Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

关于Reality的dest打断连接后xray不会打断链接的特征 #3502

Closed
3 tasks done
CalunVier opened this issue Jul 3, 2024 · 5 comments
Closed
3 tasks done

关于Reality的dest打断连接后xray不会打断链接的特征 #3502

CalunVier opened this issue Jul 3, 2024 · 5 comments
Labels
bug Something isn't working

Comments

@CalunVier
Copy link

完整性要求

  • 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
  • 我提供了完整的配置文件和日志，而不是出于自己的判断只给出截取的部分。
  • 我搜索了issues，没有发现已提出的类似问题。

版本

1.8.16

描述

当一个非Reality流量进入Reality inbound时，reality会“回落“到dest选项指定的地址，以掩盖特征。这个想法在非法流量为标准的https请求时工作良好。但当非法的reality流量同时是非法的http/https流量时，其行为将于绝大多数反代软件产生不同。我于telnet的一个典型用例中发现此问题。
当使用Linux下的telnet（Windows下效果类似，只不过Linux下的telnet实现对打断链接相应更快）访问一个标准Nginx反代的网站并发送"hello"，结果如下：

~ $ telnet 127.0.0.1 443
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
hello
HTTP/1.1 400 Bad Request
Server: nginx/1.24.0
Date: Wed, 03 Jul 2024 06:01:38 GMT
Content-Type: text/html
Content-Length: 157
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>
Connection closed by foreign host.
~ $

注意到倒数第二行，链接被迅速打断。
但当Nginx位于Xray之后时，其行为如下：

~ $ telnet 127.0.0.1 443
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
hello
HTTP/1.1 400 Bad Request
Server: nginx/1.24.0
Date: Wed, 03 Jul 2024 06:05:17 GMT
Content-Type: text/html
Content-Length: 157
Connection: close

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>
^]
telnet>

Nginx中断与Xray的连接后，Xray与telnet的连接被维持。注意到倒数第二行，是我等待数秒后使用^]手动结束的连接。

绝大多的反代软件不会拥有类似的行为，我同样尝试了位于frp之后的22端口，非法ssh连接也会被迅速打断。我同样测试了由Sing-Box实现的Reality，其在该情景下依然有明显的特征，但连接会在一段时间后打断。我不确定是否所有的反代软件都会表现的像Nginx或frp，但是至少在现实世界中，xray的行为着实小众。

这是一个应当被解决的特征。因为当Reality假设GFW会主动发起探测，并采取缓解措施时，该情景没有理由不被纳入考虑。

重现方式

重现非常简单，你只需要一个xray和http服务器，以及一个telnet客户端。

我的Vless-Xtls-version-reality入站设置见后文

客户端配置


无

服务端配置


{inbounds:
[
   {
      "tag":"inbound-vless-443",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "user1",
            "flow": "xtls-rprx-vision",
            "comment": "user1"
          },
          {
            "id": "user2",
            "flow": "xtls-rprx-vision",
            "comment": "user2"
          },
          "..."
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "dest": "127.0.0.1:26172",
          "xver": 1,
          "serverNames": [
            "my.selfs.host"
          ],
          "privateKey": "privateKey",
          "publicKey": "PublicKey",
          "minClientVer": "1.8.0",
          "shortIds": [
            "",
            "01",
            "02",
            "03"
          ]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      }
    }
]}

客户端日志


无

服务端日志


无
@Fangliding
Copy link
Member

Fangliding commented Jul 3, 2024 •
edited
Loading

大概reality库少写了一个close 远端关闭连接这边没关掉 其他软件都是调的这个库导致了相同的行为 补上应该就行了

@Fangliding Fangliding added the bug Something isn't working label Jul 3, 2024
@Fangliding Fangliding mentioned this issue Jul 3, 2024
Merged
@Fangliding
Copy link
Member 

telnet 127.0.0.1 8000
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
hello
HTTP/1.1 400 Bad Request
Server: cloudflare
Date: Wed, 03 Jul 2024 11:37:08 GMT
Content-Type: text/html
Content-Length: 155
Connection: close
CF-RAY: -

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>cloudflare</center>
</body>
</html>
Connection closed by foreign host.

现在可以正常断开力 顺便再读了一遍reality的代码

@RPRX
Copy link
Member

RPRX commented Jul 5, 2024

我记得当时故意写成了可以仅关闭上/下行，但既然其它反代是同时关闭那就同时关闭吧，感谢报告问题

@RPRX
Copy link
Member

RPRX commented Jul 11, 2024

我记得当时故意写成了可以仅关闭上/下行

当时是想写成可以仅关闭上/下行的，但没传递关闭

XTLS/REALITY#7 (comment)

@RPRX RPRX closed this as completed in 73a001d Jul 11, 2024
@RPRX
Copy link
Member

RPRX commented Jul 11, 2024

试试 73a001d

leninalive pushed a commit to amnezia-vpn/amnezia-xray-core that referenced this issue Oct 29, 2024
@RPRX @leninalive
Upgrade github.com/xtls/reality to 20240711105359
480cc2c 
Fixes XTLS#3502
@irgfw irgfw mentioned this issue Dec 31, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@CalunVier @Fangliding @RPRX