Properly accept WebSockets in DERP HTTP server

kylecarbs · kylecarbs · commit 31045cf53c85 · 2023-02-28T19:43:35.000Z
diff --git a/derp/derphttp/derphttp_server.go b/derp/derphttp/derphttp_server.go
@@ -4,6 +4,8 @@
 package derphttp
 
 import (
+	"crypto/sha1"
+	"encoding/base64"
 	"fmt"
 	"log"
 	"net/http"
@@ -47,14 +49,27 @@ func Handler(s *derp.Server) http.Handler {
 		if !fastStart {
 			pubKey := s.PublicKey()
 			fmt.Fprintf(conn, "HTTP/1.1 101 Switching Protocols\r\n"+
-				"Upgrade: DERP\r\n"+
+				"Upgrade: %s\r\n"+
 				"Connection: Upgrade\r\n"+
+				"Sec-WebSocket-Accept: %s\r\n"+
 				"Derp-Version: %v\r\n"+
 				"Derp-Public-Key: %s\r\n\r\n",
+				up,
+				secWebSocketAccept(r.Header.Get("Sec-WebSocket-Key")),
 				derp.ProtocolVersion,
 				pubKey.UntypedHexString())
 		}
 
 		s.Accept(r.Context(), netConn, conn, netConn.RemoteAddr().String())
 	})
 }
+
+var keyGUID = []byte("258EAFA5-E914-47DA-95CA-C5AB0DC85B11")
+
+func secWebSocketAccept(secWebSocketKey string) string {
+	h := sha1.New()
+	h.Write([]byte(secWebSocketKey))
+	h.Write(keyGUID)
+
+	return base64.StdEncoding.EncodeToString(h.Sum(nil))
+}
diff --git a/derp/derphttp/websocket.go b/derp/derphttp/websocket.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build linux || js
+//go:build linux || js || darwin || windows
 
 package derphttp
 
