Max/XTLS_REALITY
1
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2026-09-27 17:38:00 +03:00
Code Issues Packages Projects Releases Wiki Activity
202 Commits 8 Branches 0 Tags
94aeefe8204bec5e0792c8dd7e6296f5ac43f242
Commit Graph
202 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
yuhan6665 94aeefe820 crypto/tls: reject known extensions in disallowed handshake messages 
Change-Id: I9f3d9f3575359fb4730e0fb278d2d6a16a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/804180
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
 2026-09-10 23:24:37 -04:00
yuhan6665 cd92ddab44 crypto/tls: avoid overflow in parseECHConfigList 
When parsing an ECHConfigList, length fields were previously evaluated
as a uint16. This would cause an infinite loop to occur when parsing a
65532 bytes long ECHConfig with a declared outer length header of 0.

Triggering this condition requires a payload of at least 65538 bytes. As
ECHConfigList payloads are typically delivered via protocols that limit
them to 65535 bytes (DNS HTTPS records and TLS extensions), regular
clients are safe from this issue.

Thank you to Nguyễn Hoàng Hải (facebookmark2022@gmail.com) for reporting
this issue.

Fixes #80513

Change-Id: I8c5011d3b375c24794dd38b915bb4dc06a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/804040
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Nicholas Husin <husin@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 23:19:13 -04:00
yuhan6665 05238fd2b0 std: address ptrtoerror analyzer diagnostics 
Gopls' new ptrtoerror analyzer (CL 798580) reports types E such that
both E and *E implement error and there is no clear intent as to
which one is preferred.

This CL cleans up nearly all such diagnostics in std by adding
explicit assertions such as 'var _ error = E{}'.

Two mistaken uses of scanner.Error (sans &) were fixed,
and several unnecessary embeddings of error in tests were
change to use a plain named field.

Change-Id: I1dbf4abd5750e69c34653a1cdd17fa04edfbc6e4
Reviewed-on: https://go-review.googlesource.com/c/go/+/800560
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Commit-Queue: Alan Donovan <adonovan@google.com>
Auto-Submit: Alan Donovan <adonovan@google.com>
 2026-09-10 23:16:49 -04:00
yuhan6665 7dba75cce3 crypto/tls: omit PSK in ECH outer client hello 
When using ECH, do not include the PSK extension in the outer hello.
Including the PSK extension allows for a degradation in privacy, as an
on-path attacker can harvest outer client hellos, and then construct new
hellos using the PSK extension and arbitrary guessed SNI values,
replaying them to the target server. If the server rejects the PSK, the
handshake will continue, but if the PSK is accepted, the binder check
will fail.

Thanks to Coia Prant (github.com/rbqvq) for
reporting this issue.

Fixes CVE-2026-42505
Fixes #79282

Change-Id: Ib3a3c948106a57c1b07b9e61a58cbf757848be18
Reviewed-on: https://go-review.googlesource.com/c/go/+/775960
Auto-Submit: Roland Shoemaker <roland@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Carlos Amedee <carlos@golang.org>
 2026-09-10 23:12:18 -04:00
yuhan6665 e235ff1892 crypto/tls: document that ConnectionState is valid only after handshake 
Conn.ConnectionState reports details that are only populated once the
TLS handshake has completed. Callers that read it immediately after
Accept (for example via tls.NewListener) instead observe an
unpopulated ConnectionState whose HandshakeComplete field is false.

Document this precondition on Conn.ConnectionState and point to
ConnectionState.HandshakeComplete and Conn.Handshake, which the first
Conn.Read or Conn.Write runs automatically.

Fixes #79828.

Change-Id: Iad8a446ae45c7eb45efba6f8c1ce50fa727db989
GitHub-Last-Rev: a9ea872
GitHub-Pull-Request: #80081
Reviewed-on: https://go-review.googlesource.com/c/go/+/792720
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
 2026-09-10 23:09:13 -04:00
yuhan6665 629fee8742 crypto/tls: only set LocalCertificate when a certificate is presented 
ConnectionState.LocalCertificate is documented to be populated only for
connections which are not resumed. However, the TLS 1.0-1.2 server
handshake set it in processClientHello, which runs before
checkForResumption, and nothing cleared it on the abbreviated handshake
path. Resumed pre-1.3 server connections therefore reported a
certificate chain that was never presented to the peer (also visible to
VerifyConnection and WrapSession during the handshake).

Set the field in doFullHandshake, where the Certificate message is
actually written, so it is populated if and only if a chain was
presented. TLS 1.3 is unaffected because pickCertificate already returns
early for PSK resumption.

Also pin MaxVersion in TestLocalCertificate and
TestLocalCertificateResumption: they previously set only MinVersion, so
every pre-1.3 subtest silently negotiated TLS 1.3 and the broken path
had no coverage. With MaxVersion pinned, the resumption test fails
without this fix at TLS 1.0-1.2.

Verified: strengthened resumption test fails on unpatched master at TLS
1.0/1.1/1.2 and passes with the fix; full `go test crypto/tls` passes;
standalone repro from the issue prints len(LocalCertificate)=0 for
resumed TLS 1.2 connections.

Fixes #79967

Change-Id: Ic5586b05da956c619526b8ef500fcaa4c019a2f3
GitHub-Last-Rev: c2ef0f1
GitHub-Pull-Request: #79968
Reviewed-on: https://go-review.googlesource.com/c/go/+/789862
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 23:08:30 -04:00
yuhan6665 ed9b3f2b50 crypto/tls: update ECH specification reference 
draft-ietf-tls-esni has become RFC 9849, and the ECHConfigList structure
is unchanged.

Change-Id: Iccf05dc60206716e7d8062145955378f3df6b8e6
Reviewed-on: https://go-review.googlesource.com/c/go/+/790302
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 23:06:20 -04:00
yuhan6665 addbbfc438 crypto/tls: skip unnecessary type conversion 
Both ec.raw and the assigned enc are []byte and don't require an
explicit conversion.

Change-Id: I2f0e7c161b653269ee450fefe5a49fc9e9e42fd2
Reviewed-on: https://go-review.googlesource.com/c/go/+/790301
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2026-09-10 23:05:36 -04:00
yuhan6665 ed6f4f7375 crypto/tls: add LocalCertificate to ConnectionState 
Adds a new field to ConnectionState, LocalCertificate, which contains
the certificate chain which was presented to the connection peer, if one
was.

Fixes #24673

Change-Id: Iae758fef4a2808e3295324890f4b2f55c71fcc4c
Reviewed-on: https://go-review.googlesource.com/c/go/+/788866
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
 2026-09-10 23:04:52 -04:00
yuhan6665 b0f1538eb8 crypto/tls: update EncryptedClientHelloKey.Config KEM docs 
The EncryptedClientHelloKey.Config struct field documented a list of
acceptable KEMs, but didn't include the recently added PQ options (pure
ML-KEM, or ML-KEM hybrids).

The ECH config processing in crypto/tls dispatches through
kem.NewKEM(id) with the config's KEM id. Since the PQ KEM ids
are supported there, this commit adds them to the
EncryptedClientHelloKey doc string as acceptable KEM choices for ECH
configs.

Change-Id: I87e81e90aedaa90d7be2a4f795f4250c8bc15525
Reviewed-on: https://go-review.googlesource.com/c/go/+/788920
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
 2026-09-10 22:58:27 -04:00
yuhan6665 ff518ab8eb crypto/tls: wrap KeyLogWriter errors w/ prefix 
If a tls.Config populates a KeyLogWriter, and the io.Writer's Write()
returns an error when using it in writeKeyLog() we should wrap the error
with a prefix that indicates the source to aid in debugging.

Fixes #79392

Change-Id: Ie16bb2908575123a8e80c623a15f3835a7bc3e92
Reviewed-on: https://go-review.googlesource.com/c/go/+/784740
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Neal Patel <neal@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Neal Patel <nealpatel@google.com>
 2026-09-10 22:57:20 -04:00
yuhan6665 0b8071916e crypto/tls: clamp effective minimum version to TLS 1.3 when using QUIC 
Change-Id: Ieec72362bacf1956a2bd5e0b2eb8dad88e624bd1
Reviewed-on: https://go-review.googlesource.com/c/go/+/745980
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 22:56:11 -04:00
yuhan6665 8ea3928df4 crypto/tls: surface private key parsing error from X509KeyPair 
This can include e.g. an error that mentiones that ML-DSA is not
available due to the FIPS 140-3 module version.

Change-Id: I6f505d9baff80fee23edf6f8e995dd846a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777881
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 22:48:34 -04:00
yuhan6665 85935957e6 crypto/tls: remove the x509keypairleaf GODEBUG setting 
Fixes #75316

Change-Id: I241af97bf6a05e94f40a9f62393ed4fe6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777384
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
 2026-09-10 22:45:51 -04:00
yuhan6665 d1f34ca08f crypto/tls: remove the tls10server GODEBUG setting 
Updates #75316

Change-Id: I43e7311777fb79b9486a05c8e8d3a42e6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777383
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2026-09-10 22:42:59 -04:00
yuhan6665 168007d277 crypto/tls: remove tls3des GODEBUG setting 
Updates #75316

Change-Id: Iedd2a6746d0ebd6a7b7147f34cb7435b6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777382
TryBot-Bypass: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
 2026-09-10 22:37:34 -04:00
yuhan6665 cd6a48fe6a crypto/tls: remove tlsrsakex GODEBUG setting 
Updates #75316

Change-Id: I6eb8482505a83b8b63edcb7d443e227a6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777381
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2026-09-10 22:34:17 -04:00
yuhan6665 5f5c7a1144 crypto/tls: remove the tlsunsafeekm GODEBUG setting 
Updates #75316

Change-Id: I2efa3e485653f5b403d92e5d99959e356a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777380
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2026-09-10 22:25:08 -04:00
yuhan6665 72e1a2490a crypto/tls: implement MLKEM1024 key exchange 
Fixes #78543

Change-Id: I26a70a64665c75e5116b83f73a75093f6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777221
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2026-09-10 22:11:48 -04:00
yuhan6665 a18db620ec crypto/tls: use mlkem.GenerateKey for ML-KEM hybrids 
We were using mlkem.NewDecapsulationKey on a random slice to support
Config.Rand, but Encapsulate was already bypassing Config.Rand anyway.

Config.Rand is deprecated anyway in favor of
cryptotest.SetDefaultRandom, so switch to mlkem.GenerateKey which has
better FIPS 140-3 compliance.

Updates #79367

Change-Id: I62a5099bd69a1ee2941d5ae1c9c2bf4b6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777320
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: David Chase <drchase@google.com>
 2026-09-10 22:02:08 -04:00
yuhan6665 46c9a6be96 crypto/tls: deprecate Config.Rand 
We now use SetGlobalRandom in recorded tests.

It was already partially ineffective: ML-KEM encapsulation, used as part
of X25519MLKEM768, doesn't take a source of randomness, and instead
always uses the global random source.

Fixes #79367

Change-Id: I1cc07ebec21bee32ece685efde188c0d6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/765926
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: David Chase <drchase@google.com>
 2026-09-10 21:56:24 -04:00
yuhan6665 de0813ca88 crypto/tls: let Config.CurvePreferences override GODEBUG options 
tlsmlkem=0 and tlssecpmlkem=0 were never meant to forcibly disable PQ
KEMs, they were only meant to restore the Go 1.24 and Go 1.26 defaults
when Config.CurvePreferences is nil.

I noticed this while struggling to add a non-default key exchange.

While at it, make our behavior on unimplemented Config.CurvePreferences
entries more consistent by ignoring them regardless of role.

Udpates #69985
Updates #71206

Change-Id: I7d977282153b1d95fdb549efa92353e86a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777220
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
 2026-09-10 21:54:16 -04:00
yuhan6665 5dabb073f8 Sync upstream Go 1.27 (#30) 
https://github.com/XTLS/REALITY/pull/30#issuecomment-5579024460
 2026-09-10 01:18:53 +00:00
RPRX 8cdf7bf9c7 REALITY protocol: Reject outdated/strange Client Hello that doesn't have X25519MLKEM768 before optional X25519 
https://github.com/XTLS/Xray-core/issues/6714#issuecomment-5575338614
 2026-09-08 06:21:03 +00:00
hexonaland风扇滑翔翼 e1986a4d31 fix: DetectPostHandshakeRecordsLens background probe bugs (panic, leak, race) (#36) 
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com>
 2026-09-08 04:58:12 +00:00
fan yang 393f8de3ee Increase REALITY target TLS record buffer to 17 KiB (#33) 
Fixes https://github.com/XTLS/Xray-core/issues/6356
 2026-09-08 04:29:18 +00:00
风扇滑翔翼 9234c772ba Add maxUselessRecords (ChangeCipherSpec, etc.) detection (#29) 
https://github.com/XTLS/BBS/issues/16
https://github.com/XTLS/BBS/issues/19
 2026-03-22 12:59:25 +00:00
易安 ad4fbafc4b fix(record_detect): use configured network type instead of hardcoded tcp (#26) 
Fixes https://github.com/XTLS/Xray-core/issues/5675
 2026-03-21 14:01:11 +00:00
风扇滑翔翼 cd53f7d502 Close target when client closed 2025-11-16 12:55:10 -05:00
JesusandRPRX e4eec45205 Add detailed error reporting for REALITY invalid connections (#24) 
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
 2025-10-14 19:56:29 +00:00
RPRX dab26e77fc go.mod & go.sum: Upgrade direct dependencies 
github.com/refraction-networking/utls v1.8.1
golang.org/x/crypto v0.43.0
golang.org/x/sys v0.37.0
 2025-10-14 19:45:36 +00:00
RPRX 431b6ff8c6 README.md: Update Donation & NFTs 2025-09-04 21:47:05 +00:00
RPRX 046fad5ab6 README.md: Update Donation & NFTs 
Announcement of NFTs by Project X: https://github.com/XTLS/Xray-core/discussions/3633
Project X NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1

VLESS Post-Quantum Encryption: https://github.com/XTLS/Xray-core/pull/5067
VLESS NFT: https://opensea.io/collection/vless

XHTTP: Beyond REALITY: https://github.com/XTLS/Xray-core/discussions/4113
REALITY NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
 2025-08-28 04:45:27 +00:00
yuhan6665 de3bb4d08f Update readme 2025-07-27 19:10:20 -04:00
RPRX 5b52a03d4f Fix sending Server Hello in an unexpected way for fixing edge cases 
https://t.me/projectXray/4377580
 2025-07-25 14:20:56 +00:00
RPRX c6320729d9 README.md: Add REALITY NFT's image & link 
https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
 2025-07-23 12:10:14 +00:00
RPRX 00881f6740 README.md: Add "mldsa65Seed" and "mldsa65Verify" to example 
https://github.com/XTLS/Xray-core/pull/4915
 2025-07-23 02:23:38 +00:00
RPRX 4eaf7927f3 REALITY protocol: Add optional Post-Quantum ML-DSA-65 signature to cert's ExtraExtensions 2025-07-22 04:56:54 +00:00
RPRX ebbbf46ec3 REALITY protocol: Use X25519MLKEM768's data if X25519 doesn't exist in Client Hello 2025-07-22 04:56:14 +00:00
RPRX 05a351a645 Three types of ALPN for post-handshake records detection & imitation 
https://github.com/XTLS/Xray-core/issues/4778#issuecomment-3072047745
 2025-07-15 05:57:25 +00:00
RPRX e62c4aed0d Refactor post-handshake records detection & imitation again 
https://github.com/XTLS/Xray-core/issues/4843#issuecomment-3013196642
 2025-06-27 14:14:58 +00:00
wyx2685 dc28cce21c Fix missing config.Show check before printing len(postHandshakeRecord) (#18) 2025-06-27 11:39:29 +00:00
RPRXJes Cokcaikun233
 		50752aec6b Some small changes 
https://github.com/XTLS/REALITY/pull/10
https://github.com/XTLS/REALITY/pull/11

---------

Co-authored-by: Jes Cok <xigua67damn@gmail.com>
Co-authored-by: caikun233 <69567735+caikun233@users.noreply.github.com>
 2025-06-08 13:21:14 +00:00
MeowandRPRX 4fd34dd4eb feat: Add rate limiting to fallback handling via token bucket (#12) 
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
 2025-06-08 13:11:45 +00:00
RPRX 90e738a94c Refine GlobalPostHandshakeRecordsLens' locker 
https://github.com/XTLS/Xray-core/issues/4778#issuecomment-2952303176
 2025-06-07 10:56:25 +00:00
RPRX 88910695ec Use Chrome's fingerprint to trigger target's post-handshake records 
https://github.com/XTLS/Xray-core/issues/4778#issuecomment-2952140234
 2025-06-07 08:21:47 +00:00
RPRX 21af070492 Refactor post-handshake records detection & imitation 
https://github.com/XTLS/Xray-core/issues/4778#issuecomment-2948185205
 2025-06-06 06:46:02 +00:00
风扇滑翔翼 967adadcc7 Add post-handshake records detection (#17) 2025-06-06 01:44:11 +00:00
yuhan6665 e679ef7bb1 crypto/tls: signature_algorithms in CertificateRequest can't be empty 
Change-Id: I6a6a4656ab97e1f247df35b2589cd73461b4ac76
Reviewed-on: https://go-review.googlesource.com/c/go/+/675917
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2025-05-26 20:01:05 -04:00
yuhan6665 c169f1395b crypto/tls: reject duplicate TLS 1.3 EncryptedExtensions 
When a TLS 1.3 client processes the server's encryptedExtensionsMsg it
should reject instances that contain duplicate extension types.

RFC 8446 §4.2 says:
  There MUST NOT be more than one extension of the same type in a given
  extension block.

This update matches enforcement done in the client hello unmarshalling,
but applied to the TLS 1.3 encrypted extensions message unmarshalling.

Making this change also allows enabling the
DuplicateExtensionClient-TLS-TLS13 BoGo test.

Updates #72006

Change-Id: I27a2cd231e4b8762b0d9e2dbd3d8ddd5b87fd5d2
Reviewed-on: https://go-review.googlesource.com/c/go/+/673757
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2025-05-26 20:01:05 -04:00