From 047473426bc6e60185c2576ec3f585b9e62d5072 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Wed, 24 Nov 2021 06:00:12 +0000
Subject: Make parsing websocket proxy headers more robust.

---
 src/modules/m_websocket.cpp | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp
index c70fd2c73..0b43ea60b 100644
--- a/src/modules/m_websocket.cpp
+++ b/src/modules/m_websocket.cpp
@@ -384,15 +384,23 @@ class WebSocketHook : public IOHookMiddle
 			irc::sockets::sockaddrs realsa(luser->client_sa);
 
 			HTTPHeaderFinder proxyheader;
-			if (proxyheader.Find(recvq, "X-Real-IP:", 10, reqend)
-				&& irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa))
+			if (proxyheader.Find(recvq, "X-Real-IP:", 10, reqend) || proxyheader.Find(recvq, "X-Forwarded-For:", 16, reqend))
 			{
-				// Nothing to do here.
+				// Attempt to parse the proxy HTTP header.
+				irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa);
 			}
-			else if (proxyheader.Find(recvq, "X-Forwarded-For:", 16, reqend)
-				&& irc::sockets::aptosa(proxyheader.ExtractValue(recvq), realsa.port(), realsa))
+			else
 			{
-				// Nothing to do here.
+				// The proxy header is missing.
+				FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that did not send a real IP address header");
+				return -1;
+			}
+
+			if (realsa.family() == AF_UNSPEC)
+			{
+				// The proxy header value contains a malformed value.
+				FailHandshake(sock, "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "WebSocket: Received a proxied HTTP request that sent a malformed real IP address");
+				return -1;
 			}
 
 			for (WebSocketConfig::ProxyRanges::const_iterator iter = config.proxyranges.begin(); iter != config.proxyranges.end(); ++iter)
-- 
cgit v1.3.1-10-gc9f91