Skip to content

Bug: Clients using tls 1.2 by default!!??? #1919

@hiddify-com

Description

@hiddify-com

I found a weird bug that the clients sometimes start the connection with tls1.2
I am using xray v1.8.0

image

I have added even minVersion in tls setting but it won't change this behavior

Full client configuration
{
  "log": {
    "access": "",
    "error": "",
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "tag": "socks",
      "port": 10808,
      "listen": "127.0.0.1",
      "protocol": "socks",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls"
        ],
        "routeOnly": false
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    },
    {
      "tag": "http",
      "port": 10809,
      "listen": "127.0.0.1",
      "protocol": "http",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls"
        ],
        "routeOnly": false
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "hiddify.com",
            "port": 443,
            "users": [
              {
                "id": "e28c1a7e-98a5-4b91-a0e0-96cacf4e1fae",
                "alterId": 0,
                "email": "t@t.tt",
                "security": "auto",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "tlsSettings": {
          "allowInsecure": false,
          "serverName": "hiddify.com",
          "alpn": [
            "http/1.1"
          ],
          "fingerprint": "chrome",
          "show": false,
          "minVersion": "1.3"
        }
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {}
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      }
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api",
        "enabled": true
      },
      {
        "id": "4721901652305849247",
        "type": "field",
        "outboundTag": "direct",
        "domain": [
          "domain:example.com",
          "domain:example2.com"
        ],
        "enabled": true
      },
      {
        "id": "4964923193273991424",
        "type": "field",
        "outboundTag": "block",
        "domain": [
          "geosite:category-ads-all"
        ],
        "enabled": true
      },
      {
        "id": "5462843772156832822",
        "type": "field",
        "outboundTag": "direct",
        "domain": [
          "geosite:private",
          "geosite:apple@cn",
          "geosite:google@cn",
          "geosite:tld-cn",
          "tld-ir"
        ],
        "enabled": true
      },
      {
        "id": "5632988166244046273",
        "type": "field",
        "outboundTag": "proxy",
        "domain": [
          "geoip:!ir"
        ],
        "enabled": true
      },
      {
        "id": "4874739823930549310",
        "type": "field",
        "outboundTag": "direct",
        "ip": [
          "geoip:private",
          "geoip:cn",
          "geoip:ir"
        ],
        "enabled": true
      },
      {
        "id": "5464678198089768952",
        "type": "field",
        "port": "0-65535",
        "outboundTag": "proxy",
        "enabled": true
      }
    ],
    "balancers": []
  }
}
As you have suggested that setting a hard limit in the server side to accept only tls 1.3 is not good i have tried to use haproxy but it can not proxy tls 1.3 and 1.2 to different servers.

I think that this behavior may be used to identify proxy servers.

frontend https-in
    bind :443,:::443 v4v6
  bind :443,:::443 v4v6
    mode tcp
    option tcplog
    option dontlognull
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
    acl tls1_2 req.ssl_ver 3.3
    acl tls1_3 req.ssl_ver 3.4

    use_backend xray if tls1_3
    use_backend xraydecoy if tls1_2
#    tcp-request content reject if tls1_2
    default_backend xraydecoy

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions