From 03ee3f872f072688599d17f1fd12e3243c063dc2 Mon Sep 17 00:00:00 2001 From: Meo597 <197331664+Meo597@users.noreply.github.com> Date: Thu, 15 Oct 2026 12:22:56 +0800 Subject: [PATCH] disable signature & privileged --- common/lua/privileged_sign_test.go | 3 +++ common/lua/program.go | 8 +++--- common/lua/program_test.go | 43 +++++++++++++++++------------- main/commands/all/commands.go | 7 ++--- main/run.go | 27 ++++++++++--------- 5 files changed, 50 insertions(+), 38 deletions(-) diff --git a/common/lua/privileged_sign_test.go b/common/lua/privileged_sign_test.go index 1938e3b97..1ed12767c 100644 --- a/common/lua/privileged_sign_test.go +++ b/common/lua/privileged_sign_test.go @@ -1,5 +1,7 @@ package lua +// TODO: Re-enable these tests and their helper when Compile supports privileged signature authorization again. +/* import ( "bytes" "crypto/ed25519" @@ -80,3 +82,4 @@ func TestSignPrivilegedScriptRejectsInvalidSeed(t *testing.T) { } } } +*/ diff --git a/common/lua/program.go b/common/lua/program.go index 51a41fa78..57b950cee 100644 --- a/common/lua/program.go +++ b/common/lua/program.go @@ -37,9 +37,11 @@ func Compile(script string) (*Program, error) { return nil, errors.New("currently unavailable") code, err = base64.Decode(script) } else if name, err = platform.ResolveLuaFile(script); err == nil { - if code, err = os.ReadFile(name); err == nil { - privileged, err = verifyPrivilegedSignature(code) - } + code, err = os.ReadFile(name) + // TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries. + // if err == nil { + // privileged, err = verifyPrivilegedSignature(code) + // } } if err != nil { return nil, err diff --git a/common/lua/program_test.go b/common/lua/program_test.go index 6a24cbeb9..fbd34de19 100644 --- a/common/lua/program_test.go +++ b/common/lua/program_test.go @@ -3,10 +3,6 @@ package lua import ( "bytes" "context" - "crypto/ed25519" - "crypto/sha256" - "encoding/base64" - "encoding/hex" "errors" "fmt" "net" @@ -14,9 +10,7 @@ import ( "path/filepath" "runtime" "strings" - "sync" "testing" - "time" "weak" xerrors "github.com/xtls/xray-core/common/errors" @@ -234,6 +228,21 @@ func compileTestProgram(t *testing.T, code string) *Program { return program } +func writeTestScript(t *testing.T, code string) string { + t.Helper() + path := filepath.Join(t.TempDir(), "script.lua") + if err := os.WriteFile(path, []byte(code), 0o600); err != nil { + t.Fatal(err) + } + path, err := filepath.EvalSymlinks(path) + if err != nil { + t.Fatal(err) + } + return path +} + +// TODO: Re-enable these tests and helpers when Compile supports privileged signature authorization again. +/* const privilegedSignatureHeader = "-- @xray:privileged-signature=" // RFC 8032 test-vector key. The fixture signature was independently computed @@ -266,19 +275,6 @@ func setTestPrivilegedPublicKey(t *testing.T, key string) { } } -func writeTestScript(t *testing.T, code string) string { - t.Helper() - path := filepath.Join(t.TempDir(), "script.lua") - if err := os.WriteFile(path, []byte(code), 0o600); err != nil { - t.Fatal(err) - } - path, err := filepath.EvalSymlinks(path) - if err != nil { - t.Fatal(err) - } - return path -} - func testSignature(t *testing.T, body string) string { t.Helper() seed, err := hex.DecodeString(privilegedTestSeed) @@ -486,6 +482,8 @@ func TestProgramSignedBodyTampering(t *testing.T) { } } +*/ + // TODO: Re-enable this test when Compile supports inline scripts again. /* func TestProgramInlineSignaturesCannotAuthorize(t *testing.T) { @@ -516,6 +514,8 @@ func TestProgramInlineSignaturesCannotAuthorize(t *testing.T) { } */ +// TODO: Re-enable this test when Compile supports privileged signature authorization again. +/* func TestProgramSignedDiagnostics(t *testing.T) { setTestPrivilegedPublicKey(t, privilegedTestPublicKey) const invalidBody = "\n\nlocal = 1" @@ -543,6 +543,8 @@ func TestProgramSignedDiagnostics(t *testing.T) { } } +*/ + func TestProgramSandbox(t *testing.T) { dir := t.TempDir() if err := os.WriteFile(filepath.Join(dir, "escape.lua"), []byte(`disk_loaded = true; return "escaped"`), 0o600); err != nil { @@ -1047,6 +1049,8 @@ func TestProgramSandboxClosesFailedInitialization(t *testing.T) { } } +// TODO: Re-enable these tests when Compile supports privileged signature authorization again. +/* func TestProgramPrivilegedLibraries(t *testing.T) { setTestPrivilegedPublicKey(t, privilegedTestPublicKey) const body = `assert(require("io") == io and require("os") == os) @@ -1175,3 +1179,4 @@ func TestProgramPrivilegesAreCompileTimeSnapshot(t *testing.T) { }) } } +*/ diff --git a/main/commands/all/commands.go b/main/commands/all/commands.go index 6cce71141..aaf0642e8 100644 --- a/main/commands/all/commands.go +++ b/main/commands/all/commands.go @@ -4,7 +4,8 @@ import ( "github.com/xtls/xray-core/main/commands/all/api" "github.com/xtls/xray-core/main/commands/all/base64" "github.com/xtls/xray-core/main/commands/all/convert" - "github.com/xtls/xray-core/main/commands/all/lua" + // TODO: Restore this import and lua.CmdLua when Lua privileged signature authorization is re-enabled. + // "github.com/xtls/xray-core/main/commands/all/lua" "github.com/xtls/xray-core/main/commands/all/tls" "github.com/xtls/xray-core/main/commands/base" ) @@ -15,11 +16,11 @@ func init() { api.CmdAPI, base64.CmdBase64, convert.CmdConvert, - lua.CmdLua, + // lua.CmdLua, tls.CmdTLS, cmdUUID, cmdX25519, - cmdEd25519, + // cmdEd25519, cmdWG, cmdMLDSA65, cmdMLKEM768, diff --git a/main/run.go b/main/run.go index 31729803a..6ca9afbc5 100644 --- a/main/run.go +++ b/main/run.go @@ -17,7 +17,6 @@ import ( "github.com/xtls/xray-core/common/cmdarg" "github.com/xtls/xray-core/common/errors" clog "github.com/xtls/xray-core/common/log" - "github.com/xtls/xray-core/common/lua" "github.com/xtls/xray-core/common/platform" "github.com/xtls/xray-core/core" "github.com/xtls/xray-core/main/commands/base" @@ -37,9 +36,6 @@ The -confdir=dir flag sets a dir with multiple json config The -format=json flag sets the format of config files. Default "auto". -The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key -for privileged local Lua scripts, encoded as unpadded Base64URL. - The -test flag tells Xray to test config files only, without launching the server. @@ -47,18 +43,22 @@ The -dump flag tells Xray to print the merged config. `, } +// The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key +// for privileged local Lua scripts, encoded as unpadded Base64URL. + func init() { cmdRun.Run = executeRun // break init loop log.SetFlags(log.Ldate | log.Ltime | log.Lmicroseconds) } var ( - configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main - configDir string - dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.") - test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.") - format = cmdRun.Flag.String("format", "auto", "Format of input file.") - luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.") + configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main + configDir string + dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.") + test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.") + format = cmdRun.Flag.String("format", "auto", "Format of input file.") + // TODO: Restore this flag and its help text when Lua privileged signature authorization is re-enabled. + // luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.") /* We have to do this here because Golang's Test will also need to parse flag, before * main func in this file is run. @@ -215,9 +215,10 @@ func getConfigFormat() string { } func startXray() (core.Server, error) { - if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil { - return nil, errors.New("failed to configure Lua privileged authorization").Base(err) - } + // TODO: Restore public key initialization when Lua privileged signature authorization is re-enabled. + // if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil { + // return nil, errors.New("failed to configure Lua privileged authorization").Base(err) + // } configFiles := getConfigFilePath(true)