Skip to content
This repository has been archived by the owner on Mar 17, 2024. It is now read-only.

[Feature Request]nginx前置,vless+ws无法使用unix domain socket监听,希望生成的socket文件权限自动改为0666 #160

Closed
yy1984 opened this issue Oct 11, 2022 · 12 comments

Comments

@yy1984
Copy link

yy1984 commented Oct 11, 2022

Describe the bug【描述 bug】
nginx前置,vless+ws无法使用unix domain socket监听
希望生成的socket文件权限自动改为0666

To Reproduce【如何复现该bug】
见下面的配置文件,特别是注释部分
如果换xray监听"/dev/shm/vs.socket,0666",能正常连接
如果同时修改verysimple和nginx的配置文件,用IP:PORT监听,其他都不变,也能正常连接
只有verysimple也用socket时,nginx报错502

Expected behavior【预期的行为】
Ngnix分流后能正常传递数据到verysimple的socket

Envs (please complete the following information):【系统环境】

Config file 【配置文件,客户端服务端配置都提供】
服务端文件server.toml

[[listen]]
tag = "vless"
protocol = "vless"
uuid = "25964fbc-xxxx-xxxx-xxxxxxxxxxxxxxxxx"
network = "unix"
host = "/dev/shm/vs.socket"
#host = "127.0.0.1"
#port = 2000
advancedLayer = "ws"
path = "/webmail"

[[dial]]
protocol = "direct"

Ngnix配置文件 nginx.conf

location /webmail {
	proxy_redirect off;
	proxy_pass http://unix:/dev/shm/vs.socket;
	#proxy_pass http://127.0.0.1:2000;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";
	proxy_set_header Host $http_host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_connect_timeout 60s;
	proxy_read_timeout 86400s;
	proxy_send_timeout 60s;
}

Debug Log 【Debug日志, 客户端 和 服务端 的 日志 都提供】
Verysimple没有接收到数据,也就没有日志

Other 【其他】

【注意,配置文件和客户端服务端配置 太长的话,前后加上三个 `, 如 ```】

@yy1984 yy1984 added the bug Something isn't working label Oct 11, 2022
@SakuraSakuraSakuraChan
Copy link

502是因为nginx没法传给unix socket,如果你的VS是root用户,那nginx也需要是root用户,在conf里配置一下

@yy1984
Copy link
Author

yy1984 commented Oct 11, 2022

我这里是以nobody身份运行的
xray可以在监听地址后面设置0666权限,nobody用户运行也能跟nginx通信

我将vs改为www-data用户,nginx也是www-data,同样不能通信

@SakuraSakuraSakuraChan
Copy link

我不知道你这个www-data是什么情况,反正我按照你上边的配置试了一下也是502,然后把nginx改成root就正常通了,你如果就是不用root用户的话那试试chmod命令改一下权限

@yy1984
Copy link
Author

yy1984 commented Oct 12, 2022

那能否改成想xray一样,监听时权限自动改为0666?
"/dev/shm/vs.socket,0666"

@yy1984 yy1984 changed the title [Bug]nginx前置,vless+ws无法使用unix domain socket监听 [Feature Request]nginx前置,vless+ws无法使用unix domain socket监听,希望生成的socket文件权限自动改为0666 Oct 13, 2022
@yy1984
Copy link
Author

yy1984 commented Oct 14, 2022

这个问题我遇到过 是启动先后顺序的问题 如果nginx先启动创建了unt,vs就提示占用,vs先启动就没事,唯一的解决办法就是docker-compose全家桶 配置nginx依赖于vs后面启动,这个问题是通病

这个是权限问题
我观察了mysql、php、nginx的socket文件,都不是root用户,但文件权限是660甚至777,各进程之间都能正常通讯
root@yy:/var/run/mysqld# ls -l
total 4
-rw-rw---- 1 mysql mysql 4 Jul 4 08:31 mysqld.pid
srwxrwxrwx 1 mysql mysql 0 Jul 4 08:31 mysqld.sock
root@yy:/var/run/php# ls -l
total 4
lrwxrwxrwx 1 root root 30 Jul 4 08:31 php-fpm.sock -> /etc/alternatives/php-fpm.sock
-rw-r--r-- 1 root root 4 Oct 13 20:53 php7.4-fpm.pid
srw-rw---- 1 www-data www-data 0 Oct 13 20:53 php7.4-fpm.sock

所以只要在vs创建socket时自动将权限改为0666就可以了

@e1732a364fed
Copy link
Owner

收到。

@e1732a364fed e1732a364fed added feature request and removed bug Something isn't working labels Oct 31, 2022
@e1732a364fed
Copy link
Owner

e1732a364fed commented Oct 31, 2022

把相关知识放在这里:

rwxrwxrwx
111 111 111
 7   7   7
rw-rw-rw-
110 110 110
 6 6 6

解决办法

golang/go#11822

@yy1984
Copy link
Author

yy1984 commented Nov 4, 2022

===============================
verysimple v1.2.4-beta.6, go1.18.7 linux amd64, with advLayer packages: [ws grpcSimple quic]
===============================
A very simple implementation of V2Ray with some innovation
===============================
Log Level:2
UseReadv:true
panic: uc.underlayIsBasic, but can't cast to ReadFrom

goroutine 9 [running]:
github.com/e1732a364fed/v2ray_simple/netLayer.TryReadFrom_withSplice({0xd1c420, 0xc000223ce0}, {0xd24eb8?, 0xc00006cb40}, {0xd1cd80, 0xc00000e2b8}, 0xc0000d1b40)
        github.com/e1732a364fed/v2ray_simple/netLayer/splice.go:127 +0x625
github.com/e1732a364fed/v2ray_simple/proxy/vless.(*UserTCPConn).ReadFrom(0x7fd8d687e9e8?, {0xd1cd80?, 0xc00000e2b8?})
        github.com/e1732a364fed/v2ray_simple/proxy/vless/tcpconn.go:160 +0x59
io.copyBuffer({0xd1c420, 0xc000223ce0}, {0xd1cd80, 0xc00000e2b8}, {0x0, 0x0, 0x0})
        io/io.go:412 +0x14b
io.Copy(...)
        io/io.go:385
github.com/e1732a364fed/v2ray_simple/netLayer.TryCopy({0xd1c420?, 0xc000223ce0}, {0xd1cd80?, 0xc00000e2b8}, 0x89d65)
        github.com/e1732a364fed/v2ray_simple/netLayer/relay.go:169 +0xd4b
github.com/e1732a364fed/v2ray_simple/netLayer.Relay(0x89d65?, {0xd21f50, 0xc00000e2b8}, {0xd21650, 0xc000223ce0}, 0x89d65, 0x11f37c0, 0x11f37c8)
        github.com/e1732a364fed/v2ray_simple/netLayer/relay.go:290 +0x7a5
github.com/e1732a364fed/v2ray_simple.dialClient_andRelay({0x89d65, {0xd27488, 0xc00000e268}, {0xd24eb8, 0xc00006cb40}, {0xd291d8, 0xc0002462d0}, {0xd29ea0, 0xc0002463c0}, 0x0, ...}, ...)
        github.com/e1732a364fed/v2ray_simple/main.go:1521 +0x896
github.com/e1732a364fed/v2ray_simple.passToOutClient({0x89d65, {0xd27488, 0xc00000e268}, {0xd24eb8, 0xc00006cb40}, {0xd291d8, 0xc0002462d0}, {0xd29ea0, 0xc0002463c0}, 0x0, ...}, ...)
        github.com/e1732a364fed/v2ray_simple/main.go:971 +0x2c29
github.com/e1732a364fed/v2ray_simple.handshakeInserver_and_passToOutClient({0x89d65, {0xd27488, 0xc00000e268}, {0xd24eb8, 0xc00006cb40}, {0xd291d8, 0xc0002462d0}, {0xd29ea0, 0xc0002463c0}, 0x0, ...})
        github.com/e1732a364fed/v2ray_simple/main.go:521 +0x2a6
github.com/e1732a364fed/v2ray_simple.handleNewIncomeConnection({0xd291d8, 0xc0002462d0}, {0xd29ea0, 0xc0002463c0}, {0xd27488, 0xc00000e268}, 0x11c19e0)
        github.com/e1732a364fed/v2ray_simple/main.go:371 +0x1498
github.com/e1732a364fed/v2ray_simple.ListenSer.func2({0xd27488?, 0xc00000e268?})
        github.com/e1732a364fed/v2ray_simple/main.go:141 +0x45
created by github.com/e1732a364fed/v2ray_simple/netLayer.loopAccept
        github.com/e1732a364fed/v2ray_simple/netLayer/listen.go:63 +0x2cd

最新的1.2.4-beta6报错,是在verysimple通过socket收到nginx的数据后

@e1732a364fed
Copy link
Owner

原来unix 无法进行splice啊。一直搞错了,马上改。

e1732a364fed added a commit that referenced this issue Nov 4, 2022
这是一个古老的bug;过去一直认为unix可以用于splice,
这次重新查看资料才知道,只有tcp可以splice写入
@e1732a364fed
Copy link
Owner

修改了一下代码,请务必编译一下最新代码,试一下

@e1732a364fed
Copy link
Owner

最新代码又加了-ds命令行参数,如果还是会报错,可以临时用这个参数解决。

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants
@yy1984 @e1732a364fed @SakuraSakuraSakuraChan and others