pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-13 17:35:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(outbounds): TLS for XDRIVE outbounds

Browse Source 
xray-core 26.10.10 dials an XDRIVE outbound's storage API with the
stream's tlsSettings: their SNI, uTLS fingerprint and ALPN are what the
API sees, which is the point of fronting it. canEnableTls kept XDRIVE out
of the TLS-capable networks, so the security picker never offered TLS and
switching a TLS outbound to XDRIVE silently reset it to none.

canEnableOutboundTls admits a TLS-eligible protocol on xdrive and backs
both the picker and the network-change cascade. Inbounds keep the plain
predicate: their tlsSettings carry server certificates, not a client hello.

Also restores the plain oxfmt / oxlint --fix lint-staged commands, reverting
da6872a3: that hook change was not wanted.
This commit is contained in:
MHSanaei
2026-10-11 15:44:17 +02:00
parent ef4bda4e06
commit c7d89ceac2
9 changed files with 99 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/content/docs/en/config/transports.mdx
+3 -1
View File
@@ -135,7 +135,9 @@ client; XDRIVE inbounds get no share link or Clash entry.
The optional **Front address/port** (the stream-level `address`/`port`) is a domain
front the storage API is dialed through; TLS still names the API host. XDRIVE has
no TLS/REALITY layer of its own — its traffic is the storage API's HTTPS.
no TLS/REALITY layer of its own — its traffic is the storage API's HTTPS. On an
outbound, **TLS** security shapes that HTTPS connection: its SNI, uTLS fingerprint
and ALPN are what the storage API sees.
## FinalMask — late-layer obfuscation
docs/content/docs/fa/config/transports.mdx
+3 -1
View File
@@ -136,7 +136,9 @@ XDRIVE جریان را به‌صورت فایل‌هایی در پوشه‌ای
**آدرس/پورت Front** اختیاری (کلیدهای `address`/`port` در سطح stream) یک domain front
است که API ذخیره‌ساز از طریق آن وصل می‌شود؛ نام TLS همچنان میزبان API است. XDRIVE لایهٔ
TLS/REALITY جداگانه‌ای ندارد — ترافیکش همان HTTPS خود API ذخیره‌ساز است.
TLS/REALITY جداگانه‌ای ندارد — ترافیکش همان HTTPS خود API ذخیره‌ساز است. در اوت‌باند،
امنیت **TLS** همین اتصال HTTPS را شکل می‌دهد: API ذخیره‌ساز همان SNI، اثرانگشت uTLS و
ALPN آن را می‌بیند.
## FinalMask — مبهم‌سازی لایه پایانی
docs/content/docs/ru/config/transports.mdx
+2
View File
@@ -139,6 +139,8 @@ XDRIVE передаёт поток файлами в папке, доступн
Необязательные **адрес/порт фронтинга** (`address`/`port` на уровне stream) — домен-фронт,
через который идёт подключение к API хранилища; в TLS по-прежнему указывается хост API.
У XDRIVE нет собственного уровня TLS/REALITY — его трафик это HTTPS самого API хранилища.
На исходящем безопасность **TLS** задаёт это HTTPS-подключение: API хранилища видит его
SNI, отпечаток uTLS и ALPN.
## FinalMask — обфускация на позднем уровне
docs/content/docs/zh/config/transports.mdx
+2 -1
View File
@@ -128,7 +128,8 @@ XDRIVE 把数据流作为文件存放在双方都能访问的文件夹中：服
| 调优参数 | 内核默认值 | `segmentBytes`（512 KiB）、`flushIntervalMs`（20）、`pollIntervalMs`/`maxPollIntervalMs`（50/500）、`eagerWindowMs`（2000）、`holeTimeoutMs`（30000）、`sessionTtlSeconds`（300）、`concurrency`（8）。 |
可选的**前置地址/端口**（stream 级的 `address`/`port`）是连接存储 API 时使用的域前置；TLS 中仍使用 API 主机名。
XDRIVE 没有自己的 TLS/REALITY 层——其流量就是存储 API 自身的 HTTPS。
XDRIVE 没有自己的 TLS/REALITY 层——其流量就是存储 API 自身的 HTTPS。在出站上，**TLS**
安全设置决定这条 HTTPS 连接：存储 API 看到的就是其中的 SNI、uTLS 指纹和 ALPN。
## FinalMask — 末层混淆