mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-24 03:47:15 +00:00
Masterain
bd6a6aba43
* feat(pia): add login-and-add WireGuard outbounds (#2) * fix(pia): keep PIA outbounds identifiable after the editor strips hostname The outbound editor drops piaHostname, so last-segment matching failed for hyphenated servers. Identify rows by the computed tag, re-encrypt stored tokens onto the active key, skip unusable catalog rows, and always release the catalog refresh latch.
64 lines
1.9 KiB
Go
64 lines
1.9 KiB
Go
package pia
|
|
|
|
import (
|
|
"crypto"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/pem"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestVerifySignedServerList(t *testing.T) {
|
|
payload := []byte(`{"version":6,"groups":{},"regions":[]}`)
|
|
privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
digest := sha256.Sum256(payload)
|
|
signature, err := rsa.SignPKCS1v15(rand.Reader, privateKey, crypto.SHA256, digest[:])
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
publicDER, err := x509.MarshalPKIXPublicKey(&privateKey.PublicKey)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
publicPEM := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: publicDER})
|
|
signed := append(append(append([]byte{}, payload...), '\n', '\n'), []byte(base64.StdEncoding.EncodeToString(signature))...)
|
|
validSigned := append([]byte(nil), signed...)
|
|
verified, err := VerifySignedServerList(signed, publicPEM)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(verified) != string(payload) {
|
|
t.Fatalf("verified payload changed: %s", verified)
|
|
}
|
|
signed[10] ^= 1
|
|
if _, err := VerifySignedServerList(signed, publicPEM); err == nil {
|
|
t.Fatal("expected tampered payload to fail signature verification")
|
|
}
|
|
for name, input := range map[string][]byte{
|
|
"missing signature": payload,
|
|
"invalid base64": append(append([]byte{}, payload...), []byte("\nnot-base64!")...),
|
|
"trailing garbage": append(append([]byte{}, validSigned...), []byte("\nextra")...),
|
|
} {
|
|
t.Run(name, func(t *testing.T) {
|
|
if _, err := VerifySignedServerList(input, publicPEM); err == nil {
|
|
t.Fatal("expected malformed signed response to be rejected")
|
|
}
|
|
})
|
|
}
|
|
fixture, err := os.ReadFile(filepath.Join("testdata", "serverlist", "invalid_signature.txt"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := VerifySignedServerList(fixture, publicPEM); err == nil {
|
|
t.Fatal("expected invalid-signature fixture to be rejected")
|
|
}
|
|
}
|