mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-25 07:15:01 +03:00
feat(sub): generate random IPs from CIDR host addresses (#6784)
Operators who front a server with an IP range (a CDN or anycast prefix) had to list each address as its own host. A host address may now be a CIDR, and every subscription fetch expands it into up to randomCount (1–100, default 1) unique random host IPs from the range, IPv4 and IPv6 alike, skipping the network and broadcast addresses. The panel's own previews, QR codes and tunnel config exports (WireGuard, AmneziaWG, TUIC, MTProto) expand it the same way, and the externalProxy importer writes the model's default count so the re-sync still recognises untouched imported hosts.
This commit is contained in:
Pejman Yousefi
GitHub
@@ -0,0 +1,156 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/binary"
|
||||
"math/big"
|
||||
"net"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const MaxRandomCIDRCount = 100
|
||||
|
||||
func cleanCIDR(s string) string {
|
||||
s = strings.TrimSpace(s)
|
||||
s = strings.Trim(s, "[]")
|
||||
s = strings.TrimPrefix(s, "[")
|
||||
s = strings.Replace(s, "]/", "/", 1)
|
||||
return s
|
||||
}
|
||||
|
||||
// IsCIDR reports whether s represents a valid CIDR network notation.
|
||||
func IsCIDR(s string) bool {
|
||||
s = cleanCIDR(s)
|
||||
if !strings.Contains(s, "/") {
|
||||
return false
|
||||
}
|
||||
_, _, err := net.ParseCIDR(s)
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// RandomIPsFromCIDR returns count unique random host IPs from the specified CIDR.
|
||||
// Supported across IPv4 and IPv6; caps at the usable address space when smaller.
|
||||
func RandomIPsFromCIDR(cidr string, count int) ([]string, error) {
|
||||
if count <= 0 {
|
||||
count = 1
|
||||
} else if count > MaxRandomCIDRCount {
|
||||
count = MaxRandomCIDRCount
|
||||
}
|
||||
clean := cleanCIDR(cidr)
|
||||
_, ipNet, err := net.ParseCIDR(clean)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if ip4 := ipNet.IP.To4(); ip4 != nil {
|
||||
return randomIPv4FromCIDR(ip4, ipNet.Mask, count)
|
||||
}
|
||||
return randomIPv6FromCIDR(ipNet.IP.To16(), ipNet.Mask, count)
|
||||
}
|
||||
|
||||
func randomIPv4FromCIDR(ip4 net.IP, mask net.IPMask, count int) ([]string, error) {
|
||||
ones, bits := mask.Size()
|
||||
hostBits := bits - ones
|
||||
if hostBits == 0 {
|
||||
return []string{ip4.String()}, nil
|
||||
}
|
||||
if hostBits == 1 {
|
||||
base := binary.BigEndian.Uint32(ip4)
|
||||
out := []string{ip4.String()}
|
||||
if count > 1 {
|
||||
b := make([]byte, 4)
|
||||
binary.BigEndian.PutUint32(b, base+1)
|
||||
out = append(out, net.IP(b).String())
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
total := uint64(1) << hostBits
|
||||
// Avoid network (.0) and broadcast (.255) for /30 and larger subnets.
|
||||
usableCount := total - 2
|
||||
if usableCount == 0 {
|
||||
return []string{ip4.String()}, nil
|
||||
}
|
||||
if uint64(count) > usableCount {
|
||||
count = int(usableCount)
|
||||
}
|
||||
|
||||
baseU32 := binary.BigEndian.Uint32(ip4)
|
||||
seen := make(map[string]struct{}, count)
|
||||
result := make([]string, 0, count)
|
||||
maxOffset := big.NewInt(int64(usableCount))
|
||||
maxAttempts := count * 100
|
||||
|
||||
for len(result) < count && maxAttempts > 0 {
|
||||
maxAttempts--
|
||||
offsetBig, err := rand.Int(rand.Reader, maxOffset)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
targetU32 := baseU32 + uint32(offsetBig.Int64()+1)
|
||||
b := make([]byte, 4)
|
||||
binary.BigEndian.PutUint32(b, targetU32)
|
||||
ipStr := net.IP(b).String()
|
||||
if _, exists := seen[ipStr]; !exists {
|
||||
seen[ipStr] = struct{}{}
|
||||
result = append(result, ipStr)
|
||||
}
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func randomIPv6FromCIDR(ip6 net.IP, mask net.IPMask, count int) ([]string, error) {
|
||||
ones, bits := mask.Size()
|
||||
hostBits := bits - ones
|
||||
if hostBits == 0 {
|
||||
return []string{ip6.String()}, nil
|
||||
}
|
||||
if hostBits == 1 {
|
||||
baseInt := new(big.Int).SetBytes(ip6)
|
||||
out := []string{ip6.String()}
|
||||
if count > 1 {
|
||||
next := new(big.Int).Add(baseInt, big.NewInt(1))
|
||||
out = append(out, formatIPv6(next))
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
maxHost := new(big.Int).Lsh(big.NewInt(1), uint(hostBits))
|
||||
// Exclude the Subnet-Router Anycast address (all host bits 0, RFC 4291 §2.6.1).
|
||||
usableCount := new(big.Int).Sub(maxHost, big.NewInt(1))
|
||||
if usableCount.Cmp(big.NewInt(int64(count))) < 0 {
|
||||
count = int(usableCount.Int64())
|
||||
}
|
||||
|
||||
baseInt := new(big.Int).SetBytes(ip6)
|
||||
seen := make(map[string]struct{}, count)
|
||||
result := make([]string, 0, count)
|
||||
maxOffset := new(big.Int).Set(usableCount)
|
||||
maxAttempts := count * 100
|
||||
|
||||
for len(result) < count && maxAttempts > 0 {
|
||||
maxAttempts--
|
||||
offsetBig, err := rand.Int(rand.Reader, maxOffset)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
offset := new(big.Int).Add(offsetBig, big.NewInt(1))
|
||||
targetInt := new(big.Int).Add(baseInt, offset)
|
||||
ipStr := formatIPv6(targetInt)
|
||||
if _, exists := seen[ipStr]; !exists {
|
||||
seen[ipStr] = struct{}{}
|
||||
result = append(result, ipStr)
|
||||
}
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func formatIPv6(val *big.Int) string {
|
||||
b := val.Bytes()
|
||||
if len(b) < 16 {
|
||||
padded := make([]byte, 16)
|
||||
copy(padded[16-len(b):], b)
|
||||
b = padded
|
||||
}
|
||||
return net.IP(b).String()
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestIsCIDR(t *testing.T) {
|
||||
tests := []struct {
|
||||
input string
|
||||
want bool
|
||||
}{
|
||||
{input: "192.168.1.0/24", want: true},
|
||||
{input: "10.0.0.0/8", want: true},
|
||||
{input: "[192.168.1.0/24]", want: true},
|
||||
{input: "2a01:4f8:1c1b:729::/64", want: true},
|
||||
{input: "[2a01:4f8:1c1b:729::/64]", want: true},
|
||||
{input: "[2001:db8::]/64", want: true},
|
||||
{input: "fe80::/10", want: true},
|
||||
{input: "example.com", want: false},
|
||||
{input: "192.168.1.1", want: false},
|
||||
{input: "2001:db8::1", want: false},
|
||||
{input: "", want: false},
|
||||
{input: "invalid/33", want: false},
|
||||
{input: "999.999.999.999/24", want: false},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.input, func(t *testing.T) {
|
||||
if got := IsCIDR(tc.input); got != tc.want {
|
||||
t.Fatalf("IsCIDR(%q) = %v, want %v", tc.input, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestRandomIPsFromCIDR_IPv4(t *testing.T) {
|
||||
t.Run("single host /32", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("192.0.2.1/32", 3)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 1 || ips[0] != "192.0.2.1" {
|
||||
t.Fatalf("RandomIPsFromCIDR(/32) = %v, want [192.0.2.1]", ips)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("small subnet /30 caps count", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("198.51.100.0/30", 5)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 2 {
|
||||
t.Fatalf("len(ips) = %d, want 2", len(ips))
|
||||
}
|
||||
for _, ipStr := range ips {
|
||||
if ipStr == "198.51.100.0" || ipStr == "198.51.100.3" {
|
||||
t.Fatalf("got network or broadcast address: %s", ipStr)
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("subnet /24 generates unique IPs within range", func(t *testing.T) {
|
||||
cidr := "203.0.113.0/24"
|
||||
_, ipNet, err := net.ParseCIDR(cidr)
|
||||
if err != nil {
|
||||
t.Fatalf("parse cidr: %v", err)
|
||||
}
|
||||
|
||||
ips, err := RandomIPsFromCIDR(cidr, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 10 {
|
||||
t.Fatalf("len(ips) = %d, want 10", len(ips))
|
||||
}
|
||||
|
||||
seen := make(map[string]struct{}, len(ips))
|
||||
for _, ipStr := range ips {
|
||||
if _, dup := seen[ipStr]; dup {
|
||||
t.Fatalf("duplicate IP emitted: %s", ipStr)
|
||||
}
|
||||
seen[ipStr] = struct{}{}
|
||||
|
||||
parsed := net.ParseIP(ipStr)
|
||||
if parsed == nil || !ipNet.Contains(parsed) {
|
||||
t.Fatalf("IP %s outside expected subnet %s", ipStr, cidr)
|
||||
}
|
||||
if strings.HasSuffix(ipStr, ".0") || strings.HasSuffix(ipStr, ".255") {
|
||||
t.Fatalf("unusable host IP picked: %s", ipStr)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestRandomIPsFromCIDR_IPv6(t *testing.T) {
|
||||
t.Run("single host /128", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("2001:db8::1/128", 4)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 1 || ips[0] != "2001:db8::1" {
|
||||
t.Fatalf("RandomIPsFromCIDR(/128) = %v, want [2001:db8::1]", ips)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("standard /64 datacenter block", func(t *testing.T) {
|
||||
cidr := "2a01:4f8:1c1b:729::/64"
|
||||
_, ipNet, err := net.ParseCIDR(cidr)
|
||||
if err != nil {
|
||||
t.Fatalf("parse cidr: %v", err)
|
||||
}
|
||||
|
||||
ips, err := RandomIPsFromCIDR(cidr, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 10 {
|
||||
t.Fatalf("len(ips) = %d, want 10", len(ips))
|
||||
}
|
||||
|
||||
seen := make(map[string]struct{}, len(ips))
|
||||
for _, ipStr := range ips {
|
||||
if _, dup := seen[ipStr]; dup {
|
||||
t.Fatalf("duplicate IP emitted: %s", ipStr)
|
||||
}
|
||||
seen[ipStr] = struct{}{}
|
||||
|
||||
parsed := net.ParseIP(ipStr)
|
||||
if parsed == nil || !ipNet.Contains(parsed) {
|
||||
t.Fatalf("IP %s outside expected subnet %s", ipStr, cidr)
|
||||
}
|
||||
if ipStr == "2a01:4f8:1c1b:729::" {
|
||||
t.Fatalf("subnet-router anycast address was emitted")
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("bracketed cidr notation", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("[2a01:4f8:1c1b:729::/64]", 3)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 3 {
|
||||
t.Fatalf("len(ips) = %d, want 3", len(ips))
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("bracketed host form /64", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("[2001:db8::]/64", 3)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != 3 {
|
||||
t.Fatalf("len(ips) = %d, want 3", len(ips))
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("unbounded count clamped to MaxRandomCIDRCount", func(t *testing.T) {
|
||||
ips, err := RandomIPsFromCIDR("2001:db8::/64", 1000)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(ips) != MaxRandomCIDRCount {
|
||||
t.Fatalf("len(ips) = %d, want %d", len(ips), MaxRandomCIDRCount)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestRandomIPsFromCIDR_Invalid(t *testing.T) {
|
||||
if _, err := RandomIPsFromCIDR("example.com", 1); err == nil {
|
||||
t.Fatalf("RandomIPsFromCIDR(domain) expected error, got nil")
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,7 @@ package sub
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"maps"
|
||||
"slices"
|
||||
|
||||
@@ -34,6 +35,28 @@ func (s *SubService) hostEndpoints(inbound *model.Inbound, format string) []map[
|
||||
if slices.Contains(h.ExcludeFromSubTypes, format) {
|
||||
continue
|
||||
}
|
||||
if IsCIDR(h.Address) {
|
||||
count := h.RandomCount
|
||||
if count <= 0 {
|
||||
count = 1
|
||||
}
|
||||
ips, err := RandomIPsFromCIDR(h.Address, count)
|
||||
if err == nil && len(ips) > 0 {
|
||||
for i, ip := range ips {
|
||||
hCopy := *h
|
||||
hCopy.Address = ip
|
||||
if len(ips) > 1 {
|
||||
if h.Remark != "" {
|
||||
hCopy.Remark = fmt.Sprintf("%s - %d", h.Remark, i+1)
|
||||
} else {
|
||||
hCopy.Remark = fmt.Sprintf("%d", i+1)
|
||||
}
|
||||
}
|
||||
eps = append(eps, hostToExternalProxyMap(&hCopy, defaultDest, inbound.Port))
|
||||
}
|
||||
continue
|
||||
}
|
||||
}
|
||||
eps = append(eps, hostToExternalProxyMap(h, defaultDest, inbound.Port))
|
||||
}
|
||||
return eps
|
||||
|
||||
@@ -3,6 +3,7 @@ package sub
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/url"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
@@ -664,3 +665,113 @@ func TestSub_HostTLSVerificationJSONAtXrayLevel(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSub_HostCIDR_RawLinks(t *testing.T) {
|
||||
seedSubDB(t)
|
||||
ib := seedSubInbound(t, "s1", "cidr-raw", 4462, 1,
|
||||
`{"network":"tcp","security":"tls","tlsSettings":{"serverName":"sni.example.com"}}`)
|
||||
seedHost(t, &model.Host{
|
||||
InboundId: ib.Id,
|
||||
SortOrder: 0,
|
||||
Remark: "IPv6Node",
|
||||
Address: "2a01:4f8:1c1b:729::/64",
|
||||
Port: 8443,
|
||||
Security: "tls",
|
||||
RandomCount: 3,
|
||||
})
|
||||
|
||||
links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("GetSubs: %v", err)
|
||||
}
|
||||
parts := strings.Split(strings.Join(links, "\n"), "\n")
|
||||
if len(parts) != 3 {
|
||||
t.Fatalf("len(parts) = %d, want 3", len(parts))
|
||||
}
|
||||
|
||||
_, ipNet, _ := net.ParseCIDR("2a01:4f8:1c1b:729::/64")
|
||||
seenIPs := make(map[string]struct{}, len(parts))
|
||||
|
||||
for i, link := range parts {
|
||||
wantRemark := fmt.Sprintf("IPv6Node%%20-%%20%d", i+1)
|
||||
if !strings.Contains(link, wantRemark) {
|
||||
t.Errorf("link[%d] does not contain expected remark %q: %s", i, wantRemark, link)
|
||||
}
|
||||
|
||||
atIdx := strings.Index(link, "@")
|
||||
colonIdx := strings.LastIndex(link, ":8443")
|
||||
if atIdx == -1 || colonIdx == -1 || colonIdx <= atIdx {
|
||||
t.Fatalf("malformed link host: %s", link)
|
||||
}
|
||||
rawAddr := strings.Trim(link[atIdx+1:colonIdx], "[]")
|
||||
parsed := net.ParseIP(rawAddr)
|
||||
if parsed == nil || !ipNet.Contains(parsed) {
|
||||
t.Errorf("link[%d] IP %q not inside 2a01:4f8:1c1b:729::/64", i, rawAddr)
|
||||
}
|
||||
if _, dup := seenIPs[rawAddr]; dup {
|
||||
t.Errorf("duplicate IP %q emitted across links", rawAddr)
|
||||
}
|
||||
seenIPs[rawAddr] = struct{}{}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSub_HostCIDR_SingleCountKeepsBaseRemark(t *testing.T) {
|
||||
seedSubDB(t)
|
||||
ib := seedSubInbound(t, "s1", "cidr-single", 4463, 1,
|
||||
`{"network":"tcp","security":"none"}`)
|
||||
seedHost(t, &model.Host{
|
||||
InboundId: ib.Id,
|
||||
SortOrder: 0,
|
||||
Remark: "SingleCIDR",
|
||||
Address: "198.51.100.0/24",
|
||||
Port: 8080,
|
||||
Security: "none",
|
||||
RandomCount: 1,
|
||||
})
|
||||
|
||||
links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("GetSubs: %v", err)
|
||||
}
|
||||
parts := strings.Split(strings.Join(links, "\n"), "\n")
|
||||
if len(parts) != 1 {
|
||||
t.Fatalf("len(parts) = %d, want 1", len(parts))
|
||||
}
|
||||
if strings.Contains(parts[0], "SingleCIDR - 1") {
|
||||
t.Errorf("count=1 must not append index suffix: %s", parts[0])
|
||||
}
|
||||
if !strings.Contains(parts[0], "SingleCIDR") {
|
||||
t.Errorf("link does not contain base remark: %s", parts[0])
|
||||
}
|
||||
}
|
||||
|
||||
func TestSub_HostCIDR_ClashAndJson(t *testing.T) {
|
||||
seedSubDB(t)
|
||||
ib := seedSubInbound(t, "s1", "cidr-clash", 4464, 1,
|
||||
`{"network":"tcp","security":"none"}`)
|
||||
seedHost(t, &model.Host{
|
||||
InboundId: ib.Id,
|
||||
SortOrder: 0,
|
||||
Remark: "V4Node",
|
||||
Address: "203.0.113.0/24",
|
||||
Port: 8080,
|
||||
Security: "none",
|
||||
RandomCount: 2,
|
||||
})
|
||||
|
||||
clashYaml, _, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("GetClash: %v", err)
|
||||
}
|
||||
if !strings.Contains(clashYaml, "V4Node - 1") || !strings.Contains(clashYaml, "V4Node - 2") {
|
||||
t.Errorf("Clash YAML should contain numbered host proxies: %s", clashYaml)
|
||||
}
|
||||
|
||||
jsonDoc, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
|
||||
if err != nil {
|
||||
t.Fatalf("GetJson: %v", err)
|
||||
}
|
||||
if !strings.Contains(jsonDoc, "V4Node - 1") || !strings.Contains(jsonDoc, "V4Node - 2") {
|
||||
t.Errorf("JSON config should contain numbered host outbounds: %s", jsonDoc)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user