pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-08 06:05:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): apply the outbound address policy to remote cert pinning

Browse Source 
The remote certificate fetch now dials through the same netsafe guard
as the REALITY target scan. A private or loopback endpoint is refused
unless the request carries allowPrivate; the inbound form asks the
operator to confirm and retries with the opt-in.
This commit is contained in:
MHSanaei
2026-10-03 13:20:00 +02:00
parent d31465e37b
commit ede275e4dc
8 changed files with 87 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/server.go
+7 -4
View File
@@ -39,6 +39,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
"github.com/mhsanaei/3x-ui/v3/internal/logger"
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
"github.com/mhsanaei/3x-ui/v3/internal/util/netsafe"
"github.com/mhsanaei/3x-ui/v3/internal/util/sys"
"github.com/mhsanaei/3x-ui/v3/internal/xray"
@@ -2757,7 +2758,8 @@ func walkCertFiles(node any, out []string) []string {
// proxy). A native handshake replaces the old `xray tls ping` subprocess so the
// real dial/handshake failure (connection refused, timeout, …) surfaces
// verbatim. `server` may be host or host:port; the port defaults to 443.
func (s *ServerService) GetRemoteCertHash(server string) ([]string, error) {
// allowPrivate lifts the SSRF guard for this one probe (the panel's confirmed opt-in).
func (s *ServerService) GetRemoteCertHash(server string, allowPrivate bool) ([]string, error) {
server = strings.TrimSpace(server)
if server == "" {
return nil, common.NewError("no server provided")
@@ -2768,10 +2770,11 @@ func (s *ServerService) GetRemoteCertHash(server string) ([]string, error) {
host, port = h, p
}
dialer := stdnet.Dialer{Timeout: 10 * time.Second}
tcpConn, err := dialer.Dial("tcp", stdnet.JoinHostPort(host, port))
ctx, cancel := context.WithTimeout(netsafe.ContextWithAllowPrivate(context.Background(), allowPrivate), 10*time.Second)
defer cancel()
tcpConn, err := netsafe.SSRFGuardedDialContext(ctx, "tcp", stdnet.JoinHostPort(host, port))
if err != nil {
return nil, common.NewErrorf("failed to dial %s: %s", stdnet.JoinHostPort(host, port), err)
return nil, fmt.Errorf("failed to dial %s: %w", stdnet.JoinHostPort(host, port), err)
}
defer tcpConn.Close()
_ = tcpConn.SetDeadline(time.Now().Add(15 * time.Second))