[grid] Router bypass WebSocket data path via transparent TCP tunnel

common/repositories.bzl

@@ -50,8 +50,8 @@ js_library(
 
     http_archive(
         name = "linux_beta_firefox",
-        url = "https://ftp.mozilla.org/pub/firefox/releases/149.0b1/linux-x86_64/en-US/firefox-149.0b1.tar.xz",
-        sha256 = "f36c7db981d3098145c55b6cac5f9665066b9bb37b68531cc9dce59b72726c49",
+        url = "https://ftp.mozilla.org/pub/firefox/releases/148.0b15/linux-x86_64/en-US/firefox-148.0b15.tar.xz",
+        sha256 = "23621cf9537fd8d52d3a4e83bba48984f705facd4c10819aa07ae2531e11e2e5",
         build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 package(default_visibility = ["//visibility:public"])
@@ -72,8 +72,8 @@ js_library(
 
     dmg_archive(
         name = "mac_beta_firefox",
-        url = "https://ftp.mozilla.org/pub/firefox/releases/149.0b1/mac/en-US/Firefox%20149.0b1.dmg",
-        sha256 = "3d1f4abb063b47b392af528cf7501132fc405e2a9f1eccab71913b0fdf3e538c",
+        url = "https://ftp.mozilla.org/pub/firefox/releases/148.0b15/mac/en-US/Firefox%20148.0b15.dmg",
+        sha256 = "0da5fee250eb13165dda25f9e29d238e51f9e0d56b9355b9c8746f6bc8d5c1fe",
         build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 package(default_visibility = ["//visibility:public"])
@@ -277,8 +277,8 @@ js_library(
 
     http_archive(
         name = "linux_beta_chrome",
-        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.31/linux64/chrome-linux64.zip",
-        sha256 = "5b1961b081f0156a1923a9d9d1bfffdf00f82e8722152c35eb5eb742d63ceeb8",
+        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.16/linux64/chrome-linux64.zip",
+        sha256 = "6c3241cf5eab6b5eaed9b0b741bae799377dea26985aed08cda51fb75433218e",
         build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 package(default_visibility = ["//visibility:public"])
@@ -298,8 +298,8 @@ js_library(
     )
     http_archive(
         name = "mac_beta_chrome",
-        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.31/mac-arm64/chrome-mac-arm64.zip",
-        sha256 = "207867110edc624316b18684065df4eb06b938a3fd9141790a726ab280e2640f",
+        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.16/mac-arm64/chrome-mac-arm64.zip",
+        sha256 = "b39fe2de33190da209845e5d21ea44c75d66d0f4c33c5a293d8b6a259d3c4029",
         strip_prefix = "chrome-mac-arm64",
         patch_cmds = [
             "mv 'Google Chrome for Testing.app' Chrome.app",
@@ -319,8 +319,8 @@ js_library(
     )
     http_archive(
         name = "linux_beta_chromedriver",
-        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.31/linux64/chromedriver-linux64.zip",
-        sha256 = "a8c7be8669829ed697759390c8c42b4bca3f884fd20980e078129f5282dabe1a",
+        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.16/linux64/chromedriver-linux64.zip",
+        sha256 = "c6927758a816f0a2f5f10609b34f74080a8c0f08feaf177a68943d8d4aae3a72",
         strip_prefix = "chromedriver-linux64",
         build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")
@@ -337,8 +337,8 @@ js_library(
 
     http_archive(
         name = "mac_beta_chromedriver",
-        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.31/mac-arm64/chromedriver-mac-arm64.zip",
-        sha256 = "84c3717c0eeba663d0b8890a0fc06faa6fe158227876fc6954461730ccc81634",
+        url = "https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.16/mac-arm64/chromedriver-mac-arm64.zip",
+        sha256 = "29c44a53be87fccea4a7887a7ed2b45b5812839e357e091c6a784ee17bb8da78",
         strip_prefix = "chromedriver-mac-arm64",
         build_file_content = """
 load("@aspect_rules_js//js:defs.bzl", "js_library")

java/src/org/openqa/selenium/grid/TemplateGridServerCommand.java

@@ -18,6 +18,7 @@
 package org.openqa.selenium.grid;
 
 import java.io.Closeable;
+import java.net.URI;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
@@ -47,7 +48,10 @@ public Server<?> asServer(Config initialConfig) {
     Handlers handler = createHandlers(config);
 
     return new NettyServer(
-        new BaseServerOptions(config), handler.httpHandler, handler.websocketHandler) {
+        new BaseServerOptions(config),
+        handler.httpHandler,
+        handler.websocketHandler,
+        handler.tcpTunnelResolver) {
 
       @Override
       public void stop() {
@@ -92,12 +96,23 @@ public abstract static class Handlers implements Closeable {
     public final BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>>
         websocketHandler;
 
+    /** Optional resolver for direct TCP tunnel of WebSocket connections. May be null. */
+    public final Function<String, Optional<URI>> tcpTunnelResolver;
+
     public Handlers(
         HttpHandler http,
         BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> websocketHandler) {
+      this(http, websocketHandler, null);
+    }
+
+    public Handlers(
+        HttpHandler http,
+        BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> websocketHandler,
+        Function<String, Optional<URI>> tcpTunnelResolver) {
       this.httpHandler = Require.nonNull("HTTP handler", http);
       this.websocketHandler =
           websocketHandler == null ? (str, sink) -> Optional.empty() : websocketHandler;
+      this.tcpTunnelResolver = tcpTunnelResolver;
     }
 
     @Override

java/src/org/openqa/selenium/grid/router/httpd/RouterServer.java

@@ -32,15 +32,19 @@
 import java.io.Closeable;
 import java.io.IOException;
 import java.io.UncheckedIOException;
+import java.net.URI;
 import java.net.URL;
 import java.time.Duration;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
+import java.util.function.Function;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import java.util.stream.Stream;
 import org.openqa.selenium.BuildInfo;
+import org.openqa.selenium.NoSuchSessionException;
 import org.openqa.selenium.UsernameAndPassword;
 import org.openqa.selenium.cli.CliCommand;
 import org.openqa.selenium.grid.TemplateGridServerCommand;
@@ -67,6 +71,8 @@
 import org.openqa.selenium.grid.sessionqueue.remote.RemoteNewSessionQueue;
 import org.openqa.selenium.grid.web.GridUiRoute;
 import org.openqa.selenium.internal.Require;
+import org.openqa.selenium.remote.HttpSessionId;
+import org.openqa.selenium.remote.SessionId;
 import org.openqa.selenium.remote.http.ClientConfig;
 import org.openqa.selenium.remote.http.Contents;
 import org.openqa.selenium.remote.http.HttpClient;
@@ -183,7 +189,25 @@ protected Handlers createHandlers(Config config) {
     // access to it.
     Routable routeWithLiveness = Route.combine(route, get("/readyz").to(() -> readinessCheck));
 
-    return new Handlers(routeWithLiveness, new ProxyWebsocketsIntoGrid(clientFactory, sessions)) {
+    // Resolve a request URI to the Node URI for direct TCP tunnelling of WebSocket connections.
+    // Falls back to ProxyWebsocketsIntoGrid (the websocketHandler) when the session is not found.
+    Function<String, Optional<URI>> tcpTunnelResolver =
+        uri ->
+            HttpSessionId.getSessionId(uri)
+                .map(SessionId::new)
+                .flatMap(
+                    id -> {
+                      try {
+                        return Optional.of(sessions.getUri(id));
+                      } catch (NoSuchSessionException e) {
+                        return Optional.empty();
+                      }
+                    });
+
+    return new Handlers(
+        routeWithLiveness,
+        new ProxyWebsocketsIntoGrid(clientFactory, sessions),
+        tcpTunnelResolver) {
       @Override
       public void close() {
         router.close();

java/src/org/openqa/selenium/netty/server/NettyServer.java

@@ -36,11 +36,13 @@
 import java.net.BindException;
 import java.net.InetSocketAddress;
 import java.net.MalformedURLException;
+import java.net.URI;
 import java.net.URL;
 import java.security.cert.CertificateException;
 import java.util.Optional;
 import java.util.function.BiFunction;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import javax.net.ssl.SSLException;
 import org.openqa.selenium.grid.server.BaseServerOptions;
 import org.openqa.selenium.grid.server.Server;
@@ -62,6 +64,7 @@ public class NettyServer implements Server<NettyServer> {
   private final BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> websocketHandler;
   private final SslContext sslCtx;
   private final boolean allowCors;
+  private final Function<String, Optional<URI>> tcpTunnelResolver;
 
   private Channel channel;
 
@@ -73,9 +76,28 @@ public NettyServer(
       BaseServerOptions options,
       HttpHandler handler,
       BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> websocketHandler) {
+    this(options, handler, websocketHandler, null);
+  }
+
+  /**
+   * Creates a {@link NettyServer} with an optional TCP-level tunnel resolver for WebSocket
+   * connections. When {@code tcpTunnelResolver} is non-null, WebSocket upgrade requests that
+   * contain a Selenium session ID are intercepted before the normal WebSocket handler: the Router
+   * opens a raw TCP connection to the resolved Node URI and bridges the two sockets directly,
+   * removing itself from the WebSocket data path entirely.
+   *
+   * @param tcpTunnelResolver maps a request URI to the target Node URI. Return {@link
+   *     Optional#empty()} to fall through to the normal WebSocket handler.
+   */
+  public NettyServer(
+      BaseServerOptions options,
+      HttpHandler handler,
+      BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> websocketHandler,
+      Function<String, Optional<URI>> tcpTunnelResolver) {
     Require.nonNull("Server options", options);
     Require.nonNull("Handler", handler);
     this.websocketHandler = Require.nonNull("Factory for websocket connections", websocketHandler);
+    this.tcpTunnelResolver = tcpTunnelResolver;
 
     InternalLoggerFactory.setDefaultFactory(JdkLoggerFactory.INSTANCE);
 
@@ -155,7 +177,9 @@ public NettyServer start() {
     b.group(bossGroup, workerGroup)
         .channel(NioServerSocketChannel.class)
         .handler(new LoggingHandler(LogLevel.DEBUG))
-        .childHandler(new SeleniumHttpInitializer(sslCtx, handler, websocketHandler, allowCors));
+        .childHandler(
+            new SeleniumHttpInitializer(
+                sslCtx, handler, websocketHandler, allowCors, tcpTunnelResolver));
 
     try {
       // Using a flag to avoid binding to the host, useful in environments like Docker,

java/src/org/openqa/selenium/netty/server/SeleniumHttpInitializer.java

@@ -25,9 +25,11 @@
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.stream.ChunkedWriteHandler;
 import io.netty.util.AttributeKey;
+import java.net.URI;
 import java.util.Optional;
 import java.util.function.BiFunction;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import org.openqa.selenium.internal.Require;
 import org.openqa.selenium.remote.http.HttpHandler;
 import org.openqa.selenium.remote.http.Message;
@@ -40,16 +42,27 @@ class SeleniumHttpInitializer extends ChannelInitializer<SocketChannel> {
   private final BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> webSocketHandler;
   private final SslContext sslCtx;
   private final boolean allowCors;
+  private final Function<String, Optional<URI>> tcpTunnelResolver;
 
   SeleniumHttpInitializer(
       SslContext sslCtx,
       HttpHandler seleniumHandler,
       BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> webSocketHandler,
       boolean allowCors) {
+    this(sslCtx, seleniumHandler, webSocketHandler, allowCors, null);
+  }
+
+  SeleniumHttpInitializer(
+      SslContext sslCtx,
+      HttpHandler seleniumHandler,
+      BiFunction<String, Consumer<Message>, Optional<Consumer<Message>>> webSocketHandler,
+      boolean allowCors,
+      Function<String, Optional<URI>> tcpTunnelResolver) {
     this.sslCtx = sslCtx;
     this.seleniumHandler = Require.nonNull("HTTP handler", seleniumHandler);
     this.webSocketHandler = Require.nonNull("WebSocket handler", webSocketHandler);
     this.allowCors = allowCors;
+    this.tcpTunnelResolver = tcpTunnelResolver;
   }
 
   @Override
@@ -63,6 +76,10 @@ protected void initChannel(SocketChannel ch) {
 
     // Websocket magic
     ch.pipeline().addLast("ws-compression", new WebSocketServerCompressionHandler());
+    // TCP tunnel intercepts WS upgrades before the normal WS handler when configured.
+    if (tcpTunnelResolver != null) {
+      ch.pipeline().addLast("tcp-tunnel", new TcpUpgradeTunnelHandler(tcpTunnelResolver));
+    }
     ch.pipeline().addLast("ws-protocol", new WebSocketUpgradeHandler(KEY, webSocketHandler));
     ch.pipeline().addLast("netty-to-se-messages", new MessageInboundConverter());
     ch.pipeline().addLast("se-to-netty-messages", new MessageOutboundConverter());

java/src/org/openqa/selenium/netty/server/TcpTunnelHandler.java

@@ -0,0 +1,72 @@
+// Licensed to the Software Freedom Conservancy (SFC) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The SFC licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.openqa.selenium.netty.server;
+
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ * Forwards every inbound {@link io.netty.buffer.ByteBuf} to a target {@link Channel}. Used on both
+ * ends of a transparent TCP tunnel once the WebSocket upgrade handshake has been proxied.
+ */
+class TcpTunnelHandler extends ChannelInboundHandlerAdapter {
+
+  private static final Logger LOG = Logger.getLogger(TcpTunnelHandler.class.getName());
+
+  private final Channel target;
+
+  TcpTunnelHandler(Channel target) {
+    this.target = target;
+  }
+
+  @Override
+  public void channelRead(ChannelHandlerContext ctx, Object msg) {
+    target
+        .writeAndFlush(msg)
+        .addListener(
+            future -> {
+              if (!future.isSuccess()) {
+                LOG.log(
+                    Level.WARNING,
+                    "TCP tunnel write failed on "
+                        + ctx.channel()
+                        + " -> "
+                        + target
+                        + ", closing both channels",
+                    future.cause());
+                ctx.close();
+                target.close();
+              }
+            });
+  }
+
+  @Override
+  public void channelInactive(ChannelHandlerContext ctx) {
+    target.close();
+  }
+
+  @Override
+  public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
+    LOG.log(Level.WARNING, "TCP tunnel error, closing both channels", cause);
+    ctx.close();
+    target.close();
+  }
+}