feat(v1): Gecko-обфускация, latest-stable Hysteria на сборке и forward-compatible admin
Сквозная миграция HY2XS на современную Hysteria (2.12.2) и переход на v1. Build: - версия Hysteria резолвится на этапе сборки из HyNetworks/hysteria и замораживается в metadata пакета (version + immutable url + sha256); - compatibility gate: реальный бинарник должен принять канонический конфиг HY2XS для gecko и salamander до создания пакета; - сборка прогоняет тесты оркестратора и админки. Конфигурационный контракт: - HY2XS_CONFIG_SCHEMA_VERSION=2, чужая схема отклоняется fail-fast; - obfs стал настоящим union gecko|salamander, gecko — default; - obfs-блок рендерится оркестратором целиком, два подтипа одновременно структурно невозможны; - современный baseline: congestion bbr/standard, disableLossCompensation=false, disableStatelessReset=false, полный quic-блок. Исправления: - share URI для gecko: генератор был завязан на Obfs.Salamander.Password и выдавал нерабочую ссылку при любой другой обфускации; - SNI брался только из ACME-блока и уходил пустым при HY2XS_TLS_MODE=file; - экспорт конфига выносил trafficStats.secret, access_token и obfs-пароль; - экспорт терял неизвестные upstream-поля при round-trip через типизированную модель; - renderRuntimeEnv печатал тип обфускации литералом, расходясь с конфигом; - namedotcom удалён из ACME-реестра (нет в Hysteria с 2.11.0). Тесты: - 95 тестов оркестратора: env, рендер, семантика профиля, резолвер, rollover; - тесты URI и экспорта в Go; - tools/test/e2e-hysteria.sh с реальным клиентом Hysteria. UX: - подсказки и примеры в форме создания пира. Прочее: CHANGELOG.md, .gitattributes (LF для target-side файлов), документация на русском.
This commit is contained in:
@@ -4,26 +4,115 @@ import (
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"hy2xs-admin/model/bo"
|
||||
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
func mustParse(t *testing.T, raw string) *url.URL {
|
||||
t.Helper()
|
||||
parsed, err := url.Parse(raw)
|
||||
if err != nil {
|
||||
t.Fatalf("expected valid url, got error: %v (raw=%s)", err, raw)
|
||||
}
|
||||
if parsed.Scheme != "hysteria2" {
|
||||
t.Fatalf("expected hysteria2 scheme, got %s", parsed.Scheme)
|
||||
}
|
||||
return parsed
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_GeckoObfs(t *testing.T) {
|
||||
raw := buildHysteria2Url(
|
||||
"con-pass",
|
||||
"vpn.example.com",
|
||||
443,
|
||||
bo.ObfsShareConfig{Type: "gecko", Password: "gecko-secret"},
|
||||
"vpn.example.com",
|
||||
"",
|
||||
)
|
||||
|
||||
q := mustParse(t, raw).Query()
|
||||
if q.Get("obfs") != "gecko" {
|
||||
t.Fatalf("expected obfs=gecko, got %q", q.Get("obfs"))
|
||||
}
|
||||
if q.Get("obfs-password") != "gecko-secret" {
|
||||
t.Fatalf("expected gecko obfs password, got %q", q.Get("obfs-password"))
|
||||
}
|
||||
if q.Get("sni") != "vpn.example.com" {
|
||||
t.Fatalf("expected sni, got %q", q.Get("sni"))
|
||||
}
|
||||
if q.Get("insecure") != "0" {
|
||||
t.Fatalf("expected insecure=0, got %q", q.Get("insecure"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_SalamanderObfs(t *testing.T) {
|
||||
raw := buildHysteria2Url(
|
||||
"con-pass",
|
||||
"vpn.example.com",
|
||||
443,
|
||||
bo.ObfsShareConfig{Type: "salamander", Password: "salamander-secret"},
|
||||
"vpn.example.com",
|
||||
"",
|
||||
)
|
||||
|
||||
q := mustParse(t, raw).Query()
|
||||
if q.Get("obfs") != "salamander" {
|
||||
t.Fatalf("expected obfs=salamander, got %q", q.Get("obfs"))
|
||||
}
|
||||
if q.Get("obfs-password") != "salamander-secret" {
|
||||
t.Fatalf("expected salamander obfs password, got %q", q.Get("obfs-password"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_NoObfs(t *testing.T) {
|
||||
raw := buildHysteria2Url("pass", "example.com", 8443, bo.ObfsShareConfig{}, "", "")
|
||||
|
||||
parsed := mustParse(t, raw)
|
||||
if parsed.Host != "example.com:8443" {
|
||||
t.Fatalf("unexpected host: %s", parsed.Host)
|
||||
}
|
||||
q := parsed.Query()
|
||||
if q.Get("obfs") != "" || q.Get("obfs-password") != "" || q.Get("sni") != "" {
|
||||
t.Fatalf("unexpected optional query params in minimal config: %s", parsed.RawQuery)
|
||||
}
|
||||
if q.Get("insecure") != "0" {
|
||||
t.Fatalf("expected insecure=0, got %q", q.Get("insecure"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_UnknownObfsTypeIsNotShared(t *testing.T) {
|
||||
// Неизвестный тип не должен попадать в ссылку: клиент получил бы
|
||||
// параметр, который не понимает.
|
||||
raw := buildHysteria2Url("pass", "example.com", 443, bo.ObfsShareConfig{Type: "future-obfs", Password: "x"}, "", "")
|
||||
|
||||
q := mustParse(t, raw).Query()
|
||||
if q.Get("obfs") != "" {
|
||||
t.Fatalf("unknown obfs type must not be shared, got %q", q.Get("obfs"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_ObfsWithoutPasswordIsNotShared(t *testing.T) {
|
||||
raw := buildHysteria2Url("pass", "example.com", 443, bo.ObfsShareConfig{Type: "gecko"}, "", "")
|
||||
|
||||
q := mustParse(t, raw).Query()
|
||||
if q.Get("obfs") != "" || q.Get("obfs-password") != "" {
|
||||
t.Fatalf("obfs without password must not be shared: %s", q.Encode())
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_EncodesUserInfoQueryAndFragment(t *testing.T) {
|
||||
raw := buildHysteria2Url(
|
||||
"u@ser:#&=+ pass",
|
||||
"example.com",
|
||||
443,
|
||||
"salamander",
|
||||
"obf+s&pass=@x",
|
||||
bo.ObfsShareConfig{Type: "gecko", Password: "obf+s&pass=@x"},
|
||||
"exa mple.com",
|
||||
"my remark #1",
|
||||
)
|
||||
|
||||
parsed, err := url.Parse(raw)
|
||||
if err != nil {
|
||||
t.Fatalf("expected valid url, got error: %v", err)
|
||||
}
|
||||
if parsed.Scheme != "hysteria2" {
|
||||
t.Fatalf("expected hysteria2 scheme, got %s", parsed.Scheme)
|
||||
}
|
||||
parsed := mustParse(t, raw)
|
||||
if parsed.User == nil {
|
||||
t.Fatal("expected userinfo to be present")
|
||||
}
|
||||
@@ -32,42 +121,200 @@ func TestBuildHysteria2Url_EncodesUserInfoQueryAndFragment(t *testing.T) {
|
||||
}
|
||||
|
||||
q := parsed.Query()
|
||||
if q.Get("obfs") != "salamander" {
|
||||
t.Fatalf("expected obfs=salamander, got %q", q.Get("obfs"))
|
||||
}
|
||||
if q.Get("obfs-password") != "obf+s&pass=@x" {
|
||||
t.Fatalf("expected decoded obfs-password, got %q", q.Get("obfs-password"))
|
||||
}
|
||||
if q.Get("sni") != "exa mple.com" {
|
||||
t.Fatalf("expected decoded sni, got %q", q.Get("sni"))
|
||||
}
|
||||
if q.Get("insecure") != "0" {
|
||||
t.Fatalf("expected insecure=0, got %q", q.Get("insecure"))
|
||||
}
|
||||
if parsed.Fragment != "my remark #1" {
|
||||
t.Fatalf("expected decoded fragment, got %q", parsed.Fragment)
|
||||
}
|
||||
|
||||
if strings.Contains(raw, "u@ser:#&=+ pass") {
|
||||
t.Fatalf("raw uri must not contain unescaped userinfo: %s", raw)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHysteria2Url_MinimalConfig(t *testing.T) {
|
||||
raw := buildHysteria2Url("pass", "example.com", 8443, "", "", "", "")
|
||||
// Регрессия на upstream-баг 2.9.3: `+` в credentials при разборе share link
|
||||
// превращался в пробел. Проверяем, что кодирование однозначно.
|
||||
func TestBuildHysteria2Url_PlusInCredentialsSurvivesRoundTrip(t *testing.T) {
|
||||
cases := []string{"a+b", "a b", "a#b", "a@b", "a/b", "a?b", "a&b", "a=b", "a%b", "тест"}
|
||||
|
||||
parsed, err := url.Parse(raw)
|
||||
if err != nil {
|
||||
t.Fatalf("expected valid url, got error: %v", err)
|
||||
for _, value := range cases {
|
||||
raw := buildHysteria2Url(value, "example.com", 443, bo.ObfsShareConfig{Type: "gecko", Password: value}, "", "")
|
||||
parsed := mustParse(t, raw)
|
||||
|
||||
if got := parsed.User.Username(); got != value {
|
||||
t.Fatalf("userinfo round-trip failed for %q: got %q (raw=%s)", value, got, raw)
|
||||
}
|
||||
if got := parsed.Query().Get("obfs-password"); got != value {
|
||||
t.Fatalf("obfs-password round-trip failed for %q: got %q (raw=%s)", value, got, raw)
|
||||
}
|
||||
}
|
||||
if parsed.Host != "example.com:8443" {
|
||||
t.Fatalf("unexpected host: %s", parsed.Host)
|
||||
|
||||
// Ключевой инвариант: литеральный `+` кодируется как %2B и не может быть
|
||||
// прочитан клиентом как пробел, а пробел кодируется отдельно от него.
|
||||
plus := buildHysteria2Url("a+b", "example.com", 443, bo.ObfsShareConfig{Type: "gecko", Password: "a+b"}, "", "")
|
||||
if !strings.Contains(mustParse(t, plus).RawQuery, "%2B") {
|
||||
t.Fatalf("literal '+' must be percent-encoded as %%2B: %s", plus)
|
||||
}
|
||||
q := parsed.Query()
|
||||
if q.Get("insecure") != "0" {
|
||||
t.Fatalf("expected insecure=0, got %q", q.Get("insecure"))
|
||||
}
|
||||
if q.Get("obfs") != "" || q.Get("obfs-password") != "" || q.Get("sni") != "" {
|
||||
t.Fatalf("unexpected optional query params in minimal config: %s", parsed.RawQuery)
|
||||
|
||||
space := buildHysteria2Url("a b", "example.com", 443, bo.ObfsShareConfig{Type: "gecko", Password: "a b"}, "", "")
|
||||
if mustParse(t, space).Query().Get("obfs-password") == "a+b" {
|
||||
t.Fatalf("space and '+' must not collapse to the same value: %s", space)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveShareSni(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
acmeDomain string
|
||||
publicHost string
|
||||
envDomain string
|
||||
want string
|
||||
}{
|
||||
{name: "acme domain wins", acmeDomain: "acme.example.com", publicHost: "vpn.example.com", envDomain: "env.example.com", want: "acme.example.com"},
|
||||
{name: "file tls falls back to product domain", acmeDomain: "", publicHost: "vpn.example.com", envDomain: "env.example.com", want: "env.example.com"},
|
||||
{name: "public host used when domain is empty", acmeDomain: "", publicHost: "vpn.example.com", envDomain: "", want: "vpn.example.com"},
|
||||
{name: "ipv4 public host is not a valid sni", acmeDomain: "", publicHost: "203.0.113.10", envDomain: "", want: ""},
|
||||
{name: "ipv4 env domain is not a valid sni", acmeDomain: "", publicHost: "203.0.113.10", envDomain: "198.51.100.7", want: ""},
|
||||
{name: "whitespace is trimmed", acmeDomain: " acme.example.com ", publicHost: "", envDomain: "", want: "acme.example.com"},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
t.Setenv("HY2XS_DOMAIN", tc.envDomain)
|
||||
if got := resolveShareSni(tc.acmeDomain, tc.publicHost); got != tc.want {
|
||||
t.Fatalf("resolveShareSni(%q, %q) with HY2XS_DOMAIN=%q = %q, want %q",
|
||||
tc.acmeDomain, tc.publicHost, tc.envDomain, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestObfsShare_FromServerConfig(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
yamlConfig string
|
||||
wantType string
|
||||
wantPassword string
|
||||
}{
|
||||
{
|
||||
name: "gecko",
|
||||
yamlConfig: "obfs:\n type: gecko\n gecko:\n password: gecko-pass\n minPacketSize: 512\n maxPacketSize: 1200\n",
|
||||
wantType: "gecko",
|
||||
wantPassword: "gecko-pass",
|
||||
},
|
||||
{
|
||||
name: "salamander",
|
||||
yamlConfig: "obfs:\n type: salamander\n salamander:\n password: salamander-pass\n",
|
||||
wantType: "salamander",
|
||||
wantPassword: "salamander-pass",
|
||||
},
|
||||
{
|
||||
name: "no obfs section",
|
||||
yamlConfig: "listen: 0.0.0.0:443\n",
|
||||
},
|
||||
{
|
||||
name: "type without matching subsection",
|
||||
yamlConfig: "obfs:\n type: gecko\n salamander:\n password: mismatched\n",
|
||||
},
|
||||
{
|
||||
name: "unknown type",
|
||||
yamlConfig: "obfs:\n type: future\n gecko:\n password: p\n",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var config bo.Hysteria2ServerConfig
|
||||
if err := yaml.Unmarshal([]byte(tc.yamlConfig), &config); err != nil {
|
||||
t.Fatalf("unmarshal failed: %v", err)
|
||||
}
|
||||
got := config.ObfsShare()
|
||||
if got.Type != tc.wantType || got.Password != tc.wantPassword {
|
||||
t.Fatalf("ObfsShare() = %+v, want type=%q password=%q", got, tc.wantType, tc.wantPassword)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestHysteria2ServerConfig_ParsesModernUpstreamSchema(t *testing.T) {
|
||||
raw := `listen: 0.0.0.0:443
|
||||
tls:
|
||||
cert: /etc/hysteria/server.crt
|
||||
key: /etc/hysteria/server.key
|
||||
clientCA: /etc/hysteria/client-ca.crt
|
||||
ech:
|
||||
keyPath: /etc/hysteria/ech.pem
|
||||
obfs:
|
||||
type: gecko
|
||||
gecko:
|
||||
password: p
|
||||
minPacketSize: 512
|
||||
maxPacketSize: 1200
|
||||
bandwidth:
|
||||
up: 50 mbps
|
||||
down: 50 mbps
|
||||
disableLossCompensation: false
|
||||
congestion:
|
||||
type: bbr
|
||||
bbrProfile: standard
|
||||
quic:
|
||||
disableStatelessReset: false
|
||||
mimic:
|
||||
enabled: false
|
||||
interface: eth0
|
||||
xdpMode: skb
|
||||
realm:
|
||||
stunServers:
|
||||
- stun.example.com:3478
|
||||
ipMode: dual
|
||||
portMapping:
|
||||
enabled: false
|
||||
timeout: 10s
|
||||
masquerade:
|
||||
type: proxy
|
||||
proxy:
|
||||
url: https://example.com
|
||||
rewriteHost: true
|
||||
insecure: false
|
||||
xForwarded: true
|
||||
trafficStats:
|
||||
listen: 127.0.0.1:36712
|
||||
`
|
||||
|
||||
var config bo.Hysteria2ServerConfig
|
||||
if err := yaml.Unmarshal([]byte(raw), &config); err != nil {
|
||||
t.Fatalf("unmarshal failed: %v", err)
|
||||
}
|
||||
|
||||
if config.ECH == nil || config.ECH.KeyPath == nil || *config.ECH.KeyPath != "/etc/hysteria/ech.pem" {
|
||||
t.Fatal("ech.keyPath was not parsed")
|
||||
}
|
||||
if config.TLS == nil || config.TLS.ClientCA == nil || *config.TLS.ClientCA != "/etc/hysteria/client-ca.crt" {
|
||||
t.Fatal("tls.clientCA was not parsed")
|
||||
}
|
||||
if config.Congestion == nil || config.Congestion.Type == nil || *config.Congestion.Type != "bbr" {
|
||||
t.Fatal("congestion.type was not parsed")
|
||||
}
|
||||
if config.Congestion.BBRProfile == nil || *config.Congestion.BBRProfile != "standard" {
|
||||
t.Fatal("congestion.bbrProfile was not parsed")
|
||||
}
|
||||
if config.Bandwidth == nil || config.Bandwidth.DisableLossCompensation == nil || *config.Bandwidth.DisableLossCompensation {
|
||||
t.Fatal("bandwidth.disableLossCompensation was not parsed")
|
||||
}
|
||||
if config.QUIC == nil || config.QUIC.DisableStatelessReset == nil || *config.QUIC.DisableStatelessReset {
|
||||
t.Fatal("quic.disableStatelessReset was not parsed")
|
||||
}
|
||||
if config.Mimic == nil || config.Mimic.Enabled == nil || *config.Mimic.Enabled {
|
||||
t.Fatal("mimic section was not parsed")
|
||||
}
|
||||
if config.Realm == nil || len(config.Realm.StunServers) != 1 || config.Realm.PortMapping == nil {
|
||||
t.Fatal("realm section was not parsed")
|
||||
}
|
||||
if config.Masquerade == nil || config.Masquerade.Proxy == nil ||
|
||||
config.Masquerade.Proxy.XForwarded == nil || !*config.Masquerade.Proxy.XForwarded {
|
||||
t.Fatal("masquerade.proxy.xForwarded was not parsed")
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user