clash/component/tls/config.go

136 lines
3.6 KiB
Go
Raw Normal View History

2022-07-10 12:44:24 +00:00
package tls
import (
"bytes"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"encoding/hex"
"errors"
2022-07-10 12:44:24 +00:00
"fmt"
"strings"
2022-07-10 12:44:24 +00:00
"sync"
CN "github.com/Dreamacro/clash/common/net"
xtls "github.com/xtls/go"
2022-07-10 12:44:24 +00:00
)
var tlsCertificates = make([]tls.Certificate, 0)
2022-07-10 12:44:24 +00:00
var mutex sync.RWMutex
var errNotMacth error = errors.New("certificate fingerprints do not match")
2022-07-10 12:44:24 +00:00
func AddCertificate(privateKey, certificate string) error {
mutex.Lock()
defer mutex.Unlock()
if cert, err := CN.ParseCert(certificate, privateKey); err != nil {
return err
} else {
tlsCertificates = append(tlsCertificates, cert)
}
return nil
}
func GetCertificates() []tls.Certificate {
mutex.RLock()
defer mutex.RUnlock()
return tlsCertificates
}
func verifyFingerprint(fingerprint *[32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
// ssl pining
for i := range rawCerts {
rawCert := rawCerts[i]
cert, err := x509.ParseCertificate(rawCert)
if err == nil {
hash := sha256.Sum256(cert.Raw)
if bytes.Equal(fingerprint[:], hash[:]) {
return nil
}
2022-07-10 12:44:24 +00:00
}
}
return errNotMacth
}
2022-07-10 12:44:24 +00:00
}
func convertFingerprint(fingerprint string) (*[32]byte, error) {
fingerprint = strings.TrimSpace(strings.Replace(fingerprint, ":", "", -1))
2022-07-11 05:44:27 +00:00
fpByte, err := hex.DecodeString(fingerprint)
2022-07-10 12:44:24 +00:00
if err != nil {
return nil, err
2022-07-10 12:44:24 +00:00
}
if len(fpByte) != 32 {
return nil, fmt.Errorf("fingerprint string length error,need sha256 fingerprint")
2022-07-10 12:44:24 +00:00
}
return (*[32]byte)(fpByte), nil
2022-07-10 12:44:24 +00:00
}
func GetDefaultTLSConfig() *tls.Config {
return GetGlobalTLSConfig(nil)
}
2022-07-11 05:42:28 +00:00
// GetSpecifiedFingerprintTLSConfig specified fingerprint
func GetSpecifiedFingerprintTLSConfig(tlsConfig *tls.Config, fingerprint string) (*tls.Config, error) {
if fingerprintBytes, err := convertFingerprint(fingerprint); err != nil {
return nil, err
} else {
tlsConfig = GetGlobalTLSConfig(tlsConfig)
tlsConfig.VerifyPeerCertificate = verifyFingerprint(fingerprintBytes)
tlsConfig.InsecureSkipVerify = true
return tlsConfig, nil
}
2022-07-10 12:44:24 +00:00
}
func GetGlobalTLSConfig(tlsConfig *tls.Config) *tls.Config {
2022-07-10 12:44:24 +00:00
if tlsConfig == nil {
2022-07-11 04:37:27 +00:00
return &tls.Config{
Certificates: tlsCertificates,
2022-07-11 04:37:27 +00:00
}
2022-07-10 12:44:24 +00:00
}
tlsConfig.Certificates = append(tlsConfig.Certificates, tlsCertificates...)
2022-07-10 12:44:24 +00:00
return tlsConfig
}
2022-07-11 05:42:28 +00:00
// GetSpecifiedFingerprintXTLSConfig specified fingerprint
func GetSpecifiedFingerprintXTLSConfig(tlsConfig *xtls.Config, fingerprint string) (*xtls.Config, error) {
if fingerprintBytes, err := convertFingerprint(fingerprint); err != nil {
return nil, err
} else {
tlsConfig = GetGlobalXTLSConfig(tlsConfig)
tlsConfig.VerifyPeerCertificate = verifyFingerprint(fingerprintBytes)
tlsConfig.InsecureSkipVerify = true
return tlsConfig, nil
2022-07-11 05:42:28 +00:00
}
}
func GetGlobalXTLSConfig(tlsConfig *xtls.Config) *xtls.Config {
xtlsCerts := make([]xtls.Certificate, len(tlsCertificates))
for _, cert := range tlsCertificates {
tlsSsaList := make([]xtls.SignatureScheme, len(cert.SupportedSignatureAlgorithms))
for _, ssa := range cert.SupportedSignatureAlgorithms {
tlsSsa := xtls.SignatureScheme(ssa)
tlsSsaList = append(tlsSsaList, tlsSsa)
}
xtlsCert := xtls.Certificate{
Certificate: cert.Certificate,
PrivateKey: cert.PrivateKey,
OCSPStaple: cert.OCSPStaple,
SignedCertificateTimestamps: cert.SignedCertificateTimestamps,
Leaf: cert.Leaf,
SupportedSignatureAlgorithms: tlsSsaList,
}
xtlsCerts = append(xtlsCerts, xtlsCert)
}
2022-07-11 05:42:28 +00:00
if tlsConfig == nil {
return &xtls.Config{
Certificates: xtlsCerts,
2022-07-11 05:42:28 +00:00
}
}
tlsConfig.Certificates = xtlsCerts
2022-07-11 05:42:28 +00:00
return tlsConfig
}