mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

add InsecureSkipServerNameVerify to tls.Config (#158)

Browse source 
* add InsecureSkipServerNameVerify to tls.Config

* Support clone InsecureSkipServerNameVerify, update error message
This commit is contained in:
TNQOYxNU 2023-02-04 21:10:59 +00:00 • committed by GitHub
parent a3b55c90c4
commit d139a4a652
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 55 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

15
handshake_client.go
View file

@ -40,9 +40,13 @@ var testingOnlyForceClientHelloSignatureAlgorithms []SignatureScheme
func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
config := c.config
if len(config.ServerName) == 0 && !config.InsecureSkipVerify {
return nil, nil, errors.New("tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config")
// [UTLS SECTION START]
skipServerNameVerify := config.InsecureSkipVerify || config.InsecureSkipServerNameVerify
if len(config.ServerName) == 0 && !skipServerNameVerify {
return nil, nil, errors.New("tls: at least one of ServerName, InsecureSkipVerify or InsecureSkipServerNameVerify must be specified in the tls.Config")
}
// [UTLS SECTION END]
nextProtosLength := 0
for _, proto := range config.NextProtos {
@ -874,13 +878,18 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error {
}
if !c.config.InsecureSkipVerify {
// [UTLS SECTION START]
opts := x509.VerifyOptions{
Roots: c.config.RootCAs,
CurrentTime: c.config.time(),
DNSName: c.config.ServerName,
Intermediates: x509.NewCertPool(),
}
if !c.config.InsecureSkipServerNameVerify {
opts.DNSName = c.config.ServerName
}
// [UTLS SECTION END]
for _, cert := range certs[1:] {
opts.Intermediates.AddCert(cert)
}