Alex-Devera/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-06-06 13:14:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(hysteria): use pinSHA256 for pinned cert and emit ech in share links

Browse source 
Hysteria links now carry the pinned peer cert under the hysteria2-standard pinSHA256 key instead of pcs (frontend genHysteriaLink + outbound importer round-trip), and the Go subscription generator emits ech from echConfigList. Also drops the dead allowInsecure guard in genHysteriaLink, which read a field that does not exist on TlsClientSettings.
This commit is contained in:
MHSanaei 2026-06-01 22:02:37 +02:00
parent 7f8c79675f
commit 588ea86298
No known key found for this signature in database
GPG key ID: 7E4060F2FBE5AB7A
3 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
frontend/src/lib/xray/inbound-link.ts
View file

@ -610,6 +610,9 @@ export function genHysteriaLink(input: GenHysteriaLinkInput): string {
if (tls.alpn.length > 0) params.set('alpn', tls.alpn.join(',')); if (tls.alpn.length > 0) params.set('alpn', tls.alpn.join(','));
if (tls.settings.echConfigList.length > 0) params.set('ech', tls.settings.echConfigList); if (tls.settings.echConfigList.length > 0) params.set('ech', tls.settings.echConfigList);
if (tls.serverName.length > 0) params.set('sni', tls.serverName); if (tls.serverName.length > 0) params.set('sni', tls.serverName);
if (tls.settings.pinnedPeerCertSha256.length > 0) {
params.set('pinSHA256', tls.settings.pinnedPeerCertSha256.join(','));
}
const udpMasks = stream.finalmask?.udp; const udpMasks = stream.finalmask?.udp;
if (Array.isArray(udpMasks)) { if (Array.isArray(udpMasks)) {

2
frontend/src/lib/xray/outbound-link-parser.ts
View file

@ -417,7 +417,7 @@ export function parseHysteria2Link(link: string): Raw | null {
fingerprint: params.get('fp') ?? '', fingerprint: params.get('fp') ?? '',
echConfigList: params.get('ech') ?? '', echConfigList: params.get('ech') ?? '',
verifyPeerCertByName: '', verifyPeerCertByName: '',
pinnedPeerCertSha256: params.get('pcs') ?? '', pinnedPeerCertSha256: params.get('pinSHA256') ?? '',
}, },
}; };
applyFinalMaskParam(stream, params); applyFinalMaskParam(stream, params);

6
sub/subService.go
View file

@ -603,9 +603,9 @@ func (s *SubService) genHysteriaLink(inbound *model.Inbound, email string) strin
if fpValue, ok := searchKey(tlsSettings, "fingerprint"); ok { if fpValue, ok := searchKey(tlsSettings, "fingerprint"); ok {
params["fp"], _ = fpValue.(string) params["fp"], _ = fpValue.(string)
} }
if insecure, ok := searchKey(tlsSettings, "allowInsecure"); ok { if echValue, ok := searchKey(tlsSettings, "echConfigList"); ok {
if insecure.(bool) { if ech, _ := echValue.(string); ech != "" {
params["insecure"] = "1" params["ech"] = ech
} }
} }
if pins, ok := pinnedSha256List(tlsSettings); ok { if pins, ok := pinnedSha256List(tlsSettings); ok {