Add optional SOCKS server authentication

2026-07-13 02:39:35 +03:00
parent 416c367f81
commit ec936a675a
12 changed files with 134 additions and 10 deletions
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SERVER_JS="$ROOT_DIR/luci-app-forkop/htdocs/luci-static/resources/view/forkop/server.js"
+
+node - "$SERVER_JS" <<'NODE'
+const fs = require("fs");
+const source = fs.readFileSync(process.argv[2], "utf8");
+
+function fail(message) {
+  console.error(`FAIL: ${message}`);
+  process.exit(1);
+}
+
+function requiredIndex(needle, from = 0) {
+  const index = source.indexOf(needle, from);
+  if (index < 0) fail(`missing source contract: ${needle}`);
+  return index;
+}
+
+const flag = requiredIndex('"socks_auth_enabled"');
+const username = requiredIndex('"server_username", _("Username")', flag);
+const password = requiredIndex('"server_password", _("Password")', username);
+const nextOption = requiredIndex('"vmess_alter_id", _("Alter ID")', password);
+
+const flagBlock = source.slice(flag, username);
+if (!flagBlock.includes('_("Enable authentication")') ||
+    !flagBlock.includes('o.default = "1"') ||
+    !flagBlock.includes('o.depends("protocol", "socks")')) {
+  fail("SOCKS authentication switch must be enabled by default and limited to SOCKS servers");
+}
+
+for (const block of [source.slice(username, password), source.slice(password, nextOption)]) {
+  if (!block.includes('o.depends({ protocol: "socks", socks_auth_enabled: "1" })')) {
+    fail("SOCKS credentials must only be required while authentication is enabled");
+  }
+}
+
+const link = source.slice(
+  requiredIndex("function buildSocksLink"),
+  requiredIndex("function normalizeSha256"),
+);
+if (!link.includes("isSocksAuthenticationEnabled(sectionId)") ||
+    !link.includes('socks5://${userInfo}${uriHost}:${port}')) {
+  fail("SOCKS share links must omit credentials when authentication is disabled");
+}
+NODE
+
+printf 'LuCI SOCKS server authentication checks passed\n'