wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

boxdd: Add insecure mode

Browse Source
This commit is contained in:
世界
2026-07-15 19:31:11 +08:00
parent 52f372c536
commit e34b57c3b0
61 changed files with 1058 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/tls/std_server.go
+10 -8
View File
@@ -5,7 +5,6 @@ import (
"crypto/tls"
"crypto/x509"
"net"
"os"
"strings"
"sync"
"time"
@@ -20,6 +19,7 @@ import (
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/common/ntp"
"github.com/sagernet/sing/service"
"github.com/sagernet/sing/service/filemanager"
)
var errInsecureUnused = E.New("tls: insecure unused")
@@ -90,6 +90,7 @@ func getACMENextProtos(provider adapter.CertificateProvider) []string {
}
type STDServerConfig struct {
ctx context.Context
access sync.RWMutex
config *tls.Config
handshakeTimeout time.Duration
@@ -260,13 +261,13 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
if path == c.certificatePath || path == c.keyPath {
switch path {
case c.certificatePath:
certificate, err := os.ReadFile(c.certificatePath)
certificate, err := filemanager.ReadFile(c.ctx, c.certificatePath)
if err != nil {
return E.Cause(err, "reload certificate from ", c.certificatePath)
}
c.certificate = certificate
case c.keyPath:
key, err := os.ReadFile(c.keyPath)
key, err := filemanager.ReadFile(c.ctx, c.keyPath)
if err != nil {
return E.Cause(err, "reload key from ", c.keyPath)
}
@@ -286,7 +287,7 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
clientCertificateCA := x509.NewCertPool()
var reloaded bool
for _, certPath := range c.clientCertificatePath {
content, err := os.ReadFile(certPath)
content, err := filemanager.ReadFile(c.ctx, certPath)
if err != nil {
c.logger.Error(E.Cause(err, "reload certificate from ", c.clientCertificatePath))
continue
@@ -307,7 +308,7 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
c.access.Unlock()
c.logger.Info("reloaded client certificates")
} else if path == c.echKeyPath {
echKey, err := os.ReadFile(c.echKeyPath)
echKey, err := filemanager.ReadFile(c.ctx, c.echKeyPath)
if err != nil {
return E.Cause(err, "reload ECH keys from ", c.echKeyPath)
}
@@ -405,7 +406,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
if len(options.Certificate) > 0 {
certificate = []byte(strings.Join(options.Certificate, "\n"))
} else if options.CertificatePath != "" {
content, err := os.ReadFile(options.CertificatePath)
content, err := filemanager.ReadFile(ctx, options.CertificatePath)
if err != nil {
return nil, E.Cause(err, "read certificate")
}
@@ -414,7 +415,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
if len(options.Key) > 0 {
key = []byte(strings.Join(options.Key, "\n"))
} else if options.KeyPath != "" {
content, err := os.ReadFile(options.KeyPath)
content, err := filemanager.ReadFile(ctx, options.KeyPath)
if err != nil {
return nil, E.Cause(err, "read key")
}
@@ -457,7 +458,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
} else if len(options.ClientCertificatePath) > 0 {
clientCertificateCA := x509.NewCertPool()
for _, path := range options.ClientCertificatePath {
content, err := os.ReadFile(path)
content, err := filemanager.ReadFile(ctx, path)
if err != nil {
return nil, E.Cause(err, "read client certificate from ", path)
}
@@ -494,6 +495,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
handshakeTimeout = C.TCPTimeout
}
serverConfig := &STDServerConfig{
ctx: ctx,
config: tlsConfig,
handshakeTimeout: handshakeTimeout,
logger: logger,