107 lines
7.1 KiB
JavaScript
107 lines
7.1 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const {
|
|
newCredentialSet, buildExitResource, buildRelayResource, buildDirectResource, buildClientUri,
|
|
validateEntryProtocol, validateProtocolPair
|
|
} = require('../lib/protocols');
|
|
|
|
const customer = { id: 'cus_test', name: '测试客户' };
|
|
const relay = { id: 'srv_relay', publicAddress: 'relay.example.com' };
|
|
const exit = { id: 'srv_exit', publicAddress: 'exit.example.com' };
|
|
|
|
test('builds a VLESS Reality to Shadowsocks 2022 chain', () => {
|
|
const credentials = newCredentialSet('vless-reality-vision', 'shadowsocks-2022-aes128');
|
|
const reality = { keyId: 'test-key', serverName: 'www.microsoft.com', destPort: 443 };
|
|
const exitResource = buildExitResource({ resourceId: 'res_exit_123', tagPrefix: 'exit-test', port: 32001, protocol: 'shadowsocks-2022-aes128', credentials, customer });
|
|
const relayResource = buildRelayResource({ resourceId: 'res_relay_123', tagPrefix: 'relay-test', port: 21001, protocol: 'vless-reality-vision', exitProtocol: 'shadowsocks-2022-aes128', exitServer: exit, exitPort: 32001, credentials, customer, reality });
|
|
assert.equal(exitResource.inbounds[0].protocol, 'shadowsocks');
|
|
assert.equal(relayResource.inbounds[0].protocol, 'vless');
|
|
assert.equal(relayResource.outbounds[0].settings.servers[0].address, 'exit.example.com');
|
|
assert.equal(relayResource.inbounds[0].streamSettings.realitySettings.privateKey, '${REALITY_PRIVATE:test-key}');
|
|
const uri = buildClientUri({ protocol: 'vless-reality-vision', relayServer: relay, relayPort: 21001, credentials, reality, publicKey: 'public-key', name: '测试' });
|
|
assert.match(uri, /^vless:\/\//);
|
|
assert.match(uri, /pbk=public-key/);
|
|
});
|
|
|
|
test('rejects unsupported protocol pairs', () => {
|
|
assert.throws(() => validateProtocolPair('nonexistent', 'shadowsocks-2022-aes128'), /Unsupported relay ingress/);
|
|
assert.doesNotThrow(() => validateProtocolPair('anytls', 'vless-tcp'));
|
|
});
|
|
|
|
test('AnyTLS runs in sing-box with a separate TLS entry and VLESS or Shadowsocks exit', () => {
|
|
const { makeClash, makeSingBox, makeSurge } = require('../lib/subscriptions');
|
|
const credentials = newCredentialSet('anytls', 'vless-tcp');
|
|
assert.throws(() => buildDirectResource({ resourceId:'res_any_no_cert', tagPrefix:'any', port:23001,
|
|
protocol:'anytls', credentials, customer }), /证书域名/);
|
|
const relayResource = buildRelayResource({ resourceId:'res_any_relay', tagPrefix:'any', port:23001,
|
|
protocol:'anytls', exitProtocol:'vless-tcp', exitServer:exit, exitPort:32001,
|
|
credentials, customer, tlsDomain:'entry.example.com' });
|
|
assert.equal(relayResource.engine, 'sing-box');
|
|
assert.equal(relayResource.inbounds[0].type, 'anytls');
|
|
assert.equal(relayResource.inbounds[0].tls.certificate_path, '/etc/nexusgate/tls/entry.example.com/fullchain.pem');
|
|
assert.equal(relayResource.outbounds[0].type, 'vless');
|
|
assert.equal(relayResource.outbounds[0].uuid, credentials.clientId);
|
|
const direct = buildDirectResource({ resourceId:'res_any_direct', tagPrefix:'direct-any', port:23002,
|
|
protocol:'anytls', credentials, customer, tlsDomain:'entry.example.com' });
|
|
assert.equal(direct.outbounds[0].type, 'direct');
|
|
assert.equal(direct.routingRules[0].outbound, 'direct-any-direct');
|
|
const uri = buildClientUri({ protocol:'anytls', relayServer:relay, relayPort:23001,
|
|
credentials, tlsDomain:'entry.example.com', name:'AnyTLS 测试' });
|
|
assert.match(uri, /^anytls:\/\//);
|
|
assert.match(makeClash([{ clientUri:uri }]), /type: "anytls"/);
|
|
assert.match(makeSingBox([{ clientUri:uri }]), /"type": "anytls"/);
|
|
assert.equal(makeSurge([{ clientUri:uri }]), null);
|
|
});
|
|
|
|
test('Hysteria 2 reuses Xray route and emits importable Clash and sing-box credentials', () => {
|
|
const { makeClash, makeSingBox } = require('../lib/subscriptions');
|
|
const credentials = newCredentialSet('hysteria2', 'shadowsocks-2022-aes128');
|
|
const node = buildRelayResource({ resourceId:'res_hy2_123', tagPrefix:'hy2-test', port:23000,
|
|
protocol:'hysteria2', exitProtocol:'shadowsocks-2022-aes128', exitServer:exit, exitPort:32001,
|
|
credentials, customer, tlsDomain:'node.example.com' });
|
|
assert.equal(node.inbounds[0].protocol, 'hysteria');
|
|
assert.equal(node.inbounds[0].streamSettings.method, 'hysteria');
|
|
assert.equal(node.inbounds[0].streamSettings.network, 'hysteria');
|
|
assert.equal(node.inbounds[0].settings.clients[0].auth, credentials.relayPassword);
|
|
assert.equal(node.inbounds[0].settings.users[0].auth, credentials.relayPassword);
|
|
assert.equal(node.inbounds[0].streamSettings.tlsSettings.certificates[0].keyFile, '/etc/nexusgate/tls/node.example.com/privkey.pem');
|
|
const uri = buildClientUri({ protocol:'hysteria2', relayServer:relay, relayPort:23000,
|
|
credentials, tlsDomain:'node.example.com', name:'H2 test' });
|
|
assert.match(uri, /^hysteria2:\/\//);
|
|
assert.match(makeClash([{ clientUri:uri }]), /type: "hysteria2"/);
|
|
assert.match(makeSingBox([{ clientUri:uri }]), /"type": "hysteria2"/);
|
|
});
|
|
|
|
test('builds direct Shadowsocks, SOCKS5 and IPv6 client resources', () => {
|
|
const ssCredentials = newCredentialSet('shadowsocks-2022-aes256', null);
|
|
const direct = buildDirectResource({ resourceId: 'res_direct_123', tagPrefix: 'direct-test', port: 24001, protocol: 'shadowsocks-2022-aes256', credentials: ssCredentials, customer, networkMode: 'ipv6' });
|
|
assert.equal(direct.meta.kind, 'direct');
|
|
assert.equal(direct.inbounds[0].listen, '::');
|
|
assert.equal(direct.inbounds[0].settings.method, '2022-blake3-aes-256-gcm');
|
|
const ipv6Relay = { ...relay, publicAddressV6: '2001:db8::10' };
|
|
const uri = buildClientUri({ protocol: 'shadowsocks-2022-aes256', relayServer: ipv6Relay, relayPort: 24001, credentials: ssCredentials, name: 'IPv6 节点', networkMode: 'ipv6' });
|
|
assert.match(uri, /@\[2001:db8::10\]:24001/);
|
|
const socksCredentials = newCredentialSet('socks5-auth', null);
|
|
const socks = buildDirectResource({ resourceId: 'res_direct_456', tagPrefix: 'socks-test', port: 24002, protocol: 'socks5-auth', credentials: socksCredentials, customer, networkMode: 'ipv4' });
|
|
assert.equal(socks.inbounds[0].protocol, 'socks');
|
|
assert.doesNotThrow(() => validateEntryProtocol('socks5-auth'));
|
|
});
|
|
|
|
test('VLESS WebSocket TLS requires a node certificate domain and exports TLS clients', () => {
|
|
const credentials = newCredentialSet('vless-ws-tls', null);
|
|
assert.doesNotThrow(() => validateEntryProtocol('vless-ws-tls'));
|
|
assert.throws(() => buildDirectResource({ resourceId:'res_tls_missing', tagPrefix:'tls', port:24444,
|
|
protocol:'vless-ws-tls', credentials, customer }), /证书域名/);
|
|
const resource = buildDirectResource({ resourceId:'res_tls_123', tagPrefix:'tls', port:24444,
|
|
protocol:'vless-ws-tls', credentials, customer, tlsDomain:'node.example.com' });
|
|
const stream = resource.inbounds[0].streamSettings;
|
|
assert.equal(stream.security, 'tls');
|
|
assert.equal(stream.tlsSettings.certificates[0].certificateFile, '/etc/nexusgate/tls/node.example.com/fullchain.pem');
|
|
const uri = buildClientUri({ protocol:'vless-ws-tls', relayServer:relay, relayPort:24444,
|
|
credentials, tlsDomain:'node.example.com', name:'TLS 节点' });
|
|
assert.match(uri, /security=tls/);
|
|
assert.match(uri, /sni=node.example.com/);
|
|
});
|