OUTSOFTWARE BBS — LOCAL PATCHES TO WEBSOCKIFY 0.12.0
2026-10-25

These are local changes to the vendored websockify 0.12.0 sources. They are
not an upstream websockify release. Existing copyright notices and COPYING
(LGPL version 3) are retained. Full modified source is included.

1. websockify/websocket.py — handshake validation before target connection
   Require Connection to include the Upgrade token. Reject duplicate,
   malformed/non-ASCII/non-base64 Sec-WebSocket-Key headers and keys that do
   not decode to the 16 bytes required by the WebSocket handshake.
   The normal HTTP and failed-upgrade paths never call the TCP proxy.

2. websockify/websocketproxy.py — explicit close on every post-connect path
   Cover TCP_NODELAY setup and the proxy loop with the same cleanup block.
   Ignore shutdown errors caused by an already closed/reset peer, and always
   execute close in a nested finally. This covers both ordinary disconnects
   and exceptions immediately after connecting.

3. bbs_proxy.py — fixed service configuration, no pip/install step
   Launch directly with Python -S from the included source tree. The selected
   core path works without numpy or the optional token/auth plugin packages.
   Listen: 127.0.0.1:6080. Fixed target: 127.0.0.1:23.
   Accept only /ws, HTTP/1.1, WebSocket version 13, and exactly one Origin:
   https://bbs.outsoftware.it or https://retrobbs.sinclair.homepc.it.
   Origin comparison is exact; duplicates, suffix attacks, extra ports and
   HTTP origins are rejected before any target connection.
   Query strings and other paths are rejected. No CLI arguments,
   token plugin, HTTP file server, wrapped command, session recording, or
   public listening address. Caddy owns HTTPS/WSS termination.
   Importing this module and generating/configuring it do not open the BBS.

4. tests/test_proxy.py — isolated regression checks
   Tests create only 127.0.0.1 listeners/connections on ephemeral ports.
   They never use port 23 or connect to the BBS. They cover invalid/partial
   handshakes, byte-exact binary echo, orderly/abrupt/reset disconnects,
   shutdown failure, socket-option failure, fixed wrapper configuration and
   both permitted HTTPS origins with the same byte-exact binary echo.
   Run: python3 -S tests/test_proxy.py
   BBS_WEB_REPORT_DIR optionally selects the result directory.

Service command for the prepared installation root:
  /usr/bin/python3 -S -u /home/outsoft/outsoftware-web-bbs/bbs_proxy.py

No service was deployed, started on port 6080, or connected to port 23 during
this local preparation. Real Python 3.5 execution and Caddy routing belong
to the server-side installation checks performed by the task owner.
