pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-26 07:44:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(tuic): preserve client identity for Xray user routing (#6875)

Browse Source 
TUIC traffic reached Xray through a loopback SOCKS relay that took no login,
so Xray never learned which client a connection belonged to and user routing
rules never matched TUIC (#6874). The relay now carries one account per client
email, so per-user rules match on TCP and both UDP modes; admission stays with
the native TUIC server.

Adding, removing or renaming a TUIC client swaps only that inbound's relay
instead of restarting Xray: new sessions wait behind a bounded gate while live
streams and UDP associations continue, accounts are verified after the swap and
rolled back on failure, one failing relay no longer strands the others or blocks
unrelated live changes, and emails over SOCKS5's 255-byte limit are excluded
with a warning.
This commit is contained in:
Egor
2026-10-24 09:20:39 +05:00
committed by GitHub
parent 07910bf6c0
commit 207c705300
38 changed files with 3510 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/runtime/local.go
+25 -25
View File
@@ -17,8 +17,9 @@ import (
)
type LocalDeps struct {
APIPort func() int
SetNeedRestart func()
APIPort func() int
SetNeedRestart func()
RequestReconcile func()
}
type Local struct {
@@ -91,8 +92,8 @@ func (l *Local) AddInbound(_ context.Context, ib *model.Inbound) error {
return nil
}
err := tuic.GetManager().Ensure(inst)
if l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
if l.deps.RequestReconcile != nil {
l.deps.RequestReconcile()
}
return err
}
@@ -122,8 +123,8 @@ func (l *Local) DelInbound(_ context.Context, ib *model.Inbound) error {
}
if ib.Protocol == model.TUIC {
tuic.GetManager().Remove(ib.Id)
if l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
if l.deps.RequestReconcile != nil {
l.deps.RequestReconcile()
}
return nil
}
@@ -233,11 +234,12 @@ func (l *Local) updateAmneziaWGInbound(ctx context.Context, oldIb, newIb *model.
}
func (l *Local) updateTuicInbound(ctx context.Context, oldIb, newIb *model.Inbound) error {
// Account changes also need the generated Xray SOCKS relay refreshed after commit.
if l.deps.RequestReconcile != nil {
l.deps.RequestReconcile()
}
if oldIb.Protocol == model.TUIC && newIb.Protocol != model.TUIC {
tuic.GetManager().Remove(oldIb.Id)
if l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
}
if !newIb.Enable {
return nil
}
@@ -245,25 +247,11 @@ func (l *Local) updateTuicInbound(ctx context.Context, oldIb, newIb *model.Inbou
}
if oldIb.Protocol != model.TUIC {
_ = l.DelInbound(ctx, oldIb)
if l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
}
}
if oldIb.Protocol == model.TUIC && newIb.Protocol == model.TUIC && oldIb.Enable && newIb.Enable && oldIb.Tag != newIb.Tag && l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
}
if !newIb.Enable {
tuic.GetManager().Remove(newIb.Id)
if oldIb.Enable && l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
}
return nil
}
if !oldIb.Enable && newIb.Enable {
if l.deps.SetNeedRestart != nil {
l.deps.SetNeedRestart()
}
}
inst, ok := tuic.InstanceFromInbound(newIb)
if !ok {
tuic.GetManager().Remove(newIb.Id)
@@ -273,7 +261,13 @@ func (l *Local) updateTuicInbound(ctx context.Context, oldIb, newIb *model.Inbou
}
func (l *Local) AddUser(_ context.Context, ib *model.Inbound, userMap map[string]any) error {
if ib.Protocol == model.MTProto || ib.Protocol == model.AmneziaWG || ib.Protocol == model.TUIC {
if ib.Protocol == model.TUIC {
if l.deps.RequestReconcile != nil {
l.deps.RequestReconcile()
}
return nil
}
if ib.Protocol == model.MTProto || ib.Protocol == model.AmneziaWG {
return nil
}
return l.withAPI(func(api *xray.XrayAPI) error {
@@ -282,7 +276,13 @@ func (l *Local) AddUser(_ context.Context, ib *model.Inbound, userMap map[string
}
func (l *Local) RemoveUser(_ context.Context, ib *model.Inbound, email string) error {
if ib.Protocol == model.MTProto || ib.Protocol == model.AmneziaWG || ib.Protocol == model.TUIC {
if ib.Protocol == model.TUIC {
if l.deps.RequestReconcile != nil {
l.deps.RequestReconcile()
}
return nil
}
if ib.Protocol == model.MTProto || ib.Protocol == model.AmneziaWG {
return nil
}
return l.withAPI(func(api *xray.XrayAPI) error {
internal/web/runtime/local_tuic_test.go
+31 -11
View File
@@ -9,7 +9,7 @@ import (
func TestUpdateTuicInboundResyncsBridgeOnTagRename(t *testing.T) {
resyncs := 0
local := NewLocal(LocalDeps{SetNeedRestart: func() { resyncs++ }})
local := NewLocal(LocalDeps{RequestReconcile: func() { resyncs++ }})
oldInbound := &model.Inbound{Id: 940001, Tag: "old-tuic-tag", Protocol: model.TUIC, Enable: true, Settings: `{"clients":[]}`}
newInbound := *oldInbound
newInbound.Tag = "new-tuic-tag"
@@ -22,17 +22,37 @@ func TestUpdateTuicInboundResyncsBridgeOnTagRename(t *testing.T) {
}
}
func TestUpdateTuicInboundDoesNotResyncForProfileOnlyChange(t *testing.T) {
// applyLocalTuic reads the row after commit, so old/new payloads may already match.
func TestUpdateTuicInboundResyncsAccountsWithIdenticalPayloads(t *testing.T) {
resyncs := 0
local := NewLocal(LocalDeps{SetNeedRestart: func() { resyncs++ }})
oldInbound := &model.Inbound{Id: 940002, Tag: "tuic-tag", Protocol: model.TUIC, Enable: true, Settings: `{"clients":[],"congestion_control":"bbr"}`}
newInbound := *oldInbound
newInbound.Settings = `{"clients":[],"congestion_control":"cubic","log_level":"debug"}`
if err := local.updateTuicInbound(context.Background(), oldInbound, &newInbound); err != nil {
t.Fatalf("updateTuicInbound: %v", err)
local := NewLocal(LocalDeps{RequestReconcile: func() { resyncs++ }})
inbound := &model.Inbound{Id: 940002, Tag: "tuic-tag", Protocol: model.TUIC, Enable: true, Settings: `{"clients":[]}`}
if err := local.UpdateInbound(context.Background(), inbound, inbound); err != nil {
t.Fatal(err)
}
if resyncs != 0 {
t.Fatalf("profile-only update triggered %d Xray restarts, want 0", resyncs)
if resyncs != 1 {
t.Fatalf("relay account resync requests = %d, want 1", resyncs)
}
}
func TestTuicBulkUserOperationsResyncRelayAccounts(t *testing.T) {
for _, operation := range []string{"add", "remove"} {
t.Run(operation, func(t *testing.T) {
resyncs := 0
local := NewLocal(LocalDeps{RequestReconcile: func() { resyncs++ }})
inbound := &model.Inbound{Id: 940003, Protocol: model.TUIC, Enable: true}
var err error
if operation == "add" {
err = local.AddUser(context.Background(), inbound, map[string]any{"email": "bulk@tuic"})
} else {
err = local.RemoveUser(context.Background(), inbound, "bulk@tuic")
}
if err != nil {
t.Fatal(err)
}
if resyncs != 1 {
t.Fatalf("%s requested %d relay reconciliations, want 1", operation, resyncs)
}
})
}
}