diff --git a/infra/conf/transport_internet.go b/infra/conf/transport_internet.go index 8cc057a8bf80..c24317e63980 100644 --- a/infra/conf/transport_internet.go +++ b/infra/conf/transport_internet.go @@ -389,6 +389,8 @@ type TLSConfig struct { PinnedPeerCertificateChainSha256 *[]string `json:"pinnedPeerCertificateChainSha256"` PinnedPeerCertificatePublicKeySha256 *[]string `json:"pinnedPeerCertificatePublicKeySha256"` MasterKeyLog string `json:"masterKeyLog"` + ECHConfig string `json:"echConfig"` + ECHDOHServer string `json:"echDohServer"` } // Build implements Buildable. @@ -443,7 +445,16 @@ func (c *TLSConfig) Build() (proto.Message, error) { } } + if c.ECHConfig != "" { + ECHConfig, err := base64.StdEncoding.DecodeString(c.ECHConfig) + if err != nil { + return nil, errors.New("invalid ECH Config", c.ECHConfig) + } + config.EchConfig = ECHConfig + } + config.MasterKeyLog = c.MasterKeyLog + config.Ech_DOHserver = c.ECHDOHServer return config, nil } @@ -757,19 +768,19 @@ func (c *SocketConfig) Build() (*internet.SocketConfig, error) { } type StreamConfig struct { - Network *TransportProtocol `json:"network"` - Security string `json:"security"` - TLSSettings *TLSConfig `json:"tlsSettings"` - REALITYSettings *REALITYConfig `json:"realitySettings"` - TCPSettings *TCPConfig `json:"tcpSettings"` - KCPSettings *KCPConfig `json:"kcpSettings"` - WSSettings *WebSocketConfig `json:"wsSettings"` - HTTPSettings *HTTPConfig `json:"httpSettings"` - SocketSettings *SocketConfig `json:"sockopt"` - GRPCConfig *GRPCConfig `json:"grpcSettings"` - GUNConfig *GRPCConfig `json:"gunSettings"` - HTTPUPGRADESettings *HttpUpgradeConfig `json:"httpupgradeSettings"` - SplitHTTPSettings *SplitHTTPConfig `json:"splithttpSettings"` + Network *TransportProtocol `json:"network"` + Security string `json:"security"` + TLSSettings *TLSConfig `json:"tlsSettings"` + REALITYSettings *REALITYConfig `json:"realitySettings"` + TCPSettings *TCPConfig `json:"tcpSettings"` + KCPSettings *KCPConfig `json:"kcpSettings"` + WSSettings *WebSocketConfig `json:"wsSettings"` + HTTPSettings *HTTPConfig `json:"httpSettings"` + SocketSettings *SocketConfig `json:"sockopt"` + GRPCConfig *GRPCConfig `json:"grpcSettings"` + GUNConfig *GRPCConfig `json:"gunSettings"` + HTTPUPGRADESettings *HttpUpgradeConfig `json:"httpupgradeSettings"` + SplitHTTPSettings *SplitHTTPConfig `json:"splithttpSettings"` } // Build implements Buildable. diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go index b6c55c00bfb4..2d07a5f05792 100644 --- a/transport/internet/tls/config.go +++ b/transport/internet/tls/config.go @@ -1,6 +1,7 @@ package tls import ( + "bytes" "context" "crypto/hmac" "crypto/tls" @@ -10,7 +11,6 @@ import ( "strings" "sync" "time" - "bytes" "github.com/xtls/xray-core/common/errors" "github.com/xtls/xray-core/common/net" @@ -70,7 +70,7 @@ func (c *Config) BuildCertificates() []*tls.Certificate { continue } index := len(certs) - 1 - setupOcspTicker(entry, func(isReloaded, isOcspstapling bool){ + setupOcspTicker(entry, func(isReloaded, isOcspstapling bool) { cert := certs[index] if isReloaded { if newKeyPair := getX509KeyPair(); newKeyPair != nil { @@ -162,7 +162,7 @@ func (c *Config) getCustomCA() []*Certificate { for _, certificate := range c.Certificate { if certificate.Usage == Certificate_AUTHORITY_ISSUE { certs = append(certs, certificate) - setupOcspTicker(certificate, func(isReloaded, isOcspstapling bool){ }) + setupOcspTicker(certificate, func(isReloaded, isOcspstapling bool) {}) } } return certs @@ -390,6 +390,12 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { config.KeyLogWriter = writer } } + if len(c.EchConfig) > 0 || len(c.Ech_DOHserver) > 0 { + err := ApplyECH(c, config) + if err != nil { + errors.LogError(context.Background(), err) + } + } return config } diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index c141c375268a..bf2c1b7326f9 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -220,6 +220,8 @@ type Config struct { // @Critical PinnedPeerCertificatePublicKeySha256 [][]byte `protobuf:"bytes,14,rep,name=pinned_peer_certificate_public_key_sha256,json=pinnedPeerCertificatePublicKeySha256,proto3" json:"pinned_peer_certificate_public_key_sha256,omitempty"` MasterKeyLog string `protobuf:"bytes,15,opt,name=master_key_log,json=masterKeyLog,proto3" json:"master_key_log,omitempty"` + EchConfig []byte `protobuf:"bytes,16,opt,name=ech_config,json=echConfig,proto3" json:"ech_config,omitempty"` + Ech_DOHserver string `protobuf:"bytes,17,opt,name=ech_DOHserver,json=echDOHserver,proto3" json:"ech_DOHserver,omitempty"` } func (x *Config) Reset() { @@ -360,6 +362,20 @@ func (x *Config) GetMasterKeyLog() string { return "" } +func (x *Config) GetEchConfig() []byte { + if x != nil { + return x.EchConfig + } + return nil +} + +func (x *Config) GetEch_DOHserver() string { + if x != nil { + return x.Ech_DOHserver + } + return "" +} + var File_transport_internet_tls_config_proto protoreflect.FileDescriptor var file_transport_internet_tls_config_proto_rawDesc = []byte{ @@ -391,7 +407,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x4e, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, - 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xf6, 0x05, 0x0a, 0x06, 0x43, 0x6f, 0x6e, + 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xba, 0x06, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, 0x4a, 0x0a, 0x0b, 0x63, 0x65, @@ -439,14 +455,19 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x68, 0x61, 0x32, 0x35, 0x36, 0x12, 0x24, 0x0a, 0x0e, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x6c, 0x6f, 0x67, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x4c, 0x6f, - 0x67, 0x42, 0x73, 0x0a, 0x1f, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, - 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, - 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, - 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, - 0x65, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, - 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, 0x72, 0x61, 0x79, 0x2e, - 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, - 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x63, 0x68, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, + 0x10, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x65, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, + 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x63, 0x68, 0x5f, 0x44, 0x4f, 0x48, 0x73, 0x65, 0x72, 0x76, 0x65, + 0x72, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x63, 0x68, 0x44, 0x4f, 0x48, 0x73, + 0x65, 0x72, 0x76, 0x65, 0x72, 0x42, 0x73, 0x0a, 0x1f, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, + 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, + 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, + 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, + 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, + 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, + 0x72, 0x61, 0x79, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, + 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, + 0x6f, 0x33, } var ( diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index 0bd44dee164d..326e945cf55f 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -88,4 +88,6 @@ message Config { repeated bytes pinned_peer_certificate_public_key_sha256 = 14; string master_key_log = 15; + bytes ech_config = 16; + string ech_DOHserver = 17; } diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go new file mode 100644 index 000000000000..6d0d9d98be50 --- /dev/null +++ b/transport/internet/tls/ech.go @@ -0,0 +1,140 @@ +//go:build go1.23 +// +build go1.23 + +package tls + +import ( + "bytes" + "context" + "crypto/tls" + "io" + "net/http" + "sync" + "time" + + "github.com/miekg/dns" + "github.com/xtls/xray-core/common/errors" + "github.com/xtls/xray-core/common/net" + "github.com/xtls/xray-core/transport/internet" +) + +func ApplyECH(c *Config, config *tls.Config) error { + var ECHConfig []byte + var err error + + if len(c.EchConfig) > 0 { + ECHConfig = c.EchConfig + } else { // ECH config > DOH lookup + if config.ServerName == "" { + return errors.New("Using DOH for ECH needs serverName") + } + ECHConfig, err = QueryRecord(c.ServerName, c.Ech_DOHserver) + if err != nil { + return err + } + } + + config.EncryptedClientHelloConfigList = ECHConfig + return nil +} + +type record struct { + record []byte + expire time.Time +} + +var ( + dnsCache = make(map[string]record) + mutex sync.RWMutex +) + +func QueryRecord(domain string, server string) ([]byte, error) { + mutex.Lock() + rec, found := dnsCache[domain] + if found && rec.expire.After(time.Now()) { + mutex.Unlock() + return rec.record, nil + } + mutex.Unlock() + + errors.LogDebug(context.Background(), "Trying to query ECH config for domain: ", domain, " with ECH server: ", server) + record, ttl, err := dohQuery(server, domain) + if err != nil { + return []byte{}, err + } + + if ttl < 600 { + ttl = 600 + } + + mutex.Lock() + defer mutex.Unlock() + rec.record = record + rec.expire = time.Now().Add(time.Second * time.Duration(ttl)) + dnsCache[domain] = rec + return record, nil +} + +func dohQuery(server string, domain string) ([]byte, uint32, error) { + m := new(dns.Msg) + m.SetQuestion(dns.Fqdn(domain), dns.TypeHTTPS) + m.Id = 0 + msg, err := m.Pack() + if err != nil { + return []byte{}, 0, err + } + tr := &http.Transport{ + IdleConnTimeout: 90 * time.Second, + ForceAttemptHTTP2: true, + DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) { + dest, err := net.ParseDestination(network + ":" + addr) + if err != nil { + return nil, err + } + conn, err := internet.DialSystem(ctx, dest, nil) + if err != nil { + return nil, err + } + return conn, nil + }, + } + client := &http.Client{ + Timeout: 5 * time.Second, + Transport: tr, + } + req, err := http.NewRequest("POST", server, bytes.NewReader(msg)) + if err != nil { + return []byte{}, 0, err + } + req.Header.Set("Content-Type", "application/dns-message") + resp, err := client.Do(req) + if err != nil { + return []byte{}, 0, err + } + defer resp.Body.Close() + respBody, err := io.ReadAll(resp.Body) + if err != nil { + return []byte{}, 0, err + } + if resp.StatusCode != http.StatusOK { + return []byte{}, 0, errors.New("query failed with response code:", resp.StatusCode) + } + respMsg := new(dns.Msg) + err = respMsg.Unpack(respBody) + if err != nil { + return []byte{}, 0, err + } + if len(respMsg.Answer) > 0 { + for _, answer := range respMsg.Answer { + if https, ok := answer.(*dns.HTTPS); ok && https.Hdr.Name == dns.Fqdn(domain) { + for _, v := range https.Value { + if echConfig, ok := v.(*dns.SVCBECHConfig); ok { + errors.LogDebug(context.Background(), "Get ECH config:", echConfig.String(), " TTL:", respMsg.Answer[0].Header().Ttl) + return echConfig.ECH, answer.Header().Ttl, nil + } + } + } + } + } + return []byte{}, 0, errors.New("no ech record found") +} diff --git a/transport/internet/tls/ech_go121.go b/transport/internet/tls/ech_go121.go new file mode 100644 index 000000000000..4d77ac5ac10a --- /dev/null +++ b/transport/internet/tls/ech_go121.go @@ -0,0 +1,14 @@ +//go:build !go1.23 +// +build !go1.23 + +package tls + +import ( + "crypto/tls" + + "github.com/xtls/xray-core/common/errors" +) + +func ApplyECH(c *Config, config *tls.Config) error { + return errors.New("Win7 does not support ECH") +}