Max Lvshadowsocks-libev 与 shadowsocks-android 核心维护者，SIP 规范主导者，meow-rs 内核创立者

值得推荐作者发言

GitHub·2026.11.01 17:06:14（UTC+8）

Max Lv：AnyTLS 应拒绝未生效的 ECH 与客户端证书选项

Max Lv 在 meow-rs #870 指出，AnyTLS 当前静默忽略 ech-opts，用户以为已启用 ECH 时握手仍会明文发送 SNI；certificate/private-key 等客户端证书选项也可能被忽略。其提议在配置加载时像 hysteria2 一样拒绝无法实现的 ech-opts，并对其他忽略字段发出 warn；只有 ECH 和客户端证书会改变安全属性。

作者原文@madeye

Found while reviewing #739.

The AnyTLS adapter ignores ech-opts without a word. A user who sets it thinks ECH is on, but every handshake sends the SNI in the clear. That is a privacy downgrade nobody sees. hysteria2 already rejects ech-opts when it can't honour it.

Other mihomo AnyTLSOption fields that anytls also silently ignores today: certificate/private-key (client certificate), shadow-tls-opts/restls-opts/jls-opts, client-metadata, idle-session-check-interval/idle-session-timeout, min-idle-session and disable-reuse. Of these, only ech-opts and the client certificate change the security properties.

Proposal: refuse ech-opts at config load, as hysteria2 does, unless ECH is wired into the anytls TLS path. Emit a load-time warn! for the other ignored fields.