From 7a5721c50d43d06d0c02f5bbd9715f8f2fd39eb8 Mon Sep 17 00:00:00 2001 From: Fangliding Date: Tue, 8 Sep 2026 23:47:02 +0800 Subject: [PATCH 1/2] Write encryption back to json struct to for validateOutboundTransportSecurity --- infra/conf/vless.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/conf/vless.go b/infra/conf/vless.go index 1c8ababfdb43..8c72c730c063 100644 --- a/infra/conf/vless.go +++ b/infra/conf/vless.go @@ -312,6 +312,8 @@ func (c *VLessOutboundConfig) Build() (proto.Message, error) { if err := json.Unmarshal(rawUser, account); err != nil { return nil, errors.New(`VLESS users: invalid user`).Base(err) } + // validateOutboundTransportSecurity needs to see this + c.Encryption = account.Encryption if account.Reverse != nil { // may not be reached: error json unmarshal return nil, errors.New(`VLESS users: please use simplified outbound's config style to use "reverse"`) } From df3ad31033b6f992c67a9179363be5f45cd0e2de Mon Sep 17 00:00:00 2001 From: Fangliding Date: Wed, 9 Sep 2026 00:25:55 +0800 Subject: [PATCH 2/2] beauty --- infra/conf/vless.go | 3 ++- infra/conf/xray.go | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/infra/conf/vless.go b/infra/conf/vless.go index 8c72c730c063..1e435d90095d 100644 --- a/infra/conf/vless.go +++ b/infra/conf/vless.go @@ -312,8 +312,9 @@ func (c *VLessOutboundConfig) Build() (proto.Message, error) { if err := json.Unmarshal(rawUser, account); err != nil { return nil, errors.New(`VLESS users: invalid user`).Base(err) } - // validateOutboundTransportSecurity needs to see this + // validateOutboundTransportSecurity needs to see these c.Encryption = account.Encryption + c.Address = rec.Address if account.Reverse != nil { // may not be reached: error json unmarshal return nil, errors.New(`VLESS users: please use simplified outbound's config style to use "reverse"`) } diff --git a/infra/conf/xray.go b/infra/conf/xray.go index 0643a54f002a..be37cffe755a 100644 --- a/infra/conf/xray.go +++ b/infra/conf/xray.go @@ -242,7 +242,7 @@ func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *pr if vlessCfg.Encryption != "" && vlessCfg.Encryption != "none" { return nil } - if requiresTransportSecurity(vlessCfg.Vnext[0].Address) { + if requiresTransportSecurity(vlessCfg.Address) { return errors.New("vless without TLS or other encryption is prohibited unless the server address is a private IP or domain") } }