From ff194d0098517960dac2d535132f98b39241a27f Mon Sep 17 00:00:00 2001 From: Whispering Wind <151555003+ReturnFI@users.noreply.github.com> Date: Mon, 21 Apr 2025 00:17:28 +0330 Subject: [PATCH] Changes: feat: Add SNI checker and certificate manager Key features: - Domain-to-IP resolution verification - Automatic Let's Encrypt certificate acquisition - Self-signed fallback for domains not pointed to the server - Updates insecure flag in config.json based on certificate type - Updates SNI in environment config - Generates and updates SHA-256 fingerprint fix(urls): Update URI generator to respect TLS insecure flag Changes: - Added insecure parameter to generate_uri() function - Read TLS insecure flag from config.json - Set insecure=0 for valid certificates and insecure=1 for self-signed ones - Updated all URI generation calls to include the insecure parameter --- core/scripts/hysteria2/change_sni.sh | 109 +++++++++++++++++------- core/scripts/hysteria2/show_user_uri.py | 16 ++-- 2 files changed, 89 insertions(+), 36 deletions(-) diff --git a/core/scripts/hysteria2/change_sni.sh b/core/scripts/hysteria2/change_sni.sh index 2f590ea..a00affb 100644 --- a/core/scripts/hysteria2/change_sni.sh +++ b/core/scripts/hysteria2/change_sni.sh @@ -1,44 +1,88 @@ #!/bin/bash -# Source the necessary paths source /etc/hysteria/core/scripts/path.sh +sni="$1" + +if [ -f "$CONFIG_ENV" ]; then + source "$CONFIG_ENV" +else + echo "Error: Config file $CONFIG_ENV not found." + exit 1 +fi update_sni() { local sni=$1 - + local server_ip + if [ -z "$sni" ]; then echo "Invalid SNI. Please provide a valid SNI." + echo "Example: $0 yourdomain.com" return 1 fi - cd /etc/hysteria/ || exit - rm -f ca.key ca.crt + if [ -n "$IP4" ]; then + server_ip="$IP4" + echo "Using server IP from config: $server_ip" + else + server_ip=$(curl -s ifconfig.me) + echo "Using auto-detected server IP: $server_ip" + fi - echo "Generating CA key and certificate for SNI: $sni ..." - openssl ecparam -genkey -name prime256v1 -out ca.key >/dev/null 2>&1 - openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/CN=$sni" >/dev/null 2>&1 + echo "Checking if $sni points to this server ($server_ip)..." + domain_ip=$(dig +short "$sni" A | head -n 1) + + if [ -z "$domain_ip" ]; then + echo "Warning: Could not resolve $sni to an IPv4 address." + use_certbot=false + elif [ "$domain_ip" = "$server_ip" ]; then + echo "Success: $sni correctly points to this server ($server_ip)." + use_certbot=true + else + echo "Notice: $sni points to $domain_ip, not to this server ($server_ip)." + use_certbot=false + fi + + cd /etc/hysteria/ || exit + + if [ "$use_certbot" = true ]; then + echo "Using certbot to obtain a valid certificate for $sni..." + + if certbot certificates | grep -q "$sni"; then + echo "Certificate for $sni already exists. Renewing..." + certbot renew --cert-name "$sni" + else + echo "Requesting new certificate for $sni..." + certbot certonly --standalone -d "$sni" --non-interactive --agree-tos --email admin@"$sni" + fi + + cp /etc/letsencrypt/live/"$sni"/fullchain.pem /etc/hysteria/ca.crt + cp /etc/letsencrypt/live/"$sni"/privkey.pem /etc/hysteria/ca.key + + echo "Certificates successfully installed from Let's Encrypt." + + if [ -f "$CONFIG_FILE" ]; then + jq '.tls.insecure = false' "$CONFIG_FILE" > "${CONFIG_FILE}.temp" && mv "${CONFIG_FILE}.temp" "$CONFIG_FILE" + echo "TLS insecure flag set to false in $CONFIG_FILE" + fi + else + echo "Using self-signed certificate with openssl for $sni..." + rm -f ca.key ca.crt + + echo "Generating CA key and certificate for SNI: $sni ..." + openssl ecparam -genkey -name prime256v1 -out ca.key >/dev/null 2>&1 + openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/CN=$sni" >/dev/null 2>&1 + echo "Self-signed certificate generated for $sni" + + if [ -f "$CONFIG_FILE" ]; then + jq '.tls.insecure = true' "$CONFIG_FILE" > "${CONFIG_FILE}.temp" && mv "${CONFIG_FILE}.temp" "$CONFIG_FILE" + echo "TLS insecure flag set to true in $CONFIG_FILE" + fi + fi + chown hysteria:hysteria /etc/hysteria/ca.key /etc/hysteria/ca.crt chmod 640 /etc/hysteria/ca.key /etc/hysteria/ca.crt + sha256=$(openssl x509 -noout -fingerprint -sha256 -inform pem -in ca.crt | sed 's/.*=//;s///g') - -# sha256=$(python3 - < /dev/null 2>&1 echo "Hysteria2 restarted successfully with new SNI: $sni." + + if [ "$use_certbot" = true ]; then + echo "✅ Valid Let's Encrypt certificate installed for $sni" + echo " TLS insecure mode is now DISABLED" + else + echo "⚠️ Self-signed certificate installed for $sni" + echo " TLS insecure mode is now ENABLED" + echo " (This certificate won't be trusted by browsers)" + fi } -update_sni "$1" +update_sni "$sni" \ No newline at end of file diff --git a/core/scripts/hysteria2/show_user_uri.py b/core/scripts/hysteria2/show_user_uri.py index b5c68e1..ff11d52 100644 --- a/core/scripts/hysteria2/show_user_uri.py +++ b/core/scripts/hysteria2/show_user_uri.py @@ -66,11 +66,10 @@ def is_service_active(service_name: str) -> bool: return False def generate_uri(username: str, auth_password: str, ip: str, port: str, - obfs_password: str, sha256: str, sni: str, ip_version: int) -> str: + obfs_password: str, sha256: str, sni: str, ip_version: int, insecure: bool) -> str: """Generate Hysteria2 URI for the given parameters.""" uri_base = f"hy2://{username}%3A{auth_password}@{ip}:{port}" - # Handle IPv6 address formatting if ip_version == 6 and re.match(r'^[0-9a-fA-F:]+$', ip): uri_base = f"hy2://{username}%3A{auth_password}@[{ip}]:{port}" @@ -82,7 +81,8 @@ def generate_uri(username: str, auth_password: str, ip: str, port: str, if sha256: params.append(f"pinSHA256={sha256}") - params.append(f"insecure=1&sni={sni}") + insecure_value = "1" if insecure else "0" + params.append(f"insecure={insecure_value}&sni={sni}") params_str = "&".join(params) return f"{uri_base}?{params_str}#{username}-IPv{ip_version}" @@ -138,6 +138,8 @@ def show_uri(args: argparse.Namespace) -> None: sha256 = config.get("tls", {}).get("pinSHA256", "") obfs_password = config.get("obfs", {}).get("salamander", {}).get("password", "") + insecure = config.get("tls", {}).get("insecure", True) + ip4, ip6, sni = load_hysteria2_ips() available_ip4 = ip4 and ip4 != "None" available_ip6 = ip6 and ip6 != "None" @@ -148,21 +150,21 @@ def show_uri(args: argparse.Namespace) -> None: if args.all: if available_ip4: uri_ipv4 = generate_uri(args.username, auth_password, ip4, port, - obfs_password, sha256, sni, 4) + obfs_password, sha256, sni, 4, insecure) print(f"\nIPv4:\n{uri_ipv4}\n") if available_ip6: uri_ipv6 = generate_uri(args.username, auth_password, ip6, port, - obfs_password, sha256, sni, 6) + obfs_password, sha256, sni, 6, insecure) print(f"\nIPv6:\n{uri_ipv6}\n") else: if args.ip_version == 4 and available_ip4: uri_ipv4 = generate_uri(args.username, auth_password, ip4, port, - obfs_password, sha256, sni, 4) + obfs_password, sha256, sni, 4, insecure) print(f"\nIPv4:\n{uri_ipv4}\n") elif args.ip_version == 6 and available_ip6: uri_ipv6 = generate_uri(args.username, auth_password, ip6, port, - obfs_password, sha256, sni, 6) + obfs_password, sha256, sni, 6, insecure) print(f"\nIPv6:\n{uri_ipv6}\n") else: print("Invalid IP version or no available IP for the requested version.")