chunyu/sing-box
1
0
Fork 0
mirror of https://github.com/SagerNet/sing-box.git synced 2025-07-22 05:54:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix disable_sni not working with custom RootCAs

Browse Source
This commit is contained in:
dyhkwong 2025-07-21 19:22:43 +08:00 committed by GitHub
parent 837f6c44c2
commit d71952d81f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/tls/std_client.go
View File

@ -86,6 +86,8 @@ func NewSTDClient(ctx context.Context, serverAddress string, options option.Outb
tlsConfig.InsecureSkipVerify = true
tlsConfig.VerifyConnection = func(state tls.ConnectionState) error {
verifyOptions := x509.VerifyOptions{
Roots: tlsConfig.RootCAs,
CurrentTime: tlsConfig.Time(),
DNSName: serverName,
Intermediates: x509.NewCertPool(),
}

9
common/tls/utls_client.go
View File

@ -145,11 +145,16 @@ func NewUTLSClient(ctx context.Context, serverAddress string, options option.Out
var tlsConfig utls.Config
tlsConfig.Time = ntp.TimeFuncFromContext(ctx)
tlsConfig.RootCAs = adapter.RootPoolFromContext(ctx)
tlsConfig.ServerName = serverName
if !options.DisableSNI {
tlsConfig.ServerName = serverName
}
if options.Insecure {
tlsConfig.InsecureSkipVerify = options.Insecure
} else if options.DisableSNI {
return nil, E.New("disable_sni is unsupported in uTLS")
if options.Reality != nil && options.Reality.Enabled {
return nil, E.New("disable_sni is unsupported in reality")
}
tlsConfig.InsecureServerNameToVerify = serverName
}
if len(options.ALPN) > 0 {
tlsConfig.NextProtos = options.ALPN