From f2cb13a8ecd4523392ce0fc1dca5737307ccc616 Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Mon, 20 Sep 2021 02:46:05 -0400 Subject: [PATCH] Deprecate legacy VMess header with a planned decommission (#712) * Deprecate legacy VMess header with a planned decommission * show legacy warning only once Co-authored-by: Xiaokang Wang Co-authored-by: hmol233 <82594500+hmol233@users.noreply.github.com> --- proxy/vmess/encoding/server.go | 8 +++++++- proxy/vmess/inbound/inbound.go | 12 +++++++++++- proxy/vmess/validator.go | 13 +++++++++++++ 3 files changed, 31 insertions(+), 2 deletions(-) diff --git a/proxy/vmess/encoding/server.go b/proxy/vmess/encoding/server.go index 34f87b90..d1136371 100644 --- a/proxy/vmess/encoding/server.go +++ b/proxy/vmess/encoding/server.go @@ -191,11 +191,17 @@ func (s *ServerSession) DecodeRequestHeader(reader io.Reader, isDrain bool) (*pr decryptor = bytes.NewReader(aeadData) s.isAEADRequest = true - case !s.isAEADForced && errorAEAD == vmessaead.ErrNotFound: + case errorAEAD == vmessaead.ErrNotFound: userLegacy, timestamp, valid, userValidationError := s.userValidator.Get(buffer.Bytes()) if !valid || userValidationError != nil { return nil, drainConnection(newError("invalid user").Base(userValidationError)) } + if s.isAEADForced { + return nil, drainConnection(newError("invalid user: VMessAEAD is enforced and a non VMessAEAD connection is received. You can still disable this security feature with environment variable xray.vmess.aead.forced = false . You will not be able to enable legacy header workaround in the future.")) + } + if s.userValidator.ShouldShowLegacyWarn() { + newError("Critical Warning: potentially invalid user: a non VMessAEAD connection is received. From 2022 Jan 1st, this kind of connection will be rejected by default. You should update or replace your client software now. This message will not be shown for further violation on this inbound.").AtWarning().WriteToLog() + } user = userLegacy iv := hashTimestamp(md5.New(), timestamp) vmessAccount = userLegacy.Account.(*vmess.MemoryAccount) diff --git a/proxy/vmess/inbound/inbound.go b/proxy/vmess/inbound/inbound.go index dc05f528..3448326b 100644 --- a/proxy/vmess/inbound/inbound.go +++ b/proxy/vmess/inbound/inbound.go @@ -31,6 +31,7 @@ import ( var ( aeadForced = false + aeadForced2022 = false ) type userByEmail struct { @@ -368,8 +369,17 @@ func init() { return New(ctx, config.(*Config)) })) - const defaultFlagValue = "NOT_DEFINED_AT_ALL" + var defaultFlagValue = "NOT_DEFINED_AT_ALL" + + if time.Now().Year() >= 2022 { + defaultFlagValue = "true_by_default_2022" + } isAeadForced := platform.NewEnvFlag("xray.vmess.aead.forced").GetValue(func() string { return defaultFlagValue }) aeadForced = (isAeadForced == "true") + + if isAeadForced == "true_by_default_2022" { + aeadForced = true + aeadForced2022 = true + } } diff --git a/proxy/vmess/validator.go b/proxy/vmess/validator.go index 7b81d98f..692a9cf6 100644 --- a/proxy/vmess/validator.go +++ b/proxy/vmess/validator.go @@ -40,6 +40,8 @@ type TimedUserValidator struct { behaviorFused bool aeadDecoderHolder *aead.AuthIDDecoderHolder + + legacyWarnShown bool } type indexTimePair struct { @@ -245,6 +247,17 @@ func (v *TimedUserValidator) BurnTaintFuse(userHash []byte) error { return ErrNotFound } +/* ShouldShowLegacyWarn will return whether a Legacy Warning should be shown +Not guaranteed to only return true once for every inbound, but it is okay. +*/ +func (v *TimedUserValidator) ShouldShowLegacyWarn() bool { + if v.legacyWarnShown { + return false + } + v.legacyWarnShown = true + return true +} + var ErrNotFound = newError("Not Found") var ErrTainted = newError("ErrTainted")