gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

keykeeper的本地缓存，使用keyring_id:证书指纹作为key，在导入可信证书后，非法证书变为合法证书，但缓存查询到的仍是非法证书，导致 #119 。变更key为keyring_id:is_cert_valid:证书指纹。

Browse Source
This commit is contained in:
zhengchao
2019-02-28 15:54:27 +08:00
parent f349d1254f
commit fcb1581a1c
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
platform/src/key_keeper.cpp
View File

@@ -519,24 +519,24 @@ struct keyring* key_keeper_release_keyring(future_result_t* result)
return &(kyr->head); return &(kyr->head);
} }
static uchar* get_key_by_cert(X509* cert, int keyring_id, unsigned int* len) static uchar* get_key_by_cert(X509* cert, int keyring_id, unsigned int* len, int is_cert_valid)
{ {
if(cert == NULL) if(cert == NULL)
{ {
return NULL; return NULL;
} }
char* cert_fgr = NULL; char* cert_fingerprint = NULL;
cert_fgr = ssl_x509_fingerprint(cert, 0); cert_fingerprint = ssl_x509_fingerprint(cert, 0);
if(cert_fgr == NULL) if(cert_fingerprint == NULL)
{ {
return NULL; return NULL;
} }
char* key = (char*)malloc(HTABLE_MAX_KEY_LEN); char* key = ALLOC(char, HTABLE_MAX_KEY_LEN);
memset(key, 0, HTABLE_MAX_KEY_LEN); memset(key, 0, HTABLE_MAX_KEY_LEN);
snprintf(key, HTABLE_MAX_KEY_LEN, "%d:", keyring_id); snprintf(key, HTABLE_MAX_KEY_LEN, "%d:%d:", keyring_id, is_cert_valid);
strncat(key, cert_fgr, HTABLE_MAX_KEY_LEN); strncat(key, cert_fingerprint, HTABLE_MAX_KEY_LEN);
*len = strnlen(key, HTABLE_MAX_KEY_LEN); *len = strnlen(key, HTABLE_MAX_KEY_LEN);
free(cert_fgr); free(cert_fingerprint);
return (uchar*)key; return (uchar*)key;
} }
@@ -561,7 +561,7 @@ void key_keeper_async_ask(struct future * f, struct key_keeper * keeper, const c
{ {
struct promise* p = future_to_promise(f); struct promise* p = future_to_promise(f);
unsigned int len = 0; unsigned int len = 0;
uchar* key = get_key_by_cert(origin_cert, keyring_id, &len); uchar* key = get_key_by_cert(origin_cert, keyring_id, &len, is_cert_valid);
if(key == NULL) if(key == NULL)
{ {
promise_failed(p, FUTURE_ERROR_EXCEPTION, "get hash key by_cert failed"); promise_failed(p, FUTURE_ERROR_EXCEPTION, "get hash key by_cert failed");