fix(finalmask): keep a single udphop mask last in every client finalmask

xray-core reverses finalmask.udp and refuses, at dial time, a mask that dials its own socket (udphop) anywhere but the socket end: "incorrect index". xray run -test still says Configuration OK, so the failure only shows as a client that never connects. UDPHopClientMaskFix turned a global subJsonFinalMask hop and a host hop into udphop masks; the JSON subscription then appended both, leaving two hoppers with the first one misplaced, and a host mask merged after a global hop pushed it off the end too. A hand-ordered template outbound or an imported fm= could carry the same order. maskcompat.NormalizeUDPHop keeps the last-listed udphop alone at the end of udp, and runs wherever a client finalmask is produced: each JSON subscription endpoint, share-link fm=, the Go and frontend link importers and the template outbound heal in GetXrayConfig. The JSON subscription resolves competing hop ranges most specific first: a host hop wins over the inbound's own, which wins over the global default.
2026-11-15 17:45:03 +03:00 · 2026-10-11 18:02:12 +02:00
parent a8255944bf
commit 6321297f68
12 changed files with 281 additions and 43 deletions
@@ -1,10 +1,18 @@
 package sub

 import (
+	"context"
 	"encoding/json"
+	"fmt"
+	"net"
 	"reflect"
+	"strconv"
 	"testing"

+	xnet "github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/infra/conf"
+	"github.com/xtls/xray-core/transport/internet"
+
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 )
@@ -115,6 +123,104 @@ func TestSubJsonServiceTurnsInboundHopIntoClientUDPHopMask(t *testing.T) {
 	}
 }

+// coreDialsUDP dials a client stream's finalmask the way the core does: it reverses the
+// UDP masks and refuses a udphop anywhere but the socket end ("incorrect index").
+func coreDialsUDP(t *testing.T, stream map[string]any) {
+	t.Helper()
+	listener, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen udp: %v", err)
+	}
+	defer listener.Close()
+	raw, _ := json.Marshal(map[string]any{"finalmask": stream["finalmask"]})
+	var sc conf.StreamConfig
+	if err := json.Unmarshal(raw, &sc); err != nil {
+		t.Fatalf("decode stream: %v", err)
+	}
+	built, err := sc.Build()
+	if err != nil {
+		t.Fatalf("the core refuses the stream: %v", err)
+	}
+	mss, err := internet.ToMemoryStreamConfig(built)
+	if err != nil {
+		t.Fatalf("memory stream: %v", err)
+	}
+	port := listener.LocalAddr().(*net.UDPAddr).Port
+	conn, err := mss.FinalMask.DialUDP(context.Background(), xnet.UDPDestination(xnet.LocalHostIP, xnet.Port(port)))
+	if err != nil {
+		t.Fatalf("the core cannot dial through the finalmask: %v", err)
+	}
+	_ = conn.Close()
+}
+
+// A client dials through one hopper and the core takes it only last in udp, so the JSON
+// subscription keeps the most specific hop range (host, then inbound, then global) at the end.
+func TestSubJsonServiceKeepsOneTrailingUDPHopMask(t *testing.T) {
+	const hop = `{"type":"udphop","settings":{"mode":"intervalRemote","remotePorts":"%s","interval":"5-10"}}`
+	const salamander = `{"type":"salamander","settings":{"password":"host-pass"}}`
+	const inboundHop = `"finalmask":{"quicParams":{"udpHop":{"ports":"20000-30000","interval":"5-10"}}},`
+	tests := []struct {
+		name, inboundMask, hostMask, global, wantPorts string
+	}{
+		{
+			"a host hop overrides the inbound and the global one", inboundHop,
+			`{"udp":[` + salamander + `,` + fmt.Sprintf(hop, "40000-41000") + `]}`, fmt.Sprintf(hop, "30000-31000"), "40000-41000",
+		},
+		{
+			"the inbound hop overrides the global one", inboundHop,
+			`{"udp":[` + salamander + `]}`, fmt.Sprintf(hop, "30000-31000"), "20000-30000",
+		},
+		{
+			"the global hop stays last behind host masks", ``,
+			`{"udp":[` + salamander + `]}`, fmt.Sprintf(hop, "30000-31000"), "30000-31000",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			inbound := &model.Inbound{
+				Listen: "203.0.113.10", Port: 443, Protocol: model.Hysteria, Remark: "hy",
+				Settings: `{"version":2,"clients":[{"email":"ivy@example.test","auth":"a"}]}`,
+				StreamSettings: `{"network":"hysteria","security":"tls","hysteriaSettings":{"version":2},
+					"tlsSettings":{"serverName":"hy.example.test","alpn":["h3"]},` + tc.inboundMask + `
+					"externalProxy":[{"forceTls":"same","dest":"a.example.test","port":443,"remark":"a",
+						"finalMask":` + strconv.Quote(tc.hostMask) + `}]}`,
+			}
+			client := model.Client{Email: "ivy@example.test", Auth: "a"}
+			global := `{"udp":[` + tc.global + `]}`
+
+			configs := NewSubJsonService("", "", global, "", nil).getConfig(&SubService{address: "sub.example.com"}, inbound, client, "sub.example.com")
+			if len(configs) != 1 {
+				t.Fatalf("got %d configs, want one", len(configs))
+			}
+			var config struct {
+				Outbounds []struct {
+					StreamSettings map[string]any `json:"streamSettings"`
+				} `json:"outbounds"`
+			}
+			if err := json.Unmarshal(configs[0], &config); err != nil {
+				t.Fatalf("decode config: %v", err)
+			}
+			stream := config.Outbounds[0].StreamSettings
+			finalmask, _ := stream["finalmask"].(map[string]any)
+			masks, _ := finalmask["udp"].([]any)
+			var hops []string
+			for _, entry := range masks {
+				mask, _ := entry.(map[string]any)
+				if mask["type"] == "udphop" {
+					settings, _ := mask["settings"].(map[string]any)
+					hops = append(hops, fmt.Sprint(settings["remotePorts"]))
+				}
+			}
+			last, _ := masks[len(masks)-1].(map[string]any)
+			if len(hops) != 1 || hops[0] != tc.wantPorts || last["type"] != "udphop" {
+				got, _ := json.Marshal(finalmask)
+				t.Fatalf("client finalmask = %s, want one trailing udphop on %s", got, tc.wantPorts)
+			}
+			coreDialsUDP(t, stream)
+		})
+	}
+}
+
 // Every endpoint's config starts from the same parsed inbound finalmask; a host whose own
 // masks are merged in first must not use up the hop range the endpoints after it need.
 func TestSubJsonServiceKeepsUDPHopMaskOnEveryEndpoint(t *testing.T) {