handshake_guard.h

#pragma once
 
#include "log_sanitize.h"
#include "origin_check.h"
#include <esp32-hal-log.h> // route the refusal log through Arduino's logger (otherwise silenced)
#include <esp_http_server.h>
#include <esp_log.h>
 
// IDF 5.5 never calls a WebSocket URI handler for the handshake: ws_pre_handshake_cb runs before the 101 reply (an
// error refuses the upgrade) and ws_post_handshake_cb after it. Both are off in the precompiled Arduino libs, so
// platformio.ini sets them through custom_sdkconfig.
#if !CONFIG_HTTPD_WS_PRE_HANDSHAKE_CB_SUPPORT || !CONFIG_HTTPD_WS_POST_HANDSHAKE_CB_SUPPORT
// cppcheck-suppress preprocessorErrorDirective
#error "needs CONFIG_HTTPD_WS_PRE/POST_HANDSHAKE_CB_SUPPORT=y (custom_sdkconfig in platformio.ini)"
#endif
 
enum class HeaderStatus {
    Absent,  
    TooLong, 
    Ok       
};
 
inline HeaderStatus read_header(httpd_req_t* req, const char* name, char* buf, size_t cap, size_t* len)
{
    *len = 0;
    const size_t n = httpd_req_get_hdr_value_len(req, name);
    if (n == 0)
    {
        return HeaderStatus::Absent;
    }
    if (n >= cap || httpd_req_get_hdr_value_str(req, name, buf, cap) != ESP_OK)
    {
        return HeaderStatus::TooLong;
    }
    *len = n;
    return HeaderStatus::Ok;
}
 
inline bool handshake_origin_ok(httpd_req_t* req, const char* tag, bool any_port = false)
{
    constexpr size_t kHdrBuf = 128;
    char origin[kHdrBuf];
    char host[kHdrBuf];
    size_t origin_len = 0;
    size_t host_len = 0;
 
    const bool origin_too_long = read_header(req, "Origin", origin, kHdrBuf, &origin_len) == HeaderStatus::TooLong;
    if (read_header(req, "Host", host, kHdrBuf, &host_len) != HeaderStatus::Ok)
    {
        host_len = 0; // absent or too long both count as empty
    }
 
    if (origin_too_long)
    {
        ESP_LOGW(tag, "request refused: Origin header too long");
        return false;
    }
    const std::string_view o(origin, origin_len);
    const std::string_view h(host, host_len);
    if (!(any_port ? remote::origin_allowed_any_port(o, h) : remote::origin_allowed(o, h)))
    {
        char safe[kHdrBuf]; // the Origin is attacker-controlled: no control bytes into the serial log
        remote::sanitize_for_log(origin, origin_len, safe, sizeof(safe));
        ESP_LOGW(tag, "request refused: Origin %s", safe);
        return false;
    }
    return true;
}