我想連接到可能不安全的主機，所以我http.Client這樣使用：client := &http.Client{ Timeout: timeout, Transport: &http.Transport{ TLSClientConfig: &tls.Config{ InsecureSkipVerify: true, }, },}resp, err := client.Get(url)哪個工作得很好，但我似乎找不到事后檢查 SSL 證書有效性的方法。我意識到我可以建立兩個連接（一個有InsecureSkipVerify一個沒有），但我想在不建立另一個連接的情況下做到這一點。
1 回答
揚帆大魚
TA貢獻1799條經驗 獲得超9個贊
可行的。=)
您應該在 Transport 上設置 Dial 和 DialTLS 字段并在那里進行檢查。
希望代碼是不言自明的，請隨時詢問。
由于限制，不能在操場上工作！
https://play.golang.org/p/4TkczUEnKn
package main
import (
"fmt"
"net/http"
"net"
"time"
"crypto/tls"
)
func DialTLS(network, addr string) (net.Conn, error) {
conn, err := tls.Dial(network, addr, &tls.Config{
InsecureSkipVerify: true,
})
cs := conn.ConnectionState()
fmt.Println(cs.Version, cs.HandshakeComplete)
// insert your check here!
return conn, err
}
func Dial (network, addr string) (net.Conn, error) {
// Copied from DefaultTransport
dialer := &net.Dialer{
Timeout: 30 * time.Second,
KeepAlive: 30 * time.Second,
}
conn, err := dialer.Dial(network, addr)
fmt.Println("unsecure")
return conn, err
}
func main() {
client := &http.Client{
Timeout: time.Second,
Transport: &http.Transport{
Dial: Dial,
// If DialTLS is set, the Dial hook is not used for HTTPS
// requests and the TLSClientConfig and TLSHandshakeTimeout
// are ignored. The returned net.Conn is assumed to already be
// past the TLS handshake.
// TLSClientConfig: &tls.Config{
// InsecureSkipVerify: true,
// },
DialTLS: DialTLS,
},
}
// Deep in transport it checks "tlsDial := t.DialTLS != nil && cm.targetScheme == "https" && cm.proxyURL == nil"
// https://golang.org/src/net/http/transport.go#L741
resp, err := client.Get("https://www.google.com")
fmt.Println(resp, err, "\n\n")
resp , err = client.Get("http://www.google.com")
fmt.Println(resp, err)
}
UPD
UPD2：下面的代碼是個壞主意=）?；赝诉壿嫽煜?http.Clienterror = Get https://www.google.com: http: server gave HTTP response to HTTPS client或者我遺漏了一些東西，好吧，現在由你決定 =)
甚至更好（取決于您的邏輯）。
func DialTLSWithFallback(network, addr string) (net.Conn, error) {
conn, err := tls.Dial(network, addr, &tls.Config{
InsecureSkipVerify: true,
})
if err != nil {
// obviously, usecure
// lets try net.Dial
// and return, so check bellow wont trigger on wrong connection type
return &(net.Dialer{
Timeout: 30 * time.Second,
KeepAlive: 30 * time.Second,
}).Dial(network, addr)
}
cs := conn.ConnectionState()
fmt.Println(cs.Version, cs.HandshakeComplete)
// its "secure" connection
// check is it strong enough here!
return conn, err
}
你運輸縮小到
Transport: &http.Transport{
Dial: DialTLSWithFallback,
DialTLS: DialTLSWithFallback,
}
- 1 回答
- 0 關注
- 152 瀏覽
添加回答
舉報
0/150
提交
取消