Series 4 S# Secure WebSocket Server #cp4 #simplsharp #websocket


Cameron Bowman
 

Question up front: Am I taking the right approach? If so, what am I missing?

I'm working a project for a customer who wants a SIMPL# application that, among other things, reads and writes flat files from/to the NVRAM and also provides a UI based on those files.
The target equipment is any physical Series 4 processor. I'm testing on a CP4N, and occasionally on a VC4 when needed.

I've tried a few approaches, and while i'm not married to the approach I'm trying now, it's the closest I've gotten. My guardrails are that the loaded program must be in SIMPL#, and the UI must be accessible from a browser on the local network. I had little luck with the CH5 libraries, but I'm not opposed to stripping out the javascript calls to send/recieve signals, if that really is the best approach. Even then, I would still need a websocket server running on the controller, and I don't see any gain in repurposing those calls.

The approach I've taken on the UI side is to host a Blazor Web Assembly application as the front end running out the the HTML directory of the controller. That's all running quite smoothly and with little fuss.
I'm attempting to communicate with a SIMPL# program running on a program slot via a WebSocket Client/Server connection. The purpose of that connection is to send file data back and forth while the program handles reading/writing files and changes.

I've relied heavily on Kiel Lofstrand's blog for the majority of this
Some things I've found out:
  • sta's WebSocketSharp doesn't appear to open the securewebsocket port when the server starts. (nmap shows the port is closed)
  • CCI's WebSocketSrvr does open that port. Regardless, I don't seem to be able to establish a connection. (nmap shows the port is open, packet captures show what I believe to be repeated failed attempts, connection attempts time out)
  • I was able to supple an SSL certificate for the WebSocketSharp server and it seemed happy to start up. I haven't seen anything about supplying the SSL cert to CCI's library. I'm not seeing any errors that indicates this is an issue, but it is confusing that it wouldn't be.
  • The pre-compiled CCI WebSocket Example project does work when loaded directly.
  • I did see the Crestron.SimplSharp.CrestronSockets class, but I'm not sure if this is intended to provide the functionality I'm looking for?
At this point, I have to suspect I'm not configuring the CCI Websocket Server correctly. (Quick note: the help file states that it's only compatible with the Series 3 controller, but I did have it working)

To recap the question up top: Am I taking the wrong path here? If not any guidance would be greatly appreciated.


 

Hey Cameron!

The free CCI WebSocketServer, does not support SSL. CCI does offer a premium version that supports SSL and multiple client connections. CCI does offer support for all its modules, so feel free to contact the company for support.

Hopefully this is helpful,

Jeff Mackie


Cameron Bowman
 

Jeff,

Somehow I missed that. I'll try without SSL and if that works like it should (or I'm using it correctly), I'll see about getting the license.

I also ran across Neil Colvin's SSharpWebSocketLibrary (a mono port of sta's WebSocketSharp). I'm keen to give that a shot but haven't figured out how to build it yet. If anyone has info on building any of Neil's ports I'm all ears.


 

Hi All,

I don't know if you noticed in SimplSharp APPI. There is now a Websocket Server.
Have a look to the help file inside SIMPLSharpPro.chm inside Program Files (x86)\Crestron\Cresdb\Help

Regards,


Cameron Bowman
 

Sébastien,

Thank you, I had not seen that. I'll give that a shot now.

I was able to get WebSocketSharp to open the port as intended, but for whatever reason I don't seem to be able to get beyond the handshake, regardless of the method I've used.


 

You really don't want to be using anything that is 3-series compatible if you're working with a 4-series control system for your HTTP(S) server or websockets in my opinion.

--
 
Crestron Service Provider - TBD Enterprises Inc.


Cameron Bowman
 

Quick question up top: Anyone have any success registering a websocket cert and having a secure websocket connection pick it up and provide it?

All,

Thought I'd circle back around and throw out an update, might help some folks.
Originally I figured most C# libraries should work on Series 4 processors, then I thought my failures with WebSocketSharp indicated that I was wrong. This is not so, I do have WebSocketSharp working now, just not with SSL.

For whatever reason, my processor isn't finding and using my websocket cert, and my client was rejecting the cert, failing the connection attempt before websocket protocol upgrade. Switching to an insecure connection and it works pretty smoothly.

What I found with the CrestronWebSocketServer:
There's probably a good reason this isn't documented anywhere. I'd almost bet that it slipped into the chm by mistake. It was really unstable and kept crashing the program and often the processor on client disconnect. It's still possible I was doing something wrong with it, but I sure didn't find anything to indicate that.


Cameron Bowman
 

Troy,

That was my first instinct as well, but I'd been grasping at straws and wasn't 100% sure about staying away from anything Series-3, or even necessary what was specifically Series 3 compatible (I don't have much experience with Crestron at all).

I'm still not clear on which libraries are specifically built for Series 3 use, what has non-native alternatives, or what sorts of gaps and pitfalls I might have in finding suitable solutions.


 

It's very easy to determine which libraries are built for 3-series compatibility because there's only around a dozen of them in total and they're the only DLL's that you can use on 3-series with the sandbox limitations. Every other library that works on 3-series is derived from those libraries in some way, unless the sandbox is circumvented.

--
 
Crestron Service Provider - TBD Enterprises Inc.


Cameron Bowman
 

I'm going to correct my previous assertion that I got an insecure websocket working. The Content Security Policy of the controller web server won't allow the ws: protocol, only the wss:
Coming back to my previous question: Has anyone successfully loaded a certificate that is used for the websocket connection?


 

If by a cert, yes. I have gotten a self-signed to work. Not one issued through a cert authority (but still on my todo list) If you were a part of the discord server you'd probably have seen the demo.

SecureWss/SecureWss at master · JayLiaProgramming/SecureWss (github.com)


 

Almost every client that is using our premium WebSocket module is using CA certs and is working without issue. So yes, CA certs work on the controller and via secure socket communication.


Cameron Bowman
 

Nathan,

That did it! Thank you for posting the repo.

I was able to pick out the (embarrassingly minor) bits of code I needed, and got my server using a cert signed by a local network CA.