Skip to content

fix(security): reject plaintext upgrades when SSL is enabled #1550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
someonegg wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): reject plaintext upgrades when SSL is enabled #1550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/http.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,13 @@ int callback_http(struct lws *wsi, enum lws_callback_reasons reason, void *user,
bool done = false;

switch (reason) {
case LWS_CALLBACK_HTTP_CONFIRM_UPGRADE:
if (server->ssl && !lws_is_ssl(wsi)) {
lwsl_warn("refuse HTTP upgrade over non-SSL connection while SSL is enabled.\n");
return -1;
}
break;

case LWS_CALLBACK_HTTP:
access_log(wsi, (const char *)in);
snprintf(pss->path, sizeof(pss->path), "%s", (const char *)in);
Expand Down
1 change: 1 addition & 0 deletions src/server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -563,6 +563,7 @@ int main(int argc, char **argv) {

#if defined(LWS_OPENSSL_SUPPORT) || defined(LWS_WITH_TLS)
if (ssl) {
server->ssl = true;
info.ssl_cert_filepath = cert_path;
info.ssl_private_key_filepath = key_path;
#ifndef LWS_WITH_MBEDTLS
Expand Down
1 change: 1 addition & 0 deletions src/server.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ struct server {
bool url_arg; // allow client to send cli arguments in URL
bool writable; // whether clients to write to the TTY
bool check_origin; // whether allow websocket connection from different origin
bool ssl; // whether SSL is enabled
int max_clients; // maximum clients to support
bool once; // whether accept only one client and exit on disconnection
bool exit_no_conn; // whether exit on all clients disconnection
Expand Down