pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-06 05:05:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(amneziawg): validate peer subnets before enabling kernel mode (#6965)

Browse Source 
A kernel-mode AmneziaWG inbound routes and masquerades only its interface subnet, so peers whose AllowedIPs lay outside it (a restored backup, a changed subnet) handshook but got no internet. Enabling kernel mode, saving an active kernel inbound, and adding, enabling or re-addressing a client now refuse out-of-subnet peers with the offending client named. Legacy stray peers still start and can still be edited or disabled.
This commit is contained in:
Aleksey
2026-11-03 17:52:26 +03:00
committed by GitHub
parent e093854f5b
commit fee7b1621d
9 changed files with 286 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/kernel_client_guard_test.go
+84
View File
@@ -25,6 +25,7 @@ func TestKernelAWGClientWritesRejectUnsafeValuesAndUnsupportedFeatures(t *testin
{"public key hook injection", "control characters", model.Client{Email: "bad-key@awg", Enable: true, PublicKey: "peer-key\n[Interface]\nPostDown = touch /tmp/pwned", AllowedIPs: []string{"10.8.1.2/32"}}},
{"forwarded ports", "port forwarding is not supported", model.Client{Email: "bad-forward@awg", Enable: true, PublicKey: "peer-key", AllowedIPs: []string{"10.8.1.2/32"}, ForwardedPorts: model.ForwardedPortsPtr("54321")}},
{"IPv6 allowed IP", "per-peer IPv6 egress is not supported", model.Client{Email: "bad-v6@awg", Enable: true, PublicKey: "peer-key", AllowedIPs: []string{"2001:db8::2/128"}}},
{"outside server subnet", "outside kernel interface subnets", model.Client{Email: "bad-subnet@awg", Enable: true, PublicKey: "peer-key", AllowedIPs: []string{"10.9.1.2/32"}}},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -72,6 +73,7 @@ func TestKernelAWGClientUpdateRejectsUnsafeValuesAndUnsupportedFeatures(t *testi
{"preshared key hook injection", "control characters", model.Client{Email: "kept@awg", PreSharedKey: "psk\n[Interface]\nPreDown = touch /tmp/pwned"}},
{"forwarded ports", "port forwarding is not supported", model.Client{Email: "kept@awg", ForwardedPorts: model.ForwardedPortsPtr("54321")}},
{"IPv6 allowed IP", "per-peer IPv6 egress is not supported", model.Client{Email: "kept@awg", AllowedIPs: []string{"2001:db8::2/128"}}},
{"outside server subnet", "outside kernel interface subnets", model.Client{Email: "kept@awg", AllowedIPs: []string{"10.9.1.2/32"}}},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -89,6 +91,7 @@ func TestKernelAWGClientUpdateRejectsUnsafeValuesAndUnsupportedFeatures(t *testi
t.Fatal(getErr)
}
update := tc.update
update.Enable = true
if len(update.AllowedIPs) > 0 {
update.AllowedIPsByInbound = map[int][]string{ib.Id: update.AllowedIPs}
}
@@ -128,6 +131,87 @@ func TestKernelAWGClientFeatureChecksPreserveSupportedPaths(t *testing.T) {
}
}
func TestKernelAWGLegacyClientRecovery(t *testing.T) {
cases := []struct {
name, action string
clientEnabled, inboundEnabled, wantReject bool
}{
{"disable legacy peer", "disable", true, true, false},
{"renew legacy peer", "renew", true, true, false},
{"edit legacy peer", "edit", true, true, false},
{"rename legacy peer", "rename", true, true, false},
{"edit disabled peer", "edit", false, true, false},
{"edit disabled inbound", "change", true, false, false},
{"enable legacy peer", "enable", false, true, true},
{"change to another invalid address", "change", true, true, true},
{"repair legacy address", "repair", true, true, false},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
setupBulkDB(t)
inboundSvc, svc := &InboundService{}, &ClientService{}
ib := mkInbound(t, 52009, model.AmneziaWG, kernelAWGSettings(nil))
seed := model.Client{Email: "legacy@awg", Enable: tc.clientEnabled, PublicKey: "valid-key", PrivateKey: "valid-private", AllowedIPs: []string{"10.8.1.2/32"}}
if _, err := svc.CreateOne(inboundSvc, ib.Id, seed); err != nil {
t.Fatal(err)
}
rec := lookupClientRecord(t, seed.Email)
ib, _ = inboundSvc.GetInbound(ib.Id)
// Model a restored legacy row without going through save validation.
legacy := strings.Replace(ib.Settings, "10.8.1.0", "10.9.1.0", 1)
if legacy == ib.Settings {
t.Fatal("failed to change legacy subnet")
}
if err := database.GetDB().Model(ib).Updates(map[string]any{"settings": legacy, "enable": tc.inboundEnabled}).Error; err != nil {
t.Fatal(err)
}
update := seed
update.ExpiryTime = 4102444800000
update.AllowedIPsByInbound = map[int][]string{ib.Id: seed.AllowedIPs}
var err error
switch tc.action {
case "disable":
_, _, err = svc.SetClientEnableByEmail(inboundSvc, seed.Email, false)
case "enable":
_, _, err = svc.SetClientEnableByEmail(inboundSvc, seed.Email, true)
case "renew":
_, err = svc.ResetClientExpiryTimeByEmail(inboundSvc, seed.Email, update.ExpiryTime)
default:
if tc.action == "rename" {
update.Email = "renamed@awg"
}
if tc.action == "change" {
update.AllowedIPsByInbound[ib.Id] = []string{"10.10.1.2/32"}
}
if tc.action == "repair" {
update.AllowedIPsByInbound[ib.Id] = []string{"10.9.1.2/32"}
}
_, err = svc.Update(inboundSvc, rec.Id, update, 0)
}
if tc.wantReject {
if err == nil || !strings.Contains(err.Error(), "outside kernel interface subnets") {
t.Fatalf("error = %v, want subnet rejection", err)
}
} else if err != nil {
t.Fatalf("legacy recovery rejected: %v", err)
}
after, getErr := inboundSvc.GetInbound(ib.Id)
if getErr != nil {
t.Fatal(getErr)
}
if tc.wantReject && after.Settings != legacy {
t.Fatal("rejected update changed inbound settings")
}
if tc.action == "disable" && mustAWGClients(t, after)[0].Enable {
t.Fatal("client remained enabled")
}
if tc.action == "renew" && mustAWGClients(t, after)[0].ExpiryTime != update.ExpiryTime {
t.Fatal("client expiry was not renewed")
}
})
}
}
func TestKernelAWGSharedCreateAndUpdateValidateAllTargetsBeforeWrites(t *testing.T) {
t.Run("create", func(t *testing.T) {
setupBulkDB(t)