patterniha and Claude Opus 5.5
bb4cd4b6d3
TUN inbound's autoSystemWfpBlockLeak: Add "allexceptlan"
...
"allexceptlan" is "all" but for the local network: traffic to and from
private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), link-local
(169.254.0.0/16, fe80::/10), multicast (224.0.0.0/4, ff00::/8) and broadcast
(255.255.255.255) addresses stays allowed, so that printers, the router's
settings page, or casting to a TV keep working while nothing else leaves
outside the TUN.
It includes "dns": a resolver on the local network, like the router's,
would forward the queries outside the TUN, so DNS stays blocked there. The
LAN permit sits below the other values, like the permit through the TUN, so
they still apply on the local network, e.g. "tcp/445" blocks Windows file
sharing with it. The DNS Client service keeps mDNS and LLMNR, to the local
network's addresses only. "all" overrides it.
The addresses are matched with FWP_V4_ADDR_MASK and FWP_V6_ADDR_MASK
conditions on the remote address, which match when any of them does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-02 11:50:18 +03:30
patterniha and Claude Opus 5.5
468f745fc2
TUN inbound's autoSystemWfpBlockLeak: Add "all", "tcp", "udp", "icmp" and port ranges; Always allow loopback, DHCP and IPv6 neighbor discovery
...
autoSystemWfpBlockLeak now also takes:
- "all": everything outside the TUN, IPv4 and IPv6, in both directions, so
nothing but Xray leaves except through the TUN.
- "tcp", "udp": all ports of that protocol, also written "tcp/0", "udp/0".
- "tcp/<low>-<high>", "udp/<low>-<high>": a range of ports, matched with
FWP_MATCH_RANGE, as two conditions on the same field would match when
either does.
- "icmp": ICMP and ICMPv6, e.g. ping. It takes no port: in ICMP filters the
local port holds the type, and "icmp/0" would read as the echo reply.
Values are normalized: "tcp/0" and "tcp/1-65535" become "tcp", and
"tcp/53-53" becomes "tcp/53".
Whatever is blocked, loopback, which cannot leave the system, and what
Windows itself needs on the local link now always stay allowed: DHCP, DHCPv6,
and IPv6 neighbor and multicast listener discovery. These used to be allowed
only along with "misconfigtun", so "udp" or "icmp" would otherwise have cut
DHCP or IPv6 neighbor discovery, and "tcp" any local proxy, Xray's own
inbounds included. Loopback being allowed means that with "dns", a local
resolver on 127.0.0.1:53 now works for other programs (its own queries to
port 53 or 853 outside the TUN stay blocked), and the DNS Client service
may use it.
"all" reuses the filters of "misconfigtun", which now also let everything
through the TUN, for both IP versions whatever the routes.
On other TUN options: keeping the system's DNS inside the TUN, with "all",
"dns", "windnsclient", or anything covering TCP or UDP port 53 ("udp",
"tcp/50-60", ...), needs dns, as Windows can no longer reach the DNS
servers of the other interfaces; the config is rejected otherwise. Like the
other values, the new ones need autoSystemRoutingTable. The filters do not
need autoOutboundsInterface, as Xray is allowed by its app ID; it still
keeps Xray's own connections out of the TUN's routes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-02 11:13:10 +03:30
6cdd323ad8
TUN inbound's autoSystemWfpBlockLeak: Support "tcp/port" and "udp/port"; "dns" covers "tcp/853" and "udp/853" as well ( #7288 )
...
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-6492838227
https://github.com/XTLS/Xray-core/pull/7288#issuecomment-6507229727
https://github.com/XTLS/Xray-core/pull/7288#issuecomment-6516762634
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-31 13:16:31 +00:00
316e07a538
XHTTP server: Add h2Params ( #7295 )
...
https://github.com/XTLS/Xray-core/pull/7282#issuecomment-6523157944
https://github.com/XTLS/Xray-core/pull/7295#issuecomment-6543501751
Closes https://github.com/XTLS/Xray-core/issues/6268
---------
Co-authored-by: pqhaz3925 <195911022+pqhaz3925@users.noreply.github.com >
2026-10-31 12:52:14 +00:00
风扇滑翔翼 and GitHub
d1140de273
Chore: Regenerate *.pb.go files ( #7287 )
...
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6464669635
2026-10-31 07:13:55 +00:00
55eecaed16
Config: Move inbound module initialization to the end ( #7284 )
...
Fixes https://github.com/XTLS/Xray-core/pull/7284#issuecomment-6491545028
---------
Co-authored-by: Copilot <copilot@github.com >
2026-10-29 08:34:16 +00:00
Жора Змейкин and GitHub
b4123b5748
XDRIVE transport: Add "s3" storage backend ( #7231 )
...
https://github.com/XTLS/Xray-core/pull/7231#issuecomment-6488077212
2026-10-29 04:44:41 +00:00
78b5a6ec5c
GitHub Action CI: Enforce stricter checks on generated protobuf files ( #7263 )
...
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6447862934
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6484719865
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6485805671
---------
Co-authored-by: Fangliding <Fangliding.fshxy@outlook.com >
2026-10-29 02:34:47 +00:00
48f62b801a
Geodata: Limit download size, file extensions, and update frequency ( #7267 )
...
https://github.com/XTLS/Xray-core/pull/7265#issuecomment-6464588139
---------
Co-authored-by: xqzr <34030394+xqzr@users.noreply.github.com >
2026-10-29 00:22:51 +00:00
Meow and GitHub
43c29f8eb1
Geodata: Update built-in generalized "private" IP ranges ( #7249 )
...
And https://github.com/XTLS/Xray-core/pull/7249#issuecomment-6483478811
https://github.com/XTLS/Xray-core/pull/7249#issuecomment-6391494484
https://github.com/XTLS/Xray-core/pull/7249#issuecomment-6483591550
2026-10-28 23:45:22 +00:00
Meow and GitHub
613d8147bb
Direct/Freedom outbound: Warn about migrating fragment and noises to Finalmask ( #7242 )
...
https://github.com/XTLS/Xray-core/issues/7240#issuecomment-6361862358
2026-10-28 22:49:30 +00:00
35a3121a83
File loader: Check file extensions without resolving symlinks ( #7255 )
...
https://github.com/XTLS/Xray-core/pull/7255#issuecomment-6481194940
https://github.com/XTLS/Xray-core/pull/7250#issuecomment-6398816842
Fixes https://github.com/XTLS/Xray-core/issues/7239#issuecomment-6356122816
---------
Co-authored-by: Eljees <3.14hell@gmail.com >
2026-10-28 21:59:03 +00:00
Artem Lytkin and GitHub
fc5ba8e6a2
XDRIVE transport: Support h3 (Chrome CH by default) and XMUX as well; Send Chrome HTTP headers (User-Agent, etc.) by default ( #7187 )
...
https://github.com/XTLS/Xray-core/pull/7181#issuecomment-6229694351
https://github.com/XTLS/Xray-core/pull/7187#issuecomment-6250200781
https://github.com/XTLS/Xray-core/pull/7187#issuecomment-6314784068
2026-10-21 11:33:55 +00:00
Meow and GitHub
3653dcb4fc
Finalmask: Add filter for inbound (TCP & UDP, source IP filtering) ( #7206 )
...
https://github.com/XTLS/Xray-core/pull/7206#issuecomment-6312634417
2026-10-21 10:48:15 +00:00
Artem Lytkin and GitHub
95461cc148
XDRIVE transport: Require VLESS Multiplex+Encryption; "Google Drive"->"google-drive" ( #7182 )
...
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5752780799
2026-10-17 14:13:57 +00:00
Artem Lytkin and GitHub
3834e504b8
XDRIVE transport: Prefer h2 (Chrome CH by default); End stalled requests; Other small changes ( #7181 )
...
https://github.com/XTLS/Xray-core/pull/7170#issuecomment-6204133548
2026-10-17 09:24:53 +00:00
206a24a9f0
Noise finalmask: Support Lua script as well (on main branch: inline scripts were disabled for now; sandbox-only for now) ( #7124 )
...
https://github.com/XTLS/Xray-core/pull/7124#issuecomment-6108165942
https://github.com/XTLS/Xray-core/pull/7124#issuecomment-6149363945
https://github.com/XTLS/Xray-core/pull/7124#issuecomment-6207934753
---------
Co-authored-by: Meow <197331664+Meo597@users.noreply.github.com >
2026-10-16 04:43:55 +00:00
LjhAUMEM and GitHub
10879a4a8b
XDNS finalmask: Support DoH ("https://", tlsConfig, domain fronting, etc., quicConfig, Chrome Client Hello by default) with empty HTTP User-Agent ( #7140 )
...
https://github.com/XTLS/Xray-core/pull/7103#issuecomment-6118333973
https://github.com/XTLS/Xray-core/pull/7140#issuecomment-6161808702
https://github.com/XTLS/Xray-core/pull/7140#issuecomment-6167254749
https://github.com/XTLS/Xray-core/pull/7140#issuecomment-6185965142
https://github.com/XTLS/Xray-core/pull/7140#issuecomment-6200775375
2026-10-15 22:41:19 +00:00
c77a4d0e49
MASQUE client: Support XMUX ("maxConnections": 1 by default); Use Chrome's User-Agent by default ( #7121 )
...
https://github.com/XTLS/Xray-core/pull/6810#issuecomment-5842441136
https://github.com/XTLS/Xray-core/pull/6878#issuecomment-6095112915
https://github.com/XTLS/Xray-core/pull/7121#issuecomment-6117636043
---------
Co-authored-by: SVLAVR <skugorov.s@gmail.com >
2026-10-12 19:40:04 +00:00
Meow and GitHub
5a64db009b
Lua: Support inline scripts; Add ./xray base64 encode/decode [-gzip] command ( #7132 )
...
https://github.com/XTLS/Xray-core/pull/7124#issuecomment-6110557806
https://github.com/XTLS/Xray-core/pull/7132#issuecomment-6118169645
https://github.com/XTLS/Xray-core/pull/7132#issuecomment-6126428359
2026-10-12 16:58:20 +00:00
brookwko and RPRX
1dd2a0bd3c
TUN inbound: Support autoSystemDnsToGateway on FreeBSD as well ( #7123 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-5859521287
https://github.com/XTLS/Xray-core/pull/6691#issuecomment-5445818753
https://github.com/XTLS/Xray-core/pull/6773 & https://github.com/XTLS/Xray-core/pull/6853
2026-10-12 02:48:59 +00:00
Meow and GitHub
8855145e58
Xray-core: Add Lua script for dns and routing ( #6823 )
...
https://github.com/XTLS/Xray-core/pull/6823#issuecomment-5843754759
https://github.com/XTLS/Xray-core/pull/6823#issuecomment-5861456450
https://github.com/XTLS/Xray-core/pull/6823#issuecomment-6093596069
2026-10-10 09:01:16 +00:00
风扇滑翔翼 and RPRX
5af2e9c228
TLS client: Use Xray-core's built-in RootCAs by default (avoids maliciously injected CA in the OS) ( #7105 )
...
https://github.com/XTLS/Xray-core/pull/5532#issuecomment-3745598515
https://github.com/XTLS/Xray-core/pull/7098#issuecomment-6053012480
https://github.com/XTLS/Xray-core/pull/7105#issuecomment-6093006914
2026-10-10 06:53:39 +00:00
Cluvex and GitHub
9e55a6ed18
MASQUE client: Support WARP ( #6878 )
...
https://github.com/XTLS/Xray-core/pull/6844#issuecomment-5859092964
https://github.com/XTLS/Xray-core/pull/6862#issuecomment-5897508127
https://github.com/XTLS/Xray-core/pull/6878#issuecomment-6052448898
2026-10-08 04:53:07 +00:00
LjhAUMEM and GitHub
a3c6cc6aa8
XDNS finalmask: Default values for types; name->names; type+addr->addrs ( #7090 )
...
https://github.com/XTLS/Xray-core/pull/7090#issuecomment-5989883544
https://github.com/XTLS/Xray-core/pull/7090#issuecomment-5988755551
https://github.com/XTLS/Xray-core/pull/7089#issuecomment-5987266008
2026-10-05 08:07:19 +00:00
1f304916bd
TUN inbound: Add autoSystemWfpBlockLeak on Windows (blocks "dns" and "misconfigtun" IPv4/IPv6 traffic leaks outside the TUN); Rename autoSystemDNS to autoSystemDnsToGateway on Linux (and change some behaviors) ( #6853 )
...
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5899791359
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5901287980
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5903680113
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5904123488
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5904647772
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5905047424
Fixes https://github.com/XTLS/Xray-core/issues/6454#issuecomment-5863800676
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 06:26:16 +00:00
Cluvex and GitHub
e51b3c3621
Noise finalmask: type supports "exp" ( #6862 )
...
https://github.com/XTLS/Xray-core/pull/6844#issuecomment-5859092964
https://github.com/XTLS/Xray-core/pull/6844#issuecomment-5859855674
https://github.com/XTLS/Xray-core/pull/6862#issuecomment-5897471145
2026-09-30 03:11:12 +00:00
LjhAUMEM and GitHub
fc8f8a451d
XDNS finalmask: Refactor and new parameters ( #6718 )
...
https://github.com/XTLS/Xray-core/pull/6718#issuecomment-5894987590
Fixes https://github.com/XTLS/Xray-core/issues/6692
2026-09-29 17:16:59 +00:00
7780db9bbe
Finalmask: Fix panic when udpHop or xicmp fails; Restore udpHop's default interval ( #6808 )
...
https://github.com/XTLS/Xray-core/pull/6808#pullrequestreview-5324529175
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-27 22:17:47 +00:00
youugiuhiuh and GitHub
47a2c2ffdc
TUN inbound: Add autoSystemDNS on Linux (to TUN's gateway) ( #6773 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-4931311976
https://github.com/XTLS/Xray-core/pull/6773#issuecomment-5755516423
https://github.com/XTLS/Xray-core/pull/6807#issuecomment-5807844210
2026-09-27 20:07:53 +00:00
Cluvex and GitHub
7a018833ec
Proxy: Add MASQUE inbound (IETF CONNECT-IP server, RFC 9484) ( #6844 )
...
Completes https://github.com/XTLS/Xray-core/pull/6807 and https://github.com/XTLS/Xray-core/pull/6810
2026-09-27 19:16:54 +00:00
风扇滑翔翼 and GitHub
65e853ed84
SS2022 proxy: Refactor to remove sing* dependencies ( #6831 )
...
https://github.com/XTLS/Xray-core/pull/4356#issuecomment-2639571931
2026-09-27 18:42:53 +00:00
风扇滑翔翼 and RPRX
61cad5ec8b
Xray-core: Reduce error log usage for performance ( #6796 )
...
https://github.com/XTLS/Xray-core/pull/6796#issuecomment-5807809588
2026-09-25 17:59:49 +00:00
Esko Mobius and GitHub
7d3e44fee2
Proxy: Add MASQUE outbound & transport (IETF CONNECT-IP, RFC 9484) ( #6807 )
...
Closes https://github.com/XTLS/Xray-core/issues/5495#issuecomment-3710683679
2026-09-24 02:13:37 +00:00
LjhAUMEM and RPRX
efc9e6da62
WireGuard outbound: Remove remoteDNS' "local" mode and domainStrategy ( #6771 )
...
https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5660953757
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751826982
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751831637
2026-09-20 19:07:51 +00:00
LjhAUMEM and GitHub
8267cf953a
Transport: Refactor to be based on Finalmask's dialer & listener ( #6754 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5645958010
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5720818254
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5751585906
2026-09-20 18:12:50 +00:00
dcdfc57ccd
XDRIVE transport: Add the Google Drive and "template" backend ( #6748 )
...
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3849778103
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3851839033
https://github.com/XTLS/Xray-core/pull/6745#issuecomment-5627294204
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5660444946
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5719209642
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-09-19 09:03:11 +00:00
3461c511aa
XDRIVE transport: The universal remote-storage/any-service-based proxy, ignoring IP whitelists ( #5645 )
...
https://github.com/XTLS/Xray-core/pull/5414#issuecomment-3796734827
https://github.com/XTLS/Xray-core/pull/5581#issuecomment-3797134147
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3899873945
https://github.com/XTLS/Xray-core/pull/6745#issuecomment-5627420177
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5740443122
---------
Co-authored-by: Risaro <62798663+Risaro@users.noreply.github.com >
2026-09-19 08:23:38 +00:00
18a1b5042a
Finalmask: Make "udpHop" a new UDP mask ( #6327 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5592421364
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-09-08 22:15:02 +00:00
风扇滑翔翼 and GitHub
a1bf968be9
VLESS config: Fix validateOutboundTransportSecurity() ( #6741 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6737#issuecomment-5587270250
2026-09-08 18:18:12 +00:00
风扇滑翔翼 and GitHub
c037ccd98d
infra/vformat/main.go: Refactor ( #6739 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5581733848
2026-09-08 17:19:15 +00:00
RPRX
47cfe9994a
Update github.com/xtls/reality to 20260908062103
...
https://github.com/XTLS/REALITY/commit/8cdf7bf9c7f09cb9814bf08c3eb877f68b85fba8
https://github.com/XTLS/REALITY/commit/e1986a4d31ca33c087a72ab4644aef1295693b69
https://github.com/XTLS/REALITY/commit/393f8de3ee2d685271d79ee608334e441b2db324
2026-09-08 07:22:54 +00:00
Meow and GitHub
3e2f040cd8
Direct/Freedom outbound: Better Compatibility ( #6058 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6393
2026-09-08 03:31:25 +00:00
01a034be53
Blackhole outbound: Add customizable response data support ( #6713 )
...
https://github.com/XTLS/Xray-core/pull/6711#issuecomment-5508683394
---------
Co-authored-by: Raaad1on <djilyawhite@gmail.com >
2026-09-07 21:09:58 +00:00
patterniha and GitHub
fc7b980636
Sockopt: Fix indentation of the CustomSockopt block for Linux ( #6568 )
...
https://github.com/XTLS/Xray-core/pull/6568#issuecomment-5488145252
Fixes https://github.com/XTLS/Xray-core/issues/6564
Fixes https://github.com/XTLS/Xray-core/issues/6602
2026-09-01 04:47:55 +00:00
meanwhile131 and GitHub
5e245b082e
Routing: Export HealthCheckSettings ( #6680 )
2026-08-30 12:19:54 +00:00
LjhAUMEM and GitHub
ada99a4eb0
Hysteria: Upgrade to official v2.12.2 ( #6565 )
...
https://github.com/XTLS/Xray-core/pull/6565#issuecomment-5202554275
Fixes https://github.com/XTLS/Xray-core/issues/6408
Fixes https://github.com/XTLS/Xray-core/issues/6598
...
2026-08-27 17:25:56 +00:00
风扇滑翔翼
65458e919f
Config: Fix some issues ( #6640 )
...
https://github.com/XTLS/Xray-core/pull/6640#issuecomment-5420106315
Fixes https://github.com/XTLS/Xray-core/issues/6636
Fixes https://github.com/XTLS/Xray-core/issues/6600
...
2026-08-27 20:03:59 +08:00
c7e569b037
WireGuard outbound: Add remoteDNS & honor TTL ( #6620 )
...
Closes https://github.com/XTLS/Xray-core/pull/6569#issuecomment-5263789755
Fixes https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5150957597
---------
Co-authored-by: LagPixelLOL <2282688304@qq.com >
2026-08-25 14:28:36 +00:00
fanymagnet and GitHub
a12801c13b
Routing: Add localOS that directly matches runtime.GOOS ( #6553 )
...
https://github.com/XTLS/Xray-core/pull/6553#issuecomment-5262686006
2026-08-12 05:29:32 +00:00
