Closes #2919

Adds an optional peer-info map to the OpenVPN outbound, letting users declare custom peer-info entries (e.g. IV_HWADDR, UV_*) sent during the key-method-2 handshake. Entries are appended after the built-in IV_VER/IV_PROTO/IV_CIPHERS and sorted by key for deterministic output. Fully backward compatible — when peer-info is omitted the emitted bytes are identical to before.

proxies:
  - name: "openvpn"
    type: openvpn
    server: vpn.example.com
    port: 1194
    ca: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
    peer-info:
      IV_HWADDR: "52:54:00:ff:72:87"
      UV_DEVICE_ID: "laptop-001"

Why

Some OpenVPN deployments use --client-connect scripts or PAM plugins to read client-pushed peer-info (such as IV_HWADDR or custom UV_*) for access control — e.g. checking a device's hardware address against an allow-list. mihomo currently sends a hard-coded minimal peer-info, so such servers reject the connection and the OpenVPN outbound is unusable against them. This lets the client advertise the required peer-info.

mihomo is a user-space client with no concept of OpenVPN's native default-gateway MAC, so the values are explicitly declared by the user, not auto-detected. The client advertises peer-info to satisfy server-side policy; it does not collect real hardware information.

Related

Against servers that run slow access-control checks during the handshake, you may also need the standalone handshake-timeout fix in #2925 for the control channel to complete in time. That is submitted separately because it is an independent, pre-existing bug.

Testing

go test ./transport/openvpn/ passes. Verified against a real OpenVPN server that gates clients by IV_HWADDR.

这个 PR 做了什么

为 OpenVPN 出站新增一个可选的 peer-info map,允许用户声明在 key-method-2 握手时上送的自定义 peer-info 条目(如 IV_HWADDR、UV_*)。用户条目追加在内置 IV_VER/IV_PROTO/IV_CIPHERS 之后,并按 key 排序以保证确定性输出。完全向后兼容 —— 不填 peer-info 时,上送的字节与改动前逐字节一致。

为什么需要

部分 OpenVPN 部署会用 --client-connect 脚本或 PAM 插件读取客户端上送的 peer-info(如 IV_HWADDR 或自定义 UV_*)做准入控制(例如按设备硬件地址校验白名单)。mihomo 目前上送的是写死的最小 peer-info,这类服务端会拒绝连接,导致 OpenVPN 出站在这类环境下无法使用。本改动让客户端能上送所需的 peer-info。

mihomo 是用户态客户端,没有 OpenVPN 原生「默认网关 MAC」的概念,因此值由用户显式声明,而非自动探测。客户端只是上报 peer-info 以满足服务端策略,并不采集真实硬件信息。

关联

对在握手期间做慢速准入校验的服务端,可能还需要配合 #2925(独立的握手超时修复)才能让控制信道及时完成。那个修复是独立的、早已存在的 bug,因此单独成 PR。

测试

go test ./transport/openvpn/ 通过。已针对真实按 IV_HWADDR 做准入的 OpenVPN 服务端验证连通。

🤖 Generated with Claude Code