#include <Server/WebTerminalRequestHandler.h>

#include <Server/HTTP/HTTPResponseHelpers.h>

#include <Server/HTTP/WriteBufferFromHTTPServerResponse.h>

#include <Server/HTTPHandler.h>

#include <Server/HTTPResponseHeaderWriter.h>

#include <Server/IServer.h>

#include <Server/ClientEmbedded/ClientEmbeddedRunner.h>

#include <Server/ClientEmbedded/PtyClientDescriptorSet.h>

#include <Access/Credentials.h>

#include <Core/ServerSettings.h>

#include <Interpreters/Context.h>

#include <Interpreters/Session.h>

#include <Common/Exception.h>

#include <Common/logger_useful.h>

#include <Common/Base64.h>

#include <Poco/JSON/Object.h>

#include <Poco/JSON/Parser.h>

#include <Poco/Net/StreamSocket.h>

#include <Poco/SHA1Engine.h>

#include <base/errnoToString.h>

#include <base/scope_guard.h>

#include <Common/Stopwatch.h>

#include <fcntl.h>

#include <poll.h>

#include <unistd.h>

constexpr unsigned char resource_webterminal_html[] =

{

#embed "../../programs/server/webterminal.html"

};

namespace DB

{

namespace ErrorCodes

{

extern const int INCORRECT_DATA;

}

namespace ServerSetting

{

extern const ServerSettingsString default_session_user;

}

{

String computeWebSocketAccept(const String & key)

}

bool isValidWebSocketKey(const String & key)

}

void sendAllBytes(Poco::Net::StreamSocket & socket, const char * data, size_t len)

}

void sendWebSocketFrame(Poco::Net::StreamSocket & socket, uint8_t opcode, const char * data, size_t len)

}

void sendWebSocketBinary(Poco::Net::StreamSocket & socket, const char * data, size_t len)

{

sendWebSocketFrame(socket, 0x02, data, len);

}

void sendWebSocketClose(Poco::Net::StreamSocket & socket, uint16_t code, const String & reason)

}

bool readExact(Poco::Net::StreamSocket & socket, char * buf, size_t n, UInt64 deadline_ns = 0)

}

struct WebSocketFrame

};

WebSocketFrame readWebSocketFrame(Poco::Net::StreamSocket & socket, UInt64 deadline_ns = 0, uint64_t max_payload_size = 16 * 1024 * 1024)

}

Poco::JSON::Object::Ptr parseRootObject(const String & json)

}

String getStringField(const Poco::JSON::Object::Ptr & object, const char * key)

}

int getIntField(const Poco::JSON::Object::Ptr & object, const char * key, int max_value)

}

bool parseResizeMessage(const String & json, int & cols, int & rows)

}

bool parseAuthMessage(const String & json, String & user, String & password)

}

}

void WebTerminalRequestHandler::serveHTML(HTTPServerRequest & request, HTTPServerResponse & response)

}

void WebTerminalRequestHandler::handleWebSocket(HTTPServerRequest & request, HTTPServerResponse & response)

}

catch (...)

{

tryLogCurrentException(log, "Failed to shutdown WebSocket");

}

);

/// Wait for the first WebSocket text message containing auth credentials:

/// {"type":"auth","user":"...","password":"..."}

/// Set a per-read timeout and a total deadline to prevent slow-trickle attacks

/// where a malicious client sends one byte at a time to hold the connection.

socket.setReceiveTimeout(Poco::Timespan(5, 0)); /// 5 seconds per individual read

UInt64 auth_deadline = clock_gettime_ns() + 5'000'000'000ULL; /// 5 seconds total

/// After the 101 handshake the stream is in WebSocket framing mode. If the

/// client stalls mid-frame, `readWebSocketFrame` calls into `socket.receiveBytes`

/// which throws `Poco::TimeoutException` on recv timeout. An uncaught exception

/// would unwind without a close frame, so the browser would observe an abnormal

/// close (`1006`) indistinguishable from a network drop. Catch read errors

/// here and send an explicit policy close (`1008`) instead.

///

/// Apply a tight pre-auth payload cap. The auth JSON is small

/// (`{"type":"auth","user":...,"password":...}`), and the field-level

/// limits below restrict `user` to 256 bytes and `password` to 1024 bytes,

/// so 4 KiB is comfortably above any legitimate first frame. Without this

/// cap, an unauthenticated client could force the server to allocate up

/// to the general 16 MiB frame budget on every connection.

static constexpr uint64_t MAX_AUTH_FRAME_SIZE = 4 * 1024;

WebSocketFrame auth_frame;

try

{

auth_frame = readWebSocketFrame(socket, auth_deadline, MAX_AUTH_FRAME_SIZE);

}

catch (...)

{

tryLogCurrentException(log, "Failed to read WebSocket auth frame");

sendWebSocketClose(socket, 1008, "Auth read failed");

return;

}

socket.setReceiveTimeout(Poco::Timespan(0)); /// Clear timeout for the main loop

if (auth_frame.message_too_big)

{

sendWebSocketClose(socket, 1009, "Message too big");

return;

}

if (auth_frame.protocol_error)

{

sendWebSocketClose(socket, 1002, "Protocol error");

return;

}

if (!auth_frame.valid || auth_frame.opcode != 0x01)

{

sendWebSocketClose(socket, 1008, "Expected auth message");

return;

}

/// Parse the auth message. `parseAuthMessage` (via `Poco::JSON::Parser` and

/// `getStringField`) can throw on malformed JSON or type mismatch. After the

/// 101 handshake we are in WebSocket framing mode, so an unhandled exception

/// here would unwind without a close frame and the browser would see an

/// abnormal close (1006) indistinguishable from a network drop. Catch

/// parse errors and send a deterministic policy close (1008) instead.

///

/// `auth_user` is seeded with the default session user (the `default_session_user` server

/// setting, or its per-endpoint override) so that omitting the "user" field in the JSON falls

/// back to that default. An empty default session user leaves `auth_user` empty, so an auth

/// message without a "user" field fails authentication (anonymous connections are prohibited).

String auth_user = default_session_user

? *default_session_user

: String(server.context()->getServerSettings()[ServerSetting::default_session_user]);

String auth_password;

bool auth_parsed = false;

try

{

auth_parsed = parseAuthMessage(auth_frame.payload, auth_user, auth_password);

}

catch (...)

{

tryLogCurrentException(log, "Failed to parse WebSocket auth message");

sendWebSocketClose(socket, 1008, "Invalid auth message");

return;

}

if (!auth_parsed)

{

sendWebSocketClose(socket, 1008, "Invalid auth message");

return;

}

/// Enforce explicit limits on auth field sizes. The general frame-size cap

/// of 16 MiB is far too permissive for credentials and would let a client

/// force expensive auth work or oversized log payloads on failure.

static constexpr size_t MAX_AUTH_USER_LENGTH = 256;

static constexpr size_t MAX_AUTH_PASSWORD_LENGTH = 1024;

if (auth_user.size() > MAX_AUTH_USER_LENGTH || auth_password.size() > MAX_AUTH_PASSWORD_LENGTH)

{

sendWebSocketClose(socket, 1008, "Auth field too long");

return;

}

/// Authenticate the user. After the 101 handshake we are in WebSocket

/// framing mode, so an unhandled exception here would unwind without a

/// close frame and the browser would see an abnormal close (1006). Send

/// an explicit policy-violation close (1008) instead so clients can

/// distinguish login failure from network errors deterministically.

/// Note: do not call makeSessionContext() here - it will be called by ClientEmbedded's constructor.

auto session = std::make_unique<Session>(server.context(), ClientInfo::Interface::HTTP, request.isSecure());

try

{

/// Keep the audit information and authentication address consistent with

/// ordinary HTTP authentication. In particular, when

/// `auth_use_forwarded_address` is enabled, use the trusted final entry

/// of `X-Forwarded-For` rather than the reverse proxy address.

session->setHTTPClientInfo(request);

const auto & client_info = session->getClientInfo();

const auto forwarded_address = client_info.getLastForwardedFor();

const bool use_forwarded_address = server.context()->getConfigRef().getBool("auth_use_forwarded_address", false);

if (use_forwarded_address && !client_info.forwarded_for.empty() && !forwarded_address)

throw Exception(

ErrorCodes::INCORRECT_DATA,

"Invalid address in `X-Forwarded-For` HTTP header: expected an IP literal with an optional numeric port");

const auto client_address = forwarded_address && use_forwarded_address

? *forwarded_address

: request.clientAddress();

session->authenticate(BasicCredentials(auth_user, auth_password), client_address);

}

catch (...)

{

tryLogCurrentException(log, "WebSocket authentication failed");

sendWebSocketClose(socket, 1008, "Authentication failed");

return;

}

LOG_DEBUG(log, "WebSocket connection established for user {}", auth_user);

/// Create PTY for the embedded client.

/// 80x24 is the conventional default terminal geometry inherited from the

/// VT100 / DEC VT family; see https://en.wikipedia.org/wiki/VT100. The

/// browser sends a `resize` control message right after connecting, so this

/// only matters until the first resize.

static constexpr int DEFAULT_COLS = 80;

static constexpr int DEFAULT_ROWS = 24;

/// `xterm-256color` is the terminfo entry advertised to clickhouse-client

/// inside the PTY. It is the most broadly-available entry that signals

/// 256-color and modern xterm-style escape sequences. We do not request a

/// truecolor entry like `xterm-direct`, because terminfo databases inside

/// the container may not include it; clickhouse-client itself emits 24-bit

/// (truecolor) ANSI escape sequences directly, so the chosen TERM only

/// affects libraries (e.g. ncurses) that consult terminfo.

auto pty_descriptors = std::make_unique<PtyClientDescriptorSet>("xterm-256color", DEFAULT_COLS, DEFAULT_ROWS, 0, 0);

auto client_runner = std::make_unique<ClientEmbeddedRunner>(std::move(pty_descriptors), std::move(session));

/// `ClientEmbedded::run` interprets each entry of this map as a

/// `--key value` pair appended to the embedded `clickhouse-client`

/// command line (see `ClientEmbedded.cpp`). The map must therefore stay

/// empty here: the web terminal does not have a safe path for the

/// user-facing browser to set arbitrary CLI flags on the embedded

/// client, and reusing the SSH protocol's `SetEnv` carrier here would

/// turn any future user-controlled key into a CLI-flag injection.

NameToNameMap envs;

client_runner->run(envs);

auto server_descriptors = client_runner->getDescriptorsForServer();

int pty_master_fd = server_descriptors.out;

/// Set a send timeout to avoid hanging indefinitely on slow/non-reading clients

socket.setSendTimeout(Poco::Timespan(30, 0)); /// 30 seconds

/// Make PTY master non-blocking for polling. If we cannot put it into

/// non-blocking mode, the read loop below would deadlock on the first

/// `read`, so abort the session early instead.

int flags = fcntl(pty_master_fd, F_GETFL, 0);

if (flags == -1 || fcntl(pty_master_fd, F_SETFL, flags | O_NONBLOCK) == -1)

{

LOG_DEBUG(log, "Failed to set PTY master non-blocking: {}", errnoToString());

sendWebSocketClose(socket, 1011, "Internal error");

return;

}

/// Main I/O loop: bridge WebSocket <-> PTY

bool running = true;

/// Track whether a close frame has already been sent so we do not

/// emit a second close (or further data) after the close handshake,

/// which would violate RFC 6455.

bool close_sent = false;

char pty_buf[4096];

auto send_close_once = [&](uint16_t code, const String & reason)

{

if (close_sent)

return;

close_sent = true;

sendWebSocketClose(socket, code, reason);

};

/// State for WebSocket frame reassembly (RFC 6455 fragmentation)

String fragment_buffer;

uint8_t fragment_opcode = 0;

bool in_fragmented_message = false;

static constexpr size_t MAX_MESSAGE_SIZE = 16 * 1024 * 1024;

/// Set a receive timeout to prevent a malicious client from stalling the

/// handler thread by trickling bytes after poll() indicates readability.

/// If a timeout fires mid-frame, the catch block below terminates the

/// connection (rather than continuing), so there is no protocol desync.

socket.setReceiveTimeout(Poco::Timespan(30, 0)); /// 30 seconds per socket read

while (running && !server.isCancelled() && !client_runner->hasFinished())

{

struct pollfd fds[2];

fds[0].fd = socket.impl()->sockfd();

fds[0].events = POLLIN;

fds[0].revents = 0;

fds[1].fd = pty_master_fd;

fds[1].events = POLLIN;

fds[1].revents = 0;

int poll_result = poll(fds, 2, 100); /// 100ms timeout

if (poll_result < 0)

{

if (errno == EINTR)

continue;

break;

}

/// Data from PTY -> send to WebSocket. A failure inside `sendWebSocketBinary`

/// (for example, the client closing the socket) propagates out of

/// the loop; `SCOPE_EXIT` shuts down the socket.

if (fds[1].revents & POLLIN)

{

ssize_t n = read(pty_master_fd, pty_buf, sizeof(pty_buf));

if (n > 0)

{

sendWebSocketBinary(socket, pty_buf, static_cast<size_t>(n));

}

else if (n == 0)

{

running = false;

}

else if (errno != EINTR && errno != EAGAIN)

{

running = false;

}

}

/// Data from WebSocket -> send to PTY

if (fds[0].revents & POLLIN)

{

try

{

/// Enforce an absolute per-frame deadline. The per-read

/// `setReceiveTimeout` above bounds a single `receiveBytes` call,

/// but a client could keep trickling one byte at a time within

/// the per-read timeout to hold the handler thread indefinitely.

/// The absolute deadline closes that hole by capping the total

/// time spent reading a single frame.

UInt64 frame_deadline = clock_gettime_ns() + 30'000'000'000ULL; /// 30 seconds per frame

WebSocketFrame frame = readWebSocketFrame(socket, frame_deadline);

if (frame.message_too_big)

{

send_close_once(1009, "Message too big");

running = false;

continue;

}

if (frame.protocol_error)

{

send_close_once(1002, "Protocol error");

running = false;

continue;

}

if (!frame.valid)

{

running = false;

continue;

}

/// Handle control frames (can appear between fragmented data frames)

if (frame.opcode >= 0x08)

{

switch (frame.opcode)

{

case 0x08: /// Close frame

send_close_once(1000, "Bye");

running = false;

break;

case 0x09: /// Ping

sendWebSocketFrame(socket, 0x0A, frame.payload.data(), frame.payload.size());

break;

default:

break;

}

continue;

}

/// Handle data frames with fragmentation support (RFC 6455 Section 5.4)

if (frame.opcode != 0x00)

{

/// A new data frame while a fragmented message is in progress is a protocol error

if (in_fragmented_message)

{

send_close_once(1002, "Protocol error: new message during fragmentation");

running = false;

continue;

}

/// First frame of a message (text or binary)

fragment_opcode = frame.opcode;

fragment_buffer = std::move(frame.payload);

in_fragmented_message = !frame.fin;

}

else

{

/// Continuation frame without a preceding data frame is a protocol error

if (!in_fragmented_message)

{

send_close_once(1002, "Protocol error: unexpected continuation frame");

running = false;

continue;

}

if (fragment_buffer.size() + frame.payload.size() > MAX_MESSAGE_SIZE)

{

LOG_WARNING(log, "WebSocket message exceeded size limit");

send_close_once(1009, "Message too big");

running = false;

continue;

}

fragment_buffer.append(frame.payload);

if (frame.fin)

in_fragmented_message = false;

}

if (!frame.fin)

continue; /// More fragments to come

/// Complete message assembled

switch (fragment_opcode)

{

case 0x01: /// Text message - control message

{

int cols = 0;

int rows = 0;

if (parseResizeMessage(fragment_buffer, cols, rows))

client_runner->changeWindowSize(cols, rows, 0, 0);

break;

}

case 0x02: /// Binary message - terminal input

{

const char * write_ptr = fragment_buffer.data();

size_t remaining = fragment_buffer.size();

while (remaining > 0)

{

ssize_t written = write(server_descriptors.in, write_ptr, remaining);

if (written < 0)

{

if (errno == EINTR)

continue;

if (errno == EAGAIN || errno == EWOULDBLOCK)

{

/// Wait for the PTY to become writable before retrying.

/// On poll() error, abort instead of busy-spinning.

struct pollfd pfd = {};

pfd.fd = server_descriptors.in;

pfd.events = POLLOUT;

int poll_rc = poll(&pfd, 1, 100); /// Wait up to 100ms

if (poll_rc < 0 && errno != EINTR)

{

running = false;

break;

}

continue;

}

running = false;

break;

}

if (written == 0)

{

running = false;

break;

}

write_ptr += written;

remaining -= static_cast<size_t>(written);

}

break;

}

default:

break;

}

fragment_buffer.clear();

}

catch (const Poco::TimeoutException &)

{

/// Timeout while reading a frame means the client is stalling.

/// We must close the connection because the frame parser may have

/// consumed a partial frame, making the stream unrecoverable.

LOG_DEBUG(log, "WebSocket frame read timed out, closing connection");

running = false;

}

catch (...)

{

LOG_DEBUG(log, "WebSocket read error: {}", getCurrentExceptionMessage(false));

running = false;

}

}

/// Check for socket errors

if (fds[0].revents & (POLLERR | POLLHUP))

running = false;

}

/// Drain remaining PTY output and send the final close frame only when

/// no close has been emitted yet. RFC 6455 forbids data frames or a second

/// close after the close handshake has started.

if (!close_sent)

{

for (;;)

{

struct pollfd pfd = {};

pfd.fd = pty_master_fd;

pfd.events = POLLIN;

if (poll(&pfd, 1, 0) <= 0 || !(pfd.revents & POLLIN))

break;

ssize_t n = read(pty_master_fd, pty_buf, sizeof(pty_buf));

if (n <= 0)

break;

try

{

sendWebSocketBinary(socket, pty_buf, static_cast<size_t>(n));

}

catch (...)

{

tryLogCurrentException(log, "Failed to drain PTY output to WebSocket");

break;

}

}

send_close_once(1000, "Session ended");

}

/// socket.shutdown() is handled by SCOPE_EXIT above

LOG_INFO(log, "WebSocket connection closed");

}

void WebTerminalRequestHandler::handleRequest(HTTPServerRequest & request, HTTPServerResponse & response, const ProfileEvents::Event &)