fix(ios): allow plaintext ws:// for LAN/Tailscale hosts; prefer password over bootstrap token (#47887)#2350
Open
BingqingLyu wants to merge 1 commit into
Open
Conversation
…ord over bootstrap token (openclaw#47887) Four related bugs caused iOS LAN gateway onboarding to fail: 1. ws:// silently upgraded to wss:// for all non-loopback hosts GatewayConnectionController.shouldRequireTLS returned true for any non-loopback host, including RFC-1918 addresses (192.168.x.x, 10.x.x.x, 172.16-31.x.x), link-local (169.254.x.x), .local mDNS names, and Tailscale .ts.net addresses. Gateways on these networks commonly run without TLS, so the forced upgrade broke plain-LAN onboarding entirely. Fix: add isLocalNetworkHost() that returns true for RFC-1918, link-local, CG-NAT/Tailscale (100.64/10), .local, and .ts.net. shouldRequireTLS now returns false for these hosts when useTLS=false. 4. bootstrapToken used even when explicit password is present Mixed auth payloads (both bootstrapToken and password) were using the bootstrap path, causing AUTH_BOOTSTRAP_TOKEN_INVALID errors when a stale bootstrap token was already consumed. Fix: suppress authBootstrapToken whenever explicitPassword != nil, making password take precedence as intended. Bugs 2 and 3 (double-socket bootstrap consumption, setup-code generator emitting bootstrap-only payloads) are addressed on the gateway/TypeScript side in separate commits. Tests: 9 new tests in GatewayConnectionSecurityTests covering LAN host detection (RFC-1918, .local, .ts.net, public hosts) and TLS override behavior.
BingqingLyu
added
the
independent-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four related bugs caused iOS LAN gateway onboarding to fail. This PR addresses two of them in the iOS/shared Swift layer (bugs 1 and 4 from the issue report); bugs 2 and 3 affect the TypeScript gateway side and are tracked separately.
Bug 1:
ws://silently upgraded towss://for LAN hostsGatewayConnectionController.shouldRequireTLSreturnedtruefor any host that wasn't loopback, including:192.168.x.x,10.x.x.x,172.16-31.x.x169.254.x.x*.local*.ts.net, CG-NAT100.64.x.xGateways on these networks commonly run without TLS (the documented default for LAN), so the forced upgrade caused connection hangs before auth even started.
Fix: Add
isLocalNetworkHost()that correctly identifies these address families.shouldRequireTLSnow returnsfalsefor local-network hosts whenuseTLSis explicitlyfalse.Bug 4:
bootstrapTokenused even when explicitpasswordis presentMixed auth payloads (both
bootstrapTokenandpassword) always chose the bootstrap path. When the bootstrap token was already consumed (single-use), subsequent connection attempts gotAUTH_BOOTSTRAP_TOKEN_INVALIDwhile a validpasswordwas available.Fix: Suppress
authBootstrapTokenwheneverexplicitPassword != nil, making password take precedence.Files changed
apps/ios/Sources/Gateway/GatewayConnectionController.swiftshouldRequireTLS: exclude local-network hostsisLocalNetworkHost(): new static helper_test_isLocalNetworkHost(): test hookapps/shared/OpenClawKit/Sources/OpenClawKit/GatewayChannel.swiftauthBootstrapTokenwhenexplicitPassword != nilTests
9 new tests in
GatewayConnectionSecurityTests:.localmDNS names.ts.netnamesresolveManualUseTLSbehaviour for LAN hosts, public hosts, and explicituseTLS=trueBuild verified:
xcodebuild BUILD SUCCEEDEDforgeneric/platform=iOS.Fixes openclaw#47887