428f1333ac
* refactor(session): store user ID in session instead of full struct
Replaces storing the full User object in the session cookie with just
the user ID. GetLoginUser now re-fetches the user from the database on
every request so credential/permission changes take effect immediately
without requiring a re-login. Includes a backward-compatible migration
path for existing sessions that still carry the old struct payload.
* feat(auth): block panel with default admin/admin credentials and guide credential change
checkLogin middleware now detects default admin/admin credentials and
redirects every panel route to /panel/settings until they are changed.
The settings page auto-opens the Authentication tab, shows a
non-dismissible error banner, and lists 'Default credentials' first in
the security checklist. Login response includes mustChangeCredentials
so the login page can redirect directly. Logout is now POST-only.
Password must be at least 10 characters and cannot be admin/admin.
* feat(settings): redact secrets in AllSettingView and add TrustedProxyCIDRs
Introduces AllSettingView which strips tgBotToken, twoFactorToken,
ldapPassword, apiToken and warp/nord secrets before sending them to
the browser, replacing them with boolean hasFoo presence flags. A new
/panel/setting/secret endpoint allows updating individual secrets by
key. Secrets that arrive blank on a save are preserved from the DB
rather than overwritten. Adds TrustedProxyCIDRs as a configurable
setting (defaults to localhost CIDRs). URL fields are validated before
save.
* fix(security): SSRF prevention, trusted-proxy header gating, CSP nonce, HTTP timeouts
Adds SanitizeHTTPURL / SanitizePublicHTTPURL to reject private-range
and loopback targets before any outbound HTTP request (node probe,
xray download, outbound test, external traffic inform, tgbot API
server, panel updater). Forwarded headers (X-Real-IP, X-Forwarded-For,
X-Forwarded-Host) are now only trusted when the direct connection
arrives from a CIDR in TrustedProxyCIDRs. CSP policy is tightened with
a per-request nonce. HTTP server gains read/write/idle timeouts. Panel
updater downloads the script to a temp file instead of piping curl into
shell. Xray archive download adds a size cap and response-code check.
backuptotgbot is changed from GET to POST.
* feat(nodes): add allow-private-address toggle per node
Adds AllowPrivateAddress to the Node model (DB default false). When
enabled it bypasses the SSRF private-range check for that node's probe
URL, allowing nodes hosted on RFC-1918 or loopback addresses (e.g.
a private VPN or LAN setup).
* chore: frontend UX improvements, CI pipeline, and dev tooling
- AppSidebar: logout via POST /logout instead of navigating to GET
- InboundList: persist filter state (search, protocol, node) to
localStorage across page reloads; add protocol and node filter dropdowns
- IndexPage: add health status strip (Xray, CPU, Memory, Update) with
quick-action buttons
- dependabot: weekly go mod and npm update schedule
- ci.yml: add GitHub Actions workflow for build and vet
- .nvmrc: pin Node 22 for local development
- frontend: bump package.json and package-lock.json
- SubPage, DnsPresetsModal, api-docs: minor fixes
* fix(ci): stub web/dist before go list to satisfy go:embed at compile time
* chore(ui): remove health-strip bar from dashboard top
* Revert "feat(auth): block panel with default admin/admin credentials and guide credential change"
This reverts commit 56ce6073ce09f08147f989858e0e88b3a4359546.
* fix(auth): make logout POST+CSRF and propagate session loss to other tabs
- Switch /logout from GET to POST with CSRFMiddleware so it matches the
SPA's existing HttpUtil.post('/logout') call (previously 404'd silently)
and blocks GET-based logout via image tags or link prefetchers. Handler
now returns JSON; the SPA already navigates client-side.
- Return 401 (instead of 404) from /panel/api/* when the caller is a
browser XHR (X-Requested-With: XMLHttpRequest) so the axios interceptor
redirects to the login page on logout-in-another-tab, cookie expiry,
and server restart. Anonymous callers still get 404 to keep endpoints
hidden from casual scanners.
- One-shot the 401 redirect in axios-init.js and hang the rejected
promise so queued polls don't stack reloads or surface error toasts
while the browser is navigating away.
- Add the CSP nonce to the runtime-injected <script> in dist.go so the
panel loads under the existing script-src 'nonce-...' policy.
- Update api-docs endpoints.js: GET /logout doc entry was missing.
* fix(settings): POST /logout after credential change
* fix(auth): invalidate other sessions when credentials change
When the admin changes username/password from one machine, sessions
on every other machine kept working until they manually logged out
because session storage is a signed client-side cookie — there is
no server-side session list to revoke.
Add a per-user LoginEpoch counter stamped into the session at login
and re-verified on every authenticated request. UpdateUser and
UpdateFirstUser bump the epoch (UpdateUser via gorm.Expr so a single
update statement is atomic), so any cookie issued before the change
no longer matches the user's current epoch and GetLoginUser returns
nil — the SPA's 401 interceptor then redirects to the login page.
Backward compatible: the column defaults to 0 and missing cookie
values are treated as 0, so sessions issued before this change
remain valid until the first credential update.
---------
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
225 lines
5.7 KiB
Go
225 lines
5.7 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"regexp"
|
|
"sort"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/logger"
|
|
)
|
|
|
|
type xrayMetricsState struct {
|
|
Enabled bool `json:"enabled"`
|
|
Listen string `json:"listen"`
|
|
Reason string `json:"reason,omitempty"`
|
|
}
|
|
|
|
type ObsTagSnapshot struct {
|
|
Tag string `json:"tag"`
|
|
Alive bool `json:"alive"`
|
|
Delay int64 `json:"delay"`
|
|
LastSeenTime int64 `json:"lastSeenTime"`
|
|
LastTryTime int64 `json:"lastTryTime"`
|
|
UpdatedAt int64 `json:"updatedAt"`
|
|
}
|
|
|
|
type XrayMetricsService struct {
|
|
settingService SettingService
|
|
|
|
mu sync.RWMutex
|
|
state xrayMetricsState
|
|
client *http.Client
|
|
obsByTag map[string]ObsTagSnapshot
|
|
}
|
|
|
|
var validObsTag = regexp.MustCompile(`^[a-zA-Z0-9._\-]+$`)
|
|
|
|
func obsHistoryKey(tag string) string {
|
|
return "xrObs." + tag + ".delay"
|
|
}
|
|
|
|
func newXrayMetricsClient() *http.Client {
|
|
return &http.Client{Timeout: 1500 * time.Millisecond}
|
|
}
|
|
|
|
func (s *XrayMetricsService) getClient() *http.Client {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
if s.client == nil {
|
|
s.client = newXrayMetricsClient()
|
|
}
|
|
return s.client
|
|
}
|
|
|
|
func (s *XrayMetricsService) State() xrayMetricsState {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
return s.state
|
|
}
|
|
|
|
func (s *XrayMetricsService) AggregateMetric(metric string, bucketSeconds, maxPoints int) []map[string]any {
|
|
return xrayMetrics.aggregate(metric, bucketSeconds, maxPoints)
|
|
}
|
|
|
|
func (s *XrayMetricsService) ObservatorySnapshot() []ObsTagSnapshot {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
out := make([]ObsTagSnapshot, 0, len(s.obsByTag))
|
|
for _, v := range s.obsByTag {
|
|
out = append(out, v)
|
|
}
|
|
sort.Slice(out, func(i, j int) bool { return out[i].Tag < out[j].Tag })
|
|
return out
|
|
}
|
|
|
|
func (s *XrayMetricsService) HasObservatoryTag(tag string) bool {
|
|
if !validObsTag.MatchString(tag) {
|
|
return false
|
|
}
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
_, ok := s.obsByTag[tag]
|
|
return ok
|
|
}
|
|
|
|
func (s *XrayMetricsService) AggregateObservatory(tag string, bucketSeconds, maxPoints int) []map[string]any {
|
|
if !validObsTag.MatchString(tag) {
|
|
return []map[string]any{}
|
|
}
|
|
return xrayMetrics.aggregate(obsHistoryKey(tag), bucketSeconds, maxPoints)
|
|
}
|
|
|
|
func (s *XrayMetricsService) discoverListen() (string, error) {
|
|
tmpl, err := s.settingService.GetXrayConfigTemplate()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
var parsed struct {
|
|
Metrics *struct {
|
|
Listen string `json:"listen"`
|
|
} `json:"metrics"`
|
|
}
|
|
if err := json.Unmarshal([]byte(tmpl), &parsed); err != nil {
|
|
return "", err
|
|
}
|
|
if parsed.Metrics == nil || strings.TrimSpace(parsed.Metrics.Listen) == "" {
|
|
return "", nil
|
|
}
|
|
return strings.TrimSpace(parsed.Metrics.Listen), nil
|
|
}
|
|
|
|
type rawObsEntry struct {
|
|
Alive bool `json:"alive"`
|
|
Delay int64 `json:"delay"`
|
|
LastSeenTime int64 `json:"last_seen_time"`
|
|
LastTryTime int64 `json:"last_try_time"`
|
|
OutboundTag string `json:"outbound_tag"`
|
|
}
|
|
|
|
func (s *XrayMetricsService) Sample(t time.Time) {
|
|
listen, err := s.discoverListen()
|
|
if err != nil {
|
|
s.setState(xrayMetricsState{Reason: err.Error()})
|
|
return
|
|
}
|
|
if listen == "" {
|
|
s.setState(xrayMetricsState{Reason: "metrics block not configured in xray template"})
|
|
return
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 1500*time.Millisecond)
|
|
defer cancel()
|
|
url := fmt.Sprintf("http://%s/debug/vars", listen)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
|
if err != nil {
|
|
s.setState(xrayMetricsState{Listen: listen, Reason: err.Error()})
|
|
return
|
|
}
|
|
resp, err := s.getClient().Do(req)
|
|
if err != nil {
|
|
s.setState(xrayMetricsState{Listen: listen, Reason: err.Error()})
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusOK {
|
|
s.setState(xrayMetricsState{Listen: listen, Reason: fmt.Sprintf("HTTP %d", resp.StatusCode)})
|
|
return
|
|
}
|
|
|
|
var payload struct {
|
|
MemStats struct {
|
|
HeapAlloc uint64 `json:"HeapAlloc"`
|
|
Sys uint64 `json:"Sys"`
|
|
HeapObjects uint64 `json:"HeapObjects"`
|
|
NumGC uint32 `json:"NumGC"`
|
|
PauseNs [256]uint64 `json:"PauseNs"`
|
|
} `json:"memstats"`
|
|
Observatory map[string]rawObsEntry `json:"observatory"`
|
|
}
|
|
if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
|
|
s.setState(xrayMetricsState{Listen: listen, Reason: err.Error()})
|
|
return
|
|
}
|
|
|
|
xrayMetrics.append("xrAlloc", t, float64(payload.MemStats.HeapAlloc))
|
|
xrayMetrics.append("xrSys", t, float64(payload.MemStats.Sys))
|
|
xrayMetrics.append("xrHeapObjects", t, float64(payload.MemStats.HeapObjects))
|
|
xrayMetrics.append("xrNumGC", t, float64(payload.MemStats.NumGC))
|
|
var lastPause uint64
|
|
if payload.MemStats.NumGC > 0 {
|
|
idx := (payload.MemStats.NumGC + 255) % 256
|
|
lastPause = payload.MemStats.PauseNs[idx]
|
|
}
|
|
xrayMetrics.append("xrPauseNs", t, float64(lastPause))
|
|
|
|
s.applyObservatory(t, payload.Observatory)
|
|
s.setState(xrayMetricsState{Enabled: true, Listen: listen})
|
|
}
|
|
|
|
func (s *XrayMetricsService) applyObservatory(t time.Time, entries map[string]rawObsEntry) {
|
|
next := make(map[string]ObsTagSnapshot, len(entries))
|
|
for key, e := range entries {
|
|
tag := e.OutboundTag
|
|
if tag == "" {
|
|
tag = key
|
|
}
|
|
if !validObsTag.MatchString(tag) {
|
|
continue
|
|
}
|
|
snap := ObsTagSnapshot{
|
|
Tag: tag,
|
|
Alive: e.Alive,
|
|
Delay: e.Delay,
|
|
LastSeenTime: e.LastSeenTime,
|
|
LastTryTime: e.LastTryTime,
|
|
UpdatedAt: t.Unix(),
|
|
}
|
|
next[tag] = snap
|
|
xrayMetrics.append(obsHistoryKey(tag), t, float64(e.Delay))
|
|
}
|
|
|
|
s.mu.Lock()
|
|
for tag := range s.obsByTag {
|
|
if _, kept := next[tag]; !kept {
|
|
xrayMetrics.drop(obsHistoryKey(tag))
|
|
}
|
|
}
|
|
s.obsByTag = next
|
|
s.mu.Unlock()
|
|
}
|
|
|
|
func (s *XrayMetricsService) setState(st xrayMetricsState) {
|
|
s.mu.Lock()
|
|
s.state = st
|
|
s.mu.Unlock()
|
|
if !st.Enabled && st.Reason != "" {
|
|
logger.Debugf("xray metrics unavailable: %s", st.Reason)
|
|
}
|
|
}
|