Re: [Qemu-devel] [PATCH] io: ignore case when matching websockets HTTP headers

[Denis V. Lunev]

On 02/28/2017 01:48 PM, Daniel P. Berrange wrote:
> On Mon, Feb 27, 2017 at 08:14:56PM +0000, Daniel P. Berrange wrote:
>> According to RFC7230 Section 3.2, header field name is case-insensitive.
>> Convert the header data into all lowercase before doing string matching
>> on the headers.
>>
>> Signed-off-by: Daniel P. Berrange <address@hidden>
>> ---
>>  io/channel-websock.c | 14 +++++++++-----
>>  1 file changed, 9 insertions(+), 5 deletions(-)
>>
>> diff --git a/io/channel-websock.c b/io/channel-websock.c
>> index a06a4a8..32b7f37 100644
>> --- a/io/channel-websock.c
>> +++ b/io/channel-websock.c
>> @@ -33,9 +33,9 @@
>>  #define QIO_CHANNEL_WEBSOCK_GUID "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
>>  #define QIO_CHANNEL_WEBSOCK_GUID_LEN strlen(QIO_CHANNEL_WEBSOCK_GUID)
>>  
>> -#define QIO_CHANNEL_WEBSOCK_HEADER_PROTOCOL "Sec-WebSocket-Protocol"
>> -#define QIO_CHANNEL_WEBSOCK_HEADER_VERSION "Sec-WebSocket-Version"
>> -#define QIO_CHANNEL_WEBSOCK_HEADER_KEY "Sec-WebSocket-Key"
>> +#define QIO_CHANNEL_WEBSOCK_HEADER_PROTOCOL "sec-websocket-protocol"
>> +#define QIO_CHANNEL_WEBSOCK_HEADER_VERSION "sec-websocket-version"
>> +#define QIO_CHANNEL_WEBSOCK_HEADER_KEY "sec-websocket-key"
>>  
>>  #define QIO_CHANNEL_WEBSOCK_PROTOCOL_BINARY "binary"
>>  
>> @@ -223,7 +223,7 @@ static int 
>> qio_channel_websock_handshake_process(QIOChannelWebsock *ioc,
>>  static int qio_channel_websock_handshake_read(QIOChannelWebsock *ioc,
>>                                                Error **errp)
>>  {
>> -    char *handshake_end;
>> +    char *handshake_end, *tmp;
>>      ssize_t ret;
>>      /* Typical HTTP headers from novnc are 512 bytes, so limiting
>>       * total header size to 4096 is easily enough. */
>> @@ -249,9 +249,13 @@ static int 
>> qio_channel_websock_handshake_read(QIOChannelWebsock *ioc,
>>          }
>>      }
>>  
>> +    for (tmp = (char *)ioc->encinput.buffer; tmp < handshake_end; tmp++) {
>> +        *tmp = g_ascii_tolower(*tmp);
>> +    }
>> +
> self-nack - this does not in fact work - while it is fine to lowercase
> the header keys, we must not touch the header values as some data is
> case-sensitive
>
> Regards,
> Daniel
g-ascii-tolower() will help

Den