ss: policy: flag to allow respecting redirects

include/libwebsockets/lws-secure-streams-policy.h

@@ -124,6 +124,8 @@ enum {
 	 */
 	LWSSSPOLF_SERVER					= (1 << 15),
 	/**< we listen on a socket as a server */
+	LWSSSPOLF_ALLOW_REDIRECTS				= (1 << 16),
+	/**< follow redirects */
 };
 
 typedef struct lws_ss_trust_store {

lib/secure-streams/README.md

@@ -251,9 +251,10 @@ arbitrarily fragmented by any intermediary, such streams have to be regarded as
 ordered bytestream that may be fragmented at any byte without any meaning in terms
 of message boundaries, for that reason SOM and EOM are ignored with raw.
 
-### `plugins`
+### `allow_redirects`
 
-Array of plugin names to apply to the stream, if any
+By default redirects are not followed, if you wish a streamtype to observe them, eg,
+because that's how it responds to a POST, set `"allow_redirects": true`
 
 ### `tls`
 

lib/secure-streams/policy-json.c

@@ -50,6 +50,7 @@ static const char * const lejp_tokens_policy[] = {
 	"s[].*.client_cert",
 	"s[].*.opportunistic",
 	"s[].*.nailed_up",
+	"s[].*.allow_redirects",
 	"s[].*.urgent_tx",
 	"s[].*.urgent_rx",
 	"s[].*.long_poll",
@@ -121,6 +122,7 @@ typedef enum {
 	LSSPPT_TLS_CLIENT_CERT,
 	LSSPPT_OPPORTUNISTIC,
 	LSSPPT_NAILED_UP,
+	LSSPPT_ALLOW_REDIRECTS,
 	LSSPPT_URGENT_TX,
 	LSSPPT_URGENT_RX,
 	LSSPPT_LONG_POLL,
@@ -577,6 +579,11 @@ lws_ss_policy_parser_cb(struct lejp_ctx *ctx, char reason)
 			a->curr[LTY_POLICY].p->flags |=
 					LWSSSPOLF_WAKE_SUSPEND__VALIDITY;
 		break;
+	case LSSPPT_ALLOW_REDIRECTS:
+		if (reason == LEJPCB_VAL_TRUE)
+			a->curr[LTY_POLICY].p->flags |=
+						LWSSSPOLF_ALLOW_REDIRECTS;
+		break;
 
 	case LSSPPT_RETRYPTR:
 		bot = a->heads[LTY_BACKOFF].b;

lib/secure-streams/protocols/ss-h1.c

@@ -245,8 +245,8 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		if (h->policy->u.http.fail_redirect)
 			lws_system_cpd_set(lws_get_context(wsi),
 					   LWS_CPD_CAPTIVE_PORTAL);
-		/* don't follow it */
-		return 1;
+		/* unless it's explicitly allowed, reject to follow it */
+		return !(h->policy->flags & LWSSSPOLF_ALLOW_REDIRECTS);
 
 	case LWS_CALLBACK_CLOSED_HTTP: /* server */
 	case LWS_CALLBACK_CLOSED_CLIENT_HTTP: