cmd: add Ed25519 key generation and Lua script signing

common/lua/privileged.go

@@ -46,35 +46,72 @@ func decodePrivilegedValue(value string, size int) ([]byte, error) {
 }
 
 func verifyPrivilegedSignature(code []byte) (bool, error) {
-	for len(code) != 0 {
-		line, rest, _ := bytes.Cut(code, []byte{'\n'})
-		code = rest
+	_, end, value, found := privilegedSignatureLine(code)
+	if !found {
+		return false, nil
+	}
+
+	publicKey := privilegedKey.publicKey
+	if len(publicKey) == 0 {
+		return false, errors.New("Lua privileged signature requires --lua-privileged-pubkey")
+	}
+	signature, err := decodePrivilegedValue(string(bytes.TrimSpace(value)), ed25519.SignatureSize)
+	if err != nil {
+		return false, errors.New("invalid Lua privileged signature").Base(err)
+	}
+	digest := sha256.Sum256(bytes.TrimSpace(code[end:]))
+	if !ed25519.Verify(publicKey, digest[:], signature) {
+		return false, errors.New("Lua privileged signature verification failed")
+	}
+	return true, nil
+}
+
+// SignPrivilegedScript signs the script body, then prepends or replaces the signature line.
+func SignPrivilegedScript(code []byte, seed string) ([]byte, error) {
+	decoded, err := decodePrivilegedValue(seed, ed25519.SeedSize)
+	if err != nil {
+		return nil, errors.New("invalid Ed25519 private key seed").Base(err)
+	}
+
+	start, end, _, found := privilegedSignatureLine(code)
+	body := code
+	if found {
+		body = code[end:]
+	}
+
+	digest := sha256.Sum256(bytes.TrimSpace(body))
+	signature := ed25519.Sign(ed25519.NewKeyFromSeed(decoded), digest[:])
+	header := []byte("-- @xray:privileged-signature=" + base64.RawURLEncoding.EncodeToString(signature))
+
+	if !found {
+		if newline := bytes.IndexByte(code, '\n'); newline > 0 && code[newline-1] == '\r' {
+			header = append(header, '\r')
+		}
+		header = append(header, '\n')
+		return append(header, code...), nil
+	}
+	signed := make([]byte, 0, start+len(header)+len(code)-end)
+	signed = append(signed, code[:start]...)
+	signed = append(signed, header...)
+	return append(signed, code[end:]...), nil
+}
+
+func privilegedSignatureLine(code []byte) (start, end int, value []byte, found bool) {
+	for rest := code; len(rest) != 0; {
+		start = len(code) - len(rest)
+		var line []byte
+		line, rest, _ = bytes.Cut(rest, []byte{'\n'})
 		line = bytes.TrimSuffix(line, []byte{'\r'})
 		if len(bytes.TrimSpace(line)) == 0 {
 			continue
 		}
+		end = start + len(line)
 		line, found := bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("--"))
 		if !found {
-			return false, nil
+			return 0, 0, nil, false
 		}
-		value, found := bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("@xray:privileged-signature="))
-		if !found {
-			return false, nil
-		}
-
-		publicKey := privilegedKey.publicKey
-		if len(publicKey) == 0 {
-			return false, errors.New("Lua privileged signature requires --lua-privileged-pubkey")
-		}
-		signature, err := decodePrivilegedValue(string(bytes.TrimSpace(value)), ed25519.SignatureSize)
-		if err != nil {
-			return false, errors.New("invalid Lua privileged signature").Base(err)
-		}
-		digest := sha256.Sum256(bytes.TrimSpace(rest))
-		if !ed25519.Verify(publicKey, digest[:], signature) {
-			return false, errors.New("Lua privileged signature verification failed")
-		}
-		return true, nil
+		value, found = bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("@xray:privileged-signature="))
+		return start, end, value, found
 	}
-	return false, nil
+	return 0, 0, nil, false
 }