hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-11-06 10:12:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

TUN inbound's autoSystemWfpBlockLeak: Drop "/0"; Ports have to be 1-65535

Browse Source 
"tcp/0" and "udp/0" no longer stand for all ports, which "tcp" and "udp"
already say: no syntactic sugar. Port 0 is rejected like any port outside
1-65535. Ranges keep being checked strictly: both ends within 1-65535, the
left one not greater than the right one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
patterniha
2026-11-02 12:49:56 +03:30
co-authored by Claude Opus 5.5
parent 2933b0c8d5
commit 9ffa0f0552
4 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/tun/wfp_leak.go
+7 -6
View File
@@ -39,8 +39,9 @@ func (t leakTraffic) covers(protocol string, port uint16) bool {
}
// parseLeakTraffic parses a lower case "tcp", "udp" or "icmp" value. The former
// two may end in "/<port>" or "/<low>-<high>", where "/0" stands for all ports,
// as do "/1-65535" and no port at all; ICMP has no ports.
// two may end in "/<port>" or "/<low>-<high>", with ports from 1 to 65535 and
// low not above high, where "/1-65535" stands for all ports, as does no port
// at all; ICMP has no ports.
func parseLeakTraffic(value string) (leakTraffic, bool) {
protocol, ports, hasPorts := strings.Cut(value, "/")
switch protocol {
@@ -55,16 +56,16 @@ func parseLeakTraffic(value string) (leakTraffic, bool) {
}
lowText, highText, isRange := strings.Cut(ports, "-")
low, err := strconv.ParseUint(lowText, 10, 16)
if err != nil {
if err != nil || low == 0 {
return leakTraffic{}, false
}
high := low
if isRange {
if high, err = strconv.ParseUint(highText, 10, 16); err != nil || low == 0 || high < low {
if high, err = strconv.ParseUint(highText, 10, 16); err != nil || high < low {
return leakTraffic{}, false
}
}
if low == 0 || low == 1 && high == 65535 {
if low == 1 && high == 65535 {
return leakTraffic{protocol: protocol}, true
}
return leakTraffic{protocol: protocol, low: uint16(low), high: uint16(high)}, true
@@ -73,7 +74,7 @@ func parseLeakTraffic(value string) (leakTraffic, bool) {
// ExpandWfpBlockLeak checks the values of autoSystemWfpBlockLeak and returns
// them in lower case, in order and without duplicates, with "dns" replaced by
// what it stands for, "allexceptlan" followed by that, and ports written the
// same way, "tcp/0" as "tcp" say.
// same way, "tcp/1-65535" as "tcp" say.
func ExpandWfpBlockLeak(values []string) ([]string, error) {
var leaks []string
add := func(leak string) {