fix: preserve VLESS ML-KEM encryption and improve Clash/mihomo compatibility - #410
Open
yingxiaomo wants to merge 2 commits into
Open
fix: preserve VLESS ML-KEM encryption and improve Clash/mihomo compatibility#410yingxiaomo wants to merge 2 commits into
yingxiaomo wants to merge 2 commits into
Conversation
- Keep encryption/xhttp-opts/mode/fp for VLESS share-link conversion - Parse insecure=0 correctly with parseBool - Do not default TUIC skip-cert-verify to true
Only Clash/mihomo export is forced to skip-cert-verify: true so share nodes that claim insecure=0 still work under strict clients. Parsers still preserve the original insecure flag for other targets.
|
@yingxiaomo is attempting to deploy a commit to the 7sageer's projects Team on Vercel. A member of the Team first needs to authorize it. |
yingxiaomo
force-pushed
the
fix/vless-mlkem-xhttp-and-clash-skip-cert
branch
from
July 18, 2026 19:56
4c2208a to
9d936bb
Compare
|
赞一个 我也发现了一样的问题 转换后丢失了信息 但是导出clash完全跳过证书验证是否不妥 不够安全 一个带证书正常的域名节点应该是可以正常证书校验的 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
encryption(e.g.mlkem768x25519plus...) andxhttp-opts(path/mode/host) when converting share links to Clash/mihomo.client-fingerprint(fp) for VLESS/VMess/Trojan Clash export.insecure=0/1correctly withparseBoolinstead of truthy string checks.skip-cert-verify: trueso nodes that advertiseinsecure=0but fail strict certificate verification still work (common with public share links). Parsers still preserve the original flag for other targets.Motivation
encryption/ incompletexhttpoptions in Clash output, so mihomo could not use them.!!params.insecuretreated"0"astrue, flippingskip-cert-verifyincorrectly.insecure=0parsing, many real TUIC/Hysteria2 share nodes fail under mihomo's strict TLS verification while working in V2RayN; Clash export now prefers usability for multi-subscription conversion.Test plan
npx vitest run— 31 files / 215 tests passedtest/issue-vless-mlkem-xhttp.test.js)skip-cert-verify: truefor TUIC/Hy2 even when link hasinsecure=0Notes