apiclient: update tungstenite to v0.20.1

Newer versions of tungstenite implemented the v13 version of the Web
Sockets protocol (described in https://www.rfc-editor.org/rfc/rfc6455).
In this version, new headers are required in the upgrade request. With
this update, now the upgrade request sent by apiclient include the
missing headers.

In the same version, the 'frame' message was added. Neither apiserver
nor apiclient send this type of message, so they are ignored by
apiclient.

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

sources/api/apiclient/Cargo.toml

@@ -10,6 +10,7 @@ build = "build.rs"
 exclude = ["README.md"]
 
 [dependencies]
+base64 = "0.21"
 constants = { path = "../../constants", version = "0.1" }
 datastore = { path = "../datastore", version = "0.1" }
 futures = { version = "0.3", default-features = false }
@@ -31,7 +32,7 @@ signal-hook = "0.3"
 simplelog = "0.12"
 snafu = { version = "0.7", features = ["futures"] }
 tokio = { version = "~1.25", default-features = false, features = ["fs", "io-std", "io-util", "macros", "rt-multi-thread", "time"] }  # LTS
-tokio-tungstenite = { version = "0.16", default-features = false, features = ["connect"] }
+tokio-tungstenite = { version = "0.20", default-features = false, features = ["connect"] }
 toml = "0.5"
 unindent = "0.1"
 url = "2"

sources/api/apiclient/src/exec.rs

@@ -313,6 +313,11 @@ impl ReadFromServer {
                                 }
                             }
                         }
+                        // The API server doesn't use frames, but still logging out a
+                        // warning in case a message of this type is received
+                        Message::Frame(_) => {
+                            warn!("Received an unexpected frame message");
+                        }
                     }
                     Ok(())
                 }

sources/api/apiclient/src/exec/connect.rs

@@ -1,9 +1,13 @@
 //! The 'connect' module provides a function for connecting to a WebSocket over a Unix-domain
 //! socket, which is a bit more finicky than normal.
 
+use base64::{engine, Engine as _};
+use http::header::{CONNECTION, HOST, SEC_WEBSOCKET_KEY, SEC_WEBSOCKET_VERSION, UPGRADE};
+use httparse::Header;
 use hyper::service::Service;
 use hyper_unix_connector::{UnixClient, Uri, UDS};
 use log::debug;
+use rand::{thread_rng, Rng};
 use snafu::{ensure, ResultExt};
 use std::path::Path;
 use tokio_tungstenite::{client_async, tungstenite::http::StatusCode, WebSocketStream};
@@ -37,14 +41,40 @@ where
         .build()
     })?;
 
+    // The base64 websocket key for the connection
+    let ws_key = engine::general_purpose::STANDARD_NO_PAD.encode(thread_rng().gen::<[u8; 16]>());
+    // Create the headers required for a valid client handshake and websocket upgrade request
+    let mut headers = [
+        Header {
+            name: HOST.as_str(),
+            value: "localhost".as_bytes(),
+        },
+        Header {
+            name: CONNECTION.as_str(),
+            value: "Upgrade".as_bytes(),
+        },
+        Header {
+            name: UPGRADE.as_str(),
+            value: "websocket".as_bytes(),
+        },
+        Header {
+            name: SEC_WEBSOCKET_VERSION.as_str(),
+            value: "13".as_bytes(),
+        },
+        Header {
+            name: SEC_WEBSOCKET_KEY.as_str(),
+            value: ws_key.as_bytes(),
+        },
+    ];
+
     // Create a request object that tokio-tungstenite understands, pointed at a local WebSocket
     // URI.  This is used to create the WebSocket client.
     let ws_uri = format!("ws://localhost{}", path);
     let ws_request = httparse::Request {
         method: Some("GET"),
         path: Some(&ws_uri),
         version: Some(1), // HTTP/1.1
-        headers: &mut [],
+        headers: &mut headers,
     };
 
     // Now we can use tokio-tungstenite to upgrade the connection to a WebSocket.  We get back a

sources/deny.toml

@@ -65,8 +65,6 @@ skip = [
 ]
 
 skip-tree = [
-    # tungstenite is using an older sha-1
-    { name = "tungstenite", version = "=0.16" },
     # windows-sys is not a direct dependency. mio and schannel
     # are using different versions of windows-sys. we skip the
     # dependency tree because windows-sys has many sub-crates
@@ -78,7 +76,10 @@ skip-tree = [
     # serde_yaml actually uses a newer hashbrown dependency,
     # but several crates in the graph pull in an older one, so skip for now
     # until they can be updated
-    { name = "hashbrown", version = "=0.13.2" }
+    { name = "hashbrown", version = "=0.13.2" },
+    # tungstenite uses a newer version of base64, but many of the
+    # first party crates are still in this version
+    { name = "base64", version = "=0.13.1" }
 ]
 
 [sources]