app/v2.5.2

HyNetworks/hysteriaapp/v2.5.2Oct 6, 2024by github-actions[bot]

AI Summary

Improves security by adding SNI matching validation by default and fixes issues with QUIC packet sniffing.

Key Highlights

Server now terminates TLS handshake if client SNI does not match certificate
Added `sniGuard` option in `tls` section to control SNI matching behavior
Fixed issue where sniffing could not recognize fragmented QUIC packets

Breaking Changes

Default behavior changed to terminate TLS handshake on SNI mismatch

New Features

SNI guard option
Fixed fragmented QUIC sniffing

Full Release Notes

- By default, the server now terminates the TLS handshake if the SNI sent by a client does not match the certificate. A new `sniGuard` option has been added to the `tls` section to control this behavior
- Fixed the issue where sniffing could not recognize fragmented QUIC packets
- Updated quic-go to v0.47.0

---

- 服务端现在默认会在客户端发送的 SNI 与证书不匹配时终止 TLS 握手，并在 `tls` 中新增了 `sniGuard` 选项用于控制此行为
- 修复了 sniff 无法嗅探分片后的 QUIC 包的问题
- quic-go 更新到 v0.47.0