3x-ui/web/service
reza 2562e2eb82 feat(socks): complete backend integration for SOCKS5 inbound
Wraps up the 'help wanted' backend items from the SOCKS5 scaffold PR
(#4452) so the dedicated socks inbound is a fully functional protocol
end-to-end, not just a model constant.

xray/api.go AddUser
-------------------
Live add-user via the gRPC HandlerService now handles 'socks' and
'http' as first-class protocols. Previously these fell through the
default branch and returned nil, so adding a new password-mode account
to a running socks/http inbound silently required a full xray restart.

- New 'socks' case constructs a proxy/socks.Account{Username, Password}
  from the panel-side map keys 'user' and 'pass' (matching how
  Inbound.SocksSettings.SocksAccount serialises in
  frontend/src/models/inbound.js). Username is required, password is
  optional so a no-pass account is still expressible if Xray ever
  allows it on a specific build.
- New 'http' case mirrors the same shape via proxy/http.Account.
  The dedicated HTTP inbound isn't surfaced standalone in the panel
  UI yet, but the runtime API is symmetric with socks and several
  follow-up plans (e.g. exposing HTTP as a separate inbound) become
  one-line UI work instead of a backend refactor.

Both branches reuse the existing getRequiredUserString /
getOptionalUserString helpers, so a malformed userMap surfaces the
same typed error message as the vless / vmess paths above.

web/service/port_conflict.go
----------------------------
inboundTransports() now folds 'socks' into the same branch that already
handles 'mixed': settings.udp=true means the inbound holds both tcp and
udp on the listening port (socks5 UDP ASSOCIATE), settings.udp=false
keeps it tcp-only. Without this, a socks+udp inbound would silently be
classified as tcp-only and the validator would let a hysteria2 udp
inbound coexist with it on the same port — both processes would then
race for the udp socket at xray start, with one of them quietly failing.

The two protocols share the exact same settings JSON shape for this
field (it's the same proxy/socks server type under the hood), so the
sane thing is to merge the case clauses rather than copy/paste the
type-assertion. Comment updated to spell out why.

web/service/tgbot.go
--------------------
Add model.Socks to the excludedProtocols set in getInboundsAddClient
so the Telegram bot doesn't offer a dedicated SOCKS inbound when the
admin asks 'add a client to which inbound?'. SOCKS inbounds, like
Mixed/HTTP, don't produce a per-client subscription URL (see the
existing link-less branch in sub/subService.go::GetLink), so any
client attached via the bot would have no way to actually subscribe.
Added a header comment explaining the criterion so future protocols
fall into the right bucket without an audit.

Tests
-----
web/service/port_conflict_test.go gains four cases that pin the new
behaviour at the transport-bits level (TestInboundTransports):
  - socks + udp=true  -> tcp|udp (matches Mixed)
  - socks + udp=false -> tcp only
  - socks + missing settings -> tcp only
  - socks + empty settings   -> tcp only

…plus two end-to-end conflict checks that mirror the existing
shadowsocks/mixed coverage:
  - TestCheckPortConflict_SocksUDPBlocksUDPNeighbour: a socks+udp
    inbound on port N must clash with a hysteria2/udp on the same
    port. Catches a regression where the Socks branch is dropped
    from inboundTransports.
  - TestCheckPortConflict_SocksTCPCoexistsWithUDPNeighbour: a
    socks-tcp-only inbound must still let a hysteria2/udp neighbour
    bind the same port. Mirrors the #4103 vless+hysteria2 coexistence
    case.

Out-of-scope (still tracked in the PR description)
--------------------------------------------------
- Sub-link generation (sub/subService.go GetLink): SOCKS deliberately
  stays link-less for the reasons documented in the previous commit;
  no socks:// scheme is consistently understood across xray/v2ray
  client ecosystems.
- Routing UI: routing rules in this fork already accept any inbound
  tag, so SOCKS inbounds are routable as-is. A dedicated
  'protocol == socks' helper in the routing rule editor is a UX
  follow-up, not a correctness gap.
- Translations: protocol labels are rendered raw in this fork; no
  per-locale label key exists for vmess/vless/mixed either, so adding
  one only for socks would be inconsistent.
2026-05-25 15:05:20 +00:00
..
api_token.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
config.json feat(inbounds): align tunnel, tun, and hysteria UI with Xray docs 2026-05-13 22:44:08 +02:00
custom_geo.go fix(security): SSRF-guard node and remote HTTP clients 2026-05-13 13:33:53 +02:00
custom_geo_test.go v3 2026-05-10 02:13:42 +02:00
inbound.go fix(inbounds): don't delete remote inbound when toggling enable 2026-05-15 12:43:16 +02:00
metric_history.go feat(panel): xray metrics dashboard with observatory probe history 2026-05-12 02:17:45 +02:00
node.go fix(security): SSRF-guard node and remote HTTP clients 2026-05-13 13:33:53 +02:00
nord.go feat(xray/nord): searchable server list + colored load tag, surface API errors 2026-05-11 10:06:01 +02:00
outbound.go fix(outbound): probe UDP-based outbounds over UDP instead of TCP 2026-05-15 12:29:53 +02:00
panel.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
panel_other.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
panel_test.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
panel_unix.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
port_conflict.go feat(socks): complete backend integration for SOCKS5 inbound 2026-05-25 15:05:20 +00:00
port_conflict_test.go feat(socks): complete backend integration for SOCKS5 inbound 2026-05-25 15:05:20 +00:00
server.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
server_vlessenc_test.go Feat: clarify VLESS encryption auth selection (#4271) 2026-05-12 11:39:28 +02:00
setting.go Add possibility to remove client email from sub (#4297) 2026-05-13 19:04:17 +02:00
setting_security_test.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
tgbot.go feat(socks): complete backend integration for SOCKS5 inbound 2026-05-25 15:05:20 +00:00
tgbot_test.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
traffic_writer.go Fix: traffic writer restart freeze (#4265) 2026-05-12 11:36:05 +02:00
traffic_writer_test.go Fix: traffic writer restart freeze (#4265) 2026-05-12 11:36:05 +02:00
url_safety.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
user.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
warp.go fix(warp): set license against Cloudflare API and surface errors inline 2026-05-13 21:13:16 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray.go fix(nodes): bind form-encoded posts and skip node inbounds in central xray 2026-05-10 11:32:06 +02:00
xray_metrics.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xray_setting.go v3 2026-05-10 02:13:42 +02:00
xray_setting_test.go xray-setting: pin api routing rule to index 0 on save (#4124) 2026-04-28 17:49:39 +02:00