websocket support

[slingamn]

I think it's time we thought about getting native websocket support again, as opposed to telling people to set up webircgateway.

We may not be able to get to feature parity with webircgateway (in particular, I'm not interested in adding sockjs support), but we should be able to support modern browsers at least.

What's the current state of the specs here?

[slingamn]

@hhirtz any interest in working on this? :-)

[slingamn]

How I'm imagining this working:

1. https://github.com/gorilla/websocket seems like the best library to use
2. websocket: true should be another field of the listener config, fully orthogonal to tls, tor, etc.
3. Socket should abstract away from whether the transport is TCP/TLS or Websocket and dispatch the appropriate write call. If it is wrapping a websocket rather than a TCP/TLS socket, it will need to validate that the message is valid UTF-8; this validation should take place outside of any of the socket's mutexes.

[hhirtz]

I can work on this :)

[slingamn]

Not sure how helpful this will be, but eae04e8 was the last revision that supported websockets (and it was using gorilla/websocket). It may or may not be useful as an example of the gorilla API (assuming it hasn't changed much since).

[slingamn]

The implementation should also handle the X-Forwarded-For header. This can use the same semantics as the PROXY command: if the connection is coming from an IP whitelisted in proxy-allowed-from, then take the "rightmost" X-Forwarded-For header value and pass it to client.ApplyProxiedIP() (ignore errBadProxyLine in this case).

[slingamn]

Actually, this pseudocode should be correct for handling multiple values:

if not is_trusted(remote_ip):
    return remote_ip

forwarded_header = headers.Get("x-forwarded-for")
if not forwarded_header:
    return remote_ip

# consider the headers in reverse order;
# the first one examined that is not itself a trusted proxy is the original IP
for ip in reversed(forwarded_header.split(",")):
    if not is_trusted(ip.strip()):
        return ip

# all the headers were from trusted IPs, return the oldest one
return forwarded_headers[0]

[slingamn]

Note to self: verify that in the final version of this, the pprof listener is not visible from the websocket handler.