Add WebSocket support to SITL for PWA Configurator by sensei-hacker · Pull Request #42 · sensei-hacker/inav_unofficial_targets

sensei-hacker · 2025-12-02T02:01:57Z

User description

Summary

Adds native WebSocket server support to INAV SITL, enabling browser-based Progressive Web App (PWA) configurators to connect directly without requiring Electron or TCP proxy bridges.

Key Features

✅ RFC 6455 compliant WebSocket server implementation
✅ Self-contained (no external dependencies - includes SHA-1, Base64)
✅ Runs on ports 5771-5778 (base 5770 + UART ID)
✅ Coexists with existing TCP ports (5760-5761)
✅ Binary frame encoding/decoding with proper masking
✅ Thread-safe receive handling via pthread

Implementation Details

New Files:

src/main/drivers/serial_websocket.h - WebSocket API and structures
src/main/drivers/serial_websocket.c - Full WebSocket implementation (550+ lines)

Modified Files:

src/main/io/serial.c - uartOpen() returns WebSocket port for MSP
src/main/target/SITL/target.c - WebSocket initialization
cmake/sitl.cmake - Build integration

Testing

✅ Verified with Python websockets client
✅ Byte-level validation confirms proper frame encoding/decoding
✅ MSP protocol integrity preserved (tested with MSP_IDENT)
✅ Browser test client validates end-to-end communication

Test Results:

Client sent:     24 4d 3c 00 64 64  (MSP_IDENT request)
Server received: 24 4d 3c 00 64 64  ✅ Perfect match

Server sent:     24 4d 21 00 64 64  (MSP error response)
Client received: 24 4d 21 00 64 64  ✅ Perfect match

WebSocket Ports

UART1: ws://localhost:5771
UART2: ws://localhost:5772
UART3-8: ws://localhost:5773-5778

Use Case

This enables INAV Configurator PWA to connect directly to SITL without the TCP-to-WebSocket bridge workarounds, making browser-based testing and development seamless.

PR Type

Enhancement, New Feature

Description

Adds RFC 6455 compliant WebSocket server to SITL for PWA Configurator
Enables browser-based direct connection without TCP proxy bridges
Implements self-contained SHA-1 and Base64 for handshake authentication
Runs on ports 5771-5778 (base 5770 + UART ID) alongside TCP ports
Includes binary frame encoding/decoding with proper client masking support
Thread-safe receive handling via pthread mutex and dedicated receive thread

Diagram Walkthrough

flowchart LR
  A["Browser PWA<br/>Configurator"] -->|"WebSocket<br/>ws://localhost:577x"| B["SITL WebSocket<br/>Server"]
  B -->|"RFC 6455<br/>Handshake"| A
  B -->|"Binary Frames<br/>MSP Protocol"| C["INAV SITL<br/>Flight Controller"]
  C -->|"MSP Response"| B
  B -->|"Encoded Frame"| A
  D["TCP Client<br/>Legacy"] -->|"TCP 5760-5761"| E["TCP Server<br/>Still Available"]

File Walkthrough

Relevant files

Enhancement

serial_websocket.h `WebSocket header with port structure and API definitions` src/main/drivers/serial_websocket.h Defines WebSocket port structure (`wsPort_t`) with socket, thread, and buffer management Declares WebSocket frame opcodes (BINARY, TEXT, CLOSE, PING, PONG) Exports public API functions: `wsOpen()`, `wsReceiveBytesEx()`, `wsRXBytesFree()` Sets base port to 5770 with 2048-byte buffer and 65535-byte max packet size	+70/-0
serial_websocket.c `Complete WebSocket server implementation with frame handling` src/main/drivers/serial_websocket.c Implements complete RFC 6455 WebSocket server with embedded SHA-1 and Base64 encoding Provides frame encoding/decoding with client masking support and opcode handling Implements WebSocket handshake with Sec-WebSocket-Key validation Provides serial port interface functions (read, write, status) mirroring TCP implementation Includes thread-safe receive handling with pthread mutex and dedicated receive thread Handles control frames (PING/PONG, CLOSE) and binary payload transmission	+736/-0
serial.c `Route SITL UART to WebSocket instead of TCP` src/main/io/serial.c Adds include for `serial_websocket.h` header Changes `uartOpen()` to use `wsOpen()` instead of `tcpOpen()` for SITL builds Preserves TCP ports 5760-5761 as fallback for direct connections	+5/-1
target.c `Add WebSocket header include to SITL target` src/main/target/SITL/target.c Adds include for `serial_websocket.h` header to enable WebSocket initialization	+1/-0

Configuration changes

sitl.cmake `Include WebSocket sources in SITL build configuration` cmake/sitl.cmake Adds `drivers/serial_websocket.c` and `drivers/serial_websocket.h` to SITL build sources Comments out GCC 12+ linker flag `--no-warn-rwx-segments` due to compatibility issues	+6/-3

This commit adds native WebSocket server support to INAV SITL, enabling browser-based Progressive Web App (PWA) configurators to connect directly without requiring Electron or TCP proxy bridges. Key Features: - RFC 6455 compliant WebSocket server implementation - Self-contained (no external dependencies - includes SHA-1, Base64) - Runs on ports 5771-5778 (base 5770 + UART ID) - Coexists with existing TCP ports (5760-5761) - Binary frame encoding/decoding with proper masking - Thread-safe receive handling via pthread Implementation: - New files: * src/main/drivers/serial_websocket.h - API and structures * src/main/drivers/serial_websocket.c - Full WebSocket implementation - Modified files: * src/main/io/serial.c - uartOpen() returns WebSocket port for MSP * src/main/target/SITL/target.c - WebSocket initialization * cmake/sitl.cmake - Build integration Testing: - Verified with Python websockets client - Byte-level validation confirms proper frame encoding/decoding - MSP protocol integrity preserved (tested with MSP_IDENT) - Browser test client included: tools/websocket_test_client.html WebSocket Ports: - UART1: ws://localhost:5771 - UART2: ws://localhost:5772 - UART3-8: ws://localhost:5773-5778 This enables INAV Configurator PWA to connect directly to SITL without the TCP-to-WebSocket bridge workarounds discussed in issue iNavFlight#123. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

qodo-code-review · 2025-12-02T02:03:00Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🔴	Buffer overflow risk Description: WebSocket frame decoding trusts client-specified payload lengths up to 64-bit and copies into fixed-size buffers without explicit bounds checks against WS_MAX_PACKET_SIZE, risking buffer overflow or truncation misuse when masked payload_length exceeds local buffers. serial_websocket.c [286-355] Referred Code static ssize_t ws_decode_frame(wsPort_t port, const uint8_t data, size_t len, uint8_t payload, size_t payload_len) { if (len < 2) return 0; // Need at least 2 bytes const uint8_t p = data; size_t bytes_consumed = 0; // Byte 0: FIN and opcode bool fin = (p & 0x80) != 0; uint8_t opcode = p & 0x0F; p++; bytes_consumed++; // Byte 1: Mask and payload length bool masked = (p & 0x80) != 0; uint64_t payload_length = *p & 0x7F; p++; bytes_consumed++; // Extended payload length if (payload_length == 126) { if (len < bytes_consumed + 2) return 0; ... (clipped 49 lines)
🔴	Unsafe length handling Description: recv() reads arbitrary frame sizes into WS_BUFFER_SIZE and then ws_decode_frame() writes payload into a WS_MAX_PACKET_SIZE stack buffer without validating that payload_len fits the provided payload array size, enabling potential stack/heap corruption with large frames or extended lengths. serial_websocket.c [451-494] Referred Code // Receive WebSocket frame uint8_t buffer[WS_BUFFER_SIZE]; ssize_t recvSize = recv(port->clientSocketFd, buffer, WS_BUFFER_SIZE, 0); if (port->isClientConnected && (recvSize == 0 \|\| (recvSize == -1 && errno == ECONNRESET))) { char addrptr = prettyPrintAddress((struct sockaddr )&port->clientAddress, addrbuf, IPADDRESS_PRINT_BUFLEN); if (addrptr != NULL) { fprintf(stderr, "[WEBSOCKET] %s disconnected from UART%d\n", addrptr, port->id); } close(port->clientSocketFd); memset(&port->clientAddress, 0, sizeof(port->clientAddress)); port->isClientConnected = false; port->isHandshakeComplete = false; return 0; } if (recvSize < 0) { return 0; } // Decode WebSocket frame ... (clipped 23 lines)
⚪	Memory leak Description: The WebSocket handshake header parser allocates memory for header values with malloc in ws_find_header() but the returned pointers are not always freed (e.g., if subsequent validation fails), leading to per-connection memory leaks exploitable by repeated handshake attempts. serial_websocket.c [214-229] Referred Code { char line = strstr(request, header); if (!line) return NULL; line += strlen(header); while (line == ' ' \|\| line == ':') line++; char end = strstr(line, "\r\n"); if (!end) return NULL; size_t len = end - line; char *value = malloc(len + 1); memcpy(value, line, len); value[len] = '\0'; return value; }
	Unbounded send size Description: wsWriteBuf() sends data without checking 'count' against frame and payload limits and logs first bytes; combined with unbounded 'count' this may construct oversized frames and cause partial sends without error handling, enabling denial of service or undefined behavior. serial_websocket.c [618-639] Referred Code void wsWriteBuf(serialPort_t instance, const void data, int count) { wsPort_t port = (wsPort_t)instance; if (!port->isClientConnected \|\| !port->isHandshakeComplete) { return; } // Encode as WebSocket binary frame uint8_t frame[WS_MAX_PACKET_SIZE + 14]; // +14 for header size_t frame_len; ws_encode_frame((const uint8_t )data, count, WS_OPCODE_BINARY, frame, &frame_len); fprintf(stderr, "[WEBSOCKET] UART%d TX %d bytes: ", port->id, count); const uint8_t payload = (const uint8_t *)data; for (int i = 0; i < count && i < 32; i++) { fprintf(stderr, "%02x ", payload[i]); } fprintf(stderr, "\n"); send(port->clientSocketFd, frame, frame_len, 0); ... (clipped 1 lines)
	Resource exhaustion Description: Connection handling accepts a client before completing the WebSocket handshake and leaves the listening socket non-blocking but uses blocking select/recv without timeouts, allowing clients to hold connections and cause resource exhaustion (thread and socket) without idle timeouts. serial_websocket.c [407-465] Referred Code static int wsReceive(wsPort_t port) { char addrbuf[IPADDRESS_PRINT_BUFLEN]; if (!port->isClientConnected) { fd_set fds; FD_ZERO(&fds); FD_SET(port->socketFd, &fds); if (select(port->socketFd + 1, &fds, NULL, NULL, NULL) < 0) { fprintf(stderr, "[WEBSOCKET] Unable to wait for connection.\n"); return -1; } socklen_t addrLen = sizeof(struct sockaddr_storage); port->clientSocketFd = accept(port->socketFd, (struct sockaddr)&port->clientAddress, &addrLen); if (port->clientSocketFd < 1) { fprintf(stderr, "[WEBSOCKET] Can't accept connection.\n"); return -1; } ... (clipped 38 lines)
	Insecure default binding Description: The server binds and listens on all interfaces by default with SO_REUSEADDR and high backlog (100) without access controls, exposing SITL WebSocket services to the network and increasing attack surface on developer machines. serial_websocket.c [538-566] Referred Code err = setsockopt(port->socketFd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)); err = setsockopt(port->socketFd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)); err = fcntl(port->socketFd, F_SETFL, fcntl(port->socketFd, F_GETFL, 0) \| O_NONBLOCK); if (err < 0){ fprintf(stderr, "[WEBSOCKET] Unable to set socket options\n"); return NULL; } port->isClientConnected = false; port->isInitialized = true; port->isHandshakeComplete = false; port->id = id; if (bind(port->socketFd, (struct sockaddr*)&port->sockAddress, sockaddrlen) < 0) { fprintf(stderr, "[WEBSOCKET] Unable to bind socket\n"); return NULL; } if (listen(port->socketFd, 100) < 0) { fprintf(stderr, "[WEBSOCKET] Unable to listen.\n"); ... (clipped 8 lines)
	Protocol noncompliance Description: ws_decode_frame() responds to PING frames with an unmasked PONG but does not echo the received payload as required by RFC 6455, breaking protocol and potentially enabling application-layer desynchronization or misuse by intermediaries. serial_websocket.c [321-353] Referred Code uint8_t mask[4] = {0}; if (masked) { if (len < bytes_consumed + 4) return 0; memcpy(mask, p, 4); p += 4; bytes_consumed += 4; } // Check if we have full payload if (len < bytes_consumed + payload_length) { return 0; // Need more data } // Handle control frames if (opcode == WS_OPCODE_CLOSE) { return -1; // Connection close } if (opcode == WS_OPCODE_PING) { // Respond with PONG uint8_t pong_frame[2] = {0x8A, 0x00}; // FIN + PONG opcode, no payload ... (clipped 12 lines)
	Thread/socket leak Description: The receive thread is created without a way to stop or join it and sockets are not closed on teardown, which can leak threads and file descriptors over restarts, enabling denial of service in long-running SITL sessions. serial_websocket.c [571-601] Referred Code serialPort_t wsOpen(USART_TypeDef USARTx, serialReceiveCallbackPtr callback, void rxCallbackData, uint32_t baudRate, portMode_t mode, portOptions_t options) { wsPort_t port = NULL; #if defined(USE_UART1) \|\| defined(USE_UART2) \|\| defined(USE_UART3) \|\| defined(USE_UART4) \|\| defined(USE_UART5) \|\| defined(USE_UART6) \|\| defined(USE_UART7) \|\| defined(USE_UART8) uint32_t id = (uintptr_t)USARTx; if (id <= SERIAL_PORT_COUNT) { port = wsReConfigure(&wsPorts[id-1], id); } #endif if (port == NULL) { return NULL; } port->serialPort.vTable = wsVTable; port->serialPort.rxCallback = callback; port->serialPort.rxCallbackData = rxCallbackData; port->serialPort.rxBufferHead = port->serialPort.rxBufferTail = 0; port->serialPort.rxBufferSize = WS_BUFFER_SIZE; port->serialPort.rxBuffer = port->rxBuffer; ... (clipped 10 lines)
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Missing audit logs: The new WebSocket server performs connection, handshake, and frame processing without emitting structured audit logs capturing user/client identity, timestamps, action descriptions, and outcomes. Referred Code } static int wsReceive(wsPort_t port) { char addrbuf[IPADDRESS_PRINT_BUFLEN]; if (!port->isClientConnected) { fd_set fds; FD_ZERO(&fds); FD_SET(port->socketFd, &fds); if (select(port->socketFd + 1, &fds, NULL, NULL, NULL) < 0) { fprintf(stderr, "[WEBSOCKET] Unable to wait for connection.\n"); return -1; } socklen_t addrLen = sizeof(struct sockaddr_storage); port->clientSocketFd = accept(port->socketFd, (struct sockaddr)&port->clientAddress, &addrLen); if (port->clientSocketFd < 1) { fprintf(stderr, "[WEBSOCKET] Can't accept connection.\n"); return -1; ... (clipped 67 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Weak error handling: Handshake and frame parsing paths return or close on errors without detailed contextual error reporting, input size bounds checking, or handling of fragmented frames and oversized payloads. Referred Code static bool ws_handshake(wsPort_t port) { char buffer[2048]; ssize_t n = recv(port->clientSocketFd, buffer, sizeof(buffer) - 1, 0); if (n <= 0) { return false; } buffer[n] = '\0'; // Verify it's a GET request for WebSocket if (strncmp(buffer, "GET ", 4) != 0) { fprintf(stderr, "[WEBSOCKET] Not a GET request\n"); return false; } // Extract Sec-WebSocket-Key char key = ws_find_header(buffer, "Sec-WebSocket-Key"); if (!key) { fprintf(stderr, "[WEBSOCKET] Missing Sec-WebSocket-Key\n"); return false; } ... (clipped 104 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Verbose stderr logs: The code prints detailed internal status and network info (e.g., socket errors and client addresses) to stderr which may be user-visible in some environments and lacks separation between user-facing and internal logs. Referred Code if (strncmp(buffer, "GET ", 4) != 0) { fprintf(stderr, "[WEBSOCKET] Not a GET request\n"); return false; } // Extract Sec-WebSocket-Key char key = ws_find_header(buffer, "Sec-WebSocket-Key"); if (!key) { fprintf(stderr, "[WEBSOCKET] Missing Sec-WebSocket-Key\n"); return false; } // Compute accept key: SHA1(key + GUID) then base64 char concat[256]; snprintf(concat, sizeof(concat), "%s%s", key, WS_GUID); free(key); SHA1_CTX sha; uint8_t hash[20]; sha1_init(&sha); sha1_update(&sha, (uint8_t )concat, strlen(concat)); ... (clipped 207 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Unstructured logging: Logging uses ad-hoc fprintf(stderr, ...) with raw byte dumps and client addresses rather than structured logs and lacks safeguards to avoid sensitive data exposure in payload dumps. Referred Code if (consumed > 0 && payload_len > 0) { fprintf(stderr, "[WEBSOCKET] UART%d RX %zu bytes: ", port->id, payload_len); for (size_t i = 0; i < payload_len && i < 32; i++) { fprintf(stderr, "%02x ", payload[i]); } fprintf(stderr, "\n"); wsReceiveBytes(port, payload, payload_len); } return (int)payload_len; } static void wsReceiveThread(void arg) { wsPort_t port = (wsPort_t)arg; while(wsReceive(port) >= 0) ; return NULL; } static wsPort_t wsReConfigure(wsPort_t port, uint32_t id) ... (clipped 135 lines) Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Input validation gaps: The WebSocket handshake and frame decoder accept client inputs without enforcing strict limits (e.g., very large payload lengths, fragmentation handling, header parsing robustness) or authentication/authorization controls. Referred Code static char* ws_find_header(const char request, const char header) { char line = strstr(request, header); if (!line) return NULL; line += strlen(header); while (line == ' ' \|\| line == ':') line++; char end = strstr(line, "\r\n"); if (!end) return NULL; size_t len = end - line; char value = malloc(len + 1); memcpy(value, line, len); value[len] = '\0'; return value; } static bool ws_handshake(wsPort_t port) { char buffer[2048]; ... (clipped 122 lines) Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

qodo-code-review · 2025-12-02T02:04:15Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Prevent buffer overflow from large payloads Add a size check for the incoming WebSocket payload in `ws_decode_frame` to prevent a buffer overflow vulnerability. src/main/drivers/serial_websocket.c [287-318] static ssize_t ws_decode_frame(wsPort_t port, const uint8_t data, size_t len, uint8_t payload, size_t payload_len) { if (len < 2) return 0; // Need at least 2 bytes const uint8_t p = data; size_t bytes_consumed = 0; // Byte 0: FIN and opcode bool fin = (p & 0x80) != 0; uint8_t opcode = p & 0x0F; p++; bytes_consumed++; // Byte 1: Mask and payload length bool masked = (p & 0x80) != 0; uint64_t payload_length = *p & 0x7F; p++; bytes_consumed++; // Extended payload length if (payload_length == 126) { if (len < bytes_consumed + 2) return 0; payload_length = ((uint64_t)p[0] << 8) \| p[1]; p += 2; bytes_consumed += 2; } else if (payload_length == 127) { if (len < bytes_consumed + 8) return 0; payload_length = 0; for (int i = 0; i < 8; i++) { payload_length = (payload_length << 8) \| p[i]; } p += 8; bytes_consumed += 8; } + + if (payload_length > WS_MAX_PACKET_SIZE) { + fprintf(stderr, "[WEBSOCKET] Payload too large: %llu > %d\n", (unsigned long long)payload_length, WS_MAX_PACKET_SIZE); + return -1; // Error, close connection + } ... `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 10 __ Why: This suggestion correctly identifies a critical buffer overflow vulnerability in the WebSocket frame decoding logic, which could be exploited by a malicious client to crash the application or execute arbitrary code.	High
Possible issue	Prevent buffer overflow during frame encoding In `wsWriteBuf`, add a check to ensure the payload size does not exceed `WS_MAX_PACKET_SIZE` before calling `ws_encode_frame` to prevent a buffer overflow. src/main/drivers/serial_websocket.c [618-639] -static void ws_encode_frame(const uint8_t payload, size_t len, uint8_t opcode, uint8_t out, size_t out_len) +void wsWriteBuf(serialPort_t instance, const void data, int count) { - uint8_t p = out; + wsPort_t port = (wsPort_t)instance; - // Byte 0: FIN=1, opcode - p++ = 0x80 \| (opcode & 0x0F); - - // Byte 1+: Payload length (no mask for server->client) - if (len < 126) { - p++ = len & 0x7F; - } else if (len < 65536) { - p++ = 126; - p++ = (len >> 8) & 0xFF; - p++ = len & 0xFF; - } else { - p++ = 127; - for (int i = 7; i >= 0; i--) { - p++ = (len >> (i 8)) & 0xFF; - } + if (!port->isClientConnected \|\| !port->isHandshakeComplete) { + return; } - // Payload (no masking for server) - memcpy(p, payload, len); - p += len; + if (count > WS_MAX_PACKET_SIZE) { + fprintf(stderr, "[WEBSOCKET] UART%d TX Error: payload of %d bytes is larger than WS_MAX_PACKET_SIZE of %d\n", port->id, count, WS_MAX_PACKET_SIZE); + return; + } - out_len = p - out; + // Encode as WebSocket binary frame + uint8_t frame[WS_MAX_PACKET_SIZE + 14]; // +14 for header + size_t frame_len; + ws_encode_frame((const uint8_t )data, count, WS_OPCODE_BINARY, frame, &frame_len); + + fprintf(stderr, "[WEBSOCKET] UART%d TX %d bytes: ", port->id, count); + const uint8_t payload = (const uint8_t )data; + for (int i = 0; i < count && i < 32; i++) { + fprintf(stderr, "%02x ", payload[i]); + } + fprintf(stderr, "\n"); + + send(port->clientSocketFd, frame, frame_len, 0); } `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a potential buffer overflow in `wsWriteBuf` when handling large payloads, although the `existing_code` snippet points to the wrong function. The fix is valid and prevents a crash.	Medium
High-level	Avoid reimplementing standard cryptographic algorithms Instead of using custom-written SHA-1 and Base64 implementations, consider replacing them with a well-vetted, standard library to improve robustness and reduce maintenance overhead. Examples: src/main/drivers/serial_websocket.c [59-178] typedef struct { uint32_t state[5]; uint32_t count[2]; uint8_t buffer[64]; } SHA1_CTX; #define SHA1_ROL(value, bits) (((value) << (bits)) \| ((value) >> (32 - (bits)))) static void sha1_transform(uint32_t state[5], const uint8_t buffer[64]) { ... (clipped 110 lines) src/main/drivers/serial_websocket.c [186-207] static void base64_encode(const uint8_t data, size_t input_length, char output) { size_t i, j; for (i = 0, j = 0; i < input_length;) { uint32_t octet_a = i < input_length ? data[i++] : 0; uint32_t octet_b = i < input_length ? data[i++] : 0; uint32_t octet_c = i < input_length ? data[i++] : 0; uint32_t triple = (octet_a << 16) + (octet_b << 8) + octet_c; output[j++] = base64_chars[(triple >> 18) & 0x3F]; ... (clipped 12 lines) Solution Walkthrough: Before: // file: src/main/drivers/serial_websocket.c // Custom SHA-1 implementation static void sha1_transform(...) { ... } static void sha1_init(...) { ... } // ... etc // Custom Base64 implementation static void base64_encode(...) { ... } static bool ws_handshake(wsPort_t port) { // ... SHA1_CTX sha; uint8_t hash[20]; sha1_init(&sha); sha1_update(&sha, ...); sha1_final(&sha, hash); char accept_key[29]; base64_encode(hash, 20, accept_key); // ... } After: // file: src/main/drivers/serial_websocket.c #include <some_crypto_library.h> // e.g., mbedtls, tiny-sha1 // Custom SHA-1 and Base64 implementations are removed. static bool ws_handshake(wsPort_t port) { // ... uint8_t hash[20]; // Use library function for SHA-1 crypto_lib_sha1(..., hash); char accept_key[29]; size_t out_len; // Use library function for Base64 crypto_lib_base64_encode(hash, 20, accept_key, sizeof(accept_key), &out_len); // ... } Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies the risk of reimplementing standard algorithms like `SHA-1` and `Base64`, proposing a more robust and maintainable approach by using a vetted library, which is a significant design improvement.	Medium
General	Avoid blocking indefinitely in select call Add a timeout to the `select` call in `wsReceive` to prevent the `wsReceiveThread` from blocking indefinitely, allowing for a clean shutdown. src/main/drivers/serial_websocket.c [408-420] static int wsReceive(wsPort_t *port) { char addrbuf[IPADDRESS_PRINT_BUFLEN]; if (!port->isClientConnected) { fd_set fds; FD_ZERO(&fds); FD_SET(port->socketFd, &fds); - if (select(port->socketFd + 1, &fds, NULL, NULL, NULL) < 0) { + struct timeval tv = { .tv_sec = 1, .tv_usec = 0 }; // 1 second timeout + int ret = select(port->socketFd + 1, &fds, NULL, NULL, &tv); + + if (ret < 0) { fprintf(stderr, "[WEBSOCKET] Unable to wait for connection.\n"); return -1; } + if (ret == 0) { + // Timeout, loop again to allow thread to exit if needed + return 0; + } ... `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that the blocking `select` call will prevent clean thread termination and proposes a valid solution with a timeout, improving the application's shutdown behavior.	Low
More

qodo-code-review bot added the Review effort 4/5 label Dec 2, 2025

sensei-hacker mentioned this pull request Dec 2, 2025

Configurator as Web APP (PWA) iNavFlight/inav-configurator#2448

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add WebSocket support to SITL for PWA Configurator#42

Add WebSocket support to SITL for PWA Configurator#42
sensei-hacker wants to merge 1 commit intomaintenance-9.xfrom
websocket-sitl-support

sensei-hacker commented Dec 2, 2025 •

edited

Loading

Uh oh!

qodo-code-review bot commented Dec 2, 2025

Uh oh!

qodo-code-review bot commented Dec 2, 2025

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sensei-hacker commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Summary

Key Features

Implementation Details

Testing

WebSocket Ports

Use Case

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

qodo-code-review bot commented Dec 2, 2025

PR Compliance Guide 🔍

Uh oh!

qodo-code-review bot commented Dec 2, 2025

PR Code Suggestions ✨

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

sensei-hacker commented Dec 2, 2025 •

edited

Loading