Skip to content

Add certificate hash chain pinning support to webtunnel

This merge request add certificate hash chain pinning support to webtunnel transport in lyrebird.

This adds option: cert to bridge line.

Example bridge line(don't actually work):

Bridge webtunnel 1.2.3.4:8229 url=https://jq72vx2q-8000.eun1.devtunnels.ms/ addr=jq72vx2q-8008.eun1.devtunnels.ms:443 servername=jq72vx2q-8008.eun1.devtunnels.ms cert=tkD5HpyInq/IhfiqAj5h2Pgd93sYVEcO+1yHXYzgoJ8= utls=hellorandomizednoalpn

url is the https websocket(wss) connection url, addr is the TCP endpoint the client will connection to, servername is the server name indication that client will send to in the TLS layer client hello, and cert is the pinned certificate hash chain that have the same notation as pinnedPeerCertificateChainSha256 in V2Ray's TLSSetting.

To generate this cert value:

  1. get the certificate chain bundle. On server, this would be the certificate file supplied to nginx or other tls server. If one does not have access to server, this info can be obtained with openssl s_client -showcerts -servername jq72vx2q-8000.eun1.devtunnels.ms -connect jq72vx2q-8000.eun1.devtunnels.ms:443 and then manually gathering all the certificate in the supplied certificate chain. (Do not use a browser to do this, as the browser can reorder or supplement the certificate chain with its own certificate, resulting in an inconsistent certificate chain hash.)
  2. generate the certificate chain hash with ./v2ray tls certChainHash --cert <cert.pem>

Merge request reports

Loading