rogue/3x-ui-agent
1
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases 5 Wiki Activity

ITEM6 B0: golden fixtures + fixture validation skeleton for sing-box migration

Browse Source 
26 cases (protocol x representative transport): current-shape input,
expected sing-box fragment, and share-link baseline generated by running
current main@8e89960 GetLink. Blocked/partial cases (xhttp, kcp,
fallbacks, finalmask, vlessenc, removed SS ciphers, tunnel) record their
unmapped concepts under _b0 for the Q1 decision instead of fabricating
output. Link-route baselines only: JSON/Clash subscription families are
being removed wholesale per the 2026-10-23 decision, Q2 closed.
This commit is contained in:
Muse
2026-10-22 18:14:58 +00:00
parent 8e89960474
commit 750a270955
81 changed files with 3007 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/singbox/README.md
+64
View File
@@ -0,0 +1,64 @@
# ITEM6 golden fixtures (B0)
Per-protocol × representative-transport fixtures for the xray→sing-box
migration. Consumed by B1 (data model + migrator) and B2 (config builder)
as the acceptance baseline; see `ITEM6-CONVERSION-SPEC.md` in
`~/workspace/xui-lite-work/` for the normative mapping behind every file.
## Layout
```
testdata/golden/<case>/
input.json current-shape sample (see below)
expected-singbox.json expected converter output fragment
expected-link.txt expected share link for the primary client
```
`input.json` fields: `case`, `title`, `source` (where the shape was taken
from — frontend defaults / backend tests / production backup traits),
`disposition`, `risk` (ITEM6-SCOPE N-number or null), `notes`, `inbound`
(a `model.Inbound` row shape: `settings` / `streamSettings` / `sniffing`
as embedded objects), `clientEmail`, `client` (the primary client's
settings-mirror entry — the same object embedded in `settings.clients`
where the protocol carries one).
`expected-singbox.json` is a fragment: `inbounds[]` (and `endpoints[]`
for WireGuard). Keys starting with `_` are fixture metadata (`_b0`:
disposition, unmapped concepts awaiting Q1, notes) and are stripped
before comparison. Blocked cases intentionally contain **no** fabricated
output — `inbounds` is empty and `_b0.unmapped` records exactly what has
no sing-box carrier, pending the user's Q1 decision.
## Provenance of the link baselines
`expected-link.txt` files were generated on 2026-10-23 by running the
**current** code (main `8e89960`) `SubService.GetLink` over each
`input.json` inbound — i.e. they are the pre-migration outputs the
migration must reproduce byte for byte (ITEM6-SCOPE §2.4). A throwaway
harness test produced them and was deleted afterwards; regenerate only
by re-running `GetLink` against the same inputs on pre-migration code.
Empty files are real current behaviour for `http-auth`, `tun` and
`tunnel-dokodemo` (no share link exists today).
All credentials in this corpus are fake (sequential-byte X25519/WireGuard
keys, `fx-` passwords, TEST-NET `203.0.113.10`). In fixtures, `listen`
doubles as the resolved share address, mirroring the characterization
tests in `internal/sub`; bind-address defaults are B2 base-config
business, not fixture content.
## Baseline scope: links only
Per the 2026-10-23 product decision, the JSON and Clash subscription
families are being deleted wholesale (separate work line); subscriptions
converge on the link format only. No Clash/JSON baselines are built or
kept here, and ITEM6-SCOPE Q2 is closed by that decision.
## Dispositions
- `direct` — full mapping defined; B2 must reproduce the fragment.
- `partial-pending-q1` — mappable body is in the fragment; `_b0.unmapped`
lists concepts with no sing-box carrier, awaiting Q1.
- `blocked-pending-q1` — no valid output exists until Q1 picks a carrier;
fragment is an explicit marker, not a silent drop.
- `external-runtime` — protocol never enters the core (mtproto,
amneziawg); the migration duty is verbatim data passthrough only.
internal/singbox/doc.go
+20
View File
@@ -0,0 +1,20 @@
// Package singbox hosts the L-UI xray→sing-box migration (ITEM6) assets.
//
// B0 deliverable: the golden fixture corpus under testdata/golden — for each
// protocol × representative transport, a current-shape sample (input.json),
// the expected sing-box fragment (expected-singbox.json), and the expected
// share-link output (expected-link.txt) produced by the CURRENT code at
// main 8e89960. B1 (data model + migrator) and B2 (config builder) consume
// these fixtures as their acceptance baseline:
//
// - the converter's output for input.json must equal expected-singbox.json
// (keys starting with "_" are fixture metadata, stripped before compare);
// - subscription links regenerated from the converted model must equal
// expected-link.txt byte for byte (ITEM6-SCOPE §2.4 invariants).
//
// Subscription baselines cover the LINK route only. Per the 2026-10-23
// product decision, the JSON and Clash subscription families are being
// removed entirely (separate work line); no baselines are kept for them.
//
// The conversion spec lives in ~/workspace/xui-lite-work/ITEM6-CONVERSION-SPEC.md.
package singbox
internal/singbox/golden_test.go
+120
View File
@@ -0,0 +1,120 @@
package singbox
import (
"encoding/json"
"os"
"path/filepath"
"sort"
"strings"
"testing"
)
// goldenCase mirrors the fixture envelope shared by input.json and
// expected-singbox.json. The tests in this file are READ-ONLY fixture
// validation: they pin the corpus so B1/B2 can build the converter
// against it. They never write to testdata.
type goldenEnvelope struct {
Case string `json:"case"`
B0 *struct {
Disposition string `json:"disposition"`
Unmapped []json.RawMessage `json:"unmapped"`
} `json:"_b0"`
Inbounds []json.RawMessage `json:"inbounds"`
}
var knownDispositions = map[string]bool{
"direct": true,
"partial-pending-q1": true,
"blocked-pending-q1": true,
"external-runtime": true,
"external": true, // used on the input side
}
func goldenDirs(t *testing.T) []string {
t.Helper()
root := filepath.Join("testdata", "golden")
entries, err := os.ReadDir(root)
if err != nil {
t.Fatalf("read golden root: %v", err)
}
var dirs []string
for _, e := range entries {
if e.IsDir() {
dirs = append(dirs, filepath.Join(root, e.Name()))
}
}
sort.Strings(dirs)
if len(dirs) == 0 {
t.Fatal("no golden fixture cases found")
}
return dirs
}
func readJSON(t *testing.T, path string, v any) {
t.Helper()
raw, err := os.ReadFile(path)
if err != nil {
t.Fatalf("read %s: %v", path, err)
}
if err := json.Unmarshal(raw, v); err != nil {
t.Fatalf("parse %s: %v", path, err)
}
}
// TestGoldenFixturesWellFormed pins corpus completeness: every case dir
// carries input.json, expected-singbox.json and expected-link.txt; every
// JSON parses; dispositions are from the known taxonomy; blocked cases
// must not smuggle in a fabricated sing-box output — they carry an empty
// inbounds list plus at least one _b0.unmapped entry awaiting Q1.
func TestGoldenFixturesWellFormed(t *testing.T) {
for _, dir := range goldenDirs(t) {
name := filepath.Base(dir)
var input struct {
Case string `json:"case"`
Disposition string `json:"disposition"`
}
readJSON(t, filepath.Join(dir, "input.json"), &input)
if input.Case != name {
t.Errorf("%s: input case %q != dir name", name, input.Case)
}
if !knownDispositions[input.Disposition] {
t.Errorf("%s: unknown input disposition %q", name, input.Disposition)
}
var expected goldenEnvelope
readJSON(t, filepath.Join(dir, "expected-singbox.json"), &expected)
if expected.B0 == nil {
t.Errorf("%s: expected-singbox.json missing _b0 metadata", name)
continue
}
disp := expected.B0.Disposition
if !knownDispositions[disp] {
t.Errorf("%s: unknown expected disposition %q", name, disp)
}
if strings.HasPrefix(disp, "blocked") {
if len(expected.Inbounds) != 0 {
t.Errorf("%s: blocked case must not fabricate sing-box inbounds", name)
}
if len(expected.B0.Unmapped) == 0 {
t.Errorf("%s: blocked case must record >=1 unmapped concept for Q1", name)
}
}
if strings.HasPrefix(disp, "partial") && len(expected.B0.Unmapped) == 0 {
t.Errorf("%s: partial case must record its unmapped concepts", name)
}
if _, err := os.Stat(filepath.Join(dir, "expected-link.txt")); err != nil {
t.Errorf("%s: missing expected-link.txt: %v", name, err)
}
}
}
// TestGoldenConversion is the B1/B2 hook: once the converter exists, feed
// each input.json through it and compare against expected-singbox.json
// (metadata keys stripped), then regenerate share links from the converted
// model and compare against expected-link.txt byte for byte. Skipped until
// the converter lands.
func TestGoldenConversion(t *testing.T) {
t.Skip("converter lands in ITEM6 B1/B2; fixtures are the baseline it must meet")
}
internal/singbox/testdata/golden/amneziawg/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vpn://W0ludGVyZmFjZV0KUHJpdmF0ZUtleSA9IE16UTFOamM0T1RvN1BEMCtQMEJCUWtORVJVWkhTRWxLUzB4TlRrOVFVVkkKQWRkcmVzcyA9IDEwLjguMS4yLzMyCkROUyA9IDguOC44LjgsIDguOC40LjQKSmMgPSA0CkptaW4gPSA0MApKbWF4ID0gNzAKUzEgPSAyMApTMiA9IDMwCkgxID0gMTAwMDAwMQpIMiA9IDEwMDAwMDIKSDMgPSAxMDAwMDAzCkg0ID0gMTAwMDAwNAoKIyBmeC1hbW5lemlhd2ctdXNlckBleGFtcGxlLmNvbQpbUGVlcl0KUHVibGljS2V5ID0gd1YwaVpVV1VWY24vRlc1c0hhYS90NUVMdUs5UThyTDUrRlBxa3lVbG5VMD0KQWxsb3dlZElQcyA9IDAuMC4wLjAvMCwgOjovMApFbmRwb2ludCA9IDIwMy4wLjExMy4xMDozODQ0Mw
internal/singbox/testdata/golden/amneziawg/expected-singbox.json
Vendored
+7
View File
@@ -0,0 +1,7 @@
{
"inbounds": [],
"_b0": {
"disposition": "external-runtime",
"notes": "不进核心（internal/amneziawg 外部运行时）。sing-box wireguard endpoint 表达不了 Amnezia 混淆参数（jc/jmin/jmax/s1-s4/h1-h4/i1-i5）与 per-client forwardedPorts；新模型义务仅为 server/clients 数据原样透传，vpn:// 链接与 .conf 不变。"
}
}
internal/singbox/testdata/golden/amneziawg/input.json
Vendored
+80
View File
@@ -0,0 +1,80 @@
{
"case": "amneziawg",
"title": "AmneziaWG（外部运行时承载，不进核心）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"internal/amneziawg/types.go ServerSettings"
],
"disposition": "external",
"risk": null,
"notes": "sing-box wireguard endpoint 表达不了 Amnezia 混淆参数（jc/jmin/jmax/s/h/i）与 per-client 转发端口；运行时与参数原样保留，仅数据模型透传。",
"inbound": {
"id": 126,
"listen": "203.0.113.10",
"port": 38443,
"protocol": "amneziawg",
"remark": "fx-amneziawg",
"tag": "inbound-38443",
"enable": true,
"settings": {
"server": {
"privateKey": "ycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+g",
"publicKey": "wV0iZUWUVcn/FW5sHaa/t5ELuK9Q8rL5+FPqkyUlnU0=",
"subnetIp": "10.8.1.0",
"subnetCidr": 24,
"primaryDns": "8.8.8.8",
"secondaryDns": "8.8.4.4",
"externalInterface": "",
"ipv6Enabled": false,
"ipv6Subnet": "",
"ipv6ExternalInterface": "",
"jc": 4,
"jmin": 40,
"jmax": 70,
"s1": 20,
"s2": 30,
"h1": "1000001",
"h2": "1000002",
"h3": "1000003",
"h4": "1000004"
},
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"privateKey": "MzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVI",
"publicKey": "wV0iZUWUVcn/FW5sHaa/t5ELuK9Q8rL5+FPqkyUlnU0=",
"allowedIPs": [
"10.8.1.2/32"
],
"forwardedPorts": ""
}
]
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"privateKey": "MzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVI",
"publicKey": "wV0iZUWUVcn/FW5sHaa/t5ELuK9Q8rL5+FPqkyUlnU0=",
"allowedIPs": [
"10.8.1.2/32"
],
"forwardedPorts": ""
}
}
internal/singbox/testdata/golden/http-auth/expected-link.txt
Vendored
View File
internal/singbox/testdata/golden/http-auth/expected-singbox.json
Vendored
+20
View File
@@ -0,0 +1,20 @@
{
"inbounds": [
{
"type": "http",
"tag": "inbound-33443",
"listen": "203.0.113.10",
"listen_port": 33443,
"users": [
{
"username": "fxhttp",
"password": "fxhttppass"
}
]
}
],
"_b0": {
"disposition": "direct",
"notes": "allowTransparent=false 与 sing-box（无透明代理对应）行为一致，无损；allowTransparent=true 的存量处置见规范（无对应，待 Q1）。http 无分享链接（expected-link.txt 为空，属现行行为）。"
}
}
internal/singbox/testdata/golden/http-auth/input.json
Vendored
+40
View File
@@ -0,0 +1,40 @@
{
"case": "http-auth",
"title": "HTTP 代理 / 账号",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": null,
"notes": "GetLink 对 http 返回空（无分享链）；Clash/JSON 两路有输出。sing-box http 入站 users 改名映射，allowTransparent 无对应（本样本 false，无损）。",
"inbound": {
"id": 119,
"listen": "203.0.113.10",
"port": 33443,
"protocol": "http",
"remark": "fx-http",
"tag": "inbound-33443",
"enable": true,
"settings": {
"accounts": [
{
"user": "fxhttp",
"pass": "fxhttppass"
}
],
"allowTransparent": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0
}
}
internal/singbox/testdata/golden/hysteria1/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
hysteria://fx-hy1-auth@203.0.113.10:35443?alpn=h3&fp=chrome&security=tls&sni=hy1.example.com#fx-hy1-user%40example.com
internal/singbox/testdata/golden/hysteria1/expected-singbox.json
Vendored
+29
View File
@@ -0,0 +1,29 @@
{
"inbounds": [
{
"type": "hysteria",
"tag": "inbound-35443",
"listen": "203.0.113.10",
"listen_port": 35443,
"users": [
{
"name": "user@example.com",
"auth": "fx-hy1-auth"
}
],
"tls": {
"enabled": true,
"server_name": "hy1.example.com",
"alpn": [
"h3"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
}
}
],
"_b0": {
"disposition": "direct",
"notes": "v1 按 type:hysteria 分发；users 字段为 auth（v1 语义）。带宽字段（up/down_mbps）现形状无来源（hysteriaSettings 只有 version/udpIdleTimeout），省略走核心默认；B1 落形时以 v1.13.21 文档复核字段名。"
}
}
internal/singbox/testdata/golden/hysteria1/input.json
Vendored
+82
View File
@@ -0,0 +1,82 @@
{
"case": "hysteria1",
"title": "Hysteria v1",
"source": [
"internal/database/model/hysteria_version_test.go"
],
"disposition": "direct",
"risk": null,
"notes": "按 version 分发：v1 → sing-box type:hysteria（auth 语义字段）。现网前端强制 v2、本样本为存量兜底；生成侧有 version 自愈逻辑，B1 迁移器须以 settings.version 原值为准。",
"inbound": {
"id": 121,
"listen": "203.0.113.10",
"port": 35443,
"protocol": "hysteria",
"remark": "fx-hy1",
"tag": "inbound-35443",
"enable": true,
"settings": {
"version": 1,
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"auth": "fx-hy1-auth"
}
]
},
"streamSettings": {
"network": "hysteria",
"security": "tls",
"hysteriaSettings": {
"version": 1,
"udpIdleTimeout": 60
},
"tlsSettings": {
"serverName": "hy1.example.com",
"alpn": [
"h3"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"auth": "fx-hy1-auth"
}
}
internal/singbox/testdata/golden/hysteria2-salamander/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
hysteria2://fx-hy2-auth@203.0.113.10:34443?alpn=h3&fp=chrome&obfs=salamander&obfs-password=fx-obfs-pass&security=tls&sni=hy.example.com#fx-hy2-user%40example.com
internal/singbox/testdata/golden/hysteria2-salamander/expected-singbox.json
Vendored
+33
View File
@@ -0,0 +1,33 @@
{
"inbounds": [
{
"type": "hysteria2",
"tag": "inbound-34443",
"listen": "203.0.113.10",
"listen_port": 34443,
"users": [
{
"name": "user@example.com",
"password": "fx-hy2-auth"
}
],
"obfs": {
"type": "salamander",
"password": "fx-obfs-pass"
},
"tls": {
"enabled": true,
"server_name": "hy.example.com",
"alpn": [
"h3"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
}
}
],
"_b0": {
"disposition": "direct",
"notes": "finalmask.udp[salamander] → hysteria2 obfs 直映（现行订阅链接已带 obfs/obfs-password 参数，服务端必须同值否则握手失败——见 expected-link.txt）。masquerade 未启用（type 空）省略。hysteriaSettings.udpIdleTimeout 在 sing-box hysteria2 无对应字段（QUIC 层自理），见规范 §4.2 小损项，随 Q1 一并确认。"
}
}
internal/singbox/testdata/golden/hysteria2-salamander/input.json
Vendored
+100
View File
@@ -0,0 +1,100 @@
{
"case": "hysteria2-salamander",
"title": "Hysteria2 + finalmask salamander obfs",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"internal/sub/service.go genHysteriaLink 的 salamander 桥"
],
"disposition": "direct",
"risk": null,
"notes": "关键桥：现订阅代码已把 finalmask.udp[salamander] 翻成 hysteria2 URI 的 obfs 参数；sing-box hysteria2 原生 obfs{type:salamander,password} 直映——这是 finalmask 里唯一有直映路径的子集。masquerade 未启用（空）。",
"inbound": {
"id": 120,
"listen": "203.0.113.10",
"port": 34443,
"protocol": "hysteria",
"remark": "fx-hy2",
"tag": "inbound-34443",
"enable": true,
"settings": {
"version": 2,
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"auth": "fx-hy2-auth"
}
]
},
"streamSettings": {
"network": "hysteria",
"security": "tls",
"hysteriaSettings": {
"version": 2,
"udpIdleTimeout": 60,
"masquerade": {
"type": "",
"dir": "",
"url": "",
"rewriteHost": false,
"statusCode": 0
}
},
"tlsSettings": {
"serverName": "hy.example.com",
"alpn": [
"h3"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
},
"finalmask": {
"udp": [
{
"type": "salamander",
"settings": {
"password": "fx-obfs-pass"
}
}
]
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"auth": "fx-hy2-auth"
}
}
internal/singbox/testdata/golden/mixed-auth/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
socks://user%40example.com:fx-mixed-pass@203.0.113.10:31443#fx-mixed-user%40example.com
internal/singbox/testdata/golden/mixed-auth/expected-singbox.json
Vendored
+24
View File
@@ -0,0 +1,24 @@
{
"inbounds": [
{
"type": "mixed",
"tag": "inbound-31443",
"listen": "203.0.113.10",
"listen_port": 31443,
"users": [
{
"username": "fxacct",
"password": "fxacctpass"
},
{
"username": "user@example.com",
"password": "fx-mixed-pass"
}
]
}
],
"_b0": {
"disposition": "direct",
"notes": "顺序沿现生成语义：settings 固定 accounts 居首、身份层客户随后。mixed 的 udp 由协议原生 UDP Associate 承载（settings.udp=true 已含）；settings.ip（UDP 回源地址）无直对应，本样本 127.0.0.1 为默认值、实际无损，规范 §3.5 标注待 Q1 确认。流量归因键：sing-box 以 username 记 user 计数（B3 复核）。"
}
}
internal/singbox/testdata/golden/mixed-auth/input.json
Vendored
+57
View File
@@ -0,0 +1,57 @@
{
"case": "mixed-auth",
"title": "Mixed / 密码账号（settings accounts + 身份层客户）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": null,
"notes": "现链路：身份层客户在生成时折成 accounts（落地固定账号居首）。sing-box mixed 用 users[{username,password}]，username=email。streamSettings 存量为空串（备份库实证），本样本不带 streamSettings。",
"inbound": {
"id": 117,
"listen": "203.0.113.10",
"port": 31443,
"protocol": "mixed",
"remark": "fx-mixed",
"tag": "inbound-31443",
"enable": true,
"settings": {
"auth": "password",
"accounts": [
{
"user": "fxacct",
"pass": "fxacctpass"
}
],
"udp": true,
"ip": "127.0.0.1",
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-mixed-pass"
}
]
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-mixed-pass"
}
}
internal/singbox/testdata/golden/mtproto/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
tg://proxy?port=37443&secret=ee0123456789abcdef0123456789abcdef7777772e636c6f7564666c6172652e636f6d&server=203.0.113.10
internal/singbox/testdata/golden/mtproto/expected-singbox.json
Vendored
+7
View File
@@ -0,0 +1,7 @@
{
"inbounds": [],
"_b0": {
"disposition": "external-runtime",
"notes": "不进核心（现状即被生成器跳过，internal/mtproto 独立 manager 承载）。新模型义务仅为：settings{fakeTlsDomain, clients[{secret,...}]} 原样透传，订阅 tg:// 链接不变（见 expected-link.txt）。"
}
}
internal/singbox/testdata/golden/mtproto/input.json
Vendored
+50
View File
@@ -0,0 +1,50 @@
{
"case": "mtproto",
"title": "MTProto（外部进程承载，不进核心）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"internal/sub/service_mtproto_test.go"
],
"disposition": "external",
"risk": null,
"notes": "现状即被生成器跳过；新模型只要求 settings/clients 数据原样透传（不变量 §2.4-5 secret）。expected-singbox 为空入站 + 透传标记。",
"inbound": {
"id": 125,
"listen": "203.0.113.10",
"port": 37443,
"protocol": "mtproto",
"remark": "fx-mtproto",
"tag": "inbound-37443",
"enable": true,
"settings": {
"fakeTlsDomain": "www.cloudflare.com",
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"secret": "ee0123456789abcdef0123456789abcdef7777772e636c6f7564666c6172652e636f6d"
}
]
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"secret": "ee0123456789abcdef0123456789abcdef7777772e636c6f7564666c6172652e636f6d"
}
}
internal/singbox/testdata/golden/shadowsocks-2022/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
ss://2022-blake3-aes-128-gcm:MDEyMzQ1Njc4OWFiY2RlZg%3D%3D:Y2xpZW50LXBhc3MtMDAwMQ%3D%3D@203.0.113.10:28443?type=tcp#fx-ss2022-user%40example.com
internal/singbox/testdata/golden/shadowsocks-2022/expected-singbox.json
Vendored
+26
View File
@@ -0,0 +1,26 @@
{
"inbounds": [
{
"type": "shadowsocks",
"tag": "inbound-28443",
"listen": "203.0.113.10",
"listen_port": 28443,
"method": "2022-blake3-aes-128-gcm",
"password": "MDEyMzQ1Njc4OWFiY2RlZg==",
"users": [
{
"name": "user@example.com",
"password": "Y2xpZW50LXBhc3MtMDAwMQ=="
},
{
"name": "user2@example.com",
"password": "Y2xpZW50LXBhc3MtMDAwMg=="
}
]
}
],
"_b0": {
"disposition": "direct",
"notes": "network=tcp,udp 为 sing-box ss 默认监听面，省略不写。ivCheck 无对应（sing-box 恒校验），本样本 false→恒校验属行为收紧，规范 §3.4 标注、处置随 Q1 一并确认。NexusGate 已实证 2022 组合密码语义两侧一致。"
}
}
internal/singbox/testdata/golden/shadowsocks-2022/input.json
Vendored
+88
View File
@@ -0,0 +1,88 @@
{
"case": "shadowsocks-2022",
"title": "Shadowsocks 2022-blake3-aes-128-gcm（多用户）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"~/workspace/NexusGate 生产实证（组合密码语义）"
],
"disposition": "direct",
"risk": null,
"notes": "服务端密码:客户密码组合式两侧语义一致（不变量 §2.4-4）。主客户为 user@example.com，user2 仅出现在 settings.clients 与 expected sing-box users。",
"inbound": {
"id": 114,
"listen": "203.0.113.10",
"port": 28443,
"protocol": "shadowsocks",
"remark": "fx-ss2022",
"tag": "inbound-28443",
"enable": true,
"settings": {
"method": "2022-blake3-aes-128-gcm",
"password": "MDEyMzQ1Njc4OWFiY2RlZg==",
"network": "tcp,udp",
"ivCheck": false,
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "Y2xpZW50LXBhc3MtMDAwMQ=="
},
{
"email": "user2@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "Y2xpZW50LXBhc3MtMDAwMg=="
}
]
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "Y2xpZW50LXBhc3MtMDAwMQ=="
}
}
internal/singbox/testdata/golden/shadowsocks-legacy/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpmeC1zcy1sZWdhY3ktY2xpZW50@203.0.113.10:29443?type=tcp#fx-ss-legacy-user%40example.com
internal/singbox/testdata/golden/shadowsocks-legacy/expected-singbox.json
Vendored
+22
View File
@@ -0,0 +1,22 @@
{
"inbounds": [
{
"type": "shadowsocks",
"tag": "inbound-29443",
"listen": "203.0.113.10",
"listen_port": 29443,
"method": "chacha20-ietf-poly1305",
"password": "fx-ss-inbound-pass",
"users": [
{
"name": "user@example.com",
"password": "fx-ss-legacy-client"
}
]
}
],
"_b0": {
"disposition": "direct",
"notes": "legacy 方法 sing-box 仍支持；user 密码语义为逐用户独立密码（不做 2022 式组合），与 xray 客户行为一致，B3 以真客户端复核。"
}
}
internal/singbox/testdata/golden/shadowsocks-legacy/input.json
Vendored
+74
View File
@@ -0,0 +1,74 @@
{
"case": "shadowsocks-legacy",
"title": "Shadowsocks legacy chacha20-ietf-poly1305",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": null,
"notes": "legacy 单密码语义：客户密码即连接密码。sing-box 仍支持该 cipher。",
"inbound": {
"id": 115,
"listen": "203.0.113.10",
"port": 29443,
"protocol": "shadowsocks",
"remark": "fx-ss-legacy",
"tag": "inbound-29443",
"enable": true,
"settings": {
"method": "chacha20-ietf-poly1305",
"password": "fx-ss-inbound-pass",
"network": "tcp,udp",
"ivCheck": false,
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "fx-ss-legacy-client"
}
]
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "fx-ss-legacy-client"
}
}
internal/singbox/testdata/golden/shadowsocks-removed-cipher/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
ss://YWVzLTI1Ni1jZmI6Zngtc3MtY2ZiLWNsaWVudA@203.0.113.10:30443?type=tcp#fx-ss-cfb-user%40example.com
internal/singbox/testdata/golden/shadowsocks-removed-cipher/expected-singbox.json
Vendored
+17
View File
@@ -0,0 +1,17 @@
{
"inbounds": [],
"_b0": {
"disposition": "blocked-pending-q1",
"risk": "N6",
"unmapped": [
{
"concept": "shadowsocks method=aes-256-cfb",
"input": {
"method": "aes-256-cfb"
},
"reason": "sing-box 已移除 cfb/ctr 类 cipher，无承载；存量按 method 分组计数（census Q06）后随 Q1 报用户。",
"pending": "Q1"
}
]
}
}
internal/singbox/testdata/golden/shadowsocks-removed-cipher/input.json
Vendored
+74
View File
@@ -0,0 +1,74 @@
{
"case": "shadowsocks-removed-cipher",
"title": "Shadowsocks aes-256-cfb（sing-box 已移除）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "blocked-pending-q1",
"risk": "N6",
"notes": "cfb/ctr 类 cipher 在 sing-box 已移除，无承载。只登记，等 Q1（与 N6 按 method 分组计数一起报）。",
"inbound": {
"id": 116,
"listen": "203.0.113.10",
"port": 30443,
"protocol": "shadowsocks",
"remark": "fx-ss-cfb",
"tag": "inbound-30443",
"enable": true,
"settings": {
"method": "aes-256-cfb",
"password": "fx-ss-cfb-pass",
"network": "tcp,udp",
"ivCheck": false,
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "fx-ss-cfb-client"
}
]
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"method": "",
"password": "fx-ss-cfb-client"
}
}
internal/singbox/testdata/golden/socks-auth/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
socks://user%40example.com:fx-socks-pass@203.0.113.10:32443#fx-socks-user%40example.com
internal/singbox/testdata/golden/socks-auth/expected-singbox.json
Vendored
+24
View File
@@ -0,0 +1,24 @@
{
"inbounds": [
{
"type": "socks",
"tag": "inbound-32443",
"listen": "203.0.113.10",
"listen_port": 32443,
"users": [
{
"username": "fxsacct",
"password": "fxsacctpass"
},
{
"username": "user@example.com",
"password": "fx-socks-pass"
}
]
}
],
"_b0": {
"disposition": "direct",
"notes": "socks 与 mixed 在新模型分开成两个 type（§4.1）；users 字段为 username/password（NexusGate 服务端实证）。"
}
}
internal/singbox/testdata/golden/socks-auth/input.json
Vendored
+57
View File
@@ -0,0 +1,57 @@
{
"case": "socks-auth",
"title": "SOCKS（传统节点同步流入形状，无原生表单）",
"source": [
"internal/sub/socks_link_test.go"
],
"disposition": "direct",
"risk": null,
"notes": "sing-box socks 入站 users 字段为 username/password（NexusGate 服务端实证），与 mixed 在新模型分开成两个 type。",
"inbound": {
"id": 118,
"listen": "203.0.113.10",
"port": 32443,
"protocol": "socks",
"remark": "fx-socks",
"tag": "inbound-32443",
"enable": true,
"settings": {
"auth": "password",
"accounts": [
{
"user": "fxsacct",
"pass": "fxsacctpass"
}
],
"udp": true,
"ip": "127.0.0.1",
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-socks-pass"
}
]
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-socks-pass"
}
}
internal/singbox/testdata/golden/trojan-tcp-tls-flow/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
trojan://fx-trojan-pass@203.0.113.10:27443?alpn=h2%2Chttp%2F1.1&fp=chrome&security=tls&sni=tjf.example.com&type=tcp#fx-trojan-flow-user%40example.com
internal/singbox/testdata/golden/trojan-tcp-tls-flow/expected-singbox.json
Vendored
+39
View File
@@ -0,0 +1,39 @@
{
"inbounds": [
{
"type": "trojan",
"tag": "inbound-27443",
"listen": "203.0.113.10",
"listen_port": 27443,
"users": [
{
"name": "user@example.com",
"password": "fx-trojan-pass"
}
],
"tls": {
"enabled": true,
"server_name": "tjf.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "partial-pending-q1",
"risk": "N5",
"unmapped": [
{
"concept": "trojan client flow",
"input": "xtls-rprx-vision",
"reason": "sing-box v1.13.21 trojan 入站对 flow 的支持度未实证；B3 真机验前不写入 users（写了可能被核心拒绝或静默忽略），验明后回改本基线。",
"pending": "Q1/B3"
}
]
}
}
internal/singbox/testdata/golden/trojan-tcp-tls-flow/input.json
Vendored
+87
View File
@@ -0,0 +1,87 @@
{
"case": "trojan-tcp-tls-flow",
"title": "Trojan / TCP / TLS + xtls flow（支持度待验）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "partial-pending-q1",
"risk": "N5",
"notes": "密码直映；flow 在 sing-box trojan 入站的支持度未验（v1.13.21），登记 _b0.unmapped 待 B3 真机验，不预删。",
"inbound": {
"id": 113,
"listen": "203.0.113.10",
"port": 27443,
"protocol": "trojan",
"remark": "fx-trojan-flow",
"tag": "inbound-27443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-trojan-pass",
"flow": "xtls-rprx-vision"
}
],
"fallbacks": []
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"tlsSettings": {
"serverName": "tjf.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-trojan-pass",
"flow": "xtls-rprx-vision"
}
}
internal/singbox/testdata/golden/trojan-tcp-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
trojan://fx-trojan-pass@203.0.113.10:26443?alpn=h2%2Chttp%2F1.1&fp=chrome&security=tls&sni=tj.example.com&type=tcp#fx-trojan-user%40example.com
internal/singbox/testdata/golden/trojan-tcp-tls/expected-singbox.json
Vendored
+30
View File
@@ -0,0 +1,30 @@
{
"inbounds": [
{
"type": "trojan",
"tag": "inbound-26443",
"listen": "203.0.113.10",
"listen_port": 26443,
"users": [
{
"name": "user@example.com",
"password": "fx-trojan-pass"
}
],
"tls": {
"enabled": true,
"server_name": "tj.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct"
}
}
internal/singbox/testdata/golden/trojan-tcp-tls/input.json
Vendored
+85
View File
@@ -0,0 +1,85 @@
{
"case": "trojan-tcp-tls",
"title": "Trojan / TCP / TLS",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": null,
"notes": "",
"inbound": {
"id": 112,
"listen": "203.0.113.10",
"port": 26443,
"protocol": "trojan",
"remark": "fx-trojan",
"tag": "inbound-26443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-trojan-pass"
}
],
"fallbacks": []
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"tlsSettings": {
"serverName": "tj.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"password": "fx-trojan-pass"
}
}
internal/singbox/testdata/golden/tun/expected-link.txt
Vendored
View File
internal/singbox/testdata/golden/tun/expected-singbox.json
Vendored
+39
View File
@@ -0,0 +1,39 @@
{
"inbounds": [
{
"type": "tun",
"tag": "inbound-0",
"interface_name": "xray0",
"address": [
"172.19.0.1/28"
],
"mtu": 1500,
"auto_route": true,
"route_address": [
"0.0.0.0/0"
],
"stack": "system"
}
],
"_b0": {
"disposition": "direct",
"risk": "Q5",
"unmapped": [
{
"concept": "settings.dns",
"input": [
"1.1.1.1"
],
"reason": "tun 入站本体无 dns 字段，由 sing-box 独立 dns 配置承载——属基础配置面而非入站面，B2 定落点，此处登记防丢。",
"pending": "B2"
},
{
"concept": "settings.userLevel",
"input": 0,
"reason": "xray policy level 概念，sing-box 无对应；本样本 0 为默认，实际无损。",
"pending": "Q1"
}
],
"notes": "gateway[] → address[]；autoSystemRoutingTable → route_address + auto_route；autoOutboundsInterface=auto 省略（sing-box auto_redirect/出口自动选择为近似，字段落位 B1 定）。是否挂 agent 承载属 Q5。"
}
}
internal/singbox/testdata/golden/tun/input.json
Vendored
+46
View File
@@ -0,0 +1,46 @@
{
"case": "tun",
"title": "TUN（面板本地）",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": "Q5",
"notes": "sing-box 原生 tun 入站且字段更完整；本样本按现字段名映射（gateway→address 等改名在规范中逐项列）。是否挂 agent 承载属 Q5，不影响形状映射。",
"inbound": {
"id": 124,
"listen": "203.0.113.10",
"port": 0,
"protocol": "tun",
"remark": "fx-tun",
"tag": "inbound-0",
"enable": true,
"settings": {
"name": "xray0",
"mtu": 1500,
"gateway": [
"172.19.0.1/28"
],
"dns": [
"1.1.1.1"
],
"userLevel": 0,
"autoSystemRoutingTable": [
"0.0.0.0/0"
],
"autoOutboundsInterface": "auto"
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0
}
}
internal/singbox/testdata/golden/tunnel-dokodemo/expected-link.txt
Vendored
View File
internal/singbox/testdata/golden/tunnel-dokodemo/expected-singbox.json
Vendored
+22
View File
@@ -0,0 +1,22 @@
{
"inbounds": [],
"_b0": {
"disposition": "blocked-pending-q1",
"risk": "N2",
"unmapped": [
{
"concept": "tunnel(dokodemo-door) settings",
"input": {
"rewriteAddress": "192.0.2.50",
"rewritePort": 8080,
"portMap": {},
"allowedNetwork": "tcp,udp",
"followRedirect": false
},
"reason": "sing-box 无 dokodemo 等价物（direct 入站已弃用并在新版移除）。现为面板本地协议、不下发 agent；承载（自维护极小转发组件 / route 近似）待 Q1+Q5。",
"pending": "Q1"
}
],
"mappableRemainder": "无。"
}
}
internal/singbox/testdata/golden/tunnel-dokodemo/input.json
Vendored
+38
View File
@@ -0,0 +1,38 @@
{
"case": "tunnel-dokodemo",
"title": "Tunnel（dokodemo-door 面板本地）",
"source": [
"frontend/src/schemas/protocols/inbound/tunnel.ts"
],
"disposition": "blocked-pending-q1",
"risk": "N2",
"notes": "sing-box 无稳定等价物（direct 入站已弃用并在新版移除）。现为面板本地协议、不下发 agent。承载方式（极小转发组件/route 近似）等 Q1/Q5，先登记形状。",
"inbound": {
"id": 123,
"listen": "203.0.113.10",
"port": 36443,
"protocol": "tunnel",
"remark": "fx-tunnel",
"tag": "inbound-36443",
"enable": true,
"settings": {
"rewriteAddress": "192.0.2.50",
"rewritePort": 8080,
"portMap": {},
"allowedNetwork": "tcp,udp",
"followRedirect": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0
}
}
internal/singbox/testdata/golden/vless-grpc-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:10443?alpn=h2%2Chttp%2F1.1&authority=&encryption=none&fp=chrome&security=tls&serviceName=fx-grpc&sni=grpc.example.com&type=grpc#fx-vless-grpc-user%40example.com
internal/singbox/testdata/golden/vless-grpc-tls/expected-singbox.json
Vendored
+35
View File
@@ -0,0 +1,35 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-10443",
"listen": "203.0.113.10",
"listen_port": 10443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555"
}
],
"transport": {
"type": "grpc",
"service_name": "fx-grpc"
},
"tls": {
"enabled": true,
"server_name": "grpc.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct",
"notes": "grpcSettings.multiMode 在 sing-box grpc transport 无对应字段；本样本 false 与 sing-box 默认行为一致，无损。multiMode=true 的存量处置见规范（近似/无对应，待 Q1）。"
}
}
internal/singbox/testdata/golden/vless-grpc-tls/input.json
Vendored
+87
View File
@@ -0,0 +1,87 @@
{
"case": "vless-grpc-tls",
"title": "VLESS / gRPC / TLS",
"source": [
"frontend/src/schemas/protocols/stream/grpc.ts"
],
"disposition": "direct",
"risk": null,
"notes": "grpc serviceName 两侧改名 service_name，multiMode 在 sing-box 无对应字段（近似：默认关）——本样本 multiMode=false，无损。",
"inbound": {
"id": 103,
"listen": "203.0.113.10",
"port": 10443,
"protocol": "vless",
"remark": "fx-vless-grpc",
"tag": "inbound-10443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "grpc",
"security": "tls",
"grpcSettings": {
"serviceName": "fx-grpc",
"multiMode": false
},
"tlsSettings": {
"serverName": "grpc.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
}
internal/singbox/testdata/golden/vless-httpupgrade-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:11443?alpn=h2%2Chttp%2F1.1&encryption=none&fp=chrome&host=hu.example.com&path=%2Ffxhu&security=tls&sni=hu.example.com&type=httpupgrade#fx-vless-httpupgrade-user%40example.com
internal/singbox/testdata/golden/vless-httpupgrade-tls/expected-singbox.json
Vendored
+35
View File
@@ -0,0 +1,35 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-11443",
"listen": "203.0.113.10",
"listen_port": 11443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555"
}
],
"transport": {
"type": "httpupgrade",
"host": "hu.example.com",
"path": "/fxhu"
},
"tls": {
"enabled": true,
"server_name": "hu.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct"
}
}
internal/singbox/testdata/golden/vless-httpupgrade-tls/input.json
Vendored
+87
View File
@@ -0,0 +1,87 @@
{
"case": "vless-httpupgrade-tls",
"title": "VLESS / HTTPUpgrade / TLS",
"source": [
"frontend/src/schemas/protocols/stream/httpupgrade.ts"
],
"disposition": "direct",
"risk": null,
"notes": "",
"inbound": {
"id": 104,
"listen": "203.0.113.10",
"port": 11443,
"protocol": "vless",
"remark": "fx-vless-httpupgrade",
"tag": "inbound-11443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "httpupgrade",
"security": "tls",
"httpupgradeSettings": {
"path": "/fxhu",
"host": "hu.example.com"
},
"tlsSettings": {
"serverName": "hu.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
}
internal/singbox/testdata/golden/vless-tcp-finalmask/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:21443?encryption=none&flow=xtls-rprx-vision&fm=%7B%22tcp%22%3A%5B%7B%22settings%22%3A%7B%22interval%22%3A%2210-20%22%2C%22length%22%3A%22100-200%22%2C%22packets%22%3A%22tlshello%22%7D%2C%22type%22%3A%22fragment%22%7D%5D%7D&fp=chrome&pbk=B6N8vBQgk8i3VdwbEOhstCY3StFqqFPtC9%2FAsrhtHHw%3D&security=reality&sid=ab12cd34&sni=www.amd.com&spx=%2Fd0cf3c252cd6df6&type=tcp#fx-vless-finalmask-user%40example.com
internal/singbox/testdata/golden/vless-tcp-finalmask/expected-singbox.json
Vendored
+52
View File
@@ -0,0 +1,52 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-21443",
"listen": "203.0.113.10",
"listen_port": 21443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"tls": {
"enabled": true,
"server_name": "www.amd.com",
"reality": {
"enabled": true,
"handshake": {
"server": "www.amd.com",
"server_port": 443
},
"private_key": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=",
"short_id": [
"ab12cd34"
]
}
},
"sniff": true
}
],
"_b0": {
"disposition": "partial-pending-q1",
"risk": "N9",
"unmapped": [
{
"concept": "streamSettings.finalmask.tcp[fragment]",
"input": {
"type": "fragment",
"settings": {
"packets": "tlshello",
"length": "100-200",
"interval": "10-20"
}
},
"reason": "sing-box 无 finalmask 机制。且现行分享链接携带 fm= 参数（见 expected-link.txt），删服务端 mask 会使存量客户端链接失效——属用户可见变化，待 Q1。",
"pending": "Q1"
}
]
}
}
internal/singbox/testdata/golden/vless-tcp-finalmask/input.json
Vendored
+108
View File
@@ -0,0 +1,108 @@
{
"case": "vless-tcp-finalmask",
"title": "VLESS / TCP / Reality + finalmask（fragment）",
"source": [
"frontend/src/schemas/protocols/stream/finalmask.ts"
],
"disposition": "partial-pending-q1",
"risk": "N9",
"notes": "finalmask 无 sing-box 对应。主入站本体可直映；mask 登记 _b0.unmapped。注意例外：hysteria2 的 udp salamander mask 有直映路径，见 hysteria2-salamander。",
"inbound": {
"id": 107,
"listen": "203.0.113.10",
"port": 21443,
"protocol": "vless",
"remark": "fx-vless-finalmask",
"tag": "inbound-21443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"realitySettings": {
"show": false,
"xver": 0,
"target": "www.amd.com:443",
"serverNames": [
"www.amd.com"
],
"privateKey": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=",
"minClientVer": "",
"maxClientVer": "",
"maxTimediff": 0,
"shortIds": [
"ab12cd34"
],
"mldsa65Seed": "",
"settings": {
"publicKey": "B6N8vBQgk8i3VdwbEOhstCY3StFqqFPtC9/AsrhtHHw=",
"fingerprint": "chrome",
"serverName": "",
"spiderX": "/",
"mldsa65Verify": ""
}
},
"finalmask": {
"tcp": [
{
"type": "fragment",
"settings": {
"packets": "tlshello",
"length": "100-200",
"interval": "10-20"
}
}
]
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
}
internal/singbox/testdata/golden/vless-tcp-reality-fallbacks/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:20443?encryption=none&flow=xtls-rprx-vision&fp=chrome&pbk=WGmv9FBUlzLLqu1eXfmzCm2jHLDldCutWtShp2jxpns%3D&security=reality&sid=77aa10f0&sni=www.microsoft.com&spx=%2Fd0cf3c252cd6df6&type=tcp#fx-vless-fallback-user%40example.com
internal/singbox/testdata/golden/vless-tcp-reality-fallbacks/expected-singbox.json
Vendored
+52
View File
@@ -0,0 +1,52 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-20443",
"listen": "203.0.113.10",
"listen_port": 20443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"tls": {
"enabled": true,
"server_name": "www.microsoft.com",
"reality": {
"enabled": true,
"handshake": {
"server": "www.microsoft.com",
"server_port": 443
},
"private_key": "ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0A=",
"short_id": [
"77aa10f0"
]
}
},
"sniff": true
}
],
"_b0": {
"disposition": "partial-pending-q1",
"risk": "N1",
"unmapped": [
{
"concept": "fallbacks（inbound_fallbacks 表行 → settings.fallbacks 注入形）",
"input": {
"name": "",
"alpn": "",
"path": "",
"dest": 8080,
"xver": 0
},
"reason": "sing-box 无 fallback 概念；主入站本体已直映，回落关系（按 alpn/path 分流到 dest）无承载。候选承载（route 条件分流近似 / 专用小组件）待 Q1 拍板。",
"pending": "Q1"
}
],
"notes": "迁移器须同时读 inbound_fallbacks 表与 settings 内嵌 fallbacks 两种存量形态（见规范 §4.1）。"
}
}
internal/singbox/testdata/golden/vless-tcp-reality-fallbacks/input.json
Vendored
+105
View File
@@ -0,0 +1,105 @@
{
"case": "vless-tcp-reality-fallbacks",
"title": "VLESS / TCP / Reality + fallbacks（子入站回落）",
"source": [
"internal/database/model/model.go InboundFallback",
"internal/web/service/xray.go BuildFallbacksJSON 注入"
],
"disposition": "partial-pending-q1",
"risk": "N1",
"notes": "fallbacks 在本 fork 的真源是 inbound_fallbacks 表（master_id/child_id/dest/xver），生成时注入 settings.fallbacks。本样本以 settings 注入形表示一条 dest=8080 的网页回落。主入站本体可直映；回落关系无 sing-box 对应，登记在 expected 的 _b0.unmapped。",
"inbound": {
"id": 106,
"listen": "203.0.113.10",
"port": 20443,
"protocol": "vless",
"remark": "fx-vless-fallback",
"tag": "inbound-20443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": [
{
"name": "",
"alpn": "",
"path": "",
"dest": 8080,
"xver": 0
}
]
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"realitySettings": {
"show": false,
"xver": 0,
"target": "www.microsoft.com:443",
"serverNames": [
"www.microsoft.com"
],
"privateKey": "ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0A=",
"minClientVer": "",
"maxClientVer": "",
"maxTimediff": 0,
"shortIds": [
"77aa10f0"
],
"mldsa65Seed": "",
"settings": {
"publicKey": "WGmv9FBUlzLLqu1eXfmzCm2jHLDldCutWtShp2jxpns=",
"fingerprint": "chrome",
"serverName": "",
"spiderX": "/",
"mldsa65Verify": ""
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
}
internal/singbox/testdata/golden/vless-tcp-reality/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:443?encryption=none&flow=xtls-rprx-vision&fp=chrome&pbk=B6N8vBQgk8i3VdwbEOhstCY3StFqqFPtC9%2FAsrhtHHw%3D&security=reality&sid=ab12cd34&sni=www.amd.com&spx=%2Fd0cf3c252cd6df6&type=tcp#fx-vless-reality-user%40example.com
internal/singbox/testdata/golden/vless-tcp-reality/expected-singbox.json
Vendored
+37
View File
@@ -0,0 +1,37 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-443",
"listen": "203.0.113.10",
"listen_port": 443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"tls": {
"enabled": true,
"server_name": "www.amd.com",
"reality": {
"enabled": true,
"handshake": {
"server": "www.amd.com",
"server_port": 443
},
"private_key": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=",
"short_id": [
"ab12cd34"
]
}
},
"sniff": true
}
],
"_b0": {
"disposition": "direct",
"notes": "sniff destOverride[http,tls,quic] 由 route 层 sniff 动作近似承载（见规范 §5），入站侧只落 sniff:true。reality.maxTimediff=0 省略（sing-box max_time_difference 默认）。nested settings{publicKey,fingerprint,spiderX} 为客户端侧参数、不进服务端 tls，归订阅元数据。"
}
}
internal/singbox/testdata/golden/vless-tcp-reality/input.json
Vendored
+97
View File
@@ -0,0 +1,97 @@
{
"case": "vless-tcp-reality",
"title": "VLESS / TCP / Reality / Vision flow",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"internal/sub/characterization_test.go (C4 shape)"
],
"disposition": "direct",
"risk": null,
"notes": "现网主力形状（备份库 12 条 vless 全部 tcp+reality）。flow 归一规则：xtls-rprx-vision-udp443 在生成侧归一为 xtls-rprx-vision，sing-box 同名保留。",
"inbound": {
"id": 101,
"listen": "203.0.113.10",
"port": 443,
"protocol": "vless",
"remark": "fx-vless-reality",
"tag": "inbound-443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"realitySettings": {
"show": false,
"xver": 0,
"target": "www.amd.com:443",
"serverNames": [
"www.amd.com"
],
"privateKey": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=",
"minClientVer": "",
"maxClientVer": "",
"maxTimediff": 0,
"shortIds": [
"ab12cd34"
],
"mldsa65Seed": "",
"settings": {
"publicKey": "B6N8vBQgk8i3VdwbEOhstCY3StFqqFPtC9/AsrhtHHw=",
"fingerprint": "chrome",
"serverName": "",
"spiderX": "/",
"mldsa65Verify": ""
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": "xtls-rprx-vision"
}
}
internal/singbox/testdata/golden/vless-vlessenc/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:22443?encryption=none&security=none&type=tcp#fx-vless-vlessenc-user%40example.com
internal/singbox/testdata/golden/vless-vlessenc/expected-singbox.json
Vendored
+30
View File
@@ -0,0 +1,30 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-22443",
"listen": "203.0.113.10",
"listen_port": 22443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555"
}
],
"sniff": true
}
],
"_b0": {
"disposition": "partial-pending-q1",
"risk": "N3",
"unmapped": [
{
"concept": "settings.decryption（vlessenc / ML-KEM 加密串）",
"input": "mlkem768x25519plus.native.0rtt.*（假串）",
"reason": "sing-box vless 无对应加密层（decryption 恒 none 语义）；带 vlessenc 的入站迁过去即明文 vless，行为与安全性变化，待 Q1。",
"pending": "Q1"
}
],
"notes": "users 本体已映；阻塞点仅 decryption。client 侧 reverse 字段同属 N4，见规范 §3.1。"
}
}
internal/singbox/testdata/golden/vless-vlessenc/input.json
Vendored
+73
View File
@@ -0,0 +1,73 @@
{
"case": "vless-vlessenc",
"title": "VLESS / TCP / vlessenc（decryption=ML-KEM 串）",
"source": [
"frontend/src/lib/xray/vless-encryption.ts"
],
"disposition": "partial-pending-q1",
"risk": "N3",
"notes": "decryption 为 vlessenc 串（此处假串）时 sing-box 无对应加密层。users 本体可映；decryption 登记 _b0.unmapped，等 Q1。",
"inbound": {
"id": 108,
"listen": "203.0.113.10",
"port": 22443,
"protocol": "vless",
"remark": "fx-vless-vlessenc",
"tag": "inbound-22443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
],
"decryption": "mlkem768x25519plus.native.0rtt.FAKEFAKEFAKEFAKE",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
}
internal/singbox/testdata/golden/vless-ws-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:8443?alpn=h2%2Chttp%2F1.1&encryption=none&fp=chrome&host=cdn.example.com&path=%2Ffxws&security=tls&sni=cdn.example.com&type=ws#fx-vless-ws-user%40example.com
internal/singbox/testdata/golden/vless-ws-tls/expected-singbox.json
Vendored
+38
View File
@@ -0,0 +1,38 @@
{
"inbounds": [
{
"type": "vless",
"tag": "inbound-8443",
"listen": "203.0.113.10",
"listen_port": 8443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555"
}
],
"transport": {
"type": "ws",
"path": "/fxws",
"headers": {
"Host": "cdn.example.com"
}
},
"tls": {
"enabled": true,
"server_name": "cdn.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct",
"notes": "tlsSettings.settings.fingerprint 为客户端侧参数，不进服务端 tls。"
}
}
internal/singbox/testdata/golden/vless-ws-tls/input.json
Vendored
+91
View File
@@ -0,0 +1,91 @@
{
"case": "vless-ws-tls",
"title": "VLESS / WS / TLS",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts",
"frontend/src/schemas/protocols/stream/ws.ts"
],
"disposition": "direct",
"risk": null,
"notes": "ws headers.Host 是订阅与服务端共同参数，逐项对齐不变量 §2.4-3。",
"inbound": {
"id": 102,
"listen": "203.0.113.10",
"port": 8443,
"protocol": "vless",
"remark": "fx-vless-ws",
"tag": "inbound-8443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "ws",
"security": "tls",
"wsSettings": {
"acceptProxyProtocol": false,
"path": "/fxws",
"headers": {
"Host": "cdn.example.com"
}
},
"tlsSettings": {
"serverName": "cdn.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
}
internal/singbox/testdata/golden/vless-xhttp-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vless://11111111-2222-4333-8444-555555555555@203.0.113.10:12443?alpn=h2%2Chttp%2F1.1&encryption=none&extra=%7B%22mode%22%3A%22auto%22%2C%22xmux%22%3A%7B%22cMaxReuseTimes%22%3A0%2C%22hKeepAlivePeriod%22%3A0%2C%22hMaxRequestTimes%22%3A%22600-900%22%2C%22hMaxReusableSecs%22%3A%221800-3000%22%2C%22maxConcurrency%22%3A%2216-32%22%2C%22maxConnections%22%3A0%7D%7D&fp=chrome&host=xh.example.com&mode=auto&path=%2Ffxxh&security=tls&sni=xh.example.com&type=xhttp#fx-vless-xhttp-user%40example.com
internal/singbox/testdata/golden/vless-xhttp-tls/expected-singbox.json
Vendored
+23
View File
@@ -0,0 +1,23 @@
{
"inbounds": [],
"_b0": {
"disposition": "blocked-pending-q1",
"risk": "N8",
"unmapped": [
{
"concept": "streamSettings.network=xhttp + xhttpSettings",
"input": {
"path": "/fxxh",
"host": "xh.example.com",
"mode": "auto",
"xmux": {
"maxConcurrency": "16-32"
}
},
"reason": "sing-box v1.13.21 无 XHTTP 传输，无任何等价承载；强行落 ws/httpupgrade 会改变订阅链接（违背无感知不变量）。处置（近似映射/专用承载）待 Q1 拍板后补基线。",
"pending": "Q1"
}
],
"mappableRemainder": "users、tls、sniff 与 vless-ws-tls 同构；阻塞点仅在 transport。"
}
}
internal/singbox/testdata/golden/vless-xhttp-tls/input.json
Vendored
+96
View File
@@ -0,0 +1,96 @@
{
"case": "vless-xhttp-tls",
"title": "VLESS / XHTTP / TLS（无对应）",
"source": [
"frontend/src/schemas/protocols/stream/xhttp.ts"
],
"disposition": "blocked-pending-q1",
"risk": "N8",
"notes": "sing-box 无 XHTTP。expected-singbox.json 不给伪造输出，只登记未映射事实，等 Q1 拍板近似承载（ws/httpupgrade）后再定基线。",
"inbound": {
"id": 105,
"listen": "203.0.113.10",
"port": 12443,
"protocol": "vless",
"remark": "fx-vless-xhttp",
"tag": "inbound-12443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
],
"decryption": "none",
"encryption": "none",
"fallbacks": []
},
"streamSettings": {
"network": "xhttp",
"security": "tls",
"xhttpSettings": {
"path": "/fxxh",
"host": "xh.example.com",
"mode": "auto",
"xmux": {
"maxConcurrency": "16-32",
"maxConnections": 0,
"cMaxReuseTimes": 0,
"hMaxRequestTimes": "600-900",
"hMaxReusableSecs": "1800-3000",
"hKeepAlivePeriod": 0
}
},
"tlsSettings": {
"serverName": "xh.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"flow": ""
}
}
internal/singbox/testdata/golden/vmess-kcp/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vmess://ewogICJhZGQiOiAiMjAzLjAuMTEzLjEwIiwKICAiaWQiOiAiMTExMTExMTEtMjIyMi00MzMzLTg0NDQtNTU1NTU1NTU1NTU1IiwKICAibXR1IjogMTM1MCwKICAibmV0IjogImtjcCIsCiAgInBhdGgiOiAiZngta2NwLXNlZWQiLAogICJwb3J0IjogMjU0NDMsCiAgInBzIjogImZ4LXZtZXNzLWtjcC11c2VyQGV4YW1wbGUuY29tIiwKICAic2N5IjogImF1dG8iLAogICJ0bHMiOiAibm9uZSIsCiAgInR0aSI6IDIwLAogICJ0eXBlIjogInNydHAiLAogICJ2IjogIjIiCn0=
internal/singbox/testdata/golden/vmess-kcp/expected-singbox.json
Vendored
+25
View File
@@ -0,0 +1,25 @@
{
"inbounds": [],
"_b0": {
"disposition": "blocked-pending-q1",
"risk": "N8",
"unmapped": [
{
"concept": "streamSettings.network=kcp + kcpSettings",
"input": {
"mtu": 1350,
"tti": 20,
"uplinkCapacity": 5,
"downlinkCapacity": 20,
"header": {
"type": "srtp"
},
"seed": "*"
},
"reason": "sing-box 无 mKCP 传输，无等价承载；处置同 xhttp，待 Q1。",
"pending": "Q1"
}
],
"mappableRemainder": "users/sniff 与 vmess-ws-tls 同构；阻塞点仅在 transport。"
}
}
internal/singbox/testdata/golden/vmess-kcp/input.json
Vendored
+76
View File
@@ -0,0 +1,76 @@
{
"case": "vmess-kcp",
"title": "VMess / mKCP（无对应）",
"source": [
"frontend/src/schemas/protocols/stream/kcp.ts"
],
"disposition": "blocked-pending-q1",
"risk": "N8",
"notes": "sing-box 无 mKCP，同 xhttp 口径：只登记事实，等 Q1。",
"inbound": {
"id": 111,
"listen": "203.0.113.10",
"port": 25443,
"protocol": "vmess",
"remark": "fx-vmess-kcp",
"tag": "inbound-25443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "auto"
}
]
},
"streamSettings": {
"network": "kcp",
"security": "none",
"kcpSettings": {
"mtu": 1350,
"tti": 20,
"uplinkCapacity": 5,
"downlinkCapacity": 20,
"cwndMultiplier": 1,
"maxSendingWindow": 2097152,
"header": {
"type": "srtp"
},
"seed": "fx-kcp-seed"
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "auto"
}
}
internal/singbox/testdata/golden/vmess-tcp-httpheader/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vmess://ewogICJhZGQiOiAiMjAzLjAuMTEzLjEwIiwKICAiaG9zdCI6ICJ3d3cuZXhhbXBsZS5jb20iLAogICJpZCI6ICIxMTExMTExMS0yMjIyLTQzMzMtODQ0NC01NTU1NTU1NTU1NTUiLAogICJuZXQiOiAidGNwIiwKICAicGF0aCI6ICIvIiwKICAicG9ydCI6IDI0NDQzLAogICJwcyI6ICJmeC12bWVzcy1odHRwY2Ftby11c2VyQGV4YW1wbGUuY29tIiwKICAic2N5IjogImFlcy0xMjgtZ2NtIiwKICAidGxzIjogIm5vbmUiLAogICJ0eXBlIjogImh0dHAiLAogICJ2IjogIjIiCn0=
internal/singbox/testdata/golden/vmess-tcp-httpheader/expected-singbox.json
Vendored
+33
View File
@@ -0,0 +1,33 @@
{
"inbounds": [
{
"type": "vmess",
"tag": "inbound-24443",
"listen": "203.0.113.10",
"listen_port": 24443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555",
"security": "aes-128-gcm",
"alter_id": 0
}
],
"transport": {
"type": "http",
"host": [
"www.example.com"
],
"path": [
"/"
],
"method": "GET"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct",
"notes": "tcp header type=http → transport{type:http}；request.headers.Host 提升为 host 数组，其余 headers 进 transport.headers（本样本无其余项）。"
}
}
internal/singbox/testdata/golden/vmess-tcp-httpheader/input.json
Vendored
+82
View File
@@ -0,0 +1,82 @@
{
"case": "vmess-tcp-httpheader",
"title": "VMess / TCP / HTTP 头伪装",
"source": [
"frontend/src/schemas/protocols/stream/tcp.ts"
],
"disposition": "direct",
"risk": null,
"notes": "tcp header type=http → sing-box transport{type:http}（仅请求侧伪装字段改名）。",
"inbound": {
"id": 110,
"listen": "203.0.113.10",
"port": 24443,
"protocol": "vmess",
"remark": "fx-vmess-httpcamo",
"tag": "inbound-24443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "aes-128-gcm"
}
]
},
"streamSettings": {
"network": "tcp",
"security": "none",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "http",
"request": {
"version": "1.1",
"method": "GET",
"path": [
"/"
],
"headers": {
"Host": [
"www.example.com"
]
}
}
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "aes-128-gcm"
}
}
internal/singbox/testdata/golden/vmess-ws-tls/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
vmess://ewogICJhZGQiOiAiMjAzLjAuMTEzLjEwIiwKICAiYWxwbiI6ICJoMixodHRwLzEuMSIsCiAgImZwIjogImNocm9tZSIsCiAgImhvc3QiOiAidm0uZXhhbXBsZS5jb20iLAogICJpZCI6ICIxMTExMTExMS0yMjIyLTQzMzMtODQ0NC01NTU1NTU1NTU1NTUiLAogICJuZXQiOiAid3MiLAogICJwYXRoIjogIi9meHZtIiwKICAicG9ydCI6IDIzNDQzLAogICJwcyI6ICJmeC12bWVzcy13cy11c2VyQGV4YW1wbGUuY29tIiwKICAic2N5IjogImF1dG8iLAogICJzbmkiOiAidm0uZXhhbXBsZS5jb20iLAogICJ0bHMiOiAidGxzIiwKICAidHlwZSI6ICJub25lIiwKICAidiI6ICIyIgp9
internal/singbox/testdata/golden/vmess-ws-tls/expected-singbox.json
Vendored
+40
View File
@@ -0,0 +1,40 @@
{
"inbounds": [
{
"type": "vmess",
"tag": "inbound-23443",
"listen": "203.0.113.10",
"listen_port": 23443,
"users": [
{
"name": "user@example.com",
"uuid": "11111111-2222-4333-8444-555555555555",
"security": "auto",
"alter_id": 0
}
],
"transport": {
"type": "ws",
"path": "/fxvm",
"headers": {
"Host": "vm.example.com"
}
},
"tls": {
"enabled": true,
"server_name": "vm.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificate_path": "/etc/x-ui/cert/fx.pem",
"key_path": "/etc/x-ui/cert/fx.key"
},
"sniff": true
}
],
"_b0": {
"disposition": "direct",
"notes": "alterId 在 wire 上为 alterId、sing-box 为 alter_id；security 逐字保留（不变量 §2.4-5）。"
}
}
internal/singbox/testdata/golden/vmess-ws-tls/input.json
Vendored
+87
View File
@@ -0,0 +1,87 @@
{
"case": "vmess-ws-tls",
"title": "VMess / WS / TLS",
"source": [
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": null,
"notes": "",
"inbound": {
"id": 109,
"listen": "203.0.113.10",
"port": 23443,
"protocol": "vmess",
"remark": "fx-vmess-ws",
"tag": "inbound-23443",
"enable": true,
"settings": {
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "auto"
}
]
},
"streamSettings": {
"network": "ws",
"security": "tls",
"wsSettings": {
"acceptProxyProtocol": false,
"path": "/fxvm",
"headers": {
"Host": "vm.example.com"
}
},
"tlsSettings": {
"serverName": "vm.example.com",
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/x-ui/cert/fx.pem",
"keyFile": "/etc/x-ui/cert/fx.key"
}
],
"settings": {
"fingerprint": "chrome"
}
}
},
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"metadataOnly": false,
"routeOnly": false
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"id": "11111111-2222-4333-8444-555555555555",
"security": "auto"
}
}
internal/singbox/testdata/golden/wireguard/expected-link.txt
Vendored
+1
View File
@@ -0,0 +1 @@
wireguard://l5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tbY%3D@203.0.113.10:51820?address=10.0.0.2%2F32&keepalive=25&mtu=1420&publickey=VxR2nRFr92Q2rnS8eT0sMK0ZA8WaxSc4BcfiaYtBDDY%3D#fx-wireguard-user%40example.com
internal/singbox/testdata/golden/wireguard/expected-singbox.json
Vendored
+29
View File
@@ -0,0 +1,29 @@
{
"inbounds": [],
"endpoints": [
{
"type": "wireguard",
"tag": "inbound-51820",
"listen_port": 51820,
"address": [
"10.0.0.1/24"
],
"private_key": "ZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4Q=",
"mtu": 1420,
"peers": [
{
"public_key": "FThkYS9cXUf2hNZomaneT3wwtfdKjr1plkIhK84A2Tg=",
"allowed_ips": [
"10.0.0.2/32"
],
"persistent_keepalive_interval": 25
}
]
}
],
"_b0": {
"disposition": "direct",
"risk": "N7",
"notes": "挂载位置变化：inbounds[] → endpoints[]，且须 route 规则把流量引入（B2 基础配置处理）。服务端 address 按现后端推导口径取 subnet 首地址（10.0.0.0/24 → 10.0.0.1/24），B1 与现生成链（WireguardPeerFromClient/服务端地址推导）逐项对。noKernelTun=false → 系统 tun 模式；内核/系统模式真机差异待 B3（N7）。peers 的 preshared_key 本样本为空省略。"
}
}
internal/singbox/testdata/golden/wireguard/input.json
Vendored
+65
View File
@@ -0,0 +1,65 @@
{
"case": "wireguard",
"title": "WireGuard（endpoint 化）",
"source": [
"internal/sub/service_wireguard_test.go",
"frontend/src/lib/xray/inbound-defaults.ts"
],
"disposition": "direct",
"risk": "N7",
"notes": "新模型不是 inbound 而是 endpoints[] + route 引用。客户端 .conf 与 wireguard:// 链均属不变量 §2.4-5。noKernelTun/系统模式差异待 B3 真机验（N7）。",
"inbound": {
"id": 122,
"listen": "203.0.113.10",
"port": 51820,
"protocol": "wireguard",
"remark": "fx-wireguard",
"tag": "inbound-51820",
"enable": true,
"settings": {
"mtu": 1420,
"secretKey": "ZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4Q=",
"peers": [],
"clients": [
{
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"privateKey": "l5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tbY=",
"publicKey": "FThkYS9cXUf2hNZomaneT3wwtfdKjr1plkIhK84A2Tg=",
"allowedIPs": [
"10.0.0.2/32"
],
"keepAlive": 25
}
],
"noKernelTun": false,
"subnetIp": "10.0.0.0",
"subnetCidr": 24
}
},
"clientEmail": "user@example.com",
"client": {
"email": "user@example.com",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "fxsubid000000001",
"comment": "",
"reset": 0,
"privateKey": "l5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tbY=",
"publicKey": "FThkYS9cXUf2hNZomaneT3wwtfdKjr1plkIhK84A2Tg=",
"allowedIPs": [
"10.0.0.2/32"
],
"keepAlive": 25
}
}