lzhr
/
v2fly
mirror of https://github.com/v2fly/v2ray-core.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fix TLS Client Certificate Verify Not Applied

This commit is contained in:
Shelikhoo 2022-05-03 15:23:33 +01:00
parent c93ad2fc1c
commit 52ea2b0146
No known key found for this signature in database
GPG Key ID: C4D5E79D22B25316
3 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
transport/internet/tls/config.go
View File

@ -30,11 +30,13 @@ func ParseCertificate(c *cert.Certificate) *Certificate {
return nil return nil
} }
func (c *Config) loadSelfCertPool() (*x509.CertPool, error) { func (c *Config) loadSelfCertPool(usage Certificate_Usage) (*x509.CertPool, error) {
root := x509.NewCertPool() root := x509.NewCertPool()
for _, cert := range c.Certificate { for _, cert := range c.Certificate {
if !root.AppendCertsFromPEM(cert.Certificate) { if cert.Usage == usage {
return nil, newError("failed to append cert").AtWarning() if !root.AppendCertsFromPEM(cert.Certificate) {
return nil, newError("failed to append cert").AtWarning()
}
} }
} }
return root, nil return root, nil
@ -209,6 +211,11 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
} }
} }
clientRoot, err := c.loadSelfCertPool(Certificate_AUTHORITY_VERIFY_CLIENT)
if err != nil {
newError("failed to load client root certificate").AtError().Base(err).WriteToLog()
}
config := &tls.Config{ config := &tls.Config{
ClientSessionCache: globalSessionCache, ClientSessionCache: globalSessionCache,
RootCAs: root, RootCAs: root,
@ -216,6 +223,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
NextProtos: c.NextProtocol, NextProtos: c.NextProtocol,
SessionTicketsDisabled: !c.EnableSessionResumption, SessionTicketsDisabled: !c.EnableSessionResumption,
VerifyPeerCertificate: c.verifyPeerCert, VerifyPeerCertificate: c.verifyPeerCert,
ClientCAs: clientRoot,
} }
for _, opt := range opts { for _, opt := range opts {
@ -238,6 +246,9 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
config.NextProtos = []string{"h2", "http/1.1"} config.NextProtos = []string{"h2", "http/1.1"}
} }
if c.VerifyClientCertificate {
config.ClientAuth = tls.RequireAndVerifyClientCert
}
return config return config
} }

2
transport/internet/tls/config_other.go
View File

@ -33,7 +33,7 @@ var rootCerts rootCertsCache
func (c *Config) getCertPool() (*x509.CertPool, error) { func (c *Config) getCertPool() (*x509.CertPool, error) {
if c.DisableSystemRoot { if c.DisableSystemRoot {
return c.loadSelfCertPool() return c.loadSelfCertPool(Certificate_AUTHORITY_VERIFY)
} }
if len(c.Certificate) == 0 { if len(c.Certificate) == 0 {

2
transport/internet/tls/config_windows.go
View File

@ -7,7 +7,7 @@ import "crypto/x509"
func (c *Config) getCertPool() (*x509.CertPool, error) { func (c *Config) getCertPool() (*x509.CertPool, error) {
if c.DisableSystemRoot { if c.DisableSystemRoot {
return c.loadSelfCertPool() return c.loadSelfCertPool(Certificate_AUTHORITY_VERIFY)
} }
return nil, nil return nil, nil