black-internet-days-ahead/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2024-11-14 20:53:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

WireGuard kernelTun: Check Capabilities instead of checking UID (#3871)

Browse source 
https://github.com/XTLS/Xray-core/pull/3871#issuecomment-2412820323

---------

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
This commit is contained in:
チセ 2024-10-15 11:30:29 +08:00 committed by GitHub
parent 6a70ae6408
commit 19f3f709b2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 27 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
infra/conf/wireguard.go
View file

@ -4,6 +4,7 @@ import (
"context" "context"
"encoding/base64" "encoding/base64"
"encoding/hex" "encoding/hex"
"fmt"
"strings" "strings"
"github.com/xtls/xray-core/common/errors" "github.com/xtls/xray-core/common/errors"
@ -52,6 +53,7 @@ func (c *WireGuardPeerConfig) Build() (proto.Message, error) {
type WireGuardConfig struct { type WireGuardConfig struct {
IsClient bool `json:""` IsClient bool `json:""`
KernelTun *bool `json:"kernelTun"`
KernelMode *bool `json:"kernelMode"` KernelMode *bool `json:"kernelMode"`
SecretKey string `json:"secretKey"` SecretKey string `json:"secretKey"`
Address []string `json:"address"` Address []string `json:"address"`
@ -119,15 +121,24 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
} }
config.IsClient = c.IsClient config.IsClient = c.IsClient
kernelTunSupported, err := wireguard.KernelTunSupported()
if err != nil {
errors.LogWarning(context.Background(), fmt.Sprintf("Failed to check kernel TUN support: %v. This may indicate that your OS doesn't support kernel TUN or you lack the necessary permissions. Please ensure you have the required privileges.", err))
config.KernelMode = false
return config, nil
}
if c.KernelMode == nil {
c.KernelMode = c.KernelTun
}
if c.KernelMode != nil { if c.KernelMode != nil {
config.KernelMode = *c.KernelMode config.KernelMode = *c.KernelMode
if config.KernelMode && !wireguard.KernelTunSupported() { if config.KernelMode && !kernelTunSupported {
errors.LogWarning(context.Background(), "kernel mode is not supported on your OS or permission is insufficient") errors.LogWarning(context.Background(), "kernel TUN is not supported on your OS or permission is insufficient")
} }
} else { } else {
config.KernelMode = wireguard.KernelTunSupported() config.KernelMode = kernelTunSupported
if config.KernelMode { if config.KernelMode {
errors.LogDebug(context.Background(), "kernel mode is enabled as it's supported and permission is sufficient") errors.LogDebug(context.Background(), "kernel TUN is enabled as it's supported and permission is sufficient")
} }
} }

4
proxy/wireguard/tun_default.go
View file

@ -11,6 +11,6 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
return nil, errors.New("not implemented") return nil, errors.New("not implemented")
} }
func KernelTunSupported() bool { func KernelTunSupported() (bool, error) {
return false return false, nil
} }

15
proxy/wireguard/tun_linux.go
View file

@ -231,10 +231,15 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
return out, nil return out, nil
} }
func KernelTunSupported() bool { func KernelTunSupported() (bool, error) {
// run a superuser permission check to check var hdr unix.CapUserHeader
// if the current user has the sufficient permission hdr.Version = unix.LINUX_CAPABILITY_VERSION_3
// to create a tun device. hdr.Pid = 0 // 0 means current process
return unix.Geteuid() == 0 // 0 means root var data unix.CapUserData
if err := unix.Capget(&hdr, &data); err != nil {
return false, fmt.Errorf("failed to get capabilities: %v", err)
}
return (data.Effective & (1 << unix.CAP_NET_ADMIN)) != 0, nil
} }