Websocket connection hostname check

Question

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. If I change Burp options to generate a "CA-signed cert with a specific hostname" during the normal operation, all the rest requests generate a connection error (due to hostname verification failure) but the websocket keeps working fine. I am not familiar with websocket internals. Is it normal for a websocket or is it a bug?

Does the websocket protocol check for the host name only on start or is it controlled for each message? I cannot start the app with custom hostname configuration because the initial rest requests will fail and the web socket connection phase will never be reached.

Edit: These are my test steps:

1. The app is a native Android app and all the traffic is encrypted using TLS. App uses both rest/http requests and websocket messages.

2. I installed Burp CA to the device.

3. I opened Burp with default settings and configured Android phone to use Burp as proxy server.
4. I started the Android app and used it for a few minutes. I can see HTTP traffic under Proxy->HTTP history tab and websocket messages under Websocket History tab.
5. Then without closing the app, I go to Burp Proxy->Options tab, on Proxy Listeners field select the active interface, click on edit, move to Certificate tab. On tthis window I select Generate a CA-signed vertificate with a specific hostname and set the hostname to foo.bar.

6. I continue to use the app wtih this setting. From this point forward all the rest requests generate an error, both on UI and Alerts tab of Burp. But websocket keeps working. I can intercept the messages and edit them.

The questions are:

q1. is this the intended behaviour or a bug?

q2. If this is supposed to happen because the ws connection checks the certificate only at initial setup, can an active attacker mitm my web socket traffic? For example after the connection is made, if the app is presented a trusted certificate like nsa.com, can nsa read the messages?

Answer 1

WebSockets are an upgrade of a HTTP request: they start with a "normal" HTTP request containing an Upgrade header field and after the server send a matching response the connection switches from HTTP to the WebSockets protocol. The WebSockets protocol itself does not contain any verification of the peer, including no verification of the hostname. Thus any such verification need to be done at the HTTP level (there is none on the client side) or in case of HTTPS/WSS at the TLS level.

Does the websocket protocol check for the host name only on start or is it controlled for each request?

Based on the information above there is no client-side hostname check for ws:// and there is only the check at the TLS level for wss://, i.e. the same check which is done for HTTPS. These checks are only done at the beginning of the TCP connection - there is no "requests" in WebSockets but there are only messages (i.e. no one response matching one request as in HTTP).

Is it normal for a websocket or is it a bug?

It is not clear what exactly is going on but it might simply that ws:// is used and not wss://. Only wss:// contains the hostname check (during TLS handshake).