ws-over-h2: permessage-deflate fixes: short return, ext tx-drain wedge, client extension offer -- with selftest

Three fixes for permessage-deflate on ws-over-h2 (RFC 8441)
encapsulated streams, plus a ctest-wired selftest:

1) The encapsulated tx path returned the h2 role's write result, which
   reflects the POST-COMPRESSION frame size -- with pmd active that is
   routinely smaller than what the caller passed in, so any
   well-compressed message made callers checking (wr < len) conclude a
   short write and kill a healthy connection.  The lws_write() contract
   is to report how much of the CALLER's payload was accepted, and the
   h1 path already returns orig_len for exactly this reason; do the
   same, still propagating write errors as < 0.

2) When pmd's compressed output exceeds its chunk buffer, the ws role
   sets ws->tx_draining_ext and expects the next POLLOUT to send the
   remaining fragments -- the h1 path services this in
   rops_handle_POLLOUT_ws() priority 5, before letting the user write
   anything new.  An h2-encapsulated child never reaches that path: its
   only POLLOUT servicing is the child loop in
   rops_perform_user_POLLOUT_h2(), which went straight to the user
   callback.  Meanwhile lws_send_pipe_choked() reports choked while
   tx_draining_ext is set, so a user write loop gated on it never
   writes again either: the drain never advances and the stream wedges
   permanently.  Service the drain from the child loop, ahead of the
   user callback.  It slots in after the generic 'deal with partial at
   nwsi' branch that 774c64a ("ws-over-h2: deal with choked nwsi")
   routes carries-ws children through, preserving its ordering: a child
   on a backed-up network socket still defers there first, the same
   priority h1 connections get, and the extension drain only runs once
   the nwsi partial has cleared.

3) lws_h2_client_handshake() only emitted sec-websocket-version and
   sec-websocket-protocol, so an lws client could never negotiate
   permessage-deflate (or any extension) over h2 even against a willing
   server.  RFC 8441 Sect 5 carries the ws handshake headers unchanged
   over extended CONNECT, so build the same offer list as
   lws_generate_client_ws_handshake() and emit it after the
   pseudo-headers; the response side already instantiates accepted
   extensions in the shared lws_client_ws_upgrade() path.

api-test-ws-h2-pmd (needs LWS_WITHOUT_EXTENSIONS=OFF): single-process
h2 ws server + client, both offering pmd; the server bulk-sends a 64KB
deterministic pattern in 4KB messages gated only on
lws_send_pipe_choked(), alternating trivially-compressible blocks
(deflated frame far smaller than the payload) with incompressible hash
noise (deflated output overflows pmd's default 1KB chunk buffer,
forcing tx_draining_ext).  It fails if the connection is not genuinely
ws-over-h2, if the extended CONNECT did not offer pmd, if any
lws_write() reports fewer bytes accepted than requested, if the pattern
corrupts, or if the transfer stalls.  Reverting any one of the three
fixes makes it fail in the corresponding distinct way.

Author: thefallentree

lib/roles/h2/http2.c

@@ -2870,6 +2870,40 @@ lws_h2_client_handshake(struct lws *wsi)
 				goto fail_length;
 		}
 
+#if !defined(LWS_WITHOUT_EXTENSIONS)
+		{
+			/*
+			 * Offer the vhost's extensions the same way the h1
+			 * upgrade does (RFC 8441 Sect 5 carries the ws
+			 * headers unchanged): without this the client can
+			 * never negotiate eg, permessage-deflate over h2.
+			 */
+			const struct lws_extension *ext =
+						wsi->a.vhost->ws.extensions;
+			char eb[256];
+			int el = 0;
+
+			while (ext && ext->callback) {
+				if (wsi->a.vhost->protocols[0].callback(wsi,
+				    LWS_CALLBACK_CLIENT_CONFIRM_EXTENSION_SUPPORTED,
+				    wsi->user_space, (char *)ext->name, 0)) {
+					ext++;
+					continue;
+				}
+				el += lws_snprintf(eb + (size_t)el,
+						   sizeof(eb) - (size_t)el,
+						   "%s%s", el ? "," : "",
+						   ext->client_offer);
+				ext++;
+			}
+			if (el &&
+			    lws_add_http_header_by_token(wsi,
+					WSI_TOKEN_EXTENSIONS,
+					(unsigned char *)eb, el, &p, end))
+				goto fail_length;
+		}
+#endif
+
 		wsi->h23_stream_carries_ws = 1;
 	}
 #endif

lib/roles/h2/ops-h2.c

@@ -1139,6 +1139,33 @@ rops_perform_user_POLLOUT_h2(struct lws *wsi)
 			goto next_child;
 		}
 
+#if defined(LWS_ROLE_WS) && !defined(LWS_WITHOUT_EXTENSIONS)
+		/*
+		 * ws-over-h2: tx path extension with more to send (eg,
+		 * permessage-deflate whose compressed output exceeded its
+		 * chunk buffer).  The h1 path services this from
+		 * rops_handle_POLLOUT_ws() priority 5; this loop is the ONLY
+		 * POLLOUT servicing an encapsulated child ever gets, so it
+		 * must do the same -- while tx_draining_ext is set,
+		 * lws_send_pipe_choked() reports choked, so the user
+		 * callback will never write again and the connection wedges
+		 * for good.
+		 */
+		if (lwsi_role_ws(w) && lwsi_state(w) == LRS_ESTABLISHED &&
+		    w->ws && w->ws->tx_draining_ext) {
+			if (lws_write(w, NULL, 0, LWS_WRITE_CONTINUATION) < 0) {
+				lwsl_info("%s signalling to close\n", __func__);
+				lws_close_free_wsi(w, LWS_CLOSE_STATUS_NOSTATUS,
+						   "h2 ws ext drain");
+				wa = &wsi->mux.child_list;
+				goto next_child;
+			}
+			lws_callback_on_writable(w);
+			wa = &wsi->mux.child_list;
+			goto next_child;
+		}
+#endif
+
 		/* priority 2: pre compression-transform buffered output */
 
 #if defined(LWS_WITH_HTTP_STREAM_COMPRESSION)

lib/roles/ws/ops-ws.c

@@ -2001,10 +2001,24 @@ rops_write_role_protocol_ws(struct lws *wsi, unsigned char *buf, size_t len,
 		}
 #endif
 
-		return lws_rops_func_fidx(encap->role_ops,
+		n = lws_rops_func_fidx(encap->role_ops,
 				   LWS_ROPS_write_role_protocol).
 					write_role_protocol(wsi, buf - pre,
 							    len + (unsigned int)pre, wp);
+		if (n < 0)
+			return n;
+
+		/*
+		 * The lws_write() contract is to report how much of the
+		 * CALLER's payload was accepted.  len here is the
+		 * post-extension (eg, permessage-deflate compressed) frame
+		 * size, which is routinely SMALLER than what the caller
+		 * passed in -- returning it (as this path used to) makes
+		 * well-behaved callers conclude the write failed short and
+		 * kill the connection.  The h1 path returns orig_len for
+		 * exactly this reason; do the same.
+		 */
+		return (int)orig_len;
 	}
 
 	switch ((*wp) & 0x1f) {

minimal-examples-lowlevel/api-tests/api-test-ws-h2-pmd/CMakeLists.txt

@@ -0,0 +1,37 @@
+project(lws-api-test-ws-h2-pmd C)
+cmake_minimum_required(VERSION 3.10)
+find_package(libwebsockets CONFIG REQUIRED)
+list(APPEND CMAKE_MODULE_PATH ${LWS_CMAKE_DIR})
+include(CheckCSourceCompiles)
+include(LwsCheckRequirements)
+
+set(SAMP lws-api-test-ws-h2-pmd)
+set(SRCS main.c)
+
+set(requirements 1)
+require_lws_config(LWS_ROLE_WS 1 requirements)
+require_lws_config(LWS_ROLE_H2 1 requirements)
+require_lws_config(LWS_WITH_CLIENT 1 requirements)
+require_lws_config(LWS_WITH_SERVER 1 requirements)
+require_lws_config(LWS_WITH_TLS 1 requirements)
+require_lws_config(LWS_WITHOUT_EXTENSIONS 0 requirements)
+
+if (requirements)
+	add_executable(${SAMP} ${SRCS})
+
+	if (websockets_shared)
+		target_link_libraries(${SAMP} websockets_shared ${LIBWEBSOCKETS_DEP_LIBS})
+		add_dependencies(${SAMP} websockets_shared)
+	else()
+		target_link_libraries(${SAMP} websockets ${LIBWEBSOCKETS_DEP_LIBS})
+	endif()
+
+	lws_get_free_port(PORT_WS_H2_PMD)
+
+	add_test(NAME api-test-ws-h2-pmd COMMAND lws-api-test-ws-h2-pmd -p ${PORT_WS_H2_PMD})
+	set_tests_properties(api-test-ws-h2-pmd
+			     PROPERTIES
+			     WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/minimal-examples-lowlevel/api-tests/api-test-ws-h2-pmd
+			     TIMEOUT 60)
+
+endif()