Replace privileged PSK with Ed25519 signature verification

This commit is contained in:
Meo597
2026-10-14 06:57:32 +08:00
parent 590a5236bb
commit fa9dc21a55
5 changed files with 435 additions and 92 deletions
+13 -8
View File
@@ -17,6 +17,7 @@ import (
"github.com/xtls/xray-core/common/cmdarg"
"github.com/xtls/xray-core/common/errors"
clog "github.com/xtls/xray-core/common/log"
"github.com/xtls/xray-core/common/lua"
"github.com/xtls/xray-core/common/platform"
"github.com/xtls/xray-core/core"
"github.com/xtls/xray-core/main/commands/base"
@@ -36,9 +37,8 @@ The -confdir=dir flag sets a dir with multiple json config
The -format=json flag sets the format of config files.
Default "auto".
The config root env object sets process environment variables after all config
files are parsed. Variables needed to locate or parse config files must be set
in the process environment before Xray starts.
The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key
for privileged local Lua scripts, encoded as unpadded Base64URL.
The -test flag tells Xray to test config files only,
without launching the server.
@@ -53,11 +53,12 @@ func init() {
}
var (
configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main
configDir string
dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.")
test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.")
format = cmdRun.Flag.String("format", "auto", "Format of input file.")
configFiles cmdarg.Arg // "Config file for Xray.", the option is customed type, parse in main
configDir string
dump = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.")
test = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.")
format = cmdRun.Flag.String("format", "auto", "Format of input file.")
luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.")
/* We have to do this here because Golang's Test will also need to parse flag, before
* main func in this file is run.
@@ -214,6 +215,10 @@ func getConfigFormat() string {
}
func startXray() (core.Server, error) {
if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil {
return nil, errors.New("failed to configure Lua privileged authorization").Base(err)
}
configFiles := getConfigFilePath(true)
c, err := core.LoadConfig(getConfigFormat(), configFiles)