mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-12 17:05:01 +03:00
MHSanaei
c5e1e54c75
xray-core opens an XDRIVE stream's storage only when the inbound starts listening, so a Google Drive inbound saved with the form's defaults (no folder, no secrets), a local one without a folder, or a template one whose template xray cannot use stopped xray and every other inbound with it. validateXDriveStorage applies the core's storage rules at save, on inbound add/update and on the xray template's inbounds and outbounds: the service must be local, Google Drive or template; local and Google Drive need a remoteFolder; Google Drive needs its three non-empty secrets; a template must pass newTemplateStorage's checks (put, get, list and delete urls, and a list namesRegex with one capture group). A VLESS client kept its xtls-rprx-vision flow when its inbound moved to a transport that cannot carry it, and GetXrayConfig only honoured DisableFlow, so the server demanded Vision there and refused every client. GetXrayConfig and the outbound form now apply the Vision gate, and that gate now follows the core in the backend, the subscription service and the frontend: TLS/REALITY on raw TCP, or VLESS encryption on any transport (xray runs Vision inside encryption.CommonConn whatever the transport, not only on XHTTP). The outbound modal passes the VLESS encryption into the gate and gates Mux on the effective flow.
327 lines
12 KiB
Go
327 lines
12 KiB
Go
package service
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
|
)
|
|
|
|
func TestClientWithInboundFlow_GatesByInboundCapability(t *testing.T) {
|
|
const vision = "xtls-rprx-vision"
|
|
const enc = `{"encryption":"mlkem768x25519plus.native.0rtt.G3cdPSd1-NnlpTbWNSM5vHsT5VNzWfFzYSKwbUMnV1Y"}`
|
|
cases := []struct {
|
|
name string
|
|
protocol model.Protocol
|
|
streamSettings string
|
|
settings string
|
|
wantFlow string
|
|
}{
|
|
{"vless tcp reality keeps flow", model.VLESS, `{"network":"tcp","security":"reality"}`, "", vision},
|
|
{"vless tcp tls keeps flow", model.VLESS, `{"network":"tcp","security":"tls"}`, "", vision},
|
|
{"vless ws tls clears flow", model.VLESS, `{"network":"ws","security":"tls"}`, "", ""},
|
|
{"vless grpc tls clears flow", model.VLESS, `{"network":"grpc","security":"tls"}`, "", ""},
|
|
{"vless tcp none clears flow", model.VLESS, `{"network":"tcp","security":"none"}`, "", ""},
|
|
{"vmess tcp tls clears flow", model.VMESS, `{"network":"tcp","security":"tls"}`, "", ""},
|
|
{"empty stream clears flow", model.VLESS, "", "", ""},
|
|
// vlessenc (ML-KEM) carries Vision without transport TLS on any transport.
|
|
{"vless tcp vlessenc keeps flow", model.VLESS, `{"network":"tcp","security":"none"}`, enc, vision},
|
|
{"vless xhttp vlessenc keeps flow", model.VLESS, `{"network":"xhttp","security":"none"}`, enc, vision},
|
|
{"vless xhttp no encryption clears flow", model.VLESS, `{"network":"xhttp","security":"none"}`, `{"encryption":"none"}`, ""},
|
|
{"vless xhttp empty settings clears flow", model.VLESS, `{"network":"xhttp","security":"none"}`, "", ""},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
ib := &model.Inbound{Protocol: tc.protocol, StreamSettings: tc.streamSettings, Settings: tc.settings}
|
|
got := clientWithInboundFlow(model.Client{Email: "x@example.com", Flow: vision}, ib)
|
|
if got.Flow != tc.wantFlow {
|
|
t.Errorf("Flow = %q, want %q", got.Flow, tc.wantFlow)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestFlowIsolation_VisionDoesNotLeakToWsInbound(t *testing.T) {
|
|
dbDir := t.TempDir()
|
|
t.Setenv("XUI_DB_FOLDER", dbDir)
|
|
dbtest.InitDB(t, filepath.Join(dbDir, "x-ui.db"))
|
|
|
|
db := database.GetDB()
|
|
|
|
wsTls := &model.Inbound{Tag: "vless-ws", Enable: true, Port: 30001, Protocol: model.VLESS, StreamSettings: `{"network":"ws","security":"tls"}`}
|
|
if err := db.Create(wsTls).Error; err != nil {
|
|
t.Fatalf("create ws+tls inbound: %v", err)
|
|
}
|
|
reality := &model.Inbound{Tag: "vless-reality", Enable: true, Port: 30002, Protocol: model.VLESS, StreamSettings: `{"network":"tcp","security":"reality"}`}
|
|
if err := db.Create(reality).Error; err != nil {
|
|
t.Fatalf("create reality inbound: %v", err)
|
|
}
|
|
|
|
svc := ClientService{}
|
|
const email = "shared@example.com"
|
|
const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c003"
|
|
const vision = "xtls-rprx-vision"
|
|
|
|
source := model.Client{Email: email, ID: uid, Enable: true, Flow: vision}
|
|
for _, ib := range []*model.Inbound{wsTls, reality} {
|
|
gated := clientWithInboundFlow(source, ib)
|
|
if err := svc.SyncInbound(nil, ib.Id, []model.Client{gated}); err != nil {
|
|
t.Fatalf("SyncInbound(%s): %v", ib.Tag, err)
|
|
}
|
|
}
|
|
|
|
realityList, err := svc.ListForInbound(nil, reality.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(reality): %v", err)
|
|
}
|
|
if len(realityList) != 1 || realityList[0].Flow != vision {
|
|
t.Errorf("Reality inbound should keep flow=%q, got %#v", vision, realityList)
|
|
}
|
|
|
|
wsList, err := svc.ListForInbound(nil, wsTls.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(ws): %v", err)
|
|
}
|
|
if len(wsList) != 1 || wsList[0].Flow != "" {
|
|
t.Errorf("WS+TLS inbound must not inherit Vision flow (#4628), got %#v", wsList)
|
|
}
|
|
}
|
|
|
|
func TestEffectiveFlow_NonFlowInboundSyncedLastDoesNotHideVision(t *testing.T) {
|
|
dbDir := t.TempDir()
|
|
t.Setenv("XUI_DB_FOLDER", dbDir)
|
|
dbtest.InitDB(t, filepath.Join(dbDir, "x-ui.db"))
|
|
|
|
db := database.GetDB()
|
|
reality := &model.Inbound{Tag: "vless-reality", Enable: true, Port: 40001, Protocol: model.VLESS, StreamSettings: `{"network":"tcp","security":"reality"}`}
|
|
if err := db.Create(reality).Error; err != nil {
|
|
t.Fatalf("create reality inbound: %v", err)
|
|
}
|
|
hysteria := &model.Inbound{Tag: "hysteria", Enable: true, Port: 40002, Protocol: model.Hysteria, StreamSettings: `{"security":"tls"}`}
|
|
if err := db.Create(hysteria).Error; err != nil {
|
|
t.Fatalf("create hysteria inbound: %v", err)
|
|
}
|
|
|
|
svc := ClientService{}
|
|
const email = "shared@example.com"
|
|
const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c099"
|
|
const vision = "xtls-rprx-vision"
|
|
|
|
source := model.Client{Email: email, ID: uid, Auth: uid, Enable: true, Flow: vision}
|
|
// Reproduce #4792 ordering: the flow-capable inbound (Reality) syncs first,
|
|
// the non-flow inbound (Hysteria) syncs last and wipes clients.Flow to "".
|
|
for _, ib := range []*model.Inbound{reality, hysteria} {
|
|
gated := clientWithInboundFlow(source, ib)
|
|
if err := svc.SyncInbound(nil, ib.Id, []model.Client{gated}); err != nil {
|
|
t.Fatalf("SyncInbound(%s): %v", ib.Tag, err)
|
|
}
|
|
}
|
|
|
|
rec, err := svc.GetRecordByEmail(nil, email)
|
|
if err != nil {
|
|
t.Fatalf("GetRecordByEmail: %v", err)
|
|
}
|
|
if rec.Flow != "" {
|
|
t.Logf("note: canonical clients.Flow = %q (denormalized, not authoritative)", rec.Flow)
|
|
}
|
|
|
|
got, err := svc.EffectiveFlow(nil, rec.Id)
|
|
if err != nil {
|
|
t.Fatalf("EffectiveFlow: %v", err)
|
|
}
|
|
if got != vision {
|
|
t.Errorf("EffectiveFlow = %q, want %q — the edit form would show a blank flow (#4792)", got, vision)
|
|
}
|
|
}
|
|
|
|
func TestEffectiveFlow_ClearedFlowStaysCleared(t *testing.T) {
|
|
dbDir := t.TempDir()
|
|
t.Setenv("XUI_DB_FOLDER", dbDir)
|
|
dbtest.InitDB(t, filepath.Join(dbDir, "x-ui.db"))
|
|
|
|
db := database.GetDB()
|
|
reality := &model.Inbound{Tag: "vless-reality", Enable: true, Port: 41001, Protocol: model.VLESS, StreamSettings: `{"network":"tcp","security":"reality"}`}
|
|
if err := db.Create(reality).Error; err != nil {
|
|
t.Fatalf("create reality inbound: %v", err)
|
|
}
|
|
hysteria := &model.Inbound{Tag: "hysteria", Enable: true, Port: 41002, Protocol: model.Hysteria, StreamSettings: `{"security":"tls"}`}
|
|
if err := db.Create(hysteria).Error; err != nil {
|
|
t.Fatalf("create hysteria inbound: %v", err)
|
|
}
|
|
|
|
svc := ClientService{}
|
|
const email = "noflow@example.com"
|
|
const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c0aa"
|
|
|
|
// User chose no flow: every inbound carries "". A non-empty guard in
|
|
// SyncInbound would make this impossible to express; EffectiveFlow must
|
|
// still report "".
|
|
source := model.Client{Email: email, ID: uid, Auth: uid, Enable: true, Flow: ""}
|
|
for _, ib := range []*model.Inbound{reality, hysteria} {
|
|
gated := clientWithInboundFlow(source, ib)
|
|
if err := svc.SyncInbound(nil, ib.Id, []model.Client{gated}); err != nil {
|
|
t.Fatalf("SyncInbound(%s): %v", ib.Tag, err)
|
|
}
|
|
}
|
|
|
|
rec, err := svc.GetRecordByEmail(nil, email)
|
|
if err != nil {
|
|
t.Fatalf("GetRecordByEmail: %v", err)
|
|
}
|
|
got, err := svc.EffectiveFlow(nil, rec.Id)
|
|
if err != nil {
|
|
t.Fatalf("EffectiveFlow: %v", err)
|
|
}
|
|
if got != "" {
|
|
t.Errorf("EffectiveFlow = %q, want empty (cleared flow must stay cleared)", got)
|
|
}
|
|
}
|
|
|
|
func TestAttach_PreservesVisionFlowWhenCanonicalColumnZeroed(t *testing.T) {
|
|
dbDir := t.TempDir()
|
|
t.Setenv("XUI_DB_FOLDER", dbDir)
|
|
dbtest.InitDB(t, filepath.Join(dbDir, "x-ui.db"))
|
|
|
|
db := database.GetDB()
|
|
|
|
const email = "vision@example.com"
|
|
const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c111"
|
|
const sub = "subvision000001"
|
|
const vision = "xtls-rprx-vision"
|
|
const realityStream = `{"network":"tcp","security":"reality"}`
|
|
|
|
svc := ClientService{}
|
|
source := model.Client{Email: email, ID: uid, SubID: sub, Enable: true, Flow: vision}
|
|
|
|
reality1 := &model.Inbound{
|
|
Tag: "vless-reality-1", Enable: true, Port: 42001, Protocol: model.VLESS,
|
|
StreamSettings: realityStream,
|
|
Settings: clientsSettings(t, []model.Client{source}),
|
|
}
|
|
if err := db.Create(reality1).Error; err != nil {
|
|
t.Fatalf("create reality1: %v", err)
|
|
}
|
|
reality2 := &model.Inbound{
|
|
Tag: "vless-reality-2", Enable: true, Port: 42002, Protocol: model.VLESS,
|
|
StreamSettings: realityStream, Settings: `{"clients":[]}`,
|
|
}
|
|
if err := db.Create(reality2).Error; err != nil {
|
|
t.Fatalf("create reality2: %v", err)
|
|
}
|
|
wsTls := &model.Inbound{
|
|
Tag: "vless-ws", Enable: true, Port: 42003, Protocol: model.VLESS,
|
|
StreamSettings: `{"network":"ws","security":"tls"}`, Settings: `{"clients":[]}`,
|
|
}
|
|
if err := db.Create(wsTls).Error; err != nil {
|
|
t.Fatalf("create ws: %v", err)
|
|
}
|
|
|
|
if err := svc.SyncInbound(nil, reality1.Id, []model.Client{clientWithInboundFlow(source, reality1)}); err != nil {
|
|
t.Fatalf("SyncInbound(reality1): %v", err)
|
|
}
|
|
|
|
rec, err := svc.GetRecordByEmail(nil, email)
|
|
if err != nil {
|
|
t.Fatalf("GetRecordByEmail: %v", err)
|
|
}
|
|
if err := db.Model(&model.ClientRecord{}).Where("id = ?", rec.Id).Update("flow", "").Error; err != nil {
|
|
t.Fatalf("zero canonical flow: %v", err)
|
|
}
|
|
|
|
inboundSvc := &InboundService{}
|
|
if _, err := svc.Attach(inboundSvc, rec.Id, []int{reality2.Id, wsTls.Id}); err != nil {
|
|
t.Fatalf("Attach: %v", err)
|
|
}
|
|
|
|
reality2List, err := svc.ListForInbound(nil, reality2.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(reality2): %v", err)
|
|
}
|
|
if len(reality2List) != 1 || reality2List[0].Flow != vision {
|
|
t.Errorf("attached flow-capable inbound must inherit Vision via EffectiveFlow (#4834), got %#v", reality2List)
|
|
}
|
|
|
|
wsList, err := svc.ListForInbound(nil, wsTls.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(ws): %v", err)
|
|
}
|
|
if len(wsList) != 1 || wsList[0].Flow != "" {
|
|
t.Errorf("attached non-flow inbound must not receive Vision flow, got %#v", wsList)
|
|
}
|
|
}
|
|
|
|
func TestBulkAttach_PreservesVisionFlowWhenCanonicalColumnZeroed(t *testing.T) {
|
|
dbDir := t.TempDir()
|
|
t.Setenv("XUI_DB_FOLDER", dbDir)
|
|
dbtest.InitDB(t, filepath.Join(dbDir, "x-ui.db"))
|
|
|
|
db := database.GetDB()
|
|
|
|
const email = "vision-bulk@example.com"
|
|
const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c222"
|
|
const sub = "subvisionbulk0001"
|
|
const vision = "xtls-rprx-vision"
|
|
const realityStream = `{"network":"tcp","security":"reality"}`
|
|
|
|
svc := ClientService{}
|
|
source := model.Client{Email: email, ID: uid, SubID: sub, Enable: true, Flow: vision}
|
|
|
|
reality1 := &model.Inbound{
|
|
Tag: "vless-reality-bulk-1", Enable: true, Port: 42101, Protocol: model.VLESS,
|
|
StreamSettings: realityStream,
|
|
Settings: clientsSettings(t, []model.Client{source}),
|
|
}
|
|
if err := db.Create(reality1).Error; err != nil {
|
|
t.Fatalf("create reality1: %v", err)
|
|
}
|
|
reality2 := &model.Inbound{
|
|
Tag: "vless-reality-bulk-2", Enable: true, Port: 42102, Protocol: model.VLESS,
|
|
StreamSettings: realityStream, Settings: `{"clients":[]}`,
|
|
}
|
|
if err := db.Create(reality2).Error; err != nil {
|
|
t.Fatalf("create reality2: %v", err)
|
|
}
|
|
wsTls := &model.Inbound{
|
|
Tag: "vless-ws-bulk", Enable: true, Port: 42103, Protocol: model.VLESS,
|
|
StreamSettings: `{"network":"ws","security":"tls"}`, Settings: `{"clients":[]}`,
|
|
}
|
|
if err := db.Create(wsTls).Error; err != nil {
|
|
t.Fatalf("create ws: %v", err)
|
|
}
|
|
|
|
if err := svc.SyncInbound(nil, reality1.Id, []model.Client{clientWithInboundFlow(source, reality1)}); err != nil {
|
|
t.Fatalf("SyncInbound(reality1): %v", err)
|
|
}
|
|
|
|
rec, err := svc.GetRecordByEmail(nil, email)
|
|
if err != nil {
|
|
t.Fatalf("GetRecordByEmail: %v", err)
|
|
}
|
|
if err := db.Model(&model.ClientRecord{}).Where("id = ?", rec.Id).Update("flow", "").Error; err != nil {
|
|
t.Fatalf("zero canonical flow: %v", err)
|
|
}
|
|
|
|
inboundSvc := &InboundService{}
|
|
if _, _, err := svc.BulkAttach(inboundSvc, []string{email}, []int{reality2.Id, wsTls.Id}); err != nil {
|
|
t.Fatalf("BulkAttach: %v", err)
|
|
}
|
|
|
|
reality2List, err := svc.ListForInbound(nil, reality2.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(reality2): %v", err)
|
|
}
|
|
if len(reality2List) != 1 || reality2List[0].Flow != vision {
|
|
t.Errorf("bulk-attached flow-capable inbound must inherit Vision via EffectiveFlow (#6432), got %#v", reality2List)
|
|
}
|
|
|
|
wsList, err := svc.ListForInbound(nil, wsTls.Id)
|
|
if err != nil {
|
|
t.Fatalf("ListForInbound(ws): %v", err)
|
|
}
|
|
if len(wsList) != 1 || wsList[0].Flow != "" {
|
|
t.Errorf("bulk-attached non-flow inbound must not receive Vision flow, got %#v", wsList)
|
|
}
|
|
}
|