+ Optional. Controls XTLS Vision padding behavior (used only for xtls-rprx-vision).
+ Provide exactly four positive integers to customize padding; otherwise leave empty to use safe defaults.
+
diff --git a/web/html/form/stream/stream_xhttp.html b/web/html/form/stream/stream_xhttp.html
index 342a46f1..c275026c 100644
--- a/web/html/form/stream/stream_xhttp.html
+++ b/web/html/form/stream/stream_xhttp.html
@@ -37,6 +37,10 @@
+
+
+
@@ -67,14 +71,6 @@
-
-
- Default (POST)
- POST
- PUT
- GET (packet-up only)
-
- Default (path)
@@ -114,13 +110,8 @@
v-if="inbound.stream.xhttp.mode === 'packet-up' && inbound.stream.xhttp.uplinkDataPlacement && inbound.stream.xhttp.uplinkDataPlacement !== 'body'">
-
-
-
-{{end}}
\ No newline at end of file
+{{end}}
diff --git a/web/html/index.html b/web/html/index.html
index 60608315..57682ce5 100644
--- a/web/html/index.html
+++ b/web/html/index.html
@@ -1407,14 +1407,34 @@
class: themeSwitcher.currentTheme,
cancelText: '{{ i18n "cancel"}}',
onOk: async () => {
+ const targetVersion = panelUpdateModal.info.latestVersion || '';
+ const baseTip = '{{ i18n "pages.index.dontRefresh"}}';
+ const tipPrefix = targetVersion ? `${baseTip} (${targetVersion})` : baseTip;
panelUpdateModal.hide();
- this.loading(true, '{{ i18n "pages.index.dontRefresh"}}');
+ this.loading(true, tipPrefix);
const msg = await HttpUtil.post('/panel/api/server/updatePanel');
if (!msg.success) {
this.loading(false);
return;
}
- await PromiseUtil.sleep(15000);
+
+ // Wait for the running process to exit, then poll the new panel
+ // until it answers (up to ~90s). Reload as soon as it's back.
+ await PromiseUtil.sleep(5000);
+ this.loading(true, tipPrefix);
+ const deadline = Date.now() + 90_000;
+ let back = false;
+ while (Date.now() < deadline) {
+ try {
+ const r = await axios.get('/panel/api/server/status', { timeout: 2000 });
+ if (r && r.data && r.data.success) { back = true; break; }
+ } catch (_) { /* still restarting */ }
+ await PromiseUtil.sleep(2000);
+ }
+ if (back) {
+ this.$message.success('{{ i18n "pages.index.panelUpdateStartedPopover" }}');
+ await PromiseUtil.sleep(800);
+ }
window.location.reload();
},
});
diff --git a/web/html/modals/inbound_info_modal.html b/web/html/modals/inbound_info_modal.html
index 8ecb59bf..cc2b734d 100644
--- a/web/html/modals/inbound_info_modal.html
+++ b/web/html/modals/inbound_info_modal.html
@@ -90,14 +90,9 @@
[[
inbound.stream.security ]]
-
Authentication
- [[
- inbound.settings.selectedAuth ? inbound.settings.selectedAuth : ''
- ]]
- {{ i18n "none" }}
-
{{ i18n "encryption" }}
- [[
+ [[
inbound.settings.encryption ? inbound.settings.encryption : ''
]]
diff --git a/web/html/modals/inbound_modal.html b/web/html/modals/inbound_modal.html
index ca896096..df2588db 100644
--- a/web/html/modals/inbound_modal.html
+++ b/web/html/modals/inbound_modal.html
@@ -16,6 +16,16 @@
inbound: new Inbound(),
dbInbound: new DBInbound(),
ok() {
+ // Block submit when Vision Seed is XRV-gated and partially/invalidly filled.
+ const seedErr = inModal.testseedError();
+ if (seedErr) {
+ if (typeof Vue !== "undefined" && Vue.prototype && Vue.prototype.$message) {
+ Vue.prototype.$message.error(seedErr);
+ } else {
+ alert(seedErr);
+ }
+ return;
+ }
ObjectUtil.execute(inModal.confirm, inModal.inbound, inModal.dbInbound);
},
show({
@@ -33,16 +43,12 @@
} else {
this.inbound = new Inbound();
}
- // Always ensure testseed is initialized for VLESS protocol (even if vision flow is not set yet)
- // This ensures Vue reactivity works properly
+ // Ensure VLESS settings has a testseed array reference for Vue reactivity,
+ // but leave it empty so we don't auto-emit defaults — user must explicitly
+ // fill all four fields, or leave blank to fall back to backend defaults.
if (this.inbound.protocol === Protocols.VLESS && this.inbound.settings) {
- if (
- !this.inbound.settings.testseed ||
- !Array.isArray(this.inbound.settings.testseed) ||
- this.inbound.settings.testseed.length < 4
- ) {
- // Create a new array to ensure Vue reactivity
- this.inbound.settings.testseed = [900, 500, 900, 256].slice();
+ if (!Array.isArray(this.inbound.settings.testseed)) {
+ this.inbound.settings.testseed = [];
}
}
if (dbInbound) {
@@ -61,48 +67,50 @@
loading(loading = true) {
inModal.confirmLoading = loading;
},
- // Vision Seed methods - always available regardless of Vue context
+ // Returns an error string when the current testseed state would be rejected,
+ // or "" when it's valid (empty == use defaults; full 4 positive ints == custom).
+ testseedError() {
+ if (!inModal.inbound || inModal.inbound.protocol !== Protocols.VLESS) return "";
+ if (typeof inModal.inbound.canEnableVisionSeed === "function"
+ && !inModal.inbound.canEnableVisionSeed()) return "";
+ const seed = inModal.inbound.settings && inModal.inbound.settings.testseed;
+ if (!Array.isArray(seed) || seed.length === 0) return "";
+ const filled = seed.filter(v => v !== null && v !== undefined && v !== "");
+ if (filled.length === 0) return "";
+ if (seed.length !== 4 || filled.length !== 4 ||
+ !seed.every(v => Number.isInteger(v) && v > 0)) {
+ return "Provide exactly 4 positive integers or leave empty to use defaults.";
+ }
+ return "";
+ },
+ // Vision Seed helpers — always available regardless of Vue context
updateTestseed(index, value) {
- // Use inModal.inbound explicitly to ensure correct context
if (!inModal.inbound || !inModal.inbound.settings) return;
- // Ensure testseed is initialized
- if (
- !inModal.inbound.settings.testseed ||
- !Array.isArray(inModal.inbound.settings.testseed)
- ) {
- inModal.inbound.settings.testseed = [900, 500, 900, 256];
+ if (!Array.isArray(inModal.inbound.settings.testseed)) {
+ inModal.inbound.settings.testseed = [];
}
- // Ensure array has enough elements
- while (inModal.inbound.settings.testseed.length <= index) {
- inModal.inbound.settings.testseed.push(0);
+ const seed = inModal.inbound.settings.testseed;
+ while (seed.length <= index) seed.push(null);
+ seed[index] = value;
+ // If user cleared every slot, collapse back to empty so we omit testseed entirely.
+ if (seed.every(v => v === null || v === undefined || v === "")) {
+ inModal.inbound.settings.testseed = [];
}
- // Update value
- inModal.inbound.settings.testseed[index] = value;
},
setRandomTestseed() {
- // Use inModal.inbound explicitly to ensure correct context
if (!inModal.inbound || !inModal.inbound.settings) return;
- // Ensure testseed is initialized
- if (
- !inModal.inbound.settings.testseed ||
- !Array.isArray(inModal.inbound.settings.testseed) ||
- inModal.inbound.settings.testseed.length < 4
- ) {
- inModal.inbound.settings.testseed = [900, 500, 900, 256].slice();
- }
- // Create new array with random values
+ // Positive integers only (>=1) so the array passes validation and gets emitted.
inModal.inbound.settings.testseed = [
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
];
},
resetTestseed() {
- // Use inModal.inbound explicitly to ensure correct context
if (!inModal.inbound || !inModal.inbound.settings) return;
- // Reset testseed to default values
- inModal.inbound.settings.testseed = [900, 500, 900, 256].slice();
+ // Empty == "use server defaults [900, 500, 900, 256]"; placeholders show in the form.
+ inModal.inbound.settings.testseed = [];
},
});
@@ -170,27 +178,17 @@
});
}
},
- // Ensure testseed is always initialized when vision flow is enabled
+ // Keep testseed as a valid array reference for Vue reactivity while the user
+ // toggles flows — but do NOT auto-fill defaults. Empty means "use server defaults"
+ // and is the only way the form omits testseed from the outbound JSON.
"inModal.inbound.settings.vlesses": {
handler() {
if (
inModal.inbound.protocol === Protocols.VLESS &&
inModal.inbound.settings &&
- inModal.inbound.settings.vlesses
+ !Array.isArray(inModal.inbound.settings.testseed)
) {
- const hasVisionFlow = inModal.inbound.settings.vlesses.some(
- (c) =>
- c.flow === "xtls-rprx-vision" ||
- c.flow === "xtls-rprx-vision-udp443",
- );
- if (
- hasVisionFlow &&
- (!inModal.inbound.settings.testseed ||
- !Array.isArray(inModal.inbound.settings.testseed) ||
- inModal.inbound.settings.testseed.length < 4)
- ) {
- inModal.inbound.settings.testseed = [900, 500, 900, 256];
- }
+ inModal.inbound.settings.testseed = [];
}
},
deep: true,
@@ -304,12 +302,11 @@
this.inbound.stream.tls.echServerKeys = "";
this.inbound.stream.tls.settings.echConfigList = "";
},
- async getNewVlessEnc() {
- const selected = inModal.inbound.settings.selectedAuth;
- if (!selected) {
- this.clearVlessEnc();
- return;
- }
+ // Pulls the requested auth block from `xray vlessenc` (which always returns
+ // both X25519 and ML-KEM-768 variants) and applies it to the inbound's
+ // decryption/encryption strings. The auth mode is implied by the resulting
+ async getNewVlessEnc(authLabel) {
+ if (!authLabel) return;
inModal.loading(true);
const msg = await HttpUtil.get("/panel/api/server/getNewVlessEnc");
@@ -320,10 +317,10 @@
}
const auths = msg.obj.auths || [];
- const block = auths.find((a) => a.label === selected);
+ const block = auths.find((a) => a.label === authLabel);
if (!block) {
- console.error("No auth block for", selected);
+ console.error("No auth block for", authLabel);
return;
}
@@ -333,37 +330,37 @@
clearVlessEnc() {
this.inbound.settings.decryption = "none";
this.inbound.settings.encryption = "none";
- this.inbound.settings.selectedAuth = undefined;
},
- // Vision Seed methods - must be in Vue methods for proper binding
+ // Vision Seed methods - must be in Vue methods for proper template binding.
+ // Mirror the inModal helpers but use Vue.set so the form re-renders.
updateTestseed(index, value) {
- // Ensure testseed is initialized
- if (
- !this.inbound.settings.testseed ||
- !Array.isArray(this.inbound.settings.testseed)
- ) {
- this.$set(this.inbound.settings, "testseed", [900, 500, 900, 256]);
+ if (!Array.isArray(this.inbound.settings.testseed)) {
+ this.$set(this.inbound.settings, "testseed", []);
}
- // Ensure array has enough elements
- while (this.inbound.settings.testseed.length <= index) {
- this.inbound.settings.testseed.push(0);
+ const seed = this.inbound.settings.testseed;
+ while (seed.length <= index) seed.push(null);
+ this.$set(seed, index, value);
+ // Collapse to empty when every slot is cleared so testseed is omitted from JSON.
+ if (seed.every(v => v === null || v === undefined || v === "")) {
+ this.$set(this.inbound.settings, "testseed", []);
}
- // Update value using Vue.set for reactivity
- this.$set(this.inbound.settings.testseed, index, value);
},
setRandomTestseed() {
- // Create new array with random values and use Vue.set for reactivity
+ // Positive integers only (>=1) so the resulting array passes validation.
const newSeed = [
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
- Math.floor(Math.random() * 1000),
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
+ Math.floor(Math.random() * 999) + 1,
];
this.$set(this.inbound.settings, "testseed", newSeed);
},
resetTestseed() {
- // Reset testseed to default values using Vue.set for reactivity
- this.$set(this.inbound.settings, "testseed", [900, 500, 900, 256]);
+ // Empty == "use server defaults [900, 500, 900, 256]". Placeholders will show in the form.
+ this.$set(this.inbound.settings, "testseed", []);
+ },
+ testseedError() {
+ return inModal.testseedError();
},
},
});
diff --git a/web/html/modals/xray_outbound_modal.html b/web/html/modals/xray_outbound_modal.html
index eb536be3..16b6417a 100644
--- a/web/html/modals/xray_outbound_modal.html
+++ b/web/html/modals/xray_outbound_modal.html
@@ -104,6 +104,17 @@
return outModal.outbound;
},
},
+ watch: {
+ // xray-core's SplitHTTPConfig.Build() rejects "GET" as
+ // uplinkHTTPMethod outside packet-up mode. Clear the field
+ // instead of carrying an invalid combination through.
+ "outModal.outbound.stream.xhttp.mode"(newMode) {
+ const xhttp = outModal.outbound.stream && outModal.outbound.stream.xhttp;
+ if (xhttp && xhttp.uplinkHTTPMethod === "GET" && newMode !== "packet-up") {
+ xhttp.uplinkHTTPMethod = "";
+ }
+ },
+ },
methods: {
streamNetworkChange() {
if (this.outModal.outbound.protocol == Protocols.VLESS && !outModal.outbound
diff --git a/web/job/check_client_ip_job.go b/web/job/check_client_ip_job.go
index 7f0ac2cf..e16cced2 100644
--- a/web/job/check_client_ip_job.go
+++ b/web/job/check_client_ip_job.go
@@ -403,16 +403,6 @@ func (j *CheckClientIpJob) updateInboundClientIps(inboundClientIps *model.Inboun
shouldCleanLog := false
j.disAllowedIps = []string{}
- // Open log file
- logIpFile, err := os.OpenFile(xray.GetIPLimitLogPath(), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)
- if err != nil {
- logger.Errorf("failed to open IP limit log file: %s", err)
- return false
- }
- defer logIpFile.Close()
- log.SetOutput(logIpFile)
- log.SetFlags(log.LstdFlags)
-
// historical db-only ips are excluded from this count on purpose.
var keptLive []IPWithTimestamp
if len(liveIps) > limitIp {
@@ -422,13 +412,25 @@ func (j *CheckClientIpJob) updateInboundClientIps(inboundClientIps *model.Inboun
keptLive = liveIps[:limitIp]
bannedLive := liveIps[limitIp:]
+ // Open log file only when a ban entry needs to be written.
+ // Use a local logger to avoid mutating the global log.* state,
+ // which would redirect all standard-library logging to this file
+ // and leave a dangling closed-file handle after the defer fires.
+ logIpFile, err := os.OpenFile(xray.GetIPLimitLogPath(), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)
+ if err != nil {
+ logger.Errorf("failed to open IP limit log file: %s", err)
+ return false
+ }
+ defer logIpFile.Close()
+ ipLogger := log.New(logIpFile, "", log.LstdFlags)
+
// log format is load-bearing: x-ui.sh create_iplimit_jails builds
// filter.d/3x-ipl.conf with
// failregex = \[LIMIT_IP\]\s*Email\s*=\s*.+\s*\|\|\s*Disconnecting OLD IP\s*=\s*\s*\|\|\s*Timestamp\s*=\s*\d+
// don't change the wording.
for _, ipTime := range bannedLive {
j.disAllowedIps = append(j.disAllowedIps, ipTime.IP)
- log.Printf("[LIMIT_IP] Email = %s || Disconnecting OLD IP = %s || Timestamp = %d", clientEmail, ipTime.IP, ipTime.Timestamp)
+ ipLogger.Printf("[LIMIT_IP] Email = %s || Disconnecting OLD IP = %s || Timestamp = %d", clientEmail, ipTime.IP, ipTime.Timestamp)
}
// force xray to drop existing connections from banned ips
diff --git a/web/service/inbound.go b/web/service/inbound.go
index b3a6b945..c99843b3 100644
--- a/web/service/inbound.go
+++ b/web/service/inbound.go
@@ -1213,6 +1213,28 @@ func (s *InboundService) UpdateInboundClient(data *model.Inbound, clientId strin
settingsClients[clientIndex] = interfaceClients[0]
oldSettings["clients"] = settingsClients
+ // testseed is only meaningful when at least one VLESS client uses the exact
+ // xtls-rprx-vision flow. The client-edit path only rewrites a single client,
+ // so re-check the flow set here and strip a stale testseed when nothing in the
+ // inbound still warrants it. The full-inbound update path already handles this
+ // on the JS side via VLESSSettings.toJson().
+ if oldInbound.Protocol == model.VLESS {
+ hasVisionFlow := false
+ for _, c := range settingsClients {
+ cm, ok := c.(map[string]any)
+ if !ok {
+ continue
+ }
+ if flow, _ := cm["flow"].(string); flow == "xtls-rprx-vision" {
+ hasVisionFlow = true
+ break
+ }
+ }
+ if !hasVisionFlow {
+ delete(oldSettings, "testseed")
+ }
+ }
+
newSettings, err := json.MarshalIndent(oldSettings, "", " ")
if err != nil {
return false, err
@@ -2885,6 +2907,7 @@ func (s *InboundService) MigrationRequirements() {
if ok {
// Fix Client configuration problems
var newClients []any
+ hasVisionFlow := false
for client_index := range clients {
c := clients[client_index].(map[string]any)
@@ -2910,6 +2933,9 @@ func (s *InboundService) MigrationRequirements() {
c["flow"] = ""
}
}
+ if flow, _ := c["flow"].(string); flow == "xtls-rprx-vision" {
+ hasVisionFlow = true
+ }
// Backfill created_at and updated_at
if _, ok := c["created_at"]; !ok {
c["created_at"] = time.Now().Unix() * 1000
@@ -2918,6 +2944,15 @@ func (s *InboundService) MigrationRequirements() {
newClients = append(newClients, any(c))
}
settings["clients"] = newClients
+
+ // Drop orphaned testseed: VLESS-only field, only meaningful when at least
+ // one client uses the exact xtls-rprx-vision flow. Older versions saved it
+ // for any non-empty flow (including the UDP variant) or kept it after the
+ // flow was cleared from the client modal — clean those up here.
+ if inbounds[inbound_index].Protocol == model.VLESS && !hasVisionFlow {
+ delete(settings, "testseed")
+ }
+
modifiedSettings, err := json.MarshalIndent(settings, "", " ")
if err != nil {
return
diff --git a/x-ui.sh b/x-ui.sh
index 73e99195..31ecc683 100644
--- a/x-ui.sh
+++ b/x-ui.sh
@@ -2034,14 +2034,14 @@ backend=auto
filter=3x-ipl
action=3x-ipl
logpath=${iplimit_log_path}
-maxretry=2
+maxretry=1
findtime=32
bantime=${bantime}m
EOF
cat << EOF > /etc/fail2ban/filter.d/3x-ipl.conf
[Definition]
-datepattern = ^%%Y/%%m/%%d %%H:%%M:%%S
+datepattern = ^%Y/%m/%d %H:%M:%S
failregex = \[LIMIT_IP\]\s*Email\s*=\s*.+\s*\|\|\s*Disconnecting OLD IP\s*=\s*\s*\|\|\s*Timestamp\s*=\s*\d+
ignoreregex =
EOF
@@ -2062,10 +2062,10 @@ actionstop = -D -p -j f2b-
actioncheck = -n -L | grep -q 'f2b-[ \t]'
actionban = -I f2b- 1 -s -j
- echo "\$(date +"%%Y/%%m/%%d %%H:%%M:%%S") BAN [Email] = [IP] = banned for seconds." >> ${iplimit_banned_log_path}
+ echo "\$(date +"%Y/%m/%d %H:%M:%S") BAN [Email] = [IP] = banned for seconds." >> ${iplimit_banned_log_path}
actionunban = -D f2b- -s -j
- echo "\$(date +"%%Y/%%m/%%d %%H:%%M:%%S") UNBAN [Email] = [IP] = unbanned." >> ${iplimit_banned_log_path}
+ echo "\$(date +"%Y/%m/%d %H:%M:%S") UNBAN [Email] = [IP] = unbanned." >> ${iplimit_banned_log_path}
[Init]
name = default