RustProxy/docs/V0.23.3_AUDIT.md

RustProxy 0.23.3 specification audit

Scope

0.23.3 is a compatibility patch on top of 0.23.2. It adds an opt-in, per-vhost legacy WebSocket mode intended for older appliance and embedded WebSocket servers. Cache/Transformation history controls and HTTPS-aware local CLI/live logs from 0.23.2 are retained unchanged. No SQLite schema change is introduced.

Legacy WebSocket mode

• websocket_legacy_support defaults to false and is valid only when websockets is enabled.
• The vhost editor exposes Enable WebSocket legacy support and persists the field in the normal vhost document/API.
• The switch is compiled into the immutable per-vhost frontend snapshot; there is no global compatibility downgrade.
• For WebSocket exchanges only, legacy mode forces the upstream hop to classic HTTP/1.1, including when the normal backend protocol setting prefers HTTP/2. HTTP/2 or HTTP/3 clients are bridged to the HTTP/1.1 upstream path.
• Before the upstream handshake, the WebSocket upstream Host is forced to the configured backend authority and Origin is rewritten to <upstream-scheme>://<backend-authority>. This intentionally overrides Preserve Host for the legacy WebSocket handshake only, so old same-origin checks see the appliance address they expect.
• Legacy upstream 101 Switching Protocols validation tolerates historical syntax differences: missing Connection: Upgrade, repeated Upgrade: websocket, transfer-encoding metadata and zero Content-Length. Non-zero Content-Length is still rejected.
• The Sec-WebSocket-Accept proof remains exact and any selected Sec-WebSocket-Protocol must still have been offered by the client.
• Legacy response framing headers are removed before the downstream response.
• Ordinary HTTP requests and WebSocket vhosts without the switch use the existing strict path unchanged.

iLO4 evidence / intended acceptance

The supplied browser HAR shows repeated attempts to wss://ilo.lab.danio298.com/wss/ircport with a standard RFC 6455 request (Upgrade: websocket, Connection: Upgrade, Origin: https://ilo.lab.danio298.com) and no HTTP response (status: 0). That is consistent with an upstream handshake being closed or rejected before a browser-visible status is returned. The new mode specifically addresses the two proxy-sensitive compatibility points identified in source review: upstream Origin/Host mismatch and strict rejection of legacy 101 response framing. Live iLO4 acceptance remains a release-host/runtime gate.

Verification status

Rust-independent source, JavaScript/JSON, language-pack, shell, Go-agent and release-smoke checks are run in the packaging workspace. cargo, rustc and rustfmt are unavailable here, so compiler/type tests, release binary build and live iLO4/legacy-WebSocket runtime acceptance remain release-host gates.