wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

boxdd: Add insecure mode

Browse Source
This commit is contained in:
世界
2026-07-15 19:31:11 +08:00
parent 52f372c536
commit e34b57c3b0
61 changed files with 1058 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/tls/acme.go
+8 -1
View File
@@ -5,6 +5,7 @@ package tls
import (
"context"
"crypto/tls"
"os"
"slices"
"strings"
@@ -13,6 +14,7 @@ import (
"github.com/sagernet/sing-box/option"
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/common/logger"
"github.com/sagernet/sing/service/filemanager"
"github.com/caddyserver/certmagic"
"github.com/libdns/acmedns"
@@ -54,8 +56,13 @@ func startACME(ctx context.Context, logger logger.Logger, options option.Inbound
}
var storage certmagic.Storage
if options.DataDirectory != "" {
dataDirectory := filemanager.BasePath(ctx, os.ExpandEnv(options.DataDirectory))
err := filemanager.MkdirAll(ctx, dataDirectory, 0o700)
if err != nil {
return nil, nil, E.Cause(err, "create ACME data directory")
}
storage = &certmagic.FileStorage{
Path: options.DataDirectory,
Path: dataDirectory,
}
} else {
storage = certmagic.Default.Storage
common/tls/ech.go
+3 -3
View File
@@ -8,7 +8,6 @@ import (
"encoding/base64"
"encoding/pem"
"net"
"os"
"strings"
"sync"
"time"
@@ -19,6 +18,7 @@ import (
E "github.com/sagernet/sing/common/exceptions"
aTLS "github.com/sagernet/sing/common/tls"
"github.com/sagernet/sing/service"
"github.com/sagernet/sing/service/filemanager"
mDNS "github.com/miekg/dns"
"golang.org/x/crypto/cryptobyte"
@@ -29,7 +29,7 @@ func parseECHClientConfig(ctx context.Context, clientConfig ECHCapableConfig, op
if len(options.ECH.Config) > 0 {
echConfig = []byte(strings.Join(options.ECH.Config, "\n"))
} else if options.ECH.ConfigPath != "" {
content, err := os.ReadFile(options.ECH.ConfigPath)
content, err := filemanager.ReadFile(ctx, options.ECH.ConfigPath)
if err != nil {
return nil, E.Cause(err, "read ECH config")
}
@@ -60,7 +60,7 @@ func parseECHServerConfig(ctx context.Context, options option.InboundTLSOptions,
if len(options.ECH.Key) > 0 {
echKey = []byte(strings.Join(options.ECH.Key, "\n"))
} else if options.ECH.KeyPath != "" {
content, err := os.ReadFile(options.ECH.KeyPath)
content, err := filemanager.ReadFile(ctx, options.ECH.KeyPath)
if err != nil {
return E.Cause(err, "read ECH keys")
}
common/tls/std_client.go
+4 -4
View File
@@ -8,7 +8,6 @@ import (
"crypto/x509"
"encoding/base64"
"net"
"os"
"strings"
"time"
@@ -20,6 +19,7 @@ import (
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/common/logger"
"github.com/sagernet/sing/common/ntp"
"github.com/sagernet/sing/service/filemanager"
)
type STDClientConfig struct {
@@ -179,7 +179,7 @@ func newSTDClient(ctx context.Context, logger logger.ContextLogger, serverAddres
if len(options.Certificate) > 0 {
certificate = []byte(strings.Join(options.Certificate, "\n"))
} else if options.CertificatePath != "" {
content, err := os.ReadFile(options.CertificatePath)
content, err := filemanager.ReadFile(ctx, options.CertificatePath)
if err != nil {
return nil, E.Cause(err, "read certificate")
}
@@ -196,7 +196,7 @@ func newSTDClient(ctx context.Context, logger logger.ContextLogger, serverAddres
if len(options.ClientCertificate) > 0 {
clientCertificate = []byte(strings.Join(options.ClientCertificate, "\n"))
} else if options.ClientCertificatePath != "" {
content, err := os.ReadFile(options.ClientCertificatePath)
content, err := filemanager.ReadFile(ctx, options.ClientCertificatePath)
if err != nil {
return nil, E.Cause(err, "read client certificate")
}
@@ -206,7 +206,7 @@ func newSTDClient(ctx context.Context, logger logger.ContextLogger, serverAddres
if len(options.ClientKey) > 0 {
clientKey = []byte(strings.Join(options.ClientKey, "\n"))
} else if options.ClientKeyPath != "" {
content, err := os.ReadFile(options.ClientKeyPath)
content, err := filemanager.ReadFile(ctx, options.ClientKeyPath)
if err != nil {
return nil, E.Cause(err, "read client key")
}
common/tls/std_server.go
+10 -8
View File
@@ -5,7 +5,6 @@ import (
"crypto/tls"
"crypto/x509"
"net"
"os"
"strings"
"sync"
"time"
@@ -20,6 +19,7 @@ import (
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/common/ntp"
"github.com/sagernet/sing/service"
"github.com/sagernet/sing/service/filemanager"
)
var errInsecureUnused = E.New("tls: insecure unused")
@@ -90,6 +90,7 @@ func getACMENextProtos(provider adapter.CertificateProvider) []string {
}
type STDServerConfig struct {
ctx context.Context
access sync.RWMutex
config *tls.Config
handshakeTimeout time.Duration
@@ -260,13 +261,13 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
if path == c.certificatePath || path == c.keyPath {
switch path {
case c.certificatePath:
certificate, err := os.ReadFile(c.certificatePath)
certificate, err := filemanager.ReadFile(c.ctx, c.certificatePath)
if err != nil {
return E.Cause(err, "reload certificate from ", c.certificatePath)
}
c.certificate = certificate
case c.keyPath:
key, err := os.ReadFile(c.keyPath)
key, err := filemanager.ReadFile(c.ctx, c.keyPath)
if err != nil {
return E.Cause(err, "reload key from ", c.keyPath)
}
@@ -286,7 +287,7 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
clientCertificateCA := x509.NewCertPool()
var reloaded bool
for _, certPath := range c.clientCertificatePath {
content, err := os.ReadFile(certPath)
content, err := filemanager.ReadFile(c.ctx, certPath)
if err != nil {
c.logger.Error(E.Cause(err, "reload certificate from ", c.clientCertificatePath))
continue
@@ -307,7 +308,7 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
c.access.Unlock()
c.logger.Info("reloaded client certificates")
} else if path == c.echKeyPath {
echKey, err := os.ReadFile(c.echKeyPath)
echKey, err := filemanager.ReadFile(c.ctx, c.echKeyPath)
if err != nil {
return E.Cause(err, "reload ECH keys from ", c.echKeyPath)
}
@@ -405,7 +406,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
if len(options.Certificate) > 0 {
certificate = []byte(strings.Join(options.Certificate, "\n"))
} else if options.CertificatePath != "" {
content, err := os.ReadFile(options.CertificatePath)
content, err := filemanager.ReadFile(ctx, options.CertificatePath)
if err != nil {
return nil, E.Cause(err, "read certificate")
}
@@ -414,7 +415,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
if len(options.Key) > 0 {
key = []byte(strings.Join(options.Key, "\n"))
} else if options.KeyPath != "" {
content, err := os.ReadFile(options.KeyPath)
content, err := filemanager.ReadFile(ctx, options.KeyPath)
if err != nil {
return nil, E.Cause(err, "read key")
}
@@ -457,7 +458,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
} else if len(options.ClientCertificatePath) > 0 {
clientCertificateCA := x509.NewCertPool()
for _, path := range options.ClientCertificatePath {
content, err := os.ReadFile(path)
content, err := filemanager.ReadFile(ctx, path)
if err != nil {
return nil, E.Cause(err, "read client certificate from ", path)
}
@@ -494,6 +495,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
handshakeTimeout = C.TCPTimeout
}
serverConfig := &STDServerConfig{
ctx: ctx,
config: tlsConfig,
handshakeTimeout: handshakeTimeout,
logger: logger,
common/tls/system_client.go
+2 -2
View File
@@ -3,7 +3,6 @@ package tls
import (
"context"
"crypto/x509"
"os"
"strings"
"time"
@@ -11,6 +10,7 @@ import (
"github.com/sagernet/sing-box/option"
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/service"
"github.com/sagernet/sing/service/filemanager"
)
type SystemTLSValidated struct {
@@ -89,7 +89,7 @@ func resolveSystemAnchors(ctx context.Context, options option.OutboundTLSOptions
return []byte(strings.Join(options.Certificate, "\n")), true, nil, nil
}
if options.CertificatePath != "" {
content, err := os.ReadFile(options.CertificatePath)
content, err := filemanager.ReadFile(ctx, options.CertificatePath)
if err != nil {
return nil, false, nil, E.Cause(err, "read certificate")
}
common/tls/utls_client.go
+4 -4
View File
@@ -8,7 +8,6 @@ import (
"crypto/x509"
"math/rand"
"net"
"os"
"strings"
"time"
@@ -21,6 +20,7 @@ import (
E "github.com/sagernet/sing/common/exceptions"
"github.com/sagernet/sing/common/logger"
"github.com/sagernet/sing/common/ntp"
"github.com/sagernet/sing/service/filemanager"
utls "github.com/metacubex/utls"
"golang.org/x/net/http2"
@@ -251,7 +251,7 @@ func newUTLSClient(ctx context.Context, logger logger.ContextLogger, serverAddre
if len(options.Certificate) > 0 {
certificate = []byte(strings.Join(options.Certificate, "\n"))
} else if options.CertificatePath != "" {
content, err := os.ReadFile(options.CertificatePath)
content, err := filemanager.ReadFile(ctx, options.CertificatePath)
if err != nil {
return nil, E.Cause(err, "read certificate")
}
@@ -268,7 +268,7 @@ func newUTLSClient(ctx context.Context, logger logger.ContextLogger, serverAddre
if len(options.ClientCertificate) > 0 {
clientCertificate = []byte(strings.Join(options.ClientCertificate, "\n"))
} else if options.ClientCertificatePath != "" {
content, err := os.ReadFile(options.ClientCertificatePath)
content, err := filemanager.ReadFile(ctx, options.ClientCertificatePath)
if err != nil {
return nil, E.Cause(err, "read client certificate")
}
@@ -278,7 +278,7 @@ func newUTLSClient(ctx context.Context, logger logger.ContextLogger, serverAddre
if len(options.ClientKey) > 0 {
clientKey = []byte(strings.Join(options.ClientKey, "\n"))
} else if options.ClientKeyPath != "" {
content, err := os.ReadFile(options.ClientKeyPath)
content, err := filemanager.ReadFile(ctx, options.ClientKeyPath)
if err != nil {
return nil, E.Cause(err, "read client key")
}