mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-07-09 06:06:08 +00:00
mrnickson-hue
7db92d6318
* fix(inbound): reject finalmask configured together with REALITY security finalmask wraps the connection before REALITY's own handshake takes over (TcpmaskManager.WrapListener -> WrapConnServer runs at Accept() time, ahead of reality.Server()). reality.Server() does an unchecked type assertion assuming a raw *net.TCPConn; with finalmask in front, that assertion panics and takes down the entire xray-core process on the very first connection to the inbound - not just that connection. Upstream (XTLS/Xray-core#6453) confirmed this will be documented as unsupported rather than made graceful, so the panel needs to stop this combination from being saved rather than relying on docs. AddInbound/UpdateInbound now reject streamSettings with security=reality and a non-empty finalmask.tcp/udp with a clear error instead of letting it reach Xray. Related: MHSanaei/3x-ui#5857 * fix(inbound): heal legacy rows and narrow the finalmask+REALITY guard Per review feedback on #5861: - Narrow the check to finalmask.tcp only. xray-core's TcpmaskManager (the thing that wraps the TCP listener ahead of REALITY's handshake, the actual cause of the panic) is only constructed when tcp masks are present; a finalmask.udp-only config never touches that accept path and doesn't reproduce the crash, so it shouldn't be rejected. Extracted the shared check into finalMaskRealityTcpMasks() so both the save-time guard and the config-build heal below use one definition of "dangerous". - Heal already-saved bad rows in GetXrayConfig(), the same way liftXhttpSessionIDKeys and HealShadowsocksClientMethods heal other legacy data at config-build time. AddInbound/UpdateInbound only cover the two save paths - a row that already carries this combination (saved before this guard existed, synced from a node, restored from a backup, or edited directly in the DB) would still crash Xray-core on the next restart without this. - Add end-to-end tests exercising AddInbound, UpdateInbound, and GetXrayConfig directly (seeding rows through the real DB) rather than only unit-testing the extracted helper in isolation, so a wiring regression in any of the three call sites gets caught.