purgatory/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2024-11-24 22:26:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

WireGuard kernelTun: Check Capabilities instead of checking UID (#3871)

Browse Source 
https://github.com/XTLS/Xray-core/pull/3871#issuecomment-2412820323

---------

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>
This commit is contained in:
チセ 2024-10-15 11:30:29 +08:00 committed by GitHub
parent 6a70ae6408
commit 19f3f709b2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
infra/conf/wireguard.go
View File

@ -4,6 +4,7 @@ import (
"context"
"encoding/base64"
"encoding/hex"
"fmt"
"strings"
"github.com/xtls/xray-core/common/errors"
@ -52,6 +53,7 @@ func (c *WireGuardPeerConfig) Build() (proto.Message, error) {
type WireGuardConfig struct {
IsClient bool `json:""`
KernelTun *bool `json:"kernelTun"`
KernelMode *bool `json:"kernelMode"`
SecretKey string `json:"secretKey"`
Address []string `json:"address"`
@ -119,15 +121,24 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
}
config.IsClient = c.IsClient
kernelTunSupported, err := wireguard.KernelTunSupported()
if err != nil {
errors.LogWarning(context.Background(), fmt.Sprintf("Failed to check kernel TUN support: %v. This may indicate that your OS doesn't support kernel TUN or you lack the necessary permissions. Please ensure you have the required privileges.", err))
config.KernelMode = false
return config, nil
}
if c.KernelMode == nil {
c.KernelMode = c.KernelTun
}
if c.KernelMode != nil {
config.KernelMode = *c.KernelMode
if config.KernelMode && !wireguard.KernelTunSupported() {
errors.LogWarning(context.Background(), "kernel mode is not supported on your OS or permission is insufficient")
if config.KernelMode && !kernelTunSupported {
errors.LogWarning(context.Background(), "kernel TUN is not supported on your OS or permission is insufficient")
}
} else {
config.KernelMode = wireguard.KernelTunSupported()
config.KernelMode = kernelTunSupported
if config.KernelMode {
errors.LogDebug(context.Background(), "kernel mode is enabled as it's supported and permission is sufficient")
errors.LogDebug(context.Background(), "kernel TUN is enabled as it's supported and permission is sufficient")
}
}

4
proxy/wireguard/tun_default.go
View File

@ -11,6 +11,6 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
return nil, errors.New("not implemented")
}
func KernelTunSupported() bool {
return false
func KernelTunSupported() (bool, error) {
return false, nil
}

15
proxy/wireguard/tun_linux.go
View File

@ -231,10 +231,15 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
return out, nil
}
func KernelTunSupported() bool {
// run a superuser permission check to check
// if the current user has the sufficient permission
// to create a tun device.
func KernelTunSupported() (bool, error) {
var hdr unix.CapUserHeader
hdr.Version = unix.LINUX_CAPABILITY_VERSION_3
hdr.Pid = 0 // 0 means current process
return unix.Geteuid() == 0 // 0 means root
var data unix.CapUserData
if err := unix.Capget(&hdr, &data); err != nil {
return false, fmt.Errorf("failed to get capabilities: %v", err)
}
return (data.Effective & (1 << unix.CAP_NET_ADMIN)) != 0, nil
}