Chromium closes WebSocket with no explanation

Question

I have Chromium 12.0.742.112 (90304) and I'm trying to set up a simple WebSocket server with it. I receive a handshake request like:

Upgrade: WebSocket
Connection: Upgrade
Host: akira:22222
Origin: http://akira:22222
Sec-WebSocket-Key1: ;39LP*eC48 n /r0P6  v6548
Sec-WebSocket-Key2: 1 0  r 362547    4  4  G

followed by 8 key bytes, in this case 88 09 F9 EE 21 13 F4 0D. I've verified that these are the same keys Chromium shows in the Network console tab. I calculate the first two keys as:

Key1: 3948066548 / 4 = 987016637
Key2: 1036254744 / 12 = 86354562

and send my response:

000001  48 54 54 50  2F 31 2E 31  20 31 30 31  20 57 65 62  HTTP/1.1 101 Web
000011  20 53 6F 63  6B 65 74 20  50 72 6F 74  6F 63 6F 6C   Socket Protocol
000021  20 48 61 6E  64 73 68 61  6B 65 0D 0A  55 70 67 72   Handshake..Upgr
000031  61 64 65 3A  20 57 65 62  53 6F 63 6B  65 74 0D 0A  ade: WebSocket..
000041  43 6F 6E 6E  65 63 74 69  6F 6E 3A 20  55 70 67 72  Connection: Upgr
000051  61 64 65 0D  0A 53 65 63  2D 57 65 62  53 6F 63 6B  ade..Sec-WebSock
000061  65 74 2D 4F  72 69 67 69  6E 3A 20 68  74 74 70 3A  et-Origin: http:
000071  2F 2F 61 6B  69 72 61 3A  32 32 32 32  32 0D 0A 53  //akira:22222..S
000081  65 63 2D 57  65 62 53 6F  63 6B 65 74  2D 4C 6F 63  ec-WebSocket-Loc
000091  61 74 69 6F  6E 3A 20 77  73 3A 2F 2F  61 6B 69 72  ation: ws://akir
0000A1  61 3A 32 32  32 32 32 2F  73 6F 63 6B  65 74 0D 0A  a:22222/socket..
0000B1  0D 0A FF F4  2E 12 9D DC  12 C2 56 40  B8 09 F3 84  ..........V@....
0000C1  CA EF .. ..  .. .. .. ..  .. .. .. ..  .. .. .. ..  ..##############

Chromium just closes the socket without even printing a message in the JS console. I can't tell what I'm doing wrong?

The server-side code is in Lua (thus why the above hex dump is indexed starting from 1):

require('crypto')
local handshake = {
    "HTTP/1.1 101 Web Socket Protocol Handshake",
    "Upgrade: WebSocket",
    "Connection: Upgrade",
    "Sec-WebSocket-Origin: " .. request.header.origin,
    "Sec-WebSocket-Location: " ..
        request.header.origin:gsub('http:', 'ws:') .. "/socket",
'\r\n'}

log.debug("Request header:\n%s\n", table.concat(request.rawheader, '\n'))

local client = response.socket
client:settimeout(10)

local keys =
    {request.header.sec_websocket_key1, request.header.sec_websocket_key2}
local sum = {}
for i, k in ipairs(keys) do
    local nspc = 0
    sum[i] = ''
    k:gsub('%d', function(n) sum[i] = sum[i] ..n end)
    k:gsub(' ', function() nspc = nspc + 1 end)
    log.debug("Key%d: %s / %d = ", i, sum[i], nspc)
    sum[i] = tostring(tonumber(sum[i]) / nspc)
    log.debug("%s\n", sum[i])
end

local key = assert(client:receive(8))
local bytes = {key:byte(1, #key)}
local keydump = {}
for i = 1, #bytes do keydump[i] = ('%02X'):format(bytes[i]) end
log.debug("Key3: %s\n", table.concat(keydump, ' '))

local resp = crypto.evp.digest('md5', table.concat(sum) .. key, true)
handshake = table.concat(handshake, '\r\n') .. resp

client:settimeout(0.1)
log.debug("Send handshake:\n%s\n", rena.debug.hexdump(handshake))
client:send(handshake)

repeat
    local res, err = client:receive('*l')
    if res then log.debug("R: %s\n", res) end

    local res, err = client:send("Test " .. tostring(os.time()) .. '\n')
    if res then socket.sleep(1)
    elseif err == 'timeout' then log.debug("WS: Timed out\n")
    elseif err == 'closed' then log.debug("WS: Closed\n")
    else log.error("WS: Error: %s\n", tostring(err))
    end
until not res

(This script is loaded by the server script which presets some variables such as request and response, and uses LuaCrypto for MD5). Everything looks right (though I notice all the examples show nice ASCII characters for the binary keys whereas mine are mostly unprintable), but it just closes the socket.

Unfortunately Chromium is the only browser I have that supports WebSocket at all (unless there's some way to enable it in Firefox 6?), so I can't check in anything else.

Answer 1

Well I found the issue. The first two keys are meant to be concatenated as 32-bit integers (into a single 64-bit integer), not as ASCII strings:

- sum[i] = tostring(tonumber(sum[i]) / nspc)
+ sum[i] = ('%08X'):format(tonumber(sum[i]) / nspc)

- local resp = crypto.evp.digest('md5', table.concat(sum) .. key, true)
- handshake = table.concat(handshake, '\r\n') .. resp
+ local challenge = ''
+ (sum[1] .. sum[2]):gsub('..', function(byte)
+   challenge = challenge .. string.char(tonumber(byte, 16))
+ end)
+ 
+ challenge = challenge .. key
+ log.debug("Ch:   %s\n", challenge:tohex())
+ 
+ local resp = crypto.evp.digest('md5', challenge, true)
+ handshake = table.concat(handshake, '\r\n') .. resp

With that Chromium accepts the connection. I've filed a bug to complain about the lack of error message with an incorrect hash.