[Bug] VLESS + XHTTP connection drops after a few seconds (regression since 1.1.3, works in 1.1.2)

[ttrroyy]

Operating system

Windows

System version

11

Installation type

exe

Version

1.1.3-1.1.6

Description

VLESS with XHTTP transport connects successfully but drops after a few seconds (usually 5-30s).
The issue started in version 1.1.3 and is present in 1.1.3–1.1.6. It works stably in 1.1.2.

Reproduction

Use Throne 1.1.3 or newer.
Create/import a VLESS + XHTTP profile.
Connect to the profile.
Connection drops after a short time.

Logs

[Mahdi-zarei]

you need to provide more information (debug logs etc)

[ttrroyy]

The problem turned out to be a little different: xhttp breaks if you connect and run a ping test after connecting to the server via tun

[Mahdi-zarei]

unless you provide more information, i cannot do anything about this issue.

[ttrroyy]

What do you need to diagnose the problem and how can I get it?

[Mahdi-zarei]

Debug level logs of when the connection actually drops, so that i can see why.

[abbasnaqdi]

+‍‍1
Some configurations work perfectly fine in the Karing client (1.2.20.2303), but they fail in Throne (1.1.6), dropping the connection and causing instability (with equal settings).

[Mahdi-zarei]

Can you provide one such config please?

[abbasnaqdi]

The configurations I use are on a personal server and are confidential, but I'll share a similar free configuration here if I find one.

But for me:
The Karing client is fast and stable on both Samantel and Irancell. The Throne client with the same config works fine on Samantel, but on Irancell the connection drops after a while.

Both clients use remote DNS (https://94.140.14.14/dns-query), both are on TUN mode, and IPv6 is disabled on both.

[Mahdi-zarei]

The Karing client is fast and stable on both Samantel and Irancell. The Throne client with the same config works fine on Samantel, but on Irancell the connection drops after a while.

This changes things significantly, can you take a look at The configs generated by each app and see if Throne is missing an important piece of config?

[abbasnaqdi]

@Mahdi-zarei Im not sure what you mean or exactly where I should check. But if you're suggesting that Throne might be dropping or silently stripping parts of the raw config data for VLESS+REALITY or VLESS+REALITY+XHTTP configs.

I compared one of the imported configs across both clients. Both clients respond to ping and the test URL works correctly in each. There is one field present in Karing that I couldn't find in Throne: "packet_encoding": "xudp", not sure if that's relevant.

The config type is VLESS+REALITY+HTTP, and it's stored in Throne under the type VLESS(Xray).

Karing Config (Example):

{
  "server": "SERVER",
  "server_port": 443,
  "tag": "xray-xhttp-confluence",
  "type": "vless",
  "attach": "",
  "uuid": "a0574e90-181c-451a-9496-dc0658a47ddf",
  "packet_encoding": "xudp",
  "tls": {
    "enabled": true,
    "server_name": "confluence.com",
    "utls": {
      "enabled": true,
      "fingerprint": "chrome"
    },
    "reality": {
      "enabled": true,
      "public_key": "RmYXVdFHifGLi_k060ud6wU_Of5qrQyFWUzds0GSnno",
      "short_id": "91baee1c8b618fcc"
    }
  },
  "transport": {
    "type": "xhttp",
    "mode": "auto",
    "path": "/dac707d589cc"
  },
  "groupid": "617fd10d-b37c-4497-9117-04633495d1db",
  "latency": "123",
  "outlet_ip": "",
  "outlet_region": ""
}

[Mahdi-zarei]

Oh, they seem to be using a customized sing-box core to support XHTTP, that makes things a bit hard to diagnose, but let me see what i can do...

[abbasnaqdi]

To be sure, I tested the same config in v2rayN desktop as well, and it behaves the same as Throne.
What's strange is that it's the exact same config, same settings, same DNS, yet in Karing it's extremely fast and stable, while in v2rayN and Throne it's unreliable and sometimes doesn't work at all.

I also noticed that in Karing, configs are stable across MCI, Irancell, and Samantel networks, but in Throne, configs on MCI fail completely.

[abbasnaqdi]

@Mahdi-zarei This issue I observed isn't limited to XHTTP. I noticed the same behavior with AnyTLS and VLESS+REALITY raw configs as well.

[Mahdi-zarei]

Seems like a Xray issue. We use Xray for XHTTP, while caring uses its own custom implementation of XHTTP in sing-box. My first shot is to upgrade Xray core and see if it is resolved at the upstream. I feel like karing is deploying a custom layer of obfuscation (like fragment maybe?) on top of TLS configs which makes them bypass the censorship, while other cores do not do it by default.
If you could find out what exactly it is doing to make them more resilient to detection, that would be really helpful.

[Mahdi-zarei]

@abbasnaqdi Can we followup this issue in telegram? If you got time, there are things we could check that would make things much clearer.