From 1a681695a2ed0be942d9961c9902dfd3274260af Mon Sep 17 00:00:00 2001 From: DHR60 <192860629+DHR60@users.noreply.github.com> Date: Thu, 18 Jun 2026 02:34:18 +0000 Subject: [PATCH] Revert "Fetch cert allow insecure (#8998)" (#9585) This reverts commit 25d7f393b63a46a33e705f2a57628edbfe8afe17. --- v2rayN/ServiceLib/Manager/CertPemManager.cs | 23 ++++++------------- v2rayN/ServiceLib/Resx/ResUI.Designer.cs | 18 --------------- v2rayN/ServiceLib/Resx/ResUI.fa.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.fr.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.hu.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.ru.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx | 6 ----- v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx | 6 ----- .../ViewModels/AddServerViewModel.cs | 9 ++------ .../Views/AddServerWindow.axaml | 19 --------------- .../Views/AddServerWindow.axaml.cs | 2 -- v2rayN/v2rayN/Views/AddServerWindow.xaml | 21 ----------------- v2rayN/v2rayN/Views/AddServerWindow.xaml.cs | 4 ---- 14 files changed, 9 insertions(+), 129 deletions(-) diff --git a/v2rayN/ServiceLib/Manager/CertPemManager.cs b/v2rayN/ServiceLib/Manager/CertPemManager.cs index 7f5d3889..d96e1223 100644 --- a/v2rayN/ServiceLib/Manager/CertPemManager.cs +++ b/v2rayN/ServiceLib/Manager/CertPemManager.cs @@ -190,8 +190,8 @@ public class CertPemManager /// /// Get certificate in PEM format from a server with CA pinning validation /// - public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4, - List? verifyPeerCertByName = null, bool allowInsecure = false) + public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, + List? verifyPeerCertByName = null, int timeout = 4) { try { @@ -204,8 +204,7 @@ public class CertPemManager await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token); var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) => - ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [], - allowInsecure)); + ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [])); await using var ssl = new SslStream(client.GetStream(), false, callback); var sslOptions = new SslClientAuthenticationOptions @@ -240,8 +239,8 @@ public class CertPemManager /// /// Get certificate chain in PEM format from a server with CA pinning validation /// - public async Task<(List, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4, - List? verifyPeerCertByName = null, bool allowInsecure = false) + public async Task<(List, string?)> GetCertChainPemAsync(string target, string serverName, + List? verifyPeerCertByName = null, int timeout = 4) { var pemList = new List(); try @@ -255,8 +254,7 @@ public class CertPemManager await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token); var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) => - ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [], - allowInsecure)); + ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [])); await using var ssl = new SslStream(client.GetStream(), false, callback); var sslOptions = new SslClientAuthenticationOptions @@ -299,20 +297,13 @@ public class CertPemManager X509Certificate? certificate, X509Chain? chain, SslPolicyErrors sslPolicyErrors, - List verifyPeerCertByName, - bool allowInsecure) + List verifyPeerCertByName) { if (certificate == null) { return false; } - // In insecure mode, accept any certificate so self-signed certs can be fetched. - if (allowInsecure) - { - return true; - } - // Build certificate chain var cert2 = certificate as X509Certificate2 ?? new X509Certificate2(certificate); var certChain = chain ?? new X509Chain(); diff --git a/v2rayN/ServiceLib/Resx/ResUI.Designer.cs b/v2rayN/ServiceLib/Resx/ResUI.Designer.cs index 68bec1bb..031db114 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.Designer.cs +++ b/v2rayN/ServiceLib/Resx/ResUI.Designer.cs @@ -2670,24 +2670,6 @@ namespace ServiceLib.Resx { } } - /// - /// 查找类似 Allow insecure cert fetch (self-signed) 的本地化字符串。 - /// - public static string TbAllowInsecureCertFetch { - get { - return ResourceManager.GetString("TbAllowInsecureCertFetch", resourceCulture); - } - } - - /// - /// 查找类似 Only for fetching self-signed certificates. This may expose you to MITM risks. 的本地化字符串。 - /// - public static string TbAllowInsecureCertFetchTips { - get { - return ResourceManager.GetString("TbAllowInsecureCertFetchTips", resourceCulture); - } - } - /// /// 查找类似 ALPN 的本地化字符串。 /// diff --git a/v2rayN/ServiceLib/Resx/ResUI.fa.resx b/v2rayN/ServiceLib/Resx/ResUI.fa.resx index 7bebb881..edcce692 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.fa.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.fa.resx @@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if XHTTP Extra - - Allow insecure cert fetch (self-signed) - - - Only for fetching self-signed certificates. This may expose you to MITM risks. - Test Configurations UDP Delay diff --git a/v2rayN/ServiceLib/Resx/ResUI.fr.resx b/v2rayN/ServiceLib/Resx/ResUI.fr.resx index b97dfcb5..ef4d7522 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.fr.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.fr.resx @@ -1695,12 +1695,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if XHTTP Extra - - Allow insecure cert fetch (self-signed) - - - Pour obtenir des certificats auto-signés uniquement. Risque MITM. - Adresse de sortie locale (SendThrough) diff --git a/v2rayN/ServiceLib/Resx/ResUI.hu.resx b/v2rayN/ServiceLib/Resx/ResUI.hu.resx index f1e159c3..3635310e 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.hu.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.hu.resx @@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if XHTTP Extra - - Allow insecure cert fetch (self-signed) - - - Only for fetching self-signed certificates. This may expose you to MITM risks. - Test Configurations UDP Delay diff --git a/v2rayN/ServiceLib/Resx/ResUI.resx b/v2rayN/ServiceLib/Resx/ResUI.resx index 0b82e788..dec90625 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.resx @@ -1701,12 +1701,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if XHTTP Extra - - Allow insecure cert fetch (self-signed) - - - Only for fetching self-signed certificates. This may expose you to MITM risks. - Test Configurations UDP Delay diff --git a/v2rayN/ServiceLib/Resx/ResUI.ru.resx b/v2rayN/ServiceLib/Resx/ResUI.ru.resx index f74e45c2..3f4f74cb 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.ru.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.ru.resx @@ -1698,12 +1698,6 @@ Дополнительные параметры XHTTP (Extra) - - Разрешить небезопасную загрузку сертификата (самоподписанного) - - - Только для загрузки самоподписанных сертификатов. Это может подвергнуть вас риску атаки «человек посередине» (MITM). - Тест UDP-задержки конфигураций diff --git a/v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx b/v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx index ada0d389..a371b045 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx @@ -1695,12 +1695,6 @@ XHTTP Extra - - 允许不安全获取证书（自签名） - - - 仅用于抓取自签证书，存在中间人风险。 - 测试 UDP 延迟 (多选) diff --git a/v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx b/v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx index 9a52f0a4..ff0f4faa 100644 --- a/v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx +++ b/v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx @@ -1695,12 +1695,6 @@ XHTTP Extra - - 允許不安全獲取證書（自簽名） - - - 僅用於抓取自簽證書，存在中間人風險。 - 測試 UDP 延遲（多選） diff --git a/v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs b/v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs index d25f5b5f..338b3468 100644 --- a/v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs +++ b/v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs @@ -23,9 +23,6 @@ public class AddServerViewModel : MyReactiveObject [Reactive] public string CertSha { get; set; } - [Reactive] - public bool AllowInsecureCertFetch { get; set; } - [Reactive] public string SalamanderPass { get; set; } @@ -475,8 +472,7 @@ public class AddServerViewModel : MyReactiveObject } (Cert, var certError) = await CertPemManager.Instance.GetCertPemAsync(domain, serverName, - verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName), - allowInsecure: AllowInsecureCertFetch); + verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName)); UpdateCertTip(certError); } @@ -502,8 +498,7 @@ public class AddServerViewModel : MyReactiveObject } var (certs, certError) = await CertPemManager.Instance.GetCertChainPemAsync(domain, serverName, - verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName), - allowInsecure: AllowInsecureCertFetch); + verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName)); Cert = CertPemManager.ConcatenatePemChain(certs); UpdateCertTip(certError); } diff --git a/v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml b/v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml index 35260183..d3258d28 100644 --- a/v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml +++ b/v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml @@ -1189,25 +1189,6 @@ Margin="{StaticResource Margin4}" Content="{x:Static resx:ResUI.TbFetchCertChain}" /> - - - - - this.Bind(ViewModel, vm => vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables); - this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables); - this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.txtAllowInsecureCertFetchTips.IsVisible).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables); diff --git a/v2rayN/v2rayN/Views/AddServerWindow.xaml b/v2rayN/v2rayN/Views/AddServerWindow.xaml index b42138bf..048e695c 100644 --- a/v2rayN/v2rayN/Views/AddServerWindow.xaml +++ b/v2rayN/v2rayN/Views/AddServerWindow.xaml @@ -1519,27 +1519,6 @@ Content="{x:Static resx:ResUI.TbFetchCertChain}" Style="{StaticResource DefButton}" /> - - - - - vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables); - this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables); - this.WhenAnyValue(x => x.ViewModel.AllowInsecureCertFetch) - .Select(b => b ? Visibility.Visible : Visibility.Collapsed) - .BindTo(this, v => v.txtAllowInsecureCertFetchTips.Visibility); this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables); this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables);