Tls downgrade attack?

[hiddify-com]

I could not find how you prevent downgrade attack would you please help me?

There is an issue with utls in Iran and we are trying to investigate that (see XTLS/Xray-core#1919 )

I can not see it in your code
https://github.com/refraction-networking/utls/blob/master/handshake_client_tls13.go

However it is clearly visible in https://github.com/golang/go/blob/ee522e2cdad04a43bc9374776483b6249eb97ec9/src/crypto/tls/handshake_client.go#L203

[RPRX]

utls/handshake_client.go

Lines 208 to 218 in c785bd3

	// If we are negotiating a protocol version that's lower than what we
	// support, check for the server downgrade canaries.
	// See RFC 8446, Section 4.1.3.
	maxVers := c.config.maxSupportedVersion(roleClient)
	tls12Downgrade := string(serverHello.random[24:]) == downgradeCanaryTLS12
	tls11Downgrade := string(serverHello.random[24:]) == downgradeCanaryTLS11
	if maxVers == VersionTLS13 && c.vers <= VersionTLS12 && (tls12Downgrade || tls11Downgrade) ||
	maxVers == VersionTLS12 && c.vers <= VersionTLS11 && tls11Downgrade {
	c.sendAlert(alertIllegalParameter)
	return errors.New("tls: downgrade attempt detected, possibly due to a MitM attack or a broken middlebox")
	}

[mingyech]

Reopening, it looks like the above lines are missing for the equivalent utls function in u_handshake_client.go (moved from previously in u_conn.go). So it won't work when using custom ClientHello specs/fingerprints.