patterniha and Claude Opus 5.5
2933b0c8d5
TUN inbound: Don't warn that loopback DNS servers are blocked
...
With autoSystemWfpBlockLeak, loopback now always stays allowed, so a DNS
server in dns like 127.0.0.1, a local resolver, stays reachable although
it lies in neither gateway nor autoSystemRoutingTable. Leave loopback
servers out of the warning that queries to them cannot go through the TUN
and are blocked, and say so in the README.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-02 12:27:26 +03:30
patterniha and Claude Opus 5.5
bb4cd4b6d3
TUN inbound's autoSystemWfpBlockLeak: Add "allexceptlan"
...
"allexceptlan" is "all" but for the local network: traffic to and from
private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), link-local
(169.254.0.0/16, fe80::/10), multicast (224.0.0.0/4, ff00::/8) and broadcast
(255.255.255.255) addresses stays allowed, so that printers, the router's
settings page, or casting to a TV keep working while nothing else leaves
outside the TUN.
It includes "dns": a resolver on the local network, like the router's,
would forward the queries outside the TUN, so DNS stays blocked there. The
LAN permit sits below the other values, like the permit through the TUN, so
they still apply on the local network, e.g. "tcp/445" blocks Windows file
sharing with it. The DNS Client service keeps mDNS and LLMNR, to the local
network's addresses only. "all" overrides it.
The addresses are matched with FWP_V4_ADDR_MASK and FWP_V6_ADDR_MASK
conditions on the remote address, which match when any of them does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-02 11:50:18 +03:30
patterniha and Claude Opus 5.5
468f745fc2
TUN inbound's autoSystemWfpBlockLeak: Add "all", "tcp", "udp", "icmp" and port ranges; Always allow loopback, DHCP and IPv6 neighbor discovery
...
autoSystemWfpBlockLeak now also takes:
- "all": everything outside the TUN, IPv4 and IPv6, in both directions, so
nothing but Xray leaves except through the TUN.
- "tcp", "udp": all ports of that protocol, also written "tcp/0", "udp/0".
- "tcp/<low>-<high>", "udp/<low>-<high>": a range of ports, matched with
FWP_MATCH_RANGE, as two conditions on the same field would match when
either does.
- "icmp": ICMP and ICMPv6, e.g. ping. It takes no port: in ICMP filters the
local port holds the type, and "icmp/0" would read as the echo reply.
Values are normalized: "tcp/0" and "tcp/1-65535" become "tcp", and
"tcp/53-53" becomes "tcp/53".
Whatever is blocked, loopback, which cannot leave the system, and what
Windows itself needs on the local link now always stay allowed: DHCP, DHCPv6,
and IPv6 neighbor and multicast listener discovery. These used to be allowed
only along with "misconfigtun", so "udp" or "icmp" would otherwise have cut
DHCP or IPv6 neighbor discovery, and "tcp" any local proxy, Xray's own
inbounds included. Loopback being allowed means that with "dns", a local
resolver on 127.0.0.1:53 now works for other programs (its own queries to
port 53 or 853 outside the TUN stay blocked), and the DNS Client service
may use it.
"all" reuses the filters of "misconfigtun", which now also let everything
through the TUN, for both IP versions whatever the routes.
On other TUN options: keeping the system's DNS inside the TUN, with "all",
"dns", "windnsclient", or anything covering TCP or UDP port 53 ("udp",
"tcp/50-60", ...), needs dns, as Windows can no longer reach the DNS
servers of the other interfaces; the config is rejected otherwise. Like the
other values, the new ones need autoSystemRoutingTable. The filters do not
need autoOutboundsInterface, as Xray is allowed by its app ID; it still
keeps Xray's own connections out of the TUN's routes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-02 11:13:10 +03:30
6cdd323ad8
TUN inbound's autoSystemWfpBlockLeak: Support "tcp/port" and "udp/port"; "dns" covers "tcp/853" and "udp/853" as well ( #7288 )
...
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-6492838227
https://github.com/XTLS/Xray-core/pull/7288#issuecomment-6507229727
https://github.com/XTLS/Xray-core/pull/7288#issuecomment-6516762634
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-31 13:16:31 +00:00
bc7c895278
HTTP inbound: Forward short 100 Continue responses promptly ( #7298 )
...
https://github.com/XTLS/Xray-core/pull/7298#issuecomment-6542585254
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-10-31 11:29:02 +00:00
风扇滑翔翼 and GitHub
d1140de273
Chore: Regenerate *.pb.go files ( #7287 )
...
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6464669635
2026-10-31 07:13:55 +00:00
78b5a6ec5c
GitHub Action CI: Enforce stricter checks on generated protobuf files ( #7263 )
...
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6447862934
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6484719865
https://github.com/XTLS/Xray-core/pull/7263#issuecomment-6485805671
---------
Co-authored-by: Fangliding <Fangliding.fshxy@outlook.com >
2026-10-29 02:34:47 +00:00
5865e3ac3d
DNS outbound: Keep hijacked A/AAAA replies within the buffer ( #7225 )
...
https://github.com/XTLS/Xray-core/pull/7225#pullrequestreview-5613859264
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-10-29 00:42:19 +00:00
6a4274ab75
TUN inbound: autoOutboundsInterface should not set IP_BOUND_IF on IPv6 sockets on Darwin (mainly macOS) ( #7230 )
...
Fixes https://github.com/XTLS/Xray-core/issues/7228
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-28 20:34:40 +00:00
solodecode and GitHub
229799a7a3
Direct/Freedom outbound: Fix blockDelay for DispatchLink() inbounds such as VLESS, Hysteria, etc. ( #7238 )
...
https://github.com/XTLS/Xray-core/pull/7238#pullrequestreview-5627787937
https://github.com/XTLS/Xray-core/pull/7238#issuecomment-6467092152
https://github.com/XTLS/Xray-core/pull/6060#issuecomment-4384511163
2026-10-28 11:02:55 +00:00
3071fbfa25
Sockopt: Handle single-family interface binding on Windows, including TUN inbound's autoOutboundsInterface ( #7214 )
...
And https://github.com/XTLS/Xray-core/pull/7214#issuecomment-6329118637
https://github.com/XTLS/Xray-core/pull/7201#issuecomment-6314453444
Fixes https://github.com/XTLS/Xray-core/issues/7160#issuecomment-6246944012
---------
Co-authored-by: patterniha <71074308+patterniha@users.noreply.github.com >
2026-10-28 10:15:58 +00:00
Artem Lytkin and GitHub
557657b576
TUN inbound: Read large TCP segments straight into Xray-core's buffers on Linux ( #7179 )
...
https://github.com/XTLS/Xray-core/pull/7130#issuecomment-6119897360
https://github.com/XTLS/Xray-core/pull/7156#issuecomment-6205035216
https://github.com/XTLS/Xray-core/pull/7179#issuecomment-6250145934
2026-10-21 11:49:36 +00:00
061c2df291
HTTP outbound: Fix hanging on server-first traffic ( #7193 )
...
https://github.com/XTLS/Xray-core/pull/7193#issuecomment-6312885274
Fixes https://github.com/XTLS/Xray-core/issues/3459
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-10-21 10:33:27 +00:00
41797c234d
Socks inbound: Initialize TempUDPConn's Timer at the beginning ( #7203 )
...
Fixes https://github.com/XTLS/Xray-core/pull/7200
---------
Co-authored-by: Eliot the Cougar <1861169+eliotcougar@users.noreply.github.com >
2026-10-21 09:17:34 +00:00
0f127f934c
XTLS Vision: Compatible with Go 1.27.3+ ( #7176 )
...
https://github.com/XTLS/Xray-core/pull/7176#issuecomment-6229087350
Fixes https://github.com/XTLS/Xray-core/issues/7162#issuecomment-6210430747
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-10-17 03:37:14 +00:00
0f3d884786
WireGuard outbound: Keep the device when its setup fails ( #7151 )
...
https://github.com/XTLS/Xray-core/pull/7151#issuecomment-6186150131
Fixes https://github.com/XTLS/Xray-core/pull/7151#issuecomment-6190189547
---------
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-10-16 09:50:47 +00:00
fe2ae23f42
Sockopt: Cancel dialing after failed to bind interface, external controllers included such as TUN inbound's ( #7173 )
...
https://github.com/XTLS/Xray-core/pull/7161#issuecomment-6185101741
Fixes https://github.com/XTLS/Xray-core/issues/7160#issuecomment-6200788453
---------
Co-authored-by: Gleb <a1212gleb@gmail.com >
2026-10-16 06:37:52 +00:00
d15966c76c
Fixes: Regard int() as int32() by default, which should be a coding standard ( #7155 )
...
https://github.com/XTLS/Xray-core/pull/7155#issuecomment-6208455069
Fixes https://github.com/XTLS/Xray-core/pull/7148#issuecomment-6173633056
---------
Co-authored-by: Denis Orlov <freshcrowd@gmail.com >
Co-authored-by: Milomilo777 <117558067+Milomilo777@users.noreply.github.com >
2026-10-16 05:12:52 +00:00
Artem Lytkin and GitHub
8703fdb101
WireGuard, MASQUE proxies: Use Xray-core's built-in lightweight TCP/IP stack instead of gVisor as well ( #7156 )
...
https://github.com/XTLS/Xray-core/pull/7130#issuecomment-6116258188
https://github.com/XTLS/Xray-core/pull/7130#issuecomment-6120742739
https://github.com/XTLS/Xray-core/pull/7130#issuecomment-6137264458
https://github.com/XTLS/Xray-core/pull/7156#issuecomment-6202933664
https://github.com/XTLS/Xray-core/pull/7156#issuecomment-6203239736
2026-10-15 23:38:14 +00:00
0888beb38a
SS2022 proxy: Correct interrupt behavior and UDP conn change ( #7143 )
...
Fixes https://github.com/XTLS/Xray-core/pull/7142 and https://github.com/XTLS/Xray-core/pull/7143#issuecomment-6163926468
---------
Co-authored-by: ChownYourLife <260039878+ChownYourLife@users.noreply.github.com >
2026-10-14 11:05:45 +00:00
c77a4d0e49
MASQUE client: Support XMUX ("maxConnections": 1 by default); Use Chrome's User-Agent by default ( #7121 )
...
https://github.com/XTLS/Xray-core/pull/6810#issuecomment-5842441136
https://github.com/XTLS/Xray-core/pull/6878#issuecomment-6095112915
https://github.com/XTLS/Xray-core/pull/7121#issuecomment-6117636043
---------
Co-authored-by: SVLAVR <skugorov.s@gmail.com >
2026-10-12 19:40:04 +00:00
brookwko and RPRX
1dd2a0bd3c
TUN inbound: Support autoSystemDnsToGateway on FreeBSD as well ( #7123 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-5859521287
https://github.com/XTLS/Xray-core/pull/6691#issuecomment-5445818753
https://github.com/XTLS/Xray-core/pull/6773 & https://github.com/XTLS/Xray-core/pull/6853
2026-10-12 02:48:59 +00:00
Artem Lytkin and RPRX
70ef97d564
TUN inbound: Use Xray-core's built-in lightweight TCP/IP stack instead of gVisor ( #7130 )
...
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5752154561
https://github.com/XTLS/Xray-core/pull/6795#issuecomment-6095740152
https://github.com/XTLS/Xray-core/pull/7130#issuecomment-6116258188
2026-10-12 02:18:56 +00:00
2a14c50775
Socks inbound: Fix stats for UDP Associate traffic ( #7101 )
...
https://github.com/XTLS/Xray-core/pull/7101#pullrequestreview-5452526703
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-10-08 09:21:21 +00:00
8989adfd3f
TUN inbound: Handle weak host send and forwarding on the outbound interface on Windows ( #7092 )
...
https://github.com/XTLS/Xray-core/issues/6776#issuecomment-5994046421
https://github.com/XTLS/Xray-core/issues/6776#issuecomment-5994796106
Closes https://github.com/XTLS/Xray-core/issues/6776
Closes https://github.com/XTLS/Xray-core/issues/6872
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-08 05:49:28 +00:00
Hossin Asaadi and GitHub
1a60fc78ff
TUN inbound: Duplicate the iOS tunnel file descriptor ( #6883 )
...
https://github.com/XTLS/Xray-core/pull/6883#issuecomment-6008368575
2026-10-08 05:14:14 +00:00
nSQUICK and GitHub
1e08d48d88
TUN inbound: Start on Windows when IPv6 is disabled system-wide ( #6874 )
...
https://github.com/XTLS/Xray-core/pull/6874#issuecomment-5989986544
2026-10-05 07:26:00 +00:00
92f7e72490
WireGuard kernelTun: Fix IPv6 table index allocation when the first table is occupied ( #6881 )
...
https://github.com/XTLS/Xray-core/pull/6881#issuecomment-5927334896
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-10-05 03:50:22 +00:00
Denis and GitHub
08775afd65
WireGuard inbound: Reduce memory held by idle UDP flows ( #6856 )
...
https://github.com/XTLS/Xray-core/pull/6856#issuecomment-5870639238
2026-10-05 01:56:36 +00:00
Denis and GitHub
e0bae21201
WireGuard inbound: Reply fake pong to ICMP ping ( #6855 )
...
https://github.com/XTLS/Xray-core/pull/6015#issuecomment-4321525342
2026-10-05 01:36:54 +00:00
1f304916bd
TUN inbound: Add autoSystemWfpBlockLeak on Windows (blocks "dns" and "misconfigtun" IPv4/IPv6 traffic leaks outside the TUN); Rename autoSystemDNS to autoSystemDnsToGateway on Linux (and change some behaviors) ( #6853 )
...
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5899791359
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5901287980
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5903680113
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5904123488
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5904647772
https://github.com/XTLS/Xray-core/pull/6853#issuecomment-5905047424
Fixes https://github.com/XTLS/Xray-core/issues/6454#issuecomment-5863800676
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 06:26:16 +00:00
风扇滑翔翼
0086362663
SS2022 proxy: Refactor to fix some issues ( #6866 )
...
https://github.com/XTLS/Xray-core/pull/6866#issuecomment-5904374529
Fixes https://github.com/XTLS/Xray-core/pull/6831#issuecomment-5884408501 and https://github.com/XTLS/Xray-core/pull/6866#issuecomment-5889568266
2026-09-30 13:16:27 +08:00
风扇滑翔翼
35e616d3b9
Xray-core: Move PacketConnWrapper to common/net ( #6854 )
...
https://github.com/XTLS/Xray-core/pull/6854#issuecomment-5895541650
Fixes https://github.com/XTLS/Xray-core/issues/6849
2026-09-30 02:33:53 +08:00
v2ray and RPRX
08cb6e6bca
WireGuard proxy: Fix potential startup races ( #6852 )
...
https://github.com/XTLS/Xray-core/pull/6852#issuecomment-5871816550
Fixes https://github.com/XTLS/Xray-core/issues/6850
2026-09-29 18:13:43 +00:00
e5e85ca9da
XTLS Vision: Suppress outer CloseNotify after switching to direct copy ( #6834 )
...
https://github.com/XTLS/Xray-core/pull/6816#issuecomment-5828082031
https://github.com/XTLS/Xray-core/issues/6794#issuecomment-5847200576
https://github.com/XTLS/Xray-core/pull/6834#issuecomment-5860728689
Fixes https://github.com/XTLS/Xray-core/issues/6794#issuecomment-5754894283
Fixes https://github.com/XTLS/Xray-core/issues/6124#issuecomment-4439918073
Fixes https://github.com/XTLS/Xray-core/issues/4878#issuecomment-5754638401
---------
Co-authored-by: Artem Lytkin <146867384+4RH1T3CT0R7@users.noreply.github.com >
2026-09-27 23:39:21 +00:00
7b8ade3ec5
TUN inbound: Only close the UDP connection that actually finished ( #6814 )
...
https://github.com/XTLS/Xray-core/pull/6814#pullrequestreview-5324536423
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-27 21:06:19 +00:00
Artem Lytkin and GitHub
5dda894e29
TUN inbound: Reuse existing Wintun adapter by name on Windows again ( #6811 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6780
2026-09-27 20:39:17 +00:00
youugiuhiuh and GitHub
47a2c2ffdc
TUN inbound: Add autoSystemDNS on Linux (to TUN's gateway) ( #6773 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-4931311976
https://github.com/XTLS/Xray-core/pull/6773#issuecomment-5755516423
https://github.com/XTLS/Xray-core/pull/6807#issuecomment-5807844210
2026-09-27 20:07:53 +00:00
Cluvex and GitHub
7a018833ec
Proxy: Add MASQUE inbound (IETF CONNECT-IP server, RFC 9484) ( #6844 )
...
Completes https://github.com/XTLS/Xray-core/pull/6807 and https://github.com/XTLS/Xray-core/pull/6810
2026-09-27 19:16:54 +00:00
风扇滑翔翼 and GitHub
65e853ed84
SS2022 proxy: Refactor to remove sing* dependencies ( #6831 )
...
https://github.com/XTLS/Xray-core/pull/4356#issuecomment-2639571931
2026-09-27 18:42:53 +00:00
风扇滑翔翼 and RPRX
61cad5ec8b
Xray-core: Reduce error log usage for performance ( #6796 )
...
https://github.com/XTLS/Xray-core/pull/6796#issuecomment-5807809588
2026-09-25 17:59:49 +00:00
Hossin Asaadi and GitHub
60e2a0c502
WireGuard proxy: Release packet views after use ( #6801 )
...
https://github.com/XTLS/Xray-core/pull/6801#issuecomment-5807228464
2026-09-24 05:46:26 +00:00
Esko Mobius and GitHub
7d3e44fee2
Proxy: Add MASQUE outbound & transport (IETF CONNECT-IP, RFC 9484) ( #6807 )
...
Closes https://github.com/XTLS/Xray-core/issues/5495#issuecomment-3710683679
2026-09-24 02:13:37 +00:00
LjhAUMEM and GitHub
a308ded2e6
WireGuard outbound: Fix endpoint IP address ( #6804 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6803
2026-09-24 01:59:28 +00:00
d562d8947d
Hysteria outbound: Fix UDP DATAGRAM truncation with ChromeParrot ( #6788 )
...
https://github.com/XTLS/Xray-core/pull/6788#issuecomment-5751428127
---------
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-09-20 22:51:03 +00:00
Hossin Asaadi and GitHub
dbb1ea30ba
WireGuard proxy: Prevent panic when closing netTun with a write in flight ( #6778 )
...
https://github.com/XTLS/Xray-core/pull/6778#pullrequestreview-5251957308
2026-09-20 20:07:54 +00:00
LjhAUMEM and RPRX
efc9e6da62
WireGuard outbound: Remove remoteDNS' "local" mode and domainStrategy ( #6771 )
...
https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5660953757
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751826982
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751831637
2026-09-20 19:07:51 +00:00
LjhAUMEM and GitHub
8267cf953a
Transport: Refactor to be based on Finalmask's dialer & listener ( #6754 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5645958010
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5720818254
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5751585906
2026-09-20 18:12:50 +00:00
c412e77a9b
TUN inbound: Preserve UDP packet destinations with traffic stats ( #6747 )
...
https://github.com/XTLS/Xray-core/pull/6747#issuecomment-5647964551
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-12 20:09:35 +00:00
patterniha and GitHub
c26d2eda24
Direct/Freedom outbound: Skip domain resolution and finalRules when using sockopt.dialerProxy ( #6742 )
...
https://github.com/XTLS/Xray-core/pull/6058#issuecomment-5578800461
2026-09-08 18:45:38 +00:00
