diff options
Diffstat (limited to 'src/modules/m_websocket.cpp')
| -rw-r--r-- | src/modules/m_websocket.cpp | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp index d682d77df..5d7b95c36 100644 --- a/src/modules/m_websocket.cpp +++ b/src/modules/m_websocket.cpp @@ -386,15 +386,23 @@ class WebSocketHook final irc::sockets::sockaddrs realsa(luser->client_sa); HTTPHeaderFinder proxyheader; - if (proxyheader.Find(recvq, "X-Real-IP:", 10, reqend) - && irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa)) + if (proxyheader.Find(recvq, "X-Real-IP:", 10, reqend) || proxyheader.Find(recvq, "X-Forwarded-For:", 16, reqend)) { - // Nothing to do here. + // Attempt to parse the proxy HTTP header. + irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa); } - else if (proxyheader.Find(recvq, "X-Forwarded-For:", 16, reqend) - && irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa)) + else { - // Nothing to do here. + // The proxy header is missing. + FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that did not send a real IP address header"); + return -1; + } + + if (realsa.family() == AF_UNSPEC) + { + // The proxy header value contains a malformed value. + FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that sent a malformed real IP address"); + return -1; } for (const auto& proxyrange : config.proxyranges) |