Max/XTLS_REALITY
1
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2026-09-27 09:28:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

crypto/tls: check FIPS 140-3 compliance of leaf even with InsecureSkipVerify

Browse Source 
Fixes #80074

Change-Id: I5c619a090293a7668e26699c29b194a56a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/804200
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Mark Freeman <markfreeman@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
This commit is contained in:
yuhan6665
2026-09-12 20:09:36 -04:00
parent 6db0b2d9de
commit d6e98c8b05
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
handshake_client.go
+6 -1
View File
@@ -1162,9 +1162,14 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error {
}
}
if fips140tls.Required() && !isCertificateAllowedFIPS(certs[0]) {
c.sendAlert(alertBadCertificate)
err := errors.New("server's certificate is not allowed in FIPS 140-3 mode")
return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
}
switch certs[0].PublicKey.(type) {
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
break
case *mldsa.PublicKey:
if c.vers < VersionTLS13 {
c.sendAlert(alertIllegalParameter)
handshake_server.go
+6
View File
@@ -994,6 +994,12 @@ func (c *Conn) processCertsFromClient(certificate Certificate) error {
c.scts = certificate.SignedCertificateTimestamps
if len(certs) > 0 {
if fips140tls.Required() && !isCertificateAllowedFIPS(certs[0]) {
c.sendAlert(alertBadCertificate)
err := errors.New("client's certificate is not allowed in FIPS 140-3 mode")
return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
}
switch certs[0].PublicKey.(type) {
case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
case *mldsa.PublicKey: