Documentation
¶
Index ¶
- Variables
- func B64StrToByte(str string) ([]byte, error)
- func ByteToB64Str(b []byte) string
- func CertIsSelfSigned(pemData string) bool
- func CertPEMFromTLS(tlsConfig map[string]interface{}) string
- func CertPublicKeySha256(pemData string) string
- func CertSha256Hex(pemData string) string
- func CheckPassword(plain, stored string) bool
- func FillOutJson(i *model.Inbound, hostname string) error
- func GenerateTOTPSecret() (string, error)
- func GetExternalLink(url string) string
- func GetExternalSub(url string) ([]map[string]interface{}, error)
- func GetHeaders(client *model.Client, updateInterval int) []string
- func GetOutbound(uri string, i int) (*map[string]interface{}, string, error)
- func GetTlsPing(domain string, port string) (any, error)
- func HashPassword(plain string) (string, error)
- func HostForURI(host string) string
- func IsHashedPassword(stored string) bool
- func IsPlainDirectOutbound(outbound map[string]interface{}) bool
- func JoinRemark(clientRemark, inboundRemark string) string
- func LinkGenerator(clientConfig json.RawMessage, i *model.Inbound, hostname string, ...) []string
- func NormalizeHost(host string) string
- func ShadowsocksClientConfigKey(method string) string
- func StrOrBase64Encoded(str string) string
- func StripServerTlsFields(tls map[string]interface{}) bool
- func TOTPKeyURI(secret, account, issuer string) string
- func ValidateTOTPAfter(secret, code string, after int64) (int64, bool)
- type LinkParam
Constants ¶
This section is empty.
Variables ¶
var InboundTypeWithLink = []string{"socks", "http", "mixed", "shadowsocks", "naive", "hysteria", "hysteria2", "anytls", "tuic", "vless", "trojan", "vmess"}
Functions ¶
func B64StrToByte ¶
func ByteToB64Str ¶
func CertIsSelfSigned ¶ added in v1.5.4
CertIsSelfSigned reports whether the leaf certificate in pemData is self-signed, i.e. its signature verifies against its own public key. Only self-signed certificates should be pinned via certificate_public_key_sha256; CA-signed certificates are validated normally.
func CertPEMFromTLS ¶ added in v1.5.4
func CertPublicKeySha256 ¶ added in v1.5.4
CertPublicKeySha256 returns the base64-encoded SHA256 of the certificate's SubjectPublicKeyInfo (sing-box `certificate_public_key_sha256` / link pinSHA256).
func CertSha256Hex ¶ added in v1.5.4
CertSha256Hex returns the lowercase hex SHA256 of the whole certificate (DER), matching `openssl x509 -fingerprint -sha256` and Clash/mihomo's `fingerprint`.
func CheckPassword ¶ added in v1.5.4
func FillOutJson ¶
Fill Inbound's out_json
func GenerateTOTPSecret ¶ added in v1.7.1
GenerateTOTPSecret returns a fresh base32 shared secret.
func GetExternalLink ¶
func GetExternalSub ¶
func GetTlsPing ¶ added in v1.5.4
GetTlsPing performs a TLS handshake against domain:port (uTLS Chrome hello, no verification -- the point is to fetch whatever certificate is served) and returns the leaf certificate's SPKI SHA256 so the UI can show/pin it.
func HashPassword ¶ added in v1.5.4
func HostForURI ¶ added in v1.8.0
HostForURI returns the host formatted for a URI authority: an IPv6 literal is wrapped in brackets so "host:port" stays parseable, everything else is returned unchanged. Bracketing is idempotent -- the input is normalized first, so an already-bracketed literal does not gain a second pair.
The colon test is a real address parse, not a substring check: an address row's server field takes free text, and something like "example.com:443" contains a colon without being an IPv6 literal. Bracketing that would turn one malformed authority into a different malformed authority; leaving it alone at least keeps the operator's own spelling visible in the link.
func IsHashedPassword ¶ added in v1.5.4
func IsPlainDirectOutbound ¶ added in v1.8.0
IsPlainDirectOutbound reports whether a decoded outbound carries nothing but its identity -- a `direct` outbound with no options of its own.
sing-box refuses a detour to one of those: it would dial exactly what a dialer with no detour dials, and the flag that suppresses the check (DisableEmptyDirectCheck) has no JSON field, so the panel cannot set it. The two spellings mean the same thing, so wherever a detour is written out, such an outbound has to be written as "no detour" instead.
The argument is an outbound in sing-box shape -- type and tag, then the options spread beside them -- which is what both callers hold. A row still in the database is answered without rendering it, by asking whether its options blob is empty; see database.plainDirectOutboundTags.
func JoinRemark ¶ added in v1.8.0
func LinkGenerator ¶
func NormalizeHost ¶ added in v1.8.0
NormalizeHost strips URI brackets from an IPv6 literal ("[::1]" -> "::1"). Bare hosts, IPv4 addresses and domains are returned unchanged. Config formats -- sing-box JSON, Clash YAML, the vmess "add" field -- want the bare form; only a URI authority needs the brackets (#1220).
func ShadowsocksClientConfigKey ¶ added in v1.6.3
ShadowsocksClientConfigKey returns the key a client's config blob stores its Shadowsocks secret under, for the given inbound method.
A client config only ever carries two of them (see the frontend's randomConfigs): "shadowsocks16" holds a 16-byte secret and "shadowsocks" a 32-byte one. 2022-blake3-aes-128-gcm is the only method deriving a 128-bit key, so it is the only one that reads the short secret. Everything else reads "shadowsocks" — including 2022-blake3-aes-256-gcm and -chacha20-poly1305, which need the full 32 bytes.
Upstream s-ui routes those two to a third key, "shadowsocks32", that no client config contains; the lookup then yields "" and the inbound ends up with an empty user list. Keep the two-key mapping.
func StrOrBase64Encoded ¶
Function to return decoded bytes if a string is Base64 encoded
func StripServerTlsFields ¶ added in v1.5.7
StripServerTlsFields removes server-only TLS fields from a client-facing TLS object in place and reports whether anything was removed.
func TOTPKeyURI ¶ added in v1.7.1
TOTPKeyURI builds the otpauth:// URI the enrolment QR code encodes. issuer is repeated in the label as well as the parameter because that is what apps that predate the parameter read, and dropping it there makes every 2S-UI panel show up under the bare account name.
func ValidateTOTPAfter ¶ added in v1.7.1
ValidateTOTPAfter validates a code and rejects replays: after is the counter the last accepted code matched, and anything at or below it is refused (RFC 6238 §5.2). A malformed secret fails closed. The returned counter is what the caller persists, so the same six digits cannot be replayed for the rest of their acceptance window -- which is up to 90 seconds here, long enough for a code read over someone's shoulder to be worth something on its own.
Source Files
Directories