Reality使用特定dest会导致服务端processed invalid connection错误

[saiteTimedOut]

Xray版本：1.8.3
问题dest：mirror.de.leaseweb.net

# curl https://mirror.de.leaseweb.net/debian/ -v
*   Trying [2a00:c98:2030:a034::21]:443...
* Connected to mirror.de.leaseweb.net (2a00:c98:2030:a034::21) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=mirror.leaseweb.com
*  start date: Jun 21 12:39:46 2023 GMT
*  expire date: Sep 19 12:39:45 2023 GMT
*  subjectAltName: host "mirror.de.leaseweb.net" matched cert's "mirror.de.leaseweb.net"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /debian/]
* h2h3 [:scheme: https]
* h2h3 [:authority: mirror.de.leaseweb.net]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55e494877c70)
> GET /debian/ HTTP/2
> Host: mirror.de.leaseweb.net
> user-agent: curl/7.88.1
> accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 200 
< server: nginx
< date: Sun, 09 Jul 2023 12:47:17 GMT
< content-type: text/html
< strict-transport-security: max-age=31536000
< x-frame-options: DENY
< x-content-type-options: nosniff
< 
......

可见该dest支持TLSv1.3和HTTP2，但若使用该dest，服务端会输出processed invalid connection，且客户端无法完成握手。
客户端输出：

[Info] [3588266399] proxy/socks: TCP Connect request to tcp:199.96.59.61:80
 [Info] [3588266399] app/dispatcher: sniffed domain: www.google.com
[Info] [3588266399] app/dispatcher: taking detour [proxy] for [tcp:www.google.com:80]
tcp:127.0.0.1:53550 accepted tcp:199.96.59.61:80 [proxy]
[Info] [3588266399] transport/internet/tcp: dialing TCP to tcp:x:443
[Debug] transport/internet: dialing to tcp:x:443
REALITY localAddr: x:xxxxx    hello.SessionId[:16]: [1 8 3 0 100 170 174 47 177 0 0 0 0 0 0 0]
REALITY localAddr: x:xxxxx    uConn.AuthKey[:16]: [33 118 36 108 102 225 231 150 48 212 152 192 81 235 11 179]        AEAD: *aes.gcmAsm
[Info] [2537187317] transport/internet/tcp: dialing TCP to tcp:95.179.164.69:443
[Debug] transport/internet: dialing to tcp:x:443
REALITY localAddr: x:xxxxx    hello.SessionId[:16]: [1 8 3 0 100 170 175 177 177 0 0 0 0 0 0 0]
REALITY localAddr: x:xxxxx    uConn.AuthKey[:16]: [75 143 103 105 165 252 67 241 202 236 18 18 182 112 19 33] AEAD: *aes.gcmAsm
...
[Warning] [3588266399] app/proxyman/outbound: failed to process outbound traffic > proxy/vless/outbound: failed to find an available destination > common/retry: [EOF] > common/retry: all retry attempts failed
[Info] [3588266399] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

服务端输出：

 REALITY remoteAddr: x:xxxxx
 REALITY remoteAddr: x:xxxxx        hs.c.AuthKey[:16]: [67 4 192 19 90 42 233 153 226 55 228 240 100 21 241 137]        AEAD: *aes.gcmAsm
 REALITY remoteAddr: x:xxxxx        hs.c.ClientVer: [1 8 3]
 REALITY remoteAddr: x:xxxxx        hs.c.ClientTime: 2023-07-09 xx:xx:xx +0000 UTC
 REALITY remoteAddr: x:xxxxx        hs.c.ClientShortId: [177 0 0 0 0 0 0 0]
 REALITY remoteAddr: x:xxxxx        hs.c.conn == conn: true
 REALITY remoteAddr: x:xxxxx        len(s2cSaved): 99        Server Hello: 93
 REALITY remoteAddr: x:xxxxx        handled: false
[Info] transport/internet/tcp: REALITY: processed invalid connection
......

已使用境外VPS作为客户端尝试，排除了墙的干扰
若将dest（及serverName等改为www.microsoft.com）则可正常建立连接

为排除配置的干扰，配置文件几乎与https://cscot.pages.dev/2023/03/02/Xray-REALITY-tutorial/中的相同
服务端配置（仅修改了log、dest、serverNames）：

{
    "log": {
        "loglevel": "debug"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn"
                ],
                "outboundTag": "block"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "9f2b4b10-6818-492e-a157-d5131d450c7b",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": true,
                    "dest": "mirror.de.leaseweb.net:443",
                    "xver": 0,
                    "serverNames": [
                        "mirror.de.leaseweb.net"
                    ],
                    "privateKey": "M4cZLR81ErNfxnG1fAnNUIATs_UXqe6HR78wINhH7RA",
                    "minClientVer": "",
                    "maxClientVer": "",
                    "maxTimeDiff": 0,
                    "shortIds": [
                        "b1"
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 3,
                "connIdle": 180
            }
        }
    }
}

客户端配置（仅修改了log、serverName）：

{
    "log": {
        "loglevel": "debug"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:category-games@cn"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:geolocation-!cn"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:cn",
                    "geosite:private"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 20808,
            "protocol": "socks",
            "settings": {
                "udp": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        },
        {
            "listen": "127.0.0.1",
            "port": 20809,
            "protocol": "http",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "x",
                        "port": 443,
                        "users": [
                            {
                                "id": "9f2b4b10-6818-492e-a157-d5131d450c7b",
                                "flow": "xtls-rprx-vision",
                                "encryption": "none"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": true,
                    "fingerprint": "chrome",
                    "serverName": "mirror.de.leaseweb.net",
                    "publicKey": "ioE61VC3V30U7IdRmQ3bjhOq2ij9tPhVIgAD4JZ4YRY",
                    "shortId": "b1",
                    "spiderX": "/"
                }
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ]
}

[Smallthing]

这个站用的P-384而不是X25519

[saiteTimedOut]

感谢解答！

[saiteTimedOut]

或许应该在dest选取的要求中加上这一点？

[chika0801]

我正在看你发的 mirror.de.leaseweb.net 有不有X25519，楼上就回答了，这问题以前有人遇到过发过ISS我们才知道的。官方示例中可能没写太直白明白。

https://github.com/chika0801/Xray-examples/blob/main/VLESS-XTLS-uTLS-REALITY/config_server.json#L37

我的示例注释是写了的。虽然原理我不懂，我还是提醒过了的。