Pinning ca must have serverName

https://github.com/XTLS/Xray-core/discussions/6385#discussioncomment-17454120

https://github.com/XTLS/Xray-core/pull/6307#issuecomment-4917498294

Closes https://github.com/XTLS/Xray-core/issues/6410

transport/internet/grpc/dial.go

@@ -136,10 +136,7 @@ func getGrpcClient(ctx context.Context, dest net.Destination, streamSettings *in
 				}
 
 				if tlsConfig != nil {
-					config := tlsConfig.GetTLSConfig()
-					if config.ServerName == "" && address.Family().IsDomain() {
-						config.ServerName = address.Domain()
-					}
+					config := tlsConfig.GetTLSConfig(tls.WithDestination(dest))
 					if fingerprint := tls.GetFingerprint(tlsConfig.Fingerprint); fingerprint != nil {
 						return tls.UClient(c, config, fingerprint), nil
 					} else { // Fallback to normal gRPC TLS

transport/internet/hysteria/dialer.go

@@ -345,7 +345,7 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 			c = &client{
 				dest:           dest,
 				config:         streamSettings.ProtocolSettings.(*Config),
-				tlsConfig:      tlsConfig.GetTLSConfig(),
+				tlsConfig:      tlsConfig.GetTLSConfig(tls.WithDestination(dest)),
 				socketConfig:   streamSettings.SocketSettings,
 				udpmaskManager: streamSettings.UdpmaskManager,
 				quicParams:     streamSettings.QuicParams,

transport/internet/splithttp/config.go

@@ -24,8 +24,11 @@ func (c *Config) GetNormalizedPath() string {
 		path = "/" + path
 	}
 
-	if path[len(path)-1] != '/' {
-		path = path + "/"
+	if c.GetNormalizedSessionPlacement() == PlacementPath ||
+		c.GetNormalizedSeqPlacement() == PlacementPath {
+		if path[len(path)-1] != '/' {
+			path = path + "/"
+		}
 	}
 
 	return path

transport/internet/splithttp/config_test.go

@@ -3,16 +3,77 @@ package splithttp_test
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	. "github.com/xtls/xray-core/transport/internet/splithttp"
 )
 
 func Test_GetNormalizedPath(t *testing.T) {
-	c := Config{
-		Path: "/?world",
+	tests := []struct {
+		TestName           string
+		Path               string
+		SessionIDPlacement string
+		SeqPlacement       string
+		Expected           string
+	}{
+		{
+			TestName: "default placement keeps trailing slash",
+			Path:     "/sh",
+			Expected: "/sh/",
+		},
+		{
+			TestName: "query string is stripped",
+			Path:     "/?world",
+			Expected: "/",
+		},
+		{
+			TestName:           "both off path drops trailing slash",
+			Path:               "/stream",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/stream",
+		},
+		{
+			TestName:           "both off path keeps file-like path",
+			Path:               "/stream/filename.extension",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "header",
+			Expected:           "/stream/filename.extension",
+		},
+		{
+			TestName:           "seq in path keeps trailing slash",
+			Path:               "/stream",
+			SessionIDPlacement: "query",
+			Expected:           "/stream/",
+		},
+		{
+			TestName:     "session in path keeps trailing slash",
+			Path:         "/stream",
+			SeqPlacement: "cookie",
+			Expected:     "/stream/",
+		},
+		{
+			TestName:           "existing trailing slash preserved",
+			Path:               "/stream/",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/stream/",
+		},
+		{
+			TestName:           "root unchanged",
+			Path:               "/",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/",
+		},
 	}
-
-	path := c.GetNormalizedPath()
-	if path != "/" {
-		t.Error("Unexpected: ", path)
+	for _, test := range tests {
+		t.Run(test.TestName, func(t *testing.T) {
+			c := Config{
+				Path:               test.Path,
+				SessionIDPlacement: test.SessionIDPlacement,
+				SeqPlacement:       test.SeqPlacement,
+			}
+			assert.Equal(t, test.Expected, c.GetNormalizedPath())
+		})
 	}
 }

transport/internet/tls/config.go

@@ -331,6 +331,9 @@ func (r *RandCarrier) verifyPeerCert(rawCerts [][]byte, verifiedChains [][]*x509
 	}
 
 	if verifyResult == foundCA { // if found CA, we need to verify here
+		if len(r.Config.ServerName) == 0 {
+			return errors.New("Pinning CA needs a valid ServerName")
+		}
 		opts := x509.VerifyOptions{
 			Roots:         CAs,
 			CurrentTime:   time.Now(),