xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-21 18:37:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sub): deliver vision flow for VLESS+XHTTP+REALITY in share links and Clash (#5232)

Browse Source 
The vlessenc fix (#5185) enabled flow on XHTTP only in the security=none
branch of genVlessLink, and the Clash builder still gated flow on
network==tcp. With XHTTP+REALITY+vlessenc the panel accepts and stores
the flow (inboundCanEnableTlsFlow passes), but subscriptions dropped it,
so clients received configs without xtls-rprx-vision.

Add vlessFlowAllowed mirroring inboundCanEnableTlsFlow — tcp with
tls/reality, or xhttp with vlessenc regardless of security layer — and
use it in both the vless:// link generator and the Clash proxy builder.
This commit is contained in:
MHSanaei
2026-06-12 22:20:37 +02:00
parent c200e248f7
commit 3c68b039f6
4 changed files with 181 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/service.go
+20 -11
View File
@@ -484,6 +484,23 @@ func vlessEncryptionEnabled(settings map[string]any) bool {
return false
}
// vlessFlowAllowed reports whether a client's XTLS Vision flow belongs in
// generated links/configs. Mirrors inboundCanEnableTlsFlow in
// internal/web/service: Vision runs on TCP with tls/reality (classic), and on
// XHTTP whenever VLESS encryption (vlessenc / ML-KEM) is enabled — there the
// VLESS-level encryption stands in for the transport TLS that Vision relies
// on, regardless of the stream security layer (so XHTTP+REALITY+vlessenc
// keeps its flow too).
func vlessFlowAllowed(network, security string, settings map[string]any) bool {
switch network {
case "tcp":
return security == "tls" || security == "reality"
case "xhttp":
return vlessEncryptionEnabled(settings)
}
return false
}
func (s *SubService) genVlessLink(inbound *model.Inbound, email string) string {
if inbound.Protocol != model.VLESS {
return ""
@@ -513,21 +530,13 @@ func (s *SubService) genVlessLink(inbound *model.Inbound, email string) string {
switch security {
case "tls":
applyShareTLSParams(stream, params)
if streamNetwork == "tcp" && len(clients[clientIndex].Flow) > 0 {
params["flow"] = clients[clientIndex].Flow
}
case "reality":
applyShareRealityParams(stream, params)
if streamNetwork == "tcp" && len(clients[clientIndex].Flow) > 0 {
params["flow"] = clients[clientIndex].Flow
}
default:
params["security"] = "none"
// VLESS encryption (vlessenc / ML-KEM) carries XTLS Vision over XHTTP
// without transport TLS.
if streamNetwork == "xhttp" && len(clients[clientIndex].Flow) > 0 && vlessEncryptionEnabled(settings) {
params["flow"] = clients[clientIndex].Flow
}
}
if len(clients[clientIndex].Flow) > 0 && vlessFlowAllowed(streamNetwork, security, settings) {
params["flow"] = clients[clientIndex].Flow
}
externalProxies, _ := stream["externalProxy"].([]any)