Hysteria 2 Chrome parrot does not work with disable_sni and mutual TLS

Operating system

Windows

System version

11

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-beta.14

Environment: go1.26.5 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_purego,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0
Revision: 4902660f8424fef3c2a60dfcdce7aeadfe3f3b88
CGO: disable

Description

https://github.com/apernet/quic-go/blob/184d081eef3e9edd5cb7c0ddf2460c91f2e6adb1/internal/handshake/tls_conn_utls.go#L57-L63

Upstream github.com/apernet/quic-go does not accept non-nil VerifyConnection or non-empty Certificates in tls.Config due to the difficulty to exactly copy a tls.Config to a utls.Config. The same code also exists in github.com/sagernet/quic-go.

Reproduction

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "socks",
			"listen": "127.0.0.1",
			"listen_port": 1080
		}
	],
	"outbounds": [
		{
			"type": "hysteria2",
			"server": "127.0.0.1",
			"server_port": 443,
			"password": "password",
			"tls": {
				"enabled": true,
				"disable_sni": true
			}
		}
	]
}

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "hysteria2",
			"listen": "127.0.0.1",
			"listen_port": 443,
			"users": [
				{
					"password": "password"
				}
			],
			"tls": {
				"enabled": true,
				"certificate_path": "certificate.crt",
				"key_path": "private.key"
			}
		}
	],
	"outbounds": [
		{
			"type": "direct"
		}
	]
}

Logs

INFO[0000] network: updated default interface WLAN, index 18
INFO[0000] inbound/socks[0]: tcp server started at 127.0.0.1:1080
INFO[0000] sing-box started (0.03s)
INFO[0000] [2303620368 0ms] inbound/socks[0]: inbound connection from 127.0.0.1:58929
INFO[0000] [7853234 0ms] inbound/socks[0]: inbound connection from 127.0.0.1:58930
INFO[0000] [2303620368 0ms] inbound/socks[0]: inbound connection to aus5.mozilla-backup.org:443
INFO[0000] [7853234 0ms] inbound/socks[0]: inbound connection to firefox-settings.mozilla-backup.org:443
INFO[0000] [2303620368 0ms] outbound/hysteria2[0]: outbound connection to aus5.mozilla-backup.org:443
INFO[0000] [7853234 0ms] outbound/hysteria2[0]: outbound connection to firefox-settings.mozilla-backup.org:443
ERROR[0000] [2303620368 1ms] connection: open connection to aus5.mozilla-backup.org:443 using outbound/hysteria2[0]: quic: tls.Config.VerifyConnection is not supported with ChromeParrot

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start with the linked internal/handshake/tls_conn_utls.go lines in apernet/quic-go, then compare the same code in sagernet/quic-go and reproduce the supplied sing-box client and server configurations. Done means Hysteria 2 ChromeParrot connections no longer fail when disable_sni or mutual TLS causes VerifyConnection or Certificates to be present.