code review 1743053: Websocket: fix authentication mistake caused by misuse ...

src/pkg/websocket/server.go

 // Copyright 2009 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 package websocket
 
 import (
-        "bytes"
-        "crypto/md5"
-        "encoding/binary"
         "http"
         "io"
         "strings"
 )
 
 /*
 Handler is an interface to a WebSocket.
 
 A trivial example server:
 
@@ skipping 95 matching lines @@
         // Step 6. key number must be an integral multiple of spaces.
         if keyNumber1%space1 != 0 || keyNumber2%space2 != 0 {
                 return
         }
 
         // Step 7. let part be key number divided by spaces.
         part1 := keyNumber1 / space1
         part2 := keyNumber2 / space2
 
         // Step 8. let challenge to be concatination of part1, part2 and key3.
-        challengeBuf := new(bytes.Buffer)
-        err = binary.Write(challengeBuf, binary.BigEndian, part1)
+        // Step 9. get MD5 fingerprint of challenge.
+        response, err := getChallengeResponse(part1, part2, key3)
         if err != nil {
                 return
         }
-        err = binary.Write(challengeBuf, binary.BigEndian, part2)
-        if err != nil {
-                return
-        }
-        if n, err := challengeBuf.Write(key3); n != 8 || err != nil {
-                return
-        }
-        challenge := challengeBuf.Bytes()
-        // Step 9. get MD5 fingerprint of challenge.
-        h := md5.New()
-        if _, err = h.Write(challenge); err != nil {
-                return
-        }
-        response := h.Sum()
 
         // Step 10. send response status line.
         buf.WriteString("HTTP/1.1 101 WebSocket Protocol Handshake\r\n")
         // Step 11. send response headers.
         buf.WriteString("Upgrade: WebSocket\r\n")
         buf.WriteString("Connection: Upgrade\r\n")
         buf.WriteString("Sec-WebSocket-Location: " + location + "\r\n")
         buf.WriteString("Sec-WebSocket-Origin: " + origin + "\r\n")
         protocol, found := req.Header["Sec-WebSocket-Protocol"]
         if found {
@@ skipping 61 matching lines @@
         if found {
                 buf.WriteString("WebSocket-Protocol: " + protocol + "\r\n")
         }
         buf.WriteString("\r\n")
         if err := buf.Flush(); err != nil {
                 return
         }
         ws := newConn(origin, location, protocol, buf, rwc)
         f(ws)
 }