mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-08 19:27:14 +00:00
Kuzz007
df6d2f7652
- manager.go: serverAddress assumed subnetIp always ends in ".0"; a base like "10.8.1.5" was used verbatim as the server's own address, eventually colliding with peer allocation (which starts at .2 upward). Now derives the first host of the actual subnetIp/subnetCidr network via netip, matching serverAddressV6's own approach. A /32 base (no host bits at all) is still used as-is. (Finding 12, partial -- the /16 pool-widening half of this finding only exists on the upstream-pr/amneziawg branch's merged client_wireguard.go, not here; handled separately on that branch.) - manager.go: ensureLocked carried the previous per-peer traffic counters (`last`) forward even through a full restart, but awg-quick down+up resets the kernel's own counters to zero -- the next CollectTraffic computed a large negative delta (clamped to 0), silently discarding real traffic. Extracted the decision into nextTrafficBaseline: only a reload (syncconf) preserves the baseline. (Finding 13) - portfwd.go: exported ForwardedPortsInclude; inbound_amneziawg.go's new checkForwardedPortsConflict uses it to reject, at save time, a client's forwardedPorts that would DNAT the panel's own port or another enabled inbound's port to the tunnel client -- portForwardLines has no destination restriction, so this collision was previously silent. Wired into both the single-client update path and the add-client path (client_inbound_apply.go), plus normalizeAmneziaWGSettings for the whole-inbound save path. (Finding 14) - inbound.go: InboundOption.AwgServer sent the whole ServerSettings struct including PrivateKey to GetInboundOptions callers -- a shared, admin-wide dropdown-filling endpoint the frontend's own AwgServerOptionSchema never reads that field from. Redacted it before assigning. (Finding 11) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
100 lines
3.4 KiB
Go
100 lines
3.4 KiB
Go
package service
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
|
)
|
|
|
|
func TestCheckForwardedPortsConflict_EmptySpecNoConflict(t *testing.T) {
|
|
setupConflictDB(t)
|
|
svc := &InboundService{}
|
|
hit, err := svc.checkForwardedPortsConflict("")
|
|
if err != nil || hit != "" {
|
|
t.Fatalf("an empty spec must never conflict; got hit=%q err=%v", hit, err)
|
|
}
|
|
}
|
|
|
|
func TestCheckForwardedPortsConflict_CollidesWithPanelPort(t *testing.T) {
|
|
setupConflictDB(t)
|
|
svc := &InboundService{}
|
|
// getString falls back to defaultValueMap's "webPort": "2053" on a fresh
|
|
// DB with no explicit setting row.
|
|
hit, err := svc.checkForwardedPortsConflict("2053")
|
|
if err != nil {
|
|
t.Fatalf("checkForwardedPortsConflict: %v", err)
|
|
}
|
|
if !strings.Contains(hit, "panel") {
|
|
t.Fatalf("expected a collision naming the panel's own port, got %q", hit)
|
|
}
|
|
}
|
|
|
|
func TestCheckForwardedPortsConflict_CollidesWithEnabledInboundPort(t *testing.T) {
|
|
setupConflictDB(t)
|
|
seedInboundConflict(t, "vless-8080", "0.0.0.0", 8080, model.VLESS, `{"network":"tcp"}`, `{}`)
|
|
|
|
svc := &InboundService{}
|
|
hit, err := svc.checkForwardedPortsConflict("8000-8100")
|
|
if err != nil {
|
|
t.Fatalf("checkForwardedPortsConflict: %v", err)
|
|
}
|
|
if !strings.Contains(hit, "vless-8080") {
|
|
t.Fatalf("expected a collision naming the colliding inbound, got %q", hit)
|
|
}
|
|
}
|
|
|
|
func TestCheckForwardedPortsConflict_IgnoresDisabledInboundPort(t *testing.T) {
|
|
setupConflictDB(t)
|
|
disabled := &model.Inbound{Tag: "vless-8080-off", Enable: false, Listen: "0.0.0.0", Port: 8080, Protocol: model.VLESS, StreamSettings: `{"network":"tcp"}`}
|
|
if err := database.GetDB().Create(disabled).Error; err != nil {
|
|
t.Fatalf("seed disabled inbound: %v", err)
|
|
}
|
|
|
|
svc := &InboundService{}
|
|
hit, err := svc.checkForwardedPortsConflict("8080")
|
|
if err != nil || hit != "" {
|
|
t.Fatalf("a disabled inbound's port must not be reserved; got hit=%q err=%v", hit, err)
|
|
}
|
|
}
|
|
|
|
func TestCheckForwardedPortsConflict_NoCollisionWhenPortsDontOverlap(t *testing.T) {
|
|
setupConflictDB(t)
|
|
seedInboundConflict(t, "vless-8080", "0.0.0.0", 8080, model.VLESS, `{"network":"tcp"}`, `{}`)
|
|
|
|
svc := &InboundService{}
|
|
hit, err := svc.checkForwardedPortsConflict("9000-9100")
|
|
if err != nil || hit != "" {
|
|
t.Fatalf("unrelated ports must not conflict; got hit=%q err=%v", hit, err)
|
|
}
|
|
}
|
|
|
|
// inboundAmneziaWGServer is pure (no DB), so it needs neither setupConflictDB
|
|
// nor CGO/sqlite -- it can run in any Go environment.
|
|
func TestInboundAmneziaWGServer_RedactsPrivateKey(t *testing.T) {
|
|
settings := `{"server":{"privateKey":"super-secret","publicKey":"pub","mtu":1420},"clients":[]}`
|
|
got := inboundAmneziaWGServer(string(model.AmneziaWG), settings)
|
|
if got == nil {
|
|
t.Fatal("expected a non-nil server block")
|
|
}
|
|
if got.PrivateKey != "" {
|
|
t.Fatalf("PrivateKey must be redacted, got %q", got.PrivateKey)
|
|
}
|
|
if got.PublicKey != "pub" || got.MTU != 1420 {
|
|
t.Fatalf("non-secret fields must still come through unchanged, got %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestInboundAmneziaWGServer_NonAmneziaWGReturnsNil(t *testing.T) {
|
|
if got := inboundAmneziaWGServer(string(model.VLESS), `{"server":{"privateKey":"x"}}`); got != nil {
|
|
t.Fatalf("a non-AmneziaWG protocol must return nil, got %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestInboundAmneziaWGServer_MissingServerBlockReturnsNil(t *testing.T) {
|
|
if got := inboundAmneziaWGServer(string(model.AmneziaWG), `{"clients":[]}`); got != nil {
|
|
t.Fatalf("settings with no server block must return nil, got %+v", got)
|
|
}
|
|
}
|