🐶 Sync 2026-06-03 21:58:23

luci-app-passwall/luasrc/passwall/api.lua

@@ -1570,31 +1570,23 @@ function cleanEmptyTables(t)
 	return next(t) and t or nil
 end
 
-function fetch_cert_sha256(host, port, timeout)
-	if not host or not datatypes.hostname(host) then return "" end
+function fetch_cert_sha256(host, port, sni, timeout)
+	if not host then return "" end
 	port = tonumber(port) or 443
+	sni = sni or host
 	timeout = tonumber(timeout) or 5
-	local xray = finded_com("xray")
-	local cmd
-	if xray then
-		cmd = string.format(
-			"timeout %d %q tls ping %s:%d 2>/dev/null " ..
-			"| awk 'tolower($0) ~ /without sni/ {f=1} tolower($0) ~ /with sni/ {f=0} " ..
-			"f && tolower($0) ~ /cert.*leaf.*sha256/ {sub(/.*:/,\"\"); gsub(/[[:space:]]/,\"\"); print; exit}'",
-			timeout, xray, host, port
-		)
-	else
-		cmd = string.format(
-			"timeout %d openssl s_client -connect %s:%d -servername %s -showcerts </dev/null 2>/dev/null " ..
-			"| awk 'BEGIN{c=0}/BEGIN CERT/{c++} c==1{print} /END CERT/{if(c==1)exit}' " ..
-			"| openssl x509 -outform der 2>/dev/null " ..
-			"| sha256sum 2>/dev/null",
-			timeout, host, port, host
-		)
-	end
+	local cmd = string.format(
+		"timeout %d openssl s_client -connect %s:%d -servername %s -showcerts </dev/null 2>/dev/null " ..
+		"| awk 'BEGIN{c=0}/BEGIN CERT/{c++} c==1{print} /END CERT/{if(c==1)exit}' " ..
+		"| openssl x509 -outform der 2>/dev/null " ..
+		"| sha256sum 2>/dev/null",
+		timeout, host, port, sni
+	)
 	local out = trim(sys.exec(cmd))
 	local fp = out:match("^([0-9a-fA-F]+)")
-	if not fp then return "" end
+	if not fp or fp:lower():match("^e3b0c44298fc1c149afbf4c8996fb924") then
+		return ""
+	end
 	return fp:upper()
 end