mirror of
https://wget.la/https://github.com/leookun/cursor-byok
synced 2026-08-17 19:47:10 +08:00
v0.3.8
This commit is contained in:
leokun
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMCQ04x
|
||||
CzAJBgNVBAgTAlpKMQswCQYDVQQHEwJIWjEkMCIGA1UEChMbMTc3MDgwODQwMzI2
|
||||
ODEzMS53cHJveHkub3JnMRMwEQYDVQQLEwp3cHJveHkub3JnMSEwHwYDVQQDExh3
|
||||
aGlzdGxlLjE3NzA4MDg0MDMyNjgxMzEwHhcNMjUwMjExMTExMzIzWhcNMzYwMjEx
|
||||
MTExMzIzWjCBhTELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpKMQswCQYDVQQHEwJI
|
||||
WjEkMCIGA1UEChMbMTc3MDgwODQwMzI2ODEzMS53cHJveHkub3JnMRMwEQYDVQQL
|
||||
Ewp3cHJveHkub3JnMSEwHwYDVQQDExh3aGlzdGxlLjE3NzA4MDg0MDMyNjgxMzEw
|
||||
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKHeM0P9oW6y5GMZOaFC1f
|
||||
aGQXWqug2MQQoLFY+V+mu92XxPG6nE2/VNByb4r0qxLs7Gcpg/hC2/TrxcttoIIa
|
||||
6gD/Gmivp6etPzkq6UGrSPzP+DXLRVbGPPfE30X00PXeH3LENkKfvp6BtGSEXGle
|
||||
jDruMuwiWupYNKW0RGVMqHZwnWCFNG5A1KvuO0pCAUBHdpDp1PM4/h8I60tifreM
|
||||
vj5hzF0agrrq3Hx4UerygEti+xws2OORoAeKVkXADgmvvMcGh9NEGDTh5m6bZRNp
|
||||
GqZLJPrmJ9ebi9F1BriTUVLWCeqE8yEiNJPxvpGTG9ss2YWmQ58j14IxGkUbvL41
|
||||
AgMBAAGjgaEwgZ4wDgYDVR0PAQH/BAQDAgL0MDsGA1UdJQQ0MDIGCCsGAQUFBwMB
|
||||
BggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDAPBgNVHRMB
|
||||
Af8EBTADAQH/MB0GA1UdDgQWBBRhDWYHYoU5JEfw0v3YM2D94hJrSTAfBgNVHSME
|
||||
GDAWgBRhDWYHYoU5JEfw0v3YM2D94hJrSTANBgkqhkiG9w0BAQsFAAOCAQEAt/GR
|
||||
VsXu5tq6e9Nm9dEKPfyd0xp0tyZfkv+/Tk9acn7FVq1ag+BrUoC7vV/tD4ltw7Fh
|
||||
knSz6ML1H/tr/bbgYMNBSkb/I4qc0kfMlmj0xNOsGgzN26BzMt5NiGkDABWMUYFW
|
||||
hrZcTUt/mDOwB3oJQNRw0pmoHgDtRoN7TsRbrwT3JiQZk3lInptbY4wWs2+1J+LU
|
||||
lK0bCZg2+2MNEydulvX6pJ8gaptlYLUGcH6UfhOqjBW9zxGCzlA+Qi9s0ycISvjw
|
||||
ZFc9D55SliFfxRKvOQC46s5+0tnM1Ik3ekOIx+KeXkHckigIDlzn3gmfU8st/8m9
|
||||
YMXgBIgkG1UhdIazFw==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,258 @@
|
||||
package certs
|
||||
|
||||
import (
|
||||
"crypto"
|
||||
"crypto/ecdsa"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
_ "embed"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"math/big"
|
||||
"net"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// embeddedCACertPEM 表示当前模块中的 embeddedCACertPEM 状态值。
|
||||
//
|
||||
//go:embed ca.crt
|
||||
var embeddedCACertPEM []byte
|
||||
|
||||
// embeddedCAKeyPEM 表示当前模块中的 embeddedCAKeyPEM 状态值。
|
||||
//
|
||||
//go:embed ca.key
|
||||
var embeddedCAKeyPEM []byte
|
||||
|
||||
// Manager 定义了当前模块中的 Manager 类型。
|
||||
type Manager struct {
|
||||
// caCert 表示当前声明中的 caCert。
|
||||
caCert *x509.Certificate
|
||||
// caKey 表示当前声明中的 caKey。
|
||||
caKey crypto.PrivateKey
|
||||
|
||||
// mu 表示当前声明中的 mu。
|
||||
mu sync.Mutex
|
||||
// cache 表示当前声明中的 cache。
|
||||
cache map[string]*tls.Certificate
|
||||
}
|
||||
|
||||
// NewManager 用于处理与 NewManager 相关的逻辑。
|
||||
func NewManager(caCertPath, caKeyPath string) (*Manager, error) {
|
||||
certPEM, keyPEM, err := loadCAPEMFromFiles(caCertPath, caKeyPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return NewManagerFromPEM(certPEM, keyPEM)
|
||||
}
|
||||
|
||||
// NewEmbeddedManager 用于处理与 NewEmbeddedManager 相关的逻辑。
|
||||
func NewEmbeddedManager() (*Manager, error) {
|
||||
return NewManagerFromPEM(embeddedCACertPEM, embeddedCAKeyPEM)
|
||||
}
|
||||
|
||||
// EmbeddedCACertPEM 用于处理与 EmbeddedCACertPEM 相关的逻辑。
|
||||
func EmbeddedCACertPEM() []byte {
|
||||
return cloneBytes(embeddedCACertPEM)
|
||||
}
|
||||
|
||||
// EmbeddedCAKeyPEM 用于处理与 EmbeddedCAKeyPEM 相关的逻辑。
|
||||
func EmbeddedCAKeyPEM() []byte {
|
||||
return cloneBytes(embeddedCAKeyPEM)
|
||||
}
|
||||
|
||||
// NewManagerFromPEM 用于处理与 NewManagerFromPEM 相关的逻辑。
|
||||
func NewManagerFromPEM(caCertPEM, caKeyPEM []byte) (*Manager, error) {
|
||||
caCert, caKey, err := loadCAFromPEM(caCertPEM, caKeyPEM)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &Manager{caCert: caCert, caKey: caKey, cache: make(map[string]*tls.Certificate)}, nil
|
||||
}
|
||||
|
||||
// CATLSCertificate 用于处理与 CATLSCertificate 相关的逻辑。
|
||||
func (m *Manager) CATLSCertificate() (*tls.Certificate, error) {
|
||||
if m == nil || m.caCert == nil || m.caKey == nil {
|
||||
return nil, errors.New("CA is not initialized")
|
||||
}
|
||||
return &tls.Certificate{
|
||||
Certificate: [][]byte{append([]byte(nil), m.caCert.Raw...)},
|
||||
PrivateKey: m.caKey,
|
||||
Leaf: m.caCert,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// CertificateForServerName 用于处理与 CertificateForServerName 相关的逻辑。
|
||||
func (m *Manager) CertificateForServerName(serverName string) (*tls.Certificate, error) {
|
||||
host := normalizeHost(serverName)
|
||||
if host == "" {
|
||||
return nil, errors.New("empty server name")
|
||||
}
|
||||
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
if cert, ok := m.cache[host]; ok {
|
||||
return cert, nil
|
||||
}
|
||||
|
||||
serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
leaf := &x509.Certificate{
|
||||
SerialNumber: serial,
|
||||
Subject: pkix.Name{
|
||||
CommonName: host,
|
||||
Organization: []string{"Cursor Local Proxy"},
|
||||
},
|
||||
NotBefore: time.Now().Add(-1 * time.Hour),
|
||||
NotAfter: time.Now().Add(365 * 24 * time.Hour),
|
||||
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
if len(m.caCert.SubjectKeyId) > 0 {
|
||||
leaf.AuthorityKeyId = append([]byte(nil), m.caCert.SubjectKeyId...)
|
||||
}
|
||||
|
||||
if ip := net.ParseIP(host); ip != nil {
|
||||
leaf.IPAddresses = []net.IP{ip}
|
||||
} else {
|
||||
leaf.DNSNames = []string{host}
|
||||
}
|
||||
|
||||
leafPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
leafPublicKey := &leafPrivateKey.PublicKey
|
||||
|
||||
der, err := x509.CreateCertificate(rand.Reader, leaf, m.caCert, leafPublicKey, m.caKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
leafCertPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
|
||||
chainPEM := append([]byte(nil), leafCertPEM...)
|
||||
chainPEM = append(chainPEM, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: m.caCert.Raw})...)
|
||||
|
||||
keyPEM, err := marshalPrivateKeyPEM(leafPrivateKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
pair, err := tls.X509KeyPair(chainPEM, keyPEM)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
parsedLeaf, err := x509.ParseCertificate(der)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pair.Leaf = parsedLeaf
|
||||
|
||||
m.cache[host] = &pair
|
||||
return &pair, nil
|
||||
}
|
||||
|
||||
// marshalPrivateKeyPEM 用于处理与 marshalPrivateKeyPEM 相关的逻辑。
|
||||
func marshalPrivateKeyPEM(key any) ([]byte, error) {
|
||||
switch k := key.(type) {
|
||||
case *rsa.PrivateKey:
|
||||
return pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(k)}), nil
|
||||
case *ecdsa.PrivateKey:
|
||||
der, err := x509.MarshalECPrivateKey(k)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: der}), nil
|
||||
case ed25519.PrivateKey:
|
||||
der, err := x509.MarshalPKCS8PrivateKey(k)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der}), nil
|
||||
default:
|
||||
return nil, errors.New("unsupported private key type")
|
||||
}
|
||||
}
|
||||
|
||||
// loadCAPEMFromFiles 用于处理与 loadCAPEMFromFiles 相关的逻辑。
|
||||
func loadCAPEMFromFiles(certPath, keyPath string) ([]byte, []byte, error) {
|
||||
certPEM, err := os.ReadFile(certPath)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
keyPEM, err := os.ReadFile(keyPath)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return certPEM, keyPEM, nil
|
||||
}
|
||||
|
||||
// loadCAFromPEM 用于处理与 loadCAFromPEM 相关的逻辑。
|
||||
func loadCAFromPEM(certPEM, keyPEM []byte) (*x509.Certificate, crypto.PrivateKey, error) {
|
||||
certBlock, _ := pem.Decode(certPEM)
|
||||
if certBlock == nil {
|
||||
return nil, nil, errors.New("invalid CA cert PEM")
|
||||
}
|
||||
caCert, err := x509.ParseCertificate(certBlock.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
keyBlock, _ := pem.Decode(keyPEM)
|
||||
if keyBlock == nil {
|
||||
return nil, nil, errors.New("invalid CA key PEM")
|
||||
}
|
||||
|
||||
switch keyBlock.Type {
|
||||
case "RSA PRIVATE KEY":
|
||||
key, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return caCert, key, nil
|
||||
case "EC PRIVATE KEY":
|
||||
key, err := x509.ParseECPrivateKey(keyBlock.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return caCert, key, nil
|
||||
case "PRIVATE KEY":
|
||||
key, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return caCert, key, nil
|
||||
default:
|
||||
return nil, nil, errors.New("unsupported CA key format")
|
||||
}
|
||||
}
|
||||
|
||||
// normalizeHost 用于处理与 normalizeHost 相关的逻辑。
|
||||
func normalizeHost(serverName string) string {
|
||||
serverName = strings.TrimSpace(serverName)
|
||||
if strings.Contains(serverName, ":") {
|
||||
h, _, err := net.SplitHostPort(serverName)
|
||||
if err == nil {
|
||||
serverName = h
|
||||
}
|
||||
}
|
||||
return serverName
|
||||
}
|
||||
|
||||
// cloneBytes 用于处理与 cloneBytes 相关的逻辑。
|
||||
func cloneBytes(src []byte) []byte {
|
||||
dst := make([]byte, len(src))
|
||||
copy(dst, src)
|
||||
return dst
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAyh3jND/aFusuRjGTmhQtX2hkF1qroNjEEKCxWPlfprvdl8Tx
|
||||
upxNv1TQcm+K9KsS7OxnKYP4Qtv068XLbaCCGuoA/xpor6enrT85KulBq0j8z/g1
|
||||
y0VWxjz3xN9F9ND13h9yxDZCn76egbRkhFxpXow67jLsIlrqWDSltERlTKh2cJ1g
|
||||
hTRuQNSr7jtKQgFAR3aQ6dTzOP4fCOtLYn63jL4+YcxdGoK66tx8eFHq8oBLYvsc
|
||||
LNjjkaAHilZFwA4Jr7zHBofTRBg04eZum2UTaRqmSyT65ifXm4vRdQa4k1FS1gnq
|
||||
hPMhIjST8b6RkxvbLNmFpkOfI9eCMRpFG7y+NQIDAQABAoIBAATU9ZVOcHmLSkop
|
||||
zcBJerM09O2dAIziGb/XA55fqdJ728aQ0gGW0oIANlKCCaWjQFrTJP04VzNL/F01
|
||||
l5EpnOqlTPxMRpPqc2cAI677sBL29fpH0gtnvzUSiI7Xkp3RcAtNH6qCrJGSlkn+
|
||||
BMgoSGmW+yKuK3h/yWnt6kc2umA8fN+bHKhS3pI56PMW8qVnny9n92RaCA7Uf/4j
|
||||
XDewIreiH5jRqRwrPbOpjDFmv+W18LWZQiTwwxfY6sRZiZpsfsHidzfFGUFZXMlq
|
||||
2P3FCqoF4oMM1rRgBlHhDR7JHmSkFpZG639HJTXLllpyDbj3H86nsjIj9WZYKn+h
|
||||
B9k9bcECgYEA1HDzRCqoRZh6cL46KiYjv+LwmEKMa3nPb4ljywgLbRkzTMyVs0MK
|
||||
fDsDoTLFY9PBhveypU5gjTbQqtyBsDtbU+dH9Eks1FdL9P8bJf0ZOJFRiEB7uB4a
|
||||
z3V9tcXHwH4l2bCWbWThQGFwRudDAoY0EH89oSA/WHayjOKe1Wi4ovUCgYEA848B
|
||||
cYi+Qbkk+fOv9gSJn8KS1LH/jE28S/e7E4YkTfYUuu+7wr8bdRKUNpPIsLX0Fo9R
|
||||
KpJX0Oyjjady9n/8ARZRmD8Upl+F7Sl7Ro6F8+nfqQUrxbVDiIL3b+aZF+cDfFrB
|
||||
/xL5kyZZqTtFfP360tfYnlS6Sssd4E2Jsj0fJkECgYEA0gG+WbqZkgMDtwQ114jQ
|
||||
elZLZRkUWwKVjzsQDZssQHNTBS6RJh619M0Z73aTLvYcL+IZFdT/GVoAuYc2JRLo
|
||||
W28c8F6OFHMfwVeWbN1g20y8fqbQJtiLxF3vIYwcxStvG123tvisu8oXBeCDm7Ez
|
||||
MsO2FtwcAsWECEXWojzdmSkCgYEA18GvPawtHnuszd+Z2Q5b/DKZb+Hex6N1Ura5
|
||||
+qmyL333D0Kfyf0RjbxPn6l690+4UuPSuyu4r1Nx72KO7N6jlzL2RTBcUqX8NgOx
|
||||
OOe4skJT5561EAdrM9sQ5wgYRpxW8ipUAGoGvNwUQV5ISFmVgIHFWz0jam5UoQcP
|
||||
G94ZYgECgYBN4PB8BuAwMRqhTCLL5RJKtcdC/Ls9xdWrmswtQQ4OSBUTLGdeMhEN
|
||||
E23F0d+NdtiTWDYRDJ7z6KAF8CcOwWMt2sNbrxgNRuDzyfLqbuVLOM8iY3xA50Nl
|
||||
clZWujKILWp47+gA6/AqJLv2lA2LK8gM8zYzzm/nCuLCBLYH/hOiCA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,2 @@
|
||||
// Package certs 负责管理本地 MITM 所需的内置 CA 证书与 TLS 材料。
|
||||
package certs
|
||||
Reference in New Issue
Block a user