From f88fbaa2fe91c22f1c7280ecd96c2bcf92f73a4d Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Thu, 11 Aug 2022 14:20:18 +0100 Subject: Move aptosa/untosa into the sockaddrs union and add from/from_ip. The struct will also now always be zero-initialized by default which removes the footgun which has happened previously where the union has been accessed before being initialized leading to it containing weird values. --- src/modules/m_websocket.cpp | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) (limited to 'src/modules/m_websocket.cpp') diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp index fd5bd2a73..f9363f998 100644 --- a/src/modules/m_websocket.cpp +++ b/src/modules/m_websocket.cpp @@ -408,7 +408,12 @@ class WebSocketHook final if (proxyheader.Find(recvq, "X-Real-IP:", 10, reqend) || proxyheader.Find(recvq, "X-Forwarded-For:", 16, reqend)) { // Attempt to parse the proxy HTTP header. - irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa); + if (!realsa.from_ip_port(proxyheader.ExtractValue(recvq), realsa.port())) + { + // The proxy header value contains a malformed value. + FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that sent a malformed real IP address"); + return -1; + } } else { @@ -416,14 +421,6 @@ class WebSocketHook final FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that did not send a real IP address header"); return -1; } - - if (realsa.family() == AF_UNSPEC) - { - // The proxy header value contains a malformed value. - FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that sent a malformed real IP address"); - return -1; - } - for (const auto& proxyrange : config.proxyranges) { if (InspIRCd::MatchCIDR(luser->GetIPString(), proxyrange, ascii_case_insensitive_map)) -- cgit v1.3.1-10-gc9f91