feat: QX/Shadowrocket 支持 SS+TLS; 内部字段 _qx_obfs_http 方便设置 QX 的几个特殊的 http obfs

Author: xream

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.21.89",
+  "version": "2.21.91",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "scripts": {

backend/src/core/proxy-utils/index.js

@@ -23,7 +23,7 @@ import { findByName } from '@/utils/database';
 import { produceArtifact } from '@/restful/sync';
 import { getFlag, removeFlag, getISO, MMDB } from '@/utils/geo';
 import Gist from '@/utils/gist';
-import { isPresent } from './producers/utils';
+import { isPresent, isShadowsocksOverTls } from './producers/utils';
 import { doh } from '@/utils/dns';
 import JSON5 from 'json5';
 import { hex_md5 } from '@/vendor/md5';
@@ -247,6 +247,13 @@ function produce(proxies, targetPlatform, type, opts = {}) {
         throw new Error(`Target platform: ${targetPlatform} is not supported!`);
     }
 
+    const normalizedTarget = String(targetPlatform).toLowerCase();
+    const supportedShadowsocksOverTlsTargets = new Set([
+        'qx',
+        'quantumultx',
+        'shadowrocket',
+    ]);
+
     const sni_off_supported = /Surge|SurgeMac|Shadowrocket/i.test(
         targetPlatform,
     );
@@ -258,6 +265,14 @@ function produce(proxies, targetPlatform, type, opts = {}) {
             return false;
         }
 
+        if (
+            isShadowsocksOverTls(proxy) &&
+            !supportedShadowsocksOverTlsTargets.has(normalizedTarget) &&
+            !opts['include-unsupported-proxy']
+        ) {
+            return false;
+        }
+
         // 对于 vless 和 vmess 代理,需要额外验证 UUID
         if (['vless', 'vmess'].includes(proxy.type)) {
             const isProxyUUIDValid = isValidUUID(proxy.uuid);

backend/src/core/proxy-utils/parsers/peggy/qx.js

@@ -20,6 +20,15 @@ const grammars = String.raw`
     const obfs = {};
     const $ = {};
 
+    function setQxHttpObfs(type) {
+        // Preserve the original QX http-obfs token for round-trip output,
+        // including the upstream "vemss-http" typo that appears in QX
+        // examples.
+        proxy._qx_obfs_http = type;
+        obfs.type = "http";
+        return type;
+    }
+
     function handleObfs() {
         if (obfs.type === "ws" || obfs.type === "wss") {
             proxy.network = "ws";
@@ -73,17 +82,20 @@ shadowsocks = "shadowsocks" equals address
                 $set(proxy, "plugin-opts.tls", true);
             }
         } else if (obfs.type === 'over-tls') {
-            throw new Error('ss over-tls is not supported');
+            proxy.tls = true;
+            if (obfs.host) {
+                proxy.sni = obfs.host;
+            }
         }
-        if (obfs.type) {
+        if (obfs.type && obfs.type !== 'over-tls') {
             $set(proxy, "plugin-opts.host", obfs.host);
             $set(proxy, "plugin-opts.path", obfs.path);
         }
     }
 }
 
 vmess = "vmess" equals address
-    (uuid/method/over_tls/tls_host/tls_pubkey_sha256/tls_alpn/tls_no_session_ticket/tls_no_session_reuse/tls_fingerprint/tls_verification/tag/obfs/obfs_host/obfs_uri/udp_relay/udp_over_tcp/fast_open/aead/server_check_url/reality_base64_pubkey/reality_hex_shortid/others)* {
+    (uuid/method/over_tls/tls_host/tls_pubkey_sha256/tls_alpn/tls_no_session_ticket/tls_no_session_reuse/tls_fingerprint/tls_verification/tag/obfs_vmess/obfs_host/obfs_uri/udp_relay/udp_over_tcp/fast_open/aead/server_check_url/reality_base64_pubkey/reality_hex_shortid/others)* {
     proxy.type = "vmess";
     proxy.cipher = proxy.cipher || "none";
     if (proxy.aead === false) {
@@ -95,7 +107,7 @@ vmess = "vmess" equals address
 }
 
 vless = "vless" equals address
-    (uuid/method/over_tls/tls_host/tls_pubkey_sha256/tls_alpn/tls_no_session_ticket/tls_no_session_reuse/tls_fingerprint/tls_verification/tag/obfs/obfs_host/obfs_uri/udp_relay/udp_over_tcp/fast_open/aead/server_check_url/reality_base64_pubkey/reality_hex_shortid/vless_flow/others)* {
+    (uuid/method/over_tls/tls_host/tls_pubkey_sha256/tls_alpn/tls_no_session_ticket/tls_no_session_reuse/tls_fingerprint/tls_verification/tag/obfs_vless/obfs_host/obfs_uri/udp_relay/udp_over_tcp/fast_open/aead/server_check_url/reality_base64_pubkey/reality_hex_shortid/vless_flow/others)* {
     proxy.type = "vless";
     proxy.cipher = proxy.cipher || "none";
     handleObfs();
@@ -176,9 +188,32 @@ tls_no_session_reuse = comma "tls-no-session-reuse" equals flag:bool {
     proxy["tls-no-session-reuse"] = flag;
 }
 
-obfs_ss = comma "obfs" equals type:("http"/"tls"/"wss"/"ws"/"over-tls") { obfs.type = type; return type; }
+obfs_ss = comma "obfs" equals (
+    type:("tls"/"wss"/"ws"/"over-tls") { obfs.type = type; return type; }
+  / type:("http"/"vmess-http"/"vemss-http"/"shadowsocks-http") {
+        // QX accepts multiple http-obfs spellings for ss/vmess/vless; keep
+        // the original token so QX output can round-trip it unchanged.
+        return setQxHttpObfs(type);
+    }
+)
 obfs_ssr = comma "obfs" equals type:("plain"/"http_simple"/"http_post"/"random_head"/"tls1.2_ticket_auth"/"tls1.2_ticket_fastauth") { proxy.type = "ssr"; obfs.type = type; return type; }
 obfs = comma "obfs" equals type:("wss"/"ws"/"over-tls"/"http") { obfs.type = type; return type; };
+obfs_vmess = comma "obfs" equals (
+    type:("wss"/"ws"/"over-tls") { obfs.type = type; return type; }
+  / type:("http"/"vmess-http"/"vemss-http"/"shadowsocks-http") {
+        // QX accepts multiple http-obfs spellings for ss/vmess/vless; keep
+        // the original token so QX output can round-trip it unchanged.
+        return setQxHttpObfs(type);
+    }
+);
+obfs_vless = comma "obfs" equals (
+    type:("wss"/"ws"/"over-tls") { obfs.type = type; return type; }
+  / type:("http"/"vmess-http"/"vemss-http"/"shadowsocks-http") {
+        // QX accepts multiple http-obfs spellings for ss/vmess/vless; keep
+        // the original token so QX output can round-trip it unchanged.
+        return setQxHttpObfs(type);
+    }
+);
 
 obfs_host = comma "obfs-host" equals match:[^,]+ { obfs.host = match.join("").replace(/^"(.*)"$/, '$1'); }
 obfs_uri = comma "obfs-uri" equals uri:uri { obfs.path = uri; }

backend/src/core/proxy-utils/producers/qx.js

@@ -1,4 +1,4 @@
-import { isPresent, Result } from './utils';
+import { isPresent, isShadowsocksOverTls, Result } from './utils';
 
 const targetPlatform = 'QX';
 
@@ -54,10 +54,24 @@ export default function QX_Producer() {
     };
 }
 
+function getQxHttpObfs(proxy) {
+    // QX accepts multiple http-obfs spellings for ss/vmess/vless. Preserve
+    // the original token for round-trip output, including "vemss-http".
+    return [
+        'http',
+        'vmess-http',
+        'vemss-http',
+        'shadowsocks-http',
+    ].includes(proxy._qx_obfs_http)
+        ? proxy._qx_obfs_http
+        : 'http';
+}
+
 function shadowsocks(proxy) {
     const result = new Result(proxy);
     const append = result.append.bind(result);
     const appendIfPresent = result.appendIfPresent.bind(result);
+    const isSSOverTls = isShadowsocksOverTls(proxy);
     if (!proxy.cipher) {
         proxy.cipher = 'none';
     }
@@ -98,10 +112,23 @@ function shadowsocks(proxy) {
     if (needTls(proxy)) {
         proxy.tls = true;
     }
-    if (isPresent(proxy, 'plugin')) {
+    if (isSSOverTls) {
+        append(`,obfs=over-tls`);
+        if (isPresent(proxy, 'sni')) {
+            append(`,obfs-host=${proxy.sni}`);
+        } else {
+            appendIfPresent(`,obfs-host=${proxy.servername}`, 'servername');
+        }
+    } else if (isPresent(proxy, 'plugin')) {
         if (proxy.plugin === 'obfs') {
             const opts = proxy['plugin-opts'];
-            append(`,obfs=${opts.mode}`);
+            if (opts.mode === 'http') {
+                // Keep the original QX http-obfs token instead of collapsing
+                // it back to plain "http".
+                append(`,obfs=${getQxHttpObfs(proxy)}`);
+            } else {
+                append(`,obfs=${opts.mode}`);
+            }
         } else if (
             proxy.plugin === 'v2ray-plugin' &&
             proxy['plugin-opts'].mode === 'websocket'
@@ -147,7 +174,9 @@ function shadowsocks(proxy) {
             `,tls-verification=${!proxy['skip-cert-verify']}`,
             'skip-cert-verify',
         );
-        appendIfPresent(`,tls-host=${proxy.sni}`, 'sni');
+        if (!isSSOverTls) {
+            appendIfPresent(`,tls-host=${proxy.sni}`, 'sni');
+        }
     }
 
     // tfo
@@ -325,7 +354,7 @@ function vmess(proxy) {
             if (proxy.tls) append(`,obfs=wss`);
             else append(`,obfs=ws`);
         } else if (proxy.network === 'http') {
-            append(`,obfs=http`);
+            append(`,obfs=${getQxHttpObfs(proxy)}`);
         } else if (['tcp'].includes(proxy.network)) {
             if (proxy.tls) append(`,obfs=over-tls`);
         } else if (!['tcp'].includes(proxy.network)) {
@@ -431,7 +460,7 @@ function vless(proxy) {
             if (proxy.tls) append(`,obfs=wss`);
             else append(`,obfs=ws`);
         } else if (proxy.network === 'http') {
-            append(`,obfs=http`);
+            append(`,obfs=${getQxHttpObfs(proxy)}`);
         } else if (['tcp'].includes(proxy.network)) {
             if (proxy.tls) append(`,obfs=over-tls`);
         } else if (!['tcp'].includes(proxy.network)) {

backend/src/core/proxy-utils/producers/shadowrocket.js

@@ -1,5 +1,6 @@
 import {
     isPresent,
+    isShadowsocksOverTls,
     produceProxyListOutput,
 } from '@/core/proxy-utils/producers/utils';
 import $ from '@/core/app';
@@ -156,6 +157,13 @@ export default function Shadowrocket_Producer() {
                         delete proxy['shadow-tls-sni'];
                         delete proxy['shadow-tls-version'];
                     }
+                    if (isShadowsocksOverTls(proxy)) {
+                        if (isPresent(proxy, 'sni')) {
+                            proxy.servername = proxy.sni;
+                            // 先不删 没有明确的规范
+                            // delete proxy.sni;
+                        }
+                    }
                 }
 
                 if (

backend/src/core/proxy-utils/producers/utils.js

@@ -30,6 +30,19 @@ export function isPresent(obj, attr) {
     return typeof data !== 'undefined' && data !== null;
 }
 
+export function isShadowsocksOverTls(proxy) {
+    const normalizedNetwork =
+        typeof proxy?.network === 'string'
+            ? proxy.network.trim().toLowerCase()
+            : proxy?.network;
+    return (
+        proxy?.type === 'ss' &&
+        proxy?.tls === true &&
+        !isPresent(proxy, 'plugin') &&
+        (!isPresent(proxy, 'network') || normalizedNetwork === 'tcp')
+    );
+}
+
 export function normalizePluginMuxValue(mux) {
     if (typeof mux === 'boolean') return Number(mux);
     if (typeof mux === 'string') {