feat: поддержка AmneziaWG 3.1, keepalive ranges, безопасный ruleset HTTP client и Source-Aware DNS
This commit is contained in:
Dushnilin
+12
-2
@@ -604,9 +604,13 @@ fi
|
||||
if grep -Fq $'nft\tadd\telement\tinet\tTachyonTable\ttachyon_rule_ports_with_domain_ports\t{ 8443 }' "$NFT_LOG"; then
|
||||
fail "ports with destination matchers should not populate global port set"
|
||||
fi
|
||||
if grep -Fq '192.0.2.53' "$NFT_LOG" || grep -Fq '192.168.1.53' "$NFT_LOG" || grep -Fq 'tachyon_rule_dns_only' "$NFT_LOG"; then
|
||||
fail "DNS action should not populate nft sets or fully routed rules"
|
||||
if grep -Fq '192.0.2.53' "$NFT_LOG" || grep -Fq 'tachyon_rule_dns_only' "$NFT_LOG"; then
|
||||
fail "DNS action should not populate routing nft sets"
|
||||
fi
|
||||
if grep -Fq $'mangle\tiifname\t@tachyon_interfaces\tip\tsaddr\t192.168.1.53' "$NFT_LOG"; then
|
||||
fail "DNS action should not create fully routed mangle rules"
|
||||
fi
|
||||
assert_contains "$NFT_LOG" $'nft\tadd\telement\tinet\tTachyonTable\ttachyon_dns_sources\t{ 192.168.1.53/32 }' "DNS action populates dns sources set"
|
||||
if [ "$(grep -F $'ip\tsaddr\t192.168.1.20/32' "$NFT_LOG" | wc -l | tr -d ' ')" != "3" ]; then
|
||||
fail "duplicate fully routed source should insert exactly one tcp/udp/local rule set"
|
||||
fi
|
||||
@@ -670,6 +674,8 @@ bypass
|
||||
198.51.100.1,203.0.113.0/24
|
||||
[rule.text_rule.source_ip_cidr]
|
||||
|
||||
[rule.text_rule.source_aware_dns]
|
||||
1
|
||||
[rule.text_rule.ports]
|
||||
443,80,443-444
|
||||
[rule.text_rule.fully_routed_ips]
|
||||
@@ -696,6 +702,8 @@ proxy
|
||||
10.0.0.0/8,192.0.2.1
|
||||
[rule.default_enabled.source_ip_cidr]
|
||||
|
||||
[rule.default_enabled.source_aware_dns]
|
||||
1
|
||||
[rule.default_enabled.ports]
|
||||
53,853
|
||||
[rule.default_enabled.fully_routed_ips]
|
||||
@@ -756,6 +764,8 @@ bypass
|
||||
10.0.0.0/8,192.0.2.1
|
||||
[rule.enabled.source_ip_cidr]
|
||||
|
||||
[rule.enabled.source_aware_dns]
|
||||
1
|
||||
[rule.enabled.ports]
|
||||
443,80,443-444
|
||||
[rule.enabled.fully_routed_ips]
|
||||
|
||||
@@ -86,4 +86,33 @@ ucode -L "$TACHYON_LIB" "$GENERATOR_UC" generate-config-fixture \
|
||||
grep -Fq '"download_detour": "first_proxy-out"' "$output2" || \
|
||||
fail "global download_lists_via_proxy without explicit section must default to first enabled proxy section"
|
||||
|
||||
# 3. Verify http_clients and default_http_client handling:
|
||||
# Omitted on sing-box < 1.14 (1.12, 1.13, Leadaxe, Extended) to avoid unknown field crash
|
||||
output_v13="$WORK_DIR/out_v13.json"
|
||||
mkdir -p "$output_v13.section-cache" "$output_v13.rulesets"
|
||||
printf 'v1.13.5\n' > "$WORK_DIR/sb_v13"
|
||||
SB_VERSION_STATE_FILE="$WORK_DIR/sb_v13" \
|
||||
ucode -L "$TACHYON_LIB" "$GENERATOR_UC" generate-config-fixture \
|
||||
"$WORK_DIR/fixture.json" "$output_v13" "127.0.0.1" "0" "1"
|
||||
|
||||
if grep -q '"http_clients"' "$output_v13"; then
|
||||
fail "sing-box < 1.14 must not have http_clients (causes fatal unknown field crash)"
|
||||
fi
|
||||
if grep -q '"default_http_client"' "$output_v13"; then
|
||||
fail "sing-box < 1.14 must not have default_http_client (causes fatal unknown field crash)"
|
||||
fi
|
||||
|
||||
# Included on sing-box 1.14+
|
||||
output_v14="$WORK_DIR/out_v14.json"
|
||||
mkdir -p "$output_v14.section-cache" "$output_v14.rulesets"
|
||||
printf 'v1.14.0\n' > "$WORK_DIR/sb_v14"
|
||||
SB_VERSION_STATE_FILE="$WORK_DIR/sb_v14" \
|
||||
ucode -L "$TACHYON_LIB" "$GENERATOR_UC" generate-config-fixture \
|
||||
"$WORK_DIR/fixture.json" "$output_v14" "127.0.0.1" "0" "1"
|
||||
|
||||
grep -q '"http_clients"' "$output_v14" || \
|
||||
fail "sing-box 1.14+ must include http_clients"
|
||||
grep -q '"default_http_client": "ruleset-http"' "$output_v14" || \
|
||||
fail "sing-box 1.14+ must configure default_http_client"
|
||||
|
||||
printf "ruleset download detour checks passed\n"
|
||||
|
||||
+33
-4
@@ -97,15 +97,26 @@ cat >"$WORK_DIR/awg_fixture.json" <<'JSON'
|
||||
"awg_rekey_timeout": "5-6",
|
||||
"awg_reject_after_time": "171-193",
|
||||
"awg_keepalive_timeout": "11-18",
|
||||
"awg_max_handshake_attempts": "15-24"
|
||||
"awg_max_handshake_attempts": "15-24",
|
||||
"awg_random_trailers": "1",
|
||||
"awg_disable_cookies": "1"
|
||||
}
|
||||
],
|
||||
"section": [
|
||||
{
|
||||
".name": "default_direct",
|
||||
".name": "my_awg_section",
|
||||
".type": "section",
|
||||
"enabled": "1",
|
||||
"action": "bypass"
|
||||
"action": "awg",
|
||||
"awg_version": "3.1",
|
||||
"awg_private_key": "cHJpdmF0ZV9rZXk=",
|
||||
"awg_peer_public_key": "cGVlcl9wdWJsaWNfa2V5",
|
||||
"awg_server_address": "1.2.3.4",
|
||||
"awg_server_port": "51820",
|
||||
"awg_local_address": ["10.0.0.2/32"],
|
||||
"awg_keepalive": "25-35",
|
||||
"awg_random_trailers": "1",
|
||||
"awg_disable_cookies": "1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -114,6 +125,10 @@ JSON
|
||||
mkdir -p "$WORK_DIR/out.section-cache"
|
||||
out_json="$WORK_DIR/singbox_awg.json"
|
||||
|
||||
# Test 1: Leadaxe variant via variant state file
|
||||
printf 'lx\n' > "$WORK_DIR/sing-box-variant"
|
||||
SB_VARIANT_STATE_FILE="$WORK_DIR/sing-box-variant" \
|
||||
SB_VERSION_STATE_FILE="$WORK_DIR/nonexistent" \
|
||||
ucode -L "$TACHYON_LIB" "$TACHYON_LIB/singbox/generator.uc" generate-config-fixture \
|
||||
"$WORK_DIR/awg_fixture.json" "$out_json" "127.0.0.1" 0 0
|
||||
|
||||
@@ -135,5 +150,19 @@ grep -q '"rekey_timeout": "5-6"' "$out_json" || fail "AWG 3.1 server missing rek
|
||||
grep -q '"reject_after_time": "171-193"' "$out_json" || fail "AWG 3.1 server missing reject_after_time"
|
||||
grep -q '"keepalive_timeout": "11-18"' "$out_json" || fail "AWG 3.1 server missing keepalive_timeout"
|
||||
grep -q '"max_handshake_attempts": "15-24"' "$out_json" || fail "AWG 3.1 server missing max_handshake_attempts"
|
||||
grep -q '"random_trailers": true' "$out_json" || fail "AWG 3.1 server missing random_trailers"
|
||||
grep -q '"disable_cookies": true' "$out_json" || fail "AWG 3.1 server missing disable_cookies"
|
||||
|
||||
printf 'AWG 2.0, 3.0, and 3.1 server configuration checks passed\n'
|
||||
# Check AWG 3.1 outbound on Leadaxe (range keepalive passed through, trailers/cookies present)
|
||||
grep -q '"persistent_keepalive_interval": "25-35"' "$out_json" || fail "Leadaxe AWG outbound missing range keepalive"
|
||||
|
||||
# Test 2: Extended/Standard variant (range keepalive must degrade safely to integer 25)
|
||||
printf 'extended\n' > "$WORK_DIR/sing-box-variant"
|
||||
SB_VARIANT_STATE_FILE="$WORK_DIR/sing-box-variant" \
|
||||
SB_VERSION_STATE_FILE="$WORK_DIR/nonexistent" \
|
||||
ucode -L "$TACHYON_LIB" "$TACHYON_LIB/singbox/generator.uc" generate-config-fixture \
|
||||
"$WORK_DIR/awg_fixture.json" "$out_json" "127.0.0.1" 0 0
|
||||
|
||||
grep -q '"persistent_keepalive_interval": 25' "$out_json" || fail "Non-lx AWG outbound must safely fallback to integer keepalive"
|
||||
|
||||
printf 'AWG 2.0, 3.0, and 3.1 server and outbound configuration checks passed\n'
|
||||
|
||||
Reference in New Issue
Block a user