xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-07-19 19:16:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(mtproto): per-client ad-tags, management-API auth, and record secret sync

Browse Source 
Catch the panel up to the mtg-multi README (v1.14.0):

- Each client can now carry its own 32-hex advertising tag overriding the
  inbound-level one. The tag lives on the client (settings JSON is the
  source of truth, clients.ad_tag is the UI projection), is rendered into
  the fork's [secret-ad-tags] section for active secrets only (mtg rejects
  a config whose override names an unknown secret), is pushed per entry
  through PUT /secrets, and is part of the reload fingerprint so a tag
  edit hot-applies without dropping connections.
- The loopback management API can replace the whole secret set, so every
  mtg process now gets a random per-process api-token; the manager sends
  it as a bearer token on PUT /secrets and GET /stats and reuses it across
  config rewrites, because mtg reads the token only at startup.
- Malformed tags are rejected at every save path and additionally dropped
  in InstanceFromInbound: one bad tag would otherwise fail the whole
  generated config and take every client of the inbound down with it.
- SyncInbound never copied a re-keyed mtproto secret into the canonical
  clients table, so the clients page and subscription links kept serving
  the old secret, which mtg then rejects. It is now guarded-copied like
  the other credentials.
This commit is contained in:
MHSanaei
2026-07-07 12:00:43 +02:00
parent 659f0f404c
commit 43500a5470
33 changed files with 361 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/mtproto/manager_test.go
+44 -10
View File
@@ -20,8 +20,9 @@ func TestInstanceFromInbound(t *testing.T) {
`"domainFronting":{"ip":"127.0.0.1","port":9443,"proxyProtocol":true},` +
`"throttleMaxConnections":5000,` +
`"routeThroughXray":true,"routeXrayPort":50000,` +
`"adTag":" 0123456789abcdef0123456789abcdef ",` +
`"clients":[` +
`{"email":"alice","secret":"` + aliceSecret + `","enable":true},` +
`{"email":"alice","secret":"` + aliceSecret + `","adTag":"fedcba9876543210fedcba9876543210","enable":true},` +
`{"email":"bob","secret":"","enable":true},` +
`{"email":"carol","secret":"eeaa","enable":false}]}`,
}
@@ -38,6 +39,12 @@ func TestInstanceFromInbound(t *testing.T) {
if inst.Secrets[0].Secret != aliceSecret {
t.Fatalf("a valid secret must be preserved, got %q", inst.Secrets[0].Secret)
}
if inst.Secrets[0].AdTag != "fedcba9876543210fedcba9876543210" {
t.Fatalf("the client ad-tag override must be parsed, got %q", inst.Secrets[0].AdTag)
}
if inst.AdTag != "0123456789abcdef0123456789abcdef" {
t.Fatalf("the inbound ad-tag must be trimmed and kept, got %q", inst.AdTag)
}
if inst.Port != 8443 || inst.Id != 3 {
t.Fatalf("bad instance %+v", inst)
}
@@ -62,6 +69,17 @@ func TestInstanceFromInbound(t *testing.T) {
if _, ok := InstanceFromInbound(noSecrets); ok {
t.Fatal("an inbound with no active secret should not produce an instance")
}
badTags := &model.Inbound{Protocol: model.MTProto, Settings: `{"adTag":"nope",` +
`"clients":[{"email":"x","secret":"ee00","adTag":"deadbeef","enable":true}]}`}
badInst, ok := InstanceFromInbound(badTags)
if !ok {
t.Fatal("expected a usable instance despite malformed ad tags")
}
if badInst.AdTag != "" || badInst.Secrets[0].AdTag != "" {
t.Fatalf("malformed ad tags must be dropped so the generated config stays valid, got global=%q client=%q",
badInst.AdTag, badInst.Secrets[0].AdTag)
}
}
func TestRenderConfig(t *testing.T) {
@@ -70,8 +88,8 @@ func TestRenderConfig(t *testing.T) {
bare := renderConfig(Instance{
Secrets: []SecretEntry{{Name: "alice", Secret: "ee00"}},
Listen: "0.0.0.0", Port: 8443,
}, 5000)
for _, unwanted := range []string{"debug", "proxy-protocol-listener", "prefer-ip", "[domain-fronting]", "[stats.prometheus]", "[throttle]"} {
}, 5000, "")
for _, unwanted := range []string{"debug", "proxy-protocol-listener", "prefer-ip", "[domain-fronting]", "[stats.prometheus]", "[throttle]", "[secret-ad-tags]", "api-token"} {
if strings.Contains(bare, unwanted) {
t.Fatalf("bare config should not contain %q:\n%s", unwanted, bare)
}
@@ -87,21 +105,26 @@ func TestRenderConfig(t *testing.T) {
}
// A fully configured instance emits every option, the fronting section (as
// host, not the fork-deprecated ip), the throttle block, and [secrets] last.
// host, not the fork-deprecated ip), the throttle block, the per-client
// ad-tag overrides, and [secrets] last.
full := renderConfig(Instance{
Secrets: []SecretEntry{{Name: "alice", Secret: "ee11"}},
Listen: "0.0.0.0", Port: 443,
Secrets: []SecretEntry{
{Name: "alice", Secret: "ee11"},
{Name: "bob", Secret: "ee22", AdTag: "fedcba9876543210fedcba9876543210"},
},
Listen: "0.0.0.0", Port: 443,
Debug: true, ProxyProtocolListener: true, PreferIP: "only-ipv6",
FrontingIP: "127.0.0.1", FrontingPort: 9443, FrontingProxyProtocol: true,
ThrottleMaxConnections: 5000,
AdTag: "0123456789abcdef0123456789abcdef",
PublicIPv4: "1.2.3.4",
PublicIPv6: "2001:db8::1",
}, 6000)
}, 6000, "sesame")
for _, want := range []string{
"debug = true\n",
"proxy-protocol-listener = true\n",
`prefer-ip = "only-ipv6"`,
`api-token = "sesame"`,
`ad-tag = "0123456789abcdef0123456789abcdef"`,
`public-ipv4 = "1.2.3.4"`,
`public-ipv6 = "2001:db8::1"`,
@@ -111,6 +134,8 @@ func TestRenderConfig(t *testing.T) {
"proxy-protocol = true\n",
"[throttle]",
"max-connections = 5000",
"[secret-ad-tags]",
`"bob" = "fedcba9876543210fedcba9876543210"`,
} {
if !strings.Contains(full, want) {
t.Fatalf("full config missing %q:\n%s", want, full)
@@ -119,6 +144,9 @@ func TestRenderConfig(t *testing.T) {
if strings.Contains(full, `ip = "127.0.0.1"`) {
t.Fatalf("domain-fronting must use host, not the deprecated ip key:\n%s", full)
}
if strings.Contains(full, `"alice" = "0123456789abcdef0123456789abcdef"`) || strings.Contains(full, `"alice" = ""`) {
t.Fatalf("a client without an override must not appear in [secret-ad-tags]:\n%s", full)
}
// TOML requires top-level keys before any [section] header, and [secrets]
// must be the final section so trailing keys are not swallowed by a table.
if strings.Index(full, "prefer-ip") > strings.Index(full, "[domain-fronting]") {
@@ -130,6 +158,9 @@ func TestRenderConfig(t *testing.T) {
if strings.LastIndex(full, "[secrets]") < strings.Index(full, "[throttle]") {
t.Fatalf("[throttle] must precede [secrets]:\n%s", full)
}
if strings.LastIndex(full, "[secrets]") < strings.Index(full, "[secret-ad-tags]") {
t.Fatalf("[secret-ad-tags] must precede [secrets]:\n%s", full)
}
}
func TestRenderConfigXrayEgress(t *testing.T) {
@@ -139,7 +170,7 @@ func TestRenderConfigXrayEgress(t *testing.T) {
Secrets: []SecretEntry{{Name: "a", Secret: "ee22"}},
Listen: "0.0.0.0", Port: 443,
RouteThroughXray: true, XrayRoutePort: 50000,
}, 7000)
}, 7000, "")
if !strings.Contains(routed, "[network]") ||
!strings.Contains(routed, `proxies = ["socks5://127.0.0.1:50000"]`) {
t.Fatalf("routed config must emit the SOCKS upstream:\n%s", routed)
@@ -153,7 +184,7 @@ func TestRenderConfigXrayEgress(t *testing.T) {
{Secrets: []SecretEntry{{Name: "a", Secret: "ee"}}, Listen: "0.0.0.0", Port: 443},
{Secrets: []SecretEntry{{Name: "a", Secret: "ee"}}, Listen: "0.0.0.0", Port: 443, RouteThroughXray: true},
} {
if got := renderConfig(inst, 7000); strings.Contains(got, "[network]") {
if got := renderConfig(inst, 7000, ""); strings.Contains(got, "[network]") {
t.Fatalf("unrouted config must omit [network]:\n%s", got)
}
}
@@ -195,6 +226,9 @@ func TestFingerprintSplit(t *testing.T) {
"remove": func(i *Instance) { i.Secrets = nil },
"rename": func(i *Instance) { i.Secrets = []SecretEntry{{Name: "a2", Secret: "ee"}} },
"adTag": func(i *Instance) { i.AdTag = "0123456789abcdef0123456789abcdef" },
"clientAdTag": func(i *Instance) {
i.Secrets = []SecretEntry{{Name: "a", Secret: "ee", AdTag: "0123456789abcdef0123456789abcdef"}}
},
} {
t.Run("secrets/"+name, func(t *testing.T) {
changed := base
@@ -212,7 +246,7 @@ func TestFingerprintSplit(t *testing.T) {
t.Run("orderInsensitive", func(t *testing.T) {
forward := Instance{Secrets: []SecretEntry{{Name: "alice", Secret: "ee11"}, {Name: "bob", Secret: "ee22"}}}
reversed := Instance{Secrets: []SecretEntry{{Name: "bob", Secret: "ee22"}, {Name: "alice", Secret: "ee11"}}}
if got, want := forward.secretsFingerprint(), "adtag=|alice=ee11|bob=ee22"; got != want {
if got, want := forward.secretsFingerprint(), "adtag=|alice=ee11;tag=|bob=ee22;tag="; got != want {
t.Fatalf("secrets fingerprint must join sorted pairs: got %q, want %q", got, want)
}
if forward.secretsFingerprint() != reversed.secretsFingerprint() {