From abbd44e27697f36f3f02f0d3e827ff496af4f461 Mon Sep 17 00:00:00 2001 From: Deomid Ryabkov Date: Thu, 22 Sep 2016 18:48:14 +0300 Subject: [PATCH] Fix WS handshake nonce generation PUBLISHED_FROM=ae8d436db9aee9aec7b5ac1cbee6bc4e32d8c6cf --- mongoose.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/mongoose.c b/mongoose.c index 2fff4927..f523315a 100644 --- a/mongoose.c +++ b/mongoose.c @@ -5228,11 +5228,14 @@ void mg_set_protocol_http_websocket(struct mg_connection *nc) { void mg_send_websocket_handshake2(struct mg_connection *nc, const char *path, const char *host, const char *protocol, const char *extra_headers) { - /* pretty poor source of randomness, TODO fix */ - unsigned long random = (unsigned long) (uintptr_t) path; - char key[sizeof(random) * 3]; + char key[25]; + uint32_t nonce[4]; + nonce[0] = mg_ws_random_mask(); + nonce[1] = mg_ws_random_mask(); + nonce[2] = mg_ws_random_mask(); + nonce[3] = mg_ws_random_mask(); + mg_base64_encode((unsigned char *) &nonce, sizeof(nonce), key); - mg_base64_encode((unsigned char *) &random, sizeof(random), key); mg_printf(nc, "GET %s HTTP/1.1\r\n" "Upgrade: websocket\r\n"