From 9b8190f52c970861c938dcd8c8c6eb696a77a900 Mon Sep 17 00:00:00 2001 From: AL <7344370+fwx@users.noreply.github.com> Date: Sat, 31 Oct 2026 09:31:30 +0100 Subject: [PATCH] QUIC sniffer: Don't accept ClientHello with gaps in CRYPTO data (#7292) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://github.com/XTLS/Xray-core/pull/7292#pullrequestreview-5712194488 --------- Co-authored-by: 风扇滑翔翼 --- common/protocol/tls/sniff.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/common/protocol/tls/sniff.go b/common/protocol/tls/sniff.go index 11660b92b..77c0abe2f 100644 --- a/common/protocol/tls/sniff.go +++ b/common/protocol/tls/sniff.go @@ -101,6 +101,10 @@ func ReadClientHello(data []byte, h *SniffHeader) error { return errNotClientHello } if nameType == 0 { + // RFC 6066 requires a non-empty HostName. + if nameLen == 0 { + return errNotClientHello + } // QUIC separated across packets // May cause the serverName to be incomplete b := byte(0)