Verification Steps

• I have read the documentation and confirmed that this feature is not implemented
• I have searched for the feature request I want to propose in the Issue Tracker and did not find it
• I am a non-Chinese user.

Description

Current behavior

The OpenVPN outbound (type: openvpn) sends a hard-coded, minimal peer-info during the key-method 2 handshake. transport/openvpn/keymethod.go (InstallScriptPeerInfo) only emits:

IV_VER=mihomo-openvpn
IV_PROTO=6
[IV_LZO=1]
IV_CIPHERS=<cipher>

There is no configuration option to add any custom peer-info entry.

How it affects me

Some OpenVPN deployments use --client-connect scripts or PAM plugins to read client-pushed peer-info (such as IV_HWADDR, or custom UV_* variables) and make access-control decisions — e.g. checking a device's hardware address against an allow-list. Because mihomo cannot send these fields, such servers reject the connection, so the OpenVPN outbound is unusable against them.

What I want

A way to declare extra peer-info key/value pairs in the proxy config, appended to the built-in ones.

Note: mihomo is a user-space client and has no concept of OpenVPN's native "default-gateway MAC", so the values are explicitly declared by the user, not auto-detected. This lets the client advertise peer-info to satisfy server-side policies; it does not collect real hardware information.

Proposed solution

Add an optional peer-info map to the OpenVPN outbound. User entries are appended after the built-in IV_VER/IV_PROTO/IV_CIPHERS and sorted by key for deterministic output. Fully backward compatible — when omitted, the emitted bytes are identical to before.

proxies:
  - name: "openvpn"
    type: openvpn
    server: vpn.example.com
    port: 1194
    ca: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
    peer-info:
      IV_HWADDR: "52:54:00:ff:72:87"
      UV_DEVICE_ID: "laptop-001"

I've implemented this in PR #2917.

目前 Mihomo Core 的行为

OpenVPN 出站(type: openvpn)在 key-method 2 握手时上送的是写死的最小 peer-info(IV_VER / IV_PROTO / IV_CIPHERS [/ IV_LZO]),没有任何配置项可以补充自定义字段。

这个问题如何影响到我

部分 OpenVPN 部署会用 --client-connect 脚本或 PAM 插件读取客户端上送的 peer-info(如 IV_HWADDR 或自定义 UV_*)做准入控制(例如按设备硬件地址校验白名单)。由于 mihomo 发不出这些字段,这类服务端会拒绝连接,导致 OpenVPN 出站在这类环境下无法使用。

我想实现的功能

允许在 proxy 配置里声明额外的 peer-info 键值对,追加到内置字段之后。新增一个可选的 peer-info map:用户键值追加在内置 IV_VER/IV_PROTO/IV_CIPHERS 之后并按 key 排序;不填时与改动前逐字节一致,完全向后兼容。已在 PR #2917 中实现。