Documentation
¶
Overview ¶
Package auth provides password hashing (Argon2id), random secret generation, and constant-time helpers used by the panel's authentication and masquerade.
Index ¶
- func Configure()
- func DummyVerify()
- func GenerateRealityKeys() (priv, pub string, err error)
- func HashPassword(password string) (string, error)
- func RandomPassword() (string, error)
- func RandomRealityPath() (string, error)
- func RandomSecretPath() (string, error)
- func RandomShortIDs() (string, error)
- func RandomToken() (string, error)
- func RandomWSPath() (string, error)
- func VerifyPassword(encoded, password string) bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Configure ¶ added in v0.8.0
func Configure()
Configure tunes the Argon2id cost to the host so concurrent logins can't OOM a small VPS, while keeping the strong default on roomy hosts. Call once at startup before any password is hashed. Safe to skip (defaults stand).
func DummyVerify ¶
func DummyVerify()
DummyVerify burns roughly one Argon2id computation so that login attempts for unknown usernames take similar time to real ones (anti-enumeration).
func GenerateRealityKeys ¶
GenerateRealityKeys returns an X25519 keypair encoded base64 raw-url, matching the format of `xray x25519`: the private key goes into the server config, the public key (pbk=) into client share links.
func HashPassword ¶
HashPassword returns a PHC-formatted Argon2id hash string.
func RandomPassword ¶
RandomPassword returns a strong URL-safe random password.
func RandomRealityPath ¶ added in v1.5.0
RandomRealityPath returns the secret request path of a REALITY inbound's XHTTP transport ("/<random>"). It is the shared secret a client must know on top of the keypair, so it is generated rather than named: a guessable path lets a prober address the inbound directly instead of being handed the donor site.
func RandomSecretPath ¶
RandomSecretPath returns a ~128-bit, URL-safe lowercase path segment.
func RandomShortIDs ¶
RandomShortIDs returns a comma-separated set of REALITY shortIds of varying even hex lengths. The server accepts any of them; share links use the first (an 8-hex-char id, the widely-compatible default).
func RandomToken ¶
RandomToken returns a 256-bit URL-safe opaque token (sessions).
func RandomWSPath ¶
RandomWSPath returns a random WebSocket path like "/3f9k2m".
func VerifyPassword ¶
VerifyPassword reports whether password matches the PHC-encoded hash.
Types ¶
This section is empty.
Source Files