boostorg/beast

Use system zlib?

bgemmill opened this issue · 9 comments

bgemmill commented

For those of us with a system zlib installed, is there a way to tell beast to use it rather than the internal header implementation?

In my particular case, I'm using boost::iostreams and all ready have the adapters built for a number of compression libraries.

Version of Beast

beast from boost 1.86

Steps necessary to reproduce the problem

  1. Connect to a websocket seerver somewhere and request compression.
  2. Receive data
  3. Observe that this code is used

All relevant compiler information

$ clang --version
Ubuntu clang version 18.1.8
ashtum commented

If you want to use it for inflating/deflating HTTP messages, you are free to use any method you prefer, as there is no dependency on them in the implementation. However, websocket::stream is tightly coupled with zlib::deflate_stream and zlib::inflate_stream, so you cannot substitute your own implementation.

bgemmill commented

Thanks for the heads up, the websocket stream is the one I'm interested in.

You're saying it's so tightly coupled that it's not reasonable to use a system implementation?

ashtum commented

You're saying it's so tightly coupled that it's not reasonable to use a system implementation?

I mean, the interface doesn't allow you to substitute your own implementation.

bgemmill commented

Could that be changed? That's largely why I filed this report :-)

ashtum commented

Could that be changed? That's largely why I filed this report :-)

Do you have a motivating use case for it?

vinniefalco commented

It can't be changed.

bgemmill commented

@ashtum The motivator behind filing this is to get bugfixes for CVEs like this one with OS updates.

Is beast also tracking these fixes, or is it an entirely different implementation at this point?

vinniefalco commented

Beast tracks all fixes made to zlib, and the handling of this CVE is exactly why Beast does not use a system zlib. Note that the CVE regards one of the examples in the zlib repository, which Beast does not use (and does not contain). In other words Beast is unaffected.

bgemmill commented

If beast tracks fixes to zlib that's mostly what I was looking for. Thanks for the heads up.