xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-06 10:27:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(amneziawg): route via Xray through the stock Routing page, not custom toggles

Browse Source 
Simplifies RouteViaXray after realizing the panel already has everything
needed: the Routing page already lets an admin pick a source inbound tag
and a target outbound (plus, if they want it, a specific source IP) for
any protocol. Bolting a parallel routeThroughXray/routeOutboundTag pair
onto both the client and inbound forms duplicated that mechanism instead
of using it.

Removed entirely: Client/ClientRecord/ServerSettings/Peer's
RouteThroughXray + RouteOutboundTag fields, the effective-routing OR/
fallback logic in InstanceFromInbound, and the Switch+Select UI on both
forms. Nothing configures "route via Xray" as a setting anymore.

In its place, every enabled AmneziaWG inbound now gets its own Xray
TPROXY bridge unconditionally, by default, no toggle:

- internal/amneziawg: every peer's traffic is always TPROXY'd into that
  instance's own bridge (defaultPostUpDown, port derived from the
  inbound's id via EgressPortForInbound so the kernel side and the
  Xray-config side never need to negotiate a runtime value). Since the
  TPROXY rule is now tied to a peer's mere presence rather than an
  opt-in flag, hostRulesFingerprint now covers every peer unconditionally
  (add/remove/re-IP forces a restart, the same way ForwardedPorts always
  did) instead of skipping peers with nothing to opt into.
- internal/web/service/xray.go's injectAmneziawgEgress creates one
  dokodemo-door bridge per qualifying inbound, tagged with that inbound's
  own real tag — the same trick injectMtprotoEgress already uses (reusing
  a real inbound's tag), which is why it's already selectable in the
  panel's Routing page: InboundService.GetInboundTags() is a plain,
  protocol-blind SELECT over every inbound row's tag, no dedicated UI
  plumbing needed. The function never generates a routing rule itself
  anymore — where (if anywhere) that traffic goes is entirely up to
  whatever rules the admin adds through the existing Routing UI.

Frontend: no new UI at all. Tests rewritten to match — one bridge per
inbound with its own tag/port, no rule generation, no opt-in gating.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Kuzz007
2026-07-25 22:37:08 +03:00
parent 909feefd1d
commit db8253421a
19 changed files with 289 additions and 782 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/public/openapi.json
-23
View File
@@ -1095,14 +1095,6 @@
"description": "VLESS simple reverse proxy settings",
"nullable": true
},
"routeOutboundTag": {
"description": "Xray outbound/balancer tag this peer's TPROXY'd traffic routes to; empty uses Xray's default routing",
"type": "string"
},
"routeThroughXray": {
"description": "AmneziaWG: TPROXY this peer's traffic into Xray",
"type": "boolean"
},
"secret": {
"example": "ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d",
"type": "string"
@@ -1231,12 +1223,6 @@
"type": "integer"
},
"reverse": {},
"routeOutboundTag": {
"type": "string"
},
"routeThroughXray": {
"type": "boolean"
},
"secret": {
"type": "string"
},
@@ -1283,8 +1269,6 @@
"publicKey",
"reset",
"reverse",
"routeOutboundTag",
"routeThroughXray",
"secret",
"security",
"subId",
@@ -2878,13 +2862,6 @@
"publicKey": {
"type": "string"
},
"routeOutboundTag": {
"type": "string"
},
"routeThroughXray": {
"description": "RouteThroughXray, when true, is the inbound-wide default: every peer\nTPROXYs into Xray unless it explicitly turns its own RouteThroughXray\noff... except a plain bool can't distinguish \"peer left it unset\" from\n\"peer explicitly opted out\", so in practice this ORs with each peer's\nown flag (see Peer.RouteThroughXray) — turning this on routes every\npeer, turning it off still lets individual peers opt in on their own.\nRouteOutboundTag is the default outbound/balancer tag used when a\nrouted peer didn't set its own; empty means Xray's default routing.",
"type": "boolean"
},
"s1": {
"type": "integer"
},
frontend/src/generated/examples.ts
-6
View File
@@ -252,8 +252,6 @@ export const EXAMPLES: Record<string, unknown> = {
"publicKey": "",
"reset": 0,
"reverse": null,
"routeOutboundTag": "",
"routeThroughXray": false,
"secret": "ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d",
"security": "",
"subId": "",
@@ -288,8 +286,6 @@ export const EXAMPLES: Record<string, unknown> = {
"publicKey": "",
"reset": 0,
"reverse": null,
"routeOutboundTag": "",
"routeThroughXray": false,
"secret": "",
"security": "",
"subId": "",
@@ -670,8 +666,6 @@ export const EXAMPLES: Record<string, unknown> = {
"primaryDns": "",
"privateKey": "",
"publicKey": "",
"routeOutboundTag": "",
"routeThroughXray": false,
"s1": 0,
"s2": 0,
"s3": 0,
frontend/src/generated/schemas.ts
-23
View File
@@ -1069,14 +1069,6 @@ export const SCHEMAS: Record<string, unknown> = {
"description": "VLESS simple reverse proxy settings",
"nullable": true
},
"routeOutboundTag": {
"description": "Xray outbound/balancer tag this peer's TPROXY'd traffic routes to; empty uses Xray's default routing",
"type": "string"
},
"routeThroughXray": {
"description": "AmneziaWG: TPROXY this peer's traffic into Xray",
"type": "boolean"
},
"secret": {
"example": "ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d",
"type": "string"
@@ -1205,12 +1197,6 @@ export const SCHEMAS: Record<string, unknown> = {
"type": "integer"
},
"reverse": {},
"routeOutboundTag": {
"type": "string"
},
"routeThroughXray": {
"type": "boolean"
},
"secret": {
"type": "string"
},
@@ -1257,8 +1243,6 @@ export const SCHEMAS: Record<string, unknown> = {
"publicKey",
"reset",
"reverse",
"routeOutboundTag",
"routeThroughXray",
"secret",
"security",
"subId",
@@ -2852,13 +2836,6 @@ export const SCHEMAS: Record<string, unknown> = {
"publicKey": {
"type": "string"
},
"routeOutboundTag": {
"type": "string"
},
"routeThroughXray": {
"description": "RouteThroughXray, when true, is the inbound-wide default: every peer\nTPROXYs into Xray unless it explicitly turns its own RouteThroughXray\noff... except a plain bool can't distinguish \"peer left it unset\" from\n\"peer explicitly opted out\", so in practice this ORs with each peer's\nown flag (see Peer.RouteThroughXray) — turning this on routes every\npeer, turning it off still lets individual peers opt in on their own.\nRouteOutboundTag is the default outbound/balancer tag used when a\nrouted peer didn't set its own; empty means Xray's default routing.",
"type": "boolean"
},
"s1": {
"type": "integer"
},
frontend/src/generated/types.ts
-6
View File
@@ -261,8 +261,6 @@ export interface Client {
publicKey?: string;
reset: number;
reverse?: ClientReverse | null;
routeOutboundTag?: string;
routeThroughXray?: boolean;
secret?: string;
security: string;
subId: string;
@@ -299,8 +297,6 @@ export interface ClientRecord {
publicKey: string;
reset: number;
reverse: unknown;
routeOutboundTag: string;
routeThroughXray: boolean;
secret: string;
security: string;
subId: string;
@@ -653,8 +649,6 @@ export interface ServerSettings {
primaryDns?: string;
privateKey: string;
publicKey: string;
routeOutboundTag?: string;
routeThroughXray?: boolean;
s1: number;
s2: number;
s3: number;
frontend/src/generated/zod.ts
-6
View File
@@ -279,8 +279,6 @@ export const ClientSchema = z.object({
publicKey: z.string().optional(),
reset: z.number().int(),
reverse: z.lazy(() => ClientReverseSchema).nullable().optional(),
routeOutboundTag: z.string().optional(),
routeThroughXray: z.boolean().optional(),
secret: z.string().optional(),
security: z.string(),
subId: z.string(),
@@ -319,8 +317,6 @@ export const ClientRecordSchema = z.object({
publicKey: z.string(),
reset: z.number().int(),
reverse: z.unknown(),
routeOutboundTag: z.string(),
routeThroughXray: z.boolean(),
secret: z.string(),
security: z.string(),
subId: z.string(),
@@ -692,8 +688,6 @@ export const ServerSettingsSchema = z.object({
primaryDns: z.string().optional(),
privateKey: z.string(),
publicKey: z.string(),
routeOutboundTag: z.string().optional(),
routeThroughXray: z.boolean().optional(),
s1: z.number().int(),
s2: z.number().int(),
s3: z.number().int(),
frontend/src/lib/xray/inbound-defaults.ts
-2
View File
@@ -298,8 +298,6 @@ export function createDefaultAmneziawgInboundSettings(): AmneziawgInboundSetting
ipv6Enabled: false,
ipv6Subnet: '',
ipv6ExternalInterface: '',
routeThroughXray: false,
routeOutboundTag: '',
jc: 5,
jmin: 10,
jmax: 50,
frontend/src/pages/clients/ClientFormModal.tsx
+2 -38
View File
@@ -33,7 +33,6 @@ import { FormField } from '@/components/form/rhf';
import { TLS_FLOW_CONTROL } from '@/schemas/primitives';
import type { ClientRecord, InboundOption, ExternalLink, ExternalLinkInput } from '@/hooks/useClients';
import { useFail2banStatusQuery, getLimitIpNotice } from '@/api/queries/useFail2banStatusQuery';
import { useOutboundTags } from '@/api/queries/useOutboundTags';
import { ClientFormSchema, ClientCreateFormSchema, type ClientFormValues } from '@/schemas/client';
const FLOW_OPTIONS = Object.values(TLS_FLOW_CONTROL);
@@ -104,8 +103,6 @@ type Values = ClientFormValues & {
wgPreSharedKey: string;
wgAllowedIPs: string;
awgForwardedPorts: string;
awgRouteThroughXray: boolean;
awgRouteOutboundTag: string;
secret: string;
adTag: string;
};
@@ -136,8 +133,6 @@ const EMPTY: Values = {
wgPreSharedKey: '',
wgAllowedIPs: '',
awgForwardedPorts: '',
awgRouteThroughXray: false,
awgRouteOutboundTag: '',
secret: '',
adTag: '',
};
@@ -198,8 +193,6 @@ export default function ClientFormModal({
const subId = useWatch({ control: methods.control, name: 'subId' });
const auth = useWatch({ control: methods.control, name: 'auth' });
const wgPrivateKey = useWatch({ control: methods.control, name: 'wgPrivateKey' });
const awgRouteThroughXray = useWatch({ control: methods.control, name: 'awgRouteThroughXray' });
const { data: outboundTags } = useOutboundTags();
const limitIp = useWatch({ control: methods.control, name: 'limitIp' });
const {
fields: externalLinkFields,
@@ -253,8 +246,6 @@ export default function ClientFormModal({
wgPreSharedKey: client.preSharedKey || '',
wgAllowedIPs: client.allowedIPs || '',
awgForwardedPorts: client.forwardedPorts || '',
awgRouteThroughXray: !!client.routeThroughXray,
awgRouteOutboundTag: client.routeOutboundTag || '',
secret: client.secret || '',
adTag: client.adTag || '',
};
@@ -570,13 +561,10 @@ export default function ClientFormModal({
if (allowedIPs.length > 0) {
clientPayload.allowedIPs = allowedIPs;
}
// Port-forwarding and RouteViaXray have no WireGuard equivalent —
// Xray-native WireGuard has no host-level iptables layer to hang
// per-client DNAT/TPROXY off of.
// Port-forwarding has no WireGuard equivalent — Xray-native WireGuard
// has no host-level iptables layer to hang per-client DNAT off of.
if (showAmneziawg) {
clientPayload.forwardedPorts = values.awgForwardedPorts.trim();
clientPayload.routeThroughXray = values.awgRouteThroughXray;
clientPayload.routeOutboundTag = values.awgRouteThroughXray ? values.awgRouteOutboundTag.trim() : '';
}
}
@@ -929,30 +917,6 @@ export default function ClientFormModal({
<Input placeholder="80, 443, 8000-8100" />
</FormField>
)}
{showAmneziawg && (
<FormField
name="awgRouteThroughXray"
label={t('pages.clients.amneziaWgRouteThroughXray')}
tooltip={t('pages.clients.amneziaWgRouteThroughXrayHint')}
valueProp="checked"
>
<Switch />
</FormField>
)}
{showAmneziawg && awgRouteThroughXray && (
<FormField
name="awgRouteOutboundTag"
label={t('pages.clients.amneziaWgRouteOutboundTag')}
tooltip={t('pages.clients.amneziaWgRouteOutboundTagHint')}
>
<Select
allowClear
showSearch
placeholder={t('pages.clients.amneziaWgRouteOutboundTagPlaceholder')}
options={(outboundTags ?? []).map((tag) => ({ value: tag, label: tag }))}
/>
</FormField>
)}
</>
)}
{showMtproto && (
frontend/src/pages/inbounds/form/protocols/amneziawg.tsx
+1 -28
View File
@@ -1,10 +1,8 @@
import { useTranslation } from 'react-i18next';
import { Button, Form, Input, InputNumber, Select, Space, Switch } from 'antd';
import { Button, Form, Input, InputNumber, Space, Switch } from 'antd';
import { ReloadOutlined } from '@ant-design/icons';
import { useFormContext, useWatch } from 'react-hook-form';
import { FormField } from '@/components/form/rhf';
import { useOutboundTags } from '@/api/queries/useOutboundTags';
interface AmneziawgFieldsProps {
awgPubKey: string;
@@ -14,9 +12,6 @@ interface AmneziawgFieldsProps {
export default function AmneziawgFields({ awgPubKey, regenInboundAwg, regenInboundAwgObfuscation }: AmneziawgFieldsProps) {
const { t } = useTranslation();
const { control } = useFormContext();
const routeThroughXray = useWatch({ control, name: 'settings.server.routeThroughXray' }) as boolean | undefined;
const { data: outboundTags } = useOutboundTags();
return (
<>
<Form.Item label={t('pages.xray.amneziawg.privateKey')}>
@@ -73,28 +68,6 @@ export default function AmneziawgFields({ awgPubKey, regenInboundAwg, regenInbou
>
<Input placeholder="eth0" />
</FormField>
<FormField
name={['settings', 'server', 'routeThroughXray']}
label={t('pages.xray.amneziawg.routeThroughXray')}
tooltip={t('pages.xray.amneziawg.routeThroughXrayHint')}
valueProp="checked"
>
<Switch />
</FormField>
{routeThroughXray && (
<FormField
name={['settings', 'server', 'routeOutboundTag']}
label={t('pages.xray.amneziawg.routeOutboundTag')}
tooltip={t('pages.xray.amneziawg.routeOutboundTagHint')}
>
<Select
allowClear
showSearch
placeholder={t('pages.xray.amneziawg.routeOutboundTagPlaceholder')}
options={(outboundTags ?? []).map((tag) => ({ value: tag, label: tag }))}
/>
</FormField>
)}
<Form.Item label={t('pages.xray.amneziawg.obfuscation')}>
<Button icon={<ReloadOutlined />} onClick={regenInboundAwgObfuscation}>
{t('pages.xray.amneziawg.regenerateObfuscation')}
frontend/src/schemas/client.ts
-2
View File
@@ -38,8 +38,6 @@ export const ClientRecordSchema = z.object({
preSharedKey: z.string().optional(),
keepAlive: z.number().optional(),
forwardedPorts: z.string().optional(),
routeThroughXray: z.boolean().optional(),
routeOutboundTag: z.string().optional(),
secret: z.string().optional(),
adTag: z.string().optional(),
createdAt: z.number().optional(),
frontend/src/schemas/protocols/inbound/amneziawg.ts
+3 -10
View File
@@ -10,12 +10,9 @@ const optionalClearedInt = (schema: z.ZodNumber) =>
// WireguardClientSchema — the panel's generic ClientRecord already has those
// exact keys (privateKey/publicKey/preSharedKey/allowedIPs/keepAlive), so
// bulk operations, the QR modal and subscriptions all work unmodified — plus
// two AmneziaWG-only additions: forwardedPorts (WireGuard's Xray-native
// inbound has no host-level iptables layer to hang per-client DNAT off of)
// and routeThroughXray/routeOutboundTag (TPROXYs this peer's traffic into a
// shared Xray bridge instead of NAT'ing it straight out — see
// internal/amneziawg's EgressPort). Keys are optional on the wire — the
// backend generates them when absent.
// one AmneziaWG-only addition, forwardedPorts (WireGuard's Xray-native
// inbound has no host-level iptables layer to hang per-client DNAT off of).
// Keys are optional on the wire — the backend generates them when absent.
export const AmneziawgClientSchema = z.object({
privateKey: z.string().optional(),
publicKey: z.string().optional(),
@@ -23,8 +20,6 @@ export const AmneziawgClientSchema = z.object({
allowedIPs: z.array(z.string()).default([]),
keepAlive: optionalClearedInt(z.number().int().min(0)),
forwardedPorts: z.string().default(''),
routeThroughXray: z.boolean().default(false),
routeOutboundTag: z.string().default(''),
email: z.string().min(1),
limitIp: z.number().int().min(0).default(0),
totalGB: z.number().int().min(0).default(0),
@@ -57,8 +52,6 @@ export const AmneziawgServerSchema = z.object({
ipv6Enabled: z.boolean().default(false),
ipv6Subnet: z.string().default(''),
ipv6ExternalInterface: z.string().default(''),
routeThroughXray: z.boolean().default(false),
routeOutboundTag: z.string().default(''),
jc: z.number().int().min(0).default(5),
jmin: z.number().int().min(0).default(10),
jmax: z.number().int().min(0).default(50),
internal/amneziawg/manager.go
+38 -42
View File
@@ -52,21 +52,12 @@ func InstanceFromInbound(ib *model.Inbound) (Instance, bool) {
if !c.Enable || c.PublicKey == "" || len(c.AllowedIPs) == 0 {
continue
}
routeTag := c.RouteOutboundTag
if routeTag == "" {
routeTag = server.RouteOutboundTag
}
peers = append(peers, Peer{
Email: c.Email,
PublicKey: c.PublicKey,
PresharedKey: c.PreSharedKey,
AllowedIPs: c.AllowedIPs,
ForwardedPorts: c.ForwardedPorts,
// Effective routing: the inbound-wide default routes every peer
// unless the peer's own flag already does; the client's own
// outbound tag wins when set, else the inbound's default tag.
RouteThroughXray: c.RouteThroughXray || server.RouteThroughXray,
RouteOutboundTag: routeTag,
})
}
if len(peers) == 0 {
@@ -164,19 +155,21 @@ func (inst Instance) peersFingerprint() string {
}
// hostRulesFingerprint identifies per-peer state that only ever takes effect
// through PostUp/PostDown shell rules — forwarded ports and RouteThroughXray/
// RouteOutboundTag — rather than the WireGuard peer table itself. It is
// checked separately from peersFingerprint because `awg syncconf` never
// re-runs PostUp/PostDown, so a change here must force a full interface
// bounce (ensureRestart) to actually take effect, unlike a key/address-only
// change that syncconf can apply in place.
// through PostUp/PostDown shell rules — forwarded ports, and (unconditionally,
// for every peer with a usable IPv4 address) the TPROXY rule into this
// instance's own Xray bridge — rather than the WireGuard peer table itself.
// It is checked separately from peersFingerprint because `awg syncconf`
// never re-runs PostUp/PostDown, so a change here must force a full
// interface bounce (ensureRestart) to actually take effect, unlike a
// key-only change that syncconf can apply in place. Since the TPROXY rule is
// now tied to every peer's mere presence (there's no more per-peer opt-in
// flag), every peer is included unconditionally: adding, removing, or
// re-addressing a peer now also forces a bounce, the same way a
// ForwardedPorts-only change always did.
func (inst Instance) hostRulesFingerprint() string {
pairs := make([]string, 0, len(inst.Peers))
for _, p := range inst.Peers {
if p.ForwardedPorts == "" && !p.RouteThroughXray {
continue
}
pairs = append(pairs, fmt.Sprintf("%s=fwd:%s;route:%v,%s", p.Email, p.ForwardedPorts, p.RouteThroughXray, p.RouteOutboundTag))
pairs = append(pairs, fmt.Sprintf("%s=fwd:%s;ip:%s", p.Email, p.ForwardedPorts, FirstIPv4(p.AllowedIPs)))
}
slices.Sort(pairs)
return strings.Join(pairs, "|")
@@ -230,10 +223,11 @@ const (
// ensureActionFor decides how to apply a desired instance to the currently
// managed interface. A structural change, a host-rules change (forwarded
// ports or RouteThroughXray/RouteOutboundTag — their iptables rules only
// live in PostUp/PostDown), or a down interface all force a restart; a
// peers-only change (keys/addresses) is a candidate for an in-place
// `syncconf`; identical fingerprints on an up interface need nothing.
// ports, or simply a peer's presence/IP — its always-on TPROXY rule only
// lives in PostUp/PostDown), or a down interface all force a restart; a
// peers-only change (keys only, no IP/presence change) is a candidate for
// an in-place `syncconf`; identical fingerprints on an up interface need
// nothing.
func ensureActionFor(up bool, curStructFP, curHostRulesFP, curPeersFP, newStructFP, newHostRulesFP, newPeersFP string) ensureAction {
if !up || curStructFP != newStructFP || curHostRulesFP != newHostRulesFP {
return ensureRestart
@@ -516,10 +510,15 @@ func hOrDefault(v, def string) string {
// rules, proxy_ndp sysctl, and one `ip -6 neigh add proxy` entry per enabled
// peer with an IPv6 address, so upstream routers see each client's IPv6 as
// directly reachable on the LAN without NAT66. Also emits DNAT+FORWARD rules
// for each enabled peer with a non-empty ForwardedPorts spec, and — for each
// peer with RouteThroughXray set — a mangle-table TPROXY rule redirecting
// that peer's traffic into the shared Xray bridge (see EgressPort), plus the
// one-time policy route TPROXY needs to deliver it there.
// for each enabled peer with a non-empty ForwardedPorts spec, and —
// unconditionally, for every peer — a mangle-table TPROXY rule redirecting
// that peer's traffic into this instance's own Xray bridge (see
// EgressPortForInbound), plus the one-time policy route TPROXY needs to
// deliver it there. There is no per-peer or per-inbound opt-in: the bridge
// is always present by default, and it is entirely up to the admin's own
// Xray Routing rules (targeting this inbound's own tag, which
// injectAmneziawgEgress reuses for the bridge) whether that traffic ever
// actually goes anywhere beyond Xray's default routing.
func defaultPostUpDown(inst Instance, ext string) (postUp, postDown string) {
iface := inst.InterfaceName
up := []string{
@@ -574,28 +573,25 @@ func defaultPostUpDown(inst Instance, ext string) (postUp, postDown string) {
down = append(down, portForwardLines("-D", ext, iface, clientIP, p.Email, p.ForwardedPorts)...)
}
routedAny := false
egressPort := EgressPortForInbound(inst.Id)
anyPeerTproxied := false
for _, p := range inst.Peers {
if !p.RouteThroughXray {
continue
}
clientIP := FirstIPv4(p.AllowedIPs)
if clientIP == "" {
continue
}
up = append(up, routeEgressLines("-A", iface, clientIP, p.Email)...)
down = append(down, routeEgressLines("-D", iface, clientIP, p.Email)...)
routedAny = true
up = append(up, routeEgressLines("-A", iface, clientIP, p.Email, egressPort)...)
down = append(down, routeEgressLines("-D", iface, clientIP, p.Email, egressPort)...)
anyPeerTproxied = true
}
if routedAny {
if anyPeerTproxied {
// The fwmark->table->local-everywhere policy route is what lets TPROXY
// deliver a routed peer's packets to the shared Xray bridge even though
// their destination is never one of this host's own addresses. It is
// system-wide, not interface-specific, so — like the IPv6-forwarding
// sysctl above — it is added idempotently here and never torn down in
// PostDown; a second AmneziaWG instance with its own routed peers must
// find it already in place, not race to remove what the first still
// needs.
// deliver a peer's packets to this instance's own Xray bridge even
// though their destination is never one of this host's own addresses.
// It is system-wide, not interface-specific, so — like the
// IPv6-forwarding sysctl above — it is added idempotently here and
// never torn down in PostDown; a second AmneziaWG instance must find
// it already in place, not race to remove what the first still needs.
up = append(up,
fmt.Sprintf("ip rule add fwmark %#x lookup %d 2>/dev/null || true", EgressFwmark, EgressTable),
fmt.Sprintf("ip route replace local 0.0.0.0/0 dev lo table %d", EgressTable),
internal/amneziawg/manager_test.go
+36 -103
View File
@@ -98,79 +98,6 @@ func TestInstanceFromInboundEmptyWhenNoEnabledPeers(t *testing.T) {
}
}
func TestInstanceFromInboundComputesEffectiveRouting(t *testing.T) {
serverRouted := validServer()
serverRouted.RouteThroughXray = true
serverRouted.RouteOutboundTag = "warp"
t.Run("server default routes a peer with no flag of its own", func(t *testing.T) {
settings := mkInboundSettings(t, serverRouted, []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pubA", AllowedIPs: []string{"10.8.1.2/32"}},
})
inst, ok := InstanceFromInbound(&model.Inbound{Id: 1, Protocol: model.AmneziaWG, Settings: settings})
if !ok {
t.Fatal("expected a usable instance")
}
p := inst.Peers[0]
if !p.RouteThroughXray || p.RouteOutboundTag != "warp" {
t.Fatalf("expected the peer to inherit the server default, got %+v", p)
}
})
t.Run("client's own tag overrides the server default", func(t *testing.T) {
settings := mkInboundSettings(t, serverRouted, []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pubA", AllowedIPs: []string{"10.8.1.2/32"}, RouteOutboundTag: "direct"},
})
inst, ok := InstanceFromInbound(&model.Inbound{Id: 1, Protocol: model.AmneziaWG, Settings: settings})
if !ok {
t.Fatal("expected a usable instance")
}
p := inst.Peers[0]
if !p.RouteThroughXray || p.RouteOutboundTag != "direct" {
t.Fatalf("expected the client's own tag to win, got %+v", p)
}
})
t.Run("client can opt in on its own when the server default is off", func(t *testing.T) {
settings := mkInboundSettings(t, validServer(), []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pubA", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "direct"},
{Email: "b@x", Enable: true, PublicKey: "pubB", AllowedIPs: []string{"10.8.1.3/32"}},
})
inst, ok := InstanceFromInbound(&model.Inbound{Id: 1, Protocol: model.AmneziaWG, Settings: settings})
if !ok {
t.Fatal("expected a usable instance")
}
var a, b Peer
for _, p := range inst.Peers {
switch p.Email {
case "a@x":
a = p
case "b@x":
b = p
}
}
if !a.RouteThroughXray || a.RouteOutboundTag != "direct" {
t.Fatalf("a@x opted in on its own, expected it routed to direct, got %+v", a)
}
if b.RouteThroughXray {
t.Fatalf("b@x has no flag of its own and the server default is off, expected unrouted, got %+v", b)
}
})
t.Run("neither level set means not routed", func(t *testing.T) {
settings := mkInboundSettings(t, validServer(), []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pubA", AllowedIPs: []string{"10.8.1.2/32"}},
})
inst, ok := InstanceFromInbound(&model.Inbound{Id: 1, Protocol: model.AmneziaWG, Settings: settings})
if !ok {
t.Fatal("expected a usable instance")
}
if inst.Peers[0].RouteThroughXray || inst.Peers[0].RouteOutboundTag != "" {
t.Fatalf("expected no routing at all, got %+v", inst.Peers[0])
}
})
}
func TestServerAddress(t *testing.T) {
cases := []struct {
subnet string
@@ -262,7 +189,7 @@ func TestEnsureActionFor(t *testing.T) {
{"down forces restart even if identical", false, "s", "f", "p", "s", "f", "p", ensureRestart},
{"structural change forces restart", true, "s1", "f", "p", "s2", "f", "p", ensureRestart},
{"port-forward change forces restart", true, "s", "f1", "p", "s", "f2", "p", ensureRestart},
{"route-through-xray change forces restart", true, "s", "route:false", "p", "s", "route:true", "p", ensureRestart},
{"peer-ip change (its TPROXY rule) forces restart", true, "s", "ip:old", "p", "s", "ip:new", "p", ensureRestart},
{"peers-only change reloads", true, "s", "f", "p1", "s", "f", "p2", ensureReload},
{"identical up interface is a noop", true, "s", "f", "p", "s", "f", "p", ensureNoop},
}
@@ -276,14 +203,14 @@ func TestEnsureActionFor(t *testing.T) {
}
}
func TestHostRulesFingerprintCoversForwardedPortsAndRouting(t *testing.T) {
func TestHostRulesFingerprintCoversForwardedPortsAndPeerIP(t *testing.T) {
a := baseInstance()
b := baseInstance()
if a.hostRulesFingerprint() != b.hostRulesFingerprint() {
t.Fatal("identical instances must produce the same host-rules fingerprint")
}
if a.hostRulesFingerprint() != "" {
t.Fatal("peers with no forwarded ports and no routing must produce an empty fingerprint")
if a.hostRulesFingerprint() == "" {
t.Fatal("every peer always gets a TPROXY rule now, so the fingerprint must never be empty when peers exist")
}
forwarded := baseInstance()
@@ -292,17 +219,16 @@ func TestHostRulesFingerprintCoversForwardedPortsAndRouting(t *testing.T) {
t.Fatal("adding ForwardedPorts must change the host-rules fingerprint")
}
routed := baseInstance()
routed.Peers[0].RouteThroughXray = true
if a.hostRulesFingerprint() == routed.hostRulesFingerprint() {
t.Fatal("enabling RouteThroughXray must change the host-rules fingerprint")
reIPed := baseInstance()
reIPed.Peers[0].AllowedIPs = []string{"10.8.1.250/32"}
if a.hostRulesFingerprint() == reIPed.hostRulesFingerprint() {
t.Fatal("changing a peer's IP must change the host-rules fingerprint -- its TPROXY rule is keyed on that IP")
}
routedOtherTag := baseInstance()
routedOtherTag.Peers[0].RouteThroughXray = true
routedOtherTag.Peers[0].RouteOutboundTag = "warp"
if routed.hostRulesFingerprint() == routedOtherTag.hostRulesFingerprint() {
t.Fatal("changing RouteOutboundTag must change the host-rules fingerprint")
fewer := baseInstance()
fewer.Peers = fewer.Peers[:1]
if a.hostRulesFingerprint() == fewer.hostRulesFingerprint() {
t.Fatal("removing a peer must change the host-rules fingerprint -- one fewer TPROXY rule is needed")
}
}
@@ -321,7 +247,7 @@ func TestRouteEgressComment(t *testing.T) {
}
func TestRouteEgressLines(t *testing.T) {
up := routeEgressLines("-A", "awg1", "10.8.1.2/32", "a@x")
up := routeEgressLines("-A", "awg1", "10.8.1.2/32", "a@x", 63101)
if len(up) != 2 {
t.Fatalf("expected one TPROXY line per protocol (tcp+udp), got %d: %v", len(up), up)
}
@@ -333,7 +259,7 @@ func TestRouteEgressLines(t *testing.T) {
}
found = true
if !strings.Contains(l, "-i awg1") || !strings.Contains(l, "-s 10.8.1.2") ||
!strings.Contains(l, fmt.Sprintf("--on-port %d", EgressPort)) ||
!strings.Contains(l, "--on-port 63101") ||
!strings.Contains(l, "--on-ip 127.0.0.1") ||
!strings.Contains(l, fmt.Sprintf("--tproxy-mark %#x/%#x", EgressFwmark, EgressFwmark)) ||
!strings.Contains(l, "-A PREROUTING") {
@@ -348,27 +274,35 @@ func TestRouteEgressLines(t *testing.T) {
t.Errorf("expected the /32 mask stripped from the source match, got %s", up[0])
}
down := routeEgressLines("-D", "awg1", "10.8.1.2/32", "a@x")
down := routeEgressLines("-D", "awg1", "10.8.1.2/32", "a@x", 63101)
if len(down) != 2 || !strings.Contains(down[0], "-D PREROUTING") {
t.Fatalf("expected symmetric -D lines, got %v", down)
}
if got := routeEgressLines("-A", "awg1", "", "a@x"); got != nil {
if got := routeEgressLines("-A", "awg1", "", "a@x", 63101); got != nil {
t.Errorf("empty clientIP must yield no lines, got %v", got)
}
}
func TestDefaultPostUpDownEmitsTproxyOnlyForRoutedPeers(t *testing.T) {
inst := baseInstance()
inst.Peers[0].RouteThroughXray = true
inst.Peers[0].RouteOutboundTag = "warp"
func TestEgressPortForInbound(t *testing.T) {
if got := EgressPortForInbound(1); got != EgressBasePort+1 {
t.Errorf("EgressPortForInbound(1) = %d, want %d", got, EgressBasePort+1)
}
if EgressPortForInbound(1) == EgressPortForInbound(2) {
t.Fatal("different inbound ids must derive different ports")
}
}
func TestDefaultPostUpDownEmitsTproxyForEveryPeer(t *testing.T) {
inst := baseInstance() // two peers, a@x and b@x, no opt-in flag exists anymore
up, down := defaultPostUpDown(inst, "eth0")
if !strings.Contains(up, "TPROXY") || !strings.Contains(up, fmt.Sprintf("--on-port %d", EgressPort)) {
t.Errorf("expected a TPROXY rule for the routed peer in PostUp, got:\n%s", up)
wantPort := fmt.Sprintf("--on-port %d", EgressPortForInbound(inst.Id))
if !strings.Contains(up, "TPROXY") || !strings.Contains(up, wantPort) {
t.Errorf("expected TPROXY rules targeting this instance's own bridge port in PostUp, got:\n%s", up)
}
if !strings.Contains(down, "TPROXY") {
t.Errorf("expected a matching TPROXY removal in PostDown, got:\n%s", down)
t.Errorf("expected matching TPROXY removals in PostDown, got:\n%s", down)
}
if !strings.Contains(up, fmt.Sprintf("ip rule add fwmark %#x", EgressFwmark)) {
t.Errorf("expected the shared policy route to be added once in PostUp, got:\n%s", up)
@@ -376,16 +310,15 @@ func TestDefaultPostUpDownEmitsTproxyOnlyForRoutedPeers(t *testing.T) {
if strings.Contains(down, "ip rule") || strings.Contains(down, "ip route") {
t.Error("the shared policy route must never be removed in PostDown -- other instances may still need it")
}
// Peer b@x has no routing enabled: only the one routed peer's tcp+udp
// pair should appear.
if got := strings.Count(up, "TPROXY"); got != 2 {
t.Errorf("expected exactly 2 TPROXY lines (tcp+udp for the one routed peer), got %d in:\n%s", got, up)
// Both peers always get TPROXY'd now, no opt-in: 2 peers * 2 protocols.
if got := strings.Count(up, "TPROXY"); got != 4 {
t.Errorf("expected exactly 4 TPROXY lines (tcp+udp for each of the 2 peers), got %d in:\n%s", got, up)
}
none := baseInstance() // no peer opts in
none := Instance{Id: 2, InterfaceName: "awg2"} // no peers at all
upNone, _ := defaultPostUpDown(none, "eth0")
if strings.Contains(upNone, "TPROXY") || strings.Contains(upNone, "ip rule add fwmark") {
t.Errorf("an instance with no routed peers must not emit any TPROXY/policy-route lines, got:\n%s", upNone)
t.Errorf("an instance with no peers must not emit any TPROXY/policy-route lines, got:\n%s", upNone)
}
}
internal/amneziawg/route_egress.go
+33 -21
View File
@@ -5,25 +5,35 @@ import (
"hash/fnv"
)
// EgressPort is the loopback port of the single Xray dokodemo-door bridge
// every RouteThroughXray peer's TPROXY'd traffic lands on, shared across
// every AmneziaWG instance. defaultPostUpDown's TPROXY rules target it, and
// internal/web/service's injectAmneziawgEgress listens on it. A single
// shared bridge — rather than one per peer — keeps this a plain constant
// instead of state two independent reconcile loops would otherwise have to
// agree on at runtime; per-peer distinction happens downstream, in Xray's
// own router, matched by each peer's TPROXY-preserved tunnel source IP (see
// EgressTag).
const EgressPort = 63100
// EgressBasePort is the first loopback port used for an AmneziaWG inbound's
// own Xray TPROXY bridge. Every enabled inbound gets one bridge, always
// present by default (no opt-in flag): defaultPostUpDown's TPROXY rules
// redirect every peer's traffic there unconditionally, and
// internal/web/service's injectAmneziawgEgress creates the matching
// dokodemo-door inbound, tagged with the AmneziaWG inbound's own real tag so
// it's already selectable in the panel's stock Routing page (the same
// mechanism that already makes an mtproto inbound's own bridge routable
// there — see injectMtprotoEgress). Whether — and where — that traffic
// actually goes anywhere beyond Xray's default routing is entirely up to
// whatever rules the admin adds on that page; this package and
// injectAmneziawgEgress never generate a routing rule themselves.
//
// EgressPortForInbound derives each inbound's own port deterministically
// from its id, so the two independent reconcile loops (this package's
// PostUp generator and the Xray-config generator, in a different package)
// never have to agree on a runtime-negotiated value.
const EgressBasePort = 63100
// EgressTag is the tag of that shared bridge inbound in the generated Xray
// config. Routing rules that distinguish peers match against it as their
// inboundTag.
const EgressTag = "amneziawg-egress"
// EgressPortForInbound returns the loopback port of one AmneziaWG inbound's
// own Xray TPROXY bridge.
func EgressPortForInbound(inboundID int) int {
return EgressBasePort + inboundID
}
// EgressFwmark and EgressTable are the fwmark and policy-routing table
// TPROXY needs to deliver a routed peer's packets to a local socket even
// though their destination is never one of this host's own addresses.
// TPROXY needs to deliver a peer's packets to a local socket even though
// their destination is never one of this host's own addresses. Shared by
// every AmneziaWG instance's bridge — only the port differs per instance.
// Chosen to be distinctive; if either happens to collide with something else
// already using fwmarks/routing tables on the host, change the values here —
// nothing outside this package and its own PostUp/PostDown output depends on
@@ -50,10 +60,12 @@ func routeEgressComment(email string) string {
// routeEgressLines returns the PostUp ("-A") or PostDown ("-D") mangle-table
// TPROXY lines that redirect one peer's traffic — matched by its tunnel
// source IP, arriving on tunIface — into the shared Xray bridge. Both TCP and
// UDP are covered since RouteThroughXray means "this peer's traffic", not a
// specific protocol or port. Returns nil when clientIP is empty.
func routeEgressLines(action, tunIface, clientIP, email string) []string {
// source IP, arriving on tunIface — into that instance's own Xray bridge on
// port. Both TCP and UDP are covered since every peer's whole traffic is
// meant to reach the bridge, not just a specific protocol or port; which
// outbound (if any) it then takes is entirely up to the admin's own Routing
// rules. Returns nil when clientIP is empty.
func routeEgressLines(action, tunIface, clientIP, email string, port int) []string {
clientIP = stripCIDRMask(clientIP)
if clientIP == "" {
return nil
@@ -63,7 +75,7 @@ func routeEgressLines(action, tunIface, clientIP, email string) []string {
for _, proto := range []string{"tcp", "udp"} {
lines = append(lines, fmt.Sprintf(
"iptables -t mangle %s PREROUTING -i %s -s %s -p %s -m comment --comment %s -j TPROXY --on-port %d --on-ip 127.0.0.1 --tproxy-mark %#x/%#x",
action, tunIface, clientIP, proto, comment, EgressPort, EgressFwmark, EgressFwmark,
action, tunIface, clientIP, proto, comment, port, EgressFwmark, EgressFwmark,
))
}
return lines
internal/amneziawg/types.go
-30
View File
@@ -38,25 +38,6 @@ type Peer struct {
// ForwardedPorts is a raw, user-supplied port list ("80, 443, 8000-8100")
// DNAT'd to this peer's tunnel address. Empty means no port-forwarding.
ForwardedPorts string
// RouteThroughXray and RouteOutboundTag are this peer's EFFECTIVE routing
// decision — already resolved by InstanceFromInbound from the per-client
// setting OR'd with the inbound-wide ServerSettings.RouteThroughXray
// default (and the client's own RouteOutboundTag falling back to the
// server's when the client didn't set one). Callers never need to look at
// the raw client/server fields separately.
//
// When true, TPROXYs this peer's traffic (matched by its tunnel source
// IP) into the single shared loopback Xray dokodemo-door bridge (see
// EgressPort in route_egress.go) instead of letting it NAT straight out
// through ExternalInterface. All routed peers, across every AmneziaWG
// instance, share that one bridge and one fwmark/policy-route pair; the
// per-peer distinction happens downstream in Xray's own router, which the
// web service feeds a source-IP-matched rule per peer. RouteOutboundTag
// is the Xray outbound/balancer tag that rule targets; empty means
// Xray's default routing decides.
RouteThroughXray bool
RouteOutboundTag string
}
// Instance is the desired runtime configuration of one AmneziaWG inbound: a
@@ -120,17 +101,6 @@ type ServerSettings struct {
IPv6Subnet string `json:"ipv6Subnet,omitempty"`
IPv6ExternalInterface string `json:"ipv6ExternalInterface,omitempty"`
// RouteThroughXray, when true, is the inbound-wide default: every peer
// TPROXYs into Xray unless it explicitly turns its own RouteThroughXray
// off... except a plain bool can't distinguish "peer left it unset" from
// "peer explicitly opted out", so in practice this ORs with each peer's
// own flag (see Peer.RouteThroughXray) — turning this on routes every
// peer, turning it off still lets individual peers opt in on their own.
// RouteOutboundTag is the default outbound/balancer tag used when a
// routed peer didn't set its own; empty means Xray's default routing.
RouteThroughXray bool `json:"routeThroughXray,omitempty"`
RouteOutboundTag string `json:"routeOutboundTag,omitempty"`
// Obfuscation20's fields, repeated flat (not embedded) rather than
// nested under their own key: encoding/json would happily inline an
// embedded Obfuscation20 the same way, but the frontend's Go->Zod/TS
internal/database/model/model.go
+69 -89
View File
@@ -797,66 +797,62 @@ type ClientReverse struct {
// Client represents a client configuration for Xray inbounds with traffic limits and settings.
type Client struct {
ID string `json:"id,omitempty"` // Unique client identifier
Security string `json:"security"` // Security method (e.g., "auto", "aes-128-gcm")
Password string `json:"password,omitempty"` // Client password
Flow string `json:"flow,omitempty"` // Flow control (XTLS)
Reverse *ClientReverse `json:"reverse,omitempty"` // VLESS simple reverse proxy settings
Auth string `json:"auth,omitempty"` // Auth password (Hysteria)
PrivateKey string `json:"privateKey,omitempty"`
PublicKey string `json:"publicKey,omitempty"`
AllowedIPs []string `json:"allowedIPs,omitempty"`
PreSharedKey string `json:"preSharedKey,omitempty"`
KeepAlive int `json:"keepAlive,omitempty"`
ForwardedPorts string `json:"forwardedPorts,omitempty"` // AmneziaWG per-client port-forwarding spec, e.g. "80,443,8000-8100"
RouteThroughXray bool `json:"routeThroughXray,omitempty"` // AmneziaWG: TPROXY this peer's traffic into Xray
RouteOutboundTag string `json:"routeOutboundTag,omitempty"` // Xray outbound/balancer tag this peer's TPROXY'd traffic routes to; empty uses Xray's default routing
Secret string `json:"secret,omitempty" example:"ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d"`
AdTag string `json:"adTag,omitempty" example:"0123456789abcdef0123456789abcdef"`
Email string `json:"email"` // Client email identifier
LimitIP int `json:"limitIp"` // IP limit for this client
TotalGB int64 `json:"totalGB" form:"totalGB"` // Total traffic limit in GB
ExpiryTime int64 `json:"expiryTime" form:"expiryTime"` // Expiration timestamp
Enable bool `json:"enable" form:"enable"` // Whether the client is enabled
TgID int64 `json:"tgId" form:"tgId"` // Telegram user ID for notifications
SubID string `json:"subId" form:"subId"` // Subscription identifier
Group string `json:"group,omitempty" form:"group"` // Logical grouping label
Comment string `json:"comment" form:"comment"` // Client comment
Reset int `json:"reset" form:"reset"` // Reset period in days
CreatedAt int64 `json:"created_at,omitempty"` // Creation timestamp
UpdatedAt int64 `json:"updated_at,omitempty"` // Last update timestamp
ID string `json:"id,omitempty"` // Unique client identifier
Security string `json:"security"` // Security method (e.g., "auto", "aes-128-gcm")
Password string `json:"password,omitempty"` // Client password
Flow string `json:"flow,omitempty"` // Flow control (XTLS)
Reverse *ClientReverse `json:"reverse,omitempty"` // VLESS simple reverse proxy settings
Auth string `json:"auth,omitempty"` // Auth password (Hysteria)
PrivateKey string `json:"privateKey,omitempty"`
PublicKey string `json:"publicKey,omitempty"`
AllowedIPs []string `json:"allowedIPs,omitempty"`
PreSharedKey string `json:"preSharedKey,omitempty"`
KeepAlive int `json:"keepAlive,omitempty"`
ForwardedPorts string `json:"forwardedPorts,omitempty"` // AmneziaWG per-client port-forwarding spec, e.g. "80,443,8000-8100"
Secret string `json:"secret,omitempty" example:"ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d"`
AdTag string `json:"adTag,omitempty" example:"0123456789abcdef0123456789abcdef"`
Email string `json:"email"` // Client email identifier
LimitIP int `json:"limitIp"` // IP limit for this client
TotalGB int64 `json:"totalGB" form:"totalGB"` // Total traffic limit in GB
ExpiryTime int64 `json:"expiryTime" form:"expiryTime"` // Expiration timestamp
Enable bool `json:"enable" form:"enable"` // Whether the client is enabled
TgID int64 `json:"tgId" form:"tgId"` // Telegram user ID for notifications
SubID string `json:"subId" form:"subId"` // Subscription identifier
Group string `json:"group,omitempty" form:"group"` // Logical grouping label
Comment string `json:"comment" form:"comment"` // Client comment
Reset int `json:"reset" form:"reset"` // Reset period in days
CreatedAt int64 `json:"created_at,omitempty"` // Creation timestamp
UpdatedAt int64 `json:"updated_at,omitempty"` // Last update timestamp
}
type ClientRecord struct {
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
Email string `json:"email" gorm:"uniqueIndex;not null"`
SubID string `json:"subId" gorm:"index;column:sub_id"`
UUID string `json:"uuid" gorm:"column:uuid"`
Password string `json:"password"`
Auth string `json:"auth"`
Flow string `json:"flow"`
Security string `json:"security"`
Reverse string `json:"reverse" gorm:"column:reverse"`
PrivateKey string `json:"privateKey" gorm:"column:wg_private_key"`
PublicKey string `json:"publicKey" gorm:"column:wg_public_key"`
AllowedIPs string `json:"allowedIPs" gorm:"column:wg_allowed_ips"`
PreSharedKey string `json:"preSharedKey" gorm:"column:wg_pre_shared_key"`
KeepAlive int `json:"keepAlive" gorm:"column:wg_keep_alive;default:0"`
ForwardedPorts string `json:"forwardedPorts" gorm:"column:wg_forwarded_ports"`
RouteThroughXray bool `json:"routeThroughXray" gorm:"column:wg_route_through_xray;default:false"`
RouteOutboundTag string `json:"routeOutboundTag" gorm:"column:wg_route_outbound_tag"`
Secret string `json:"secret" gorm:"column:secret"`
AdTag string `json:"adTag" gorm:"column:ad_tag;default:''"`
LimitIP int `json:"limitIp" gorm:"column:limit_ip"`
TotalGB int64 `json:"totalGB" gorm:"column:total_gb"`
ExpiryTime int64 `json:"expiryTime" gorm:"column:expiry_time"`
Enable bool `json:"enable" gorm:"default:true"`
TgID int64 `json:"tgId" gorm:"column:tg_id"`
Group string `json:"group" gorm:"column:group_name;default:'';index:idx_client_record_group"`
Comment string `json:"comment"`
Reset int `json:"reset" gorm:"default:0"`
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli"`
Id int `json:"id" gorm:"primaryKey;autoIncrement"`
Email string `json:"email" gorm:"uniqueIndex;not null"`
SubID string `json:"subId" gorm:"index;column:sub_id"`
UUID string `json:"uuid" gorm:"column:uuid"`
Password string `json:"password"`
Auth string `json:"auth"`
Flow string `json:"flow"`
Security string `json:"security"`
Reverse string `json:"reverse" gorm:"column:reverse"`
PrivateKey string `json:"privateKey" gorm:"column:wg_private_key"`
PublicKey string `json:"publicKey" gorm:"column:wg_public_key"`
AllowedIPs string `json:"allowedIPs" gorm:"column:wg_allowed_ips"`
PreSharedKey string `json:"preSharedKey" gorm:"column:wg_pre_shared_key"`
KeepAlive int `json:"keepAlive" gorm:"column:wg_keep_alive;default:0"`
ForwardedPorts string `json:"forwardedPorts" gorm:"column:wg_forwarded_ports"`
Secret string `json:"secret" gorm:"column:secret"`
AdTag string `json:"adTag" gorm:"column:ad_tag;default:''"`
LimitIP int `json:"limitIp" gorm:"column:limit_ip"`
TotalGB int64 `json:"totalGB" gorm:"column:total_gb"`
ExpiryTime int64 `json:"expiryTime" gorm:"column:expiry_time"`
Enable bool `json:"enable" gorm:"default:true"`
TgID int64 `json:"tgId" gorm:"column:tg_id"`
Group string `json:"group" gorm:"column:group_name;default:'';index:idx_client_record_group"`
Comment string `json:"comment"`
Reset int `json:"reset" gorm:"default:0"`
CreatedAt int64 `json:"createdAt" gorm:"autoCreateTime:milli"`
UpdatedAt int64 `json:"updatedAt" gorm:"autoUpdateTime:milli"`
}
func (ClientRecord) TableName() string { return "clients" }
@@ -1022,16 +1018,14 @@ func (c *Client) ToRecord() *ClientRecord {
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
PrivateKey: c.PrivateKey,
PublicKey: c.PublicKey,
AllowedIPs: strings.Join(c.AllowedIPs, ","),
PreSharedKey: c.PreSharedKey,
KeepAlive: c.KeepAlive,
ForwardedPorts: c.ForwardedPorts,
RouteThroughXray: c.RouteThroughXray,
RouteOutboundTag: c.RouteOutboundTag,
Secret: c.Secret,
AdTag: c.AdTag,
PrivateKey: c.PrivateKey,
PublicKey: c.PublicKey,
AllowedIPs: strings.Join(c.AllowedIPs, ","),
PreSharedKey: c.PreSharedKey,
KeepAlive: c.KeepAlive,
ForwardedPorts: c.ForwardedPorts,
Secret: c.Secret,
AdTag: c.AdTag,
}
if c.Reverse != nil {
if b, err := json.Marshal(c.Reverse); err == nil {
@@ -1078,16 +1072,14 @@ func (r *ClientRecord) ToClient() *Client {
CreatedAt: r.CreatedAt,
UpdatedAt: r.UpdatedAt,
PrivateKey: r.PrivateKey,
PublicKey: r.PublicKey,
AllowedIPs: splitWireguardAllowedIPs(r.AllowedIPs),
PreSharedKey: r.PreSharedKey,
KeepAlive: r.KeepAlive,
ForwardedPorts: r.ForwardedPorts,
RouteThroughXray: r.RouteThroughXray,
RouteOutboundTag: r.RouteOutboundTag,
Secret: r.Secret,
AdTag: r.AdTag,
PrivateKey: r.PrivateKey,
PublicKey: r.PublicKey,
AllowedIPs: splitWireguardAllowedIPs(r.AllowedIPs),
PreSharedKey: r.PreSharedKey,
KeepAlive: r.KeepAlive,
ForwardedPorts: r.ForwardedPorts,
Secret: r.Secret,
AdTag: r.AdTag,
}
if r.Reverse != "" {
var rev ClientReverse
@@ -1264,18 +1256,6 @@ func MergeClientRecord(existing *ClientRecord, incoming *ClientRecord) []ClientM
existing.ForwardedPorts = incoming.ForwardedPorts
}
}
if existing.RouteThroughXray != incoming.RouteThroughXray && incoming.RouteThroughXray {
if incomingNewer || !existing.RouteThroughXray {
keep("routeThroughXray", existing.RouteThroughXray, incoming.RouteThroughXray, true)
existing.RouteThroughXray = true
}
}
if existing.RouteOutboundTag != incoming.RouteOutboundTag && incoming.RouteOutboundTag != "" {
if incomingNewer || existing.RouteOutboundTag == "" {
keep("routeOutboundTag", existing.RouteOutboundTag, incoming.RouteOutboundTag, incoming.RouteOutboundTag)
existing.RouteOutboundTag = incoming.RouteOutboundTag
}
}
if existing.Comment != incoming.Comment && incoming.Comment != "" {
if incomingNewer || existing.Comment == "" {
keep("comment", existing.Comment, incoming.Comment, incoming.Comment)
internal/web/service/xray.go
+44 -93
View File
@@ -645,35 +645,36 @@ const amneziawgEgressDokodemoSettings = `{"allowedNetwork":"tcp,udp","followRedi
// socket.
const amneziawgEgressStreamSettings = `{"sockopt":{"tproxy":"tproxy"}}`
// amneziawgRouteRule is one routed AmneziaWG peer — gathered from every
// enabled AmneziaWG inbound's client list — that injectAmneziawgEgress turns
// into a source-matched routing rule against the shared bridge.
type amneziawgRouteRule struct {
sourceIP string
outboundTag string
}
// injectAmneziawgEgress wires every effectively-routed AmneziaWG peer, across
// every enabled AmneziaWG inbound, into the generated config through one
// loopback dokodemo-door bridge shared by all of them (tag
// amneziawg.EgressTag, port amneziawg.EgressPort) rather than one bridge per
// peer: the TPROXY rule that redirects a peer's traffic there is per-peer
// (see internal/amneziawg's defaultPostUpDown), but distinguishing which peer
// a given connection came from — and picking its own outbound — happens
// here, in Xray's own router, matched against the TPROXY-preserved source
// IP. Reuses amneziawg.InstanceFromInbound for the peer list (rather than
// re-parsing Settings itself) specifically so "is this peer routed, and to
// which outbound" is computed in exactly one place — the same place the
// kernel-side TPROXY rules read it from — and can never quietly diverge
// between the two independent reconcile loops.
// injectAmneziawgEgress gives every enabled AmneziaWG inbound with at least
// one qualifying peer its own loopback dokodemo-door bridge — tagged with
// that inbound's own real tag, so it's already selectable in the panel's
// stock Routing page's inbound-tag picker, exactly the way an mtproto
// inbound's own bridge already is (see injectMtprotoEgress): the picker's
// tag list comes from InboundService.GetInboundTags(), a plain,
// protocol-blind SELECT over every inbound row's tag, so reusing a real
// inbound's own tag needs no dedicated UI plumbing at all.
//
// Mirrors injectMtprotoEgress/injectPanelEgress: an invalid or missing
// outbound target skips that one peer's rule, not the whole bridge; the
// bridge itself is skipped entirely when no peer needs it or its tag is
// already taken by a real inbound. Generated state is hot-appliable and
// never modifies the stored template or restarts the core.
// Every peer's traffic always lands on the bridge — internal/amneziawg's
// defaultPostUpDown TPROXYs it there unconditionally, there is no per-peer
// or per-inbound opt-in flag — but this function never generates a routing
// rule of its own. Whether that traffic goes anywhere beyond Xray's default
// routing is entirely up to whatever rules the admin adds through that same
// stock Routing page (inboundTag + an optional sourceIP to target one
// specific peer + outboundTag, exactly like routing any other protocol).
//
// An inbound is skipped, individually, when its own tag is already taken by
// another config entry — mirroring injectMtprotoEgress/injectPanelEgress's
// own defensive check, even though a real collision shouldn't be possible
// (inbound tags are unique, and the main GenXrayInboundConfig loop already
// excludes mtproto/amneziawg inbounds from ever claiming their own tag
// there). Generated state is hot-appliable and never modifies the stored
// template or restarts the core.
func injectAmneziawgEgress(cfg *xray.Config, inbounds []*model.Inbound) {
var rules []amneziawgRouteRule
existingTags := make(map[string]struct{}, len(cfg.InboundConfigs))
for i := range cfg.InboundConfigs {
existingTags[cfg.InboundConfigs[i].Tag] = struct{}{}
}
for _, inbound := range inbounds {
if inbound.Protocol != model.AmneziaWG || !inbound.Enable || inbound.NodeID != nil {
continue
@@ -682,80 +683,30 @@ func injectAmneziawgEgress(cfg *xray.Config, inbounds []*model.Inbound) {
if !ok {
continue
}
hasQualifyingPeer := false
for _, p := range inst.Peers {
if !p.RouteThroughXray {
continue
if amneziawg.FirstIPv4(p.AllowedIPs) != "" {
hasQualifyingPeer = true
break
}
sourceIP := amneziawg.FirstIPv4(p.AllowedIPs)
if sourceIP == "" {
continue
}
rules = append(rules, amneziawgRouteRule{sourceIP: sourceIP, outboundTag: p.RouteOutboundTag})
}
}
if len(rules) == 0 {
return
}
for i := range cfg.InboundConfigs {
if cfg.InboundConfigs[i].Tag == amneziawg.EgressTag {
logger.Warning("amneziawg egress: inbound tag [", amneziawg.EgressTag, "] already present in generated config, skipping bridge")
return
}
}
routing := map[string]any{}
if len(cfg.RouterConfig) > 0 {
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
logger.Warning("amneziawg egress: routing section is unparsable, skipping injection:", err)
return
}
}
existingRules, _ := routing["rules"].([]any)
newRules := make([]any, 0, len(rules))
for _, r := range rules {
if r.outboundTag == "" {
// No chosen outbound: the peer's traffic still lands on the
// bridge (it's already TPROXY'd there at the kernel level) but
// with no rule of its own it falls through to whatever the rest
// of the router decides, matching injectMtprotoEgress's
// no-outbound-selected behavior.
if !hasQualifyingPeer {
continue
}
if !routingTargetExists(routing, cfg.OutboundConfigs, r.outboundTag) {
logger.Warning("amneziawg egress: target tag [", r.outboundTag, "] not found, skipping rule for [", r.sourceIP, "]")
if _, taken := existingTags[inbound.Tag]; taken {
logger.Warning("amneziawg egress: inbound tag [", inbound.Tag, "] already present in generated config, skipping its bridge")
continue
}
rule := map[string]any{
"type": "field",
"inboundTag": []any{amneziawg.EgressTag},
"source": []any{r.sourceIP + "/32"},
}
if routingTagIsBalancer(routing, r.outboundTag) {
rule["balancerTag"] = r.outboundTag
} else {
rule["outboundTag"] = r.outboundTag
}
newRules = append(newRules, rule)
existingTags[inbound.Tag] = struct{}{}
cfg.InboundConfigs = append(cfg.InboundConfigs, xray.InboundConfig{
Listen: json_util.RawMessage(`"127.0.0.1"`),
Port: amneziawg.EgressPortForInbound(inbound.Id),
Protocol: "dokodemo-door",
Settings: json_util.RawMessage(amneziawgEgressDokodemoSettings),
StreamSettings: json_util.RawMessage(amneziawgEgressStreamSettings),
Tag: inbound.Tag,
})
}
if len(newRules) > 0 {
routing["rules"] = append(newRules, existingRules...)
newRouting, err := json.Marshal(routing)
if err != nil {
logger.Warning("amneziawg egress: failed to rebuild routing section, skipping injection:", err)
return
}
cfg.RouterConfig = json_util.RawMessage(newRouting)
}
cfg.InboundConfigs = append(cfg.InboundConfigs, xray.InboundConfig{
Listen: json_util.RawMessage(`"127.0.0.1"`),
Port: amneziawg.EgressPort,
Protocol: "dokodemo-door",
Settings: json_util.RawMessage(amneziawgEgressDokodemoSettings),
StreamSettings: json_util.RawMessage(amneziawgEgressStreamSettings),
Tag: amneziawg.EgressTag,
})
}
// mergeSubscriptionOutbounds appends the subscription outbounds to the
internal/web/service/xray_config_inject_test.go
+63 -240
View File
@@ -561,49 +561,25 @@ func TestInjectMtprotoEgress_BadRoutingSkips(t *testing.T) {
}
func amneziawgInbound(id int, tag string, clients []model.Client) *model.Inbound {
return amneziawgInboundWithServer(id, tag, amneziawg.ServerSettings{}, clients)
}
// amneziawgInboundWithServer lets a test set inbound-wide fields (namely
// RouteThroughXray/RouteOutboundTag) that InstanceFromInbound now needs —
// injectAmneziawgEgress computes each peer's EFFECTIVE routing decision via
// InstanceFromInbound rather than reading model.Client fields raw, so a
// server block (even a minimal valid one) is required for any of these
// tests to see peers at all.
func amneziawgInboundWithServer(id int, tag string, server amneziawg.ServerSettings, clients []model.Client) *model.Inbound {
if server.SubnetIP == "" {
server.SubnetIP = "10.8.1.0"
}
if server.SubnetCIDR == 0 {
server.SubnetCIDR = 24
}
server := amneziawg.ServerSettings{SubnetIP: "10.8.1.0", SubnetCIDR: 24}
settings, _ := json.Marshal(amneziawg.InboundSettings{Server: &server, Clients: clients})
return &model.Inbound{Id: id, Tag: tag, Protocol: model.AmneziaWG, Enable: true, Settings: string(settings)}
}
type amneziawgRouting struct {
Rules []struct {
InboundTag []string `json:"inboundTag"`
OutboundTag string `json:"outboundTag"`
BalancerTag string `json:"balancerTag"`
Source []string `json:"source"`
Type string `json:"type"`
} `json:"rules"`
}
func TestInjectAmneziawgEgress_WithOutbound(t *testing.T) {
func TestInjectAmneziawgEgress_CreatesBridgeTaggedWithInboundsOwnTag(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
before := string(cfg.RouterConfig)
inbound := amneziawgInbound(7, "awg-7", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("expected the shared bridge to be appended, got %d inbounds", len(cfg.InboundConfigs))
t.Fatalf("expected the bridge to be appended, got %d inbounds", len(cfg.InboundConfigs))
}
ib := cfg.InboundConfigs[1]
if ib.Tag != amneziawg.EgressTag || ib.Protocol != "dokodemo-door" || ib.Port != amneziawg.EgressPort {
t.Fatalf("unexpected bridge inbound: %+v", ib)
if ib.Tag != "awg-7" || ib.Protocol != "dokodemo-door" || ib.Port != amneziawg.EgressPortForInbound(7) {
t.Fatalf("bridge must reuse the inbound's own tag (so it's already selectable in the stock Routing page) and this instance's own derived port, got %+v", ib)
}
if string(ib.Listen) != `"127.0.0.1"` {
t.Fatalf("bridge must listen on loopback, got %s", ib.Listen)
@@ -614,94 +590,45 @@ func TestInjectAmneziawgEgress_WithOutbound(t *testing.T) {
if !strings.Contains(string(ib.Settings), `"followRedirect":true`) {
t.Fatalf("bridge must set followRedirect, got %s", ib.Settings)
}
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(routing.Rules) != 2 {
t.Fatalf("expected the egress rule prepended to the existing rule, got %+v", routing.Rules)
}
first := routing.Rules[0]
if first.Type != "field" || first.OutboundTag != "warp" ||
len(first.InboundTag) != 1 || first.InboundTag[0] != amneziawg.EgressTag ||
len(first.Source) != 1 || first.Source[0] != "10.8.1.2/32" {
t.Fatalf("egress rule must bind the shared bridge tag + peer source IP to the outbound, got %+v", first)
}
}
func TestInjectAmneziawgEgress_MultiplePeersDifferentOutbounds(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
{Email: "b@x", Enable: true, PublicKey: "pub-b", AllowedIPs: []string{"10.8.1.3/32"}, RouteThroughXray: true, RouteOutboundTag: "direct"},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("expected exactly one shared bridge regardless of peer count, got %d inbounds", len(cfg.InboundConfigs))
}
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(routing.Rules) != 3 { // 2 egress rules + the 1 pre-existing rule
t.Fatalf("expected one rule per routed peer, got %+v", routing.Rules)
}
bySource := map[string]string{}
for _, r := range routing.Rules {
if len(r.Source) == 1 {
bySource[r.Source[0]] = r.OutboundTag
}
}
if bySource["10.8.1.2/32"] != "warp" || bySource["10.8.1.3/32"] != "direct" {
t.Fatalf("each peer must route to its own outbound, got %+v", bySource)
}
}
func TestInjectAmneziawgEgress_NoOutboundLeavesRouting(t *testing.T) {
cfg := egressTestConfig()
before := string(cfg.RouterConfig)
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("bridge must still be appended without an outbound, got %+v", cfg.InboundConfigs)
}
// No auto-generated routing rule: it's entirely up to the admin's own
// Routing-page rules, same as any other protocol's inbound tag.
if string(cfg.RouterConfig) != before {
t.Fatalf("no outbound selected means no rule change, got %s", cfg.RouterConfig)
t.Fatalf("injectAmneziawgEgress must never touch the routing section, got %s", cfg.RouterConfig)
}
}
func TestInjectAmneziawgEgress_BalancerTag(t *testing.T) {
func TestInjectAmneziawgEgress_MultipleInboundsEachGetOwnBridge(t *testing.T) {
cfg := egressTestConfig()
cfg.RouterConfig = json_util.RawMessage(`{"rules":[],"balancers":[{"tag":"lb","selector":["warp"]}]}`)
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "lb"},
inbound1 := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
inbound2 := amneziawgInbound(2, "awg-2", []model.Client{
{Email: "b@x", Enable: true, PublicKey: "pub-b", AllowedIPs: []string{"10.9.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound1, inbound2})
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
if len(cfg.InboundConfigs) != 3 {
t.Fatalf("expected one bridge per inbound (plus the pre-existing one), got %d inbounds: %+v", len(cfg.InboundConfigs), cfg.InboundConfigs)
}
if len(routing.Rules) != 1 || routing.Rules[0].BalancerTag != "lb" || routing.Rules[0].OutboundTag != "" {
t.Fatalf("a balancer tag must target balancerTag, got %+v", routing.Rules)
byTag := map[string]int{}
for _, ib := range cfg.InboundConfigs[1:] {
byTag[ib.Tag] = ib.Port
}
if byTag["awg-1"] != amneziawg.EgressPortForInbound(1) || byTag["awg-2"] != amneziawg.EgressPortForInbound(2) {
t.Fatalf("each inbound must get its own tag and its own derived port, got %+v", byTag)
}
}
func TestInjectAmneziawgEgress_Disabled(t *testing.T) {
func TestInjectAmneziawgEgress_NoQualifyingPeerSkipsBridge(t *testing.T) {
cases := []struct {
name string
client model.Client
enable bool
}{
{"client disabled", model.Client{Email: "a@x", Enable: false, AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"}, true},
{"RouteThroughXray off", model.Client{Email: "a@x", Enable: true, AllowedIPs: []string{"10.8.1.2/32"}, RouteOutboundTag: "warp"}, true},
{"no AllowedIPs", model.Client{Email: "a@x", Enable: true, RouteThroughXray: true, RouteOutboundTag: "warp"}, true},
{"inbound disabled", model.Client{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"}, false},
{"client disabled", model.Client{Email: "a@x", Enable: false, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}}, true},
{"no PublicKey", model.Client{Email: "a@x", Enable: true, AllowedIPs: []string{"10.8.1.2/32"}}, true},
{"no AllowedIPs", model.Client{Email: "a@x", Enable: true, PublicKey: "pub-a"}, true},
{"inbound disabled", model.Client{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}}, false},
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
@@ -716,148 +643,44 @@ func TestInjectAmneziawgEgress_Disabled(t *testing.T) {
}
}
func TestInjectAmneziawgEgress_TagCollisionSkips(t *testing.T) {
func TestInjectAmneziawgEgress_WrongProtocolOrNodeSkipped(t *testing.T) {
cfg := egressTestConfig()
vless := &model.Inbound{Id: 1, Tag: "in-1", Protocol: model.VLESS, Enable: true}
nodeID := 5
nodeHosted := amneziawgInbound(2, "awg-2", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}},
})
nodeHosted.NodeID = &nodeID
injectAmneziawgEgress(cfg, []*model.Inbound{vless, nodeHosted})
if len(cfg.InboundConfigs) != 1 {
t.Fatalf("a non-AmneziaWG or node-hosted inbound must never get a bridge, got %+v", cfg.InboundConfigs)
}
}
func TestInjectAmneziawgEgress_TagCollisionSkipsThatInboundOnly(t *testing.T) {
cfg := egressTestConfig()
cfg.InboundConfigs = append(cfg.InboundConfigs,
xray.InboundConfig{Port: 1234, Protocol: "vless", Tag: amneziawg.EgressTag})
before := string(cfg.RouterConfig)
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
xray.InboundConfig{Port: 1234, Protocol: "vless", Tag: "awg-1"})
inbound1 := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 || string(cfg.RouterConfig) != before {
t.Fatal("a real inbound already owning the shared bridge tag must make injection a no-op")
}
}
func TestInjectAmneziawgEgress_MissingTargetSkipsOnlyThatPeer(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
{Email: "b@x", Enable: true, PublicKey: "pub-b", AllowedIPs: []string{"10.8.1.3/32"}, RouteThroughXray: true, RouteOutboundTag: "removed-subscription-outbound"},
inbound2 := amneziawgInbound(2, "awg-2", []model.Client{
{Email: "b@x", Enable: true, PublicKey: "pub-b", AllowedIPs: []string{"10.9.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound1, inbound2})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("the bridge must still be created for the peer with a valid target, got %+v", cfg.InboundConfigs)
// Started with 2 (api + the colliding vless entry); only awg-2's bridge
// should have been added, awg-1's skipped since its tag is taken.
if len(cfg.InboundConfigs) != 3 {
t.Fatalf("expected only the non-colliding inbound's bridge to be added, got %+v", cfg.InboundConfigs)
}
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
found := false
for _, ib := range cfg.InboundConfigs {
if ib.Tag == "awg-2" && ib.Protocol == "dokodemo-door" {
found = true
}
}
if len(routing.Rules) != 2 { // only a@x's rule + the 1 pre-existing rule
t.Fatalf("only the peer with a valid target should get a rule, got %+v", routing.Rules)
}
if routing.Rules[0].Source[0] != "10.8.1.2/32" {
t.Fatalf("expected a@x's rule, got %+v", routing.Rules[0])
}
}
func TestInjectAmneziawgEgress_BadOutboundsSkipsRulesKeepsBridge(t *testing.T) {
cfg := egressTestConfig()
cfg.OutboundConfigs = json_util.RawMessage(`{not json`)
before := string(cfg.RouterConfig)
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("unparsable outbounds must still expose the bridge (other peers may not need routing), got %+v", cfg.InboundConfigs)
}
if string(cfg.RouterConfig) != before {
t.Fatalf("unparsable outbounds means no target can resolve, so no rule change, got %s", cfg.RouterConfig)
}
}
func TestInjectAmneziawgEgress_BadRoutingSkipsEverything(t *testing.T) {
cfg := egressTestConfig()
cfg.RouterConfig = json_util.RawMessage(`{not json`)
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "warp"},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 1 {
t.Fatalf("unparsable routing must not expose the bridge either, got %+v", cfg.InboundConfigs)
}
if string(cfg.RouterConfig) != `{not json` {
t.Fatalf("unparsable routing must be left untouched, got %s", cfg.RouterConfig)
}
}
func TestInjectAmneziawgEgress_NoRoutingSection(t *testing.T) {
cfg := egressTestConfig()
cfg.RouterConfig = nil
inbound := amneziawgInbound(1, "awg-1", []model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "direct"},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(cfg.InboundConfigs) != 2 || len(routing.Rules) != 1 || routing.Rules[0].OutboundTag != "direct" {
t.Fatalf("a routing section must be created with the egress rule, got %+v", routing.Rules)
}
}
func TestInjectAmneziawgEgress_ServerLevelRoutesPeerWithNoOwnFlag(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInboundWithServer(1, "awg-1",
amneziawg.ServerSettings{RouteThroughXray: true, RouteOutboundTag: "warp"},
[]model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
if len(cfg.InboundConfigs) != 2 {
t.Fatalf("the inbound-wide default must route a peer with no client-level flag of its own, got %+v", cfg.InboundConfigs)
}
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(routing.Rules) != 2 || routing.Rules[0].OutboundTag != "warp" || routing.Rules[0].Source[0] != "10.8.1.2/32" {
t.Fatalf("expected a rule routing the peer to the inbound's default outbound, got %+v", routing.Rules)
}
}
func TestInjectAmneziawgEgress_ClientTagOverridesServerTag(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInboundWithServer(1, "awg-1",
amneziawg.ServerSettings{RouteThroughXray: true, RouteOutboundTag: "warp"},
[]model.Client{
// Routed by the server-wide default, but picks its own outbound.
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteOutboundTag: "direct"},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(routing.Rules) != 2 || routing.Rules[0].OutboundTag != "direct" {
t.Fatalf("a client's own outbound tag must win over the inbound's default, got %+v", routing.Rules)
}
}
func TestInjectAmneziawgEgress_ServerLevelOffClientCanStillOptIn(t *testing.T) {
cfg := egressTestConfig()
inbound := amneziawgInboundWithServer(1, "awg-1",
amneziawg.ServerSettings{}, // server-wide routing off
[]model.Client{
{Email: "a@x", Enable: true, PublicKey: "pub-a", AllowedIPs: []string{"10.8.1.2/32"}, RouteThroughXray: true, RouteOutboundTag: "direct"},
{Email: "b@x", Enable: true, PublicKey: "pub-b", AllowedIPs: []string{"10.8.1.3/32"}},
})
injectAmneziawgEgress(cfg, []*model.Inbound{inbound})
var routing amneziawgRouting
if err := json.Unmarshal(cfg.RouterConfig, &routing); err != nil {
t.Fatal(err)
}
if len(routing.Rules) != 2 || routing.Rules[0].Source[0] != "10.8.1.2/32" {
t.Fatalf("a@x must be routed on its own opt-in even with the inbound default off, got %+v", routing.Rules)
if !found {
t.Fatal("awg-2's bridge must still be created despite awg-1's tag collision")
}
}
internal/web/translation/en-US.json
-10
View File
@@ -922,11 +922,6 @@
"amneziaWgAllowedIPsHint": "Leave empty to auto-assign; separate entries with commas",
"amneziaWgForwardedPorts": "Forwarded Ports",
"amneziaWgForwardedPortsHint": "Ports/ranges DNAT'd to this client, e.g. 80, 443, 8000-8100. Leave empty for none.",
"amneziaWgRouteThroughXray": "Route via Xray",
"amneziaWgRouteThroughXrayHint": "Send this client's traffic through Xray instead of straight out the server's network interface.",
"amneziaWgRouteOutboundTag": "Outbound",
"amneziaWgRouteOutboundTagHint": "Which Xray outbound (or balancer) this client's traffic exits through. Leave empty to use Xray's default routing.",
"amneziaWgRouteOutboundTagPlaceholder": "Select an outbound",
"amneziaWgConfig": "AmneziaWG config",
"mtprotoSecret": "MTProto secret",
"mtprotoSecretHint": "The client's FakeTLS secret. Regenerate to rotate it.",
@@ -1945,11 +1940,6 @@
"ipv6SubnetHint": "e.g. fd86:ea04:1115::/64. Required when IPv6 is enabled.",
"ipv6ExternalInterface": "IPv6 External Interface",
"ipv6ExternalInterfaceHint": "Host NIC for the NDP proxy entries. Leave empty to reuse External Interface.",
"routeThroughXray": "Route via Xray (all clients)",
"routeThroughXrayHint": "Send every client's traffic through Xray by default instead of straight out the server's network interface. A client can still enable this on its own even when it's off here.",
"routeOutboundTag": "Default Outbound",
"routeOutboundTagHint": "Default Xray outbound (or balancer) for clients routed through Xray. A client's own outbound choice overrides this. Leave empty to use Xray's default routing.",
"routeOutboundTagPlaceholder": "Select an outbound",
"obfuscation": "Obfuscation parameters",
"regenerateObfuscation": "Regenerate",
"jc": "Jc (junk packet count)",
internal/web/translation/ru-RU.json
-10
View File
@@ -922,11 +922,6 @@
"amneziaWgAllowedIPsHint": "Оставьте пустым для автоназначения; разделяйте записи запятыми",
"amneziaWgForwardedPorts": "Проброс портов",
"amneziaWgForwardedPortsHint": "Порты/диапазоны, DNAT'ящиеся на этого клиента, например 80, 443, 8000-8100. Оставьте пустым, если не нужно.",
"amneziaWgRouteThroughXray": "Маршрутизировать через Xray",
"amneziaWgRouteThroughXrayHint": "Направлять трафик этого клиента через Xray вместо прямого выхода через сетевой интерфейс сервера.",
"amneziaWgRouteOutboundTag": "Исходящий",
"amneziaWgRouteOutboundTagHint": "Через какой исходящий (outbound) или балансировщик Xray выходит трафик этого клиента. Оставьте пустым, чтобы использовать маршрутизацию Xray по умолчанию.",
"amneziaWgRouteOutboundTagPlaceholder": "Выберите исходящий",
"amneziaWgConfig": "Конфиг AmneziaWG",
"mtprotoSecret": "Секрет MTProto",
"mtprotoSecretHint": "Секрет FakeTLS клиента. Перегенерируйте, чтобы сменить.",
@@ -1828,11 +1823,6 @@
"ipv6SubnetHint": "Например, fd86:ea04:1115::/64. Обязательно при включённом IPv6.",
"ipv6ExternalInterface": "Внешний интерфейс для IPv6",
"ipv6ExternalInterfaceHint": "Сетевой интерфейс хоста для записей NDP-прокси. Оставьте пустым, чтобы использовать «Внешний интерфейс».",
"routeThroughXray": "Маршрутизировать через Xray (все клиенты)",
"routeThroughXrayHint": "Направлять трафик всех клиентов через Xray по умолчанию вместо прямого выхода через сетевой интерфейс сервера. Клиент может включить это индивидуально, даже если здесь выключено.",
"routeOutboundTag": "Исходящий по умолчанию",
"routeOutboundTagHint": "Исходящий (outbound) или балансировщик Xray по умолчанию для клиентов, маршрутизируемых через Xray. Собственный выбор клиента имеет приоритет. Оставьте пустым для маршрутизации Xray по умолчанию.",
"routeOutboundTagPlaceholder": "Выберите исходящий",
"obfuscation": "Параметры обфускации",
"regenerateObfuscation": "Сгенерировать заново",
"jc": "Jc (кол-во мусорных пакетов)",