amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 13:52:15 +00:00

[PR #3169] fix(android): preserve Xray TLS and HTTP host identit #3114

New issue

Open

opened 2026-10-14 21:07:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:07:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/3169
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: dev ← Head: fix/android-xray-endpoint-rewrite

📝 Commits (3)

eda1372 fix(android): isolate Xray endpoint address rewrite
8f7f175 fix(android): preserve Xray TLS and HTTP host identity
ccab29f test(android): cover Xray endpoint address rewrite

📊 Changes

4 files changed (+264 additions, -2 deletions)

View changed files

📝 client/android/xray/build.gradle.kts (+3 -0)
📝 client/android/xray/src/main/kotlin/Xray.kt (+2 -2)
➕ client/android/xray/src/main/kotlin/XrayRuntimeConfig.kt (+35 -0)
➕ client/android/xray/src/test/kotlin/XrayRuntimeConfigTest.kt (+224 -0)

📄 Description

Summary

Fix Android Xray pre-resolution so that resolving the transport endpoint does
not rewrite TLS/HTTP identity fields elsewhere in the native Xray JSON.

Current Android code serializes the whole Xray config and then performs a
global hostname-to-IP string replacement. For VLESS WS + TLS profiles where
the same domain is used as the endpoint, TLS SNI and WebSocket Host, that can
turn all three values into the resolved IP and cause CDN TLS handshakes to fail.

This change keeps pre-resolution, but applies the resolved address only to
structured Xray endpoint fields:

outbounds[*].settings.vnext[*].address
outbounds[*].settings.servers[*].address

TLS serverName, REALITY serverName, WebSocket Host, XHTTP host values and
unrelated JSON strings are left untouched.

Why this matches #3091

The workaround reported in #3091 uses a numeric IPv4 transport endpoint while
preserving the original domain in TLS SNI and WebSocket Host. That bypasses the
global replacement and restores traffic.

This patch preserves the same endpoint/identity separation automatically.

Scope

This PR fixes only the Android hostname-to-IP rewrite part of #3091.

It intentionally does not address the separate issues reported there around:

IPv4/IPv6 fallback
the Connected health state
raw native-config persistence
IPv6 route exclusion prefixes

The reporter has offered to retest on the same Android 16 device once a build
is available.

Related to #3091

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/3169 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `fix/android-xray-endpoint-rewrite` --- ### 📝 Commits (3) - [`eda1372`](https://github.com/amnezia-vpn/amnezia-client/commit/eda13726b1139a98dd5fbfd2715840fc750fd941) fix(android): isolate Xray endpoint address rewrite - [`8f7f175`](https://github.com/amnezia-vpn/amnezia-client/commit/8f7f175689a84320f1f49e389b4c736f9a5e027f) fix(android): preserve Xray TLS and HTTP host identity - [`ccab29f`](https://github.com/amnezia-vpn/amnezia-client/commit/ccab29fa52cdf5d08ea9690310e89b669584fbe4) test(android): cover Xray endpoint address rewrite ### 📊 Changes **4 files changed** (+264 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `client/android/xray/build.gradle.kts` (+3 -0) 📝 `client/android/xray/src/main/kotlin/Xray.kt` (+2 -2) ➕ `client/android/xray/src/main/kotlin/XrayRuntimeConfig.kt` (+35 -0) ➕ `client/android/xray/src/test/kotlin/XrayRuntimeConfigTest.kt` (+224 -0) </details> ### 📄 Description ## Summary Fix Android Xray pre-resolution so that resolving the transport endpoint does not rewrite TLS/HTTP identity fields elsewhere in the native Xray JSON. Current Android code serializes the whole Xray config and then performs a global hostname-to-IP string replacement. For VLESS WS + TLS profiles where the same domain is used as the endpoint, TLS SNI and WebSocket Host, that can turn all three values into the resolved IP and cause CDN TLS handshakes to fail. This change keeps pre-resolution, but applies the resolved address only to structured Xray endpoint fields: - `outbounds[*].settings.vnext[*].address` - `outbounds[*].settings.servers[*].address` TLS `serverName`, REALITY `serverName`, WebSocket `Host`, XHTTP host values and unrelated JSON strings are left untouched. ## Why this matches #3091 The workaround reported in #3091 uses a numeric IPv4 transport endpoint while preserving the original domain in TLS SNI and WebSocket Host. That bypasses the global replacement and restores traffic. This patch preserves the same endpoint/identity separation automatically. ## Scope This PR fixes only the Android hostname-to-IP rewrite part of #3091. It intentionally does not address the separate issues reported there around: - IPv4/IPv6 fallback - the `Connected` health state - raw native-config persistence - IPv6 route exclusion prefixes The reporter has offered to retest on the same Android 16 device once a build is available. Related to #3091 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-14 21:07:35 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#3114

No description provided.

Rows
Columns