tokenplsClash by Hako 创作者与 Hako 内核核心维护者

作者发言

GitHub·2026.09.07 14:52:05（UTC+8）

TokenPLS 排查 OpenVPN 兼容性，向 Mihomo 提交 tls-auth 摘要算法修复

TokenPLS 在排查 tls-crypt 超时时发现，tls-auth 固定使用 HMAC-SHA1 会导致 auth SHA256/SHA512 配置握手失败，并向 Mihomo 提交 PR #3189。作者明确说明这是另一项独立问题，不能据此认定原 tls-crypt 故障已解决；该修复 PR 后于 9 月 8 日合并。

作者原文@TokenPLS

Update on the tls-crypt investigation.

We now have an interop test that runs the OpenVPN outbound against an official OpenVPN 2.7.5 server with tls-crypt, tls-crypt-v2, tls-auth and auth-user-pass. We will post its results here once the run completes.

One finding already: the upstream tls-auth implementation hard-codes HMAC-SHA1, so any profile that combines tls-auth with auth SHA256 or auth SHA512 cannot complete the handshake at all. That is a different bug from yours; we sent the fix upstream in https://github.com/MetaCubeX/mihomo/pull/3189. If you try the tls-auth comparison we asked for, expect it to fail for that reason until the fix ships, so that comparison is not informative for now. tls-crypt does not depend on auth, so your profile is not affected by that bug.

Still the most useful data for your case: the server-side openvpn --verb 4 lines from the moment the app tries to connect (or confirmation that the server logs nothing at all), and whether the official client on the same Mac connects with the same profile.