+			   union lws_ss_contemp *ct)
+{
+	const char *pbasis = h->policy->u.http.url;
+	size_t used_in, used_out;
+	lws_strexp_t exp;
+
+	/* i.path on entry is used to override the policy urlpath if not "" */
+
+	if (i->path[0])
+		pbasis = i->path;
+
+	if (!pbasis)
+		return 0;
+
+	if (h->policy->flags & LWSSSPOLF_HTTP_CACHE_COOKIES)
+		i->ssl_connection |= LCCSCF_CACHE_COOKIES;
+
+	if (h->policy->flags & LWSSSPOLF_PRIORITIZE_READS)
+		i->ssl_connection |= LCCSCF_PRIORITIZE_READS;
+
+	/* protocol aux is the path part ; ws subprotocol name */
+
+	i->path = buf;
+	buf[0] = '/';
+
+	lws_strexp_init(&exp, (void *)h, lws_ss_exp_cb_metadata, buf + 1, len - 1);
+
+	if (lws_strexp_expand(&exp, pbasis, strlen(pbasis),
+			      &used_in, &used_out) != LSTRX_DONE)
+		return 1;
+
+	i->protocol = h->policy->u.http.u.ws.subprotocol;
+
+	lwsl_ss_info(h, "url %s, ws subprotocol %s", buf, i->protocol);
+
+	return 0;
+}
+
+const struct ss_pcols ss_pcol_ws = {
+	"ws",  "http/1.1",  &protocol_secstream_ws, secstream_connect_munge_ws, 0, 0
+};