Skip to content

fix: require valid OpenSSL client certificate for websocket server connections - #1436

Merged
skarg merged 1 commit into
masterfrom
bugfix/bacne-sc-hub-never-requires-a-client-cert
Jul 22, 2026
Merged

fix: require valid OpenSSL client certificate for websocket server connections#1436
skarg merged 1 commit into
masterfrom
bugfix/bacne-sc-hub-never-requires-a-client-cert

Conversation

@skarg

@skarg skarg commented Jul 22, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens BACnet/SC websocket server security in the platform-specific libwebsockets ports by requiring clients to present a valid OpenSSL client certificate during TLS handshake.

Changes:

  • Enable libwebsockets’ “require valid OpenSSL client cert” server option for Linux.
  • Enable the same requirement for BSD/macOS.
  • Enable the same requirement for Win32.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
ports/win32/websocket-srv.c Require valid OpenSSL client certificate for incoming websocket server connections.
ports/linux/websocket-srv.c Require valid OpenSSL client certificate for incoming websocket server connections.
ports/bsd/websocket-srv.c Require valid OpenSSL client certificate for incoming websocket server connections.

info.server_ssl_private_key_mem_len = key_size;
info.options |= LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
info.options |= LWS_SERVER_OPTION_FAIL_UPON_UNABLE_TO_BIND;
info.options |= LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT;
Comment thread ports/bsd/websocket-srv.c
info.server_ssl_private_key_mem_len = key_size;
info.options |= LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
info.options |= LWS_SERVER_OPTION_FAIL_UPON_UNABLE_TO_BIND;
info.options |= LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT;
info.server_ssl_private_key_mem_len = (unsigned int)key_size;
info.options |= LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
info.options |= LWS_SERVER_OPTION_FAIL_UPON_UNABLE_TO_BIND;
info.options |= LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT;
info.server_ssl_private_key_mem_len = key_size;
info.options |= LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
info.options |= LWS_SERVER_OPTION_FAIL_UPON_UNABLE_TO_BIND;
info.options |= LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT;
@skarg
skarg merged commit 7522175 into master Jul 22, 2026
37 checks passed
@skarg
skarg deleted the bugfix/bacne-sc-hub-never-requires-a-client-cert branch July 22, 2026 18:53
skarg added a commit that referenced this pull request Aug 4, 2026
* doc: add CVE-2026-64675 to GHSA-mmg6-p4pr-cj6h advisory entry

The published advisory for GHSA-mmg6-p4pr-cj6h (pre-auth OOB read in
xy_color_decode) was assigned CVE-2026-64675, but the SECURITY.md
entry was missing the CVE link. Add it to match the published record.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* doc: add 9 draft advisory entries to SECURITY.md

Add entries for all draft GHSA advisories visible after authentication:

- GHSA-f23j-5f4w-cxhj: Command object action list resize heap use-after-free write (1.7.0-rc2, PR #1461)
- GHSA-rxvq-3mhq-474x: Cross-peer disclosure caused by a BVLC length mismatch (1.4.6/1.5.2/1.6.1/1.7.0, PR #1451)
- GHSA-9qx8-hr5x-r35c: Silent decode failure in bacnet_octet_string_decode() (1.4.6/1.5.2/1.6.1/1.7.0, PR #1440)
- GHSA-gv7j-28x8-cr37: AtomicWriteFile access-method mismatch leading to RAMFS heap OOB read (1.4.6/1.5.2/1.6.1/1.7.0, PR #1439)
- GHSA-gj7v-fwjp-7x8q: Router route-table Tx_Buffer overflow (1.4.6/1.5.2/1.6.1/1.7.0, PR #1438)
- GHSA-hg85-pmm3-jfcf: Structured View subordinate-list[0] unbounded resize DoS (1.6.1/1.7.0, PR #1437)
- GHSA-92q2-p4vr-fvmp: BACnet/SC hub never requires a client cert (1.4.6/1.5.2/1.6.1/1.7.0, PR #1436)
- GHSA-gr74-333w-7wg8: Trailing MORE bit BACnet/SC header option OOB read/write (1.4.6/1.5.2/1.6.1/1.7.0, PR #1435)
- GHSA-jgm4-2wg9-jwfg: BACnet/SC node accepts self-signed hub cert MITM (1.4.6/1.5.2/1.6.1/1.7.0, PR #1434)

None of these drafts have CVE IDs assigned yet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
skarg added a commit that referenced this pull request Aug 11, 2026
skarg added a commit that referenced this pull request Aug 11, 2026
skarg added a commit that referenced this pull request Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants