* fix(inbound): reject finalmask configured together with REALITY security
finalmask wraps the connection before REALITY's own handshake takes
over (TcpmaskManager.WrapListener -> WrapConnServer runs at Accept()
time, ahead of reality.Server()). reality.Server() does an unchecked
type assertion assuming a raw *net.TCPConn; with finalmask in front,
that assertion panics and takes down the entire xray-core process on
the very first connection to the inbound - not just that connection.
Upstream (XTLS/Xray-core#6453) confirmed this will be documented as
unsupported rather than made graceful, so the panel needs to stop this
combination from being saved rather than relying on docs.
AddInbound/UpdateInbound now reject streamSettings with
security=reality and a non-empty finalmask.tcp/udp with a clear error
instead of letting it reach Xray.
Related: MHSanaei/3x-ui#5857
* fix(inbound): heal legacy rows and narrow the finalmask+REALITY guard
Per review feedback on #5861:
- Narrow the check to finalmask.tcp only. xray-core's TcpmaskManager
(the thing that wraps the TCP listener ahead of REALITY's handshake,
the actual cause of the panic) is only constructed when tcp masks
are present; a finalmask.udp-only config never touches that accept
path and doesn't reproduce the crash, so it shouldn't be rejected.
Extracted the shared check into finalMaskRealityTcpMasks() so both
the save-time guard and the config-build heal below use one
definition of "dangerous".
- Heal already-saved bad rows in GetXrayConfig(), the same way
liftXhttpSessionIDKeys and HealShadowsocksClientMethods heal other
legacy data at config-build time. AddInbound/UpdateInbound only cover
the two save paths - a row that already carries this combination
(saved before this guard existed, synced from a node, restored from
a backup, or edited directly in the DB) would still crash Xray-core
on the next restart without this.
- Add end-to-end tests exercising AddInbound, UpdateInbound, and
GetXrayConfig directly (seeding rows through the real DB) rather
than only unit-testing the extracted helper in isolation, so a
wiring regression in any of the three call sites gets caught.
mrnickson-hue