test2/Amnezia-Web-Panel-main
Template
1
2
Fork 1
Code Issues Pull Requests Packages Projects Releases 18 Wiki Activity

Fix cascade silent dead internet with per-step settings and handshake checks.

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
orohi
2026-07-26 06:46:02 +03:00
co-authored by Cursor
parent 8fa7f27223
commit 7230697b7f
5 changed files with 434 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
managers/cascade_manager.py
+199 -45
View File
@@ -12,11 +12,50 @@ from __future__ import annotations
import re
import shlex
from datetime import datetime
from typing import Any, Optional
WG_FAMILY = {'awg', 'awg2', 'awg_legacy', 'wireguard'}
CASCADE_MARKER = '# amnezia-web-panel-cascade'
DEFAULT_SETTINGS = {
'pin_exit_route': True, # host route to exit IP via real gateway
'remove_eth_masquerade': True, # stop NATing VPN clients out entry eth0/eth1
'force_forward': True, # FORWARD accept between awg0/wg0 and cascade
'mss_clamp': True, # fix broken TCP / endless page load
'wait_handshake': True, # fail if exit tunnel has no handshake
'handshake_timeout_sec': 25,
'allowed_ips': '0.0.0.0/0, ::/0',
'keep_exit_dns': False, # keep DNS= from exit client config
'vpn_subnet_override': '', # e.g. 10.8.1.0/24; empty = auto
'table_id': 200,
'rule_priority': 100,
}
def normalize_settings(raw: Optional[dict]) -> dict:
settings = dict(DEFAULT_SETTINGS)
if isinstance(raw, dict):
for key, default in DEFAULT_SETTINGS.items():
if key not in raw or raw[key] is None:
continue
if isinstance(default, bool):
settings[key] = bool(raw[key])
elif isinstance(default, int):
try:
settings[key] = int(raw[key])
except (TypeError, ValueError):
settings[key] = default
else:
settings[key] = str(raw[key]).strip()
# Sanity clamps
settings['handshake_timeout_sec'] = max(5, min(120, int(settings['handshake_timeout_sec'])))
settings['table_id'] = max(1, min(252, int(settings['table_id'])))
settings['rule_priority'] = max(1, min(32765, int(settings['rule_priority'])))
if not settings.get('allowed_ips'):
settings['allowed_ips'] = DEFAULT_SETTINGS['allowed_ips']
return settings
class CascadeManager:
def __init__(self, ssh_manager):
@@ -76,20 +115,27 @@ class CascadeManager:
return '/opt/amnezia/awg/awg0.conf'
@staticmethod
def prepare_exit_client_config(raw_config: str, endpoint_host: str) -> str:
def prepare_exit_client_config(
raw_config: str,
endpoint_host: str,
*,
keep_dns: bool = False,
allowed_ips: str = '0.0.0.0/0, ::/0',
) -> str:
"""Adapt a normal client config for use as an entry→exit cascade tunnel."""
lines = []
in_interface = False
in_peer = False
has_table = False
for raw in (raw_config or '').splitlines():
line = raw.rstrip('\n')
stripped = line.strip()
stripped = raw.strip()
lower = stripped.lower()
if stripped.startswith('[') and stripped.endswith(']'):
in_interface = stripped.lower() == '[interface]'
in_peer = stripped.lower() == '[peer]'
lines.append(stripped)
continue
if in_interface and lower.startswith('dns'):
if in_interface and lower.startswith('dns') and not keep_dns:
continue
if in_interface and lower.startswith('table'):
has_table = True
@@ -107,6 +153,9 @@ class CascadeManager:
else:
lines.append(stripped)
continue
if in_peer and lower.startswith('allowedips'):
lines.append(f'AllowedIPs = {allowed_ips}')
continue
lines.append(stripped)
if not has_table:
@@ -131,29 +180,44 @@ class CascadeManager:
def status(self, entry_protocol: str) -> dict:
container = self._container_name(entry_protocol)
if not container:
return {'enabled': False, 'up': False, 'error': 'Unsupported protocol'}
return {'enabled': False, 'up': False, 'handshake': False, 'error': 'Unsupported protocol'}
conf = self._cascade_conf(entry_protocol)
wg_bin = self._wg_binary(entry_protocol)
out, _, _ = self.ssh.run_sudo_command(
f"docker exec {shlex.quote(container)} bash -lc "
f"'test -f {shlex.quote(conf)} && echo HAS_CONF; "
f"ip -o link show cascade 2>/dev/null | head -1; "
f"{wg_bin} show interfaces 2>/dev/null'"
f"'echo HAS=$(test -f {shlex.quote(conf)} && echo 1 || echo 0); "
f"echo IFACES=$({wg_bin} show interfaces 2>/dev/null); "
f"echo HANDSHAKE=$({wg_bin} show cascade latest-handshakes 2>/dev/null | awk \"{{print \\$2}}\" | head -1); "
f"echo TRANSFER=$({wg_bin} show cascade transfer 2>/dev/null | head -1); "
f"ip rule show 2>/dev/null | head -20; "
f"ip route show table 200 2>/dev/null | head -10'"
)
text = out or ''
ifaces = []
has_conf = 'HAS=1' in text
ifaces_line = ''
handshake_ts = 0
for line in text.splitlines():
if line.strip() == 'HAS_CONF':
continue
ifaces.extend(line.split())
up = 'cascade' in ifaces or bool(re.search(r'\bcascade\b', text))
if line.startswith('IFACES='):
ifaces_line = line.split('=', 1)[1].strip()
if line.startswith('HANDSHAKE='):
try:
handshake_ts = int(line.split('=', 1)[1].strip() or '0')
except ValueError:
handshake_ts = 0
up = 'cascade' in ifaces_line.split()
# WireGuard reports unix timestamp; 0 means never
handshake_ok = handshake_ts > 0
return {
'enabled': 'HAS_CONF' in text,
'enabled': has_conf,
'up': up,
'raw': text.strip()[:2000],
'handshake': handshake_ok,
'handshake_ts': handshake_ts,
'raw': text.strip()[:3000],
}
def _vpn_subnet(self, entry_protocol: str, container: str) -> str:
def _vpn_subnet(self, entry_protocol: str, container: str, override: str = '') -> str:
if override and re.match(r'^\d+\.\d+\.\d+\.\d+/\d+$', override.strip()):
return override.strip()
conf = self._server_conf(entry_protocol)
out, _, _ = self.ssh.run_sudo_command(
f"docker exec {shlex.quote(container)} bash -lc "
@@ -173,7 +237,14 @@ class CascadeManager:
return f"{parts[0]}.{parts[1]}.{parts[2]}.0/24"
return '10.8.1.0/24'
def apply(self, entry_protocol: str, exit_client_config: str, exit_host: str) -> dict:
def apply(
self,
entry_protocol: str,
exit_client_config: str,
exit_host: str,
settings: Optional[dict] = None,
) -> dict:
opts = normalize_settings(settings)
container = self._container_name(entry_protocol)
if not container:
return {'status': 'error', 'message': 'Unsupported entry protocol'}
@@ -186,12 +257,87 @@ class CascadeManager:
cascade_conf_path = self._cascade_conf(entry_protocol)
cascade_up_path = self._cascade_up(entry_protocol)
cascade_conf = self.prepare_exit_client_config(exit_client_config, exit_host)
cascade_conf = self.prepare_exit_client_config(
exit_client_config,
exit_host,
keep_dns=bool(opts['keep_exit_dns']),
allowed_ips=str(opts['allowed_ips']),
)
endpoint_host = self._extract_endpoint_host(cascade_conf) or exit_host
subnet = self._vpn_subnet(entry_protocol, container)
subnet = self._vpn_subnet(entry_protocol, container, opts.get('vpn_subnet_override') or '')
wg_bin = self._wg_binary(entry_protocol)
quick_bin = self._quick_binary(entry_protocol)
conf_dir = self._conf_dir(entry_protocol)
table_id = int(opts['table_id'])
prio = int(opts['rule_priority'])
hs_timeout = int(opts['handshake_timeout_sec'])
pin_block = ''
if opts['pin_exit_route']:
pin_block = f"""
EXIT_IP="$EXIT_HOST"
if ! printf '%s' "$EXIT_IP" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'; then
EXIT_IP=$(getent ahostsv4 "$EXIT_HOST" 2>/dev/null | awk '{{print $1; exit}}')
if [ -z "$EXIT_IP" ]; then
EXIT_IP=$(python3 - <<'PY' 2>/dev/null || true
import socket
print(socket.gethostbyname("{endpoint_host}"))
PY
)
fi
fi
GW=$(ip route | awk '/default/ {{print $3; exit}}')
DEV=$(ip route | awk '/default/ {{print $5; exit}}')
if [ -n "$EXIT_IP" ] && [ -n "$GW" ] && [ -n "$DEV" ]; then
ip route replace "$EXIT_IP/32" via "$GW" dev "$DEV" 2>/dev/null || true
fi
"""
remove_masq = ''
if opts['remove_eth_masquerade']:
remove_masq = f"""
# Stop leaking VPN clients out of the entry server NIC
for ETH in eth0 eth1 eth2 ens3 ens5 enp0s3 enp1s0; do
while iptables -t nat -D POSTROUTING -s "$SUBNET" -o "$ETH" -j MASQUERADE 2>/dev/null; do :; done
done
"""
forward_block = ''
if opts['force_forward']:
forward_block = f"""
sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
for SRC_IF in awg0 wg0; do
iptables -C FORWARD -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null \\
|| iptables -I FORWARD 1 -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null || true
iptables -C FORWARD -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null \\
|| iptables -I FORWARD 1 -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null || true
done
iptables -C FORWARD -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \\
|| iptables -I FORWARD 1 -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
"""
mss_block = ''
if opts['mss_clamp']:
mss_block = """
iptables -t mangle -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null \\
|| iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
"""
handshake_block = ''
if opts['wait_handshake']:
handshake_block = f"""
OK=0
for i in $(seq 1 {hs_timeout}); do
HS=$({shlex.quote(wg_bin)} show "$IFACE" latest-handshakes 2>/dev/null | awk '{{print $2}}' | head -1)
if [ -n "$HS" ] && [ "$HS" != "0" ]; then OK=1; break; fi
sleep 1
done
if [ "$OK" != "1" ]; then
echo "CASCADE_NO_HANDSHAKE" >&2
echo "Tunnel interface is up but exit peer did not handshake. Check exit server / UDP port / keys." >&2
exit 42
fi
"""
up_script = f"""#!/bin/bash
{CASCADE_MARKER}
@@ -201,35 +347,29 @@ QUICK={shlex.quote(quick_bin)}
SUBNET={shlex.quote(subnet)}
EXIT_HOST={shlex.quote(endpoint_host)}
IFACE=cascade
TABLE={table_id}
PRIO={prio}
"$QUICK" down "$CONF" 2>/dev/null || true
ip link delete "$IFACE" 2>/dev/null || true
ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true
ip route flush table "$TABLE" 2>/dev/null || true
# Resolve hostname to IP if needed (pin route must use IP)
EXIT_IP="$EXIT_HOST"
if ! printf '%s' "$EXIT_IP" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'; then
EXIT_IP=$(getent ahostsv4 "$EXIT_HOST" 2>/dev/null | awk '{{print $1; exit}}')
fi
GW=$(ip route | awk '/default/ {{print $3; exit}}')
DEV=$(ip route | awk '/default/ {{print $5; exit}}')
if [ -n "$EXIT_IP" ] && [ -n "$GW" ] && [ -n "$DEV" ]; then
ip route replace "$EXIT_IP/32" via "$GW" dev "$DEV" 2>/dev/null || true
fi
{pin_block}
"$QUICK" up "$CONF"
ip route replace default dev "$IFACE" table 200 2>/dev/null || ip route add default dev "$IFACE" table 200
ip rule del from "$SUBNET" table 200 2>/dev/null || true
ip rule add from "$SUBNET" table 200 priority 100
# Source-based routing: VPN clients go through cascade iface
ip route replace default dev "$IFACE" table "$TABLE" 2>/dev/null || ip route add default dev "$IFACE" table "$TABLE"
ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true
ip rule add from "$SUBNET" table "$TABLE" priority "$PRIO"
for SRC_IF in awg0 wg0; do
iptables -C FORWARD -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null \\
|| iptables -I FORWARD 1 -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null || true
done
iptables -C FORWARD -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \\
|| iptables -I FORWARD 1 -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
{remove_masq}
{forward_block}
iptables -t nat -C POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE 2>/dev/null \\
|| iptables -t nat -A POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE
{mss_block}
{handshake_block}
echo CASCADE_UP_OK
"""
@@ -249,12 +389,21 @@ echo CASCADE_UP_OK
out, err, code = self.ssh.run_sudo_command(
f"docker exec {shlex.quote(container)} bash {shlex.quote(cascade_up_path)}",
timeout=90,
timeout=max(90, hs_timeout + 40),
)
combined = ((out or '') + '\n' + (err or '')).strip()
if code != 0 or 'CASCADE_UP_OK' not in (out or ''):
msg = combined
if 'CASCADE_NO_HANDSHAKE' in combined:
msg = (
'Туннель к серверу выхода поднят, но handshake не прошёл. '
'Проверьте, что на выходе открыт UDP-порт, протокол совпадает, '
'и входной сервер может достучаться до IP выхода.'
)
return {
'status': 'error',
'message': (err or out or 'Failed to bring cascade interface up').strip()[:800],
'message': (msg or 'Failed to bring cascade interface up').strip()[:900],
'log': combined[:2000],
}
st = self.status(entry_protocol)
@@ -264,7 +413,10 @@ echo CASCADE_UP_OK
'endpoint': endpoint_host,
'container': container,
'up': bool(st.get('up')),
'handshake': bool(st.get('handshake')),
'settings': opts,
'applied_at': datetime.now().isoformat(timespec='seconds'),
'diagnostics': st.get('raw', '')[:1500],
}
def _ensure_start_hook(self, container: str, cascade_up_path: str) -> None:
@@ -285,24 +437,26 @@ printf '%s\\n' 'if [ -x {cascade_up_path} ]; then bash {cascade_up_path} || true
)
self.ssh.run_command('rm -f /tmp/_amnz_cascade_hook.sh')
def disable(self, entry_protocol: str) -> dict:
def disable(self, entry_protocol: str, settings: Optional[dict] = None) -> dict:
opts = normalize_settings(settings)
container = self._container_name(entry_protocol)
if not container:
return {'status': 'error', 'message': 'Unsupported entry protocol'}
conf = self._cascade_conf(entry_protocol)
up = self._cascade_up(entry_protocol)
quick_bin = self._quick_binary(entry_protocol)
# Avoid nested quotes issues: upload a small script
table_id = int(opts['table_id'])
script = f"""#!/bin/bash
set +e
QUICK={shlex.quote(quick_bin)}
CONF={shlex.quote(conf)}
UP={shlex.quote(up)}
TABLE={table_id}
"$QUICK" down "$CONF" 2>/dev/null
ip link delete cascade 2>/dev/null
ip rule del table 200 2>/dev/null
ip rule del table 200 2>/dev/null
ip route flush table 200 2>/dev/null
ip rule del table "$TABLE" 2>/dev/null
ip rule del table "$TABLE" 2>/dev/null
ip route flush table "$TABLE" 2>/dev/null
rm -f "$CONF" "$UP"
echo CASCADE_DOWN_OK
"""