pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-07 05:35:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(tuic): preserve client identity for Xray user routing (#6875)

Browse Source 
TUIC traffic reached Xray through a loopback SOCKS relay that took no login,
so Xray never learned which client a connection belonged to and user routing
rules never matched TUIC (#6874). The relay now carries one account per client
email, so per-user rules match on TCP and both UDP modes; admission stays with
the native TUIC server.

Adding, removing or renaming a TUIC client swaps only that inbound's relay
instead of restarting Xray: new sessions wait behind a bounded gate while live
streams and UDP associations continue, accounts are verified after the swap and
rolled back on failure, one failing relay no longer strands the others or blocks
unrelated live changes, and emails over SOCKS5's 255-byte limit are excluded
with a warning.
This commit is contained in:
Egor
2026-10-24 09:20:39 +05:00
committed by GitHub
parent 07910bf6c0
commit 207c705300
38 changed files with 3510 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/tuic/server.go
+39 -5
View File
@@ -32,6 +32,7 @@ type Server struct {
logLevel atomic.Uint32
maxUdpRelayPacketSize int
pendingUdpBudget pendingUdpBudget
users *UserRegistry
relay *SocksRelay
@@ -355,6 +356,7 @@ func (s *Server) handleConn(conn *quic.Conn) {
authOnce sync.Once
udpAssociations = newUdpAssociationRegistry(s.maxUdpRelayPacketSize)
)
udpAssociations.pendingBudget = &s.pendingUdpBudget
authTimer := time.AfterFunc(s.authTimeout, func() {
if authState.CompareAndSwap(0, 2) {
@@ -835,15 +837,35 @@ func (s *Server) forwardUDPPacket(
udpAssociations *udpAssociationRegistry,
relayWg *sync.WaitGroup,
) {
if len(payload) > s.maxUdpRelayPacketSize || !isPacketTarget(target) {
return
}
if association == nil || len(payload) > s.maxUdpRelayPacketSize || !isPacketTarget(target) {
return
}
association, created, err := udpAssociations.ensureRelay(ctx, assocID, association, user, s.relay)
sess, opening, err := udpAssociations.queuePacket(ctx, assocID, association, target, payload)
if err != nil {
s.logLimited(tuicLogWarn, "udp-dial", 30*time.Second, "UDP relay could not be opened: %v", err)
s.logLimited(tuicLogWarn, "udp-queue", 30*time.Second, "UDP relay packet could not be queued: %v", err)
return
}
if sess != nil {
s.sendUDPRequest(user, sess, target, payload)
return
}
if opening == nil {
return
}
relayWg.Add(1)
go func() {
defer relayWg.Done()
s.openUDPRelay(ctx, opening, conn, user, assocID, association, udpAssociations, relayWg)
}()
}
func (s *Server) openUDPRelay(ctx, opening context.Context, conn *quic.Conn, user *User, assocID uint16, association *udpAssociation, udpAssociations *udpAssociationRegistry, relayWg *sync.WaitGroup) {
_, created, err := udpAssociations.ensureRelay(opening, assocID, association, user, s.relay)
if err != nil {
if opening.Err() == nil {
s.logLimited(tuicLogWarn, "udp-dial", 30*time.Second, "UDP relay could not be opened: %v", err)
}
udpAssociations.failPending(association)
return
}
sess := association.relay
@@ -855,7 +877,19 @@ func (s *Server) forwardUDPPacket(
s.relayUDPResponses(ctx, conn, user, assocID, association, udpAssociations, sess)
}()
}
for {
packet, ok := udpAssociations.nextPending(assocID, association)
if !ok {
return
}
if ctx.Err() == nil {
s.sendUDPRequest(user, sess, packet.target, packet.payload)
}
udpAssociations.releasePendingPacket(packet)
}
}
func (s *Server) sendUDPRequest(user *User, sess *udpRelaySession, target *Address, payload []byte) {
if _, err := sess.relay.Send(target, payload); err != nil {
s.logLimited(tuicLogWarn, "udp-send", 30*time.Second, "UDP relay request failed: %v", err)
return