Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

旧的加密方法存在篡改客户端数据的漏洞,希望支持2022-blake3-aes-128-gcm、2022-blake3-aes-256-gcm、2022-blake3-chacha20-poly1305 #1229

Closed
xcanwin opened this issue Jun 26, 2023 · 0 comments
Labels
bug Something isn't working
Milestone

Comments

@xcanwin
Copy link

xcanwin commented Jun 26, 2023

提交 Issue 之前请先在issue上搜索是否有相似问题, 看看能不能解决问题 (有太多相同的issue,没精力处理)。
除非特殊情况,请完整填写以下所有问题,不按模板发的 issue 将直接被关闭。

  1. 我正在使用的 V2RayU 和 Mac 版本 ?
    最新版。

  2. 我遇到的问题是什么?
    Shadowsocks AEAD 加密方式设计存在严重漏洞,无法保证通信内容的可靠性:Shadowsocks AEAD 加密方式设计存在严重漏洞,无法保证通信内容的可靠性 shadowsocks/shadowsocks-org#183
    这些漏洞会导致V2rayU客户端解析被篡改的数据

  3. 我的建议:
    xray-core作者已在1.5.6支持了2022-blake3-aes-128-gcm、2022-blake3-aes-256-gcm、2022-blake3-chacha20-poly1305:https://github.com/XTLS/Xray-core/releases/tag/v1.5.6
    我看到V2rayU内置的xray-core版本是1.5.9,其实已经支持了这三种新加密。
    所以我建议在https://github.com/yanue/V2rayU/blob/master/V2rayU/v2ray/v2rayOutbound.swift的V2rayOutboundShadowsockMethod里追加三种新加密方法。

@xcanwin xcanwin added the bug Something isn't working label Jun 26, 2023
@yanue yanue added this to the 4.0.0 milestone Sep 11, 2023
@yanue yanue closed this as completed Sep 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants