Implement forced TLS fingerprinting for specific VPN protocols

- Added functionality to enforce a default TLS fingerprint ("firefox") for vless, trojan, and vmess protocols when not explicitly set in the stream settings. - Introduced methods to modify the connection string to include the fingerprint for TLS/reality links, ensuring compatibility with existing configurations. - Updated documentation to reflect the new behavior regarding TLS fingerprint handling in the architecture overview.
2026-07-18 23:02:14 +03:00
parent 3304eed4b3
commit c196e0c322
2 changed files with 73 additions and 1 deletions
@@ -1,5 +1,7 @@
 using System.Collections.Concurrent;
+using System.Text;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 using Microsoft.Extensions.Logging;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Models;
@@ -221,7 +223,9 @@ internal sealed class XuiPanelGateway(
                remoteInbound
            );

-            return Result.Success(builder.Build(request));
+            return Result.Success(
+                ForceFingerprint(builder.Build(request), inbound.Protocol, ForcedFingerprint)
+            );
        }
        catch (Exception ex)
        {
@@ -234,6 +238,70 @@ internal sealed class XuiPanelGateway(
        }
    }

+    /// <summary>
+    /// Клиентские приложения выдают TLS-fingerprint панели, если fp не задан явно в
+    /// share-ссылке — подставляем "firefox" поверх того, что вернул ThreeXui.Net
+    /// (сам параметр берётся из streamSettings ноды, per-nod настройки не даём).
+    /// Применимо только к tls/reality-ссылкам (vless/trojan/vmess); shadowsocks TLS
+    /// не использует.
+    /// </summary>
+    private const string ForcedFingerprint = "firefox";
+
+    private static string ForceFingerprint(string link, VpnProtocol protocol, string fingerprint) =>
+        protocol switch
+        {
+            VpnProtocol.Vless or VpnProtocol.Trojan => ForceQueryFingerprint(link, fingerprint),
+            VpnProtocol.Vmess => ForceVmessFingerprint(link, fingerprint),
+            _ => link,
+        };
+
+    private static string ForceQueryFingerprint(string link, string fingerprint)
+    {
+        var hashIndex = link.IndexOf('#');
+        var head = hashIndex >= 0 ? link[..hashIndex] : link;
+        var fragment = hashIndex >= 0 ? link[hashIndex..] : string.Empty;
+
+        var queryIndex = head.IndexOf('?');
+        if (queryIndex < 0)
+            return link;
+
+        var baseUri = head[..queryIndex];
+        var query = head[(queryIndex + 1)..];
+        if (!query.Contains("security=tls") && !query.Contains("security=reality"))
+            return link;
+
+        var parts = query
+            .Split('&', StringSplitOptions.RemoveEmptyEntries)
+            .Where(p => !p.StartsWith("fp=", StringComparison.Ordinal))
+            .Append($"fp={fingerprint}");
+
+        return $"{baseUri}?{string.Join('&', parts)}{fragment}";
+    }
+
+    private static string ForceVmessFingerprint(string link, string fingerprint)
+    {
+        const string prefix = "vmess://";
+        if (!link.StartsWith(prefix, StringComparison.Ordinal))
+            return link;
+
+        try
+        {
+            var json = Encoding.UTF8.GetString(Convert.FromBase64String(link[prefix.Length..]));
+            var node = JsonNode.Parse(json)?.AsObject();
+            if (node is null || string.IsNullOrEmpty(node["tls"]?.GetValue<string>()))
+                return link;
+
+            node["fp"] = fingerprint;
+            var updatedJson = node.ToJsonString();
+            return prefix + Convert.ToBase64String(Encoding.UTF8.GetBytes(updatedJson));
+        }
+        catch (Exception)
+        {
+            // Неожиданный формат vmess-пейлоада — возвращаем ссылку как есть.
+            return link;
+        }
+    }
+
    public async Task<Result<IReadOnlyDictionary<string, ClientTrafficInfo>>> GetClientTrafficAsync(
        Node node,
        string inboundRemoteId,