feat: Enhance WireGuard support by rejecting legacy outbound configurations and adding validation tests

Author: dsfkjlweuyr

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
         run: ./run lib core
       - name: WireGuard endpoint schema and box tests
         working-directory: libcore
-        run: go test -v -run 'Test(WireGuardEndpointConfigsCreateAndClose|MissingWireGuardRouteTagDoesNotFallbackToDirect|LegacyWireGuardOutboundIsRejected)$' .
+        run: go test -v -tags='with_conntrack,with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api' -run 'Test(WireGuardEndpointConfigsCreateAndClose|MissingWireGuardRouteTagDoesNotFallbackToDirect|LegacyWireGuardOutboundIsRejected)$' .
       - name: Verify LibCore AAR
         run: |
           test -s app/libs/libcore.aar

libcore/box.go

@@ -3,6 +3,7 @@ package libcore
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -36,6 +37,33 @@ import (
 var mainInstance *BoxInstance
 var boxInstanceSequence atomic.Uint64
 
+type outboundTypeProbe struct {
+	Outbounds []struct {
+		Type string `json:"type"`
+	} `json:"outbounds"`
+}
+
+// rejectLegacyWireGuardOutbound runs before sing-box decodes registered outbound
+// options. The registry intentionally maps WireGuard to option.StubOptions, whose
+// strict decoder otherwise reports the first removed field as "unknown" before
+// the registry factory can return the actionable migration error.
+//
+// Only the top-level outbound type is inspected. Malformed JSON is left to the
+// official context-aware decoder below so this probe neither replaces schema
+// validation nor exposes legacy credentials in an error or diagnostic.
+func rejectLegacyWireGuardOutbound(config string) error {
+	var probe outboundTypeProbe
+	if json.Unmarshal([]byte(config), &probe) != nil {
+		return nil
+	}
+	for _, outbound := range probe.Outbounds {
+		if outbound.Type == constant.TypeWireGuard {
+			return E.New(legacyWireGuardOutboundError)
+		}
+	}
+	return nil
+}
+
 func diagnosticTagID(tag string) string {
 	digest := sha256.Sum256([]byte(tag))
 	return fmt.Sprintf("%x", digest[:6])
@@ -153,7 +181,10 @@ func newSingBoxInstance(config string, localTransport LocalDNSTransport, platfor
 
 	// parse options
 	var options option.Options
-	err = options.UnmarshalJSONContext(ctx, []byte(config))
+	err = rejectLegacyWireGuardOutbound(config)
+	if err == nil {
+		err = options.UnmarshalJSONContext(ctx, []byte(config))
+	}
 	if err != nil {
 		if !platformLog {
 			log.Printf("URLTestTrace goId=%d stage=parse-config failed elapsed=%s errorType=%T", diagnosticID, time.Since(createStarted), err)

libcore/box_include.go

@@ -48,6 +48,8 @@ import (
 	E "github.com/sagernet/sing/common/exceptions"
 )
 
+const legacyWireGuardOutboundError = "WireGuard outbound is deprecated in sing-box 1.11.0 and removed in sing-box 1.13.0, use WireGuard endpoint instead"
+
 func nekoboxAndroidInboundRegistry() *inbound.Registry {
 	registry := inbound.NewRegistry()
 
@@ -100,7 +102,7 @@ func nekoboxAndroidOutboundRegistry() *outbound.Registry {
 	// 见下方 nekoboxAndroidEndpointRegistry）；镜像官方 include/registry.go 的 stub，
 	// 让旧式 wireguard outbound 配置得到明确报错而非 "unknown outbound type"。
 	outbound.Register[option.StubOptions](registry, C.TypeWireGuard, func(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.StubOptions) (adapter.Outbound, error) {
-		return nil, E.New("WireGuard outbound is deprecated in sing-box 1.11.0 and removed in sing-box 1.13.0, use WireGuard endpoint instead")
+		return nil, E.New(legacyWireGuardOutboundError)
 	})
 
 	return registry

libcore/wireguard_endpoint_test.go

@@ -135,6 +135,14 @@ func TestWireGuardEndpointConfigsCreateAndClose(t *testing.T) {
 			if err != nil {
 				t.Fatalf("create test box: %v", err)
 			}
+			defer func() {
+				if closeErr := instance.Close(); closeErr != nil {
+					t.Errorf("cleanup test box: %v", closeErr)
+				}
+			}()
+			if err = instance.Start(); err != nil {
+				t.Fatalf("start test box: %v", err)
+			}
 			if _, loaded := instance.Outbound().Outbound(testCase.finalTag); !loaded {
 				t.Fatalf("final tag %q is not available through unified outbound lookup", testCase.finalTag)
 			}
@@ -171,21 +179,43 @@ func TestWireGuardEndpointConfigsCreateAndClose(t *testing.T) {
 
 func TestMissingWireGuardRouteTagDoesNotFallbackToDirect(t *testing.T) {
 	config := testConfig("", `{"type":"direct","tag":"direct"}`, "missing-wg")
-	if _, err := NewTestSingBoxInstance(config, nil); err == nil {
-		t.Fatal("missing endpoint route tag was silently accepted")
+	instance, err := NewTestSingBoxInstance(config, nil)
+	if err != nil {
+		t.Fatalf("create test box before route validation: %v", err)
+	}
+	defer func() {
+		if closeErr := instance.Close(); closeErr != nil {
+			t.Errorf("close test box: %v", closeErr)
+		}
+	}()
+
+	err = instance.Start()
+	if err == nil || !strings.Contains(err.Error(), "default outbound not found: missing-wg") {
+		t.Fatalf("expected missing endpoint route tag rejection at start, got %v", err)
+	}
+	if defaultOutbound := instance.Outbound().Default(); defaultOutbound != nil {
+		t.Fatalf("missing endpoint route tag fell back to outbound %q", defaultOutbound.Tag())
 	}
 }
 
 func TestLegacyWireGuardOutboundIsRejected(t *testing.T) {
-	config := fmt.Sprintf(`{
+	cases := map[string]string{
+		"type-only": `{"outbounds":[{"type":"wireguard","tag":"wg"}]}`,
+		"legacy-fields": fmt.Sprintf(`{
   "outbounds": [{
     "type": "wireguard",
     "tag": "wg",
     "local_address": ["10.0.0.2/32"],
     "private_key": %q
   }]
-}`, testWireGuardPrivateKey)
-	if _, err := NewTestSingBoxInstance(config, nil); err == nil || !strings.Contains(err.Error(), "use WireGuard endpoint instead") {
-		t.Fatalf("expected explicit legacy outbound rejection, got %v", err)
+}`, testWireGuardPrivateKey),
+	}
+
+	for name, config := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, err := NewTestSingBoxInstance(config, nil); err == nil || !strings.Contains(err.Error(), "use WireGuard endpoint instead") {
+				t.Fatalf("expected explicit legacy outbound rejection, got %v", err)
+			}
+		})
 	}
 }

tools/diagnostics/roo_check_wireguard_endpoint.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from pathlib import Path
 
 
@@ -20,6 +21,13 @@ def reject(text: str, needle: str, description: str) -> None:
         raise SystemExit(f"forbidden {description}: {needle}")
 
 
+def build_tags(text: str, source: str) -> set[str]:
+    match = re.search(r"-tags='([^']+)'", text)
+    if match is None:
+        raise SystemExit(f"missing Go build tags in {source}")
+    return {tag.strip() for tag in match.group(1).split(",") if tag.strip()}
+
+
 def main() -> None:
     options = read("app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java")
     formatter = read(
@@ -32,6 +40,8 @@ def main() -> None:
     proxy_instance = read(
         "app/src/main/java/io/nekohasekai/sagernet/bg/proto/ProxyInstance.kt"
     )
+    libcore_build = read("libcore/build.sh")
+    ci_workflow = read(".github/workflows/ci.yml")
 
     require(options, "public List<SingBoxOption> endpoints;", "top-level endpoints")
     require(options, "class Endpoint_WireGuardOptions", "WireGuard endpoint model")
@@ -56,6 +66,15 @@ def main() -> None:
     reject(test_instance, "endpointTags=", "raw test endpoint tag logging")
     reject(proxy_instance, "endpointTags=", "raw production endpoint tag logging")
 
+    production_tags = build_tags(libcore_build, "libcore/build.sh")
+    ci_test_tags = build_tags(ci_workflow, ".github/workflows/ci.yml")
+    if ci_test_tags != production_tags:
+        raise SystemExit(
+            "WireGuard Go test tags differ from production libcore tags: "
+            f"missing={sorted(production_tags - ci_test_tags)}, "
+            f"extra={sorted(ci_test_tags - production_tags)}"
+        )
+
     diagnostic_lines = [
         line.strip()
         for source in (builder, test_instance, proxy_instance)