mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

add InsecureSkipTimeVerify

Browse source
This commit is contained in:
molon 2023-03-11 17:30:16 +08:00
parent dae72adb81
commit 7973961f55
3 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
common.go
View file

@ -656,6 +656,14 @@ type Config struct {
// testing or in combination with VerifyConnection or VerifyPeerCertificate.
InsecureSkipVerify bool
// InsecureSkipTimeVerify is used to verify the time on the returned
// certificates.
// If InsecureSkipTimeVerify true, crypto/tls will do normal
// certificate validation but ignore certifacate's time.
//
// This field is ignored when InsecureSkipVerify is true.
InsecureSkipTimeVerify bool // [uTLS]
// InsecureServerNameToVerify is used to verify the hostname on the returned
// certificates. It is intended to use with spoofed ServerName.
// If InsecureServerNameToVerify is "*", crypto/tls will do normal
@ -821,6 +829,7 @@ func (c *Config) Clone() *Config {
ClientAuth: c.ClientAuth,
ClientCAs: c.ClientCAs,
InsecureSkipVerify: c.InsecureSkipVerify,
InsecureSkipTimeVerify: c.InsecureSkipTimeVerify,
InsecureServerNameToVerify: c.InsecureServerNameToVerify,
CipherSuites: c.CipherSuites,
PreferServerCipherSuites: c.PreferServerCipherSuites,

17
handshake_client.go
View file

@ -303,10 +303,12 @@ func (c *Conn) loadSession(hello *clientHelloMsg) (cacheKey string,
return cacheKey, nil, nil, nil, nil
}
serverCert := session.serverCertificates[0]
if c.config.time().After(serverCert.NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return cacheKey, nil, nil, nil, nil
if !c.config.InsecureSkipTimeVerify {
if c.config.time().After(serverCert.NotAfter) {
// Expired certificate, delete the entry.
c.config.ClientSessionCache.Put(cacheKey, nil)
return cacheKey, nil, nil, nil, nil
}
}
if err := serverCert.VerifyHostname(c.config.ServerName); err != nil {
return cacheKey, nil, nil, nil, nil
@ -891,10 +893,15 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error {
// [UTLS SECTION START]
opts := x509.VerifyOptions{
Roots: c.config.RootCAs,
CurrentTime: c.config.time(),
Intermediates: x509.NewCertPool(),
}
if c.config.InsecureSkipTimeVerify {
opts.CurrentTime = certs[0].NotAfter
} else {
opts.CurrentTime = c.config.time()
}
if len(c.config.InsecureServerNameToVerify) == 0 {
opts.DNSName = c.config.ServerName
} else if c.config.InsecureServerNameToVerify != "*" {

2
tls_test.go
View file

@ -814,7 +814,7 @@ func TestCloneNonFuncFields(t *testing.T) {
f.Set(reflect.ValueOf("b"))
case "ClientAuth":
f.Set(reflect.ValueOf(VerifyClientCertIfGiven))
case "InsecureSkipVerify", "SessionTicketsDisabled", "DynamicRecordSizingDisabled", "PreferServerCipherSuites":
case "InsecureSkipVerify", "InsecureSkipTimeVerify", "SessionTicketsDisabled", "DynamicRecordSizingDisabled", "PreferServerCipherSuites":
f.Set(reflect.ValueOf(true))
case "InsecureServerNameToVerify":
f.Set(reflect.ValueOf("c"))