diff --git a/FastGithub.Core/DomainConfig.cs b/FastGithub.Core/DomainConfig.cs
index bbde172..161795d 100644
--- a/FastGithub.Core/DomainConfig.cs
+++ b/FastGithub.Core/DomainConfig.cs
@@ -17,6 +17,12 @@ namespace FastGithub
///
public string? TlsSniPattern { get; init; }
+ ///
+ /// 是否忽略服务器证书域名不匹配
+ /// 当不发送SNI时服务器可能发回域名不匹配的证书
+ ///
+ public bool TlsIgnoreNameMismatch { get; init; }
+
///
/// 请求超时时长
///
diff --git a/FastGithub.ReverseProxy/HttpClient.cs b/FastGithub.ReverseProxy/HttpClient.cs
index 8c41199..e2d141f 100644
--- a/FastGithub.ReverseProxy/HttpClient.cs
+++ b/FastGithub.ReverseProxy/HttpClient.cs
@@ -11,6 +11,7 @@ namespace FastGithub.ReverseProxy
class HttpClient : HttpMessageInvoker
{
private readonly TlsSniPattern tlsSniPattern;
+ private readonly bool tlsIgnoreNameMismatch;
///
/// YARP的HttpClient
@@ -18,10 +19,14 @@ namespace FastGithub.ReverseProxy
///
///
///
- public HttpClient(HttpMessageHandler handler, TlsSniPattern tlsSniPattern, bool disposeHandler = false) :
- base(handler, disposeHandler)
+ public HttpClient(
+ HttpMessageHandler handler,
+ TlsSniPattern tlsSniPattern,
+ bool tlsIgnoreNameMismatch,
+ bool disposeHandler = false) : base(handler, disposeHandler)
{
this.tlsSniPattern = tlsSniPattern;
+ this.tlsIgnoreNameMismatch = tlsIgnoreNameMismatch;
}
///
@@ -37,6 +42,7 @@ namespace FastGithub.ReverseProxy
Host = request.RequestUri?.Host,
IsHttps = request.RequestUri?.Scheme == Uri.UriSchemeHttps,
TlsSniPattern = this.tlsSniPattern,
+ TlsIgnoreNameMismatch = this.tlsIgnoreNameMismatch
});
return base.SendAsync(request, cancellationToken);
}
diff --git a/FastGithub.ReverseProxy/HttpClientHanlder.cs b/FastGithub.ReverseProxy/HttpClientHanlder.cs
index 1a18de7..9ece290 100644
--- a/FastGithub.ReverseProxy/HttpClientHanlder.cs
+++ b/FastGithub.ReverseProxy/HttpClientHanlder.cs
@@ -64,6 +64,11 @@ namespace FastGithub.ReverseProxy
{
if (errors == SslPolicyErrors.RemoteCertificateNameMismatch)
{
+ if (requestContext.TlsIgnoreNameMismatch == true)
+ {
+ return true;
+ }
+
var host = requestContext.Host;
var dnsNames = ReadDnsNames(cert);
return dnsNames.Any(dns => IsMatch(dns, host));
@@ -97,7 +102,7 @@ namespace FastGithub.ReverseProxy
if (list.Count >= 2 && list[0] is int nameType && nameType == 2)
{
var dnsName = list[1]?.ToString();
- if(dnsName!=null)
+ if (dnsName != null)
{
yield return dnsName;
}
diff --git a/FastGithub.ReverseProxy/RequestContext.cs b/FastGithub.ReverseProxy/RequestContext.cs
index 23fb808..509526a 100644
--- a/FastGithub.ReverseProxy/RequestContext.cs
+++ b/FastGithub.ReverseProxy/RequestContext.cs
@@ -19,5 +19,10 @@
/// 获取或设置Sni值的表达式
///
public TlsSniPattern TlsSniPattern { get; set; }
+
+ ///
+ /// 是否忽略服务器证书域名不匹配
+ ///
+ public bool TlsIgnoreNameMismatch { get; set; }
}
}
diff --git a/FastGithub.ReverseProxy/ReverseProxyMiddleware.cs b/FastGithub.ReverseProxy/ReverseProxyMiddleware.cs
index 413d258..934a995 100644
--- a/FastGithub.ReverseProxy/ReverseProxyMiddleware.cs
+++ b/FastGithub.ReverseProxy/ReverseProxyMiddleware.cs
@@ -57,7 +57,7 @@ namespace FastGithub.ReverseProxy
var requestConfig = new ForwarderRequestConfig { Timeout = domainConfig.Timeout };
var tlsSniPattern = domainConfig.GetTlsSniPattern();
- using var httpClient = new HttpClient(this.httpClientHanlder, tlsSniPattern);
+ using var httpClient = new HttpClient(this.httpClientHanlder, tlsSniPattern, domainConfig.TlsIgnoreNameMismatch);
var error = await httpForwarder.SendAsync(context, destinationPrefix, httpClient, requestConfig);
await HandleErrorAsync(context, error);
diff --git a/FastGithub/appsettings.json b/FastGithub/appsettings.json
index 2d458af..fda2e06 100644
--- a/FastGithub/appsettings.json
+++ b/FastGithub/appsettings.json
@@ -8,12 +8,18 @@
"IPAddress": "114.114.114.114",
"Port": 53
},
- "DomainConfigs": { // 域名的*表示0到多个任意字符
+ "DomainConfigs": { // 域名的*表示0到多个任意字符
"github.com": {
"TlsSni": false, // 指示tls握手时是否发送SNI
"TlsSniPattern": null, // SNI表达式,@domain变量表示取域名值 @ipadress变量表示取ip @random变量表示取随机值,其它字符保留不替换
+ "TlsIgnoreNameMismatch": false, // 是否忽略服务器证书域名不匹配,当不发送SNI时服务器可能发回域名不匹配的证书,默认为false
"Timeout": null, // 请求超时时长,格式为"00:02:00",默认为null
"Destination": null // 请求目的地,格式为绝对或相对Uri,默认null
+ //"Response": { // 阻断请求直接响应,设置了Response其它配置都不起作用了
+ // "StatusCode": 404,
+ // "ContentType": "text/plain;charset=utf-8",
+ // "ContentValue": "阻断的请求"
+ //}
},
"githubstatus.com": {
"TlsSni": false
@@ -61,10 +67,8 @@
"Destination": "https://fdn.geekzu.org/"
},
"i.stack.imgur.com": {
- "Response": { // 直接响应
- "StatusCode": 404,
- "ContentType": "text/plain;charset=utf-8",
- "ContentValue": "阻断的请求"
+ "Response": {
+ "StatusCode": 404
}
},
"lh*.googleusercontent.com": {