ProHoster > Π‘Π»ΠΎΠ³ > Maamulka > Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Maqaalku wuxuu noqon doonaa mid waxtar u leh kuwa:

  • wuu garanayaa waxa uu yahay Client Cert wuuna fahmay sababta ay ugu baahan tahay websockets on Safari mobaylada;
  • Waxaan jeclaan lahaa inaan u daabaco adeegyada shabakadda dad kooban ama naftayda oo keliya;
  • Waxay u malaynaysaa in wax walba uu horay u sameeyay qof, oo jeclaan lahaa in uu adduunka ka dhigo mid ku habboon oo ammaan ah.

Taariikhda websockets waxay bilaabatay qiyaastii 8 sano ka hor. Markii hore, hababka waxaa loo isticmaali jiray qaab codsi dheer oo http ah (dhab ahaantii jawaabaha): browserka isticmaalaha ayaa codsi u diray server-ka oo sugayay inuu ka jawaabo wax, ka dib jawaabta ayaa mar kale ku xirtay oo sugtay. Laakiin markaa websockets ayaa soo muuqday.

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Dhowr sano ka hor, waxaan ku horumarinay dhaqankeena PHP saafi ah, oo aan isticmaali karin codsiyada https, maadaama kani yahay lakabka isku xirka. Muddo aan fogayn, ku dhawaad ​​dhammaan adeegayaasha shabakadu waxay barteen codsiyada wakiilnimada ee https iyo taageerada xidhiidhka: cusboonaysiinta.

Markii ay taasi dhacday, websockets waxay noqdeen ku dhawaad ​​adeegga caadiga ah ee codsiyada SPA, sababtoo ah sida ay ugu habboon tahay in la siiyo macluumaadka isticmaalaha hindisaha serverka (u gudbi fariinta isticmaale kale ama soo dejiso nooc cusub oo sawir ah, dukumeenti, soo bandhigid in qof kale hadda wax tafatiro) .

In kasta oo Shahaadada Macmiilku ay jirtay in muddo ah, haddana weli si liidata loo taageero, maadaama ay abuurto dhibaatooyin badan marka la isku dayo in laga gudbo. Iyo (laga yaabo :slightly_smiling_face: ) waana sababta daalacashada IOS (dhammaan laga reebo Safari) ma rabaan inay isticmaalaan oo ay ka codsadaan dukaanka shahaadaynta deegaanka. Shahaadooyinku waxay leeyihiin faa'iidooyin badan marka la barbar dhigo gelitaanka/pass ama furayaasha ssh ama xidhitaanka dekedaha lagama maarmaanka ah iyada oo loo marayo firewall. Laakiin taasi maaha waxa ay tani ku saabsan tahay.

IOS, habka loogu rakibo shahaado waa mid fudud (ma aha iyada oo aan wax gaar ah lahayn), laakiin guud ahaan waxaa loo sameeyaa si waafaqsan tilmaamaha, kuwaas oo ay jiraan wax badan oo internetka ah oo kaliya oo loo heli karo browserka Safari. Nasiib darro, Safari ma garanayo sida loo isticmaalo Client Cert ee saldhigyada webka, laakiin waxaa jira tilmaamo badan oo ku saabsan internetka oo ku saabsan sida loo abuuro shahaadadan, laakiin ficil ahaan tani waa mid aan la heli karin.

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Si loo fahmo websockets, waxaan isticmaalnay qorshaha soo socda: dhibaato/malo awaal/xalin.

Dhibaato: ma jirto wax taageero ah oo loogu talagalay saldhigyada shabakada marka la wakiilanayo codsiyada agabka ay ilaaliso shahaadada macmiilka ee browserka mobaylka Safari ee IOS iyo codsiyada kale ee suurtageliyay taageerada shahaadada.

Mala-awaal:

  1. Waa suurtogal in la habeeyo ka-reebitaankan oo kale si loo isticmaalo shahaadooyinka (iyadoo la og yahay inaysan jiri doonin) shabakadaha ilaha gudaha/dibadda ee proxied.
  2. Sockets-ka, waxaad samayn kartaa xiriir gaar ah, sugan oo la difaaci karo adigoo isticmaalaya kalfadhiyo ku meel gaar ah oo la soo saaray inta lagu jiro codsiga browserka caadiga ah (non-websocket).
  3. Kulamada ku meel gaadhka ah waxa lagu fulin karaa iyada oo la isticmaalayo hal server-ka wakiil (qayb-ku-dhisan iyo hawlo keliya).
  4. Calaamadaha fadhiga ku meel gaadhka ah ayaa horeba loo hirgeliyey sidii qaybo Apache oo diyaarsan.
  5. Calaamadaha fadhiga ku meel gaadhka ah waxaa lagu hirgelin karaa iyadoo si macquul ah loo naqshadeynayo qaabka isdhexgalka.

Xaalad muuqata ka dib hirgelinta.

Hadafka shaqada: maamulka adeegyada iyo kaabayaasha waa in laga heli karaa taleefanka gacanta ee IOS iyada oo aan la helin barnaamijyo dheeraad ah (sida VPN), midaysan oo sugan.

Hadafka dheeriga ah: Badbaadinta wakhtiga iyo agabka/taraafikada taleefanka (adeegyada qaarkood oo aan lahayn saldhigyada shabakadu waxay abuuraan codsiyo aan loo baahnayn) iyadoo si dhakhso leh loogu gudbinayo macluumaadka internetka moobiilka.

Sidee baad u eegtaa?

1. Bogagga furitaanka: 

β€” Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, https://teamcity.yourdomain.com Π² мобильном Π±Ρ€Π°ΡƒΠ·Π΅Ρ€Π΅ Safari (доступСн Ρ‚Π°ΠΊΠΆΠ΅ Π² дСсктопной вСрсии) β€” Π²Ρ‹Π·Ρ‹Π²Π°Π΅Ρ‚ ΡƒΡΠΏΠ΅ΡˆΠ½ΠΎΠ΅ ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ ΠΊ Π²Π΅Π±-сокСтам.
β€” Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, https://teamcity.yourdomain.com/admin/admin.html?item=diagnostics&tab=webS…— ΠΏΠΎΠΊΠ°Π·Ρ‹Π²Π°Π΅Ρ‚ ping/pong.
β€” Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, https://rancher.yourdomain.com/p/c-84bnv:p-vkszd/workload/deployment:danidb:ph…-> viewlogs β€” ΠΏΠΎΠΊΠ°Π·Ρ‹Π²Π°Π΅Ρ‚ Π»ΠΎΠ³ΠΈ ΠΊΠΎΠ½Ρ‚Π΅ΠΉΠ½Π΅Ρ€Π°.

2. Ama ku jira console-ka horumariyaha:

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Tijaabada mala-awaalka:

1. Waa suurtogal in la habeeyo ka-reebitaankan oo kale si loo isticmaalo shahaadooyinka (iyadoo la og yahay in aanay jiri doonin) saldhigyada shabakadaha gudaha/dibadda ee ilaha proxied.

2 xal ayaa halkan laga helay:

a) Heerka 

<Location sock*> SSLVerifyClient optional </Location>
<Location /> SSLVerifyClient require </Location>

beddelo heerka gelitaanka.

Habkani wuxuu leeyahay nuancesyada soo socda:

  • Xaqiijinta shahaadadu waxay dhacdaa ka dib marka la codsado ilaha wakiillada, taas oo ah, gacan qaad codsi kadib. Tani waxay ka dhigan tahay in wakiilku marka hore soo shubi doono ka dibna uu jarayo codsiga adeegga la ilaaliyo. Tani waa xun, laakiin maaha mid muhiim ah;
  • In nidaamka http2. Wali waa qabyo, iyo soosaarayaasha browserka ma garanayaan sida loo fuliyo #info ku saabsan tls1.3 http2 gacan qaad kadib (aan shaqayn hadda) Hirgeli RFC 8740 "Isticmaalka TLS 1.3 oo wata HTTP/2";
  • Ma cadda sida loo midayn karo habayntan.

b) Heerka aasaasiga ah, ogow ssl bilaa shahaado.

SSLVerifyClient waxay u baahan tahay => SSLVerifyClient ikhtiyaari ah, laakiin tani waxay yaraynaysaa heerka amniga server-ka wakiilnimada, maadaama xidhiidhkan oo kale lagu farsamayn doono shahaado la'aan. Si kastaba ha ahaatee, waxaad si dheeraad ah u diidi kartaa helitaanka adeegyada wakiillada iyadoo la raacayo dardaaranka soo socda:

RewriteEngine        on
RewriteCond     %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteRule     .? - [F]
ErrorDocument 403 "You need a client side certificate issued by CAcert to access this site"

Macluumaad faahfaahsan oo dheeraad ah ayaa laga heli karaa maqaalka ku saabsan ssl: Xaqiijinta Shahaadada Macmiilka Server Apache

Labada ikhtiyaarba waa la tijaabiyay, ikhtiyaarka "b" ayaa loo doortay isku-duubnaantiisa iyo waafaqsanaanta borotokoolka http2.

Si loo dhamaystiro xaqiijinta mala-awaalkan, waxay qaadatay tijaabooyin badan qaabaynta; nashqadaha soo socda ayaa la tijaabiyay:

haddii = baahan = dib u qor

Natiijadu waa naqshadda aasaasiga ah ee soo socota:

SSLVerifyClient optional
RewriteEngine on
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
RewriteRule     .? - [F]
#ErrorDocument 403 "You need a client side certificate issued by CAcert to access this site"

#websocket for safari without cert auth
<If "%{SSL:SSL_CLIENT_VERIFY} != 'SUCCESS'">
<If "%{HTTP:Upgrade} = 'websocket'">
...
    #Π·Π°ΠΌΠ΅Ρ‰Π°Π΅ΠΌ Π°Π²Ρ‚ΠΎΡ€ΠΈΠ·Π°Ρ†ΠΈΡŽ ΠΏΠΎ Π²Π»Π°Π΄Π΅Π»ΡŒΡ†Ρƒ сСртификата Π½Π° Π°Π²Ρ‚ΠΎΡ€ΠΈΠ·Π°Ρ†ΠΈΡŽ ΠΏΠΎ Π½ΠΎΠΌΠ΅Ρ€Ρƒ ΠΏΡ€ΠΎΡ‚ΠΎΠΊΠΎΠ»Π°
    SSLUserName SSl_PROTOCOL
</If>
</If>

Anigoo tixgelinaya oggolaanshaha jira ee mulkiilaha shahaadada, laakiin leh shahaado maqan, waa inaan ku daraa mulkiilaha shahaado aan jirin oo ah qaab mid ka mid ah doorsoomayaasha la heli karo SSl_PROTOCOL (halkii SSL_CLIENT_S_DN_CN), faahfaahin dheeraad ah oo ku jirta dukumeentiga:

Module Apache mod_ssl

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

2. Shabakadda internetka, waxaad samayn kartaa xiriir gaar ah, sugan oo ilaalinaya adigoo isticmaalaya kalfadhiyo ku meel gaar ah oo la soo saaray inta lagu jiro codsiga browserka caadiga ah (non-websocket).

Iyada oo ku saleysan waayo-aragnimadii hore, waxaad u baahan tahay inaad ku darto qayb dheeraad ah qaabeynta si aad u diyaariso calaamado ku meel gaar ah xirmooyinka godadka shabakada inta lagu jiro codsiga caadiga ah (non-web socket).

#ΠΏΠΎΠ΄Π³ΠΎΡ‚ΠΎΠ²ΠΊΠ° ΠΏΠ΅Ρ€Π΅Π΄Π°Ρ‡Π° сСбС Π‘ookie Ρ‡Π΅Ρ€Π΅Π· ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»ΡŒΡΠΊΠΈΠΉ Π±Ρ€Π°ΡƒΠ·Π΅Ρ€
<If "%{SSL:SSL_CLIENT_VERIFY} = 'SUCCESS'">
<If "%{HTTP:Upgrade} != 'websocket'">
Header set Set-Cookie "websocket-allowed=true; path=/; Max-Age=100"
</If>
</If>

#ΠΏΡ€ΠΎΠ²Π΅Ρ€ΠΊΠ° Cookie для установлСния Π²Π΅Π±-сокСт соСдинСния
<source lang="javascript">
<If "%{SSL:SSL_CLIENT_VERIFY} != 'SUCCESS'">
<If "%{HTTP:Upgrade} = 'websocket'">
#check for exists cookie

#get and check
SetEnvIf Cookie "websocket-allowed=(.*)" env-var-name=$1

#or rewrite rule
RewriteCond %{HTTP_COOKIE} !^.*mycookie.*$

#or if
<If "%{HTTP_COOKIE} =~ /(^|; )cookie-names*=s*some-val(;|$)/ >
</If

</If>
</If>

Tijaabadu waxay muujisay inay shaqaynayso. Waa suurtagal in aad ku wareejiso kukiyada adiga oo isticmaalaya browserka isticmaalaha.

3. Kulamada ku meel gaadhka ah waxa lagu fulin karaa iyada oo la isticmaalayo hal server web wakiil (kaliya qaybo iyo hawlo ku dhex dhisan).

Sida aan horay u ogaanay, Apache waxay leedahay wax badan oo ka mid ah shaqeynta asaasiga ah oo kuu ogolaaneysa inaad abuurto dhismo shuruudo ah. Si kastaba ha ahaatee, waxaan u baahanahay si aan u ilaalino macluumaadkayaga inta ay ku jirto browserka isticmaalaha, si aan u dejino waxa la kaydiyo iyo sababta, iyo waxa la dhisay ee aan isticmaali doono:

  • Waxaan u baahanahay calaamad aan si fudud loo kala saari karin.
  • Waxaan u baahanahay calaamad ku dhisan gabowga iyo awoodda lagu hubinayo gabowga ee server-ka.
  • Waxaan u baahanahay calaamad lala xiriirin doono mulkiilaha shahaadada.

Tani waxay u baahan tahay shaqo xashiish ah, milix, iyo taariikhda da'da calaamadda. Iyada oo ku saleysan dukumentiyada Odhaahyada ku jira Server-ka Apache HTTP waxaan dhamaanteen ka saarnay sanduuqa sha1 iyo %{TIME}.

Natiijadu waxay ahayd nashqadan:

#Π½Π΅Ρ‚ сСртификата, ΠΈ ΠΎΠ±Ρ€Π°Ρ‰Π΅Π½ΠΈΠ΅ ΠΊ websocket
<If "%{SSL:SSL_CLIENT_VERIFY} != 'SUCCESS'">
<If "%{HTTP:Upgrade} = 'websocket'">
    SetEnvIf Cookie "zt-cert-sha1=([^;]+)" zt-cert-sha1=$1
    SetEnvIf Cookie "zt-cert-uid=([^;]+)" zt-cert-uid=$1
    SetEnvIf Cookie "zt-cert-date=([^;]+)" zt-cert-date=$1

#Ρ‚ΠΎΠ»ΡŒΠΊΠΎ Ρ‚Π°ΠΊ ΠΌΠΎΠΆΠ½ΠΎ Ρ€Π°Π±ΠΎΡ‚Π°Ρ‚ΡŒ с ΠΏΠ΅Ρ€Π΅ΠΌΠ΅Π½Π½Ρ‹ΠΌΠΈ, ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΌΠΈ Π² env-Π°Ρ… Π² этот ΠΌΠΎΠΌΠ΅Π½Ρ‚ Π²Ρ€Π΅ΠΌΠ΅Π½ΠΈ, Π±ΠΎΠ»Π΅Π΅ ΠΎΠ½ΠΈ Π½ΠΈΠ³Π΄Π΅ Π½Π΅ доступны для Ρ„ΡƒΠ½ΠΊΡ†ΠΈΠΈ Ρ…Π΅ΡˆΠΈΡ€ΠΎΠ²Π°Π½ΠΈΡ (ΠΏΠΎ ΠΎΡ‚Π΄Π΅Π»ΡŒΠ½ΠΎΡΡ‚ΠΈ ΠΌΠΎΠΆΠ½ΠΎ, Π½ΠΎ Π½Π΅ вмСстС, Π΄Π° ΠΈ Π΅Ρ‰Ρ‘ с Ρ…Π΅ΡˆΠΈΡ€ΠΎΠ²Π°Π½ΠΈΠ΅ΠΌ)
    <RequireAll>
        Require expr %{sha1:salt1%{env:zt-cert-date}salt3%{env:zt-cert-uid}salt2} == %{env:zt-cert-sha1}
        Require expr %{env:zt-cert-sha1} =~ /^.{40}$/
    </RequireAll>
</If>
</If>

#Π΅ΡΡ‚ΡŒ сСртификат, Π·Π°ΠΏΡ€Π°ΡˆΠΈΠ²Π°Π΅Ρ‚ΡΡ Π½Π΅ websocket
<If "%{SSL:SSL_CLIENT_VERIFY} = 'SUCCESS'">
<If "%{HTTP:Upgrade} != 'websocket'">
    SetEnvIf Cookie "zt-cert-sha1=([^;]+)" HAVE_zt-cert-sha1=$1

    SetEnv zt_cert "path=/; HttpOnly;Secure;SameSite=Strict"
#НовыС ΠΊΡƒΠΊΠΈ ставятся, Ссли старых Π½Π΅Ρ‚
    Header add Set-Cookie "expr=zt-cert-sha1=%{sha1:salt1%{TIME}salt3%{SSL_CLIENT_S_DN_CN}salt2};%{env:zt_cert}" env=!HAVE_zt-cert-sha1
    Header add Set-Cookie "expr=zt-cert-uid=%{SSL_CLIENT_S_DN_CN};%{env:zt_cert}" env=!HAVE_zt-cert-sha1
    Header add Set-Cookie "expr=zt-cert-date=%{TIME};%{env:zt_cert}" env=!HAVE_zt-cert-sha1
</If>
</If>

Hadafka waa la gaarey, laakiin waxaa jira dhibaatooyin ku saabsan duugista server-ka (waxaad isticmaali kartaa kukiyada sanadka jira), taas oo macnaheedu yahay in calaamadaha, inkasta oo ay ammaan u yihiin isticmaalka gudaha, ay yihiin kuwo aan badbaado u ahayn isticmaalka warshadaha (mass).

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

4. Calaamadaha fadhiga ku meel gaadhka ah ayaa horeba loo hirgeliyey sidii qaybo Apache oo diyaarsan.

Hal dhibaato oo muhiim ah ayaa ka soo hadhay soo noqnoqonkii hore - awood la'aanta in la xakameeyo gabownimada calaamadda.

Waxaan raadineynaa cutub diyaarsan oo tan sameeya, sida ku cad erayada: apache token json two factor auth

Haa, waxaa jira qaybo diyaarsan, laakiin dhammaantood waxay ku xidhan yihiin ficillo gaar ah waxayna leeyihiin farshaxanno qaab bilaabista fadhiga iyo Kukiyada dheeraadka ah. Taasi waa, ma aha in muddo ah.
Shan saacadood ayay nagu qaadatay inaan baadhno, taasoo aan natiijo la taaban karo ka soo bixin.

5. Calaamadaha fadhiga ku meel gaadhka ah waxaa lagu fulin karaa iyadoo si macquul ah loo qaabeynayo qaab dhismeedka isdhexgalka.

Qaybaha diyaarsan waa kuwo aad u adag, sababtoo ah waxaan u baahanahay kaliya dhowr hawlood.

Taas marka la yiraahdo, dhibka taariikhda ku jira ayaa ah in Apache's-ku-dhismay hawlaha aysan oggolayn soo saarista taariikhda mustaqbalka, mana jirto wax xisaab ah oo lagu daray / kala-goynta hawlaha gudaha ku jira marka la hubinayo gabowga.

Taasi waa, ma qori kartid:

(%{env:zt-cert-date} + 30) > %{DATE}

Waxaad is barbar dhigi kartaa laba tiro oo kaliya.

Intii aan raadinayey xal u helida dhibaatada Safari, waxaan helay maqaal xiiso leh: Ku sugidda HomeAssistant shahaadooyinka macmiilka (wuxuu la shaqeeyaa Safari/iOS)
Waxay qeexaysaa tusaalaha koodka Lua ee Nginx, kaas oo, sida ay soo baxday, aad u soo noqnoqonaysa macquulnimada qaybta qaabeynta ee aan horey u hirgelinay, marka laga reebo isticmaalka habka cusbada hmac ee xashiishka ( kan aan laga helin Apache).

Waxaa caddaatay in Lua yahay luqad leh caqli cad, waxaana suurtagal ah in wax fudud loo sameeyo Apache:

Markuu bartay farqiga u dhexeeya Nginx iyo Apache:

Iyo hawlaha laga heli karo soo saaraha luqadda Lua:
22.1 - Taariikhda iyo Waqtiga

Waxaan helnay hab lagu dejiyo doorsoomayaasha env fayl yar oo Lua ah si aan u dejino taariikhda mustaqbalka si loo barbardhigo tan hadda.

Tani waa sida qoraalka fudud ee Lua u eg yahay:

require 'apache2'

function handler(r)
    local fmt = '%Y%m%d%H%M%S'
    local timeout = 3600 -- 1 hour

    r.notes['zt-cert-timeout'] = timeout
    r.notes['zt-cert-date-next'] = os.date(fmt,os.time()+timeout)
    r.notes['zt-cert-date-halfnext'] = os.date(fmt,os.time()+ (timeout/2))
    r.notes['zt-cert-date-now'] = os.date(fmt,os.time())

    return apache2.OK
end

Oo tani waa sida ay dhammaan u wada shaqeeyaan, iyada oo la wanaajinayo tirada Kukiyada iyo beddelka calaamadda marka nuska wakhtiga ay timaado ka hor inta uusan dhicin kukigii hore (calaamad):

SSLVerifyClient optional

#LuaScope thread
#generate event variables zt-cert-date-next
LuaHookAccessChecker /usr/local/etc/apache24/sslincludes/websocket_token.lua handler early

#Π·Π°ΠΏΡ€Π΅Ρ‰Π°Π΅ΠΌ Π±Π΅Π· сСртификата Ρ‡Ρ‚ΠΎ-Ρ‚ΠΎ Π΅Ρ‰Ρ‘, ΠΊΡ€ΠΎΠΌΠ΅ webscoket
RewriteEngine on
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
RewriteRule     .? - [F]
#ErrorDocument 403 "You need a client side certificate issued by CAcert to access this site"

#websocket for safari without certauth
<If "%{SSL:SSL_CLIENT_VERIFY} != 'SUCCESS'">
<If "%{HTTP:Upgrade} = 'websocket'">
    SetEnvIf Cookie "zt-cert=([^,;]+),([^,;]+),[^,;]+,([^,;]+)" zt-cert-sha1=$1 zt-cert-date=$2 zt-cert-uid=$3

    <RequireAll>
        Require expr %{sha1:salt1%{env:zt-cert-date}salt3%{env:zt-cert-uid}salt2} == %{env:zt-cert-sha1}
        Require expr %{env:zt-cert-sha1} =~ /^.{40}$/
        Require expr %{env:zt-cert-date} -ge %{env:zt-cert-date-now}
    </RequireAll>
   
    #Π·Π°ΠΌΠ΅Ρ‰Π°Π΅ΠΌ Π°Π²Ρ‚ΠΎΡ€ΠΈΠ·Π°Ρ†ΠΈΡŽ ΠΏΠΎ Π²Π»Π°Π΄Π΅Π»ΡŒΡ†Ρƒ сСртификата Π½Π° Π°Π²Ρ‚ΠΎΡ€ΠΈΠ·Π°Ρ†ΠΈΡŽ ΠΏΠΎ Π½ΠΎΠΌΠ΅Ρ€Ρƒ ΠΏΡ€ΠΎΡ‚ΠΎΠΊΠΎΠ»Π°
    SSLUserName SSl_PROTOCOL
    SSLOptions -FakeBasicAuth
</If>
</If>

<If "%{SSL:SSL_CLIENT_VERIFY} = 'SUCCESS'">
<If "%{HTTP:Upgrade} != 'websocket'">
    SetEnvIf Cookie "zt-cert=([^,;]+),[^,;]+,([^,;]+)" HAVE_zt-cert-sha1=$1 HAVE_zt-cert-date-halfnow=$2
    SetEnvIfExpr "env('HAVE_zt-cert-date-halfnow') -ge %{TIME} && env('HAVE_zt-cert-sha1')=~/.{40}/" HAVE_zt-cert-sha1-found=1

    Define zt-cert "path=/;Max-Age=%{env:zt-cert-timeout};HttpOnly;Secure;SameSite=Strict"
    Define dates_user "%{env:zt-cert-date-next},%{env:zt-cert-date-halfnext},%{SSL_CLIENT_S_DN_CN}"
    Header set Set-Cookie "expr=zt-cert=%{sha1:salt1%{env:zt-cert-date-next}sal3%{SSL_CLIENT_S_DN_CN}salt2},${dates_user};${zt-cert}" env=!HAVE_zt-cert-sha1-found
</If>
</If>

SetEnvIfExpr "env('HAVE_zt-cert-date-halfnow') -ge %{TIME} && env('HAVE_zt-cert-sha1')=~/.{40}/" HAVE_zt-cert-sha1-found=1
Ρ€Π°Π±ΠΎΡ‚Π°Π΅Ρ‚,

Π° Ρ‚Π°ΠΊ Ρ€Π°Π±ΠΎΡ‚Π°Ρ‚ΡŒ Π½Π΅ Π±ΡƒΠ΄Π΅Ρ‚
SetEnvIfExpr "env('HAVE_zt-cert-date-halfnow') -ge  env('zt-cert-date-now') && env('HAVE_zt-cert-sha1')=~/.{40}/" HAVE_zt-cert-sha1-found=1

Sababtoo ah LuaHookAccessChecker waxa la hawlgelin doonaa ka dib hubinta gelitaanka ee ku salaysan xogtan Nginx.

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Xidhiidhka isha image.

Hal shay oo kale.

Guud ahaan, dhib malahan sida ay amarrada ugu qoran yihiin Apache (malaha sidoo kale Nginx) qaabeynta, tan iyo dhamaadka wax walba waa la sooci doonaa iyadoo lagu saleynayo nidaamka codsiga isticmaalaha, kaas oo u dhigma nidaamka habaynta. Lua scripts

Dhamaystirka:

Xaalad muuqata fulinta ka dib ( hadaf):
maamulka adeegyada iyo kaabayaasha ayaa laga heli karaa taleefanka gacanta ee IOS iyada oo aan lahayn barnaamijyo dheeri ah (VPN), midaysan oo sugan.

Hadafkii waa la gaaray, saldhigyada shabakadu way shaqeeyaan waxayna leeyihiin heer ammaan oo aan ka yarayn shahaadada.

Sida aan ZeroTech ugu xidhnay Apple Safari iyo shahaadooyin macmiilka leh websockets

Source: www.habr.com

Add a comment