pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-09 22:55:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(finalmask): keep a single udphop mask last in every client finalmask

Browse Source 
xray-core reverses finalmask.udp and refuses, at dial time, a mask that
dials its own socket (udphop) anywhere but the socket end: "incorrect
index". xray run -test still says Configuration OK, so the failure only
shows as a client that never connects.

UDPHopClientMaskFix turned a global subJsonFinalMask hop and a host hop
into udphop masks; the JSON subscription then appended both, leaving two
hoppers with the first one misplaced, and a host mask merged after a
global hop pushed it off the end too. A hand-ordered template outbound
or an imported fm= could carry the same order.

maskcompat.NormalizeUDPHop keeps the last-listed udphop alone at the end
of udp, and runs wherever a client finalmask is produced: each JSON
subscription endpoint, share-link fm=, the Go and frontend link
importers and the template outbound heal in GetXrayConfig. The JSON
subscription resolves competing hop ranges most specific first: a host
hop wins over the inbound's own, which wins over the global default.
This commit is contained in:
MHSanaei
2026-10-11 18:02:12 +02:00
parent a8255944bf
commit 6321297f68
12 changed files with 281 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/json_service.go
+9 -1
View File
@@ -641,8 +641,9 @@ func (s *SubJsonService) getConfig(subReq *SubService, inbound *model.Inbound, c
if finalmask, ok := newStream["finalmask"].(map[string]any); ok {
newStream["finalmask"] = withLegacyFragmentRanges(finalmask)
}
// An inbound keeps its hop range as quicParams.udpHop; clients hop only with the mask.
// A host's legacy hop still needs the mask; the last-merged hop, the host's, wins.
maskcompat.UpgradeLegacyUDPHop(newStream["finalmask"])
maskcompat.NormalizeUDPHop(newStream["finalmask"])
streamSettings, _ := json.MarshalIndent(newStream, "", " ")
hostMux := hostMuxOverride(extPrxy)
@@ -715,6 +716,8 @@ func (s *SubJsonService) streamData(stream string, clientKey string) map[string]
}
delete(streamSettings, "sockopt")
// The inbound's own hop range becomes a mask first, so the global default yields to it.
maskcompat.UpgradeLegacyUDPHop(streamSettings["finalmask"])
if s.finalMask != "" {
s.applyGlobalFinalMask(streamSettings)
}
@@ -754,6 +757,10 @@ func (s *SubJsonService) applyGlobalFinalMask(streamSettings map[string]any) {
if err := json.Unmarshal([]byte(s.finalMask), &fm); err != nil || len(fm) == 0 {
return
}
// The global hop range is a default: an inbound that advertises its own keeps it.
if maskcompat.HasUDPHopMask(streamSettings["finalmask"]) {
fm = maskcompat.WithoutUDPHop(fm)
}
merged := mergeFinalMask(streamSettings["finalmask"], fm)
if len(merged) > 0 {
streamSettings["finalmask"] = merged
@@ -1005,6 +1012,7 @@ func (s *SubJsonService) genHy(inbound *model.Inbound, newStream map[string]any,
newStream["finalmask"] = mergeFinalMask(newStream["finalmask"], finalmask)
}
maskcompat.UpgradeLegacyUDPHop(newStream["finalmask"])
maskcompat.NormalizeUDPHop(newStream["finalmask"])
newStream["network"] = "hysteria"
newStream["security"] = "tls"
internal/sub/masque_test.go
+106
View File
@@ -1,10 +1,18 @@
package sub
import (
"context"
"encoding/json"
"fmt"
"net"
"reflect"
"strconv"
"testing"
xnet "github.com/xtls/xray-core/common/net"
"github.com/xtls/xray-core/infra/conf"
"github.com/xtls/xray-core/transport/internet"
"github.com/mhsanaei/3x-ui/v3/internal/database"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
)
@@ -115,6 +123,104 @@ func TestSubJsonServiceTurnsInboundHopIntoClientUDPHopMask(t *testing.T) {
}
}
// coreDialsUDP dials a client stream's finalmask the way the core does: it reverses the
// UDP masks and refuses a udphop anywhere but the socket end ("incorrect index").
func coreDialsUDP(t *testing.T, stream map[string]any) {
t.Helper()
listener, err := net.ListenPacket("udp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen udp: %v", err)
}
defer listener.Close()
raw, _ := json.Marshal(map[string]any{"finalmask": stream["finalmask"]})
var sc conf.StreamConfig
if err := json.Unmarshal(raw, &sc); err != nil {
t.Fatalf("decode stream: %v", err)
}
built, err := sc.Build()
if err != nil {
t.Fatalf("the core refuses the stream: %v", err)
}
mss, err := internet.ToMemoryStreamConfig(built)
if err != nil {
t.Fatalf("memory stream: %v", err)
}
port := listener.LocalAddr().(*net.UDPAddr).Port
conn, err := mss.FinalMask.DialUDP(context.Background(), xnet.UDPDestination(xnet.LocalHostIP, xnet.Port(port)))
if err != nil {
t.Fatalf("the core cannot dial through the finalmask: %v", err)
}
_ = conn.Close()
}
// A client dials through one hopper and the core takes it only last in udp, so the JSON
// subscription keeps the most specific hop range (host, then inbound, then global) at the end.
func TestSubJsonServiceKeepsOneTrailingUDPHopMask(t *testing.T) {
const hop = `{"type":"udphop","settings":{"mode":"intervalRemote","remotePorts":"%s","interval":"5-10"}}`
const salamander = `{"type":"salamander","settings":{"password":"host-pass"}}`
const inboundHop = `"finalmask":{"quicParams":{"udpHop":{"ports":"20000-30000","interval":"5-10"}}},`
tests := []struct {
name, inboundMask, hostMask, global, wantPorts string
}{
{
"a host hop overrides the inbound and the global one", inboundHop,
`{"udp":[` + salamander + `,` + fmt.Sprintf(hop, "40000-41000") + `]}`, fmt.Sprintf(hop, "30000-31000"), "40000-41000",
},
{
"the inbound hop overrides the global one", inboundHop,
`{"udp":[` + salamander + `]}`, fmt.Sprintf(hop, "30000-31000"), "20000-30000",
},
{
"the global hop stays last behind host masks", ``,
`{"udp":[` + salamander + `]}`, fmt.Sprintf(hop, "30000-31000"), "30000-31000",
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
inbound := &model.Inbound{
Listen: "203.0.113.10", Port: 443, Protocol: model.Hysteria, Remark: "hy",
Settings: `{"version":2,"clients":[{"email":"ivy@example.test","auth":"a"}]}`,
StreamSettings: `{"network":"hysteria","security":"tls","hysteriaSettings":{"version":2},
"tlsSettings":{"serverName":"hy.example.test","alpn":["h3"]},` + tc.inboundMask + `
"externalProxy":[{"forceTls":"same","dest":"a.example.test","port":443,"remark":"a",
"finalMask":` + strconv.Quote(tc.hostMask) + `}]}`,
}
client := model.Client{Email: "ivy@example.test", Auth: "a"}
global := `{"udp":[` + tc.global + `]}`
configs := NewSubJsonService("", "", global, "", nil).getConfig(&SubService{address: "sub.example.com"}, inbound, client, "sub.example.com")
if len(configs) != 1 {
t.Fatalf("got %d configs, want one", len(configs))
}
var config struct {
Outbounds []struct {
StreamSettings map[string]any `json:"streamSettings"`
} `json:"outbounds"`
}
if err := json.Unmarshal(configs[0], &config); err != nil {
t.Fatalf("decode config: %v", err)
}
stream := config.Outbounds[0].StreamSettings
finalmask, _ := stream["finalmask"].(map[string]any)
masks, _ := finalmask["udp"].([]any)
var hops []string
for _, entry := range masks {
mask, _ := entry.(map[string]any)
if mask["type"] == "udphop" {
settings, _ := mask["settings"].(map[string]any)
hops = append(hops, fmt.Sprint(settings["remotePorts"]))
}
}
last, _ := masks[len(masks)-1].(map[string]any)
if len(hops) != 1 || hops[0] != tc.wantPorts || last["type"] != "udphop" {
got, _ := json.Marshal(finalmask)
t.Fatalf("client finalmask = %s, want one trailing udphop on %s", got, tc.wantPorts)
}
coreDialsUDP(t, stream)
})
}
}
// Every endpoint's config starts from the same parsed inbound finalmask; a host whose own
// masks are merged in first must not use up the hop range the endpoints after it need.
func TestSubJsonServiceKeepsUDPHopMaskOnEveryEndpoint(t *testing.T) {
internal/sub/service.go
+2
View File
@@ -24,6 +24,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/logger"
"github.com/mhsanaei/3x-ui/v3/internal/tuic"
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
"github.com/mhsanaei/3x-ui/v3/internal/util/maskcompat"
"github.com/mhsanaei/3x-ui/v3/internal/util/random"
wgutil "github.com/mhsanaei/3x-ui/v3/internal/util/wireguard"
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
@@ -2855,6 +2856,7 @@ func applyFinalMaskObj(finalmask map[string]any, obj map[string]any) {
func marshalFinalMask(finalmask map[string]any) (string, bool) {
normalized := withLegacyFragmentRanges(normalizeFinalMask(finalmask))
maskcompat.NormalizeUDPHop(normalized)
if !hasFinalMaskContent(normalized) {
return "", false
}
internal/sub/service_test.go
+14
View File
@@ -1195,6 +1195,20 @@ func TestMarshalFinalMask_KeepsSudokuUdpMask(t *testing.T) {
}
}
// A share link's fm= is what a client dials with; a udphop listed before another UDP mask
// makes the core refuse every dial ("incorrect index"), so the link carries it last.
func TestMarshalFinalMask_PutsUDPHopLast(t *testing.T) {
fm := map[string]any{"udp": []any{
map[string]any{"type": "udphop", "settings": map[string]any{"mode": "intervalRemote", "remotePorts": "20000-30000"}},
map[string]any{"type": "salamander", "settings": map[string]any{"password": "s3cr3t"}},
}}
out, ok := marshalFinalMask(fm)
want := `{"udp":[{"settings":{"password":"s3cr3t"},"type":"salamander"},{"settings":{"mode":"intervalRemote","remotePorts":"20000-30000"},"type":"udphop"}]}`
if !ok || out != want {
t.Fatalf("marshalFinalMask = %s, want %s", out, want)
}
}
func TestHasFinalMaskContent(t *testing.T) {
if hasFinalMaskContent(nil) {
t.Fatal("nil should not count as content")