(RFC) WebUI mod - #1467
Merged
Merged
Conversation
michaelortmann
force-pushed
the
webui.mod
branch
from
August 31, 2023 19:26
28e752d to
930c847
Compare
added 8 commits
October 8, 2023 02:37
Member
and a second one with debug enabled and a third non-crash, but still can't connect over a TLS port with https: |
Member
Author
|
@vanosg: The crash should be fixed now. |
Member
|
One more- |
Member
Author
michaelortmann
force-pushed
the
webui.mod
branch
from
October 26, 2025 03:36
731aca8 to
fb17505
Compare
michaelortmann
force-pushed
the
webui.mod
branch
from
December 1, 2025 06:56
b434872 to
462a287
Compare
Merged
vanosg
pushed a commit
that referenced
this pull request
May 23, 2026
This PR Fixes:
Blocker — src/tls.c ssl_init() X509 use-after-free on error.
Fix use after free / fingerprint logging, implemented a TODO left by (RFC) WebUI mod #1467
Blocker — src/tcldcc.c webui listen type works even without the webui module.
Init webui_dcc_telnet_hostresolved() hook to null_func instead of 0
But we dont need any fix here, because the listen type webui is only set for webui listen ports to begin with.
Should-fix — src/tls.c:1075-1104 HTTP-on-SSL handler hijacks every TLS listener, not just webui.
Fixed SSL_R_HTTP_REQUEST logic to only apply to webui ports
Response status HTTP 200 -> 400 for error msg "Error: HTTP request received on an SSL port, please try HTTPS"
Leaking program name and version when stealth telnets is set to 1 is not a bug but a feature. nginx does the same.
The write()/SSL_shutdown() was only suffering from a bad comment. I removed the comment, because the connection is properly closed with SO_LINGER + close(), verified with strace and tcpdump
killsock(): dont kill stdout, so that we keep stdout logging until the very last cycle of .die waving killsock(), it just doesnt make sense to kill stdout.
puts(): fix openssl error logging
puts(): fix memleak
Fix error logging for SSL_write() by doing ERR_clear_error() before that write call
Stop writing to sock after close notify during write and enhance logging
Fix fatal(): end all logging to dcc for killed sock
Fix memleak by calling changeover_dcc() before dcc[i].u is reused. this bug existed since at least eggdrop 1.10.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by: michaelortmann
Patch by: michaelortmann
Fixes:
One-line summary:
WebUI mod adds webinterface to eggdrop
Additional description (if needed):
Screenshot desktop firefox: https://imgur.com/a/WONc3dR
Screenshot iOS safari: https://imgur.com/a/AQwxNgs (the imgur content detection/warning, is ridiculous ;)
Reuses eggdrops telnet interface
Adds minimal http/websocket
The html and vanilla js (best js framework ;) code is handcrafted
It sends our eggman as favicon :)
Work in progress, but already working for me
Eggdrops
make installdoesnt automatically copy from module to text directory, so you have tocp src/mod/webui.mod/webui.html ~/eggdrop/text/manually for nowAdd to config:
Yes, the
+means it already supports httpsTest cases demonstrating functionality (if applicable):
Tested with destop firefox, desktop brave (based on chromium) and iphone iOS safari