From 8bbca76bdd55fc5eef828418abe566a238d4e5d8 Mon Sep 17 00:00:00 2001
From: n0liu <landuoduo123@gmail.com>
Date: Wed, 29 Jul 2026 04:10:47 +0800
Subject: [PATCH] fix(sub): drop duplicated fingerprint in external-proxy
 tlsSettings (#6096)

applyExternalProxyTLSToStream wrote the external proxy fingerprint both to
tlsSettings.fingerprint and to tlsSettings.settings.fingerprint, so the
generated JSON subscription for an XHTTP Host group carried the same
fingerprint twice. Every other field in this function writes a single
location, and tlsData already emits fingerprint at the top level, so keep
only tlsSettings.fingerprint.
---
 internal/sub/service.go      |  6 ------
 internal/sub/service_test.go | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/internal/sub/service.go b/internal/sub/service.go
index 3df68744c..d1b062240 100644
--- a/internal/sub/service.go
+++ b/internal/sub/service.go
@@ -1625,12 +1625,6 @@ func applyExternalProxyTLSToStream(ep map[string]any, stream map[string]any, sec
 	}
 	if fp, ok := ep["fingerprint"].(string); ok && fp != "" {
 		tlsSettings["fingerprint"] = fp
-		settings, _ := tlsSettings["settings"].(map[string]any)
-		if settings == nil {
-			settings = map[string]any{}
-			tlsSettings["settings"] = settings
-		}
-		settings["fingerprint"] = fp
 	}
 	if alpn, ok := externalProxyALPNList(ep["alpn"]); ok {
 		tlsSettings["alpn"] = alpn
diff --git a/internal/sub/service_test.go b/internal/sub/service_test.go
index 32f9ebe87..7754cd4f3 100644
--- a/internal/sub/service_test.go
+++ b/internal/sub/service_test.go
@@ -775,6 +775,26 @@ func TestApplyExternalProxyTLSToStream_DoesNotLeakAcrossProxies(t *testing.T) {
 	}
 }
 
+func TestApplyExternalProxyTLSToStream_FingerprintNotDuplicated(t *testing.T) {
+	stream := map[string]any{
+		"security":    "tls",
+		"tlsSettings": map[string]any{},
+	}
+	ep := map[string]any{"dest": "proxy.example.com", "fingerprint": "chrome"}
+
+	applyExternalProxyTLSToStream(ep, stream, "tls")
+
+	ts, _ := stream["tlsSettings"].(map[string]any)
+	if ts["fingerprint"] != "chrome" {
+		t.Fatalf("tlsSettings.fingerprint = %v, want %q", ts["fingerprint"], "chrome")
+	}
+	if settings, ok := ts["settings"].(map[string]any); ok {
+		if got, dup := settings["fingerprint"]; dup {
+			t.Fatalf("fingerprint must not be duplicated into tlsSettings.settings, got %v", got)
+		}
+	}
+}
+
 func TestApplyExternalProxyTLSParams_SetsPinnedPeerCert(t *testing.T) {
 	params := map[string]string{"security": "tls"}
 	ep := map[string]any{