#6234·swoole-src

Add a Windows random source for WebSocket masking keys

Author: binaryfireCreated Sep 12, 2026Updated Sep 12, 2026

#6165 generates a fresh random masking key for every WebSocket frame using swoole_random_bytes(). Windows doesn't currently have an implementation for that helper: it falls through to the /dev/urandom fallback, which Windows doesn't provide.

This doesn't affect current master because #6165 hasn't been merged forward yet. Once it is, masked Frame::pack() calls and coroutine WebSocket client sends will fail on Windows.

Reproduction

On Windows, use a build containing #6165 and #6232, then run:

powershell
$env:PHPT = '1'
$env:TEST_PHP_EXECUTABLE = 'php'
$env:SKIP_ONLINE_TESTS = '1'
$env:NO_INTERACTION = '1'

php tests\run-tests -P -q `
  -d extension=php_swoole `
  -d swoole.use_shortname=On `
  --show-diff `
  -g PASS,FAIL,BORK,LEAK,XLEAK `
  --set-timeout 12 `
  tests\swoole_http_server_coro\websocket_compression.phpt

The masked send reports failed to generate websocket masking key; the following receive fails and the test can't complete normally.

Proposed fix

Use BCryptGenRandom() with BCRYPT_USE_SYSTEM_PREFERRED_RNG in the Windows random-byte path and link bcrypt.lib. The existing Windows WebSocket test added by #6232 will then cover the active caller.

I can submit this fix, but it needs to be based on the final master code after #6165 is merged forward. I'll open the PR as soon as that happens.