TLS无法配置成功 - Githubissues

Jabberworkkkk commented 6 years ago

中文：提交 Issue 之前请先阅读 Issue 指引，然后回答下面的问题，谢谢。除非特殊情况，请完整填写所有问题。不按模板发的 issue 将直接被关闭。

1) 你正在使用哪个版本的 V2Ray？（如果服务器和客户端使用了不同版本，请注明） 3.30 2) 你的使用场景是什么？比如使用 Chrome 通过 Socks/VMess 代理观看 YouTube 视频。

3) 你看到的不正常的现象是什么？（请描述具体现象，比如访问超时，TLS 证书错误等） 1、已经拥有域名并可以正常解析 2、已经通过 acme.sh 申请了该域名的ECC版证书 3、使用教程推荐的命令安装证书至V2RAY目录： $ sudo ~/.acme.sh/acme.sh --installcert -d mydomain.me --fullchainpath /etc/v2ray/v2ray.crt --keypath /etc/v2ray/v2ray.key --ecc 确认v2ray目录下有上述证书文件 4、按照官方及白话文教程里的方法修改了配置，修改后能正常启动v2ray服务，error.log没有异常记录 5、客户端（使用V2rayN GUI）如果选择不启用TLS，可以正常连接服务器端并代理流量（如看youtube），如果选择启用TLS，则无法正常代理，网页显示超时 6、LOG开DEBUG，客户端如果用TLS连接，会记录类似这样的条目：2018/07/19 09:21:21 [Info] [2811233533] App|Proxyman|Inbound: connection ends > Proxy|VMess|Inbound: invalid request from x.x.x.x:8444 > Proxy|VMess|Encoding: invalid user 7、使用白话文教程中推荐的SSL LAB测试SSL的结果： Assessment failed: No secure protocols supported 8、配置使用另一个代理软件GOST使用相同的证书，则 SSL LAB测试是能正常通过的，评级为B，并且GOST的HTTPS代理也能正常使用，证明证书是没有问题的

4) 你期待看到的正确表现是怎样的？能成功使用TLS

5) 请附上你的配置（提交 Issue 前请隐藏服务器端IP地址）。

服务器端配置:

    {
  "log" : {
    "access": "",
    "error": "/var/log/v2ray/error.log",
    "loglevel": "warning"
  },
  "inbound": {
    "port": 443,
    "protocol": "vmess",
    "settings": {
      "clients": [
        {
          "id": "",
          "level": 1,
          "alterId": 32,
          "email": "t@t.tt"
        }
      ],
      "detour": {         
        "to": "inboundRandomPort"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "tlsSettings": {
          "serverName": "",
          "certificates": [
            {
              "certificateFile": "/etc/v2ray/v2ray.crt",
              "keyFile": "/etc/v2ray/v2ray.key"
            }
          ]
        }
      },
      "disableInsecureEncryption": true
    }
  },
  "inboundDetour": [
    {
    "protocol": "vmess",
    "port": "10001-11000", 
    "tag": "inboundRandomPort",       
    "settings": {
      "default": {
        "level": 1,
        "alterId": 32
      }
    },
    "streamSettings": {
      "network": "tcp",
      "security": "tls",
      "tlsSettings": {
        "serverName": "",
        "certificates": [
          {
            "certificateFile": "/etc/v2ray/v2ray.crt",
            "keyFile": "/etc/v2ray/v2ray.key"
          }
        ]
      }
    },

    "allocate": {            
      "strategy": "random",  
      "concurrency": 3,      
      "refresh": 5           
    }
  }
  ],
  "outbound": {
    "protocol": "freedom",
    "settings": {}
  },
  "outboundDetour": [
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ],
  "routing": {
    "strategy": "rules",
    "settings": {
      "rules": [
        {
          "type": "field",
          "ip": [
            "0.0.0.0/8",
            "10.0.0.0/8",
            "100.64.0.0/10",
            "127.0.0.0/8",
            "169.254.0.0/16",
            "172.16.0.0/12",
            "192.0.0.0/24",
            "192.0.2.0/24",
            "192.168.0.0/16",
            "198.18.0.0/15",
            "198.51.100.0/24",
            "203.0.113.0/24",
            "::1/128",
            "fc00::/7",
            "fe80::/10"
          ],
          "outboundTag": "blocked"
        }
      ]
    }
  }
}

客户端配置:

    {
  "log": {
    "access": "",
    "error": "",
    "loglevel": "warning"
  },
  "inbound": {
    "port": 1081,
    "listen": "127.0.0.1",
    "protocol": "socks",
    "settings": {
      "auth": "noauth",
      "udp": true,
      "ip": "127.0.0.1",
      "clients": null
    },
    "streamSettings": null
  },
  "outbound": {
    "tag": "agentout",
    "protocol": "vmess",
    "settings": {
      "vnext": [
        {
          "address": "",
          "port": 443,
          "users": [
            {
              "id": "",
              "alterId": 32,
              "email": "t@t.tt",
              "security": "aes-128-gcm"
            }
          ]
        }
      ],
      "servers": null
    },
    "streamSettings": {
      "network": "tcp",
      "security": "",
      "tlsSettings": null,
      "tcpSettings": null,
      "kcpSettings": null,
      "wsSettings": null,
      "httpSettings": null
    },
    "mux": {
      "enabled": true
    }
  },
  "inboundDetour": null,
  "outboundDetour": [
    {
      "protocol": "freedom",
      "settings": {
        "response": null
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      },
      "tag": "blockout"
    }
  ],
  "dns": {
    "servers": [
      "8.8.8.8",
      "8.8.4.4",
      "localhost"
    ]
  },
  "routing": {
    "strategy": "rules",
    "settings": {
      "domainStrategy": "IPIfNonMatch",
      "rules": [
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": null,
          "domain": [
            "geosite:cn"
          ]
        },
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": [
            "geoip:cn"
          ],
          "domain": null
        },
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": [
            "0.0.0.0/8",
            "10.0.0.0/8",
            "100.64.0.0/10",
            "127.0.0.0/8",
            "169.254.0.0/16",
            "172.16.0.0/12",
            "192.0.0.0/24",
            "192.0.2.0/24",
            "192.168.0.0/16",
            "198.18.0.0/15",
            "198.51.100.0/24",
            "203.0.113.0/24",
            "::1/128",
            "fc00::/7",
            "fe80::/10"
          ],
          "domain": null
        }
      ]
    }
  }
}

6) 请附上出错时软件输出的错误日志。在 Linux 中，日志通常在 /var/log/v2ray/error.log 文件中。

服务器端错误日志:

 2018/07/19 15:22:03 [Warning] Core: V2Ray v3.30 started
2018/07/19 15:38:13 [Warning] Core: V2Ray v3.30 started
2018/07/19 15:48:56 [Warning] Core: V2Ray v3.30 started

客户端错误日志:

    // 在这里附上客户端日志

7) 请附上访问日志。在 Linux 中，日志通常在 /var/log/v2ray/access.log 文件中。

未打开

8) 其它相关的配置文件（如 Nginx）和相关日志。

9) 如果 V2Ray 无法启动，请附上 --test 输出。

通常的命令为 /usr/bin/v2ray/v2ray --test --config /etc/v2ray/config.json。请按实际情况修改。

10) 如果 V2Ray 服务运行不正常，请附上 journal 日志。

通常的命令为 journalctl -u v2ray。

请预览一下你填的内容再提交。

VictoriaRaymond commented 6 years ago

你的客户端没有开启TLS

Jabberworkkkk commented 6 years ago

作者你好，这个客户端配置是我关闭客户端TLS时的配置，如果打开是这样：

{
  "log": {
    "access": "",
    "error": "",
    "loglevel": "warning"
  },
  "inbound": {
    "port": 1081,
    "listen": "127.0.0.1",
    "protocol": "socks",
    "settings": {
      "auth": "noauth",
      "udp": true,
      "ip": "127.0.0.1",
      "clients": null
    },
    "streamSettings": null
  },
  "outbound": {
    "tag": "agentout",
    "protocol": "vmess",
    "settings": {
      "vnext": [
        {
          "address": "",
          "port": 443,
          "users": [
            {
              "id": "",
              "alterId": 32,
              "email": "t@t.tt",
              "security": "aes-128-gcm"
            }
          ]
        }
      ],
      "servers": null
    },
    "streamSettings": {
      "network": "tcp",
      "security": "tls",
      "tlsSettings": null,
      "tcpSettings": null,
      "kcpSettings": null,
      "wsSettings": null,
      "httpSettings": null
    },
    "mux": {
      "enabled": true
    }
  },
  "inboundDetour": null,
  "outboundDetour": [
    {
      "protocol": "freedom",
      "settings": {
        "response": null
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      },
      "tag": "blockout"
    }
  ],
  "dns": {
    "servers": [
      "8.8.8.8",
      "8.8.4.4",
      "localhost"
    ]
  },
  "routing": {
    "strategy": "rules",
    "settings": {
      "domainStrategy": "IPIfNonMatch",
      "rules": [
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": null,
          "domain": [
            "geosite:cn"
          ]
        },
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": [
            "geoip:cn"
          ],
          "domain": null
        },
        {
          "type": "field",
          "port": null,
          "outboundTag": "direct",
          "ip": [
            "0.0.0.0/8",
            "10.0.0.0/8",
            "100.64.0.0/10",
            "127.0.0.0/8",
            "169.254.0.0/16",
            "172.16.0.0/12",
            "192.0.0.0/24",
            "192.0.2.0/24",
            "192.168.0.0/16",
            "198.18.0.0/15",
            "198.51.100.0/24",
            "203.0.113.0/24",
            "::1/128",
            "fc00::/7",
            "fe80::/10"
          ],
          "domain": null
        }
      ]
    }
  }
}

VictoriaRaymond commented 6 years ago

如果你在outbound里填的是IP的话，tlsSettings里要填域名。如果你用的反代的话，请贴出反代的配置。

Jabberworkkkk commented 6 years ago

是指客户端 outbound 的 address 参数吗？那里我填的是我的域名的在没配置TLS之前就已经申请好域名了，所以一开始就在address 部分填了域名并确认能通过域名访问的

VictoriaRaymond commented 6 years ago

你把loglevel设为info，如果log里没有tls报错的话，那就是系统时间不匹配。

Jabberworkkkk commented 6 years ago

设置loglevel为info后两个log的内容： access log

2018/07/19 19:05:42 x.x.x.x:36256 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:05:43 x.x.x.x:5442 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:05:46 x.x.x.x:36259 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:05:47 x.x.x.x:36260 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:05:51 x.x.x.x:36261 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:05:59 x.x.x.x:5466 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:06:03 x.x.x.x:36283 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:06:14 x.x.x.x:5494 rejected Proxy|VMess|Encoding: invalid user 2018/07/19 19:06:15 tcp:y.y.y.y:5386 accepted udp:8.8.8.8:53 2018/07/19 19:06:15 tcp:y.y.y.y:5386 accepted tcp:mtalk.google.com:443

error log

其中 x.x.x.x 是配置使用TLS的客户端，y.y.y.y是另一个没有配置使用TLS的客户端从两个log里好像看不出TLS错误

系统时间仔细看过应该没问题，时区是CST VPS使用的是GOOGLE CLOUD PLATFORM，系统是 Ubuntu 16.04.4 LTS 没有安装NGINX，CADDY，单纯使用v2ray客户端与服务器端直连

DarienRaymond commented 6 years ago

哦，你的streamSettings的位置写错了...........

Jabberworkkkk commented 6 years ago

（掩面）我对streamsettings的位置想当然了，抱歉抱歉。

修改配置后TLS正常了，谢谢作者耐心解答！

v2ray / v2ray-core

TLS无法配置成功 #1201