github uNetworking/uWebSockets v20.78.0

6 hours ago

PROXY v2 fix for L4 use cases

UWS_WITH_PROXY has been working fine for L7 proxy (HTTP level) use cases, but has been broken for L4 proxy use cases (TCP level):

If you deploy uWS compiled with UWS_WITH_PROXY behind a L4 proxy that sends PROXY v2 frames, and your app relies on getProxiedRemoteAddress() to handle some form of IP-level blocking, rate limiting or such, then that assumption was broken.

Formerly, in such a set-up a remote end user could spoof their getProxiedRemoteAddress() by just sending an extra PROXY v2 frame. This works, since the L4 TCP proxy has no understanding of what is invalid HTTP, and uWS would just update its record for the connection.

This has been fixed now, and both L7 and L4 proxies can be used together with UWS_WITH_PROXY.

Reported by @Carmel0

Other changes:

  • preOpen, adoptSocket now takes 2 extra arguments for IP. This breaks API compatibility for certain uses, but should be easy to update. Most users would rely on abstractions like the uWS::LocalCluster feature.
  • onWritable can now be safely set inside of itself, for recursive-styled use cases

Don't miss a new uWebSockets release

NewReleases is sending notifications on new releases.