pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-25 15:25:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(sub): close a deleted host binding only on the inbound it served

Browse Source 
Deleting the only host a client was bound to blanked that client on every
inbound. Once the host row was gone, the binding could no longer say which
inbound it guarded, so it failed closed everywhere: a client on inbounds A
and B, bound to one host on A, lost B's link the moment that host was
deleted, and nothing in the panel hinted at it.

Every host delete (host groups, the externalProxy sync, inbound deletion,
the depleted-inbound sweep and the orphan prune) now goes through
database.DeleteHosts, which keeps each deleted host's inbound in
host_tombstones in the same transaction. A binding to a deleted host closes
only that inbound; ids that resolve to no host at all still fail closed
everywhere. The Postgres Host step now runs the deletion cases as well.
This commit is contained in:
MHSanaei
2026-10-24 20:07:55 +02:00
parent e8feb9d641
commit 2c18cbe1cd
10 changed files with 155 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/host_order_test.go
+2 -1
View File
@@ -22,7 +22,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
)
func TestSubHostOrder_Postgres(t *testing.T) {
func TestSubHosts_Postgres(t *testing.T) {
if os.Getenv("XUI_DB_TYPE") != "postgres" || os.Getenv("XUI_DB_DSN") == "" {
t.Skip("requires a disposable PostgreSQL database")
}
@@ -34,6 +34,7 @@ func TestSubHostOrder_Postgres(t *testing.T) {
{"filters", TestSub_HostOrderFiltersAndFallbacks},
{"base64", TestSub_HostOrderBase64AndInfoNode},
{"balancer", TestSub_HostOrderBalancerSlots},
{"deleted binding", TestSub_ClientHostRule_DeletedHostClosesOnlyItsInbound},
} {
t.Run(scenario.name, func(t *testing.T) {
cleanup, err := testpg.IsolatePackage("host_order")
internal/sub/host_sub.go
+29 -10
View File
@@ -20,35 +20,54 @@ const (
hostBindingBound // render only the returned bound hosts of this inbound
)
// clientHostBinding resolves the client's bound host rules against one inbound. A binding whose
// every id is gone fails closed; a missing id beside a live one never silences other inbounds.
// clientHostBinding resolves the client's bound host rules against one inbound. A deleted bound host
// closes only the inbound it served; ids that resolve to no inbound at all fail closed everywhere.
func (s *SubService) clientHostBinding(inbound *model.Inbound, client model.Client) (hostBinding, []*model.Host) {
ids := model.EffectiveClientHostRuleIds(client)
if len(ids) == 0 || database.GetDB() == nil {
db := database.GetDB()
if len(ids) == 0 || db == nil {
return hostBindingNone, nil
}
var rows []model.Host
if err := database.GetDB().Where("id IN ?", ids).Find(&rows).Error; err != nil {
if err := db.Where("id IN ?", ids).Find(&rows).Error; err != nil {
logger.Warning("SubService - clientHostBinding:", err)
return hostBindingClosed, nil
}
if len(rows) == 0 {
return hostBindingClosed, nil
}
byId := make(map[int]*model.Host, len(rows))
for i := range rows {
byId[rows[i].Id] = &rows[i]
}
var here []*model.Host
var gone []int
for _, id := range ids {
if h, ok := byId[id]; ok && h.InboundId == inbound.Id {
h, ok := byId[id]
switch {
case !ok:
gone = append(gone, id)
case h.InboundId == inbound.Id:
here = append(here, h)
}
}
if len(here) == 0 {
if len(here) > 0 {
return hostBindingBound, here
}
if len(gone) == 0 {
return hostBindingNone, nil
}
return hostBindingBound, here
var tombstones []model.HostTombstone
if err := db.Where("host_id IN ?", gone).Find(&tombstones).Error; err != nil {
logger.Warning("SubService - clientHostBinding:", err)
return hostBindingClosed, nil
}
if len(rows) == 0 && len(tombstones) == 0 {
return hostBindingClosed, nil
}
for _, tomb := range tombstones {
if tomb.InboundId == inbound.Id {
return hostBindingClosed, nil
}
}
return hostBindingNone, nil
}
// clientHostEndpoints returns the endpoints of the client's usable bound hosts on this inbound, or
internal/sub/host_sub_test.go
+64 -5
View File
@@ -1160,8 +1160,8 @@ func TestSub_ClientHostRule_MultipleBindings(t *testing.T) {
}
}
// A deleted binding is skipped; with no valid binding left the client fails closed with zero
// links (no fallback, no dummy link) but stays in traffic accounting.
// A deleted binding is skipped; a binding that resolves to no inbound fails closed with zero links
// (no fallback, no dummy link) but stays in traffic accounting.
func TestSub_ClientHostRule_DeletedFallsBack(t *testing.T) {
t.Run("deleted and valid binding renders only the valid host", func(t *testing.T) {
seedSubDB(t)
@@ -1191,7 +1191,7 @@ func TestSub_ClientHostRule_DeletedFallsBack(t *testing.T) {
}
})
t.Run("deleted-only binding fails closed with zero links", func(t *testing.T) {
t.Run("binding that resolves to no inbound fails closed with zero links", func(t *testing.T) {
seedSubDB(t)
ib := seedSubInbound(t, "s1", "fb", 445, 1, tcpTLSStream)
seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
@@ -1228,8 +1228,8 @@ func TestSub_ClientHostRule_DeletedFallsBack(t *testing.T) {
}
})
// A deleted host id must not silence an inbound without the client's other bound hosts:
// relevance comes from rows that still exist, fail-closed only when every bound id is gone.
// An unknown host id must not silence an inbound without the client's other bound hosts: the
// live and deleted hosts the ids resolve to decide which inbounds the binding guards.
t.Run("deleted id on one inbound does not silence an unrelated inbound", func(t *testing.T) {
seedSubDB(t)
ibA := seedSubInbound(t, "s1", "xa", 4471, 1, tcpTLSStream)
@@ -1267,6 +1267,65 @@ func TestSub_ClientHostRule_DeletedFallsBack(t *testing.T) {
})
}
// Deleting a client's only bound host blanked it on every inbound, since the gone rows no longer
// said which inbound the binding guarded; only the inbound the host served may close.
func TestSub_ClientHostRule_DeletedHostClosesOnlyItsInbound(t *testing.T) {
for _, tc := range []struct {
name string
subId string
portA int
remove func(t *testing.T, ibA *model.Inbound, groupId string) error
}{
{"by its host group", "dg", 4481, func(_ *testing.T, _ *model.Inbound, groupId string) error {
return (&service.HostService{}).DeleteHostGroup(groupId)
}},
{"with its inbound", "di", 4483, func(t *testing.T, ibA *model.Inbound, _ string) error {
if err := database.GetDB().Model(ibA).Update("enable", false).Error; err != nil {
t.Fatalf("disable inbound A: %v", err)
}
_, err := (&service.InboundService{}).DelInbound(ibA.Id)
return err
}},
} {
t.Run(tc.name, func(t *testing.T) {
seedSubDB(t)
ibA := seedSubInbound(t, tc.subId, tc.subId+"a", tc.portA, 1, tcpTLSStream)
ibB := seedSubInbound(t, tc.subId, tc.subId+"b", tc.portA+1, 2, tcpTLSStream)
email, groupId := tc.subId+"b@e", tc.subId+"-grp"
db := database.GetDB()
var client model.ClientRecord
if err := db.Where("email = ?", email).First(&client).Error; err != nil {
t.Fatalf("load client %s: %v", email, err)
}
if err := db.Create(&model.ClientInbound{ClientId: client.Id, InboundId: ibA.Id}).Error; err != nil {
t.Fatalf("link client to inbound A: %v", err)
}
hostA := seedHost(t, &model.Host{GroupId: groupId, InboundId: ibA.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
if err := db.Model(&model.ClientRecord{}).Where("email = ?", email).
Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostA.Id})).Error; err != nil {
t.Fatalf("bind host rule: %v", err)
}
if err := tc.remove(t, ibA, groupId); err != nil {
t.Fatalf("delete the bound host: %v", err)
}
links, _, _, _, err := NewSubService("").GetSubs(tc.subId, "req.example.com")
if err != nil {
t.Fatalf("GetSubs: %v", err)
}
joined := strings.Join(links, "\n")
uuid := "11111111-2222-4333-8444-" + fmt.Sprintf("%012d", ibB.Port)
if strings.Contains(joined, "a.cdn.com") || strings.Contains(joined, fmt.Sprintf("%s@203.0.113.5:%d", uuid, ibA.Port)) {
t.Fatalf("inbound A lost the client's bound host and must render nothing for it: %s", joined)
}
if !strings.Contains(joined, fmt.Sprintf("%s@203.0.113.5:%d", uuid, ibB.Port)) {
t.Fatalf("inbound B never had a binding and must keep the client's link: %s", joined)
}
})
}
}
// A client bound to a disabled host fails closed on every format (no links, outbounds or proxies)
// but stays in traffic accounting, so quota and expiry headers stay correct.
func TestSub_ClientHostRule_DisabledFailsClosed(t *testing.T) {