hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-10-16 04:24:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

disable signature & privileged

Browse Source
This commit is contained in:
Meo597
2026-10-15 12:22:56 +08:00
parent 65449d4f03
commit 03ee3f872f
5 changed files with 50 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/lua/privileged_sign_test.go
+3
View File
@@ -1,5 +1,7 @@
package lua
// TODO: Re-enable these tests and their helper when Compile supports privileged signature authorization again.
/*
import (
"bytes"
"crypto/ed25519"
@@ -80,3 +82,4 @@ func TestSignPrivilegedScriptRejectsInvalidSeed(t *testing.T) {
}
}
}
*/
common/lua/program.go
+5 -3
View File
@@ -37,9 +37,11 @@ func Compile(script string) (*Program, error) {
return nil, errors.New("currently unavailable")
code, err = base64.Decode(script)
} else if name, err = platform.ResolveLuaFile(script); err == nil {
if code, err = os.ReadFile(name); err == nil {
privileged, err = verifyPrivilegedSignature(code)
}
code, err = os.ReadFile(name)
// TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries.
// if err == nil {
// privileged, err = verifyPrivilegedSignature(code)
// }
}
if err != nil {
return nil, err
common/lua/program_test.go
+24 -19
View File
@@ -3,10 +3,6 @@ package lua
import (
"bytes"
"context"
"crypto/ed25519"
"crypto/sha256"
"encoding/base64"
"encoding/hex"
"errors"
"fmt"
"net"
@@ -14,9 +10,7 @@ import (
"path/filepath"
"runtime"
"strings"
"sync"
"testing"
"time"
"weak"
xerrors "github.com/xtls/xray-core/common/errors"
@@ -234,6 +228,21 @@ func compileTestProgram(t *testing.T, code string) *Program {
return program
}
func writeTestScript(t *testing.T, code string) string {
t.Helper()
path := filepath.Join(t.TempDir(), "script.lua")
if err := os.WriteFile(path, []byte(code), 0o600); err != nil {
t.Fatal(err)
}
path, err := filepath.EvalSymlinks(path)
if err != nil {
t.Fatal(err)
}
return path
}
// TODO: Re-enable these tests and helpers when Compile supports privileged signature authorization again.
/*
const privilegedSignatureHeader = "-- @xray:privileged-signature="
// RFC 8032 test-vector key. The fixture signature was independently computed
@@ -266,19 +275,6 @@ func setTestPrivilegedPublicKey(t *testing.T, key string) {
}
}
func writeTestScript(t *testing.T, code string) string {
t.Helper()
path := filepath.Join(t.TempDir(), "script.lua")
if err := os.WriteFile(path, []byte(code), 0o600); err != nil {
t.Fatal(err)
}
path, err := filepath.EvalSymlinks(path)
if err != nil {
t.Fatal(err)
}
return path
}
func testSignature(t *testing.T, body string) string {
t.Helper()
seed, err := hex.DecodeString(privilegedTestSeed)
@@ -486,6 +482,8 @@ func TestProgramSignedBodyTampering(t *testing.T) {
}
}
*/
// TODO: Re-enable this test when Compile supports inline scripts again.
/*
func TestProgramInlineSignaturesCannotAuthorize(t *testing.T) {
@@ -516,6 +514,8 @@ func TestProgramInlineSignaturesCannotAuthorize(t *testing.T) {
}
*/
// TODO: Re-enable this test when Compile supports privileged signature authorization again.
/*
func TestProgramSignedDiagnostics(t *testing.T) {
setTestPrivilegedPublicKey(t, privilegedTestPublicKey)
const invalidBody = "\n\nlocal = 1"
@@ -543,6 +543,8 @@ func TestProgramSignedDiagnostics(t *testing.T) {
}
}
*/
func TestProgramSandbox(t *testing.T) {
dir := t.TempDir()
if err := os.WriteFile(filepath.Join(dir, "escape.lua"), []byte(`disk_loaded = true; return "escaped"`), 0o600); err != nil {
@@ -1047,6 +1049,8 @@ func TestProgramSandboxClosesFailedInitialization(t *testing.T) {
}
}
// TODO: Re-enable these tests when Compile supports privileged signature authorization again.
/*
func TestProgramPrivilegedLibraries(t *testing.T) {
setTestPrivilegedPublicKey(t, privilegedTestPublicKey)
const body = `assert(require("io") == io and require("os") == os)
@@ -1175,3 +1179,4 @@ func TestProgramPrivilegesAreCompileTimeSnapshot(t *testing.T) {
})
}
}
*/
main/commands/all/commands.go
+4 -3
View File
@@ -4,7 +4,8 @@ import (
"github.com/xtls/xray-core/main/commands/all/api"
"github.com/xtls/xray-core/main/commands/all/base64"
"github.com/xtls/xray-core/main/commands/all/convert"
"github.com/xtls/xray-core/main/commands/all/lua"
// TODO: Restore this import and lua.CmdLua when Lua privileged signature authorization is re-enabled.
// "github.com/xtls/xray-core/main/commands/all/lua"
"github.com/xtls/xray-core/main/commands/all/tls"
"github.com/xtls/xray-core/main/commands/base"
)
@@ -15,11 +16,11 @@ func init() {
api.CmdAPI,
base64.CmdBase64,
convert.CmdConvert,
lua.CmdLua,
// lua.CmdLua,
tls.CmdTLS,
cmdUUID,
cmdX25519,
cmdEd25519,
// cmdEd25519,
cmdWG,
cmdMLDSA65,
cmdMLKEM768,
main/run.go
+14 -13
View File
@@ -17,7 +17,6 @@ import (
"github.com/xtls/xray-core/common/cmdarg"
"github.com/xtls/xray-core/common/errors"
clog "github.com/xtls/xray-core/common/log"
"github.com/xtls/xray-core/common/lua"
"github.com/xtls/xray-core/common/platform"
"github.com/xtls/xray-core/core"
"github.com/xtls/xray-core/main/commands/base"
@@ -37,9 +36,6 @@ The -confdir=dir flag sets a dir with multiple json config
The -format=json flag sets the format of config files.
Default "auto".
The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key
for privileged local Lua scripts, encoded as unpadded Base64URL.
The -test flag tells Xray to test config files only,
without launching the server.
@@ -47,18 +43,22 @@ The -dump flag tells Xray to print the merged config.
`,
}
// The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key
// for privileged local Lua scripts, encoded as unpadded Base64URL.
func init() {
cmdRun.Run = executeRun // break init loop
log.SetFlags(log.Ldate | log.Ltime | log.Lmicroseconds)
}
var (
configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main
configDir string
dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.")
test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.")
format = cmdRun.Flag.String("format", "auto", "Format of input file.")
luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.")
configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main
configDir string
dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.")
test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.")
format = cmdRun.Flag.String("format", "auto", "Format of input file.")
// TODO: Restore this flag and its help text when Lua privileged signature authorization is re-enabled.
// luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.")
/* We have to do this here because Golang's Test will also need to parse flag, before
* main func in this file is run.
@@ -215,9 +215,10 @@ func getConfigFormat() string {
}
func startXray() (core.Server, error) {
if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil {
return nil, errors.New("failed to configure Lua privileged authorization").Base(err)
}
// TODO: Restore public key initialization when Lua privileged signature authorization is re-enabled.
// if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil {
// return nil, errors.New("failed to configure Lua privileged authorization").Base(err)
// }
configFiles := getConfigFilePath(true)