firebug / websocket-monitor

Not compatible with Firefox Quantum (57 and newer)
Other
147 stars 18 forks source link

opcodes are incorrect #70

Open tdhsmith opened 7 years ago

tdhsmith commented 7 years ago

My connections seem to have incorrectly flagged opcodes/frame types. All of the outgoing frames are marked TEXT (opcode 0x1) and all the incoming frames are marked CONTINUATION (opcode 0x0), regardless of ground truth.

Here are the same 4 frames, shown first in the socket monitor and then in wireshark: screen shot 2017-01-06 at 2 09 57 pm

screen shot 2017-01-06 at 2 20 21 pm

As seen in the right column, their true values are TEXT, TEXT, TEXT, BINARY, which was confirmed by dissection as well.

I understand it is likely an underlying issue and not one with this package itself, but I wanted to file the issue while I was dealing with it to investigate later. (Would this again be stemming from the SDK or from something closer to FF internals?)

tdhsmith commented 7 years ago

Actually I'm just realizing the inaccuracies are a bit larger than that:

(I don't have the capability right now to modify my stack to send true continuation frames with finBit=0, so I can't verify if the finBit is parsing correctly or not.)

eliihen commented 7 years ago

Yeah, the entire frame, including the metadata like opcode, comes from the Firefox API we're using to read websockets. We pretty much only map that to a string. I can't really give any info on the Firefox API because I haven't been that deep.

Let's try pinging @bakulf, he seems knowledgeable on the matter.

bakulf commented 7 years ago

Can I have a testcase? I would like to test it locally. @esphen, thanks.

tdhsmith commented 7 years ago

Here's a quick demonstration server in NodeJS, if that helps. Sorry for the messy code; threw it together on lunch break.

https://gist.github.com/tdhsmith/8e71aba02c684f549cdec05761e6e87b

You'll need to install ws first. Run the server with node server.js then browse to http://localhost:3000/ and the browser and client will each send a variety of frame types.

Here's what I see:

Server

-> TEXT         (0x1); MASKED
-> BINARY       (0x2); MASKED
<- BINARY       (0x2); unmasked
<- PING         (0x9); unmasked
<- PONG         (0xA); unmasked
<- TEXT         (0x1); unmasked
<- CONTINUATION (0x0); unmasked
<- CLOSE        (0x8)
-> PONG         (0xA); MASKED
-> CLOSE        (0x8)

(note that the ordering of the last few is off slightly due to when I'm calling the log commands relative to the actual message queue)

WireShark

screen shot 2017-01-18 at 11 43 10 am

Raw capture file is available in the gist above.

websocket-monitor

screen shot 2017-01-18 at 11 46 39 am