From 7f6a825bfe12edf1fa1dff53ceeff7d753f9d22f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Sun, 9 Mar 2025 11:40:10 +0000 Subject: [PATCH] Do some rename --- infra/conf/transport_internet.go | 13 ++------ transport/internet/tls/config.go | 2 +- transport/internet/tls/config.pb.go | 46 +++++++++++------------------ transport/internet/tls/config.proto | 6 ++-- transport/internet/tls/ech.go | 42 +++++++++++++++----------- 5 files changed, 48 insertions(+), 61 deletions(-) diff --git a/infra/conf/transport_internet.go b/infra/conf/transport_internet.go index 07fe4aa3..f28d68fc 100644 --- a/infra/conf/transport_internet.go +++ b/infra/conf/transport_internet.go @@ -412,8 +412,7 @@ type TLSConfig struct { MasterKeyLog string `json:"masterKeyLog"` ServerNameToVerify string `json:"serverNameToVerify"` VerifyPeerCertInNames []string `json:"verifyPeerCertInNames"` - ECHConfig string `json:"echConfig"` - ECHDNSServer string `json:"echDnsServer"` + ECHConfigList string `json:"echConfigList"` EchKeySets string `json:"echKeySets"` } @@ -486,13 +485,8 @@ func (c *TLSConfig) Build() (proto.Message, error) { } config.VerifyPeerCertInNames = c.VerifyPeerCertInNames - if c.ECHConfig != "" { - ECHConfig, err := base64.StdEncoding.DecodeString(c.ECHConfig) - if err != nil { - return nil, errors.New("invalid ECH Config", c.ECHConfig) - } - config.EchConfig = ECHConfig - } + config.EchConfigList = c.ECHConfigList + if c.EchKeySets != "" { EchPrivateKey, err := base64.StdEncoding.DecodeString(c.EchKeySets) if err != nil { @@ -500,7 +494,6 @@ func (c *TLSConfig) Build() (proto.Message, error) { } config.EchKeySets = EchPrivateKey } - config.Ech_DNSserver = c.ECHDNSServer return config, nil } diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go index 7c86b406..1ba242a9 100644 --- a/transport/internet/tls/config.go +++ b/transport/internet/tls/config.go @@ -444,7 +444,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { config.KeyLogWriter = writer } } - if len(c.EchConfig) > 0 || len(c.Ech_DNSserver) > 0 || len(c.EchKeySets) > 0 { + if len(c.EchConfigList) > 0 || len(c.EchKeySets) > 0 { err := ApplyECH(c, config) if err != nil { errors.LogError(context.Background(), err) diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index e8d218a4..064c795a 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -217,9 +217,8 @@ type Config struct { // @Document After allow_insecure (automatically), if the server's cert can't be verified by any of these names, pinned_peer_certificate_chain_sha256 will be tried. // @Critical VerifyPeerCertInNames []string `protobuf:"bytes,17,rep,name=verify_peer_cert_in_names,json=verifyPeerCertInNames,proto3" json:"verify_peer_cert_in_names,omitempty"` - EchConfig []byte `protobuf:"bytes,18,opt,name=ech_config,json=echConfig,proto3" json:"ech_config,omitempty"` - Ech_DNSserver string `protobuf:"bytes,19,opt,name=ech_DNSserver,json=echDNSserver,proto3" json:"ech_DNSserver,omitempty"` - EchKeySets []byte `protobuf:"bytes,20,opt,name=ech_key_sets,json=echKeySets,proto3" json:"ech_key_sets,omitempty"` + EchConfigList string `protobuf:"bytes,18,opt,name=ech_config_list,json=echConfigList,proto3" json:"ech_config_list,omitempty"` + EchKeySets []byte `protobuf:"bytes,19,opt,name=ech_key_sets,json=echKeySets,proto3" json:"ech_key_sets,omitempty"` } func (x *Config) Reset() { @@ -364,16 +363,9 @@ func (x *Config) GetVerifyPeerCertInNames() []string { return nil } -func (x *Config) GetEchConfig() []byte { +func (x *Config) GetEchConfigList() string { if x != nil { - return x.EchConfig - } - return nil -} - -func (x *Config) GetEch_DNSserver() string { - if x != nil { - return x.Ech_DNSserver + return x.EchConfigList } return "" } @@ -416,7 +408,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x4e, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, - 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0x80, 0x07, 0x0a, 0x06, 0x43, 0x6f, 0x6e, + 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xe4, 0x06, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, 0x4a, 0x0a, 0x0b, 0x63, 0x65, @@ -466,21 +458,19 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x65, 0x72, 0x69, 0x66, 0x79, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x69, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x49, 0x6e, - 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x63, 0x68, 0x5f, 0x63, 0x6f, 0x6e, - 0x66, 0x69, 0x67, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x65, 0x63, 0x68, 0x43, 0x6f, - 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x63, 0x68, 0x5f, 0x44, 0x4e, 0x53, 0x73, - 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x13, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x63, 0x68, - 0x44, 0x4e, 0x53, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0c, 0x65, 0x63, 0x68, - 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0c, 0x52, - 0x0a, 0x65, 0x63, 0x68, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x73, 0x42, 0x73, 0x0a, 0x1f, 0x63, - 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, - 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, - 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, - 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x74, 0x72, 0x61, 0x6e, - 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, - 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, - 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, - 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x65, 0x63, 0x68, 0x5f, 0x63, 0x6f, 0x6e, + 0x66, 0x69, 0x67, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x12, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, + 0x65, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x20, 0x0a, + 0x0c, 0x65, 0x63, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x13, 0x20, + 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x65, 0x63, 0x68, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x73, 0x42, + 0x73, 0x0a, 0x1f, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, + 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, + 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, + 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, + 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, + 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x54, 0x72, + 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, + 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index df3bcb05..3e032183 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -92,9 +92,7 @@ message Config { */ repeated string verify_peer_cert_in_names = 17; - bytes ech_config = 18; + string ech_config_list = 18; - string ech_DNSserver = 19; - - bytes ech_key_sets = 20; + bytes ech_key_sets = 19; } diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go index cbe13042..716bde34 100644 --- a/transport/internet/tls/ech.go +++ b/transport/internet/tls/ech.go @@ -4,7 +4,6 @@ import ( "bytes" "context" "crypto/tls" - "fmt" "io" "net/http" "strings" @@ -25,22 +24,28 @@ func ApplyECH(c *Config, config *tls.Config) error { nameToQuery := c.ServerName var DOHServer string - if len(c.EchConfig) != 0 || len(c.Ech_DNSserver) != 0 { - parts := strings.Split(c.Ech_DNSserver, "+") - if len(parts) == 2 { - // parse ECH DOH server in format of "example.com+https://1.1.1.1/dns-query" - nameToQuery = parts[0] - DOHServer = parts[1] - } else if len(parts) == 1 { - // normal format - DOHServer = parts[0] - } else { - return errors.New("Invalid ECH DOH server format: ", c.Ech_DNSserver) - } - - if len(c.EchConfig) > 0 { - ECHConfig = c.EchConfig - } else { // ECH config > DOH lookup + // for client + if len(c.EchConfigList) != 0 { + // direct base64 config + if strings.HasPrefix(c.EchConfigList, "base64") { + Base64ECHConfigList := c.EchConfigList[len("base64://"):] + ECHConfigList, err := goech.ECHConfigListFromBase64(Base64ECHConfigList) + if err != nil { + return errors.New("Failed to unmarshal ECHConfigList: ", err) + } + ECHConfig, _ = ECHConfigList.MarshalBinary() + } else { // query config from dns + parts := strings.Split(c.EchConfigList, "+") + if len(parts) == 2 { + // parse ECH DOH server in format of "example.com+https://1.1.1.1/dns-query" + nameToQuery = parts[0] + DOHServer = parts[1] + } else if len(parts) == 1 { + // normal format + DOHServer = parts[0] + } else { + return errors.New("Invalid ECH DNS server format: ", c.EchConfigList) + } if nameToQuery == "" { return errors.New("Using DOH for ECH needs serverName or use dohServer format example.com+https://1.1.1.1/dns-query") } @@ -53,6 +58,7 @@ func ApplyECH(c *Config, config *tls.Config) error { config.EncryptedClientHelloConfigList = ECHConfig } + // for server if len(c.EchKeySets) != 0 { var keys []tls.EncryptedClientHelloKey KeySets, err := goech.UnmarshalECHKeySetList(c.EchKeySets) @@ -70,8 +76,8 @@ func ApplyECH(c *Config, config *tls.Config) error { PrivateKey: ECHPrivateKey}) } config.EncryptedClientHelloKeys = keys - fmt.Println(config.EncryptedClientHelloKeys) } + return nil }