hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-10-11 10:05:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

MASQUE client: Ignore publicKey in warp when pcs/vcn exists (domain fronting for WARP)

Browse Source 
Closes https://github.com/XTLS/Xray-core/issues/7115#issuecomment-6088708005
This commit is contained in:
RPRX
2026-10-10 06:56:57 +00:00
parent 2cc08769a5
commit aa7aa9ad0a
1 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
transport/internet/masque/warp.go
+18 -18
View File
@@ -54,25 +54,25 @@ func useWarp(config *Config, tlsConfig *gotls.Config) error {
tlsConfig.GetClientCertificate = func(*gotls.CertificateRequestInfo) (*gotls.Certificate, error) {
return cert, nil
}
if publicKey := config.Warp.PublicKey; len(publicKey) > 0 {
verify := tlsConfig.VerifyPeerCertificate
tlsConfig.InsecureSkipVerify = true
tlsConfig.VerifyPeerCertificate = func(raw [][]byte, chains [][]*x509.Certificate) error {
if len(raw) == 0 {
return errors.New("the WARP endpoint sent no certificate")
}
leaf, err := x509.ParseCertificate(raw[0])
if err != nil {
return err
}
if !bytes.Equal(leaf.RawSubjectPublicKeyInfo, publicKey) {
return errors.New("the WARP endpoint's key doesn't match \"publicKey\"")
}
if verify != nil {
return verify(raw, chains)
}
return nil
if tlsConfig.InsecureSkipVerify == true {
return nil // pcs or vcn or both
}
if _, err = x509.ParsePKIXPublicKey(config.Warp.PublicKey); err != nil {
return err
}
tlsConfig.InsecureSkipVerify = true
tlsConfig.VerifyPeerCertificate = func(raw [][]byte, chains [][]*x509.Certificate) error {
if len(raw) == 0 {
return errors.New("the WARP endpoint sent no certificate")
}
leaf, err := x509.ParseCertificate(raw[0])
if err != nil {
return err
}
if !bytes.Equal(leaf.RawSubjectPublicKeyInfo, config.Warp.PublicKey) {
return errors.New("the WARP endpoint's key doesn't match \"publicKey\"")
}
return nil
}
return nil
}