Fix wireguard sendthrough

app/proxyman/outbound/handler.go

@@ -347,7 +347,6 @@ func (h *Handler) SetOutboundGateway(ctx context.Context, ob *session.Outbound)
 		// case addr.Family().IsDomain():
 		default:
 			ob.Gateway = addr
-
 		}
 
 	}

proxy/wireguard/client.go

@@ -138,6 +138,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	}
 	ob.Name = "wireguard"
 	ob.CanSpliceCopy = 3
+	dialer.SetOutboundGateway(ctx, ob)
 
 	if err := h.init(ctx); err != nil {
 		return err

transport/internet/tls/config.go

@@ -13,7 +13,6 @@ import (
 	"sync"
 	"time"
 
-	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/ocsp"
@@ -23,7 +22,6 @@ import (
 )
 
 var globalSessionCache = tls.NewLRUClientSessionCache(128)
-var uGlobalSessionCache = utls.NewLRUClientSessionCache(128)
 
 // ParseCertificate converts a cert.Certificate to Certificate.
 func ParseCertificate(c *cert.Certificate) *Certificate {
@@ -282,10 +280,12 @@ func (c *Config) parseServerName() string {
 	return c.ServerName
 }
 
-// Note: Remember to update uVerifyConnectionAdapter if this function needs more fields in the future.
+func (r *RandCarrier) verifyPeerCert(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) (err error) {
-func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
+	// extract x509 certificates from rawCerts (verifiedChains will be nil if InsecureSkipVerify is true)
-	certs := cs.PeerCertificates
+	certs := make([]*x509.Certificate, len(rawCerts))
-	// extract x509 certificates from cs.PeerCertificates
+	for i, asn1Data := range rawCerts {
+		certs[i], _ = x509.ParseCertificate(asn1Data)
+	}
 	if len(certs) == 0 {
 		return errors.New("unexpected certs")
 	}
@@ -325,7 +325,7 @@ func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
 			}
 		}
 		if verifyResult == foundCA {
-			return errors.New("peer cert is invalid (against pinned CA and verifyPeerCertByName)")
+			errors.New("peer cert is invalid (against pinned CA and verifyPeerCertByName)")
 		}
 		return errors.New("peer cert is invalid (against root CAs and verifyPeerCertByName)")
 	}
@@ -352,18 +352,6 @@ func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
 	return nil // r.PinnedPeerCertSha256==nil && r.verifyPeerCertByName==nil
 }
 
-func uVerifyConnectionAdapter(f func(tls.ConnectionState) error) func(utls.ConnectionState) error {
-	if f == nil {
-		return nil
-	}
-	return func(cs utls.ConnectionState) error {
-		standardCS := tls.ConnectionState{
-			PeerCertificates: cs.PeerCertificates,
-		}
-		return f(standardCS)
-	}
-}
-
 type RandCarrier struct {
 	Config               *tls.Config
 	RootCAs              *x509.CertPool
@@ -401,7 +389,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 		RootCAs:                root,
 		NextProtos:             slices.Clone(c.NextProtocol),
 		SessionTicketsDisabled: !c.EnableSessionResumption,
-		VerifyConnection:       randCarrier.verifyConnection,
+		VerifyPeerCertificate:  randCarrier.verifyPeerCert,
 	}
 	randCarrier.Config = config
 	if len(c.VerifyPeerCertByName) > 0 {

transport/internet/tls/pin_test.go

@@ -110,15 +110,15 @@ func TestVerifyPeerLeafCert(t *testing.T) {
 		PinnedPeerCertSha256: [][]byte{leafHash[:]},
 	}
 
-	cs := tls.ConnectionState{PeerCertificates: []*x509.Certificate{leaf}}
+	rawCerts := [][]byte{leaf.Raw}
-	err := r.verifyConnection(cs)
+	err := r.verifyPeerCert(rawCerts, nil)
 	if err != nil {
 		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
 	}
 
 	// make the pinned hash incorrect
 	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyConnection(cs)
+	err = r.verifyPeerCert(rawCerts, nil)
 	if err == nil {
 		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
 	}
@@ -138,15 +138,15 @@ func TestVerifyPeerCACert(t *testing.T) {
 		PinnedPeerCertSha256: [][]byte{caHash[:]},
 	}
 
-	cs := tls.ConnectionState{PeerCertificates: []*x509.Certificate{leaf, ca}}
+	rawCerts := [][]byte{leaf.Raw, ca.Raw}
-	err := r.verifyConnection(cs)
+	err := r.verifyPeerCert(rawCerts, nil)
 	if err != nil {
 		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
 	}
 
 	// make the pinned hash incorrect
 	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyConnection(cs)
+	err = r.verifyPeerCert(rawCerts, nil)
 	if err == nil {
 		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
 	}

transport/internet/tls/tls.go

@@ -152,16 +152,11 @@ func copyConfig(c *tls.Config) *utls.Config {
 		RootCAs:                        c.RootCAs,
 		ServerName:                     c.ServerName,
 		InsecureSkipVerify:             c.InsecureSkipVerify,
-		VerifyConnection:               uVerifyConnectionAdapter(c.VerifyConnection),
+		VerifyPeerCertificate:          c.VerifyPeerCertificate,
-		SessionTicketsDisabled:         c.SessionTicketsDisabled,
 		KeyLogWriter:                   c.KeyLogWriter,
 		EncryptedClientHelloConfigList: c.EncryptedClientHelloConfigList,
 		NextProtos:                     c.NextProtos,
 	}
-	if c.ClientSessionCache != nil {
-		config.ClientSessionCache = uGlobalSessionCache
-	}
-
 	return config
 }