mirror of
https://github.com/XTLS/Xray-core.git
synced 2024-11-14 12:43:18 +00:00
WireGuard kernelTun: Check Capabilities instead of checking UID (#3871)
https://github.com/XTLS/Xray-core/pull/3871#issuecomment-2412820323 --------- Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
This commit is contained in:
parent
6a70ae6408
commit
19f3f709b2
|
@ -4,6 +4,7 @@ import (
|
||||||
"context"
|
"context"
|
||||||
"encoding/base64"
|
"encoding/base64"
|
||||||
"encoding/hex"
|
"encoding/hex"
|
||||||
|
"fmt"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
"github.com/xtls/xray-core/common/errors"
|
"github.com/xtls/xray-core/common/errors"
|
||||||
|
@ -52,6 +53,7 @@ func (c *WireGuardPeerConfig) Build() (proto.Message, error) {
|
||||||
type WireGuardConfig struct {
|
type WireGuardConfig struct {
|
||||||
IsClient bool `json:""`
|
IsClient bool `json:""`
|
||||||
|
|
||||||
|
KernelTun *bool `json:"kernelTun"`
|
||||||
KernelMode *bool `json:"kernelMode"`
|
KernelMode *bool `json:"kernelMode"`
|
||||||
SecretKey string `json:"secretKey"`
|
SecretKey string `json:"secretKey"`
|
||||||
Address []string `json:"address"`
|
Address []string `json:"address"`
|
||||||
|
@ -119,15 +121,24 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
|
||||||
}
|
}
|
||||||
|
|
||||||
config.IsClient = c.IsClient
|
config.IsClient = c.IsClient
|
||||||
|
kernelTunSupported, err := wireguard.KernelTunSupported()
|
||||||
|
if err != nil {
|
||||||
|
errors.LogWarning(context.Background(), fmt.Sprintf("Failed to check kernel TUN support: %v. This may indicate that your OS doesn't support kernel TUN or you lack the necessary permissions. Please ensure you have the required privileges.", err))
|
||||||
|
config.KernelMode = false
|
||||||
|
return config, nil
|
||||||
|
}
|
||||||
|
if c.KernelMode == nil {
|
||||||
|
c.KernelMode = c.KernelTun
|
||||||
|
}
|
||||||
if c.KernelMode != nil {
|
if c.KernelMode != nil {
|
||||||
config.KernelMode = *c.KernelMode
|
config.KernelMode = *c.KernelMode
|
||||||
if config.KernelMode && !wireguard.KernelTunSupported() {
|
if config.KernelMode && !kernelTunSupported {
|
||||||
errors.LogWarning(context.Background(), "kernel mode is not supported on your OS or permission is insufficient")
|
errors.LogWarning(context.Background(), "kernel TUN is not supported on your OS or permission is insufficient")
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
config.KernelMode = wireguard.KernelTunSupported()
|
config.KernelMode = kernelTunSupported
|
||||||
if config.KernelMode {
|
if config.KernelMode {
|
||||||
errors.LogDebug(context.Background(), "kernel mode is enabled as it's supported and permission is sufficient")
|
errors.LogDebug(context.Background(), "kernel TUN is enabled as it's supported and permission is sufficient")
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -11,6 +11,6 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
|
||||||
return nil, errors.New("not implemented")
|
return nil, errors.New("not implemented")
|
||||||
}
|
}
|
||||||
|
|
||||||
func KernelTunSupported() bool {
|
func KernelTunSupported() (bool, error) {
|
||||||
return false
|
return false, nil
|
||||||
}
|
}
|
||||||
|
|
|
@ -231,10 +231,15 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
|
||||||
return out, nil
|
return out, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func KernelTunSupported() bool {
|
func KernelTunSupported() (bool, error) {
|
||||||
// run a superuser permission check to check
|
var hdr unix.CapUserHeader
|
||||||
// if the current user has the sufficient permission
|
hdr.Version = unix.LINUX_CAPABILITY_VERSION_3
|
||||||
// to create a tun device.
|
hdr.Pid = 0 // 0 means current process
|
||||||
|
|
||||||
return unix.Geteuid() == 0 // 0 means root
|
var data unix.CapUserData
|
||||||
|
if err := unix.Capget(&hdr, &data); err != nil {
|
||||||
|
return false, fmt.Errorf("failed to get capabilities: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return (data.Effective & (1 << unix.CAP_NET_ADMIN)) != 0, nil
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue