fix: sing-box "unsafe" fingerprint guard and CipherSuites resets (follow-up to #1) - #2
Merged
Merged
Conversation
…low-up to #1) The "unsafe" fingerprint added in #1 is Xray-only: sing-box passes the node fingerprint into tls.utls.fingerprint and rejects unknown uTLS names at startup, so any node with fingerprint "unsafe" running on the sing-box core failed to connect. This is also reachable indirectly via AddServerCommon, which stamps the global default fingerprint (settable to "unsafe" in options) onto REALITY nodes. Skip uTLS in that case; plain Go TLS matches what Xray's "unsafe" means anyway. Also reset CipherSuites in AddHysteria2Server and AddNaiveServer alongside the existing Fingerprint/Alpn resets, since #1 disabled the textbox for these protocols but left stale values in the database. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1, which added the
cipherSuitesTLS option and theunsafefingerprint. That PR was largely complete (all 8 locales, both WPF and Avalonia layouts, DB column auto-migrates via sqlite-net), but an audit found two behavioral gaps.What changed
unsafefingerprint guard (SingboxOutboundService.cs):unsafeis an Xray-only fingerprint. sing-box passes the node fingerprint intotls.utls.fingerprintand rejects unknown uTLS names at startup, so any node with fingerprintunsaferunning on the sing-box core failed to connect. Also reachable indirectly:AddServerCommonstamps the global default fingerprint (settable tounsafein the options window) onto REALITY nodes with an empty fingerprint. uTLS is now skipped when the fingerprint isunsafe— plain Go TLS is also what Xray'sunsafesemantically means, so behavior converges across cores.CipherSuitesresets for Hysteria2/Naive (ConfigHandler.cs): feat: add cipherSuites option and "unsafe" fingerprint to TLS UI settings #1 disabledtxtCipherSuitesfor these protocols but their add/save paths only resetFingerprint/Alpn, leaving staleCipherSuitesvalues in the database. The reset is added alongside the existing ones.Considered and deliberately not changed
CompareProfileItemdoesn't compareCipherSuites: the function consistently excludes manual-only fields (EchConfigList,VerifyPeerCertByName,Cert) and also drives active-node re-selection and traffic-stats preservation across subscription updates, where new items can never carrycipherSuites. Adding it would break re-matching of manually edited subscription items.txtCipherSuitesenabled despite being sing-box-only — matches existing precedent (verifyPeerCertByName, also Xray-only, stays enabled for them).unsafe+ REALITY on Xray: the shared fingerprint combos offerunsafefor REALITY where Xray may reject it; validation is left to the core.ServiceLibbuilds cleanly with these changes (0 warnings, 0 errors).🤖 Generated with Claude Code