From 924c718005f311d995d7ab584533f30f4e1c8061 Mon Sep 17 00:00:00 2001
From: qing <1776177662@qq.com>
Date: Wed, 5 Aug 2026 00:37:11 +0800
Subject: [PATCH] =?UTF-8?q?fix(waf):=20WebSocket=20=E5=8A=AB=E6=8C=81?=
 =?UTF-8?q?=E5=90=8E=E6=B8=85=E9=99=A4=20http.Server=20=E8=AF=BB=E5=86=99?=
 =?UTF-8?q?=20deadline=EF=BC=8C=E9=81=BF=E5=85=8D=E9=95=BF=E8=BF=9E?=
 =?UTF-8?q?=E6=8E=A5=E8=A2=AB=E5=BC=BA=E5=88=B6=E6=96=AD=E5=BC=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 waf/internal/proxy/proxy.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index eb49bf6..8270b05 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -260,6 +260,10 @@ func (r *responseRecorder) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	}
 	conn, rw, err := hijacker.Hijack()
 	if err == nil {
+		// 清除 http.Server 在劫持前设置的读写 deadline（ReadTimeout=15s / WriteTimeout=30s）。
+		// 这些绝对 deadline 在劫持后仍会生效，会导致长连接 WebSocket 在空闲或 30s 后被强制断开。
+		// 底层 WebSocket 桥接由 ReverseProxy 的 io.Copy 双向转发，长时间无人读写时应保持连接。
+		_ = conn.SetDeadline(time.Time{})
 		r.hijacked = true
 		// WebSocket 升级响应是 101 Switching Protocols
 		r.status = http.StatusSwitchingProtocols