diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/validation/real-subscription-vm.md | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/docs/validation/real-subscription-vm.md b/docs/validation/real-subscription-vm.md new file mode 100644 index 0000000..7bd06ed --- /dev/null +++ b/docs/validation/real-subscription-vm.md @@ -0,0 +1,40 @@ +# Real subscription TUN validation + +Validated on `altctlrs` on 2026-10-30 after the system upgrade, with ALT's +Xray 26.10.29 package. The recovery checkpoint is +`roentgen-upgraded-xray-20261030`. Subscription credentials are omitted. + +The subscription imports one supported Trojan TCP/TLS configuration and one +unsupported VLESS entry. A temporary SOCKS listener first verified the Trojan +connection independently of host routing. + +Before the firewall fix, the selected configuration enabled TUN, but the real +request timed out. A targeted nftables trace showed the capture mark set in +OUTPUT and the guard dropping the packet because its hook state still named +`ens19`. Moving the guard to POSTROUTING made the request succeed. The final +source applies that change while retaining the guard's default drop policy. +See the kernel's [route hook](https://github.com/torvalds/linux/blob/master/net/netfilter/nft_chain_route.c) +and [hook state](https://github.com/torvalds/linux/blob/master/include/linux/netfilter.h). + +The live acceptance check failed before the fix and passed after rebuilding and +installing the source: + +```sh +sudo python3 tests/vm_tun_acceptance.py --expected-ip 93.95.225.219 +``` + +- Direct IPv4: `185.39.118.143`. +- TUN IPv4: `93.95.225.219`, through both HTTP and HTTPS requests. +- Disabling restored `185.39.118.143`. +- An ordinary `rustacean` user's request also returned `93.95.225.219`. +- Masking and stopping the owned Xray service caused a pinned-IP public request + to time out instead of falling back directly. Unmasking and enabling restored + `93.95.225.219`. +- The six existing `vm_guard_acceptance.py` checks passed, including private + IPv4/IPv6 exceptions, public blocking, UDP DNS policy, incoming TCP continuity, + rejection of preexisting outgoing flows, and explicit disable. +- The missing-interface regression in `routes_acceptance.rs` passed on this VM + during the preceding run. + +The VM was left with the subscription selected and proxying enabled. This is +live validation of this configuration, not the full release acceptance matrix. |