← Graph

How to hijack

talk 26 connections

wroclove.rb 2019 talk by David Halasz titled 'Smuggling, hijacking and proxying in-browser remote console sockets with Rack and Ruby'. Walks through how ManageIQ implements in-browser VNC remote consoles: the architecture (VM → hypervisor VNC endpoint → Ruby proxy → browser WebSocket), the computer-science foundations (sockets as files, buffered blocking read/write, non-blocking I/O via IO.select, why naive threaded and spin-locking proxies fail), and the author's 'bouncing select' technique with dynamic socket arrays. Covers alternatives considered (EventMachine, Celluloid, async, auto-yielding fibers promised for Ruby 3), moves to epoll with EPOLLONESHOT (hand-written C extension because no existing Ruby wrapper supported it), and falls back to kqueue/IO.select on macOS. Second half introduces WebSockets as HTTP upgraded for bi-directional traffic, then Rack socket hijacking to escape the request/response loop and run a persistent proxy thread. Finally presents 'PURR' (Protocol Upgrade Raw Request): instead of upgrading to WebSocket, downgrade to TCP to tunnel VNC/SSH from a hypervisor to a native desktop client, passing through a browser plug-in that invokes a binary (the W3C draft for browser-initiated TCP connections would remove this workaround). Demo shows connecting a native VNC viewer and an SSH client through a ManageIQ-style Puma server to containers running in VirtualBox. Q&A covers role-based access control and temporary VM access as a motivation, Red Hat new-hire hats, VNC↔WebSocket frame translation, and an audience recommendation to use kernel splice to move bytes between sockets without copying to userspace.

type
talk
full_title
Smuggling, hijacking and proxying in-browser remote console sockets with Rack and Ruby
talk How to hijack
about
ManageIQ project
Talk centers on ManageIQ's remote-console architecture
talk How to hijack
about
VNC concept
Explains VNC-in-browser remote consoles and VNC smuggling over HTTP
talk How to hijack
about
WebSockets concept
WebSocket upgrade is the browser-side transport for the remote console
talk How to hijack
about
Rack tool
Relies on Rack's call interface and hijacking API
talk How to hijack
about
Rack socket hijacking is central to the proxy design
talk How to hijack
about
Blocking I/O concept
Discusses buffered blocking read/write on sockets
talk How to hijack
about
Contrasts non-blocking IO with threaded blocking IO
talk How to hijack
about
IO.select concept
Base building block for the proxy event loop
talk How to hijack
about
Bouncing Select concept
Speaker's own technique for avoiding spin-lock in bidirectional proxies
talk How to hijack
about
epoll concept
Ports the bouncing technique to epoll with EPOLLONESHOT
talk How to hijack
about
kqueue concept
Mentioned as the BSD/macOS alternative backend
talk How to hijack
about
PURR project
Second half of the talk introduces the PURR protocol
talk How to hijack
about
Considered and rejected because of async PostgreSQL
talk How to hijack
about
Celluloid tool
Considered and rejected because of async PostgreSQL
talk How to hijack
about
async tool
Would have been the author's preferred choice if it had existed
talk How to hijack
about
Promised feature for Ruby 3 that would simplify the proxy
asked_at
How to hijack talk
Q&A question
asked_at
How to hijack talk
Q&A question
asked_at
How to hijack talk
Q&A question on efficiency of frame translation
asked_at
How to hijack talk
Casual Q&A question
person David Halasz
authored
How to hijack talk
Presenter of the talk
from_talk
How to hijack talk
Audience suggestion during the Q&A
Key lesson of the talk
from_talk
How to hijack talk
Insight from the epoll section of the talk
from_talk
How to hijack talk
Takeaway from the Rack hijacking section
talk How to hijack
presented_at
Given at wroclove.rb 2019

Provenance

Created
2026-04-17 16:17 seed
Read by
17 extractions