Add verified WSS transport for legacy boards

Configure the default WSS endpoint and ISRG Root X2 trust anchor, preserve device authentication, enforce TLS and WebSocket handshake validation, and handle partial I/O and connection cleanup. Add host tests, server probes, package verification and integration documentation. Backend 443 /ws still returns HTTP 404; on-device validation remains pending.
2026-09-16 11:23:33 +08:00
parent 4b565958f9
commit 3e463f57b6
23 changed files with 809 additions and 396 deletions
@@ -22,6 +22,7 @@

 #ifndef __LIBRWS_H__
 #define __LIBRWS_H__
+#include "rws_tls_config.h"

 #include <stdio.h>

@@ -23,6 +23,8 @@
 #ifndef __RWS_COMMON_H__
 #define __RWS_COMMON_H__ 1

+#include "rws_tls_config.h"
+
 #include <stdio.h>
 #include "ql_type.h"
 #include "ql_rtos.h"
@@ -0,0 +1,8 @@
+#ifndef RWS_HANDSHAKE_H
+#define RWS_HANDSHAKE_H
+#include <stddef.h>
+#define RWS_HANDSHAKE_MAX 8192
+/* 1: valid upgrade, 0: incomplete, -1: rejected. Never needs a NUL terminator. */
+int rws_check_handshake(const char *data, size_t length, const char *expected_accept,
+                        size_t *header_length, int *http_status);
+#endif
@@ -87,9 +87,11 @@ typedef struct _rws_socket_struct
    char *host;
    char *path;

+    char expected_accept[29];
    char *sec_ws_accept; // "Sec-WebSocket-Accept" field from handshake

    rws_thread work_thread;
+    rws_bool worker_started;

    int command;

@@ -0,0 +1,5 @@
+#ifndef RWS_TLS_CONFIG_H
+#define RWS_TLS_CONFIG_H
+/* Shared by public and private headers so every socket layout agrees. */
+#define LIBRWS_USING_MBED_TLS 1
+#endif