mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-05 04:57:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

fix: Config.InsecureSkipTimeVerify did not skip peerCertificate expiry check

Browse source
This commit is contained in:
Amir Khan 2024-07-15 13:06:57 -04:00
parent 925bfb39ab
commit 7409f6f17c
1 changed files with 9 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

22
handshake_client.go
View file

@ -368,25 +368,21 @@ func (c *Conn) loadSession(hello *clientHelloMsg) (
// Check that the cached server certificate is not expired, and that it's // Check that the cached server certificate is not expired, and that it's
// valid for the ServerName. This should be ensured by the cache key, but // valid for the ServerName. This should be ensured by the cache key, but
// protect the application from a faulty ClientSessionCache implementation. // protect the application from a faulty ClientSessionCache implementation.
if c.config.time().After(session.peerCertificates[0].NotAfter) { // [UTLS SECTION START]
// Expired certificate, delete the entry. if !c.config.InsecureSkipTimeVerify {
c.config.ClientSessionCache.Put(cacheKey, nil) if c.config.time().After(session.peerCertificates[0].NotAfter) {
return nil, nil, nil, nil // Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return nil, nil, nil, nil
}
} }
// [UTLS SECTION END]
if !c.config.InsecureSkipVerify { if !c.config.InsecureSkipVerify {
if len(session.verifiedChains) == 0 { if len(session.verifiedChains) == 0 {
// The original connection had InsecureSkipVerify, while this doesn't. // The original connection had InsecureSkipVerify, while this doesn't.
return nil, nil, nil, nil return nil, nil, nil, nil
} }
serverCert := session.peerCertificates[0]
// [UTLS SECTION START] // [UTLS SECTION START]
if !c.config.InsecureSkipTimeVerify {
if c.config.time().After(serverCert.NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return nil, nil, nil, nil
}
}
var dnsName string var dnsName string
if len(c.config.InsecureServerNameToVerify) == 0 { if len(c.config.InsecureServerNameToVerify) == 0 {
dnsName = c.config.ServerName dnsName = c.config.ServerName
@ -394,7 +390,7 @@ func (c *Conn) loadSession(hello *clientHelloMsg) (
dnsName = c.config.InsecureServerNameToVerify dnsName = c.config.InsecureServerNameToVerify
} }
if len(dnsName) > 0 { if len(dnsName) > 0 {
if err := serverCert.VerifyHostname(dnsName); err != nil { if err := session.peerCertificates[0].VerifyHostname(dnsName); err != nil {
return nil, nil, nil, nil return nil, nil, nil, nil
} }
} }