← Extractions

Smuggling, hijacking and proxying remote console sockets with Rack and Ruby

David Halasz's wroclove.rb 2019 talk on how ManageIQ implements in-browser VNC remote consoles in Ruby, covering blocking vs non-blocking socket I/O, epoll, Rack socket hijacking for WebSocket upgrades, and a proof-of-concept 'PURR' protocol that downgrades an HTTP upgrade to raw TCP to tunnel VNC/SSH to a native desktop client.

Model

claude-opus-4-7

Ingestion

78c3c03e

Input tokens

126,516

fresh: 67,966
cached: 50,929
cache write: 7,621

Output tokens

10,030

Duration

141.0s

Roundtrips

Tool calls

Cost

$0.00

Nodes/edges extracted

29 / 44

Read set (nodes/edges)

77 / 3

Nodes (29)

update David Halasz person

attrs (empty) → {"location" => "Brno, Czech Republic", "nationality" => "Hungarian", "twitter_handle" => "(mentioned on slide)"}

description Conference speaker. → Hungarian-born Ruby developer living in Brno, Czech Republic. Works at Red Hat on the ManageIQ project, mostly on in-...

short_description Conference speaker. → Red Hat engineer working on ManageIQ in-browser remote consoles.

update How to hijack talk

attrs {"type" => "talk"} → {"type" => "talk", "full_title" => "Smuggling, hijacking and proxying in-browser remote console sockets with Rack and...

description Talk at wroclove.rb 2019. → wroclove.rb 2019 talk by David Halasz titled 'Smuggling, hijacking and proxying in-browser remote console sockets wit...

short_description Talk at wroclove.rb 2019. → Talk on smuggling, hijacking and proxying remote-console sockets in Ruby/Rack.

create Red Hat company

kind (empty) → company

name (empty) → Red Hat

slug (empty) → red-hat

attrs (empty) → {"industry" => "open-source software"}

description (empty) → Open-source software company where David Halasz works on ManageIQ. New hires go to an orientation where they can pick...

short_description (empty) → Open-source software company; employer of the speaker.

create ManageIQ project

kind (empty) → project

name (empty) → ManageIQ

slug (empty) → manageiq

attrs (empty) → {"mascot" => "George", "status" => "active", "license" => "open-source", "language" => "Ruby/Rails"}

description (empty) → Open-source hybrid cloud infrastructure management platform maintained by Red Hat. Written in Ruby on Rails with over...

short_description (empty) → Open-source hybrid cloud and virtualization management platform.

create VNC concept

kind (empty) → concept

name (empty) → VNC

slug (empty) → vnc

attrs (empty) → {"category" => "protocol"}

description (empty) → Remote Desktop protocol used by ManageIQ to expose VM consoles. Hypervisors such as VMware and VirtualBox expose a VN...

short_description (empty) → Remote desktop protocol providing access to a graphical session.

update WebSockets concept

description Protocol underlying real-time web apps such as chat. Action Cable speaks WebSockets only, which excludes a small perc... → HTTP-upgraded bi-directional protocol (HTTP/1.1, not HTTP/2). Established via an HTTP GET with an Upgrade header to w...

create Blocking I/O concept

kind (empty) → concept

name (empty) → Blocking I/O

slug (empty) → blocking-i-o

attrs (empty) → {"category" => "pattern"}

description (empty) → Traditional socket I/O model: read/write operations block the calling thread until the OS buffer has space (write) or...

short_description (empty) → I/O model where reads/writes wait for the OS buffer to be ready.

create Non-blocking I/O concept

kind (empty) → concept

name (empty) → Non-blocking I/O

slug (empty) → non-blocking-i-o

attrs (empty) → {"category" => "pattern"}

description (empty) → I/O model where read_nonblock/write_nonblock return immediately; when not ready they raise IO::WaitReadable/WaitWrita...

short_description (empty) → Socket I/O that returns immediately with EAGAIN/EWOULDBLOCK instead of blocking.

create Bouncing Select concept

kind (empty) → concept

name (empty) → Bouncing Select

slug (empty) → bouncing-select

attrs (empty) → {"category" => "pattern"}

description (empty) → Technique David Halasz devised for writing a non-blocking bidirectional socket proxy on top of IO.select. Sockets rea...

short_description (empty) → Dynamic-array IO.select pattern to avoid spin-lock in bidirectional proxies.

create IO.select concept

kind (empty) → concept

name (empty) → IO.select

slug (empty) → io-select

attrs (empty) → {"category" => "practice"}

description (empty) → Ruby method that calls the POSIX select syscall to wait for sockets to become ready for reading or writing. Not ideal...

short_description (empty) → Ruby wrapper over the POSIX select system call.

create epoll concept

kind (empty) → concept

name (empty) → epoll

slug (empty) → epoll

attrs (empty) → {"category" => "architecture", "platform" => "Linux"}

description (empty) → Linux kernel facility that splits select into two calls — one to register sockets and one to wait — avoiding the per-...

short_description (empty) → Linux scalable I/O event notification mechanism.

create kqueue concept

kind (empty) → concept

name (empty) → kqueue

slug (empty) → kqueue

attrs (empty) → {"category" => "architecture", "platform" => "BSD/macOS"}

description (empty) → BSD/macOS equivalent of Linux epoll. David Halasz's proxy library falls back to IO.select bouncing on macOS and invit...

short_description (empty) → BSD/macOS scalable event notification mechanism analogous to epoll.

create Socket Hijacking concept

kind (empty) → concept

name (empty) → Socket Hijacking

slug (empty) → socket-hijacking

attrs (empty) → {"category" => "pattern"}

description (empty) → Rack feature that lets an application grab the raw TCP socket behind an HTTP request and escape the normal request/re...

short_description (empty) → Rack mechanism to take over the raw socket behind a request.

create PURR project

kind (empty) → project

name (empty) → PURR

slug (empty) → purr

attrs (empty) → {"status" => "active", "license" => "open-source"}

description (empty) → Experimental protocol by David Halasz standing for 'Protocol Upgrade Raw Request'. Mirrors the WebSocket handshake — ...

short_description (empty) → Protocol Upgrade Raw Request — tunnel TCP through an HTTP upgrade.

create Puma tool

kind (empty) → tool

name (empty) → Puma

slug (empty) → puma

attrs (empty) → {"category" => "service"}

description (empty) → Concurrent Rack web server used by David Halasz to run the PURR demo server.

short_description (empty) → Concurrent Rack-compatible Ruby web server.

create EventMachine tool

kind (empty) → tool

name (empty) → EventMachine

slug (empty) → eventmachine

attrs (empty) → {"category" => "library"}

description (empty) → Classic Ruby event-driven networking library. David Halasz considered it for the remote-console proxy but discarded i...

short_description (empty) → Reactor-pattern event-driven I/O library for Ruby.

create Celluloid tool

kind (empty) → tool

name (empty) → Celluloid

slug (empty) → celluloid

attrs (empty) → {"category" => "library"}

description (empty) → Actor/concurrency library for Ruby. David Halasz considered it but discarded it alongside EventMachine because of inc...

short_description (empty) → Actor-based concurrency library for Ruby.

create async tool

kind (empty) → tool

name (empty) → async

slug (empty) → async

attrs (empty) → {"category" => "library"}

description (empty) → Newer Ruby concurrency framework based on fibers. Not available when David Halasz started the project; he notes he wo...

short_description (empty) → Fiber-based asynchronous I/O framework for Ruby.

create Auto-yielding Fibers concept

kind (empty) → concept

name (empty) → Auto-yielding Fibers

slug (empty) → auto-yielding-fibers

attrs (empty) → {"category" => "architecture"}

description (empty) → Fibers that transparently yield on sleep/wait/IO.select calls, turning blocking I/O into non-blocking I/O automatical...

short_description (empty) → Fibers that yield automatically on blocking I/O, like Go/Crystal.

create Crystal tool

kind (empty) → tool

name (empty) → Crystal

slug (empty) → crystal

attrs (empty) → {"category" => "language"}

description (empty) → Language with Ruby-like syntax whose fiber-based concurrency model (with automatic yielding on I/O) is analogous to w...

short_description (empty) → Compiled language with Ruby-like syntax and built-in concurrency.

update Rack tool

description Low-level web-server interface that is the basis of all Ruby web frameworks. Shrine is built on Rack rather than Rail... → Low-level web-server interface that is the basis of all Ruby web frameworks. A Rack server is anything that responds ...

create Splice sockets in the kernel takeaway

kind (empty) → takeaway

name (empty) → Splice sockets in the kernel

slug (empty) → splice-sockets-in-the-kernel

attrs (empty) → {"type" => "recommendation"}

description (empty) → Audience recommendation at the end of the Q&A: for a pure TCP-tunneling proxy like PURR, the bytes never need to reac...

short_description (empty) → Use kernel splice to move bytes between two sockets without copying to userspace.

create Use bouncing IO.select to avoid spin-lock in bidirectional proxies takeaway

kind (empty) → takeaway

name (empty) → Use bouncing IO.select to avoid spin-lock in bidirectional proxies

slug (empty) → use-bouncing-io-select-to-avoid-spin-lock-in-bidirectional-proxies

attrs (empty) → {"type" => "lesson-learned"}

description (empty) → When proxying in both directions with IO.select, a naive loop spin-locks at 100% CPU when only one side is ready. The...

short_description (empty) → Remove ready sockets from IO.select arrays until a transmission actually happens.

create EPOLLONESHOT removes ready sockets automatically takeaway

kind (empty) → takeaway

name (empty) → EPOLLONESHOT removes ready sockets automatically

slug (empty) → epolloneshot-removes-ready-sockets-automatically

attrs (empty) → {"type" => "insight"}

description (empty) → Using the Linux EPOLLONESHOT flag lets the kernel remove a socket from the epoll interest set once it becomes ready, ...

short_description (empty) → EPOLLONESHOT gives bouncing-select behavior for free on Linux.

create Use Rack socket hijacking for long-running connections takeaway

kind (empty) → takeaway

name (empty) → Use Rack socket hijacking for long-running connections

slug (empty) → use-rack-socket-hijacking-for-long-running-connections

attrs (empty) → {"type" => "recommendation"}

description (empty) → Rack's request/response model does not fit WebSockets or similar persistent connections. The Rack hijacking API lets ...

short_description (empty) → Detach the raw socket from Rack to run a proxy thread outside the request cycle.

create Why implement the proxy in Ruby? question

kind (empty) → question

name (empty) → Why implement the proxy in Ruby?

slug (empty) → why-implement-the-proxy-in-ruby

attrs (empty) → {"answer_summary" => "ManageIQ only runs Ruby, so a Ruby solution was the pragmatic choice."}

description (empty) → Audience question at the end: there are better stacks for a proxy — why Ruby? Answer: ManageIQ is a Ruby/Rails enviro...

short_description (empty) → Audience asks why build a network proxy in Ruby rather than a faster language.

create Why not just install a client binary? question

kind (empty) → question

name (empty) → Why not just install a client binary?

slug (empty) → why-not-just-install-a-client-binary

attrs (empty) → {"answer_summary" => "Going through the management app enables RBAC, OTPs, quotas and temporary-access scopes."}

description (empty) → Audience question: for the native-console flow, why not skip the HTTP tunnel and just let the client install a binary...

short_description (empty) → Why go through HTTP at all instead of a direct native VNC client?

create VNC↔WebSocket frame translation question

kind (empty) → question

name (empty) → VNC↔WebSocket frame translation

slug (empty) → vnc-websocket-frame-translation

attrs (empty) → {"answer_summary" => "Browser remote console translates frames (not very efficient in Ruby); PURR smuggling just rout...

description (empty) → Audience question on the browser-side remote console: is there post-processing between VNC frames and WebSocket frame...

short_description (empty) → How is VNC translated to WebSocket frames, and is it efficient in Ruby?

create Do all Red Hat developers get a Red Hat? question

kind (empty) → question

name (empty) → Do all Red Hat developers get a Red Hat?

slug (empty) → do-all-red-hat-developers-get-a-red-hat

attrs (empty) → {"answer_summary" => "Yes, new-hire orientation lets employees pick a hat."}

description (empty) → Casual audience question: do all Red Hat developers get a hat? Answer: yes — new hires go to an orientation where the...

short_description (empty) → Whether Red Hat gives every new hire a red hat.

Edges (44)

update David Halasz → authored → How to hijack

context (empty) → Presenter of the talk

update How to hijack → presented_at → wroclove.rb 2019

context (empty) → Given at wroclove.rb 2019

create David Halasz → works_at → Red Hat

attrs (empty) → {"role" => "engineer"}

context (empty) → Speaker states he works for Red Hat

relation (empty) → works_at

source_node_id (empty) → 8596ec85-2603-4772-9dce-8b1a5ce40c17

target_node_id (empty) → b8adbc24-a0a8-4b53-8afd-df15f24f5b81

create David Halasz → works_on → ManageIQ

attrs (empty) → {"role" => "developer, remote consoles"}

context (empty) → Works on in-browser remote consoles in ManageIQ

relation (empty) → works_on

source_node_id (empty) → 8596ec85-2603-4772-9dce-8b1a5ce40c17

target_node_id (empty) → 9d8b9550-aa1d-4e81-9f40-adc17768f140

create ManageIQ → uses → Ruby on Rails

context (empty) → ManageIQ is a Ruby/Rails application with over a million LOC

relation (empty) → uses

source_node_id (empty) → 9d8b9550-aa1d-4e81-9f40-adc17768f140

target_node_id (empty) → 7aac705a-0987-49f2-b665-9d4e08a6acee

create How to hijack → about → ManageIQ

context (empty) → Talk centers on ManageIQ's remote-console architecture

relation (empty) → about