feat: Prepare to specify the fingerprint function

common/tls/config.go

@@ -12,14 +12,11 @@ import (
 	"time"
 )
 
-var fingerprints [][32]byte
+var globalFingerprints [][32]byte
-var rwLock sync.Mutex
+var mutex sync.Mutex
-var defaultTLSConfig = &tls.Config{
+
-	InsecureSkipVerify:    true,
+func verifyPeerCertificateAndFingerprints(fingerprints [][32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
-	VerifyPeerCertificate: verifyPeerCertificate,
+	return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
-}
-var verifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
-	fingerprints := fingerprints
 
 		var preErr error
 		for i := range rawCerts {
@@ -46,27 +43,57 @@ var verifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Cer
 		}
 
 		return preErr
+	}
 }
 
 func AddCertFingerprint(fingerprint string) error {
-	fp := strings.Replace(fingerprint, ":", "", -1)
+	fpByte, err2 := convertFingerprint(fingerprint)
-	fpByte, err := hex.DecodeString(fp)
+	if err2 != nil {
-	if err != nil {
+		return err2
-		return err
 	}
 
-	if len(fpByte) != 32 {
+	mutex.Lock()
-		return fmt.Errorf("fingerprint string length error,need sha25 fingerprint")
+	globalFingerprints = append(globalFingerprints, *fpByte)
-	}
+	mutex.Unlock()
-
-	rwLock.Lock()
-	fingerprints = append(fingerprints, *(*[32]byte)(fpByte))
-	rwLock.Unlock()
 	return nil
 }
 
+func convertFingerprint(fingerprint string) (*[32]byte, error) {
+	fp := strings.Replace(fingerprint, ":", "", -1)
+	fpByte, err := hex.DecodeString(fp)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(fpByte) != 32 {
+		return nil, fmt.Errorf("fingerprint string length error,need sha25 fingerprint")
+	}
+	return (*[32]byte)(fpByte), nil
+}
+
 func GetDefaultTLSConfig() *tls.Config {
-	return defaultTLSConfig
+	return &tls.Config{
+		InsecureSkipVerify:    true,
+		VerifyPeerCertificate: verifyPeerCertificateAndFingerprints(globalFingerprints),
+	}
+}
+
+// GetTLSConfigWithSpecifiedFingerprint specified fingerprint
+func GetTLSConfigWithSpecifiedFingerprint(tlsConfig *tls.Config, fingerprint string) (*tls.Config, error) {
+	if fingerprintBytes, err := convertFingerprint(fingerprint); err != nil {
+		return nil, err
+	} else {
+		if tlsConfig == nil {
+			return &tls.Config{
+				InsecureSkipVerify:    true,
+				VerifyPeerCertificate: verifyPeerCertificateAndFingerprints([][32]byte{*fingerprintBytes}),
+			}, nil
+		} else {
+			tlsConfig.InsecureSkipVerify = true
+			tlsConfig.VerifyPeerCertificate = verifyPeerCertificateAndFingerprints([][32]byte{*fingerprintBytes})
+			return tlsConfig, nil
+		}
+	}
 }
 
 func MixinTLSConfig(tlsConfig *tls.Config) *tls.Config {
@@ -75,6 +102,6 @@ func MixinTLSConfig(tlsConfig *tls.Config) *tls.Config {
 	}
 
 	tlsConfig.InsecureSkipVerify = true
-	tlsConfig.VerifyPeerCertificate = verifyPeerCertificate
+	tlsConfig.VerifyPeerCertificate = verifyPeerCertificateAndFingerprints(globalFingerprints)
 	return tlsConfig
 }