abff247 · typeable/wai

git.iko.soy/typeable/wai

warp-tls: Handle recv failure on mkConn

That `safeRecv` is no different than a `recv` except on Windows. Without this patch, a simple connect scan (nmap -sT <ip> -p <port>) leaks an open socket, because the first recv fails with `recv: connection vanished`.

commitabff2476c498d5754595165b530d94ed460fff87 authorUtku Demir <utdemir@gmail.com> dateTue 21 Jun 2016, 10:09 (10 years ago) parente0fcc8a

1 file changed+7−6

compare with master

unifiedsplit

warp-tls/Network/Wai/Handler/WarpTLS.hs+7−6

warp-tls/Network/Wai/Handler/WarpTLS.hs+7−6

@@ -309,12 +309,13 @@ getter tlsset@TLSSettings{..} sock params = do

309309 return (mkConn tlsset s params, sa)

310310

311311mkConn :: TLS.TLSParams params => TLSSettings -> Socket -> params -> IO (Connection, Transport)

312−mkConn tlsset s params = do

313− firstBS <- safeRecv s 4096

314− (if not (S.null firstBS) && S.head firstBS == 0x16 then

315− httpOverTls tlsset s firstBS params

316− else

317− plainHTTP tlsset s firstBS) `onException` sClose s

312+mkConn tlsset s params =

313+ ( do firstBS <- safeRecv s 4096

314+ if not (S.null firstBS) && S.head firstBS == 0x16 then

315+ httpOverTls tlsset s firstBS params

316+ else

317+ plainHTTP tlsset s firstBS

318+ ) `onException` sClose s

318319

319320----------------------------------------------------------------

320321