Repository navigation
connect host option - #147
Open
jasonharmongit wants to merge 1 commit into
Open
jasonharmongit wants to merge 1 commit into
jasonharmongit wants to merge 1 commit into
Conversation
Owner
|
@jasonharmongit can you resolve the conflicts? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, WebSockex takes the URL a caller provides, extracts the host, looks up its IP, and opens a connection there. This leaves callers vulnerable to SSRF attacks--even if the caller does their own DNS lookup to verify the IP, an attacker who controls the hostname could answer the caller's lookup with a public address, then answer WebSockex's lookup with an internal address on the caller's network. On
wss://the certificate check usually stops the handshake. Onws://the connection can complete.This PR lets the caller pass the verified IP address as
connect_host. WebSockex opens the socket to that address and does not look the URL host up again. The original host name still goes to the peer in the Host header and, forwss://, as the server name. The certificate check still uses that host name.Leave
connect_hostout and WebSockex connects as it does today.