pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-18 03:45:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds

Browse Source 
xray-core builds a Shadowsocks-2022 inbound with users only for the AES
methods: the multi-user identity header is AES-only, so the config
builder and the multi-user server both reject chacha20. Every panel
inbound carries clients, so picking 2022-blake3-chacha20-poly1305 in the
inbound form kept the whole core from starting; its links also failed
on the client with "multi-key is not supported".

The inbound form no longer offers the method and AddInbound/UpdateInbound
reject it. Startup moves stored inbounds to 2022-blake3-aes-256-gcm,
which takes the same 32-byte keys, so every stored key stays valid.
Outbounds keep the method, since a single-key outbound to such a server
works. The share-link generator drops the single-user branch that only
this method reached.
This commit is contained in:
MHSanaei
2026-10-11 21:20:07 +02:00
parent b9e1d3afee
commit f1ed1a9b17
16 changed files with 203 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/xray/inbound-link.ts
+7 -17
View File
@@ -676,13 +676,8 @@ export interface GenShadowsocksLinkInput {
externalProxy?: ExternalProxyEntry | null;
}
// Shadowsocks 2022 share link. The userinfo portion is base64(method:pw)
// for single-user and base64(method:settingsPw:clientPw) for multi-user
// 2022-blake3. Legacy SS (non-2022) leaves the password out of the
// userinfo entirely — matches the legacy class's password-array logic.
// Note: legacy `isSSMultiUser` returns true for everything except
// 2022-blake3-chacha20-poly1305 (a curious classification, but we
// preserve it for byte-stable parity).
// Shadowsocks share link: base64(method:clientPw) for legacy SS, and
// percent-encoded method:serverPw:clientPw for 2022-blake3 (SIP022).
export function genShadowsocksLink(input: GenShadowsocksLinkInput): string {
const {
inbound,
@@ -725,10 +720,9 @@ export function genShadowsocksLink(input: GenShadowsocksLinkInput): string {
}
const isSS2022 = settings.method.substring(0, 4) === '2022';
const isSSMultiUser = settings.method !== '2022-blake3-chacha20-poly1305';
const passwords: string[] = [];
if (isSS2022) passwords.push(settings.password);
if (isSSMultiUser) passwords.push(clientPassword);
passwords.push(clientPassword);
if (isSS2022) {
// SIP022 (2022-blake3-*) forbids base64 userinfo: method and each key are
@@ -1430,10 +1424,8 @@ export function getInboundClients(inbound: Inbound): ClientShape[] | null {
return (inbound.settings.clients ?? []) as ClientShape[];
case 'tuic':
return (inbound.settings.clients ?? []) as ClientShape[];
case 'shadowsocks': {
const isMultiUser = inbound.settings.method !== '2022-blake3-chacha20-poly1305';
return isMultiUser ? ((inbound.settings.clients ?? []) as ClientShape[]) : null;
}
case 'shadowsocks':
return (inbound.settings.clients ?? []) as ClientShape[];
default:
return null;
}
@@ -1493,18 +1485,16 @@ export function genLink(input: GenLinkInput): string {
flow: client.flow,
externalProxy,
});
case 'shadowsocks': {
const isMultiUser = inbound.settings.method !== '2022-blake3-chacha20-poly1305';
case 'shadowsocks':
return genShadowsocksLink({
inbound,
address,
port,
forceTls,
remark,
clientPassword: isMultiUser ? (client.password ?? '') : '',
clientPassword: client.password ?? '',
externalProxy,
});
}
case 'trojan':
return genTrojanLink({
inbound,