clash/component/tls/config.go

123 lines
2.7 KiB
Go
Raw Normal View History

2022-07-10 12:44:24 +00:00
package tls
import (
"bytes"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"encoding/hex"
"errors"
2022-07-10 12:44:24 +00:00
"fmt"
"strings"
2022-07-10 12:44:24 +00:00
"sync"
)
2023-03-27 14:27:59 +00:00
var trustCerts []*x509.Certificate
var certPool *x509.CertPool
var mutex sync.RWMutex
var errNotMatch = errors.New("certificate fingerprints do not match")
2022-07-10 12:44:24 +00:00
2023-02-25 14:01:20 +00:00
func AddCertificate(certificate string) error {
mutex.Lock()
defer mutex.Unlock()
2023-02-25 14:01:20 +00:00
if certificate == "" {
return fmt.Errorf("certificate is empty")
}
2023-03-27 14:27:59 +00:00
if cert, err := x509.ParseCertificate([]byte(certificate)); err == nil {
trustCerts = append(trustCerts, cert)
return nil
} else {
2023-02-25 14:01:20 +00:00
return fmt.Errorf("add certificate failed")
}
}
func initializeCertPool() {
var err error
certPool, err = x509.SystemCertPool()
if err != nil {
certPool = x509.NewCertPool()
}
for _, cert := range trustCerts {
certPool.AddCert(cert)
}
}
2023-02-26 12:38:32 +00:00
func ResetCertificate() {
2023-02-25 14:01:20 +00:00
mutex.Lock()
defer mutex.Unlock()
2023-03-27 14:27:59 +00:00
trustCerts = nil
initializeCertPool()
2023-03-27 14:27:59 +00:00
}
func getCertPool() *x509.CertPool {
if len(trustCerts) == 0 {
return nil
}
if certPool == nil {
mutex.Lock()
defer mutex.Unlock()
if certPool != nil {
return certPool
}
initializeCertPool()
2023-03-27 14:27:59 +00:00
}
return certPool
}
func verifyFingerprint(fingerprint *[32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
// ssl pining
for i := range rawCerts {
rawCert := rawCerts[i]
cert, err := x509.ParseCertificate(rawCert)
if err == nil {
hash := sha256.Sum256(cert.Raw)
if bytes.Equal(fingerprint[:], hash[:]) {
return nil
}
2022-07-10 12:44:24 +00:00
}
}
return errNotMatch
}
2022-07-10 12:44:24 +00:00
}
func convertFingerprint(fingerprint string) (*[32]byte, error) {
fingerprint = strings.TrimSpace(strings.Replace(fingerprint, ":", "", -1))
2022-07-11 05:44:27 +00:00
fpByte, err := hex.DecodeString(fingerprint)
2022-07-10 12:44:24 +00:00
if err != nil {
return nil, err
2022-07-10 12:44:24 +00:00
}
if len(fpByte) != 32 {
return nil, fmt.Errorf("fingerprint string length error,need sha256 fingerprint")
2022-07-10 12:44:24 +00:00
}
return (*[32]byte)(fpByte), nil
2022-07-10 12:44:24 +00:00
}
func GetDefaultTLSConfig() *tls.Config {
return GetGlobalTLSConfig(nil)
}
2022-07-11 05:42:28 +00:00
// GetSpecifiedFingerprintTLSConfig specified fingerprint
func GetSpecifiedFingerprintTLSConfig(tlsConfig *tls.Config, fingerprint string) (*tls.Config, error) {
if fingerprintBytes, err := convertFingerprint(fingerprint); err != nil {
return nil, err
} else {
tlsConfig = GetGlobalTLSConfig(tlsConfig)
tlsConfig.VerifyPeerCertificate = verifyFingerprint(fingerprintBytes)
tlsConfig.InsecureSkipVerify = true
return tlsConfig, nil
}
2022-07-10 12:44:24 +00:00
}
func GetGlobalTLSConfig(tlsConfig *tls.Config) *tls.Config {
2023-03-27 14:27:59 +00:00
certPool := getCertPool()
2022-07-10 12:44:24 +00:00
if tlsConfig == nil {
2022-07-11 04:37:27 +00:00
return &tls.Config{
2023-03-27 14:27:59 +00:00
RootCAs: certPool,
2022-07-11 04:37:27 +00:00
}
2022-07-10 12:44:24 +00:00
}
2023-03-27 14:27:59 +00:00
tlsConfig.RootCAs = certPool
2022-07-10 12:44:24 +00:00
return tlsConfig
}