335 lines
18 KiB
JavaScript
335 lines
18 KiB
JavaScript
'use strict';
|
||
|
||
const crypto = require('node:crypto');
|
||
const net = require('node:net');
|
||
const dns = require('node:dns/promises');
|
||
|
||
const REALITY_PRESETS = Object.freeze([
|
||
{ id: 'tesla', label: 'Tesla', serverName: 'www.tesla.com', destPort: 443 },
|
||
{ id: 'amazon', label: 'Amazon', serverName: 'www.amazon.com', destPort: 443 },
|
||
{ id: 'apple', label: 'Apple', serverName: 'www.apple.com', destPort: 443 },
|
||
{ id: 'intel', label: 'Intel', serverName: 'www.intel.com', destPort: 443 },
|
||
{ id: 'amd', label: 'AMD', serverName: 'www.amd.com', destPort: 443 }
|
||
]);
|
||
|
||
const PROFILE_CATALOG = Object.freeze([
|
||
{ id: 'vless-reality-vision', role: 'relay-ingress', name: 'VLESS · Reality · Vision', status: 'stable', deployable: true, capabilities: ['sing-box', 'reality'], description: '推荐公网入口，无需在节点机部署证书。' },
|
||
{ id: 'vless-reality', role: 'relay-ingress', name: 'VLESS · Reality', status: 'stable', deployable: true, capabilities: ['sing-box', 'reality'], description: '不启用 Vision 流控的 Reality 入口。' },
|
||
{ id: 'vless-ws', role: 'relay-ingress', name: 'VLESS · WebSocket', status: 'beta', deployable: true, capabilities: ['sing-box', 'websocket'], description: '无 TLS 的兼容模式，建议仅在可信或外层 TLS 环境使用。' },
|
||
{ id: 'shadowsocks-2022-aes128', role: 'relay-ingress', name: 'SS 2022 · AES-128', status: 'stable', deployable: true, capabilities: ['sing-box', ], description: '轻量、推荐的 AEAD 2022 入口。' },
|
||
{ id: 'shadowsocks-2022-aes256', role: 'relay-ingress', name: 'SS 2022 · AES-256', status: 'stable', deployable: true, capabilities: ['sing-box', ], description: '32 字节密钥的 AEAD 2022 入口。' },
|
||
{ id: 'shadowsocks-aes128-gcm', role: 'relay-ingress', name: 'SS · AES-128-GCM', status: 'stable', deployable: true, capabilities: ['sing-box', ], description: '兼容主流旧版 Shadowsocks 客户端。' },
|
||
{ id: 'shadowsocks-aes256-gcm', role: 'relay-ingress', name: 'SS · AES-256-GCM', status: 'stable', deployable: true, capabilities: ['sing-box', ], description: '兼容主流旧版 Shadowsocks 客户端。' },
|
||
{ id: 'socks5-auth', role: 'relay-ingress', name: 'SOCKS5 · 用户密码', status: 'stable', deployable: true, capabilities: ['sing-box', ], description: '适合受控网络或程序级代理。' },
|
||
{ id: 'vless-ws-tls', role: 'relay-ingress', name: 'VLESS · WS · TLS', status: 'beta', deployable: true, capabilities: ['sing-box', 'tls-domain'], description: '需为每台入口设备填写 TLS 域名，并在 Agent 上安装对应证书。' },
|
||
{ id: 'hysteria2', role: 'relay-ingress', name: 'Hysteria 2 · UDP', status: 'beta', deployable: true, capabilities: ['sing-box', 'udp', 'tls-domain'], description: '由 sing-box 承载；入口须安装有效节点证书并放行所选 UDP 端口。' },
|
||
{ id: 'anytls', role: 'relay-ingress', name: 'AnyTLS · TLS', status: 'beta', deployable: true, capabilities: ['sing-box', 'tls-domain'], description: '由 sing-box 独立承载，需入口设备的有效节点证书；支持直连或转发到现有出口。' },
|
||
{ id: 'shadowsocks-2022-aes128', role: 'exit-transport', name: 'SS 2022 · AES-128', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '推荐的转发到出口传输。' },
|
||
{ id: 'shadowsocks-2022-aes256', role: 'exit-transport', name: 'SS 2022 · AES-256', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '增强密钥长度的转发传输。' },
|
||
{ id: 'shadowsocks-aes128-gcm', role: 'exit-transport', name: 'SS · AES-128-GCM', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '兼容旧环境的转发传输。' },
|
||
{ id: 'shadowsocks-aes256-gcm', role: 'exit-transport', name: 'SS · AES-256-GCM', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '兼容旧环境的转发传输。' },
|
||
{ id: 'vless-tcp', role: 'exit-transport', name: 'VLESS · TCP', status: 'beta', deployable: true, capabilities: [], description: '适合可信内网或已有加密隧道，不建议裸露公网。' },
|
||
{ id: 'socks5-auth', role: 'exit-transport', name: 'SOCKS5 · 用户密码', status: 'beta', deployable: true, capabilities: [], description: '不加密，仅用于可信网络或外层隧道。' }
|
||
]);
|
||
|
||
const SHADOWSOCKS_METHODS = Object.freeze({
|
||
'shadowsocks-2022-aes128': { method: '2022-blake3-aes-128-gcm', keyBytes: 16 },
|
||
'shadowsocks-2022-aes256': { method: '2022-blake3-aes-256-gcm', keyBytes: 32 },
|
||
'shadowsocks-aes128-gcm': { method: 'aes-128-gcm', keyBytes: 24 },
|
||
'shadowsocks-aes256-gcm': { method: 'aes-256-gcm', keyBytes: 32 }
|
||
});
|
||
|
||
function b64(bytes) { return crypto.randomBytes(bytes).toString('base64'); }
|
||
function shortId() { return crypto.randomBytes(8).toString('hex'); }
|
||
|
||
function listenAddress(networkMode, server, bindAddress) {
|
||
// bindAddress 是控制面按所选网络栈解析好的字面 IP（登记的域名已在下发前解析），优先使用。
|
||
if (bindAddress) return bindAddress;
|
||
// 只绑定所选网络栈对应的具体 IP，避免通配符地址跨栈泄漏。
|
||
// ipv6 绑定 `::` 时 Linux 默认是双栈 socket（bindv6only=0），IPv4 也能连进来。
|
||
if (networkMode === 'ipv6') return (server && server.publicAddressV6) || '::';
|
||
// dual 单个 inbound 只能填一个 listen 地址，`::` 即双栈语义；缺地址时回退通配符。
|
||
if (networkMode === 'dual') return '::';
|
||
return (server && server.publicAddress) || '0.0.0.0';
|
||
}
|
||
|
||
// 把服务器登记的地址解析成字面 IP，供 inbound listen 绑定。
|
||
// v4/v6 各自登记了单栈域名时，按所选网络栈只取对应记录（A / AAAA），避免绑到错误的栈。
|
||
async function resolveBindAddress(networkMode, server) {
|
||
if (networkMode === 'dual') return null;
|
||
const raw = networkMode === 'ipv6' ? server?.publicAddressV6 : server?.publicAddress;
|
||
if (!raw) return null;
|
||
const text = String(raw).trim();
|
||
const family = networkMode === 'ipv6' ? 6 : 4;
|
||
if (net.isIP(text)) return text;
|
||
try {
|
||
const { address } = await dns.lookup(text, { family });
|
||
return address;
|
||
} catch (err) {
|
||
const error = new Error(`绑定地址 DNS 解析失败：${text} 没有 ${family === 6 ? 'AAAA' : 'A'} 记录（${err.code || err.message}），请检查该服务器登记的地址`);
|
||
error.statusCode = 400;
|
||
throw error;
|
||
}
|
||
}
|
||
|
||
// ---------- Shared nodes: one inbound, many clients (3x-ui style) ----------
|
||
|
||
// 统计与日志里的用户身份统一为 ng:<customerId>：
|
||
// VLESS/HY2/SS 用 email，SOCKS 用用户名，AnyTLS 用 sing-box 用户名。
|
||
function nodeEmail(customerId) { return `ng:${customerId}`; }
|
||
|
||
function newNodeClientCredentials(protocol) {
|
||
const cipher = SHADOWSOCKS_METHODS[protocol];
|
||
return {
|
||
clientId: crypto.randomUUID(),
|
||
relayPassword: b64(cipher ? cipher.keyBytes : 24),
|
||
shortId: shortId(),
|
||
};
|
||
}
|
||
|
||
// Fill in node-level secrets that are missing for the node's current
|
||
// protocol/topology. Called on node create and on node edit.
|
||
function ensureNodeSecrets(node) {
|
||
node.wsPath ||= `/${crypto.randomBytes(9).toString('hex')}`;
|
||
const cipher = SHADOWSOCKS_METHODS[node.protocol];
|
||
if (cipher && !node.ssServerKey) node.ssServerKey = b64(cipher.keyBytes);
|
||
if (isRealityProtocol(node.protocol)) {
|
||
node.reality ||= { keyId: `reality-${node.id}` };
|
||
node.reality.serverName = node.realityServerName || 'www.tesla.com';
|
||
node.reality.destPort = Number(node.realityDestPort || 443);
|
||
}
|
||
if ((node.topology || 'forward') !== 'direct' && !node.exitCredentials) {
|
||
const exitCipher = SHADOWSOCKS_METHODS[node.exitProtocol];
|
||
node.exitCredentials = {
|
||
clientId: crypto.randomUUID(),
|
||
password: b64(exitCipher ? exitCipher.keyBytes : 24),
|
||
socksUser: `ng_${crypto.randomBytes(5).toString('hex')}`,
|
||
};
|
||
}
|
||
return node;
|
||
}
|
||
|
||
// sing-box 全协议 inbound 构建器
|
||
function buildSingBoxInbound({ tag, node, nodeClients, server, bindAddress }) {
|
||
const protocol = node.protocol;
|
||
const port = node.port;
|
||
const networkMode = node.networkMode || 'ipv4';
|
||
const listen = listenAddress(networkMode, server, bindAddress);
|
||
const tlsDomain = server.tlsDomain;
|
||
|
||
// VLESS Reality (Vision / 普通)
|
||
if (protocol === 'vless-reality-vision' || protocol === 'vless-reality') {
|
||
if (!node.reality) throw new Error('Reality 节点缺少密钥配置');
|
||
const users = nodeClients.map((nc) => ({
|
||
name: nodeEmail(nc.customerId),
|
||
uuid: nc.credentials.clientId,
|
||
...(protocol === 'vless-reality-vision' ? { flow: 'xtls-rprx-vision' } : {}),
|
||
}));
|
||
return {
|
||
type: 'vless', tag, listen, listen_port: port, users,
|
||
tls: {
|
||
enabled: true, server_name: node.reality.serverName,
|
||
reality: {
|
||
enabled: true,
|
||
handshake: { server: node.reality.serverName, server_port: node.reality.destPort || 443 },
|
||
private_key: `\${REALITY_PRIVATE:${node.reality.keyId}}`,
|
||
short_id: nodeClients.map((nc) => nc.credentials.shortId),
|
||
},
|
||
},
|
||
};
|
||
}
|
||
|
||
// VLESS WS / WS+TLS
|
||
if (protocol === 'vless-ws' || protocol === 'vless-ws-tls') {
|
||
if (protocol === 'vless-ws-tls' && !tlsDomain) throw new Error('TLS 节点缺少有效证书域名');
|
||
const users = nodeClients.map((nc) => ({ name: nodeEmail(nc.customerId), uuid: nc.credentials.clientId }));
|
||
const inbound = {
|
||
type: 'vless', tag, listen, listen_port: port, users,
|
||
transport: { type: 'ws', path: node.wsPath || '/' },
|
||
};
|
||
if (protocol === 'vless-ws-tls') {
|
||
inbound.tls = {
|
||
enabled: true, server_name: tlsDomain,
|
||
certificate_path: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`,
|
||
key_path: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem`,
|
||
};
|
||
}
|
||
return inbound;
|
||
}
|
||
|
||
// Shadowsocks (2022 全系 + 旧版)
|
||
if (SHADOWSOCKS_METHODS[protocol]) {
|
||
return {
|
||
type: 'shadowsocks', tag, listen, listen_port: port,
|
||
method: SHADOWSOCKS_METHODS[protocol].method,
|
||
password: node.ssServerKey,
|
||
users: nodeClients.map((nc) => ({ name: nodeEmail(nc.customerId), password: nc.credentials.relayPassword })),
|
||
};
|
||
}
|
||
|
||
// SOCKS5
|
||
if (protocol === 'socks5-auth') {
|
||
return {
|
||
type: 'socks', tag, listen, listen_port: port,
|
||
users: nodeClients.map((nc) => ({ username: nodeEmail(nc.customerId), password: nc.credentials.relayPassword })),
|
||
};
|
||
}
|
||
|
||
// Hysteria2
|
||
if (protocol === 'hysteria2') {
|
||
if (!tlsDomain) throw new Error('Hysteria 2 入口缺少有效证书域名');
|
||
return {
|
||
type: 'hysteria2', tag, listen, listen_port: port,
|
||
users: nodeClients.map((nc) => ({ name: nodeEmail(nc.customerId), password: nc.credentials.relayPassword })),
|
||
tls: {
|
||
enabled: true, server_name: tlsDomain, alpn: ['h3'],
|
||
certificate_path: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`,
|
||
key_path: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem`,
|
||
},
|
||
};
|
||
}
|
||
|
||
// AnyTLS 走专用构建器
|
||
if (protocol === 'anytls') {
|
||
if (!tlsDomain) throw new Error('AnyTLS 入口缺少有效证书域名');
|
||
return {
|
||
type: 'anytls', tag, listen, listen_port: port,
|
||
users: nodeClients.map((nc) => ({ name: nodeEmail(nc.customerId), password: nc.credentials.relayPassword })),
|
||
tls: {
|
||
enabled: true, server_name: tlsDomain,
|
||
certificate_path: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`,
|
||
key_path: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem`,
|
||
},
|
||
};
|
||
}
|
||
|
||
throw new Error(`sing-box 不支持的协议: ${protocol}`);
|
||
}
|
||
|
||
function buildSingBoxNodeResource({ resourceId, tagPrefix, node, nodeClients, server, bindAddress, exitServer }) {
|
||
ensureNodeSecrets(node);
|
||
const tag = `${tagPrefix}-in`;
|
||
const forward = (node.topology || 'forward') === 'forward';
|
||
const outboundTag = `${tagPrefix}-${forward ? 'exit' : 'direct'}`;
|
||
const networkMode = node.networkMode || 'ipv4';
|
||
let outbound;
|
||
if (!forward) {
|
||
outbound = { type: 'direct', tag: outboundTag };
|
||
} else {
|
||
const base = { tag: outboundTag, server: serverAddress(exitServer, networkMode), server_port: node.exitPort };
|
||
const creds = node.exitCredentials;
|
||
const cipher = SHADOWSOCKS_METHODS[node.exitProtocol];
|
||
if (cipher) outbound = { type: 'shadowsocks', ...base, method: cipher.method, password: creds.password };
|
||
else if (node.exitProtocol === 'socks5-auth') outbound = { type: 'socks', ...base, version: '5', username: creds.socksUser, password: creds.password };
|
||
else if (node.exitProtocol === 'vless-tcp') outbound = { type: 'vless', ...base, uuid: creds.clientId };
|
||
else throw new Error(`Unsupported exit transport: ${node.exitProtocol}`);
|
||
}
|
||
return {
|
||
id: resourceId, engine: 'sing-box',
|
||
meta: { kind: 'node', nodeId: node.id, metricsTag: tag, protocol: node.protocol },
|
||
inbounds: [buildSingBoxInbound({ tag, node, nodeClients, server, bindAddress })],
|
||
outbounds: [outbound],
|
||
routingRules: [{ inbound: [tag], action: 'route', outbound: outboundTag }],
|
||
};
|
||
}
|
||
|
||
function buildNodeResource({ resourceId, tagPrefix, node, nodeClients, server, bindAddress, exitServer }) {
|
||
// 全部走 sing-box，不再生成 Xray 配置
|
||
return buildSingBoxNodeResource({ resourceId, tagPrefix, node, nodeClients, server, bindAddress, exitServer });
|
||
}
|
||
|
||
function buildNodeExitResource({ resourceId, tagPrefix, node, server, bindAddress }) {
|
||
const tag = `${tagPrefix}-exit-in`;
|
||
const directTag = `${tagPrefix}-exit-direct`;
|
||
const protocol = node.exitProtocol;
|
||
const creds = node.exitCredentials;
|
||
const networkMode = node.networkMode || 'ipv4';
|
||
const listen = listenAddress(networkMode, server, bindAddress);
|
||
const cipher = SHADOWSOCKS_METHODS[protocol];
|
||
let inbound;
|
||
if (cipher) {
|
||
inbound = { type: 'shadowsocks', tag, listen, listen_port: node.exitPort,
|
||
method: cipher.method, password: creds.password };
|
||
} else if (protocol === 'vless-tcp') {
|
||
inbound = { type: 'vless', tag, listen, listen_port: node.exitPort,
|
||
users: [{ uuid: creds.clientId }] };
|
||
} else if (protocol === 'socks5-auth') {
|
||
inbound = { type: 'socks', tag, listen, listen_port: node.exitPort,
|
||
users: [{ username: creds.socksUser, password: creds.password }] };
|
||
} else {
|
||
throw new Error(`Unsupported exit transport: ${protocol}`);
|
||
}
|
||
return {
|
||
id: resourceId, engine: 'sing-box',
|
||
meta: { kind: 'node-exit', nodeId: node.id, metricsTag: tag },
|
||
inbounds: [inbound],
|
||
outbounds: [{ type: 'direct', tag: directTag }],
|
||
routingRules: [{ inbound: [tag], action: 'route', outbound: directTag }],
|
||
};
|
||
}
|
||
|
||
function serverAddress(server, networkMode) {
|
||
if (!server) throw new Error('Missing server for address selection');
|
||
if (networkMode === 'ipv6') return server.publicAddressV6;
|
||
return server.publicAddress;
|
||
}
|
||
|
||
function uriHost(address) { return net.isIP(String(address)) === 6 ? `[${address}]` : address; }
|
||
|
||
function buildClientUri({ protocol, relayServer, relayPort, credentials, reality, publicKey, name, networkMode, tlsDomain, ssServerKey }) {
|
||
const label = encodeURIComponent(name);
|
||
const publicAddress = serverAddress(relayServer, networkMode);
|
||
const host = uriHost(publicAddress);
|
||
if (protocol === 'hysteria2') {
|
||
const query = new URLSearchParams({ sni: tlsDomain, alpn: 'h3' });
|
||
return `hysteria2://${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}?${query}#${label}`;
|
||
}
|
||
if (protocol === 'anytls') {
|
||
const query = new URLSearchParams({ sni: tlsDomain });
|
||
return `anytls://${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}?${query}#${label}`;
|
||
}
|
||
if (protocol === 'vless-reality-vision' || protocol === 'vless-reality') {
|
||
if (!publicKey) return null;
|
||
const query = new URLSearchParams({ encryption: 'none', security: 'reality', sni: reality.serverName, fp: 'chrome', pbk: publicKey, sid: credentials.shortId, type: 'tcp', headerType: 'none' });
|
||
if (protocol === 'vless-reality-vision') query.set('flow', 'xtls-rprx-vision');
|
||
return `vless://${credentials.clientId}@${host}:${relayPort}?${query}#${label}`;
|
||
}
|
||
if (protocol === 'vless-ws' || protocol === 'vless-ws-tls') {
|
||
const query = new URLSearchParams({ encryption: 'none', security: protocol === 'vless-ws-tls' ? 'tls' : 'none', type: 'ws', path: credentials.wsPath });
|
||
if (protocol === 'vless-ws-tls') query.set('sni', tlsDomain);
|
||
return `vless://${credentials.clientId}@${host}:${relayPort}?${query}#${label}`;
|
||
}
|
||
if (SHADOWSOCKS_METHODS[protocol]) {
|
||
const method = SHADOWSOCKS_METHODS[protocol].method;
|
||
// SS2022 multi-user needs the EIH identity header: sing-box derives the
|
||
// identity subkey from the node's main PSK, so the client password must be
|
||
// "<server PSK>:<user PSK>" or the server rejects with "invalid request".
|
||
// Classic AEAD methods identify users by trying keys: user password alone.
|
||
const password = method.startsWith('2022-blake3-') && ssServerKey
|
||
? `${ssServerKey}:${credentials.relayPassword}`
|
||
: credentials.relayPassword;
|
||
const user = Buffer.from(`${method}:${password}`).toString('base64url');
|
||
return `ss://${user}@${host}:${relayPort}#${label}`;
|
||
}
|
||
if (protocol === 'socks5-auth') return `socks5://${encodeURIComponent(credentials.socksUser)}:${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}#${label}`;
|
||
return null;
|
||
}
|
||
|
||
function profile(role, protocol) { return PROFILE_CATALOG.find((item) => item.role === role && item.id === protocol); }
|
||
function validateEntryProtocol(protocol) {
|
||
const item = profile('relay-ingress', protocol);
|
||
if (!item || !item.deployable) { const error = new Error(`Unsupported relay ingress: ${protocol}`); error.statusCode = 400; throw error; }
|
||
}
|
||
function validateProtocolPair(relayProtocol, exitProtocol) {
|
||
validateEntryProtocol(relayProtocol);
|
||
const exit = profile('exit-transport', exitProtocol);
|
||
if (!exit || !exit.deployable) { const error = new Error(`Unsupported exit transport: ${exitProtocol}`); error.statusCode = 400; throw error; }
|
||
}
|
||
function isRealityProtocol(protocol) { return ['vless-reality-vision', 'vless-reality'].includes(protocol); }
|
||
|
||
module.exports = {
|
||
PROFILE_CATALOG, REALITY_PRESETS, SHADOWSOCKS_METHODS, nodeEmail, newNodeClientCredentials,
|
||
buildNodeResource, buildNodeExitResource, ensureNodeSecrets, buildClientUri, validateEntryProtocol, validateProtocolPair, isRealityProtocol,
|
||
resolveBindAddress
|
||
};
|