TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 #1416
Comments
|
我服务端1.6.5版本最新的用vision，iOS端用shadowrocket还是老的稳定版1.6.1内核，用普通vless+tls（不带xtls）直连，没有遇到过断连的情况。但op端ssrp用最新1.6.5 vision连接也是时常断连半分钟到几分钟不等。可以推测问题在最新版vision的客户端。 |
|
Other protoctols open UTLS will get e47eae8f8c4887b6. |
|
No, using different browsers will get different fingerprints. |
Tried vless+tls+vision with chrome fingerprint, did get e47eae8f8c4887b6. It looks like only tls+ws renders chrome fingerprint as b8ddad74f1546398. BTW, does fingerprint send with vision protoctol align with the real browser? |
手机客户端V2rayNG默认不开启mux，无论是tcp+ws还是vision，阻断都很厉害，打开Youtube秒挂。 因为没有看到过vision类似的报告，所以推测阿里这边的审查可能和单位时间新增连接数有关 可以看下你iOS端的shadowrocket有没有mux，是不是也可能是mux减少了连接数的关系？ 不过总的来说阻断和这个issue没有必然关联 |
嗯，我还有北京南京两个固定客户端ip的阻断情况是不太一样 还有就是我这边开始观察到阻断的现象 不过阻断属于题外话了，和issue里报告的指纹应该关联不大 |
|
😅 Suddenly sadness fall in mind... fingerprint: b8ddad74f1546398
fingerprint: a8cbd41521a6d477
fingerprint: b8ddad74f1546398
fingerprint: a8cbd41521a6d477
fingerprint: b8ddad74f1546398
fingerprint: a8cbd41521a6d477
fingerprint: b8ddad74f1546398
fingerprint: a8cbd41521a6d477 |
没有开mux |
|
Op did you mean OPPO, which system has implanted code to intervene and
detect servers?
…----------------------------------------
*发件人： *loydcheung ***@***.***>
*收件人： *XTLS/Xray-core ***@***.***>
*抄送： *Nanyu ***@***.***>; Comment ***@***.***>
*日期： *Dec 9, 2022 14:36:39
*主题： *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue #1416)
我服务端1.6.5版本最新的用vision，iOS端用shadowrocket还是老的稳定版1.6.1内核，用普通vless+tls（不带xtls）直连，没有遇到过断连的情况。但op端ssrp用最新1.6.5
vision连接也是时常断连半分钟到几分钟不等。可以推测问题在最新版vision的客户端。
手机客户端V2rayNG默认不开启mux，无论是tcp+ws还是vision，阻断都很厉害，打开Youtube秒挂。
后来找到了自定义配置的办法，在配置文件中开启了128路mux再配合tcp+ws，可用性好了很多。
因为没有看到过vision类似的报告，所以推测阿里这边的审查可能和单位时间新增连接数有关
而端口IP一直没有被封，极端情况也可能是阿里防火墙防ddos的默认行为
可以看下你iOS端的shadowrocket有没有mux，是不是也可能是mux减少了连接数的关系？
不过总的来说阻断和这个issue没有必然关联
这个issue本身就是chrome指纹配置在tls+ws时的行为不正确
[https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg][image][https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg]
没有开mux
—
Reply to this email directly, view it on
GitHub[#1416 (comment)],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYH6OXNYOFP3JIREJZDWMM7XNANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYBOLI4M43WSRZHXCITWMM7XNA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEGXJ6.gif]Message
ID: ***@***.***>
|
lol, op means OpenWrt, it contains the ssr plus. |
|
🤭 Remember Ssr plus doesn't have UTLS options. May you need to add some
extra operations.
…----------------------------------------
*From: *loydcheung ***@***.***>
*To: *XTLS/Xray-core ***@***.***>
*CC: *Nanyu ***@***.***>; Comment ***@***.***>
*Date: *Dec 9, 2022 15:09:35
*Subject: *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue
#1416)
Op did you mean OPPO, which system has implanted code to intervene and
detect servers?
----------------------------------------
/发件人： /loydcheung /*@*/.///>
/收件人： /XTLS/Xray-core /*@*/.///>
/抄送： /Nanyu /*@*/.///>; Comment /*@*/./**>
*日期： *Dec 9, 2022 14:36:39
*主题： *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue
#1416[#1416])
我服务端1.6.5版本最新的用vision，iOS端用shadowrocket还是老的稳定版1.6.1内核，用普通vless+tls（不带xtls）直连，没有遇到过断连的情况。但op端ssrp用最新1.6.5
vision连接也是时常断连半分钟到几分钟不等。可以推测问题在最新版vision的客户端。
手机客户端V2rayNG默认不开启mux，无论是tcp+ws还是vision，阻断都很厉害，打开Youtube秒挂。
后来找到了自定义配置的办法，在配置文件中开启了128路mux再配合tcp+ws，可用性好了很多。
因为没有看到过vision类似的报告，所以推测阿里这边的审查可能和单位时间新增连接数有关
而端口IP一直没有被封，极端情况也可能是阿里防火墙防ddos的默认行为
可以看下你iOS端的shadowrocket有没有mux，是不是也可能是mux减少了连接数的关系？
不过总的来说阻断和这个issue没有必然关联
这个issue本身就是chrome指纹配置在tls+ws时的行为不正确
[https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg][image][https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg]
没有开mux
—
Reply to this email directly, view it on
GitHub[#1416]#issuecomment-1344384671],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYH6OXNYOFP3JIREJZDWMM7XNANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYBOLI4M43WSRZHXCITWMM7XNA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEGXJ6.gif]Message
ID: /*@*/.***>
lol, op means OpenWrt, it contains the ssr plus.
—
Reply to this email directly, view it on
GitHub[#1416 (comment)],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYHHI34CLAFE5DTJTJTWMNDS5ANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYGSXK4UCXTUSXAK4ZTWMNDS5A5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEJAEW.gif]Message
ID: ***@***.***>
|
uTLS setting equals the fingerprint setting right? the latest ssrp has that option, can be Chrome/Firefox/Safari/Random |
|
根据之前的讨论 浏览器发 ws 时候 指纹确实是不一样的 原因是 ALPN 仅支持 http/1.1 |
|
😅
…----------------------------------------
*From: *loydcheung ***@***.***>
*To: *XTLS/Xray-core ***@***.***>
*CC: *Nanyu ***@***.***>; Comment ***@***.***>
*Date: *Dec 9, 2022 16:37:47
*Subject: *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue
#1416)
🤭 Remember Ssr plus doesn't have UTLS options. May you need to add
some
extra operations.
----------------------------------------
/From: /loydcheung /*@*/.///>
/To: /XTLS/Xray-core /*@*/.///>
/CC: /Nanyu /*@*/.///>; Comment /*@*/./**>
*Date: *Dec 9, 2022 15:09:35
*Subject: *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue
#1416[#1416])
Op did you mean OPPO, which system has implanted code to intervene and
detect servers?
----------------------------------------
/发件人： /loydcheung //@//.///>
/收件人： /XTLS/Xray-core //@//.///>
/抄送： /Nanyu //@//.///>; Comment //@//./**>
*日期： *Dec 9, 2022 14:36:39
*主题： *Re: [XTLS/Xray-core] TLS指纹设置为chrome时，仍然有被识别为go客户端的风险 (Issue
#1416[#1416][https://github.com//issues/1416[https://github.com/XTLS/Xray-core/issues/1416]])
我服务端1.6.5版本最新的用vision，iOS端用shadowrocket还是老的稳定版1.6.1内核，用普通vless+tls（不带xtls）直连，没有遇到过断连的情况。但op端ssrp用最新1.6.5
vision连接也是时常断连半分钟到几分钟不等。可以推测问题在最新版vision的客户端。
手机客户端V2rayNG默认不开启mux，无论是tcp+ws还是vision，阻断都很厉害，打开Youtube秒挂。
后来找到了自定义配置的办法，在配置文件中开启了128路mux再配合tcp+ws，可用性好了很多。
因为没有看到过vision类似的报告，所以推测阿里这边的审查可能和单位时间新增连接数有关
而端口IP一直没有被封，极端情况也可能是阿里防火墙防ddos的默认行为
可以看下你iOS端的shadowrocket有没有mux，是不是也可能是mux减少了连接数的关系？
不过总的来说阻断和这个issue没有必然关联
这个issue本身就是chrome指纹配置在tls+ws时的行为不正确
[https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg][image][https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg]
没有开mux
—
Reply to this email directly, view it on
GitHub[#1416][https://github.com//issues/1416[https://github.com/XTLS/Xray-core/issues/1416]]#issuecomment-1344384671],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYH6OXNYOFP3JIREJZDWMM7XNANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYBOLI4M43WSRZHXCITWMM7XNA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEGXJ6.gif]Message
ID: //@//.***>
lol, op means OpenWrt, it contains the ssr plus.
—
Reply to this email directly, view it on
GitHub[#1416]#issuecomment-1344421963],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYHHI34CLAFE5DTJTJTWMNDS5ANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYGSXK4UCXTUSXAK4ZTWMNDS5A5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEJAEW.gif]Message
ID: /*@*/.***>
uTLS setting equals the fingerprint setting right? the latest ssrp has
that option, can be Chrome/Firefox/Safari/Random
—
Reply to this email directly, view it on
GitHub[#1416 (comment)],
or
unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYCPWU7EXHOITOXRMLTWMNN5VANCNFSM6AAAAAASY3V35A].
You are receiving this because you commented.[Tracking
image][https://github.com/notifications/beacon/AKGBAYCX3XUFDMKZ2MXLSIDWMNN5VA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEO6AE.gif]Message
ID: ***@***.***>
|
但是针对ws，指纹设置为safari、firefox时，查询到的结果中并没有 go 客户端的命中，仅设置为chrome时会有如题图中的结果，不知道是否会引起被识别的风险。 |
![https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg][image][https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg](https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg][image][https://user-images.githubusercontent.com/59357798/206725754-4e86ed3e-ab29-47ee-beb6-a761bc53d2a5.jpeg){kind=link}
![https://github.com/notifications/beacon/AKGBAYBOLI4M43WSRZHXCITWMM7XNA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEGXJ6.gif]Message](https://github.com/notifications/beacon/AKGBAYBOLI4M43WSRZHXCITWMM7XNA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEGXJ6.gif]Message){kind=link}
![https://github.com/notifications/beacon/AKGBAYGSXK4UCXTUSXAK4ZTWMNDS5A5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEJAEW.gif]Message](https://github.com/notifications/beacon/AKGBAYGSXK4UCXTUSXAK4ZTWMNDS5A5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEJAEW.gif]Message){kind=link}
![https://github.com/notifications/beacon/AKGBAYCX3XUFDMKZ2MXLSIDWMNN5VA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEO6AE.gif]Message](https://github.com/notifications/beacon/AKGBAYCX3XUFDMKZ2MXLSIDWMNN5VA5CNFSM6AAAAAASY3V35CWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSQEO6AE.gif]Message){kind=link}
基本配置：vless+tls+ws，回落正常站点伪装
R2C做旁路由，ubuntu20.04系统
使用dmsmasq仅分流gfwlist域名流量，TPROXY模式
当前版本使用Xray 1.6.5
通过 get-tls-fingerprints.py 抓取获得的指纹信息:
sudo tcpdump '(tcp[tcp[12]/4]=22) and (tcp[tcp[12]/4+1]=3) and (tcp[tcp[12]/4+5]=1) and (tcp[tcp[12]/4+9]=3)' -w - | ./get-tls-fingerprints.py | grep domain.com如果设置为 chrome，可以得到指纹 b8ddad74f1546398。
通过查询 https://tlsfingerprint.io/id/b8ddad74f1546398
可见在12月的增长以及curl、go两个客户端在使用：
设置为 safari 时，暂时未查询到有 go 客户端的信息：
https://tlsfingerprint.io/id/833fb25fb38a093b
而实际使用Mac上Chrome 108.0.5359.98访问的指纹为：
https://tlsfingerprint.io/id/e47eae8f8c4887b6
PS：
当前使用阿里新加坡的主机，客户端网络为上海电信
10月之前连接很稳定，但是10月以来开始出现连接中断的情况
实测443端口并发链接多时，无论是回落到ws还是直接用XTLS的各种流控，包括vision
均会对应特定客户端IP阻断若干时间（几秒到几分钟）
阻断时回落的站点也无法访问，但是其他IP访问正常
指纹为safari时阻断似乎恢复较快，不知道是不是心理作用
开启ws+128路mux，保持单IP连接在2个以内时较为稳定
针对没有mux的vision等协议，有时开启后重启服务即会被阻断。
推测是因为审查发生在链接建立时，较少建立新连接的话较不易被侦测到
不过10月以来虽然各种尝试均有被阻断情况
但是服务器端口和 IP尚未被封，可能是因为自用流量较小的原因。
也尝试过手机端的V2rayNG直连服务器，阻断的行为类似
所以分析这个情况和电信、阿里的审查有关，而和客户端采用socks代理、tproxy等模式关系不大
The text was updated successfully, but these errors were encountered: