[突发] macOS+shadowrocket连接xray报错: REALITY: processed invalid connection

[steam-dumpling]

客户端是macOS或iOS+shadowrocket（配置文件见客户端配置1），服务器一开始用的是xray 1.8.1（配置文件见服务端配置），都很正常，突然某个时候不能用了，检查error_log里报告：
[Info] transport/internet/tcp: REALITY: processed invalid connection
换了1.8.4，问题照旧。

后来在macOS上也用xray 1.8.4（配置文件见客户端配置2），替换掉Shadowrocket，手动设置操作系统的网络代理，就可以正常工作，然而切换回shadowrocket，又不行，报同样的错。反复核对publickey, privatekey, uuid, shortid，都正常呢。

最后又试了最新版本的V2rayU，也ok。

这种情况，可以怀疑shadowrocket的这个版本有bug，或者它和xray的兼容性有问题吗？

客户端配置1（shadowrocket导出的配置json）:

  "host" : "myhost.com",
  "file" : "",
  "obfsParam" : "",
  "alpn" : "",
  "cert" : "",
  "created" : 1685262950.8124309,
  "updated" : 1694186788.453717,
  "tls" : true,
  "mtu" : "",
  "flag" : "US",
  "ping" : 146,
  "privateKey" : "",
  "uuid" : "0E9315C2-EBBC-45DB-A3AE-4B82EBD88D97",
  "type" : "VLESS",
  "downmbps" : "",
  "user" : "",
  "xtls" : 2,
  "plugin" : "none",
  "method" : "auto",
  "data" : "",
  "udp" : 1,
  "filter" : "",
  "protoParam" : "",
  "reserved" : "",
  "alterId" : "",
  "upmbps" : "",
  "keepalive" : "",
  "port" : "554",
  "obfs" : "none",
  "dns" : "",
  "publicKey" : "--nAYUYkxWfHZiNlzRiLXZlnMqdUQ_XA2xiDN6oCvHo",
  "peer" : "",
  "weight" : 1685262950,
  "ip" : "",
  "title" : "BWG-vless-reality",
  "proto" : "",
  "password" : "f453e444-ccb9-47be-ab5a-49c15069b789",
  "chain" : "",
  "shortId" : "49c15069b789"
}

客户端配置2: (客户端的xray使用的配置文件）

    "log": {
        "access": "access.log",
        "error": "error.log",
        "loglevel": "info"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:cn",
                    "geosite:private"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 10808,
            "protocol": "socks"
        },
        {
            "listen": "127.0.0.1",
            "port": 10809,
            "protocol": "http"
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "myhost.com",
                        "port": 443,
                        "users": [
                            {
                                "id": "f453e444-ccb9-47be-ab5a-49c15069b789", 
                                "encryption": "none",
                                "flow": "xtls-rprx-vision"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "publicKey": "--nAYUYkxWfHZiNlzRiLXZlnMqdUQ_XA2xiDN6oCvHo",
                    "shortId": "49c15069b789",
                    "fingerprint": "randomized",
                    "serverName": "www.amazon.com"
                }
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ]
}

服务器端配置：

  "log": {
     "access": "logs/access.log",
     "error": "logs/error.log",
     "loglevel": "debug"
  },
  "routing": {
    "rules": [
      {
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api",
        "type": "field"
      },
      {
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "blocked",
        "type": "field"
      },
      {
        "outboundTag": "blocked",
        "protocol": [
          "bittorrent"
        ],
        "type": "field"
      }
    ]
  },
  "dns": null,
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "f453e444-ccb9-47be-ab5a-49c15069b789",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "privateKey":"YEQx7DXLpzDCrDb13b9kpDhCZS1xnW4WGbilqCFQOH0",
          "shortIds": ["49c15069b789"],
          "dest": "13.225.150.222:443",
          "xver": 0,
          "type": "tcp",
          "serverNames": ["www.amazon.com"],
          "minClientVer": "", 
          "maxClientVer": "",
          "maxTimeDiff": 0
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ],
  "transport": null,
  "policy": {
    "system": {
      "statsInboundDownlink": true,
      "statsInboundUplink": true
    }
  },
  "api": {
    "services": [
      "HandlerService",
      "LoggerService",
      "StatsService"
    ],
    "tag": "api"
  },
  "stats": {},
  "reverse": null,
  "fakeDns": null
}

V2rayU的客户端配置：

  "log": {
    "error": "",
    "loglevel": "info",
    "access": ""
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "protocol": "socks",
      "settings": {
        "udp": false,
        "auth": "noauth"
      },
      "port": "1080"
    },
    {
      "listen": "127.0.0.1",
      "protocol": "http",
      "settings": {
        "timeout": 360
      },
      "port": "1087"
    }
  ],
  "outbounds": [
    {
      "mux": {
        "enabled": false,
        "concurrency": 8
      },
      "protocol": "vless",
      "streamSettings": {
        "tcpSettings": {
          "header": {
            "type": "none"
          }
        },
        "security": "reality",
        "realitySettings": {
          "spiderX": "",
          "publicKey": "--nAYUYkxWfHZiNlzRiLXZlnMqdUQ_XA2xiDN6oCvHo",
          "show": true,
          "serverName": "www.amazon.com",
          "shortId": "49c15069b789",
          "fingerprint": "chrome"
        },
        "network": "tcp"
      },
      "tag": "proxy",
      "settings": {
        "vnext": [
          {
            "address": "myhost.com",
            "users": [
              {
                "encryption": "none",
                "id": "f453e444-ccb9-47be-ab5a-49c15069b789",
                "level": 0,
                "flow": "xtls-rprx-vision"
              }
            ],
            "port": 554
          }
        ]
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIP",
        "userLevel": 0
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "none"
        }
      }
    }
  ],
  "dns": {
    "servers": [
      "https://1.1.1.1/dns-query"
    ]
  },
  "routing": {
    "settings": {
      "domainStrategy": "AsIs",
      "rules": []
    }
  },
  "transport": {}
}

[computerscot]

Is www.amazon.com the problem? Does your configuration work if you change the serverName on both server and client?

[steam-dumpling]

If www.amazon.com was the problem, how could xray<-->xray or V2rayU<-->xray is working?
如果www.amazon.com是问题的话，那为啥xray<-->xray或V2rayU<-->xray的架构可以呢？

I tried to modify serverNames to "serverNames": [""] but kept "dest": "13.225.150.222:443" which is the IP addr of www.amazon.com got from ping on the xray server. But no luck with shadowrocket as my client.
我试过把serverNames改成"serverNames": [""]，但保留了"dest": "13.225.150.222:443"，这是xray服务器上用ping得到的amazon的IP，但用shadowrocket作客户端还是不行。

And I could not find a place to set serverName in shadowrocket, can you advise how to achieve that?
另外，我没找到shadowrocket设serverName的地方，你知道吗？

Thank you.

[computerscot]

Here is the JSON that Shadowrocket generated from the GUI. I notice it has TLS, where your example has XTLS.

{
  "host" : "YOUR.SERVER.IP.ADDRESS",
  "file" : "",
  "obfsParam" : "",
  "alpn" : "",
  "cert" : "",
  "created" : 1694226294.9797649,
  "updated" : 1694226394.4457889,
  "tls" : true,
  "mtu" : "",
  "flag" : "CA",
  "privateKey" : "",
  "uuid" : "0EC459A8-F907-4750-B8FC-C774856952FB",
  "type" : "VLESS",
  "downmbps" : "",
  "user" : "",
  "plugin" : "none",
  "method" : "auto",
  "data" : "",
  "udp" : 1,
  "filter" : "",
  "protoParam" : "",
  "reserved" : "",
  "alterId" : "",
  "upmbps" : "",
  "keepalive" : "",
  "port" : "443",
  "obfs" : "h2",
  "dns" : "",
  "publicKey" : "lmjh9CfF_ddWSuCUPUtEo_CGz9N5CyR67ks7VINfD3s",
  "peer" : "www.cisco.com",
  "weight" : 1694226294,
  "ip" : "",
  "title" : "",
  "proto" : "",
  "password" : "853af180-f6e2-4252-991a-1e3a450490ad",
  "chain" : "",
  "shortId" : "d6aeb0a2aa95237c"
}

[computerscot]

Server config corresponding to above Shadowrocket JSON:

{
    "log": {
        "loglevel": "warning"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "block"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "853af180-f6e2-4252-991a-1e3a450490ad",
                        "flow": ""
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "h2",
                "security": "reality",
                "realitySettings": {
                    "show": false,
                    "dest": "www.cisco.com:443",
                    "xver": 0,
                    "serverNames": [ 
                        "www.cisco.com"
                    ],
                    "privateKey": "gIpzouKzSapqg8uk9LR7OvDmq1KBxs0oct7emb4bjXc",
                    "shortIds": [ 
                        "d6aeb0a2aa95237c"
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ]
}

[computerscot]

Screenshot of latest Shadowrocket GUI config.

[steam-dumpling]

Thanks @computerscot ! Your help is very useful.

I found the problem is that I should have set SNI in shadowrocket to 'www.amazon.com'. With that one changed, it works as it should be. My bad ignoring this setting before.