pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-25 07:15:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(amneziawg): support persistent keepalive ranges (#6881)

Browse Source 
AmneziaWG clients accept a randomised PersistentKeepalive range such as 15-25,
which makes keepalive timing harder to fingerprint; the panel only stored a
single number. A client's keepalive may now be a range, validated the way
AmneziaWG parses it. The downloadable .conf and vpn:// profile carry the range,
Clash/Mihomo output gets its lower bound, and plain WireGuard stays scalar-only.
The range lives in an additive wg_keep_alive_range column, so the integer
column and an older panel binary keep working after a rollback.
This commit is contained in:
YoungReckless4
2026-10-24 07:36:49 +03:00
committed by GitHub
parent 207c705300
commit 35e09191de
59 changed files with 1871 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/clash_service.go
+2 -2
View File
@@ -652,7 +652,7 @@ func (s *SubClashService) buildWireguardProxy(subReq *SubService, inbound *model
if client.PreSharedKey != "" {
proxy["pre-shared-key"] = client.PreSharedKey
}
if ka := client.KeepAliveSeconds(); ka > 0 {
if ka, ok := keepAliveForScalarExport(client); ok {
proxy["persistent-keepalive"] = ka
}
for _, addr := range client.AllowedIPs {
@@ -794,7 +794,7 @@ func (s *SubClashService) buildAmneziaWGProxy(subReq *SubService, inbound *model
if client.PreSharedKey != "" {
proxy["pre-shared-key"] = client.PreSharedKey
}
if ka := client.KeepAliveSeconds(); ka > 0 {
if ka, ok := keepAliveForScalarExport(client); ok {
proxy["persistent-keepalive"] = ka
}
internal/sub/clash_service_test.go
+25
View File
@@ -4,6 +4,7 @@ import (
"encoding/json"
"fmt"
"reflect"
"strings"
"testing"
"github.com/mhsanaei/3x-ui/v3/internal/amneziawg"
@@ -1537,3 +1538,27 @@ func TestMihomoCertFingerprintUsesFirstValidPin(t *testing.T) {
})
}
}
func TestBuildAmneziaWGProxyForClashProjectsKeepAliveRangeToLowerBound(t *testing.T) {
keepAlive := model.KeepAliveValue("15-25")
client := model.Client{Email: "range@awg", PrivateKey: "client-key", KeepAlive: &keepAlive}
inbound := &model.Inbound{Protocol: model.AmneziaWG, Listen: "198.51.100.1", Port: 443, Settings: `{"server":{"privateKey":"server","publicKey":"server-pub","subnetIp":"10.8.1.0","subnetCidr":24},"clients":[]}`}
svc := NewSubClashService(false, "", false, &SubService{})
proxy := svc.buildProxy(svc.SubService, inbound, client, nil, nil)
if proxy == nil || proxy["persistent-keepalive"] != 15 {
t.Fatalf("Clash persistent-keepalive = %v, want range lower bound 15", proxy["persistent-keepalive"])
}
blob, err := marshalClashYAML(proxy)
if err != nil {
t.Fatalf("marshal Clash proxy: %v", err)
}
if !strings.Contains(string(blob), "persistent-keepalive: 15") {
t.Fatalf("Clash YAML did not preserve lower-bound projection:\n%s", blob)
}
legacyNegative := model.KeepAliveValue("-1")
client.KeepAlive = &legacyNegative
proxy = svc.buildProxy(svc.SubService, inbound, client, nil, nil)
if _, ok := proxy["persistent-keepalive"]; ok {
t.Fatalf("Clash export emitted invalid legacy keepalive: %v", proxy["persistent-keepalive"])
}
}
internal/sub/keepalive.go
+18
View File
@@ -0,0 +1,18 @@
package sub
import (
"strings"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
)
func keepAliveForScalarExport(client model.Client) (int, bool) {
if client.KeepAlive == nil {
return 0, false
}
if strings.Contains(client.KeepAliveText(), "-") && client.KeepAlive.Validate(true) == nil {
return client.KeepAlive.MinSeconds(), true
}
value := client.KeepAliveSeconds()
return value, value > 0
}
internal/sub/service.go
+5 -2
View File
@@ -1057,8 +1057,11 @@ func amneziaWGConfigText(server *amneziawg.ServerSettings, client *model.Client,
lines = append(lines, "PresharedKey = "+client.PreSharedKey)
}
lines = append(lines, "AllowedIPs = 0.0.0.0/0, ::/0", fmt.Sprintf("Endpoint = %s:%d", host, port))
if ka := client.KeepAliveSeconds(); ka > 0 {
lines = append(lines, fmt.Sprintf("PersistentKeepalive = %d", ka))
if client.KeepAlive != nil {
keepAlive := client.KeepAliveText()
if (strings.Contains(keepAlive, "-") && client.KeepAlive.Validate(true) == nil) || client.KeepAlive.Seconds() > 0 {
lines = append(lines, "PersistentKeepalive = "+keepAlive)
}
}
// A control character would split its line, and the split can re-open
internal/sub/service_amneziawg_test.go
+22 -4
View File
@@ -228,6 +228,24 @@ func TestAmneziaWGConfigTextPeerFieldOrder(t *testing.T) {
}
})
t.Run("range keepalive is preserved in native config", func(t *testing.T) {
keepAlive := model.KeepAliveValue("15-25")
client := &model.Client{PrivateKey: "clientPriv", AllowedIPs: []string{"10.8.1.2/32"}, KeepAlive: &keepAlive}
conf := amneziaWGConfigText(server, client, "203.0.113.7", 51820, "remark")
if !strings.Contains(conf, "PersistentKeepalive = 15-25") {
t.Fatalf("native config lost keepalive range:\n%s", conf)
}
})
t.Run("legacy negative keepalive is omitted", func(t *testing.T) {
keepAlive := model.KeepAliveValue("-1")
client := &model.Client{PrivateKey: "clientPriv", AllowedIPs: []string{"10.8.1.2/32"}, KeepAlive: &keepAlive}
conf := amneziaWGConfigText(server, client, "203.0.113.7", 51820, "remark")
if strings.Contains(conf, "PersistentKeepalive") {
t.Fatalf("native config emitted invalid legacy keepalive:\n%s", conf)
}
})
t.Run("no preshared key or keepalive", func(t *testing.T) {
client := &model.Client{PrivateKey: "clientPriv", AllowedIPs: []string{"10.8.1.2/32"}}
conf := amneziaWGConfigText(server, client, "203.0.113.7", 51820, "remark")
@@ -364,7 +382,7 @@ func TestGetSubs_PreservesPerInboundAmneziaWGIdentity(t *testing.T) {
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: mergedAddr,
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)
@@ -452,7 +470,7 @@ func TestGetSubs_AmneziaWGUnavailableSettingsEmitNoSharedConfig(t *testing.T) {
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: mergedAddr,
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)
@@ -515,7 +533,7 @@ func TestGetSubs_AmneziaWGEmptyOptionalTunnelFieldsDoNotInheritShared(t *testing
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: mergedAddr,
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)
@@ -580,7 +598,7 @@ func TestMatchingClients_TunnelMetadataStaysNormalized(t *testing.T) {
Email: email, SubID: subID, UUID: freshID, Enable: true,
TotalGB: 5, ExpiryTime: expiry, Comment: "vip", LimitIP: 3,
PrivateKey: sharedKey, PublicKey: "shared-pub", AllowedIPs: "10.9.9.9/32",
PreSharedKey: "shared-psk", KeepAlive: 99,
PreSharedKey: "shared-psk", KeepAlive: model.KeepAliveValue("99"),
}
other := &model.ClientRecord{
Email: "other-sub@awg", SubID: "other-sub", UUID: "22222222-2222-4333-8444-555555555555", Enable: true,
internal/sub/service_wireguard_test.go
+3 -3
View File
@@ -206,7 +206,7 @@ func TestGetSubs_PreservesPerInboundWireGuardIdentity(t *testing.T) {
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: mergedAddr,
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)
@@ -298,7 +298,7 @@ func TestGetSubs_WireGuardUnavailableSettingsEmitNoSharedConfig(t *testing.T) {
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: mergedAddr,
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)
@@ -358,7 +358,7 @@ func TestGetSubs_WireGuardEmptyOptionalTunnelFieldsDoNotInheritShared(t *testing
rec := &model.ClientRecord{
Email: email, SubID: subID, Enable: true,
PrivateKey: mergedPriv, AllowedIPs: "10.9.9.9/32,fd00:9::9/128",
PreSharedKey: "sharedpsk", KeepAlive: 25,
PreSharedKey: "sharedpsk", KeepAlive: model.KeepAliveValue("25"),
}
if err := db.Create(rec).Error; err != nil {
t.Fatalf("create client: %v", err)