mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-29 17:25:01 +03:00
refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)
* refactor(service): split client.go into focused files
client.go had grown to 4455 lines mixing ~10 responsibilities. Split it
verbatim into cohesive same-package files (no behavior change):
client.go foundation: ClientService, ClientWithAttachments,
ClientCreatePayload, ErrClientNotInInbound, sqlInChunk
client_locks.go inbound mutation locks, delete tombstones, compactOrphans
client_lookup.go read-only lookups (GetByID, List, EffectiveFlow, ...)
client_link.go inbound association sync (SyncInbound, DetachInbound, ...)
client_crud.go single-client CRUD + validation + protocol defaults
client_inbound_apply.go low-level inbound-settings mutators + by-email setters
client_bulk.go bulk attach/detach/adjust/delete/create + DelDepleted
client_traffic.go traffic-reset paths
client_groups.go client group management
client_paging.go paged listing, filtering, sorting, summary
Every declaration moved unchanged (verified: identical func/type/const/var
signature set before vs after). Imports redistributed per file via goimports.
go build ./..., go vet, and go test ./web/service/... all pass.
* refactor(service): split inbound.go into focused files
inbound.go was 4100 lines. Split it verbatim into cohesive same-package
files (no behavior change):
inbound.go core inbound CRUD + InboundService (keeps pkg doc)
inbound_protocol.go protocol / stream capability helpers
inbound_node.go node/runtime/remote coordination + online tracking
inbound_traffic.go traffic accounting, reset, client stats
inbound_client_ips.go per-client IP tracking
inbound_clients.go client lookups within inbounds + copy-clients
inbound_disable.go auto-disable invalid inbounds/clients
inbound_migration.go DB migrations
inbound_sublink.go subscription link providers
inbound_util.go generic slice/string helpers
Identical func/type/const/var signature set before vs after; package doc
comment preserved on inbound.go. Imports redistributed via goimports.
Build, vet, and go test ./web/service/... all pass.
* refactor(service): split tgbot.go into focused files
tgbot.go was 3738 lines dominated by a 1246-line answerCallback. Split it
verbatim into cohesive same-package files (no behavior change):
tgbot.go lifecycle, bot setup, caches, small utils
tgbot_router.go incoming update / command / callback dispatch
tgbot_send.go outbound messaging primitives
tgbot_client.go client views, actions, subscription links
tgbot_inbound.go inbound listing / pickers
tgbot_report.go server usage, exhausted, online, backups, notifications
Identical func/type/const/var signature set before vs after. Imports
redistributed via goimports. Build, vet, and go test ./web/service/... pass.
* refactor(client): dedupe single-field by-email setters
ResetClientIpLimitByEmail, ResetClientExpiryTimeByEmail, and
ResetClientTrafficLimitByEmail shared an identical ~50-line body that
resolves the inbound by email, confirms the client exists, rewrites a
single-client settings payload, and delegates to UpdateInboundClient.
Extract that into applyClientFieldByEmail(inboundSvc, email, mutate) and
reduce each setter to a 3-line wrapper. Behavior is unchanged: same checks
and error strings, same single-client payload contract, same totalGB guard.
SetClientTelegramUserID (resolves by traffic id, different error text) and
ToggleClientEnableByEmail/SetClientEnableByEmail (different return shape and
a pre-read of the old state) intentionally keep their own bodies.
* refactor(service): extract panel/ subpackage
Move the panel-administration leaf services out of the flat service
package into web/service/panel/ (package panel):
user.go UserService (auth / 2FA / LDAP)
panel.go PanelService (restart / self-update) + version helpers
panel_other.go non-unix RestartPanel
panel_unix.go unix RestartPanel
api_token.go ApiTokenService
websocket.go WebSocketService
panel_test.go version/shellQuote unit tests
These are leaves: they depend on core (SettingService, Release) but no
core file references them, so the extraction creates no import cycle.
Core references are now qualified (service.SettingService, service.Release);
callers in main.go, web/web.go, and web/controller/* updated to panel.*.
Build, vet, and go test ./web/... pass.
* refactor(service): extract integration/ subpackage
Move the external-provider integration leaves into web/service/integration/
(package integration):
warp.go WarpService (Cloudflare WARP)
nord.go NordService (NordVPN)
custom_geo.go CustomGeoService (custom geo asset management)
*_test.go custom_geo / panel-proxy tests
These depend on core (SettingService, ServerService, XraySettingService) but
no core file references them. xray_setting.go stays in core because it calls
the unexported SettingService.saveSetting. The shared isBlockedIP SSRF helper
(used by core url_safety.go and by custom_geo) now has a small copy in each
package rather than being exported. Core references qualified; callers in
web/web.go, web/job/*, and web/controller/* updated to integration.*.
Build, vet, and go test ./web/... pass.
* refactor(service): extract tgbot/ subpackage
Move the Telegram bot (6 files + test) into web/service/tgbot/ (package
tgbot). It is a leaf: it embeds five core services (Inbound/Client/Setting/
Server/Xray) and the core never references it, so no import cycle.
To support the package boundary without changing behavior:
- core exposes XrayProcess() *xray.Process so tgbot keeps calling the
exact same running-process methods it used via the package-level `p`;
- three core methods tgbot calls are exported: ClientService.checkIs-
EnabledByEmail -> CheckIsEnabledByEmail, InboundService.getAllEmails ->
GetAllEmails (callers updated in-package);
- tgbot's embedded-field types and the few core type refs (Status,
ClientCreatePayload, SanitizePublicHTTPURL) are now service-qualified.
Callers in main.go, web/web.go, web/job/*, and web/controller/* updated to
tgbot.*. Build, vet, and go test ./web/... pass.
* refactor(service): extract outbound/ subpackage
OutboundService (outbound.go) imports only neutral packages (config,
database, model, xray) and its production code is referenced by no core or
sibling service file — only by web/controller/xray_setting.go and
web/job/xray_traffic_job.go. Move it to web/service/outbound/ (package
outbound); no core qualification needed inside. Callers updated to outbound.*.
The one coupling was a tiny pure test helper, outboundsContainTag, used by
both outbound.go and the core outbound_subscription_test.go; it now has a
small copy in that test file rather than being shared across the boundary.
Build, vet, and go test ./web/... pass.
* refactor(util): move wireguard into its own subpackage
util/wireguard.go was the lone file of the root `util` package (24 lines,
one exported func GenerateWireguardKeypair), while every other util concern
lives in a focused subpackage (util/common, util/crypto, util/netsafe, ...).
Move it to util/wireguard/ (package wireguard) for consistency; its only
importer, web/service/integration/warp.go, is updated. The root `util`
package no longer exists.
* refactor(sub): drop redundant sub prefix from filenames
Inside package sub the subXxx.go prefix just repeats the package name
(like client_*.go did inside service). Rename for consistency; content and
type names are unchanged:
subController.go -> controller.go
subService.go -> service.go
subClashService.go -> clash_service.go
subJsonService.go -> json_service.go
(+ matching _test.go files)
* refactor(controller): rename xui.go -> spa.go
XUIController serves the panel's single-page-app shell; spa.go names that
role plainly (the other controller files are domain-named). File rename only
— the type stays XUIController. api_docs_test.go keys route base paths by
filename, so its "xui.go" case is updated to "spa.go".
* refactor: move backend packages under internal/
Adopt the idiomatic Go application layout: the backend packages now live
under internal/ (a boundary the toolchain enforces), signalling private
implementation instead of a library-style flat root. No runtime behavior
changes — only import paths and a few build/config paths move.
Moved: config, database, logger, mtproto, sub, util, web, xray -> internal/.
main.go stays at the repo root and tools/openapigen stays under tools/ (both
still import internal/* because the internal rule keys off the module root).
The module path github.com/mhsanaei/3x-ui/v3 is unchanged; 149 .go files had
their import prefix rewritten to .../internal/<pkg>.
Couplings the Go compiler can't see, updated to the new layout:
- frontend i18n imports of web/translation (react.ts, setup.components.ts)
- vite outDir + eslint/tsconfig ignore globs -> internal/web/dist
- Dockerfile COPY paths for web/dist and web/translation
- locale.go os.DirFS("web") disk fallback -> "internal/web"
- .gitignore and ci.yml go:embed stub for internal/web/dist
- api_docs_test.go repo-root relative walk (one level deeper)
- tools/openapigen filesystem package paths; ApiTokenView repointed to the
web/service/panel subpackage and codegen regenerated (clears a stale
type the ci.yml codegen check was failing on)
Verified: go build/vet/test (all packages), and frontend typecheck, lint,
vitest (478 tests), and production build into internal/web/dist.
* fix(config): keep test runs from writing logs into the source tree
GetLogFolder() returns a CWD-relative "./log" on Windows. Under `go test`
the working directory is each package's own folder, so InitLogger (called by
tests in web/job, web/service, xray, web/websocket) created stray log/
directories scattered through the source tree (e.g. internal/web/job/log/).
Redirect to a shared temp folder when testing.Testing() reports a test run.
Production behavior is unchanged: Windows still uses ./log next to the binary
and Linux /var/log/x-ui. The log files were always gitignored (*.log) and
never committed; this just stops the noise at the source.
* docs: move subscription-template guide out of root into docs/
sub_templates/ was a top-level folder holding only a README and no actual
templates (3x-ui ships none by design), referenced nowhere and unlinked from
any doc — it read like an empty placeholder cluttering the repo root.
Move the guide to docs/custom-subscription-templates.md (a proper docs home),
reword its intro to read as documentation rather than a folder note, link it
from the Features list in README.md, and drop the empty sub_templates/ folder.
* fix: update stale web/ path references after the internal/ move
The internal/ migration rewrote Go import paths but left some references to
the old top-level layout in docs, comments, and a few runtime disk paths.
Functional (dev-mode only): the disk-serving fallbacks that read the Vite
build from disk when running from source still pointed at web/dist/, which
moved to internal/web/dist/ — so `os.DirFS`/`os.Stat`/`os.ReadFile` in
internal/web/web.go and internal/sub/{sub,controller}.go are corrected.
Production was unaffected (it serves the embedded FS; verified by the Docker
build), but `go run` with a live frontend build silently fell back to embed.
Docs/comments: frontend/README.md, CONTRIBUTING.md, the claude-issue-bot and
release workflows, the openapigen -root help text, and assorted Go comments
now reference internal/web, internal/database, internal/sub, internal/xray,
etc. Package-name mentions (the "web" package), root paths (main.go,
frontend/, install scripts, /etc/x-ui), routes (/panel/api/xray), and the
historical "web/assets no longer exists" note were intentionally left as-is.
* refactor(web): remove the legacy /xui -> /panel redirect middleware
RedirectMiddleware existed only for backward compatibility with the old
`/xui` URL scheme (301-redirecting /xui and /xui/API to /panel and
/panel/api). That cutover was long ago, so drop the middleware, its
registration in initRouter, and the now-inaccurate "URL redirection"
mention in the middleware package doc. Old /xui URLs now 404 like any other
unknown path. HTTPS auto-redirect and auth redirects are unrelated and stay.
* build: fix .dockerignore for internal/ layout and exclude runtime dir
- web/dist -> internal/web/dist: the embedded frontend moved under internal/,
so the stale exclude no longer matched and the locally-built dist could be
sent to the build context (the frontend stage rebuilds it fresh anyway).
- exclude x-ui/: the local runtime directory (SQLite db, geo .dat files, xray
binaries, certs — ~150MB) was being shipped into the build context for no
reason. Verified the pattern excludes only the directory and still keeps
x-ui.sh, which the Dockerfile copies to /usr/bin/x-ui.
This commit is contained in:
Sanaei
GitHub
@@ -0,0 +1,197 @@
|
||||
// Package config provides configuration management utilities for the 3x-ui panel,
|
||||
// including version information, logging levels, database paths, and environment variable handling.
|
||||
package config
|
||||
|
||||
import (
|
||||
_ "embed"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
//go:embed version
|
||||
var version string
|
||||
|
||||
//go:embed name
|
||||
var name string
|
||||
|
||||
// LogLevel represents the logging level for the application.
|
||||
type LogLevel string
|
||||
|
||||
// Logging level constants
|
||||
const (
|
||||
Debug LogLevel = "debug"
|
||||
Info LogLevel = "info"
|
||||
Notice LogLevel = "notice"
|
||||
Warning LogLevel = "warning"
|
||||
Error LogLevel = "error"
|
||||
)
|
||||
|
||||
// GetVersion returns the version string of the 3x-ui application.
|
||||
func GetVersion() string {
|
||||
return strings.TrimSpace(version)
|
||||
}
|
||||
|
||||
// GetName returns the name of the 3x-ui application.
|
||||
func GetName() string {
|
||||
return strings.TrimSpace(name)
|
||||
}
|
||||
|
||||
// GetLogLevel returns the current logging level based on environment variables or defaults to Info.
|
||||
func GetLogLevel() LogLevel {
|
||||
if IsDebug() {
|
||||
return Debug
|
||||
}
|
||||
logLevel := os.Getenv("XUI_LOG_LEVEL")
|
||||
if logLevel == "" {
|
||||
return Info
|
||||
}
|
||||
return LogLevel(logLevel)
|
||||
}
|
||||
|
||||
// IsDebug returns true if debug mode is enabled via the XUI_DEBUG environment variable.
|
||||
func IsDebug() bool {
|
||||
return os.Getenv("XUI_DEBUG") == "true"
|
||||
}
|
||||
|
||||
// IsSkipHSTS returns true if skipping HSTS mode is enabled via the XUI_SKIP_HSTS environment variable.
|
||||
func IsSkipHSTS() bool {
|
||||
return os.Getenv("XUI_SKIP_HSTS") == "true"
|
||||
}
|
||||
|
||||
// GetBinFolderPath returns the path to the binary folder, defaulting to "bin" if not set via XUI_BIN_FOLDER.
|
||||
func GetBinFolderPath() string {
|
||||
binFolderPath := os.Getenv("XUI_BIN_FOLDER")
|
||||
if binFolderPath == "" {
|
||||
binFolderPath = "bin"
|
||||
}
|
||||
return binFolderPath
|
||||
}
|
||||
|
||||
func getBaseDir() string {
|
||||
exePath, err := os.Executable()
|
||||
if err != nil {
|
||||
return "."
|
||||
}
|
||||
exeDir := filepath.Dir(exePath)
|
||||
exeDirLower := strings.ToLower(filepath.ToSlash(exeDir))
|
||||
if strings.Contains(exeDirLower, "/appdata/local/temp/") || strings.Contains(exeDirLower, "/go-build") {
|
||||
wd, err := os.Getwd()
|
||||
if err != nil {
|
||||
return "."
|
||||
}
|
||||
return wd
|
||||
}
|
||||
return exeDir
|
||||
}
|
||||
|
||||
// GetDBFolderPath returns the path to the database folder based on environment variables or platform defaults.
|
||||
func GetDBFolderPath() string {
|
||||
dbFolderPath := os.Getenv("XUI_DB_FOLDER")
|
||||
if dbFolderPath != "" {
|
||||
return dbFolderPath
|
||||
}
|
||||
if runtime.GOOS == "windows" {
|
||||
return getBaseDir()
|
||||
}
|
||||
return "/etc/x-ui"
|
||||
}
|
||||
|
||||
// GetDBPath returns the full path to the database file.
|
||||
func GetDBPath() string {
|
||||
return fmt.Sprintf("%s/%s.db", GetDBFolderPath(), GetName())
|
||||
}
|
||||
|
||||
// GetDBKind returns the configured database backend: "sqlite" (default) or "postgres".
|
||||
func GetDBKind() string {
|
||||
v := strings.ToLower(strings.TrimSpace(os.Getenv("XUI_DB_TYPE")))
|
||||
switch v {
|
||||
case "postgres", "postgresql", "pg":
|
||||
return "postgres"
|
||||
default:
|
||||
return "sqlite"
|
||||
}
|
||||
}
|
||||
|
||||
// GetDBDSN returns the PostgreSQL DSN from XUI_DB_DSN. Empty for sqlite.
|
||||
func GetDBDSN() string {
|
||||
return strings.TrimSpace(os.Getenv("XUI_DB_DSN"))
|
||||
}
|
||||
|
||||
// GetEnvFilePaths returns the candidate service environment file paths (the file
|
||||
// systemd loads via EnvironmentFile) across the supported distro families.
|
||||
func GetEnvFilePaths() []string {
|
||||
if runtime.GOOS == "windows" {
|
||||
return nil
|
||||
}
|
||||
return []string{
|
||||
"/etc/default/x-ui",
|
||||
"/etc/conf.d/x-ui",
|
||||
"/etc/sysconfig/x-ui",
|
||||
}
|
||||
}
|
||||
|
||||
// GetLogFolder returns the path to the log folder based on environment variables or platform defaults.
|
||||
func GetLogFolder() string {
|
||||
logFolderPath := os.Getenv("XUI_LOG_FOLDER")
|
||||
if logFolderPath != "" {
|
||||
return logFolderPath
|
||||
}
|
||||
// Under `go test` the Windows default below is CWD-relative ("./log"), which
|
||||
// scatters a log/ directory through the source tree (one per tested package).
|
||||
// Redirect test runs to a shared temp folder so the source tree stays clean.
|
||||
if testing.Testing() {
|
||||
return filepath.Join(os.TempDir(), "3x-ui-test-log")
|
||||
}
|
||||
if runtime.GOOS == "windows" {
|
||||
return filepath.Join(".", "log")
|
||||
}
|
||||
return "/var/log/x-ui"
|
||||
}
|
||||
|
||||
func copyFile(src, dst string) error {
|
||||
in, err := os.Open(src)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer in.Close()
|
||||
|
||||
out, err := os.Create(dst)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer out.Close()
|
||||
|
||||
_, err = io.Copy(out, in)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return out.Sync()
|
||||
}
|
||||
|
||||
func init() {
|
||||
if runtime.GOOS != "windows" {
|
||||
return
|
||||
}
|
||||
if os.Getenv("XUI_DB_FOLDER") != "" {
|
||||
return
|
||||
}
|
||||
oldDBFolder := "/etc/x-ui"
|
||||
oldDBPath := fmt.Sprintf("%s/%s.db", oldDBFolder, GetName())
|
||||
newDBFolder := GetDBFolderPath()
|
||||
newDBPath := fmt.Sprintf("%s/%s.db", newDBFolder, GetName())
|
||||
_, err := os.Stat(newDBPath)
|
||||
if err == nil {
|
||||
return // new exists
|
||||
}
|
||||
_, err = os.Stat(oldDBPath)
|
||||
if os.IsNotExist(err) {
|
||||
return // old does not exist
|
||||
}
|
||||
_ = copyFile(oldDBPath, newDBPath) // ignore error
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
x-ui
|
||||
@@ -0,0 +1 @@
|
||||
3.3.0
|
||||
@@ -0,0 +1,850 @@
|
||||
// Package database provides database initialization, migration, and management utilities
|
||||
// for the 3x-ui panel using GORM with SQLite or PostgreSQL.
|
||||
package database
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io"
|
||||
"log"
|
||||
"math"
|
||||
"os"
|
||||
"path"
|
||||
"slices"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/config"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/random"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
|
||||
"gorm.io/driver/postgres"
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
var db *gorm.DB
|
||||
|
||||
const (
|
||||
DialectSQLite = "sqlite"
|
||||
DialectPostgres = "postgres"
|
||||
)
|
||||
|
||||
// IsPostgres reports whether the active connection is a PostgreSQL backend.
|
||||
func IsPostgres() bool {
|
||||
if db == nil {
|
||||
return config.GetDBKind() == "postgres"
|
||||
}
|
||||
return db.Dialector.Name() == "postgres"
|
||||
}
|
||||
|
||||
// Dialect returns the active GORM dialect name, or "" if the DB is not open.
|
||||
func Dialect() string {
|
||||
if db == nil {
|
||||
return ""
|
||||
}
|
||||
return db.Dialector.Name()
|
||||
}
|
||||
|
||||
const (
|
||||
defaultUsername = "admin"
|
||||
defaultPassword = "admin"
|
||||
)
|
||||
|
||||
func initModels() error {
|
||||
models := []any{
|
||||
&model.User{},
|
||||
&model.Inbound{},
|
||||
&model.OutboundTraffics{},
|
||||
&model.Setting{},
|
||||
&model.InboundClientIps{},
|
||||
&xray.ClientTraffic{},
|
||||
&model.HistoryOfSeeders{},
|
||||
&model.CustomGeoResource{},
|
||||
&model.Node{},
|
||||
&model.ApiToken{},
|
||||
&model.ClientRecord{},
|
||||
&model.ClientInbound{},
|
||||
&model.ClientGroup{},
|
||||
&model.InboundFallback{},
|
||||
&model.NodeClientTraffic{},
|
||||
&model.OutboundSubscription{},
|
||||
}
|
||||
for _, mdl := range models {
|
||||
if err := db.AutoMigrate(mdl); err != nil {
|
||||
if isIgnorableDuplicateColumnErr(err, mdl) {
|
||||
log.Printf("Ignoring duplicate column during auto migration for %T: %v", mdl, err)
|
||||
continue
|
||||
}
|
||||
log.Printf("Error auto migrating model: %v", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err := dropLegacyForeignKeys(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := pruneOrphanedClientInbounds(); err != nil {
|
||||
return err
|
||||
}
|
||||
if IsPostgres() {
|
||||
if err := resyncPostgresSequences(db, models); err != nil {
|
||||
log.Printf("Error resyncing postgres sequences: %v", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func dropLegacyForeignKeys() error {
|
||||
if !IsPostgres() {
|
||||
return nil
|
||||
}
|
||||
if err := db.Exec("ALTER TABLE client_traffics DROP CONSTRAINT IF EXISTS fk_inbounds_client_stats").Error; err != nil {
|
||||
log.Printf("Error dropping legacy foreign key fk_inbounds_client_stats: %v", err)
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func pruneOrphanedClientInbounds() error {
|
||||
res := db.Exec("DELETE FROM client_inbounds WHERE inbound_id NOT IN (SELECT id FROM inbounds)")
|
||||
if res.Error != nil {
|
||||
log.Printf("Error pruning orphaned client_inbounds rows: %v", res.Error)
|
||||
return res.Error
|
||||
}
|
||||
if res.RowsAffected > 0 {
|
||||
log.Printf("Pruned %d orphaned client_inbounds row(s)", res.RowsAffected)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func isIgnorableDuplicateColumnErr(err error, mdl any) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
errMsg := strings.ToLower(err.Error())
|
||||
// SQLite: "duplicate column name: foo"
|
||||
// Postgres: `pq: column "foo" of relation "bar" already exists` / `sqlstate 42701`
|
||||
const sqlitePrefix = "duplicate column name:"
|
||||
if _, after, ok := strings.Cut(errMsg, sqlitePrefix); ok {
|
||||
col := strings.TrimSpace(after)
|
||||
col = strings.Trim(col, "`\"[]")
|
||||
return col != "" && db != nil && db.Migrator().HasColumn(mdl, col)
|
||||
}
|
||||
if strings.Contains(errMsg, "already exists") && strings.Contains(errMsg, "column ") {
|
||||
// Best effort: extract the column name between the first pair of double quotes.
|
||||
if _, after, ok := strings.Cut(errMsg, "column \""); ok {
|
||||
rest := after
|
||||
if e := strings.Index(rest, "\""); e > 0 {
|
||||
col := rest[:e]
|
||||
return col != "" && db != nil && db.Migrator().HasColumn(mdl, col)
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// initUser creates a default admin user if the users table is empty.
|
||||
func initUser() error {
|
||||
empty, err := isTableEmpty("users")
|
||||
if err != nil {
|
||||
log.Printf("Error checking if users table is empty: %v", err)
|
||||
return err
|
||||
}
|
||||
if empty {
|
||||
hashedPassword, err := crypto.HashPasswordAsBcrypt(defaultPassword)
|
||||
|
||||
if err != nil {
|
||||
log.Printf("Error hashing default password: %v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
user := &model.User{
|
||||
Username: defaultUsername,
|
||||
Password: hashedPassword,
|
||||
}
|
||||
return db.Create(user).Error
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// runSeeders migrates user passwords to bcrypt and records seeder execution to prevent re-running.
|
||||
func runSeeders(isUsersEmpty bool) error {
|
||||
empty, err := isTableEmpty("history_of_seeders")
|
||||
if err != nil {
|
||||
log.Printf("Error checking if users table is empty: %v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
if empty && isUsersEmpty {
|
||||
seeders := []string{"UserPasswordHash", "ClientsTable", "InboundClientsArrayFix", "InboundClientTgIdFix", "InboundClientSubIdFix", "FreedomFinalRulesReverseFix", "ApiTokensHash"}
|
||||
for _, name := range seeders {
|
||||
if err := db.Create(&model.HistoryOfSeeders{SeederName: name}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return seedApiTokens()
|
||||
}
|
||||
|
||||
var seedersHistory []string
|
||||
if err := db.Model(&model.HistoryOfSeeders{}).Pluck("seeder_name", &seedersHistory).Error; err != nil {
|
||||
log.Printf("Error fetching seeder history: %v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "UserPasswordHash") && !isUsersEmpty {
|
||||
var users []model.User
|
||||
if err := db.Find(&users).Error; err != nil {
|
||||
log.Printf("Error fetching users for password migration: %v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
for _, user := range users {
|
||||
if crypto.IsHashed(user.Password) {
|
||||
continue
|
||||
}
|
||||
hashedPassword, err := crypto.HashPasswordAsBcrypt(user.Password)
|
||||
if err != nil {
|
||||
log.Printf("Error hashing password for user '%s': %v", user.Username, err)
|
||||
return err
|
||||
}
|
||||
if err := db.Model(&user).Update("password", hashedPassword).Error; err != nil {
|
||||
log.Printf("Error updating password for user '%s': %v", user.Username, err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
hashSeeder := &model.HistoryOfSeeders{
|
||||
SeederName: "UserPasswordHash",
|
||||
}
|
||||
if err := db.Create(hashSeeder).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "ApiTokensTable") {
|
||||
if err := seedApiTokens(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "ApiTokensHash") {
|
||||
if err := hashExistingApiTokens(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "ClientsTable") {
|
||||
if err := seedClientsFromInboundJSON(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "InboundClientsArrayFix") {
|
||||
if err := normalizeInboundClientsArray(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "InboundClientTgIdFix") {
|
||||
if err := normalizeInboundClientTgId(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "InboundClientSubIdFix") {
|
||||
if err := normalizeInboundClientSubId(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if !slices.Contains(seedersHistory, "FreedomFinalRulesReverseFix") {
|
||||
if err := normalizeFreedomFinalRules(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func normalizeInboundClientTgId() error {
|
||||
var inbounds []model.Inbound
|
||||
if err := db.Find(&inbounds).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return db.Transaction(func(tx *gorm.DB) error {
|
||||
for _, inbound := range inbounds {
|
||||
if strings.TrimSpace(inbound.Settings) == "" {
|
||||
continue
|
||||
}
|
||||
var settings map[string]any
|
||||
if err := json.Unmarshal([]byte(inbound.Settings), &settings); err != nil {
|
||||
log.Printf("InboundClientTgIdFix: skip inbound %d (invalid settings json): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
clients, ok := settings["clients"].([]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
mutated := false
|
||||
for i, raw := range clients {
|
||||
obj, ok := raw.(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
tgRaw, present := obj["tgId"]
|
||||
if !present {
|
||||
continue
|
||||
}
|
||||
v, isFloat := tgRaw.(float64)
|
||||
if isFloat && !math.IsNaN(v) && !math.IsInf(v, 0) && v == math.Trunc(v) {
|
||||
continue
|
||||
}
|
||||
obj["tgId"] = int64(0)
|
||||
clients[i] = obj
|
||||
mutated = true
|
||||
}
|
||||
if !mutated {
|
||||
continue
|
||||
}
|
||||
settings["clients"] = clients
|
||||
newSettings, err := json.MarshalIndent(settings, "", " ")
|
||||
if err != nil {
|
||||
log.Printf("InboundClientTgIdFix: skip inbound %d (marshal failed): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
if err := tx.Model(&model.Inbound{}).Where("id = ?", inbound.Id).
|
||||
Update("settings", string(newSettings)).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return tx.Create(&model.HistoryOfSeeders{SeederName: "InboundClientTgIdFix"}).Error
|
||||
})
|
||||
}
|
||||
|
||||
func normalizeInboundClientSubId() error {
|
||||
var inbounds []model.Inbound
|
||||
if err := db.Find(&inbounds).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return db.Transaction(func(tx *gorm.DB) error {
|
||||
for _, inbound := range inbounds {
|
||||
if strings.TrimSpace(inbound.Settings) == "" {
|
||||
continue
|
||||
}
|
||||
var settings map[string]any
|
||||
if err := json.Unmarshal([]byte(inbound.Settings), &settings); err != nil {
|
||||
log.Printf("InboundClientSubIdFix: skip inbound %d (invalid settings json): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
clients, ok := settings["clients"].([]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
mutated := false
|
||||
for i, raw := range clients {
|
||||
obj, ok := raw.(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
existing, _ := obj["subId"].(string)
|
||||
if strings.TrimSpace(existing) != "" {
|
||||
continue
|
||||
}
|
||||
obj["subId"] = random.NumLower(16)
|
||||
clients[i] = obj
|
||||
mutated = true
|
||||
}
|
||||
if !mutated {
|
||||
continue
|
||||
}
|
||||
settings["clients"] = clients
|
||||
newSettings, err := json.MarshalIndent(settings, "", " ")
|
||||
if err != nil {
|
||||
log.Printf("InboundClientSubIdFix: skip inbound %d (marshal failed): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
if err := tx.Model(&model.Inbound{}).Where("id = ?", inbound.Id).
|
||||
Update("settings", string(newSettings)).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return tx.Create(&model.HistoryOfSeeders{SeederName: "InboundClientSubIdFix"}).Error
|
||||
})
|
||||
}
|
||||
|
||||
func normalizeInboundClientsArray() error {
|
||||
var inbounds []model.Inbound
|
||||
if err := db.Find(&inbounds).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return db.Transaction(func(tx *gorm.DB) error {
|
||||
for _, inbound := range inbounds {
|
||||
if strings.TrimSpace(inbound.Settings) == "" {
|
||||
continue
|
||||
}
|
||||
var settings map[string]any
|
||||
if err := json.Unmarshal([]byte(inbound.Settings), &settings); err != nil {
|
||||
log.Printf("InboundClientsArrayFix: skip inbound %d (invalid settings json): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
raw, exists := settings["clients"]
|
||||
if !exists || raw != nil {
|
||||
continue
|
||||
}
|
||||
settings["clients"] = []any{}
|
||||
newSettings, err := json.MarshalIndent(settings, "", " ")
|
||||
if err != nil {
|
||||
log.Printf("InboundClientsArrayFix: skip inbound %d (marshal failed): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
if err := tx.Model(&model.Inbound{}).Where("id = ?", inbound.Id).
|
||||
Update("settings", string(newSettings)).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return tx.Create(&model.HistoryOfSeeders{SeederName: "InboundClientsArrayFix"}).Error
|
||||
})
|
||||
}
|
||||
|
||||
func normalizeFreedomFinalRules() error {
|
||||
var setting model.Setting
|
||||
err := db.Model(model.Setting{}).Where("key = ?", "xrayTemplateConfig").First(&setting).Error
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
return db.Create(&model.HistoryOfSeeders{SeederName: "FreedomFinalRulesReverseFix"}).Error
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
updated, changed, rErr := rewriteFreedomFinalRules(setting.Value)
|
||||
if rErr != nil {
|
||||
log.Printf("FreedomFinalRulesReverseFix: skip (invalid xrayTemplateConfig json): %v", rErr)
|
||||
return db.Create(&model.HistoryOfSeeders{SeederName: "FreedomFinalRulesReverseFix"}).Error
|
||||
}
|
||||
|
||||
return db.Transaction(func(tx *gorm.DB) error {
|
||||
if changed {
|
||||
if err := tx.Model(&model.Setting{}).Where("key = ?", "xrayTemplateConfig").
|
||||
Update("value", updated).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return tx.Create(&model.HistoryOfSeeders{SeederName: "FreedomFinalRulesReverseFix"}).Error
|
||||
})
|
||||
}
|
||||
|
||||
func rewriteFreedomFinalRules(raw string) (string, bool, error) {
|
||||
if strings.TrimSpace(raw) == "" {
|
||||
return raw, false, nil
|
||||
}
|
||||
var cfg map[string]any
|
||||
if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
|
||||
return raw, false, err
|
||||
}
|
||||
outbounds, ok := cfg["outbounds"].([]any)
|
||||
if !ok {
|
||||
return raw, false, nil
|
||||
}
|
||||
changed := false
|
||||
for _, ob := range outbounds {
|
||||
obj, ok := ob.(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
if proto, _ := obj["protocol"].(string); proto != "freedom" {
|
||||
continue
|
||||
}
|
||||
settings, ok := obj["settings"].(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
if !isLegacyPrivateOnlyFinalRules(settings["finalRules"]) {
|
||||
continue
|
||||
}
|
||||
settings["finalRules"] = []any{map[string]any{"action": "allow"}}
|
||||
changed = true
|
||||
}
|
||||
if !changed {
|
||||
return raw, false, nil
|
||||
}
|
||||
out, err := json.MarshalIndent(cfg, "", " ")
|
||||
if err != nil {
|
||||
return raw, false, err
|
||||
}
|
||||
return string(out), true, nil
|
||||
}
|
||||
|
||||
func isLegacyPrivateOnlyFinalRules(v any) bool {
|
||||
rules, ok := v.([]any)
|
||||
if !ok || len(rules) != 1 {
|
||||
return false
|
||||
}
|
||||
rule, ok := rules[0].(map[string]any)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
if action, _ := rule["action"].(string); action != "allow" {
|
||||
return false
|
||||
}
|
||||
ips, ok := rule["ip"].([]any)
|
||||
if !ok || len(ips) != 1 {
|
||||
return false
|
||||
}
|
||||
if s, _ := ips[0].(string); s != "geoip:private" {
|
||||
return false
|
||||
}
|
||||
for k := range rule {
|
||||
if k != "action" && k != "ip" {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// normalizeClientJSONFields coerces loosely-typed numeric fields in a raw
|
||||
// settings.clients entry so json.Unmarshal into model.Client doesn't fail
|
||||
// when older rows wrote tgId/limitIp/totalGB/etc. as strings. Empty strings
|
||||
// drop the key so the field falls back to its zero value.
|
||||
func normalizeClientJSONFields(obj map[string]any) {
|
||||
normalizeInt := func(key string) {
|
||||
raw, exists := obj[key]
|
||||
if !exists {
|
||||
return
|
||||
}
|
||||
s, ok := raw.(string)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
trimmed := strings.ReplaceAll(strings.TrimSpace(s), " ", "")
|
||||
if trimmed == "" {
|
||||
delete(obj, key)
|
||||
return
|
||||
}
|
||||
if n, err := strconv.ParseInt(trimmed, 10, 64); err == nil {
|
||||
obj[key] = n
|
||||
} else {
|
||||
delete(obj, key)
|
||||
}
|
||||
}
|
||||
for _, k := range []string{"tgId", "limitIp", "totalGB", "expiryTime", "reset", "created_at", "updated_at"} {
|
||||
normalizeInt(k)
|
||||
}
|
||||
}
|
||||
|
||||
func seedClientsFromInboundJSON() error {
|
||||
var inbounds []model.Inbound
|
||||
if err := db.Find(&inbounds).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return db.Transaction(func(tx *gorm.DB) error {
|
||||
byEmail := map[string]*model.ClientRecord{}
|
||||
|
||||
var existing []model.ClientRecord
|
||||
if err := tx.Find(&existing).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
for i := range existing {
|
||||
byEmail[existing[i].Email] = &existing[i]
|
||||
}
|
||||
|
||||
for _, inbound := range inbounds {
|
||||
if strings.TrimSpace(inbound.Settings) == "" {
|
||||
continue
|
||||
}
|
||||
var settings map[string]any
|
||||
if err := json.Unmarshal([]byte(inbound.Settings), &settings); err != nil {
|
||||
log.Printf("ClientsTable seed: skip inbound %d (invalid settings json): %v", inbound.Id, err)
|
||||
continue
|
||||
}
|
||||
rawList, ok := settings["clients"].([]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
for _, raw := range rawList {
|
||||
obj, ok := raw.(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
normalizeClientJSONFields(obj)
|
||||
blob, err := json.Marshal(obj)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
var c model.Client
|
||||
if err := json.Unmarshal(blob, &c); err != nil {
|
||||
log.Printf("ClientsTable seed: skip client in inbound %d (unmarshal failed): %v; payload=%s",
|
||||
inbound.Id, err, string(blob))
|
||||
continue
|
||||
}
|
||||
email := strings.TrimSpace(c.Email)
|
||||
if email == "" {
|
||||
continue
|
||||
}
|
||||
incoming := c.ToRecord()
|
||||
|
||||
row, dup := byEmail[email]
|
||||
if !dup {
|
||||
if err := tx.Create(incoming).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
byEmail[email] = incoming
|
||||
row = incoming
|
||||
} else {
|
||||
conflicts := model.MergeClientRecord(row, incoming)
|
||||
for _, x := range conflicts {
|
||||
log.Printf("client merge: email=%s conflict on %s old=%v new=%v kept=%v",
|
||||
email, x.Field, x.Old, x.New, x.Kept)
|
||||
}
|
||||
if err := tx.Save(row).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
link := model.ClientInbound{
|
||||
ClientId: row.Id,
|
||||
InboundId: inbound.Id,
|
||||
FlowOverride: c.Flow,
|
||||
}
|
||||
if err := tx.Where("client_id = ? AND inbound_id = ?", row.Id, inbound.Id).
|
||||
FirstOrCreate(&link).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return tx.Create(&model.HistoryOfSeeders{SeederName: "ClientsTable"}).Error
|
||||
})
|
||||
}
|
||||
|
||||
// seedApiTokens copies the legacy `apiToken` setting into the new
|
||||
// api_tokens table as a row named "default" so existing central panels
|
||||
// keep working after the upgrade. Idempotent — records itself in
|
||||
// history_of_seeders and only runs when api_tokens is empty.
|
||||
func seedApiTokens() error {
|
||||
empty, err := isTableEmpty("api_tokens")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if empty {
|
||||
var legacy model.Setting
|
||||
err := db.Model(model.Setting{}).Where("key = ?", "apiToken").First(&legacy).Error
|
||||
if err == nil && legacy.Value != "" {
|
||||
row := &model.ApiToken{
|
||||
Name: "default",
|
||||
Token: legacy.Value,
|
||||
Enabled: true,
|
||||
}
|
||||
if err := db.Create(row).Error; err != nil {
|
||||
log.Printf("Error migrating legacy apiToken: %v", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
return db.Create(&model.HistoryOfSeeders{SeederName: "ApiTokensTable"}).Error
|
||||
}
|
||||
|
||||
// hashExistingApiTokens replaces any plaintext token stored before tokens were
|
||||
// hashed at rest with its SHA-256 digest. Callers keep their plaintext copy
|
||||
// (used on remote nodes), so existing tokens keep authenticating; the panel
|
||||
// just can no longer reveal them. Idempotent — already-hashed rows are skipped.
|
||||
func hashExistingApiTokens() error {
|
||||
var rows []*model.ApiToken
|
||||
if err := db.Find(&rows).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
for _, r := range rows {
|
||||
if crypto.IsSHA256Hex(r.Token) {
|
||||
continue
|
||||
}
|
||||
hashed := crypto.HashTokenSHA256(r.Token)
|
||||
if err := db.Model(model.ApiToken{}).Where("id = ?", r.Id).Update("token", hashed).Error; err != nil {
|
||||
log.Printf("Error hashing api token %d: %v", r.Id, err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
return db.Create(&model.HistoryOfSeeders{SeederName: "ApiTokensHash"}).Error
|
||||
}
|
||||
|
||||
// isTableEmpty returns true if the named table contains zero rows.
|
||||
func isTableEmpty(tableName string) (bool, error) {
|
||||
var count int64
|
||||
err := db.Table(tableName).Count(&count).Error
|
||||
return count == 0, err
|
||||
}
|
||||
|
||||
// InitDB sets up the database connection, migrates models, and runs seeders.
|
||||
// When XUI_DB_TYPE=postgres, dbPath is ignored and XUI_DB_DSN is used instead.
|
||||
func InitDB(dbPath string) error {
|
||||
var gormLogger logger.Interface
|
||||
if config.IsDebug() {
|
||||
gormLogger = logger.New(
|
||||
log.New(os.Stdout, "\r\n", log.LstdFlags),
|
||||
logger.Config{
|
||||
SlowThreshold: time.Second,
|
||||
LogLevel: logger.Info,
|
||||
IgnoreRecordNotFoundError: true,
|
||||
Colorful: true,
|
||||
},
|
||||
)
|
||||
} else {
|
||||
gormLogger = logger.Discard
|
||||
}
|
||||
c := &gorm.Config{Logger: gormLogger, DisableForeignKeyConstraintWhenMigrating: true}
|
||||
|
||||
var err error
|
||||
switch config.GetDBKind() {
|
||||
case "postgres":
|
||||
dsn := config.GetDBDSN()
|
||||
if dsn == "" {
|
||||
return errors.New("XUI_DB_TYPE=postgres but XUI_DB_DSN is empty")
|
||||
}
|
||||
db, err = gorm.Open(postgres.Open(dsn), c)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
default:
|
||||
dir := path.Dir(dbPath)
|
||||
if err = os.MkdirAll(dir, 0755); err != nil {
|
||||
return err
|
||||
}
|
||||
dsn := dbPath + "?_journal_mode=WAL&_busy_timeout=10000&_synchronous=NORMAL&_txlock=immediate"
|
||||
db, err = gorm.Open(sqlite.Open(dsn), c)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
sqlDB, err := db.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := sqlDB.Exec("PRAGMA journal_mode=WAL"); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := sqlDB.Exec("PRAGMA busy_timeout=10000"); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := sqlDB.Exec("PRAGMA synchronous=NORMAL"); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
sqlDB, err := db.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
var maxOpen, maxIdle int
|
||||
switch config.GetDBKind() {
|
||||
case "postgres":
|
||||
maxOpen = envInt("XUI_DB_MAX_OPEN_CONNS", 25)
|
||||
maxIdle = envInt("XUI_DB_MAX_IDLE_CONNS", 25)
|
||||
default:
|
||||
maxOpen = envInt("XUI_DB_MAX_OPEN_CONNS", 8)
|
||||
maxIdle = envInt("XUI_DB_MAX_IDLE_CONNS", 4)
|
||||
}
|
||||
sqlDB.SetMaxOpenConns(maxOpen)
|
||||
sqlDB.SetMaxIdleConns(maxIdle)
|
||||
sqlDB.SetConnMaxLifetime(time.Hour)
|
||||
sqlDB.SetConnMaxIdleTime(30 * time.Minute)
|
||||
|
||||
if err := initModels(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
isUsersEmpty, err := isTableEmpty("users")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := initUser(); err != nil {
|
||||
return err
|
||||
}
|
||||
return runSeeders(isUsersEmpty)
|
||||
}
|
||||
|
||||
func envInt(key string, def int) int {
|
||||
v := strings.TrimSpace(os.Getenv(key))
|
||||
if v == "" {
|
||||
return def
|
||||
}
|
||||
n, err := strconv.Atoi(v)
|
||||
if err != nil || n <= 0 {
|
||||
return def
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
// CloseDB closes the database connection if it exists.
|
||||
func CloseDB() error {
|
||||
if db != nil {
|
||||
sqlDB, err := db.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return sqlDB.Close()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetDB returns the global GORM database instance.
|
||||
func GetDB() *gorm.DB {
|
||||
return db
|
||||
}
|
||||
|
||||
func IsNotFound(err error) bool {
|
||||
return errors.Is(err, gorm.ErrRecordNotFound)
|
||||
}
|
||||
|
||||
// IsSQLiteDB checks if the given file is a valid SQLite database by reading its signature.
|
||||
func IsSQLiteDB(file io.ReaderAt) (bool, error) {
|
||||
signature := []byte("SQLite format 3\x00")
|
||||
buf := make([]byte, len(signature))
|
||||
_, err := file.ReadAt(buf, 0)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
return bytes.Equal(buf, signature), nil
|
||||
}
|
||||
|
||||
// Checkpoint performs a WAL checkpoint on the SQLite database to ensure data consistency.
|
||||
// No-op on PostgreSQL (WAL there is managed by the server).
|
||||
func Checkpoint() error {
|
||||
if IsPostgres() {
|
||||
return nil
|
||||
}
|
||||
return db.Exec("PRAGMA wal_checkpoint;").Error
|
||||
}
|
||||
|
||||
// ValidateSQLiteDB opens the provided sqlite DB path with a throw-away connection
|
||||
// and runs a PRAGMA integrity_check to ensure the file is structurally sound.
|
||||
// It does not mutate global state or run migrations.
|
||||
func ValidateSQLiteDB(dbPath string) error {
|
||||
if _, err := os.Stat(dbPath); err != nil { // file must exist
|
||||
return err
|
||||
}
|
||||
gdb, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer sqlDB.Close()
|
||||
var res string
|
||||
if err := gdb.Raw("PRAGMA integrity_check;").Scan(&res).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if res != "ok" {
|
||||
return errors.New("sqlite integrity check failed: " + res)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
)
|
||||
|
||||
func TestSeedClientsFromInboundJSON_IsIdempotentAgainstExistingClients(t *testing.T) {
|
||||
dbDir := t.TempDir()
|
||||
t.Setenv("XUI_DB_FOLDER", dbDir)
|
||||
if err := InitDB(filepath.Join(dbDir, "x-ui.db")); err != nil {
|
||||
t.Fatalf("InitDB failed: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = CloseDB() })
|
||||
|
||||
settings, err := json.Marshal(map[string]any{
|
||||
"clients": []any{
|
||||
map[string]any{
|
||||
"id": "ce8d33df-3a64-4f10-8f9b-91c3a8e0c001",
|
||||
"email": "alice@example.com",
|
||||
"enable": true,
|
||||
"flow": "",
|
||||
"subId": "alice-sub",
|
||||
"comment": "from-inbound-json",
|
||||
},
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal settings: %v", err)
|
||||
}
|
||||
inbound := model.Inbound{
|
||||
UserId: 1,
|
||||
Port: 12345,
|
||||
Protocol: model.VLESS,
|
||||
Settings: string(settings),
|
||||
Tag: "test-inbound",
|
||||
}
|
||||
if err := db.Create(&inbound).Error; err != nil {
|
||||
t.Fatalf("seed inbound: %v", err)
|
||||
}
|
||||
|
||||
preExisting := &model.ClientRecord{
|
||||
Email: "alice@example.com",
|
||||
UUID: "ce8d33df-3a64-4f10-8f9b-91c3a8e0c001",
|
||||
SubID: "alice-sub",
|
||||
Enable: true,
|
||||
Comment: "added-via-api",
|
||||
}
|
||||
if err := db.Create(preExisting).Error; err != nil {
|
||||
t.Fatalf("seed client row: %v", err)
|
||||
}
|
||||
|
||||
if err := db.Where("seeder_name = ?", "ClientsTable").Delete(&model.HistoryOfSeeders{}).Error; err != nil {
|
||||
t.Fatalf("clear ClientsTable history: %v", err)
|
||||
}
|
||||
|
||||
if err := seedClientsFromInboundJSON(); err != nil {
|
||||
t.Fatalf("seedClientsFromInboundJSON should be idempotent against existing rows, got: %v", err)
|
||||
}
|
||||
|
||||
var count int64
|
||||
if err := db.Model(&model.ClientRecord{}).Where("email = ?", "alice@example.com").Count(&count).Error; err != nil {
|
||||
t.Fatalf("count clients: %v", err)
|
||||
}
|
||||
if count != 1 {
|
||||
t.Fatalf("alice@example.com should resolve to exactly one row, got %d", count)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeInboundClientSubId_FillsMissingAndPreservesExisting(t *testing.T) {
|
||||
dbDir := t.TempDir()
|
||||
t.Setenv("XUI_DB_FOLDER", dbDir)
|
||||
if err := InitDB(filepath.Join(dbDir, "x-ui.db")); err != nil {
|
||||
t.Fatalf("InitDB failed: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = CloseDB() })
|
||||
|
||||
settings, err := json.Marshal(map[string]any{
|
||||
"clients": []any{
|
||||
map[string]any{
|
||||
"id": "00000000-0000-0000-0000-000000000001",
|
||||
"email": "missing-sub@example.com",
|
||||
"subId": "",
|
||||
},
|
||||
map[string]any{
|
||||
"id": "00000000-0000-0000-0000-000000000002",
|
||||
"email": "no-sub-key@example.com",
|
||||
},
|
||||
map[string]any{
|
||||
"id": "00000000-0000-0000-0000-000000000003",
|
||||
"email": "has-sub@example.com",
|
||||
"subId": "keep-me-1234",
|
||||
},
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal settings: %v", err)
|
||||
}
|
||||
inbound := model.Inbound{
|
||||
UserId: 1,
|
||||
Port: 23456,
|
||||
Protocol: model.VLESS,
|
||||
Settings: string(settings),
|
||||
Tag: "subid-fix-inbound",
|
||||
}
|
||||
if err := db.Create(&inbound).Error; err != nil {
|
||||
t.Fatalf("seed inbound: %v", err)
|
||||
}
|
||||
|
||||
if err := db.Where("seeder_name = ?", "InboundClientSubIdFix").Delete(&model.HistoryOfSeeders{}).Error; err != nil {
|
||||
t.Fatalf("clear seeder history: %v", err)
|
||||
}
|
||||
|
||||
if err := normalizeInboundClientSubId(); err != nil {
|
||||
t.Fatalf("normalizeInboundClientSubId: %v", err)
|
||||
}
|
||||
|
||||
var reloaded model.Inbound
|
||||
if err := db.First(&reloaded, inbound.Id).Error; err != nil {
|
||||
t.Fatalf("reload inbound: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(reloaded.Settings), &parsed); err != nil {
|
||||
t.Fatalf("unmarshal settings: %v", err)
|
||||
}
|
||||
clients, ok := parsed["clients"].([]any)
|
||||
if !ok || len(clients) != 3 {
|
||||
t.Fatalf("expected 3 clients, got %v", parsed["clients"])
|
||||
}
|
||||
|
||||
subIdPattern := regexp.MustCompile(`^[0-9a-z]{16}$`)
|
||||
for i := range 2 {
|
||||
obj := clients[i].(map[string]any)
|
||||
sub, _ := obj["subId"].(string)
|
||||
if !subIdPattern.MatchString(sub) {
|
||||
t.Fatalf("client %d: expected 16-char [0-9a-z] subId, got %q", i, sub)
|
||||
}
|
||||
}
|
||||
preserved := clients[2].(map[string]any)["subId"].(string)
|
||||
if preserved != "keep-me-1234" {
|
||||
t.Fatalf("expected existing subId preserved, got %q", preserved)
|
||||
}
|
||||
|
||||
var historyCount int64
|
||||
if err := db.Model(&model.HistoryOfSeeders{}).Where("seeder_name = ?", "InboundClientSubIdFix").Count(&historyCount).Error; err != nil {
|
||||
t.Fatalf("count seeder history: %v", err)
|
||||
}
|
||||
if historyCount != 1 {
|
||||
t.Fatalf("expected one InboundClientSubIdFix history row, got %d", historyCount)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
package database
|
||||
|
||||
import "fmt"
|
||||
|
||||
func JSONClientsFromInbound() string {
|
||||
if IsPostgres() {
|
||||
return "FROM inbounds, jsonb_array_elements(inbounds.settings::jsonb -> 'clients') AS client(value)"
|
||||
}
|
||||
return "FROM inbounds, JSON_EACH(JSON_EXTRACT(inbounds.settings, '$.clients')) AS client"
|
||||
}
|
||||
|
||||
func JSONFieldText(expr, key string) string {
|
||||
if IsPostgres() {
|
||||
return fmt.Sprintf("(%s ->> '%s')", expr, key)
|
||||
}
|
||||
|
||||
return fmt.Sprintf("TRIM(JSON_EXTRACT(%s, '$.%s'), '\"')", expr, key)
|
||||
}
|
||||
|
||||
func GreatestExpr(a, b string) string {
|
||||
if IsPostgres() {
|
||||
return fmt.Sprintf("GREATEST(%s::bigint, %s::bigint)", a, b)
|
||||
}
|
||||
return fmt.Sprintf("MAX(%s, %s)", a, b)
|
||||
}
|
||||
|
||||
func ClientTrafficEnableMergeExpr() string {
|
||||
if IsPostgres() {
|
||||
return "CASE WHEN ?::boolean THEN enable::boolean ELSE false END"
|
||||
}
|
||||
return "CASE WHEN ? THEN enable ELSE 0 END"
|
||||
}
|
||||
@@ -0,0 +1,218 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"unicode/utf8"
|
||||
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
// DumpSQLite writes a portable SQL text dump of the SQLite database at srcPath
|
||||
// to outPath. The output mirrors the `sqlite3 .dump` format (schema + data +
|
||||
// indexes wrapped in a transaction), so it can be rebuilt with RestoreSQLite or
|
||||
// loaded by the sqlite3 CLI. The source database is opened read-only in effect
|
||||
// and left untouched.
|
||||
func DumpSQLite(srcPath, outPath string) error {
|
||||
data, err := DumpSQLiteToBytes(srcPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(outPath, data, 0o644)
|
||||
}
|
||||
|
||||
// DumpSQLiteToBytes builds the same `sqlite3 .dump`-style SQL text as DumpSQLite
|
||||
// but returns it in memory, which the panel uses to stream a migration download.
|
||||
func DumpSQLiteToBytes(srcPath string) ([]byte, error) {
|
||||
if _, err := os.Stat(srcPath); err != nil {
|
||||
return nil, fmt.Errorf("source sqlite not found at %s: %w", srcPath, err)
|
||||
}
|
||||
|
||||
gdb, err := gorm.Open(sqlite.Open(srcPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer sqlDB.Close()
|
||||
|
||||
var b strings.Builder
|
||||
b.WriteString("PRAGMA foreign_keys=OFF;\n")
|
||||
b.WriteString("BEGIN TRANSACTION;\n")
|
||||
|
||||
// Tables in creation order, each followed by its data.
|
||||
type object struct{ name, ddl string }
|
||||
var tables []object
|
||||
rows, err := sqlDB.Query(`SELECT name, sql FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND sql IS NOT NULL ORDER BY rowid`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for rows.Next() {
|
||||
var o object
|
||||
if err := rows.Scan(&o.name, &o.ddl); err != nil {
|
||||
rows.Close()
|
||||
return nil, err
|
||||
}
|
||||
tables = append(tables, o)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
rows.Close()
|
||||
return nil, err
|
||||
}
|
||||
rows.Close()
|
||||
|
||||
for _, t := range tables {
|
||||
b.WriteString(t.ddl)
|
||||
b.WriteString(";\n")
|
||||
if err := dumpTableData(sqlDB, t.name, &b); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
// AUTOINCREMENT bookkeeping, restored verbatim like the sqlite3 CLI does.
|
||||
if sqliteTableExists(sqlDB, "sqlite_sequence") {
|
||||
b.WriteString("DELETE FROM sqlite_sequence;\n")
|
||||
if err := dumpTableData(sqlDB, "sqlite_sequence", &b); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
// Indexes, triggers and views after the data is in place.
|
||||
rows2, err := sqlDB.Query(`SELECT sql FROM sqlite_master WHERE type IN ('index','trigger','view') AND sql IS NOT NULL ORDER BY rowid`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for rows2.Next() {
|
||||
var ddl string
|
||||
if err := rows2.Scan(&ddl); err != nil {
|
||||
rows2.Close()
|
||||
return nil, err
|
||||
}
|
||||
b.WriteString(ddl)
|
||||
b.WriteString(";\n")
|
||||
}
|
||||
if err := rows2.Err(); err != nil {
|
||||
rows2.Close()
|
||||
return nil, err
|
||||
}
|
||||
rows2.Close()
|
||||
|
||||
b.WriteString("COMMIT;\n")
|
||||
|
||||
return []byte(b.String()), nil
|
||||
}
|
||||
|
||||
// RestoreSQLite rebuilds a SQLite database at dstPath from a SQL text dump
|
||||
// produced by DumpSQLite (or `sqlite3 .dump`). dstPath must not already exist so
|
||||
// an existing database is never clobbered silently.
|
||||
func RestoreSQLite(dumpPath, dstPath string) error {
|
||||
script, err := os.ReadFile(dumpPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := os.Stat(dstPath); err == nil {
|
||||
return fmt.Errorf("destination already exists: %s", dstPath)
|
||||
}
|
||||
|
||||
gdb, err := gorm.Open(sqlite.Open(dstPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// mattn/go-sqlite3 executes every statement in a multi-statement string.
|
||||
if _, err := sqlDB.Exec(string(script)); err != nil {
|
||||
sqlDB.Close()
|
||||
os.Remove(dstPath)
|
||||
return fmt.Errorf("restore failed: %w", err)
|
||||
}
|
||||
return sqlDB.Close()
|
||||
}
|
||||
|
||||
// dumpTableData appends one INSERT statement per row of table to b.
|
||||
func dumpTableData(db *sql.DB, table string, b *strings.Builder) error {
|
||||
rows, err := db.Query(`SELECT * FROM "` + table + `"`)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
cols, err := rows.Columns()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
n := len(cols)
|
||||
prefix := `INSERT INTO "` + table + `" VALUES(`
|
||||
|
||||
for rows.Next() {
|
||||
vals := make([]any, n)
|
||||
ptrs := make([]any, n)
|
||||
for i := range vals {
|
||||
ptrs[i] = &vals[i]
|
||||
}
|
||||
if err := rows.Scan(ptrs...); err != nil {
|
||||
return err
|
||||
}
|
||||
b.WriteString(prefix)
|
||||
for i, v := range vals {
|
||||
if i > 0 {
|
||||
b.WriteByte(',')
|
||||
}
|
||||
b.WriteString(sqliteLiteral(v))
|
||||
}
|
||||
b.WriteString(");\n")
|
||||
}
|
||||
return rows.Err()
|
||||
}
|
||||
|
||||
// sqliteLiteral renders a scanned column value as a SQLite SQL literal.
|
||||
func sqliteLiteral(v any) string {
|
||||
switch x := v.(type) {
|
||||
case nil:
|
||||
return "NULL"
|
||||
case int64:
|
||||
return strconv.FormatInt(x, 10)
|
||||
case float64:
|
||||
return strconv.FormatFloat(x, 'g', -1, 64)
|
||||
case bool:
|
||||
if x {
|
||||
return "1"
|
||||
}
|
||||
return "0"
|
||||
case string:
|
||||
return quoteSQLiteText(x)
|
||||
case []byte:
|
||||
if utf8.Valid(x) {
|
||||
return quoteSQLiteText(string(x))
|
||||
}
|
||||
var sb strings.Builder
|
||||
sb.WriteString("X'")
|
||||
for _, c := range x {
|
||||
fmt.Fprintf(&sb, "%02x", c)
|
||||
}
|
||||
sb.WriteByte('\'')
|
||||
return sb.String()
|
||||
default:
|
||||
return quoteSQLiteText(fmt.Sprintf("%v", x))
|
||||
}
|
||||
}
|
||||
|
||||
func quoteSQLiteText(s string) string {
|
||||
return "'" + strings.ReplaceAll(s, "'", "''") + "'"
|
||||
}
|
||||
|
||||
func sqliteTableExists(db *sql.DB, name string) bool {
|
||||
var found string
|
||||
err := db.QueryRow(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`, name).Scan(&found)
|
||||
return err == nil
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
// TestCopyAllModelsIntoSQLite exercises the same AutoMigrate + copyTable
|
||||
// machinery that ExportPostgresToSQLite relies on, but with a SQLite source so
|
||||
// it needs no external database. The Postgres source path uses identical gorm
|
||||
// reads (see MigrateData), so this validates the destination-side copy.
|
||||
func TestCopyAllModelsIntoSQLite(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
srcPath := filepath.Join(dir, "src.db")
|
||||
dstPath := filepath.Join(dir, "dst.db")
|
||||
|
||||
src, err := gorm.Open(sqlite.Open(srcPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open src: %v", err)
|
||||
}
|
||||
defer closeGorm(src)
|
||||
for _, m := range migrationModels() {
|
||||
if err := src.AutoMigrate(m); err != nil {
|
||||
t.Fatalf("automigrate src %T: %v", m, err)
|
||||
}
|
||||
}
|
||||
|
||||
// Seed a few rows across parent/child tables and a composite-PK table.
|
||||
if err := src.Create(&model.User{Username: "admin", Password: "x"}).Error; err != nil {
|
||||
t.Fatalf("seed user: %v", err)
|
||||
}
|
||||
if err := src.Create(&model.Inbound{UserId: 1, Remark: "in", Port: 443, Protocol: "vless", Tag: "inbound-443"}).Error; err != nil {
|
||||
t.Fatalf("seed inbound: %v", err)
|
||||
}
|
||||
if err := src.Create(&xray.ClientTraffic{InboundId: 1, Email: "a@b.c", Enable: true, Up: 10, Down: 20}).Error; err != nil {
|
||||
t.Fatalf("seed traffic: %v", err)
|
||||
}
|
||||
|
||||
dst, err := gorm.Open(sqlite.Open(dstPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open dst: %v", err)
|
||||
}
|
||||
defer closeGorm(dst)
|
||||
if err := copyAllModels(src, dst); err != nil {
|
||||
t.Fatalf("copyAllModels: %v", err)
|
||||
}
|
||||
|
||||
for _, tc := range []struct {
|
||||
model any
|
||||
want int64
|
||||
}{
|
||||
{&model.User{}, 1},
|
||||
{&model.Inbound{}, 1},
|
||||
{&xray.ClientTraffic{}, 1},
|
||||
} {
|
||||
var got int64
|
||||
if err := dst.Model(tc.model).Count(&got).Error; err != nil {
|
||||
t.Fatalf("count %T: %v", tc.model, err)
|
||||
}
|
||||
if got != tc.want {
|
||||
t.Errorf("%T: got %d rows, want %d", tc.model, got, tc.want)
|
||||
}
|
||||
}
|
||||
|
||||
// Spot-check a copied value survived the round-trip.
|
||||
var ct xray.ClientTraffic
|
||||
if err := dst.Where("email = ?", "a@b.c").First(&ct).Error; err != nil {
|
||||
t.Fatalf("read back traffic: %v", err)
|
||||
}
|
||||
if ct.Up != 10 || ct.Down != 20 || !ct.Enable {
|
||||
t.Errorf("traffic mismatch: %+v", ct)
|
||||
}
|
||||
}
|
||||
|
||||
// TestDumpAndRestoreSQLiteRoundTrip dumps a seeded SQLite db to .dump text and
|
||||
// rebuilds it, asserting the row survives.
|
||||
func TestDumpAndRestoreSQLiteRoundTrip(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
srcPath := filepath.Join(dir, "src.db")
|
||||
dumpPath := filepath.Join(dir, "out.dump")
|
||||
dstPath := filepath.Join(dir, "rebuilt.db")
|
||||
|
||||
src, err := gorm.Open(sqlite.Open(srcPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open src: %v", err)
|
||||
}
|
||||
if err := src.AutoMigrate(&model.Setting{}); err != nil {
|
||||
t.Fatalf("automigrate: %v", err)
|
||||
}
|
||||
if err := src.Create(&model.Setting{Key: "secret", Value: "o'brien \"quote\""}).Error; err != nil {
|
||||
t.Fatalf("seed: %v", err)
|
||||
}
|
||||
if sqlDB, _ := src.DB(); sqlDB != nil {
|
||||
sqlDB.Close()
|
||||
}
|
||||
|
||||
if err := DumpSQLite(srcPath, dumpPath); err != nil {
|
||||
t.Fatalf("DumpSQLite: %v", err)
|
||||
}
|
||||
if fi, err := os.Stat(dumpPath); err != nil || fi.Size() == 0 {
|
||||
t.Fatalf("dump missing/empty: %v", err)
|
||||
}
|
||||
if err := RestoreSQLite(dumpPath, dstPath); err != nil {
|
||||
t.Fatalf("RestoreSQLite: %v", err)
|
||||
}
|
||||
|
||||
dst, err := gorm.Open(sqlite.Open(dstPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open dst: %v", err)
|
||||
}
|
||||
defer closeGorm(dst)
|
||||
var s model.Setting
|
||||
if err := dst.Where("key = ?", "secret").First(&s).Error; err != nil {
|
||||
t.Fatalf("read back: %v", err)
|
||||
}
|
||||
if s.Value != "o'brien \"quote\"" {
|
||||
t.Errorf("value mismatch after round-trip: %q", s.Value)
|
||||
}
|
||||
}
|
||||
|
||||
// closeGorm closes the underlying *sql.DB so Windows can delete the temp file.
|
||||
func closeGorm(db *gorm.DB) {
|
||||
if db == nil {
|
||||
return
|
||||
}
|
||||
if s, err := db.DB(); err == nil {
|
||||
s.Close()
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,293 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"path"
|
||||
"reflect"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
|
||||
"gorm.io/driver/postgres"
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
// migrationModels is the FK-aware order in which tables are created and copied
|
||||
// during `x-ui migrate-db --dsn` (SQLite → PostgreSQL data migration) and in
|
||||
// related tests.
|
||||
//
|
||||
// Important: When adding a new top-level model (like OutboundSubscription),
|
||||
// you must add it here **in addition to** the list in internal/database/db.go:initModels().
|
||||
// This list is used for:
|
||||
// - Creating the destination schema during cross-DB migration
|
||||
// - Truncating tables
|
||||
// - Copying data row-by-row
|
||||
// - Resyncing Postgres sequences after bulk insert
|
||||
//
|
||||
// DumpSQLite / RestoreSQLite are schema-introspective (they read sqlite_master)
|
||||
// so they do not need manual updates.
|
||||
func migrationModels() []any {
|
||||
return []any{
|
||||
&model.User{},
|
||||
&model.Setting{},
|
||||
&model.HistoryOfSeeders{},
|
||||
&model.CustomGeoResource{},
|
||||
&model.Node{},
|
||||
&model.ApiToken{},
|
||||
&model.Inbound{},
|
||||
&xray.ClientTraffic{},
|
||||
&model.OutboundTraffics{},
|
||||
&model.InboundClientIps{},
|
||||
&model.ClientRecord{},
|
||||
&model.ClientInbound{},
|
||||
&model.InboundFallback{},
|
||||
&model.NodeClientTraffic{},
|
||||
&model.OutboundSubscription{},
|
||||
}
|
||||
}
|
||||
|
||||
// MigrateData copies every row from the configured SQLite file at srcPath into
|
||||
// a fresh PostgreSQL database described by dstDSN. The destination tables are
|
||||
// (re)created with AutoMigrate before the copy. Source data is left untouched.
|
||||
func MigrateData(srcPath, dstDSN string) error {
|
||||
if _, err := os.Stat(srcPath); err != nil {
|
||||
return fmt.Errorf("source sqlite not found at %s: %w", srcPath, err)
|
||||
}
|
||||
if dstDSN == "" {
|
||||
return errors.New("destination DSN is required")
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(path.Dir(srcPath), 0755); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
srcDSN := srcPath + "?_journal_mode=WAL&_busy_timeout=10000"
|
||||
src, err := gorm.Open(sqlite.Open(srcDSN), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return fmt.Errorf("open sqlite source: %w", err)
|
||||
}
|
||||
srcSQL, err := src.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer srcSQL.Close()
|
||||
|
||||
dst, err := gorm.Open(postgres.Open(dstDSN), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return fmt.Errorf("open postgres destination: %w", err)
|
||||
}
|
||||
dstSQL, err := dst.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dstSQL.Close()
|
||||
dstSQL.SetConnMaxLifetime(time.Hour)
|
||||
|
||||
log.Println("Creating destination schema...")
|
||||
for _, m := range migrationModels() {
|
||||
if err := dst.AutoMigrate(m); err != nil {
|
||||
return fmt.Errorf("AutoMigrate %T: %w", m, err)
|
||||
}
|
||||
}
|
||||
|
||||
// AutoMigrate re-creates the legacy client_traffics -> inbounds foreign key,
|
||||
// but the running panel drops it (see dropLegacyForeignKeys) and tolerates
|
||||
// client_traffics rows whose inbound was deleted. Drop it here too so copying
|
||||
// such orphaned rows can't fail with an fk_inbounds_client_stats violation.
|
||||
if err := dst.Exec("ALTER TABLE client_traffics DROP CONSTRAINT IF EXISTS fk_inbounds_client_stats").Error; err != nil {
|
||||
return fmt.Errorf("drop legacy foreign key: %w", err)
|
||||
}
|
||||
|
||||
// Empty the destination tables so the migration is idempotent: a fresh
|
||||
// PostgreSQL DB already holds an auto-seeded admin (id=1) from any prior
|
||||
// panel start, and a partially-failed earlier run leaves rows behind. Either
|
||||
// way a plain INSERT with explicit ids would collide on users_pkey, so clear
|
||||
// our tables (only) before copying.
|
||||
if err := truncatePostgresTables(dst, migrationModels()); err != nil {
|
||||
return fmt.Errorf("clear destination tables: %w", err)
|
||||
}
|
||||
|
||||
totalRows := 0
|
||||
for _, m := range migrationModels() {
|
||||
n, err := copyTable(src, dst, m)
|
||||
if err != nil {
|
||||
return fmt.Errorf("copy %T: %w", m, err)
|
||||
}
|
||||
totalRows += n
|
||||
log.Printf(" %-32s %d rows", reflect.TypeOf(m).Elem().Name(), n)
|
||||
}
|
||||
|
||||
if err := resetPostgresSequences(dst); err != nil {
|
||||
log.Printf("warning: failed to reset some postgres sequences: %v", err)
|
||||
}
|
||||
|
||||
log.Printf("Migration complete: %d rows across %d tables.", totalRows, len(migrationModels()))
|
||||
log.Println("Set XUI_DB_TYPE=postgres and XUI_DB_DSN=... in /etc/default/x-ui, then restart x-ui.")
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExportPostgresToSQLite copies every row from the PostgreSQL database described
|
||||
// by srcDSN into a fresh SQLite file at dstPath. It is the reverse of
|
||||
// MigrateData and is used to hand a PostgreSQL-backed panel a portable .db file.
|
||||
// dstPath is created/overwritten; the PostgreSQL source is left untouched.
|
||||
func ExportPostgresToSQLite(srcDSN, dstPath string) error {
|
||||
if srcDSN == "" {
|
||||
return errors.New("source DSN is required")
|
||||
}
|
||||
if err := os.MkdirAll(path.Dir(dstPath), 0755); err != nil {
|
||||
return err
|
||||
}
|
||||
// Start from an empty file so AutoMigrate creates the canonical schema.
|
||||
if err := os.Remove(dstPath); err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
|
||||
src, err := gorm.Open(postgres.Open(srcDSN), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return fmt.Errorf("open postgres source: %w", err)
|
||||
}
|
||||
srcSQL, err := src.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer srcSQL.Close()
|
||||
|
||||
// No WAL: keep all data in the main file so it is complete once closed.
|
||||
dst, err := gorm.Open(sqlite.Open(dstPath+"?_busy_timeout=10000"), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
return fmt.Errorf("open sqlite destination: %w", err)
|
||||
}
|
||||
dstSQL, err := dst.DB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dstSQL.Close()
|
||||
|
||||
return copyAllModels(src, dst)
|
||||
}
|
||||
|
||||
// copyAllModels (re)creates the schema on dst and copies every migrated table
|
||||
// from src to dst in FK-safe order. src/dst may be any gorm backend.
|
||||
func copyAllModels(src, dst *gorm.DB) error {
|
||||
for _, m := range migrationModels() {
|
||||
if err := dst.AutoMigrate(m); err != nil {
|
||||
return fmt.Errorf("AutoMigrate %T: %w", m, err)
|
||||
}
|
||||
}
|
||||
for _, m := range migrationModels() {
|
||||
if _, err := copyTable(src, dst, m); err != nil {
|
||||
return fmt.Errorf("copy %T: %w", m, err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func copyTable(src, dst *gorm.DB, mdl any) (int, error) {
|
||||
const batchSize = 500
|
||||
|
||||
sliceType := reflect.SliceOf(reflect.PointerTo(reflect.TypeOf(mdl).Elem()))
|
||||
|
||||
stmt := &gorm.Statement{DB: src}
|
||||
if err := stmt.Parse(mdl); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
order := strings.Join(stmt.Schema.PrimaryFieldDBNames, ", ")
|
||||
table := stmt.Schema.Table
|
||||
columns := stmt.Schema.DBNames
|
||||
|
||||
ctx := context.Background()
|
||||
total := 0
|
||||
for offset := 0; ; offset += batchSize {
|
||||
batchPtr := reflect.New(sliceType)
|
||||
q := src.Model(mdl).Limit(batchSize).Offset(offset)
|
||||
if order != "" {
|
||||
q = q.Order(order)
|
||||
}
|
||||
if err := q.Find(batchPtr.Interface()).Error; err != nil {
|
||||
return total, err
|
||||
}
|
||||
slice := batchPtr.Elem()
|
||||
n := slice.Len()
|
||||
if n == 0 {
|
||||
break
|
||||
}
|
||||
|
||||
rows := make([]map[string]any, n)
|
||||
for i := 0; i < n; i++ {
|
||||
rv := reflect.Indirect(slice.Index(i))
|
||||
row := make(map[string]any, len(columns))
|
||||
for _, name := range columns {
|
||||
value, _ := stmt.Schema.FieldsByDBName[name].ValueOf(ctx, rv)
|
||||
row[name] = value
|
||||
}
|
||||
rows[i] = row
|
||||
}
|
||||
|
||||
if err := dst.Table(table).CreateInBatches(rows, 200).Error; err != nil {
|
||||
return total, err
|
||||
}
|
||||
total += n
|
||||
if n < batchSize {
|
||||
break
|
||||
}
|
||||
}
|
||||
return total, nil
|
||||
}
|
||||
|
||||
// truncatePostgresTables empties every migrated table on dst in a single
|
||||
// statement, resetting identity sequences. CASCADE covers the inbound/client
|
||||
// foreign keys regardless of insertion order. Only the panel's own tables are
|
||||
// touched, never the rest of the schema.
|
||||
func truncatePostgresTables(dst *gorm.DB, models []any) error {
|
||||
tables := make([]string, 0, len(models))
|
||||
for _, m := range models {
|
||||
stmt := &gorm.Statement{DB: dst}
|
||||
if err := stmt.Parse(m); err != nil {
|
||||
return err
|
||||
}
|
||||
tables = append(tables, `"`+stmt.Schema.Table+`"`)
|
||||
}
|
||||
if len(tables) == 0 {
|
||||
return nil
|
||||
}
|
||||
log.Println("Clearing destination tables...")
|
||||
return dst.Exec("TRUNCATE TABLE " + strings.Join(tables, ", ") + " RESTART IDENTITY CASCADE").Error
|
||||
}
|
||||
|
||||
// resetPostgresSequences advances each migrated table's id sequence past MAX(id),
|
||||
// otherwise the next INSERT-without-id would clash with copied rows.
|
||||
func resetPostgresSequences(dst *gorm.DB) error {
|
||||
return resyncPostgresSequences(dst, migrationModels())
|
||||
}
|
||||
|
||||
// resyncPostgresSequences sets each model's id sequence to MAX(id) so the next
|
||||
// auto-increment INSERT won't collide with an existing row. Table names are
|
||||
// resolved from the models themselves (not hardcoded), so they always match the
|
||||
// migrated tables. The statement is a no-op for tables without an id sequence
|
||||
// (e.g. composite-PK tables), and idempotent on a healthy DB, so it is safe to
|
||||
// run both after migration and on every Postgres startup.
|
||||
func resyncPostgresSequences(db *gorm.DB, models []any) error {
|
||||
for _, m := range models {
|
||||
stmt := &gorm.Statement{DB: db}
|
||||
if err := stmt.Parse(m); err != nil {
|
||||
continue
|
||||
}
|
||||
t := stmt.Table
|
||||
// t comes from the trusted model set parsed by GORM, not user input, so
|
||||
// interpolating it as an identifier is safe. We ignore errors per-table.
|
||||
_ = db.Exec(
|
||||
`SELECT setval(pg_get_serial_sequence(?, 'id'), COALESCE((SELECT MAX(id) FROM "`+t+`"), 1), true)
|
||||
WHERE pg_get_serial_sequence(?, 'id') IS NOT NULL`,
|
||||
t, t,
|
||||
).Error
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
|
||||
"gorm.io/driver/postgres"
|
||||
"gorm.io/driver/sqlite"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
func TestMigrateData_CompositeKeyTableLargerThanBatch(t *testing.T) {
|
||||
dsn := os.Getenv("XUI_TEST_PG_DSN")
|
||||
if dsn == "" {
|
||||
t.Skip("set XUI_TEST_PG_DSN to a reachable Postgres to run this test")
|
||||
}
|
||||
|
||||
// Seed a SQLite source with the full schema and >500 client_inbounds rows.
|
||||
srcPath := t.TempDir() + "/x-ui.db"
|
||||
src, err := gorm.Open(sqlite.Open(srcPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open sqlite: %v", err)
|
||||
}
|
||||
for _, m := range migrationModels() {
|
||||
if err := src.AutoMigrate(m); err != nil {
|
||||
t.Fatalf("automigrate %T: %v", m, err)
|
||||
}
|
||||
}
|
||||
const n = 600 // > batchSize (500) so the between-batches path is exercised
|
||||
links := make([]model.ClientInbound, 0, n)
|
||||
for i := 1; i <= n; i++ {
|
||||
links = append(links, model.ClientInbound{ClientId: i, InboundId: 1})
|
||||
}
|
||||
if err := src.CreateInBatches(links, 200).Error; err != nil {
|
||||
t.Fatalf("seed client_inbounds: %v", err)
|
||||
}
|
||||
if sqlDB, err := src.DB(); err == nil {
|
||||
sqlDB.Close() // flush before MigrateData reopens the file
|
||||
}
|
||||
|
||||
// Make the test re-runnable: drop any tables from a previous run.
|
||||
dst, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open postgres: %v", err)
|
||||
}
|
||||
if err := dst.Migrator().DropTable(migrationModels()...); err != nil {
|
||||
t.Fatalf("drop tables: %v", err)
|
||||
}
|
||||
|
||||
if err := MigrateData(srcPath, dsn); err != nil {
|
||||
t.Fatalf("MigrateData: %v", err) // fails here before the fix
|
||||
}
|
||||
|
||||
var got int64
|
||||
if err := dst.Model(&model.ClientInbound{}).Count(&got).Error; err != nil {
|
||||
t.Fatalf("count: %v", err)
|
||||
}
|
||||
if got != n {
|
||||
t.Fatalf("client_inbounds rows = %d, want %d", got, n)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMigrateData_PreservesFalseDefaultedColumns(t *testing.T) {
|
||||
dsn := os.Getenv("XUI_TEST_PG_DSN")
|
||||
if dsn == "" {
|
||||
t.Skip("set XUI_TEST_PG_DSN to a reachable Postgres to run this test")
|
||||
}
|
||||
|
||||
srcPath := t.TempDir() + "/x-ui.db"
|
||||
src, err := gorm.Open(sqlite.Open(srcPath), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open sqlite: %v", err)
|
||||
}
|
||||
for _, m := range migrationModels() {
|
||||
if err := src.AutoMigrate(m); err != nil {
|
||||
t.Fatalf("automigrate %T: %v", m, err)
|
||||
}
|
||||
}
|
||||
|
||||
if err := src.Create([]*model.ClientRecord{
|
||||
{Email: "on@example.com"},
|
||||
{Email: "off@example.com"},
|
||||
}).Error; err != nil {
|
||||
t.Fatalf("seed clients: %v", err)
|
||||
}
|
||||
if err := src.Model(&model.ClientRecord{}).Where("email = ?", "off@example.com").
|
||||
Update("enable", false).Error; err != nil {
|
||||
t.Fatalf("disable client: %v", err)
|
||||
}
|
||||
if err := src.Create(&model.Node{Name: "n-off", Address: "1.2.3.4", Port: 1, ApiToken: "tok"}).Error; err != nil {
|
||||
t.Fatalf("seed node: %v", err)
|
||||
}
|
||||
if err := src.Model(&model.Node{}).Where("name = ?", "n-off").
|
||||
Update("enable", false).Error; err != nil {
|
||||
t.Fatalf("disable node: %v", err)
|
||||
}
|
||||
if sqlDB, err := src.DB(); err == nil {
|
||||
sqlDB.Close()
|
||||
}
|
||||
|
||||
dst, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Discard})
|
||||
if err != nil {
|
||||
t.Fatalf("open postgres: %v", err)
|
||||
}
|
||||
if err := dst.Migrator().DropTable(migrationModels()...); err != nil {
|
||||
t.Fatalf("drop tables: %v", err)
|
||||
}
|
||||
|
||||
if err := MigrateData(srcPath, dsn); err != nil {
|
||||
t.Fatalf("MigrateData: %v", err)
|
||||
}
|
||||
|
||||
var off model.ClientRecord
|
||||
if err := dst.Where("email = ?", "off@example.com").First(&off).Error; err != nil {
|
||||
t.Fatalf("load disabled client: %v", err)
|
||||
}
|
||||
if off.Enable {
|
||||
t.Fatalf("disabled client re-enabled after migration (enable=%v)", off.Enable)
|
||||
}
|
||||
|
||||
var on model.ClientRecord
|
||||
if err := dst.Where("email = ?", "on@example.com").First(&on).Error; err != nil {
|
||||
t.Fatalf("load enabled client: %v", err)
|
||||
}
|
||||
if !on.Enable {
|
||||
t.Fatalf("enabled client wrongly disabled after migration")
|
||||
}
|
||||
|
||||
var node model.Node
|
||||
if err := dst.Where("name = ?", "n-off").First(&node).Error; err != nil {
|
||||
t.Fatalf("load node: %v", err)
|
||||
}
|
||||
if node.Enable {
|
||||
t.Fatalf("disabled node re-enabled after migration")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,860 @@
|
||||
// Package model defines the database models and data structures used by the 3x-ui panel.
|
||||
package model
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/json_util"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
)
|
||||
|
||||
// Protocol represents the protocol type for Xray inbounds.
|
||||
type Protocol string
|
||||
|
||||
// Protocol constants for different Xray inbound protocols.
|
||||
// Hysteria v2 is not a distinct protocol — it is plain "hysteria"
|
||||
// with streamSettings.version = 2. The share-link URI scheme
|
||||
// "hysteria2://" is independent of this and is still emitted by the
|
||||
// link generator when the stream version is 2.
|
||||
const (
|
||||
VMESS Protocol = "vmess"
|
||||
VLESS Protocol = "vless"
|
||||
Tunnel Protocol = "tunnel"
|
||||
HTTP Protocol = "http"
|
||||
Trojan Protocol = "trojan"
|
||||
Shadowsocks Protocol = "shadowsocks"
|
||||
Mixed Protocol = "mixed"
|
||||
WireGuard Protocol = "wireguard"
|
||||
Hysteria Protocol = "hysteria"
|
||||
MTProto Protocol = "mtproto"
|
||||
)
|
||||
|
||||
// User represents a user account in the 3x-ui panel.
|
||||
type User struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Username string `json:"username"`
|
||||
Password string `json:"password"`
|
||||
LoginEpoch int64 `json:"-" gorm:"default:0"`
|
||||
}
|
||||
|
||||
// Inbound represents an Xray inbound configuration with traffic statistics and settings.
|
||||
type Inbound struct {
|
||||
Id int `json:"id" form:"id" gorm:"primaryKey;autoIncrement" example:"1"` // Unique identifier
|
||||
UserId int `json:"-"` // Associated user ID
|
||||
Up int64 `json:"up" form:"up"` // Upload traffic in bytes
|
||||
Down int64 `json:"down" form:"down"` // Download traffic in bytes
|
||||
Total int64 `json:"total" form:"total"` // Total traffic limit in bytes
|
||||
Remark string `json:"remark" form:"remark" example:"VLESS-443"` // Human-readable remark
|
||||
Enable bool `json:"enable" form:"enable" gorm:"index:idx_enable_traffic_reset,priority:1" example:"true"` // Whether the inbound is enabled
|
||||
ExpiryTime int64 `json:"expiryTime" form:"expiryTime"` // Expiration timestamp
|
||||
TrafficReset string `json:"trafficReset" form:"trafficReset" gorm:"default:never;index:idx_enable_traffic_reset,priority:2" validate:"omitempty,oneof=never hourly daily weekly monthly"` // Traffic reset schedule
|
||||
LastTrafficResetTime int64 `json:"lastTrafficResetTime" form:"lastTrafficResetTime" gorm:"default:0"` // Last traffic reset timestamp
|
||||
ClientStats []xray.ClientTraffic `gorm:"foreignKey:InboundId;references:Id" json:"clientStats" form:"clientStats"` // Client traffic statistics
|
||||
|
||||
// Xray configuration fields
|
||||
Listen string `json:"listen" form:"listen"`
|
||||
Port int `json:"port" form:"port" validate:"gte=0,lte=65535" example:"443"`
|
||||
Protocol Protocol `json:"protocol" form:"protocol" validate:"required,oneof=vmess vless trojan shadowsocks wireguard hysteria http mixed tunnel tun mtproto" example:"vless"`
|
||||
Settings string `json:"settings" form:"settings"`
|
||||
StreamSettings string `json:"streamSettings" form:"streamSettings"`
|
||||
Tag string `json:"tag" form:"tag" gorm:"unique" example:"in-443-tcp"`
|
||||
Sniffing string `json:"sniffing" form:"sniffing"`
|
||||
NodeID *int `json:"nodeId,omitempty" form:"nodeId" gorm:"index"`
|
||||
|
||||
// OriginNodeGuid is the panelGuid of the node that physically hosts this
|
||||
// inbound, propagated up across hops (#4983). Empty for an inbound that
|
||||
// lives on this panel's own xray; set to the originating node's GUID when
|
||||
// the inbound was synced from a node (kept as-is across further hops). Lets
|
||||
// the master attribute a deeply nested inbound to the real node instead of
|
||||
// the intermediate one it was fetched through.
|
||||
OriginNodeGuid string `json:"originNodeGuid,omitempty" form:"originNodeGuid" gorm:"column:origin_node_guid;index"`
|
||||
|
||||
// FallbackParent is populated by the API layer when this inbound is
|
||||
// attached as a fallback child of a VLESS/Trojan TCP-TLS master.
|
||||
// The frontend uses it to rewrite client-share links so they advertise
|
||||
// the master's externally reachable endpoint instead of the child's
|
||||
// loopback listen. Not persisted.
|
||||
FallbackParent *FallbackParentInfo `json:"fallbackParent,omitempty" gorm:"-"`
|
||||
}
|
||||
|
||||
// FallbackParentInfo carries everything the frontend needs to rewrite a
|
||||
// child inbound's client link: where to connect (the master's address
|
||||
// and port) and which path matched on the master's fallbacks array.
|
||||
// The frontend already has the master inbound in its dbInbounds list,
|
||||
// so we only ship identifiers + the match path here.
|
||||
type FallbackParentInfo struct {
|
||||
MasterId int `json:"masterId"`
|
||||
Path string `json:"path,omitempty"`
|
||||
}
|
||||
|
||||
// OutboundTraffics tracks traffic statistics for Xray outbound connections.
|
||||
type OutboundTraffics struct {
|
||||
Id int `json:"id" form:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Tag string `json:"tag" form:"tag" gorm:"unique"`
|
||||
Up int64 `json:"up" form:"up" gorm:"default:0"`
|
||||
Down int64 `json:"down" form:"down" gorm:"default:0"`
|
||||
Total int64 `json:"total" form:"total" gorm:"default:0"`
|
||||
}
|
||||
|
||||
// InboundClientIps stores IP addresses associated with inbound clients for access control.
|
||||
type InboundClientIps struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
ClientEmail string `json:"clientEmail" form:"clientEmail" gorm:"unique"`
|
||||
Ips string `json:"ips" form:"ips"`
|
||||
}
|
||||
|
||||
// MarshalJSON emits the Ips column as a real JSON array instead of an escaped
|
||||
// JSON-text string. Empty or unparseable storage renders as null so API
|
||||
// consumers don't have to special-case the legacy double-encoded shape.
|
||||
func (ic InboundClientIps) MarshalJSON() ([]byte, error) {
|
||||
type alias InboundClientIps
|
||||
return json.Marshal(struct {
|
||||
alias
|
||||
Ips json.RawMessage `json:"ips"`
|
||||
}{
|
||||
alias: alias(ic),
|
||||
Ips: jsonStringFieldToRaw(ic.Ips),
|
||||
})
|
||||
}
|
||||
|
||||
// UnmarshalJSON accepts ips as either a JSON array (modern shape) or a
|
||||
// JSON-encoded string (legacy shape), normalising back to the JSON-text the
|
||||
// column stores.
|
||||
func (ic *InboundClientIps) UnmarshalJSON(data []byte) error {
|
||||
type alias InboundClientIps
|
||||
aux := struct {
|
||||
*alias
|
||||
Ips json.RawMessage `json:"ips"`
|
||||
}{
|
||||
alias: (*alias)(ic),
|
||||
}
|
||||
if err := json.Unmarshal(data, &aux); err != nil {
|
||||
return err
|
||||
}
|
||||
ic.Ips = jsonStringFieldFromRaw(aux.Ips)
|
||||
return nil
|
||||
}
|
||||
|
||||
// HistoryOfSeeders tracks which database seeders have been executed to prevent re-running.
|
||||
type HistoryOfSeeders struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
SeederName string `json:"seederName"`
|
||||
}
|
||||
|
||||
type ApiToken struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Name string `json:"name" gorm:"uniqueIndex;not null"`
|
||||
Token string `json:"token" gorm:"not null"` // SHA-256 hash; the plaintext is shown only once at creation
|
||||
Enabled bool `json:"enabled" gorm:"default:true"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
|
||||
}
|
||||
|
||||
// MarshalJSON emits settings, streamSettings, and sniffing as nested JSON
|
||||
// objects rather than escaped strings, so API consumers don't need to JSON.parse
|
||||
// a string inside a string. Empty fields render as null; fields whose stored
|
||||
// text isn't valid JSON fall back to a JSON-encoded string so no data is lost.
|
||||
func (i Inbound) MarshalJSON() ([]byte, error) {
|
||||
type alias Inbound
|
||||
return json.Marshal(struct {
|
||||
alias
|
||||
Settings json.RawMessage `json:"settings"`
|
||||
StreamSettings json.RawMessage `json:"streamSettings"`
|
||||
Sniffing json.RawMessage `json:"sniffing"`
|
||||
}{
|
||||
alias: alias(i),
|
||||
Settings: jsonStringFieldToRaw(i.Settings),
|
||||
StreamSettings: jsonStringFieldToRaw(i.StreamSettings),
|
||||
Sniffing: jsonStringFieldToRaw(i.Sniffing),
|
||||
})
|
||||
}
|
||||
|
||||
// UnmarshalJSON accepts settings, streamSettings, and sniffing as either a raw
|
||||
// JSON object/array (the modern shape MarshalJSON emits) or a JSON-encoded
|
||||
// string (the legacy shape). Either form is normalised back to the JSON-text
|
||||
// string the DB column stores.
|
||||
func (i *Inbound) UnmarshalJSON(data []byte) error {
|
||||
type alias Inbound
|
||||
aux := struct {
|
||||
*alias
|
||||
Settings json.RawMessage `json:"settings"`
|
||||
StreamSettings json.RawMessage `json:"streamSettings"`
|
||||
Sniffing json.RawMessage `json:"sniffing"`
|
||||
}{
|
||||
alias: (*alias)(i),
|
||||
}
|
||||
if err := json.Unmarshal(data, &aux); err != nil {
|
||||
return err
|
||||
}
|
||||
i.Settings = jsonStringFieldFromRaw(aux.Settings)
|
||||
i.StreamSettings = jsonStringFieldFromRaw(aux.StreamSettings)
|
||||
i.Sniffing = jsonStringFieldFromRaw(aux.Sniffing)
|
||||
return nil
|
||||
}
|
||||
|
||||
func jsonStringFieldToRaw(s string) json.RawMessage {
|
||||
trimmed := strings.TrimSpace(s)
|
||||
if trimmed == "" {
|
||||
return json.RawMessage("null")
|
||||
}
|
||||
if json.Valid([]byte(trimmed)) {
|
||||
return json.RawMessage(trimmed)
|
||||
}
|
||||
b, _ := json.Marshal(s)
|
||||
return b
|
||||
}
|
||||
|
||||
func jsonStringFieldFromRaw(r json.RawMessage) string {
|
||||
trimmed := bytes.TrimSpace(r)
|
||||
if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
|
||||
return ""
|
||||
}
|
||||
if trimmed[0] == '"' {
|
||||
var s string
|
||||
if err := json.Unmarshal(trimmed, &s); err == nil {
|
||||
return s
|
||||
}
|
||||
}
|
||||
return string(trimmed)
|
||||
}
|
||||
|
||||
// GenXrayInboundConfig generates an Xray inbound configuration from the Inbound model.
|
||||
func (i *Inbound) GenXrayInboundConfig() *xray.InboundConfig {
|
||||
listen := i.Listen
|
||||
if listen == "" {
|
||||
listen = "0.0.0.0"
|
||||
}
|
||||
listen = fmt.Sprintf("\"%v\"", listen)
|
||||
protocol := string(i.Protocol)
|
||||
settings := i.Settings
|
||||
switch i.Protocol {
|
||||
case Shadowsocks:
|
||||
if healed, ok := HealShadowsocksClientMethods(settings); ok {
|
||||
settings = healed
|
||||
}
|
||||
case VMESS:
|
||||
if stripped, ok := StripVmessClientSecurity(settings); ok {
|
||||
settings = stripped
|
||||
}
|
||||
case VLESS:
|
||||
if stripped, ok := StripVlessInboundEncryption(settings); ok {
|
||||
settings = stripped
|
||||
}
|
||||
}
|
||||
return &xray.InboundConfig{
|
||||
Listen: json_util.RawMessage(listen),
|
||||
Port: i.Port,
|
||||
Protocol: protocol,
|
||||
Settings: json_util.RawMessage(settings),
|
||||
StreamSettings: json_util.RawMessage(i.StreamSettings),
|
||||
Tag: i.Tag,
|
||||
Sniffing: json_util.RawMessage(i.Sniffing),
|
||||
}
|
||||
}
|
||||
|
||||
func StripVmessClientSecurity(settings string) (string, bool) {
|
||||
if settings == "" {
|
||||
return settings, false
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(settings), &parsed); err != nil {
|
||||
return settings, false
|
||||
}
|
||||
clients, ok := parsed["clients"].([]any)
|
||||
if !ok {
|
||||
return settings, false
|
||||
}
|
||||
changed := false
|
||||
for i := range clients {
|
||||
cm, ok := clients[i].(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
if _, has := cm["security"]; has {
|
||||
delete(cm, "security")
|
||||
clients[i] = cm
|
||||
changed = true
|
||||
}
|
||||
}
|
||||
if !changed {
|
||||
return settings, false
|
||||
}
|
||||
out, err := json.MarshalIndent(parsed, "", " ")
|
||||
if err != nil {
|
||||
return settings, false
|
||||
}
|
||||
return string(out), true
|
||||
}
|
||||
|
||||
func StripVlessInboundEncryption(settings string) (string, bool) {
|
||||
if settings == "" {
|
||||
return settings, false
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(settings), &parsed); err != nil {
|
||||
return settings, false
|
||||
}
|
||||
if _, has := parsed["encryption"]; !has {
|
||||
return settings, false
|
||||
}
|
||||
delete(parsed, "encryption")
|
||||
out, err := json.MarshalIndent(parsed, "", " ")
|
||||
if err != nil {
|
||||
return settings, false
|
||||
}
|
||||
return string(out), true
|
||||
}
|
||||
|
||||
// HealShadowsocksClientMethods normalises the per-client `method` field
|
||||
// on a shadowsocks inbound's settings JSON before it leaves for xray-core:
|
||||
// - Legacy ciphers (aes-*, chacha20-*): every client must carry a
|
||||
// per-user `method` matching the inbound's top-level method, otherwise
|
||||
// xray fails with "unsupported cipher method:".
|
||||
// - Shadowsocks 2022 (2022-blake3-*): xray's multi-user code rejects the
|
||||
// inbound with "users must have empty method" when a client carries
|
||||
// one — strip stale entries left over from a switch off a legacy
|
||||
// cipher.
|
||||
//
|
||||
// Returns the rewritten settings string and true when anything changed.
|
||||
func HealShadowsocksClientMethods(settings string) (string, bool) {
|
||||
if settings == "" {
|
||||
return settings, false
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(settings), &parsed); err != nil {
|
||||
return settings, false
|
||||
}
|
||||
method, _ := parsed["method"].(string)
|
||||
clients, ok := parsed["clients"].([]any)
|
||||
if !ok {
|
||||
return settings, false
|
||||
}
|
||||
is2022 := strings.HasPrefix(method, "2022-blake3-")
|
||||
changed := false
|
||||
for i := range clients {
|
||||
cm, ok := clients[i].(map[string]any)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
if is2022 {
|
||||
if _, hasKey := cm["method"]; hasKey {
|
||||
delete(cm, "method")
|
||||
clients[i] = cm
|
||||
changed = true
|
||||
}
|
||||
continue
|
||||
}
|
||||
if method == "" {
|
||||
continue
|
||||
}
|
||||
existing, _ := cm["method"].(string)
|
||||
if existing == method {
|
||||
continue
|
||||
}
|
||||
cm["method"] = method
|
||||
clients[i] = cm
|
||||
changed = true
|
||||
}
|
||||
if !changed {
|
||||
return settings, false
|
||||
}
|
||||
out, err := json.MarshalIndent(parsed, "", " ")
|
||||
if err != nil {
|
||||
return settings, false
|
||||
}
|
||||
return string(out), true
|
||||
}
|
||||
|
||||
// GenerateFakeTLSSecret builds an MTProto FakeTLS secret for the given domain:
|
||||
// the "ee" FakeTLS marker, 16 random bytes, then the domain encoded as hex.
|
||||
// This single value is what mtg's config and the client tg:// link both use.
|
||||
func GenerateFakeTLSSecret(domain string) string {
|
||||
return "ee" + mtprotoRandomMiddle() + hex.EncodeToString([]byte(domain))
|
||||
}
|
||||
|
||||
func mtprotoRandomMiddle() string {
|
||||
buf := make([]byte, 16)
|
||||
if _, err := rand.Read(buf); err != nil {
|
||||
panic(fmt.Errorf("mtproto: crypto/rand read failed: %w", err))
|
||||
}
|
||||
return hex.EncodeToString(buf)
|
||||
}
|
||||
|
||||
// mtprotoSecretMiddle returns the 16-byte random middle of an existing secret
|
||||
// when it is well-formed, otherwise a freshly generated one. Reusing the middle
|
||||
// keeps the secret stable when only the FakeTLS domain changes.
|
||||
func mtprotoSecretMiddle(secret string) string {
|
||||
s := secret
|
||||
if strings.HasPrefix(s, "ee") || strings.HasPrefix(s, "dd") {
|
||||
s = s[2:]
|
||||
}
|
||||
if len(s) >= 32 {
|
||||
mid := s[:32]
|
||||
if _, err := hex.DecodeString(mid); err == nil {
|
||||
return mid
|
||||
}
|
||||
}
|
||||
return mtprotoRandomMiddle()
|
||||
}
|
||||
|
||||
// HealMtprotoSecret normalises an mtproto inbound's settings JSON before the
|
||||
// value leaves for the mtg sidecar or a share link: it rebuilds `secret` so it
|
||||
// is always a valid FakeTLS secret whose trailing domain matches
|
||||
// `fakeTlsDomain`, generating the random middle when one is missing and
|
||||
// rewriting the domain suffix when the domain changed. Returns the rewritten
|
||||
// settings and true when anything changed.
|
||||
func HealMtprotoSecret(settings string) (string, bool) {
|
||||
if settings == "" {
|
||||
return settings, false
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(settings), &parsed); err != nil {
|
||||
return settings, false
|
||||
}
|
||||
domain, _ := parsed["fakeTlsDomain"].(string)
|
||||
domain = strings.TrimSpace(domain)
|
||||
if domain == "" {
|
||||
return settings, false
|
||||
}
|
||||
secret, _ := parsed["secret"].(string)
|
||||
expected := "ee" + mtprotoSecretMiddle(secret) + hex.EncodeToString([]byte(domain))
|
||||
if secret == expected {
|
||||
return settings, false
|
||||
}
|
||||
parsed["secret"] = expected
|
||||
out, err := json.MarshalIndent(parsed, "", " ")
|
||||
if err != nil {
|
||||
return settings, false
|
||||
}
|
||||
return string(out), true
|
||||
}
|
||||
|
||||
// Setting stores key-value configuration settings for the 3x-ui panel.
|
||||
type Setting struct {
|
||||
Id int `json:"id" form:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Key string `json:"key" form:"key"`
|
||||
Value string `json:"value" form:"value"`
|
||||
}
|
||||
|
||||
// Node represents a remote 3x-ui panel registered with the central panel.
|
||||
// The central panel polls each node's existing /panel/api/server/status
|
||||
// endpoint over HTTP using the per-node ApiToken to populate the runtime
|
||||
// status fields below.
|
||||
type Node struct {
|
||||
Id int `json:"id" form:"id" gorm:"primaryKey;autoIncrement" example:"1"`
|
||||
Name string `json:"name" form:"name" gorm:"uniqueIndex" validate:"required" example:"de-fra-1"`
|
||||
Remark string `json:"remark" form:"remark"`
|
||||
Scheme string `json:"scheme" form:"scheme" validate:"omitempty,oneof=http https" example:"https"`
|
||||
Address string `json:"address" form:"address" validate:"required" example:"node1.example.com"`
|
||||
Port int `json:"port" form:"port" validate:"gte=1,lte=65535" example:"2053"`
|
||||
BasePath string `json:"basePath" form:"basePath" example:"/"`
|
||||
ApiToken string `json:"apiToken" form:"apiToken" validate:"required" example:"abcdef0123456789"`
|
||||
Enable bool `json:"enable" form:"enable" gorm:"default:true" example:"true"`
|
||||
AllowPrivateAddress bool `json:"allowPrivateAddress" form:"allowPrivateAddress" gorm:"default:false"`
|
||||
TlsVerifyMode string `json:"tlsVerifyMode" form:"tlsVerifyMode" gorm:"column:tls_verify_mode;default:verify" validate:"omitempty,oneof=verify skip pin"`
|
||||
PinnedCertSha256 string `json:"pinnedCertSha256" form:"pinnedCertSha256" gorm:"column:pinned_cert_sha256"`
|
||||
|
||||
// Guid is the remote panel's stable self-identifier (its panelGuid),
|
||||
// learned from each heartbeat. It is the globally stable node identity used
|
||||
// to attribute online clients/inbounds to the physical node across a chain
|
||||
// of nodes (#4983); panel-local autoincrement ids don't survive a hop.
|
||||
// Observed-state only — never user-edited.
|
||||
Guid string `json:"guid" gorm:"column:guid;index"`
|
||||
|
||||
// Heartbeat-updated fields. UpdatedAt advances on every probe even when
|
||||
// the row is otherwise unchanged so the UI's "last seen" tooltip is
|
||||
// truthful without us having to read LastHeartbeat separately.
|
||||
Status string `json:"status" gorm:"default:unknown" example:"online"` // online|offline|unknown
|
||||
LastHeartbeat int64 `json:"lastHeartbeat" example:"1700000000"` // unix seconds, 0 = never
|
||||
LatencyMs int `json:"latencyMs" example:"42"`
|
||||
XrayVersion string `json:"xrayVersion" example:"25.10.31"`
|
||||
PanelVersion string `json:"panelVersion" gorm:"column:panel_version" example:"v3.x.x"`
|
||||
CpuPct float64 `json:"cpuPct" example:"23.5"`
|
||||
MemPct float64 `json:"memPct" example:"45.1"`
|
||||
UptimeSecs uint64 `json:"uptimeSecs" example:"86400"`
|
||||
LastError string `json:"lastError"`
|
||||
|
||||
// XrayState and XrayError are captured from the remote node's /panel/api/server/status
|
||||
// during heartbeats. They let the central panel distinguish "panel API reachable"
|
||||
// (status=online) from "Xray core itself has failed on the node" for monitoring.
|
||||
XrayState string `json:"xrayState" gorm:"column:xray_state"`
|
||||
XrayError string `json:"xrayError" gorm:"column:xray_error"`
|
||||
|
||||
ConfigDirty bool `json:"configDirty" gorm:"default:false"`
|
||||
ConfigDirtyAt int64 `json:"configDirtyAt"`
|
||||
|
||||
InboundCount int `json:"inboundCount" gorm:"-" example:"5"`
|
||||
ClientCount int `json:"clientCount" gorm:"-" example:"27"`
|
||||
OnlineCount int `json:"onlineCount" gorm:"-" example:"3"`
|
||||
DepletedCount int `json:"depletedCount" gorm:"-" example:"1"`
|
||||
|
||||
// ParentGuid + Transitive are set only when a node is surfaced as part of a
|
||||
// node tree (#4983): direct nodes carry the master panel's own GUID, a
|
||||
// transitive sub-node carries its parent node's GUID. Transitive nodes are
|
||||
// read-only projections (Id == 0, not persisted) — never edited or deployed.
|
||||
ParentGuid string `json:"parentGuid,omitempty" gorm:"-"`
|
||||
Transitive bool `json:"transitive,omitempty" gorm:"-"`
|
||||
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli" example:"1700000000"`
|
||||
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli" example:"1700000000"`
|
||||
}
|
||||
|
||||
// NodeSummary is the read-only identity of a node as published one hop up: the
|
||||
// view a panel exposes about the nodes it directly manages, so a master can
|
||||
// surface transitive sub-nodes in a chained topology (#4983). Counts are
|
||||
// computed by the consuming master from its own per-GUID data, never trusted
|
||||
// from the child, so this carries identity/health only.
|
||||
type NodeSummary struct {
|
||||
Guid string `json:"guid"`
|
||||
ParentGuid string `json:"parentGuid"`
|
||||
Name string `json:"name"`
|
||||
Address string `json:"address"`
|
||||
Scheme string `json:"scheme"`
|
||||
Port int `json:"port"`
|
||||
Status string `json:"status"`
|
||||
LastHeartbeat int64 `json:"lastHeartbeat"`
|
||||
LatencyMs int `json:"latencyMs"`
|
||||
PanelVersion string `json:"panelVersion"`
|
||||
XrayVersion string `json:"xrayVersion"`
|
||||
// XrayState/XrayError forwarded so masters can surface xray failure on transitive sub-nodes too.
|
||||
XrayState string `json:"xrayState"`
|
||||
XrayError string `json:"xrayError,omitempty"`
|
||||
}
|
||||
|
||||
type CustomGeoResource struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Type string `json:"type" gorm:"not null;uniqueIndex:idx_custom_geo_type_alias;column:geo_type"`
|
||||
Alias string `json:"alias" gorm:"not null;uniqueIndex:idx_custom_geo_type_alias"`
|
||||
Url string `json:"url" gorm:"not null"`
|
||||
LocalPath string `json:"localPath" gorm:"column:local_path"`
|
||||
LastUpdatedAt int64 `json:"lastUpdatedAt" gorm:"default:0;column:last_updated_at"`
|
||||
LastModified string `json:"lastModified" gorm:"column:last_modified"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli;column:created_at"`
|
||||
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli;column:updated_at"`
|
||||
}
|
||||
|
||||
type ClientReverse struct {
|
||||
Tag string `json:"tag"`
|
||||
}
|
||||
|
||||
// Client represents a client configuration for Xray inbounds with traffic limits and settings.
|
||||
type Client struct {
|
||||
ID string `json:"id,omitempty"` // Unique client identifier
|
||||
Security string `json:"security"` // Security method (e.g., "auto", "aes-128-gcm")
|
||||
Password string `json:"password,omitempty"` // Client password
|
||||
Flow string `json:"flow,omitempty"` // Flow control (XTLS)
|
||||
Reverse *ClientReverse `json:"reverse,omitempty"` // VLESS simple reverse proxy settings
|
||||
Auth string `json:"auth,omitempty"` // Auth password (Hysteria)
|
||||
Email string `json:"email"` // Client email identifier
|
||||
LimitIP int `json:"limitIp"` // IP limit for this client
|
||||
TotalGB int64 `json:"totalGB" form:"totalGB"` // Total traffic limit in GB
|
||||
ExpiryTime int64 `json:"expiryTime" form:"expiryTime"` // Expiration timestamp
|
||||
Enable bool `json:"enable" form:"enable"` // Whether the client is enabled
|
||||
TgID int64 `json:"tgId" form:"tgId"` // Telegram user ID for notifications
|
||||
SubID string `json:"subId" form:"subId"` // Subscription identifier
|
||||
Group string `json:"group,omitempty" form:"group"` // Logical grouping label
|
||||
Comment string `json:"comment" form:"comment"` // Client comment
|
||||
Reset int `json:"reset" form:"reset"` // Reset period in days
|
||||
CreatedAt int64 `json:"created_at,omitempty"` // Creation timestamp
|
||||
UpdatedAt int64 `json:"updated_at,omitempty"` // Last update timestamp
|
||||
}
|
||||
|
||||
type ClientRecord struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Email string `json:"email" gorm:"uniqueIndex;not null"`
|
||||
SubID string `json:"subId" gorm:"index;column:sub_id"`
|
||||
UUID string `json:"uuid" gorm:"column:uuid"`
|
||||
Password string `json:"password"`
|
||||
Auth string `json:"auth"`
|
||||
Flow string `json:"flow"`
|
||||
Security string `json:"security"`
|
||||
Reverse string `json:"reverse" gorm:"column:reverse"`
|
||||
LimitIP int `json:"limitIp" gorm:"column:limit_ip"`
|
||||
TotalGB int64 `json:"totalGB" gorm:"column:total_gb"`
|
||||
ExpiryTime int64 `json:"expiryTime" gorm:"column:expiry_time"`
|
||||
Enable bool `json:"enable" gorm:"default:true"`
|
||||
TgID int64 `json:"tgId" gorm:"column:tg_id"`
|
||||
Group string `json:"group" gorm:"column:group_name;default:''"`
|
||||
Comment string `json:"comment"`
|
||||
Reset int `json:"reset" gorm:"default:0"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
|
||||
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli"`
|
||||
}
|
||||
|
||||
func (ClientRecord) TableName() string { return "clients" }
|
||||
|
||||
type ClientGroup struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Name string `json:"name" gorm:"uniqueIndex;not null"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
|
||||
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli"`
|
||||
}
|
||||
|
||||
func (ClientGroup) TableName() string { return "client_groups" }
|
||||
|
||||
// MarshalJSON emits the reverse column as a nested JSON object rather than an
|
||||
// escaped JSON-text string, matching the same convention Inbound uses for its
|
||||
// JSON-text columns. Empty storage renders as null.
|
||||
func (r ClientRecord) MarshalJSON() ([]byte, error) {
|
||||
type alias ClientRecord
|
||||
return json.Marshal(struct {
|
||||
alias
|
||||
Reverse json.RawMessage `json:"reverse"`
|
||||
}{
|
||||
alias: alias(r),
|
||||
Reverse: jsonStringFieldToRaw(r.Reverse),
|
||||
})
|
||||
}
|
||||
|
||||
// UnmarshalJSON accepts reverse as either a JSON object (modern shape) or a
|
||||
// JSON-encoded string (legacy shape).
|
||||
func (r *ClientRecord) UnmarshalJSON(data []byte) error {
|
||||
type alias ClientRecord
|
||||
aux := struct {
|
||||
*alias
|
||||
Reverse json.RawMessage `json:"reverse"`
|
||||
}{
|
||||
alias: (*alias)(r),
|
||||
}
|
||||
if err := json.Unmarshal(data, &aux); err != nil {
|
||||
return err
|
||||
}
|
||||
r.Reverse = jsonStringFieldFromRaw(aux.Reverse)
|
||||
return nil
|
||||
}
|
||||
|
||||
type ClientInbound struct {
|
||||
ClientId int `json:"clientId" gorm:"primaryKey;column:client_id;index"`
|
||||
InboundId int `json:"inboundId" gorm:"primaryKey;column:inbound_id;index"`
|
||||
FlowOverride string `json:"flowOverride" gorm:"column:flow_override"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
|
||||
}
|
||||
|
||||
func (ClientInbound) TableName() string { return "client_inbounds" }
|
||||
|
||||
type InboundFallback struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
MasterId int `json:"masterId" gorm:"index;not null;column:master_id"`
|
||||
ChildId int `json:"childId" gorm:"index;not null;column:child_id"`
|
||||
Name string `json:"name"`
|
||||
Alpn string `json:"alpn"`
|
||||
Path string `json:"path"`
|
||||
Dest string `json:"dest"`
|
||||
Xver int `json:"xver"`
|
||||
SortOrder int `json:"sortOrder" gorm:"default:0;column:sort_order"`
|
||||
}
|
||||
|
||||
func (InboundFallback) TableName() string { return "inbound_fallbacks" }
|
||||
|
||||
func (c *Client) ToRecord() *ClientRecord {
|
||||
rec := &ClientRecord{
|
||||
Email: c.Email,
|
||||
SubID: c.SubID,
|
||||
UUID: c.ID,
|
||||
Password: c.Password,
|
||||
Auth: c.Auth,
|
||||
Flow: c.Flow,
|
||||
Security: c.Security,
|
||||
LimitIP: c.LimitIP,
|
||||
TotalGB: c.TotalGB,
|
||||
ExpiryTime: c.ExpiryTime,
|
||||
Enable: c.Enable,
|
||||
TgID: c.TgID,
|
||||
Group: c.Group,
|
||||
Comment: c.Comment,
|
||||
Reset: c.Reset,
|
||||
CreatedAt: c.CreatedAt,
|
||||
UpdatedAt: c.UpdatedAt,
|
||||
}
|
||||
if c.Reverse != nil {
|
||||
if b, err := json.Marshal(c.Reverse); err == nil {
|
||||
rec.Reverse = string(b)
|
||||
}
|
||||
}
|
||||
return rec
|
||||
}
|
||||
|
||||
func (r *ClientRecord) ToClient() *Client {
|
||||
c := &Client{
|
||||
ID: r.UUID,
|
||||
Email: r.Email,
|
||||
SubID: r.SubID,
|
||||
Password: r.Password,
|
||||
Auth: r.Auth,
|
||||
Flow: r.Flow,
|
||||
Security: r.Security,
|
||||
LimitIP: r.LimitIP,
|
||||
TotalGB: r.TotalGB,
|
||||
ExpiryTime: r.ExpiryTime,
|
||||
Enable: r.Enable,
|
||||
TgID: r.TgID,
|
||||
Group: r.Group,
|
||||
Comment: r.Comment,
|
||||
Reset: r.Reset,
|
||||
CreatedAt: r.CreatedAt,
|
||||
UpdatedAt: r.UpdatedAt,
|
||||
}
|
||||
if r.Reverse != "" {
|
||||
var rev ClientReverse
|
||||
if err := json.Unmarshal([]byte(r.Reverse), &rev); err == nil {
|
||||
c.Reverse = &rev
|
||||
}
|
||||
}
|
||||
return c
|
||||
}
|
||||
|
||||
type ClientMergeConflict struct {
|
||||
Field string
|
||||
Old any
|
||||
New any
|
||||
Kept any
|
||||
}
|
||||
|
||||
type OutboundSubscription struct {
|
||||
Id int `json:"id" form:"id" gorm:"primaryKey;autoIncrement"`
|
||||
Remark string `json:"remark" form:"remark"`
|
||||
Url string `json:"url" form:"url"`
|
||||
Enabled bool `json:"enabled" form:"enabled" gorm:"default:true"`
|
||||
AllowPrivate bool `json:"allowPrivate" form:"allowPrivate" gorm:"default:false"`
|
||||
TagPrefix string `json:"tagPrefix" form:"tagPrefix"`
|
||||
UpdateInterval int `json:"updateInterval" form:"updateInterval" gorm:"default:600"` // seconds between refreshes
|
||||
Priority int `json:"priority" form:"priority" gorm:"default:0"` // order among subscriptions in the merged outbounds (lower = earlier)
|
||||
Prepend bool `json:"prepend" form:"prepend" gorm:"default:false"` // place this subscription's outbounds before the manual template outbounds
|
||||
LastUpdated int64 `json:"lastUpdated" form:"lastUpdated"`
|
||||
LastError string `json:"lastError" form:"lastError"`
|
||||
LastFetchedOutbounds string `json:"lastFetchedOutbounds" form:"lastFetchedOutbounds" gorm:"type:text"`
|
||||
LinkIdentities string `json:"-" gorm:"type:text;column:link_identities"`
|
||||
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
|
||||
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli"`
|
||||
OutboundCount int `json:"outboundCount" gorm:"-"`
|
||||
}
|
||||
|
||||
func MergeClientRecord(existing *ClientRecord, incoming *ClientRecord) []ClientMergeConflict {
|
||||
var conflicts []ClientMergeConflict
|
||||
keep := func(field string, oldV, newV, kept any) {
|
||||
conflicts = append(conflicts, ClientMergeConflict{Field: field, Old: oldV, New: newV, Kept: kept})
|
||||
}
|
||||
const redacted = "<redacted>"
|
||||
keepSecret := func(field string) {
|
||||
conflicts = append(conflicts, ClientMergeConflict{Field: field, Old: redacted, New: redacted, Kept: redacted})
|
||||
}
|
||||
|
||||
incomingNewer := incoming.UpdatedAt > existing.UpdatedAt ||
|
||||
(incoming.UpdatedAt == existing.UpdatedAt && incoming.CreatedAt > existing.CreatedAt)
|
||||
|
||||
if existing.UUID != incoming.UUID && incoming.UUID != "" {
|
||||
if incomingNewer || existing.UUID == "" {
|
||||
existing.UUID = incoming.UUID
|
||||
}
|
||||
keepSecret("uuid")
|
||||
}
|
||||
if existing.Password != incoming.Password && incoming.Password != "" {
|
||||
if incomingNewer || existing.Password == "" {
|
||||
existing.Password = incoming.Password
|
||||
keepSecret("password")
|
||||
}
|
||||
}
|
||||
if existing.Auth != incoming.Auth && incoming.Auth != "" {
|
||||
if incomingNewer || existing.Auth == "" {
|
||||
existing.Auth = incoming.Auth
|
||||
keepSecret("auth")
|
||||
}
|
||||
}
|
||||
if existing.Flow != incoming.Flow && incoming.Flow != "" {
|
||||
if incomingNewer || existing.Flow == "" {
|
||||
keep("flow", existing.Flow, incoming.Flow, incoming.Flow)
|
||||
existing.Flow = incoming.Flow
|
||||
}
|
||||
}
|
||||
if existing.Security != incoming.Security && incoming.Security != "" {
|
||||
if incomingNewer || existing.Security == "" {
|
||||
keep("security", existing.Security, incoming.Security, incoming.Security)
|
||||
existing.Security = incoming.Security
|
||||
}
|
||||
}
|
||||
if existing.SubID != incoming.SubID && incoming.SubID != "" {
|
||||
if incomingNewer || existing.SubID == "" {
|
||||
existing.SubID = incoming.SubID
|
||||
keepSecret("subId")
|
||||
}
|
||||
}
|
||||
if existing.TotalGB != incoming.TotalGB {
|
||||
picked := existing.TotalGB
|
||||
if existing.TotalGB == 0 || (incoming.TotalGB != 0 && incoming.TotalGB > existing.TotalGB) {
|
||||
picked = incoming.TotalGB
|
||||
}
|
||||
if picked != existing.TotalGB {
|
||||
keep("totalGB", existing.TotalGB, incoming.TotalGB, picked)
|
||||
existing.TotalGB = picked
|
||||
}
|
||||
}
|
||||
if existing.ExpiryTime != incoming.ExpiryTime {
|
||||
picked := existing.ExpiryTime
|
||||
if existing.ExpiryTime == 0 || (incoming.ExpiryTime != 0 && incoming.ExpiryTime > existing.ExpiryTime) {
|
||||
picked = incoming.ExpiryTime
|
||||
}
|
||||
if picked != existing.ExpiryTime {
|
||||
keep("expiryTime", existing.ExpiryTime, incoming.ExpiryTime, picked)
|
||||
existing.ExpiryTime = picked
|
||||
}
|
||||
}
|
||||
if existing.LimitIP != incoming.LimitIP && incoming.LimitIP != 0 {
|
||||
picked := existing.LimitIP
|
||||
if existing.LimitIP == 0 || incoming.LimitIP > existing.LimitIP {
|
||||
picked = incoming.LimitIP
|
||||
}
|
||||
if picked != existing.LimitIP {
|
||||
keep("limitIp", existing.LimitIP, incoming.LimitIP, picked)
|
||||
existing.LimitIP = picked
|
||||
}
|
||||
}
|
||||
if existing.TgID != incoming.TgID && incoming.TgID != 0 {
|
||||
if incomingNewer || existing.TgID == 0 {
|
||||
keep("tgId", existing.TgID, incoming.TgID, incoming.TgID)
|
||||
existing.TgID = incoming.TgID
|
||||
}
|
||||
}
|
||||
if existing.Reset != incoming.Reset && incoming.Reset != 0 {
|
||||
if incomingNewer || existing.Reset == 0 {
|
||||
keep("reset", existing.Reset, incoming.Reset, incoming.Reset)
|
||||
existing.Reset = incoming.Reset
|
||||
}
|
||||
}
|
||||
if existing.Reverse != incoming.Reverse && incoming.Reverse != "" {
|
||||
if incomingNewer || existing.Reverse == "" {
|
||||
keep("reverse", existing.Reverse, incoming.Reverse, incoming.Reverse)
|
||||
existing.Reverse = incoming.Reverse
|
||||
}
|
||||
}
|
||||
if existing.Comment != incoming.Comment && incoming.Comment != "" {
|
||||
if incomingNewer || existing.Comment == "" {
|
||||
keep("comment", existing.Comment, incoming.Comment, incoming.Comment)
|
||||
existing.Comment = incoming.Comment
|
||||
}
|
||||
}
|
||||
if existing.Group != incoming.Group && incoming.Group != "" {
|
||||
if incomingNewer || existing.Group == "" {
|
||||
keep("group", existing.Group, incoming.Group, incoming.Group)
|
||||
existing.Group = incoming.Group
|
||||
}
|
||||
}
|
||||
if existing.Enable != incoming.Enable {
|
||||
if incoming.Enable {
|
||||
if !existing.Enable {
|
||||
keep("enable", existing.Enable, incoming.Enable, true)
|
||||
existing.Enable = true
|
||||
}
|
||||
}
|
||||
}
|
||||
if incoming.CreatedAt != 0 && (existing.CreatedAt == 0 || incoming.CreatedAt < existing.CreatedAt) {
|
||||
existing.CreatedAt = incoming.CreatedAt
|
||||
}
|
||||
if incoming.UpdatedAt > existing.UpdatedAt {
|
||||
existing.UpdatedAt = incoming.UpdatedAt
|
||||
}
|
||||
return conflicts
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
package model
|
||||
|
||||
import (
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestGenerateFakeTLSSecret(t *testing.T) {
|
||||
domain := "www.cloudflare.com"
|
||||
s := GenerateFakeTLSSecret(domain)
|
||||
if !strings.HasPrefix(s, "ee") {
|
||||
t.Fatalf("secret must start with ee, got %q", s)
|
||||
}
|
||||
wantSuffix := hex.EncodeToString([]byte(domain))
|
||||
if !strings.HasSuffix(s, wantSuffix) {
|
||||
t.Fatalf("secret must end with hex(domain) %q, got %q", wantSuffix, s)
|
||||
}
|
||||
if len(s) != 2+32+len(wantSuffix) {
|
||||
t.Fatalf("unexpected secret length %d", len(s))
|
||||
}
|
||||
if _, err := hex.DecodeString(s[2:34]); err != nil {
|
||||
t.Fatalf("middle is not valid hex: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHealMtprotoSecret(t *testing.T) {
|
||||
domain := "example.com"
|
||||
suffix := hex.EncodeToString([]byte(domain))
|
||||
|
||||
in := `{"fakeTlsDomain":"example.com","secret":""}`
|
||||
out, changed := HealMtprotoSecret(in)
|
||||
if !changed {
|
||||
t.Fatal("expected heal to populate an empty secret")
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal([]byte(out), &parsed); err != nil {
|
||||
t.Fatalf("healed settings not valid json: %v", err)
|
||||
}
|
||||
got, _ := parsed["secret"].(string)
|
||||
if !strings.HasPrefix(got, "ee") || !strings.HasSuffix(got, suffix) {
|
||||
t.Fatalf("healed secret malformed: %q", got)
|
||||
}
|
||||
|
||||
if _, changed2 := HealMtprotoSecret(out); changed2 {
|
||||
t.Fatal("expected no change for an already-valid secret")
|
||||
}
|
||||
|
||||
mid := got[2:34]
|
||||
newDomain := "telegram.org"
|
||||
in3 := `{"fakeTlsDomain":"telegram.org","secret":"` + got + `"}`
|
||||
out3, changed3 := HealMtprotoSecret(in3)
|
||||
if !changed3 {
|
||||
t.Fatal("expected heal to rewrite the domain suffix")
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out3), &parsed); err != nil {
|
||||
t.Fatalf("healed settings not valid json: %v", err)
|
||||
}
|
||||
got3, _ := parsed["secret"].(string)
|
||||
if got3[2:34] != mid {
|
||||
t.Fatalf("random middle should be preserved on domain change: %q vs %q", got3[2:34], mid)
|
||||
}
|
||||
if !strings.HasSuffix(got3, hex.EncodeToString([]byte(newDomain))) {
|
||||
t.Fatalf("suffix not updated for new domain: %q", got3)
|
||||
}
|
||||
|
||||
if _, changed4 := HealMtprotoSecret(`{"secret":"ee"}`); changed4 {
|
||||
t.Fatal("expected no change when fakeTlsDomain is missing")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
package model
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestInboundMarshalJSONNestsObjectFields(t *testing.T) {
|
||||
in := Inbound{
|
||||
Id: 7,
|
||||
Protocol: VLESS,
|
||||
Port: 443,
|
||||
Settings: `{"clients":[],"decryption":"none"}`,
|
||||
StreamSettings: `{"network":"tcp"}`,
|
||||
Sniffing: `{"enabled":true}`,
|
||||
}
|
||||
out, err := json.Marshal(in)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
t.Fatalf("output is not valid JSON: %v", err)
|
||||
}
|
||||
for _, field := range []string{"settings", "streamSettings", "sniffing"} {
|
||||
if _, ok := parsed[field].(map[string]any); !ok {
|
||||
t.Errorf("expected %s to marshal as a JSON object, got %T", field, parsed[field])
|
||||
}
|
||||
}
|
||||
if strings.Contains(string(out), `"settings":"`) {
|
||||
t.Errorf("settings should not be emitted as a JSON string: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundMarshalJSONEmptyFieldsBecomeNull(t *testing.T) {
|
||||
in := Inbound{Id: 1, Protocol: VLESS}
|
||||
out, err := json.Marshal(in)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
t.Fatalf("output is not valid JSON: %v", err)
|
||||
}
|
||||
for _, field := range []string{"settings", "streamSettings", "sniffing"} {
|
||||
if parsed[field] != nil {
|
||||
t.Errorf("expected %s to be null, got %v", field, parsed[field])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundUnmarshalJSONAcceptsBothShapes(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
body string
|
||||
}{
|
||||
{
|
||||
name: "nested objects (modern)",
|
||||
body: `{"id":1,"settings":{"clients":[],"decryption":"none"},"streamSettings":{"network":"tcp"},"sniffing":{"enabled":true}}`,
|
||||
},
|
||||
{
|
||||
name: "JSON-encoded strings (legacy)",
|
||||
body: `{"id":1,"settings":"{\"clients\":[],\"decryption\":\"none\"}","streamSettings":"{\"network\":\"tcp\"}","sniffing":"{\"enabled\":true}"}`,
|
||||
},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var in Inbound
|
||||
if err := json.Unmarshal([]byte(tc.body), &in); err != nil {
|
||||
t.Fatalf("Unmarshal failed: %v", err)
|
||||
}
|
||||
if !strings.Contains(in.Settings, `"decryption":"none"`) {
|
||||
t.Errorf("Settings not normalised: %q", in.Settings)
|
||||
}
|
||||
if !strings.Contains(in.StreamSettings, `"network":"tcp"`) {
|
||||
t.Errorf("StreamSettings not normalised: %q", in.StreamSettings)
|
||||
}
|
||||
if !strings.Contains(in.Sniffing, `"enabled":true`) {
|
||||
t.Errorf("Sniffing not normalised: %q", in.Sniffing)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundMarshalJSONInvalidTextFallsBackToString(t *testing.T) {
|
||||
in := Inbound{Id: 1, Settings: "not json at all"}
|
||||
out, err := json.Marshal(in)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
if !strings.Contains(string(out), `"settings":"not json at all"`) {
|
||||
t.Errorf("expected invalid settings text to be wrapped as a JSON string, got %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestClientRecordMarshalJSONNestsReverse(t *testing.T) {
|
||||
rec := ClientRecord{Id: 1, Email: "alice@example.com", Reverse: `{"tag":"vless-in"}`}
|
||||
out, err := json.Marshal(rec)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
t.Fatalf("output is not valid JSON: %v", err)
|
||||
}
|
||||
obj, ok := parsed["reverse"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("expected reverse to marshal as a JSON object, got %T", parsed["reverse"])
|
||||
}
|
||||
if obj["tag"] != "vless-in" {
|
||||
t.Errorf("expected tag to be preserved, got %v", obj["tag"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestClientRecordMarshalJSONEmptyReverseIsNull(t *testing.T) {
|
||||
rec := ClientRecord{Id: 1, Email: "alice@example.com"}
|
||||
out, err := json.Marshal(rec)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
t.Fatalf("output is not valid JSON: %v", err)
|
||||
}
|
||||
if parsed["reverse"] != nil {
|
||||
t.Errorf("expected reverse to be null, got %v", parsed["reverse"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestClientRecordUnmarshalJSONAcceptsBothShapes(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
body string
|
||||
}{
|
||||
{name: "nested object", body: `{"id":1,"reverse":{"tag":"vless-in"}}`},
|
||||
{name: "legacy string", body: `{"id":1,"reverse":"{\"tag\":\"vless-in\"}"}`},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var rec ClientRecord
|
||||
if err := json.Unmarshal([]byte(tc.body), &rec); err != nil {
|
||||
t.Fatalf("Unmarshal failed: %v", err)
|
||||
}
|
||||
if !strings.Contains(rec.Reverse, `"tag":"vless-in"`) {
|
||||
t.Errorf("Reverse not normalised: %q", rec.Reverse)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundClientIpsMarshalJSONNestsArray(t *testing.T) {
|
||||
row := InboundClientIps{Id: 1, ClientEmail: "alice@example.com", Ips: `[{"ip":"1.2.3.4","timestamp":1700000000}]`}
|
||||
out, err := json.Marshal(row)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal failed: %v", err)
|
||||
}
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
t.Fatalf("output is not valid JSON: %v", err)
|
||||
}
|
||||
arr, ok := parsed["ips"].([]any)
|
||||
if !ok {
|
||||
t.Fatalf("expected ips to marshal as a JSON array, got %T", parsed["ips"])
|
||||
}
|
||||
if len(arr) != 1 {
|
||||
t.Errorf("expected 1 entry, got %d", len(arr))
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundClientIpsUnmarshalJSONAcceptsBothShapes(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
body string
|
||||
}{
|
||||
{name: "nested array", body: `{"id":1,"ips":[{"ip":"1.2.3.4","timestamp":1}]}`},
|
||||
{name: "legacy string", body: `{"id":1,"ips":"[{\"ip\":\"1.2.3.4\",\"timestamp\":1}]"}`},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var row InboundClientIps
|
||||
if err := json.Unmarshal([]byte(tc.body), &row); err != nil {
|
||||
t.Fatalf("Unmarshal failed: %v", err)
|
||||
}
|
||||
if !strings.Contains(row.Ips, `"ip":"1.2.3.4"`) {
|
||||
t.Errorf("Ips not normalised: %q", row.Ips)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
package model
|
||||
|
||||
type NodeClientTraffic struct {
|
||||
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
|
||||
NodeId int `json:"nodeId" gorm:"uniqueIndex:idx_node_email,priority:1;not null"`
|
||||
Email string `json:"email" gorm:"uniqueIndex:idx_node_email,priority:2;not null"`
|
||||
Up int64 `json:"up"`
|
||||
Down int64 `json:"down"`
|
||||
}
|
||||
@@ -0,0 +1,223 @@
|
||||
// Package logger provides logging functionality for the 3x-ui panel with
|
||||
// dual-backend logging (console/syslog and file) and buffered log storage for web UI.
|
||||
package logger
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/config"
|
||||
"github.com/op/go-logging"
|
||||
|
||||
"gopkg.in/natefinch/lumberjack.v2"
|
||||
)
|
||||
|
||||
const (
|
||||
maxLogBufferSize = 10240 // Maximum log entries kept in memory
|
||||
logFileName = "3xui.log" // Log file name
|
||||
timeFormat = "2006/01/02 15:04:05" // Log timestamp format
|
||||
|
||||
// On-disk rotation limits — single file capped, old segments pruned automatically.
|
||||
maxLogFileMB = 10 // rotate active log when larger than this
|
||||
maxLogBackups = 5 // rotated files retained (beyond current segment)
|
||||
maxLogAgeDays = 7 // remove rotated backups older than this (0 disables time-based pruning)
|
||||
compressRotated = true
|
||||
)
|
||||
|
||||
var (
|
||||
logger *logging.Logger
|
||||
fileRotate *lumberjack.Logger // nil when file backend disabled
|
||||
|
||||
// logBuffer maintains recent log entries in memory for web UI retrieval
|
||||
logBuffer []struct {
|
||||
time string
|
||||
level logging.Level
|
||||
log string
|
||||
}
|
||||
)
|
||||
|
||||
// InitLogger initializes dual logging backends: console/syslog and file.
|
||||
// Console logging uses the specified level, file logging always uses DEBUG level.
|
||||
func InitLogger(level logging.Level) {
|
||||
newLogger := logging.MustGetLogger("x-ui")
|
||||
backends := make([]logging.Backend, 0, 2)
|
||||
|
||||
// Console/syslog backend with configurable level
|
||||
if consoleBackend := initDefaultBackend(); consoleBackend != nil {
|
||||
leveledBackend := logging.AddModuleLevel(consoleBackend)
|
||||
leveledBackend.SetLevel(level, "x-ui")
|
||||
backends = append(backends, leveledBackend)
|
||||
}
|
||||
|
||||
// File backend with DEBUG level for comprehensive logging
|
||||
if fileBackend := initFileBackend(); fileBackend != nil {
|
||||
leveledBackend := logging.AddModuleLevel(fileBackend)
|
||||
leveledBackend.SetLevel(logging.DEBUG, "x-ui")
|
||||
backends = append(backends, leveledBackend)
|
||||
}
|
||||
|
||||
multiBackend := logging.MultiLogger(backends...)
|
||||
newLogger.SetBackend(multiBackend)
|
||||
logger = newLogger
|
||||
}
|
||||
|
||||
// initDefaultBackend creates the console/syslog logging backend.
|
||||
// Windows: Uses stderr directly (no syslog support)
|
||||
// Unix-like: Attempts syslog, falls back to stderr
|
||||
func initDefaultBackend() logging.Backend {
|
||||
var backend logging.Backend
|
||||
includeTime := false
|
||||
|
||||
if runtime.GOOS == "windows" {
|
||||
// Windows: Use stderr directly (no syslog support)
|
||||
backend = logging.NewLogBackend(os.Stderr, "", 0)
|
||||
includeTime = true
|
||||
} else {
|
||||
// Unix-like: Try syslog, fallback to stderr
|
||||
if syslogBackend, err := logging.NewSyslogBackend(""); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "syslog backend disabled: %v\n", err)
|
||||
backend = logging.NewLogBackend(os.Stderr, "", 0)
|
||||
includeTime = os.Getppid() > 0
|
||||
} else {
|
||||
backend = syslogBackend
|
||||
}
|
||||
}
|
||||
|
||||
return logging.NewBackendFormatter(backend, newFormatter(includeTime))
|
||||
}
|
||||
|
||||
// initFileBackend creates the file logging backend with size/age‑bounded rotation
|
||||
// so log volume cannot grow without limit on disk.
|
||||
func initFileBackend() logging.Backend {
|
||||
logDir := config.GetLogFolder()
|
||||
if err := os.MkdirAll(logDir, 0o750); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "failed to create log folder %s: %v\n", logDir, err)
|
||||
return nil
|
||||
}
|
||||
|
||||
logPath := filepath.Join(logDir, logFileName)
|
||||
fileRotate = &lumberjack.Logger{
|
||||
Filename: logPath,
|
||||
MaxSize: maxLogFileMB,
|
||||
MaxBackups: maxLogBackups,
|
||||
MaxAge: maxLogAgeDays,
|
||||
LocalTime: true,
|
||||
Compress: compressRotated,
|
||||
}
|
||||
|
||||
backend := logging.NewLogBackend(fileRotate, "", 0)
|
||||
return logging.NewBackendFormatter(backend, newFormatter(true))
|
||||
}
|
||||
|
||||
// newFormatter creates a log formatter with optional timestamp.
|
||||
func newFormatter(withTime bool) logging.Formatter {
|
||||
format := `%{level} - %{message}`
|
||||
if withTime {
|
||||
format = `%{time:` + timeFormat + `} %{level} - %{message}`
|
||||
}
|
||||
return logging.MustStringFormatter(format)
|
||||
}
|
||||
|
||||
// CloseLogger closes the rotating log writer and cleans up resources.
|
||||
// Should be called during application shutdown.
|
||||
func CloseLogger() {
|
||||
if fileRotate != nil {
|
||||
_ = fileRotate.Close()
|
||||
fileRotate = nil
|
||||
}
|
||||
}
|
||||
|
||||
// Debug logs a debug message and adds it to the log buffer.
|
||||
func Debug(args ...any) {
|
||||
logger.Debug(args...)
|
||||
addToBuffer("DEBUG", fmt.Sprint(args...))
|
||||
}
|
||||
|
||||
// Debugf logs a formatted debug message and adds it to the log buffer.
|
||||
func Debugf(format string, args ...any) {
|
||||
logger.Debugf(format, args...)
|
||||
addToBuffer("DEBUG", fmt.Sprintf(format, args...))
|
||||
}
|
||||
|
||||
// Info logs an info message and adds it to the log buffer.
|
||||
func Info(args ...any) {
|
||||
logger.Info(args...)
|
||||
addToBuffer("INFO", fmt.Sprint(args...))
|
||||
}
|
||||
|
||||
// Infof logs a formatted info message and adds it to the log buffer.
|
||||
func Infof(format string, args ...any) {
|
||||
logger.Infof(format, args...)
|
||||
addToBuffer("INFO", fmt.Sprintf(format, args...))
|
||||
}
|
||||
|
||||
// Notice logs a notice message and adds it to the log buffer.
|
||||
func Notice(args ...any) {
|
||||
logger.Notice(args...)
|
||||
addToBuffer("NOTICE", fmt.Sprint(args...))
|
||||
}
|
||||
|
||||
// Noticef logs a formatted notice message and adds it to the log buffer.
|
||||
func Noticef(format string, args ...any) {
|
||||
logger.Noticef(format, args...)
|
||||
addToBuffer("NOTICE", fmt.Sprintf(format, args...))
|
||||
}
|
||||
|
||||
// Warning logs a warning message and adds it to the log buffer.
|
||||
func Warning(args ...any) {
|
||||
logger.Warning(args...)
|
||||
addToBuffer("WARNING", fmt.Sprint(args...))
|
||||
}
|
||||
|
||||
// Warningf logs a formatted warning message and adds it to the log buffer.
|
||||
func Warningf(format string, args ...any) {
|
||||
logger.Warningf(format, args...)
|
||||
addToBuffer("WARNING", fmt.Sprintf(format, args...))
|
||||
}
|
||||
|
||||
// Error logs an error message and adds it to the log buffer.
|
||||
func Error(args ...any) {
|
||||
logger.Error(args...)
|
||||
addToBuffer("ERROR", fmt.Sprint(args...))
|
||||
}
|
||||
|
||||
// Errorf logs a formatted error message and adds it to the log buffer.
|
||||
func Errorf(format string, args ...any) {
|
||||
logger.Errorf(format, args...)
|
||||
addToBuffer("ERROR", fmt.Sprintf(format, args...))
|
||||
}
|
||||
|
||||
// addToBuffer adds a log entry to the in-memory ring buffer for web UI retrieval.
|
||||
func addToBuffer(level string, newLog string) {
|
||||
t := time.Now()
|
||||
if len(logBuffer) >= maxLogBufferSize {
|
||||
logBuffer = logBuffer[1:]
|
||||
}
|
||||
|
||||
logLevel, _ := logging.LogLevel(level)
|
||||
logBuffer = append(logBuffer, struct {
|
||||
time string
|
||||
level logging.Level
|
||||
log string
|
||||
}{
|
||||
time: t.Format(timeFormat),
|
||||
level: logLevel,
|
||||
log: newLog,
|
||||
})
|
||||
}
|
||||
|
||||
// GetLogs retrieves up to c log entries from the buffer that are at or below the specified level.
|
||||
func GetLogs(c int, level string) []string {
|
||||
var output []string
|
||||
logLevel, _ := logging.LogLevel(level)
|
||||
|
||||
for i := len(logBuffer) - 1; i >= 0 && len(output) <= c; i-- {
|
||||
if logBuffer[i].level <= logLevel {
|
||||
output = append(output, fmt.Sprintf("%s %s - %s", logBuffer[i].time, logBuffer[i].level, logBuffer[i].log))
|
||||
}
|
||||
}
|
||||
return output
|
||||
}
|
||||
@@ -0,0 +1,432 @@
|
||||
package mtproto
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
)
|
||||
|
||||
// Instance is the desired runtime configuration of one mtproto inbound.
|
||||
type Instance struct {
|
||||
Id int
|
||||
Tag string
|
||||
Listen string
|
||||
Port int
|
||||
Secret string
|
||||
|
||||
// Optional mtg tuning; each is omitted from the generated TOML when
|
||||
// zero-valued so mtg falls back to its own defaults.
|
||||
Debug bool
|
||||
ProxyProtocolListener bool
|
||||
PreferIP string
|
||||
FrontingIP string
|
||||
FrontingPort int
|
||||
FrontingProxyProtocol bool
|
||||
}
|
||||
|
||||
func (inst Instance) bindTo() string {
|
||||
listen := inst.Listen
|
||||
if listen == "" {
|
||||
listen = "0.0.0.0"
|
||||
}
|
||||
return fmt.Sprintf("%s:%d", listen, inst.Port)
|
||||
}
|
||||
|
||||
// fingerprint changes whenever any value that ends up in the generated TOML
|
||||
// changes, so ensureLocked restarts mtg when the operator edits a setting.
|
||||
func (inst Instance) fingerprint() string {
|
||||
return strings.Join([]string{
|
||||
inst.bindTo(),
|
||||
inst.Secret,
|
||||
strconv.FormatBool(inst.Debug),
|
||||
strconv.FormatBool(inst.ProxyProtocolListener),
|
||||
inst.PreferIP,
|
||||
inst.FrontingIP,
|
||||
strconv.Itoa(inst.FrontingPort),
|
||||
strconv.FormatBool(inst.FrontingProxyProtocol),
|
||||
}, "|")
|
||||
}
|
||||
|
||||
// Traffic is a per-inbound traffic delta scraped from an mtg metrics endpoint.
|
||||
type Traffic struct {
|
||||
Tag string
|
||||
Up int64
|
||||
Down int64
|
||||
}
|
||||
|
||||
type managed struct {
|
||||
proc *Process
|
||||
tag string
|
||||
fingerprint string
|
||||
metricsPort int
|
||||
lastUp int64
|
||||
lastDown int64
|
||||
haveLast bool
|
||||
}
|
||||
|
||||
// Manager owns the set of running mtg processes keyed by inbound id.
|
||||
type Manager struct {
|
||||
mu sync.Mutex
|
||||
procs map[int]*managed
|
||||
// swept records that the one-time startup cleanup of orphaned mtg
|
||||
// processes (survivors of a previous x-ui run) has already run.
|
||||
swept bool
|
||||
}
|
||||
|
||||
var (
|
||||
managerOnce sync.Once
|
||||
manager *Manager
|
||||
)
|
||||
|
||||
// GetManager returns the process-wide mtg manager singleton.
|
||||
func GetManager() *Manager {
|
||||
managerOnce.Do(func() {
|
||||
manager = &Manager{procs: map[int]*managed{}}
|
||||
})
|
||||
return manager
|
||||
}
|
||||
|
||||
// InstanceFromInbound derives a desired Instance from an mtproto inbound,
|
||||
// healing the FakeTLS secret so it always matches the configured domain.
|
||||
// Returns false when the inbound is not a usable mtproto inbound.
|
||||
func InstanceFromInbound(ib *model.Inbound) (Instance, bool) {
|
||||
if ib == nil || ib.Protocol != model.MTProto {
|
||||
return Instance{}, false
|
||||
}
|
||||
settings := ib.Settings
|
||||
if healed, ok := model.HealMtprotoSecret(settings); ok {
|
||||
settings = healed
|
||||
}
|
||||
var parsed struct {
|
||||
Secret string `json:"secret"`
|
||||
Debug bool `json:"debug"`
|
||||
ProxyProtocolListener bool `json:"proxyProtocolListener"`
|
||||
PreferIP string `json:"preferIp"`
|
||||
DomainFronting struct {
|
||||
IP string `json:"ip"`
|
||||
Port int `json:"port"`
|
||||
ProxyProtocol bool `json:"proxyProtocol"`
|
||||
} `json:"domainFronting"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(settings), &parsed); err != nil {
|
||||
return Instance{}, false
|
||||
}
|
||||
if parsed.Secret == "" {
|
||||
return Instance{}, false
|
||||
}
|
||||
return Instance{
|
||||
Id: ib.Id,
|
||||
Tag: ib.Tag,
|
||||
Listen: ib.Listen,
|
||||
Port: ib.Port,
|
||||
Secret: parsed.Secret,
|
||||
Debug: parsed.Debug,
|
||||
ProxyProtocolListener: parsed.ProxyProtocolListener,
|
||||
PreferIP: parsed.PreferIP,
|
||||
FrontingIP: parsed.DomainFronting.IP,
|
||||
FrontingPort: parsed.DomainFronting.Port,
|
||||
FrontingProxyProtocol: parsed.DomainFronting.ProxyProtocol,
|
||||
}, true
|
||||
}
|
||||
|
||||
// Ensure starts the mtg process for an instance, or restarts it when its
|
||||
// configuration changed. A no-op when the desired process is already running.
|
||||
func (m *Manager) Ensure(inst Instance) error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
m.sweepOrphansLocked()
|
||||
return m.ensureLocked(inst)
|
||||
}
|
||||
|
||||
// sweepOrphansLocked kills mtg processes left running by a previous x-ui run,
|
||||
// exactly once per process lifetime and before any of our own mtg are started.
|
||||
// Because x-ui owns every mtg process, anything alive at this point is an orphan
|
||||
// that would otherwise keep holding an inbound port with a stale secret.
|
||||
func (m *Manager) sweepOrphansLocked() {
|
||||
if m.swept {
|
||||
return
|
||||
}
|
||||
m.swept = true
|
||||
if n := killStrayMtgProcesses(GetBinaryPath()); n > 0 {
|
||||
logger.Warningf("mtproto: terminated %d orphaned mtg process(es) from a previous run", n)
|
||||
}
|
||||
}
|
||||
|
||||
func (m *Manager) ensureLocked(inst Instance) error {
|
||||
fp := inst.fingerprint()
|
||||
if cur, ok := m.procs[inst.Id]; ok {
|
||||
if cur.fingerprint == fp && cur.proc.IsRunning() {
|
||||
cur.tag = inst.Tag
|
||||
return nil
|
||||
}
|
||||
cur.proc.Stop()
|
||||
delete(m.procs, inst.Id)
|
||||
}
|
||||
metricsPort, err := freeLocalPort()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
cfgPath := configPathForID(inst.Id)
|
||||
if err := writeConfig(cfgPath, inst, metricsPort); err != nil {
|
||||
return err
|
||||
}
|
||||
proc := newProcess(cfgPath, fmt.Sprintf("inbound %d", inst.Id))
|
||||
if err := proc.Start(); err != nil {
|
||||
return err
|
||||
}
|
||||
m.procs[inst.Id] = &managed{
|
||||
proc: proc,
|
||||
tag: inst.Tag,
|
||||
fingerprint: fp,
|
||||
metricsPort: metricsPort,
|
||||
}
|
||||
logger.Infof("mtproto: started mtg for inbound %d on %s", inst.Id, inst.bindTo())
|
||||
return nil
|
||||
}
|
||||
|
||||
// Remove stops and forgets the mtg process for an inbound id.
|
||||
func (m *Manager) Remove(id int) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
if cur, ok := m.procs[id]; ok {
|
||||
cur.proc.Stop()
|
||||
delete(m.procs, id)
|
||||
_ = os.Remove(configPathForID(id))
|
||||
logger.Infof("mtproto: stopped mtg for inbound %d", id)
|
||||
}
|
||||
}
|
||||
|
||||
// Reconcile drives the running set toward the desired instances: it stops
|
||||
// processes that are no longer wanted and (re)starts the rest. Used at boot
|
||||
// and periodically to recover from crashes.
|
||||
func (m *Manager) Reconcile(desired []Instance) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
m.sweepOrphansLocked()
|
||||
want := make(map[int]struct{}, len(desired))
|
||||
for _, inst := range desired {
|
||||
want[inst.Id] = struct{}{}
|
||||
}
|
||||
for id, cur := range m.procs {
|
||||
if _, ok := want[id]; !ok {
|
||||
cur.proc.Stop()
|
||||
delete(m.procs, id)
|
||||
_ = os.Remove(configPathForID(id))
|
||||
}
|
||||
}
|
||||
for _, inst := range desired {
|
||||
if err := m.ensureLocked(inst); err != nil {
|
||||
logger.Warningf("mtproto: reconcile failed for inbound %d: %v", inst.Id, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// StopAll stops every managed mtg process. Called on panel shutdown.
|
||||
func (m *Manager) StopAll() {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
for id, cur := range m.procs {
|
||||
_ = cur.proc.Stop()
|
||||
_ = os.Remove(configPathForID(id))
|
||||
delete(m.procs, id)
|
||||
}
|
||||
}
|
||||
|
||||
// CollectTraffic scrapes each running mtg metrics endpoint and returns the
|
||||
// per-inbound byte deltas since the previous scrape.
|
||||
func (m *Manager) CollectTraffic() []Traffic {
|
||||
// Snapshot the state we need under the lock, then release before doing
|
||||
// network I/O so that Ensure/Reconcile/Remove are not blocked.
|
||||
type snap struct {
|
||||
id int
|
||||
metricsPort int
|
||||
tag string
|
||||
haveLast bool
|
||||
lastUp int64
|
||||
lastDown int64
|
||||
}
|
||||
m.mu.Lock()
|
||||
snaps := make([]snap, 0, len(m.procs))
|
||||
for id, cur := range m.procs {
|
||||
if cur.proc == nil || !cur.proc.IsRunning() {
|
||||
continue
|
||||
}
|
||||
snaps = append(snaps, snap{
|
||||
id: id,
|
||||
metricsPort: cur.metricsPort,
|
||||
tag: cur.tag,
|
||||
haveLast: cur.haveLast,
|
||||
lastUp: cur.lastUp,
|
||||
lastDown: cur.lastDown,
|
||||
})
|
||||
}
|
||||
m.mu.Unlock()
|
||||
|
||||
out := make([]Traffic, 0, len(snaps))
|
||||
for _, s := range snaps {
|
||||
up, down, ok := scrapeTraffic(s.metricsPort)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
var du, dd int64
|
||||
if s.haveLast {
|
||||
du = up - s.lastUp
|
||||
dd = down - s.lastDown
|
||||
if du < 0 {
|
||||
du = 0
|
||||
}
|
||||
if dd < 0 {
|
||||
dd = 0
|
||||
}
|
||||
}
|
||||
|
||||
// Re-acquire lock to persist the new baseline, but only if the entry
|
||||
// still exists (it may have been removed during the scrape).
|
||||
m.mu.Lock()
|
||||
if cur, ok := m.procs[s.id]; ok {
|
||||
cur.lastUp = up
|
||||
cur.lastDown = down
|
||||
cur.haveLast = true
|
||||
}
|
||||
m.mu.Unlock()
|
||||
|
||||
if s.haveLast && (du > 0 || dd > 0) {
|
||||
out = append(out, Traffic{Tag: s.tag, Up: du, Down: dd})
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func freeLocalPort() (int, error) {
|
||||
l, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer l.Close()
|
||||
return l.Addr().(*net.TCPAddr).Port, nil
|
||||
}
|
||||
|
||||
// renderConfig builds the mtg TOML for an instance. Top-level keys must precede
|
||||
// any [section] header in TOML, so the layout is: required keys, then the
|
||||
// optional scalar tuning, then [domain-fronting], and finally [stats.prometheus]
|
||||
// — which x-ui always emits and scrapes for traffic (see scrapeTraffic).
|
||||
func renderConfig(inst Instance, metricsPort int) string {
|
||||
var b strings.Builder
|
||||
fmt.Fprintf(&b, "secret = %q\n", inst.Secret)
|
||||
fmt.Fprintf(&b, "bind-to = %q\n", inst.bindTo())
|
||||
if inst.Debug {
|
||||
b.WriteString("debug = true\n")
|
||||
}
|
||||
if inst.ProxyProtocolListener {
|
||||
b.WriteString("proxy-protocol-listener = true\n")
|
||||
}
|
||||
if inst.PreferIP != "" {
|
||||
fmt.Fprintf(&b, "prefer-ip = %q\n", inst.PreferIP)
|
||||
}
|
||||
if inst.FrontingIP != "" || inst.FrontingPort > 0 || inst.FrontingProxyProtocol {
|
||||
b.WriteString("\n[domain-fronting]\n")
|
||||
if inst.FrontingIP != "" {
|
||||
fmt.Fprintf(&b, "ip = %q\n", inst.FrontingIP)
|
||||
}
|
||||
if inst.FrontingPort > 0 {
|
||||
fmt.Fprintf(&b, "port = %d\n", inst.FrontingPort)
|
||||
}
|
||||
if inst.FrontingProxyProtocol {
|
||||
b.WriteString("proxy-protocol = true\n")
|
||||
}
|
||||
}
|
||||
fmt.Fprintf(&b, "\n[stats.prometheus]\nenabled = true\nbind-to = \"127.0.0.1:%d\"\nhttp-path = \"/metrics\"\nmetric-prefix = \"mtg\"\n", metricsPort)
|
||||
return b.String()
|
||||
}
|
||||
|
||||
func writeConfig(path string, inst Instance, metricsPort int) error {
|
||||
if err := os.MkdirAll(configDir(), 0o750); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(path, []byte(renderConfig(inst, metricsPort)), 0o640)
|
||||
}
|
||||
|
||||
// scrapeTraffic reads the mtg Prometheus metrics endpoint and sums byte
|
||||
// counters by direction. mtg exposes a traffic counter labelled with a
|
||||
// direction; "to_telegram" is treated as upload and "to_client" as download.
|
||||
// Best-effort: an unreachable endpoint or unrecognised format yields ok=false.
|
||||
func scrapeTraffic(port int) (up int64, down int64, ok bool) {
|
||||
client := http.Client{Timeout: 3 * time.Second}
|
||||
resp, err := client.Get(fmt.Sprintf("http://127.0.0.1:%d/metrics", port))
|
||||
if err != nil {
|
||||
return 0, 0, false
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
scanner := bufio.NewScanner(resp.Body)
|
||||
scanner.Buffer(make([]byte, 64*1024), 1024*1024)
|
||||
found := false
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" || line[0] == '#' || !strings.Contains(line, "traffic") {
|
||||
continue
|
||||
}
|
||||
name, labels, value, perr := parseMetricLine(line)
|
||||
if perr != nil || !strings.HasPrefix(name, "mtg") {
|
||||
continue
|
||||
}
|
||||
switch labels["direction"] {
|
||||
case "to_telegram", "egress", "up":
|
||||
up += int64(value)
|
||||
case "to_client", "ingress", "down":
|
||||
down += int64(value)
|
||||
default:
|
||||
down += int64(value)
|
||||
}
|
||||
found = true
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
logger.Debug("mtproto: metrics scan error:", err)
|
||||
}
|
||||
return up, down, found
|
||||
}
|
||||
|
||||
func parseMetricLine(line string) (name string, labels map[string]string, value float64, err error) {
|
||||
labels = map[string]string{}
|
||||
rest := line
|
||||
if brace := strings.IndexByte(line, '{'); brace >= 0 {
|
||||
name = line[:brace]
|
||||
end := strings.IndexByte(line, '}')
|
||||
if end < brace {
|
||||
return "", nil, 0, fmt.Errorf("malformed metric line")
|
||||
}
|
||||
for _, kv := range strings.Split(line[brace+1:end], ",") {
|
||||
eq := strings.IndexByte(kv, '=')
|
||||
if eq < 0 {
|
||||
continue
|
||||
}
|
||||
labels[strings.TrimSpace(kv[:eq])] = strings.Trim(strings.TrimSpace(kv[eq+1:]), `"`)
|
||||
}
|
||||
rest = strings.TrimSpace(line[end+1:])
|
||||
} else {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) < 2 {
|
||||
return "", nil, 0, fmt.Errorf("malformed metric line")
|
||||
}
|
||||
name = fields[0]
|
||||
rest = fields[1]
|
||||
}
|
||||
valFields := strings.Fields(rest)
|
||||
if len(valFields) == 0 {
|
||||
return "", nil, 0, fmt.Errorf("missing metric value")
|
||||
}
|
||||
value, err = strconv.ParseFloat(valFields[0], 64)
|
||||
if err != nil {
|
||||
return "", nil, 0, err
|
||||
}
|
||||
return name, labels, value, nil
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
package mtproto
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
)
|
||||
|
||||
func TestParseMetricLine(t *testing.T) {
|
||||
name, labels, val, err := parseMetricLine(`mtg_traffic{direction="to_client"} 12345`)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if name != "mtg_traffic" {
|
||||
t.Fatalf("name=%q", name)
|
||||
}
|
||||
if labels["direction"] != "to_client" {
|
||||
t.Fatalf("labels=%v", labels)
|
||||
}
|
||||
if val != 12345 {
|
||||
t.Fatalf("val=%v", val)
|
||||
}
|
||||
|
||||
name2, _, val2, err2 := parseMetricLine(`mtg_concurrency 7`)
|
||||
if err2 != nil {
|
||||
t.Fatal(err2)
|
||||
}
|
||||
if name2 != "mtg_concurrency" || val2 != 7 {
|
||||
t.Fatalf("got %q %v", name2, val2)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstanceFromInbound(t *testing.T) {
|
||||
ib := &model.Inbound{
|
||||
Id: 3,
|
||||
Tag: "inbound-3",
|
||||
Listen: "0.0.0.0",
|
||||
Port: 8443,
|
||||
Protocol: model.MTProto,
|
||||
Settings: `{"fakeTlsDomain":"example.com","secret":"",` +
|
||||
`"debug":true,"proxyProtocolListener":true,"preferIp":"prefer-ipv4",` +
|
||||
`"domainFronting":{"ip":"127.0.0.1","port":9443,"proxyProtocol":true}}`,
|
||||
}
|
||||
inst, ok := InstanceFromInbound(ib)
|
||||
if !ok {
|
||||
t.Fatal("expected a usable instance")
|
||||
}
|
||||
if inst.Secret == "" {
|
||||
t.Fatal("secret should be healed to a non-empty value")
|
||||
}
|
||||
if inst.Port != 8443 || inst.Id != 3 {
|
||||
t.Fatalf("bad instance %+v", inst)
|
||||
}
|
||||
if !inst.Debug || !inst.ProxyProtocolListener || inst.PreferIP != "prefer-ipv4" {
|
||||
t.Fatalf("scalar options not parsed: %+v", inst)
|
||||
}
|
||||
if inst.FrontingIP != "127.0.0.1" || inst.FrontingPort != 9443 || !inst.FrontingProxyProtocol {
|
||||
t.Fatalf("domain-fronting not parsed: %+v", inst)
|
||||
}
|
||||
|
||||
if _, ok := InstanceFromInbound(&model.Inbound{Protocol: model.VLESS}); ok {
|
||||
t.Fatal("non-mtproto inbound should not produce an instance")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderConfig(t *testing.T) {
|
||||
// A bare instance emits only the required keys and the prometheus block,
|
||||
// with no optional keys and no [domain-fronting] section.
|
||||
bare := renderConfig(Instance{Secret: "ee00", Listen: "0.0.0.0", Port: 8443}, 5000)
|
||||
for _, unwanted := range []string{"debug", "proxy-protocol-listener", "prefer-ip", "[domain-fronting]"} {
|
||||
if strings.Contains(bare, unwanted) {
|
||||
t.Fatalf("bare config should not contain %q:\n%s", unwanted, bare)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(bare, `bind-to = "0.0.0.0:8443"`) {
|
||||
t.Fatalf("missing bind-to:\n%s", bare)
|
||||
}
|
||||
if !strings.Contains(bare, "[stats.prometheus]") || !strings.Contains(bare, "127.0.0.1:5000") {
|
||||
t.Fatalf("prometheus block must always be present:\n%s", bare)
|
||||
}
|
||||
|
||||
// A fully configured instance emits every option and the fronting section.
|
||||
full := renderConfig(Instance{
|
||||
Secret: "ee11", Listen: "0.0.0.0", Port: 443,
|
||||
Debug: true, ProxyProtocolListener: true, PreferIP: "only-ipv6",
|
||||
FrontingIP: "127.0.0.1", FrontingPort: 9443, FrontingProxyProtocol: true,
|
||||
}, 6000)
|
||||
for _, want := range []string{
|
||||
"debug = true\n",
|
||||
"proxy-protocol-listener = true\n",
|
||||
`prefer-ip = "only-ipv6"`,
|
||||
"[domain-fronting]",
|
||||
`ip = "127.0.0.1"`,
|
||||
"port = 9443",
|
||||
"proxy-protocol = true\n",
|
||||
} {
|
||||
if !strings.Contains(full, want) {
|
||||
t.Fatalf("full config missing %q:\n%s", want, full)
|
||||
}
|
||||
}
|
||||
// TOML requires top-level keys before any [section] header.
|
||||
if strings.Index(full, "prefer-ip") > strings.Index(full, "[domain-fronting]") {
|
||||
t.Fatalf("top-level keys must precede the [domain-fronting] section:\n%s", full)
|
||||
}
|
||||
if strings.LastIndex(full, "[domain-fronting]") > strings.Index(full, "[stats.prometheus]") {
|
||||
t.Fatalf("[domain-fronting] must precede [stats.prometheus]:\n%s", full)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFingerprintReactsToOptions(t *testing.T) {
|
||||
base := Instance{Secret: "ee", Listen: "0.0.0.0", Port: 443}
|
||||
for name, mutate := range map[string]func(*Instance){
|
||||
"debug": func(i *Instance) { i.Debug = true },
|
||||
"listener": func(i *Instance) { i.ProxyProtocolListener = true },
|
||||
"preferIp": func(i *Instance) { i.PreferIP = "only-ipv4" },
|
||||
"frontingIP": func(i *Instance) { i.FrontingIP = "127.0.0.1" },
|
||||
"frontingPort": func(i *Instance) { i.FrontingPort = 9443 },
|
||||
"frontingProxy": func(i *Instance) { i.FrontingProxyProtocol = true },
|
||||
} {
|
||||
changed := base
|
||||
mutate(&changed)
|
||||
if base.fingerprint() == changed.fingerprint() {
|
||||
t.Fatalf("fingerprint must change when %s changes", name)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
//go:build linux
|
||||
|
||||
package mtproto
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// killStrayMtgProcesses terminates orphaned mtg sidecars left over from a
|
||||
// previous x-ui run and returns how many were killed.
|
||||
//
|
||||
// x-ui starts one mtg process per mtproto inbound outside its own lifecycle, and
|
||||
// on Linux a child is not guaranteed to die with the panel (there is no
|
||||
// kill-on-exit, unlike the Windows job object). A survivor keeps holding the
|
||||
// inbound port with a now-stale secret, so new clients are silently
|
||||
// domain-fronted to the FakeTLS domain instead of proxied to Telegram. x-ui is
|
||||
// the sole owner of mtg, so any process matching our binary name at startup is
|
||||
// an orphan and is safe to kill before we start our own.
|
||||
//
|
||||
// binaryPath is the configured mtg path (e.g. "bin/mtg-linux-amd64"); matching
|
||||
// is done on the executable's base name so it is independent of the bin folder
|
||||
// and still works after an update has deleted the binary (the running process's
|
||||
// /proc/<pid>/exe then reads as "<path> (deleted)", so argv[0] is used too).
|
||||
func killStrayMtgProcesses(binaryPath string) int {
|
||||
base := filepath.Base(binaryPath)
|
||||
if base == "" || base == "." || base == string(filepath.Separator) {
|
||||
return 0
|
||||
}
|
||||
self := os.Getpid()
|
||||
entries, err := os.ReadDir("/proc")
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
killed := 0
|
||||
for _, e := range entries {
|
||||
pid, err := strconv.Atoi(e.Name())
|
||||
if err != nil || pid == self {
|
||||
continue
|
||||
}
|
||||
if procExeBase(pid) != base && cmdlineArgv0Base(pid) != base {
|
||||
continue
|
||||
}
|
||||
if err := syscall.Kill(pid, syscall.SIGKILL); err == nil {
|
||||
killed++
|
||||
}
|
||||
}
|
||||
return killed
|
||||
}
|
||||
|
||||
// procExeBase returns the base name of /proc/<pid>/exe, or "" if unreadable.
|
||||
func procExeBase(pid int) string {
|
||||
exe, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid))
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return filepath.Base(exe)
|
||||
}
|
||||
|
||||
// cmdlineArgv0Base returns the base name of argv[0] from /proc/<pid>/cmdline,
|
||||
// the reliable fallback when the binary has been replaced or exe is unreadable.
|
||||
func cmdlineArgv0Base(pid int) string {
|
||||
data, err := os.ReadFile(fmt.Sprintf("/proc/%d/cmdline", pid))
|
||||
if err != nil || len(data) == 0 {
|
||||
return ""
|
||||
}
|
||||
argv0 := data
|
||||
if i := strings.IndexByte(string(data), 0); i >= 0 {
|
||||
argv0 = data[:i]
|
||||
}
|
||||
if len(argv0) == 0 {
|
||||
return ""
|
||||
}
|
||||
return filepath.Base(string(argv0))
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
//go:build !linux
|
||||
|
||||
package mtproto
|
||||
|
||||
// killStrayMtgProcesses is a no-op off Linux. On Windows the kill-on-exit job
|
||||
// object already terminates mtg together with the panel (see
|
||||
// attachChildLifetime), so orphans do not arise there; other platforms are not
|
||||
// a supported deployment target for the mtg sidecar.
|
||||
func killStrayMtgProcesses(_ string) int { return 0 }
|
||||
@@ -0,0 +1,235 @@
|
||||
// Package mtproto manages mtg (github.com/9seconds/mtg) sidecar processes that
|
||||
// serve MTProto FakeTLS proxies. Xray-core has no mtproto protocol, so mtproto
|
||||
// inbounds are run as standalone mtg processes — one process per inbound —
|
||||
// entirely outside the Xray config and lifecycle.
|
||||
package mtproto
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/config"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
)
|
||||
|
||||
// GetBinaryName returns the mtg binary filename for the current OS and arch,
|
||||
// matching the naming scheme used for the Xray binary. On Windows the ".exe"
|
||||
// extension is appended so a natural "mtg-windows-amd64.exe" is found.
|
||||
func GetBinaryName() string {
|
||||
name := fmt.Sprintf("mtg-%s-%s", runtime.GOOS, runtime.GOARCH)
|
||||
if runtime.GOOS == "windows" {
|
||||
name += ".exe"
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
// GetBinaryPath returns the full path to the mtg binary, alongside the Xray binary.
|
||||
func GetBinaryPath() string {
|
||||
return config.GetBinFolderPath() + "/" + GetBinaryName()
|
||||
}
|
||||
|
||||
func configDir() string {
|
||||
return config.GetBinFolderPath() + "/mtproto"
|
||||
}
|
||||
|
||||
func configPathForID(id int) string {
|
||||
return fmt.Sprintf("%s/mtg-%d.toml", configDir(), id)
|
||||
}
|
||||
|
||||
var (
|
||||
gracefulStopTimeout = 5 * time.Second
|
||||
forceStopTimeout = 2 * time.Second
|
||||
)
|
||||
|
||||
// procLogWriter consumes the mtg child process's stdout/stderr. It splits the
|
||||
// stream into lines, forwards each one to the x-ui log — so mtg's own messages,
|
||||
// including why it cannot reach Telegram, become visible in the panel log viewer
|
||||
// and journald — and remembers the most recent line for GetResult.
|
||||
type procLogWriter struct {
|
||||
mu sync.Mutex
|
||||
label string
|
||||
buf string
|
||||
lastLine string
|
||||
}
|
||||
|
||||
func (w *procLogWriter) Write(p []byte) (int, error) {
|
||||
w.mu.Lock()
|
||||
defer w.mu.Unlock()
|
||||
w.buf += string(p)
|
||||
for {
|
||||
i := strings.IndexByte(w.buf, '\n')
|
||||
if i < 0 {
|
||||
break
|
||||
}
|
||||
line := w.buf[:i]
|
||||
w.buf = w.buf[i+1:]
|
||||
w.emitLocked(line)
|
||||
}
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
// Flush emits any buffered partial line; called once the process exits so a
|
||||
// final un-terminated error line is not lost.
|
||||
func (w *procLogWriter) Flush() {
|
||||
w.mu.Lock()
|
||||
defer w.mu.Unlock()
|
||||
if w.buf != "" {
|
||||
line := w.buf
|
||||
w.buf = ""
|
||||
w.emitLocked(line)
|
||||
}
|
||||
}
|
||||
|
||||
func (w *procLogWriter) emitLocked(line string) {
|
||||
trimmed := strings.TrimSpace(strings.TrimRight(line, "\r"))
|
||||
if trimmed == "" {
|
||||
return
|
||||
}
|
||||
w.lastLine = trimmed
|
||||
logger.Infof("mtproto: mtg %s | %s", w.label, trimmed)
|
||||
}
|
||||
|
||||
func (w *procLogWriter) LastLine() string {
|
||||
w.mu.Lock()
|
||||
defer w.mu.Unlock()
|
||||
return w.lastLine
|
||||
}
|
||||
|
||||
// Process wraps a single mtg process invocation for one mtproto inbound.
|
||||
type Process struct {
|
||||
cmd *exec.Cmd
|
||||
done chan struct{}
|
||||
configPath string
|
||||
logWriter *procLogWriter
|
||||
exitErr error
|
||||
intentionalStop atomic.Bool
|
||||
}
|
||||
|
||||
func newProcess(configPath, label string) *Process {
|
||||
return &Process{
|
||||
configPath: configPath,
|
||||
logWriter: &procLogWriter{label: label},
|
||||
}
|
||||
}
|
||||
|
||||
// IsRunning reports whether the mtg process is currently running.
|
||||
func (p *Process) IsRunning() bool {
|
||||
if p.cmd == nil || p.cmd.Process == nil {
|
||||
return false
|
||||
}
|
||||
if p.done != nil {
|
||||
select {
|
||||
case <-p.done:
|
||||
return false
|
||||
default:
|
||||
}
|
||||
}
|
||||
if p.cmd.ProcessState == nil {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// GetResult returns the last log line or the exit error from the mtg process.
|
||||
func (p *Process) GetResult() string {
|
||||
if line := p.logWriter.LastLine(); line != "" {
|
||||
return line
|
||||
}
|
||||
if p.exitErr != nil {
|
||||
return p.exitErr.Error()
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// Start launches the mtg process against its generated config file.
|
||||
func (p *Process) Start() error {
|
||||
if p.IsRunning() {
|
||||
return errors.New("mtg is already running")
|
||||
}
|
||||
cmd := exec.Command(GetBinaryPath(), "run", p.configPath)
|
||||
cmd.Stdout = p.logWriter
|
||||
cmd.Stderr = p.logWriter
|
||||
p.cmd = cmd
|
||||
p.done = make(chan struct{})
|
||||
p.exitErr = nil
|
||||
p.intentionalStop.Store(false)
|
||||
if err := cmd.Start(); err != nil {
|
||||
close(p.done)
|
||||
p.cmd = nil
|
||||
return err
|
||||
}
|
||||
attachChildLifetime(cmd)
|
||||
go p.wait(cmd)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (p *Process) wait(cmd *exec.Cmd) {
|
||||
defer close(p.done)
|
||||
err := cmd.Wait()
|
||||
p.logWriter.Flush()
|
||||
if err == nil || p.intentionalStop.Load() {
|
||||
return
|
||||
}
|
||||
if runtime.GOOS == "windows" {
|
||||
if strings.Contains(strings.ToLower(err.Error()), "exit status 1") {
|
||||
p.exitErr = err
|
||||
return
|
||||
}
|
||||
}
|
||||
logger.Errorf("mtproto: mtg process exited: %v", err)
|
||||
p.exitErr = err
|
||||
}
|
||||
|
||||
// Stop terminates the running mtg process gracefully, falling back to a kill.
|
||||
func (p *Process) Stop() error {
|
||||
if !p.IsRunning() {
|
||||
return errors.New("mtg is not running")
|
||||
}
|
||||
p.intentionalStop.Store(true)
|
||||
|
||||
if runtime.GOOS == "windows" {
|
||||
if err := p.cmd.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
|
||||
return err
|
||||
}
|
||||
return p.waitForExit(forceStopTimeout)
|
||||
}
|
||||
|
||||
if err := p.cmd.Process.Signal(syscall.SIGTERM); err != nil {
|
||||
if errors.Is(err, os.ErrProcessDone) {
|
||||
return p.waitForExit(forceStopTimeout)
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
if err := p.waitForExit(gracefulStopTimeout); err == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
logger.Warning("mtproto: mtg did not stop after SIGTERM, killing process")
|
||||
if err := p.cmd.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
|
||||
return err
|
||||
}
|
||||
return p.waitForExit(forceStopTimeout)
|
||||
}
|
||||
|
||||
func (p *Process) waitForExit(timeout time.Duration) error {
|
||||
if p.done == nil {
|
||||
return nil
|
||||
}
|
||||
timer := time.NewTimer(timeout)
|
||||
defer timer.Stop()
|
||||
select {
|
||||
case <-p.done:
|
||||
return nil
|
||||
case <-timer.C:
|
||||
return fmt.Errorf("timed out waiting for mtg process to stop after %s", timeout)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
//go:build !windows
|
||||
|
||||
package mtproto
|
||||
|
||||
import "os/exec"
|
||||
|
||||
func attachChildLifetime(_ *exec.Cmd) {}
|
||||
@@ -0,0 +1,66 @@
|
||||
//go:build windows
|
||||
|
||||
package mtproto
|
||||
|
||||
import (
|
||||
"os/exec"
|
||||
"sync"
|
||||
"unsafe"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"golang.org/x/sys/windows"
|
||||
)
|
||||
|
||||
var (
|
||||
killOnExitJobOnce sync.Once
|
||||
killOnExitJob windows.Handle
|
||||
killOnExitJobErr error
|
||||
)
|
||||
|
||||
func ensureKillOnExitJob() (windows.Handle, error) {
|
||||
killOnExitJobOnce.Do(func() {
|
||||
h, err := windows.CreateJobObject(nil, nil)
|
||||
if err != nil {
|
||||
killOnExitJobErr = err
|
||||
return
|
||||
}
|
||||
info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
|
||||
BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
|
||||
LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
|
||||
},
|
||||
}
|
||||
_, err = windows.SetInformationJobObject(
|
||||
h,
|
||||
windows.JobObjectExtendedLimitInformation,
|
||||
uintptr(unsafe.Pointer(&info)),
|
||||
uint32(unsafe.Sizeof(info)),
|
||||
)
|
||||
if err != nil {
|
||||
windows.CloseHandle(h)
|
||||
killOnExitJobErr = err
|
||||
return
|
||||
}
|
||||
killOnExitJob = h
|
||||
})
|
||||
return killOnExitJob, killOnExitJobErr
|
||||
}
|
||||
|
||||
func attachChildLifetime(cmd *exec.Cmd) {
|
||||
if cmd == nil || cmd.Process == nil {
|
||||
return
|
||||
}
|
||||
job, err := ensureKillOnExitJob()
|
||||
if err != nil {
|
||||
logger.Warningf("mtproto: kill-on-exit job unavailable: %v", err)
|
||||
return
|
||||
}
|
||||
h, err := windows.OpenProcess(windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE, false, uint32(cmd.Process.Pid))
|
||||
if err != nil {
|
||||
logger.Warningf("mtproto: OpenProcess for job attach failed: %v", err)
|
||||
return
|
||||
}
|
||||
defer windows.CloseHandle(h)
|
||||
if err := windows.AssignProcessToJobObject(job, h); err != nil {
|
||||
logger.Warningf("mtproto: AssignProcessToJobObject failed: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
||||
)
|
||||
|
||||
func initSubDB(t *testing.T) {
|
||||
t.Helper()
|
||||
if err := database.InitDB(filepath.Join(t.TempDir(), "x-ui.db")); err != nil {
|
||||
t.Fatalf("InitDB: %v", err)
|
||||
}
|
||||
// Close the handle before t.TempDir cleanup so Windows doesn't refuse to
|
||||
// remove the still-open sqlite file.
|
||||
t.Cleanup(func() { _ = database.CloseDB() })
|
||||
}
|
||||
|
||||
// The subscription page's Copy URL must be built from the same host the
|
||||
// subscriber reached the page on (after PrepareForRequest normalizes away a
|
||||
// loopback/bind address) — never the raw listen IP. A subscriber that hit a
|
||||
// loopback bind should see "localhost", not "127.0.0.1".
|
||||
func TestBuildURLs_NormalizesListenIP(t *testing.T) {
|
||||
initSubDB(t)
|
||||
s := &SubService{}
|
||||
s.PrepareForRequest("127.0.0.1")
|
||||
|
||||
subURL, _, _ := s.BuildURLs("/sub/", "/json/", "/clash/", "ABC")
|
||||
|
||||
if strings.Contains(subURL, "127.0.0.1") {
|
||||
t.Fatalf("listen IP leaked into Copy URL: %q", subURL)
|
||||
}
|
||||
if !strings.Contains(subURL, "localhost") {
|
||||
t.Fatalf("Copy URL = %q, want a localhost host", subURL)
|
||||
}
|
||||
if !strings.HasSuffix(subURL, "/sub/ABC") {
|
||||
t.Fatalf("Copy URL = %q, want it to end with /sub/ABC", subURL)
|
||||
}
|
||||
}
|
||||
|
||||
// A subscriber arriving on a real domain gets that exact domain in the Copy
|
||||
// URL, with the configured sub port — matching the Client Information page.
|
||||
func TestBuildURLs_UsesSubscriberDomain(t *testing.T) {
|
||||
initSubDB(t)
|
||||
s := &SubService{}
|
||||
s.PrepareForRequest("sub.example.com")
|
||||
|
||||
subURL, jsonURL, clashURL := s.BuildURLs("/sub/", "/json/", "/clash/", "ABC")
|
||||
|
||||
if subURL != "http://sub.example.com:2096/sub/ABC" {
|
||||
t.Fatalf("subURL = %q", subURL)
|
||||
}
|
||||
if jsonURL != "http://sub.example.com:2096/json/ABC" {
|
||||
t.Fatalf("jsonURL = %q", jsonURL)
|
||||
}
|
||||
if clashURL != "http://sub.example.com:2096/clash/ABC" {
|
||||
t.Fatalf("clashURL = %q", clashURL)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildURLs_EmptySubId(t *testing.T) {
|
||||
initSubDB(t)
|
||||
s := &SubService{}
|
||||
s.PrepareForRequest("sub.example.com")
|
||||
a, b, c := s.BuildURLs("/sub/", "/json/", "/clash/", "")
|
||||
if a != "" || b != "" || c != "" {
|
||||
t.Fatalf("empty subId must yield empty URLs, got %q %q %q", a, b, c)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,658 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"maps"
|
||||
"strings"
|
||||
|
||||
"github.com/goccy/go-json"
|
||||
yaml "github.com/goccy/go-yaml"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
type SubClashService struct {
|
||||
inboundService service.InboundService
|
||||
enableRouting bool
|
||||
clashRules string
|
||||
SubService *SubService
|
||||
}
|
||||
|
||||
func NewSubClashService(enableRouting bool, clashRules string, subService *SubService) *SubClashService {
|
||||
return &SubClashService{enableRouting: enableRouting, clashRules: clashRules, SubService: subService}
|
||||
}
|
||||
|
||||
func (s *SubClashService) GetClash(subId string, host string) (string, string, error) {
|
||||
// Set per-request state so resolveInboundAddress sees the node map.
|
||||
s.SubService.PrepareForRequest(host)
|
||||
inbounds, err := s.SubService.getInboundsBySubId(subId)
|
||||
if err != nil || len(inbounds) == 0 {
|
||||
return "", "", err
|
||||
}
|
||||
|
||||
var proxies []map[string]any
|
||||
|
||||
seenEmails := make(map[string]struct{})
|
||||
for _, inbound := range inbounds {
|
||||
clients, err := s.inboundService.GetClients(inbound)
|
||||
if err != nil {
|
||||
logger.Error("SubClashService - GetClients: Unable to get clients from inbound")
|
||||
}
|
||||
if clients == nil {
|
||||
continue
|
||||
}
|
||||
s.SubService.projectThroughFallbackMaster(inbound)
|
||||
for _, client := range clients {
|
||||
if client.SubID == subId {
|
||||
seenEmails[client.Email] = struct{}{}
|
||||
proxies = append(proxies, s.getProxies(inbound, client, host)...)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(proxies) == 0 {
|
||||
return "", "", nil
|
||||
}
|
||||
|
||||
ensureUniqueProxyNames(proxies)
|
||||
|
||||
emails := make([]string, 0, len(seenEmails))
|
||||
for e := range seenEmails {
|
||||
emails = append(emails, e)
|
||||
}
|
||||
traffic, _ := s.SubService.AggregateTrafficByEmails(emails)
|
||||
|
||||
proxyNames := make([]string, 0, len(proxies)+1)
|
||||
for _, proxy := range proxies {
|
||||
if name, ok := proxy["name"].(string); ok && name != "" {
|
||||
proxyNames = append(proxyNames, name)
|
||||
}
|
||||
}
|
||||
proxyNames = append(proxyNames, "DIRECT")
|
||||
|
||||
config := map[string]any{
|
||||
"proxies": proxies,
|
||||
"proxy-groups": []map[string]any{{
|
||||
"name": "PROXY",
|
||||
"type": "select",
|
||||
"proxies": proxyNames,
|
||||
}},
|
||||
"rules": []string{"MATCH,PROXY"},
|
||||
}
|
||||
|
||||
if s.enableRouting {
|
||||
if err := mergeClashRulesYAML(config, s.clashRules); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
}
|
||||
|
||||
finalYAML, err := yaml.Marshal(config)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
|
||||
header := fmt.Sprintf("upload=%d; download=%d; total=%d; expire=%d", traffic.Up, traffic.Down, traffic.Total, traffic.ExpiryTime/1000)
|
||||
return string(finalYAML), header, nil
|
||||
}
|
||||
|
||||
// ensureUniqueProxyNames keeps every proxy "name" non-empty and unique:
|
||||
// mihomo rejects the whole config on a duplicate name (the empty string
|
||||
// genRemark returns for a remark-less inbound counts), vanishing the Clash
|
||||
// profile on refresh. See issue #4641.
|
||||
func ensureUniqueProxyNames(proxies []map[string]any) {
|
||||
seen := make(map[string]struct{}, len(proxies))
|
||||
for i, proxy := range proxies {
|
||||
base, _ := proxy["name"].(string)
|
||||
if base == "" {
|
||||
base = fallbackProxyName(proxy, i)
|
||||
}
|
||||
name := base
|
||||
for n := 2; ; n++ {
|
||||
if _, dup := seen[name]; !dup {
|
||||
break
|
||||
}
|
||||
name = fmt.Sprintf("%s-%d", base, n)
|
||||
}
|
||||
seen[name] = struct{}{}
|
||||
proxy["name"] = name
|
||||
}
|
||||
}
|
||||
|
||||
func fallbackProxyName(proxy map[string]any, idx int) string {
|
||||
typ, _ := proxy["type"].(string)
|
||||
server, _ := proxy["server"].(string)
|
||||
if typ != "" && server != "" {
|
||||
return fmt.Sprintf("%s-%s-%v", typ, server, proxy["port"])
|
||||
}
|
||||
return fmt.Sprintf("proxy-%d", idx+1)
|
||||
}
|
||||
|
||||
func (s *SubClashService) getProxies(inbound *model.Inbound, client model.Client, host string) []map[string]any {
|
||||
stream := s.streamData(inbound.StreamSettings)
|
||||
// For node-managed inbounds the Clash proxy "server" must be the
|
||||
// node's address, not the request host. resolveInboundAddress handles
|
||||
// the node→subscriber-host fallback chain.
|
||||
defaultDest := s.SubService.resolveInboundAddress(inbound)
|
||||
if defaultDest == "" {
|
||||
defaultDest = host
|
||||
}
|
||||
externalProxies, ok := stream["externalProxy"].([]any)
|
||||
hasExternalProxy := ok && len(externalProxies) > 0
|
||||
if !hasExternalProxy {
|
||||
externalProxies = []any{map[string]any{
|
||||
"forceTls": "same",
|
||||
"dest": defaultDest,
|
||||
"port": float64(inbound.Port),
|
||||
"remark": "",
|
||||
}}
|
||||
}
|
||||
delete(stream, "externalProxy")
|
||||
|
||||
proxies := make([]map[string]any, 0, len(externalProxies))
|
||||
for _, ep := range externalProxies {
|
||||
extPrxy := ep.(map[string]any)
|
||||
workingInbound := *inbound
|
||||
workingInbound.Listen = extPrxy["dest"].(string)
|
||||
workingInbound.Port = int(extPrxy["port"].(float64))
|
||||
workingStream := cloneStreamForExternalProxy(stream)
|
||||
|
||||
switch extPrxy["forceTls"].(string) {
|
||||
case "tls":
|
||||
if workingStream["security"] != "tls" {
|
||||
workingStream["security"] = "tls"
|
||||
workingStream["tlsSettings"] = map[string]any{}
|
||||
}
|
||||
case "none":
|
||||
if workingStream["security"] != "none" {
|
||||
workingStream["security"] = "none"
|
||||
delete(workingStream, "tlsSettings")
|
||||
delete(workingStream, "realitySettings")
|
||||
}
|
||||
}
|
||||
security, _ := workingStream["security"].(string)
|
||||
if hasExternalProxy {
|
||||
applyExternalProxyTLSToStream(extPrxy, workingStream, security)
|
||||
}
|
||||
|
||||
proxy := s.buildProxy(&workingInbound, client, workingStream, extPrxy["remark"].(string))
|
||||
if len(proxy) > 0 {
|
||||
proxies = append(proxies, proxy)
|
||||
}
|
||||
}
|
||||
return proxies
|
||||
}
|
||||
|
||||
func (s *SubClashService) buildProxy(inbound *model.Inbound, client model.Client, stream map[string]any, extraRemark string) map[string]any {
|
||||
// Hysteria has its own transport + TLS model, applyTransport /
|
||||
// applySecurity don't fit.
|
||||
if inbound.Protocol == model.Hysteria {
|
||||
return s.buildHysteriaProxy(inbound, client, extraRemark)
|
||||
}
|
||||
|
||||
proxy := map[string]any{
|
||||
"name": s.SubService.genRemark(inbound, client.Email, extraRemark),
|
||||
"server": inbound.Listen,
|
||||
"port": inbound.Port,
|
||||
"udp": true,
|
||||
}
|
||||
|
||||
network, _ := stream["network"].(string)
|
||||
if !s.applyTransport(proxy, network, stream) {
|
||||
return nil
|
||||
}
|
||||
|
||||
switch inbound.Protocol {
|
||||
case model.VMESS:
|
||||
proxy["type"] = "vmess"
|
||||
proxy["uuid"] = client.ID
|
||||
proxy["alterId"] = 0
|
||||
cipher := client.Security
|
||||
if cipher == "" {
|
||||
cipher = "auto"
|
||||
}
|
||||
proxy["cipher"] = cipher
|
||||
case model.VLESS:
|
||||
proxy["type"] = "vless"
|
||||
proxy["uuid"] = client.ID
|
||||
if client.Flow != "" && network == "tcp" {
|
||||
proxy["flow"] = client.Flow
|
||||
}
|
||||
var inboundSettings map[string]any
|
||||
json.Unmarshal([]byte(inbound.Settings), &inboundSettings)
|
||||
if encryption, ok := inboundSettings["encryption"].(string); ok {
|
||||
encryption = strings.TrimSpace(encryption)
|
||||
if encryption != "" && encryption != "none" {
|
||||
proxy["encryption"] = encryption
|
||||
}
|
||||
}
|
||||
case model.Trojan:
|
||||
proxy["type"] = "trojan"
|
||||
proxy["password"] = client.Password
|
||||
case model.Shadowsocks:
|
||||
proxy["type"] = "ss"
|
||||
proxy["password"] = client.Password
|
||||
var inboundSettings map[string]any
|
||||
json.Unmarshal([]byte(inbound.Settings), &inboundSettings)
|
||||
method, _ := inboundSettings["method"].(string)
|
||||
if method == "" {
|
||||
return nil
|
||||
}
|
||||
proxy["cipher"] = method
|
||||
if strings.HasPrefix(method, "2022") {
|
||||
if serverPassword, ok := inboundSettings["password"].(string); ok && serverPassword != "" {
|
||||
proxy["password"] = fmt.Sprintf("%s:%s", serverPassword, client.Password)
|
||||
}
|
||||
}
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
|
||||
security, _ := stream["security"].(string)
|
||||
if !s.applySecurity(proxy, security, stream) {
|
||||
return nil
|
||||
}
|
||||
|
||||
return proxy
|
||||
}
|
||||
|
||||
// buildHysteriaProxy produces a mihomo-compatible Clash entry for a
|
||||
// Hysteria (v1) or Hysteria2 inbound. It reads `inbound.StreamSettings`
|
||||
// directly instead of going through streamData/tlsData, because those
|
||||
// helpers prune fields (like `allowInsecure` / the salamander obfs
|
||||
// block) that the hysteria proxy wants preserved.
|
||||
func (s *SubClashService) buildHysteriaProxy(inbound *model.Inbound, client model.Client, extraRemark string) map[string]any {
|
||||
var inboundSettings map[string]any
|
||||
_ = json.Unmarshal([]byte(inbound.Settings), &inboundSettings)
|
||||
|
||||
proxyType := "hysteria2"
|
||||
authKey := "password"
|
||||
if v, ok := inboundSettings["version"].(float64); ok && int(v) == 1 {
|
||||
proxyType = "hysteria"
|
||||
authKey = "auth-str"
|
||||
}
|
||||
|
||||
proxy := map[string]any{
|
||||
"name": s.SubService.genRemark(inbound, client.Email, extraRemark),
|
||||
"type": proxyType,
|
||||
"server": inbound.Listen,
|
||||
"port": inbound.Port,
|
||||
"udp": true,
|
||||
authKey: client.Auth,
|
||||
}
|
||||
|
||||
var rawStream map[string]any
|
||||
_ = json.Unmarshal([]byte(inbound.StreamSettings), &rawStream)
|
||||
|
||||
// TLS details — hysteria always uses TLS.
|
||||
if tlsSettings, ok := rawStream["tlsSettings"].(map[string]any); ok {
|
||||
if serverName, ok := tlsSettings["serverName"].(string); ok && serverName != "" {
|
||||
proxy["sni"] = serverName
|
||||
}
|
||||
if alpnList, ok := tlsSettings["alpn"].([]any); ok && len(alpnList) > 0 {
|
||||
out := make([]string, 0, len(alpnList))
|
||||
for _, a := range alpnList {
|
||||
if s, ok := a.(string); ok && s != "" {
|
||||
out = append(out, s)
|
||||
}
|
||||
}
|
||||
if len(out) > 0 {
|
||||
proxy["alpn"] = out
|
||||
}
|
||||
}
|
||||
if inner, ok := tlsSettings["settings"].(map[string]any); ok {
|
||||
if insecure, ok := inner["allowInsecure"].(bool); ok && insecure {
|
||||
proxy["skip-cert-verify"] = true
|
||||
}
|
||||
if fp, ok := inner["fingerprint"].(string); ok && fp != "" {
|
||||
proxy["client-fingerprint"] = fp
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Salamander obfs (Hysteria2). Read the same finalmask.udp[salamander]
|
||||
// block the subscription link generator uses.
|
||||
if finalmask, ok := rawStream["finalmask"].(map[string]any); ok {
|
||||
if udpMasks, ok := finalmask["udp"].([]any); ok {
|
||||
for _, m := range udpMasks {
|
||||
mask, _ := m.(map[string]any)
|
||||
if mask == nil || mask["type"] != "salamander" {
|
||||
continue
|
||||
}
|
||||
settings, _ := mask["settings"].(map[string]any)
|
||||
if pw, ok := settings["password"].(string); ok && pw != "" {
|
||||
proxy["obfs"] = "salamander"
|
||||
proxy["obfs-password"] = pw
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// UDP port hopping. mihomo reads the range from a dedicated `ports`
|
||||
// field (the base `port` stays as the redirect target).
|
||||
if hopPorts := hysteriaHopPorts(rawStream); hopPorts != "" {
|
||||
proxy["ports"] = hopPorts
|
||||
}
|
||||
|
||||
return proxy
|
||||
}
|
||||
|
||||
func (s *SubClashService) applyTransport(proxy map[string]any, network string, stream map[string]any) bool {
|
||||
switch network {
|
||||
case "", "tcp":
|
||||
proxy["network"] = "tcp"
|
||||
tcp, _ := stream["tcpSettings"].(map[string]any)
|
||||
if tcp != nil {
|
||||
header, _ := tcp["header"].(map[string]any)
|
||||
if header != nil {
|
||||
typeStr, _ := header["type"].(string)
|
||||
if typeStr != "" && typeStr != "none" {
|
||||
return false
|
||||
}
|
||||
}
|
||||
}
|
||||
return true
|
||||
case "ws":
|
||||
proxy["network"] = "ws"
|
||||
ws, _ := stream["wsSettings"].(map[string]any)
|
||||
wsOpts := map[string]any{}
|
||||
if ws != nil {
|
||||
if path, ok := ws["path"].(string); ok && path != "" {
|
||||
wsOpts["path"] = path
|
||||
}
|
||||
host := ""
|
||||
if v, ok := ws["host"].(string); ok && v != "" {
|
||||
host = v
|
||||
} else if headers, ok := ws["headers"].(map[string]any); ok {
|
||||
host = searchHost(headers)
|
||||
}
|
||||
if host != "" {
|
||||
wsOpts["headers"] = map[string]any{"Host": host}
|
||||
}
|
||||
}
|
||||
if len(wsOpts) > 0 {
|
||||
proxy["ws-opts"] = wsOpts
|
||||
}
|
||||
return true
|
||||
case "grpc":
|
||||
proxy["network"] = "grpc"
|
||||
grpc, _ := stream["grpcSettings"].(map[string]any)
|
||||
grpcOpts := map[string]any{}
|
||||
if grpc != nil {
|
||||
if serviceName, ok := grpc["serviceName"].(string); ok && serviceName != "" {
|
||||
grpcOpts["grpc-service-name"] = serviceName
|
||||
}
|
||||
}
|
||||
if len(grpcOpts) > 0 {
|
||||
proxy["grpc-opts"] = grpcOpts
|
||||
}
|
||||
return true
|
||||
case "httpupgrade":
|
||||
proxy["network"] = "httpupgrade"
|
||||
hu, _ := stream["httpupgradeSettings"].(map[string]any)
|
||||
opts := map[string]any{}
|
||||
if hu != nil {
|
||||
if path, ok := hu["path"].(string); ok && path != "" {
|
||||
opts["path"] = path
|
||||
}
|
||||
host := ""
|
||||
if v, ok := hu["host"].(string); ok && v != "" {
|
||||
host = v
|
||||
} else if headers, ok := hu["headers"].(map[string]any); ok {
|
||||
host = searchHost(headers)
|
||||
}
|
||||
if host != "" {
|
||||
opts["headers"] = map[string]any{"Host": host}
|
||||
}
|
||||
}
|
||||
if len(opts) > 0 {
|
||||
proxy["http-upgrade-opts"] = opts
|
||||
}
|
||||
return true
|
||||
case "xhttp":
|
||||
proxy["network"] = "xhttp"
|
||||
xhttp, _ := stream["xhttpSettings"].(map[string]any)
|
||||
opts := map[string]any{}
|
||||
if xhttp != nil {
|
||||
if path, ok := xhttp["path"].(string); ok && path != "" {
|
||||
opts["path"] = path
|
||||
}
|
||||
host := ""
|
||||
if v, ok := xhttp["host"].(string); ok && v != "" {
|
||||
host = v
|
||||
} else if headers, ok := xhttp["headers"].(map[string]any); ok {
|
||||
host = searchHost(headers)
|
||||
}
|
||||
if host != "" {
|
||||
opts["host"] = host
|
||||
}
|
||||
if mode, ok := xhttp["mode"].(string); ok && mode != "" {
|
||||
opts["mode"] = mode
|
||||
}
|
||||
}
|
||||
if len(opts) > 0 {
|
||||
proxy["xhttp-opts"] = opts
|
||||
}
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
func (s *SubClashService) applySecurity(proxy map[string]any, security string, stream map[string]any) bool {
|
||||
switch security {
|
||||
case "", "none":
|
||||
proxy["tls"] = false
|
||||
return true
|
||||
case "tls":
|
||||
proxy["tls"] = true
|
||||
tlsSettings, _ := stream["tlsSettings"].(map[string]any)
|
||||
if tlsSettings != nil {
|
||||
if serverName, ok := tlsSettings["serverName"].(string); ok && serverName != "" {
|
||||
proxy["servername"] = serverName
|
||||
switch proxy["type"] {
|
||||
case "trojan":
|
||||
proxy["sni"] = serverName
|
||||
}
|
||||
}
|
||||
if fingerprint, ok := tlsSettings["fingerprint"].(string); ok && fingerprint != "" {
|
||||
proxy["client-fingerprint"] = fingerprint
|
||||
}
|
||||
if alpn, ok := externalProxyALPNList(tlsSettings["alpn"]); ok {
|
||||
out := make([]string, 0, len(alpn))
|
||||
for _, item := range alpn {
|
||||
if s, ok := item.(string); ok && s != "" {
|
||||
out = append(out, s)
|
||||
}
|
||||
}
|
||||
if len(out) > 0 {
|
||||
proxy["alpn"] = out
|
||||
}
|
||||
}
|
||||
}
|
||||
return true
|
||||
case "reality":
|
||||
proxy["tls"] = true
|
||||
realitySettings, _ := stream["realitySettings"].(map[string]any)
|
||||
if realitySettings == nil {
|
||||
return false
|
||||
}
|
||||
if serverName, ok := realitySettings["serverName"].(string); ok && serverName != "" {
|
||||
proxy["servername"] = serverName
|
||||
}
|
||||
realityOpts := map[string]any{}
|
||||
if publicKey, ok := realitySettings["publicKey"].(string); ok && publicKey != "" {
|
||||
realityOpts["public-key"] = publicKey
|
||||
}
|
||||
if shortID, ok := realitySettings["shortId"].(string); ok && shortID != "" {
|
||||
realityOpts["short-id"] = shortID
|
||||
}
|
||||
if len(realityOpts) > 0 {
|
||||
proxy["reality-opts"] = realityOpts
|
||||
}
|
||||
if fingerprint, ok := realitySettings["fingerprint"].(string); ok && fingerprint != "" {
|
||||
proxy["client-fingerprint"] = fingerprint
|
||||
}
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
func (s *SubClashService) streamData(stream string) map[string]any {
|
||||
var streamSettings map[string]any
|
||||
json.Unmarshal([]byte(stream), &streamSettings)
|
||||
security, _ := streamSettings["security"].(string)
|
||||
switch security {
|
||||
case "tls":
|
||||
if tlsSettings, ok := streamSettings["tlsSettings"].(map[string]any); ok {
|
||||
streamSettings["tlsSettings"] = s.tlsData(tlsSettings)
|
||||
}
|
||||
case "reality":
|
||||
if realitySettings, ok := streamSettings["realitySettings"].(map[string]any); ok {
|
||||
streamSettings["realitySettings"] = s.realityData(realitySettings)
|
||||
}
|
||||
}
|
||||
delete(streamSettings, "sockopt")
|
||||
return streamSettings
|
||||
}
|
||||
|
||||
func (s *SubClashService) tlsData(tData map[string]any) map[string]any {
|
||||
tlsData := make(map[string]any, 1)
|
||||
tlsClientSettings, _ := tData["settings"].(map[string]any)
|
||||
tlsData["serverName"] = tData["serverName"]
|
||||
tlsData["alpn"] = tData["alpn"]
|
||||
if fingerprint, ok := tlsClientSettings["fingerprint"].(string); ok {
|
||||
tlsData["fingerprint"] = fingerprint
|
||||
}
|
||||
if pins, ok := tlsClientSettings["pinnedPeerCertSha256"].([]any); ok && len(pins) > 0 {
|
||||
tlsData["pin-sha256"] = pins
|
||||
}
|
||||
return tlsData
|
||||
}
|
||||
|
||||
func (s *SubClashService) realityData(rData map[string]any) map[string]any {
|
||||
rDataOut := make(map[string]any, 1)
|
||||
realityClientSettings, _ := rData["settings"].(map[string]any)
|
||||
if publicKey, ok := realityClientSettings["publicKey"].(string); ok {
|
||||
rDataOut["publicKey"] = publicKey
|
||||
}
|
||||
if fingerprint, ok := realityClientSettings["fingerprint"].(string); ok {
|
||||
rDataOut["fingerprint"] = fingerprint
|
||||
}
|
||||
if serverNames, ok := rData["serverNames"].([]any); ok && len(serverNames) > 0 {
|
||||
rDataOut["serverName"] = fmt.Sprint(serverNames[0])
|
||||
}
|
||||
if shortIDs, ok := rData["shortIds"].([]any); ok && len(shortIDs) > 0 {
|
||||
rDataOut["shortId"] = fmt.Sprint(shortIDs[0])
|
||||
}
|
||||
return rDataOut
|
||||
}
|
||||
|
||||
func cloneMap(src map[string]any) map[string]any {
|
||||
if src == nil {
|
||||
return nil
|
||||
}
|
||||
dst := make(map[string]any, len(src))
|
||||
maps.Copy(dst, src)
|
||||
return dst
|
||||
}
|
||||
|
||||
func mergeClashRulesYAML(base map[string]any, raw string) error {
|
||||
raw = strings.TrimSpace(raw)
|
||||
if raw == "" {
|
||||
return nil
|
||||
}
|
||||
|
||||
var custom any
|
||||
if err := yaml.Unmarshal([]byte(raw), &custom); err != nil {
|
||||
mergeClashRules(base, linesToClashRules(raw))
|
||||
return nil
|
||||
}
|
||||
|
||||
switch typed := custom.(type) {
|
||||
case []any:
|
||||
mergeClashRules(base, typed)
|
||||
case map[string]any:
|
||||
for key, value := range typed {
|
||||
if key == "rules" {
|
||||
if ruleList, ok := asAnySlice(value); ok {
|
||||
mergeClashRules(base, ruleList)
|
||||
}
|
||||
continue
|
||||
}
|
||||
base[key] = value
|
||||
}
|
||||
default:
|
||||
mergeClashRules(base, linesToClashRules(raw))
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func mergeClashRules(base map[string]any, customRules []any) {
|
||||
if len(customRules) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
baseRules, _ := asAnySlice(base["rules"])
|
||||
if hasClashMatchRule(customRules) {
|
||||
base["rules"] = customRules
|
||||
return
|
||||
}
|
||||
|
||||
merged := make([]any, 0, len(customRules)+len(baseRules))
|
||||
merged = append(merged, customRules...)
|
||||
merged = append(merged, baseRules...)
|
||||
base["rules"] = merged
|
||||
}
|
||||
|
||||
func asAnySlice(value any) ([]any, bool) {
|
||||
switch typed := value.(type) {
|
||||
case []any:
|
||||
return typed, true
|
||||
case []string:
|
||||
out := make([]any, 0, len(typed))
|
||||
for _, item := range typed {
|
||||
out = append(out, item)
|
||||
}
|
||||
return out, true
|
||||
case []map[string]any:
|
||||
out := make([]any, 0, len(typed))
|
||||
for _, item := range typed {
|
||||
out = append(out, item)
|
||||
}
|
||||
return out, true
|
||||
default:
|
||||
return nil, false
|
||||
}
|
||||
}
|
||||
|
||||
func hasClashMatchRule(rules []any) bool {
|
||||
for _, rule := range rules {
|
||||
ruleText, ok := rule.(string)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
parts := strings.SplitN(ruleText, ",", 2)
|
||||
if strings.EqualFold(strings.TrimSpace(parts[0]), "MATCH") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func linesToClashRules(raw string) []any {
|
||||
lines := strings.Split(raw, "\n")
|
||||
rules := make([]any, 0, len(lines))
|
||||
for _, line := range lines {
|
||||
line = strings.TrimSpace(line)
|
||||
if line == "" || strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
rules = append(rules, line)
|
||||
}
|
||||
return rules
|
||||
}
|
||||
@@ -0,0 +1,174 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
)
|
||||
|
||||
func TestEnsureUniqueProxyNames(t *testing.T) {
|
||||
proxies := []map[string]any{
|
||||
{"name": "", "type": "vless", "server": "a.com", "port": 443},
|
||||
{"name": "", "type": "vmess", "server": "b.com", "port": 8443},
|
||||
{"name": "node"},
|
||||
{"name": "node"},
|
||||
{"name": ""},
|
||||
}
|
||||
|
||||
ensureUniqueProxyNames(proxies)
|
||||
|
||||
seen := map[string]bool{}
|
||||
for i, p := range proxies {
|
||||
name, _ := p["name"].(string)
|
||||
if name == "" {
|
||||
t.Fatalf("proxy %d still has an empty name (mihomo would reject the config, #4641)", i)
|
||||
}
|
||||
if seen[name] {
|
||||
t.Fatalf("proxy %d has duplicate name %q (mihomo rejects the whole config, #4641)", i, name)
|
||||
}
|
||||
seen[name] = true
|
||||
}
|
||||
|
||||
if got := proxies[0]["name"]; got != "vless-a.com-443" {
|
||||
t.Errorf("empty name fallback = %q, want vless-a.com-443", got)
|
||||
}
|
||||
if proxies[2]["name"] == proxies[3]["name"] {
|
||||
t.Errorf("duplicate %q was not disambiguated", proxies[2]["name"])
|
||||
}
|
||||
if got := proxies[4]["name"]; got != "proxy-5" {
|
||||
t.Errorf("typeless empty name fallback = %q, want proxy-5", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyTransport_XHTTP(t *testing.T) {
|
||||
svc := &SubClashService{}
|
||||
proxy := map[string]any{}
|
||||
stream := map[string]any{
|
||||
"xhttpSettings": map[string]any{
|
||||
"path": "/xh",
|
||||
"host": "example.com",
|
||||
"mode": "auto",
|
||||
},
|
||||
}
|
||||
|
||||
if !svc.applyTransport(proxy, "xhttp", stream) {
|
||||
t.Fatalf("applyTransport returned false for xhttp (#4531: would drop the inbound and yield an empty Clash YAML)")
|
||||
}
|
||||
if proxy["network"] != "xhttp" {
|
||||
t.Fatalf("network = %v, want xhttp", proxy["network"])
|
||||
}
|
||||
opts, ok := proxy["xhttp-opts"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("xhttp-opts missing or wrong type: %#v", proxy["xhttp-opts"])
|
||||
}
|
||||
want := map[string]any{"path": "/xh", "host": "example.com", "mode": "auto"}
|
||||
if !reflect.DeepEqual(opts, want) {
|
||||
t.Fatalf("xhttp-opts = %#v, want %#v", opts, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyTransport_XHTTP_HostFromHeaders(t *testing.T) {
|
||||
svc := &SubClashService{}
|
||||
proxy := map[string]any{}
|
||||
stream := map[string]any{
|
||||
"xhttpSettings": map[string]any{
|
||||
"path": "/xh",
|
||||
"headers": map[string]any{"Host": "via-header.example.com"},
|
||||
},
|
||||
}
|
||||
|
||||
if !svc.applyTransport(proxy, "xhttp", stream) {
|
||||
t.Fatalf("applyTransport returned false for xhttp")
|
||||
}
|
||||
opts, _ := proxy["xhttp-opts"].(map[string]any)
|
||||
if opts["host"] != "via-header.example.com" {
|
||||
t.Fatalf("host should fall back to headers.Host, got %v", opts["host"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyTransport_HTTPUpgrade(t *testing.T) {
|
||||
svc := &SubClashService{}
|
||||
proxy := map[string]any{}
|
||||
stream := map[string]any{
|
||||
"httpupgradeSettings": map[string]any{
|
||||
"path": "/hu",
|
||||
"host": "example.com",
|
||||
},
|
||||
}
|
||||
|
||||
if !svc.applyTransport(proxy, "httpupgrade", stream) {
|
||||
t.Fatalf("applyTransport returned false for httpupgrade")
|
||||
}
|
||||
if proxy["network"] != "httpupgrade" {
|
||||
t.Fatalf("network = %v, want httpupgrade", proxy["network"])
|
||||
}
|
||||
opts, ok := proxy["http-upgrade-opts"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("http-upgrade-opts missing: %#v", proxy["http-upgrade-opts"])
|
||||
}
|
||||
if opts["path"] != "/hu" {
|
||||
t.Fatalf("path = %v, want /hu", opts["path"])
|
||||
}
|
||||
headers, _ := opts["headers"].(map[string]any)
|
||||
if headers["Host"] != "example.com" {
|
||||
t.Fatalf("headers.Host = %v, want example.com", headers["Host"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildProxy_VLESSPostQuantumEncryptionUsesMihomoEncryptionField(t *testing.T) {
|
||||
svc := &SubClashService{SubService: &SubService{remarkModel: "-i"}}
|
||||
encryption := "mlkem768x25519plus.native.0rtt.client"
|
||||
inbound := &model.Inbound{
|
||||
Listen: "203.0.113.1",
|
||||
Port: 443,
|
||||
Protocol: model.VLESS,
|
||||
Remark: "pq",
|
||||
Settings: `{"encryption":"` + encryption + `"}`,
|
||||
}
|
||||
client := model.Client{ID: "11111111-2222-4333-8444-555555555555"}
|
||||
stream := map[string]any{
|
||||
"network": "xhttp",
|
||||
"xhttpSettings": map[string]any{
|
||||
"path": "/",
|
||||
"mode": "auto",
|
||||
},
|
||||
"security": "reality",
|
||||
"realitySettings": map[string]any{
|
||||
"publicKey": "pub",
|
||||
"serverName": "example.com",
|
||||
"shortId": "abcd",
|
||||
},
|
||||
}
|
||||
|
||||
proxy := svc.buildProxy(inbound, client, stream, "")
|
||||
|
||||
if proxy["encryption"] != encryption {
|
||||
t.Fatalf("encryption = %v, want %q", proxy["encryption"], encryption)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildProxy_VLESSNoneEncryptionOmittedForClash(t *testing.T) {
|
||||
svc := &SubClashService{SubService: &SubService{remarkModel: "-i"}}
|
||||
inbound := &model.Inbound{
|
||||
Listen: "203.0.113.1",
|
||||
Port: 443,
|
||||
Protocol: model.VLESS,
|
||||
Remark: "plain",
|
||||
Settings: `{"encryption":"none"}`,
|
||||
}
|
||||
client := model.Client{ID: "11111111-2222-4333-8444-555555555555"}
|
||||
stream := map[string]any{
|
||||
"network": "tcp",
|
||||
"security": "none",
|
||||
"tcpSettings": map[string]any{
|
||||
"header": map[string]any{"type": "none"},
|
||||
},
|
||||
}
|
||||
|
||||
proxy := svc.buildProxy(inbound, client, stream, "")
|
||||
|
||||
if _, ok := proxy["encryption"]; ok {
|
||||
t.Fatalf("plain vless encryption should be omitted for mihomo: %#v", proxy)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,414 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"html/template"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
// writeSubError translates a service-layer result into an HTTP response.
|
||||
// A nil error with no rows means the subId doesn't match anything (deleted
|
||||
// client, never-existed id) and becomes 404. A real error becomes 500. No
|
||||
// body — VPN clients only look at the status.
|
||||
func writeSubError(c *gin.Context, err error) {
|
||||
if err == nil {
|
||||
c.Status(http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
c.Status(http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
// cachedSubTemplate holds a parsed custom subscription template together with
|
||||
// the modification time of the file it was parsed from, so the cache can be
|
||||
// invalidated when an admin edits the template on disk.
|
||||
type cachedSubTemplate struct {
|
||||
tmpl *template.Template
|
||||
modTime time.Time
|
||||
}
|
||||
|
||||
// SUBController handles HTTP requests for subscription links and JSON configurations.
|
||||
type SUBController struct {
|
||||
subTitle string
|
||||
subSupportUrl string
|
||||
subProfileUrl string
|
||||
subAnnounce string
|
||||
subEnableRouting bool
|
||||
subRoutingRules string
|
||||
subPath string
|
||||
subJsonPath string
|
||||
subClashPath string
|
||||
jsonEnabled bool
|
||||
clashEnabled bool
|
||||
subEncrypt bool
|
||||
updateInterval string
|
||||
|
||||
subService *SubService
|
||||
subJsonService *SubJsonService
|
||||
subClashService *SubClashService
|
||||
settingService service.SettingService
|
||||
|
||||
subTemplateMu sync.RWMutex
|
||||
subTemplateCache map[string]*cachedSubTemplate
|
||||
}
|
||||
|
||||
// NewSUBController creates a new subscription controller with the given configuration.
|
||||
func NewSUBController(
|
||||
g *gin.RouterGroup,
|
||||
subPath string,
|
||||
jsonPath string,
|
||||
clashPath string,
|
||||
jsonEnabled bool,
|
||||
clashEnabled bool,
|
||||
encrypt bool,
|
||||
showInfo bool,
|
||||
rModel string,
|
||||
update string,
|
||||
jsonMux string,
|
||||
jsonRules string,
|
||||
jsonFinalMask string,
|
||||
clashEnableRouting bool,
|
||||
clashRules string,
|
||||
subTitle string,
|
||||
subSupportUrl string,
|
||||
subProfileUrl string,
|
||||
subAnnounce string,
|
||||
subEnableRouting bool,
|
||||
subRoutingRules string,
|
||||
) *SUBController {
|
||||
sub := NewSubService(showInfo, rModel)
|
||||
a := &SUBController{
|
||||
subTitle: subTitle,
|
||||
subSupportUrl: subSupportUrl,
|
||||
subProfileUrl: subProfileUrl,
|
||||
subAnnounce: subAnnounce,
|
||||
subEnableRouting: subEnableRouting,
|
||||
subRoutingRules: subRoutingRules,
|
||||
subPath: subPath,
|
||||
subJsonPath: jsonPath,
|
||||
subClashPath: clashPath,
|
||||
jsonEnabled: jsonEnabled,
|
||||
clashEnabled: clashEnabled,
|
||||
subEncrypt: encrypt,
|
||||
updateInterval: update,
|
||||
|
||||
subService: sub,
|
||||
subJsonService: NewSubJsonService(jsonMux, jsonRules, jsonFinalMask, sub),
|
||||
subClashService: NewSubClashService(clashEnableRouting, clashRules, sub),
|
||||
|
||||
subTemplateCache: map[string]*cachedSubTemplate{},
|
||||
}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter registers HTTP routes for subscription links and JSON endpoints
|
||||
// on the provided router group.
|
||||
func (a *SUBController) initRouter(g *gin.RouterGroup) {
|
||||
gLink := g.Group(a.subPath)
|
||||
gLink.GET(":subid", a.subs)
|
||||
gLink.HEAD(":subid", a.subs)
|
||||
if a.jsonEnabled {
|
||||
gJson := g.Group(a.subJsonPath)
|
||||
gJson.GET(":subid", a.subJsons)
|
||||
gJson.HEAD(":subid", a.subJsons)
|
||||
}
|
||||
if a.clashEnabled {
|
||||
gClash := g.Group(a.subClashPath)
|
||||
gClash.GET(":subid", a.subClashs)
|
||||
gClash.HEAD(":subid", a.subClashs)
|
||||
}
|
||||
}
|
||||
|
||||
// subs handles HTTP requests for subscription links, returning either HTML page or base64-encoded subscription data.
|
||||
func (a *SUBController) subs(c *gin.Context) {
|
||||
subId := c.Param("subid")
|
||||
scheme, host, hostWithPort, hostHeader := a.subService.ResolveRequest(c)
|
||||
subs, emails, lastOnline, traffic, err := a.subService.GetSubs(subId, host)
|
||||
if err != nil || len(subs) == 0 {
|
||||
writeSubError(c, err)
|
||||
} else {
|
||||
result := ""
|
||||
for _, sub := range subs {
|
||||
result += sub + "\n"
|
||||
}
|
||||
|
||||
// If the request expects HTML (e.g., browser) or explicitly asked (?html=1 or ?view=html), render the info page here
|
||||
accept := c.GetHeader("Accept")
|
||||
if strings.Contains(strings.ToLower(accept), "text/html") || c.Query("html") == "1" || strings.EqualFold(c.Query("view"), "html") {
|
||||
subURL, subJsonURL, subClashURL := a.subService.BuildURLs(a.subPath, a.subJsonPath, a.subClashPath, subId)
|
||||
if !a.jsonEnabled {
|
||||
subJsonURL = ""
|
||||
}
|
||||
if !a.clashEnabled {
|
||||
subClashURL = ""
|
||||
}
|
||||
basePath, exists := c.Get("base_path")
|
||||
if !exists {
|
||||
basePath = "/"
|
||||
}
|
||||
basePathStr := basePath.(string)
|
||||
page := a.subService.BuildPageData(subId, hostHeader, traffic, lastOnline, subs, emails, subURL, subJsonURL, subClashURL, basePathStr, a.subTitle, a.subSupportUrl)
|
||||
a.serveSubPage(c, basePathStr, page)
|
||||
return
|
||||
}
|
||||
|
||||
// Add headers
|
||||
header := fmt.Sprintf("upload=%d; download=%d; total=%d; expire=%d", traffic.Up, traffic.Down, traffic.Total, traffic.ExpiryTime/1000)
|
||||
profileUrl := a.subProfileUrl
|
||||
if profileUrl == "" {
|
||||
profileUrl = fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
|
||||
}
|
||||
a.ApplyCommonHeaders(c, header, a.updateInterval, a.subTitle, a.subSupportUrl, profileUrl, a.subAnnounce, a.subEnableRouting, a.subRoutingRules)
|
||||
|
||||
if a.subEncrypt {
|
||||
c.String(200, base64.StdEncoding.EncodeToString([]byte(result)))
|
||||
} else {
|
||||
c.String(200, result)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// serveSubPage renders internal/web/dist/subpage.html for the current subscription
|
||||
// request. The Vite-built SPA reads window.__SUB_PAGE_DATA__ on mount —
|
||||
// we inject that here, along with window.X_UI_BASE_PATH so the
|
||||
// page's static asset references resolve correctly when the panel runs
|
||||
// behind a URL prefix.
|
||||
func (a *SUBController) serveSubPage(c *gin.Context, basePath string, page PageData) {
|
||||
var body []byte
|
||||
if diskBody, diskErr := os.ReadFile("internal/web/dist/subpage.html"); diskErr == nil {
|
||||
body = diskBody
|
||||
} else {
|
||||
readBody, err := distFS.ReadFile("dist/subpage.html")
|
||||
if err != nil {
|
||||
c.String(http.StatusInternalServerError, "missing embedded subpage")
|
||||
return
|
||||
}
|
||||
body = readBody
|
||||
}
|
||||
|
||||
// Vite emits absolute asset URLs (`/assets/...`); when the panel is
|
||||
// installed under a custom URL prefix, rewrite them so the bundle
|
||||
// loads from `<basePath>assets/...` where the static handler is
|
||||
// actually mounted.
|
||||
if basePath != "/" && basePath != "" {
|
||||
body = bytes.ReplaceAll(body, []byte(`src="/assets/`), []byte(`src="`+basePath+`assets/`))
|
||||
body = bytes.ReplaceAll(body, []byte(`href="/assets/`), []byte(`href="`+basePath+`assets/`))
|
||||
}
|
||||
|
||||
// JSON-marshal the view-model so the SPA can read it as a plain
|
||||
// The panel's "Calendar Type" setting decides whether the SubPage
|
||||
// renders dates in Gregorian or Jalali — surface it here so the SPA
|
||||
// can match the rest of the panel without a round-trip.
|
||||
datepicker, _ := a.settingService.GetDatepicker()
|
||||
if datepicker == "" {
|
||||
datepicker = "gregorian"
|
||||
}
|
||||
|
||||
subData := map[string]any{
|
||||
"sId": page.SId,
|
||||
"enabled": page.Enabled,
|
||||
"download": page.Download,
|
||||
"upload": page.Upload,
|
||||
"total": page.Total,
|
||||
"used": page.Used,
|
||||
"remained": page.Remained,
|
||||
"expire": page.Expire,
|
||||
"lastOnline": page.LastOnline,
|
||||
"downloadByte": page.DownloadByte,
|
||||
"uploadByte": page.UploadByte,
|
||||
"totalByte": page.TotalByte,
|
||||
"subUrl": page.SubUrl,
|
||||
"subJsonUrl": page.SubJsonUrl,
|
||||
"subClashUrl": page.SubClashUrl,
|
||||
"subTitle": page.SubTitle,
|
||||
"subSupportUrl": page.SubSupportUrl,
|
||||
"links": page.Result,
|
||||
"emails": page.Emails,
|
||||
"datepicker": datepicker,
|
||||
}
|
||||
|
||||
// When an admin has configured a custom subscription theme, render it
|
||||
// instead of the default SPA. We render into a buffer first so a template
|
||||
// that fails mid-execution can't leave a partially-written (corrupt)
|
||||
// response — on any error we log and fall through to the default page.
|
||||
if themeDir, _ := a.settingService.GetSubThemeDir(); themeDir != "" {
|
||||
if tmpl, err := a.loadSubTemplate(themeDir); err != nil {
|
||||
logger.Error("sub: custom template parse failed, using default page:", err)
|
||||
} else if tmpl == nil {
|
||||
logger.Warning("sub: subThemeDir set but no usable template found, using default page:", themeDir)
|
||||
} else {
|
||||
var buf bytes.Buffer
|
||||
if execErr := tmpl.Execute(&buf, subData); execErr != nil {
|
||||
logger.Error("sub: custom template execution failed, using default page:", execErr)
|
||||
} else {
|
||||
setNoCacheHeaders(c)
|
||||
c.Data(http.StatusOK, "text/html; charset=utf-8", buf.Bytes())
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
subDataJSON, err := json.Marshal(subData)
|
||||
if err != nil {
|
||||
subDataJSON = []byte("{}")
|
||||
}
|
||||
|
||||
// Defense-in-depth string-escape for the basePath embed — admin-
|
||||
// controlled but cheap to harden.
|
||||
jsEscape := strings.NewReplacer(
|
||||
`\`, `\\`,
|
||||
`"`, `\"`,
|
||||
"\n", `\n`,
|
||||
"\r", `\r`,
|
||||
"<", `<`,
|
||||
">", `>`,
|
||||
"&", `&`,
|
||||
)
|
||||
escapedBase := jsEscape.Replace(basePath)
|
||||
|
||||
inject := []byte(`<script>window.X_UI_BASE_PATH="` + escapedBase + `";` +
|
||||
`window.__SUB_PAGE_DATA__=` + string(subDataJSON) + `;</script></head>`)
|
||||
out := bytes.Replace(body, []byte("</head>"), inject, 1)
|
||||
|
||||
setNoCacheHeaders(c)
|
||||
c.Data(http.StatusOK, "text/html; charset=utf-8", out)
|
||||
}
|
||||
|
||||
// setNoCacheHeaders marks a subscription page response as non-cacheable so VPN
|
||||
// clients and browsers always fetch fresh traffic/expiry data.
|
||||
func setNoCacheHeaders(c *gin.Context) {
|
||||
c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
|
||||
c.Header("Pragma", "no-cache")
|
||||
c.Header("Expires", "0")
|
||||
}
|
||||
|
||||
// loadSubTemplate returns the parsed custom subscription template located in
|
||||
// themeDir, preferring sub.html over index.html. Parsed templates are cached and
|
||||
// only re-parsed when the underlying file's modification time changes, so admin
|
||||
// edits are picked up without paying a disk read + HTML parse on every request.
|
||||
//
|
||||
// It returns (nil, nil) when themeDir is not a usable directory or contains no
|
||||
// template file — the caller should fall back to the default page. A non-nil
|
||||
// error means a template file exists but failed to parse.
|
||||
func (a *SUBController) loadSubTemplate(themeDir string) (*template.Template, error) {
|
||||
info, err := os.Stat(themeDir)
|
||||
if err != nil || !info.IsDir() {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
templatePath := filepath.Join(themeDir, "index.html")
|
||||
if _, err := os.Stat(filepath.Join(themeDir, "sub.html")); err == nil {
|
||||
templatePath = filepath.Join(themeDir, "sub.html")
|
||||
}
|
||||
|
||||
fi, err := os.Stat(templatePath)
|
||||
if err != nil {
|
||||
return nil, nil
|
||||
}
|
||||
modTime := fi.ModTime()
|
||||
|
||||
a.subTemplateMu.RLock()
|
||||
cached := a.subTemplateCache[templatePath]
|
||||
a.subTemplateMu.RUnlock()
|
||||
if cached != nil && cached.modTime.Equal(modTime) {
|
||||
return cached.tmpl, nil
|
||||
}
|
||||
|
||||
tmpl, err := template.ParseFiles(templatePath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
a.subTemplateMu.Lock()
|
||||
a.subTemplateCache[templatePath] = &cachedSubTemplate{tmpl: tmpl, modTime: modTime}
|
||||
a.subTemplateMu.Unlock()
|
||||
return tmpl, nil
|
||||
}
|
||||
|
||||
// subJsons handles HTTP requests for JSON subscription configurations.
|
||||
func (a *SUBController) subJsons(c *gin.Context) {
|
||||
subId := c.Param("subid")
|
||||
scheme, host, hostWithPort, _ := a.subService.ResolveRequest(c)
|
||||
jsonSub, header, err := a.subJsonService.GetJson(subId, host)
|
||||
if err != nil || len(jsonSub) == 0 {
|
||||
writeSubError(c, err)
|
||||
} else {
|
||||
profileUrl := a.subProfileUrl
|
||||
if profileUrl == "" {
|
||||
profileUrl = fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
|
||||
}
|
||||
a.ApplyCommonHeaders(c, header, a.updateInterval, a.subTitle, a.subSupportUrl, profileUrl, a.subAnnounce, a.subEnableRouting, a.subRoutingRules)
|
||||
|
||||
c.String(200, jsonSub)
|
||||
}
|
||||
}
|
||||
|
||||
func (a *SUBController) subClashs(c *gin.Context) {
|
||||
subId := c.Param("subid")
|
||||
scheme, host, hostWithPort, _ := a.subService.ResolveRequest(c)
|
||||
clashSub, header, err := a.subClashService.GetClash(subId, host)
|
||||
if err != nil || len(clashSub) == 0 {
|
||||
writeSubError(c, err)
|
||||
} else {
|
||||
profileUrl := a.subProfileUrl
|
||||
if profileUrl == "" {
|
||||
profileUrl = fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
|
||||
}
|
||||
a.ApplyCommonHeaders(c, header, a.updateInterval, a.subTitle, a.subSupportUrl, profileUrl, a.subAnnounce, a.subEnableRouting, a.subRoutingRules)
|
||||
if a.subTitle != "" {
|
||||
// Clash clients commonly use Content-Disposition to choose the imported profile name.
|
||||
c.Writer.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename*=UTF-8''%s`, url.PathEscape(a.subTitle)))
|
||||
}
|
||||
c.Data(200, "application/yaml; charset=utf-8", []byte(clashSub))
|
||||
}
|
||||
}
|
||||
|
||||
// ApplyCommonHeaders sets common HTTP headers for subscription responses including user info, update interval, and profile title.
|
||||
func (a *SUBController) ApplyCommonHeaders(
|
||||
c *gin.Context,
|
||||
header,
|
||||
updateInterval,
|
||||
profileTitle string,
|
||||
profileSupportUrl string,
|
||||
profileUrl string,
|
||||
profileAnnounce string,
|
||||
profileEnableRouting bool,
|
||||
profileRoutingRules string,
|
||||
) {
|
||||
c.Writer.Header().Set("Subscription-Userinfo", header)
|
||||
c.Writer.Header().Set("Profile-Update-Interval", updateInterval)
|
||||
|
||||
//Basics
|
||||
if profileTitle != "" {
|
||||
c.Writer.Header().Set("Profile-Title", "base64:"+base64.StdEncoding.EncodeToString([]byte(profileTitle)))
|
||||
}
|
||||
if profileSupportUrl != "" {
|
||||
c.Writer.Header().Set("Support-Url", profileSupportUrl)
|
||||
}
|
||||
if profileUrl != "" {
|
||||
c.Writer.Header().Set("Profile-Web-Page-Url", profileUrl)
|
||||
}
|
||||
if profileAnnounce != "" {
|
||||
c.Writer.Header().Set("Announce", "base64:"+base64.StdEncoding.EncodeToString([]byte(profileAnnounce)))
|
||||
}
|
||||
|
||||
//Advanced (Happ)
|
||||
c.Writer.Header().Set("Routing-Enable", strconv.FormatBool(profileEnableRouting))
|
||||
if profileRoutingRules != "" {
|
||||
c.Writer.Header().Set("Routing", profileRoutingRules)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// newTestSUBController builds a controller with just the bits loadSubTemplate
|
||||
// needs, so the template tests don't require a database.
|
||||
func newTestSUBController() *SUBController {
|
||||
return &SUBController{subTemplateCache: map[string]*cachedSubTemplate{}}
|
||||
}
|
||||
|
||||
func writeFile(t *testing.T, path, content string) {
|
||||
t.Helper()
|
||||
if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
|
||||
t.Fatalf("write %s: %v", path, err)
|
||||
}
|
||||
}
|
||||
|
||||
func renderTemplate(t *testing.T, a *SUBController, dir string, data map[string]any) string {
|
||||
t.Helper()
|
||||
tmpl, err := a.loadSubTemplate(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("loadSubTemplate: unexpected error: %v", err)
|
||||
}
|
||||
if tmpl == nil {
|
||||
t.Fatal("loadSubTemplate: expected a template, got nil")
|
||||
}
|
||||
var buf bytes.Buffer
|
||||
if err := tmpl.Execute(&buf, data); err != nil {
|
||||
t.Fatalf("execute: %v", err)
|
||||
}
|
||||
return buf.String()
|
||||
}
|
||||
|
||||
func TestLoadSubTemplate_RendersIndex(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
writeFile(t, filepath.Join(dir, "index.html"), `<h1>{{ .sId }}</h1>`)
|
||||
|
||||
got := renderTemplate(t, newTestSUBController(), dir, map[string]any{"sId": "abc-123"})
|
||||
if want := `<h1>abc-123</h1>`; got != want {
|
||||
t.Fatalf("rendered = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadSubTemplate_PrefersSubHTML(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
writeFile(t, filepath.Join(dir, "index.html"), `from-index`)
|
||||
writeFile(t, filepath.Join(dir, "sub.html"), `from-sub`)
|
||||
|
||||
got := renderTemplate(t, newTestSUBController(), dir, nil)
|
||||
if got != "from-sub" {
|
||||
t.Fatalf("rendered = %q, want %q (sub.html should take precedence)", got, "from-sub")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadSubTemplate_FallbackCases(t *testing.T) {
|
||||
a := newTestSUBController()
|
||||
|
||||
t.Run("missing dir", func(t *testing.T) {
|
||||
tmpl, err := a.loadSubTemplate(filepath.Join(t.TempDir(), "does-not-exist"))
|
||||
if tmpl != nil || err != nil {
|
||||
t.Fatalf("got (%v, %v), want (nil, nil)", tmpl, err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("path is a file not a dir", func(t *testing.T) {
|
||||
file := filepath.Join(t.TempDir(), "index.html")
|
||||
writeFile(t, file, `whatever`)
|
||||
tmpl, err := a.loadSubTemplate(file)
|
||||
if tmpl != nil || err != nil {
|
||||
t.Fatalf("got (%v, %v), want (nil, nil)", tmpl, err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("dir without template file", func(t *testing.T) {
|
||||
tmpl, err := a.loadSubTemplate(t.TempDir())
|
||||
if tmpl != nil || err != nil {
|
||||
t.Fatalf("got (%v, %v), want (nil, nil)", tmpl, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestLoadSubTemplate_MalformedTemplate(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
// Unterminated action — html/template fails to parse this.
|
||||
writeFile(t, filepath.Join(dir, "index.html"), `<h1>{{ .sId </h1>`)
|
||||
|
||||
tmpl, err := newTestSUBController().loadSubTemplate(dir)
|
||||
if err == nil {
|
||||
t.Fatal("expected a parse error for a malformed template, got nil")
|
||||
}
|
||||
if tmpl != nil {
|
||||
t.Fatalf("expected nil template on parse error, got %v", tmpl)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadSubTemplate_CacheHitAndInvalidation(t *testing.T) {
|
||||
a := newTestSUBController()
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "index.html")
|
||||
|
||||
// v1 with a fixed mtime.
|
||||
writeFile(t, path, `v1`)
|
||||
t1 := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
|
||||
if err := os.Chtimes(path, t1, t1); err != nil {
|
||||
t.Fatalf("chtimes: %v", err)
|
||||
}
|
||||
|
||||
first, err := a.loadSubTemplate(dir)
|
||||
if err != nil || first == nil {
|
||||
t.Fatalf("first load: (%v, %v)", first, err)
|
||||
}
|
||||
|
||||
// Same mtime → cache hit returns the identical parsed template.
|
||||
second, err := a.loadSubTemplate(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("second load: %v", err)
|
||||
}
|
||||
if second != first {
|
||||
t.Fatal("expected cache hit to return the same *template.Template pointer")
|
||||
}
|
||||
|
||||
// New content + newer mtime → cache invalidated, fresh content served.
|
||||
writeFile(t, path, `v2`)
|
||||
t2 := t1.Add(time.Hour)
|
||||
if err := os.Chtimes(path, t2, t2); err != nil {
|
||||
t.Fatalf("chtimes: %v", err)
|
||||
}
|
||||
|
||||
third, err := a.loadSubTemplate(dir)
|
||||
if err != nil || third == nil {
|
||||
t.Fatalf("third load: (%v, %v)", third, err)
|
||||
}
|
||||
if third == first {
|
||||
t.Fatal("expected cache invalidation to re-parse the template after mtime change")
|
||||
}
|
||||
var buf bytes.Buffer
|
||||
if err := third.Execute(&buf, nil); err != nil {
|
||||
t.Fatalf("execute: %v", err)
|
||||
}
|
||||
if buf.String() != "v2" {
|
||||
t.Fatalf("rendered = %q, want %q after edit", buf.String(), "v2")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
{
|
||||
"remarks": "",
|
||||
"dns": {
|
||||
"tag": "dns_out",
|
||||
"queryStrategy": "UseIP",
|
||||
"servers": [
|
||||
{
|
||||
"address": "8.8.8.8",
|
||||
"skipFallback": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"inbounds": [
|
||||
{
|
||||
"port": 10808,
|
||||
"protocol": "mixed",
|
||||
"settings": {
|
||||
"auth": "noauth",
|
||||
"udp": true,
|
||||
"userLevel": 8
|
||||
},
|
||||
"sniffing": {
|
||||
"destOverride": [
|
||||
"http",
|
||||
"tls",
|
||||
"quic",
|
||||
"fakedns"
|
||||
],
|
||||
"enabled": true
|
||||
},
|
||||
"tag": "mixed"
|
||||
},
|
||||
{
|
||||
"port": 10809,
|
||||
"protocol": "http",
|
||||
"settings": {
|
||||
"userLevel": 8
|
||||
},
|
||||
"tag": "http"
|
||||
}
|
||||
],
|
||||
"log": {
|
||||
"loglevel": "warning"
|
||||
},
|
||||
"outbounds": [
|
||||
{
|
||||
"tag": "direct",
|
||||
"protocol": "freedom",
|
||||
"settings": {
|
||||
"domainStrategy": "AsIs",
|
||||
"redirect": "",
|
||||
"noises": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"tag": "block",
|
||||
"protocol": "blackhole",
|
||||
"settings": {
|
||||
"response": {
|
||||
"type": "http"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"policy": {
|
||||
"levels": {
|
||||
"8": {
|
||||
"connIdle": 300,
|
||||
"downlinkOnly": 1,
|
||||
"handshake": 4,
|
||||
"uplinkOnly": 1
|
||||
}
|
||||
},
|
||||
"system": {
|
||||
"statsOutboundUplink": true,
|
||||
"statsOutboundDownlink": true
|
||||
}
|
||||
},
|
||||
"routing": {
|
||||
"domainStrategy": "AsIs",
|
||||
"rules": [
|
||||
{
|
||||
"type": "field",
|
||||
"network": "tcp,udp",
|
||||
"outboundTag": "proxy"
|
||||
}
|
||||
]
|
||||
},
|
||||
"stats": {}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
package sub
|
||||
|
||||
import "embed"
|
||||
|
||||
// distFS holds the Vite-built frontend filesystem, injected from main at
|
||||
// startup. The `web` package owns the //go:embed directive (because dist/
|
||||
// is at internal/web/dist/), and hands the FS over via SetDistFS so the sub package
|
||||
// doesn't import web — that would create an import cycle once any
|
||||
// internal/web/controller handler reuses sub's link-building service.
|
||||
var distFS embed.FS
|
||||
|
||||
// SetDistFS installs the embedded frontend filesystem the sub server uses
|
||||
// for its info page assets. Must be called before NewServer().Start().
|
||||
func SetDistFS(fs embed.FS) {
|
||||
distFS = fs
|
||||
}
|
||||
@@ -0,0 +1,495 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
_ "embed"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"maps"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/json_util"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/random"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
//go:embed default.json
|
||||
var defaultJson string
|
||||
|
||||
// SubJsonService handles JSON subscription configuration generation and management.
|
||||
type SubJsonService struct {
|
||||
configJson map[string]any
|
||||
defaultOutbounds []json_util.RawMessage
|
||||
finalMask string
|
||||
mux string
|
||||
|
||||
inboundService service.InboundService
|
||||
SubService *SubService
|
||||
}
|
||||
|
||||
// NewSubJsonService creates a new JSON subscription service with the given configuration.
|
||||
func NewSubJsonService(mux string, rules string, finalMask string, subService *SubService) *SubJsonService {
|
||||
var configJson map[string]any
|
||||
var defaultOutbounds []json_util.RawMessage
|
||||
json.Unmarshal([]byte(defaultJson), &configJson)
|
||||
if outboundSlices, ok := configJson["outbounds"].([]any); ok {
|
||||
for _, defaultOutbound := range outboundSlices {
|
||||
jsonBytes, _ := json.Marshal(defaultOutbound)
|
||||
defaultOutbounds = append(defaultOutbounds, jsonBytes)
|
||||
}
|
||||
}
|
||||
|
||||
if rules != "" {
|
||||
var newRules []any
|
||||
routing, _ := configJson["routing"].(map[string]any)
|
||||
defaultRules, _ := routing["rules"].([]any)
|
||||
json.Unmarshal([]byte(rules), &newRules)
|
||||
defaultRules = append(newRules, defaultRules...)
|
||||
routing["rules"] = defaultRules
|
||||
configJson["routing"] = routing
|
||||
}
|
||||
|
||||
return &SubJsonService{
|
||||
configJson: configJson,
|
||||
defaultOutbounds: defaultOutbounds,
|
||||
finalMask: finalMask,
|
||||
mux: mux,
|
||||
SubService: subService,
|
||||
}
|
||||
}
|
||||
|
||||
// GetJson generates a JSON subscription configuration for the given subscription ID and host.
|
||||
func (s *SubJsonService) GetJson(subId string, host string) (string, string, error) {
|
||||
// Set per-request state on the shared SubService so any
|
||||
// resolveInboundAddress call inside picks node-aware host values.
|
||||
s.SubService.PrepareForRequest(host)
|
||||
inbounds, err := s.SubService.getInboundsBySubId(subId)
|
||||
if err != nil || len(inbounds) == 0 {
|
||||
return "", "", err
|
||||
}
|
||||
|
||||
var header string
|
||||
var configArray []json_util.RawMessage
|
||||
|
||||
seenEmails := make(map[string]struct{})
|
||||
// Prepare Inbounds
|
||||
for _, inbound := range inbounds {
|
||||
clients, err := s.inboundService.GetClients(inbound)
|
||||
if err != nil {
|
||||
logger.Error("SubJsonService - GetClients: Unable to get clients from inbound")
|
||||
}
|
||||
if clients == nil {
|
||||
continue
|
||||
}
|
||||
s.SubService.projectThroughFallbackMaster(inbound)
|
||||
|
||||
for _, client := range clients {
|
||||
if client.SubID == subId {
|
||||
seenEmails[client.Email] = struct{}{}
|
||||
configArray = append(configArray, s.getConfig(inbound, client, host)...)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(configArray) == 0 {
|
||||
return "", "", nil
|
||||
}
|
||||
|
||||
emails := make([]string, 0, len(seenEmails))
|
||||
for e := range seenEmails {
|
||||
emails = append(emails, e)
|
||||
}
|
||||
traffic, _ := s.SubService.AggregateTrafficByEmails(emails)
|
||||
|
||||
// Combile outbounds
|
||||
var finalJson []byte
|
||||
if len(configArray) == 1 {
|
||||
finalJson, _ = json.MarshalIndent(configArray[0], "", " ")
|
||||
} else {
|
||||
finalJson, _ = json.MarshalIndent(configArray, "", " ")
|
||||
}
|
||||
|
||||
header = fmt.Sprintf("upload=%d; download=%d; total=%d; expire=%d", traffic.Up, traffic.Down, traffic.Total, traffic.ExpiryTime/1000)
|
||||
return string(finalJson), header, nil
|
||||
}
|
||||
|
||||
func (s *SubJsonService) getConfig(inbound *model.Inbound, client model.Client, host string) []json_util.RawMessage {
|
||||
var newJsonArray []json_util.RawMessage
|
||||
stream := s.streamData(inbound.StreamSettings)
|
||||
|
||||
// When externalProxy is empty the JSON config falls back to a
|
||||
// synthetic one whose `dest` is the host the client connects to.
|
||||
// For node-managed inbounds we want the node's address — request
|
||||
// host won't reach the right xray. resolveInboundAddress already
|
||||
// implements the node→subscriber-host fallback chain.
|
||||
defaultDest := s.SubService.resolveInboundAddress(inbound)
|
||||
if defaultDest == "" {
|
||||
defaultDest = host
|
||||
}
|
||||
|
||||
externalProxies, ok := stream["externalProxy"].([]any)
|
||||
hasExternalProxy := ok && len(externalProxies) > 0
|
||||
if !hasExternalProxy {
|
||||
externalProxies = []any{
|
||||
map[string]any{
|
||||
"forceTls": "same",
|
||||
"dest": defaultDest,
|
||||
"port": float64(inbound.Port),
|
||||
"remark": "",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
delete(stream, "externalProxy")
|
||||
|
||||
for _, ep := range externalProxies {
|
||||
extPrxy := ep.(map[string]any)
|
||||
inbound.Listen = extPrxy["dest"].(string)
|
||||
inbound.Port = int(extPrxy["port"].(float64))
|
||||
newStream := cloneStreamForExternalProxy(stream)
|
||||
switch extPrxy["forceTls"].(string) {
|
||||
case "tls":
|
||||
if newStream["security"] != "tls" {
|
||||
newStream["security"] = "tls"
|
||||
newStream["tlsSettings"] = map[string]any{}
|
||||
}
|
||||
case "none":
|
||||
if newStream["security"] != "none" {
|
||||
newStream["security"] = "none"
|
||||
delete(newStream, "tlsSettings")
|
||||
}
|
||||
}
|
||||
security, _ := newStream["security"].(string)
|
||||
if hasExternalProxy {
|
||||
applyExternalProxyTLSToStream(extPrxy, newStream, security)
|
||||
}
|
||||
streamSettings, _ := json.MarshalIndent(newStream, "", " ")
|
||||
|
||||
var newOutbounds []json_util.RawMessage
|
||||
|
||||
switch inbound.Protocol {
|
||||
case "vmess":
|
||||
newOutbounds = append(newOutbounds, s.genVnext(inbound, streamSettings, client))
|
||||
case "vless":
|
||||
newOutbounds = append(newOutbounds, s.genVless(inbound, streamSettings, client))
|
||||
case "trojan", "shadowsocks":
|
||||
newOutbounds = append(newOutbounds, s.genServer(inbound, streamSettings, client))
|
||||
case "hysteria":
|
||||
newOutbounds = append(newOutbounds, s.genHy(inbound, newStream, client))
|
||||
}
|
||||
|
||||
newOutbounds = append(newOutbounds, s.defaultOutbounds...)
|
||||
newConfigJson := make(map[string]any)
|
||||
maps.Copy(newConfigJson, s.configJson)
|
||||
|
||||
newConfigJson["outbounds"] = newOutbounds
|
||||
newConfigJson["remarks"] = s.SubService.genRemark(inbound, client.Email, extPrxy["remark"].(string))
|
||||
|
||||
newConfig, _ := json.MarshalIndent(newConfigJson, "", " ")
|
||||
newJsonArray = append(newJsonArray, newConfig)
|
||||
}
|
||||
|
||||
return newJsonArray
|
||||
}
|
||||
|
||||
func (s *SubJsonService) streamData(stream string) map[string]any {
|
||||
var streamSettings map[string]any
|
||||
json.Unmarshal([]byte(stream), &streamSettings)
|
||||
security, _ := streamSettings["security"].(string)
|
||||
switch security {
|
||||
case "tls":
|
||||
streamSettings["tlsSettings"] = s.tlsData(streamSettings["tlsSettings"].(map[string]any))
|
||||
case "reality":
|
||||
streamSettings["realitySettings"] = s.realityData(streamSettings["realitySettings"].(map[string]any))
|
||||
}
|
||||
delete(streamSettings, "sockopt")
|
||||
|
||||
if s.finalMask != "" {
|
||||
s.applyGlobalFinalMask(streamSettings)
|
||||
}
|
||||
|
||||
// remove proxy protocol
|
||||
network, _ := streamSettings["network"].(string)
|
||||
switch network {
|
||||
case "tcp":
|
||||
streamSettings["tcpSettings"] = s.removeAcceptProxy(streamSettings["tcpSettings"])
|
||||
case "ws":
|
||||
streamSettings["wsSettings"] = s.removeAcceptProxy(streamSettings["wsSettings"])
|
||||
case "httpupgrade":
|
||||
streamSettings["httpupgradeSettings"] = s.removeAcceptProxy(streamSettings["httpupgradeSettings"])
|
||||
case "xhttp":
|
||||
streamSettings["xhttpSettings"] = s.removeAcceptProxy(streamSettings["xhttpSettings"])
|
||||
if xhttp, ok := streamSettings["xhttpSettings"].(map[string]any); ok {
|
||||
delete(xhttp, "noSSEHeader")
|
||||
delete(xhttp, "scMaxBufferedPosts")
|
||||
delete(xhttp, "scStreamUpServerSecs")
|
||||
delete(xhttp, "serverMaxHeaderBytes")
|
||||
}
|
||||
}
|
||||
return streamSettings
|
||||
}
|
||||
|
||||
func (s *SubJsonService) applyGlobalFinalMask(streamSettings map[string]any) {
|
||||
var fm map[string]any
|
||||
if err := json.Unmarshal([]byte(s.finalMask), &fm); err != nil || len(fm) == 0 {
|
||||
return
|
||||
}
|
||||
merged := mergeFinalMask(streamSettings["finalmask"], fm)
|
||||
if len(merged) > 0 {
|
||||
streamSettings["finalmask"] = merged
|
||||
}
|
||||
}
|
||||
|
||||
func (s *SubJsonService) removeAcceptProxy(setting any) map[string]any {
|
||||
netSettings, ok := setting.(map[string]any)
|
||||
if ok {
|
||||
delete(netSettings, "acceptProxyProtocol")
|
||||
}
|
||||
return netSettings
|
||||
}
|
||||
|
||||
func (s *SubJsonService) tlsData(tData map[string]any) map[string]any {
|
||||
tlsData := make(map[string]any, 1)
|
||||
tlsClientSettings, _ := tData["settings"].(map[string]any)
|
||||
|
||||
tlsData["serverName"] = tData["serverName"]
|
||||
tlsData["alpn"] = tData["alpn"]
|
||||
if fingerprint, ok := tlsClientSettings["fingerprint"].(string); ok {
|
||||
tlsData["fingerprint"] = fingerprint
|
||||
}
|
||||
if ech, ok := tlsClientSettings["echConfigList"].(string); ok && ech != "" {
|
||||
tlsData["echConfigList"] = ech
|
||||
}
|
||||
if pins, ok := tlsClientSettings["pinnedPeerCertSha256"].([]any); ok && len(pins) > 0 {
|
||||
tlsData["pinnedPeerCertSha256"] = pins
|
||||
}
|
||||
return tlsData
|
||||
}
|
||||
|
||||
func (s *SubJsonService) realityData(rData map[string]any) map[string]any {
|
||||
rltyData := make(map[string]any, 1)
|
||||
rltyClientSettings, _ := rData["settings"].(map[string]any)
|
||||
|
||||
rltyData["show"] = false
|
||||
rltyData["publicKey"] = rltyClientSettings["publicKey"]
|
||||
rltyData["fingerprint"] = rltyClientSettings["fingerprint"]
|
||||
rltyData["mldsa65Verify"] = rltyClientSettings["mldsa65Verify"]
|
||||
|
||||
// Set random data
|
||||
rltyData["spiderX"] = "/" + random.Seq(15)
|
||||
shortIds, ok := rData["shortIds"].([]any)
|
||||
if ok && len(shortIds) > 0 {
|
||||
rltyData["shortId"] = shortIds[random.Num(len(shortIds))].(string)
|
||||
} else {
|
||||
rltyData["shortId"] = ""
|
||||
}
|
||||
serverNames, ok := rData["serverNames"].([]any)
|
||||
if ok && len(serverNames) > 0 {
|
||||
rltyData["serverName"] = serverNames[random.Num(len(serverNames))].(string)
|
||||
} else {
|
||||
rltyData["serverName"] = ""
|
||||
}
|
||||
|
||||
return rltyData
|
||||
}
|
||||
|
||||
func (s *SubJsonService) genVnext(inbound *model.Inbound, streamSettings json_util.RawMessage, client model.Client) json_util.RawMessage {
|
||||
outbound := Outbound{}
|
||||
|
||||
outbound.Protocol = string(inbound.Protocol)
|
||||
outbound.Tag = "proxy"
|
||||
if s.mux != "" {
|
||||
outbound.Mux = json_util.RawMessage(s.mux)
|
||||
}
|
||||
outbound.StreamSettings = streamSettings
|
||||
|
||||
security := client.Security
|
||||
if security == "" {
|
||||
security = "auto"
|
||||
}
|
||||
outbound.Settings = map[string]any{
|
||||
"address": inbound.Listen,
|
||||
"port": inbound.Port,
|
||||
"id": client.ID,
|
||||
"security": security,
|
||||
"level": 8,
|
||||
}
|
||||
|
||||
result, _ := json.MarshalIndent(outbound, "", " ")
|
||||
return result
|
||||
}
|
||||
|
||||
func (s *SubJsonService) genVless(inbound *model.Inbound, streamSettings json_util.RawMessage, client model.Client) json_util.RawMessage {
|
||||
outbound := Outbound{}
|
||||
outbound.Protocol = string(inbound.Protocol)
|
||||
outbound.Tag = "proxy"
|
||||
if s.mux != "" {
|
||||
outbound.Mux = json_util.RawMessage(s.mux)
|
||||
}
|
||||
outbound.StreamSettings = streamSettings
|
||||
|
||||
// Add encryption for VLESS outbound from inbound settings
|
||||
var inboundSettings map[string]any
|
||||
json.Unmarshal([]byte(inbound.Settings), &inboundSettings)
|
||||
encryption, _ := inboundSettings["encryption"].(string)
|
||||
|
||||
settings := map[string]any{
|
||||
"address": inbound.Listen,
|
||||
"port": inbound.Port,
|
||||
"id": client.ID,
|
||||
"encryption": encryption,
|
||||
"level": 8,
|
||||
}
|
||||
if client.Flow != "" {
|
||||
settings["flow"] = client.Flow
|
||||
}
|
||||
outbound.Settings = settings
|
||||
result, _ := json.MarshalIndent(outbound, "", " ")
|
||||
return result
|
||||
}
|
||||
|
||||
func (s *SubJsonService) genServer(inbound *model.Inbound, streamSettings json_util.RawMessage, client model.Client) json_util.RawMessage {
|
||||
outbound := Outbound{}
|
||||
|
||||
serverData := make([]ServerSetting, 1)
|
||||
serverData[0] = ServerSetting{
|
||||
Address: inbound.Listen,
|
||||
Port: inbound.Port,
|
||||
Level: 8,
|
||||
Password: client.Password,
|
||||
}
|
||||
|
||||
if inbound.Protocol == model.Shadowsocks {
|
||||
var inboundSettings map[string]any
|
||||
json.Unmarshal([]byte(inbound.Settings), &inboundSettings)
|
||||
method, _ := inboundSettings["method"].(string)
|
||||
serverData[0].Method = method
|
||||
|
||||
// server password in multi-user 2022 protocols
|
||||
if strings.HasPrefix(method, "2022") {
|
||||
if serverPassword, ok := inboundSettings["password"].(string); ok {
|
||||
serverData[0].Password = fmt.Sprintf("%s:%s", serverPassword, client.Password)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
outbound.Protocol = string(inbound.Protocol)
|
||||
outbound.Tag = "proxy"
|
||||
if s.mux != "" {
|
||||
outbound.Mux = json_util.RawMessage(s.mux)
|
||||
}
|
||||
outbound.StreamSettings = streamSettings
|
||||
|
||||
settings := map[string]any{
|
||||
"address": serverData[0].Address,
|
||||
"port": serverData[0].Port,
|
||||
"password": serverData[0].Password,
|
||||
"level": 8,
|
||||
}
|
||||
if inbound.Protocol == model.Shadowsocks {
|
||||
settings["method"] = serverData[0].Method
|
||||
}
|
||||
outbound.Settings = settings
|
||||
|
||||
result, _ := json.MarshalIndent(outbound, "", " ")
|
||||
return result
|
||||
}
|
||||
|
||||
func (s *SubJsonService) genHy(inbound *model.Inbound, newStream map[string]any, client model.Client) json_util.RawMessage {
|
||||
outbound := Outbound{}
|
||||
|
||||
outbound.Protocol = string(inbound.Protocol)
|
||||
outbound.Tag = "proxy"
|
||||
|
||||
if s.mux != "" {
|
||||
outbound.Mux = json_util.RawMessage(s.mux)
|
||||
}
|
||||
|
||||
var settings, stream map[string]any
|
||||
json.Unmarshal([]byte(inbound.Settings), &settings)
|
||||
version, _ := settings["version"].(float64)
|
||||
outbound.Settings = map[string]any{
|
||||
"version": int(version),
|
||||
"address": inbound.Listen,
|
||||
"port": inbound.Port,
|
||||
}
|
||||
|
||||
json.Unmarshal([]byte(inbound.StreamSettings), &stream)
|
||||
hyStream := stream["hysteriaSettings"].(map[string]any)
|
||||
outHyStream := map[string]any{
|
||||
"version": int(version),
|
||||
"auth": client.Auth,
|
||||
}
|
||||
if udpIdleTimeout, ok := hyStream["udpIdleTimeout"].(float64); ok {
|
||||
outHyStream["udpIdleTimeout"] = int(udpIdleTimeout)
|
||||
}
|
||||
if masquerade, ok := hyStream["masquerade"].(map[string]any); ok {
|
||||
outHyStream["masquerade"] = masquerade
|
||||
}
|
||||
newStream["hysteriaSettings"] = outHyStream
|
||||
|
||||
if finalmask, ok := hyStream["finalmask"].(map[string]any); ok {
|
||||
newStream["finalmask"] = mergeFinalMask(newStream["finalmask"], finalmask)
|
||||
}
|
||||
|
||||
newStream["network"] = "hysteria"
|
||||
newStream["security"] = "tls"
|
||||
|
||||
outbound.StreamSettings, _ = json.MarshalIndent(newStream, "", " ")
|
||||
|
||||
result, _ := json.MarshalIndent(outbound, "", " ")
|
||||
return result
|
||||
}
|
||||
|
||||
func mergeFinalMask(base any, extra map[string]any) map[string]any {
|
||||
merged := map[string]any{}
|
||||
if baseMap, ok := base.(map[string]any); ok {
|
||||
for key, value := range baseMap {
|
||||
switch key {
|
||||
case "tcp", "udp":
|
||||
if masks, ok := value.([]any); ok {
|
||||
merged[key] = append([]any(nil), masks...)
|
||||
}
|
||||
default:
|
||||
merged[key] = value
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for key, value := range extra {
|
||||
switch key {
|
||||
case "tcp", "udp":
|
||||
baseMasks, _ := merged[key].([]any)
|
||||
extraMasks, _ := value.([]any)
|
||||
if len(extraMasks) > 0 {
|
||||
merged[key] = append(baseMasks, extraMasks...)
|
||||
}
|
||||
case "quicParams":
|
||||
if _, exists := merged[key]; !exists {
|
||||
merged[key] = value
|
||||
}
|
||||
default:
|
||||
merged[key] = value
|
||||
}
|
||||
}
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
type Outbound struct {
|
||||
Protocol string `json:"protocol"`
|
||||
Tag string `json:"tag"`
|
||||
StreamSettings json_util.RawMessage `json:"streamSettings"`
|
||||
Mux json_util.RawMessage `json:"mux,omitempty"`
|
||||
Settings map[string]any `json:"settings,omitempty"`
|
||||
}
|
||||
|
||||
type ServerSetting struct {
|
||||
Password string `json:"password"`
|
||||
Level int `json:"level"`
|
||||
Address string `json:"address"`
|
||||
Port int `json:"port"`
|
||||
Flow string `json:"flow,omitempty"`
|
||||
Method string `json:"method,omitempty"`
|
||||
}
|
||||
@@ -0,0 +1,148 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
)
|
||||
|
||||
func hasDirectOutOutbound(svc *SubJsonService) bool {
|
||||
for _, raw := range svc.defaultOutbounds {
|
||||
var outbound map[string]any
|
||||
if err := json.Unmarshal(raw, &outbound); err != nil {
|
||||
continue
|
||||
}
|
||||
if outbound["tag"] == "direct_out" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func outboundSettings(t *testing.T, raw []byte) map[string]any {
|
||||
t.Helper()
|
||||
var parsed map[string]any
|
||||
if err := json.Unmarshal(raw, &parsed); err != nil {
|
||||
t.Fatalf("failed to unmarshal outbound: %v", err)
|
||||
}
|
||||
settings, _ := parsed["settings"].(map[string]any)
|
||||
if settings == nil {
|
||||
t.Fatal("outbound has no settings")
|
||||
}
|
||||
return settings
|
||||
}
|
||||
|
||||
func TestSubJsonServiceInjectsGlobalFinalMask(t *testing.T) {
|
||||
finalMask := `{"tcp":[{"type":"fragment","settings":{"packets":"tlshello","length":"100-200","delay":"10-20"}}],"udp":[{"type":"noise","settings":{"noise":[{"type":"base64","packet":"SGVsbG8="}]}}],"quicParams":{"congestion":"bbr"}}`
|
||||
svc := NewSubJsonService("", "", finalMask, nil)
|
||||
|
||||
if hasDirectOutOutbound(svc) {
|
||||
t.Fatal("direct_out outbound must never be emitted")
|
||||
}
|
||||
|
||||
stream := svc.streamData(`{"network":"tcp","security":"none","tcpSettings":{"header":{"type":"none"}}}`)
|
||||
if _, ok := stream["sockopt"]; ok {
|
||||
t.Fatal("legacy direct_out dialerProxy sockopt must never be set")
|
||||
}
|
||||
|
||||
finalmask, _ := stream["finalmask"].(map[string]any)
|
||||
if finalmask == nil {
|
||||
t.Fatal("streamSettings is missing finalmask")
|
||||
}
|
||||
|
||||
tcp, _ := finalmask["tcp"].([]any)
|
||||
if len(tcp) != 1 {
|
||||
t.Fatalf("tcp masks len = %d, want 1", len(tcp))
|
||||
}
|
||||
if first, _ := tcp[0].(map[string]any); first["type"] != "fragment" {
|
||||
t.Fatalf("tcp[0] type = %v, want fragment", first["type"])
|
||||
}
|
||||
|
||||
udp, _ := finalmask["udp"].([]any)
|
||||
if len(udp) != 1 {
|
||||
t.Fatalf("udp masks len = %d, want 1", len(udp))
|
||||
}
|
||||
|
||||
quic, _ := finalmask["quicParams"].(map[string]any)
|
||||
if quic == nil || quic["congestion"] != "bbr" {
|
||||
t.Fatalf("quicParams missing/wrong: %#v", finalmask["quicParams"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestSubJsonServiceMergesWithExistingFinalMask(t *testing.T) {
|
||||
finalMask := `{"tcp":[{"type":"fragment","settings":{"packets":"tlshello"}}]}`
|
||||
svc := NewSubJsonService("", "", finalMask, nil)
|
||||
|
||||
stream := svc.streamData(`{
|
||||
"network":"tcp","security":"none","tcpSettings":{"header":{"type":"none"}},
|
||||
"finalmask":{"tcp":[{"type":"sudoku"}]}
|
||||
}`)
|
||||
|
||||
finalmask, _ := stream["finalmask"].(map[string]any)
|
||||
tcp, _ := finalmask["tcp"].([]any)
|
||||
if len(tcp) != 2 {
|
||||
t.Fatalf("tcp masks len = %d, want 2 (existing + global)", len(tcp))
|
||||
}
|
||||
a, _ := tcp[0].(map[string]any)
|
||||
b, _ := tcp[1].(map[string]any)
|
||||
if a["type"] != "sudoku" || b["type"] != "fragment" {
|
||||
t.Fatalf("tcp masks = %#v, want existing sudoku then global fragment", tcp)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSubJsonServiceNoFinalMaskWhenEmpty(t *testing.T) {
|
||||
svc := NewSubJsonService("", "", "", nil)
|
||||
stream := svc.streamData(`{"network":"tcp","security":"none","tcpSettings":{"header":{"type":"none"}}}`)
|
||||
if _, ok := stream["finalmask"]; ok {
|
||||
t.Fatal("no finalmask should be emitted when subJsonFinalMask is empty")
|
||||
}
|
||||
if _, ok := stream["sockopt"]; ok {
|
||||
t.Fatal("legacy direct_out sockopt must never be set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSubJsonServiceVlessFlattened(t *testing.T) {
|
||||
inbound := &model.Inbound{Listen: "1.2.3.4", Port: 443, Protocol: model.VLESS, Settings: `{"encryption":"none"}`}
|
||||
client := model.Client{ID: "uuid-1", Flow: "xtls-rprx-vision"}
|
||||
|
||||
settings := outboundSettings(t, NewSubJsonService("", "", "", nil).genVless(inbound, nil, client))
|
||||
if _, ok := settings["vnext"]; ok {
|
||||
t.Fatal("vless outbound must not use vnext")
|
||||
}
|
||||
if settings["address"] != "1.2.3.4" || settings["id"] != "uuid-1" || settings["encryption"] != "none" || settings["flow"] != "xtls-rprx-vision" {
|
||||
t.Fatalf("flat vless settings wrong: %#v", settings)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSubJsonServiceVmessFlattened(t *testing.T) {
|
||||
inbound := &model.Inbound{Listen: "1.2.3.4", Port: 443, Protocol: model.VMESS, Settings: `{}`}
|
||||
client := model.Client{ID: "uuid-2"}
|
||||
|
||||
settings := outboundSettings(t, NewSubJsonService("", "", "", nil).genVnext(inbound, nil, client))
|
||||
if _, ok := settings["vnext"]; ok {
|
||||
t.Fatal("vmess outbound must not use vnext")
|
||||
}
|
||||
if settings["id"] != "uuid-2" || settings["security"] != "auto" {
|
||||
t.Fatalf("flat vmess settings wrong: %#v", settings)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSubJsonServiceServerFlattened(t *testing.T) {
|
||||
trojan := &model.Inbound{Listen: "1.2.3.4", Port: 443, Protocol: model.Trojan, Settings: `{}`}
|
||||
client := model.Client{Password: "p4ss"}
|
||||
|
||||
settings := outboundSettings(t, NewSubJsonService("", "", "", nil).genServer(trojan, nil, client))
|
||||
if _, ok := settings["servers"]; ok {
|
||||
t.Fatal("trojan outbound must not use servers array")
|
||||
}
|
||||
if settings["password"] != "p4ss" || settings["address"] != "1.2.3.4" {
|
||||
t.Fatalf("flat trojan settings wrong: %#v", settings)
|
||||
}
|
||||
|
||||
ss := &model.Inbound{Listen: "1.2.3.4", Port: 443, Protocol: model.Shadowsocks, Settings: `{"method":"aes-256-gcm"}`}
|
||||
ssSettings := outboundSettings(t, NewSubJsonService("", "", "", nil).genServer(ss, nil, client))
|
||||
if ssSettings["method"] != "aes-256-gcm" {
|
||||
t.Fatalf("flat shadowsocks must carry method: %#v", ssSettings)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
type LinkProvider struct {
|
||||
settingService service.SettingService
|
||||
}
|
||||
|
||||
func NewLinkProvider() *LinkProvider {
|
||||
return &LinkProvider{}
|
||||
}
|
||||
|
||||
func (p *LinkProvider) build(host string) *SubService {
|
||||
showInfo, _ := p.settingService.GetSubShowInfo()
|
||||
rModel, err := p.settingService.GetRemarkModel()
|
||||
if err != nil {
|
||||
rModel = "-io"
|
||||
}
|
||||
svc := NewSubService(showInfo, rModel)
|
||||
svc.PrepareForRequest(host)
|
||||
return svc
|
||||
}
|
||||
|
||||
func (p *LinkProvider) SubLinksForSubId(host, subId string) ([]string, error) {
|
||||
svc := p.build(host)
|
||||
links, _, _, _, err := svc.GetSubs(subId, host)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out := make([]string, 0, len(links))
|
||||
for _, l := range links {
|
||||
out = append(out, splitLinkLines(l)...)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (p *LinkProvider) LinksForClient(host string, inbound *model.Inbound, email string) []string {
|
||||
svc := p.build(host)
|
||||
svc.projectThroughFallbackMaster(inbound)
|
||||
return splitLinkLines(svc.GetLink(inbound, email))
|
||||
}
|
||||
|
||||
func splitLinkLines(raw string) []string {
|
||||
if raw == "" {
|
||||
return nil
|
||||
}
|
||||
parts := strings.Split(raw, "\n")
|
||||
out := make([]string, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
if p = strings.TrimSpace(p); p != "" {
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestSplitLinkLines(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
in string
|
||||
want []string
|
||||
}{
|
||||
{"single_line", "vless://abc", []string{"vless://abc"}},
|
||||
{"two_lines", "vless://abc\nvmess://xyz", []string{"vless://abc", "vmess://xyz"}},
|
||||
{"trims_each_line", " vless://abc \n\tvmess://xyz\t", []string{"vless://abc", "vmess://xyz"}},
|
||||
{"skips_blank_lines", "vless://abc\n\n\nvmess://xyz\n", []string{"vless://abc", "vmess://xyz"}},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
got := splitLinkLines(c.in)
|
||||
if !reflect.DeepEqual(got, c.want) {
|
||||
t.Fatalf("splitLinkLines(%q) = %#v, want %#v", c.in, got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSplitLinkLines_EmptyInputIsNil(t *testing.T) {
|
||||
if got := splitLinkLines(""); got != nil {
|
||||
t.Fatalf("splitLinkLines(\"\") = %#v, want nil", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSplitLinkLines_WhitespaceOnlyHasNoEntries(t *testing.T) {
|
||||
got := splitLinkLines(" \n\t \n")
|
||||
if len(got) != 0 {
|
||||
t.Fatalf("splitLinkLines(whitespace) = %#v, want empty slice", got)
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,999 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
)
|
||||
|
||||
func TestSubscriptionExpiryFromClient(t *testing.T) {
|
||||
const now = int64(1_700_000_000_000)
|
||||
const oneDayMs = int64(86_400_000)
|
||||
if got := subscriptionExpiryFromClient(now, 0); got != 0 {
|
||||
t.Fatalf("zero expiry should stay zero, got %d", got)
|
||||
}
|
||||
if got := subscriptionExpiryFromClient(now, 1_700_000_000_000); got != 1_700_000_000_000 {
|
||||
t.Fatalf("positive expiry should pass through, got %d", got)
|
||||
}
|
||||
if got := subscriptionExpiryFromClient(now, -oneDayMs); got != now+oneDayMs {
|
||||
t.Fatalf("delayed-start expiry should be now+|value|, got %d, want %d", got, now+oneDayMs)
|
||||
}
|
||||
if a, b := subscriptionExpiryFromClient(now, -oneDayMs), subscriptionExpiryFromClient(now, -oneDayMs); a != b {
|
||||
t.Fatalf("same now+value should be deterministic across calls, got %d vs %d (#4545 review)", a, b)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFindClientIndex(t *testing.T) {
|
||||
clients := []model.Client{
|
||||
{Email: "a@example.com"},
|
||||
{Email: "b@example.com"},
|
||||
{Email: "c@example.com"},
|
||||
}
|
||||
if got := findClientIndex(clients, "b@example.com"); got != 1 {
|
||||
t.Fatalf("findClientIndex middle = %d, want 1", got)
|
||||
}
|
||||
if got := findClientIndex(clients, "a@example.com"); got != 0 {
|
||||
t.Fatalf("findClientIndex first = %d, want 0", got)
|
||||
}
|
||||
if got := findClientIndex(clients, "missing@example.com"); got != -1 {
|
||||
t.Fatalf("findClientIndex missing = %d, want -1", got)
|
||||
}
|
||||
if got := findClientIndex(nil, "x"); got != -1 {
|
||||
t.Fatalf("findClientIndex on nil slice = %d, want -1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsRoutableHost(t *testing.T) {
|
||||
routable := []string{"example.com", "sub.example.com", "10.0.0.1", "192.168.1.5", "1.2.3.4", "2001:db8::1"}
|
||||
for _, v := range routable {
|
||||
if !isRoutableHost(v) {
|
||||
t.Fatalf("isRoutableHost(%q) = false, want true", v)
|
||||
}
|
||||
}
|
||||
notRoutable := []string{"", "0.0.0.0", "::", "::0", "127.0.0.1", "127.0.0.2", "::1", "[::1]"}
|
||||
for _, v := range notRoutable {
|
||||
if isRoutableHost(v) {
|
||||
t.Fatalf("isRoutableHost(%q) = true, want false", v)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestListenIsInternalOnly(t *testing.T) {
|
||||
// Reachable only from the same host -> a fallback child here must be
|
||||
// projected through its master.
|
||||
internalOnly := []string{"127.0.0.1", "127.0.0.2", "::1", "[::1]", "@fallback", "/run/x.sock"}
|
||||
for _, v := range internalOnly {
|
||||
if !listenIsInternalOnly(v) {
|
||||
t.Fatalf("listenIsInternalOnly(%q) = false, want true", v)
|
||||
}
|
||||
}
|
||||
// Directly reachable on its own port -> never projected, even if a stale
|
||||
// fallback rule names it as a child (#4987).
|
||||
reachable := []string{"", "0.0.0.0", "::", "::0", "1.2.3.4", "10.0.0.5", "192.168.1.10", "vpn.example.com"}
|
||||
for _, v := range reachable {
|
||||
if listenIsInternalOnly(v) {
|
||||
t.Fatalf("listenIsInternalOnly(%q) = true, want false", v)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveInboundAddress(t *testing.T) {
|
||||
const reqHost = "sub.example.com"
|
||||
|
||||
// A routable bind Listen (a real IP or hostname the operator set as the
|
||||
// inbound's advertised endpoint) becomes the link's connect host.
|
||||
t.Run("routable listen is advertised as the link host", func(t *testing.T) {
|
||||
s := &SubService{address: reqHost}
|
||||
for _, listen := range []string{"1.2.3.4", "10.0.0.5", "192.168.1.10", "203.0.113.7", "vpn.example.com"} {
|
||||
ib := &model.Inbound{Listen: listen}
|
||||
if got := s.resolveInboundAddress(ib); got != listen {
|
||||
t.Fatalf("listen %q: address = %q, want %q (advertised listen)", listen, got, listen)
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
// A loopback/wildcard bind or a unix-domain-socket listen is a
|
||||
// server-side detail and must never leak into the link host.
|
||||
t.Run("non-routable listen falls back to subscriber host", func(t *testing.T) {
|
||||
s := &SubService{address: reqHost}
|
||||
for _, listen := range []string{"", "0.0.0.0", "::", "::0", "127.0.0.1", "::1", "@fallback", "/run/x.sock"} {
|
||||
ib := &model.Inbound{Listen: listen}
|
||||
if got := s.resolveInboundAddress(ib); got != reqHost {
|
||||
t.Fatalf("listen %q: address = %q, want %q (subscriber host, not bind detail)", listen, got, reqHost)
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("node-managed inbound uses the node address", func(t *testing.T) {
|
||||
id := 7
|
||||
s := &SubService{
|
||||
address: reqHost,
|
||||
nodesByID: map[int]*model.Node{7: {Id: 7, Address: "node7.example.com"}},
|
||||
}
|
||||
ib := &model.Inbound{NodeID: &id, Listen: "1.2.3.4"}
|
||||
if got := s.resolveInboundAddress(ib); got != "node7.example.com" {
|
||||
t.Fatalf("node-managed address = %q, want node7.example.com", got)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("node id with no known node falls back to subscriber host", func(t *testing.T) {
|
||||
id := 9
|
||||
s := &SubService{address: reqHost, nodesByID: map[int]*model.Node{}}
|
||||
ib := &model.Inbound{NodeID: &id, Listen: "0.0.0.0"}
|
||||
if got := s.resolveInboundAddress(ib); got != reqHost {
|
||||
t.Fatalf("unknown-node address = %q, want subscriber host %q", got, reqHost)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestUnmarshalStreamSettings(t *testing.T) {
|
||||
got := unmarshalStreamSettings(`{"network":"ws","wsSettings":{"path":"/api"}}`)
|
||||
if got["network"] != "ws" {
|
||||
t.Fatalf("network = %v, want ws", got["network"])
|
||||
}
|
||||
ws, ok := got["wsSettings"].(map[string]any)
|
||||
if !ok || ws["path"] != "/api" {
|
||||
t.Fatalf("wsSettings = %v, want map with path=/api", got["wsSettings"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnmarshalStreamSettings_InvalidJSON(t *testing.T) {
|
||||
if got := unmarshalStreamSettings("not json"); got != nil {
|
||||
t.Fatalf("invalid JSON should produce nil map, got %#v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_StringValue(t *testing.T) {
|
||||
headers := map[string]any{"Host": "example.com"}
|
||||
if got := searchHost(headers); got != "example.com" {
|
||||
t.Fatalf("searchHost = %q, want example.com", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_CaseInsensitiveKey(t *testing.T) {
|
||||
headers := map[string]any{"host": "example.com"}
|
||||
if got := searchHost(headers); got != "example.com" {
|
||||
t.Fatalf("searchHost = %q, want example.com", got)
|
||||
}
|
||||
headers2 := map[string]any{"HOST": "example.com"}
|
||||
if got := searchHost(headers2); got != "example.com" {
|
||||
t.Fatalf("searchHost uppercase = %q, want example.com", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_ArrayValue(t *testing.T) {
|
||||
headers := map[string]any{"Host": []any{"first.example.com", "second.example.com"}}
|
||||
if got := searchHost(headers); got != "first.example.com" {
|
||||
t.Fatalf("searchHost array = %q, want first.example.com", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_EmptyArray(t *testing.T) {
|
||||
headers := map[string]any{"Host": []any{}}
|
||||
if got := searchHost(headers); got != "" {
|
||||
t.Fatalf("searchHost empty array = %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_NoHostKey(t *testing.T) {
|
||||
headers := map[string]any{"X-Other": "value"}
|
||||
if got := searchHost(headers); got != "" {
|
||||
t.Fatalf("searchHost no host = %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchHost_NotAMap(t *testing.T) {
|
||||
if got := searchHost("not a map"); got != "" {
|
||||
t.Fatalf("searchHost non-map = %q, want empty", got)
|
||||
}
|
||||
if got := searchHost(nil); got != "" {
|
||||
t.Fatalf("searchHost nil = %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchKey_FoundAtTopLevel(t *testing.T) {
|
||||
data := map[string]any{"foo": 42, "bar": "x"}
|
||||
got, ok := searchKey(data, "foo")
|
||||
if !ok {
|
||||
t.Fatal("expected to find foo")
|
||||
}
|
||||
if got != 42 {
|
||||
t.Fatalf("got %v, want 42", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchKey_FoundInNested(t *testing.T) {
|
||||
data := map[string]any{
|
||||
"outer": map[string]any{
|
||||
"inner": map[string]any{
|
||||
"target": "hit",
|
||||
},
|
||||
},
|
||||
}
|
||||
got, ok := searchKey(data, "target")
|
||||
if !ok {
|
||||
t.Fatal("expected to find target in nested map")
|
||||
}
|
||||
if got != "hit" {
|
||||
t.Fatalf("got %v, want hit", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchKey_FoundInsideArray(t *testing.T) {
|
||||
data := map[string]any{
|
||||
"list": []any{
|
||||
map[string]any{"other": 1},
|
||||
map[string]any{"needle": "found"},
|
||||
},
|
||||
}
|
||||
got, ok := searchKey(data, "needle")
|
||||
if !ok {
|
||||
t.Fatal("expected to find needle in array element")
|
||||
}
|
||||
if got != "found" {
|
||||
t.Fatalf("got %v, want found", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchKey_NotFound(t *testing.T) {
|
||||
data := map[string]any{"foo": "bar"}
|
||||
if _, ok := searchKey(data, "missing"); ok {
|
||||
t.Fatal("expected ok=false for missing key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchKey_OnScalar(t *testing.T) {
|
||||
if _, ok := searchKey(42, "anything"); ok {
|
||||
t.Fatal("expected ok=false searching on a scalar")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildXhttpExtra_IncludesClientSideFieldsWhenPresent(t *testing.T) {
|
||||
extra := buildXhttpExtra(map[string]any{
|
||||
"path": "/xhttp",
|
||||
"host": "example.com",
|
||||
"mode": "packet-up",
|
||||
"xPaddingBytes": "100-1000",
|
||||
"uplinkHTTPMethod": "GET",
|
||||
"uplinkChunkSize": float64(4096),
|
||||
"noGRPCHeader": true,
|
||||
"scMinPostsIntervalMs": "20-40",
|
||||
"xmux": map[string]any{
|
||||
"maxConcurrency": "16-32",
|
||||
"hMaxRequestTimes": "600-900",
|
||||
"hMaxReusableSecs": "1800-3000",
|
||||
"hKeepAlivePeriod": float64(15),
|
||||
},
|
||||
"downloadSettings": map[string]any{
|
||||
"network": "xhttp",
|
||||
},
|
||||
"headers": map[string]any{
|
||||
"Host": "ignored.example.com",
|
||||
"X-Forwarded": "1",
|
||||
"X-Test-Empty": "",
|
||||
},
|
||||
})
|
||||
|
||||
if extra["path"] != nil || extra["host"] != nil {
|
||||
t.Fatalf("path/host should stay top-level, got extra %#v", extra)
|
||||
}
|
||||
for _, key := range []string{
|
||||
"xPaddingBytes",
|
||||
"uplinkHTTPMethod",
|
||||
"uplinkChunkSize",
|
||||
"noGRPCHeader",
|
||||
"scMinPostsIntervalMs",
|
||||
"xmux",
|
||||
"downloadSettings",
|
||||
} {
|
||||
if _, ok := extra[key]; !ok {
|
||||
t.Fatalf("extra missing %q: %#v", key, extra)
|
||||
}
|
||||
}
|
||||
if _, ok := extra["mode"]; ok {
|
||||
t.Fatalf("mode should stay as a top-level query parameter, got extra %#v", extra)
|
||||
}
|
||||
|
||||
headers, ok := extra["headers"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("headers = %#v, want map", extra["headers"])
|
||||
}
|
||||
if _, ok := headers["Host"]; ok {
|
||||
t.Fatalf("headers should not include Host: %#v", headers)
|
||||
}
|
||||
if headers["X-Forwarded"] != "1" {
|
||||
t.Fatalf("headers[X-Forwarded] = %#v, want 1", headers["X-Forwarded"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildXhttpExtra_LeavesDefaultClientSideFieldsOut(t *testing.T) {
|
||||
extra := buildXhttpExtra(map[string]any{
|
||||
"uplinkHTTPMethod": "",
|
||||
"uplinkChunkSize": float64(0),
|
||||
"noGRPCHeader": false,
|
||||
"xmux": map[string]any{},
|
||||
"downloadSettings": map[string]any{},
|
||||
})
|
||||
if extra != nil {
|
||||
t.Fatalf("default-only xhttp extra = %#v, want nil", extra)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCloneStringMap(t *testing.T) {
|
||||
src := map[string]string{"a": "1", "b": "2"}
|
||||
dst := cloneStringMap(src)
|
||||
if len(dst) != len(src) {
|
||||
t.Fatalf("clone length = %d, want %d", len(dst), len(src))
|
||||
}
|
||||
for k, v := range src {
|
||||
if dst[k] != v {
|
||||
t.Fatalf("clone[%q] = %q, want %q", k, dst[k], v)
|
||||
}
|
||||
}
|
||||
dst["a"] = "changed"
|
||||
if src["a"] == "changed" {
|
||||
t.Fatal("modifying clone leaked into source")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCloneStringMap_Empty(t *testing.T) {
|
||||
dst := cloneStringMap(map[string]string{})
|
||||
if dst == nil {
|
||||
t.Fatal("clone of empty map should not be nil")
|
||||
}
|
||||
if len(dst) != 0 {
|
||||
t.Fatalf("clone of empty map should be empty, got %v", dst)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetHostFromXFH_HostOnly(t *testing.T) {
|
||||
got, err := getHostFromXFH("example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if got != "example.com" {
|
||||
t.Fatalf("got %q, want example.com", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetHostFromXFH_HostWithPort(t *testing.T) {
|
||||
got, err := getHostFromXFH("example.com:8443")
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if got != "example.com" {
|
||||
t.Fatalf("got %q, want example.com", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetHostFromXFH_IPv6WithPort(t *testing.T) {
|
||||
got, err := getHostFromXFH("[2606:4700::1111]:443")
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if got != "2606:4700::1111" {
|
||||
t.Fatalf("got %q, want 2606:4700::1111", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetHostFromXFH_BadHostPort(t *testing.T) {
|
||||
if _, err := getHostFromXFH("example.com:8443:9999"); err == nil {
|
||||
t.Fatal("expected error for malformed host:port")
|
||||
}
|
||||
}
|
||||
|
||||
func TestReadPositiveInt(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
in any
|
||||
wantVal int
|
||||
wantOk bool
|
||||
}{
|
||||
{"int_positive", int(5), 5, true},
|
||||
{"int_zero", int(0), 0, false},
|
||||
{"int_negative", int(-3), -3, false},
|
||||
{"int32_positive", int32(7), 7, true},
|
||||
{"int64_positive", int64(99), 99, true},
|
||||
{"float64_positive", float64(12), 12, true},
|
||||
{"float64_zero", float64(0.0), 0, false},
|
||||
{"float64_negative", float64(-1.5), -1, false},
|
||||
{"float32_positive", float32(3), 3, true},
|
||||
{"string", "not a number", 0, false},
|
||||
{"nil", nil, 0, false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
gotVal, gotOk := readPositiveInt(c.in)
|
||||
if gotVal != c.wantVal || gotOk != c.wantOk {
|
||||
t.Fatalf("readPositiveInt(%v) = (%d, %v), want (%d, %v)", c.in, gotVal, gotOk, c.wantVal, c.wantOk)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSetStringParam(t *testing.T) {
|
||||
p := map[string]string{"existing": "value"}
|
||||
|
||||
setStringParam(p, "new", "hello")
|
||||
if p["new"] != "hello" {
|
||||
t.Fatalf("missing key after set: %v", p)
|
||||
}
|
||||
|
||||
setStringParam(p, "existing", "")
|
||||
if _, ok := p["existing"]; ok {
|
||||
t.Fatalf("empty value should delete the key, got %v", p)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSetIntParam(t *testing.T) {
|
||||
p := map[string]string{"existing": "10"}
|
||||
|
||||
setIntParam(p, "n", 42)
|
||||
if p["n"] != "42" {
|
||||
t.Fatalf("set positive int: got %v", p)
|
||||
}
|
||||
|
||||
setIntParam(p, "existing", 0)
|
||||
if _, ok := p["existing"]; ok {
|
||||
t.Fatalf("zero value should delete the key, got %v", p)
|
||||
}
|
||||
|
||||
p["other"] = "5"
|
||||
setIntParam(p, "other", -1)
|
||||
if _, ok := p["other"]; ok {
|
||||
t.Fatalf("negative value should delete the key, got %v", p)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSetStringField(t *testing.T) {
|
||||
f := map[string]any{"existing": "value"}
|
||||
|
||||
setStringField(f, "new", "hello")
|
||||
if f["new"] != "hello" {
|
||||
t.Fatalf("missing key after set: %v", f)
|
||||
}
|
||||
|
||||
setStringField(f, "existing", "")
|
||||
if _, ok := f["existing"]; ok {
|
||||
t.Fatalf("empty value should delete the key, got %v", f)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSetIntField(t *testing.T) {
|
||||
f := map[string]any{"existing": 10}
|
||||
|
||||
setIntField(f, "n", 7)
|
||||
if f["n"] != 7 {
|
||||
t.Fatalf("set positive int: got %v", f)
|
||||
}
|
||||
|
||||
setIntField(f, "existing", 0)
|
||||
if _, ok := f["existing"]; ok {
|
||||
t.Fatalf("zero value should delete the key, got %v", f)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildVmessLink(t *testing.T) {
|
||||
obj := map[string]any{
|
||||
"v": "2",
|
||||
"ps": "remark",
|
||||
"add": "example.com",
|
||||
"port": 443,
|
||||
"net": "tcp",
|
||||
}
|
||||
link := buildVmessLink(obj)
|
||||
if !strings.HasPrefix(link, "vmess://") {
|
||||
t.Fatalf("missing vmess:// prefix: %q", link)
|
||||
}
|
||||
payload := strings.TrimPrefix(link, "vmess://")
|
||||
decoded, err := base64.StdEncoding.DecodeString(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("base64 decode failed: %v", err)
|
||||
}
|
||||
var roundTrip map[string]any
|
||||
if err := json.Unmarshal(decoded, &roundTrip); err != nil {
|
||||
t.Fatalf("decoded payload is not JSON: %v\n%s", err, decoded)
|
||||
}
|
||||
if roundTrip["add"] != "example.com" {
|
||||
t.Fatalf("round-trip add = %v, want example.com", roundTrip["add"])
|
||||
}
|
||||
if roundTrip["ps"] != "remark" {
|
||||
t.Fatalf("round-trip ps = %v, want remark", roundTrip["ps"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestCloneVmessShareObj_CopiesEverythingByDefault(t *testing.T) {
|
||||
base := map[string]any{
|
||||
"v": "2",
|
||||
"sni": "example.com",
|
||||
"alpn": "h2",
|
||||
"fp": "chrome",
|
||||
"net": "tcp",
|
||||
}
|
||||
out := cloneVmessShareObj(base, "tls")
|
||||
for _, key := range []string{"sni", "alpn", "fp", "net", "v"} {
|
||||
if _, ok := out[key]; !ok {
|
||||
t.Fatalf("expected key %q to be preserved when security=tls, got %v", key, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCloneVmessShareObj_NoneStripsTLSOnlyKeys(t *testing.T) {
|
||||
base := map[string]any{
|
||||
"v": "2",
|
||||
"sni": "example.com",
|
||||
"alpn": "h2",
|
||||
"fp": "chrome",
|
||||
"net": "tcp",
|
||||
}
|
||||
out := cloneVmessShareObj(base, "none")
|
||||
for _, key := range []string{"sni", "alpn", "fp"} {
|
||||
if _, ok := out[key]; ok {
|
||||
t.Fatalf("security=none should strip %q, got %v", key, out)
|
||||
}
|
||||
}
|
||||
if out["v"] != "2" || out["net"] != "tcp" {
|
||||
t.Fatalf("non-TLS keys should remain, got %v", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSParams_UsesProxyDomainAndOverrides(t *testing.T) {
|
||||
params := map[string]string{
|
||||
"security": "tls",
|
||||
"sni": "origin.example.com",
|
||||
"fp": "firefox",
|
||||
"alpn": "h2",
|
||||
}
|
||||
ep := map[string]any{
|
||||
"dest": "proxy.example.com",
|
||||
"sni": "tls.example.com",
|
||||
"fingerprint": "chrome",
|
||||
"alpn": []any{"h3", "h2"},
|
||||
}
|
||||
|
||||
applyExternalProxyTLSParams(ep, params, "tls")
|
||||
|
||||
if params["sni"] != "tls.example.com" {
|
||||
t.Fatalf("sni = %q, want tls.example.com", params["sni"])
|
||||
}
|
||||
if params["fp"] != "chrome" {
|
||||
t.Fatalf("fp = %q, want chrome", params["fp"])
|
||||
}
|
||||
if params["alpn"] != "h3,h2" {
|
||||
t.Fatalf("alpn = %q, want h3,h2", params["alpn"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSParams_PreservesUpstreamSNI(t *testing.T) {
|
||||
// External-proxy entry has no SNI of its own; its dest must not
|
||||
// clobber the upstream tlsSettings.serverName already written into
|
||||
// params. Regression: the dest fallback used to overwrite "222" with
|
||||
// "111" whenever an operator set forceTls=same and left the proxy's
|
||||
// SNI field blank.
|
||||
params := map[string]string{"security": "tls", "sni": "real.example.com"}
|
||||
ep := map[string]any{"dest": "proxy.example.com"}
|
||||
|
||||
applyExternalProxyTLSParams(ep, params, "tls")
|
||||
|
||||
if params["sni"] != "real.example.com" {
|
||||
t.Fatalf("sni = %q, want upstream sni preserved (real.example.com)", params["sni"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSParams_ExplicitSNIOverridesUpstream(t *testing.T) {
|
||||
params := map[string]string{"security": "tls", "sni": "real.example.com"}
|
||||
ep := map[string]any{"dest": "proxy.example.com", "sni": "edge.example.com"}
|
||||
|
||||
applyExternalProxyTLSParams(ep, params, "tls")
|
||||
|
||||
if params["sni"] != "edge.example.com" {
|
||||
t.Fatalf("sni = %q, want edge.example.com", params["sni"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxy_ECHPropagates(t *testing.T) {
|
||||
const ech = "ech-config-base64"
|
||||
|
||||
t.Run("url params", func(t *testing.T) {
|
||||
params := map[string]string{"security": "tls"}
|
||||
ep := map[string]any{"dest": "proxy.example.com", "echConfigList": ech}
|
||||
applyExternalProxyTLSParams(ep, params, "tls")
|
||||
if params["ech"] != ech {
|
||||
t.Fatalf("ech param = %q, want %q", params["ech"], ech)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("vmess obj", func(t *testing.T) {
|
||||
obj := map[string]any{}
|
||||
ep := map[string]any{"dest": "proxy.example.com", "echConfigList": ech}
|
||||
applyExternalProxyTLSObj(ep, obj, "tls")
|
||||
if obj["ech"] != ech {
|
||||
t.Fatalf("ech obj = %v, want %q", obj["ech"], ech)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("json stream settings", func(t *testing.T) {
|
||||
stream := map[string]any{"security": "tls", "tlsSettings": map[string]any{}}
|
||||
ep := map[string]any{"dest": "proxy.example.com", "echConfigList": ech}
|
||||
applyExternalProxyTLSToStream(ep, stream, "tls")
|
||||
settings, _ := stream["tlsSettings"].(map[string]any)["settings"].(map[string]any)
|
||||
if settings["echConfigList"] != ech {
|
||||
t.Fatalf("echConfigList = %v, want %q", settings["echConfigList"], ech)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("non-tls security drops ech", func(t *testing.T) {
|
||||
params := map[string]string{}
|
||||
ep := map[string]any{"echConfigList": ech}
|
||||
applyExternalProxyTLSParams(ep, params, "none")
|
||||
if _, ok := params["ech"]; ok {
|
||||
t.Fatalf("ech must not be set when security != tls")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSToStream_DoesNotLeakAcrossProxies(t *testing.T) {
|
||||
stream := map[string]any{
|
||||
"security": "tls",
|
||||
"tlsSettings": map[string]any{
|
||||
"serverName": "upstream.example.com",
|
||||
},
|
||||
}
|
||||
proxies := []map[string]any{
|
||||
{"dest": "a.example.com", "sni": "a-sni.example.com", "fingerprint": "chrome", "alpn": []any{"h3"}},
|
||||
{"dest": "b.example.com"},
|
||||
}
|
||||
|
||||
results := make([]map[string]any, 0, len(proxies))
|
||||
for _, ep := range proxies {
|
||||
working := cloneStreamForExternalProxy(stream)
|
||||
applyExternalProxyTLSToStream(ep, working, "tls")
|
||||
ts := working["tlsSettings"].(map[string]any)
|
||||
snapshot := map[string]any{
|
||||
"serverName": ts["serverName"],
|
||||
"fingerprint": ts["fingerprint"],
|
||||
"alpn": ts["alpn"],
|
||||
}
|
||||
results = append(results, snapshot)
|
||||
}
|
||||
|
||||
if results[0]["serverName"] != "a-sni.example.com" || results[0]["fingerprint"] != "chrome" {
|
||||
t.Fatalf("proxy A snapshot = %v", results[0])
|
||||
}
|
||||
// Proxy B has no SNI of its own — the upstream tlsSettings serverName
|
||||
// must remain in place (no dest fallback) and no fingerprint/alpn
|
||||
// must leak from proxy A.
|
||||
if results[1]["serverName"] != "upstream.example.com" {
|
||||
t.Fatalf("proxy B serverName = %v, want upstream.example.com preserved", results[1]["serverName"])
|
||||
}
|
||||
if results[1]["fingerprint"] != nil {
|
||||
t.Fatalf("proxy B should inherit no fingerprint, got %v (leaked from A)", results[1]["fingerprint"])
|
||||
}
|
||||
if results[1]["alpn"] != nil {
|
||||
t.Fatalf("proxy B should inherit no alpn, got %v (leaked from A)", results[1]["alpn"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSParams_SetsPinnedPeerCert(t *testing.T) {
|
||||
params := map[string]string{"security": "tls"}
|
||||
ep := map[string]any{
|
||||
"dest": "proxy.example.com",
|
||||
"pinnedPeerCertSha256": []any{"aa11", "bb22"},
|
||||
}
|
||||
|
||||
applyExternalProxyTLSParams(ep, params, "tls")
|
||||
|
||||
if params["pcs"] != "aa11,bb22" {
|
||||
t.Fatalf("pcs = %q, want aa11,bb22", params["pcs"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSObj_SetsPinnedPeerCert(t *testing.T) {
|
||||
obj := map[string]any{"tls": "tls"}
|
||||
ep := map[string]any{
|
||||
"dest": "proxy.example.com",
|
||||
"pinnedPeerCertSha256": []any{"aa11"},
|
||||
}
|
||||
|
||||
applyExternalProxyTLSObj(ep, obj, "tls")
|
||||
|
||||
if obj["pcs"] != "aa11" {
|
||||
t.Fatalf("pcs = %v, want aa11", obj["pcs"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSToStream_SetsPinnedPeerCert(t *testing.T) {
|
||||
stream := map[string]any{
|
||||
"security": "tls",
|
||||
"tlsSettings": map[string]any{"serverName": "upstream.example.com"},
|
||||
}
|
||||
ep := map[string]any{"dest": "edge.example.com", "pinnedPeerCertSha256": []any{"aa11", "bb22"}}
|
||||
|
||||
working := cloneStreamForExternalProxy(stream)
|
||||
applyExternalProxyTLSToStream(ep, working, "tls")
|
||||
|
||||
ts := working["tlsSettings"].(map[string]any)
|
||||
settings, _ := ts["settings"].(map[string]any)
|
||||
pins, ok := settings["pinnedPeerCertSha256"].([]any)
|
||||
if !ok || len(pins) != 2 || pins[0] != "aa11" || pins[1] != "bb22" {
|
||||
t.Fatalf("pinnedPeerCertSha256 = %v, want [aa11 bb22]", settings["pinnedPeerCertSha256"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyHysteriaParams_PinIsHexNormalized(t *testing.T) {
|
||||
// base64 SHA-256 pin must come out as bare lowercase hex for Hysteria's
|
||||
// pinSHA256, which other (pcs) protocols leave untouched.
|
||||
params := map[string]string{"security": "tls", "sni": "server.example.com"}
|
||||
ep := map[string]any{
|
||||
"dest": "edge.example.com",
|
||||
"pinnedPeerCertSha256": []any{"yEfdI5XQl4wHgLggHEsomosoFZfUfCdfLXfT+W2N6cQ="},
|
||||
}
|
||||
|
||||
applyExternalProxyHysteriaParams(ep, params)
|
||||
|
||||
if params["pinSHA256"] != "c847dd2395d0978c0780b8201c4b289a8b281597d47c275f2d77d3f96d8de9c4" {
|
||||
t.Fatalf("pinSHA256 = %q, want hex-normalized pin", params["pinSHA256"])
|
||||
}
|
||||
if _, ok := params["pcs"]; ok {
|
||||
t.Fatalf("pcs must not be set for Hysteria, got %v", params)
|
||||
}
|
||||
if params["sni"] != "server.example.com" {
|
||||
t.Fatalf("sni = %q, want inbound sni preserved (no override for Hysteria)", params["sni"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyHysteriaParams_NoPinLeavesMainPin(t *testing.T) {
|
||||
params := map[string]string{"security": "tls", "pinSHA256": "deadbeef"}
|
||||
ep := map[string]any{"dest": "edge.example.com"}
|
||||
|
||||
applyExternalProxyHysteriaParams(ep, params)
|
||||
|
||||
if params["pinSHA256"] != "deadbeef" {
|
||||
t.Fatalf("pinSHA256 = %q, want main pin preserved when proxy has none", params["pinSHA256"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyExternalProxyTLSParams_DoesNotApplyForNone(t *testing.T) {
|
||||
params := map[string]string{
|
||||
"security": "none",
|
||||
"sni": "origin.example.com",
|
||||
}
|
||||
ep := map[string]any{
|
||||
"dest": "proxy.example.com",
|
||||
"fingerprint": "chrome",
|
||||
"alpn": []any{"h3"},
|
||||
}
|
||||
|
||||
applyExternalProxyTLSParams(ep, params, "none")
|
||||
|
||||
if params["sni"] != "origin.example.com" {
|
||||
t.Fatalf("sni should not change for security=none, got %q", params["sni"])
|
||||
}
|
||||
if _, ok := params["fp"]; ok {
|
||||
t.Fatalf("fp should not be set for security=none, got %v", params)
|
||||
}
|
||||
if _, ok := params["alpn"]; ok {
|
||||
t.Fatalf("alpn should not be set for security=none, got %v", params)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExtractKcpShareFields_Defaults(t *testing.T) {
|
||||
stream := map[string]any{}
|
||||
got := extractKcpShareFields(stream)
|
||||
if got.headerType != "none" {
|
||||
t.Fatalf("default headerType = %q, want none", got.headerType)
|
||||
}
|
||||
if got.seed != "" || got.mtu != 0 || got.tti != 0 {
|
||||
t.Fatalf("default kcpShareFields should be zero except headerType, got %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExtractKcpShareFields_ReadsAllFields(t *testing.T) {
|
||||
stream := map[string]any{
|
||||
"kcpSettings": map[string]any{
|
||||
"header": map[string]any{"type": "wechat-video"},
|
||||
"seed": "secret-seed",
|
||||
"mtu": float64(1350),
|
||||
"tti": float64(50),
|
||||
},
|
||||
}
|
||||
got := extractKcpShareFields(stream)
|
||||
if got.headerType != "wechat-video" {
|
||||
t.Fatalf("headerType = %q, want wechat-video", got.headerType)
|
||||
}
|
||||
if got.seed != "secret-seed" {
|
||||
t.Fatalf("seed = %q, want secret-seed", got.seed)
|
||||
}
|
||||
if got.mtu != 1350 {
|
||||
t.Fatalf("mtu = %d, want 1350", got.mtu)
|
||||
}
|
||||
if got.tti != 50 {
|
||||
t.Fatalf("tti = %d, want 50", got.tti)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExtractKcpShareFields_FinalMaskLegacyHeader(t *testing.T) {
|
||||
stream := map[string]any{
|
||||
"finalmask": map[string]any{
|
||||
"udp": []any{
|
||||
map[string]any{
|
||||
"type": "mkcp-legacy",
|
||||
"settings": map[string]any{"header": "wechat", "value": ""},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
got := extractKcpShareFields(stream)
|
||||
if got.headerType != "wechat-video" {
|
||||
t.Fatalf("headerType = %q, want wechat-video", got.headerType)
|
||||
}
|
||||
if got.seed != "" {
|
||||
t.Fatalf("seed = %q, want empty for header mask", got.seed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExtractKcpShareFields_FinalMaskLegacySeed(t *testing.T) {
|
||||
stream := map[string]any{
|
||||
"finalmask": map[string]any{
|
||||
"udp": []any{
|
||||
map[string]any{
|
||||
"type": "mkcp-legacy",
|
||||
"settings": map[string]any{"header": "", "value": "obfs-pass"},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
got := extractKcpShareFields(stream)
|
||||
if got.headerType != "none" {
|
||||
t.Fatalf("headerType = %q, want none for empty-header legacy mask", got.headerType)
|
||||
}
|
||||
if got.seed != "obfs-pass" {
|
||||
t.Fatalf("seed = %q, want obfs-pass", got.seed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestKcpShareFields_ApplyToParams(t *testing.T) {
|
||||
params := map[string]string{}
|
||||
kcpShareFields{headerType: "wechat-video", seed: "s", mtu: 1350, tti: 50}.applyToParams(params)
|
||||
if params["headerType"] != "wechat-video" {
|
||||
t.Fatalf("headerType param = %q", params["headerType"])
|
||||
}
|
||||
if params["seed"] != "s" {
|
||||
t.Fatalf("seed param = %q", params["seed"])
|
||||
}
|
||||
if params["mtu"] != "1350" {
|
||||
t.Fatalf("mtu param = %q", params["mtu"])
|
||||
}
|
||||
if params["tti"] != "50" {
|
||||
t.Fatalf("tti param = %q", params["tti"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestKcpShareFields_ApplyToParams_NoneHeaderNotAdded(t *testing.T) {
|
||||
params := map[string]string{}
|
||||
kcpShareFields{headerType: "none"}.applyToParams(params)
|
||||
if _, ok := params["headerType"]; ok {
|
||||
t.Fatalf("headerType=none should not be added, got %v", params)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMarshalFinalMask_EmptyReturnsFalse(t *testing.T) {
|
||||
if _, ok := marshalFinalMask(map[string]any{}); ok {
|
||||
t.Fatal("expected ok=false for empty finalmask")
|
||||
}
|
||||
if _, ok := marshalFinalMask(nil); ok {
|
||||
t.Fatal("expected ok=false for nil finalmask")
|
||||
}
|
||||
}
|
||||
|
||||
func TestMarshalFinalMask_WithContent(t *testing.T) {
|
||||
fm := map[string]any{
|
||||
"tcp": []any{
|
||||
map[string]any{"type": "fragment"},
|
||||
},
|
||||
}
|
||||
out, ok := marshalFinalMask(fm)
|
||||
if !ok {
|
||||
t.Fatal("expected ok=true for finalmask with valid tcp mask")
|
||||
}
|
||||
if !strings.Contains(out, `"tcp"`) {
|
||||
t.Fatalf("marshaled finalmask missing tcp key: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "fragment") {
|
||||
t.Fatalf("marshaled finalmask missing mask type: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMarshalFinalMask_UnknownTypeIsDropped(t *testing.T) {
|
||||
fm := map[string]any{
|
||||
"tcp": []any{
|
||||
map[string]any{"type": "not-a-real-mask"},
|
||||
},
|
||||
}
|
||||
if _, ok := marshalFinalMask(fm); ok {
|
||||
t.Fatal("unknown mask types should be dropped, leaving nothing to marshal")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHasFinalMaskContent(t *testing.T) {
|
||||
if hasFinalMaskContent(nil) {
|
||||
t.Fatal("nil should not count as content")
|
||||
}
|
||||
if hasFinalMaskContent(map[string]any{}) {
|
||||
t.Fatal("empty map should not count as content")
|
||||
}
|
||||
if !hasFinalMaskContent(map[string]any{"x": 1}) {
|
||||
t.Fatal("non-empty map should count as content")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHysteriaPinHex(t *testing.T) {
|
||||
const hexPin = "c847dd2395d0978c0780b8201c4b289a8b281597d47c275f2d77d3f96d8de9c4"
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
in string
|
||||
want string
|
||||
}{
|
||||
// Std base64 (xray-core's native TLS format / the panel generate button)
|
||||
// must be re-encoded to the hex form Hysteria2 clients expect (#4818).
|
||||
{"std base64", "yEfdI5XQl4wHgLggHEsomosoFZfUfCdfLXfT+W2N6cQ=", hexPin},
|
||||
// A manually pasted hex fingerprint passes through (lowercased).
|
||||
{"hex passthrough", hexPin, hexPin},
|
||||
{"uppercase hex lowercased", strings.ToUpper(hexPin), hexPin},
|
||||
// openssl x509 -fingerprint -sha256 emits colon-separated hex.
|
||||
{"colon hex stripped", "C8:47:DD:23:95:D0:97:8C:07:80:B8:20:1C:4B:28:9A:8B:28:15:97:D4:7C:27:5F:2D:77:D3:F9:6D:8D:E9:C4", hexPin},
|
||||
{"surrounding whitespace trimmed", " " + hexPin + " ", hexPin},
|
||||
// URL-safe base64 with the same 32 bytes decodes identically.
|
||||
{"url-safe base64", "yEfdI5XQl4wHgLggHEsomosoFZfUfCdfLXfT-W2N6cQ=", hexPin},
|
||||
// Garbage that is neither valid hex nor a 32-byte base64 is left as-is
|
||||
// rather than silently dropped.
|
||||
{"unrecognized passthrough", "not-a-pin", "not-a-pin"},
|
||||
{"empty", "", ""},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if got := hysteriaPinHex(tc.in); got != tc.want {
|
||||
t.Fatalf("hysteriaPinHex(%q) = %q, want %q", tc.in, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestHysteriaHopPorts(t *testing.T) {
|
||||
withHop := func(ports any) map[string]any {
|
||||
return map[string]any{
|
||||
"finalmask": map[string]any{
|
||||
"quicParams": map[string]any{
|
||||
"udpHop": map[string]any{"ports": ports, "interval": "5-10"},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
stream map[string]any
|
||||
want string
|
||||
}{
|
||||
{"range", withHop("20000-50000"), "20000-50000"},
|
||||
{"trimmed", withHop(" 443,20000-50000 "), "443,20000-50000"},
|
||||
{"empty string", withHop(""), ""},
|
||||
{"non-string", withHop(float64(443)), ""},
|
||||
{"no udpHop", map[string]any{"finalmask": map[string]any{"quicParams": map[string]any{}}}, ""},
|
||||
{"no finalmask", map[string]any{}, ""},
|
||||
{"nil stream", nil, ""},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if got := hysteriaHopPorts(tc.stream); got != tc.want {
|
||||
t.Fatalf("hysteriaHopPorts() = %q, want %q", got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
)
|
||||
|
||||
func TestAggregateTrafficByEmails_FallsBackToClientLimits(t *testing.T) {
|
||||
dbDir := t.TempDir()
|
||||
t.Setenv("XUI_DB_FOLDER", dbDir)
|
||||
if err := database.InitDB(filepath.Join(dbDir, "x-ui.db")); err != nil {
|
||||
t.Fatalf("InitDB: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = database.CloseDB() })
|
||||
|
||||
const email = "node-client@example.com"
|
||||
const totalBytes = int64(300) * 1024 * 1024 * 1024
|
||||
const expiry = int64(1893456000000)
|
||||
|
||||
db := database.GetDB()
|
||||
if err := db.Create(&model.ClientRecord{
|
||||
Email: email,
|
||||
TotalGB: totalBytes,
|
||||
ExpiryTime: expiry,
|
||||
Enable: true,
|
||||
}).Error; err != nil {
|
||||
t.Fatalf("seed client record: %v", err)
|
||||
}
|
||||
if err := db.Create(&xray.ClientTraffic{
|
||||
Email: email,
|
||||
Up: 111,
|
||||
Down: 222,
|
||||
Total: 0,
|
||||
ExpiryTime: 0,
|
||||
Enable: true,
|
||||
}).Error; err != nil {
|
||||
t.Fatalf("seed client traffic: %v", err)
|
||||
}
|
||||
|
||||
var s SubService
|
||||
agg, _ := s.AggregateTrafficByEmails([]string{email})
|
||||
|
||||
if agg.Up != 111 || agg.Down != 222 {
|
||||
t.Errorf("usage = up %d/down %d, want 111/222", agg.Up, agg.Down)
|
||||
}
|
||||
if agg.Total != totalBytes {
|
||||
t.Errorf("total = %d, want %d (fallback to clients table)", agg.Total, totalBytes)
|
||||
}
|
||||
if agg.ExpiryTime != expiry {
|
||||
t.Errorf("expiry = %d, want %d (fallback to clients table)", agg.ExpiryTime, expiry)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,334 @@
|
||||
// Package sub provides subscription server functionality for the 3x-ui panel,
|
||||
// including HTTP/HTTPS servers for serving subscription links and JSON configurations.
|
||||
package sub
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"io"
|
||||
"io/fs"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/locale"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/network"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// Server represents the subscription server that serves subscription links and JSON configurations.
|
||||
type Server struct {
|
||||
httpServer *http.Server
|
||||
listener net.Listener
|
||||
|
||||
sub *SUBController
|
||||
settingService service.SettingService
|
||||
|
||||
ctx context.Context
|
||||
cancel context.CancelFunc
|
||||
}
|
||||
|
||||
// NewServer creates a new subscription server instance with a cancellable context.
|
||||
func NewServer() *Server {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
return &Server{
|
||||
ctx: ctx,
|
||||
cancel: cancel,
|
||||
}
|
||||
}
|
||||
|
||||
// initRouter configures the subscription server's Gin engine, middleware,
|
||||
// templates and static assets and returns the ready-to-use engine.
|
||||
func (s *Server) initRouter() (*gin.Engine, error) {
|
||||
// Always run in release mode for the subscription server
|
||||
gin.DefaultWriter = io.Discard
|
||||
gin.DefaultErrorWriter = io.Discard
|
||||
gin.SetMode(gin.ReleaseMode)
|
||||
|
||||
engine := gin.Default()
|
||||
|
||||
subDomain, err := s.settingService.GetSubDomain()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if subDomain != "" {
|
||||
engine.Use(middleware.DomainValidatorMiddleware(subDomain))
|
||||
}
|
||||
|
||||
LinksPath, err := s.settingService.GetSubPath()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
JsonPath, err := s.settingService.GetSubJsonPath()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ClashPath, err := s.settingService.GetSubClashPath()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
subJsonEnable, err := s.settingService.GetSubJsonEnable()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
subClashEnable, err := s.settingService.GetSubClashEnable()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Set base_path based on LinksPath for template rendering
|
||||
// Ensure LinksPath ends with "/" for proper asset URL generation
|
||||
basePath := LinksPath
|
||||
if basePath != "/" && !strings.HasSuffix(basePath, "/") {
|
||||
basePath += "/"
|
||||
}
|
||||
// logger.Debug("sub: Setting base_path to:", basePath)
|
||||
engine.Use(func(c *gin.Context) {
|
||||
c.Set("base_path", basePath)
|
||||
})
|
||||
|
||||
Encrypt, err := s.settingService.GetSubEncrypt()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ShowInfo, err := s.settingService.GetSubShowInfo()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
RemarkModel, err := s.settingService.GetRemarkModel()
|
||||
if err != nil {
|
||||
RemarkModel = "-io"
|
||||
}
|
||||
|
||||
SubUpdates, err := s.settingService.GetSubUpdates()
|
||||
if err != nil {
|
||||
SubUpdates = "10"
|
||||
}
|
||||
|
||||
SubJsonMux, err := s.settingService.GetSubJsonMux()
|
||||
if err != nil {
|
||||
SubJsonMux = ""
|
||||
}
|
||||
|
||||
SubJsonRules, err := s.settingService.GetSubJsonRules()
|
||||
if err != nil {
|
||||
SubJsonRules = ""
|
||||
}
|
||||
|
||||
SubJsonFinalMask, err := s.settingService.GetSubJsonFinalMask()
|
||||
if err != nil {
|
||||
SubJsonFinalMask = ""
|
||||
}
|
||||
|
||||
SubClashEnableRouting, err := s.settingService.GetSubClashEnableRouting()
|
||||
if err != nil {
|
||||
SubClashEnableRouting = false
|
||||
}
|
||||
|
||||
SubClashRules, err := s.settingService.GetSubClashRules()
|
||||
if err != nil {
|
||||
SubClashRules = ""
|
||||
}
|
||||
|
||||
SubTitle, err := s.settingService.GetSubTitle()
|
||||
if err != nil {
|
||||
SubTitle = ""
|
||||
}
|
||||
|
||||
SubSupportUrl, err := s.settingService.GetSubSupportUrl()
|
||||
if err != nil {
|
||||
SubSupportUrl = ""
|
||||
}
|
||||
|
||||
SubProfileUrl, err := s.settingService.GetSubProfileUrl()
|
||||
if err != nil {
|
||||
SubProfileUrl = ""
|
||||
}
|
||||
|
||||
SubAnnounce, err := s.settingService.GetSubAnnounce()
|
||||
if err != nil {
|
||||
SubAnnounce = ""
|
||||
}
|
||||
|
||||
SubEnableRouting, err := s.settingService.GetSubEnableRouting()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
SubRoutingRules, err := s.settingService.GetSubRoutingRules()
|
||||
if err != nil {
|
||||
SubRoutingRules = ""
|
||||
}
|
||||
|
||||
// set per-request localizer from headers/cookies
|
||||
engine.Use(locale.LocalizerMiddleware())
|
||||
|
||||
// Mount the Vite-built dist/assets/ so the subscription page's JS/CSS
|
||||
// bundles load from `/assets/...`. Also mount the same FS under the
|
||||
// subscription path prefix (LinksPath + "assets") so reverse proxies
|
||||
// running the panel under a URI prefix can resolve those URLs too.
|
||||
// Note: LinksPath always starts and ends with "/" (validated in settings).
|
||||
var linksPathForAssets string
|
||||
if LinksPath == "/" {
|
||||
linksPathForAssets = "/assets"
|
||||
} else {
|
||||
linksPathForAssets = strings.TrimRight(LinksPath, "/") + "/assets"
|
||||
}
|
||||
|
||||
var assetsFS http.FileSystem
|
||||
if _, err := os.Stat("internal/web/dist/assets"); err == nil {
|
||||
assetsFS = http.FS(os.DirFS("internal/web/dist/assets"))
|
||||
} else if subFS, err := fs.Sub(distFS, "dist/assets"); err == nil {
|
||||
assetsFS = http.FS(subFS)
|
||||
} else {
|
||||
logger.Error("sub: failed to mount embedded dist assets:", err)
|
||||
}
|
||||
|
||||
if assetsFS != nil {
|
||||
engine.StaticFS("/assets", assetsFS)
|
||||
if linksPathForAssets != "/assets" {
|
||||
engine.StaticFS(linksPathForAssets, assetsFS)
|
||||
}
|
||||
|
||||
// Browser may resolve subpage assets relative to the request URL —
|
||||
// /sub/<basePath>/<subId>/assets/... — so route those to the same FS.
|
||||
if LinksPath != "/" {
|
||||
engine.Use(func(c *gin.Context) {
|
||||
path := c.Request.URL.Path
|
||||
pathPrefix := strings.TrimRight(LinksPath, "/") + "/"
|
||||
if strings.HasPrefix(path, pathPrefix) && strings.Contains(path, "/assets/") {
|
||||
_, after, ok := strings.Cut(path, "/assets/")
|
||||
if ok {
|
||||
assetPath := after // +8 to skip "/assets/"
|
||||
if assetPath != "" {
|
||||
c.FileFromFS(assetPath, assetsFS)
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
c.Next()
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
g := engine.Group("/")
|
||||
|
||||
s.sub = NewSUBController(
|
||||
g, LinksPath, JsonPath, ClashPath, subJsonEnable, subClashEnable, Encrypt, ShowInfo, RemarkModel, SubUpdates,
|
||||
SubJsonMux, SubJsonRules, SubJsonFinalMask, SubClashEnableRouting, SubClashRules, SubTitle, SubSupportUrl,
|
||||
SubProfileUrl, SubAnnounce, SubEnableRouting, SubRoutingRules)
|
||||
|
||||
return engine, nil
|
||||
}
|
||||
|
||||
// Start initializes and starts the subscription server with configured settings.
|
||||
func (s *Server) Start() (err error) {
|
||||
// This is an anonymous function, no function name
|
||||
defer func() {
|
||||
if err != nil {
|
||||
s.Stop()
|
||||
}
|
||||
}()
|
||||
|
||||
subEnable, err := s.settingService.GetSubEnable()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !subEnable {
|
||||
return nil
|
||||
}
|
||||
|
||||
engine, err := s.initRouter()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
certFile, err := s.settingService.GetSubCertFile()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
keyFile, err := s.settingService.GetSubKeyFile()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
listen, err := s.settingService.GetSubListen()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
port, err := s.settingService.GetSubPort()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
listenAddr := net.JoinHostPort(listen, strconv.Itoa(port))
|
||||
listener, err := net.Listen("tcp", listenAddr)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if certFile != "" || keyFile != "" {
|
||||
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
|
||||
if err == nil {
|
||||
c := &tls.Config{
|
||||
Certificates: []tls.Certificate{cert},
|
||||
}
|
||||
listener = network.NewAutoHttpsListener(listener)
|
||||
listener = tls.NewListener(listener, c)
|
||||
logger.Info("Sub server running HTTPS on", listener.Addr())
|
||||
} else {
|
||||
logger.Error("Error loading certificates:", err)
|
||||
logger.Info("Sub server running HTTP on", listener.Addr())
|
||||
}
|
||||
} else {
|
||||
logger.Info("Sub server running HTTP on", listener.Addr())
|
||||
}
|
||||
s.listener = listener
|
||||
|
||||
s.httpServer = &http.Server{
|
||||
Handler: engine,
|
||||
}
|
||||
|
||||
go func() {
|
||||
s.httpServer.Serve(listener)
|
||||
}()
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Stop gracefully shuts down the subscription server and closes the listener.
|
||||
func (s *Server) Stop() error {
|
||||
s.cancel()
|
||||
|
||||
var err1 error
|
||||
var err2 error
|
||||
if s.httpServer != nil {
|
||||
shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer shutdownCancel()
|
||||
err1 = s.httpServer.Shutdown(shutdownCtx)
|
||||
}
|
||||
if s.listener != nil {
|
||||
err2 = s.listener.Close()
|
||||
}
|
||||
return common.Combine(err1, err2)
|
||||
}
|
||||
|
||||
// GetCtx returns the server's context for cancellation and deadline management.
|
||||
func (s *Server) GetCtx() context.Context {
|
||||
return s.ctx
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
// Package common provides common utility functions for error handling, formatting, and multi-error management.
|
||||
package common
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
)
|
||||
|
||||
// NewErrorf creates a new error with formatted message.
|
||||
func NewErrorf(format string, a ...any) error {
|
||||
msg := fmt.Sprintf(format, a...)
|
||||
return errors.New(msg)
|
||||
}
|
||||
|
||||
// NewError creates a new error from the given arguments.
|
||||
func NewError(a ...any) error {
|
||||
msg := fmt.Sprintln(a...)
|
||||
return errors.New(msg)
|
||||
}
|
||||
|
||||
// Recover handles panic recovery and logs the panic error if a message is provided.
|
||||
func Recover(msg string) any {
|
||||
panicErr := recover()
|
||||
if panicErr != nil {
|
||||
if msg != "" {
|
||||
logger.Error(msg, "panic:", panicErr)
|
||||
}
|
||||
}
|
||||
return panicErr
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
)
|
||||
|
||||
// FormatTraffic formats traffic bytes into human-readable units (B, KB, MB, GB, TB, PB).
|
||||
func FormatTraffic(trafficBytes int64) string {
|
||||
units := []string{"B", "KB", "MB", "GB", "TB", "PB"}
|
||||
unitIndex := 0
|
||||
size := float64(trafficBytes)
|
||||
|
||||
for size >= 1024 && unitIndex < len(units)-1 {
|
||||
size /= 1024
|
||||
unitIndex++
|
||||
}
|
||||
return fmt.Sprintf("%.2f%s", size, units[unitIndex])
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
package common
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestFormatTraffic(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
bytes int64
|
||||
want string
|
||||
}{
|
||||
{"zero", 0, "0.00B"},
|
||||
{"under_one_kb", 512, "512.00B"},
|
||||
{"exactly_one_kb", 1024, "1.00KB"},
|
||||
{"one_and_a_half_kb", 1536, "1.50KB"},
|
||||
{"one_mb", 1024 * 1024, "1.00MB"},
|
||||
{"one_gb", 1024 * 1024 * 1024, "1.00GB"},
|
||||
{"one_tb", 1024 * 1024 * 1024 * 1024, "1.00TB"},
|
||||
{"one_pb", 1024 * 1024 * 1024 * 1024 * 1024, "1.00PB"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
got := FormatTraffic(c.bytes)
|
||||
if got != c.want {
|
||||
t.Fatalf("FormatTraffic(%d) = %q, want %q", c.bytes, got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"strings"
|
||||
)
|
||||
|
||||
// multiError represents a collection of errors.
|
||||
type multiError []error
|
||||
|
||||
// Error returns a string representation of all errors joined with " | ".
|
||||
func (e multiError) Error() string {
|
||||
var r strings.Builder
|
||||
r.WriteString("multierr: ")
|
||||
for _, err := range e {
|
||||
r.WriteString(err.Error())
|
||||
r.WriteString(" | ")
|
||||
}
|
||||
return r.String()
|
||||
}
|
||||
|
||||
// Combine combines multiple errors into a single error, filtering out nil errors.
|
||||
func Combine(maybeError ...error) error {
|
||||
var errs multiError
|
||||
for _, err := range maybeError {
|
||||
if err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
if len(errs) == 0 {
|
||||
return nil
|
||||
}
|
||||
return errs
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCombine_AllNilReturnsNil(t *testing.T) {
|
||||
if err := Combine(); err != nil {
|
||||
t.Fatalf("Combine() with no args = %v, want nil", err)
|
||||
}
|
||||
if err := Combine(nil, nil, nil); err != nil {
|
||||
t.Fatalf("Combine(nil, nil, nil) = %v, want nil", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCombine_SkipsNilErrors(t *testing.T) {
|
||||
e1 := errors.New("boom one")
|
||||
e2 := errors.New("boom two")
|
||||
|
||||
err := Combine(nil, e1, nil, e2, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected non-nil combined error")
|
||||
}
|
||||
msg := err.Error()
|
||||
if !strings.Contains(msg, "boom one") || !strings.Contains(msg, "boom two") {
|
||||
t.Fatalf("combined error %q does not contain both underlying messages", msg)
|
||||
}
|
||||
if !strings.HasPrefix(msg, "multierr: ") {
|
||||
t.Fatalf("combined error %q missing %q prefix", msg, "multierr: ")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCombine_SingleErrorStillWrapped(t *testing.T) {
|
||||
e := errors.New("only one")
|
||||
err := Combine(e)
|
||||
if err == nil {
|
||||
t.Fatal("expected non-nil error")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "only one") {
|
||||
t.Fatalf("combined error %q missing underlying message", err.Error())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
// Package crypto provides cryptographic utilities for password hashing and verification.
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// HashPasswordAsBcrypt generates a bcrypt hash of the given password.
|
||||
func HashPasswordAsBcrypt(password string) (string, error) {
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||
return string(hash), err
|
||||
}
|
||||
|
||||
// CheckPasswordHash verifies if the given password matches the bcrypt hash.
|
||||
func CheckPasswordHash(hash, password string) bool {
|
||||
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
|
||||
}
|
||||
|
||||
func IsHashed(s string) bool {
|
||||
_, err := bcrypt.Cost([]byte(s))
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// HashTokenSHA256 returns the hex-encoded SHA-256 digest of token. API tokens
|
||||
// are high-entropy random strings, so a fast unsalted digest is sufficient to
|
||||
// keep them irrecoverable at rest while allowing constant-time verification.
|
||||
func HashTokenSHA256(token string) string {
|
||||
sum := sha256.Sum256([]byte(token))
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
// IsSHA256Hex reports whether s looks like a hex-encoded SHA-256 digest
|
||||
// (64 lowercase hex characters), used to skip already-hashed token rows.
|
||||
func IsSHA256Hex(s string) bool {
|
||||
if len(s) != 64 {
|
||||
return false
|
||||
}
|
||||
for _, c := range s {
|
||||
if (c < '0' || c > '9') && (c < 'a' || c > 'f') {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestHashPasswordAsBcrypt_RoundTrip(t *testing.T) {
|
||||
password := "correct horse battery staple"
|
||||
|
||||
hash, err := HashPasswordAsBcrypt(password)
|
||||
if err != nil {
|
||||
t.Fatalf("HashPasswordAsBcrypt returned error: %v", err)
|
||||
}
|
||||
if hash == "" {
|
||||
t.Fatal("expected non-empty hash")
|
||||
}
|
||||
if hash == password {
|
||||
t.Fatal("hash must not equal the plaintext password")
|
||||
}
|
||||
if !strings.HasPrefix(hash, "$2") {
|
||||
t.Fatalf("expected bcrypt prefix $2..., got %q", hash[:min(4, len(hash))])
|
||||
}
|
||||
|
||||
if !CheckPasswordHash(hash, password) {
|
||||
t.Fatal("CheckPasswordHash returned false for the matching password")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckPasswordHash_WrongPassword(t *testing.T) {
|
||||
hash, err := HashPasswordAsBcrypt("right-password")
|
||||
if err != nil {
|
||||
t.Fatalf("HashPasswordAsBcrypt returned error: %v", err)
|
||||
}
|
||||
|
||||
if CheckPasswordHash(hash, "wrong-password") {
|
||||
t.Fatal("CheckPasswordHash returned true for a wrong password")
|
||||
}
|
||||
if CheckPasswordHash(hash, "") {
|
||||
t.Fatal("CheckPasswordHash returned true for an empty password")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckPasswordHash_InvalidHash(t *testing.T) {
|
||||
if CheckPasswordHash("", "anything") {
|
||||
t.Fatal("empty hash must not validate")
|
||||
}
|
||||
if CheckPasswordHash("not-a-bcrypt-hash", "anything") {
|
||||
t.Fatal("malformed hash must not validate")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHashPasswordAsBcrypt_DifferentHashesForSamePassword(t *testing.T) {
|
||||
password := "same-password"
|
||||
h1, err := HashPasswordAsBcrypt(password)
|
||||
if err != nil {
|
||||
t.Fatalf("first hash failed: %v", err)
|
||||
}
|
||||
h2, err := HashPasswordAsBcrypt(password)
|
||||
if err != nil {
|
||||
t.Fatalf("second hash failed: %v", err)
|
||||
}
|
||||
if h1 == h2 {
|
||||
t.Fatal("expected bcrypt to produce different hashes (random salt) for the same password")
|
||||
}
|
||||
if !CheckPasswordHash(h1, password) || !CheckPasswordHash(h2, password) {
|
||||
t.Fatal("both hashes should still validate the original password")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
// Package json_util provides JSON utilities including a custom RawMessage type.
|
||||
package json_util
|
||||
|
||||
import (
|
||||
"errors"
|
||||
)
|
||||
|
||||
// RawMessage is a custom JSON raw message type that marshals empty slices as "null".
|
||||
type RawMessage []byte
|
||||
|
||||
// MarshalJSON customizes the JSON marshaling behavior for RawMessage.
|
||||
// Empty RawMessage values are marshaled as "null" instead of "[]".
|
||||
func (m RawMessage) MarshalJSON() ([]byte, error) {
|
||||
if len(m) == 0 {
|
||||
return []byte("null"), nil
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// UnmarshalJSON sets *m to a copy of the JSON data.
|
||||
func (m *RawMessage) UnmarshalJSON(data []byte) error {
|
||||
if m == nil {
|
||||
return errors.New("json.RawMessage: UnmarshalJSON on nil pointer")
|
||||
}
|
||||
*m = append((*m)[0:0], data...)
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
package json_util
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestRawMessage_MarshalEmptyIsNull(t *testing.T) {
|
||||
var m RawMessage
|
||||
out, err := m.MarshalJSON()
|
||||
if err != nil {
|
||||
t.Fatalf("MarshalJSON on empty returned error: %v", err)
|
||||
}
|
||||
if !bytes.Equal(out, []byte("null")) {
|
||||
t.Fatalf("empty RawMessage marshaled to %q, want %q", out, "null")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRawMessage_MarshalPassthrough(t *testing.T) {
|
||||
payload := []byte(`{"a":1}`)
|
||||
m := RawMessage(payload)
|
||||
out, err := m.MarshalJSON()
|
||||
if err != nil {
|
||||
t.Fatalf("MarshalJSON returned error: %v", err)
|
||||
}
|
||||
if !bytes.Equal(out, payload) {
|
||||
t.Fatalf("MarshalJSON = %q, want %q", out, payload)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRawMessage_UnmarshalCopiesData(t *testing.T) {
|
||||
var m RawMessage
|
||||
src := []byte(`{"k":"v"}`)
|
||||
if err := m.UnmarshalJSON(src); err != nil {
|
||||
t.Fatalf("UnmarshalJSON returned error: %v", err)
|
||||
}
|
||||
if !bytes.Equal(m, src) {
|
||||
t.Fatalf("UnmarshalJSON stored %q, want %q", []byte(m), src)
|
||||
}
|
||||
|
||||
src[0] = 'X'
|
||||
if m[0] == 'X' {
|
||||
t.Fatal("UnmarshalJSON kept a reference to the caller's buffer; expected a copy")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRawMessage_UnmarshalNilReceiverErrors(t *testing.T) {
|
||||
var m *RawMessage
|
||||
if err := m.UnmarshalJSON([]byte("123")); err == nil {
|
||||
t.Fatal("expected error for nil receiver")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRawMessage_RoundTripInsideStruct(t *testing.T) {
|
||||
type wrapper struct {
|
||||
Body RawMessage `json:"body"`
|
||||
}
|
||||
in := wrapper{Body: RawMessage(`{"x":42}`)}
|
||||
encoded, err := json.Marshal(in)
|
||||
if err != nil {
|
||||
t.Fatalf("json.Marshal returned error: %v", err)
|
||||
}
|
||||
want := `{"body":{"x":42}}`
|
||||
if string(encoded) != want {
|
||||
t.Fatalf("Marshal = %s, want %s", encoded, want)
|
||||
}
|
||||
|
||||
var out wrapper
|
||||
if err := json.Unmarshal(encoded, &out); err != nil {
|
||||
t.Fatalf("json.Unmarshal returned error: %v", err)
|
||||
}
|
||||
if string(out.Body) != `{"x":42}` {
|
||||
t.Fatalf("round-trip Body = %s, want %s", out.Body, `{"x":42}`)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
package ldaputil
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"fmt"
|
||||
"slices"
|
||||
|
||||
"github.com/go-ldap/ldap/v3"
|
||||
)
|
||||
|
||||
type Config struct {
|
||||
Host string
|
||||
Port int
|
||||
UseTLS bool
|
||||
BindDN string
|
||||
Password string
|
||||
BaseDN string
|
||||
UserFilter string
|
||||
UserAttr string
|
||||
FlagField string
|
||||
TruthyVals []string
|
||||
Invert bool
|
||||
}
|
||||
|
||||
// FetchVlessFlags returns map[email]enabled
|
||||
func FetchVlessFlags(cfg Config) (map[string]bool, error) {
|
||||
addr := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
|
||||
|
||||
scheme := "ldap"
|
||||
if cfg.UseTLS {
|
||||
scheme = "ldaps"
|
||||
}
|
||||
|
||||
ldapURL := fmt.Sprintf("%s://%s", scheme, addr)
|
||||
|
||||
var opts []ldap.DialOpt
|
||||
if cfg.UseTLS {
|
||||
opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{
|
||||
InsecureSkipVerify: false,
|
||||
}))
|
||||
}
|
||||
|
||||
conn, err := ldap.DialURL(ldapURL, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
if cfg.BindDN != "" {
|
||||
if err := conn.Bind(cfg.BindDN, cfg.Password); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
if cfg.UserFilter == "" {
|
||||
cfg.UserFilter = "(objectClass=person)"
|
||||
}
|
||||
if cfg.UserAttr == "" {
|
||||
cfg.UserAttr = "mail"
|
||||
}
|
||||
// if field not set we fallback to legacy vless_enabled
|
||||
if cfg.FlagField == "" {
|
||||
cfg.FlagField = "vless_enabled"
|
||||
}
|
||||
|
||||
req := ldap.NewSearchRequest(
|
||||
cfg.BaseDN,
|
||||
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
|
||||
cfg.UserFilter,
|
||||
[]string{cfg.UserAttr, cfg.FlagField},
|
||||
nil,
|
||||
)
|
||||
|
||||
res, err := conn.Search(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result := make(map[string]bool, len(res.Entries))
|
||||
for _, e := range res.Entries {
|
||||
user := e.GetAttributeValue(cfg.UserAttr)
|
||||
if user == "" {
|
||||
continue
|
||||
}
|
||||
val := e.GetAttributeValue(cfg.FlagField)
|
||||
enabled := slices.Contains(cfg.TruthyVals, val)
|
||||
if cfg.Invert {
|
||||
enabled = !enabled
|
||||
}
|
||||
result[user] = enabled
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
// AuthenticateUser searches user by cfg.UserAttr and attempts to bind with provided password.
|
||||
func AuthenticateUser(cfg Config, username, password string) (bool, error) {
|
||||
addr := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
|
||||
|
||||
scheme := "ldap"
|
||||
if cfg.UseTLS {
|
||||
scheme = "ldaps"
|
||||
}
|
||||
|
||||
ldapURL := fmt.Sprintf("%s://%s", scheme, addr)
|
||||
|
||||
var opts []ldap.DialOpt
|
||||
if cfg.UseTLS {
|
||||
opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{
|
||||
InsecureSkipVerify: false,
|
||||
}))
|
||||
}
|
||||
|
||||
conn, err := ldap.DialURL(ldapURL, opts...)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
// Optional initial bind for search
|
||||
if cfg.BindDN != "" {
|
||||
if err := conn.Bind(cfg.BindDN, cfg.Password); err != nil {
|
||||
return false, err
|
||||
}
|
||||
}
|
||||
|
||||
if cfg.UserFilter == "" {
|
||||
cfg.UserFilter = "(objectClass=person)"
|
||||
}
|
||||
if cfg.UserAttr == "" {
|
||||
cfg.UserAttr = "uid"
|
||||
}
|
||||
|
||||
// Build filter to find specific user
|
||||
filter := fmt.Sprintf("(&%s(%s=%s))", cfg.UserFilter, cfg.UserAttr, ldap.EscapeFilter(username))
|
||||
req := ldap.NewSearchRequest(
|
||||
cfg.BaseDN,
|
||||
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 1, 0, false,
|
||||
filter,
|
||||
[]string{"dn"},
|
||||
nil,
|
||||
)
|
||||
res, err := conn.Search(req)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
if len(res.Entries) == 0 {
|
||||
return false, nil
|
||||
}
|
||||
userDN := res.Entries[0].DN
|
||||
// Try to bind as the user
|
||||
if err := conn.Bind(userDN, password); err != nil {
|
||||
return false, nil
|
||||
}
|
||||
return true, nil
|
||||
}
|
||||
@@ -0,0 +1,811 @@
|
||||
// Package link provides parsers for VPN share links (vmess://, vless://, etc.)
|
||||
// and subscription bodies (typically base64-encoded newline lists of such links).
|
||||
// The output shape matches the wire format used by the panel's Xray template
|
||||
// outbounds array so that parsed objects can be injected directly.
|
||||
package link
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Outbound is the minimal shape we emit for each parsed link.
|
||||
// Extra fields (mux, etc.) are carried inside settings/streamSettings.
|
||||
type Outbound map[string]any
|
||||
|
||||
// ParseResult holds a parsed outbound together with a stable identity string
|
||||
// that can be used to correlate the same logical server across refreshes
|
||||
// (even if the remark changes).
|
||||
type ParseResult struct {
|
||||
Outbound Outbound
|
||||
Identity string
|
||||
}
|
||||
|
||||
// ParseSubscriptionBody accepts the raw body returned by a subscription URL.
|
||||
// It handles the common case where the body is a base64-encoded blob of
|
||||
// newline-separated links, and also tolerates an already-decoded text body.
|
||||
// It returns the list of successfully parsed outbounds (in order) and their
|
||||
// corresponding identities.
|
||||
func ParseSubscriptionBody(body []byte) ([]Outbound, []string, error) {
|
||||
text := strings.TrimSpace(string(body))
|
||||
if text == "" {
|
||||
return nil, nil, nil
|
||||
}
|
||||
|
||||
// Try base64 decode first (standard and URL-safe variants).
|
||||
if decoded, ok := tryBase64(text); ok {
|
||||
text = strings.TrimSpace(decoded)
|
||||
}
|
||||
|
||||
lines := splitLines(text)
|
||||
var outbounds []Outbound
|
||||
var identities []string
|
||||
|
||||
for _, ln := range lines {
|
||||
ln = strings.TrimSpace(ln)
|
||||
if ln == "" || strings.HasPrefix(ln, "#") {
|
||||
continue
|
||||
}
|
||||
res, err := ParseLink(ln)
|
||||
if err != nil || res == nil {
|
||||
// Ignore unparseable lines (comments, unsupported protocols, etc.)
|
||||
continue
|
||||
}
|
||||
outbounds = append(outbounds, res.Outbound)
|
||||
identities = append(identities, res.Identity)
|
||||
}
|
||||
return outbounds, identities, nil
|
||||
}
|
||||
|
||||
func tryBase64(s string) (string, bool) {
|
||||
// Remove whitespace that some providers insert.
|
||||
clean := strings.Map(func(r rune) rune {
|
||||
if r == ' ' || r == '\n' || r == '\r' || r == '\t' {
|
||||
return -1
|
||||
}
|
||||
return r
|
||||
}, s)
|
||||
|
||||
// Common padding fix
|
||||
for len(clean)%4 != 0 {
|
||||
clean += "="
|
||||
}
|
||||
|
||||
// Standard
|
||||
if b, err := base64.StdEncoding.DecodeString(clean); err == nil {
|
||||
return string(b), true
|
||||
}
|
||||
// URL-safe (no padding)
|
||||
if b, err := base64.RawURLEncoding.DecodeString(clean); err == nil {
|
||||
return string(b), true
|
||||
}
|
||||
// URL-safe with padding
|
||||
if b, err := base64.URLEncoding.DecodeString(clean); err == nil {
|
||||
return string(b), true
|
||||
}
|
||||
return "", false
|
||||
}
|
||||
|
||||
func splitLines(s string) []string {
|
||||
// Accept \n, \r\n, and also some providers use literal \n in the text.
|
||||
s = strings.ReplaceAll(s, `\n`, "\n")
|
||||
return strings.FieldsFunc(s, func(r rune) bool { return r == '\n' || r == '\r' })
|
||||
}
|
||||
|
||||
// ParseLink parses a single share link and returns the outbound object plus
|
||||
// a stable identity for tag correlation. Supported schemes:
|
||||
// - vmess://
|
||||
// - vless://
|
||||
// - trojan://
|
||||
// - ss:// (modern and legacy)
|
||||
// - hysteria2:// (also hy2://)
|
||||
// - wireguard:// (also wg://)
|
||||
func ParseLink(link string) (*ParseResult, error) {
|
||||
link = strings.TrimSpace(link)
|
||||
switch {
|
||||
case strings.HasPrefix(link, "vmess://"):
|
||||
return parseVmess(link)
|
||||
case strings.HasPrefix(link, "vless://"):
|
||||
return parseVless(link)
|
||||
case strings.HasPrefix(link, "trojan://"):
|
||||
return parseTrojan(link)
|
||||
case strings.HasPrefix(link, "ss://"):
|
||||
return parseShadowsocks(link)
|
||||
case strings.HasPrefix(link, "hysteria2://"), strings.HasPrefix(link, "hy2://"):
|
||||
return parseHysteria2(link)
|
||||
case strings.HasPrefix(link, "wireguard://"), strings.HasPrefix(link, "wg://"):
|
||||
return parseWireguard(link)
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported link scheme")
|
||||
}
|
||||
}
|
||||
|
||||
// --- vmess ---
|
||||
|
||||
func parseVmess(link string) (*ParseResult, error) {
|
||||
b64 := strings.TrimPrefix(link, "vmess://")
|
||||
// vmess:// base64(json)
|
||||
raw, err := base64.StdEncoding.DecodeString(padBase64(b64))
|
||||
if err != nil {
|
||||
// Some providers use raw URL-safe
|
||||
raw, err = base64.RawURLEncoding.DecodeString(b64)
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("vmess decode: %w", err)
|
||||
}
|
||||
var j map[string]any
|
||||
if err := json.Unmarshal(raw, &j); err != nil {
|
||||
return nil, fmt.Errorf("vmess json: %w", err)
|
||||
}
|
||||
|
||||
identity := vmessIdentity(j)
|
||||
|
||||
network := getString(j, "net", "tcp")
|
||||
security := "none"
|
||||
if tls, _ := j["tls"].(string); tls == "tls" {
|
||||
security = "tls"
|
||||
}
|
||||
stream := buildStream(network, security)
|
||||
|
||||
// Map known fields (best effort, matching frontend parser coverage)
|
||||
switch network {
|
||||
case "ws":
|
||||
if host, ok := j["host"].(string); ok {
|
||||
setWS(stream, host, getString(j, "path", "/"))
|
||||
}
|
||||
case "grpc":
|
||||
svc := getString(j, "path", "")
|
||||
if auth, ok := j["authority"].(string); ok && auth != "" {
|
||||
(stream["grpcSettings"].(map[string]any))["authority"] = auth
|
||||
}
|
||||
(stream["grpcSettings"].(map[string]any))["serviceName"] = svc
|
||||
(stream["grpcSettings"].(map[string]any))["multiMode"] = getString(j, "type", "") == "multi"
|
||||
case "httpupgrade":
|
||||
setHTTPUpgrade(stream, getString(j, "host", ""), getString(j, "path", "/"))
|
||||
case "xhttp":
|
||||
xh := stream["xhttpSettings"].(map[string]any)
|
||||
xh["host"] = getString(j, "host", "")
|
||||
xh["path"] = getString(j, "path", "/")
|
||||
if m := getString(j, "mode", ""); m != "" {
|
||||
xh["mode"] = m
|
||||
}
|
||||
// xhttp advanced keys are passed through if present in the json
|
||||
for _, k := range []string{"xPaddingBytes", "scMaxEachPostBytes", "scMinPostsIntervalMs"} {
|
||||
if v, ok := j[k]; ok {
|
||||
xh[k] = v
|
||||
}
|
||||
}
|
||||
case "tcp":
|
||||
if getString(j, "type", "") == "http" {
|
||||
stream["tcpSettings"] = map[string]any{
|
||||
"header": map[string]any{
|
||||
"type": "http",
|
||||
"request": map[string]any{
|
||||
"version": "1.1",
|
||||
"method": "GET",
|
||||
"path": splitComma(getString(j, "path", "/")),
|
||||
"headers": map[string]any{"Host": splitComma(getString(j, "host", ""))},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if security == "tls" {
|
||||
tls := stream["tlsSettings"].(map[string]any)
|
||||
tls["serverName"] = getString(j, "sni", "")
|
||||
tls["fingerprint"] = getString(j, "fp", "")
|
||||
if alpn := getString(j, "alpn", ""); alpn != "" {
|
||||
tls["alpn"] = splitComma(alpn)
|
||||
}
|
||||
}
|
||||
|
||||
port := num(j["port"])
|
||||
ob := Outbound{
|
||||
"protocol": "vmess",
|
||||
"tag": getString(j, "ps", ""),
|
||||
"settings": map[string]any{
|
||||
"vnext": []any{
|
||||
map[string]any{
|
||||
"address": getString(j, "add", ""),
|
||||
"port": port,
|
||||
"users": []any{
|
||||
map[string]any{
|
||||
"id": getString(j, "id", ""),
|
||||
"security": getString(j, "scy", "auto"),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
"streamSettings": stream,
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
func vmessIdentity(j map[string]any) string {
|
||||
// Remove ps (remark) for identity
|
||||
core := map[string]any{}
|
||||
for k, v := range j {
|
||||
if k == "ps" {
|
||||
continue
|
||||
}
|
||||
core[k] = v
|
||||
}
|
||||
b, _ := json.Marshal(core)
|
||||
return "vmess:" + string(b)
|
||||
}
|
||||
|
||||
// --- vless / trojan (URL forms) ---
|
||||
|
||||
func parseVless(link string) (*ParseResult, error) {
|
||||
u, err := url.Parse(link)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if u.Scheme != "vless" {
|
||||
return nil, fmt.Errorf("not vless")
|
||||
}
|
||||
id := u.User.Username()
|
||||
host := u.Hostname()
|
||||
port := defaultPort(u.Port(), 443)
|
||||
params := u.Query()
|
||||
network := params.Get("type")
|
||||
if network == "" {
|
||||
network = "tcp"
|
||||
}
|
||||
security := params.Get("security")
|
||||
if security == "" {
|
||||
security = "none"
|
||||
}
|
||||
stream := buildStream(network, security)
|
||||
applyTransport(stream, params)
|
||||
applySecurity(stream, params)
|
||||
applyFinalMask(stream, params)
|
||||
|
||||
identity := "vless:" + u.Scheme + "://" + id + "@" + host + ":" + strconv.Itoa(port) + "?" + canonicalQuery(params)
|
||||
|
||||
ob := Outbound{
|
||||
"protocol": "vless",
|
||||
"tag": decodeHash(u.Fragment),
|
||||
"settings": map[string]any{
|
||||
"address": host,
|
||||
"port": port,
|
||||
"id": id,
|
||||
"flow": params.Get("flow"),
|
||||
"encryption": firstNonEmpty(params.Get("encryption"), "none"),
|
||||
},
|
||||
"streamSettings": stream,
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
func parseTrojan(link string) (*ParseResult, error) {
|
||||
u, err := url.Parse(link)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if u.Scheme != "trojan" {
|
||||
return nil, fmt.Errorf("not trojan")
|
||||
}
|
||||
pw := u.User.Username()
|
||||
host := u.Hostname()
|
||||
port := defaultPort(u.Port(), 443)
|
||||
params := u.Query()
|
||||
network := params.Get("type")
|
||||
if network == "" {
|
||||
network = "tcp"
|
||||
}
|
||||
security := params.Get("security")
|
||||
if security == "" {
|
||||
security = "tls"
|
||||
}
|
||||
stream := buildStream(network, security)
|
||||
applyTransport(stream, params)
|
||||
applySecurity(stream, params)
|
||||
applyFinalMask(stream, params)
|
||||
|
||||
identity := "trojan:" + u.Scheme + "://" + pw + "@" + host + ":" + strconv.Itoa(port) + "?" + canonicalQuery(params)
|
||||
|
||||
ob := Outbound{
|
||||
"protocol": "trojan",
|
||||
"tag": decodeHash(u.Fragment),
|
||||
"settings": map[string]any{
|
||||
"servers": []any{
|
||||
map[string]any{"address": host, "port": port, "password": pw},
|
||||
},
|
||||
},
|
||||
"streamSettings": stream,
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
// --- shadowsocks ---
|
||||
|
||||
func parseShadowsocks(link string) (*ParseResult, error) {
|
||||
// Two shapes:
|
||||
// ss://base64(method:pass)@host:port#remark
|
||||
// ss://base64(method:pass@host:port)#remark
|
||||
remark := ""
|
||||
if i := strings.Index(link, "#"); i >= 0 {
|
||||
remark, _ = url.QueryUnescape(link[i+1:])
|
||||
link = link[:i]
|
||||
}
|
||||
core := strings.TrimPrefix(link, "ss://")
|
||||
at := strings.Index(core, "@")
|
||||
if at >= 0 {
|
||||
// modern
|
||||
userB64 := core[:at]
|
||||
hp := core[at+1:]
|
||||
userInfo, err := base64DecodeFlexible(userB64)
|
||||
if err != nil {
|
||||
userInfo = userB64 // not b64, rare
|
||||
}
|
||||
colon := strings.LastIndex(hp, ":")
|
||||
if colon < 0 {
|
||||
return nil, fmt.Errorf("bad ss host:port")
|
||||
}
|
||||
host := hp[:colon]
|
||||
port, _ := strconv.Atoi(hp[colon+1:])
|
||||
method, pass := splitMethodPass(userInfo)
|
||||
identity := "ss:" + method + ":" + pass + "@" + host + ":" + strconv.Itoa(port)
|
||||
ob := Outbound{
|
||||
"protocol": "shadowsocks",
|
||||
"tag": remark,
|
||||
"settings": map[string]any{
|
||||
"servers": []any{
|
||||
map[string]any{"address": host, "port": port, "password": pass, "method": method},
|
||||
},
|
||||
},
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
// legacy: whole thing b64
|
||||
dec, err := base64DecodeFlexible(core)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
at = strings.Index(dec, "@")
|
||||
if at < 0 {
|
||||
return nil, fmt.Errorf("bad legacy ss")
|
||||
}
|
||||
userInfo := dec[:at]
|
||||
hp := dec[at+1:]
|
||||
colon := strings.LastIndex(hp, ":")
|
||||
if colon < 0 {
|
||||
return nil, fmt.Errorf("bad legacy ss hp")
|
||||
}
|
||||
host := hp[:colon]
|
||||
port, _ := strconv.Atoi(hp[colon+1:])
|
||||
method, pass := splitMethodPass(userInfo)
|
||||
identity := "ss:" + method + ":" + pass + "@" + host + ":" + strconv.Itoa(port)
|
||||
ob := Outbound{
|
||||
"protocol": "shadowsocks",
|
||||
"tag": remark,
|
||||
"settings": map[string]any{
|
||||
"servers": []any{
|
||||
map[string]any{"address": host, "port": port, "password": pass, "method": method},
|
||||
},
|
||||
},
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
func splitMethodPass(userInfo string) (string, string) {
|
||||
colon := strings.Index(userInfo, ":")
|
||||
if colon < 0 {
|
||||
return "2022-blake3-aes-128-gcm", userInfo // guess
|
||||
}
|
||||
return userInfo[:colon], userInfo[colon+1:]
|
||||
}
|
||||
|
||||
// --- hysteria2 ---
|
||||
|
||||
func parseHysteria2(link string) (*ParseResult, error) {
|
||||
u, err := url.Parse(link)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if u.Scheme != "hysteria2" && u.Scheme != "hy2" {
|
||||
return nil, fmt.Errorf("not hysteria2")
|
||||
}
|
||||
auth := u.User.Username()
|
||||
host := u.Hostname()
|
||||
port := defaultPort(u.Port(), 443)
|
||||
params := u.Query()
|
||||
|
||||
stream := map[string]any{
|
||||
"network": "hysteria",
|
||||
"security": "tls",
|
||||
"hysteriaSettings": map[string]any{
|
||||
"version": 2,
|
||||
"auth": auth,
|
||||
"udpIdleTimeout": 60,
|
||||
},
|
||||
"tlsSettings": map[string]any{
|
||||
"serverName": params.Get("sni"),
|
||||
"alpn": splitCommaOrDefault(params.Get("alpn"), []string{"h3"}),
|
||||
"fingerprint": params.Get("fp"),
|
||||
"echConfigList": params.Get("ech"),
|
||||
"verifyPeerCertByName": "",
|
||||
"pinnedPeerCertSha256": params.Get("pinSHA256"),
|
||||
},
|
||||
}
|
||||
applyFinalMask(stream, params)
|
||||
|
||||
identity := "hysteria2:" + auth + "@" + host + ":" + strconv.Itoa(port) + "?" + canonicalQuery(params)
|
||||
|
||||
ob := Outbound{
|
||||
"protocol": "hysteria",
|
||||
"tag": decodeHash(u.Fragment),
|
||||
"settings": map[string]any{"address": host, "port": port, "version": 2},
|
||||
"streamSettings": stream,
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
// --- wireguard ---
|
||||
|
||||
func parseWireguard(link string) (*ParseResult, error) {
|
||||
u, err := url.Parse(link)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if u.Scheme != "wireguard" && u.Scheme != "wg" {
|
||||
return nil, fmt.Errorf("not wireguard")
|
||||
}
|
||||
secret, _ := url.QueryUnescape(u.User.Username())
|
||||
params := u.Query()
|
||||
host := u.Hostname()
|
||||
portStr := u.Port()
|
||||
endpoint := host
|
||||
if portStr != "" {
|
||||
endpoint = host + ":" + portStr
|
||||
}
|
||||
|
||||
addrRaw := firstParam(params, "address", "ip")
|
||||
allowedRaw := firstParam(params, "allowedips", "allowed_ips")
|
||||
addrs := splitComma(addrRaw)
|
||||
if len(addrs) == 0 {
|
||||
addrs = []string{"0.0.0.0/0", "::/0"}
|
||||
}
|
||||
allowed := splitComma(allowedRaw)
|
||||
if len(allowed) == 0 {
|
||||
allowed = []string{"0.0.0.0/0", "::/0"}
|
||||
}
|
||||
|
||||
peer := map[string]any{
|
||||
"publicKey": firstParam(params, "publickey", "publicKey", "public_key", "peerPublicKey"),
|
||||
"endpoint": endpoint,
|
||||
"allowedIPs": allowed,
|
||||
}
|
||||
if psk := firstParam(params, "presharedkey", "preshared_key", "pre-shared-key", "psk"); psk != "" {
|
||||
peer["preSharedKey"] = psk
|
||||
}
|
||||
if ka := firstParam(params, "keepalive", "persistentkeepalive", "persistent_keepalive"); ka != "" {
|
||||
if n, err := strconv.Atoi(ka); err == nil {
|
||||
peer["keepAlive"] = n
|
||||
}
|
||||
}
|
||||
|
||||
settings := map[string]any{
|
||||
"secretKey": secret,
|
||||
"address": addrs,
|
||||
"peers": []any{peer},
|
||||
}
|
||||
if mtu := params.Get("mtu"); mtu != "" {
|
||||
if n, err := strconv.Atoi(mtu); err == nil {
|
||||
settings["mtu"] = n
|
||||
}
|
||||
}
|
||||
if res := params.Get("reserved"); res != "" {
|
||||
parts := splitComma(res)
|
||||
var iv []int
|
||||
for _, p := range parts {
|
||||
if n, err := strconv.Atoi(strings.TrimSpace(p)); err == nil {
|
||||
iv = append(iv, n)
|
||||
}
|
||||
}
|
||||
if len(iv) > 0 {
|
||||
settings["reserved"] = iv
|
||||
}
|
||||
}
|
||||
|
||||
identity := "wireguard:" + secret + "@" + endpoint + "?" + canonicalQuery(params)
|
||||
|
||||
ob := Outbound{
|
||||
"protocol": "wireguard",
|
||||
"tag": decodeHash(u.Fragment),
|
||||
"settings": settings,
|
||||
}
|
||||
return &ParseResult{Outbound: ob, Identity: identity}, nil
|
||||
}
|
||||
|
||||
// --- helpers ---
|
||||
|
||||
func buildStream(network, security string) map[string]any {
|
||||
stream := map[string]any{"network": network, "security": security}
|
||||
switch network {
|
||||
case "tcp":
|
||||
stream["tcpSettings"] = map[string]any{"header": map[string]any{"type": "none"}}
|
||||
case "kcp":
|
||||
stream["kcpSettings"] = map[string]any{
|
||||
"mtu": 1350, "tti": 20, "uplinkCapacity": 5, "downlinkCapacity": 20,
|
||||
"cwndMultiplier": 1, "maxSendingWindow": 2097152,
|
||||
}
|
||||
case "ws":
|
||||
stream["wsSettings"] = map[string]any{"path": "/", "host": "", "headers": map[string]any{}, "heartbeatPeriod": 0}
|
||||
case "grpc":
|
||||
stream["grpcSettings"] = map[string]any{"serviceName": "", "authority": "", "multiMode": false}
|
||||
case "httpupgrade":
|
||||
stream["httpupgradeSettings"] = map[string]any{"path": "/", "host": "", "headers": map[string]any{}}
|
||||
case "xhttp":
|
||||
stream["xhttpSettings"] = map[string]any{
|
||||
"path": "/", "host": "", "mode": "auto", "headers": map[string]any{},
|
||||
"xPaddingBytes": "100-1000", "scMaxEachPostBytes": "1000000",
|
||||
}
|
||||
default:
|
||||
stream["tcpSettings"] = map[string]any{"header": map[string]any{"type": "none"}}
|
||||
}
|
||||
switch security {
|
||||
case "tls":
|
||||
stream["tlsSettings"] = map[string]any{
|
||||
"serverName": "", "alpn": []any{}, "fingerprint": "",
|
||||
"echConfigList": "", "verifyPeerCertByName": "", "pinnedPeerCertSha256": "",
|
||||
}
|
||||
case "reality":
|
||||
stream["realitySettings"] = map[string]any{
|
||||
"publicKey": "", "fingerprint": "chrome", "serverName": "",
|
||||
"shortId": "", "spiderX": "", "mldsa65Verify": "",
|
||||
}
|
||||
}
|
||||
return stream
|
||||
}
|
||||
|
||||
func setWS(stream map[string]any, host, path string) {
|
||||
ws := stream["wsSettings"].(map[string]any)
|
||||
ws["host"] = host
|
||||
ws["path"] = path
|
||||
}
|
||||
|
||||
func setHTTPUpgrade(stream map[string]any, host, path string) {
|
||||
h := stream["httpupgradeSettings"].(map[string]any)
|
||||
h["host"] = host
|
||||
h["path"] = path
|
||||
}
|
||||
|
||||
func applyTransport(stream map[string]any, p url.Values) {
|
||||
net := stream["network"].(string)
|
||||
host := p.Get("host")
|
||||
path := firstNonEmpty(p.Get("path"), "/")
|
||||
switch net {
|
||||
case "ws":
|
||||
setWS(stream, host, path)
|
||||
case "grpc":
|
||||
gs := stream["grpcSettings"].(map[string]any)
|
||||
gs["serviceName"] = firstNonEmpty(p.Get("serviceName"), p.Get("path"))
|
||||
gs["authority"] = p.Get("authority")
|
||||
gs["multiMode"] = p.Get("mode") == "multi"
|
||||
case "httpupgrade":
|
||||
setHTTPUpgrade(stream, host, path)
|
||||
case "xhttp":
|
||||
xh := stream["xhttpSettings"].(map[string]any)
|
||||
xh["host"] = host
|
||||
xh["path"] = path
|
||||
if m := p.Get("mode"); m != "" {
|
||||
xh["mode"] = m
|
||||
}
|
||||
// A few advanced xhttp fields that are commonly carried
|
||||
for _, k := range []string{"xPaddingBytes", "scMaxEachPostBytes", "scMinPostsIntervalMs", "uplinkChunkSize"} {
|
||||
if v := p.Get(k); v != "" {
|
||||
xh[k] = v
|
||||
}
|
||||
}
|
||||
case "tcp":
|
||||
if p.Get("headerType") == "http" || p.Get("type") == "http" {
|
||||
stream["tcpSettings"] = map[string]any{
|
||||
"header": map[string]any{
|
||||
"type": "http",
|
||||
"request": map[string]any{
|
||||
"version": "1.1",
|
||||
"method": "GET",
|
||||
"path": splitComma(path),
|
||||
"headers": map[string]any{"Host": splitComma(host)},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func applySecurity(stream map[string]any, p url.Values) {
|
||||
sec := stream["security"].(string)
|
||||
switch sec {
|
||||
case "tls":
|
||||
tls := stream["tlsSettings"].(map[string]any)
|
||||
tls["serverName"] = p.Get("sni")
|
||||
tls["fingerprint"] = p.Get("fp")
|
||||
if alpn := p.Get("alpn"); alpn != "" {
|
||||
tls["alpn"] = splitComma(alpn)
|
||||
}
|
||||
tls["echConfigList"] = p.Get("ech")
|
||||
tls["pinnedPeerCertSha256"] = p.Get("pcs")
|
||||
case "reality":
|
||||
re := stream["realitySettings"].(map[string]any)
|
||||
re["serverName"] = p.Get("sni")
|
||||
re["fingerprint"] = firstNonEmpty(p.Get("fp"), "chrome")
|
||||
re["publicKey"] = p.Get("pbk")
|
||||
re["shortId"] = p.Get("sid")
|
||||
re["spiderX"] = p.Get("spx")
|
||||
re["mldsa65Verify"] = p.Get("pqv")
|
||||
}
|
||||
}
|
||||
|
||||
func applyFinalMask(stream map[string]any, p url.Values) {
|
||||
if fm := p.Get("fm"); fm != "" {
|
||||
var parsed any
|
||||
if json.Unmarshal([]byte(fm), &parsed) == nil {
|
||||
stream["finalmask"] = parsed
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func firstNonEmpty(a, b string) string {
|
||||
if a != "" {
|
||||
return a
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
func firstParam(p url.Values, keys ...string) string {
|
||||
for _, k := range keys {
|
||||
if v := p.Get(k); v != "" {
|
||||
return v
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func canonicalQuery(p url.Values) string {
|
||||
// Sort keys for stable identity
|
||||
keys := make([]string, 0, len(p))
|
||||
for k := range p {
|
||||
keys = append(keys, k)
|
||||
}
|
||||
// simple sort
|
||||
for i := 0; i < len(keys); i++ {
|
||||
for j := i + 1; j < len(keys); j++ {
|
||||
if keys[j] < keys[i] {
|
||||
keys[i], keys[j] = keys[j], keys[i]
|
||||
}
|
||||
}
|
||||
}
|
||||
parts := make([]string, 0, len(keys))
|
||||
for _, k := range keys {
|
||||
for _, v := range p[k] {
|
||||
parts = append(parts, k+"="+v)
|
||||
}
|
||||
}
|
||||
return strings.Join(parts, "&")
|
||||
}
|
||||
|
||||
func decodeHash(h string) string {
|
||||
if h == "" {
|
||||
return ""
|
||||
}
|
||||
if dec, err := url.QueryUnescape(h); err == nil {
|
||||
return dec
|
||||
}
|
||||
return h
|
||||
}
|
||||
|
||||
func defaultPort(p string, def int) int {
|
||||
if p == "" {
|
||||
return def
|
||||
}
|
||||
n, err := strconv.Atoi(p)
|
||||
if err != nil || n <= 0 {
|
||||
return def
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func num(v any) int {
|
||||
switch x := v.(type) {
|
||||
case float64:
|
||||
return int(x)
|
||||
case int:
|
||||
return x
|
||||
case int64:
|
||||
return int(x)
|
||||
case string:
|
||||
n, _ := strconv.Atoi(x)
|
||||
return n
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func getString(m map[string]any, key, def string) string {
|
||||
if v, ok := m[key]; ok {
|
||||
if s, ok := v.(string); ok {
|
||||
return s
|
||||
}
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func splitComma(s string) []string {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
parts := strings.Split(s, ",")
|
||||
out := make([]string, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
p = strings.TrimSpace(p)
|
||||
if p != "" {
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func splitCommaOrDefault(s string, def []string) []string {
|
||||
if s == "" {
|
||||
return def
|
||||
}
|
||||
return splitComma(s)
|
||||
}
|
||||
|
||||
func padBase64(s string) string {
|
||||
for len(s)%4 != 0 {
|
||||
s += "="
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func base64DecodeFlexible(s string) (string, error) {
|
||||
s = padBase64(s)
|
||||
if b, err := base64.StdEncoding.DecodeString(s); err == nil {
|
||||
return string(b), nil
|
||||
}
|
||||
if b, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(s, "=")); err == nil {
|
||||
return string(b), nil
|
||||
}
|
||||
return "", fmt.Errorf("base64 decode failed")
|
||||
}
|
||||
|
||||
// SlugRemark turns a free-form remark into a conservative DNS-ish tag segment.
|
||||
var slugRe = regexp.MustCompile(`[^a-z0-9]+`)
|
||||
|
||||
func SlugRemark(remark string) string {
|
||||
s := strings.ToLower(strings.TrimSpace(remark))
|
||||
s = slugRe.ReplaceAllString(s, "-")
|
||||
s = strings.Trim(s, "-")
|
||||
if s == "" {
|
||||
return ""
|
||||
}
|
||||
// collapse runs of dashes
|
||||
for strings.Contains(s, "--") {
|
||||
s = strings.ReplaceAll(s, "--", "-")
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// SuggestTag builds a tag from a prefix and a remark (or index fallback).
|
||||
// It is intended for initial assignment; stability is handled by the service layer.
|
||||
func SuggestTag(prefix, remark string, idx int) string {
|
||||
base := SlugRemark(remark)
|
||||
if base == "" {
|
||||
base = fmt.Sprintf("%d", idx)
|
||||
}
|
||||
p := strings.TrimSuffix(prefix, "-")
|
||||
if p != "" {
|
||||
return p + "-" + base
|
||||
}
|
||||
return base
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
package link
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseVmessLink(t *testing.T) {
|
||||
// vmess:// + base64 of:
|
||||
// {"v":"2","ps":"test","add":"1.2.3.4","port":443,"id":"uuid","aid":"0","net":"ws","type":"","host":"ex.com","path":"/","tls":"tls"}
|
||||
link := "vmess://eyJ2IjoiMiIsInBzIjoidGVzdCIsImFkZCI6IjEuMi4zLjQiLCJwb3J0Ijo0NDMsImlkIjoidXVpZCIsImFpZCI6IjAiLCJuZXQiOiJ3cyIsInR5cGUiOiIiLCJob3N0IjoiZXguY29tIiwicGF0aCI6Ii8iLCJ0bHMiOiJ0bHMifQ=="
|
||||
res, err := ParseLink(link)
|
||||
if err != nil {
|
||||
t.Fatalf("parse vmess: %v", err)
|
||||
}
|
||||
if res.Outbound["protocol"] != "vmess" {
|
||||
t.Errorf("expected vmess protocol, got %v", res.Outbound["protocol"])
|
||||
}
|
||||
if res.Outbound["tag"] != "test" {
|
||||
t.Errorf("expected tag 'test', got %v", res.Outbound["tag"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseVlessLink(t *testing.T) {
|
||||
link := "vless://uuid@1.2.3.4:443?type=ws&security=tls&path=/&host=ex.com#node1"
|
||||
res, err := ParseLink(link)
|
||||
if err != nil {
|
||||
t.Fatalf("parse vless: %v", err)
|
||||
}
|
||||
if res.Outbound["protocol"] != "vless" {
|
||||
t.Fatalf("bad protocol")
|
||||
}
|
||||
if res.Outbound["tag"] != "node1" {
|
||||
t.Errorf("tag mismatch: %v", res.Outbound["tag"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseSubscriptionBody_Base64(t *testing.T) {
|
||||
// base64 of the two joined links:
|
||||
// vless://u@h:443?type=tcp#A\nvless://u2@h2:443?type=tcp#B
|
||||
b64 := "dmxlc3M6Ly91QGg6NDQzP3R5cGU9dGNwI0EKdmxlc3M6Ly91MkBoMjo0NDM/dHlwZT10Y3AjQg=="
|
||||
obs, ids, err := ParseSubscriptionBody([]byte(b64))
|
||||
if err != nil {
|
||||
t.Fatalf("parse sub body: %v", err)
|
||||
}
|
||||
if len(obs) != 2 {
|
||||
t.Fatalf("expected 2 outbounds, got %d", len(obs))
|
||||
}
|
||||
if !strings.HasPrefix(ids[0], "vless:") || !strings.HasPrefix(ids[1], "vless:") {
|
||||
t.Errorf("bad identities: %v", ids)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSlugAndSuggest(t *testing.T) {
|
||||
if SlugRemark("Hello World!") != "hello-world" {
|
||||
t.Errorf("slug failed")
|
||||
}
|
||||
tag := SuggestTag("hk-", " SG 01 !! ", 0)
|
||||
if tag != "hk-sg-01" {
|
||||
t.Errorf("suggest tag got %q", tag)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
// Package netproxy builds HTTP clients that route the panel's own outbound
|
||||
// requests through an admin-configured proxy, used to reach GitHub and Telegram
|
||||
// from servers where those services are filtered.
|
||||
package netproxy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/net/proxy"
|
||||
)
|
||||
|
||||
// NewHTTPClient returns an *http.Client whose transport honors proxyURL.
|
||||
//
|
||||
// An empty proxyURL yields a plain client (unchanged behavior). socks5/socks5h
|
||||
// URLs are dialed through golang.org/x/net/proxy; http/https URLs use the
|
||||
// standard library proxy support. Any other scheme returns an error so callers
|
||||
// can log it and fall back to a direct connection.
|
||||
//
|
||||
// The proxy address is intentionally not subjected to SSRF filtering: it is
|
||||
// admin-configured and is commonly a loopback/private address (for example a
|
||||
// local Xray SOCKS inbound).
|
||||
func NewHTTPClient(proxyURL string, timeout time.Duration) (*http.Client, error) {
|
||||
if proxyURL == "" {
|
||||
return &http.Client{Timeout: timeout}, nil
|
||||
}
|
||||
|
||||
parsed, err := url.Parse(proxyURL)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse proxy url: %w", err)
|
||||
}
|
||||
|
||||
transport := baseTransport()
|
||||
|
||||
switch strings.ToLower(parsed.Scheme) {
|
||||
case "socks5", "socks5h":
|
||||
var auth *proxy.Auth
|
||||
if parsed.User != nil {
|
||||
password, _ := parsed.User.Password()
|
||||
auth = &proxy.Auth{User: parsed.User.Username(), Password: password}
|
||||
}
|
||||
dialer, err := proxy.SOCKS5("tcp", parsed.Host, auth, proxy.Direct)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create socks5 dialer: %w", err)
|
||||
}
|
||||
if contextDialer, ok := dialer.(proxy.ContextDialer); ok {
|
||||
transport.DialContext = contextDialer.DialContext
|
||||
} else {
|
||||
transport.DialContext = func(_ context.Context, network, addr string) (net.Conn, error) {
|
||||
return dialer.Dial(network, addr)
|
||||
}
|
||||
}
|
||||
case "http", "https":
|
||||
transport.Proxy = http.ProxyURL(parsed)
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported proxy scheme %q", parsed.Scheme)
|
||||
}
|
||||
|
||||
return &http.Client{Timeout: timeout, Transport: transport}, nil
|
||||
}
|
||||
|
||||
func baseTransport() *http.Transport {
|
||||
if base, ok := http.DefaultTransport.(*http.Transport); ok {
|
||||
return base.Clone()
|
||||
}
|
||||
return &http.Transport{}
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
package netproxy
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestNewHTTPClient(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
proxyURL string
|
||||
wantErr bool
|
||||
wantProxy bool
|
||||
wantDial bool
|
||||
}{
|
||||
{name: "empty returns direct client", proxyURL: ""},
|
||||
{name: "socks5 sets custom dialer", proxyURL: "socks5://127.0.0.1:1080", wantDial: true},
|
||||
{name: "socks5 with auth", proxyURL: "socks5://user:pass@127.0.0.1:1080", wantDial: true},
|
||||
{name: "http sets transport proxy", proxyURL: "http://127.0.0.1:8080", wantProxy: true},
|
||||
{name: "https sets transport proxy", proxyURL: "https://127.0.0.1:8080", wantProxy: true},
|
||||
{name: "unsupported scheme errors", proxyURL: "ftp://127.0.0.1:21", wantErr: true},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
client, err := NewHTTPClient(tc.proxyURL, 5*time.Second)
|
||||
if tc.wantErr {
|
||||
if err == nil {
|
||||
t.Fatalf("expected error for %q, got nil", tc.proxyURL)
|
||||
}
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error for %q: %v", tc.proxyURL, err)
|
||||
}
|
||||
if client.Timeout != 5*time.Second {
|
||||
t.Errorf("timeout = %v, want 5s", client.Timeout)
|
||||
}
|
||||
if tc.wantProxy {
|
||||
transport, ok := client.Transport.(*http.Transport)
|
||||
if !ok || transport.Proxy == nil {
|
||||
t.Errorf("expected transport with Proxy set for %q", tc.proxyURL)
|
||||
}
|
||||
}
|
||||
if tc.wantDial {
|
||||
transport, ok := client.Transport.(*http.Transport)
|
||||
if !ok || transport.DialContext == nil {
|
||||
t.Errorf("expected transport with DialContext set for %q", tc.proxyURL)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
package netsafe
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
func IsBlockedIP(ip net.IP) bool {
|
||||
return ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() ||
|
||||
ip.IsLinkLocalMulticast() || ip.IsUnspecified()
|
||||
}
|
||||
|
||||
type allowPrivateCtxKey struct{}
|
||||
|
||||
func ContextWithAllowPrivate(ctx context.Context, allow bool) context.Context {
|
||||
return context.WithValue(ctx, allowPrivateCtxKey{}, allow)
|
||||
}
|
||||
|
||||
func AllowPrivateFromContext(ctx context.Context) bool {
|
||||
v, _ := ctx.Value(allowPrivateCtxKey{}).(bool)
|
||||
return v
|
||||
}
|
||||
|
||||
var defaultDialer = &net.Dialer{Timeout: 10 * time.Second}
|
||||
|
||||
func SSRFGuardedDialContext(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
host, port, err := net.SplitHostPort(addr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
allowPrivate := AllowPrivateFromContext(ctx)
|
||||
var ips []net.IPAddr
|
||||
if ip := net.ParseIP(host); ip != nil {
|
||||
ips = []net.IPAddr{{IP: ip}}
|
||||
} else {
|
||||
ips, err = net.DefaultResolver.LookupIPAddr(ctx, host)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
var lastErr error
|
||||
for _, ipAddr := range ips {
|
||||
if !allowPrivate && IsBlockedIP(ipAddr.IP) {
|
||||
lastErr = fmt.Errorf("blocked private/internal address %s", ipAddr.IP)
|
||||
continue
|
||||
}
|
||||
conn, derr := defaultDialer.DialContext(ctx, network, net.JoinHostPort(ipAddr.IP.String(), port))
|
||||
if derr == nil {
|
||||
return conn, nil
|
||||
}
|
||||
lastErr = derr
|
||||
}
|
||||
if lastErr == nil {
|
||||
lastErr = fmt.Errorf("no usable address for %s", host)
|
||||
}
|
||||
return nil, lastErr
|
||||
}
|
||||
|
||||
var hostnamePattern = regexp.MustCompile(`^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$`)
|
||||
|
||||
func NormalizeHost(addr string) (string, error) {
|
||||
addr = strings.TrimSpace(addr)
|
||||
if addr == "" {
|
||||
return "", fmt.Errorf("address is required")
|
||||
}
|
||||
if strings.HasPrefix(addr, "[") && strings.HasSuffix(addr, "]") {
|
||||
addr = addr[1 : len(addr)-1]
|
||||
}
|
||||
if ip := net.ParseIP(addr); ip != nil {
|
||||
return ip.String(), nil
|
||||
}
|
||||
if len(addr) > 253 || !hostnamePattern.MatchString(addr) {
|
||||
return "", fmt.Errorf("invalid host %q", addr)
|
||||
}
|
||||
return addr, nil
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
package netsafe
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestIsBlockedIP(t *testing.T) {
|
||||
cases := []struct {
|
||||
ip string
|
||||
want bool
|
||||
}{
|
||||
{"127.0.0.1", true},
|
||||
{"::1", true},
|
||||
{"10.0.0.5", true},
|
||||
{"172.16.0.1", true},
|
||||
{"192.168.1.1", true},
|
||||
{"169.254.0.1", true},
|
||||
{"0.0.0.0", true},
|
||||
{"::", true},
|
||||
{"8.8.8.8", false},
|
||||
{"1.1.1.1", false},
|
||||
{"2606:4700:4700::1111", false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.ip, func(t *testing.T) {
|
||||
ip := net.ParseIP(c.ip)
|
||||
if ip == nil {
|
||||
t.Fatalf("could not parse %q", c.ip)
|
||||
}
|
||||
if got := IsBlockedIP(ip); got != c.want {
|
||||
t.Fatalf("IsBlockedIP(%s) = %v, want %v", c.ip, got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAllowPrivateFromContext_Default(t *testing.T) {
|
||||
if AllowPrivateFromContext(context.Background()) {
|
||||
t.Fatal("default context should report AllowPrivate=false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAllowPrivateFromContext_RoundTrip(t *testing.T) {
|
||||
ctx := ContextWithAllowPrivate(context.Background(), true)
|
||||
if !AllowPrivateFromContext(ctx) {
|
||||
t.Fatal("expected AllowPrivate=true after ContextWithAllowPrivate(true)")
|
||||
}
|
||||
ctx = ContextWithAllowPrivate(ctx, false)
|
||||
if AllowPrivateFromContext(ctx) {
|
||||
t.Fatal("expected AllowPrivate=false after overriding with false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeHost_Valid(t *testing.T) {
|
||||
cases := []struct {
|
||||
in string
|
||||
want string
|
||||
}{
|
||||
{"example.com", "example.com"},
|
||||
{" example.com ", "example.com"},
|
||||
{"a.b.c.example.com", "a.b.c.example.com"},
|
||||
{"10.0.0.1", "10.0.0.1"},
|
||||
{"[2606:4700:4700::1111]", "2606:4700:4700::1111"},
|
||||
{"2606:4700:4700::1111", "2606:4700:4700::1111"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.in, func(t *testing.T) {
|
||||
got, err := NormalizeHost(c.in)
|
||||
if err != nil {
|
||||
t.Fatalf("NormalizeHost(%q) returned error: %v", c.in, err)
|
||||
}
|
||||
if !strings.EqualFold(got, c.want) {
|
||||
t.Fatalf("NormalizeHost(%q) = %q, want %q", c.in, got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeHost_Invalid(t *testing.T) {
|
||||
cases := []string{
|
||||
"",
|
||||
" ",
|
||||
"-leading-dash.com",
|
||||
"trailing-dash-.com",
|
||||
"bad host with spaces",
|
||||
"under_score.example.com",
|
||||
"exa$mple.com",
|
||||
strings.Repeat("a", 254),
|
||||
}
|
||||
for _, in := range cases {
|
||||
t.Run(in, func(t *testing.T) {
|
||||
if _, err := NormalizeHost(in); err == nil {
|
||||
t.Fatalf("NormalizeHost(%q) expected error, got nil", in)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSRFGuardedDialContext_BlocksLiteralPrivateIP(t *testing.T) {
|
||||
_, err := SSRFGuardedDialContext(context.Background(), "tcp", "127.0.0.1:1")
|
||||
if err == nil {
|
||||
t.Fatal("expected dial to 127.0.0.1 to be blocked")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "blocked") {
|
||||
t.Fatalf("expected 'blocked' in error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSRFGuardedDialContext_AllowPrivateBypassesGuard(t *testing.T) {
|
||||
ctx := ContextWithAllowPrivate(context.Background(), true)
|
||||
_, err := SSRFGuardedDialContext(ctx, "tcp", "127.0.0.1:1")
|
||||
if err == nil {
|
||||
t.Fatal("dial to a closed loopback port should still fail at the connect step")
|
||||
}
|
||||
if strings.Contains(err.Error(), "blocked private/internal address") {
|
||||
t.Fatalf("expected guard to be bypassed when AllowPrivate=true, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSRFGuardedDialContext_BadAddress(t *testing.T) {
|
||||
if _, err := SSRFGuardedDialContext(context.Background(), "tcp", "no-port"); err == nil {
|
||||
t.Fatal("expected error for address without port")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
// Package random provides utilities for generating random strings and numbers.
|
||||
package random
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"math/big"
|
||||
)
|
||||
|
||||
var (
|
||||
numSeq [10]rune
|
||||
lowerSeq [26]rune
|
||||
upperSeq [26]rune
|
||||
numLowerSeq [36]rune
|
||||
numUpperSeq [36]rune
|
||||
allSeq [62]rune
|
||||
)
|
||||
|
||||
// init initializes the character sequences used for random string generation.
|
||||
// It sets up arrays for numbers, lowercase letters, uppercase letters, and combinations.
|
||||
func init() {
|
||||
for i := range 10 {
|
||||
numSeq[i] = rune('0' + i)
|
||||
}
|
||||
for i := range 26 {
|
||||
lowerSeq[i] = rune('a' + i)
|
||||
upperSeq[i] = rune('A' + i)
|
||||
}
|
||||
|
||||
copy(numLowerSeq[:], numSeq[:])
|
||||
copy(numLowerSeq[len(numSeq):], lowerSeq[:])
|
||||
|
||||
copy(numUpperSeq[:], numSeq[:])
|
||||
copy(numUpperSeq[len(numSeq):], upperSeq[:])
|
||||
|
||||
copy(allSeq[:], numSeq[:])
|
||||
copy(allSeq[len(numSeq):], lowerSeq[:])
|
||||
copy(allSeq[len(numSeq)+len(lowerSeq):], upperSeq[:])
|
||||
}
|
||||
|
||||
// Seq generates a random string of length n containing alphanumeric characters (numbers, lowercase and uppercase letters).
|
||||
func Seq(n int) string {
|
||||
runes := make([]rune, n)
|
||||
for i := range n {
|
||||
idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(allSeq))))
|
||||
if err != nil {
|
||||
panic("crypto/rand failed: " + err.Error())
|
||||
}
|
||||
runes[i] = allSeq[idx.Int64()]
|
||||
}
|
||||
return string(runes)
|
||||
}
|
||||
|
||||
// NumLower generates a random string of length n containing digits and lowercase letters only.
|
||||
func NumLower(n int) string {
|
||||
runes := make([]rune, n)
|
||||
for i := range n {
|
||||
idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(numLowerSeq))))
|
||||
if err != nil {
|
||||
panic("crypto/rand failed: " + err.Error())
|
||||
}
|
||||
runes[i] = numLowerSeq[idx.Int64()]
|
||||
}
|
||||
return string(runes)
|
||||
}
|
||||
|
||||
// Num generates a random integer between 0 and n-1.
|
||||
func Num(n int) int {
|
||||
bn := big.NewInt(int64(n))
|
||||
r, err := rand.Int(rand.Reader, bn)
|
||||
if err != nil {
|
||||
panic("crypto/rand failed: " + err.Error())
|
||||
}
|
||||
return int(r.Int64())
|
||||
}
|
||||
|
||||
// Base64Bytes returns n cryptographically-random bytes encoded as standard
|
||||
// base64 (with padding). Used for ss2022 keys, which xray expects as a
|
||||
// base64-encoded key of a specific byte length per cipher.
|
||||
func Base64Bytes(n int) string {
|
||||
b := make([]byte, n)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
panic("crypto/rand failed: " + err.Error())
|
||||
}
|
||||
return base64.StdEncoding.EncodeToString(b)
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
package random
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestSeq_LengthAndAlphabet(t *testing.T) {
|
||||
for _, n := range []int{0, 1, 8, 64, 256} {
|
||||
s := Seq(n)
|
||||
if len(s) != n {
|
||||
t.Fatalf("Seq(%d) returned length %d", n, len(s))
|
||||
}
|
||||
for i, r := range s {
|
||||
isDigit := r >= '0' && r <= '9'
|
||||
isLower := r >= 'a' && r <= 'z'
|
||||
isUpper := r >= 'A' && r <= 'Z'
|
||||
if !(isDigit || isLower || isUpper) {
|
||||
t.Fatalf("Seq(%d) byte %d = %q is not alphanumeric", n, i, r)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSeq_NotConstant(t *testing.T) {
|
||||
a := Seq(32)
|
||||
b := Seq(32)
|
||||
if a == b {
|
||||
t.Fatalf("two consecutive Seq(32) calls produced identical output: %q", a)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNum_InRange(t *testing.T) {
|
||||
for _, upper := range []int{1, 2, 10, 1000} {
|
||||
for range 200 {
|
||||
v := Num(upper)
|
||||
if v < 0 || v >= upper {
|
||||
t.Fatalf("Num(%d) returned %d, out of [0, %d)", upper, v, upper)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBase64Bytes_DecodesToRequestedSize(t *testing.T) {
|
||||
for _, n := range []int{1, 16, 32, 64} {
|
||||
out := Base64Bytes(n)
|
||||
decoded, err := base64.StdEncoding.DecodeString(out)
|
||||
if err != nil {
|
||||
t.Fatalf("Base64Bytes(%d) produced invalid base64 %q: %v", n, out, err)
|
||||
}
|
||||
if len(decoded) != n {
|
||||
t.Fatalf("Base64Bytes(%d) decoded to %d bytes", n, len(decoded))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBase64Bytes_Random(t *testing.T) {
|
||||
a := Base64Bytes(32)
|
||||
b := Base64Bytes(32)
|
||||
if a == b {
|
||||
t.Fatalf("two consecutive Base64Bytes(32) calls produced identical output: %q", a)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
// Package reflect_util provides reflection utilities for working with struct fields and values.
|
||||
package reflect_util
|
||||
|
||||
import "reflect"
|
||||
|
||||
// GetFields returns all struct fields of the given reflect.Type.
|
||||
func GetFields(t reflect.Type) []reflect.StructField {
|
||||
num := t.NumField()
|
||||
fields := make([]reflect.StructField, 0, num)
|
||||
for i := range num {
|
||||
fields = append(fields, t.Field(i))
|
||||
}
|
||||
return fields
|
||||
}
|
||||
|
||||
// GetFieldValues returns all field values of the given reflect.Value.
|
||||
func GetFieldValues(v reflect.Value) []reflect.Value {
|
||||
num := v.NumField()
|
||||
fields := make([]reflect.Value, 0, num)
|
||||
for i := range num {
|
||||
fields = append(fields, v.Field(i))
|
||||
}
|
||||
return fields
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
// Package sys provides system utilities for monitoring network connections and CPU usage.
|
||||
// Platform-specific implementations are provided for Windows, Linux, and macOS.
|
||||
package sys
|
||||
|
||||
import (
|
||||
_ "unsafe"
|
||||
)
|
||||
|
||||
//go:linkname HostProc github.com/shirou/gopsutil/v4/internal/common.HostProc
|
||||
func HostProc(combineWith ...string) string
|
||||
@@ -0,0 +1,91 @@
|
||||
//go:build darwin
|
||||
|
||||
package sys
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"sync"
|
||||
"syscall"
|
||||
|
||||
"github.com/shirou/gopsutil/v4/net"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
var SIGUSR1 = syscall.SIGUSR1
|
||||
|
||||
func GetTCPCount() (int, error) {
|
||||
stats, err := net.Connections("tcp")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return len(stats), nil
|
||||
}
|
||||
|
||||
func GetUDPCount() (int, error) {
|
||||
stats, err := net.Connections("udp")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return len(stats), nil
|
||||
}
|
||||
|
||||
// --- CPU Utilization (macOS native) ---
|
||||
|
||||
// sysctl kern.cp_time returns 5 longs in the BSD CPUSTATES order:
|
||||
// user, nice, sys, intr, idle (CP_INTR=3, CP_IDLE=4). gopsutil reads the
|
||||
// same layout in cpu_darwin_nocgo.go.
|
||||
var (
|
||||
cpuMu sync.Mutex
|
||||
lastTotals [5]uint64
|
||||
hasLastCPUT bool
|
||||
)
|
||||
|
||||
func CPUPercentRaw() (float64, error) {
|
||||
raw, err := unix.SysctlRaw("kern.cp_time")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
// Expect either 5*8 bytes (uint64) or 5*4 bytes (uint32)
|
||||
var out [5]uint64
|
||||
switch len(raw) {
|
||||
case 5 * 8:
|
||||
for i := range 5 {
|
||||
out[i] = binary.LittleEndian.Uint64(raw[i*8 : (i+1)*8])
|
||||
}
|
||||
case 5 * 4:
|
||||
for i := range 5 {
|
||||
out[i] = uint64(binary.LittleEndian.Uint32(raw[i*4 : (i+1)*4]))
|
||||
}
|
||||
default:
|
||||
return 0, fmt.Errorf("unexpected kern.cp_time size: %d", len(raw))
|
||||
}
|
||||
|
||||
cpuMu.Lock()
|
||||
defer cpuMu.Unlock()
|
||||
|
||||
if !hasLastCPUT {
|
||||
lastTotals = out
|
||||
hasLastCPUT = true
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
var deltas [5]uint64
|
||||
var totald uint64
|
||||
for i := range 5 {
|
||||
deltas[i] = out[i] - lastTotals[i]
|
||||
totald += deltas[i]
|
||||
}
|
||||
lastTotals = out
|
||||
|
||||
if totald == 0 {
|
||||
return 0, nil
|
||||
}
|
||||
idleDelta := deltas[4]
|
||||
busy := totald - idleDelta
|
||||
pct := float64(busy) / float64(totald) * 100.0
|
||||
if pct > 100 {
|
||||
pct = 100
|
||||
}
|
||||
return pct, nil
|
||||
}
|
||||
@@ -0,0 +1,151 @@
|
||||
//go:build linux
|
||||
|
||||
package sys
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
var SIGUSR1 = syscall.SIGUSR1
|
||||
|
||||
// countConnections returns the number of entries in a /proc/net/{tcp,udp}[6]
|
||||
// file. Returns 0 if the file is absent (e.g. /proc/net/tcp6 when IPv6 is
|
||||
// disabled) and excludes the column header line.
|
||||
func countConnections(path string) (int, error) {
|
||||
f, err := os.Open(path)
|
||||
if os.IsNotExist(err) {
|
||||
return 0, nil
|
||||
}
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
sc := bufio.NewScanner(f)
|
||||
n := 0
|
||||
for sc.Scan() {
|
||||
n++
|
||||
}
|
||||
if err := sc.Err(); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if n > 0 {
|
||||
n-- // first line is the column header
|
||||
}
|
||||
return n, nil
|
||||
}
|
||||
|
||||
// GetTCPCount returns the number of active TCP connections by reading
|
||||
// /proc/net/tcp and /proc/net/tcp6 when available.
|
||||
func GetTCPCount() (int, error) {
|
||||
root := HostProc()
|
||||
tcp4, err := countConnections(root + "/net/tcp")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
tcp6, err := countConnections(root + "/net/tcp6")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return tcp4 + tcp6, nil
|
||||
}
|
||||
|
||||
// GetUDPCount returns the number of active UDP connections by reading
|
||||
// /proc/net/udp and /proc/net/udp6 when available.
|
||||
func GetUDPCount() (int, error) {
|
||||
root := HostProc()
|
||||
udp4, err := countConnections(root + "/net/udp")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
udp6, err := countConnections(root + "/net/udp6")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return udp4 + udp6, nil
|
||||
}
|
||||
|
||||
// --- CPU Utilization (Linux native) ---
|
||||
|
||||
var (
|
||||
cpuMu sync.Mutex
|
||||
lastTotal uint64
|
||||
lastIdleAll uint64
|
||||
hasLast bool
|
||||
)
|
||||
|
||||
// CPUPercentRaw returns instantaneous total CPU utilization by reading
|
||||
// /proc/stat. First call initializes and returns 0; subsequent calls return
|
||||
// busy/total * 100. Uses HostProc so HOST_PROC overrides (containers) apply.
|
||||
func CPUPercentRaw() (float64, error) {
|
||||
f, err := os.Open(HostProc("stat"))
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
rd := bufio.NewReader(f)
|
||||
line, err := rd.ReadString('\n')
|
||||
if err != nil && err != io.EOF {
|
||||
return 0, err
|
||||
}
|
||||
// Expect: cpu user nice system idle iowait irq softirq steal guest guest_nice
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) < 5 || fields[0] != "cpu" {
|
||||
return 0, fmt.Errorf("unexpected /proc/stat format")
|
||||
}
|
||||
|
||||
nums := make([]uint64, 0, len(fields)-1)
|
||||
for i := 1; i < len(fields); i++ {
|
||||
v, err := strconv.ParseUint(fields[i], 10, 64)
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
nums = append(nums, v)
|
||||
}
|
||||
if len(nums) < 4 {
|
||||
return 0, fmt.Errorf("insufficient cpu fields")
|
||||
}
|
||||
for len(nums) < 8 {
|
||||
nums = append(nums, 0)
|
||||
}
|
||||
|
||||
user, nice, system, idle := nums[0], nums[1], nums[2], nums[3]
|
||||
iowait, irq, softirq, steal := nums[4], nums[5], nums[6], nums[7]
|
||||
|
||||
idleAll := idle + iowait
|
||||
nonIdle := user + nice + system + irq + softirq + steal
|
||||
total := idleAll + nonIdle
|
||||
|
||||
cpuMu.Lock()
|
||||
defer cpuMu.Unlock()
|
||||
|
||||
if !hasLast {
|
||||
lastTotal = total
|
||||
lastIdleAll = idleAll
|
||||
hasLast = true
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
totald := total - lastTotal
|
||||
idled := idleAll - lastIdleAll
|
||||
lastTotal = total
|
||||
lastIdleAll = idleAll
|
||||
|
||||
if totald == 0 {
|
||||
return 0, nil
|
||||
}
|
||||
busy := totald - idled
|
||||
pct := float64(busy) / float64(totald) * 100.0
|
||||
if pct > 100 {
|
||||
pct = 100
|
||||
}
|
||||
return pct, nil
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
//go:build windows
|
||||
|
||||
package sys
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"sync"
|
||||
"syscall"
|
||||
"unsafe"
|
||||
|
||||
"github.com/shirou/gopsutil/v4/net"
|
||||
"golang.org/x/sys/windows"
|
||||
)
|
||||
|
||||
var SIGUSR1 = syscall.Signal(0)
|
||||
|
||||
// GetConnectionCount returns the number of active connections for the specified protocol ("tcp" or "udp").
|
||||
func GetConnectionCount(proto string) (int, error) {
|
||||
if proto != "tcp" && proto != "udp" {
|
||||
return 0, errors.New("invalid protocol")
|
||||
}
|
||||
stats, err := net.Connections(proto)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return len(stats), nil
|
||||
}
|
||||
|
||||
// GetTCPCount returns the number of active TCP connections.
|
||||
func GetTCPCount() (int, error) {
|
||||
return GetConnectionCount("tcp")
|
||||
}
|
||||
|
||||
// GetUDPCount returns the number of active UDP connections.
|
||||
func GetUDPCount() (int, error) {
|
||||
return GetConnectionCount("udp")
|
||||
}
|
||||
|
||||
// --- CPU Utilization (Windows native) ---
|
||||
|
||||
var (
|
||||
// NewLazySystemDLL forces the load from %SystemRoot%\System32 so a
|
||||
// kernel32.dll planted next to the binary can't hijack the call.
|
||||
modKernel32 = windows.NewLazySystemDLL("kernel32.dll")
|
||||
procGetSystemTimes = modKernel32.NewProc("GetSystemTimes")
|
||||
|
||||
cpuMu sync.Mutex
|
||||
lastIdle uint64
|
||||
lastKernel uint64
|
||||
lastUser uint64
|
||||
hasLast bool
|
||||
)
|
||||
|
||||
func ftToUint64(ft windows.Filetime) uint64 {
|
||||
return (uint64(ft.HighDateTime) << 32) | uint64(ft.LowDateTime)
|
||||
}
|
||||
|
||||
// CPUPercentRaw returns instantaneous total CPU utilization across all
|
||||
// logical processors via Windows GetSystemTimes. The first call returns 0
|
||||
// while it initializes the baseline; subsequent calls compute deltas.
|
||||
func CPUPercentRaw() (float64, error) {
|
||||
var idleFT, kernelFT, userFT windows.Filetime
|
||||
r1, _, e1 := procGetSystemTimes.Call(
|
||||
uintptr(unsafe.Pointer(&idleFT)),
|
||||
uintptr(unsafe.Pointer(&kernelFT)),
|
||||
uintptr(unsafe.Pointer(&userFT)),
|
||||
)
|
||||
if r1 == 0 {
|
||||
if errno, _ := e1.(syscall.Errno); errno != 0 {
|
||||
return 0, errno
|
||||
}
|
||||
return 0, errors.New("GetSystemTimes failed")
|
||||
}
|
||||
|
||||
idle := ftToUint64(idleFT)
|
||||
kernel := ftToUint64(kernelFT)
|
||||
user := ftToUint64(userFT)
|
||||
|
||||
cpuMu.Lock()
|
||||
defer cpuMu.Unlock()
|
||||
|
||||
if !hasLast {
|
||||
lastIdle = idle
|
||||
lastKernel = kernel
|
||||
lastUser = user
|
||||
hasLast = true
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
idleDelta := idle - lastIdle
|
||||
kernelDelta := kernel - lastKernel
|
||||
userDelta := user - lastUser
|
||||
|
||||
lastIdle = idle
|
||||
lastKernel = kernel
|
||||
lastUser = user
|
||||
|
||||
total := kernelDelta + userDelta
|
||||
if total == 0 {
|
||||
return 0, nil
|
||||
}
|
||||
// kernel time includes idle on Windows; busy = total - idle
|
||||
busy := total - idleDelta
|
||||
|
||||
pct := float64(busy) / float64(total) * 100.0
|
||||
if pct > 100 {
|
||||
pct = 100
|
||||
}
|
||||
return pct, nil
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
package wireguard
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
|
||||
"golang.org/x/crypto/curve25519"
|
||||
)
|
||||
|
||||
// GenerateWireguardKeypair generates a base64 encoded private and public key pair for Wireguard.
|
||||
func GenerateWireguardKeypair() (privateKey string, publicKey string, err error) {
|
||||
var priv [32]byte
|
||||
if _, err := rand.Read(priv[:]); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
priv[0] &= 248
|
||||
priv[31] &= 127
|
||||
priv[31] |= 64
|
||||
|
||||
var pub [32]byte
|
||||
curve25519.ScalarBaseMult(&pub, &priv)
|
||||
|
||||
return base64.StdEncoding.EncodeToString(priv[:]), base64.StdEncoding.EncodeToString(pub[:]), nil
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/integration"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/panel"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/tgbot"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// APIController handles the main API routes for the 3x-ui panel, including inbounds and server management.
|
||||
type APIController struct {
|
||||
BaseController
|
||||
inboundController *InboundController
|
||||
serverController *ServerController
|
||||
nodeController *NodeController
|
||||
settingController *SettingController
|
||||
xraySettingController *XraySettingController
|
||||
settingService service.SettingService
|
||||
userService panel.UserService
|
||||
apiTokenService panel.ApiTokenService
|
||||
Tgbot tgbot.Tgbot
|
||||
}
|
||||
|
||||
// NewAPIController creates a new APIController instance and initializes its routes.
|
||||
func NewAPIController(g *gin.RouterGroup, customGeo *integration.CustomGeoService) *APIController {
|
||||
a := &APIController{}
|
||||
a.initRouter(g, customGeo)
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *APIController) checkAPIAuth(c *gin.Context) {
|
||||
auth := c.GetHeader("Authorization")
|
||||
if after, ok := strings.CutPrefix(auth, "Bearer "); ok {
|
||||
tok := after
|
||||
if a.apiTokenService.Match(tok) {
|
||||
if u, err := a.userService.GetFirstUser(); err == nil {
|
||||
session.SetAPIAuthUser(c, u)
|
||||
}
|
||||
c.Set("api_authed", true)
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
}
|
||||
if !session.IsLogin(c) {
|
||||
if c.GetHeader("X-Requested-With") == "XMLHttpRequest" {
|
||||
c.AbortWithStatus(http.StatusUnauthorized)
|
||||
} else {
|
||||
c.AbortWithStatus(http.StatusNotFound)
|
||||
}
|
||||
return
|
||||
}
|
||||
c.Next()
|
||||
}
|
||||
|
||||
// initRouter sets up the API routes for inbounds, server, and other endpoints.
|
||||
func (a *APIController) initRouter(g *gin.RouterGroup, customGeo *integration.CustomGeoService) {
|
||||
// Main API group
|
||||
api := g.Group("/panel/api")
|
||||
api.Use(a.checkAPIAuth)
|
||||
api.Use(middleware.CSRFMiddleware())
|
||||
|
||||
// Inbounds API
|
||||
inbounds := api.Group("/inbounds")
|
||||
a.inboundController = NewInboundController(inbounds)
|
||||
|
||||
clients := api.Group("/clients")
|
||||
NewClientController(clients)
|
||||
NewGroupController(clients)
|
||||
|
||||
// Server API
|
||||
server := api.Group("/server")
|
||||
a.serverController = NewServerController(server)
|
||||
|
||||
// Nodes API — multi-panel management
|
||||
nodes := api.Group("/nodes")
|
||||
a.nodeController = NewNodeController(nodes)
|
||||
|
||||
NewCustomGeoController(api.Group("/custom-geo"), customGeo)
|
||||
|
||||
// Settings + Xray config management live under the API surface too, so the
|
||||
// same API token drives them. Paths are /panel/api/setting/* and
|
||||
// /panel/api/xray/*.
|
||||
a.settingController = NewSettingController(api)
|
||||
a.xraySettingController = NewXraySettingController(api)
|
||||
|
||||
// Extra routes
|
||||
api.POST("/backuptotgbot", a.BackuptoTgbot)
|
||||
}
|
||||
|
||||
// BackuptoTgbot sends a backup of the panel data to Telegram bot admins.
|
||||
func (a *APIController) BackuptoTgbot(c *gin.Context) {
|
||||
a.Tgbot.SendBackupToAdmins()
|
||||
}
|
||||
@@ -0,0 +1,165 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type routeDef struct {
|
||||
Method string
|
||||
Path string
|
||||
}
|
||||
|
||||
// routePattern matches route registrations like g.GET("/path", handler) or api.GET("/path", handler)
|
||||
var routePattern = regexp.MustCompile(`\b(g|api)\.(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\("([^"]+)"`)
|
||||
|
||||
// docRoutePattern matches { method: 'X', path: 'Y' ... } entries in endpoints.ts.
|
||||
var docRoutePattern = regexp.MustCompile(`method:\s*'([A-Z]+)'\s*,\s*path:\s*'([^']+)'`)
|
||||
|
||||
// buildDocSet parses frontend/src/pages/api-docs/endpoints.ts and returns the
|
||||
// set of documented "METHOD PATH" keys. WS pseudo-routes and subscription
|
||||
// placeholders (paths starting with /{...}) are skipped because they aren't
|
||||
// registered on the main Gin engine.
|
||||
func buildDocSet(t *testing.T) map[string]bool {
|
||||
t.Helper()
|
||||
controllerDir, err := filepath.Abs(".")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to get current dir: %v", err)
|
||||
}
|
||||
endpointsPath := filepath.Join(controllerDir, "..", "..", "..", "frontend", "src", "pages", "api-docs", "endpoints.ts")
|
||||
data, err := os.ReadFile(endpointsPath)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to read endpoints.ts at %s: %v", endpointsPath, err)
|
||||
}
|
||||
docSet := make(map[string]bool)
|
||||
for _, m := range docRoutePattern.FindAllStringSubmatch(string(data), -1) {
|
||||
method, path := m[1], m[2]
|
||||
if method == "WS" {
|
||||
continue
|
||||
}
|
||||
if !strings.HasPrefix(path, "/") || strings.HasPrefix(path, "/{") {
|
||||
continue
|
||||
}
|
||||
docSet[method+" "+path] = true
|
||||
}
|
||||
if len(docSet) == 0 {
|
||||
t.Fatalf("no documented routes parsed from %s — regex or file format may have changed", endpointsPath)
|
||||
}
|
||||
return docSet
|
||||
}
|
||||
|
||||
func TestAPIRoutesDocumented(t *testing.T) {
|
||||
docSet := buildDocSet(t)
|
||||
|
||||
controllerDir, err := filepath.Abs(".")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to get current dir: %v", err)
|
||||
}
|
||||
|
||||
var allRoutes []routeDef
|
||||
|
||||
entries, err := os.ReadDir(controllerDir)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to read controller dir: %v", err)
|
||||
}
|
||||
|
||||
for _, entry := range entries {
|
||||
if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".go") || strings.HasSuffix(entry.Name(), "_test.go") {
|
||||
continue
|
||||
}
|
||||
data, err := os.ReadFile(filepath.Join(controllerDir, entry.Name()))
|
||||
if err != nil {
|
||||
t.Fatalf("failed to read %s: %v", entry.Name(), err)
|
||||
}
|
||||
src := string(data)
|
||||
|
||||
// Determine the base path for this file based on its initRouter patterns
|
||||
basePath := ""
|
||||
switch entry.Name() {
|
||||
case "index.go":
|
||||
basePath = ""
|
||||
case "spa.go":
|
||||
basePath = "/panel"
|
||||
case "api.go":
|
||||
basePath = "/panel/api"
|
||||
case "inbound.go":
|
||||
basePath = "/panel/api/inbounds"
|
||||
case "client.go":
|
||||
basePath = "/panel/api/clients"
|
||||
case "group.go":
|
||||
basePath = "/panel/api/clients"
|
||||
case "server.go":
|
||||
basePath = "/panel/api/server"
|
||||
case "node.go":
|
||||
basePath = "/panel/api/nodes"
|
||||
case "setting.go":
|
||||
basePath = "/panel/api/setting"
|
||||
case "xray_setting.go":
|
||||
basePath = "/panel/api/xray"
|
||||
case "custom_geo.go":
|
||||
basePath = "/panel/api/custom-geo"
|
||||
case "websocket.go":
|
||||
basePath = ""
|
||||
}
|
||||
|
||||
// Find all route registrations
|
||||
matches := routePattern.FindAllStringSubmatch(src, -1)
|
||||
for _, m := range matches {
|
||||
method := m[2]
|
||||
path := strings.TrimSpace(m[3])
|
||||
if basePath == "" {
|
||||
allRoutes = append(allRoutes, routeDef{Method: method, Path: path})
|
||||
} else {
|
||||
fullPath := basePath + path
|
||||
allRoutes = append(allRoutes, routeDef{Method: method, Path: fullPath})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The WebSocket route /ws is registered in web/web.go (not a controller file)
|
||||
allRoutes = append(allRoutes, routeDef{Method: "GET", Path: "/ws"})
|
||||
|
||||
missingFromDocs := 0
|
||||
foundInDoc := 0
|
||||
sourceSet := make(map[string]bool)
|
||||
|
||||
for _, r := range allRoutes {
|
||||
key := r.Method + " " + r.Path
|
||||
// Skip SPA page routes (these are UI pages, not API endpoints)
|
||||
spaPages := map[string]bool{
|
||||
"/": true, "/panel/": true, "/panel/inbounds": true,
|
||||
"/panel/clients": true, "/panel/groups": true,
|
||||
"/panel/nodes": true, "/panel/settings": true,
|
||||
"/panel/xray": true, "/panel/api-docs": true,
|
||||
}
|
||||
if spaPages[r.Path] {
|
||||
continue
|
||||
}
|
||||
// Skip /panel/csrf-token (documented under auth as /csrf-token)
|
||||
if r.Path == "/panel/csrf-token" {
|
||||
continue
|
||||
}
|
||||
// Skip Chrome DevTools route
|
||||
if strings.Contains(r.Path, ".well-known") {
|
||||
continue
|
||||
}
|
||||
|
||||
sourceSet[key] = true
|
||||
if docSet[key] {
|
||||
foundInDoc++
|
||||
} else {
|
||||
missingFromDocs++
|
||||
t.Errorf("Route not documented in endpoints.ts: %s %s", r.Method, r.Path)
|
||||
}
|
||||
}
|
||||
|
||||
t.Logf("Routes found in source: %d, documented: %d, matching: %d, missing: %d",
|
||||
len(sourceSet), len(docSet), foundInDoc, missingFromDocs)
|
||||
|
||||
if missingFromDocs > 0 {
|
||||
t.Errorf("Found %d undocumented route(s). Update endpoints.ts to match.", missingFromDocs)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
// Package controller provides HTTP request handlers and controllers for the 3x-ui web management panel.
|
||||
// It handles routing, authentication, and API endpoints for managing Xray inbounds, settings, and more.
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/locale"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// BaseController provides common functionality for all controllers, including authentication checks.
|
||||
type BaseController struct{}
|
||||
|
||||
// checkLogin is a middleware that verifies user authentication and handles unauthorized access.
|
||||
func (a *BaseController) checkLogin(c *gin.Context) {
|
||||
if !session.IsLogin(c) {
|
||||
if isAjax(c) {
|
||||
pureJsonMsg(c, http.StatusUnauthorized, false, I18nWeb(c, "pages.login.loginAgain"))
|
||||
} else {
|
||||
c.Header("Cache-Control", "no-store")
|
||||
c.Redirect(http.StatusTemporaryRedirect, c.GetString("base_path"))
|
||||
}
|
||||
c.Abort()
|
||||
} else {
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// I18nWeb retrieves an internationalized message for the web interface based on the current locale.
|
||||
func I18nWeb(c *gin.Context, name string, params ...string) string {
|
||||
anyfunc, funcExists := c.Get("I18n")
|
||||
if !funcExists {
|
||||
logger.Warning("I18n function not exists in gin context!")
|
||||
return ""
|
||||
}
|
||||
i18nFunc, _ := anyfunc.(func(i18nType locale.I18nType, key string, keyParams ...string) string)
|
||||
msg := i18nFunc(locale.Web, name, params...)
|
||||
return msg
|
||||
}
|
||||
@@ -0,0 +1,498 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
func notifyClientsChanged() {
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeClients)
|
||||
}
|
||||
|
||||
func parseInboundIdsQuery(raw string) []int {
|
||||
raw = strings.TrimSpace(raw)
|
||||
if raw == "" {
|
||||
return nil
|
||||
}
|
||||
parts := strings.Split(raw, ",")
|
||||
ids := make([]int, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
if id, err := strconv.Atoi(strings.TrimSpace(p)); err == nil {
|
||||
ids = append(ids, id)
|
||||
}
|
||||
}
|
||||
return ids
|
||||
}
|
||||
|
||||
type ClientController struct {
|
||||
clientService service.ClientService
|
||||
inboundService service.InboundService
|
||||
xrayService service.XrayService
|
||||
settingService service.SettingService
|
||||
}
|
||||
|
||||
func NewClientController(g *gin.RouterGroup) *ClientController {
|
||||
a := &ClientController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *ClientController) initRouter(g *gin.RouterGroup) {
|
||||
g.GET("/list", a.list)
|
||||
g.GET("/list/paged", a.listPaged)
|
||||
g.GET("/get/:email", a.get)
|
||||
g.GET("/traffic/:email", a.getTrafficByEmail)
|
||||
g.GET("/subLinks/:subId", a.getSubLinks)
|
||||
g.GET("/links/:email", a.getClientLinks)
|
||||
|
||||
g.POST("/add", a.create)
|
||||
g.POST("/update/:email", a.update)
|
||||
g.POST("/del/:email", a.delete)
|
||||
g.POST("/:email/attach", a.attach)
|
||||
g.POST("/:email/detach", a.detach)
|
||||
g.POST("/resetAllTraffics", a.resetAllTraffics)
|
||||
g.POST("/delDepleted", a.delDepleted)
|
||||
g.POST("/bulkAdjust", a.bulkAdjust)
|
||||
g.POST("/bulkDel", a.bulkDelete)
|
||||
g.POST("/bulkCreate", a.bulkCreate)
|
||||
g.POST("/bulkAttach", a.bulkAttach)
|
||||
g.POST("/bulkDetach", a.bulkDetach)
|
||||
g.POST("/bulkResetTraffic", a.bulkResetTraffic)
|
||||
g.POST("/resetTraffic/:email", a.resetTrafficByEmail)
|
||||
g.POST("/updateTraffic/:email", a.updateTrafficByEmail)
|
||||
g.POST("/ips/:email", a.getIps)
|
||||
g.POST("/clearIps/:email", a.clearIps)
|
||||
g.POST("/onlines", a.onlines)
|
||||
g.POST("/onlinesByGuid", a.onlinesByGuid)
|
||||
g.POST("/activeInbounds", a.activeInbounds)
|
||||
g.POST("/lastOnline", a.lastOnline)
|
||||
}
|
||||
|
||||
func (a *ClientController) list(c *gin.Context) {
|
||||
rows, err := a.clientService.List()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, rows, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) listPaged(c *gin.Context) {
|
||||
var params service.ClientPageParams
|
||||
if err := c.ShouldBindQuery(¶ms); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
resp, err := a.clientService.ListPaged(&a.inboundService, &a.settingService, params)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, resp, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) get(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
rec, err := a.clientService.GetRecordByEmail(nil, email)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
inboundIds, err := a.clientService.GetInboundIdsForRecord(rec.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
flow, err := a.clientService.EffectiveFlow(nil, rec.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
rec.Flow = flow
|
||||
jsonObj(c, gin.H{"client": rec, "inboundIds": inboundIds}, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) create(c *gin.Context) {
|
||||
var payload service.ClientCreatePayload
|
||||
if err := c.ShouldBindJSON(&payload); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
needRestart, err := a.clientService.Create(&a.inboundService, &payload)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientAddSuccess"), pendingNodeObj(a.inboundService.AnyNodePending(payload.InboundIds)), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) update(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
var updated model.Client
|
||||
if err := c.ShouldBindJSON(&updated); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
inboundFilter := parseInboundIdsQuery(c.Query("inboundIds"))
|
||||
needRestart, err := a.clientService.UpdateByEmail(&a.inboundService, email, updated, inboundFilter...)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientUpdateSuccess"), pendingNodeObj(a.clientService.HasPendingNode(&a.inboundService, email)), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) delete(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
keepTraffic := c.Query("keepTraffic") == "1"
|
||||
needRestart, err := a.clientService.DeleteByEmail(&a.inboundService, email, keepTraffic)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientDeleteSuccess"), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type attachDetachBody struct {
|
||||
InboundIds []int `json:"inboundIds"`
|
||||
}
|
||||
|
||||
func (a *ClientController) attach(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
var body attachDetachBody
|
||||
if err := c.ShouldBindJSON(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
needRestart, err := a.clientService.AttachByEmail(&a.inboundService, email, body.InboundIds)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientAddSuccess"), pendingNodeObj(a.inboundService.AnyNodePending(body.InboundIds)), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) resetAllTraffics(c *gin.Context) {
|
||||
needRestart, err := a.clientService.ResetAllTraffics()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.resetAllClientTrafficSuccess"), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkAdjustRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
AddDays int `json:"addDays"`
|
||||
AddBytes int64 `json:"addBytes"`
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkAdjust(c *gin.Context) {
|
||||
var req bulkAdjustRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkAdjust(&a.inboundService, req.Emails, req.AddDays, req.AddBytes)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkDeleteRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
KeepTraffic bool `json:"keepTraffic"`
|
||||
}
|
||||
|
||||
type bulkAttachRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
InboundIds []int `json:"inboundIds"`
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkAttach(c *gin.Context) {
|
||||
var req bulkAttachRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkAttach(&a.inboundService, req.Emails, req.InboundIds)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkDetachRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
InboundIds []int `json:"inboundIds"`
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkDetach(c *gin.Context) {
|
||||
var req bulkDetachRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkDetach(&a.inboundService, req.Emails, req.InboundIds)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkDelete(c *gin.Context) {
|
||||
var req bulkDeleteRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkDelete(&a.inboundService, req.Emails, req.KeepTraffic)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkCreate(c *gin.Context) {
|
||||
var payloads []service.ClientCreatePayload
|
||||
if err := c.ShouldBindJSON(&payloads); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkCreate(&a.inboundService, payloads)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) delDepleted(c *gin.Context) {
|
||||
deleted, needRestart, err := a.clientService.DelDepleted(&a.inboundService)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"deleted": deleted}, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) resetTrafficByEmail(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
needRestart, err := a.clientService.ResetTrafficByEmail(&a.inboundService, email)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.resetInboundClientTrafficSuccess"), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type trafficUpdateRequest struct {
|
||||
Upload int64 `json:"upload"`
|
||||
Download int64 `json:"download"`
|
||||
}
|
||||
|
||||
func (a *ClientController) updateTrafficByEmail(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
var req trafficUpdateRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if err := a.inboundService.UpdateClientTrafficByEmail(email, req.Upload, req.Download); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientUpdateSuccess"), nil)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
func (a *ClientController) getIps(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
ips, err := a.inboundService.GetInboundClientIps(email)
|
||||
if err != nil || ips == "" {
|
||||
jsonObj(c, "No IP Record", nil)
|
||||
return
|
||||
}
|
||||
type ipWithTimestamp struct {
|
||||
IP string `json:"ip"`
|
||||
Timestamp int64 `json:"timestamp"`
|
||||
}
|
||||
var ipsWithTime []ipWithTimestamp
|
||||
if err := json.Unmarshal([]byte(ips), &ipsWithTime); err == nil && len(ipsWithTime) > 0 {
|
||||
formatted := make([]string, 0, len(ipsWithTime))
|
||||
for _, item := range ipsWithTime {
|
||||
if item.IP == "" {
|
||||
continue
|
||||
}
|
||||
if item.Timestamp > 0 {
|
||||
ts := time.Unix(item.Timestamp, 0).Local().Format("2006-01-02 15:04:05")
|
||||
formatted = append(formatted, fmt.Sprintf("%s (%s)", item.IP, ts))
|
||||
continue
|
||||
}
|
||||
formatted = append(formatted, item.IP)
|
||||
}
|
||||
jsonObj(c, formatted, nil)
|
||||
return
|
||||
}
|
||||
var oldIps []string
|
||||
if err := json.Unmarshal([]byte(ips), &oldIps); err == nil && len(oldIps) > 0 {
|
||||
jsonObj(c, oldIps, nil)
|
||||
return
|
||||
}
|
||||
jsonObj(c, ips, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) clearIps(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
if err := a.inboundService.ClearClientIps(email); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.updateSuccess"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.logCleanSuccess"), nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) onlines(c *gin.Context) {
|
||||
jsonObj(c, a.inboundService.GetOnlineClients(), nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) onlinesByGuid(c *gin.Context) {
|
||||
jsonObj(c, a.inboundService.GetOnlineClientsByGuid(), nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) activeInbounds(c *gin.Context) {
|
||||
jsonObj(c, a.inboundService.GetActiveInboundsByGuid(), nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) lastOnline(c *gin.Context) {
|
||||
data, err := a.inboundService.GetClientsLastOnline()
|
||||
jsonObj(c, data, err)
|
||||
}
|
||||
|
||||
func (a *ClientController) getTrafficByEmail(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
traffic, err := a.inboundService.GetClientTrafficByEmail(email)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.trafficGetError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, traffic, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) getSubLinks(c *gin.Context) {
|
||||
links, err := a.inboundService.GetSubLinks(resolveHost(c), c.Param("subId"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, links, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) getClientLinks(c *gin.Context) {
|
||||
links, err := a.inboundService.GetAllClientLinks(resolveHost(c), c.Param("email"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, links, nil)
|
||||
}
|
||||
|
||||
func (a *ClientController) detach(c *gin.Context) {
|
||||
email := c.Param("email")
|
||||
var body attachDetachBody
|
||||
if err := c.ShouldBindJSON(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
needRestart, err := a.clientService.DetachByEmailMany(&a.inboundService, email, body.InboundIds)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundClientDeleteSuccess"), pendingNodeObj(a.inboundService.AnyNodePending(body.InboundIds)), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkResetRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
}
|
||||
|
||||
func (a *ClientController) bulkResetTraffic(c *gin.Context) {
|
||||
var req bulkResetRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
affected, err := a.clientService.BulkResetTraffic(&a.inboundService, req.Emails)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"affected": affected}, nil)
|
||||
a.xrayService.SetToNeedRestart()
|
||||
notifyClientsChanged()
|
||||
}
|
||||
@@ -0,0 +1,180 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/integration"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type CustomGeoController struct {
|
||||
BaseController
|
||||
customGeoService *integration.CustomGeoService
|
||||
}
|
||||
|
||||
func NewCustomGeoController(g *gin.RouterGroup, customGeo *integration.CustomGeoService) *CustomGeoController {
|
||||
a := &CustomGeoController{customGeoService: customGeo}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) initRouter(g *gin.RouterGroup) {
|
||||
g.GET("/list", a.list)
|
||||
g.GET("/aliases", a.aliases)
|
||||
g.POST("/add", a.add)
|
||||
g.POST("/update/:id", a.update)
|
||||
g.POST("/delete/:id", a.delete)
|
||||
g.POST("/download/:id", a.download)
|
||||
g.POST("/update-all", a.updateAll)
|
||||
}
|
||||
|
||||
func mapCustomGeoErr(c *gin.Context, err error) error {
|
||||
if err == nil {
|
||||
return nil
|
||||
}
|
||||
switch {
|
||||
case errors.Is(err, integration.ErrCustomGeoInvalidType):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrInvalidType"))
|
||||
case errors.Is(err, integration.ErrCustomGeoAliasRequired):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrAliasRequired"))
|
||||
case errors.Is(err, integration.ErrCustomGeoAliasPattern):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrAliasPattern"))
|
||||
case errors.Is(err, integration.ErrCustomGeoAliasReserved):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrAliasReserved"))
|
||||
case errors.Is(err, integration.ErrCustomGeoURLRequired):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrUrlRequired"))
|
||||
case errors.Is(err, integration.ErrCustomGeoInvalidURL):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrInvalidUrl"))
|
||||
case errors.Is(err, integration.ErrCustomGeoURLScheme):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrUrlScheme"))
|
||||
case errors.Is(err, integration.ErrCustomGeoURLHost):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrUrlHost"))
|
||||
case errors.Is(err, integration.ErrCustomGeoDuplicateAlias):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrDuplicateAlias"))
|
||||
case errors.Is(err, integration.ErrCustomGeoNotFound):
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrNotFound"))
|
||||
case errors.Is(err, integration.ErrCustomGeoDownload):
|
||||
logger.Warning("custom geo download:", err)
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrDownload"))
|
||||
case errors.Is(err, integration.ErrCustomGeoSSRFBlocked):
|
||||
logger.Warning("custom geo SSRF blocked:", err)
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrUrlHost"))
|
||||
case errors.Is(err, integration.ErrCustomGeoPathTraversal):
|
||||
logger.Warning("custom geo path traversal blocked:", err)
|
||||
return errors.New(I18nWeb(c, "pages.index.customGeoErrDownload"))
|
||||
default:
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) list(c *gin.Context) {
|
||||
list, err := a.customGeoService.GetAll()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastList"), mapCustomGeoErr(c, err))
|
||||
return
|
||||
}
|
||||
jsonObj(c, list, nil)
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) aliases(c *gin.Context) {
|
||||
out, err := a.customGeoService.GetAliasesForUI()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoAliasesError"), mapCustomGeoErr(c, err))
|
||||
return
|
||||
}
|
||||
jsonObj(c, out, nil)
|
||||
}
|
||||
|
||||
type customGeoForm struct {
|
||||
Type string `json:"type" form:"type"`
|
||||
Alias string `json:"alias" form:"alias"`
|
||||
Url string `json:"url" form:"url"`
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) add(c *gin.Context) {
|
||||
var form customGeoForm
|
||||
if err := c.ShouldBind(&form); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastAdd"), err)
|
||||
return
|
||||
}
|
||||
r := &model.CustomGeoResource{
|
||||
Type: form.Type,
|
||||
Alias: form.Alias,
|
||||
Url: form.Url,
|
||||
}
|
||||
err := a.customGeoService.Create(r)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastAdd"), mapCustomGeoErr(c, err))
|
||||
}
|
||||
|
||||
func parseCustomGeoID(c *gin.Context, idStr string) (int, bool) {
|
||||
id, err := strconv.Atoi(idStr)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoInvalidId"), err)
|
||||
return 0, false
|
||||
}
|
||||
if id <= 0 {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoInvalidId"), errors.New(""))
|
||||
return 0, false
|
||||
}
|
||||
return id, true
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) update(c *gin.Context) {
|
||||
id, ok := parseCustomGeoID(c, c.Param("id"))
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var form customGeoForm
|
||||
if bindErr := c.ShouldBind(&form); bindErr != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastUpdate"), bindErr)
|
||||
return
|
||||
}
|
||||
r := &model.CustomGeoResource{
|
||||
Type: form.Type,
|
||||
Alias: form.Alias,
|
||||
Url: form.Url,
|
||||
}
|
||||
err := a.customGeoService.Update(id, r)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastUpdate"), mapCustomGeoErr(c, err))
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) delete(c *gin.Context) {
|
||||
id, ok := parseCustomGeoID(c, c.Param("id"))
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
name, err := a.customGeoService.Delete(id)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastDelete", "fileName=="+name), mapCustomGeoErr(c, err))
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) download(c *gin.Context) {
|
||||
id, ok := parseCustomGeoID(c, c.Param("id"))
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
name, err := a.customGeoService.TriggerUpdate(id)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastDownload", "fileName=="+name), mapCustomGeoErr(c, err))
|
||||
}
|
||||
|
||||
func (a *CustomGeoController) updateAll(c *gin.Context) {
|
||||
res, err := a.customGeoService.TriggerUpdateAll()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.customGeoToastUpdateAll"), mapCustomGeoErr(c, err))
|
||||
return
|
||||
}
|
||||
if len(res.Failed) > 0 {
|
||||
c.JSON(http.StatusOK, entity.Msg{
|
||||
Success: false,
|
||||
Msg: I18nWeb(c, "pages.index.customGeoErrUpdateAllIncomplete"),
|
||||
Obj: res,
|
||||
})
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.index.customGeoToastUpdateAll"), res, nil)
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"embed"
|
||||
"encoding/json"
|
||||
htmlpkg "html"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/config"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
)
|
||||
|
||||
var distFS embed.FS
|
||||
|
||||
func SetDistFS(fs embed.FS) {
|
||||
distFS = fs
|
||||
}
|
||||
|
||||
var distPageBuildTime = time.Now()
|
||||
|
||||
// ServeOpenAPISpec returns the generated OpenAPI 3.0 description of the
|
||||
// panel API. Postman / Insomnia / openapi-generator consume this URL
|
||||
// directly; the in-panel Swagger UI page also fetches it. The spec is
|
||||
// produced at frontend build time by scripts/build-openapi.mjs and
|
||||
// embedded into the binary via the dist FS.
|
||||
func ServeOpenAPISpec(c *gin.Context) {
|
||||
body, err := distFS.ReadFile("dist/openapi.json")
|
||||
if err != nil {
|
||||
c.JSON(http.StatusNotFound, gin.H{"success": false, "msg": "openapi.json not found"})
|
||||
return
|
||||
}
|
||||
|
||||
// The embedded spec ships with `servers: [{url: "/"}]`. When the panel runs
|
||||
// under a non-root web base path, Swagger UI "Try it out" and external
|
||||
// generators must target that prefix, so rewrite the single server entry to
|
||||
// the runtime base path before serving.
|
||||
if basePath := c.GetString("base_path"); basePath != "" && basePath != "/" {
|
||||
if rebuilt, err := withServerBasePath(body, basePath); err != nil {
|
||||
logger.Warning("openapi.json: could not inject base path:", err)
|
||||
} else {
|
||||
body = rebuilt
|
||||
}
|
||||
}
|
||||
|
||||
c.Header("Cache-Control", "public, max-age=300")
|
||||
c.Data(http.StatusOK, "application/json; charset=utf-8", body)
|
||||
}
|
||||
|
||||
// withServerBasePath rewrites the spec's `servers` entry so requests target the
|
||||
// panel's configured web base path. Only the top-level `servers` field is
|
||||
// replaced; every other field is preserved verbatim via json.RawMessage.
|
||||
func withServerBasePath(spec []byte, basePath string) ([]byte, error) {
|
||||
var doc map[string]json.RawMessage
|
||||
if err := json.Unmarshal(spec, &doc); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
servers, err := json.Marshal([]map[string]string{{
|
||||
"url": strings.TrimSuffix(basePath, "/"),
|
||||
"description": "Current panel",
|
||||
}})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
doc["servers"] = servers
|
||||
return json.Marshal(doc)
|
||||
}
|
||||
|
||||
func serveDistPage(c *gin.Context, name string) {
|
||||
body, err := distFS.ReadFile("dist/" + name)
|
||||
if err != nil {
|
||||
c.String(http.StatusInternalServerError, "missing embedded page: %s", name)
|
||||
return
|
||||
}
|
||||
|
||||
basePath := c.GetString("base_path")
|
||||
if basePath == "" {
|
||||
basePath = "/"
|
||||
}
|
||||
|
||||
if basePath != "/" {
|
||||
body = bytes.ReplaceAll(body, []byte(`src="/assets/`), []byte(`src="`+basePath+`assets/`))
|
||||
body = bytes.ReplaceAll(body, []byte(`href="/assets/`), []byte(`href="`+basePath+`assets/`))
|
||||
}
|
||||
|
||||
jsEscape := strings.NewReplacer(
|
||||
`\`, `\\`,
|
||||
`"`, `\"`,
|
||||
"\n", `\n`,
|
||||
"\r", `\r`,
|
||||
"<", `<`,
|
||||
">", `>`,
|
||||
"&", `&`,
|
||||
)
|
||||
escapedBase := jsEscape.Replace(basePath)
|
||||
csrfToken, err := session.EnsureCSRFToken(c)
|
||||
if err != nil {
|
||||
logger.Warning("Unable to mint CSRF token for", name+":", err)
|
||||
csrfToken = ""
|
||||
}
|
||||
csrfMeta := []byte(`<meta name="csrf-token" content="` + htmlpkg.EscapeString(csrfToken) + `">`)
|
||||
basePathMeta := []byte(`<meta name="base-path" content="` + htmlpkg.EscapeString(basePath) + `">`)
|
||||
|
||||
nonceAttr := ""
|
||||
if nonce := c.GetString("csp_nonce"); nonce != "" {
|
||||
nonceAttr = ` nonce="` + htmlpkg.EscapeString(nonce) + `"`
|
||||
}
|
||||
script := `<script` + nonceAttr + `>window.X_UI_BASE_PATH="` + escapedBase + `"`
|
||||
if name != "login.html" {
|
||||
escapedVer := jsEscape.Replace(config.GetVersion())
|
||||
script += `;window.X_UI_CUR_VER="` + escapedVer + `"`
|
||||
script += `;window.X_UI_DB_TYPE="` + config.GetDBKind() + `"`
|
||||
}
|
||||
script += `;</script>`
|
||||
inject := []byte(script)
|
||||
inject = append(inject, csrfMeta...)
|
||||
inject = append(inject, basePathMeta...)
|
||||
inject = append(inject, []byte(`</head>`)...)
|
||||
out := bytes.Replace(body, []byte("</head>"), inject, 1)
|
||||
|
||||
c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
|
||||
c.Header("Pragma", "no-cache")
|
||||
c.Header("Expires", "0")
|
||||
c.Header("Last-Modified", distPageBuildTime.UTC().Format(http.TimeFormat))
|
||||
c.Data(http.StatusOK, "text/html; charset=utf-8", out)
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestWithServerBasePath(t *testing.T) {
|
||||
spec := []byte(`{"openapi":"3.0.3","info":{"title":"x"},"servers":[{"url":"/","description":"old"}],"paths":{"/p":{"get":{"summary":"s"}}}}`)
|
||||
|
||||
out, err := withServerBasePath(spec, "/test/")
|
||||
if err != nil {
|
||||
t.Fatalf("withServerBasePath: %v", err)
|
||||
}
|
||||
|
||||
var doc map[string]any
|
||||
if err := json.Unmarshal(out, &doc); err != nil {
|
||||
t.Fatalf("unmarshal result: %v", err)
|
||||
}
|
||||
|
||||
servers, ok := doc["servers"].([]any)
|
||||
if !ok || len(servers) != 1 {
|
||||
t.Fatalf("servers = %v, want one entry", doc["servers"])
|
||||
}
|
||||
srv, _ := servers[0].(map[string]any)
|
||||
if srv["url"] != "/test" {
|
||||
t.Errorf("server url = %v, want /test (trailing slash trimmed)", srv["url"])
|
||||
}
|
||||
|
||||
if doc["openapi"] != "3.0.3" {
|
||||
t.Errorf("openapi field not preserved: %v", doc["openapi"])
|
||||
}
|
||||
if _, ok := doc["paths"].(map[string]any)["/p"]; !ok {
|
||||
t.Errorf("paths content not preserved verbatim")
|
||||
}
|
||||
}
|
||||
|
||||
func TestWithServerBasePathInvalidJSON(t *testing.T) {
|
||||
if _, err := withServerBasePath([]byte("not json"), "/test/"); err == nil {
|
||||
t.Errorf("expected error on invalid spec, got nil")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,154 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type GroupController struct {
|
||||
clientService service.ClientService
|
||||
xrayService service.XrayService
|
||||
}
|
||||
|
||||
func NewGroupController(g *gin.RouterGroup) *GroupController {
|
||||
a := &GroupController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *GroupController) initRouter(g *gin.RouterGroup) {
|
||||
g.GET("/groups", a.list)
|
||||
g.GET("/groups/:name/emails", a.emails)
|
||||
g.POST("/groups/create", a.create)
|
||||
g.POST("/groups/rename", a.rename)
|
||||
g.POST("/groups/delete", a.delete)
|
||||
g.POST("/groups/bulkAdd", a.bulkAdd)
|
||||
g.POST("/groups/bulkRemove", a.bulkRemove)
|
||||
}
|
||||
|
||||
func (a *GroupController) list(c *gin.Context) {
|
||||
rows, err := a.clientService.ListGroups()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, rows, nil)
|
||||
}
|
||||
|
||||
func (a *GroupController) emails(c *gin.Context) {
|
||||
name := c.Param("name")
|
||||
emails, err := a.clientService.EmailsByGroup(name)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, emails, nil)
|
||||
}
|
||||
|
||||
type groupCreateBody struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
func (a *GroupController) create(c *gin.Context) {
|
||||
var body groupCreateBody
|
||||
if err := c.ShouldBindJSON(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if err := a.clientService.CreateGroup(body.Name); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"name": body.Name}, nil)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type groupRenameBody struct {
|
||||
OldName string `json:"oldName"`
|
||||
NewName string `json:"newName"`
|
||||
}
|
||||
|
||||
func (a *GroupController) rename(c *gin.Context) {
|
||||
var body groupRenameBody
|
||||
if err := c.ShouldBindJSON(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
affected, err := a.clientService.RenameGroup(body.OldName, body.NewName)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
a.xrayService.SetToNeedRestart()
|
||||
jsonObj(c, gin.H{"affected": affected}, nil)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type groupDeleteBody struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
func (a *GroupController) delete(c *gin.Context) {
|
||||
var body groupDeleteBody
|
||||
if err := c.ShouldBindJSON(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
affected, err := a.clientService.DeleteGroup(body.Name)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
a.xrayService.SetToNeedRestart()
|
||||
jsonObj(c, gin.H{"affected": affected}, nil)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkAddToGroupRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
Group string `json:"group"`
|
||||
}
|
||||
|
||||
func (a *GroupController) bulkAdd(c *gin.Context) {
|
||||
var req bulkAddToGroupRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if strings.TrimSpace(req.Group) == "" {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), common.NewError("group name is required"))
|
||||
return
|
||||
}
|
||||
affected, err := a.clientService.AddToGroup(req.Emails, req.Group)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"affected": affected}, nil)
|
||||
a.xrayService.SetToNeedRestart()
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkRemoveFromGroupRequest struct {
|
||||
Emails []string `json:"emails"`
|
||||
}
|
||||
|
||||
func (a *GroupController) bulkRemove(c *gin.Context) {
|
||||
var req bulkRemoveFromGroupRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
affected, err := a.clientService.RemoveFromGroup(req.Emails)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"affected": affected}, nil)
|
||||
a.xrayService.SetToNeedRestart()
|
||||
notifyClientsChanged()
|
||||
}
|
||||
@@ -0,0 +1,446 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// InboundController handles HTTP requests related to Xray inbounds management.
|
||||
type InboundController struct {
|
||||
inboundService service.InboundService
|
||||
clientService service.ClientService
|
||||
xrayService service.XrayService
|
||||
fallbackService service.FallbackService
|
||||
}
|
||||
|
||||
// NewInboundController creates a new InboundController and sets up its routes.
|
||||
func NewInboundController(g *gin.RouterGroup) *InboundController {
|
||||
a := &InboundController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// broadcastInboundsUpdateClientLimit is the threshold past which we skip the
|
||||
// full-list push over WebSocket and signal the frontend to re-fetch via REST.
|
||||
// Mirrors the same heuristic used by the periodic traffic job.
|
||||
const broadcastInboundsUpdateClientLimit = 5000
|
||||
|
||||
// broadcastInboundsUpdate fetches and broadcasts the inbound list for userId.
|
||||
// At scale (10k+ clients) the marshaled JSON exceeds the WS payload ceiling,
|
||||
// so we send an invalidate signal instead — frontend re-fetches via REST.
|
||||
// Skipped entirely when no WebSocket clients are connected.
|
||||
func (a *InboundController) broadcastInboundsUpdate(userId int) {
|
||||
if !websocket.HasClients() {
|
||||
return
|
||||
}
|
||||
inbounds, err := a.inboundService.GetInbounds(userId)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
totalClients := 0
|
||||
for _, ib := range inbounds {
|
||||
totalClients += len(ib.ClientStats)
|
||||
}
|
||||
if totalClients > broadcastInboundsUpdateClientLimit {
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeInbounds)
|
||||
return
|
||||
}
|
||||
websocket.BroadcastInbounds(inbounds)
|
||||
}
|
||||
|
||||
// initRouter initializes the routes for inbound-related operations.
|
||||
func (a *InboundController) initRouter(g *gin.RouterGroup) {
|
||||
|
||||
g.GET("/list", a.getInbounds)
|
||||
g.GET("/list/slim", a.getInboundsSlim)
|
||||
g.GET("/options", a.getInboundOptions)
|
||||
g.GET("/get/:id", a.getInbound)
|
||||
g.GET("/:id/fallbacks", a.getFallbacks)
|
||||
|
||||
g.POST("/add", a.addInbound)
|
||||
g.POST("/del/:id", a.delInbound)
|
||||
g.POST("/bulkDel", a.bulkDelInbounds)
|
||||
g.POST("/update/:id", a.updateInbound)
|
||||
g.POST("/setEnable/:id", a.setInboundEnable)
|
||||
g.POST("/:id/resetTraffic", a.resetInboundTraffic)
|
||||
g.POST("/:id/delAllClients", a.delAllInboundClients)
|
||||
g.POST("/resetAllTraffics", a.resetAllTraffics)
|
||||
g.POST("/import", a.importInbound)
|
||||
g.POST("/:id/fallbacks", a.setFallbacks)
|
||||
}
|
||||
|
||||
// getInbounds retrieves the list of inbounds for the logged-in user.
|
||||
func (a *InboundController) getInbounds(c *gin.Context) {
|
||||
user := session.GetLoginUser(c)
|
||||
inbounds, err := a.inboundService.GetInbounds(user.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, inbounds, nil)
|
||||
}
|
||||
|
||||
// getInboundsSlim is the list-page variant that strips full client
|
||||
// payloads from settings.clients[]. Detail-view flows still use /get/:id.
|
||||
func (a *InboundController) getInboundsSlim(c *gin.Context) {
|
||||
user := session.GetLoginUser(c)
|
||||
inbounds, err := a.inboundService.GetInboundsSlim(user.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, inbounds, nil)
|
||||
}
|
||||
|
||||
// getInboundOptions returns a lightweight projection of the user's inbounds
|
||||
// (id, remark, protocol, port, tlsFlowCapable) for pickers in the clients UI.
|
||||
// Avoids shipping per-client settings and traffic stats just to fill a dropdown.
|
||||
func (a *InboundController) getInboundOptions(c *gin.Context) {
|
||||
user := session.GetLoginUser(c)
|
||||
options, err := a.inboundService.GetInboundOptions(user.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, options, nil)
|
||||
}
|
||||
|
||||
// getInbound retrieves a specific inbound by its ID.
|
||||
func (a *InboundController) getInbound(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
inbound, err := a.inboundService.GetInboundDetail(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, inbound, nil)
|
||||
}
|
||||
|
||||
// addInbound creates a new inbound configuration.
|
||||
func (a *InboundController) addInbound(c *gin.Context) {
|
||||
inbound, ok := middleware.BindAndValidate[model.Inbound](c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
inbound.UserId = user.Id
|
||||
// Treat NodeID=0 as "no node" — gin's *int form binding can land on
|
||||
// 0 when the field is absent or empty, and 0 is never a valid Node
|
||||
// row id. Without this normalization the runtime layer would try to
|
||||
// load Node id=0 and surface "record not found".
|
||||
if inbound.NodeID != nil && *inbound.NodeID == 0 {
|
||||
inbound.NodeID = nil
|
||||
}
|
||||
|
||||
inbound, needRestart, err := a.inboundService.AddInbound(inbound)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundCreateSuccess"), inbound, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
// delInbound deletes an inbound configuration by its ID.
|
||||
func (a *InboundController) delInbound(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundDeleteSuccess"), err)
|
||||
return
|
||||
}
|
||||
needRestart, err := a.inboundService.DelInbound(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundDeleteSuccess"), id, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
type bulkDelInboundsRequest struct {
|
||||
Ids []int `json:"ids"`
|
||||
}
|
||||
|
||||
// bulkDelInbounds deletes several inbounds in one call. Failures are
|
||||
// reported per id and the rest still proceed; xray restarts at most once.
|
||||
func (a *InboundController) bulkDelInbounds(c *gin.Context) {
|
||||
var req bulkDelInboundsRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.inboundService.DelInbounds(req.Ids)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
// updateInbound updates an existing inbound configuration.
|
||||
func (a *InboundController) updateInbound(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), err)
|
||||
return
|
||||
}
|
||||
inbound := &model.Inbound{
|
||||
Id: id,
|
||||
}
|
||||
if !middleware.BindAndValidateInto(c, inbound) {
|
||||
return
|
||||
}
|
||||
// Same NodeID=0 → nil normalisation as addInbound. UpdateInbound
|
||||
// loads the existing row's NodeID from DB anyway (Phase 1 doesn't
|
||||
// support migrating an inbound between nodes), but normalising here
|
||||
// keeps the wire shape consistent.
|
||||
if inbound.NodeID != nil && *inbound.NodeID == 0 {
|
||||
inbound.NodeID = nil
|
||||
}
|
||||
inbound, needRestart, err := a.inboundService.UpdateInbound(inbound)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), inbound, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
// setInboundEnable flips only the enable flag of an inbound. This is a
|
||||
// dedicated endpoint because the regular update path serialises the entire
|
||||
// settings JSON (every client) — far too heavy for an interactive switch
|
||||
// on inbounds with thousands of clients. Frontend optimistically updates
|
||||
// the UI; we just persist + sync xray + nudge other open admin sessions.
|
||||
func (a *InboundController) setInboundEnable(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), err)
|
||||
return
|
||||
}
|
||||
type form struct {
|
||||
Enable bool `json:"enable" form:"enable"`
|
||||
}
|
||||
var f form
|
||||
if err := c.ShouldBind(&f); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
needRestart, err := a.inboundService.SetInboundEnable(id, f.Enable)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
// Cross-admin sync: lightweight invalidate signal (a few hundred bytes)
|
||||
// instead of fetching + serialising the whole inbound list. Other open
|
||||
// sessions re-fetch via REST. The toggling admin's own UI already
|
||||
// updated optimistically.
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeInbounds)
|
||||
}
|
||||
|
||||
// resetInboundTraffic resets traffic counters for a specific inbound.
|
||||
func (a *InboundController) resetInboundTraffic(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), err)
|
||||
return
|
||||
}
|
||||
|
||||
err = a.inboundService.ResetInboundTraffic(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
} else {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.resetInboundTrafficSuccess"), nil)
|
||||
}
|
||||
|
||||
// delAllInboundClients removes every client attached to a specific inbound
|
||||
// while keeping the inbound itself. Internally collects the current email
|
||||
// list from settings.clients[] and feeds it into ClientService.BulkDelete,
|
||||
// which handles per-inbound JSON rewriting, runtime user removal, traffic
|
||||
// row cleanup, and the SyncInbound mapping pass in one optimized cycle.
|
||||
func (a *InboundController) delAllInboundClients(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
emails, err := a.inboundService.EmailsByInbound(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if len(emails) == 0 {
|
||||
jsonObj(c, service.BulkDeleteResult{}, nil)
|
||||
return
|
||||
}
|
||||
result, needRestart, err := a.clientService.BulkDelete(&a.inboundService, emails, false)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
// resetAllTraffics resets all traffic counters across all inbounds.
|
||||
func (a *InboundController) resetAllTraffics(c *gin.Context) {
|
||||
err := a.inboundService.ResetAllTraffics()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
} else {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.resetAllTrafficSuccess"), nil)
|
||||
}
|
||||
|
||||
// importInbound imports an inbound configuration from provided data.
|
||||
func (a *InboundController) importInbound(c *gin.Context) {
|
||||
inbound := &model.Inbound{}
|
||||
err := json.Unmarshal([]byte(c.PostForm("data")), inbound)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
inbound.Id = 0
|
||||
inbound.UserId = user.Id
|
||||
// Node IDs are panel-local and not portable across panels. Drop a node
|
||||
// reference that is zero or that points to a node which doesn't exist on
|
||||
// this panel, so a cross-panel export imports as a local inbound instead of
|
||||
// failing with "record not found" when nodePushPlan looks the node up.
|
||||
if inbound.NodeID != nil {
|
||||
if *inbound.NodeID == 0 {
|
||||
inbound.NodeID = nil
|
||||
} else if exists, err := (&service.NodeService{}).NodeExists(*inbound.NodeID); err == nil && !exists {
|
||||
inbound.NodeID = nil
|
||||
}
|
||||
}
|
||||
|
||||
for index := range inbound.ClientStats {
|
||||
inbound.ClientStats[index].Id = 0
|
||||
inbound.ClientStats[index].Enable = true
|
||||
}
|
||||
|
||||
inbound, needRestart, err := a.inboundService.AddInbound(inbound)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.inbounds.toasts.inboundCreateSuccess"), inbound, nil)
|
||||
if needRestart {
|
||||
a.xrayService.SetToNeedRestart()
|
||||
}
|
||||
a.broadcastInboundsUpdate(user.Id)
|
||||
notifyClientsChanged()
|
||||
}
|
||||
|
||||
// resolveHost mirrors what sub.SubService.ResolveRequest does for the host
|
||||
// field: prefers X-Forwarded-Host (first entry of any list, port stripped),
|
||||
// then X-Real-IP, then the host portion of c.Request.Host. Keeping it in the
|
||||
// controller layer means the service interface stays HTTP-agnostic — service
|
||||
// methods receive a plain host string instead of a *gin.Context.
|
||||
func resolveHost(c *gin.Context) string {
|
||||
if isTrustedForwardedRequest(c) {
|
||||
if h := strings.TrimSpace(c.GetHeader("X-Forwarded-Host")); h != "" {
|
||||
if i := strings.Index(h, ","); i >= 0 {
|
||||
h = strings.TrimSpace(h[:i])
|
||||
}
|
||||
if hp, _, err := net.SplitHostPort(h); err == nil {
|
||||
return hp
|
||||
}
|
||||
return h
|
||||
}
|
||||
if h := c.GetHeader("X-Real-IP"); h != "" {
|
||||
return h
|
||||
}
|
||||
}
|
||||
if h, _, err := net.SplitHostPort(c.Request.Host); err == nil {
|
||||
return h
|
||||
}
|
||||
return c.Request.Host
|
||||
}
|
||||
|
||||
// getFallbacks returns the fallback rules attached to the master inbound.
|
||||
func (a *InboundController) getFallbacks(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
rows, err := a.fallbackService.GetByMaster(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, rows, nil)
|
||||
}
|
||||
|
||||
// setFallbacks atomically replaces the master inbound's fallback list
|
||||
// and triggers an Xray restart so the new settings.fallbacks take effect.
|
||||
func (a *InboundController) setFallbacks(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
type body struct {
|
||||
Fallbacks []service.FallbackInput `json:"fallbacks"`
|
||||
}
|
||||
var b body
|
||||
if err := c.ShouldBindJSON(&b); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if err := a.fallbackService.SetByMaster(id, b.Fallbacks); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
a.xrayService.SetToNeedRestart()
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.inboundUpdateSuccess"), nil)
|
||||
}
|
||||
@@ -0,0 +1,169 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"text/template"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/panel"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/tgbot"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// LoginForm represents the login request structure.
|
||||
type LoginForm struct {
|
||||
Username string `json:"username" form:"username"`
|
||||
Password string `json:"password" form:"password"`
|
||||
TwoFactorCode string `json:"twoFactorCode" form:"twoFactorCode"`
|
||||
}
|
||||
|
||||
// IndexController handles the main index and login-related routes.
|
||||
type IndexController struct {
|
||||
BaseController
|
||||
|
||||
settingService service.SettingService
|
||||
userService panel.UserService
|
||||
tgbot tgbot.Tgbot
|
||||
}
|
||||
|
||||
// NewIndexController creates a new IndexController and initializes its routes.
|
||||
func NewIndexController(g *gin.RouterGroup) *IndexController {
|
||||
a := &IndexController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter sets up the routes for index, login, logout, and two-factor authentication.
|
||||
func (a *IndexController) initRouter(g *gin.RouterGroup) {
|
||||
g.GET("/", a.index)
|
||||
g.GET("/csrf-token", a.csrfToken)
|
||||
|
||||
g.POST("/login", middleware.CSRFMiddleware(), a.login)
|
||||
g.POST("/logout", middleware.CSRFMiddleware(), a.logout)
|
||||
g.POST("/getTwoFactorEnable", middleware.CSRFMiddleware(), a.getTwoFactorEnable)
|
||||
}
|
||||
|
||||
// index handles the root route, redirecting logged-in users to the panel or showing the login page.
|
||||
func (a *IndexController) index(c *gin.Context) {
|
||||
if session.IsLogin(c) {
|
||||
c.Header("Cache-Control", "no-store")
|
||||
c.Redirect(http.StatusTemporaryRedirect, c.GetString("base_path")+"panel/")
|
||||
return
|
||||
}
|
||||
serveDistPage(c, "login.html")
|
||||
}
|
||||
|
||||
// login handles user authentication and session creation.
|
||||
func (a *IndexController) login(c *gin.Context) {
|
||||
var form LoginForm
|
||||
|
||||
if err := c.ShouldBind(&form); err != nil {
|
||||
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.invalidFormData"))
|
||||
return
|
||||
}
|
||||
if form.Username == "" {
|
||||
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.emptyUsername"))
|
||||
return
|
||||
}
|
||||
if form.Password == "" {
|
||||
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.emptyPassword"))
|
||||
return
|
||||
}
|
||||
|
||||
remoteIP := getRemoteIp(c)
|
||||
safeUser := template.HTMLEscapeString(form.Username)
|
||||
timeStr := time.Now().Format("2006-01-02 15:04:05")
|
||||
if blockedUntil, ok := defaultLoginLimiter.allow(remoteIP, form.Username); !ok {
|
||||
reason := "too many failed attempts"
|
||||
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339))
|
||||
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
|
||||
Username: safeUser,
|
||||
IP: remoteIP,
|
||||
Time: timeStr,
|
||||
Status: tgbot.LoginFail,
|
||||
Reason: reason,
|
||||
})
|
||||
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.wrongUsernameOrPassword"))
|
||||
return
|
||||
}
|
||||
|
||||
user, checkErr := a.userService.CheckUser(form.Username, form.Password, form.TwoFactorCode)
|
||||
|
||||
if user == nil {
|
||||
reason := loginFailureReason(checkErr)
|
||||
if blockedUntil, blocked := defaultLoginLimiter.registerFailure(remoteIP, form.Username); blocked {
|
||||
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339))
|
||||
} else {
|
||||
logger.Warningf("failed login: username=%q, IP=%q, reason=%q", safeUser, remoteIP, reason)
|
||||
}
|
||||
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
|
||||
Username: safeUser,
|
||||
IP: remoteIP,
|
||||
Time: timeStr,
|
||||
Status: tgbot.LoginFail,
|
||||
Reason: reason,
|
||||
})
|
||||
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.wrongUsernameOrPassword"))
|
||||
return
|
||||
}
|
||||
|
||||
defaultLoginLimiter.registerSuccess(remoteIP, form.Username)
|
||||
logger.Infof("%s logged in successfully, Ip Address: %s\n", safeUser, remoteIP)
|
||||
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
|
||||
Username: safeUser,
|
||||
IP: remoteIP,
|
||||
Time: timeStr,
|
||||
Status: tgbot.LoginSuccess,
|
||||
})
|
||||
|
||||
if err := session.SetLoginUser(c, user); err != nil {
|
||||
logger.Warning("Unable to save session:", err)
|
||||
return
|
||||
}
|
||||
|
||||
logger.Infof("%s logged in successfully", safeUser)
|
||||
jsonMsg(c, I18nWeb(c, "pages.login.toasts.successLogin"), nil)
|
||||
}
|
||||
|
||||
func loginFailureReason(err error) string {
|
||||
if err != nil && err.Error() == "invalid 2fa code" {
|
||||
return "invalid 2FA code"
|
||||
}
|
||||
return "invalid credentials"
|
||||
}
|
||||
|
||||
func (a *IndexController) logout(c *gin.Context) {
|
||||
user := session.GetLoginUser(c)
|
||||
if user != nil {
|
||||
logger.Infof("%s logged out successfully", user.Username)
|
||||
}
|
||||
if err := session.ClearSession(c); err != nil {
|
||||
logger.Warning("Unable to clear session on logout:", err)
|
||||
}
|
||||
c.Header("Cache-Control", "no-store")
|
||||
c.JSON(http.StatusOK, gin.H{"success": true})
|
||||
}
|
||||
|
||||
// csrfToken returns the session CSRF token. Public — the login page
|
||||
// needs a token before authenticating.
|
||||
func (a *IndexController) csrfToken(c *gin.Context) {
|
||||
token, err := session.EnsureCSRFToken(c)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"success": false, "msg": err.Error()})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusOK, gin.H{"success": true, "obj": token})
|
||||
}
|
||||
|
||||
// getTwoFactorEnable retrieves the current status of two-factor authentication.
|
||||
func (a *IndexController) getTwoFactorEnable(c *gin.Context) {
|
||||
status, err := a.settingService.GetTwoFactorEnable()
|
||||
if err == nil {
|
||||
jsonObj(c, status, nil)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
loginLimitMaxFailures = 5
|
||||
loginLimitWindow = 5 * time.Minute
|
||||
loginLimitCooldown = 15 * time.Minute
|
||||
)
|
||||
|
||||
var defaultLoginLimiter = newLoginLimiter(loginLimitMaxFailures, loginLimitWindow, loginLimitCooldown)
|
||||
|
||||
type loginLimiter struct {
|
||||
mu sync.Mutex
|
||||
now func() time.Time
|
||||
maxFailures int
|
||||
window time.Duration
|
||||
cooldown time.Duration
|
||||
attempts map[string]*loginLimitRecord
|
||||
}
|
||||
|
||||
type loginLimitRecord struct {
|
||||
failures []time.Time
|
||||
blockedUntil time.Time
|
||||
}
|
||||
|
||||
func newLoginLimiter(maxFailures int, window, cooldown time.Duration) *loginLimiter {
|
||||
return &loginLimiter{
|
||||
now: time.Now,
|
||||
maxFailures: maxFailures,
|
||||
window: window,
|
||||
cooldown: cooldown,
|
||||
attempts: make(map[string]*loginLimitRecord),
|
||||
}
|
||||
}
|
||||
|
||||
func (l *loginLimiter) allow(ip, username string) (time.Time, bool) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
|
||||
key := loginLimitKey(ip, username)
|
||||
record := l.attempts[key]
|
||||
if record == nil {
|
||||
return time.Time{}, true
|
||||
}
|
||||
now := l.now()
|
||||
if now.Before(record.blockedUntil) {
|
||||
return record.blockedUntil, false
|
||||
}
|
||||
record.blockedUntil = time.Time{}
|
||||
record.failures = pruneLoginFailures(record.failures, now.Add(-l.window))
|
||||
if len(record.failures) == 0 {
|
||||
delete(l.attempts, key)
|
||||
}
|
||||
return time.Time{}, true
|
||||
}
|
||||
|
||||
func (l *loginLimiter) registerFailure(ip, username string) (time.Time, bool) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
|
||||
key := loginLimitKey(ip, username)
|
||||
record := l.attempts[key]
|
||||
if record == nil {
|
||||
record = &loginLimitRecord{}
|
||||
l.attempts[key] = record
|
||||
}
|
||||
now := l.now()
|
||||
record.failures = pruneLoginFailures(record.failures, now.Add(-l.window))
|
||||
record.failures = append(record.failures, now)
|
||||
if len(record.failures) >= l.maxFailures {
|
||||
record.failures = nil
|
||||
record.blockedUntil = now.Add(l.cooldown)
|
||||
return record.blockedUntil, true
|
||||
}
|
||||
return time.Time{}, false
|
||||
}
|
||||
|
||||
func (l *loginLimiter) registerSuccess(ip, username string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
delete(l.attempts, loginLimitKey(ip, username))
|
||||
}
|
||||
|
||||
func loginLimitKey(ip, username string) string {
|
||||
return strings.TrimSpace(ip) + "\x00" + strings.ToLower(strings.TrimSpace(username))
|
||||
}
|
||||
|
||||
func pruneLoginFailures(failures []time.Time, cutoff time.Time) []time.Time {
|
||||
keepFrom := 0
|
||||
for keepFrom < len(failures) && failures[keepFrom].Before(cutoff) {
|
||||
keepFrom++
|
||||
}
|
||||
return failures[keepFrom:]
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestLoginLimiterBlocksAfterConfiguredFailures(t *testing.T) {
|
||||
now := time.Date(2026, 5, 6, 12, 0, 0, 0, time.UTC)
|
||||
limiter := newLoginLimiter(5, 5*time.Minute, 15*time.Minute)
|
||||
limiter.now = func() time.Time { return now }
|
||||
|
||||
for i := range 4 {
|
||||
if _, blocked := limiter.registerFailure("192.0.2.10", "Admin"); blocked {
|
||||
t.Fatalf("failure %d should not block yet", i+1)
|
||||
}
|
||||
if _, ok := limiter.allow("192.0.2.10", "admin"); !ok {
|
||||
t.Fatalf("failure %d should still allow login attempts", i+1)
|
||||
}
|
||||
}
|
||||
|
||||
blockedUntil, blocked := limiter.registerFailure("192.0.2.10", "ADMIN")
|
||||
if !blocked {
|
||||
t.Fatal("fifth failure should start cooldown")
|
||||
}
|
||||
if want := now.Add(15 * time.Minute); !blockedUntil.Equal(want) {
|
||||
t.Fatalf("blocked until %s, want %s", blockedUntil, want)
|
||||
}
|
||||
if _, ok := limiter.allow("192.0.2.10", "admin"); ok {
|
||||
t.Fatal("login should be blocked during cooldown")
|
||||
}
|
||||
|
||||
now = blockedUntil
|
||||
if _, ok := limiter.allow("192.0.2.10", "admin"); !ok {
|
||||
t.Fatal("login should be allowed after cooldown")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginLimiterPrunesOldFailuresAndResetsOnSuccess(t *testing.T) {
|
||||
now := time.Date(2026, 5, 6, 12, 0, 0, 0, time.UTC)
|
||||
limiter := newLoginLimiter(5, 5*time.Minute, 15*time.Minute)
|
||||
limiter.now = func() time.Time { return now }
|
||||
|
||||
for range 4 {
|
||||
limiter.registerFailure("192.0.2.10", "admin")
|
||||
}
|
||||
now = now.Add(6 * time.Minute)
|
||||
if _, blocked := limiter.registerFailure("192.0.2.10", "admin"); blocked {
|
||||
t.Fatal("old failures should be pruned outside the rolling window")
|
||||
}
|
||||
|
||||
limiter.registerSuccess("192.0.2.10", "admin")
|
||||
for i := range 4 {
|
||||
if _, blocked := limiter.registerFailure("192.0.2.10", "admin"); blocked {
|
||||
t.Fatalf("success should reset previous failures; failure %d blocked", i+1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginLimiterSeparatesIPAndUsername(t *testing.T) {
|
||||
now := time.Date(2026, 5, 6, 12, 0, 0, 0, time.UTC)
|
||||
limiter := newLoginLimiter(5, 5*time.Minute, 15*time.Minute)
|
||||
limiter.now = func() time.Time { return now }
|
||||
|
||||
for range 5 {
|
||||
limiter.registerFailure("192.0.2.10", "admin")
|
||||
}
|
||||
if _, ok := limiter.allow("192.0.2.11", "admin"); !ok {
|
||||
t.Fatal("different IP should not be blocked")
|
||||
}
|
||||
if _, ok := limiter.allow("192.0.2.10", "other-admin"); !ok {
|
||||
t.Fatal("different username should not be blocked")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,261 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"slices"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type NodeController struct {
|
||||
nodeService service.NodeService
|
||||
}
|
||||
|
||||
func NewNodeController(g *gin.RouterGroup) *NodeController {
|
||||
a := &NodeController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *NodeController) initRouter(g *gin.RouterGroup) {
|
||||
g.GET("/list", a.list)
|
||||
g.GET("/get/:id", a.get)
|
||||
g.GET("/webCert/:id", a.webCert)
|
||||
|
||||
g.POST("/add", a.add)
|
||||
g.POST("/update/:id", a.update)
|
||||
g.POST("/del/:id", a.del)
|
||||
g.POST("/setEnable/:id", a.setEnable)
|
||||
|
||||
g.POST("/test", a.test)
|
||||
g.POST("/certFingerprint", a.certFingerprint)
|
||||
g.POST("/probe/:id", a.probe)
|
||||
g.POST("/updatePanel", a.updatePanel)
|
||||
g.GET("/history/:id/:metric/:bucket", a.history)
|
||||
}
|
||||
|
||||
func (a *NodeController) list(c *gin.Context) {
|
||||
nodes, err := a.nodeService.GetNodeTree()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.list"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, nodes, nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) get(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
n, err := a.nodeService.GetById(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, n, nil)
|
||||
}
|
||||
|
||||
// webCert returns the node's own web TLS certificate/key file paths so the
|
||||
// inbound form's "Set Cert from Panel" can fill paths that exist on the node.
|
||||
func (a *NodeController) webCert(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
files, err := a.nodeService.GetWebCertFiles(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, files, nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) ensureReachable(c *gin.Context, n *model.Node) error {
|
||||
ctx, cancel := context.WithTimeout(c.Request.Context(), 6*time.Second)
|
||||
defer cancel()
|
||||
if _, err := a.nodeService.Probe(ctx, n); err != nil {
|
||||
return errors.New(service.FriendlyProbeError(err.Error()))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *NodeController) add(c *gin.Context) {
|
||||
n, ok := middleware.BindAndValidate[model.Node](c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
if err := a.ensureReachable(c, n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.add"), err)
|
||||
return
|
||||
}
|
||||
if err := a.nodeService.Create(n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.add"), err)
|
||||
return
|
||||
}
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.nodes.toasts.add"), n, nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) update(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
n, ok := middleware.BindAndValidate[model.Node](c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
if err := a.ensureReachable(c, n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), err)
|
||||
return
|
||||
}
|
||||
if err := a.nodeService.Update(id, n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) del(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
if err := a.nodeService.Delete(id); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.delete"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.delete"), nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) setEnable(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
body := struct {
|
||||
Enable bool `json:"enable" form:"enable"`
|
||||
}{}
|
||||
if err := c.ShouldBind(&body); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), err)
|
||||
return
|
||||
}
|
||||
if err := a.nodeService.SetEnable(id, body.Enable); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.update"), nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) test(c *gin.Context) {
|
||||
n := &model.Node{}
|
||||
if err := c.ShouldBind(n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.test"), err)
|
||||
return
|
||||
}
|
||||
if n.Scheme == "" {
|
||||
n.Scheme = "https"
|
||||
}
|
||||
if n.BasePath == "" {
|
||||
n.BasePath = "/"
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(c.Request.Context(), 6*time.Second)
|
||||
defer cancel()
|
||||
patch, err := a.nodeService.Probe(ctx, n)
|
||||
jsonObj(c, patch.ToUI(err == nil), nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) certFingerprint(c *gin.Context) {
|
||||
n := &model.Node{}
|
||||
if err := c.ShouldBind(n); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.test"), err)
|
||||
return
|
||||
}
|
||||
if n.Scheme == "" {
|
||||
n.Scheme = "https"
|
||||
}
|
||||
if n.BasePath == "" {
|
||||
n.BasePath = "/"
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(c.Request.Context(), 6*time.Second)
|
||||
defer cancel()
|
||||
fp, err := a.nodeService.FetchCertFingerprint(ctx, n)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.test"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, fp, nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) probe(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
n, err := a.nodeService.GetById(id)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.obtain"), err)
|
||||
return
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(c.Request.Context(), 6*time.Second)
|
||||
defer cancel()
|
||||
patch, probeErr := a.nodeService.Probe(ctx, n)
|
||||
if probeErr != nil {
|
||||
patch.Status = "offline"
|
||||
} else {
|
||||
patch.Status = "online"
|
||||
}
|
||||
_ = a.nodeService.UpdateHeartbeat(id, patch)
|
||||
jsonObj(c, patch.ToUI(probeErr == nil), nil)
|
||||
}
|
||||
|
||||
func (a *NodeController) updatePanel(c *gin.Context) {
|
||||
var req struct {
|
||||
Ids []int `json:"ids"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
if len(req.Ids) == 0 {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), fmt.Errorf("no nodes selected"))
|
||||
return
|
||||
}
|
||||
results, err := a.nodeService.UpdatePanels(req.Ids)
|
||||
jsonMsgObj(c, I18nWeb(c, "pages.nodes.toasts.updateStarted"), results, err)
|
||||
}
|
||||
|
||||
func (a *NodeController) history(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "get"), err)
|
||||
return
|
||||
}
|
||||
metric := c.Param("metric")
|
||||
if !slices.Contains(service.NodeMetricKeys, metric) {
|
||||
jsonMsg(c, "invalid metric", fmt.Errorf("unknown metric"))
|
||||
return
|
||||
}
|
||||
bucket, err := strconv.Atoi(c.Param("bucket"))
|
||||
if err != nil || bucket <= 0 || !service.IsAllowedHistoryBucket(bucket) {
|
||||
jsonMsg(c, "invalid bucket", fmt.Errorf("unsupported bucket"))
|
||||
return
|
||||
}
|
||||
jsonObj(c, a.nodeService.AggregateNodeMetric(id, metric, bucket, 60), nil)
|
||||
}
|
||||
@@ -0,0 +1,441 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"regexp"
|
||||
"slices"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/global"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/panel"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
var filenameRegex = regexp.MustCompile(`^[a-zA-Z0-9_\-.]+$`)
|
||||
|
||||
// ServerController handles server management and status-related operations.
|
||||
type ServerController struct {
|
||||
BaseController
|
||||
|
||||
serverService service.ServerService
|
||||
settingService service.SettingService
|
||||
panelService panel.PanelService
|
||||
xrayMetricsService service.XrayMetricsService
|
||||
}
|
||||
|
||||
// NewServerController creates a new ServerController, initializes routes, and starts background tasks.
|
||||
func NewServerController(g *gin.RouterGroup) *ServerController {
|
||||
a := &ServerController{}
|
||||
service.RestoreSystemMetrics()
|
||||
a.initRouter(g)
|
||||
a.startTask()
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter sets up the routes for server status, Xray management, and utility endpoints.
|
||||
func (a *ServerController) initRouter(g *gin.RouterGroup) {
|
||||
|
||||
g.GET("/status", a.status)
|
||||
g.GET("/cpuHistory/:bucket", a.getCpuHistoryBucket)
|
||||
g.GET("/history/:metric/:bucket", a.getMetricHistoryBucket)
|
||||
g.GET("/xrayMetricsState", a.getXrayMetricsState)
|
||||
g.GET("/xrayMetricsHistory/:metric/:bucket", a.getXrayMetricsHistoryBucket)
|
||||
g.GET("/xrayObservatory", a.getXrayObservatory)
|
||||
g.GET("/xrayObservatoryHistory/:tag/:bucket", a.getXrayObservatoryHistoryBucket)
|
||||
g.GET("/getXrayVersion", a.getXrayVersion)
|
||||
g.GET("/getPanelUpdateInfo", a.getPanelUpdateInfo)
|
||||
g.GET("/getConfigJson", a.getConfigJson)
|
||||
g.GET("/getDb", a.getDb)
|
||||
g.GET("/getMigration", a.getMigration)
|
||||
g.GET("/getNewUUID", a.getNewUUID)
|
||||
g.GET("/getWebCertFiles", a.getWebCertFiles)
|
||||
g.GET("/descendants", a.descendants)
|
||||
g.GET("/getNewX25519Cert", a.getNewX25519Cert)
|
||||
g.GET("/getNewmldsa65", a.getNewmldsa65)
|
||||
g.GET("/getNewmlkem768", a.getNewmlkem768)
|
||||
g.GET("/getNewVlessEnc", a.getNewVlessEnc)
|
||||
g.GET("/clientIps", a.getClientIps)
|
||||
|
||||
g.POST("/stopXrayService", a.stopXrayService)
|
||||
g.POST("/restartXrayService", a.restartXrayService)
|
||||
g.POST("/installXray/:version", a.installXray)
|
||||
g.POST("/updatePanel", a.updatePanel)
|
||||
g.POST("/updateGeofile", a.updateGeofile)
|
||||
g.POST("/updateGeofile/:fileName", a.updateGeofile)
|
||||
g.POST("/logs/:count", a.getLogs)
|
||||
g.POST("/xraylogs/:count", a.getXrayLogs)
|
||||
g.POST("/importDB", a.importDB)
|
||||
g.POST("/getNewEchCert", a.getNewEchCert)
|
||||
g.POST("/clientIps", a.setClientIps)
|
||||
}
|
||||
|
||||
// startTask registers the @2s ticker that refreshes server status, samples
|
||||
// xray metrics, and pushes the new snapshot to all websocket subscribers.
|
||||
// State + sampling live in ServerService; the controller only orchestrates
|
||||
// the cross-service side effects (xrayMetrics sample + websocket broadcast).
|
||||
func (a *ServerController) startTask() {
|
||||
c := global.GetWebServer().GetCron()
|
||||
c.AddFunc("@every 2s", func() {
|
||||
status := a.serverService.RefreshStatus()
|
||||
if status == nil {
|
||||
return
|
||||
}
|
||||
a.xrayMetricsService.Sample(time.Now())
|
||||
websocket.BroadcastStatus(status)
|
||||
})
|
||||
c.AddFunc("@every 1m", func() {
|
||||
if err := service.PersistSystemMetrics(); err != nil {
|
||||
logger.Warning("persist system metrics failed:", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// status returns the current server status information.
|
||||
func (a *ServerController) status(c *gin.Context) { jsonObj(c, a.serverService.LastStatus(), nil) }
|
||||
|
||||
func parseHistoryBucket(c *gin.Context) (int, bool) {
|
||||
bucket, err := strconv.Atoi(c.Param("bucket"))
|
||||
if err != nil || bucket <= 0 || !service.IsAllowedHistoryBucket(bucket) {
|
||||
jsonMsg(c, "invalid bucket", fmt.Errorf("unsupported bucket"))
|
||||
return 0, false
|
||||
}
|
||||
return bucket, true
|
||||
}
|
||||
|
||||
// getCpuHistoryBucket retrieves aggregated CPU usage history based on the specified time bucket.
|
||||
// Kept for back-compat; new callers should use /history/cpu/:bucket which
|
||||
// returns {"t","v"} (uniform across all metrics) instead of {"t","cpu"}.
|
||||
func (a *ServerController) getCpuHistoryBucket(c *gin.Context) {
|
||||
bucket, ok := parseHistoryBucket(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
jsonObj(c, a.serverService.AggregateCpuHistory(bucket, 60), nil)
|
||||
}
|
||||
|
||||
// getMetricHistoryBucket returns up to 60 buckets of history for a single
|
||||
// system metric (cpu, mem, netUp, netDown, online, load1/5/15). The
|
||||
// SystemHistoryModal calls one endpoint per active tab.
|
||||
func (a *ServerController) getMetricHistoryBucket(c *gin.Context) {
|
||||
metric := c.Param("metric")
|
||||
if !slices.Contains(service.SystemMetricKeys, metric) {
|
||||
jsonMsg(c, "invalid metric", fmt.Errorf("unknown metric"))
|
||||
return
|
||||
}
|
||||
bucket, ok := parseHistoryBucket(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
jsonObj(c, a.serverService.AggregateSystemMetric(metric, bucket, 60), nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getXrayMetricsState(c *gin.Context) {
|
||||
jsonObj(c, a.xrayMetricsService.State(), nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getXrayMetricsHistoryBucket(c *gin.Context) {
|
||||
metric := c.Param("metric")
|
||||
if !slices.Contains(service.XrayMetricKeys, metric) {
|
||||
jsonMsg(c, "invalid metric", fmt.Errorf("unknown metric"))
|
||||
return
|
||||
}
|
||||
bucket, ok := parseHistoryBucket(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
jsonObj(c, a.xrayMetricsService.AggregateMetric(metric, bucket, 60), nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getXrayObservatory(c *gin.Context) {
|
||||
jsonObj(c, a.xrayMetricsService.ObservatorySnapshot(), nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getXrayObservatoryHistoryBucket(c *gin.Context) {
|
||||
tag := c.Param("tag")
|
||||
if !a.xrayMetricsService.HasObservatoryTag(tag) {
|
||||
jsonMsg(c, "invalid tag", fmt.Errorf("unknown observatory tag"))
|
||||
return
|
||||
}
|
||||
bucket, ok := parseHistoryBucket(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
jsonObj(c, a.xrayMetricsService.AggregateObservatory(tag, bucket, 60), nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getXrayVersion(c *gin.Context) {
|
||||
versions, err := a.serverService.GetXrayVersionsCached()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "getVersion"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, versions, nil)
|
||||
}
|
||||
|
||||
// getPanelUpdateInfo retrieves the current and latest panel version.
|
||||
func (a *ServerController) getPanelUpdateInfo(c *gin.Context) {
|
||||
info, err := a.panelService.GetUpdateInfo()
|
||||
if err != nil {
|
||||
logger.Debug("panel update check failed:", err)
|
||||
c.JSON(http.StatusOK, entity.Msg{Success: false})
|
||||
return
|
||||
}
|
||||
jsonObj(c, info, nil)
|
||||
}
|
||||
|
||||
// installXray installs or updates Xray to the specified version.
|
||||
func (a *ServerController) installXray(c *gin.Context) {
|
||||
version := c.Param("version")
|
||||
err := a.serverService.UpdateXray(version)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.xraySwitchVersionPopover"), err)
|
||||
}
|
||||
|
||||
// updatePanel starts a panel self-update to the latest release.
|
||||
func (a *ServerController) updatePanel(c *gin.Context) {
|
||||
err := a.panelService.StartUpdate()
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.panelUpdateStartedPopover"), err)
|
||||
}
|
||||
|
||||
// updateGeofile updates the specified geo file for Xray.
|
||||
func (a *ServerController) updateGeofile(c *gin.Context) {
|
||||
fileName := c.Param("fileName")
|
||||
|
||||
if fileName != "" && !a.serverService.IsValidGeofileName(fileName) {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.geofileUpdatePopover"),
|
||||
fmt.Errorf("invalid filename: contains unsafe characters or path traversal patterns"))
|
||||
return
|
||||
}
|
||||
|
||||
err := a.serverService.UpdateGeofile(fileName)
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.geofileUpdatePopover"), err)
|
||||
}
|
||||
|
||||
// stopXrayService stops the Xray service.
|
||||
func (a *ServerController) stopXrayService(c *gin.Context) {
|
||||
err := a.serverService.StopXrayService()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.xray.stopError"), err)
|
||||
websocket.BroadcastXrayState("error", err.Error())
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.xray.stopSuccess"), err)
|
||||
websocket.BroadcastXrayState("stop", "")
|
||||
websocket.BroadcastNotification(
|
||||
I18nWeb(c, "pages.xray.stopSuccess"),
|
||||
"Xray service has been stopped",
|
||||
"warning",
|
||||
)
|
||||
}
|
||||
|
||||
// restartXrayService restarts the Xray service.
|
||||
func (a *ServerController) restartXrayService(c *gin.Context) {
|
||||
err := a.serverService.RestartXrayService()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.xray.restartError"), err)
|
||||
websocket.BroadcastXrayState("error", err.Error())
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.xray.restartSuccess"), err)
|
||||
websocket.BroadcastXrayState("running", "")
|
||||
websocket.BroadcastNotification(
|
||||
I18nWeb(c, "pages.xray.restartSuccess"),
|
||||
"Xray service has been restarted successfully",
|
||||
"success",
|
||||
)
|
||||
}
|
||||
|
||||
// getLogs retrieves the application logs based on count, level, and syslog filters.
|
||||
func (a *ServerController) getLogs(c *gin.Context) {
|
||||
logs := a.serverService.GetLogs(c.Param("count"), c.PostForm("level"), c.PostForm("syslog"))
|
||||
jsonObj(c, logs, nil)
|
||||
}
|
||||
|
||||
// getXrayLogs retrieves Xray logs with filtering options for direct, blocked, and proxy traffic.
|
||||
func (a *ServerController) getXrayLogs(c *gin.Context) {
|
||||
freedoms, blackholes := a.serverService.GetDefaultLogOutboundTags()
|
||||
logs := a.serverService.GetXrayLogs(
|
||||
c.Param("count"),
|
||||
c.PostForm("filter"),
|
||||
c.PostForm("showDirect"),
|
||||
c.PostForm("showBlocked"),
|
||||
c.PostForm("showProxy"),
|
||||
freedoms,
|
||||
blackholes,
|
||||
)
|
||||
jsonObj(c, logs, nil)
|
||||
}
|
||||
|
||||
// getConfigJson retrieves the Xray configuration as JSON.
|
||||
func (a *ServerController) getConfigJson(c *gin.Context) {
|
||||
configJson, err := a.serverService.GetConfigJson()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.getConfigError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, configJson, nil)
|
||||
}
|
||||
|
||||
// getDb downloads the database file.
|
||||
func (a *ServerController) getDb(c *gin.Context) {
|
||||
db, err := a.serverService.GetDb()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.getDatabaseError"), err)
|
||||
return
|
||||
}
|
||||
|
||||
filename := "x-ui.db"
|
||||
if database.IsPostgres() {
|
||||
filename = "x-ui.dump"
|
||||
}
|
||||
if !filenameRegex.MatchString(filename) {
|
||||
c.AbortWithError(http.StatusBadRequest, fmt.Errorf("invalid filename"))
|
||||
return
|
||||
}
|
||||
|
||||
c.Header("Content-Type", "application/octet-stream")
|
||||
c.Header("Content-Disposition", "attachment; filename="+filename)
|
||||
c.Writer.Write(db)
|
||||
}
|
||||
|
||||
// getMigration downloads a cross-engine migration file: a .dump on SQLite or a
|
||||
// .db SQLite database on PostgreSQL, so the data can seed the other backend.
|
||||
func (a *ServerController) getMigration(c *gin.Context) {
|
||||
data, filename, err := a.serverService.GetMigration()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.getDatabaseError"), err)
|
||||
return
|
||||
}
|
||||
if !filenameRegex.MatchString(filename) {
|
||||
c.AbortWithError(http.StatusBadRequest, fmt.Errorf("invalid filename"))
|
||||
return
|
||||
}
|
||||
|
||||
c.Header("Content-Type", "application/octet-stream")
|
||||
c.Header("Content-Disposition", "attachment; filename="+filename)
|
||||
c.Writer.Write(data)
|
||||
}
|
||||
|
||||
// importDB imports a database file and restarts the Xray service.
|
||||
func (a *ServerController) importDB(c *gin.Context) {
|
||||
file, _, err := c.Request.FormFile("db")
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.readDatabaseError"), err)
|
||||
return
|
||||
}
|
||||
defer file.Close()
|
||||
if err := a.serverService.ImportDB(file); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.index.importDatabaseError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, I18nWeb(c, "pages.index.importDatabaseSuccess"), nil)
|
||||
}
|
||||
|
||||
// descendants publishes read-only summaries of the nodes this panel manages so
|
||||
// a parent panel can surface them as transitive sub-nodes in a chained
|
||||
// topology. Called by the parent via the node's API token (#4983).
|
||||
func (a *ServerController) descendants(c *gin.Context) {
|
||||
data, err := (&service.NodeService{}).LocalDescendants()
|
||||
jsonObj(c, data, err)
|
||||
}
|
||||
|
||||
// getWebCertFiles returns this panel's own web TLS certificate and key file
|
||||
// paths. The central panel calls it on a node (via the node's API token) so
|
||||
// "Set Cert from Panel" can fill a node-assigned inbound with paths that exist
|
||||
// on the node's filesystem instead of the central panel's — see issue #4854.
|
||||
func (a *ServerController) getWebCertFiles(c *gin.Context) {
|
||||
certFile, err := a.settingService.GetCertFile()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
keyFile, err := a.settingService.GetKeyFile()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, gin.H{"webCertFile": certFile, "webKeyFile": keyFile}, nil)
|
||||
}
|
||||
|
||||
// getNewX25519Cert generates a new X25519 certificate.
|
||||
func (a *ServerController) getNewX25519Cert(c *gin.Context) {
|
||||
cert, err := a.serverService.GetNewX25519Cert()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.getNewX25519CertError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, cert, nil)
|
||||
}
|
||||
|
||||
// getNewmldsa65 generates a new ML-DSA-65 key.
|
||||
func (a *ServerController) getNewmldsa65(c *gin.Context) {
|
||||
cert, err := a.serverService.GetNewmldsa65()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.getNewmldsa65Error"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, cert, nil)
|
||||
}
|
||||
|
||||
// getNewEchCert generates a new ECH certificate for the given SNI.
|
||||
func (a *ServerController) getNewEchCert(c *gin.Context) {
|
||||
cert, err := a.serverService.GetNewEchCert(c.PostForm("sni"))
|
||||
if err != nil {
|
||||
jsonMsg(c, "get ech certificate", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, cert, nil)
|
||||
}
|
||||
|
||||
// getNewVlessEnc generates a new VLESS encryption key.
|
||||
func (a *ServerController) getNewVlessEnc(c *gin.Context) {
|
||||
out, err := a.serverService.GetNewVlessEnc()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.getNewVlessEncError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, out, nil)
|
||||
}
|
||||
|
||||
// getNewUUID generates a new UUID.
|
||||
func (a *ServerController) getNewUUID(c *gin.Context) {
|
||||
uuidResp, err := a.serverService.GetNewUUID()
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to generate UUID", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, uuidResp, nil)
|
||||
}
|
||||
|
||||
// getNewmlkem768 generates a new ML-KEM-768 key.
|
||||
func (a *ServerController) getNewmlkem768(c *gin.Context) {
|
||||
out, err := a.serverService.GetNewmlkem768()
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to generate mlkem768 keys", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, out, nil)
|
||||
}
|
||||
|
||||
func (a *ServerController) getClientIps(c *gin.Context) {
|
||||
ips, err := (&service.InboundService{}).GetAllInboundClientIps()
|
||||
jsonObj(c, ips, err)
|
||||
}
|
||||
|
||||
func (a *ServerController) setClientIps(c *gin.Context) {
|
||||
var ips []model.InboundClientIps
|
||||
if err := c.ShouldBindJSON(&ips); err != nil {
|
||||
jsonMsg(c, "invalid data", err)
|
||||
return
|
||||
}
|
||||
err := (&service.InboundService{}).MergeInboundClientIps(ips)
|
||||
jsonMsg(c, "Client IPs merged", err)
|
||||
}
|
||||
@@ -0,0 +1,189 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/panel"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// updateUserForm represents the form for updating user credentials.
|
||||
type updateUserForm struct {
|
||||
OldUsername string `json:"oldUsername" form:"oldUsername"`
|
||||
OldPassword string `json:"oldPassword" form:"oldPassword"`
|
||||
NewUsername string `json:"newUsername" form:"newUsername"`
|
||||
NewPassword string `json:"newPassword" form:"newPassword"`
|
||||
}
|
||||
|
||||
// SettingController handles settings and user management operations.
|
||||
type SettingController struct {
|
||||
settingService service.SettingService
|
||||
userService panel.UserService
|
||||
panelService panel.PanelService
|
||||
apiTokenService panel.ApiTokenService
|
||||
}
|
||||
|
||||
// NewSettingController creates a new SettingController and initializes its routes.
|
||||
func NewSettingController(g *gin.RouterGroup) *SettingController {
|
||||
a := &SettingController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter sets up the routes for settings management.
|
||||
func (a *SettingController) initRouter(g *gin.RouterGroup) {
|
||||
g = g.Group("/setting")
|
||||
|
||||
g.POST("/all", a.getAllSetting)
|
||||
g.POST("/defaultSettings", a.getDefaultSettings)
|
||||
g.POST("/update", a.updateSetting)
|
||||
g.POST("/updateUser", a.updateUser)
|
||||
g.POST("/restartPanel", a.restartPanel)
|
||||
g.GET("/getDefaultJsonConfig", a.getDefaultXrayConfig)
|
||||
g.GET("/apiTokens", a.listApiTokens)
|
||||
g.POST("/apiTokens/create", a.createApiToken)
|
||||
g.POST("/apiTokens/delete/:id", a.deleteApiToken)
|
||||
g.POST("/apiTokens/setEnabled/:id", a.setApiTokenEnabled)
|
||||
}
|
||||
|
||||
// getAllSetting retrieves all current settings.
|
||||
func (a *SettingController) getAllSetting(c *gin.Context) {
|
||||
allSetting, err := a.settingService.GetAllSetting()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, allSetting, nil)
|
||||
}
|
||||
|
||||
// getDefaultSettings retrieves the default settings based on the host.
|
||||
func (a *SettingController) getDefaultSettings(c *gin.Context) {
|
||||
result, err := a.settingService.GetDefaultSettings(c.Request.Host)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, result, nil)
|
||||
}
|
||||
|
||||
// updateSetting updates all settings with the provided data.
|
||||
func (a *SettingController) updateSetting(c *gin.Context) {
|
||||
allSetting, ok := middleware.BindAndValidate[entity.AllSetting](c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
oldTwoFactor, twoFactorErr := a.settingService.GetTwoFactorEnable()
|
||||
err := a.settingService.UpdateAllSetting(allSetting)
|
||||
if err == nil && twoFactorErr == nil && !oldTwoFactor && allSetting.TwoFactorEnable {
|
||||
if bumpErr := a.userService.BumpLoginEpoch(); bumpErr != nil {
|
||||
err = bumpErr
|
||||
}
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
}
|
||||
|
||||
// updateUser updates the current user's username and password.
|
||||
func (a *SettingController) updateUser(c *gin.Context) {
|
||||
form := &updateUserForm{}
|
||||
err := c.ShouldBind(form)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
user := session.GetLoginUser(c)
|
||||
if user.Username != form.OldUsername || !crypto.CheckPasswordHash(user.Password, form.OldPassword) {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.originalUserPassIncorrect")))
|
||||
return
|
||||
}
|
||||
if form.NewUsername == "" || form.NewPassword == "" {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.userPassMustBeNotEmpty")))
|
||||
return
|
||||
}
|
||||
err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
|
||||
if err == nil {
|
||||
user.Username = form.NewUsername
|
||||
user.Password, _ = crypto.HashPasswordAsBcrypt(form.NewPassword)
|
||||
if saveErr := session.SetLoginUser(c, user); saveErr != nil {
|
||||
err = saveErr
|
||||
}
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUser"), err)
|
||||
}
|
||||
|
||||
// restartPanel restarts the panel service after a delay.
|
||||
func (a *SettingController) restartPanel(c *gin.Context) {
|
||||
err := a.panelService.RestartPanel(time.Second * 3)
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.restartPanelSuccess"), err)
|
||||
}
|
||||
|
||||
// getDefaultXrayConfig retrieves the default Xray configuration.
|
||||
func (a *SettingController) getDefaultXrayConfig(c *gin.Context) {
|
||||
defaultJsonConfig, err := a.settingService.GetDefaultXrayConfig()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, defaultJsonConfig, nil)
|
||||
}
|
||||
|
||||
type apiTokenCreateForm struct {
|
||||
Name string `json:"name" form:"name"`
|
||||
}
|
||||
|
||||
type apiTokenEnabledForm struct {
|
||||
Enabled bool `json:"enabled" form:"enabled"`
|
||||
}
|
||||
|
||||
func (a *SettingController) listApiTokens(c *gin.Context) {
|
||||
rows, err := a.apiTokenService.List()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, rows, nil)
|
||||
}
|
||||
|
||||
func (a *SettingController) createApiToken(c *gin.Context) {
|
||||
form := &apiTokenCreateForm{}
|
||||
if err := c.ShouldBind(form); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
row, err := a.apiTokenService.Create(form.Name)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, row, nil)
|
||||
}
|
||||
|
||||
func (a *SettingController) deleteApiToken(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.Delete(id))
|
||||
}
|
||||
|
||||
func (a *SettingController) setApiTokenEnabled(c *gin.Context) {
|
||||
id, err := strconv.Atoi(c.Param("id"))
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
form := &apiTokenEnabledForm{}
|
||||
if bindErr := c.ShouldBind(form); bindErr != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), bindErr)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.SetEnabled(id, form.Enabled))
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// XUIController is the main controller for the X-UI panel, serving the SPA shell.
|
||||
type XUIController struct {
|
||||
BaseController
|
||||
}
|
||||
|
||||
// NewXUIController creates a new XUIController and initializes its routes.
|
||||
func NewXUIController(g *gin.RouterGroup) *XUIController {
|
||||
a := &XUIController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter sets up the main panel routes and initializes sub-controllers.
|
||||
//
|
||||
// The HTML routes all hand the same single-page-app shell (index.html) to the
|
||||
// browser; React Router takes over and renders the correct page from the URL.
|
||||
// The /panel/api, /panel/setting, /panel/xray sub-routers register POST/JSON
|
||||
// endpoints on different paths and stay untouched by the shell handler.
|
||||
func (a *XUIController) initRouter(g *gin.RouterGroup) {
|
||||
g = g.Group("/panel")
|
||||
g.Use(a.checkLogin)
|
||||
g.Use(middleware.CSRFMiddleware())
|
||||
|
||||
g.GET("/", a.panelSPA)
|
||||
g.GET("/inbounds", a.panelSPA)
|
||||
g.GET("/clients", a.panelSPA)
|
||||
g.GET("/groups", a.panelSPA)
|
||||
g.GET("/nodes", a.panelSPA)
|
||||
g.GET("/settings", a.panelSPA)
|
||||
g.GET("/xray", a.panelSPA)
|
||||
g.GET("/api-docs", a.panelSPA)
|
||||
|
||||
// SPA pages built by Vite don't have a server-rendered <meta name="csrf-token">,
|
||||
// so they fetch the session token via this endpoint at startup and replay it
|
||||
// on subsequent unsafe requests through axios.
|
||||
g.GET("/csrf-token", a.csrfToken)
|
||||
}
|
||||
|
||||
// panelSPA serves the React SPA shell. Every GET under /panel/ that isn't an
|
||||
// API endpoint returns the same index.html — React Router reads the URL and
|
||||
// mounts the matching page on the client.
|
||||
func (a *XUIController) panelSPA(c *gin.Context) {
|
||||
serveDistPage(c, "index.html")
|
||||
}
|
||||
|
||||
// csrfToken returns the session CSRF token to authenticated SPA clients.
|
||||
// The endpoint is GET (a safe method) so it bypasses CSRFMiddleware itself,
|
||||
// but checkLogin still gates the response — anonymous callers get 401/redirect.
|
||||
func (a *XUIController) csrfToken(c *gin.Context) {
|
||||
token, err := session.EnsureCSRFToken(c)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, entity.Msg{Success: false, Msg: err.Error()})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusOK, entity.Msg{Success: true, Obj: token})
|
||||
}
|
||||
@@ -0,0 +1,206 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// getRemoteIp extracts the real IP address from the request headers or remote address.
|
||||
func getRemoteIp(c *gin.Context) string {
|
||||
remoteIP, ok := extractTrustedIP(c.Request.RemoteAddr)
|
||||
if !ok {
|
||||
return "unknown"
|
||||
}
|
||||
|
||||
if isTrustedProxy(remoteIP) {
|
||||
if ip, ok := extractTrustedIP(c.GetHeader("X-Real-IP")); ok {
|
||||
return ip
|
||||
}
|
||||
|
||||
if xff := c.GetHeader("X-Forwarded-For"); xff != "" {
|
||||
for part := range strings.SplitSeq(xff, ",") {
|
||||
if ip, ok := extractTrustedIP(part); ok {
|
||||
return ip
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return remoteIP
|
||||
}
|
||||
|
||||
func isTrustedForwardedRequest(c *gin.Context) bool {
|
||||
remoteIP, ok := extractTrustedIP(c.Request.RemoteAddr)
|
||||
return ok && isTrustedProxy(remoteIP)
|
||||
}
|
||||
|
||||
func isTrustedProxy(ip string) bool {
|
||||
addr, err := netip.ParseAddr(ip)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
trusted := trustedProxyCIDRs()
|
||||
for value := range strings.SplitSeq(trusted, ",") {
|
||||
value = strings.TrimSpace(value)
|
||||
if value == "" {
|
||||
continue
|
||||
}
|
||||
if prefix, err := netip.ParsePrefix(value); err == nil {
|
||||
if prefix.Contains(addr) {
|
||||
return true
|
||||
}
|
||||
continue
|
||||
}
|
||||
if proxyIP, err := netip.ParseAddr(value); err == nil && proxyIP.Unmap() == addr.Unmap() {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func trustedProxyCIDRs() (trusted string) {
|
||||
trusted = "127.0.0.1/32,::1/128"
|
||||
defer func() {
|
||||
_ = recover()
|
||||
}()
|
||||
settingService := service.SettingService{}
|
||||
if value, err := settingService.GetTrustedProxyCIDRs(); err == nil && strings.TrimSpace(value) != "" {
|
||||
trusted = value
|
||||
}
|
||||
return trusted
|
||||
}
|
||||
|
||||
func extractTrustedIP(value string) (string, bool) {
|
||||
candidate := strings.TrimSpace(value)
|
||||
if candidate == "" {
|
||||
return "", false
|
||||
}
|
||||
|
||||
if ip, ok := parseIPCandidate(candidate); ok {
|
||||
return ip.String(), true
|
||||
}
|
||||
|
||||
if host, _, err := net.SplitHostPort(candidate); err == nil {
|
||||
if ip, ok := parseIPCandidate(host); ok {
|
||||
return ip.String(), true
|
||||
}
|
||||
}
|
||||
|
||||
if strings.Count(candidate, ":") == 1 {
|
||||
if host, _, err := net.SplitHostPort(fmt.Sprintf("[%s]", candidate)); err == nil {
|
||||
if ip, ok := parseIPCandidate(host); ok {
|
||||
return ip.String(), true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return "", false
|
||||
}
|
||||
|
||||
func parseIPCandidate(value string) (netip.Addr, bool) {
|
||||
ip, err := netip.ParseAddr(strings.TrimSpace(value))
|
||||
if err != nil {
|
||||
return netip.Addr{}, false
|
||||
}
|
||||
return ip.Unmap(), true
|
||||
}
|
||||
|
||||
// jsonMsg sends a JSON response with a message and error status.
|
||||
func jsonMsg(c *gin.Context, msg string, err error) {
|
||||
jsonMsgObj(c, msg, nil, err)
|
||||
}
|
||||
|
||||
// jsonObj sends a JSON response with an object and error status.
|
||||
func jsonObj(c *gin.Context, obj any, err error) {
|
||||
jsonMsgObj(c, "", obj, err)
|
||||
}
|
||||
|
||||
func requestErrorContext(c *gin.Context) string {
|
||||
handler, loc := callerOutsideUtil()
|
||||
return fmt.Sprintf("[%s %s handler=%s %s]", c.Request.Method, c.Request.URL.Path, handler, loc)
|
||||
}
|
||||
|
||||
func callerOutsideUtil() (string, string) {
|
||||
var pcs [12]uintptr
|
||||
n := runtime.Callers(2, pcs[:])
|
||||
frames := runtime.CallersFrames(pcs[:n])
|
||||
for {
|
||||
frame, more := frames.Next()
|
||||
base := filepath.Base(frame.File)
|
||||
if base != "util.go" {
|
||||
name := frame.Function
|
||||
if idx := strings.LastIndex(name, "/"); idx >= 0 {
|
||||
name = name[idx+1:]
|
||||
}
|
||||
return name, fmt.Sprintf("%s:%d", base, frame.Line)
|
||||
}
|
||||
if !more {
|
||||
break
|
||||
}
|
||||
}
|
||||
return "unknown", "unknown"
|
||||
}
|
||||
|
||||
// jsonMsgObj sends a JSON response with a message, object, and error status.
|
||||
func jsonMsgObj(c *gin.Context, msg string, obj any, err error) {
|
||||
m := entity.Msg{
|
||||
Obj: obj,
|
||||
}
|
||||
if err == nil {
|
||||
m.Success = true
|
||||
if msg != "" {
|
||||
m.Msg = msg
|
||||
}
|
||||
} else {
|
||||
m.Success = false
|
||||
ctx := requestErrorContext(c)
|
||||
fail := I18nWeb(c, "fail")
|
||||
errStr := err.Error()
|
||||
if errStr != "" {
|
||||
m.Msg = msg + " (" + errStr + ")"
|
||||
logger.Warningf("%s %s %s: %v", ctx, msg, fail, err)
|
||||
} else if msg != "" {
|
||||
m.Msg = msg
|
||||
logger.Warningf("%s %s %s", ctx, msg, fail)
|
||||
} else {
|
||||
m.Msg = I18nWeb(c, "somethingWentWrong")
|
||||
logger.Warningf("%s %s %s", ctx, m.Msg, fail)
|
||||
}
|
||||
}
|
||||
c.JSON(http.StatusOK, m)
|
||||
}
|
||||
|
||||
// pendingNodeObj returns a response object flagging that the save committed
|
||||
// locally but a backing node was offline/disabled, so the change will be
|
||||
// mirrored to the node once it reconnects. Returns nil when nothing is pending.
|
||||
func pendingNodeObj(pending bool) any {
|
||||
if pending {
|
||||
return gin.H{"nodePending": true}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// pureJsonMsg sends a pure JSON message response with custom status code.
|
||||
func pureJsonMsg(c *gin.Context, statusCode int, success bool, msg string) {
|
||||
c.JSON(statusCode, entity.Msg{
|
||||
Success: success,
|
||||
Msg: msg,
|
||||
})
|
||||
}
|
||||
|
||||
// isAjax checks if the request is an AJAX request.
|
||||
func isAjax(c *gin.Context) bool {
|
||||
return c.GetHeader("X-Requested-With") == "XMLHttpRequest"
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
func TestGetRemoteIpIgnoresForwardedHeadersFromUntrustedRemote(t *testing.T) {
|
||||
gin.SetMode(gin.TestMode)
|
||||
c, _ := gin.CreateTestContext(httptest.NewRecorder())
|
||||
c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
c.Request.RemoteAddr = "203.0.113.10:12345"
|
||||
c.Request.Header.Set("X-Real-IP", "198.51.100.9")
|
||||
c.Request.Header.Set("X-Forwarded-For", "198.51.100.8")
|
||||
|
||||
if got := getRemoteIp(c); got != "203.0.113.10" {
|
||||
t.Fatalf("remote IP = %q, want request remote address", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetRemoteIpHonorsForwardedHeadersFromTrustedLoopbackProxy(t *testing.T) {
|
||||
gin.SetMode(gin.TestMode)
|
||||
c, _ := gin.CreateTestContext(httptest.NewRecorder())
|
||||
c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
c.Request.RemoteAddr = "127.0.0.1:12345"
|
||||
c.Request.Header.Set("X-Forwarded-For", "198.51.100.8, 127.0.0.1")
|
||||
|
||||
if got := getRemoteIp(c); got != "198.51.100.8" {
|
||||
t.Fatalf("remote IP = %q, want forwarded client IP", got)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/panel"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/session"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
ws "github.com/gorilla/websocket"
|
||||
)
|
||||
|
||||
var upgrader = ws.Upgrader{
|
||||
ReadBufferSize: 32768,
|
||||
WriteBufferSize: 32768,
|
||||
EnableCompression: true,
|
||||
CheckOrigin: checkSameOrigin,
|
||||
}
|
||||
|
||||
// checkSameOrigin allows requests with no Origin header (same-origin or non-browser
|
||||
// clients) and otherwise requires the Origin hostname to match the request hostname.
|
||||
// Comparison is case-insensitive (RFC 7230 §2.7.3) and ignores port differences
|
||||
// (the panel often sits behind a reverse proxy on a different port).
|
||||
func checkSameOrigin(r *http.Request) bool {
|
||||
origin := r.Header.Get("Origin")
|
||||
if origin == "" {
|
||||
return true
|
||||
}
|
||||
u, err := url.Parse(origin)
|
||||
if err != nil || u.Hostname() == "" {
|
||||
return false
|
||||
}
|
||||
host, _, err := net.SplitHostPort(r.Host)
|
||||
if err != nil {
|
||||
// IPv6 literals without a port arrive as "[::1]"; net.SplitHostPort
|
||||
// fails in that case while url.Hostname() returns the address without
|
||||
// brackets. Strip them so same-origin checks pass for bare IPv6 hosts.
|
||||
host = r.Host
|
||||
if len(host) >= 2 && host[0] == '[' && host[len(host)-1] == ']' {
|
||||
host = host[1 : len(host)-1]
|
||||
}
|
||||
}
|
||||
return strings.EqualFold(u.Hostname(), host)
|
||||
}
|
||||
|
||||
// WebSocketController handles the HTTP→WebSocket upgrade for real-time updates.
|
||||
// All per-connection lifecycle (pumps, hub registration) lives in
|
||||
// panel.WebSocketService — this controller is HTTP-layer only.
|
||||
type WebSocketController struct {
|
||||
BaseController
|
||||
service *panel.WebSocketService
|
||||
}
|
||||
|
||||
// NewWebSocketController creates a controller wired to the given service.
|
||||
func NewWebSocketController(svc *panel.WebSocketService) *WebSocketController {
|
||||
return &WebSocketController{service: svc}
|
||||
}
|
||||
|
||||
// HandleWebSocket authenticates the request, upgrades the HTTP connection, and
|
||||
// hands ownership of the connection off to the service.
|
||||
func (w *WebSocketController) HandleWebSocket(c *gin.Context) {
|
||||
if !session.IsLogin(c) {
|
||||
logger.Warningf("Unauthorized WebSocket connection attempt from %s", getRemoteIp(c))
|
||||
c.AbortWithStatus(http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
|
||||
if err != nil {
|
||||
logger.Error("Failed to upgrade WebSocket connection:", err)
|
||||
return
|
||||
}
|
||||
|
||||
w.service.HandleConnection(conn, getRemoteIp(c))
|
||||
}
|
||||
@@ -0,0 +1,419 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/integration"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/outbound"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// XraySettingController handles Xray configuration and settings operations.
|
||||
type XraySettingController struct {
|
||||
XraySettingService service.XraySettingService
|
||||
SettingService service.SettingService
|
||||
InboundService service.InboundService
|
||||
OutboundService outbound.OutboundService
|
||||
XrayService service.XrayService
|
||||
WarpService integration.WarpService
|
||||
NordService integration.NordService
|
||||
OutboundSubscriptionService service.OutboundSubscriptionService
|
||||
}
|
||||
|
||||
// NewXraySettingController creates a new XraySettingController and initializes its routes.
|
||||
func NewXraySettingController(g *gin.RouterGroup) *XraySettingController {
|
||||
a := &XraySettingController{}
|
||||
a.initRouter(g)
|
||||
return a
|
||||
}
|
||||
|
||||
// initRouter sets up the routes for Xray settings management.
|
||||
func (a *XraySettingController) initRouter(g *gin.RouterGroup) {
|
||||
g = g.Group("/xray")
|
||||
g.GET("/getDefaultJsonConfig", a.getDefaultXrayConfig)
|
||||
g.GET("/getOutboundsTraffic", a.getOutboundsTraffic)
|
||||
g.GET("/getXrayResult", a.getXrayResult)
|
||||
|
||||
g.POST("/", a.getXraySetting)
|
||||
g.POST("/warp/:action", a.warp)
|
||||
g.POST("/nord/:action", a.nord)
|
||||
g.POST("/update", a.updateSetting)
|
||||
g.POST("/resetOutboundsTraffic", a.resetOutboundsTraffic)
|
||||
g.POST("/testOutbound", a.testOutbound)
|
||||
|
||||
// Outbound subscription (remote outbound lists)
|
||||
g.GET("/outbound-subs", a.listOutboundSubs)
|
||||
g.POST("/outbound-subs", a.createOutboundSub)
|
||||
g.POST("/outbound-subs/:id/refresh", a.refreshOutboundSub)
|
||||
g.POST("/outbound-subs/:id/move", a.moveOutboundSub)
|
||||
g.POST("/outbound-subs/:id", a.updateOutboundSub)
|
||||
g.DELETE("/outbound-subs/:id", a.deleteOutboundSub)
|
||||
g.POST("/outbound-subs/:id/del", a.deleteOutboundSub) // axios-friendly alias
|
||||
g.POST("/outbound-subs/parse", a.parseOutboundSubURL) // preview without saving
|
||||
}
|
||||
|
||||
// getXraySetting retrieves the Xray configuration template, inbound tags, and outbound test URL.
|
||||
func (a *XraySettingController) getXraySetting(c *gin.Context) {
|
||||
xraySetting, err := a.SettingService.GetXrayConfigTemplate()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
// Older versions of this handler embedded the raw DB value as
|
||||
// `xraySetting` in the response without checking if the value
|
||||
// already had that wrapper shape. When the frontend saved it
|
||||
// back through the textarea verbatim, the wrapper got persisted
|
||||
// and every subsequent save nested another layer, which is what
|
||||
// eventually produced the blank Xray Settings page in #4059.
|
||||
// Strip any such wrapper here, and heal the DB if we found one so
|
||||
// the next read is O(1) instead of climbing the same pile again.
|
||||
if unwrapped := service.UnwrapXrayTemplateConfig(xraySetting); unwrapped != xraySetting {
|
||||
if saveErr := a.XraySettingService.SaveXraySetting(unwrapped); saveErr == nil {
|
||||
xraySetting = unwrapped
|
||||
} else {
|
||||
// Don't fail the read — just serve the unwrapped value
|
||||
// and leave the DB healing for a later save.
|
||||
xraySetting = unwrapped
|
||||
}
|
||||
}
|
||||
inboundTags, err := a.InboundService.GetInboundTags()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
clientReverseTags, err := a.InboundService.GetClientReverseTags()
|
||||
if err != nil {
|
||||
clientReverseTags = "[]"
|
||||
}
|
||||
outboundTestUrl, _ := a.SettingService.GetXrayOutboundTestUrl()
|
||||
if outboundTestUrl == "" {
|
||||
outboundTestUrl = "https://www.google.com/generate_204"
|
||||
}
|
||||
xrayResponse := map[string]any{
|
||||
"xraySetting": json.RawMessage(xraySetting),
|
||||
"inboundTags": json.RawMessage(inboundTags),
|
||||
"clientReverseTags": json.RawMessage(clientReverseTags),
|
||||
"outboundTestUrl": outboundTestUrl,
|
||||
}
|
||||
|
||||
// Surface subscription outbounds (and their tags) so the frontend can:
|
||||
// - show them as read-only items in the Outbounds tab
|
||||
// - let users pick them in balancers and routing rules
|
||||
// These are not part of the editable template; they are injected at runtime.
|
||||
if subObs, err := a.OutboundSubscriptionService.AllActiveOutbounds(); err == nil && len(subObs) > 0 {
|
||||
xrayResponse["subscriptionOutbounds"] = subObs
|
||||
}
|
||||
if subTags, err := a.OutboundSubscriptionService.AllActiveOutboundTags(); err == nil && len(subTags) > 0 {
|
||||
xrayResponse["subscriptionOutboundTags"] = subTags
|
||||
}
|
||||
result, err := json.Marshal(xrayResponse)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, string(result), nil)
|
||||
}
|
||||
|
||||
// updateSetting updates the Xray configuration settings.
|
||||
func (a *XraySettingController) updateSetting(c *gin.Context) {
|
||||
xraySetting := c.PostForm("xraySetting")
|
||||
if err := a.XraySettingService.SaveXraySetting(xraySetting); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
outboundTestUrl := c.PostForm("outboundTestUrl")
|
||||
if outboundTestUrl == "" {
|
||||
outboundTestUrl = "https://www.google.com/generate_204"
|
||||
}
|
||||
if err := a.SettingService.SetXrayOutboundTestUrl(outboundTestUrl); err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
|
||||
return
|
||||
}
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), nil)
|
||||
}
|
||||
|
||||
// getDefaultXrayConfig retrieves the default Xray configuration.
|
||||
func (a *XraySettingController) getDefaultXrayConfig(c *gin.Context) {
|
||||
defaultJsonConfig, err := a.SettingService.GetDefaultXrayConfig()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getSettings"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, defaultJsonConfig, nil)
|
||||
}
|
||||
|
||||
// getXrayResult retrieves the current Xray service result.
|
||||
func (a *XraySettingController) getXrayResult(c *gin.Context) {
|
||||
jsonObj(c, a.XrayService.GetXrayResult(), nil)
|
||||
}
|
||||
|
||||
// warp handles Warp-related operations based on the action parameter.
|
||||
func (a *XraySettingController) warp(c *gin.Context) {
|
||||
action := c.Param("action")
|
||||
var resp string
|
||||
var err error
|
||||
switch action {
|
||||
case "data":
|
||||
resp, err = a.WarpService.GetWarpData()
|
||||
case "del":
|
||||
err = a.WarpService.DelWarpData()
|
||||
case "config":
|
||||
resp, err = a.WarpService.GetWarpConfig()
|
||||
case "reg":
|
||||
skey := c.PostForm("privateKey")
|
||||
pkey := c.PostForm("publicKey")
|
||||
resp, err = a.WarpService.RegWarp(skey, pkey)
|
||||
case "changeIp":
|
||||
resp, err = a.WarpService.ChangeWarpIP()
|
||||
if err == nil {
|
||||
a.XrayService.SetToNeedRestart()
|
||||
// Restart the auto-update clock so a scheduled rotation
|
||||
// doesn't fire right after this manual one.
|
||||
_ = a.SettingService.SetWarpLastUpdate(time.Now().Unix())
|
||||
}
|
||||
case "license":
|
||||
license := c.PostForm("license")
|
||||
resp, err = a.WarpService.SetWarpLicense(license)
|
||||
case "interval":
|
||||
interval, convErr := strconv.Atoi(c.PostForm("interval"))
|
||||
if convErr != nil || interval < 0 {
|
||||
err = common.NewError("invalid warp update interval")
|
||||
} else if err = a.SettingService.SetWarpUpdateInterval(interval); err == nil && interval > 0 {
|
||||
// Count the interval from now rather than from epoch 0,
|
||||
// otherwise the job would rotate on its next tick.
|
||||
_ = a.SettingService.SetWarpLastUpdate(time.Now().Unix())
|
||||
}
|
||||
}
|
||||
|
||||
jsonObj(c, resp, err)
|
||||
}
|
||||
|
||||
// nord handles NordVPN-related operations based on the action parameter.
|
||||
func (a *XraySettingController) nord(c *gin.Context) {
|
||||
action := c.Param("action")
|
||||
var resp string
|
||||
var err error
|
||||
switch action {
|
||||
case "countries":
|
||||
resp, err = a.NordService.GetCountries()
|
||||
case "servers":
|
||||
countryId := c.PostForm("countryId")
|
||||
resp, err = a.NordService.GetServers(countryId)
|
||||
case "reg":
|
||||
token := c.PostForm("token")
|
||||
resp, err = a.NordService.GetCredentials(token)
|
||||
case "setKey":
|
||||
key := c.PostForm("key")
|
||||
resp, err = a.NordService.SetKey(key)
|
||||
case "data":
|
||||
resp, err = a.NordService.GetNordData()
|
||||
case "del":
|
||||
err = a.NordService.DelNordData()
|
||||
}
|
||||
|
||||
jsonObj(c, resp, err)
|
||||
}
|
||||
|
||||
// getOutboundsTraffic retrieves the traffic statistics for outbounds.
|
||||
func (a *XraySettingController) getOutboundsTraffic(c *gin.Context) {
|
||||
outboundsTraffic, err := a.OutboundService.GetOutboundsTraffic()
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.getOutboundTrafficError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, outboundsTraffic, nil)
|
||||
}
|
||||
|
||||
// resetOutboundsTraffic resets the traffic statistics for the specified outbound tag.
|
||||
func (a *XraySettingController) resetOutboundsTraffic(c *gin.Context) {
|
||||
tag := c.PostForm("tag")
|
||||
err := a.OutboundService.ResetOutboundTraffic(tag)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.resetOutboundTrafficError"), err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, "", nil)
|
||||
}
|
||||
|
||||
// testOutbound tests an outbound configuration and returns the delay/response time.
|
||||
// Optional form "allOutbounds": JSON array of all outbounds; used to resolve sockopt.dialerProxy dependencies.
|
||||
// Optional form "mode": "tcp" for a fast dial-only probe (parallel-safe),
|
||||
// anything else (default) for a full HTTP probe through a temp xray instance.
|
||||
func (a *XraySettingController) testOutbound(c *gin.Context) {
|
||||
outboundJSON := c.PostForm("outbound")
|
||||
allOutboundsJSON := c.PostForm("allOutbounds")
|
||||
mode := c.PostForm("mode")
|
||||
|
||||
if outboundJSON == "" {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), common.NewError("outbound parameter is required"))
|
||||
return
|
||||
}
|
||||
|
||||
// Load the test URL from server settings to prevent SSRF via user-controlled URLs
|
||||
testURL, _ := a.SettingService.GetXrayOutboundTestUrl()
|
||||
testURL, err := service.SanitizePublicHTTPURL(testURL, false)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
|
||||
result, err := a.OutboundService.TestOutbound(outboundJSON, testURL, allOutboundsJSON, mode)
|
||||
if err != nil {
|
||||
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
|
||||
return
|
||||
}
|
||||
|
||||
jsonObj(c, result, nil)
|
||||
}
|
||||
|
||||
// --- Outbound Subscription handlers ---
|
||||
|
||||
func (a *XraySettingController) listOutboundSubs(c *gin.Context) {
|
||||
list, err := a.OutboundSubscriptionService.List()
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to list outbound subscriptions", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, list, nil)
|
||||
}
|
||||
|
||||
func (a *XraySettingController) createOutboundSub(c *gin.Context) {
|
||||
remark := c.PostForm("remark")
|
||||
rawURL := c.PostForm("url")
|
||||
prefix := c.PostForm("tagPrefix")
|
||||
enabled := c.PostForm("enabled") != "false"
|
||||
allowPrivate := c.PostForm("allowPrivate") == "true"
|
||||
prepend := c.PostForm("prepend") == "true"
|
||||
intervalStr := c.PostForm("updateInterval")
|
||||
interval := 600
|
||||
if intervalStr != "" {
|
||||
if v, err := parseIntSafe(intervalStr); err == nil && v > 0 {
|
||||
interval = v
|
||||
}
|
||||
}
|
||||
sub, err := a.OutboundSubscriptionService.Create(remark, rawURL, prefix, enabled, interval, allowPrivate, prepend)
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to create outbound subscription", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, sub, nil)
|
||||
}
|
||||
|
||||
func (a *XraySettingController) updateOutboundSub(c *gin.Context) {
|
||||
id := c.Param("id")
|
||||
var subID int
|
||||
if _, err := fmt.Sscanf(id, "%d", &subID); err != nil {
|
||||
jsonMsg(c, "Invalid id", err)
|
||||
return
|
||||
}
|
||||
remark := c.PostForm("remark")
|
||||
rawURL := c.PostForm("url")
|
||||
prefix := c.PostForm("tagPrefix")
|
||||
enabled := c.PostForm("enabled") != "false"
|
||||
allowPrivate := c.PostForm("allowPrivate") == "true"
|
||||
prepend := c.PostForm("prepend") == "true"
|
||||
intervalStr := c.PostForm("updateInterval")
|
||||
interval := 600
|
||||
if intervalStr != "" {
|
||||
if v, err := parseIntSafe(intervalStr); err == nil && v > 0 {
|
||||
interval = v
|
||||
}
|
||||
}
|
||||
if err := a.OutboundSubscriptionService.Update(subID, remark, rawURL, prefix, enabled, interval, allowPrivate, prepend); err != nil {
|
||||
jsonMsg(c, "Failed to update outbound subscription", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, "", nil)
|
||||
}
|
||||
|
||||
func (a *XraySettingController) deleteOutboundSub(c *gin.Context) {
|
||||
id := c.Param("id")
|
||||
var subID int
|
||||
if _, err := fmt.Sscanf(id, "%d", &subID); err != nil {
|
||||
jsonMsg(c, "Invalid id", err)
|
||||
return
|
||||
}
|
||||
if err := a.OutboundSubscriptionService.Delete(subID); err != nil {
|
||||
jsonMsg(c, "Failed to delete outbound subscription", err)
|
||||
return
|
||||
}
|
||||
// Signal that xray should drop this subscription's outbounds on next reload.
|
||||
a.XrayService.SetToNeedRestart()
|
||||
jsonObj(c, "", nil)
|
||||
}
|
||||
|
||||
func (a *XraySettingController) refreshOutboundSub(c *gin.Context) {
|
||||
id := c.Param("id")
|
||||
var subID int
|
||||
if _, err := fmt.Sscanf(id, "%d", &subID); err != nil {
|
||||
jsonMsg(c, "Invalid id", err)
|
||||
return
|
||||
}
|
||||
obs, err := a.OutboundSubscriptionService.Refresh(subID)
|
||||
if err != nil {
|
||||
jsonMsg(c, "Refresh failed", err)
|
||||
return
|
||||
}
|
||||
// Signal that xray should pick up the new outbounds on next restart/reload
|
||||
a.XrayService.SetToNeedRestart()
|
||||
jsonObj(c, obs, nil)
|
||||
}
|
||||
|
||||
func (a *XraySettingController) moveOutboundSub(c *gin.Context) {
|
||||
id := c.Param("id")
|
||||
var subID int
|
||||
if _, err := fmt.Sscanf(id, "%d", &subID); err != nil {
|
||||
jsonMsg(c, "Invalid id", err)
|
||||
return
|
||||
}
|
||||
up := c.PostForm("dir") == "up"
|
||||
if err := a.OutboundSubscriptionService.Move(subID, up); err != nil {
|
||||
jsonMsg(c, "Failed to reorder outbound subscription", err)
|
||||
return
|
||||
}
|
||||
// Order affects the merged outbounds, so xray needs a reload.
|
||||
a.XrayService.SetToNeedRestart()
|
||||
jsonObj(c, "", nil)
|
||||
}
|
||||
|
||||
// parseOutboundSubURL is a preview endpoint: it fetches + parses the provided
|
||||
// URL but does not persist anything. Useful for the "add subscription" flow
|
||||
// so the user can see the resulting outbounds (and assigned tags) before saving.
|
||||
func (a *XraySettingController) parseOutboundSubURL(c *gin.Context) {
|
||||
rawURL := c.PostForm("url")
|
||||
if rawURL == "" {
|
||||
jsonMsg(c, "url is required", common.NewError("missing url"))
|
||||
return
|
||||
}
|
||||
allowPrivate := c.PostForm("allowPrivate") == "true"
|
||||
// Use a throw-away service instance; it only needs the settingService for proxy.
|
||||
svc := service.OutboundSubscriptionService{}
|
||||
// We don't have a direct "fetch once" that returns without storing, so we
|
||||
// temporarily create a disabled row, refresh it, then delete. Cleaner would
|
||||
// be to expose a pure ParseURL on the service, but this keeps the surface small.
|
||||
tmp, err := svc.Create("preview", rawURL, "", false, 600, allowPrivate, false)
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to preview subscription", err)
|
||||
return
|
||||
}
|
||||
obs, err := svc.Refresh(tmp.Id)
|
||||
// best-effort cleanup
|
||||
_ = svc.Delete(tmp.Id)
|
||||
if err != nil {
|
||||
jsonMsg(c, "Failed to fetch/parse subscription", err)
|
||||
return
|
||||
}
|
||||
jsonObj(c, obs, nil)
|
||||
}
|
||||
|
||||
func parseIntSafe(s string) (int, error) {
|
||||
var v int
|
||||
_, err := fmt.Sscanf(s, "%d", &v)
|
||||
return v, err
|
||||
}
|
||||
@@ -0,0 +1,246 @@
|
||||
// Package entity defines data structures and entities used by the web layer of the 3x-ui panel.
|
||||
package entity
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"math"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
|
||||
)
|
||||
|
||||
// Msg represents a standard API response message with success status, message text, and optional data object.
|
||||
type Msg struct {
|
||||
Success bool `json:"success"` // Indicates if the operation was successful
|
||||
Msg string `json:"msg"` // Response message text
|
||||
Obj any `json:"obj"` // Optional data object
|
||||
}
|
||||
|
||||
// AllSetting contains all configuration settings for the 3x-ui panel including web server, Telegram bot, and subscription settings.
|
||||
type AllSetting struct {
|
||||
// Web server settings
|
||||
WebListen string `json:"webListen" form:"webListen"` // Web server listen IP address
|
||||
WebDomain string `json:"webDomain" form:"webDomain"` // Web server domain for domain validation
|
||||
WebPort int `json:"webPort" form:"webPort" validate:"gte=1,lte=65535"` // Web server port number
|
||||
WebCertFile string `json:"webCertFile" form:"webCertFile"` // Path to SSL certificate file for web server
|
||||
WebKeyFile string `json:"webKeyFile" form:"webKeyFile"` // Path to SSL private key file for web server
|
||||
WebBasePath string `json:"webBasePath" form:"webBasePath"` // Base path for web panel URLs
|
||||
SessionMaxAge int `json:"sessionMaxAge" form:"sessionMaxAge" validate:"gte=1,lte=525600"` // Session maximum age in minutes (cap at one year)
|
||||
TrustedProxyCIDRs string `json:"trustedProxyCIDRs" form:"trustedProxyCIDRs"` // Trusted reverse proxy IPs/CIDRs for forwarded headers
|
||||
PanelProxy string `json:"panelProxy" form:"panelProxy"` // Proxy URL for the panel's own outbound requests (GitHub/Telegram)
|
||||
|
||||
// UI settings
|
||||
PageSize int `json:"pageSize" form:"pageSize" validate:"gte=0,lte=1000"` // Number of items per page in lists (0 disables pagination)
|
||||
ExpireDiff int `json:"expireDiff" form:"expireDiff" validate:"gte=0"` // Expiration warning threshold in days
|
||||
TrafficDiff int `json:"trafficDiff" form:"trafficDiff" validate:"gte=0,lte=100"` // Traffic warning threshold percentage
|
||||
RemarkModel string `json:"remarkModel" form:"remarkModel"` // Remark model pattern for inbounds
|
||||
Datepicker string `json:"datepicker" form:"datepicker"` // Date picker format
|
||||
|
||||
// Telegram bot settings
|
||||
TgBotEnable bool `json:"tgBotEnable" form:"tgBotEnable"` // Enable Telegram bot notifications
|
||||
TgBotToken string `json:"tgBotToken" form:"tgBotToken"` // Telegram bot token
|
||||
TgBotProxy string `json:"tgBotProxy" form:"tgBotProxy"` // Proxy URL for Telegram bot
|
||||
TgBotAPIServer string `json:"tgBotAPIServer" form:"tgBotAPIServer"` // Custom API server for Telegram bot
|
||||
TgBotChatId string `json:"tgBotChatId" form:"tgBotChatId"` // Telegram chat ID for notifications
|
||||
TgRunTime string `json:"tgRunTime" form:"tgRunTime"` // Cron schedule for Telegram notifications
|
||||
TgBotBackup bool `json:"tgBotBackup" form:"tgBotBackup"` // Enable database backup via Telegram
|
||||
TgBotLoginNotify bool `json:"tgBotLoginNotify" form:"tgBotLoginNotify"` // Send login notifications
|
||||
TgCpu int `json:"tgCpu" form:"tgCpu" validate:"gte=0,lte=100"` // CPU usage threshold for alerts (percent)
|
||||
TgLang string `json:"tgLang" form:"tgLang"` // Telegram bot language
|
||||
|
||||
// Security settings
|
||||
TimeLocation string `json:"timeLocation" form:"timeLocation"` // Time zone location
|
||||
TwoFactorEnable bool `json:"twoFactorEnable" form:"twoFactorEnable"` // Enable two-factor authentication
|
||||
TwoFactorToken string `json:"twoFactorToken" form:"twoFactorToken"` // Two-factor authentication token
|
||||
|
||||
// Subscription server settings
|
||||
SubEnable bool `json:"subEnable" form:"subEnable"` // Enable subscription server
|
||||
SubJsonEnable bool `json:"subJsonEnable" form:"subJsonEnable"` // Enable JSON subscription endpoint
|
||||
SubTitle string `json:"subTitle" form:"subTitle"` // Subscription title
|
||||
SubSupportUrl string `json:"subSupportUrl" form:"subSupportUrl"` // Subscription support URL
|
||||
SubProfileUrl string `json:"subProfileUrl" form:"subProfileUrl"` // Subscription profile URL
|
||||
SubAnnounce string `json:"subAnnounce" form:"subAnnounce"` // Subscription announce
|
||||
SubEnableRouting bool `json:"subEnableRouting" form:"subEnableRouting"` // Enable routing for subscription
|
||||
SubRoutingRules string `json:"subRoutingRules" form:"subRoutingRules"` // Subscription global routing rules (Only for Happ)
|
||||
SubListen string `json:"subListen" form:"subListen"` // Subscription server listen IP
|
||||
SubPort int `json:"subPort" form:"subPort" validate:"gte=1,lte=65535"` // Subscription server port
|
||||
SubPath string `json:"subPath" form:"subPath"` // Base path for subscription URLs
|
||||
SubDomain string `json:"subDomain" form:"subDomain"` // Domain for subscription server validation
|
||||
SubCertFile string `json:"subCertFile" form:"subCertFile"` // SSL certificate file for subscription server
|
||||
SubKeyFile string `json:"subKeyFile" form:"subKeyFile"` // SSL private key file for subscription server
|
||||
SubUpdates int `json:"subUpdates" form:"subUpdates" validate:"gte=0,lte=525600"` // Subscription update interval in minutes
|
||||
ExternalTrafficInformEnable bool `json:"externalTrafficInformEnable" form:"externalTrafficInformEnable"` // Enable external traffic reporting
|
||||
ExternalTrafficInformURI string `json:"externalTrafficInformURI" form:"externalTrafficInformURI"` // URI for external traffic reporting
|
||||
RestartXrayOnClientDisable bool `json:"restartXrayOnClientDisable" form:"restartXrayOnClientDisable"` // Restart Xray when clients are auto-disabled by expiry/traffic limit
|
||||
SubEncrypt bool `json:"subEncrypt" form:"subEncrypt"` // Encrypt subscription responses
|
||||
SubShowInfo bool `json:"subShowInfo" form:"subShowInfo"` // Show client information in subscriptions
|
||||
SubEmailInRemark bool `json:"subEmailInRemark" form:"subEmailInRemark"` // Include email in subscription remark/name
|
||||
SubURI string `json:"subURI" form:"subURI"` // Subscription server URI
|
||||
SubJsonPath string `json:"subJsonPath" form:"subJsonPath"` // Path for JSON subscription endpoint
|
||||
SubJsonURI string `json:"subJsonURI" form:"subJsonURI"` // JSON subscription server URI
|
||||
SubClashEnable bool `json:"subClashEnable" form:"subClashEnable"` // Enable Clash/Mihomo subscription endpoint
|
||||
SubClashPath string `json:"subClashPath" form:"subClashPath"` // Path for Clash/Mihomo subscription endpoint
|
||||
SubClashURI string `json:"subClashURI" form:"subClashURI"` // Clash/Mihomo subscription server URI
|
||||
SubClashEnableRouting bool `json:"subClashEnableRouting" form:"subClashEnableRouting"` // Enable global routing rules for Clash/Mihomo
|
||||
SubClashRules string `json:"subClashRules" form:"subClashRules"` // Clash/Mihomo global routing rules
|
||||
SubJsonMux string `json:"subJsonMux" form:"subJsonMux"` // JSON subscription mux configuration
|
||||
SubJsonRules string `json:"subJsonRules" form:"subJsonRules"`
|
||||
SubJsonFinalMask string `json:"subJsonFinalMask" form:"subJsonFinalMask"` // JSON subscription global finalmask (tcp/udp masks + quicParams)
|
||||
SubThemeDir string `json:"subThemeDir" form:"subThemeDir"` // Absolute path to a folder containing a custom subscription page template
|
||||
|
||||
// LDAP settings
|
||||
LdapEnable bool `json:"ldapEnable" form:"ldapEnable"`
|
||||
LdapHost string `json:"ldapHost" form:"ldapHost"`
|
||||
LdapPort int `json:"ldapPort" form:"ldapPort" validate:"gte=0,lte=65535"`
|
||||
LdapUseTLS bool `json:"ldapUseTLS" form:"ldapUseTLS"`
|
||||
LdapBindDN string `json:"ldapBindDN" form:"ldapBindDN"`
|
||||
LdapPassword string `json:"ldapPassword" form:"ldapPassword"`
|
||||
LdapBaseDN string `json:"ldapBaseDN" form:"ldapBaseDN"`
|
||||
LdapUserFilter string `json:"ldapUserFilter" form:"ldapUserFilter"`
|
||||
LdapUserAttr string `json:"ldapUserAttr" form:"ldapUserAttr"` // e.g., mail or uid
|
||||
LdapVlessField string `json:"ldapVlessField" form:"ldapVlessField"`
|
||||
LdapSyncCron string `json:"ldapSyncCron" form:"ldapSyncCron"`
|
||||
// Generic flag configuration
|
||||
LdapFlagField string `json:"ldapFlagField" form:"ldapFlagField"`
|
||||
LdapTruthyValues string `json:"ldapTruthyValues" form:"ldapTruthyValues"`
|
||||
LdapInvertFlag bool `json:"ldapInvertFlag" form:"ldapInvertFlag"`
|
||||
LdapInboundTags string `json:"ldapInboundTags" form:"ldapInboundTags"`
|
||||
LdapAutoCreate bool `json:"ldapAutoCreate" form:"ldapAutoCreate"`
|
||||
LdapAutoDelete bool `json:"ldapAutoDelete" form:"ldapAutoDelete"`
|
||||
LdapDefaultTotalGB int `json:"ldapDefaultTotalGB" form:"ldapDefaultTotalGB" validate:"gte=0"`
|
||||
LdapDefaultExpiryDays int `json:"ldapDefaultExpiryDays" form:"ldapDefaultExpiryDays" validate:"gte=0"`
|
||||
LdapDefaultLimitIP int `json:"ldapDefaultLimitIP" form:"ldapDefaultLimitIP" validate:"gte=0"`
|
||||
// JSON subscription routing rules
|
||||
|
||||
// WARP
|
||||
WarpUpdateInterval int `json:"warpUpdateInterval" form:"warpUpdateInterval" validate:"gte=0"`
|
||||
}
|
||||
|
||||
// AllSettingView is the browser-safe settings read model. Secret values
|
||||
// are redacted from the embedded write model and represented by presence
|
||||
// flags so the UI can show configured/not configured state.
|
||||
type AllSettingView struct {
|
||||
AllSetting
|
||||
|
||||
HasTgBotToken bool `json:"hasTgBotToken"`
|
||||
HasTwoFactorToken bool `json:"hasTwoFactorToken"`
|
||||
HasLdapPassword bool `json:"hasLdapPassword"`
|
||||
HasApiToken bool `json:"hasApiToken"`
|
||||
HasWarpSecret bool `json:"hasWarpSecret"`
|
||||
HasNordSecret bool `json:"hasNordSecret"`
|
||||
}
|
||||
|
||||
// CheckValid validates all settings in the AllSetting struct, checking IP addresses, ports, SSL certificates, and other configuration values.
|
||||
func pathHasForbiddenChar(s string) bool {
|
||||
for _, r := range s {
|
||||
if r == '\\' || r == ' ' || r < 0x20 || r == 0x7f {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (s *AllSetting) CheckValid() error {
|
||||
if s.WebListen != "" {
|
||||
ip := net.ParseIP(s.WebListen)
|
||||
if ip == nil {
|
||||
return common.NewError("web listen is not valid ip:", s.WebListen)
|
||||
}
|
||||
}
|
||||
|
||||
if s.SubListen != "" {
|
||||
ip := net.ParseIP(s.SubListen)
|
||||
if ip == nil {
|
||||
return common.NewError("Sub listen is not valid ip:", s.SubListen)
|
||||
}
|
||||
}
|
||||
|
||||
if s.WebPort <= 0 || s.WebPort > math.MaxUint16 {
|
||||
return common.NewError("web port is not a valid port:", s.WebPort)
|
||||
}
|
||||
|
||||
if s.SubPort <= 0 || s.SubPort > math.MaxUint16 {
|
||||
return common.NewError("Sub port is not a valid port:", s.SubPort)
|
||||
}
|
||||
|
||||
if (s.SubPort == s.WebPort) && (s.WebListen == s.SubListen) {
|
||||
return common.NewError("Sub and Web could not use same ip:port, ", s.SubListen, ":", s.SubPort, " & ", s.WebListen, ":", s.WebPort)
|
||||
}
|
||||
|
||||
if s.WebCertFile != "" || s.WebKeyFile != "" {
|
||||
_, err := tls.LoadX509KeyPair(s.WebCertFile, s.WebKeyFile)
|
||||
if err != nil {
|
||||
return common.NewErrorf("cert file <%v> or key file <%v> invalid: %v", s.WebCertFile, s.WebKeyFile, err)
|
||||
}
|
||||
}
|
||||
|
||||
if s.SubCertFile != "" || s.SubKeyFile != "" {
|
||||
_, err := tls.LoadX509KeyPair(s.SubCertFile, s.SubKeyFile)
|
||||
if err != nil {
|
||||
return common.NewErrorf("cert file <%v> or key file <%v> invalid: %v", s.SubCertFile, s.SubKeyFile, err)
|
||||
}
|
||||
}
|
||||
|
||||
for _, p := range []struct {
|
||||
name string
|
||||
value string
|
||||
}{
|
||||
{"web base path", s.WebBasePath},
|
||||
{"subscription path", s.SubPath},
|
||||
{"subscription JSON path", s.SubJsonPath},
|
||||
{"subscription Clash path", s.SubClashPath},
|
||||
} {
|
||||
if pathHasForbiddenChar(p.value) {
|
||||
return common.NewError("URI path contains an invalid character:", p.name)
|
||||
}
|
||||
}
|
||||
|
||||
if !strings.HasPrefix(s.WebBasePath, "/") {
|
||||
s.WebBasePath = "/" + s.WebBasePath
|
||||
}
|
||||
if !strings.HasSuffix(s.WebBasePath, "/") {
|
||||
s.WebBasePath += "/"
|
||||
}
|
||||
if !strings.HasPrefix(s.SubPath, "/") {
|
||||
s.SubPath = "/" + s.SubPath
|
||||
}
|
||||
if !strings.HasSuffix(s.SubPath, "/") {
|
||||
s.SubPath += "/"
|
||||
}
|
||||
|
||||
if !strings.HasPrefix(s.SubJsonPath, "/") {
|
||||
s.SubJsonPath = "/" + s.SubJsonPath
|
||||
}
|
||||
if !strings.HasSuffix(s.SubJsonPath, "/") {
|
||||
s.SubJsonPath += "/"
|
||||
}
|
||||
|
||||
if !strings.HasPrefix(s.SubClashPath, "/") {
|
||||
s.SubClashPath = "/" + s.SubClashPath
|
||||
}
|
||||
if !strings.HasSuffix(s.SubClashPath, "/") {
|
||||
s.SubClashPath += "/"
|
||||
}
|
||||
|
||||
for cidr := range strings.SplitSeq(s.TrustedProxyCIDRs, ",") {
|
||||
cidr = strings.TrimSpace(cidr)
|
||||
if cidr == "" {
|
||||
continue
|
||||
}
|
||||
if ip := net.ParseIP(cidr); ip != nil {
|
||||
continue
|
||||
}
|
||||
if _, _, err := net.ParseCIDR(cidr); err != nil {
|
||||
return common.NewError("trusted proxy CIDR is not valid:", cidr)
|
||||
}
|
||||
}
|
||||
|
||||
_, err := time.LoadLocation(s.TimeLocation)
|
||||
if err != nil {
|
||||
return common.NewError("time location not exist:", s.TimeLocation)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
package entity
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestPathHasForbiddenChar(t *testing.T) {
|
||||
valid := []string{
|
||||
"",
|
||||
"/",
|
||||
"/sub/",
|
||||
"/json/",
|
||||
"/a/b/c/",
|
||||
"/My-Path_123/",
|
||||
}
|
||||
for _, p := range valid {
|
||||
if pathHasForbiddenChar(p) {
|
||||
t.Errorf("pathHasForbiddenChar(%q) = true, want false", p)
|
||||
}
|
||||
}
|
||||
|
||||
invalid := []string{
|
||||
"/sub path/",
|
||||
"/back\\slash/",
|
||||
"/tab\there/",
|
||||
"/new\nline/",
|
||||
"/\x7f/",
|
||||
}
|
||||
for _, p := range invalid {
|
||||
if !pathHasForbiddenChar(p) {
|
||||
t.Errorf("pathHasForbiddenChar(%q) = false, want true", p)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
// Package global provides global variables and interfaces for accessing web and subscription servers.
|
||||
package global
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
_ "unsafe"
|
||||
|
||||
"github.com/robfig/cron/v3"
|
||||
)
|
||||
|
||||
var (
|
||||
webServer WebServer
|
||||
subServer SubServer
|
||||
|
||||
restartHookMu sync.RWMutex
|
||||
restartHook func()
|
||||
)
|
||||
|
||||
// WebServer interface defines methods for accessing the web server instance.
|
||||
type WebServer interface {
|
||||
GetCron() *cron.Cron // Get the cron scheduler
|
||||
GetCtx() context.Context // Get the server context
|
||||
GetWSHub() any // Get the WebSocket hub (using any to avoid circular dependency)
|
||||
}
|
||||
|
||||
// SubServer interface defines methods for accessing the subscription server instance.
|
||||
type SubServer interface {
|
||||
GetCtx() context.Context // Get the server context
|
||||
}
|
||||
|
||||
// SetWebServer sets the global web server instance.
|
||||
func SetWebServer(s WebServer) {
|
||||
webServer = s
|
||||
}
|
||||
|
||||
// GetWebServer returns the global web server instance.
|
||||
func GetWebServer() WebServer {
|
||||
return webServer
|
||||
}
|
||||
|
||||
// SetSubServer sets the global subscription server instance.
|
||||
func SetSubServer(s SubServer) {
|
||||
subServer = s
|
||||
}
|
||||
|
||||
// GetSubServer returns the global subscription server instance.
|
||||
func GetSubServer() SubServer {
|
||||
return subServer
|
||||
}
|
||||
|
||||
// SetRestartHook registers a callback that triggers an in-process panel
|
||||
// restart. main.go sets this up to push SIGHUP into its own signal channel
|
||||
// so the restart path works on Windows (where p.Signal(SIGHUP) is unsupported).
|
||||
func SetRestartHook(fn func()) {
|
||||
restartHookMu.Lock()
|
||||
defer restartHookMu.Unlock()
|
||||
restartHook = fn
|
||||
}
|
||||
|
||||
// TriggerRestart fires the registered restart hook. Returns false if none is set.
|
||||
func TriggerRestart() bool {
|
||||
restartHookMu.RLock()
|
||||
fn := restartHook
|
||||
restartHookMu.RUnlock()
|
||||
if fn == nil {
|
||||
return false
|
||||
}
|
||||
fn()
|
||||
return true
|
||||
}
|
||||
@@ -0,0 +1,88 @@
|
||||
package global
|
||||
|
||||
import (
|
||||
"crypto/md5"
|
||||
"encoding/hex"
|
||||
"regexp"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// HashEntry represents a stored hash entry with its value and timestamp.
|
||||
type HashEntry struct {
|
||||
Hash string // MD5 hash string
|
||||
Value string // Original value
|
||||
Timestamp time.Time // Time when the hash was created
|
||||
}
|
||||
|
||||
// HashStorage provides thread-safe storage for hash-value pairs with expiration.
|
||||
type HashStorage struct {
|
||||
sync.RWMutex
|
||||
Data map[string]HashEntry // Map of hash to entry
|
||||
Expiration time.Duration // Expiration duration for entries
|
||||
}
|
||||
|
||||
// NewHashStorage creates a new HashStorage instance with the specified expiration duration.
|
||||
func NewHashStorage(expiration time.Duration) *HashStorage {
|
||||
return &HashStorage{
|
||||
Data: make(map[string]HashEntry),
|
||||
Expiration: expiration,
|
||||
}
|
||||
}
|
||||
|
||||
// SaveHash generates an MD5 hash for the given query string and stores it with a timestamp.
|
||||
func (h *HashStorage) SaveHash(query string) string {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
|
||||
md5Hash := md5.Sum([]byte(query))
|
||||
md5HashString := hex.EncodeToString(md5Hash[:])
|
||||
|
||||
entry := HashEntry{
|
||||
Hash: md5HashString,
|
||||
Value: query,
|
||||
Timestamp: time.Now(),
|
||||
}
|
||||
|
||||
h.Data[md5HashString] = entry
|
||||
|
||||
return md5HashString
|
||||
}
|
||||
|
||||
// GetValue retrieves the original value for the given hash, returning true if found.
|
||||
func (h *HashStorage) GetValue(hash string) (string, bool) {
|
||||
h.RLock()
|
||||
defer h.RUnlock()
|
||||
|
||||
entry, exists := h.Data[hash]
|
||||
|
||||
return entry.Value, exists
|
||||
}
|
||||
|
||||
// IsMD5 checks if the given string is a valid 32-character MD5 hash.
|
||||
func (h *HashStorage) IsMD5(hash string) bool {
|
||||
match, _ := regexp.MatchString("^[a-f0-9]{32}$", hash)
|
||||
return match
|
||||
}
|
||||
|
||||
// RemoveExpiredHashes removes all hash entries that have exceeded the expiration duration.
|
||||
func (h *HashStorage) RemoveExpiredHashes() {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
|
||||
now := time.Now()
|
||||
|
||||
for hash, entry := range h.Data {
|
||||
if now.Sub(entry.Timestamp) > h.Expiration {
|
||||
delete(h.Data, hash)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Reset clears all stored hash entries.
|
||||
func (h *HashStorage) Reset() {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
|
||||
h.Data = make(map[string]HashEntry)
|
||||
}
|
||||
@@ -0,0 +1,586 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io"
|
||||
"log"
|
||||
"os"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"runtime"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// IPWithTimestamp tracks an IP address with its last seen timestamp
|
||||
type IPWithTimestamp struct {
|
||||
IP string `json:"ip"`
|
||||
Timestamp int64 `json:"timestamp"`
|
||||
}
|
||||
|
||||
// CheckClientIpJob monitors client IP addresses from access logs and manages IP blocking based on configured limits.
|
||||
type CheckClientIpJob struct {
|
||||
lastClear int64
|
||||
disAllowedIps []string
|
||||
}
|
||||
|
||||
var job *CheckClientIpJob
|
||||
|
||||
const defaultXrayAPIPort = 62789
|
||||
|
||||
const ipStaleAfterSeconds = int64(30 * 60)
|
||||
|
||||
// NewCheckClientIpJob creates a new client IP monitoring job instance.
|
||||
func NewCheckClientIpJob() *CheckClientIpJob {
|
||||
job = new(CheckClientIpJob)
|
||||
return job
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) Run() {
|
||||
if j.lastClear == 0 {
|
||||
j.lastClear = time.Now().Unix()
|
||||
}
|
||||
|
||||
shouldClearAccessLog := false
|
||||
fail2BanEnabled := isFail2BanEnabled()
|
||||
hasLimit := fail2BanEnabled && j.hasLimitIp()
|
||||
f2bInstalled := false
|
||||
if hasLimit {
|
||||
f2bInstalled = j.checkFail2BanInstalled()
|
||||
}
|
||||
isAccessLogAvailable := j.checkAccessLogAvailable(hasLimit)
|
||||
|
||||
if fail2BanEnabled && isAccessLogAvailable {
|
||||
enforce := hasLimit
|
||||
if hasLimit && runtime.GOOS != "windows" && !f2bInstalled {
|
||||
logger.Warning("[LimitIP] Fail2Ban is not installed, Please install Fail2Ban from the x-ui bash menu.")
|
||||
enforce = false
|
||||
}
|
||||
shouldClearAccessLog = j.processLogFile(enforce)
|
||||
}
|
||||
|
||||
if shouldClearAccessLog || (isAccessLogAvailable && time.Now().Unix()-j.lastClear > 3600) {
|
||||
j.clearAccessLog()
|
||||
}
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) clearAccessLog() {
|
||||
logAccessP, err := os.OpenFile(xray.GetAccessPersistentLogPath(), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
|
||||
j.checkError(err)
|
||||
defer logAccessP.Close()
|
||||
|
||||
accessLogPath, err := xray.GetAccessLogPath()
|
||||
j.checkError(err)
|
||||
|
||||
file, err := os.Open(accessLogPath)
|
||||
j.checkError(err)
|
||||
defer file.Close()
|
||||
|
||||
_, err = io.Copy(logAccessP, file)
|
||||
j.checkError(err)
|
||||
|
||||
err = os.Truncate(accessLogPath, 0)
|
||||
j.checkError(err)
|
||||
|
||||
j.lastClear = time.Now().Unix()
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) hasLimitIp() bool {
|
||||
db := database.GetDB()
|
||||
var inbounds []*model.Inbound
|
||||
|
||||
err := db.Model(model.Inbound{}).Find(&inbounds).Error
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, inbound := range inbounds {
|
||||
if inbound.Settings == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
settings := map[string][]model.Client{}
|
||||
json.Unmarshal([]byte(inbound.Settings), &settings)
|
||||
clients := settings["clients"]
|
||||
|
||||
for _, client := range clients {
|
||||
limitIp := client.LimitIP
|
||||
if limitIp > 0 {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) processLogFile(enforce bool) bool {
|
||||
|
||||
ipRegex := regexp.MustCompile(`from (?:tcp:|udp:)?\[?([0-9a-fA-F\.:]+)\]?:\d+ accepted`)
|
||||
emailRegex := regexp.MustCompile(`email: (.+)$`)
|
||||
timestampRegex := regexp.MustCompile(`^(\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})`)
|
||||
|
||||
accessLogPath, _ := xray.GetAccessLogPath()
|
||||
file, _ := os.Open(accessLogPath)
|
||||
defer file.Close()
|
||||
|
||||
// Track IPs with their last seen timestamp
|
||||
inboundClientIps := make(map[string]map[string]int64, 100)
|
||||
|
||||
scanner := bufio.NewScanner(file)
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
|
||||
ipMatches := ipRegex.FindStringSubmatch(line)
|
||||
if len(ipMatches) < 2 {
|
||||
continue
|
||||
}
|
||||
|
||||
ip := ipMatches[1]
|
||||
|
||||
if ip == "127.0.0.1" || ip == "::1" {
|
||||
continue
|
||||
}
|
||||
|
||||
emailMatches := emailRegex.FindStringSubmatch(line)
|
||||
if len(emailMatches) < 2 {
|
||||
continue
|
||||
}
|
||||
email := emailMatches[1]
|
||||
|
||||
// Extract timestamp from log line
|
||||
var timestamp int64
|
||||
timestampMatches := timestampRegex.FindStringSubmatch(line)
|
||||
if len(timestampMatches) >= 2 {
|
||||
t, err := time.ParseInLocation("2006/01/02 15:04:05", timestampMatches[1], time.Local)
|
||||
if err == nil {
|
||||
timestamp = t.Unix()
|
||||
} else {
|
||||
timestamp = time.Now().Unix()
|
||||
}
|
||||
} else {
|
||||
timestamp = time.Now().Unix()
|
||||
}
|
||||
|
||||
if _, exists := inboundClientIps[email]; !exists {
|
||||
inboundClientIps[email] = make(map[string]int64)
|
||||
}
|
||||
// Update timestamp - keep the latest
|
||||
if existingTime, ok := inboundClientIps[email][ip]; !ok || timestamp > existingTime {
|
||||
inboundClientIps[email][ip] = timestamp
|
||||
}
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
j.checkError(err)
|
||||
}
|
||||
|
||||
shouldCleanLog := false
|
||||
for email, ipTimestamps := range inboundClientIps {
|
||||
|
||||
// The access log can still reference a client that was just renamed
|
||||
// or deleted; its email no longer matches any inbound. Skip it (and
|
||||
// drop any orphaned tracking row) instead of recreating a row and
|
||||
// logging an ERROR every run until the log rotates out the old email
|
||||
// (#4963).
|
||||
inbound, err := j.getInboundByEmail(email)
|
||||
if err != nil {
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
logger.Debugf("[LimitIP] skipping stale access-log email %q (renamed or deleted)", email)
|
||||
j.delInboundClientIps(email)
|
||||
} else {
|
||||
j.checkError(err)
|
||||
}
|
||||
continue
|
||||
}
|
||||
|
||||
// Convert to IPWithTimestamp slice
|
||||
ipsWithTime := make([]IPWithTimestamp, 0, len(ipTimestamps))
|
||||
for ip, timestamp := range ipTimestamps {
|
||||
ipsWithTime = append(ipsWithTime, IPWithTimestamp{IP: ip, Timestamp: timestamp})
|
||||
}
|
||||
|
||||
clientIpsRecord, err := j.getInboundClientIps(email)
|
||||
if err != nil {
|
||||
j.addInboundClientIps(email, ipsWithTime)
|
||||
continue
|
||||
}
|
||||
|
||||
shouldCleanLog = j.updateInboundClientIps(clientIpsRecord, inbound, email, ipsWithTime, enforce) || shouldCleanLog
|
||||
}
|
||||
|
||||
return shouldCleanLog
|
||||
}
|
||||
|
||||
func mergeClientIps(old, new []IPWithTimestamp, staleCutoff int64) map[string]int64 {
|
||||
ipMap := make(map[string]int64, len(old)+len(new))
|
||||
for _, ipTime := range old {
|
||||
if ipTime.Timestamp < staleCutoff {
|
||||
continue
|
||||
}
|
||||
ipMap[ipTime.IP] = ipTime.Timestamp
|
||||
}
|
||||
for _, ipTime := range new {
|
||||
if ipTime.Timestamp < staleCutoff {
|
||||
continue
|
||||
}
|
||||
if existingTime, ok := ipMap[ipTime.IP]; !ok || ipTime.Timestamp > existingTime {
|
||||
ipMap[ipTime.IP] = ipTime.Timestamp
|
||||
}
|
||||
}
|
||||
return ipMap
|
||||
}
|
||||
|
||||
func partitionLiveIps(ipMap map[string]int64, observedThisScan map[string]bool) (live, historical []IPWithTimestamp) {
|
||||
live = make([]IPWithTimestamp, 0, len(observedThisScan))
|
||||
historical = make([]IPWithTimestamp, 0, len(ipMap))
|
||||
now := time.Now().Unix()
|
||||
for ip, ts := range ipMap {
|
||||
entry := IPWithTimestamp{IP: ip, Timestamp: ts}
|
||||
// Consider an IP "live" if it was seen locally in this scan, OR if its
|
||||
// timestamp from the synced database is very recent (e.g. within 2 minutes).
|
||||
// This ensures cluster-wide limits work even if the IP was seen on another node.
|
||||
if observedThisScan[ip] || now-ts < 120 {
|
||||
live = append(live, entry)
|
||||
} else {
|
||||
historical = append(historical, entry)
|
||||
}
|
||||
}
|
||||
sort.Slice(live, func(i, j int) bool { return live[i].Timestamp < live[j].Timestamp })
|
||||
sort.Slice(historical, func(i, j int) bool { return historical[i].Timestamp < historical[j].Timestamp })
|
||||
return live, historical
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) checkFail2BanInstalled() bool {
|
||||
if !isFail2BanEnabled() {
|
||||
return false
|
||||
}
|
||||
|
||||
cmd := "fail2ban-client"
|
||||
args := []string{"-h"}
|
||||
err := exec.Command(cmd, args...).Run()
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func isFail2BanEnabled() bool {
|
||||
value, ok := os.LookupEnv("XUI_ENABLE_FAIL2BAN")
|
||||
return !ok || value == "true"
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) checkAccessLogAvailable(iplimitActive bool) bool {
|
||||
accessLogPath, err := xray.GetAccessLogPath()
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
if accessLogPath == "none" || accessLogPath == "" {
|
||||
if iplimitActive {
|
||||
logger.Warning("[LimitIP] Access log path is not set, Please configure the access log path in Xray configs.")
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) checkError(e error) {
|
||||
if e != nil {
|
||||
logger.Warning("client ip job err:", e)
|
||||
}
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) getInboundClientIps(clientEmail string) (*model.InboundClientIps, error) {
|
||||
db := database.GetDB()
|
||||
InboundClientIps := &model.InboundClientIps{}
|
||||
err := db.Model(model.InboundClientIps{}).Where("client_email = ?", clientEmail).First(InboundClientIps).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return InboundClientIps, nil
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) addInboundClientIps(clientEmail string, ipsWithTime []IPWithTimestamp) error {
|
||||
inboundClientIps := &model.InboundClientIps{}
|
||||
jsonIps, err := json.Marshal(ipsWithTime)
|
||||
j.checkError(err)
|
||||
|
||||
inboundClientIps.ClientEmail = clientEmail
|
||||
inboundClientIps.Ips = string(jsonIps)
|
||||
|
||||
db := database.GetDB()
|
||||
tx := db.Begin()
|
||||
|
||||
defer func() {
|
||||
if err == nil {
|
||||
tx.Commit()
|
||||
} else {
|
||||
tx.Rollback()
|
||||
}
|
||||
}()
|
||||
|
||||
err = tx.Save(inboundClientIps).Error
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// delInboundClientIps drops the inbound_client_ips tracking row for an email
|
||||
// that no longer maps to any inbound (a renamed or deleted client), so stale
|
||||
// access-log entries don't keep a ghost row alive (#4963).
|
||||
func (j *CheckClientIpJob) delInboundClientIps(clientEmail string) {
|
||||
db := database.GetDB()
|
||||
if err := db.Where("client_email = ?", clientEmail).Delete(&model.InboundClientIps{}).Error; err != nil {
|
||||
j.checkError(err)
|
||||
}
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) updateInboundClientIps(inboundClientIps *model.InboundClientIps, inbound *model.Inbound, clientEmail string, newIpsWithTime []IPWithTimestamp, enforce bool) bool {
|
||||
if inbound.Settings == "" {
|
||||
logger.Debug("wrong data:", inbound)
|
||||
return false
|
||||
}
|
||||
|
||||
settings := map[string][]model.Client{}
|
||||
json.Unmarshal([]byte(inbound.Settings), &settings)
|
||||
clients := settings["clients"]
|
||||
|
||||
// Find the client's IP limit
|
||||
var limitIp int
|
||||
var clientFound bool
|
||||
for _, client := range clients {
|
||||
if client.Email == clientEmail {
|
||||
limitIp = client.LimitIP
|
||||
clientFound = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !enforce || !clientFound || limitIp <= 0 || !inbound.Enable {
|
||||
// Nothing to enforce (collection-only run, no limit, client missing, or
|
||||
// inbound disabled): record the observed IPs for the panel and return.
|
||||
jsonIps, _ := json.Marshal(newIpsWithTime)
|
||||
inboundClientIps.Ips = string(jsonIps)
|
||||
db := database.GetDB()
|
||||
db.Save(inboundClientIps)
|
||||
return false
|
||||
}
|
||||
|
||||
// Parse old IPs from database
|
||||
var oldIpsWithTime []IPWithTimestamp
|
||||
if inboundClientIps.Ips != "" {
|
||||
json.Unmarshal([]byte(inboundClientIps.Ips), &oldIpsWithTime)
|
||||
}
|
||||
|
||||
ipMap := mergeClientIps(oldIpsWithTime, newIpsWithTime, time.Now().Unix()-ipStaleAfterSeconds)
|
||||
|
||||
// only ips seen in this scan count toward the limit. see
|
||||
// partitionLiveIps.
|
||||
observedThisScan := make(map[string]bool, len(newIpsWithTime))
|
||||
for _, ipTime := range newIpsWithTime {
|
||||
observedThisScan[ipTime.IP] = true
|
||||
}
|
||||
liveIps, historicalIps := partitionLiveIps(ipMap, observedThisScan)
|
||||
|
||||
shouldCleanLog := false
|
||||
j.disAllowedIps = []string{}
|
||||
|
||||
// historical db-only ips are excluded from this count on purpose.
|
||||
var keptLive []IPWithTimestamp
|
||||
if len(liveIps) > limitIp {
|
||||
shouldCleanLog = true
|
||||
|
||||
// keep the newest live ips, ban older ones.
|
||||
cutoff := len(liveIps) - limitIp
|
||||
keptLive = liveIps[cutoff:]
|
||||
bannedLive := liveIps[:cutoff]
|
||||
|
||||
logIpFile, err := os.OpenFile(xray.GetIPLimitLogPath(), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)
|
||||
if err != nil {
|
||||
logger.Errorf("failed to open IP limit log file: %s", err)
|
||||
return false
|
||||
}
|
||||
defer logIpFile.Close()
|
||||
ipLogger := log.New(logIpFile, "", log.LstdFlags)
|
||||
|
||||
// log format is load-bearing: x-ui.sh create_iplimit_jails builds
|
||||
// filter.d/3x-ipl.conf with
|
||||
// failregex = \[LIMIT_IP\]\s*Email\s*=\s*<F-USER>.+</F-USER>\s*\|\|\s*Disconnecting OLD IP\s*=\s*<ADDR>\s*\|\|\s*Timestamp\s*=\s*\d+
|
||||
// don't change the wording.
|
||||
for _, ipTime := range bannedLive {
|
||||
j.disAllowedIps = append(j.disAllowedIps, ipTime.IP)
|
||||
ipLogger.Printf("[LIMIT_IP] Email = %s || Disconnecting OLD IP = %s || Timestamp = %d", clientEmail, ipTime.IP, ipTime.Timestamp)
|
||||
}
|
||||
|
||||
// force xray to drop existing connections from banned ips
|
||||
j.disconnectClientTemporarily(inbound, clientEmail, clients)
|
||||
} else {
|
||||
keptLive = liveIps
|
||||
}
|
||||
|
||||
// keep kept-live + historical in the blob so the panel keeps showing
|
||||
// recently seen ips. banned live ips are already in the fail2ban log
|
||||
// and will reappear in the next scan if they reconnect.
|
||||
dbIps := make([]IPWithTimestamp, 0, len(keptLive)+len(historicalIps))
|
||||
dbIps = append(dbIps, keptLive...)
|
||||
dbIps = append(dbIps, historicalIps...)
|
||||
jsonIps, _ := json.Marshal(dbIps)
|
||||
inboundClientIps.Ips = string(jsonIps)
|
||||
|
||||
db := database.GetDB()
|
||||
err := db.Save(inboundClientIps).Error
|
||||
if err != nil {
|
||||
logger.Error("failed to save inboundClientIps:", err)
|
||||
return false
|
||||
}
|
||||
|
||||
if len(j.disAllowedIps) > 0 {
|
||||
logger.Infof("[LIMIT_IP] Client %s: Kept %d live IPs, queued %d old IPs for fail2ban", clientEmail, len(keptLive), len(j.disAllowedIps))
|
||||
}
|
||||
|
||||
return shouldCleanLog
|
||||
}
|
||||
|
||||
// disconnectClientTemporarily removes and re-adds a client to force disconnect banned connections
|
||||
func (j *CheckClientIpJob) disconnectClientTemporarily(inbound *model.Inbound, clientEmail string, clients []model.Client) {
|
||||
var xrayAPI xray.XrayAPI
|
||||
apiPort := j.resolveXrayAPIPort()
|
||||
|
||||
err := xrayAPI.Init(apiPort)
|
||||
if err != nil {
|
||||
logger.Warningf("[LIMIT_IP] Failed to init Xray API for disconnection: %v", err)
|
||||
return
|
||||
}
|
||||
defer xrayAPI.Close()
|
||||
|
||||
// Find the client config
|
||||
var clientConfig map[string]any
|
||||
for _, client := range clients {
|
||||
if client.Email == clientEmail {
|
||||
// Convert client to map for API
|
||||
clientBytes, _ := json.Marshal(client)
|
||||
json.Unmarshal(clientBytes, &clientConfig)
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if clientConfig == nil {
|
||||
return
|
||||
}
|
||||
|
||||
// Only perform remove/re-add for protocols supported by XrayAPI.AddUser
|
||||
protocol := string(inbound.Protocol)
|
||||
switch protocol {
|
||||
case "vmess", "vless", "trojan", "shadowsocks":
|
||||
// supported protocols, continue
|
||||
default:
|
||||
logger.Warningf("[LIMIT_IP] Temporary disconnect is not supported for protocol %s on inbound %s", protocol, inbound.Tag)
|
||||
return
|
||||
}
|
||||
|
||||
// For Shadowsocks, ensure the required "cipher" field is present by
|
||||
// reading it from the inbound settings (e.g., settings["method"]).
|
||||
if string(inbound.Protocol) == "shadowsocks" {
|
||||
var inboundSettings map[string]any
|
||||
if err := json.Unmarshal([]byte(inbound.Settings), &inboundSettings); err != nil {
|
||||
logger.Warningf("[LIMIT_IP] Failed to parse inbound settings for shadowsocks cipher: %v", err)
|
||||
} else {
|
||||
if method, ok := inboundSettings["method"].(string); ok && method != "" {
|
||||
clientConfig["cipher"] = method
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Remove user to disconnect all connections
|
||||
err = xrayAPI.RemoveUser(inbound.Tag, clientEmail)
|
||||
if err != nil {
|
||||
logger.Warningf("[LIMIT_IP] Failed to remove user %s: %v", clientEmail, err)
|
||||
return
|
||||
}
|
||||
|
||||
// Wait a moment for disconnection to take effect
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
|
||||
// Re-add user to allow new connections
|
||||
err = xrayAPI.AddUser(protocol, inbound.Tag, clientConfig)
|
||||
if err != nil {
|
||||
logger.Warningf("[LIMIT_IP] Failed to re-add user %s: %v", clientEmail, err)
|
||||
}
|
||||
}
|
||||
|
||||
// resolveXrayAPIPort returns the API inbound port from running config, then template config, then default.
|
||||
func (j *CheckClientIpJob) resolveXrayAPIPort() int {
|
||||
var configErr error
|
||||
var templateErr error
|
||||
|
||||
if port, err := getAPIPortFromConfigPath(xray.GetConfigPath()); err == nil {
|
||||
return port
|
||||
} else {
|
||||
configErr = err
|
||||
}
|
||||
|
||||
db := database.GetDB()
|
||||
var template model.Setting
|
||||
if err := db.Where("key = ?", "xrayTemplateConfig").First(&template).Error; err == nil {
|
||||
if port, parseErr := getAPIPortFromConfigData([]byte(template.Value)); parseErr == nil {
|
||||
return port
|
||||
} else {
|
||||
templateErr = parseErr
|
||||
}
|
||||
} else {
|
||||
templateErr = err
|
||||
}
|
||||
|
||||
logger.Warningf(
|
||||
"[LIMIT_IP] Could not determine Xray API port from config or template; falling back to default port %d (config error: %v, template error: %v)",
|
||||
defaultXrayAPIPort,
|
||||
configErr,
|
||||
templateErr,
|
||||
)
|
||||
|
||||
return defaultXrayAPIPort
|
||||
}
|
||||
|
||||
func getAPIPortFromConfigPath(configPath string) (int, error) {
|
||||
configData, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
return getAPIPortFromConfigData(configData)
|
||||
}
|
||||
|
||||
func getAPIPortFromConfigData(configData []byte) (int, error) {
|
||||
xrayConfig := &xray.Config{}
|
||||
if err := json.Unmarshal(configData, xrayConfig); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
for _, inboundConfig := range xrayConfig.InboundConfigs {
|
||||
if inboundConfig.Tag == "api" && inboundConfig.Port > 0 {
|
||||
return inboundConfig.Port, nil
|
||||
}
|
||||
}
|
||||
|
||||
return 0, errors.New("api inbound port not found")
|
||||
}
|
||||
|
||||
func (j *CheckClientIpJob) getInboundByEmail(clientEmail string) (*model.Inbound, error) {
|
||||
db := database.GetDB()
|
||||
inbound := &model.Inbound{}
|
||||
|
||||
err := db.Model(&model.Inbound{}).Where("settings LIKE ?", "%"+clientEmail+"%").First(inbound).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return inbound, nil
|
||||
}
|
||||
@@ -0,0 +1,377 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
xuilogger "github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/op/go-logging"
|
||||
)
|
||||
|
||||
// 3x-ui logger must be initialised once before any code path that can
|
||||
// log a warning. otherwise log.Warningf panics on a nil logger.
|
||||
var loggerInitOnce sync.Once
|
||||
|
||||
// setupIntegrationDB wires a temp sqlite db and log folder so
|
||||
// updateInboundClientIps can run end to end. closes the db before
|
||||
// TempDir cleanup so windows doesn't complain about the file being in
|
||||
// use.
|
||||
func setupIntegrationDB(t *testing.T) {
|
||||
t.Helper()
|
||||
|
||||
loggerInitOnce.Do(func() {
|
||||
xuilogger.InitLogger(logging.ERROR)
|
||||
})
|
||||
|
||||
dbDir := t.TempDir()
|
||||
logDir := t.TempDir()
|
||||
|
||||
t.Setenv("XUI_DB_FOLDER", dbDir)
|
||||
t.Setenv("XUI_LOG_FOLDER", logDir)
|
||||
|
||||
// updateInboundClientIps calls log.SetOutput on the package global,
|
||||
// which would leak to other tests in the same binary.
|
||||
origLogWriter := log.Writer()
|
||||
origLogFlags := log.Flags()
|
||||
t.Cleanup(func() {
|
||||
log.SetOutput(origLogWriter)
|
||||
log.SetFlags(origLogFlags)
|
||||
})
|
||||
|
||||
if err := database.InitDB(filepath.Join(dbDir, "x-ui.db")); err != nil {
|
||||
t.Fatalf("database.InitDB failed: %v", err)
|
||||
}
|
||||
// LIFO cleanup order: this runs before t.TempDir's own cleanup.
|
||||
t.Cleanup(func() {
|
||||
if err := database.CloseDB(); err != nil {
|
||||
t.Logf("database.CloseDB warning: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// seed an inbound whose settings json has a single client with the
|
||||
// given email and ip limit.
|
||||
func seedInboundWithClient(t *testing.T, tag, email string, limitIp int) {
|
||||
t.Helper()
|
||||
settings := map[string]any{
|
||||
"clients": []map[string]any{
|
||||
{
|
||||
"email": email,
|
||||
"limitIp": limitIp,
|
||||
"enable": true,
|
||||
},
|
||||
},
|
||||
}
|
||||
settingsJSON, err := json.Marshal(settings)
|
||||
if err != nil {
|
||||
t.Fatalf("marshal settings: %v", err)
|
||||
}
|
||||
inbound := &model.Inbound{
|
||||
Tag: tag,
|
||||
Enable: true,
|
||||
Protocol: model.VLESS,
|
||||
Port: 4321,
|
||||
Settings: string(settingsJSON),
|
||||
}
|
||||
if err := database.GetDB().Create(inbound).Error; err != nil {
|
||||
t.Fatalf("seed inbound: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// seed an InboundClientIps row with the given blob.
|
||||
func seedClientIps(t *testing.T, email string, ips []IPWithTimestamp) *model.InboundClientIps {
|
||||
t.Helper()
|
||||
blob, err := json.Marshal(ips)
|
||||
if err != nil {
|
||||
t.Fatalf("marshal ips: %v", err)
|
||||
}
|
||||
row := &model.InboundClientIps{
|
||||
ClientEmail: email,
|
||||
Ips: string(blob),
|
||||
}
|
||||
if err := database.GetDB().Create(row).Error; err != nil {
|
||||
t.Fatalf("seed InboundClientIps: %v", err)
|
||||
}
|
||||
return row
|
||||
}
|
||||
|
||||
// read the persisted blob and parse it back.
|
||||
func readClientIps(t *testing.T, email string) []IPWithTimestamp {
|
||||
t.Helper()
|
||||
row := &model.InboundClientIps{}
|
||||
if err := database.GetDB().Where("client_email = ?", email).First(row).Error; err != nil {
|
||||
t.Fatalf("read InboundClientIps for %s: %v", email, err)
|
||||
}
|
||||
if row.Ips == "" {
|
||||
return nil
|
||||
}
|
||||
var out []IPWithTimestamp
|
||||
if err := json.Unmarshal([]byte(row.Ips), &out); err != nil {
|
||||
t.Fatalf("unmarshal Ips blob %q: %v", row.Ips, err)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// make a lookup map so asserts don't depend on slice order.
|
||||
func ipSet(entries []IPWithTimestamp) map[string]int64 {
|
||||
out := make(map[string]int64, len(entries))
|
||||
for _, e := range entries {
|
||||
out[e.IP] = e.Timestamp
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func TestRun_DisabledFail2BanSkipsProbeAndBanLog(t *testing.T) {
|
||||
setupIntegrationDB(t)
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "false")
|
||||
marker := fakeFail2BanClient(t)
|
||||
|
||||
const email = "disabled-fail2ban"
|
||||
seedInboundWithClient(t, "inbound-disabled-fail2ban", email, 1)
|
||||
|
||||
binDir := t.TempDir()
|
||||
accessLog := filepath.Join(t.TempDir(), "access.log")
|
||||
t.Setenv("XUI_BIN_FOLDER", binDir)
|
||||
configData, err := json.Marshal(map[string]any{
|
||||
"log": map[string]any{"access": accessLog},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal xray config: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(binDir, "config.json"), configData, 0644); err != nil {
|
||||
t.Fatalf("write xray config: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(accessLog, []byte("2026/05/26 12:00:00 from tcp:203.0.113.10:443 accepted tcp:example.com:443 email: disabled-fail2ban\n"), 0644); err != nil {
|
||||
t.Fatalf("write access log: %v", err)
|
||||
}
|
||||
|
||||
j := NewCheckClientIpJob()
|
||||
j.Run()
|
||||
|
||||
if _, err := os.Stat(marker); !os.IsNotExist(err) {
|
||||
t.Fatalf("fail2ban-client should not have been executed, stat error: %v", err)
|
||||
}
|
||||
if info, err := os.Stat(readIpLimitLogPath()); err == nil && info.Size() > 0 {
|
||||
body, _ := os.ReadFile(readIpLimitLogPath())
|
||||
t.Fatalf("3xipl.log should be empty when fail2ban is disabled, got:\n%s", body)
|
||||
}
|
||||
var count int64
|
||||
if err := database.GetDB().Model(&model.InboundClientIps{}).Where("client_email = ?", email).Count(&count).Error; err != nil {
|
||||
t.Fatalf("count InboundClientIps: %v", err)
|
||||
}
|
||||
if count != 0 {
|
||||
t.Fatalf("disabled fail2ban should not persist IP-limit rows, got %d", count)
|
||||
}
|
||||
}
|
||||
|
||||
// #4091 repro: client has limit=3, db still holds 3 idle ips from a
|
||||
// few minutes ago, only one live ip is actually connecting. pre-fix:
|
||||
// live ip got banned every tick and never appeared in the panel.
|
||||
// post-fix: no ban, live ip persisted, historical ips still visible.
|
||||
func TestUpdateInboundClientIps_LiveIpNotBannedByStillFreshHistoricals(t *testing.T) {
|
||||
setupIntegrationDB(t)
|
||||
|
||||
const email = "pr4091-repro"
|
||||
seedInboundWithClient(t, "inbound-pr4091", email, 3)
|
||||
|
||||
now := time.Now().Unix()
|
||||
// idle but still within the 30min staleness window.
|
||||
row := seedClientIps(t, email, []IPWithTimestamp{
|
||||
{IP: "10.0.0.1", Timestamp: now - 20*60},
|
||||
{IP: "10.0.0.2", Timestamp: now - 15*60},
|
||||
{IP: "10.0.0.3", Timestamp: now - 10*60},
|
||||
})
|
||||
|
||||
j := NewCheckClientIpJob()
|
||||
// the one that's actually connecting (user's 128.71.x.x).
|
||||
live := []IPWithTimestamp{
|
||||
{IP: "128.71.1.1", Timestamp: now},
|
||||
}
|
||||
|
||||
inbound, err := j.getInboundByEmail(email)
|
||||
if err != nil {
|
||||
t.Fatalf("getInboundByEmail: %v", err)
|
||||
}
|
||||
shouldCleanLog := j.updateInboundClientIps(row, inbound, email, live, true)
|
||||
|
||||
if shouldCleanLog {
|
||||
t.Fatalf("shouldCleanLog must be false, nothing should have been banned with 1 live ip under limit 3")
|
||||
}
|
||||
if len(j.disAllowedIps) != 0 {
|
||||
t.Fatalf("disAllowedIps must be empty, got %v", j.disAllowedIps)
|
||||
}
|
||||
|
||||
persisted := ipSet(readClientIps(t, email))
|
||||
for _, want := range []string{"128.71.1.1", "10.0.0.1", "10.0.0.2", "10.0.0.3"} {
|
||||
if _, ok := persisted[want]; !ok {
|
||||
t.Errorf("expected %s to be persisted in inbound_client_ips.ips; got %v", want, persisted)
|
||||
}
|
||||
}
|
||||
if got := persisted["128.71.1.1"]; got != now {
|
||||
t.Errorf("live ip timestamp should match the scan timestamp %d, got %d", now, got)
|
||||
}
|
||||
|
||||
// 3xipl.log must not contain a ban line.
|
||||
if info, err := os.Stat(readIpLimitLogPath()); err == nil && info.Size() > 0 {
|
||||
body, _ := os.ReadFile(readIpLimitLogPath())
|
||||
t.Fatalf("3xipl.log should be empty when no ips are banned, got:\n%s", body)
|
||||
}
|
||||
}
|
||||
|
||||
// opposite invariant: when several ips are actually live and exceed
|
||||
// the limit, the oldest connection is dropped and the most recent one
|
||||
// keeps the slot (last-IP-wins policy from #3735, restored in #4699).
|
||||
func TestUpdateInboundClientIps_ExcessLiveIpIsStillBanned(t *testing.T) {
|
||||
setupIntegrationDB(t)
|
||||
|
||||
const email = "pr4091-abuse"
|
||||
seedInboundWithClient(t, "inbound-pr4091-abuse", email, 1)
|
||||
|
||||
now := time.Now().Unix()
|
||||
row := seedClientIps(t, email, []IPWithTimestamp{
|
||||
{IP: "10.1.0.1", Timestamp: now - 60}, // original connection
|
||||
})
|
||||
|
||||
j := NewCheckClientIpJob()
|
||||
// both live, limit=1. use distinct timestamps so sort-by-timestamp
|
||||
// is deterministic: 10.1.0.1 is the original (older) and must get
|
||||
// banned; 192.0.2.9 joined later and keeps the slot (last IP wins).
|
||||
live := []IPWithTimestamp{
|
||||
{IP: "10.1.0.1", Timestamp: now - 5},
|
||||
{IP: "192.0.2.9", Timestamp: now},
|
||||
}
|
||||
|
||||
inbound, err := j.getInboundByEmail(email)
|
||||
if err != nil {
|
||||
t.Fatalf("getInboundByEmail: %v", err)
|
||||
}
|
||||
shouldCleanLog := j.updateInboundClientIps(row, inbound, email, live, true)
|
||||
|
||||
if !shouldCleanLog {
|
||||
t.Fatalf("shouldCleanLog must be true when the live set exceeds the limit")
|
||||
}
|
||||
if len(j.disAllowedIps) != 1 || j.disAllowedIps[0] != "10.1.0.1" {
|
||||
t.Fatalf("expected 10.1.0.1 to be banned; disAllowedIps = %v", j.disAllowedIps)
|
||||
}
|
||||
|
||||
persisted := ipSet(readClientIps(t, email))
|
||||
if _, ok := persisted["192.0.2.9"]; !ok {
|
||||
t.Errorf("newest IP 192.0.2.9 must still be persisted; got %v", persisted)
|
||||
}
|
||||
if _, ok := persisted["10.1.0.1"]; ok {
|
||||
t.Errorf("banned IP 10.1.0.1 must NOT be persisted; got %v", persisted)
|
||||
}
|
||||
|
||||
// 3xipl.log must contain the ban line in the exact fail2ban format.
|
||||
body, err := os.ReadFile(readIpLimitLogPath())
|
||||
if err != nil {
|
||||
t.Fatalf("read 3xipl.log: %v", err)
|
||||
}
|
||||
wantSubstr := "[LIMIT_IP] Email = pr4091-abuse || Disconnecting OLD IP = 10.1.0.1"
|
||||
if !contains(string(body), wantSubstr) {
|
||||
t.Fatalf("3xipl.log missing expected ban line %q\nfull log:\n%s", wantSubstr, body)
|
||||
}
|
||||
}
|
||||
|
||||
// writeXrayAccessLog points bin/config.json at a fresh access.log holding a
|
||||
// single default-format Xray line (`from tcp:<ip>:<port> accepted … email: <e>`)
|
||||
// for the given client, so Run() has something to scrape.
|
||||
func writeXrayAccessLog(t *testing.T, email, ip string) {
|
||||
t.Helper()
|
||||
binDir := t.TempDir()
|
||||
accessLog := filepath.Join(t.TempDir(), "access.log")
|
||||
t.Setenv("XUI_BIN_FOLDER", binDir)
|
||||
configData, err := json.Marshal(map[string]any{
|
||||
"log": map[string]any{"access": accessLog},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal xray config: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(binDir, "config.json"), configData, 0644); err != nil {
|
||||
t.Fatalf("write xray config: %v", err)
|
||||
}
|
||||
line := "2026/06/02 13:35:53 from tcp:" + ip + ":2387 accepted tcp:example.com:443 email: " + email + "\n"
|
||||
if err := os.WriteFile(accessLog, []byte(line), 0644); err != nil {
|
||||
t.Fatalf("write access log: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// #4800: the per-client IP log must populate even when no client has an IP
|
||||
// limit. Before the fix, Run() only scraped the access log when an IP limit
|
||||
// was active, so a limit-free install always showed an empty IP log despite
|
||||
// valid access-log lines. No ban may be written since there's no limit.
|
||||
func TestRun_CollectsIpsWithoutLimit(t *testing.T) {
|
||||
setupIntegrationDB(t)
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "true")
|
||||
fakeFail2BanClient(t)
|
||||
|
||||
const email = "no-limit-user"
|
||||
seedInboundWithClient(t, "inbound-no-limit", email, 0) // limitIp = 0
|
||||
writeXrayAccessLog(t, email, "203.0.113.10")
|
||||
|
||||
NewCheckClientIpJob().Run()
|
||||
|
||||
ips := readClientIps(t, email)
|
||||
if len(ips) != 1 || ips[0].IP != "203.0.113.10" {
|
||||
t.Fatalf("expected the access-log IP to be collected without a limit, got %v", ips)
|
||||
}
|
||||
|
||||
if info, err := os.Stat(readIpLimitLogPath()); err == nil && info.Size() > 0 {
|
||||
body, _ := os.ReadFile(readIpLimitLogPath())
|
||||
t.Fatalf("3xipl.log should be empty with no limit set, got:\n%s", body)
|
||||
}
|
||||
}
|
||||
|
||||
// #4963: a stale access-log entry for a renamed/deleted client (its email no
|
||||
// longer maps to any inbound) must not create or resurrect an
|
||||
// inbound_client_ips row, and must drop any orphan left behind — instead of
|
||||
// spamming "failed to fetch inbound settings" every run.
|
||||
func TestRun_StaleAccessLogEmailIsSkippedAndOrphanDropped(t *testing.T) {
|
||||
setupIntegrationDB(t)
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "true")
|
||||
fakeFail2BanClient(t)
|
||||
|
||||
const staleEmail = "renamed-away"
|
||||
// No inbound references staleEmail. Pre-seed an orphan tracking row to
|
||||
// confirm the job removes it rather than leaving it to error forever.
|
||||
seedClientIps(t, staleEmail, []IPWithTimestamp{{IP: "203.0.113.5", Timestamp: time.Now().Unix()}})
|
||||
writeXrayAccessLog(t, staleEmail, "203.0.113.5")
|
||||
|
||||
NewCheckClientIpJob().Run()
|
||||
|
||||
var count int64
|
||||
if err := database.GetDB().Model(&model.InboundClientIps{}).Where("client_email = ?", staleEmail).Count(&count).Error; err != nil {
|
||||
t.Fatalf("count InboundClientIps: %v", err)
|
||||
}
|
||||
if count != 0 {
|
||||
t.Fatalf("stale-email orphan row should be deleted, got %d row(s)", count)
|
||||
}
|
||||
}
|
||||
|
||||
// readIpLimitLogPath reads the 3xipl.log path the same way the job
|
||||
// does via xray.GetIPLimitLogPath but without importing xray here
|
||||
// just for the path helper (which would pull a lot more deps into the
|
||||
// test binary). The env-derived log folder is deterministic.
|
||||
func readIpLimitLogPath() string {
|
||||
folder := os.Getenv("XUI_LOG_FOLDER")
|
||||
if folder == "" {
|
||||
folder = filepath.Join(".", "log")
|
||||
}
|
||||
return filepath.Join(folder, "3xipl.log")
|
||||
}
|
||||
|
||||
func contains(haystack, needle string) bool {
|
||||
for i := 0; i+len(needle) <= len(haystack); i++ {
|
||||
if haystack[i:i+len(needle)] == needle {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -0,0 +1,243 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"runtime"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestMergeClientIps_EvictsStaleOldEntries(t *testing.T) {
|
||||
// #4077: after a ban expires, a single IP that reconnects used to get
|
||||
// banned again immediately because a long-disconnected IP stayed in the
|
||||
// DB with an ancient timestamp and kept "protecting" itself against
|
||||
// eviction. Guard against that regression here.
|
||||
old := []IPWithTimestamp{
|
||||
{IP: "1.1.1.1", Timestamp: 100}, // stale — client disconnected long ago
|
||||
{IP: "2.2.2.2", Timestamp: 1900}, // fresh — still connecting
|
||||
}
|
||||
new := []IPWithTimestamp{
|
||||
{IP: "2.2.2.2", Timestamp: 2000}, // same IP, newer log line
|
||||
}
|
||||
|
||||
got := mergeClientIps(old, new, 1000)
|
||||
|
||||
want := map[string]int64{"2.2.2.2": 2000}
|
||||
if !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("stale 1.1.1.1 should have been dropped\ngot: %v\nwant: %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeClientIps_KeepsFreshOldEntriesUnchanged(t *testing.T) {
|
||||
// Backwards-compat: entries that aren't stale are still carried forward,
|
||||
// so enforcement survives access-log rotation.
|
||||
old := []IPWithTimestamp{
|
||||
{IP: "1.1.1.1", Timestamp: 1500},
|
||||
}
|
||||
got := mergeClientIps(old, nil, 1000)
|
||||
|
||||
want := map[string]int64{"1.1.1.1": 1500}
|
||||
if !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("fresh old IP should have been retained\ngot: %v\nwant: %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeClientIps_PrefersLaterTimestampForSameIp(t *testing.T) {
|
||||
old := []IPWithTimestamp{{IP: "1.1.1.1", Timestamp: 1500}}
|
||||
new := []IPWithTimestamp{{IP: "1.1.1.1", Timestamp: 1700}}
|
||||
|
||||
got := mergeClientIps(old, new, 1000)
|
||||
|
||||
if got["1.1.1.1"] != 1700 {
|
||||
t.Fatalf("expected latest timestamp 1700, got %d", got["1.1.1.1"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeClientIps_DropsStaleNewEntries(t *testing.T) {
|
||||
// A log line with a clock-skewed old timestamp must not resurrect a
|
||||
// stale IP past the cutoff.
|
||||
new := []IPWithTimestamp{{IP: "1.1.1.1", Timestamp: 500}}
|
||||
got := mergeClientIps(nil, new, 1000)
|
||||
|
||||
if len(got) != 0 {
|
||||
t.Fatalf("stale new IP should have been dropped, got %v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeClientIps_NoStaleCutoffStillWorks(t *testing.T) {
|
||||
// Defensive: a zero cutoff (e.g. during very first run on a fresh
|
||||
// install) must not over-evict.
|
||||
old := []IPWithTimestamp{{IP: "1.1.1.1", Timestamp: 100}}
|
||||
new := []IPWithTimestamp{{IP: "2.2.2.2", Timestamp: 200}}
|
||||
|
||||
got := mergeClientIps(old, new, 0)
|
||||
|
||||
want := map[string]int64{"1.1.1.1": 100, "2.2.2.2": 200}
|
||||
if !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("zero cutoff should keep everything\ngot: %v\nwant: %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func collectIps(entries []IPWithTimestamp) []string {
|
||||
out := make([]string, 0, len(entries))
|
||||
for _, e := range entries {
|
||||
out = append(out, e.IP)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func TestPartitionLiveIps_SingleLiveNotStarvedByStillFreshHistoricals(t *testing.T) {
|
||||
// #4091: db holds A, B, C from minutes ago (still in the 30min
|
||||
// window) but they're not connecting anymore. only D is. old code
|
||||
// merged all four, sorted ascending, kept [A,B,C] and banned D
|
||||
// every tick. pin the new rule: only live ips count toward the limit.
|
||||
ipMap := map[string]int64{
|
||||
"A": 1000,
|
||||
"B": 1100,
|
||||
"C": 1200,
|
||||
"D": 2000,
|
||||
}
|
||||
observed := map[string]bool{"D": true}
|
||||
|
||||
live, historical := partitionLiveIps(ipMap, observed)
|
||||
|
||||
if got := collectIps(live); !reflect.DeepEqual(got, []string{"D"}) {
|
||||
t.Fatalf("live set should only contain the ip observed this scan\ngot: %v\nwant: [D]", got)
|
||||
}
|
||||
if got := collectIps(historical); !reflect.DeepEqual(got, []string{"A", "B", "C"}) {
|
||||
t.Fatalf("historical set should contain db-only ips in ascending order\ngot: %v\nwant: [A B C]", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPartitionLiveIps_ConcurrentLiveIpsSortedAscending(t *testing.T) {
|
||||
// when several ips are really live, partition returns them all in the
|
||||
// live set sorted ascending by timestamp. updateInboundClientIps then
|
||||
// keeps the newest and bans the oldest (last-IP-wins, #4699).
|
||||
ipMap := map[string]int64{
|
||||
"A": 5000,
|
||||
"B": 5500,
|
||||
}
|
||||
observed := map[string]bool{"A": true, "B": true}
|
||||
|
||||
live, historical := partitionLiveIps(ipMap, observed)
|
||||
|
||||
if got := collectIps(live); !reflect.DeepEqual(got, []string{"A", "B"}) {
|
||||
t.Fatalf("both live ips should be in the live set, ascending\ngot: %v\nwant: [A B]", got)
|
||||
}
|
||||
if len(historical) != 0 {
|
||||
t.Fatalf("no historical ips expected, got %v", historical)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPartitionLiveIps_EmptyScanLeavesDbIntact(t *testing.T) {
|
||||
// quiet tick: nothing observed => nothing live. everything merged
|
||||
// is historical. keeps the panel from wiping recent-but-idle ips.
|
||||
ipMap := map[string]int64{
|
||||
"A": 1000,
|
||||
"B": 1100,
|
||||
}
|
||||
observed := map[string]bool{}
|
||||
|
||||
live, historical := partitionLiveIps(ipMap, observed)
|
||||
|
||||
if len(live) != 0 {
|
||||
t.Fatalf("no live ips expected, got %v", live)
|
||||
}
|
||||
if got := collectIps(historical); !reflect.DeepEqual(got, []string{"A", "B"}) {
|
||||
t.Fatalf("all merged entries should flow to historical\ngot: %v\nwant: [A B]", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPartitionLiveIps_RecentSyncedIpIsLive(t *testing.T) {
|
||||
// Synced IPs from other nodes within 2 minutes should be counted as live
|
||||
// even if they weren't observed in the local scan.
|
||||
now := time.Now().Unix()
|
||||
ipMap := map[string]int64{
|
||||
"A": now - 30, // synced 30s ago -> live
|
||||
"B": now - 150, // synced 2m30s ago -> historical
|
||||
}
|
||||
observed := map[string]bool{}
|
||||
|
||||
live, historical := partitionLiveIps(ipMap, observed)
|
||||
|
||||
if got := collectIps(live); !reflect.DeepEqual(got, []string{"A"}) {
|
||||
t.Fatalf("recent IP should be live\ngot: %v\nwant: [A]", got)
|
||||
}
|
||||
if got := collectIps(historical); !reflect.DeepEqual(got, []string{"B"}) {
|
||||
t.Fatalf("older IP should be historical\ngot: %v\nwant: [B]", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckFail2BanInstalled_DisabledEnvSkipsClientProbe(t *testing.T) {
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "false")
|
||||
marker := fakeFail2BanClient(t)
|
||||
|
||||
if (&CheckClientIpJob{}).checkFail2BanInstalled() {
|
||||
t.Fatal("fail2ban should be unavailable when XUI_ENABLE_FAIL2BAN=false")
|
||||
}
|
||||
if _, err := os.Stat(marker); !os.IsNotExist(err) {
|
||||
t.Fatalf("fail2ban-client should not have been executed, stat error: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckFail2BanInstalled_EmptyEnvSkipsClientProbe(t *testing.T) {
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "")
|
||||
marker := fakeFail2BanClient(t)
|
||||
|
||||
if (&CheckClientIpJob{}).checkFail2BanInstalled() {
|
||||
t.Fatal("fail2ban should be unavailable when XUI_ENABLE_FAIL2BAN is empty")
|
||||
}
|
||||
if _, err := os.Stat(marker); !os.IsNotExist(err) {
|
||||
t.Fatalf("fail2ban-client should not have been executed, stat error: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsFail2BanEnabled_DefaultsToEnabledWhenUnset(t *testing.T) {
|
||||
value, ok := os.LookupEnv("XUI_ENABLE_FAIL2BAN")
|
||||
os.Unsetenv("XUI_ENABLE_FAIL2BAN")
|
||||
t.Cleanup(func() {
|
||||
if ok {
|
||||
os.Setenv("XUI_ENABLE_FAIL2BAN", value)
|
||||
} else {
|
||||
os.Unsetenv("XUI_ENABLE_FAIL2BAN")
|
||||
}
|
||||
})
|
||||
|
||||
if !isFail2BanEnabled() {
|
||||
t.Fatal("fail2ban should default to enabled when XUI_ENABLE_FAIL2BAN is unset")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckFail2BanInstalled_EnabledEnvProbesClient(t *testing.T) {
|
||||
t.Setenv("XUI_ENABLE_FAIL2BAN", "true")
|
||||
marker := fakeFail2BanClient(t)
|
||||
|
||||
if !(&CheckClientIpJob{}).checkFail2BanInstalled() {
|
||||
t.Fatal("fail2ban should be available when the client probe succeeds")
|
||||
}
|
||||
if _, err := os.Stat(marker); err != nil {
|
||||
t.Fatalf("fail2ban-client should have been executed: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func fakeFail2BanClient(t *testing.T) string {
|
||||
t.Helper()
|
||||
|
||||
dir := t.TempDir()
|
||||
marker := filepath.Join(dir, "probe-called")
|
||||
fakeClient := filepath.Join(dir, "fail2ban-client")
|
||||
script := "#!/bin/sh\n: > \"$FAIL2BAN_PROBE_MARKER\"\nexit 0\n"
|
||||
if runtime.GOOS == "windows" {
|
||||
fakeClient += ".bat"
|
||||
script = "@echo off\ntype nul > \"%FAIL2BAN_PROBE_MARKER%\"\nexit /b 0\n"
|
||||
}
|
||||
if err := os.WriteFile(fakeClient, []byte(script), 0o755); err != nil {
|
||||
t.Fatalf("write fake fail2ban-client: %v", err)
|
||||
}
|
||||
|
||||
t.Setenv("FAIL2BAN_PROBE_MARKER", marker)
|
||||
t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
|
||||
return marker
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service/tgbot"
|
||||
|
||||
"github.com/shirou/gopsutil/v4/cpu"
|
||||
)
|
||||
|
||||
// CheckCpuJob monitors CPU usage and sends Telegram notifications when usage exceeds the configured threshold.
|
||||
type CheckCpuJob struct {
|
||||
tgbotService tgbot.Tgbot
|
||||
settingService service.SettingService
|
||||
}
|
||||
|
||||
// NewCheckCpuJob creates a new CPU monitoring job instance.
|
||||
func NewCheckCpuJob() *CheckCpuJob {
|
||||
return new(CheckCpuJob)
|
||||
}
|
||||
|
||||
// Run checks CPU usage over the last minute and sends a Telegram alert if it exceeds the threshold.
|
||||
func (j *CheckCpuJob) Run() {
|
||||
threshold, err := j.settingService.GetTgCpu()
|
||||
if err != nil || threshold <= 0 {
|
||||
// If threshold cannot be retrieved or is not set, skip sending notifications
|
||||
return
|
||||
}
|
||||
|
||||
// get latest status of server
|
||||
percent, err := cpu.Percent(1*time.Minute, false)
|
||||
if err == nil && percent[0] > float64(threshold) {
|
||||
msg := j.tgbotService.I18nBot("tgbot.messages.cpuThreshold",
|
||||
"Percent=="+strconv.FormatFloat(percent[0], 'f', 2, 64),
|
||||
"Threshold=="+strconv.Itoa(threshold))
|
||||
|
||||
j.tgbotService.SendMsgToTgbotAdmins(msg)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
package job
|
||||
|
||||
import "github.com/mhsanaei/3x-ui/v3/internal/web/service/tgbot"
|
||||
|
||||
// CheckHashStorageJob periodically cleans up expired hash entries from the Telegram bot's hash storage.
|
||||
type CheckHashStorageJob struct {
|
||||
tgbotService tgbot.Tgbot
|
||||
}
|
||||
|
||||
// NewCheckHashStorageJob creates a new hash storage cleanup job instance.
|
||||
func NewCheckHashStorageJob() *CheckHashStorageJob {
|
||||
return new(CheckHashStorageJob)
|
||||
}
|
||||
|
||||
// Run removes expired hash entries from the Telegram bot's hash storage.
|
||||
func (j *CheckHashStorageJob) Run() {
|
||||
storage := j.tgbotService.GetHashStorage()
|
||||
if storage == nil {
|
||||
return
|
||||
}
|
||||
storage.RemoveExpiredHashes()
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
package job
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestCheckHashStorageJob_RunWithoutPanicWhenStorageNil(t *testing.T) {
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("CheckHashStorageJob.Run panicked when storage is nil: %v", r)
|
||||
}
|
||||
}()
|
||||
NewCheckHashStorageJob().Run()
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
// Package job provides background job implementations for the 3x-ui web panel,
|
||||
// including traffic monitoring, system checks, and periodic maintenance tasks.
|
||||
package job
|
||||
|
||||
import (
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
// CheckXrayRunningJob monitors Xray process health and restarts it if it crashes.
|
||||
type CheckXrayRunningJob struct {
|
||||
xrayService service.XrayService
|
||||
checkTime int
|
||||
}
|
||||
|
||||
// NewCheckXrayRunningJob creates a new Xray health check job instance.
|
||||
func NewCheckXrayRunningJob() *CheckXrayRunningJob {
|
||||
return new(CheckXrayRunningJob)
|
||||
}
|
||||
|
||||
// Run checks if Xray has crashed and restarts it after confirming it's down for 2 consecutive checks.
|
||||
func (j *CheckXrayRunningJob) Run() {
|
||||
if !j.xrayService.DidXrayCrash() {
|
||||
j.checkTime = 0
|
||||
} else {
|
||||
j.checkTime++
|
||||
// only restart if it's down 2 times in a row
|
||||
if j.checkTime > 1 {
|
||||
err := j.xrayService.RestartXray(false)
|
||||
j.checkTime = 0
|
||||
if err != nil {
|
||||
logger.Error("Restart xray failed:", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
)
|
||||
|
||||
// ClearLogsJob clears old log files to prevent disk space issues.
|
||||
type ClearLogsJob struct{}
|
||||
|
||||
// NewClearLogsJob creates a new log cleanup job instance.
|
||||
func NewClearLogsJob() *ClearLogsJob {
|
||||
return new(ClearLogsJob)
|
||||
}
|
||||
|
||||
// ensureFileExists creates the necessary directories and file if they don't exist
|
||||
func ensureFileExists(path string) error {
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0755); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0644)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
file.Close()
|
||||
return nil
|
||||
}
|
||||
|
||||
// Here Run is an interface method of the Job interface
|
||||
func (j *ClearLogsJob) Run() {
|
||||
logFiles := []string{xray.GetIPLimitLogPath(), xray.GetIPLimitBannedLogPath(), xray.GetAccessPersistentLogPath()}
|
||||
logFilesPrev := []string{xray.GetIPLimitBannedPrevLogPath(), xray.GetAccessPersistentPrevLogPath()}
|
||||
|
||||
// Ensure all log files and their paths exist
|
||||
for _, path := range append(logFiles, logFilesPrev...) {
|
||||
if err := ensureFileExists(path); err != nil {
|
||||
logger.Warning("Failed to ensure log file exists:", path, "-", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Clear log files and copy to previous logs
|
||||
for i := range len(logFiles) {
|
||||
if i > 0 {
|
||||
// Copy to previous logs
|
||||
logFilePrev, err := os.OpenFile(logFilesPrev[i-1], os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
|
||||
if err != nil {
|
||||
logger.Warning("Failed to open previous log file for writing:", logFilesPrev[i-1], "-", err)
|
||||
continue
|
||||
}
|
||||
|
||||
logFile, err := os.OpenFile(logFiles[i], os.O_RDONLY, 0644)
|
||||
if err != nil {
|
||||
logger.Warning("Failed to open current log file for reading:", logFiles[i], "-", err)
|
||||
logFilePrev.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
_, err = io.Copy(logFilePrev, logFile)
|
||||
if err != nil {
|
||||
logger.Warning("Failed to copy log file:", logFiles[i], "to", logFilesPrev[i-1], "-", err)
|
||||
}
|
||||
|
||||
logFile.Close()
|
||||
logFilePrev.Close()
|
||||
}
|
||||
|
||||
err := os.Truncate(logFiles[i], 0)
|
||||
if err != nil {
|
||||
logger.Warning("Failed to truncate log file:", logFiles[i], "-", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,302 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
ldaputil "github.com/mhsanaei/3x-ui/v3/internal/util/ldap"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
var DefaultTruthyValues = []string{"true", "1", "yes", "on"}
|
||||
|
||||
type LdapSyncJob struct {
|
||||
settingService service.SettingService
|
||||
inboundService service.InboundService
|
||||
clientService service.ClientService
|
||||
xrayService service.XrayService
|
||||
}
|
||||
|
||||
// --- Helper functions for mustGet ---
|
||||
func mustGetString(fn func() (string, error)) string {
|
||||
v, err := fn()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func mustGetInt(fn func() (int, error)) int {
|
||||
v, err := fn()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func mustGetBool(fn func() (bool, error)) bool {
|
||||
v, err := fn()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func mustGetStringOr(fn func() (string, error), fallback string) string {
|
||||
v, err := fn()
|
||||
if err != nil || v == "" {
|
||||
return fallback
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func NewLdapSyncJob() *LdapSyncJob {
|
||||
return new(LdapSyncJob)
|
||||
}
|
||||
|
||||
func (j *LdapSyncJob) Run() {
|
||||
logger.Info("LDAP sync job started")
|
||||
|
||||
enabled, err := j.settingService.GetLdapEnable()
|
||||
if err != nil || !enabled {
|
||||
logger.Warning("LDAP disabled or failed to fetch flag")
|
||||
return
|
||||
}
|
||||
|
||||
// --- LDAP fetch ---
|
||||
cfg := ldaputil.Config{
|
||||
Host: mustGetString(j.settingService.GetLdapHost),
|
||||
Port: mustGetInt(j.settingService.GetLdapPort),
|
||||
UseTLS: mustGetBool(j.settingService.GetLdapUseTLS),
|
||||
BindDN: mustGetString(j.settingService.GetLdapBindDN),
|
||||
Password: mustGetString(j.settingService.GetLdapPassword),
|
||||
BaseDN: mustGetString(j.settingService.GetLdapBaseDN),
|
||||
UserFilter: mustGetString(j.settingService.GetLdapUserFilter),
|
||||
UserAttr: mustGetString(j.settingService.GetLdapUserAttr),
|
||||
FlagField: mustGetStringOr(j.settingService.GetLdapFlagField, mustGetString(j.settingService.GetLdapVlessField)),
|
||||
TruthyVals: splitCsv(mustGetString(j.settingService.GetLdapTruthyValues)),
|
||||
Invert: mustGetBool(j.settingService.GetLdapInvertFlag),
|
||||
}
|
||||
|
||||
flags, err := ldaputil.FetchVlessFlags(cfg)
|
||||
if err != nil {
|
||||
logger.Warning("LDAP fetch failed:", err)
|
||||
return
|
||||
}
|
||||
logger.Infof("Fetched %d LDAP flags", len(flags))
|
||||
|
||||
// --- Load all inbounds and all clients once ---
|
||||
inboundTags := splitCsv(mustGetString(j.settingService.GetLdapInboundTags))
|
||||
inbounds, err := j.inboundService.GetAllInbounds()
|
||||
if err != nil {
|
||||
logger.Warning("Failed to get inbounds:", err)
|
||||
return
|
||||
}
|
||||
|
||||
allClients := map[string]*model.Client{} // email -> client
|
||||
inboundMap := map[string]*model.Inbound{} // tag -> inbound
|
||||
for _, ib := range inbounds {
|
||||
inboundMap[ib.Tag] = ib
|
||||
clients, _ := j.inboundService.GetClients(ib)
|
||||
for i := range clients {
|
||||
allClients[clients[i].Email] = &clients[i]
|
||||
}
|
||||
}
|
||||
|
||||
// --- Prepare batch operations ---
|
||||
autoCreate := mustGetBool(j.settingService.GetLdapAutoCreate)
|
||||
defGB := mustGetInt(j.settingService.GetLdapDefaultTotalGB)
|
||||
defExpiryDays := mustGetInt(j.settingService.GetLdapDefaultExpiryDays)
|
||||
defLimitIP := mustGetInt(j.settingService.GetLdapDefaultLimitIP)
|
||||
|
||||
clientsToCreate := map[string][]model.Client{} // tag -> []new clients
|
||||
clientsToEnable := map[string][]string{} // tag -> []email
|
||||
clientsToDisable := map[string][]string{} // tag -> []email
|
||||
|
||||
for email, allowed := range flags {
|
||||
exists := allClients[email] != nil
|
||||
for _, tag := range inboundTags {
|
||||
if !exists && allowed && autoCreate {
|
||||
newClient := j.buildClient(inboundMap[tag], email, defGB, defExpiryDays, defLimitIP)
|
||||
clientsToCreate[tag] = append(clientsToCreate[tag], newClient)
|
||||
} else if exists {
|
||||
if allowed && !allClients[email].Enable {
|
||||
clientsToEnable[tag] = append(clientsToEnable[tag], email)
|
||||
} else if !allowed && allClients[email].Enable {
|
||||
clientsToDisable[tag] = append(clientsToDisable[tag], email)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for tag, newClients := range clientsToCreate {
|
||||
if len(newClients) == 0 {
|
||||
continue
|
||||
}
|
||||
ib := inboundMap[tag]
|
||||
created := 0
|
||||
restartNeeded := false
|
||||
for _, c := range newClients {
|
||||
nr, err := j.clientService.CreateOne(&j.inboundService, ib.Id, c)
|
||||
if err != nil {
|
||||
logger.Warningf("Failed to add client %s for tag %s: %v", c.Email, tag, err)
|
||||
continue
|
||||
}
|
||||
created++
|
||||
if nr {
|
||||
restartNeeded = true
|
||||
}
|
||||
}
|
||||
if created > 0 {
|
||||
logger.Infof("LDAP auto-create: %d clients for %s", created, tag)
|
||||
if restartNeeded {
|
||||
j.xrayService.SetToNeedRestart()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// --- Execute enable/disable batch ---
|
||||
for tag, emails := range clientsToEnable {
|
||||
j.batchSetEnable(inboundMap[tag], emails, true)
|
||||
}
|
||||
for tag, emails := range clientsToDisable {
|
||||
j.batchSetEnable(inboundMap[tag], emails, false)
|
||||
}
|
||||
|
||||
// --- Auto delete clients not in LDAP ---
|
||||
autoDelete := mustGetBool(j.settingService.GetLdapAutoDelete)
|
||||
if autoDelete {
|
||||
ldapEmailSet := map[string]struct{}{}
|
||||
for e := range flags {
|
||||
ldapEmailSet[e] = struct{}{}
|
||||
}
|
||||
for _, tag := range inboundTags {
|
||||
j.deleteClientsNotInLDAP(tag, ldapEmailSet)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func splitCsv(s string) []string {
|
||||
if s == "" {
|
||||
return DefaultTruthyValues
|
||||
}
|
||||
parts := strings.Split(s, ",")
|
||||
out := make([]string, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
v := strings.TrimSpace(p)
|
||||
if v != "" {
|
||||
out = append(out, v)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// buildClient creates a new client for auto-create
|
||||
func (j *LdapSyncJob) buildClient(ib *model.Inbound, email string, defGB, defExpiryDays, defLimitIP int) model.Client {
|
||||
c := model.Client{
|
||||
Email: email,
|
||||
Enable: true,
|
||||
LimitIP: defLimitIP,
|
||||
TotalGB: int64(defGB),
|
||||
}
|
||||
if defExpiryDays > 0 {
|
||||
c.ExpiryTime = time.Now().Add(time.Duration(defExpiryDays) * 24 * time.Hour).UnixMilli()
|
||||
}
|
||||
switch ib.Protocol {
|
||||
case model.Trojan, model.Shadowsocks:
|
||||
c.Password = uuid.NewString()
|
||||
default:
|
||||
c.ID = uuid.NewString()
|
||||
}
|
||||
return c
|
||||
}
|
||||
|
||||
func (j *LdapSyncJob) batchSetEnable(ib *model.Inbound, emails []string, enable bool) {
|
||||
if len(emails) == 0 {
|
||||
return
|
||||
}
|
||||
restartNeeded := false
|
||||
changed := 0
|
||||
for _, email := range emails {
|
||||
ok, needRestart, err := j.clientService.SetClientEnableByEmail(&j.inboundService, email, enable)
|
||||
if err != nil {
|
||||
logger.Warningf("Batch set enable failed for %s in inbound %s: %v", email, ib.Tag, err)
|
||||
continue
|
||||
}
|
||||
if ok {
|
||||
changed++
|
||||
}
|
||||
if needRestart {
|
||||
restartNeeded = true
|
||||
}
|
||||
}
|
||||
if changed > 0 {
|
||||
logger.Infof("Batch set enable=%v for %d clients in inbound %s", enable, changed, ib.Tag)
|
||||
}
|
||||
if restartNeeded {
|
||||
j.xrayService.SetToNeedRestart()
|
||||
}
|
||||
}
|
||||
|
||||
// deleteClientsNotInLDAP deletes clients not in LDAP using batches and a single restart
|
||||
func (j *LdapSyncJob) deleteClientsNotInLDAP(inboundTag string, ldapEmails map[string]struct{}) {
|
||||
inbounds, err := j.inboundService.GetAllInbounds()
|
||||
if err != nil {
|
||||
logger.Warning("Failed to get inbounds for deletion:", err)
|
||||
return
|
||||
}
|
||||
|
||||
batchSize := 50 // clients in 1 batch
|
||||
restartNeeded := false
|
||||
|
||||
for _, ib := range inbounds {
|
||||
if ib.Tag != inboundTag {
|
||||
continue
|
||||
}
|
||||
clients, err := j.inboundService.GetClients(ib)
|
||||
if err != nil {
|
||||
logger.Warningf("Failed to get clients for inbound %s: %v", ib.Tag, err)
|
||||
continue
|
||||
}
|
||||
|
||||
// Collect clients for deletion
|
||||
toDelete := []model.Client{}
|
||||
for _, c := range clients {
|
||||
if _, ok := ldapEmails[c.Email]; !ok {
|
||||
toDelete = append(toDelete, c)
|
||||
}
|
||||
}
|
||||
|
||||
if len(toDelete) == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
for i := 0; i < len(toDelete); i += batchSize {
|
||||
end := min(i+batchSize, len(toDelete))
|
||||
batch := toDelete[i:end]
|
||||
|
||||
for _, c := range batch {
|
||||
nr, err := j.clientService.DetachByEmail(&j.inboundService, ib.Id, c.Email)
|
||||
if err != nil {
|
||||
logger.Warningf("Failed to delete client %s from inbound id=%d(tag=%s): %v",
|
||||
c.Email, ib.Id, ib.Tag, err)
|
||||
continue
|
||||
}
|
||||
logger.Infof("Deleted client %s from inbound id=%d(tag=%s)",
|
||||
c.Email, ib.Id, ib.Tag)
|
||||
if nr {
|
||||
restartNeeded = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if restartNeeded {
|
||||
j.xrayService.SetToNeedRestart()
|
||||
logger.Info("Xray restart scheduled after batch deletion")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/mtproto"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
||||
)
|
||||
|
||||
// MtprotoJob reconciles the running mtg sidecar processes against the enabled
|
||||
// mtproto inbounds in the database, restarts any that crashed, and folds the
|
||||
// per-inbound traffic scraped from each mtg metrics endpoint into the usual
|
||||
// inbound traffic accounting.
|
||||
type MtprotoJob struct {
|
||||
inboundService service.InboundService
|
||||
}
|
||||
|
||||
// NewMtprotoJob creates a new mtproto reconcile/traffic job instance.
|
||||
func NewMtprotoJob() *MtprotoJob {
|
||||
return new(MtprotoJob)
|
||||
}
|
||||
|
||||
// Run reconciles desired mtproto inbounds with running mtg processes and
|
||||
// records traffic deltas.
|
||||
func (j *MtprotoJob) Run() {
|
||||
inbounds, err := j.inboundService.GetAllInbounds()
|
||||
if err != nil {
|
||||
logger.Warning("mtproto job: get inbounds failed:", err)
|
||||
return
|
||||
}
|
||||
|
||||
var desired []mtproto.Instance
|
||||
for _, ib := range inbounds {
|
||||
if ib.Protocol != model.MTProto || !ib.Enable || ib.NodeID != nil {
|
||||
continue
|
||||
}
|
||||
if inst, ok := mtproto.InstanceFromInbound(ib); ok {
|
||||
desired = append(desired, inst)
|
||||
}
|
||||
}
|
||||
|
||||
mgr := mtproto.GetManager()
|
||||
mgr.Reconcile(desired)
|
||||
|
||||
deltas := mgr.CollectTraffic()
|
||||
if len(deltas) == 0 {
|
||||
return
|
||||
}
|
||||
traffics := make([]*xray.Traffic, 0, len(deltas))
|
||||
for _, d := range deltas {
|
||||
traffics = append(traffics, &xray.Traffic{
|
||||
IsInbound: true,
|
||||
Tag: d.Tag,
|
||||
Up: d.Up,
|
||||
Down: d.Down,
|
||||
})
|
||||
}
|
||||
if _, _, err := j.inboundService.AddTraffic(traffics, nil); err != nil {
|
||||
logger.Warning("mtproto job: add traffic failed:", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
)
|
||||
|
||||
const (
|
||||
nodeHeartbeatConcurrency = 32
|
||||
nodeHeartbeatRequestTimeout = 4 * time.Second
|
||||
)
|
||||
|
||||
type NodeHeartbeatJob struct {
|
||||
nodeService service.NodeService
|
||||
running sync.Mutex
|
||||
}
|
||||
|
||||
func NewNodeHeartbeatJob() *NodeHeartbeatJob {
|
||||
return &NodeHeartbeatJob{}
|
||||
}
|
||||
|
||||
func (j *NodeHeartbeatJob) Run() {
|
||||
if !j.running.TryLock() {
|
||||
return
|
||||
}
|
||||
defer j.running.Unlock()
|
||||
|
||||
nodes, err := j.nodeService.GetAll()
|
||||
if err != nil {
|
||||
logger.Warning("node heartbeat: load nodes failed:", err)
|
||||
return
|
||||
}
|
||||
if len(nodes) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
sem := make(chan struct{}, nodeHeartbeatConcurrency)
|
||||
var wg sync.WaitGroup
|
||||
for _, n := range nodes {
|
||||
if !n.Enable {
|
||||
continue
|
||||
}
|
||||
wg.Add(1)
|
||||
sem <- struct{}{}
|
||||
go func(n *model.Node) {
|
||||
defer wg.Done()
|
||||
defer func() { <-sem }()
|
||||
j.probeOne(n)
|
||||
}(n)
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
if !websocket.HasClients() {
|
||||
return
|
||||
}
|
||||
updated, err := j.nodeService.GetNodeTree()
|
||||
if err != nil {
|
||||
logger.Warning("node heartbeat: load nodes for broadcast failed:", err)
|
||||
return
|
||||
}
|
||||
websocket.BroadcastNodes(updated)
|
||||
}
|
||||
|
||||
func (j *NodeHeartbeatJob) probeOne(n *model.Node) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), nodeHeartbeatRequestTimeout)
|
||||
defer cancel()
|
||||
patch, err := j.nodeService.Probe(ctx, n)
|
||||
if err != nil {
|
||||
patch.Status = "offline"
|
||||
} else {
|
||||
patch.Status = "online"
|
||||
}
|
||||
if updErr := j.nodeService.UpdateHeartbeat(n.Id, patch); updErr != nil {
|
||||
logger.Warning("node heartbeat: update node", n.Id, "failed:", updErr)
|
||||
}
|
||||
// Learn the nodes this node manages so the panel can surface them as
|
||||
// transitive sub-nodes (#4983). Fresh context — the probe budget above may
|
||||
// be spent. Drop them when the node is unreachable.
|
||||
if patch.Status == "online" {
|
||||
dctx, dcancel := context.WithTimeout(context.Background(), nodeHeartbeatRequestTimeout)
|
||||
j.nodeService.RefreshDescendants(dctx, n)
|
||||
dcancel()
|
||||
} else {
|
||||
j.nodeService.ClearDescendants(n.Id)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,230 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/runtime"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
)
|
||||
|
||||
const (
|
||||
nodeTrafficSyncConcurrency = 8
|
||||
nodeTrafficSyncRequestTimeout = 4 * time.Second
|
||||
nodeReconcileTimeout = 30 * time.Second
|
||||
nodeClientIpSyncInterval = 10 * time.Second
|
||||
)
|
||||
|
||||
type NodeTrafficSyncJob struct {
|
||||
nodeService service.NodeService
|
||||
inboundService service.InboundService
|
||||
settingService service.SettingService
|
||||
xrayService service.XrayService
|
||||
running sync.Mutex
|
||||
structural atomicBool
|
||||
ipSyncMu sync.Mutex
|
||||
lastIpSync int64
|
||||
}
|
||||
|
||||
type atomicBool struct {
|
||||
mu sync.Mutex
|
||||
v bool
|
||||
}
|
||||
|
||||
func (a *atomicBool) set() {
|
||||
a.mu.Lock()
|
||||
a.v = true
|
||||
a.mu.Unlock()
|
||||
}
|
||||
|
||||
func (a *atomicBool) takeAndReset() bool {
|
||||
a.mu.Lock()
|
||||
v := a.v
|
||||
a.v = false
|
||||
a.mu.Unlock()
|
||||
return v
|
||||
}
|
||||
|
||||
func NewNodeTrafficSyncJob() *NodeTrafficSyncJob {
|
||||
return &NodeTrafficSyncJob{}
|
||||
}
|
||||
|
||||
func (j *NodeTrafficSyncJob) Run() {
|
||||
if !j.running.TryLock() {
|
||||
return
|
||||
}
|
||||
defer j.running.Unlock()
|
||||
|
||||
mgr := runtime.GetManager()
|
||||
if mgr == nil {
|
||||
return
|
||||
}
|
||||
|
||||
nodes, err := j.nodeService.GetAll()
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: load nodes failed:", err)
|
||||
return
|
||||
}
|
||||
if len(nodes) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
// Decide once per tick whether this run also syncs client IPs, and stamp the
|
||||
// clock before the loop so two back-to-back 5s ticks can't both qualify.
|
||||
doIpSync := false
|
||||
j.ipSyncMu.Lock()
|
||||
if now := time.Now().Unix(); now-j.lastIpSync >= int64(nodeClientIpSyncInterval/time.Second) {
|
||||
doIpSync = true
|
||||
j.lastIpSync = now
|
||||
}
|
||||
j.ipSyncMu.Unlock()
|
||||
|
||||
sem := make(chan struct{}, nodeTrafficSyncConcurrency)
|
||||
var wg sync.WaitGroup
|
||||
for _, n := range nodes {
|
||||
if !n.Enable || n.Status != "online" {
|
||||
continue
|
||||
}
|
||||
wg.Add(1)
|
||||
sem <- struct{}{}
|
||||
go func(n *model.Node) {
|
||||
defer wg.Done()
|
||||
defer func() { <-sem }()
|
||||
j.syncOne(mgr, n, doIpSync)
|
||||
}(n)
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
_, clientsDisabled, err := j.inboundService.AddTraffic(nil, nil)
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: depletion check failed:", err)
|
||||
}
|
||||
if clientsDisabled {
|
||||
if restartOnDisable, settingErr := j.settingService.GetRestartXrayOnClientDisable(); settingErr == nil && restartOnDisable {
|
||||
if err := j.xrayService.RestartXray(true); err != nil {
|
||||
logger.Warning("node traffic sync: restart xray after disabling clients failed:", err)
|
||||
j.xrayService.SetToNeedRestart()
|
||||
}
|
||||
} else if settingErr != nil {
|
||||
logger.Warning("node traffic sync: get RestartXrayOnClientDisable failed:", settingErr)
|
||||
}
|
||||
j.structural.set()
|
||||
}
|
||||
|
||||
lastOnline, err := j.inboundService.GetClientsLastOnline()
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: get last-online failed:", err)
|
||||
}
|
||||
if lastOnline == nil {
|
||||
lastOnline = map[string]int64{}
|
||||
}
|
||||
|
||||
// Prune stale local-online entries (no local active emails or inbound tags
|
||||
// to add here — only the local xray poll feeds those) so a stopped local
|
||||
// xray's clients and inbounds still age out between traffic polls.
|
||||
j.inboundService.RefreshLocalOnlineClients(nil, nil)
|
||||
|
||||
if !websocket.HasClients() {
|
||||
return
|
||||
}
|
||||
|
||||
online := j.inboundService.GetOnlineClients()
|
||||
if online == nil {
|
||||
online = []string{}
|
||||
}
|
||||
websocket.BroadcastTraffic(map[string]any{
|
||||
"onlineClients": online,
|
||||
"onlineByGuid": j.inboundService.GetOnlineClientsByGuid(),
|
||||
"activeInbounds": j.inboundService.GetActiveInboundsByGuid(),
|
||||
"lastOnlineMap": lastOnline,
|
||||
})
|
||||
|
||||
clientStats := map[string]any{}
|
||||
if stats, err := j.inboundService.GetAllClientTraffics(); err != nil {
|
||||
logger.Warning("node traffic sync: get all client traffics for websocket failed:", err)
|
||||
} else if len(stats) > 0 {
|
||||
clientStats["clients"] = stats
|
||||
}
|
||||
if summary, err := j.inboundService.GetInboundsTrafficSummary(); err != nil {
|
||||
logger.Warning("node traffic sync: get inbounds summary for websocket failed:", err)
|
||||
} else if len(summary) > 0 {
|
||||
clientStats["inbounds"] = summary
|
||||
}
|
||||
if len(clientStats) > 0 {
|
||||
websocket.BroadcastClientStats(clientStats)
|
||||
}
|
||||
|
||||
if j.structural.takeAndReset() {
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeInbounds)
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeClients)
|
||||
}
|
||||
}
|
||||
|
||||
func (j *NodeTrafficSyncJob) syncOne(mgr *runtime.Manager, n *model.Node, doIpSync bool) {
|
||||
rt, err := mgr.RemoteFor(n)
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: remote lookup failed for", n.Name, ":", err)
|
||||
return
|
||||
}
|
||||
|
||||
if n.ConfigDirty {
|
||||
reconcileCtx, reconcileCancel := context.WithTimeout(context.Background(), nodeReconcileTimeout)
|
||||
reconcileErr := j.inboundService.ReconcileNode(reconcileCtx, rt, n.Id)
|
||||
reconcileCancel()
|
||||
if reconcileErr != nil {
|
||||
logger.Warning("node traffic sync: reconcile for", n.Name, "failed:", reconcileErr)
|
||||
return
|
||||
}
|
||||
if clearErr := j.nodeService.ClearNodeDirty(n.Id, n.ConfigDirtyAt); clearErr != nil {
|
||||
logger.Warning("node traffic sync: clear dirty for", n.Name, "failed:", clearErr)
|
||||
}
|
||||
j.structural.set()
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), nodeTrafficSyncRequestTimeout)
|
||||
defer cancel()
|
||||
|
||||
snap, err := rt.FetchTrafficSnapshot(ctx)
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: fetch from", n.Name, "failed:", err)
|
||||
j.inboundService.ClearNodeOnlineClients(n.Id)
|
||||
return
|
||||
}
|
||||
_, _, dirty, _, _ := j.nodeService.NodeSyncState(n.Id)
|
||||
changed, err := j.inboundService.SetRemoteTraffic(n.Id, snap, dirty)
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: merge for", n.Name, "failed:", err)
|
||||
return
|
||||
}
|
||||
if changed {
|
||||
j.structural.set()
|
||||
}
|
||||
|
||||
if !doIpSync {
|
||||
return
|
||||
}
|
||||
|
||||
nodeIps, err := rt.FetchAllClientIps(ctx)
|
||||
if err == nil && len(nodeIps) > 0 {
|
||||
if err := j.inboundService.MergeInboundClientIps(nodeIps); err != nil {
|
||||
logger.Warning("node traffic sync: merge client ips from", n.Name, "failed:", err)
|
||||
}
|
||||
} else if err != nil {
|
||||
logger.Warning("node traffic sync: fetch client ips from", n.Name, "failed:", err)
|
||||
}
|
||||
|
||||
masterIps, err := j.inboundService.GetAllInboundClientIps()
|
||||
if err != nil {
|
||||
logger.Warning("node traffic sync: load client ips for push to", n.Name, "failed:", err)
|
||||
return
|
||||
}
|
||||
if len(masterIps) > 0 {
|
||||
if err := rt.PushAllClientIps(ctx, masterIps); err != nil {
|
||||
logger.Warning("node traffic sync: push client ips to", n.Name, "failed:", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"sync"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestAtomicBool_DefaultIsFalse(t *testing.T) {
|
||||
var a atomicBool
|
||||
if a.takeAndReset() {
|
||||
t.Fatal("default atomicBool should report false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAtomicBool_SetThenTakeReturnsTrueOnce(t *testing.T) {
|
||||
var a atomicBool
|
||||
a.set()
|
||||
if !a.takeAndReset() {
|
||||
t.Fatal("takeAndReset after set should return true")
|
||||
}
|
||||
if a.takeAndReset() {
|
||||
t.Fatal("second takeAndReset should return false (state was reset)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAtomicBool_SetIsIdempotent(t *testing.T) {
|
||||
var a atomicBool
|
||||
a.set()
|
||||
a.set()
|
||||
a.set()
|
||||
if !a.takeAndReset() {
|
||||
t.Fatal("repeated set should still leave the flag true")
|
||||
}
|
||||
if a.takeAndReset() {
|
||||
t.Fatal("flag should be cleared after the first take")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAtomicBool_ConcurrentSettersExactlyOneTakeWins(t *testing.T) {
|
||||
var a atomicBool
|
||||
const setters = 100
|
||||
const readers = 20
|
||||
|
||||
var wg sync.WaitGroup
|
||||
for range setters {
|
||||
wg.Go(func() {
|
||||
a.set()
|
||||
})
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
trueCount := 0
|
||||
var rwg sync.WaitGroup
|
||||
var mu sync.Mutex
|
||||
for range readers {
|
||||
rwg.Go(func() {
|
||||
if a.takeAndReset() {
|
||||
mu.Lock()
|
||||
trueCount++
|
||||
mu.Unlock()
|
||||
}
|
||||
})
|
||||
}
|
||||
rwg.Wait()
|
||||
|
||||
if trueCount != 1 {
|
||||
t.Fatalf("expected exactly one reader to observe true, got %d", trueCount)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/websocket"
|
||||
)
|
||||
|
||||
// OutboundSubscriptionJob periodically re-fetches enabled outbound subscriptions,
|
||||
// updates the stored outbounds (with stable tags), and signals that xray
|
||||
// should be reloaded so the new outbounds take effect.
|
||||
type OutboundSubscriptionJob struct {
|
||||
subService *service.OutboundSubscriptionService
|
||||
xraySvc *service.XrayService
|
||||
}
|
||||
|
||||
// NewOutboundSubscriptionJob creates the job (zero-value services are populated
|
||||
// on first Run via method calls, same pattern as other jobs).
|
||||
func NewOutboundSubscriptionJob() *OutboundSubscriptionJob {
|
||||
return &OutboundSubscriptionJob{
|
||||
subService: &service.OutboundSubscriptionService{},
|
||||
xraySvc: &service.XrayService{},
|
||||
}
|
||||
}
|
||||
|
||||
// Run is invoked by the cron scheduler.
|
||||
func (j *OutboundSubscriptionJob) Run() {
|
||||
if j.subService == nil {
|
||||
j.subService = &service.OutboundSubscriptionService{}
|
||||
}
|
||||
if j.xraySvc == nil {
|
||||
j.xraySvc = &service.XrayService{}
|
||||
}
|
||||
|
||||
count, err := j.subService.RefreshAllEnabled()
|
||||
if err != nil {
|
||||
logger.Warning("outbound subscription auto-update error:", err)
|
||||
return
|
||||
}
|
||||
if count > 0 {
|
||||
logger.Infof("Refreshed %d outbound subscription(s)", count)
|
||||
// Ask the xray manager to restart/reload on the next 30s check.
|
||||
j.xraySvc.SetToNeedRestart()
|
||||
// Also broadcast an invalidate so the UI can refresh the xray setting
|
||||
// view (new outbounds will be visible after the reload cycle).
|
||||
websocket.BroadcastInvalidate(websocket.MessageTypeOutbounds)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
package job
|
||||
|
||||
import (
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/logger"
|
||||
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
||||
)
|
||||
|
||||
// Period represents the time period for traffic resets.
|
||||
type Period string
|
||||
|
||||
// PeriodicTrafficResetJob resets traffic statistics for inbounds based on their configured reset period.
|
||||
type PeriodicTrafficResetJob struct {
|
||||
inboundService service.InboundService
|
||||
clientService service.ClientService
|
||||
period Period
|
||||
}
|
||||
|
||||
// NewPeriodicTrafficResetJob creates a new periodic traffic reset job for the specified period.
|
||||
func NewPeriodicTrafficResetJob(period Period) *PeriodicTrafficResetJob {
|
||||
return &PeriodicTrafficResetJob{
|
||||
period: period,
|
||||
}
|
||||
}
|
||||
|
||||
// Run resets traffic statistics for all inbounds that match the configured reset period.
|
||||
func (j *PeriodicTrafficResetJob) Run() {
|
||||
inbounds, err := j.inboundService.GetInboundsByTrafficReset(string(j.period))
|
||||
if err != nil {
|
||||
logger.Warning("Failed to get inbounds for traffic reset:", err)
|
||||
return
|
||||
}
|
||||
|
||||
if len(inbounds) == 0 {
|
||||
return
|
||||
}
|
||||
logger.Infof("Running periodic traffic reset job for period: %s (%d matching inbounds)", j.period, len(inbounds))
|
||||
|
||||
resetCount := 0
|
||||
|
||||
for _, inbound := range inbounds {
|
||||
resetInboundErr := j.inboundService.ResetInboundTraffic(inbound.Id)
|
||||
if resetInboundErr != nil {
|
||||
logger.Warning("Failed to reset traffic for inbound", inbound.Id, ":", resetInboundErr)
|
||||
}
|
||||
|
||||
resetClientErr := j.clientService.ResetAllClientTraffics(&j.inboundService, inbound.Id)
|
||||
if resetClientErr != nil {
|
||||
logger.Warning("Failed to reset traffic for all users of inbound", inbound.Id, ":", resetClientErr)
|
||||
}
|
||||
|
||||
if resetInboundErr == nil && resetClientErr == nil {
|
||||
resetCount++
|
||||
}
|
||||
}
|
||||
|
||||
if resetCount > 0 {
|
||||
logger.Infof("Periodic traffic reset completed: %d inbounds reset", resetCount)
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user