This changes the interface used to apply a decorator to the HTTP
request or response messages used to perform the WebSocket handshake
as follows:
* Add the `stream_base::decorator` option object
* Add `stream::set_option` overload to set the decorator from
the option
* The decorator applies to all client and server handshakes
performed on the stream after the option is set.
* Overloads of the following functions which accept a Decorator
are deprecated:
- accept, accept_ex
- handshake, handshake_ex
- async_accept, async_accept_ex
- async_handshake, async_handshake_ex
Actions Required:
* Code which passes decorator to any `websocket::stream` member
function should call `stream::set_option` instead with a newly
constructed `stream_base::decorator` object containing the
decorator. Alternatively, the macro `BOOST_BEAST_ALLOW_DEPRECATED`
may be defined to 1.
This resolves a medium vulnerability described in the
Beast Hybrid Assessment Report by Bishop Fox, where masks generated
for use with outgoing WebSocket client frames use an insufficient
source of entropy and a non-cryptographically secure pseudo-random
number generator.
By default, all newly constructed WebSocket streams will use a
uniquely seeded secure PRNG (ChaCha20 in counter mode). As this may
result in increased CPU resource consumption, the function
websocket::stream::secure_prng() may be used to select a faster but
less secure PRNG, for the case where the caller knows that the secure
generator is not necessary.
On some systems, std::random_device may produce insufficient entropy
to securely seed the PRNG. As this condition cannot be detected by
Beast, callers may use the function websocket::seed_prng() called
once at startup to provide at least 256 bits of entropy which will
be used to uniquely seed all subsequent PRNGs.
fix#849
This adds an additional `bool` template parameter to
`websocket::stream`:
* When deflateSupported is `true`, the stream will be capable
of negotiating the permessage-deflate websocket extension per
the configured run-time settings.
* When deflateSupported is `false`, the stream will never negotiate
the permessage-deflate websocket extension. Furthermore, all of the
code necessary for implementing the permessage-deflate extension
will be excluded from function instantiations. The resulting emitted
object code should be smaller.
fix#769
The following classes are removed:
* handler_type
* async_result
* async_completion
* is_dynamic_buffer
* is_const_buffer_sequence
* is_mutable_buffer_sequence
* handler_alloc
Actions Required:
* Use BOOST_ASIO_HANDLER_TYPE instead of handler_type
* Use BOOST_ASIO_INITFN_RESULT_TYPE instead of async_result
* Use boost::asio::async_completion
* Use boost::asio::is_dynamic_buffer
* Use boost::asio::is_const_buffer_sequence
* Use boost::asio::is_mutable_buffer_sequence
* boost::asio::associated_allocator_t replaces handler_alloc
* stream overloads of accept which take both a message
and a buffer sequence are removed.
Actions Required:
* Do not call websocket accept overloads which take
both a message and a buffer sequence, as it is
illegal per rfc6455.
fix#642
* Calls to stream::close and stream::async_close will
automatically perform the required read operations
Actions Required:
* Remove calling code which drains the connection after
calling stream::close or stream::async_close
