From 676a600edbd21e036102b82e84c3541ba56c9eea Mon Sep 17 00:00:00 2001 From: RPRX <63339210+RPRX@users.noreply.github.com> Date: Wed, 14 Oct 2026 10:44:41 +0000 Subject: [PATCH] Update github.com/xtls/reality to 20261014101318 https://github.com/XTLS/REALITY/commit/83f621788ca88b83179810b12baa7ae518aacb83 https://github.com/XTLS/REALITY/commit/14cefac9bd7a724a811b02759fa97aa86a1ec894 https://github.com/XTLS/REALITY/commit/3c98159dee388c2914a2b9e73ea57bc10023f9d3 --- go.mod | 7 +++---- go.sum | 16 ++++++++-------- main/commands/all/mldsa65.go | 6 +++--- transport/internet/reality/config.go | 13 +++++++++---- transport/internet/reality/reality.go | 19 +++++++++---------- 5 files changed, 32 insertions(+), 29 deletions(-) diff --git a/go.mod b/go.mod index 554a3bb8b..505c6b6d1 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,6 @@ go 1.27 require ( github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e - github.com/cloudflare/circl v1.6.5 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 github.com/golang/mock v1.7.0-rc.1 github.com/google/go-cmp v0.7.0 @@ -20,7 +19,7 @@ require ( github.com/robfig/cron/v3 v3.0.1 github.com/stretchr/testify v1.12.1 github.com/vishvananda/netlink v1.3.1 - github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0 + github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8 github.com/yuin/gopher-lua v1.1.2 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba golang.org/x/crypto v0.57.0 @@ -42,13 +41,13 @@ require ( ) require ( - github.com/andybalholm/brotli v1.0.6 // indirect + github.com/andybalholm/brotli v1.2.3 // indirect github.com/google/btree v1.1.2 // indirect github.com/google/gopacket v1.1.19 // indirect github.com/huin/goupnp v1.2.0 // indirect github.com/jackpal/go-nat-pmp v1.0.2 // indirect github.com/juju/ratelimit v1.0.2 // indirect - github.com/klauspost/compress v1.17.4 // indirect + github.com/klauspost/compress v1.20.0 // indirect github.com/koron/go-ssdp v0.0.4 // indirect github.com/libp2p/go-netroute v0.2.1 // indirect github.com/pion/dtls/v3 v3.1.5 // indirect diff --git a/go.sum b/go.sum index 871d83571..3d453ff84 100644 --- a/go.sum +++ b/go.sum @@ -1,12 +1,10 @@ -github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI= -github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= +github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA5NQ= +github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg= github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= -github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA= -github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c= github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 h1:Arcl6UOIS/kgO2nW3A65HN+7CMjSDP/gofXL4CZt1V4= github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I= github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474= @@ -33,8 +31,8 @@ github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7Bd github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc= github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI= github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk= -github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4= -github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM= +github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA= +github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw= github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0= @@ -81,8 +79,10 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM= github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU= github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA= -github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0 h1:rb+fKQFhz+5I2PPuQsNYxI5mUU840XWYtRF0ZBjvkws= -github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI= +github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8 h1:RjLnVvlzK4q6zWaSBPNRGsrgx2fbJDeUWffjw574uzs= +github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8/go.mod h1:ptlSkJ8k/7IDauNH0SA96JPOo+nYGLTv2Y3UMpwvAsY= +github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= +github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ= github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA= diff --git a/main/commands/all/mldsa65.go b/main/commands/all/mldsa65.go index 2c90d9756..767c57122 100644 --- a/main/commands/all/mldsa65.go +++ b/main/commands/all/mldsa65.go @@ -1,11 +1,11 @@ package all import ( + "crypto/mldsa" "crypto/rand" "encoding/base64" "fmt" - "github.com/cloudflare/circl/sign/mldsa/mldsa65" "github.com/xtls/xray-core/main/commands/base" ) @@ -39,8 +39,8 @@ func executeMLDSA65(cmd *base.Command, args []string) { } else { rand.Read(seed[:]) } - pub, _ := mldsa65.NewKeyFromSeed(&seed) + key, _ := mldsa.NewPrivateKey(mldsa.MLDSA65(), seed[:]) fmt.Printf("Seed: %v\nVerify: %v\n", base64.RawURLEncoding.EncodeToString(seed[:]), - base64.RawURLEncoding.EncodeToString(pub.Bytes())) + base64.RawURLEncoding.EncodeToString(key.PublicKey().Bytes())) } diff --git a/transport/internet/reality/config.go b/transport/internet/reality/config.go index 0b26621d8..6709ae2c8 100644 --- a/transport/internet/reality/config.go +++ b/transport/internet/reality/config.go @@ -2,12 +2,13 @@ package reality import ( "context" + "crypto/ecdh" + "crypto/mldsa" "io" "net" "os" "time" - "github.com/cloudflare/circl/sign/mldsa/mldsa65" "github.com/xtls/reality" "github.com/xtls/xray-core/common/errors" "github.com/xtls/xray-core/transport/internet" @@ -23,7 +24,6 @@ func (c *Config) GetREALITYConfig() *reality.Config { Dest: c.Dest, Xver: byte(c.Xver), - PrivateKey: c.PrivateKey, MinClientVer: c.MinClientVer, MaxClientVer: c.MaxClientVer, MaxTimeDiff: time.Duration(c.MaxTimeDiff) * time.Millisecond, @@ -33,9 +33,14 @@ func (c *Config) GetREALITYConfig() *reality.Config { KeyLogWriter: KeyLogWriterFromConfig(c), } + var err error + if config.PrivateKey, err = ecdh.X25519().NewPrivateKey(c.PrivateKey); err != nil { + panic(err) + } if c.Mldsa65Seed != nil { - _, key := mldsa65.NewKeyFromSeed((*[32]byte)(c.Mldsa65Seed)) - config.Mldsa65Key = key.Bytes() + if config.Mldsa65Key, err = mldsa.NewPrivateKey(mldsa.MLDSA65(), c.Mldsa65Seed); err != nil { + panic(err) + } } if c.LimitFallbackUpload != nil { config.LimitFallbackUpload.AfterBytes = c.LimitFallbackUpload.AfterBytes diff --git a/transport/internet/reality/reality.go b/transport/internet/reality/reality.go index 9ccae6686..4431a1764 100644 --- a/transport/internet/reality/reality.go +++ b/transport/internet/reality/reality.go @@ -5,7 +5,9 @@ import ( "context" "crypto/ecdh" "crypto/ed25519" + "crypto/hkdf" "crypto/hmac" + "crypto/mldsa" "crypto/sha256" "crypto/sha512" gotls "crypto/tls" @@ -22,7 +24,6 @@ import ( "time" "unsafe" - "github.com/cloudflare/circl/sign/mldsa/mldsa65" utls "github.com/refraction-networking/utls" "github.com/xtls/reality" "github.com/xtls/xray-core/common/crypto" @@ -31,7 +32,6 @@ import ( "github.com/xtls/xray-core/common/utils" "github.com/xtls/xray-core/core" "github.com/xtls/xray-core/transport/internet/tls" - "golang.org/x/crypto/hkdf" "golang.org/x/net/http2" ) @@ -114,8 +114,8 @@ func (c *UConn) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x50 if len(certs[0].Extensions) > 0 { h.Write(c.HandshakeState.Hello.Raw) h.Write(c.HandshakeState.ServerHello.Raw) - verify, _ := mldsa65.Scheme().UnmarshalBinaryPublicKey(c.Config.Mldsa65Verify) - if mldsa65.Verify(verify.(*mldsa65.PublicKey), h.Sum(nil), nil, certs[0].Extensions[0].Value) { + verify, _ := mldsa.NewPublicKey(mldsa.MLDSA65(), c.Config.Mldsa65Verify) + if mldsa.Verify(verify, h.Sum(nil), certs[0].Extensions[0].Value, nil) == nil { c.Verified = true return nil } @@ -176,7 +176,7 @@ func UClient(c net.Conn, config *Config, ctx context.Context, dest net.Destinati } publicKey, err := ecdh.X25519().NewPublicKey(config.PublicKey) if err != nil { - return nil, errors.New("REALITY: publicKey == nil") + return nil, errors.New("REALITY: nil publicKey").Base(err) } ecdhe := uConn.HandshakeState.State13.KeyShareKeys.Ecdhe if ecdhe == nil { @@ -185,12 +185,11 @@ func UClient(c net.Conn, config *Config, ctx context.Context, dest net.Destinati if ecdhe == nil { return nil, errors.New("Current fingerprint ", uConn.ClientHelloID.Client, uConn.ClientHelloID.Version, " does not support TLS 1.3, REALITY handshake cannot establish.") } - uConn.AuthKey, _ = ecdhe.ECDH(publicKey) - if uConn.AuthKey == nil { - return nil, errors.New("REALITY: SharedKey == nil") + if uConn.AuthKey, err = ecdhe.ECDH(publicKey); err != nil { + return nil, errors.New("REALITY: nil sharedKey").Base(err) } - if _, err := hkdf.New(sha256.New, uConn.AuthKey, hello.Random[:20], []byte("REALITY")).Read(uConn.AuthKey); err != nil { - return nil, err + if uConn.AuthKey, err = hkdf.Key(sha256.New, uConn.AuthKey, hello.Random[:20], "REALITY", 32); err != nil { + return nil, errors.New("REALITY: nil authKey").Base(err) } aead := crypto.NewAesGcm(uConn.AuthKey) if config.Show {