No way to fully disable the http server? #997

New Issue

2026-10-05T04:57:41+02:00

adam commented

2026-10-05 04:57:41 +02:00

Hi !

I’ve been wanting to remove the webadmin module and fully disable ZNC from being able to respond anything meaningful over HTTP, because it listens to the same port as the IRC protocol one and so I cannot just block the port. Either this is a behaviour not achievable or I am missing a setting somewhere after searching the wiki for a solution.

I tried setting AllowWeb to false by hand on my only listener but it doesn’t work, as ZNC still serves an html page saying that Web Access have is not enabled.

<Listener listener0>
    AllowIRC = true
    AllowWeb = false
    IPv4 = true
    IPv6 = true
    Port = ****
    SSL = true
    URIPrefix = /
</Listener>

From this changelog, I can see that the http server got embedded in ZNC so that modules other than webadmin can serve pages over http. Is there a way to tell ZNC to not load it?

Serving a page isn’t that big of a deal so I’m okay with this for now. But from a rigorous standpoint, if I don’t want my bouncer to communicate over HTTP I wish I could tell it to not do it, at all.

I am on Debian Bullseye, using their package of ZNC. I took a quick glance over the other issues but I have to say there was too much of them to see if this was an issue already raised.

$ znc --version
ZNC 1.8.2+deb2+b1 - https://znc.in
IPv6: yes, SSL: yes, DNS: threads, charset: yes, i18n: yes, build: cmake

Thanks in advance for your time,

Hi ! I’ve been wanting to remove the `webadmin` module and fully disable ZNC from being able to respond anything meaningful over HTTP, because it listens to the same port as the IRC protocol one and so I cannot just block the port. Either this is a behaviour not achievable or I am missing a setting somewhere after searching the wiki for a solution. I tried setting `AllowWeb` to `false` by hand on my only listener but it doesn’t work, as ZNC still serves an html page saying that `Web Access have is not enabled.` ``` <Listener listener0> AllowIRC = true AllowWeb = false IPv4 = true IPv6 = true Port = **** SSL = true URIPrefix = / </Listener> ``` ![名称未設定](https://user-images.githubusercontent.com/37584624/130321317-f36e1f7e-10d6-4e93-a206-ce85d7e7d056.png) [From this changelog](https://wiki.znc.in/ChangeLog/0.090), I can see that the http server got embedded in ZNC so that modules other than webadmin can serve pages over http. Is there a way to tell ZNC to not load it? Serving a page *isn’t* that big of a deal so I’m okay with this for now. But from a rigorous standpoint, if I don’t want my bouncer to communicate over HTTP I wish I could tell it to not do it, at all. I am on Debian Bullseye, using their package of ZNC. I took a quick glance over the other issues but I have to say there was too much of them to see if this was an issue already raised. ``` $ znc --version ZNC 1.8.2+deb2+b1 - https://znc.in IPv6: yes, SSL: yes, DNS: threads, charset: yes, i18n: yes, build: cmake ``` Thanks in advance for your time,

adam closed this issue

2026-10-05 04:57:41 +02:00

adam commented

2026-10-05 04:57:42 +02:00

Web Access have is not enabled. is the only thing it replies. What error do you want to see instead? "Connection refused" is not possible, because the port is still open.

`Web Access have is not enabled.` is the only thing it replies. What error do you want to see instead? "Connection refused" is not possible, because the port is still open.

adam commented

2026-10-05 04:57:43 +02:00

I don’t think you understand the behaviour I would like to have so I’m going to try my best to reformulate:

I don’t want to see any error/warning/dismissing message in a html page when I make a http request to my bouncer. I want the bouncer to not respond, at all, to any kind of http request, and my web browser to tell me It was unable to connect to the url I gave it, like so :

Is this behaviour achievable as of today? Would the code architecture support that kind of feature without having to make major breaking changes?

I don’t think you understand the behaviour I would like to have so I’m going to try my best to reformulate: I don’t want to see any error/warning/dismissing message in a html page when I make a http request to my bouncer. I want the bouncer to not respond, at all, to any kind of http request, and my web browser to tell me It was unable to connect to the url I gave it, like so : ![名称未設定2](https://user-images.githubusercontent.com/37584624/130358864-c7285ce4-5b0f-44da-8a30-f2e8b92f6f71.png) Is this behaviour achievable as of today? Would the code architecture support that kind of feature without having to make major breaking changes?

adam commented

2026-10-05 04:57:43 +02:00

The port needs to be open to be able to accept IRC connections. And SSL handshake happens even before the client (IRC client or web browser) sends any data to server. ZNC can't distinguish IRC vs HTTP client until at least some data got communicated; in case of SSL, communicated both ways).

So no, "Unable to connect" can't be done.

Why exactly do you need this?

The port needs to be open to be able to accept IRC connections. And SSL handshake happens even before the client (IRC client or web browser) sends any data to server. ZNC can't distinguish IRC vs HTTP client until at least some data got communicated; in case of SSL, communicated both ways). So no, "Unable to connect" can't be done. Why exactly do you need this?

adam commented

2026-10-05 04:57:44 +02:00

I need this because I don’t want to serve anything HTTP and so I don’t want the HTTP server to be in my way.

ZNC may not be able to distinguish IRC vs HTTP until at least some data data got communicated, but at some point it knows the client want HTTP instead of IRC then right? I don’t see why it wouldn’t be feasible to make ZNC not respond anything at this point.

You’re coming to me saying your a client. I acknowledge you and I don’t know what you want yet. Then you’re going to tell me you want HTTP. I’m going to ignore you, pretend I didn’t hear anything and that this event never happened at all.

I need this because I don’t want to serve anything HTTP and so I don’t want the HTTP server to be in my way. ZNC may not be able to distinguish IRC vs HTTP until at least some data data got communicated, but at some point it knows the client want HTTP instead of IRC then right? I don’t see why it wouldn’t be feasible to make ZNC not respond anything at this point. You’re coming to me saying your a client. I acknowledge you and I don’t know what you want yet. Then you’re going to tell me you want HTTP. I’m going to ignore you, pretend I didn’t hear anything and that this event never happened at all.

adam commented

2026-10-05 04:57:44 +02:00

I don’t want to serve anything HTTP and so I don’t want the HTTP server to be in my way.

Why?

pretend I didn’t hear anything and that this event never happened at all.

accept() and SSL handshake happened already, you can't undo them.

I don’t see why it wouldn’t be feasible to make ZNC not respond anything at this point.

You can patch it to close the socket instead of returning HTTP error.

> I don’t want to serve anything HTTP and so I don’t want the HTTP server to be in my way. Why? > pretend I didn’t hear anything and that this event never happened at all. accept() and SSL handshake happened already, you can't undo them. > I don’t see why it wouldn’t be feasible to make ZNC not respond anything at this point. You can patch it to close the socket instead of returning HTTP error.

adam commented

2026-10-05 04:57:45 +02:00

God please make an effort to not be a huge freaking pain in the ass. You don’t have to care about why I want something. If I want something it’s for a good reason and I’ve been writing about it since my first message.

I can’t undo handshakes because I’m not a freaking magic time traveling wizard good job smartass did you figured that out yourself?

Now just tell me how to close the damn socket so I can flag this issue as closed and move on to something more productive than having to interact with an antisocial edgelord who can’t go straight to the point.

God please make an effort to not be a huge freaking pain in the ass. You don’t have to care about why I want something. If I want something it’s for a good reason and I’ve been writing about it since my first message. I can’t undo handshakes because I’m not a freaking magic time traveling wizard good job smartass did you figured that out yourself? Now just tell me how to close the damn socket so I can flag this issue as closed and move on to something more productive than having to interact with an antisocial edgelord who can’t go straight to the point.

adam commented

2026-10-05 04:57:46 +02:00

God please make an effort to not be a huge freaking pain in the ass.

Great way to request a feature. Or not.

You don’t have to care about why I want something.

Yes, I do. Without a good reason, I won't change this in the code.

I can’t undo handshakes because I’m not a freaking magic time traveling wizard

That's what I'm trying to tell you since the first message.

did you figured that out yourself?

I thought it's pretty obvious, but apparently it was not, therefore I had to say it directly.

smartass

Oh, insults will help your cause for sure.

Now just tell me how to close the damn socket

I'm sure google search will help you.

> God please make an effort to not be a huge freaking pain in the ass. Great way to request a feature. Or not. > You don’t have to care about why I want something. Yes, I do. Without a good reason, I won't change this in the code. > I can’t undo handshakes because I’m not a freaking magic time traveling wizard That's what I'm trying to tell you since the first message. > did you figured that out yourself? I thought it's pretty obvious, but apparently it was not, therefore I had to say it directly. > smartass Oh, insults will help your cause for sure. > Now just tell me how to close the damn socket I'm sure google search will help you.

adam commented

2026-10-05 04:57:46 +02:00

Here's one more link for you to read: https://en.wikipedia.org/wiki/XY_problem

Here's one more link for you to read: https://en.wikipedia.org/wiki/XY_problem

adam commented

2026-10-05 04:57:47 +02:00

I can’t undo handshakes because I’m not a freaking magic time traveling wizard

That's what I'm trying to tell you since the first message.

If you want someone to understand something, you can tell it straight away you know? Tell me, how hard would have it been to write from the start : "you can’t do exactly the behaviour you want because there are handshakes happening and you cannot make them not happen. However, instead you could either return an HTTP error or just simply close the socket. Here is where you should look into if you want to add this feature"

But you had to play your little game of being a smug winnie for no apparent reason.

> > I can’t undo handshakes because I’m not a freaking magic time traveling wizard > > That's what I'm trying to tell you since the first message. If you want someone to understand something, you can tell it straight away you know? Tell me, how hard would have it been to write from the start : "you can’t do exactly the behaviour you want because there are handshakes happening and you cannot make them not happen. However, instead you could either return an HTTP error or just simply close the socket. Here is where you should look into if you want to add this feature" But you had to play your little game of being a smug winnie for no apparent reason.

adam commented

2026-10-05 04:57:48 +02:00

I did.

And SSL handshake happens even before

So no, "Unable to connect" can't be done.

I did. > And SSL handshake happens even before > So no, "Unable to connect" can't be done.

adam commented

2026-10-05 04:57:48 +02:00

No you didn’t.

You just told facts here and there, without any intention to go out of your way to help me understand the blind spots I have in my understanding. It took one day of back and forth reformulations to get to a single piece of possible solution : apparently, I could make ZNC close a socket.

You didn’t take the time to show me how my reasoning doesn’t comply with how protocols are supposed to work, you didn’t explain how to change my reasoning to find a middle ground between knowing what’s possible and not possible and being satisfied with a behaviour that meets my need, and you didn’t even try to guide me towards the parts of ZNC that would need to be patched if this was something that wouldn’t introduce breaking changes.

As of right now, I am still figuring out the whole timeline of events between ZNC and a http client. Here is something you would find dead obvious : how an SSL handshake can’t lead to a browser telling its user they were unable to connect to the website? This isn’t a call for help by the way. It has been a day since I knew I would have to do and understand everything by myself, way before we got to here.

Facts are not the sole metric in a conversation. You’re intent will show. You felt dismissive.

No you didn’t. You just told facts here and there, without any intention to go out of your way to help me understand the blind spots I have in my understanding. It took one day of back and forth reformulations to get to a single piece of possible solution : apparently, I could make ZNC close a socket. You didn’t take the time to show me how my reasoning doesn’t comply with how protocols are supposed to work, you didn’t explain how to change my reasoning to find a middle ground between knowing what’s possible and not possible and being satisfied with a behaviour that meets my need, and you didn’t even try to guide me towards the parts of ZNC that would need to be patched if this was something that wouldn’t introduce breaking changes. As of right now, I am still figuring out the whole timeline of events between ZNC and a http client. Here is something you would find dead obvious : how an SSL handshake can’t lead to a browser telling its user they were unable to connect to the website? This isn’t a call for help by the way. It has been a day since I knew I would have to do and understand everything by myself, way before we got to here. Facts are not the sole metric in a conversation. You’re intent will show. You felt dismissive.

adam commented

2026-10-05 04:57:49 +02:00

to go out of your way

Why would I do that? First, I need to understand what you're actually trying to do, before showing you the direction: otherwise the direction I show would be completely wrong. But you're refusing to answer my questions! Again, please read about the XY problem I linked above.

understand the blind spots I have in my understanding

How am I supposed to know what parts of protocols you know and what parts you don't know? Do you expect me to teach you the whole computer science from "2+2=4", or? The two facts "And SSL handshake happens even before" and "So no, "Unable to connect" can't be done." imply that you obviously can't go back in time. Or I should expect that you don't know physics and also teach you that?

you didn’t even try to guide me towards the parts of ZNC that would need to be patched

You think the correct answer always is a patch? Wrong!

The first step is to figure out what you actually want. Then show you the existing configuration option (or e.g. a module) to do what you want. Then, if there's no such opiton, a patch, and not just on your side, but in upstream ZNC, so that it benefits everyone, not just you. Of course, if this is useful at all.

> to go out of your way Why would I do that? First, I need to understand what you're actually trying to do, before showing you the direction: otherwise the direction I show would be completely wrong. But you're refusing to answer my questions! Again, please read about the XY problem I linked above. > understand the blind spots I have in my understanding How am I supposed to know what parts of protocols you know and what parts you don't know? Do you expect me to teach you the whole computer science from "2+2=4", or? The two facts "And SSL handshake happens even before" and "So no, "Unable to connect" can't be done." imply that you obviously can't go back in time. Or I should expect that you don't know physics and also teach you that? > you didn’t even try to guide me towards the parts of ZNC that would need to be patched You think the correct answer always is a patch? Wrong! The first step is to figure out what you actually want. Then show you the existing configuration option (or e.g. a module) to do what you want. Then, if there's no such opiton, a patch, and not just on your side, but in upstream ZNC, so that it benefits everyone, not just you. Of course, if this is useful at all.

adam commented

2026-10-05 04:57:50 +02:00

I'm also not sure what exactly you are trying to achieve. Also, I don't think you deserve more help than DG already tried to provide. But okay....

It seems like you want some kind of error message in your web browser. As you already heard, the error that you wanted to get is not possible, because the internet does not work that way. If you want an "connection closed unexpectedly" error message, you can just remove the call to Write() here:
https://github.com/znc/znc/blob/e0ffdddd473e97cb843f2bc8ad4fa16cf47c65b4/src/Listener.cpp#L149-L151
If you want another kind of error message, you can try replacing this with Write("this is definitely not http\n");. No idea how browsers react to that, but perhaps one of these two options solves the problem you are actually trying to solve.

I subscribed to your issue in the mlemnc repository. I might or might not write more answers there, in case you write some questions.

Edit:

You didn’t take the time

Why would DG have to take the time? As far as I know, this is a hobby of theirs and there are no reasons why you get to dictate how people spend their free time.

I'm also not sure what exactly you are trying to achieve. Also, I don't think you deserve more help than DG already tried to provide. But okay.... It *seems* like you want some kind of error message in your web browser. As you already heard, the error that you wanted to get is not possible, because the internet does not work that way. If you want an "connection closed unexpectedly" error message, you can just remove the call to `Write()` here: https://github.com/znc/znc/blob/e0ffdddd473e97cb843f2bc8ad4fa16cf47c65b4/src/Listener.cpp#L149-L151 If you want another kind of error message, you can try replacing this with `Write("this is definitely not http\n");`. No idea how browsers react to that, but perhaps one of these two options solves the problem you are actually trying to solve. I subscribed to your issue in the mlemnc repository. I might or might not write more answers there, in case you write some questions. Edit: > You didn’t take the time Why would DG have to take the time? As far as I know, this is a hobby of theirs and there are no reasons why you get to dictate how people spend their free time.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#997