Force add websockify

base/app/novnc/utils/websockify/.github/workflows/test.yml

@@ -0,0 +1,39 @@
+name: Test
+
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ubuntu-20.04
+    strategy:
+      matrix:
+        python-version:
+          - 3.6
+          - 3.7
+          - 3.8
+          - 3.9
+          - "3.10"
+          - 3.11
+          - 3.12
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Update pip and setuptools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install setuptools
+      - name: Install dependencies
+        run: |
+          python -m pip install -e .
+          python -m pip install -r test-requirements.txt
+      - name: Install old numpy
+        run: |
+          python -m pip install 'numpy<1.17'
+        if: ${{ matrix.python-version >= '3.4' && matrix.python-version < '3.7' }}
+      - name: Run tests
+        run: |
+          python -m nose2 --verbosity=3

base/app/novnc/utils/websockify/.gitignore

@@ -0,0 +1,12 @@
+*.pyc
+*.o
+*.so
+.project
+.pydevproject
+target.cfg
+target.cfg.d
+.tox
+
+build/
+dist/
+*.egg-info

base/app/novnc/utils/websockify/CHANGES.txt

@@ -0,0 +1,131 @@
+Changes
+=======
+
+0.12.0
+------
+
+* The simplejson module is no longer needed for redis token support
+* redis tokens can now be either JSON or plain text
+* websockify can now listen to a Unix socket for incoming connections
+
+0.11.0
+------
+
+* Command line now supports disabling directory listings
+* Basic Dockerfile included
+
+0.10.0
+------
+
+* Python 3.4 or newer is now required
+* Empty message frames are now supported
+* Tokens can now specify a Unix domain socket file to connect to
+* Time limits on JWT tokens are now respected
+* Whitespace is better tolerated in token files
+* Lots of minor fixes...
+
+0.9.0
+-----
+
+* Base64 support removed and binary mode is now required
+* Low level WebSocket protocol handling now has its own class
+* Authentication now optionally required for web server
+* Server hostname can be used as the token
+* JWT/JWS/JWE can be used for the token
+* redis can be used for the token
+* Can now log to syslog
+* Improved latency by disabling Nagle for proxied connection
+* Added client certificate authentication
+* Support for password protected certificate key file
+* TLS ciphers and options are now configurable
+* Can be invoked via inetd
+* Lots of minor fixes...
+
+0.8.0
+-----
+
+* Make websockify properly terminate children on SIGTERM (#226)
+* Remove logging in signal handlers (this can cause Python to hang under certain conditions) (#219)
+* Make it easier to log to a file (#205)
+* Add support for IPv6 addresses in tokens in the TokenFile token plugins (#197)
+* Improve auth plugin framework to enable better support for HTTP auth (#194, #201)
+* Fix bug in JSONTokenAPI token plugin (#192)
+* Fix a missing variable in the exception handler (#178)
+
+0.7.0
+-----
+
+* Python 3 support fixes (#140, #155, #159)
+* Generic token-parsing plugins support (#162)
+* Generic authentication plugins support (#172)
+* Fixed frame corruption on big-endian systems (#161)
+* Support heartbeats (via PING) and automatic responses to PONG (#169)
+* Automatically reject unmasked client frames by default (strict mode) (#174)
+* Automatically restart interrupted select calls (#175)
+* Make 'run' respect environment settings (including virtualenv) (#176)
+
+0.6.1 - May 11, 2015
+--------------------
+
+* **PATCH RELEASE**: Fixes a bug causing file_only to not be passed properly
+
+0.6.0 - Feb 18, 2014
+--------------------
+
+* **NOTE** : 0.6.0 will break existing code that sub-classes WebsocketProxy
+* Refactor to use standard SocketServer RequestHandler design
+* Fix zombie process bug on certain systems when using multiprocessing
+* Add better unit tests
+* Log information via python `logging` module
+
+0.5.1 - Jun 27, 2013
+--------------------
+
+ * use upstream einaros/ws (>=0.4.27) with websockify.js
+ * file_only and no_parent security options for WSRequestHandler
+ * Update build of web-socket-js (c0855c6cae)
+ * add include/web-socket-js-project submodule to gimite/web-socket-js
+   for DSFG compliance.
+ * drop Hixie protocol support
+
+0.4.1 - Mar 12, 2013
+--------------------
+
+ * ***NOTE*** : 0.5.0 will drop Hixie protocol support
+ * add include/ directory and remove some dev files from source
+   distribution.
+
+0.4.0 - Mar 12, 2013
+--------------------
+
+ * ***NOTE*** : 0.5.0 will drop Hixie protocol support
+ * use Buffer base64 support in Node.js implementation
+
+0.3.0 - Jan 15, 2013
+--------------------
+
+ * refactor into modules: websocket, websocketproxy
+ * switch to web-socket-js that uses IETF 6455
+ * change to MPL 2.0 license for include/*.js
+ * fix session recording
+
+0.2.1 - Oct 15, 2012
+--------------------
+
+ * re-released with updated version number
+
+0.2.0 - Sep 17, 2012
+--------------------
+
+ * Binary data support in websock.js
+ * Target config file/dir and multiple targets with token selector
+ * IPv6 fixes
+ * SSL target support
+ * Proxy to/from unix socket
+
+
+0.1.0 - May 11, 2012
+--------------------
+
+ * Initial versioned release.
+

base/app/novnc/utils/websockify/COPYING

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

base/app/novnc/utils/websockify/MANIFEST.in

@@ -0,0 +1 @@
+include CHANGES.txt README.md COPYING

base/app/novnc/utils/websockify/Makefile

@@ -0,0 +1,11 @@
+TARGETS=rebind.so
+CFLAGS += -fPIC
+
+all: $(TARGETS)
+
+rebind.so: rebind.o
+	$(CC) $(LDFLAGS) $^ -shared -fPIC -ldl -o $@
+
+clean:
+	rm -f rebind.o rebind.so
+

base/app/novnc/utils/websockify/README.md

@@ -0,0 +1,208 @@
+## websockify: WebSockets support for any application/server
+
+websockify was formerly named wsproxy and was part of the
+[noVNC](https://github.com/novnc/noVNC) project.
+
+At the most basic level, websockify just translates WebSockets traffic
+to normal socket traffic. Websockify accepts the WebSockets handshake,
+parses it, and then begins forwarding traffic between the client and
+the target in both directions.
+
+### News/help/contact
+
+Notable commits, announcements and news are posted to
+<a href="http://www.twitter.com/noVNC">@noVNC</a>
+
+If you are a websockify developer/integrator/user (or want to be)
+please join the <a
+href="https://groups.google.com/forum/?fromgroups#!forum/novnc">noVNC/websockify
+discussion group</a>
+
+Bugs and feature requests can be submitted via [github
+issues](https://github.com/novnc/websockify/issues).
+
+If you want to show appreciation for websockify you could donate to a great
+non-profits such as: [Compassion
+International](http://www.compassion.com/), [SIL](http://www.sil.org),
+[Habitat for Humanity](http://www.habitat.org), [Electronic Frontier
+Foundation](https://www.eff.org/), [Against Malaria
+Foundation](http://www.againstmalaria.com/), [Nothing But
+Nets](http://www.nothingbutnets.net/), etc. Please tweet <a
+href="http://www.twitter.com/noVNC">@noVNC</a> if you do.
+
+### WebSockets binary data
+
+Starting with websockify 0.5.0, only the HyBi / IETF
+6455 WebSocket protocol is supported. There is no support for the older
+Base64 encoded data format.
+
+
+### Encrypted WebSocket connections (wss://)
+
+To encrypt the traffic using the WebSocket 'wss://' URI scheme you need to
+generate a certificate and key for Websockify to load. By default, Websockify
+loads a certificate file name `self.pem` but the `--cert=CERT` and `--key=KEY`
+options can override the file name. You can generate a self-signed certificate
+using openssl. When asked for the common name, use the hostname of the server
+where the proxy will be running:
+
+```
+openssl req -new -x509 -days 365 -nodes -out self.pem -keyout self.pem
+```
+
+For a self-signed certificate to work, you need to make your client/browser
+understand it. You can do this by installing it as accepted certificate, or by
+using that same certificate for a HTTPS connection to which you navigate first
+and approve. Browsers generally don't give you the "trust certificate?" prompt
+by opening a WSS socket with invalid certificate, hence you need to have it
+accept it by either of those two methods. 
+
+The ports may be considered as distinguishing connections by the browser,
+for example, if your website url is https://my.local:8443 and your WebSocket 
+url is wss://my.local:8001, first browse to https://my.local:8001, add the 
+exception, then browse to https://my.local:8443 and add another exception.
+Then an html page served over :8443 will be able to open WSS to :8001
+
+If you have a commercial/valid SSL certificate with one or more intermediate
+certificates, concat them into one file, server certificate first, then the
+intermediate(s) from the CA, etc. Point to this file with the `--cert` option
+and then also to the key with `--key`. Finally, use `--ssl-only` as needed.
+
+
+### Additional websockify features
+
+These are not necessary for the basic operation.
+
+* Daemonizing: When the `-D` option is specified, websockify runs
+  in the background as a daemon process.
+
+* SSL (the wss:// WebSockets URI): This is detected automatically by
+  websockify by sniffing the first byte sent from the client and then
+  wrapping the socket if the data starts with '\x16' or '\x80'
+  (indicating SSL).
+
+* Session recording: This feature that allows recording of the traffic
+  sent and received from the client to a file using the `--record`
+  option.
+
+* Mini-webserver: websockify can detect and respond to normal web
+  requests on the same port as the WebSockets proxy. This functionality
+  is activated with the `--web DIR` option where DIR is the root of the
+  web directory to serve.
+
+* Wrap a program: see the "Wrap a Program" section below.
+
+* Log files: websockify can save all logging information in a file.
+  This functionality is activated with the `--log-file FILE` option
+  where FILE is the file where the logs should be saved.
+
+* Authentication plugins: websockify can demand authentication for
+  websocket connections and, if you use `--web-auth`, also for normal
+  web requests. This functionality is activated with the
+  `--auth-plugin CLASS` and `--auth-source ARG` options, where CLASS is
+  usually one from auth_plugins.py and ARG is the plugin's configuration.
+
+* Token plugins: a single instance of websockify can connect clients to
+  multiple different pre-configured targets, depending on the token sent
+  by the client using the `token` URL parameter, or the hostname used to
+  reach websockify, if you use `--host-token`. This functionality is
+  activated with the `--token-plugin CLASS` and `--token-source ARG`
+  options, where CLASS is usually one from token_plugins.py and ARG is
+  the plugin's configuration.
+
+### Other implementations of websockify
+
+The primary implementation of websockify is in python. There are
+several alternate implementations in other languages available in
+our sister repositories [websockify-js](https://github.com/novnc/websockify-js)
+(JavaScript/Node.js) and [websockify-other](https://github.com/novnc/websockify-other)
+ (C, Clojure, Ruby).
+
+In addition there are several other external projects that implement
+the websockify "protocol". See the alternate implementation [Feature
+Matrix](https://github.com/novnc/websockify/wiki/Feature_Matrix) for
+more information.
+
+
+### Wrap a Program
+
+In addition to proxying from a source address to a target address
+(which may be on a different system), websockify has the ability to
+launch a program on the local system and proxy WebSockets traffic to
+a normal TCP port owned/bound by the program.
+
+This is accomplished by the LD_PRELOAD library (`rebind.so`)
+which intercepts bind() system calls by the program. The specified
+port is moved to a new localhost/loopback free high port. websockify
+then proxies WebSockets traffic directed to the original port to the
+new (moved) port of the program.
+
+The program wrap mode is invoked by replacing the target with `--`
+followed by the program command line to wrap.
+
+    `./run 2023 -- PROGRAM ARGS`
+
+The `--wrap-mode` option can be used to indicate what action to take
+when the wrapped program exits or daemonizes.
+
+Here is an example of using websockify to wrap the vncserver command
+(which backgrounds itself) for use with
+[noVNC](https://github.com/novnc/noVNC):
+
+    `./run 5901 --wrap-mode=ignore -- vncserver -geometry 1024x768 :1`
+
+Here is an example of wrapping telnetd (from krb5-telnetd). telnetd
+exits after the connection closes so the wrap mode is set to respawn
+the command:
+
+    `sudo ./run 2023 --wrap-mode=respawn -- telnetd -debug 2023`
+
+The `wstelnet.html` page in the [websockify-js](https://github.com/novnc/websockify-js)
+project demonstrates a simple WebSockets based telnet client (use
+'localhost' and '2023' for the host and port respectively).
+
+
+### Installing websockify
+
+Download one of the releases or the latest development version, extract
+it and run `python3 setup.py install` as root in the directory where you
+extracted the files. Normally, this will also install numpy for better
+performance, if you don't have it installed already. However, numpy is
+optional. If you don't want to install numpy or if you can't compile it,
+you can edit setup.py and remove the `install_requires=['numpy'],` line
+before running `python3 setup.py install`.
+
+Afterwards, websockify should be available in your path. Run
+`websockify --help` to confirm it's installed correctly.
+
+
+### Running with Docker/Podman
+You can also run websockify using Docker, Podman, Singularity, udocker or
+your favourite container runtime that support OCI container images.
+
+The entrypoint of the image is the `run` command.
+
+To build the image:
+```
+./docker/build.sh
+```
+
+Once built you can just launch it with the same
+arguments you would give to the `run` command and taking care of
+assigning the port mappings:
+```
+docker run -it --rm -p <port>:<container_port> novnc/websockify <container_port> <run_arguments>
+```
+
+For example to forward traffic from local port 7000 to 10.1.1.1:5902
+you can use:
+```
+docker run -it --rm -p 7000:80 novnc/websockify 80 10.1.1.1:5902
+```
+
+If you need to include files, like for example for the `--web` or `--cert`
+options you can just mount the required files in the `/data` volume and then
+you can reference them in the usual way:
+```
+docker run -it --rm -p 443:443 -v websockify-data:/data novnc/websockify --cert /data/self.pem --web /data/noVNC :443 --token-plugin TokenRedis --token-source myredis.local:6379 --ssl-only --ssl-version tlsv1_2
+```

base/app/novnc/utils/websockify/Windows/Windows Service Readme.md

@@ -0,0 +1,61 @@
+Running Websockify as a Windows service
+=======================================
+
+Installation and configuration
+------------------------------
+
+Download the following software:
+
+ * Python, from https://www.python.org/downloads/windows/
+ * SrvAny, from http://simpleauto.byethost8.com/Zip/SrvAny.zip
+
+Note that there is [a modern alternative for SrvAny](https://github.com/rwmjones/rhsrvany),
+but that project does not provide binaries.
+
+Install Python for all users, not just the current one. Extract Websockify
+into a directory, e.g. `C:\Program Files\websockify`, so that e.g.
+`README.md` ends up there. Extract the `SrvAny.zip` archive, copy the
+`WIN7\SrvAny.exe` file into `C:\Program Files\websockify`.
+
+Then create a batch file, `C:\Program Files\websockify\run.bat`, that runs
+Websockify from its directory with the correct options under the correct
+Python interpreter:
+
+```
+C:
+cd "\Program Files\websockify"
+"C:\Program Files\Python39\python.exe" -m websockify 5901 127.0.0.1:5900
+```
+
+Run it by hand once so that Windows asks you about a firewall exception.
+After confirming the exception, press `Ctrl+C` to terminate the script.
+
+Then create a Windows service for Websockify (use an Administrator command
+prompt for that). For paths with spaces, like in this example, double-escaping
+is needed: once for `cmd.exe` and once for `SrvAny.exe`.
+
+```
+C:
+cd "\Program Files\websockify"
+SrvAny.exe -install Websockify 10s \\\"C:\Program Files\websockify\run.bat\\\"
+```
+
+In the Windows Control Panel, under Services, a new "Websockify" service will
+appear. In its properties dialog, you can change the startup type, e.g. make
+it start automatically at boot. Or, you can start the service manually.
+
+Uninstallation
+--------------
+
+If you want to remove the service, first set its startup type to Manual, then
+reboot the PC. Then run this command using the Administrator command prompt:
+
+```
+C:
+cd "\Program Files\websockify"
+SrvAny.exe -remove Websockify
+```
+
+After that, you will be able to remove the `C:\Program Files\websockify`
+directory completely.
+

base/app/novnc/utils/websockify/docker/Dockerfile

@@ -0,0 +1,16 @@
+FROM python
+
+COPY websockify-*.tar.gz /
+
+RUN python3 -m pip install websockify-*.tar.gz
+RUN rm -rf /websockify-* /root/.cache
+
+VOLUME /data
+
+EXPOSE 80
+EXPOSE 443
+
+WORKDIR /opt/websockify
+
+ENTRYPOINT ["/usr/local/bin/websockify"]
+CMD ["--help"]

base/app/novnc/utils/websockify/docker/build.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+set -e -x
+cd "$(dirname "$0")"
+(cd .. && python3 setup.py sdist --dist-dir docker/)
+docker build -t novnc/websockify .

base/app/novnc/utils/websockify/docs/latency_results.txt

@@ -0,0 +1,114 @@
+This data is raw copy from the latency tester set to send a frame with
+a little over 2000 KB of data every 10ms.
+
+The number of packets sent and received is just a visual counter and
+is just the total when I chose to stop the test (around 3000 or so
+packets).
+
+The latency measure are from the point the packet was sent to when it
+was received back again in milliseconds. One notable data point
+missing from this is how long it actually took for the client to send
+3000 packets because sending large packets can put load on the browser
+and it may be a lot longer than 10ms before the timer event to
+send the next packet fires. So even with low latency numbers, the
+actual send rate may be fairly low because sending the WebSockets
+frames is impacting the performance of the browser in general.
+
+
+------------------------------------------------------------
+
+Native WebSockets implementations, 2000 byte payload, 10ms delay
+
+Chrome 8.0.552 - native WebSockets
+    Packets sent:                     2998
+    Packets Received:                 2998
+    Average Latency:                  1.84
+    40 Frame Running Average Latency: 1.90
+    Minimum Latency:                  1.00
+    Maximum Latency:                  10.00
+
+firefox 4.0b9 - WebSockets enabled
+    Packets sent:                     3011
+    Packets Received:                 3011
+    Average Latency:                  6.45
+    40 Frame Running Average Latency: 6.08
+    Minimum Latency:                  5.00
+    Maximum Latency:                  119.00
+
+Opera 11 - WebSockets enabled
+    Packets sent:                     3065
+    Packets Received:                 3064
+    Average Latency:                  9.56
+    40 Frame Running Average Latency: 8.15
+    Minimum Latency:                  4.00
+    Maximum Latency:                  53.00
+
+------------------------------------------------------------
+
+New web-socket-js (20f837425d4), 2000 byte payload, 10ms delay
+
+firefox 4.0b9 - no WebSockets
+    Packets sent:                     3088
+    Packets Received:                 3087
+    Average Latency:                  16.71
+    40 Frame Running Average Latency: 16.80
+    Minimum Latency:                  7.00
+    Maximum Latency:                  75.00
+
+    - First 1000 sent in 13 seconds 
+    - Second 1000 sent in 12 seconds
+    - Third 1000 sent in 12 seconds
+
+firefox 3.6.10 - no WebSockets
+    Packets sent:                     3100
+    Packets Received:                 3099
+    Average Latency:                  17.32
+    40 Frame Running Average Latency: 16.73
+    Minimum Latency:                  6.00
+    Maximum Latency:                  72.00
+
+Opera 11 - no WebSockets
+    Packets sent:                     3007
+    Packets Received:                 3007
+    Average Latency:                  465.91
+    40 Frame Running Average Latency: 147.95
+    Minimum Latency:                  12.00
+    Maximum Latency:                  9143.00
+
+    - average starts at around 28ms
+    - time for each 500 packets: 13s, 16s, 25s, 37s, 50s, 72s
+    - also start seeing sent, receive lags around 1200 packets
+
+---------------------------------------------------------------
+
+Old web-socket-js (9e7663771), 2000 byte payload, 10ms delay
+
+firefox 4.0b9 - no WebSockets
+    Packets sent:                     3024
+    Packets Received:                 3020
+    Average Latency:                  80.59
+    40 Frame Running Average Latency: 60.15
+    Minimum Latency:                  10.00
+    Maximm Latency:                   348.00
+
+
+firefox 3.6.10 - no WebSockets
+    Packets sent:                     2777
+    Packets Received:                 2775
+    Average Latency:                  34.89
+    40 Frame Running Average Latency: 24.50
+    Minimum Latency:                  10.00
+    Maximum Latency:                  208.00
+
+
+Opera 11 - no Websockets
+    Packets sent:                     3012
+    Packets Received:                 3011
+    Average Latency:                  380.87
+    40 Frame Running Average Latency: 341.90
+    Minimum Latency:                  28.00
+    Maximum Latency:                  2175.00
+
+    - average starts at around 290ms
+    - time for each 1000 packets: 23s, 38s, 65s
+

base/app/novnc/utils/websockify/docs/notes

@@ -0,0 +1,6 @@
+Building release tarball:
+    - not really necessary since tagged revision can be downloaded
+      from github as tarballs
+
+    git archive --format=tar --prefix=websockify-${WVER}/ v${WVER} > websockify-${WVER}.tar
+    gzip websockify-${WVER}.tar

base/app/novnc/utils/websockify/docs/release.txt

@@ -0,0 +1,10 @@
+- Update setup.py and CHANGES.txt and commit
+- Create version tag and tarball from tag
+    WVER=0.1.0
+    git tag v${WVER}
+    git push origin master
+    git push origin v${WVER}
+- Create the source distribution
+    python3 setup.py sdist
+- Upload the source distribution
+    python3 -m twine upload dist/websockify-${WVER}.tar.gz

base/app/novnc/utils/websockify/docs/websockify.1

@@ -0,0 +1,110 @@
+.TH websockify  1  "June 7, 2012" "version 0.3" "USER COMMANDS"
+
+.SH NAME
+
+websockify - WebSockets to TCP socket bridge
+
+.SH SYNOPSIS
+
+ websockify [options] [source_addr:]source_port target_addr:target_port
+ websockify [options] [source_addr:]source_port \-\- WRAP_COMMAND_LINE
+
+.SH OPTIONS
+
+ -h, --help         show this help message and exit
+ -v, --verbose      verbose messages and per frame traffic
+ --record=FILE      record sessions to FILE.[session_number]
+ -D, --daemon       become a daemon (background process)
+ --run-once         handle a single WebSocket connection and exit
+ --timeout=TIMEOUT  after TIMEOUT seconds exit when not connected
+ --cert=CERT        SSL certificate file
+ --key=KEY          SSL key file (if separate from cert)
+ --ssl-only         disallow non-encrypted connections
+ --web=DIR          run webserver on same port. Serve files from DIR.
+ --wrap-mode=MODE   action to take when the wrapped program exits or
+                     daemonizes: exit (default), ignore, respawn
+
+.SH DESCRIPTION
+
+At the most basic level, websockify just translates WebSockets traffic to normal TCP socket traffic. Websockify accepts the WebSockets handshake, parses it, and then begins forwarding traffic between the client and the target in both directions.
+
+websockify was formerly named wsproxy and was part of the noVNC project.
+
+.SH NOTES
+
+.SS WebSockets binary data
+
+Websockify supports all versions of the WebSockets protocol (Hixie and HyBI). The older Hixie versions of the protocol only support UTF-8 text payloads. In order to transport binary data over UTF-8 an encoding must used to encapsulate the data within UTF-8. Websockify uses base64 to encode all traffic to and from the client. This does not affect the data between websockify and the server.
+
+.SS Encrypted WebSocket connections (wss://)
+
+To encrypt the traffic using the WebSocket 'wss://' URI scheme you need to generate a certificate for websockify to load. By default websockify loads a certificate file name self.pem but the --cert=CERT option can override the file name. You can generate a self-signed certificate using openssl. When asked for the common name, use the hostname of the server where the proxy will be running:
+
+openssl req -new -x509 -days 365 -nodes -out self.pem -keyout self.pem
+
+.SS Additional websockify features
+
+These are not necessary for the basic operation.
+
+.IP *
+Daemonizing: When the -D option is specified, websockify runs in the background as a daemon process.
+
+.IP *
+SSL (the wss:// WebSockets URI): This is detected automatically by websockify by sniffing the first byte sent from the client and then wrapping the socket if the data starts with '\\x16' or '\\x80' (indicating SSL).
+
+.IP *
+Session recording: This feature that allows recording of the traffic sent and received from the client to a file using the --record option.
+
+.IP *
+Mini-webserver: websockify can detect and respond to normal web requests on the same port as the WebSockets proxy. This functionality is activate with the --web DIR option where DIR is the root of the web directory to serve.
+
+.IP *
+Wrap a program: see the "Wrap a Program" section below.
+
+.SS Wrap a Program
+
+In addition to proxying from a source address to a target address (which may be on a different system), websockify has the ability to launch a program on the local system and proxy WebSockets traffic to a normal TCP port owned/bound by the program.
+
+The is accomplished with a small LD_PRELOAD library (rebind.so) which intercepts bind() system calls by the program. The specified port is moved to a new localhost/loopback free high port. websockify then proxies WebSockets traffic directed to the original port to the new (moved) port of the program.
+
+The program wrap mode is invoked by replacing the target with -- followed by the program command line to wrap.
+
+`./websockify 2023 -- PROGRAM ARGS`
+
+The --wrap-mode option can be used to indicate what action to take when the wrapped program exits or daemonizes.
+
+Here is an example of using websockify to wrap the vncserver command (which backgrounds itself) for use with noVNC:
+
+`./websockify 5901 --wrap-mode=ignore -- vncserver -geometry 1024x768 :1`
+
+Here is an example of wrapping telnetd (from krb5-telnetd). telnetd exits after the connection closes so the wrap mode is set to respawn the command:
+
+`sudo ./websockify 2023 --wrap-mode=respawn -- telnetd -debug 2023`
+
+The wstelnet.html page demonstrates a simple WebSockets based telnet client.
+
+.SS Use client certificate verification
+
+This feature requires Python 2.7.9 or newer or Python 3.4 or newer.
+
+The --verify-client option makes the server ask the client for a SSL certificate. Presenting a valid (not expired and trusted by any supplied certificate authority) certificate is required for the client connection. With -auth-plugin=ClientCertCNAuth, the client certificate can be checked against a list of authorised certificate users. Non-encrypted connection attempts always fail during authentication.
+
+Here is an example of a vncsevrer with password-less, certificate-driven authentication:
+
+`./websockify 5901 --cert=fullchain.pem --key=privkey.pem --ssl-only --verify-client --cafile=ca-certificates.crt --auth-plugin=ClientCertCNAuth --auth-source='jane@example.com Joe User9824510' --web=noVNC/ --wrap-mode=ignore -- vncserver :1 -geometry 1024x768 -SecurityTypes=None`
+
+The --auth-source option takes a white-space separated list of common names. Depending on your clients certificates they can be verified email addresses, user-names or any other string used for identification.
+
+The --cafile option selects a file containing concatenated certificates of authorities trusted for validating clients. If this option is omitted, system default list of CAs is used. Upon connect, the client should supply the whole certificate chain. If your clients are known not to send intermediate certificates, they can be appended to the ca-file as well.
+            
+Note: Most browsers ask the user to select a certificate only while connecting via HTTPS, not WebSockets. Connecting directly to the SSL secured WebSocket may cause the browser to abort the connection. If you want to connect via noVNC, the --web option should point to a copy of noVNC, so it is loaded from the same host.
+
+.SH AUTHOR
+Joel Martin (github@martintribe.org)
+
+.SH SEE ALSO
+
+https://github.com/novnc/websockify/
+
+https://github.com/novnc/websockify/wiki/
+

base/app/novnc/utils/websockify/rebind

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+usage() {
+    echo "Usage: $(basename $0) OLD_PORT NEW_PORT COMMAND_LINE"
+    echo
+    echo "Launch COMMAND_LINE, but intercept system calls to bind"
+    echo "to OLD_PORT and instead bind them to localhost:NEW_PORT"
+    exit 2
+}
+
+# Parameter defaults
+mydir=$(readlink -f $(dirname ${0}))
+
+export REBIND_PORT_OLD="${1}"; shift
+export REBIND_PORT_NEW="${1}"; shift
+
+LD_PRELOAD=${mydir}/rebind.so "${@}"
+

base/app/novnc/utils/websockify/rebind.c

@@ -0,0 +1,94 @@
+/*
+ * rebind: Intercept bind calls and bind to a different port
+ * Copyright 2010 Joel Martin
+ * Licensed under LGPL version 3 (see docs/LICENSE.LGPL-3)
+ *
+ * Overload (LD_PRELOAD) bind system call. If REBIND_PORT_OLD and
+ * REBIND_PORT_NEW environment variables are set then bind on the new
+ * port (of localhost) instead of the old port. 
+ *
+ * This allows a bridge/proxy (such as websockify) to run on the old port and
+ * translate traffic to/from the new port.
+ *
+ * Usage:
+ *     LD_PRELOAD=./rebind.so \
+ *     REBIND_PORT_OLD=23 \
+ *     REBIND_PORT_NEW=2023 \
+ *     program
+ */
+
+//#define DO_DEBUG 1
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#define __USE_GNU 1  // Pull in RTLD_NEXT
+#include <dlfcn.h>
+
+#include <string.h>
+#include <netinet/in.h>
+
+
+#if defined(DO_DEBUG)
+#define DEBUG(...) \
+    fprintf(stderr, "rebind: "); \
+    fprintf(stderr, __VA_ARGS__);
+#else
+#define DEBUG(...)
+#endif
+
+
+int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
+{
+    static void * (*func)();
+    int do_move = 0;
+    struct sockaddr_in * addr_in = (struct sockaddr_in *)addr;
+    struct sockaddr_in addr_tmp;
+    socklen_t addrlen_tmp;
+    char * PORT_OLD, * PORT_NEW, * end1, * end2;
+    int ret, oldport, newport, askport = htons(addr_in->sin_port);
+    uint32_t askaddr = htons(addr_in->sin_addr.s_addr);
+    if (!func) func = (void *(*)()) dlsym(RTLD_NEXT, "bind");
+
+    DEBUG(">> bind(%d, _, %d), askaddr %d, askport %d\n",
+          sockfd, addrlen, askaddr, askport);
+
+    /* Determine if we should move this socket */
+    if (addr_in->sin_family == AF_INET) {
+        // TODO: support IPv6
+        PORT_OLD = getenv("REBIND_OLD_PORT");
+        PORT_NEW = getenv("REBIND_NEW_PORT");
+        if (PORT_OLD && (*PORT_OLD != '\0') &&
+            PORT_NEW && (*PORT_NEW != '\0')) {
+            oldport = strtol(PORT_OLD, &end1, 10);
+            newport = strtol(PORT_NEW, &end2, 10);
+            if (oldport && (*end1 == '\0') &&
+                newport && (*end2 == '\0') &&
+                (oldport == askport)) {
+                do_move = 1;
+            }
+        }
+    }
+
+    if (! do_move) {
+        /* Just pass everything right through to the real bind */
+        ret = (long) func(sockfd, addr, addrlen);
+        DEBUG("<< bind(%d, _, %d) ret %d\n", sockfd, addrlen, ret);
+        return ret;
+    }
+
+    DEBUG("binding fd %d on localhost:%d instead of 0x%x:%d\n",
+        sockfd, newport, ntohl(addr_in->sin_addr.s_addr), oldport);
+
+    /* Use a temporary location for the new address information */
+    addrlen_tmp = sizeof(addr_tmp);
+    memcpy(&addr_tmp, addr, addrlen_tmp);
+
+    /* Bind to other port on the loopback instead */
+    addr_tmp.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr_tmp.sin_port = htons(newport);
+    ret = (long) func(sockfd, &addr_tmp, addrlen_tmp);
+
+    DEBUG("<< bind(%d, _, %d) ret %d\n", sockfd, addrlen, ret);
+    return ret;
+}

base/app/novnc/utils/websockify/run

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+set -e
+cd "$(dirname "$0")"
+exec python3 -m websockify "$@"

base/app/novnc/utils/websockify/setup.py

@@ -0,0 +1,43 @@
+from setuptools import setup, find_packages
+
+version = '0.12.0'
+name = 'websockify'
+long_description = open("README.md").read() + "\n" + \
+    open("CHANGES.txt").read() + "\n"
+
+setup(name=name,
+      version=version,
+      description="Websockify.",
+      long_description=long_description,
+      long_description_content_type="text/markdown",
+      classifiers=[
+          "Programming Language :: Python",
+          "Programming Language :: Python :: 3",
+          "Programming Language :: Python :: 3 :: Only",
+          "Programming Language :: Python :: 3.4",
+          "Programming Language :: Python :: 3.5",
+          "Programming Language :: Python :: 3.6",
+          "Programming Language :: Python :: 3.7",
+          "Programming Language :: Python :: 3.8",
+          "Programming Language :: Python :: 3.9",
+        ],
+      keywords='noVNC websockify',
+      license='LGPLv3',
+      url="https://github.com/novnc/websockify",
+      author="Joel Martin",
+      author_email="github@martintribe.org",
+
+      packages=['websockify'],
+      include_package_data=True,
+      install_requires=[
+        'numpy', 'requests',
+        'jwcrypto',
+        'redis',
+        ],
+      zip_safe=False,
+      entry_points={
+        'console_scripts': [
+            'websockify = websockify.websocketproxy:websockify_init',
+        ]
+      },
+    )

base/app/novnc/utils/websockify/test-requirements.txt

@@ -0,0 +1,5 @@
+mock
+nose2
+six
+redis
+wrapt<=1.12.1;python_version<="3.4"