Galaxy-Tunnel VLESS server is running, but no valid UUID has been configured.
uuidgen in your terminal or generate one at uuidgenerator.net.UUID with your generated UUID. Or add UUID = "your-uuid" in wrangler.toml.wrangler deploy and test the connection.The requested resource was not found on this server.
`; } // ============================================ // MAIN WORKER FETCH HANDLER // ============================================ const worker_default = { async fetch(request, env, ctx) { const requestId = generateRequestId(); const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-forwarded-for") || "unknown"; const logger = new Logger(requestId, clientIp); // Rate Limiting (Item 4) const rateLimit = rateLimiter.check(clientIp); if (!rateLimit.allowed) { logger.warn("RATE_LIMIT_EXCEEDED", { remaining: rateLimit.remaining, resetIn: rateLimit.resetIn }); return new Response( JSON.stringify({ error: "Too Many Requests", retryAfterSeconds: rateLimit.resetIn }), { status: 429, headers: { ...getSecurityHeaders("application/json"), "Retry-After": rateLimit.resetIn.toString(), "X-RateLimit-Limit": DEFAULT_RATE_LIMIT_PER_MINUTE.toString(), "X-RateLimit-Remaining": "0" } } ); } const url = new URL(request.url); const pathname = url.pathname.replace(/^\/+|\/+$/g, ""); // Load configurations from env (Item 2: fully configurable via wrangler.toml / env) const userID = env.UUID || env.uuid || ""; const proxyIP = env.PROXYIP || env.proxyip || env.PROXY_IP || DEFAULT_LOCAL_PROXIES[0]; const rawProxyListUrl = env.PROXY_LIST_URL || ""; const dohURL = env.DNS_RESOLVER_URL || DEFAULT_DOH_URL; const configuredWsPath = (env.WS_PATH || "galaxy-tunnel").replace(/^\/+|\/+$/g, ""); // Health check endpoint (Item 10) if (url.pathname === "/health" || url.pathname === "/api/health") { logger.info("HEALTH_CHECK_REQUESTED"); return new Response( JSON.stringify({ status: "healthy", service: "galaxy-tunnel-vless", timestamp: new Date().toISOString(), uuidConfigured: isValidUUID(userID), proxyPoolSize: proxyPoolManager.getPoolSize(), wsPath: configuredWsPath, rateLimitRemaining: rateLimit.remaining }), { status: 200, headers: getSecurityHeaders("application/json") } ); } // CORS preflight options if (request.method === "OPTIONS") { return new Response(null, { status: 204, headers: getSecurityHeaders("text/plain") }); } // Handle WebSocket Proxy Connection const upgradeHeader = request.headers.get("Upgrade"); if (upgradeHeader === "websocket") { // Camouflage WebSocket path leak risk (Item 11) if (configuredWsPath && pathname !== configuredWsPath && pathname !== "") { logger.warn("UNAUTHORIZED_WS_PATH", { path: pathname, expected: configuredWsPath }); return new Response(getCamouflage404(), { status: 404, headers: getSecurityHeaders("text/html; charset=utf-8") }); } // Check UUID validity for WebSocket upgrade (Item 1) if (!isValidUUID(userID)) { logger.warn("WS_ATTEMPT_WITHOUT_UUID"); return new Response(getUnauthorizedPage(), { status: 401, headers: getSecurityHeaders("text/html; charset=utf-8") }); } return await proxyOverWSHandler(request, userID, proxyIP, rawProxyListUrl, dohURL, logger); } // Validate UUID on regular web visits (Item 1: return 401 Unauthorized + steps page) if (!isValidUUID(userID)) { logger.info("VISIT_WITHOUT_UUID_SERVED_401"); return new Response(getUnauthorizedPage(), { status: 401, headers: getSecurityHeaders("text/html; charset=utf-8") }); } // Check path for normal GET visits (Item 11: non-matching subpaths return 404 camouflage) if (pathname !== "" && pathname !== configuredWsPath) { return new Response(getCamouflage404(), { status: 404, headers: getSecurityHeaders("text/html; charset=utf-8") }); } // Normal Web Browser Request -> Render Galaxy Page (Item 12: with noindex) logger.info("GALAXY_PAGE_SERVED"); return new Response(getGalaxyPage(), { status: 200, headers: getSecurityHeaders("text/html; charset=utf-8") }); } }; // ============================================ // WEBSOCKET PROXY STREAM HANDLER // ============================================ async function proxyOverWSHandler(request, userID, defaultProxy, rawProxyListUrl, dohURL, logger) { const webSocketPair = new WebSocketPair(); const [client, webSocket] = Object.values(webSocketPair); webSocket.accept(); let address = ""; let portWithRandomLog = ""; const earlyDataHeader = request.headers.get("sec-websocket-protocol") || ""; const readableWebSocketStream = makeReadableWebSocketStream(webSocket, earlyDataHeader, logger); const remoteSocketWrapper = { value: null }; let udpStreamWrite = null; let isDns = false; readableWebSocketStream.pipeTo( new WritableStream({ async write(chunk) { if (isDns && udpStreamWrite) { return udpStreamWrite(chunk); } if (remoteSocketWrapper.value) { const writer = remoteSocketWrapper.value.writable.getWriter(); await writer.write(chunk); writer.releaseLock(); return; } // Process VLESS Protocol Header const result = processVlessHeader(chunk, userID); if (result.hasError) { logger.error("VLESS_HEADER_ERROR", { message: result.message }); throw new Error(result.message); } const { addressRemote = "", portRemote = 443, rawDataIndex, responseHeader, isUDP } = result; // SSRF check on target destination if (isPrivateOrBlockedHost(addressRemote)) { logger.warn("BLOCKED_PRIVATE_DESTINATION", { address: addressRemote }); throw new Error("Access to private destination is blocked"); } address = addressRemote; portWithRandomLog = `${portRemote} ${isUDP ? "udp" : "tcp"}`; if (isUDP && portRemote !== 53) { logger.warn("NON_DNS_UDP_REJECTED", { port: portRemote }); throw new Error("UDP proxy only enabled for DNS (port 53)"); } if (isUDP && portRemote === 53) { isDns = true; } const rawClientData = chunk.slice(rawDataIndex); if (isDns) { const { write } = await handleUDPOutBound(webSocket, responseHeader, dohURL, logger); udpStreamWrite = write; udpStreamWrite(rawClientData); return; } handleTCPOutBound( remoteSocketWrapper, addressRemote, portRemote, rawClientData, webSocket, responseHeader, defaultProxy, rawProxyListUrl, logger ); }, close() { logger.info("WS_STREAM_CLOSED"); }, abort(reason) { logger.warn("WS_STREAM_ABORTED", { reason: String(reason) }); } }) ).catch((err) => { logger.error("WS_PIPE_ERROR", { error: err.message }); }); return new Response(null, { status: 101, webSocket: client }); } // ============================================ // TCP OUTBOUND WITH TIMEOUT & HYBRID PROXY (Item 8) // ============================================ async function handleTCPOutBound( remoteSocket, addressRemote, portRemote, rawClientData, webSocket, responseHeader, defaultProxy, rawProxyListUrl, logger ) { let timeoutTimer = null; const resetTimeout = () => { if (timeoutTimer) clearTimeout(timeoutTimer); timeoutTimer = setTimeout(() => { logger.warn("CONNECTION_TIMEOUT_REACHED", { address: addressRemote, port: portRemote }); safeCloseWebSocket(webSocket); if (remoteSocket.value && remoteSocket.value.close) { try { remoteSocket.value.close(); } catch {} } }, CONNECTION_TIMEOUT_MS); }; async function connectAndWrite(address, port) { resetTimeout(); const tcpSocket2 = connect({ hostname: address, port }); remoteSocket.value = tcpSocket2; logger.info("TCP_CONNECTING", { target: `${address}:${port}` }); const writer = tcpSocket2.writable.getWriter(); await writer.write(rawClientData); writer.releaseLock(); return tcpSocket2; } async function retry() { const activeProxy = await proxyPoolManager.getProxy(defaultProxy, rawProxyListUrl, logger); const target = activeProxy || addressRemote; logger.info("RETRYING_VIA_PROXY", { proxy: target, port: portRemote }); try { const tcpSocket2 = await connectAndWrite(target, portRemote); tcpSocket2.closed .catch((error) => { logger.warn("RETRY_TCP_CLOSED_ERROR", { error: error.message }); }) .finally(() => { if (timeoutTimer) clearTimeout(timeoutTimer); safeCloseWebSocket(webSocket); }); remoteSocketToWS(tcpSocket2, webSocket, responseHeader, null, logger, resetTimeout); } catch (retryErr) { logger.error("RETRY_CONNECT_FAILED", { error: retryErr.message }); safeCloseWebSocket(webSocket); } } try { const tcpSocket = await connectAndWrite(addressRemote, portRemote); remoteSocketToWS(tcpSocket, webSocket, responseHeader, retry, logger, resetTimeout); } catch (err) { logger.warn("DIRECT_TCP_FAILED_RETRYING", { error: err.message }); await retry(); } } function makeReadableWebSocketStream(webSocketServer, earlyDataHeader, logger) { return new ReadableStream({ start(controller) { webSocketServer.addEventListener("message", (event) => { controller.enqueue(event.data); }); webSocketServer.addEventListener("close", () => { safeCloseWebSocket(webSocketServer); controller.close(); }); webSocketServer.addEventListener("error", (err) => { logger.error("WS_EVENT_ERROR", { error: err.message }); controller.error(err); }); const { earlyData, error } = base64ToArrayBuffer(earlyDataHeader); if (error) { controller.error(error); } else if (earlyData) { controller.enqueue(earlyData); } }, cancel(reason) { logger.warn("WS_STREAM_CANCELED", { reason: String(reason) }); safeCloseWebSocket(webSocketServer); } }); } // ============================================ // VLESS PROTOCOL PARSER (Item 7: with formatIPv6) // ============================================ function processVlessHeader(vlessBuffer, userID2) { if (vlessBuffer.byteLength < 24) { return { hasError: true, message: "Invalid VLESS data" }; } const version = new Uint8Array(vlessBuffer.slice(0, 1)); const slicedBuffer = new Uint8Array(vlessBuffer.slice(1, 17)); const slicedBufferString = stringify(slicedBuffer); const uuids = userID2.includes(",") ? userID2.split(",") : [userID2]; const isValidUser = uuids.some((userUuid) => slicedBufferString === userUuid.trim()); if (!isValidUser) { return { hasError: true, message: "Invalid VLESS user" }; } const optLength = new Uint8Array(vlessBuffer.slice(17, 18))[0]; const command = new Uint8Array(vlessBuffer.slice(18 + optLength, 18 + optLength + 1))[0]; let isUDP = false; if (command === 1) { isUDP = false; } else if (command === 2) { isUDP = true; } else { return { hasError: true, message: `VLESS command ${command} not supported` }; } const portIndex = 18 + optLength + 1; const portBuffer = vlessBuffer.slice(portIndex, portIndex + 2); const portRemote = new DataView(portBuffer).getUint16(0); const addressIndex = portIndex + 2; const addressType = new Uint8Array(vlessBuffer.slice(addressIndex, addressIndex + 1))[0]; let addressLength = 0; let addressValueIndex = addressIndex + 1; let addressValue = ""; switch (addressType) { case 1: addressLength = 4; addressValue = new Uint8Array(vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)).join("."); break; case 2: addressLength = new Uint8Array(vlessBuffer.slice(addressValueIndex, addressValueIndex + 1))[0]; addressValueIndex += 1; addressValue = new TextDecoder().decode(vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)); break; case 3: { addressLength = 16; const dataView = new DataView(vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)); const rawHextets = []; for (let i = 0; i < 8; i++) { rawHextets.push(dataView.getUint16(i * 2)); } // IPv6 RFC 5952 Zero-Compression (Item 7) addressValue = formatIPv6(rawHextets); break; } default: return { hasError: true, message: `Invalid VLESS address type ${addressType}` }; } if (!addressValue) { return { hasError: true, message: "VLESS address value is empty" }; } const responseHeader = new Uint8Array([version[0], 0]); return { hasError: false, addressRemote: addressValue, addressType, portRemote, rawDataIndex: addressValueIndex + addressLength, responseHeader, isUDP }; } async function remoteSocketToWS(remoteSocket, webSocket, responseHeader, retry, logger, onDataActivity) { let header = responseHeader; let hasIncomingData = false; await remoteSocket.readable .pipeTo( new WritableStream({ async write(chunk) { hasIncomingData = true; if (onDataActivity) onDataActivity(); if (webSocket.readyState !== 1) { throw new Error("WebSocket not open"); } if (header) { webSocket.send(await new Blob([header, chunk]).arrayBuffer()); header = null; } else { webSocket.send(chunk); } }, close() { logger.info("REMOTE_SOCKET_CLOSED", { hadData: hasIncomingData }); }, abort(reason) { logger.warn("REMOTE_READABLE_ABORT", { reason: String(reason) }); } }) ) .catch((error) => { logger.error("REMOTE_SOCKET_PIPE_ERROR", { error: error.message }); safeCloseWebSocket(webSocket); }); if (hasIncomingData === false && retry) { logger.info("NO_DATA_RECEIVED_TRIGGERING_RETRY"); retry(); } } function base64ToArrayBuffer(base64Str) { if (!base64Str) { return { earlyData: null, error: null }; } try { base64Str = base64Str.replace(/-/g, "+").replace(/_/g, "/"); const decode = atob(base64Str); const arrayBuffer = Uint8Array.from(decode, (c) => c.charCodeAt(0)); return { earlyData: arrayBuffer.buffer, error: null }; } catch (error) { return { earlyData: null, error }; } } const byteToHex = []; for (let i = 0; i < 256; ++i) { byteToHex.push((i + 256).toString(16).slice(1)); } function unsafeStringify(arr, offset = 0) { return ( byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]] ).toLowerCase(); } function stringify(arr, offset = 0) { const uuid = unsafeStringify(arr, offset); if (!isValidUUID(uuid)) { throw TypeError("Stringified UUID is invalid"); } return uuid; } function safeCloseWebSocket(socket) { try { if (socket.readyState === 1 || socket.readyState === 2) { socket.close(); } } catch (error) { console.error("safeCloseWebSocket error", error); } } async function handleUDPOutBound(webSocket, responseHeader, dohURL, logger) { let isHeaderSent = false; const transformStream = new TransformStream({ transform(chunk, controller) { for (let index = 0; index < chunk.byteLength; ) { const lengthBuffer = chunk.slice(index, index + 2); const udpPacketLength = new DataView(lengthBuffer).getUint16(0); const udpData = new Uint8Array(chunk.slice(index + 2, index + 2 + udpPacketLength)); index = index + 2 + udpPacketLength; controller.enqueue(udpData); } }, flush() {} }); transformStream.readable .pipeTo( new WritableStream({ async write(chunk) { const resp = await fetch(dohURL, { method: "POST", headers: { "content-type": "application/dns-message" }, body: chunk }); const dnsQueryResult = await resp.arrayBuffer(); const udpSize = dnsQueryResult.byteLength; const udpSizeBuffer = new Uint8Array([(udpSize >> 8) & 255, udpSize & 255]); if (webSocket.readyState === 1) { logger.info("DOH_QUERY_SUCCESS", { responseSize: udpSize }); if (isHeaderSent) { webSocket.send(await new Blob([udpSizeBuffer, dnsQueryResult]).arrayBuffer()); } else { webSocket.send(await new Blob([responseHeader, udpSizeBuffer, dnsQueryResult]).arrayBuffer()); isHeaderSent = true; } } } }) ) .catch((error) => { logger.error("DNS_UDP_ERROR", { error: error.message }); }); const writer = transformStream.writable.getWriter(); return { write: (chunk) => writer.write(chunk) }; } export default worker_default;