diff --git a/Tun/Super/SDLSuperService.swift b/Tun/Super/SDLSuperService.swift index 531d64c..52cd4bb 100644 --- a/Tun/Super/SDLSuperService.swift +++ b/Tun/Super/SDLSuperService.swift @@ -82,7 +82,7 @@ actor SDLSuperService { let onMessage = self.onMessage group.addTask { - for try await message in await superClient.messageStream { + for try await message in superClient.messageStream { try Task.checkCancellation() await onMessage(message) } diff --git a/Tun/Super/SDLSuperTLSVerifier.swift b/Tun/Super/SDLSuperTLSVerifier.swift index 2c94efc..6540079 100644 --- a/Tun/Super/SDLSuperTLSVerifier.swift +++ b/Tun/Super/SDLSuperTLSVerifier.swift @@ -9,55 +9,55 @@ import CryptoKit import Security enum SDLSuperTLSVerifier { - // 你的 Base64 公钥指纹 - static let pinnedPublicKeyHashes = [ - "Q41r6hbMWEVyxo6heNAH4Wx/TH5NNOWlNif9bewcJ3E=" - ] - - static func verify(trust: sec_trust_t, host: String) -> Bool { - let secTrust = sec_trust_copy_ref(trust).takeRetainedValue() - - // --- Step 1: 系统验证 --- - var error: CFError? - guard SecTrustEvaluateWithError(secTrust, &error) else { - SDLLogger.log("❌ 系统证书验证失败: \(error?.localizedDescription ?? "未知错误")", for: .debug) - return false - } - - // --- Step 2: 主机名验证 --- - let policy = SecPolicyCreateSSL(true, host as CFString) - SecTrustSetPolicies(secTrust, policy) - - guard SecTrustEvaluateWithError(secTrust, &error) else { - SDLLogger.log("❌ 主机名校验失败: \(error?.localizedDescription ?? "未知错误")", for: .debug) - return false - } - - // --- Step 3: 获取叶子证书 --- - guard let chain = SecTrustCopyCertificateChain(secTrust) as? [SecCertificate], - let leafCertificate = chain.first else { - SDLLogger.log("❌ 无法获取证书链或叶子证书", for: .debug) - return false - } - - // --- Step 4: 提取公钥 --- - guard let publicKey = SecCertificateCopyKey(leafCertificate), - let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else { - SDLLogger.log("❌ 无法提取公钥", for: .debug) - return false - } - - // --- Step 5: SHA256 校验 --- - let hash = SHA256.hash(data: publicKeyData) - let hashBase64 = Data(hash).base64EncodedString() - - if pinnedPublicKeyHashes.contains(hashBase64) { - SDLLogger.log("✅ 公钥校验通过", for: .debug) - return true - } else { - SDLLogger.log("⚠️ 公钥不匹配! 收到: \(hashBase64)", for: .debug) - return false - } + // 你的 Base64 公钥指纹 + static let pinnedPublicKeyHashes = [ + "Q41r6hbMWEVyxo6heNAH4Wx/TH5NNOWlNif9bewcJ3E=" + ] + + static func verify(trust: sec_trust_t, host: String) -> Bool { + let secTrust = sec_trust_copy_ref(trust).takeRetainedValue() + + // --- Step 1: 系统验证 --- + var error: CFError? + guard SecTrustEvaluateWithError(secTrust, &error) else { + SDLLogger.log("❌ 系统证书验证失败: \(error?.localizedDescription ?? "未知错误")", for: .debug) + return false + } + + // --- Step 2: 主机名验证 --- + let policy = SecPolicyCreateSSL(true, host as CFString) + SecTrustSetPolicies(secTrust, policy) + + guard SecTrustEvaluateWithError(secTrust, &error) else { + SDLLogger.log("❌ 主机名校验失败: \(error?.localizedDescription ?? "未知错误")", for: .debug) + return false + } + + // --- Step 3: 获取叶子证书 --- + guard let chain = SecTrustCopyCertificateChain(secTrust) as? [SecCertificate], + let leafCertificate = chain.first else { + SDLLogger.log("❌ 无法获取证书链或叶子证书", for: .debug) + return false + } + + // --- Step 4: 提取公钥 --- + guard let publicKey = SecCertificateCopyKey(leafCertificate), + let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else { + SDLLogger.log("❌ 无法提取公钥", for: .debug) + return false + } + + // --- Step 5: SHA256 校验 --- + let hash = SHA256.hash(data: publicKeyData) + let hashBase64 = Data(hash).base64EncodedString() + + if pinnedPublicKeyHashes.contains(hashBase64) { + SDLLogger.log("✅ 公钥校验通过", for: .debug) + return true + } else { + SDLLogger.log("⚠️ 公钥不匹配! 收到: \(hashBase64)", for: .debug) + return false } - } + +}