Alex-Devera/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-06-05 12:44:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(node): capture node cert via VerifyConnection for fingerprint fetch

Browse source 
FetchCertFingerprint read the leaf certificate from a bare insecure TLS
handshake, which CodeQL flagged as go/disabled-certificate-check. The
function intentionally accepts any cert (trust-on-first-use, so the admin
can pin a not-yet-trusted node), so verification cannot be enabled.

Capture the leaf cert inside a VerifyConnection callback instead, matching
the existing pattern in nodeHTTPClientFor that already clears the same
query. Behavior is unchanged.
This commit is contained in:
MHSanaei 2026-06-02 03:09:33 +02:00
parent 87f446fe22
commit d2dc589f14
No known key found for this signature in database
GPG key ID: 7E4060F2FBE5AB7A
1 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
web/service/node.go
View file

@ -136,10 +136,20 @@ func (s *NodeService) FetchCertFingerprint(ctx context.Context, n *model.Node) (
if err != nil { if err != nil {
return "", err return "", err
} }
var fingerprint string
client := &http.Client{ client := &http.Client{
Transport: &http.Transport{ Transport: &http.Transport{
DialContext: netsafe.SSRFGuardedDialContext, DialContext: netsafe.SSRFGuardedDialContext,
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
VerifyConnection: func(cs tls.ConnectionState) error {
if len(cs.PeerCertificates) > 0 {
sum := sha256.Sum256(cs.PeerCertificates[0].Raw)
fingerprint = base64.StdEncoding.EncodeToString(sum[:])
}
return nil
},
},
}, },
} }
resp, err := client.Do(req) resp, err := client.Do(req)
@ -147,11 +157,10 @@ func (s *NodeService) FetchCertFingerprint(ctx context.Context, n *model.Node) (
return "", err return "", err
} }
defer resp.Body.Close() defer resp.Body.Close()
if resp.TLS == nil || len(resp.TLS.PeerCertificates) == 0 { if fingerprint == "" {
return "", common.NewError("node did not present a TLS certificate") return "", common.NewError("node did not present a TLS certificate")
} }
sum := sha256.Sum256(resp.TLS.PeerCertificates[0].Raw) return fingerprint, nil
return base64.StdEncoding.EncodeToString(sum[:]), nil
} }
func (s *NodeService) GetAll() ([]*model.Node, error) { func (s *NodeService) GetAll() ([]*model.Node, error) {