Using Ratchet WebSockets in a Secure Environment is not working

Viewed 89

I am using Ratchet WebSocket in a Windows-based server project that is entirely working in an insecure environment. That is to say that when I navigate my browser to http://www.example.com and connect to the websocket server using ws:// on port 8686 everything works spectacularly.

The server doesn't run through IIS - but instead is executed via php.exe in command prompt like this.

php wsocket-server.php [...parameters...]

However, if run the Ratchet Server and try to connect from https://www.example.com using wss:// the browser simply will not connect to the websocket server, despite the fact that the server starts up fine and the insecure site and connect via ws://

Now, I realize I need to utilize some additional code to include my SSL documentation. This is the relevant code I have in place:

use Ratchet\Server\IoServer;
use Ratchet\Http\HttpServer;
use Ratchet\WebSocket\WsServer;

$websocket_server = new WsServer();

if ($site_secure){
   //RUN WSS (SECURE) SERVER
    $options = [
        'local_cert'        => 'c:\inetpub\ssl\2c6fa1928847451c.crt',
        'local_pk'          => 'c:\inetpub\ssl\2c6fa1928847451c.key',
        'allow_self_signed' => true,
        'verify_peer'       => false
    ];
    
    $loop = React\EventLoop\Factory::create();
    $websocket_server->enableKeepAlive($loop);
    $app = new HttpServer($websocket_server);

    $insecure_websockets = new \React\Socket\Server('0.0.0.0:'.$port, $loop);
    $secure_websockets = new \React\Socket\SecureServer($insecure_websockets , $loop, $options);
    $secure_websockets_server = new \Ratchet\Server\IoServer($app, $secure_websockets, $loop);

    $secure_websockets_server->run();
}else{    
   //RUN WS (INSECURE) SERVER
    $http_server = new HttpServer($websocket_server);
    $server = IoServer::factory($http_server, $port);
    $websocket->log ("Initializing ".(($site_secure) ? "Secure " : "Insecure ")."Server ($port)");
    $server->run();
}

What I have tried

  • I have ensured the correct ports are all open in the windows firewall.
  • I have ensured nothing else is listening on the port using netstat
  • I have tried using nginx, on a minimal level. I'd prefer to NOT use this method if possible, and was having some initial problems with it starting up so I did not dedicate 100% to it at this time. Ideally, I'd like to use Ratchet's native abilities.
  • I have searched other similar posts both here and elsewhere, such as this.
  • I have tried a number of different ports, even the same 8686 as I use in the insecure connection

I am hoping someone can lend me an assist with an issue that has been driving me crazy for 2 weeks. At this point I feel like I'm just trying things to try them and I may be coding myself in circles.

Thank you in advance.

1 Answers

A browser is never going to connect to anything running on port 465. Especially not a WebSocket.

Establishing a WebSocket connection is specified in terms of the Fetch standard. As such, the specific exclusion of this port is found within the latter:

A port is a bad port if it is listed in the first column of the following table.

Port Typical service
… …
465 submission
… …

Now, why are some ports blacklisted? This is a protection against cross-protocol scripting attacks, as once demonstrated (warning: NSFW links) against Firefox and against Safari. Port 465 has been (and still sometimes is) used for SMTP over (pure) TLS, so in this case, an XPS attack might trick a browser into sending mail on the user’s behalf. Blocking those ports is meant to prevent it. Of course, all bets are off when a service runs on a non-standard port.

To make the service available in a browser, all you need to do is change the port number.

Related