mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 03:57:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

fix: Config.InsecureSkipTimeVerify did not skip peerCertificate expiry check

Browse source
This commit is contained in:
Amir Khan 2024-07-15 13:06:57 -04:00
parent 925bfb39ab
commit 7409f6f17c
1 changed files with 9 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

22
handshake_client.go
View file

@ -368,25 +368,21 @@ func (c *Conn) loadSession(hello *clientHelloMsg) (
// Check that the cached server certificate is not expired, and that it's
// valid for the ServerName. This should be ensured by the cache key, but
// protect the application from a faulty ClientSessionCache implementation.
if c.config.time().After(session.peerCertificates[0].NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return nil, nil, nil, nil
// [UTLS SECTION START]
if !c.config.InsecureSkipTimeVerify {
if c.config.time().After(session.peerCertificates[0].NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return nil, nil, nil, nil
}
}
// [UTLS SECTION END]
if !c.config.InsecureSkipVerify {
if len(session.verifiedChains) == 0 {
// The original connection had InsecureSkipVerify, while this doesn't.
return nil, nil, nil, nil
}
serverCert := session.peerCertificates[0]
// [UTLS SECTION START]
if !c.config.InsecureSkipTimeVerify {
if c.config.time().After(serverCert.NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return nil, nil, nil, nil
}
}
var dnsName string
if len(c.config.InsecureServerNameToVerify) == 0 {
dnsName = c.config.ServerName
@ -394,7 +390,7 @@ func (c *Conn) loadSession(hello *clientHelloMsg) (
dnsName = c.config.InsecureServerNameToVerify
}
if len(dnsName) > 0 {
if err := serverCert.VerifyHostname(dnsName); err != nil {
if err := session.peerCertificates[0].VerifyHostname(dnsName); err != nil {
return nil, nil, nil, nil
}
}