From eb4791a1cdabebbf0b0d5a81a40ecc7d88924656 Mon Sep 17 00:00:00 2001 From: pwnnex Date: Wed, 22 Apr 2026 18:55:09 +0300 Subject: [PATCH 1/2] hysteria: also accept "hysteria2" protocol string UI stores v1 and v2 both as "hysteria" with settings.version, but inbounds that came in from imports / manual SQL can carry the literal "hysteria2" string and get silently dropped everywhere we switch on protocol. Add Hysteria2 constant + IsHysteria helper, use it in the places that gate on protocol (sub SQL, getLink, genHysteriaLink, clash buildProxy, json gen, inbound.go validation, xray AddUser). Existing "hysteria" inbounds are untouched. closes #4081 --- database/model/model.go | 14 +++++++++++++- database/model/model_test.go | 22 ++++++++++++++++++++++ sub/subClashService.go | 11 ++++------- sub/subJsonService.go | 2 +- sub/subService.go | 10 ++++++---- web/service/inbound.go | 8 ++++---- xray/api.go | 2 +- 7 files changed, 51 insertions(+), 18 deletions(-) create mode 100644 database/model/model_test.go diff --git a/database/model/model.go b/database/model/model.go index 5fa934c0..01654d22 100644 --- a/database/model/model.go +++ b/database/model/model.go @@ -21,9 +21,21 @@ const ( Shadowsocks Protocol = "shadowsocks" Mixed Protocol = "mixed" WireGuard Protocol = "wireguard" - Hysteria Protocol = "hysteria" + // UI stores Hysteria v1 and v2 both as "hysteria" and uses + // settings.version to discriminate. Imports from outside the panel + // can carry the literal "hysteria2" string, so IsHysteria below + // accepts both. + Hysteria Protocol = "hysteria" + Hysteria2 Protocol = "hysteria2" ) +// IsHysteria returns true for both "hysteria" and "hysteria2". +// Use instead of a bare ==model.Hysteria check: a v2 inbound stored +// with the literal v2 string would otherwise fall through (#4081). +func IsHysteria(p Protocol) bool { + return p == Hysteria || p == Hysteria2 +} + // User represents a user account in the 3x-ui panel. type User struct { Id int `json:"id" gorm:"primaryKey;autoIncrement"` diff --git a/database/model/model_test.go b/database/model/model_test.go new file mode 100644 index 00000000..d98c5157 --- /dev/null +++ b/database/model/model_test.go @@ -0,0 +1,22 @@ +package model + +import "testing" + +func TestIsHysteria(t *testing.T) { + cases := []struct { + in Protocol + want bool + }{ + {Hysteria, true}, + {Hysteria2, true}, + {VLESS, false}, + {Shadowsocks, false}, + {Protocol(""), false}, + {Protocol("hysteria3"), false}, + } + for _, c := range cases { + if got := IsHysteria(c.in); got != c.want { + t.Errorf("IsHysteria(%q) = %v, want %v", c.in, got, c.want) + } + } +} diff --git a/sub/subClashService.go b/sub/subClashService.go index d0445aa4..7b6b8214 100644 --- a/sub/subClashService.go +++ b/sub/subClashService.go @@ -159,13 +159,10 @@ func (s *SubClashService) getProxies(inbound *model.Inbound, client model.Client } func (s *SubClashService) buildProxy(inbound *model.Inbound, client model.Client, stream map[string]any, extraRemark string) map[string]any { - // Hysteria (v1 / v2) doesn't ride an xray `streamSettings.network` - // transport and the TLS story is handled inside hysteria itself, so - // applyTransport / applySecurity below don't model it. Build the - // proxy directly. Without this, hysteria inbounds fell into the - // `default: return nil` branch and silently vanished from the - // generated Clash config. - if inbound.Protocol == model.Hysteria { + // Hysteria has its own transport + TLS model, applyTransport / + // applySecurity don't fit. IsHysteria also covers the literal + // "hysteria2" protocol string (#4081). + if model.IsHysteria(inbound.Protocol) { return s.buildHysteriaProxy(inbound, client, extraRemark) } diff --git a/sub/subJsonService.go b/sub/subJsonService.go index acb8e05f..a51f10bb 100644 --- a/sub/subJsonService.go +++ b/sub/subJsonService.go @@ -209,7 +209,7 @@ func (s *SubJsonService) getConfig(inbound *model.Inbound, client model.Client, newOutbounds = append(newOutbounds, s.genVless(inbound, streamSettings, client)) case "trojan", "shadowsocks": newOutbounds = append(newOutbounds, s.genServer(inbound, streamSettings, client)) - case "hysteria": + case "hysteria", "hysteria2": newOutbounds = append(newOutbounds, s.genHy(inbound, newStream, client)) } diff --git a/sub/subService.go b/sub/subService.go index dd6bbcc9..44549390 100644 --- a/sub/subService.go +++ b/sub/subService.go @@ -115,12 +115,14 @@ func (s *SubService) GetSubs(subId string, host string) ([]string, int64, xray.C func (s *SubService) getInboundsBySubId(subId string) ([]*model.Inbound, error) { db := database.GetDB() var inbounds []*model.Inbound + // allow "hysteria2" so imports stored with the literal v2 protocol + // string still surface here (#4081) err := db.Model(model.Inbound{}).Preload("ClientStats").Where(`id in ( SELECT DISTINCT inbounds.id FROM inbounds, - JSON_EACH(JSON_EXTRACT(inbounds.settings, '$.clients')) AS client + JSON_EACH(JSON_EXTRACT(inbounds.settings, '$.clients')) AS client WHERE - protocol in ('vmess','vless','trojan','shadowsocks','hysteria') + protocol in ('vmess','vless','trojan','shadowsocks','hysteria','hysteria2') AND JSON_EXTRACT(client.value, '$.subId') = ? AND enable = ? )`, subId, true).Find(&inbounds).Error if err != nil { @@ -171,7 +173,7 @@ func (s *SubService) getLink(inbound *model.Inbound, email string) string { return s.genTrojanLink(inbound, email) case "shadowsocks": return s.genShadowsocksLink(inbound, email) - case "hysteria": + case "hysteria", "hysteria2": return s.genHysteriaLink(inbound, email) } return "" @@ -906,7 +908,7 @@ func (s *SubService) genShadowsocksLink(inbound *model.Inbound, email string) st } func (s *SubService) genHysteriaLink(inbound *model.Inbound, email string) string { - if inbound.Protocol != model.Hysteria { + if !model.IsHysteria(inbound.Protocol) { return "" } var stream map[string]interface{} diff --git a/web/service/inbound.go b/web/service/inbound.go index 5153b700..19c3d80c 100644 --- a/web/service/inbound.go +++ b/web/service/inbound.go @@ -270,7 +270,7 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo if client.Email == "" { return inbound, false, common.NewError("empty client ID") } - case "hysteria": + case "hysteria", "hysteria2": if client.Auth == "" { return inbound, false, common.NewError("empty client ID") } @@ -675,7 +675,7 @@ func (s *InboundService) AddInboundClient(data *model.Inbound) (bool, error) { if client.Email == "" { return false, common.NewError("empty client ID") } - case "hysteria": + case "hysteria", "hysteria2": if client.Auth == "" { return false, common.NewError("empty client ID") } @@ -769,7 +769,7 @@ func (s *InboundService) DelInboundClient(inboundId int, clientId string) (bool, client_key = "password" case "shadowsocks": client_key = "email" - case "hysteria": + case "hysteria", "hysteria2": client_key = "auth" } @@ -877,7 +877,7 @@ func (s *InboundService) UpdateInboundClient(data *model.Inbound, clientId strin case "shadowsocks": oldClientId = oldClient.Email newClientId = clients[0].Email - case "hysteria": + case "hysteria", "hysteria2": oldClientId = oldClient.Auth newClientId = clients[0].Auth default: diff --git a/xray/api.go b/xray/api.go index a887d666..277571f4 100644 --- a/xray/api.go +++ b/xray/api.go @@ -231,7 +231,7 @@ func (x *XrayAPI) AddUser(Protocol string, inboundTag string, user map[string]an Email: userEmail, }) } - case "hysteria": + case "hysteria", "hysteria2": auth, err := getRequiredUserString(user, "auth") if err != nil { return err From 17f67ef3a51537cbb32b2fcd3884c26434f4ee62 Mon Sep 17 00:00:00 2001 From: pwnnex Date: Wed, 22 Apr 2026 18:55:27 +0300 Subject: [PATCH 2/2] sub: dont panic on bad externalProxy entry in genHysteriaLink The externalProxy fanout from #4073 did `int(ep["port"].(float64))` with no ok-check. If any entry is missing port or has the wrong type it panics, and since this runs in the /sub/ handler the whole subscription returns 500. Skip malformed entries instead. --- sub/subService.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sub/subService.go b/sub/subService.go index 44549390..272bf9d5 100644 --- a/sub/subService.go +++ b/sub/subService.go @@ -987,12 +987,18 @@ func (s *SubService) genHysteriaLink(inbound *model.Inbound, email string) strin if len(externalProxies) > 0 { links := make([]string, 0, len(externalProxies)) for _, externalProxy := range externalProxies { - ep, _ := externalProxy.(map[string]interface{}) + ep, ok := externalProxy.(map[string]interface{}) + if !ok { + continue + } dest, _ := ep["dest"].(string) - epPort := int(ep["port"].(float64)) + portF, okPort := ep["port"].(float64) + if dest == "" || !okPort { + continue + } epRemark, _ := ep["remark"].(string) - link := fmt.Sprintf("%s://%s@%s:%d", protocol, auth, dest, epPort) + link := fmt.Sprintf("%s://%s@%s:%d", protocol, auth, dest, int(portF)) u, _ := url.Parse(link) q := u.Query() for k, v := range params {