fix(finalmask): keep a single udphop mask last in every client finalmask

xray-core reverses finalmask.udp and refuses, at dial time, a mask that
dials its own socket (udphop) anywhere but the socket end: "incorrect
index". xray run -test still says Configuration OK, so the failure only
shows as a client that never connects.

UDPHopClientMaskFix turned a global subJsonFinalMask hop and a host hop
into udphop masks; the JSON subscription then appended both, leaving two
hoppers with the first one misplaced, and a host mask merged after a
global hop pushed it off the end too. A hand-ordered template outbound
or an imported fm= could carry the same order.

maskcompat.NormalizeUDPHop keeps the last-listed udphop alone at the end
of udp, and runs wherever a client finalmask is produced: each JSON
subscription endpoint, share-link fm=, the Go and frontend link
importers and the template outbound heal in GetXrayConfig. The JSON
subscription resolves competing hop ranges most specific first: a host
hop wins over the inbound's own, which wins over the global default.
This commit is contained in:
MHSanaei
2026-10-11 18:02:12 +02:00
parent a8255944bf
commit 6321297f68
12 changed files with 281 additions and 43 deletions
+9 -1
View File
@@ -641,8 +641,9 @@ func (s *SubJsonService) getConfig(subReq *SubService, inbound *model.Inbound, c
if finalmask, ok := newStream["finalmask"].(map[string]any); ok {
newStream["finalmask"] = withLegacyFragmentRanges(finalmask)
}
// An inbound keeps its hop range as quicParams.udpHop; clients hop only with the mask.
// A host's legacy hop still needs the mask; the last-merged hop, the host's, wins.
maskcompat.UpgradeLegacyUDPHop(newStream["finalmask"])
maskcompat.NormalizeUDPHop(newStream["finalmask"])
streamSettings, _ := json.MarshalIndent(newStream, "", " ")
hostMux := hostMuxOverride(extPrxy)
@@ -715,6 +716,8 @@ func (s *SubJsonService) streamData(stream string, clientKey string) map[string]
}
delete(streamSettings, "sockopt")
// The inbound's own hop range becomes a mask first, so the global default yields to it.
maskcompat.UpgradeLegacyUDPHop(streamSettings["finalmask"])
if s.finalMask != "" {
s.applyGlobalFinalMask(streamSettings)
}
@@ -754,6 +757,10 @@ func (s *SubJsonService) applyGlobalFinalMask(streamSettings map[string]any) {
if err := json.Unmarshal([]byte(s.finalMask), &fm); err != nil || len(fm) == 0 {
return
}
// The global hop range is a default: an inbound that advertises its own keeps it.
if maskcompat.HasUDPHopMask(streamSettings["finalmask"]) {
fm = maskcompat.WithoutUDPHop(fm)
}
merged := mergeFinalMask(streamSettings["finalmask"], fm)
if len(merged) > 0 {
streamSettings["finalmask"] = merged
@@ -1005,6 +1012,7 @@ func (s *SubJsonService) genHy(inbound *model.Inbound, newStream map[string]any,
newStream["finalmask"] = mergeFinalMask(newStream["finalmask"], finalmask)
}
maskcompat.UpgradeLegacyUDPHop(newStream["finalmask"])
maskcompat.NormalizeUDPHop(newStream["finalmask"])
newStream["network"] = "hysteria"
newStream["security"] = "tls"