TokenPLS：向 Mihomo 提交 OpenVPN tls-auth 摘要算法修复

tokenplsClash by Hako 创作者与 Hako 内核核心维护者

GitHub·2026.09.07 14:52:05（UTC+8）

TokenPLS：向 Mihomo 提交 OpenVPN tls-auth 摘要算法修复

TokenPLS 在排查 tls-crypt 超时时发现 tls-auth 固定 HMAC-SHA1 会导致 auth SHA256/SHA512 握手失败，并向 Mihomo 提交 PR #3189；强调这是独立问题，不代表 tls-crypt 原故障已解决。该 PR 后已合并。

作者原文@TokenPLS

Update on the tls-crypt investigation.

We now have an interop test that runs the OpenVPN outbound against an official OpenVPN 2.7.5 server with tls-crypt, tls-crypt-v2, tls-auth and auth-user-pass. We will post its results here once the run completes.

One finding already: the upstream tls-auth implementation hard-codes HMAC-SHA1, so any profile that combines tls-auth with auth SHA256 or auth SHA512 cannot complete the handshake at all. That is a different bug from yours; we sent the fix upstream in https://github.com/MetaCubeX/mihomo/pull/3189. If you try the tls-auth comparison we asked for, expect it to fail for that reason until the fix ships, so that comparison is not informative for now. tls-crypt does not depend on auth, so your profile is not affected by that bug.

Still the most useful data for your case: the server-side openvpn --verb 4 lines from the moment the app tries to connect (or confirmation that the server logs nothing at all), and whether the official client on the same Mac connects with the same profile.