pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-14 09:55:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(xray): add the MASQUE protocol and transport

Browse Source 
xray-core v26.10.10 serves MASQUE: CONNECT-IP over HTTP/3 or HTTP/2,
always behind TLS, as an inbound and an outbound protocol riding a
dedicated "masque" transport. The panel could not create either.

Inbound: MASQUE is a multi-user protocol whose users log in with their
email and password over Basic auth. The panel keeps the client's
"password" like trojan and GenXrayInboundConfig hands it to the core as
"pass", so the full-config path, the live AddInbound path and node
pushes all emit what the core reads; one user with an empty pass makes
the core refuse the whole inbound. Live user adds build a masque.Account
from either key, client-only changes diff per user so a new client does
not drop every connected tunnel, and client creation, copy, validation
and edits key on the password. The address pool and MTU get form
fields, TLS is mandatory, and the port check follows the core's
listener choice: HTTP/2 on TCP when the ALPN offers h2, HTTP/3 on UDP
when it offers h3 or not h2. Nodes may host MASQUE from v3.9.1, the
first panel release that knows to rename the password.

MASQUE has no share-link format, so links and Clash skip it; the JSON
subscription builds the client's masque outbound with its email and
password, and the subscription allowlist now lets a subId see MASQUE
inbounds at all. The IP-limit job, client pages and traffic tracking
list the protocol.

Outbound: the form edits the server, remote DNS, and the transport's
host, path, Basic credentials, headers and WARP block (enrolled key,
endpoint public key, tunnel addresses), which xray-core refuses next to
user/pass. The outbound test probes it through the core, since its
default HTTP/3 dial is UDP.
This commit is contained in:
MHSanaei
2026-10-11 10:26:21 +02:00
parent ca5983595b
commit b04039c2bd
96 changed files with 1506 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/test/__snapshots__/inbound-full.test.ts.snap
+89
View File
@@ -84,6 +84,95 @@ exports[`InboundSchema (full) fixtures > parses hysteria-tls byte-stably 1`] = `
}
`;
exports[`InboundSchema (full) fixtures > parses masque-tls byte-stably 1`] = `
{
"down": 0,
"enable": true,
"expiryTime": 0,
"id": 31,
"listen": "",
"port": 8443,
"protocol": "masque",
"remark": "ivy-masque",
"settings": {
"address": [
"10.14.0.1/24",
"fd14::1/64",
],
"clients": [
{
"comment": "",
"email": "ivy@example.test",
"enable": true,
"expiryTime": 0,
"limitIp": 0,
"password": "masque-pass-ivy",
"reset": 0,
"subId": "masque-001",
"tgId": 0,
"totalGB": 0,
},
],
"mtu": 1400,
},
"shareAddr": "",
"shareAddrStrategy": "node",
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns",
],
"domainsExcluded": [],
"enabled": true,
"ipsExcluded": [],
"metadataOnly": false,
"routeOnly": false,
},
"streamSettings": {
"masqueSettings": {
"path": "/.well-known/masque/ip/*/*/",
},
"network": "masque",
"security": "tls",
"tlsSettings": {
"alpn": [
"h3",
"h2",
],
"certificates": [
{
"buildChain": false,
"certificateFile": "/etc/ssl/certs/masque.crt",
"keyFile": "/etc/ssl/private/masque.key",
"ocspStapling": 0,
"oneTimeLoading": false,
"usage": "encipherment",
},
],
"cipherSuites": "",
"disableSystemRoot": false,
"echServerKeys": "",
"enableSessionResumption": false,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "masque.example.test",
"settings": {
"echConfigList": "",
"fingerprint": "chrome",
"pinnedPeerCertSha256": [],
"verifyPeerCertByName": "",
},
},
},
"tag": "inbound-masque",
"total": 0,
"up": 0,
}
`;
exports[`InboundSchema (full) fixtures > parses shadowsocks-tcp-2022 byte-stably 1`] = `
{
"down": 0,
frontend/src/test/__snapshots__/inbound-link.test.ts.snap
+2
View File
@@ -4,6 +4,8 @@ exports[`genHysteriaLink > hysteria-tls: byte-stable 1`] = `"hysteria2://hyst-v1
exports[`genInboundLinks orchestrator > hysteria-tls: byte-stable 1`] = `"hysteria2://hyst-v1-auth-XYZ@override.test:36715?security=tls&fp=chrome&alpn=h3&sni=hysteria.example.test#parity-test"`;
exports[`genInboundLinks orchestrator > masque-tls: byte-stable 1`] = `""`;
exports[`genInboundLinks orchestrator > shadowsocks-tcp-2022: byte-stable 1`] = `"ss://2022-blake3-aes-256-gcm:ZmFrZS1zZXJ2ZXItcGFzc3dvcmQtMDAwMQ%3D%3D:dGVzdC1jbGllbnQtcGFzc3dvcmQtMQ%3D%3D@override.test:8388?type=tcp#parity-test"`;
exports[`genInboundLinks orchestrator > trojan-ws-tls: byte-stable 1`] = `"trojan://trojan-test-pw-XYZ@override.test:443?type=ws&path=%2Ftrojan&host=trojan.example.test&security=tls&fp=chrome&alpn=h2%2Chttp%2F1.1&sni=trojan.example.test#parity-test"`;
frontend/src/test/client-form-modal.test.tsx
+2 -2
View File
@@ -43,7 +43,7 @@ function tooltipIconForLabel(label: string): HTMLElement {
}
describe('ClientFormModal credential tooltips', () => {
it('explains that the Password field is only consumed by Trojan/Shadowsocks', async () => {
it('explains which protocols consume the Password field', async () => {
renderModal();
openCredentialsTab();
@@ -52,7 +52,7 @@ describe('ClientFormModal credential tooltips', () => {
await waitFor(() => {
expect(document.body.textContent).toContain(
'Used by Trojan, Shadowsocks, and TUIC clients; ignored for VLESS, VMess, Hysteria, and WireGuard.',
'Used by Trojan, Shadowsocks, TUIC, and MASQUE clients; ignored for VLESS, VMess, Hysteria, and WireGuard.',
);
});
});
frontend/src/test/golden/fixtures/inbound-full/masque-tls.json
+70
View File
@@ -0,0 +1,70 @@
{
"id": 31,
"up": 0,
"down": 0,
"total": 0,
"remark": "ivy-masque",
"enable": true,
"expiryTime": 0,
"listen": "",
"port": 8443,
"tag": "inbound-masque",
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls", "quic", "fakedns"],
"metadataOnly": false,
"routeOnly": false,
"ipsExcluded": [],
"domainsExcluded": []
},
"protocol": "masque",
"settings": {
"clients": [
{
"password": "masque-pass-ivy",
"email": "ivy@example.test",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "masque-001",
"comment": "",
"reset": 0
}
],
"address": ["10.14.0.1/24", "fd14::1/64"],
"mtu": 1400
},
"streamSettings": {
"network": "masque",
"masqueSettings": {
"path": "/.well-known/masque/ip/*/*/"
},
"security": "tls",
"tlsSettings": {
"serverName": "masque.example.test",
"minVersion": "1.2",
"maxVersion": "1.3",
"cipherSuites": "",
"rejectUnknownSni": false,
"disableSystemRoot": false,
"enableSessionResumption": false,
"certificates": [
{
"certificateFile": "/etc/ssl/certs/masque.crt",
"keyFile": "/etc/ssl/private/masque.key",
"oneTimeLoading": false,
"usage": "encipherment",
"buildChain": false
}
],
"alpn": ["h3", "h2"],
"echServerKeys": "",
"settings": {
"fingerprint": "chrome",
"echConfigList": ""
}
}
}
}
frontend/src/test/inbound-form-modal.test.tsx
+55
View File
@@ -5,6 +5,7 @@ import InboundFormModal from '@/pages/inbounds/form/InboundFormModal';
import { DBInbound } from '@/models/dbinbound';
import { ThemeProvider } from '@/hooks/useTheme';
import { HttpUtil } from '@/utils';
import { Protocols } from '@/schemas/primitives';
import {
renderWithProviders,
fieldLabels,
@@ -39,6 +40,22 @@ function renderModal() {
);
}
// The protocol dropdown is virtualized, so jsdom renders only its first options; step
// the active option by keyboard from the current protocol in the options' own order.
function chooseVirtualizedProtocol(optionText: string) {
const input = document.getElementById('protocol') as HTMLElement;
const select = input.closest('.ant-select') as HTMLElement;
const current = (select.textContent ?? '').trim();
const order = Object.values(Protocols) as string[];
const steps = order.indexOf(optionText) - order.indexOf(current);
if (order.indexOf(optionText) < 0 || order.indexOf(current) < 0 || steps < 0) {
throw new Error(`cannot step from '${current}' to '${optionText}'`);
}
fireEvent.mouseDown(select.querySelector('.ant-select-selector') ?? select);
for (let i = 0; i < steps; i++) fireEvent.keyDown(input, { key: 'ArrowDown', keyCode: 40 });
fireEvent.keyDown(input, { key: 'Enter', keyCode: 13 });
}
function primaryButton(): HTMLElement {
const button = document.querySelector('.ant-modal-footer .ant-btn-primary');
if (!button) throw new Error('Primary modal button not found');
@@ -362,6 +379,44 @@ describe('InboundFormModal', () => {
expect(stream.realitySettings).toBeUndefined();
});
// xray-core runs MASQUE only on its own transport behind TLS, and leases tunnel
// addresses from settings.address; picking the protocol must seed all three.
it('adds a MASQUE inbound on its own transport with TLS and an address pool', async () => {
const post = vi.mocked(HttpUtil.post);
post.mockClear();
renderModal();
chooseVirtualizedProtocol('masque');
await act(async () => {
await new Promise((r) => setTimeout(r, 0));
});
fireEvent.click(screen.getByRole('tab', { name: 'Security' }));
expect(screen.queryByRole('radio', { name: 'None' })).toBeNull();
fireEvent.change(await screen.findByLabelText('Public Key'), {
target: { value: '/etc/ssl/certs/m.crt' },
});
fireEvent.change(screen.getByLabelText('Private Key'), {
target: { value: '/etc/ssl/private/m.key' },
});
fireEvent.click(primaryButton());
const isAdd = ([url]: unknown[]) => url === '/panel/api/inbounds/add';
await waitFor(() => expect(post.mock.calls.some(isAdd)).toBe(true));
const payload = post.mock.calls.find(isAdd)![1] as {
protocol: string;
settings: string;
streamSettings: string;
};
expect(payload.protocol).toBe('masque');
expect(JSON.parse(payload.settings)).toMatchObject({ address: ['10.14.0.1/24', 'fd14::1/64'] });
expect(JSON.parse(payload.streamSettings)).toMatchObject({
network: 'masque',
security: 'tls',
masqueSettings: { path: '/.well-known/masque/ip/*/*/' },
tlsSettings: { alpn: ['h3'] },
});
});
// Clients and enable change through their own endpoints; the server keeps the
// stored ones, so the edit form must neither send nor validate its stale copy.
it('edit save neither sends nor validates the clients it loaded', async () => {
frontend/src/test/inbound-tag.test.ts
+21
View File
@@ -31,6 +31,27 @@ describe('composeInboundTag transport suffix parity', () => {
'in-443-udp',
],
['wireguard forced udp', base({ protocol: 'wireguard' }), 'in-443-udp'],
[
'masque without alpn is udp',
base({ protocol: 'masque', streamSettings: { network: 'masque', tlsSettings: {} } }),
'in-443-udp',
],
[
'masque h2 is tcp',
base({
protocol: 'masque',
streamSettings: { network: 'masque', tlsSettings: { alpn: ['h2'] } },
}),
'in-443-tcp',
],
[
'masque h3+h2 is both',
base({
protocol: 'masque',
streamSettings: { network: 'masque', tlsSettings: { alpn: ['h3', 'h2'] } },
}),
'in-443-tcpudp',
],
[
'tuic forced udp',
base({ protocol: 'tuic', streamSettings: { network: 'tcp' } }),
frontend/src/test/outbound-form-modal.test.tsx
+74
View File
@@ -378,3 +378,77 @@ describe('OutboundFormModal', () => {
});
});
});
describe('OutboundFormModal MASQUE', () => {
// xray-core refuses user/pass next to warp, and builds the WARP client certificate
// from privateKey; a save that kept stale credentials or dropped a key never connects.
it('saves a WARP-over-MASQUE outbound without Basic-auth credentials', async () => {
const onConfirm = vi.fn();
const queryClient = makeTestQueryClient();
const outbound = {
protocol: 'masque',
tag: 'warp-masque',
settings: { address: '162.159.198.1', port: 443 },
streamSettings: {
network: 'masque',
security: 'tls',
tlsSettings: { serverName: '' },
masqueSettings: { user: 'old-user', pass: 'old-pass' },
},
};
const tree = (open: boolean) => (
<QueryClientProvider client={queryClient}>
<ThemeProvider>
<OutboundFormModal
open={open}
outbound={outbound}
existingTags={[]}
onClose={() => {}}
onConfirm={onConfirm}
/>
</ThemeProvider>
</QueryClientProvider>
);
const { rerender } = render(tree(false));
rerender(tree(true));
await act(async () => {
await new Promise((r) => setTimeout(r, 0));
});
toggleSwitch('WARP');
await act(async () => {
await new Promise((r) => setTimeout(r, 0));
});
fireEvent.change(screen.getByLabelText('Private key'), { target: { value: 'PRIVATE-PEM' } });
fireEvent.change(screen.getByLabelText('Endpoint public key'), {
target: { value: 'PUBLIC-PEM' },
});
const ok = document.querySelector('.ant-modal-footer .ant-btn-primary') as HTMLElement;
await act(async () => {
fireEvent.click(ok);
});
await act(async () => {
await new Promise((r) => setTimeout(r, 0));
});
expect(onConfirm).toHaveBeenCalledTimes(1);
const payload = onConfirm.mock.calls[0][0] as {
protocol: string;
settings: Record<string, unknown>;
streamSettings: {
network: string;
security: string;
masqueSettings: Record<string, unknown>;
};
};
expect(payload.protocol).toBe('masque');
expect(payload.settings).toMatchObject({ address: '162.159.198.1', port: 443 });
expect(payload.streamSettings).toMatchObject({ network: 'masque', security: 'tls' });
expect(payload.streamSettings.masqueSettings.warp).toMatchObject({
privateKey: 'PRIVATE-PEM',
publicKey: 'PUBLIC-PEM',
});
expect(payload.streamSettings.masqueSettings.user).toBeUndefined();
expect(payload.streamSettings.masqueSettings.pass).toBeUndefined();
});
});