search

tsl0922 / ttyd

Share your terminal over the web
https://tsl0922.github.io/ttyd
MIT License
8.18k stars 898 forks source link

ttyd doesn't check client certification when connecting to ip addr instead of domain #1405

Open ikicha opened 2 weeks ago

ikicha commented 2 weeks ago

Describe the bug ttyd doesn't check client certification when connecting to ip addr instead of domain

To Reproduce Steps to reproduce the behavior:

  1. /ttyd.x86_64 --ssl --ssl-cert server.crt --ssl-key server.key --ssl-ca ca.crt bash
  2. curl --insecure -vvv https://127.0.0.1:7681 succeeds to get response, while curl --insecure -vvv https://localhost:7681 fails.

Expected behavior It should check and verify the client certificate regardless of how a user connects to ttyd.

Additional context Here is https://github.com/warmcat/libwebsockets/pull/3257 which is my PR to fix this bug in libwebsockets. Can we use libwebsockets with patch? or it looks like the recent libwebsocket might include some workaround as well(https://github.com/warmcat/libwebsockets/pull/2902)

ikicha commented 1 week ago

the change in libwebsockets has been merged in main.