Reject IP literal server name with TLS spoof

nekohasekai · nekohasekai · commit a23c825f4579 · 2026-04-16T18:00:13.000+08:00
diff --git a/common/tls/client.go b/common/tls/client.go
@@ -30,7 +30,7 @@ func parseTLSSpoofOptions(serverName string, options option.OutboundTLSOptions)
 	if !tlsspoof.PlatformSupported {
 		return "", 0, E.New("`spoof` is not supported on this platform")
 	}
-	if options.DisableSNI || serverName == "" {
+	if options.DisableSNI || serverName == "" || M.ParseAddr(serverName).IsValid() {
 		return "", 0, E.New("`spoof` requires TLS ClientHello with SNI")
 	}
 	method, err := tlsspoof.ParseMethod(options.SpoofMethod)

Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ func parseTLSSpoofOptions(serverName string, options option.OutboundTLSOptions)`
`30`	`30`	`if !tlsspoof.PlatformSupported {`
`31`	`31`	return "", 0, E.New("`spoof` is not supported on this platform")
`32`	`32`	`}`
`33`		`- if options.DisableSNI \|\| serverName == "" {`
	`33`	`+ if options.DisableSNI \|\| serverName == "" \|\| M.ParseAddr(serverName).IsValid() {`
`34`	`34`	return "", 0, E.New("`spoof` requires TLS ClientHello with SNI")
`35`	`35`	`}`
`36`	`36`	`method, err := tlsspoof.ParseMethod(options.SpoofMethod)`