pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-02 19:25:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(xray): keep legacy-private unencrypted outbounds on cores before 26.10.29

Browse Source 
xray-core 26.10.29 (#7249) narrowed the "private" addresses an
unencrypted vless/trojan outbound may reach to RFC 1918, loopback and
link-local, so 100.64.0.0/10 (CGNAT, Tailscale), 198.18.0.0/15 and the
other ranges of the old geoip:private list are now refused. The
embedded validator follows the new core, which made the template save
and outbound subscriptions refuse such an outbound even when the panel
still runs an older core that accepts it.

The legacy skip now also lets through, on a core from 26.7.11 up to
26.10.28, an outbound whose server address (flat, vnext or servers) is
an IP in that core's wider private set. Unknown versions stay strict.
This commit is contained in:
MHSanaei
2026-11-01 14:55:29 +01:00
parent 72c9092d4a
commit e789583b63
3 changed files with 94 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/outbound_subscription.go
+1 -1
View File
@@ -41,7 +41,7 @@ func filterOutboundsRejectedByCore(label string, outbounds []any) ([]any, []stri
for _, ob := range outbounds {
raw, err := json.Marshal(ob)
if err == nil {
if buildErr := xray.ValidateOutboundConfig(raw); buildErr != nil && !shouldSkipLegacyUnencryptedOutboundRejection(coreVersion, buildErr) {
if buildErr := xray.ValidateOutboundConfig(raw); buildErr != nil && !shouldSkipLegacyUnencryptedOutboundRejection(coreVersion, raw, buildErr) {
tag := ""
if m, ok := ob.(map[string]any); ok {
tag, _ = m["tag"].(string)