This resolves a medium vulnerability described in the
Beast Hybrid Assessment Report by Bishop Fox, where masks generated
for use with outgoing WebSocket client frames use an insufficient
source of entropy and a non-cryptographically secure pseudo-random
number generator.
By default, all newly constructed WebSocket streams will use a
uniquely seeded secure PRNG (ChaCha20 in counter mode). As this may
result in increased CPU resource consumption, the function
websocket::stream::secure_prng() may be used to select a faster but
less secure PRNG, for the case where the caller knows that the secure
generator is not necessary.
On some systems, std::random_device may produce insufficient entropy
to securely seed the PRNG. As this condition cannot be detected by
Beast, callers may use the function websocket::seed_prng() called
once at startup to provide at least 256 bits of entropy which will
be used to uniquely seed all subsequent PRNGs.
fix#941, fix#1016
`get_lowest_layer` is now a type alias for the
lowest layer instead of a struct with a nested type.
Actions required:
* Replace instances of `typename get_lowest_layer<T>::type`
with `get_lowest_layer<T>`.
fix#930
* The function serializer::reader_impl is deprecated and will
be removed in a subsequent version.
* Some private symbols used in the implementation were
also renamed to reflect correct terminology.
Actions Required:
* Call serializer::writer_impl instead of reader_impl
fix#769
The following classes are removed:
* handler_type
* async_result
* async_completion
* is_dynamic_buffer
* is_const_buffer_sequence
* is_mutable_buffer_sequence
* handler_alloc
Actions Required:
* Use BOOST_ASIO_HANDLER_TYPE instead of handler_type
* Use BOOST_ASIO_INITFN_RESULT_TYPE instead of async_result
* Use boost::asio::async_completion
* Use boost::asio::is_dynamic_buffer
* Use boost::asio::is_const_buffer_sequence
* Use boost::asio::is_mutable_buffer_sequence
* boost::asio::associated_allocator_t replaces handler_alloc
fix#778
* The body data member is replaced with accessor
member functions.
Actions Required:
* Call member function message::body instead of accessing
the data member at call sites.
Vinnie Falco
Glen Fernandes
Daniel James
Damian Jarek
zerotypos-found