Dushnilin
890450d619
В ветке mtproto тип инбаунда перезатирался на shadowsocks-2022,
и ee-секрет уходил в password: SS2022 парсит его как base64-PSK —
отсюда FATAL «decode psk: illegal base64 data at input byte 60»
у всех, у кого включён MTProto-сервер.
- mtproto снова эмитит type=mtproxy (как в схеме extended 2.6.x),
юзер — {name, secret}, а не password (регрессия fe0099a3)
- конфиг с MTProto и AWG проверен `sing-box check` на реальном
sing-box-extended 1.13.18-extended-2.6.5 — PASS
- warp-генератор: прямой префлайт-зонд с --resolve (DNS-отравление
больше не даёт ложное «API недоступен»), живость 4534 — локальная
по /proc/net/tcp вместо сквозного запроса через туннель
- багрепорт маскирует ai_doctor_api_key и tuic_password
117 lines
3.6 KiB
Bash
117 lines
3.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TACHYON_LIB="$ROOT_DIR/tachyon/files/usr/lib"
|
|
WORK_DIR="$(mktemp -d)"
|
|
|
|
cleanup() {
|
|
rm -rf "$WORK_DIR"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Canonical serialized secret for key 367a189aee18fa31c190054efd4a8e95 with
|
|
# faketls host google.com.
|
|
CANONICAL='ee367a189aee18fa31c190054efd4a8e95676f6f676c652e636f6d'
|
|
|
|
fixture_with_secret() {
|
|
cat >"$WORK_DIR/mtproto_fixture.json" <<JSON
|
|
{
|
|
"settings": {
|
|
".name": "settings",
|
|
".type": "settings",
|
|
"enabled": "1"
|
|
},
|
|
"server": [
|
|
{
|
|
".name": "my_mtproto_server",
|
|
".type": "server",
|
|
"enabled": "1",
|
|
"protocol": "mtproto",
|
|
"listen_port": "443",
|
|
"mtproto_secret": "$1",
|
|
"mtproto_faketls": "google.com"
|
|
}
|
|
],
|
|
"section": [
|
|
{
|
|
".name": "default_direct",
|
|
".type": "section",
|
|
"enabled": "1",
|
|
"action": "bypass"
|
|
}
|
|
]
|
|
}
|
|
JSON
|
|
}
|
|
|
|
generate() {
|
|
mkdir -p "$WORK_DIR/out.section-cache"
|
|
ucode -L "$TACHYON_LIB" "$TACHYON_LIB/singbox/generator.uc" generate-config-fixture \
|
|
"$WORK_DIR/mtproto_fixture.json" "$WORK_DIR/singbox_mtproto.json" "127.0.0.1" 0 0
|
|
}
|
|
|
|
assert_canonical_user_password() {
|
|
grep -q '"type": "mtproxy"' "$WORK_DIR/singbox_mtproto.json" ||
|
|
fail "mtproto server must emit an mtproxy inbound, never a shadowsocks fallback"
|
|
grep -q '"secret": "'"$CANONICAL"'"' "$WORK_DIR/singbox_mtproto.json" ||
|
|
fail "sing-box config must carry the canonical serialized secret as MTProxyUser.secret"
|
|
if grep -q '"method": "2022' "$WORK_DIR/singbox_mtproto.json"; then
|
|
fail "mtproxy inbound must not carry a shadowsocks-2022 method"
|
|
fi
|
|
}
|
|
|
|
# 1. Full ee-secret in hex passes through unchanged.
|
|
fixture_with_secret "$CANONICAL"
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 2. Bare 16-byte key in hex gets wrapped with the marker and faketls host.
|
|
fixture_with_secret '367a189aee18fa31c190054efd4a8e95'
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 3. Full secret in padded standard base64 is decoded and re-encoded as hex.
|
|
fixture_with_secret '7jZ6GJruGPoxwZAFTv1KjpVnb29nbGUuY29t'
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 4. Bare key in padded standard base64 gets wrapped.
|
|
fixture_with_secret 'NnoYmu4Y+jHBkAVO/UqOlQ=='
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 5. Full secret in raw url-safe base64 (as produced by mtg) is normalized.
|
|
fixture_with_secret '7jZ6GJruGPoxwZAFTv1KjpVnb29nbGUuY29t'
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 6. Url-safe alphabet (- and _ instead of + and /) is translated.
|
|
fixture_with_secret 'NnoYmu4Y-jHBkAVO_UqOlQ'
|
|
generate
|
|
assert_canonical_user_password
|
|
|
|
# 7. The validator accepts a canonical secret and rejects garbage with a
|
|
# clear message instead of a sing-box FATAL at start time.
|
|
cat >"$WORK_DIR/validate_secret.uc" <<'UC'
|
|
let common = require("core.common");
|
|
let secret = ARGV[1];
|
|
printf("%s", common.mtproto_secret_canonical(secret, "google.com") == null ? "invalid" : "valid");
|
|
UC
|
|
|
|
[ "$(ucode -L "$TACHYON_LIB" "$WORK_DIR/validate_secret.uc" x "$CANONICAL")" = "valid" ] ||
|
|
fail "validator helper must accept the canonical hex secret"
|
|
[ "$(ucode -L "$TACHYON_LIB" "$WORK_DIR/validate_secret.uc" x '7jZ6GJruGPoxwZAFTv1KjpVnb29nbGUuY29t')" = "valid" ] ||
|
|
fail "validator helper must accept the base64 form of the secret"
|
|
[ "$(ucode -L "$TACHYON_LIB" "$WORK_DIR/validate_secret.uc" x 'not a real secret')" = "invalid" ] ||
|
|
fail "validator helper must reject unparseable secrets"
|
|
[ "$(ucode -L "$TACHYON_LIB" "$WORK_DIR/validate_secret.uc" x '')" = "invalid" ] ||
|
|
fail "validator helper must reject an empty secret"
|
|
|
|
printf 'MTProto server configuration checks passed\n'
|