pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-03 03:35:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(tls): cipher suite presets and a uTLS fingerprint warning

Browse Source 
Adds PattN's semi-python and real-firefox client cipher lists as presets
in the cipher suites picker. A preset replaces the whole list because the
order is part of the ClientHello.

The inbound TLS form now warns when cipher suites are set under a uTLS
fingerprint other than "unsafe": clients ignore them there, while an
empty fingerprint is already pinned to unsafe in share links.
This commit is contained in:
MHSanaei
2026-10-25 15:54:48 +01:00
parent c3d4a153b3
commit f992694712
19 changed files with 134 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/test/cipher-suites-select.test.tsx
+16
View File
@@ -24,6 +24,22 @@ describe('CipherSuitesSelect', () => {
expect(onChange).toHaveBeenLastCalledWith('TLS_AES_256_GCM_SHA384:MY_CUSTOM_SUITE');
});
// A preset is a whole ordered list (the order is part of the ClientHello), so
// picking one replaces the suites instead of appending a tag named after it.
it('replaces the suites with the picked preset list', async () => {
const onChange = renderSelect('TLS_AES_256_GCM_SHA384');
fireEvent.mouseDown(screen.getByRole('combobox', { name: 'cipher suites' }));
fireEvent.click(await screen.findByText('real-firefox'));
expect(onChange).toHaveBeenLastCalledWith(
'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:' +
'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:' +
'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:' +
'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:' +
'TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:' +
'TLS_RSA_WITH_AES_128_CBC_SHA:TLS_RSA_WITH_AES_256_CBC_SHA',
);
});
it('stores an empty string once every suite is removed', () => {
const onChange = renderSelect('TLS_AES_256_GCM_SHA384');
const remove = document.querySelector('.ant-select-selection-item-remove');
frontend/src/test/ech-dynamic-helper-tls.test.tsx
+23
View File
@@ -136,3 +136,26 @@ describe('inbound TLS dynamic ECH helper', () => {
expect(screen.getByTestId('ech-cdn-warning').textContent).toMatch(/Cloudflare CDN/i);
});
});
// Xray drops cipherSuites under every uTLS fingerprint but unsafe; an empty one
// is left out because share links pin it to unsafe.
describe('inbound TLS cipherSuites fingerprint warning', () => {
function tlsValues(cipherSuites: string, fingerprint: string) {
return { streamSettings: { tlsSettings: { cipherSuites, settings: { fingerprint } } } };
}
it('warns when cipher suites sit under a uTLS fingerprint', async () => {
renderTls(tlsValues('TLS_AES_128_GCM_SHA256', 'chrome'));
expect(await screen.findByTestId('cipher-suites-fingerprint-warning')).toBeTruthy();
});
it.each([
['unsafe fingerprint', 'TLS_AES_128_GCM_SHA256', 'unsafe'],
['empty fingerprint', 'TLS_AES_128_GCM_SHA256', ''],
['no cipher suites', '', 'chrome'],
])('stays silent with %s', async (_, cipherSuites, fingerprint) => {
renderTls(tlsValues(cipherSuites, fingerprint));
await screen.findByTestId('ech-dynamic-helper');
expect(screen.queryByTestId('cipher-suites-fingerprint-warning')).toBeNull();
});
});