[BUG]SetTLSFingerprintSpec

[1992w]

同一个client连续访问两个不同的域名，第二个会报错。改成类似下面这样就没问题：

type NewClientHelloIDFunc func() *utls.ClientHelloSpec

func (c *Client) SetTLSFingerprintSpec(clientHelloIDFunc NewClientHelloIDFunc) *Client {
c.setTLSFingerprint(utls.HelloCustom, func(conn *uTLSConn) error {
return conn.ApplyPreset(clientHelloIDFunc())
})
return c
}

func TestSetTLSFingerprintSpec(t *testing.T) {
c := tc().SetTLSFingerprintSpec(func() *utls.ClientHelloSpec {
return &utls.ClientHelloSpec{
CipherSuites: []uint16{
utls.GREASE_PLACEHOLDER,
utls.TLS_AES_128_GCM_SHA256,
utls.TLS_AES_256_GCM_SHA384,
utls.TLS_CHACHA20_POLY1305_SHA256,
utls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
utls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
utls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
utls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
utls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
utls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
utls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
utls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
utls.TLS_RSA_WITH_AES_128_GCM_SHA256,
utls.TLS_RSA_WITH_AES_256_GCM_SHA384,
utls.TLS_RSA_WITH_AES_128_CBC_SHA,
utls.TLS_RSA_WITH_AES_256_CBC_SHA,
},
CompressionMethods: []byte{
0x00, // compressionNone
},
Extensions: utls.ShuffleChromeTLSExtensions([]utls.TLSExtension{
&utls.UtlsGREASEExtension{},
&utls.SNIExtension{},
&utls.ExtendedMasterSecretExtension{},
&utls.RenegotiationInfoExtension{Renegotiation: utls.RenegotiateOnceAsClient},
&utls.SupportedCurvesExtension{Curves: []utls.CurveID{
utls.GREASE_PLACEHOLDER,
utls.X25519,
utls.CurveP256,
utls.CurveP384,
}},
&utls.SupportedPointsExtension{SupportedPoints: []byte{
0x00, // pointFormatUncompressed
}},
&utls.SessionTicketExtension{},
&utls.ALPNExtension{AlpnProtocols: []string{"h2", "http/1.1"}},
&utls.StatusRequestExtension{},
&utls.SignatureAlgorithmsExtension{SupportedSignatureAlgorithms: []utls.SignatureScheme{
utls.ECDSAWithP256AndSHA256,
utls.PSSWithSHA256,
utls.PKCS1WithSHA256,
utls.ECDSAWithP384AndSHA384,
utls.PSSWithSHA384,
utls.PKCS1WithSHA384,
utls.PSSWithSHA512,
utls.PKCS1WithSHA512,
}},
&utls.SCTExtension{},
&utls.KeyShareExtension{KeyShares: []utls.KeyShare{
{Group: utls.CurveID(utls.GREASE_PLACEHOLDER), Data: []byte{0}},
{Group: utls.X25519},
}},
&utls.PSKKeyExchangeModesExtension{Modes: []uint8{
utls.PskModeDHE,
}},
&utls.SupportedVersionsExtension{Versions: []uint16{
utls.GREASE_PLACEHOLDER,
utls.VersionTLS13,
utls.VersionTLS12,
}},
&utls.UtlsCompressCertExtension{Algorithms: []utls.CertCompressionAlgo{
utls.CertCompressionBrotli,
}},
&utls.ApplicationSettingsExtension{SupportedProtocols: []string{"h2"}},
utls.BoringGREASEECH(),
&utls.UtlsGREASEExtension{},
&utls.UtlsPaddingExtension{GetPaddingLen: utls.BoringPaddingStyle},
}),
}
})

if _, err := c.R().Get("https://www.baidu.com"); err != nil {
	t.Fatal(err.Error())
}

if _, err := c.R().Get("https://www.163.com"); err != nil {
	t.Fatal(err.Error())
}

}

[imroc]

Thanks for the detailed report and reproduction.

Root cause: SetTLSFingerprintSpec currently stores a single static *utls.ClientHelloSpec and reuses it for every TLS handshake. When the same client connects to a different domain, reusing the same spec (e.g. cached state or domain-specific context) causes the second handshake to fail.

Your fix — accepting a func() *utls.ClientHelloSpec so a fresh spec is generated per connection — looks like the right direction. This is a bug in the TLS fingerprinting path (labeled tls-fingerprint), medium priority since a workaround exists.

If you're able to open a PR with this change (plus the test you included), that would be the fastest way to get it merged. Otherwise we'll track it for a future fix. We won't commit to a specific timeline.