From 49e91b96d9faeca50ab0b212174744938d446132 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Thu, 5 Feb 2026 21:18:40 +0000
Subject: aptwebserver: Refuse client immediately on TLS handshake

We implement a HTTP-only server here (that is wrapped by stunnel for
HTTPS support), so if a TLS handshake reaches us it is always wrong
and we can just close the connection immediately instead of accepting
it and letting the client run into a timeout as we will never receive
the message(s) we expect.

This happens e.g. with browsers like Firefox that opportunistically
try https first (even if you ask for http and specify a port).
---
 test/interactive-helper/aptwebserver.cc | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

(limited to 'test/interactive-helper')

diff --git a/test/interactive-helper/aptwebserver.cc b/test/interactive-helper/aptwebserver.cc
index e9882abd0..80a971e87 100644
--- a/test/interactive-helper/aptwebserver.cc
+++ b/test/interactive-helper/aptwebserver.cc
@@ -684,13 +684,34 @@ static void * handleClient(int const client, size_t const id)		/*{{{*/
    std::ofstream logfile(logfilepath);
    basic_teeostream<char> log(std::clog, logfile);
 
-   log << "ACCEPT client " << client << std::endl;
    bool closeConnection = false;
+   bool firstHandshake = true;
+   std::array<char, 2> handshake = {'\0', '\0' };
+   if (not FileFd::Read(client, handshake.data(), handshake.size() * sizeof(decltype(handshake)::value_type)))
+   {
+      log << "READ ERROR handshake from client " << client << '\n';
+      closeConnection = true;
+   }
+   // a TLS handshake packet starts with the type 0x16 and a two byte TLS version,
+   // but all versions start with 0x03 and TLS1.3 defines it as a legacy version
+   // hardcoding it to the TLS1.2 value of 0x03 0x03.
+   else if (handshake[0] == 0x16 && handshake[1] == 0x03)
+   {
+      log << "REFUSE TLS-handshaking client " << client << '\n';
+      closeConnection = true;
+   }
+   else
+      log << "ACCEPT client " << client << '\n';
    while (closeConnection == false)
    {
       std::vector<std::string> messages;
       if (ReadMessages(client, messages) == false)
 	 break;
+      if (firstHandshake && not messages.empty())
+      {
+	 messages.front().insert(0, handshake.data(), handshake.size());
+	 firstHandshake = false;
+      }
 
       std::list<std::string> headers;
       for (std::vector<std::string>::const_iterator m = messages.begin();
-- 
cgit v1.2.3-70-g09d2