scripts/meridian-recovery-lab/generate.go
Rama main · réplica de lectura del repositorio original.
//go:build ignore
package main
import (
"crypto/ecdh"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/x509"
"crypto/x509/pkix"
"encoding/base64"
"encoding/json"
"encoding/pem"
"math/big"
"os"
"strings"
"time"
m "github.com/petauron/glivela"
"github.com/petauron/vastora/internal/meridianruntime"
)
func must[T any](value T, err error) T {
if err != nil {
panic(err)
}
return value
}
func writeFile(path string, data []byte) {
if err := os.WriteFile(path, data, 0600); err != nil {
panic(err)
}
}
func main() {
if len(os.Args) != 2 {
panic("usage: generate.go LAB_DIRECTORY")
}
d := os.Args[1]
key := must(ecdh.X25519().GenerateKey(rand.Reader))
priv := must(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
pub := &priv.PublicKey
template := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "entry.example.test"}, DNSNames: []string{"entry.example.test"}, NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour), KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, BasicConstraintsValid: true}
der := must(x509.CreateCertificate(rand.Reader, template, template, pub, priv))
pkey := must(x509.MarshalPKCS8PrivateKey(priv))
cert := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))
certKey := string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkey}))
writeFile(d+"/cert.pem", []byte(cert))
writeFile(d+"/key.pem", []byte(certKey))
id := "00000000-0000-4000-8000-000000000001"
material := m.CredentialMaterial{Credential: m.Credential{ID: "native", AccountID: "account", EntryID: "entry", User: "lab", Kind: m.NativeCredential, Identity: m.Identity(id), Enabled: true}, ProtocolID: id}
artifact, err := m.BuildDesiredArtifact(m.XrayPlan{Revision: 1, RealityEndpoints: []m.RealityEndpoint{{ID: "entry", EntryID: "entry", InboundTag: "entry", ListenAddress: "192.168.241.2", ListenPort: m.RealityBackendPort, AdvertiseHost: "entry.example.test", AdvertisePort: 443, Target: "192.168.241.4:443", ServerNames: []string{"entry.example.test"}, PrivateKey: base64.RawURLEncoding.EncodeToString(key.Bytes()), PublicKey: base64.RawURLEncoding.EncodeToString(key.PublicKey().Bytes()), ShortIDs: []string{"0123456789abcdef"}, Fingerprint: "chrome"}}, Credentials: []m.CredentialMaterial{material, {Credential: m.Credential{ID: "fixed", AccountID: "account", EntryID: "entry", EgressID: "landing", User: "lab-fixed", Kind: m.RouteCredential, Identity: m.Identity("00000000-0000-4000-8000-000000000002"), Enabled: true}, ProtocolID: "00000000-0000-4000-8000-000000000002"}}, Peers: []m.RoutePeer{{EgressID: "landing", Address: "192.168.241.5", Port: 1080}}, Grants: []m.RouteGrant{{ID: "fixed-route", AccountID: "account", EntryID: "entry", EgressID: "landing", InboundTag: "entry", Base: material.Credential, Route: m.Credential{ID: "fixed", AccountID: "account", EntryID: "entry", EgressID: "landing", User: "lab-fixed", Kind: m.RouteCredential, Identity: m.Identity("00000000-0000-4000-8000-000000000002"), Enabled: true}, Mode: m.FixedMode, Enabled: true, DesiredRev: 1}}})
if err != nil {
panic(err)
}
writeFile(d+"/rendered.json", artifact.Config)
// Only this isolated fixture may reach its synthetic HTTP witness.
// Production private-destination restrictions remain unchanged.
var server map[string]any
if err := json.Unmarshal(artifact.Config, &server); err != nil {
panic(err)
}
direct := server["outbounds"].([]any)[0].(map[string]any)
if direct["protocol"] != "freedom" {
panic("unexpected direct outbound")
}
direct["settings"] = map[string]any{"finalRules": []any{map[string]any{"action": "allow", "network": "tcp", "ip": []string{"192.168.241.4/32"}, "port": "8080"}}}
fixture, err := json.MarshalIndent(server, "", " ")
if err != nil {
panic(err)
}
writeFile(d+"/server-initial.json", fixture)
// Preserve the exact runtime and business credentials; change only the
// replacement host's approved listen address in the isolated fixture.
writeFile(d+"/server-replacement.json", []byte(strings.ReplaceAll(string(fixture), "192.168.241.2", "192.168.241.7")))
write := func(name string, v any) { writeFile(d+"/"+name, must(json.MarshalIndent(v, "", " "))) }
public := m.RealityEndpoint{ID: "entry", EntryID: "entry", AdvertiseHost: "192.168.241.6", AdvertisePort: 443, ServerNames: []string{"entry.example.test"}, PublicKey: base64.RawURLEncoding.EncodeToString(key.PublicKey().Bytes()), ShortIDs: []string{"0123456789abcdef"}, Fingerprint: "chrome"}
for name, credential := range map[string]string{"native": id, "fixed": "00000000-0000-4000-8000-000000000002", "invalid": "00000000-0000-4000-8000-000000000003"} {
selected := material
selected.Credential.ID = name
selected.Credential.Identity = m.Identity(credential)
selected.ProtocolID = credential
if name == "fixed" {
selected.Credential.Kind = m.RouteCredential
selected.Credential.EgressID = "landing"
}
config := must((meridianruntime.AcceptanceClient{Protocol: m.VLESSReality, Reality: &public, Material: selected}).Config(1080))
writeFile(d+"/"+name+".json", config)
}
write("landing.json", map[string]any{"log": map[string]any{"loglevel": "none"}, "inbounds": []any{map[string]any{"listen": "0.0.0.0", "port": 1080, "protocol": "socks", "settings": map[string]any{"auth": "noauth"}}}, "outbounds": []any{map[string]any{"protocol": "freedom", "settings": map[string]any{"finalRules": []any{map[string]any{"action": "allow", "network": "tcp", "ip": []string{"192.168.241.4/32"}, "port": "8080"}}}}}})
}