From 53b99efe788f0b91e6c84e140ab44a72dcf201c7 Mon Sep 17 00:00:00 2001
From: hmol233 <82594500+hmol233@users.noreply.github.com>
Date: Sun, 9 May 2021 23:47:21 +0800
Subject: [PATCH 1/4] Add: reject unknown SNI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: 玖柒Max <60207794+jiuqi9997@users.noreply.github.com>
---
 infra/conf/transport_internet.go     |  4 ++++
 transport/internet/tls/config.go     |  7 ++++--
 transport/internet/tls/config.pb.go  | 35 ++++++++++++++++++----------
 transport/internet/tls/config.proto  |  2 ++
 transport/internet/xtls/config.go    |  7 ++++--
 transport/internet/xtls/config.pb.go | 32 ++++++++++++++++---------
 transport/internet/xtls/config.proto |  3 +++
 7 files changed, 63 insertions(+), 27 deletions(-)

diff --git a/infra/conf/transport_internet.go b/infra/conf/transport_internet.go
index 62c3f1a8..36bcb918 100644
--- a/infra/conf/transport_internet.go
+++ b/infra/conf/transport_internet.go
@@ -322,6 +322,7 @@ type TLSConfig struct {
 	CipherSuites             string           `json:"cipherSuites"`
 	PreferServerCipherSuites bool             `json:"preferServerCipherSuites"`
 	Fingerprint              string           `json:"fingerprint"`
+	RejectUnknownSNI         bool             `json:"rejectUnknownSni"`
 }
 
 // Build implements Buildable.
@@ -350,6 +351,7 @@ func (c *TLSConfig) Build() (proto.Message, error) {
 	config.CipherSuites = c.CipherSuites
 	config.PreferServerCipherSuites = c.PreferServerCipherSuites
 	config.Fingerprint = strings.ToLower(c.Fingerprint)
+	config.RejectUnknownSni = c.RejectUnknownSNI
 	return config, nil
 }
 
@@ -413,6 +415,7 @@ type XTLSConfig struct {
 	MaxVersion               string            `json:"maxVersion"`
 	CipherSuites             string            `json:"cipherSuites"`
 	PreferServerCipherSuites bool              `json:"preferServerCipherSuites"`
+	RejectUnknownSNI         bool              `json:"rejectUnknownSni"`
 }
 
 // Build implements Buildable.
@@ -440,6 +443,7 @@ func (c *XTLSConfig) Build() (proto.Message, error) {
 	config.MaxVersion = c.MaxVersion
 	config.CipherSuites = c.CipherSuites
 	config.PreferServerCipherSuites = c.PreferServerCipherSuites
+	config.RejectUnknownSni = c.RejectUnknownSNI
 	return config, nil
 }
 
diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index e39a9a4f..c5bd6c37 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -211,7 +211,7 @@ func getGetCertificateFunc(c *tls.Config, ca []*Certificate) func(hello *tls.Cli
 	}
 }
 
-func getNewGetCertficateFunc(certs []*tls.Certificate) func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+func getNewGetCertificateFunc(certs []*tls.Certificate, rejectUnknownSNI bool) func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 	return func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 		if len(certs) == 0 {
 			return nil, newError("empty certs")
@@ -234,6 +234,9 @@ func getNewGetCertficateFunc(certs []*tls.Certificate) func(hello *tls.ClientHel
 				}
 			}
 		}
+		if rejectUnknownSNI {
+			return nil, newError("reject unknown sni")
+		}
 		return certs[0], nil
 	}
 }
@@ -275,7 +278,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 	if len(caCerts) > 0 {
 		config.GetCertificate = getGetCertificateFunc(config, caCerts)
 	} else {
-		config.GetCertificate = getNewGetCertficateFunc(c.BuildCertificates())
+		config.GetCertificate = getNewGetCertificateFunc(c.BuildCertificates(), c.RejectUnknownSni)
 	}
 
 	if sn := c.parseServerName(); len(sn) > 0 {
diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go
index b58a660d..437a244d 100644
--- a/transport/internet/tls/config.pb.go
+++ b/transport/internet/tls/config.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.25.0
-// 	protoc        v3.15.6
+// 	protoc        v3.15.8
 // source: transport/internet/tls/config.proto
 
 package tls
@@ -201,7 +201,8 @@ type Config struct {
 	// Whether the server selects its most preferred ciphersuite.
 	PreferServerCipherSuites bool `protobuf:"varint,10,opt,name=prefer_server_cipher_suites,json=preferServerCipherSuites,proto3" json:"prefer_server_cipher_suites,omitempty"`
 	// TLS Client Hello fingerprint (uTLS).
-	Fingerprint string `protobuf:"bytes,11,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
+	Fingerprint      string `protobuf:"bytes,11,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
+	RejectUnknownSni bool   `protobuf:"varint,12,opt,name=reject_unknown_sni,json=rejectUnknownSni,proto3" json:"reject_unknown_sni,omitempty"`
 }
 
 func (x *Config) Reset() {
@@ -313,6 +314,13 @@ func (x *Config) GetFingerprint() string {
 	return ""
 }
 
+func (x *Config) GetRejectUnknownSni() bool {
+	if x != nil {
+		return x.RejectUnknownSni
+	}
+	return false
+}
+
 var File_transport_internet_tls_config_proto protoreflect.FileDescriptor
 
 var file_transport_internet_tls_config_proto_rawDesc = []byte{
@@ -342,7 +350,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{
 	0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10,
 	0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59,
 	0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f,
-	0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xf5, 0x03, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66,
+	0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xa3, 0x04, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66,
 	0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65,
 	0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f,
 	0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, 0x4a, 0x0a, 0x0b, 0x63, 0x65, 0x72,
@@ -373,15 +381,18 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{
 	0x01, 0x28, 0x08, 0x52, 0x18, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x65,
 	0x72, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x73, 0x12, 0x20, 0x0a,
 	0x0b, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0b, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x42,
-	0x73, 0x0a, 0x1f, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e,
-	0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74,
-	0x6c, 0x73, 0x50, 0x01, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f,
-	0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
-	0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x54, 0x72,
-	0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74,
-	0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x28, 0x09, 0x52, 0x0b, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x12,
+	0x2c, 0x0a, 0x12, 0x72, 0x65, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77,
+	0x6e, 0x5f, 0x73, 0x6e, 0x69, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x6a,
+	0x65, 0x63, 0x74, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x53, 0x6e, 0x69, 0x42, 0x73, 0x0a,
+	0x1f, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73,
+	0x50, 0x01, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78,
+	0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x74, 0x72,
+	0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1b, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x54, 0x72, 0x61, 0x6e,
+	0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54,
+	0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto
index 7cae8436..cc2ae7cc 100644
--- a/transport/internet/tls/config.proto
+++ b/transport/internet/tls/config.proto
@@ -67,4 +67,6 @@ message Config {
 
   // TLS Client Hello fingerprint (uTLS).
   string fingerprint = 11;
+
+  bool reject_unknown_sni = 12;
 }
diff --git a/transport/internet/xtls/config.go b/transport/internet/xtls/config.go
index cd15e573..58faa7f0 100644
--- a/transport/internet/xtls/config.go
+++ b/transport/internet/xtls/config.go
@@ -212,7 +212,7 @@ func getGetCertificateFunc(c *xtls.Config, ca []*Certificate) func(hello *xtls.C
 	}
 }
 
-func getNewGetCertficateFunc(certs []*xtls.Certificate) func(hello *xtls.ClientHelloInfo) (*xtls.Certificate, error) {
+func getNewGetCertificateFunc(certs []*xtls.Certificate, rejectUnknownSNI bool) func(hello *xtls.ClientHelloInfo) (*xtls.Certificate, error) {
 	return func(hello *xtls.ClientHelloInfo) (*xtls.Certificate, error) {
 		if len(certs) == 0 {
 			return nil, newError("empty certs")
@@ -235,6 +235,9 @@ func getNewGetCertficateFunc(certs []*xtls.Certificate) func(hello *xtls.ClientH
 				}
 			}
 		}
+		if rejectUnknownSNI {
+			return nil, newError("reject unknown sni")
+		}
 		return certs[0], nil
 	}
 }
@@ -276,7 +279,7 @@ func (c *Config) GetXTLSConfig(opts ...Option) *xtls.Config {
 	if len(caCerts) > 0 {
 		config.GetCertificate = getGetCertificateFunc(config, caCerts)
 	} else {
-		config.GetCertificate = getNewGetCertficateFunc(c.BuildCertificates())
+		config.GetCertificate = getNewGetCertificateFunc(c.BuildCertificates(), c.RejectUnknownSni)
 	}
 
 	if sn := c.parseServerName(); len(sn) > 0 {
diff --git a/transport/internet/xtls/config.pb.go b/transport/internet/xtls/config.pb.go
index fa07663c..516efff4 100644
--- a/transport/internet/xtls/config.pb.go
+++ b/transport/internet/xtls/config.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc        v3.15.8
 // source: transport/internet/xtls/config.proto
 
 package xtls
@@ -200,6 +200,7 @@ type Config struct {
 	CipherSuites string `protobuf:"bytes,9,opt,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
 	// Whether the server selects its most preferred ciphersuite.
 	PreferServerCipherSuites bool `protobuf:"varint,10,opt,name=prefer_server_cipher_suites,json=preferServerCipherSuites,proto3" json:"prefer_server_cipher_suites,omitempty"`
+	RejectUnknownSni         bool `protobuf:"varint,12,opt,name=reject_unknown_sni,json=rejectUnknownSni,proto3" json:"reject_unknown_sni,omitempty"`
 }
 
 func (x *Config) Reset() {
@@ -304,6 +305,13 @@ func (x *Config) GetPreferServerCipherSuites() bool {
 	return false
 }
 
+func (x *Config) GetRejectUnknownSni() bool {
+	if x != nil {
+		return x.RejectUnknownSni
+	}
+	return false
+}
+
 var File_transport_internet_xtls_config_proto protoreflect.FileDescriptor
 
 var file_transport_internet_xtls_config_proto_rawDesc = []byte{
@@ -333,7 +341,7 @@ var file_transport_internet_xtls_config_proto_rawDesc = []byte{
 	0x0c, 0x45, 0x4e, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12,
 	0x14, 0x0a, 0x10, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52,
 	0x49, 0x46, 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49,
-	0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xd4, 0x03, 0x0a, 0x06, 0x43,
+	0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0x82, 0x04, 0x0a, 0x06, 0x43,
 	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69,
 	0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61,
 	0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, 0x4b, 0x0a, 0x0b,
@@ -363,15 +371,17 @@ var file_transport_internet_xtls_config_proto_rawDesc = []byte{
 	0x76, 0x65, 0x72, 0x5f, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x5f, 0x73, 0x75, 0x69, 0x74, 0x65,
 	0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x18, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x53,
 	0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65,
-	0x73, 0x42, 0x76, 0x0a, 0x20, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72,
-	0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74,
-	0x2e, 0x78, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f,
-	0x72, 0x65, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1c, 0x58, 0x72, 0x61,
-	0x79, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65,
-	0x72, 0x6e, 0x65, 0x74, 0x2e, 0x58, 0x74, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x73, 0x12, 0x2c, 0x0a, 0x12, 0x72, 0x65, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x6e, 0x6b, 0x6e,
+	0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x6e, 0x69, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72,
+	0x65, 0x6a, 0x65, 0x63, 0x74, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x53, 0x6e, 0x69, 0x42,
+	0x76, 0x0a, 0x20, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e,
+	0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x78,
+	0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65,
+	0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x65, 0x74, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x1c, 0x58, 0x72, 0x61, 0x79, 0x2e,
+	0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x65, 0x74, 0x2e, 0x58, 0x74, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/transport/internet/xtls/config.proto b/transport/internet/xtls/config.proto
index 72ca4c5f..57410148 100644
--- a/transport/internet/xtls/config.proto
+++ b/transport/internet/xtls/config.proto
@@ -64,4 +64,7 @@ message Config {
 
   // Whether the server selects its most preferred ciphersuite.
   bool prefer_server_cipher_suites = 10;
+
+
+  bool reject_unknown_sni = 12;
 }

From 1f92b948c099a08310afdc4dd87569a619f12b73 Mon Sep 17 00:00:00 2001
From: hmol233 <82594500+hmol233@users.noreply.github.com>
Date: Mon, 10 May 2021 00:11:45 +0800
Subject: [PATCH 2/4] Fix errNoCertificates

---
 transport/internet/tls/config.go  | 2 +-
 transport/internet/tls/unsafe.go  | 6 ++++++
 transport/internet/xtls/config.go | 2 +-
 transport/internet/xtls/unsafe.go | 6 ++++++
 4 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 transport/internet/tls/unsafe.go
 create mode 100644 transport/internet/xtls/unsafe.go

diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index c5bd6c37..daca8f16 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -235,7 +235,7 @@ func getNewGetCertificateFunc(certs []*tls.Certificate, rejectUnknownSNI bool) f
 			}
 		}
 		if rejectUnknownSNI {
-			return nil, newError("reject unknown sni")
+			return nil, errNoCertificates
 		}
 		return certs[0], nil
 	}
diff --git a/transport/internet/tls/unsafe.go b/transport/internet/tls/unsafe.go
new file mode 100644
index 00000000..bb212abd
--- /dev/null
+++ b/transport/internet/tls/unsafe.go
@@ -0,0 +1,6 @@
+package tls
+
+import _ "unsafe"
+
+//go:linkname errNoCertificates crypto/tls.errNoCertificates
+var errNoCertificates error
diff --git a/transport/internet/xtls/config.go b/transport/internet/xtls/config.go
index 58faa7f0..b74976cb 100644
--- a/transport/internet/xtls/config.go
+++ b/transport/internet/xtls/config.go
@@ -236,7 +236,7 @@ func getNewGetCertificateFunc(certs []*xtls.Certificate, rejectUnknownSNI bool)
 			}
 		}
 		if rejectUnknownSNI {
-			return nil, newError("reject unknown sni")
+			return nil, errNoCertificates
 		}
 		return certs[0], nil
 	}
diff --git a/transport/internet/xtls/unsafe.go b/transport/internet/xtls/unsafe.go
new file mode 100644
index 00000000..181684e8
--- /dev/null
+++ b/transport/internet/xtls/unsafe.go
@@ -0,0 +1,6 @@
+package xtls
+
+import _ "unsafe"
+
+//go:linkname errNoCertificates crypto/tls.errNoCertificates
+var errNoCertificates error

From e8a8465220e06c99a7b098a449cc9204283debf6 Mon Sep 17 00:00:00 2001
From: hmol233 <82594500+hmol233@users.noreply.github.com>
Date: Mon, 10 May 2021 00:28:40 +0800
Subject: [PATCH 3/4] Fix reject unknown sni with single cert

---
 transport/internet/tls/config.go  | 4 ++--
 transport/internet/xtls/config.go | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index daca8f16..71bd52ce 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -214,10 +214,10 @@ func getGetCertificateFunc(c *tls.Config, ca []*Certificate) func(hello *tls.Cli
 func getNewGetCertificateFunc(certs []*tls.Certificate, rejectUnknownSNI bool) func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 	return func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 		if len(certs) == 0 {
-			return nil, newError("empty certs")
+			return nil, errNoCertificates
 		}
 		sni := strings.ToLower(hello.ServerName)
-		if len(certs) == 1 || sni == "" {
+		if !rejectUnknownSNI && (len(certs) == 1 || sni == "") {
 			return certs[0], nil
 		}
 		gsni := "*"
diff --git a/transport/internet/xtls/config.go b/transport/internet/xtls/config.go
index b74976cb..071bcc8f 100644
--- a/transport/internet/xtls/config.go
+++ b/transport/internet/xtls/config.go
@@ -215,10 +215,10 @@ func getGetCertificateFunc(c *xtls.Config, ca []*Certificate) func(hello *xtls.C
 func getNewGetCertificateFunc(certs []*xtls.Certificate, rejectUnknownSNI bool) func(hello *xtls.ClientHelloInfo) (*xtls.Certificate, error) {
 	return func(hello *xtls.ClientHelloInfo) (*xtls.Certificate, error) {
 		if len(certs) == 0 {
-			return nil, newError("empty certs")
+			return nil, errNoCertificates
 		}
 		sni := strings.ToLower(hello.ServerName)
-		if len(certs) == 1 || sni == "" {
+		if !rejectUnknownSNI && (len(certs) == 1 || sni == "") {
 			return certs[0], nil
 		}
 		gsni := "*"

From 3b8618b379038883ec916d0c1090e15af3337c2f Mon Sep 17 00:00:00 2001
From: hmol233 <82594500+hmol233@users.noreply.github.com>
Date: Mon, 10 May 2021 07:11:27 +0800
Subject: [PATCH 4/4] Fix linkname

---
 transport/internet/xtls/unsafe.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/transport/internet/xtls/unsafe.go b/transport/internet/xtls/unsafe.go
index 181684e8..96c89416 100644
--- a/transport/internet/xtls/unsafe.go
+++ b/transport/internet/xtls/unsafe.go
@@ -2,5 +2,5 @@ package xtls
 
 import _ "unsafe"
 
-//go:linkname errNoCertificates crypto/tls.errNoCertificates
+//go:linkname errNoCertificates github.com/xtls/go.errNoCertificates
 var errNoCertificates error