detail

.github/docker/Dockerfile

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -40,15 +40,21 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 FROM gcr.io/distroless/static:nonroot
 
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/docker/Dockerfile.usa

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -40,6 +40,11 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 # Note on Distroless Base Image and Architecture Support:
 # - The official 'gcr.io/distroless/static' image provided by Google only supports a limited set of architectures for Linux:
@@ -55,9 +60,10 @@ FROM --platform=linux/amd64 gcr.io/distroless/static:nonroot
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/workflows/cleanup-dangling-images.yml

@@ -1,28 +0,0 @@
-name: Cleanup dangling container images
-
-on:
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Preview only (do not delete image versions)"
-        type: boolean
-        default: false
-
-# Share this lock with publishing and the other cleanup workflow.
-concurrency:
-  group: ghcr-images
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    permissions:
-      packages: write
-    steps:
-      # Untagged architecture manifests can still belong to a tagged image.
-      - name: Delete untagged and unreferenced versions
-        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
-        with:
-          delete-untagged: true
-          dry-run: ${{ inputs.dry_run }}

.github/workflows/cleanup-sha-images.yml

@@ -1,32 +0,0 @@
-name: Cleanup sha- container images
-
-on:
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Preview only (do not delete image versions)"
-        type: boolean
-        default: false
-
-# Share this lock with publishing and the other cleanup workflow.
-concurrency:
-  group: ghcr-images
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    permissions:
-      packages: write
-    steps:
-      # The repository needs Admin access under the package's Manage Actions access.
-      - name: Delete versions with only sha- tags
-        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
-        with:
-          use-regex: true
-          delete-tags: '^sha-'
-          # Preserve every non-sha- tag. The colon check avoids matching digests.
-          exclude-tags: '^(?!sha-)[^:]+$'
-          delete-untagged: false
-          dry-run: ${{ inputs.dry_run }}

.github/workflows/docker.yml

@@ -82,7 +82,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/scheduled-assets-update.yml

@@ -40,7 +40,7 @@ jobs:
           max_attempts: 60
           command: |
             [ -d 'resources' ] || mkdir resources
-            LIST=('XTLS Xray-rules-dat geoip/geoip-lite geoip' 'XTLS Xray-rules-dat geosite/geosite geosite')
+            LIST=('Loyalsoldier v2ray-rules-dat geoip geoip' 'Loyalsoldier v2ray-rules-dat geosite geosite')
             for i in "${LIST[@]}"
             do
               INFO=($(echo $i | awk 'BEGIN{FS=" ";OFS=" "} {print $1,$2,$3,$4}'))

.github/workflows/test.yml

@@ -35,7 +35,24 @@ jobs:
         if: steps.check-assets.outputs.missing == 'true'
         run: sleep 90
 
-  check-format-and-proto:
+  check-proto:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v7
+      - name: Check Proto Version Header
+        run: |
+          head -n 4 core/config.pb.go > ref.txt
+          find . -name "*.pb.go" ! -name "*_grpc.pb.go" -print0 | while IFS= read -r -d '' file; do
+            if ! cmp -s ref.txt <(head -n 4 "$file"); then
+              echo "Error: Header mismatch in $file"
+              head -n 4 "$file"
+              exit 1
+            fi
+          done
+
+  check-format:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     permissions:
@@ -51,8 +68,6 @@ jobs:
           cache: false
       - name: Check Format
         run: go run ./infra/vformat/main.go -mode check -pwd ./
-      - name: Check Protobuf
-        run: go run ./infra/vprotogen/main.go -mode check -pwd ./
 
   test:
     needs: check-assets

app/dns/config.pb.go

@@ -266,9 +266,10 @@ type Config struct {
 	DisableFallback        bool          `protobuf:"varint,10,opt,name=disableFallback,proto3" json:"disableFallback,omitempty"`
 	DisableFallbackIfMatch bool          `protobuf:"varint,11,opt,name=disableFallbackIfMatch,proto3" json:"disableFallbackIfMatch,omitempty"`
 	EnableParallelQuery    bool          `protobuf:"varint,14,opt,name=enableParallelQuery,proto3" json:"enableParallelQuery,omitempty"`
-	Script                 string        `protobuf:"bytes,15,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields          protoimpl.UnknownFields
-	sizeCache              protoimpl.SizeCache
+	// Absolute path to the Lua DNS query script.
+	Script        string `protobuf:"bytes,15,opt,name=script,proto3" json:"script,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {

app/dns/config.proto

@@ -75,5 +75,6 @@ message Config {
 
   bool enableParallelQuery = 14;
 
+  // Absolute path to the Lua DNS query script.
   string script = 15;
 }

app/dns/dns.go

@@ -32,6 +32,7 @@ type DNS struct {
 	matcherInfos           []*DomainMatcherInfo
 	checkSystem            bool
 	script                 *scriptEngine
+	scriptPath             string
 }
 
 // DomainMatcherInfo contains information attached to index returned by Server.domainMatcher.
@@ -170,13 +171,6 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		clients = append(clients, NewLocalDNSClient(ipOption))
 	}
 
-	var script *scriptEngine
-	if config.Script != "" {
-		if script, err = newScriptEngine(config.Script); err != nil {
-			return nil, errors.New("failed to prepare DNS script").Base(err)
-		}
-	}
-
 	return &DNS{
 		hosts:                  hosts,
 		ipOption:               &ipOption,
@@ -188,7 +182,7 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		disableFallbackIfMatch: config.DisableFallbackIfMatch,
 		enableParallelQuery:    config.EnableParallelQuery,
 		checkSystem:            checkSystem,
-		script:                 script,
+		scriptPath:             config.Script,
 	}, nil
 }
 
@@ -199,10 +193,12 @@ func (*DNS) Type() interface{} {
 
 // Start implements common.Runnable.
 func (s *DNS) Start() error {
-	if s.script != nil {
-		if err := s.script.start(s); err != nil {
+	if s.scriptPath != "" {
+		engine, err := newScriptEngine(s.scriptPath, s)
+		if err != nil {
 			return errors.New("failed to initialize DNS script").Base(err)
 		}
+		s.script = engine
 	}
 	return nil
 }

app/dns/lua.go

@@ -52,7 +52,7 @@ func luaServers(s *DNS) []luaDNSServer {
 
 func registerLua(L *lua.LState, servers []luaDNSServer, client featureDNS.Client) {
 	L.PreloadModule("xray.dns", func(L *lua.LState) int {
-		pushIPs := xlua.NewReadOnlySlicePusher[net.IP](L)
+		pushIPs := xlua.NewSlicePusher[net.IP](L)
 
 		serverList := L.CreateTable(len(servers), 0)
 		for i, client := range servers {

app/dns/lua_benchmark_test.go

@@ -72,13 +72,10 @@ end
 	if err := os.WriteFile(path, []byte(script), 0o600); err != nil {
 		b.Fatal(err)
 	}
-	engine, err := newScriptEngine(path)
+	engine, err := newScriptEngine(path, server)
 	if err != nil {
 		b.Fatal(err)
 	}
-	if err := engine.start(server); err != nil {
-		b.Fatal(err)
-	}
 	b.Cleanup(engine.close)
 	for _, bench := range []struct {
 		name  string

app/dns/script.go

@@ -15,22 +15,17 @@ import (
 const scriptExecutionTimeout = 6 * time.Second
 
 type scriptEngine struct {
-	program *xlua.Program
-	pool    *xlua.Pool
+	pool *xlua.Pool
 }
 
-func newScriptEngine(script string) (*scriptEngine, error) {
-	program, err := xlua.Compile(script)
+func newScriptEngine(path string, server *DNS) (*scriptEngine, error) {
+	program, err := xlua.CompileFile(path)
 	if err != nil {
 		return nil, err
 	}
-	return &scriptEngine{program: program}, nil
-}
 
-func (e *scriptEngine) start(server *DNS) error {
-	pool, err := xlua.NewPool(server.ctx, scriptExecutionTimeout, e.program.NewStateFactory(
+	pool, err := xlua.NewPool(server.ctx, scriptExecutionTimeout, program.NewStateFactory(
 		scriptExecutionTimeout*20,
-		256,
 		func(L *lua.LState) {
 			geodata.RegisterLua(L)
 			log.RegisterLua(L)
@@ -43,18 +38,15 @@ func (e *scriptEngine) start(server *DNS) error {
 			return nil
 		}))
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	e.pool = pool
-	errors.LogInfo(server.ctx, "DNS script initialized")
-	return nil
+	errors.LogInfo(server.ctx, "DNS script initialized from ", path)
+	return &scriptEngine{pool: pool}, nil
 }
 
 func (e *scriptEngine) close() {
-	if e.pool != nil {
-		e.pool.Close()
-	}
+	e.pool.Close()
 }
 
 func (e *scriptEngine) query(domain string, option dns.IPOption) (ips []net.IP, ttl uint32, queryErr error) {

app/dns/script_test.go

@@ -85,13 +85,10 @@ end
 				ctx:     context.Background(),
 				clients: []*Client{{server: upstream, ipOption: &option, timeoutMs: time.Second}},
 			}
-			engine, err := newScriptEngine(path)
+			engine, err := newScriptEngine(path, server)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if err := engine.start(server); err != nil {
-				t.Fatal(err)
-			}
 			defer engine.close()
 
 			ips, ttl, err := engine.query("good.example", option)
@@ -128,7 +125,7 @@ func TestDNSScriptGeoIPFallback(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 	script := `
 local servers = require("xray.dns").Servers
-local ru_ips = require("xray.geodata").BuildIPMatcher("geoip:ru")
+local us_ips = require("xray.geodata").BuildIPMatcher("geoip:us")
 
 local by_id = {}
 for _, server in ipairs(servers) do
@@ -138,7 +135,7 @@ assert(by_id.primary and by_id.fallback, "primary and fallback DNS servers are r
 
 function HandleDNSQuery(domain, ipv4, ipv6, fake)
     local ips, ttl, err = by_id.primary:Query(domain, ipv4, ipv6, fake)
-    if not err and ru_ips:AnyMatch(ips) then
+    if not err and us_ips:AnyMatch(ips) then
         return ips, ttl, nil
     end
     return by_id.fallback:Query(domain, ipv4, ipv6, fake)
@@ -152,7 +149,7 @@ end
 	primary := &scriptNameServer{
 		name: "primary",
 		answers: map[string]net.IP{
-			"ru.example":    net.ParseIP("2a02:6b8::feed:0ff"),
+			"us.example":    net.ParseIP("2001:4860:4860::8888"),
 			"other.example": net.ParseIP("127.0.0.1"),
 		},
 		ttl: 30,
@@ -167,15 +164,11 @@ end
 	if err != nil {
 		t.Fatal(err)
 	}
-	engine, err := newScriptEngine(scriptPath)
-	if err != nil {
-		t.Fatal(err)
-	}
 	server := &DNS{
-		ctx:      context.Background(),
-		hosts:    hosts,
-		ipOption: &option,
-		script:   engine,
+		ctx:        context.Background(),
+		hosts:      hosts,
+		ipOption:   &option,
+		scriptPath: scriptPath,
 		clients: []*Client{
 			{id: "primary", server: primary, ipOption: &option, timeoutMs: 2 * time.Second},
 			{id: "fallback", server: fallback, ipOption: &option, timeoutMs: 2 * time.Second},
@@ -191,7 +184,7 @@ end
 		ip     net.IP
 		ttl    uint32
 	}{
-		{"Ru.Example.", net.ParseIP("2a02:6b8::feed:0ff"), 30},
+		{"Us.Example.", net.ParseIP("2001:4860:4860::8888"), 30},
 		{"other.example", net.ParseIP("9.9.9.9"), 60},
 	} {
 		ips, ttl, err := server.LookupIP(tc.domain, option)
@@ -209,67 +202,29 @@ end
 
 func TestDNSScriptRejectsInvalidStartup(t *testing.T) {
 	for _, tc := range []struct {
-		name, script string
-		compileError bool
+		name   string
+		script string
 	}{
-		{"syntax", "function HandleDNSQuery(", true},
-		{"missing hook", "value = 1", false},
-		{"invalid hook", "HandleDNSQuery = true", false},
-		{"top-level error", `error("setup failed")`, false},
+		{"syntax", "function HandleDNSQuery("},
+		{"missing hook", "value = 1"},
+		{"top-level error", `error("setup failed")`},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "script.lua")
 			if err := os.WriteFile(path, []byte(tc.script), 0o600); err != nil {
 				t.Fatal(err)
 			}
-			server, err := New(context.Background(), &Config{Script: path})
-			if tc.compileError {
-				if server != nil || err == nil || !strings.Contains(err.Error(), "failed to prepare DNS script") {
-					t.Fatalf("New = %v, %v; want nil server and script preparation error", server, err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer server.Close()
-			if server.script.program == nil || server.script.pool != nil {
-				t.Fatal("New did not compile the script without starting its pool")
-			}
-			if err := server.Close(); err != nil {
-				t.Fatal(err)
-			}
+			server := &DNS{ctx: context.Background(), scriptPath: path}
 			if err := server.Start(); err == nil {
 				t.Fatal("Start accepted an invalid DNS script")
 			}
-			if server.script.pool != nil {
-				t.Fatal("Start retained a script pool after failure")
+			if server.script != nil {
+				t.Fatal("Start retained a script engine after failure")
 			}
 		})
 	}
 }
 
-func TestDNSScriptProgramSnapshot(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "script.lua")
-	if err := os.WriteFile(path, []byte(`function HandleDNSQuery() return nil, nil, "compiled" end`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer engine.close()
-	if err := os.Remove(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := engine.start(&DNS{ctx: context.Background()}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := engine.query("example.com", featureDNS.IPOption{}); err == nil || !strings.Contains(err.Error(), "compiled") {
-		t.Fatalf("query error = %v, want compiled", err)
-	}
-}
-
 func TestDNSScriptFakeDNSOption(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "script.lua")
 	script := `
@@ -296,16 +251,12 @@ end
 		answers: map[string]net.IP{"good.example": net.ParseIP("198.18.0.1")},
 		ttl:     30,
 	}
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
 	server := &DNS{
-		ctx:      context.Background(),
-		hosts:    hosts,
-		ipOption: &option,
-		script:   engine,
-		clients:  []*Client{{id: "fake", server: upstream, ipOption: &option, timeoutMs: time.Second}},
+		ctx:        context.Background(),
+		hosts:      hosts,
+		ipOption:   &option,
+		scriptPath: path,
+		clients:    []*Client{{id: "fake", server: upstream, ipOption: &option, timeoutMs: time.Second}},
 	}
 	if err := server.Start(); err != nil {
 		t.Fatal(err)

app/geodata/download.go

@@ -21,13 +21,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-const (
-	idleTimeout           = 30 * time.Second
-	maxDownloadSize int64 = 256 * 1024 * 1024
-)
-
-// DO NOT EDIT. Ignored by geodata, rejected by Lua.
-const luaGuardHeader = "\x12\x01\x00"
+const idleTimeout = 30 * time.Second
 
 type stage struct {
 	target string
@@ -36,6 +30,7 @@ type stage struct {
 
 type downloader struct {
 	ctx         context.Context
+	httpClient  *http.Client
 	httpsClient *http.Client
 }
 
@@ -63,11 +58,12 @@ func (c *idleConn) Write(b []byte) (int, error) {
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
 		ctx:         ctx,
-		httpsClient: newClient(ctx, dispatcher, outbound),
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
 	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
 		var conn net.Conn
 		err := task.Run(ctx, func() error {
@@ -92,33 +88,53 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 			Conn: conn,
 		}, nil
 	}
-	return &http.Client{
-		Transport: &http2.Transport{
-			DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
-				conn, err := dial(ctx, network, address)
-				if err != nil {
-					return nil, err
-				}
-				host, _, _ := net.SplitHostPort(address)
-				tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
-				handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
-				defer cancel()
-				if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
-					conn.Close()
-					return nil, err
-				}
-				return tlsConn, nil
+	if isHTTPS {
+		return &http.Client{
+			Transport: &http2.Transport{
+				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+					conn, err := dial(ctx, network, address)
+					if err != nil {
+						return nil, err
+					}
+					host, _, _ := net.SplitHostPort(address)
+					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+					defer cancel()
+					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+						conn.Close()
+						return nil, err
+					}
+					return tlsConn, nil
+				},
 			},
-		},
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if req.URL.Scheme != "https" {
-				return errors.New("redirected to non-https URL: ", req.URL.String())
-			}
-			if len(via) >= 20 {
-				return errors.New("stopped after 20 redirects")
-			}
-			return nil
-		},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
 	}
 }
 
@@ -154,10 +170,6 @@ func (d *downloader) downloadOne(asset *Asset) (stage, error) {
 		}
 	}()
 
-	if _, err := temp.WriteString(luaGuardHeader); err != nil {
-		temp.Close()
-		return stage{}, err
-	}
 	if err := d.fetch(asset.Url, temp); err != nil {
 		temp.Close()
 		return stage{}, err
@@ -184,26 +196,27 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	resp, err := d.httpsClient.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		io.Copy(io.Discard, resp.Body)
 		return errors.New("unexpected status code: ", resp.StatusCode)
 	}
-	if resp.ContentLength > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 
-	n, err := io.Copy(writer, io.LimitReader(resp.Body, maxDownloadSize+1))
+	n, err := io.Copy(writer, resp.Body)
 	if err != nil {
 		return err
 	}
-	if n > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 	if n == 0 {
 		return errors.New("empty response body")
 	}

app/geodata/download_test.go

@@ -1,126 +0,0 @@
-package geodata
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	commongeodata "github.com/xtls/xray-core/common/geodata"
-	xlua "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
-	"github.com/yuin/gopher-lua/parse"
-	"google.golang.org/protobuf/proto"
-)
-
-func TestDownloadOneLuaGuard(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		body string
-		code string
-	}{
-		{"geodata", "\x0a\x03\x0a\x01A", "A"},
-		{"prefixed geodata", luaGuardHeader + "\x0a\x03\x0a\x01A", "A"},
-		{"Lua", "function HandleRoute() end", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			t.Setenv("xray.location.asset", dir)
-			if err := os.WriteFile(filepath.Join(dir, "asset.lua"), nil, 0o600); err != nil {
-				t.Fatal(err)
-			}
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				_, _ = w.Write([]byte(tc.body))
-			}))
-			defer server.Close()
-			d := &downloader{ctx: context.Background(), httpsClient: server.Client()}
-			staged, err := d.downloadOne(&Asset{Url: server.URL, File: "asset.lua"})
-			if err != nil {
-				t.Fatal(err)
-			}
-			tx, err := swapAll([]stage{staged})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := tx.commit(); err != nil {
-				t.Fatal(err)
-			}
-			data, err := os.ReadFile(staged.target)
-			if err != nil || string(data) != luaGuardHeader+tc.body {
-				t.Fatalf("downloaded data = % x, %v", data, err)
-			}
-			program, err := xlua.Compile(staged.target)
-			var syntaxErr *parse.Error
-			if program != nil || !errors.As(err, &syntaxErr) || syntaxErr.Pos.Line != 1 || syntaxErr.Pos.Column != 1 {
-				t.Fatalf("want Lua rejection at the first byte, got %v, %v", program, err)
-			}
-			if tc.code != "" {
-				var list commongeodata.GeoSiteList
-				if err := proto.Unmarshal(data, &list); err != nil {
-					t.Fatal(err)
-				}
-				if len(list.Entry) != 1 || list.Entry[0].Code != tc.code {
-					t.Fatalf("header changed geodata: %v", &list)
-				}
-				if _, err := commongeodata.ParseDomainRules([]string{"ext:" + filepath.Base(staged.target) + ":" + tc.code}, commongeodata.Domain_Full); err != nil {
-					t.Fatalf("geodata loader rejected the header: %v", err)
-				}
-			}
-		})
-	}
-}
-
-func TestProtobufConfigValidation(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	for _, name := range []string{"asset.dat", "asset.DAT"} {
-		if err := os.WriteFile(filepath.Join(dir, name), nil, 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.Mkdir(filepath.Join(dir, "directory.dat"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	server, err := core.New(&core.Config{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = server.Close() })
-	for _, tc := range []struct {
-		name      string
-		config    *Config
-		wantError string
-	}{
-		{"minutely cron", &Config{Cron: "* * * * *"}, ""},
-		{"minimum interval", &Config{Cron: "@every 1m"}, ""},
-		{"short interval", &Config{Cron: "@every 59s"}, "interval must be at least 1 minute"},
-		{"fractional interval", &Config{Cron: "@every 59.999s"}, "interval must be at least 1 minute"},
-		{"invalid cron", &Config{Cron: "invalid"}, "invalid geodata cron"},
-		{"dat extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.dat"}}}, ""},
-		{"uppercase extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.DAT"}}}, ""},
-		{"invalid extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.lua"}}}, "extension must be .dat"},
-		{"missing extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset"}}}, "extension must be .dat"},
-		{"missing file", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "missing.dat"}}}, "invalid geodata asset file"},
-		{"directory", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "directory.dat"}}}, "asset is not a regular file"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			config, err := serial.ToTypedMessage(tc.config).GetInstance()
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, err = core.CreateObject(server, config)
-			if tc.wantError == "" {
-				if err != nil {
-					t.Fatal(err)
-				}
-			} else if err == nil || !strings.Contains(err.Error(), tc.wantError) {
-				t.Fatalf("CreateObject() error = %v; want %q", err, tc.wantError)
-			}
-		})
-	}
-}

app/geodata/geodata.go

@@ -2,16 +2,12 @@ package geodata
 
 import (
 	"context"
-	"path/filepath"
-	"strings"
 	"sync"
-	"time"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	commongeodata "github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
 )
@@ -29,24 +25,6 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 	if config.Cron == "" {
 		return &Instance{}, nil
 	}
-	if len(config.Assets) > 100 {
-		return nil, errors.New("geodata supports at most 100 assets")
-	}
-	for _, asset := range config.Assets {
-		if !strings.EqualFold(filepath.Ext(asset.GetFile()), ".dat") {
-			return nil, errors.New("geodata asset file extension must be .dat")
-		}
-		if _, err := filesystem.ResolveAsset(asset.GetFile()); err != nil {
-			return nil, errors.New("invalid geodata asset file: ", asset.GetFile()).Base(err)
-		}
-	}
-	schedule, err := cron.ParseStandard(config.Cron)
-	if err != nil {
-		return nil, errors.New("invalid geodata cron").Base(err)
-	}
-	if interval, ok := schedule.(cron.ConstantDelaySchedule); ok && interval.Delay < time.Minute {
-		return nil, errors.New("geodata cron interval must be at least 1 minute")
-	}
 
 	g := &Instance{
 		assets: config.Assets,
@@ -66,7 +44,9 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 		cron.WithChain(cron.SkipIfStillRunning(cron.DiscardLogger)),
 		cron.WithLogger(cron.DiscardLogger),
 	)
-	g.tasker.Schedule(schedule, cron.FuncJob(g.execute))
+	if _, err := g.tasker.AddFunc(config.Cron, g.execute); err != nil {
+		return nil, errors.New("invalid geodata cron").Base(err)
+	}
 	errors.LogInfo(ctx, "scheduled geodata reload with cron: ", config.Cron)
 
 	return g, nil

app/observatory/burst/healthping_result.go

@@ -109,7 +109,7 @@ func (h *HealthPingRTTS) getStatistics() *HealthPingStats {
 		stats.Min = 0
 		return stats
 	}
-	stats.Average = sum / time.Duration(cnt)
+	stats.Average = time.Duration(int(sum) / cnt)
 	var std float64
 	if cnt < 2 {
 		// no enough data for standard deviation, we assume it's half of the average rtt

app/observatory/config.pb.go

@@ -152,23 +152,23 @@ func (x *HealthPingMeasurementResult) GetMin() int64 {
 type OutboundStatus struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Type time.ms
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The last error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	// @Document The outbound tag for this Server
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	OutboundTag string `protobuf:"bytes,4,opt,name=outbound_tag,json=outboundTag,proto3" json:"outbound_tag,omitempty"`
 	// @Document The time this outbound is known to be alive
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastSeenTime int64 `protobuf:"varint,5,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
 	// @Document The time this outbound is tried
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastTryTime   int64                        `protobuf:"varint,6,opt,name=last_try_time,json=lastTryTime,proto3" json:"last_try_time,omitempty"`
 	HealthPing    *HealthPingMeasurementResult `protobuf:"bytes,7,opt,name=health_ping,json=healthPing,proto3" json:"health_ping,omitempty"`
 	unknownFields protoimpl.UnknownFields
@@ -257,14 +257,14 @@ func (x *OutboundStatus) GetHealthPing() *HealthPingMeasurementResult {
 type ProbeResult struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Type time.ms
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -324,7 +324,7 @@ func (x *ProbeResult) GetLastErrorReason() string {
 type Intensity struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document The time interval for a probe request in ms.
-	//@Type time.ms
+	// @Type time.ms
 	ProbeInterval uint32 `protobuf:"varint,1,opt,name=probe_interval,json=probeInterval,proto3" json:"probe_interval,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache

app/proxyman/inbound/inbound.go

@@ -174,7 +174,7 @@ func NewHandler(ctx context.Context, config *core.InboundHandlerConfig) (inbound
 			Mark: streamSettings.SocketSettings.Mark,
 		})
 	}
-	if streamSettings != nil && (streamSettings.ProtocolName == "splithttp" || streamSettings.ProtocolName == "masque") {
+	if streamSettings != nil && streamSettings.ProtocolName == "splithttp" {
 		ctx = session.ContextWithAllowedNetwork(ctx, net.Network_UDP)
 	}
 

app/router/command/command.proto

@@ -34,19 +34,18 @@ message RoutingContext {
 // opened by xray-core.
 // * FieldSelectors selects a subset of fields in routing statistics to return.
 // Valid selectors:
-//   - inbound: Selects connection's inbound tag.
-//   - network: Selects connection's network.
-//   - ip: Equivalent as "ip_source" and "ip_target", selects both source and
-//     target IP.
-//   - port: Equivalent as "port_source" and "port_target", selects both source
-//     and target port.
-//   - domain: Selects target domain.
-//   - protocol: Select connection's protocol.
-//   - user: Select connection's inbound user email.
-//   - attributes: Select connection's additional attributes.
-//   - outbound: Equivalent as "outbound" and "outbound_group", select both
-//     outbound tag and outbound group tags.
-//
+//  - inbound: Selects connection's inbound tag.
+//  - network: Selects connection's network.
+//  - ip: Equivalent as "ip_source" and "ip_target", selects both source and
+//  target IP.
+//  - port: Equivalent as "port_source" and "port_target", selects both source
+//  and target port.
+//  - domain: Selects target domain.
+//  - protocol: Select connection's protocol.
+//  - user: Select connection's inbound user email.
+//  - attributes: Select connection's additional attributes.
+//  - outbound: Equivalent as "outbound" and "outbound_group", select both
+//  outbound tag and outbound group tags.
 // * If FieldSelectors is left empty, all fields will be returned.
 message SubscribeRoutingStatsRequest {
   repeated string FieldSelectors = 1;

app/router/condition_test.go

@@ -415,7 +415,7 @@ func BenchmarkMphDomainMatcher(b *testing.B) {
 
 func BenchmarkMultiGeoIPMatcher(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
-	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:ir", "geoip:ru"})
+	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:jp", "geoip:ca", "geoip:us"})
 	common.Must(err)
 
 	matcher, err := NewIPMatcher(rules, MatcherAsType_Target)

app/router/config.pb.go

@@ -587,9 +587,10 @@ type Config struct {
 	DomainStrategy Config_DomainStrategy  `protobuf:"varint,1,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.app.router.Config_DomainStrategy" json:"domain_strategy,omitempty"`
 	Rule           []*RoutingRule         `protobuf:"bytes,2,rep,name=rule,proto3" json:"rule,omitempty"`
 	BalancingRule  []*BalancingRule       `protobuf:"bytes,3,rep,name=balancing_rule,json=balancingRule,proto3" json:"balancing_rule,omitempty"`
-	Script         string                 `protobuf:"bytes,4,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// Absolute path to the Lua routing script.
+	Script        string `protobuf:"bytes,4,opt,name=script,proto3" json:"script,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {

app/router/config.proto

@@ -110,5 +110,6 @@ message Config {
   DomainStrategy domain_strategy = 1;
   repeated RoutingRule rule = 2;
   repeated BalancingRule balancing_rule = 3;
+  // Absolute path to the Lua routing script.
   string script = 4;
 }

app/router/lua.go

@@ -30,9 +30,9 @@ func (r *Router) RegisterLua(L *lua.LState) {
 		module.RawSetString("LocalOS", lua.LString(runtime.GOOS))
 
 		module.RawSetString("PickOutbound", L.NewFunction(func(L *lua.LState) int {
-			tag, ok := L.Get(1).(lua.LString)
+			tag, ok := L.Get(2).(lua.LString)
 			if !ok {
-				L.ArgError(1, "balancer tag must be a string")
+				L.ArgError(2, "balancer tag must be a string")
 				return 0
 			}
 			balancer, found := (*r.balancers.Load())[string(tag)]
@@ -62,7 +62,7 @@ func (r *Router) RegisterLua(L *lua.LState) {
 }
 
 func registerLuaContext(L *lua.LState) {
-	pushIPs := xlua.NewReadOnlySlicePusher[net.IP](L)
+	pushIPs := xlua.NewSlicePusher[net.IP](L)
 	attributes := L.NewTypeMetatable(luaAttributesType)
 	L.SetField(attributes, "__index", L.NewFunction(func(L *lua.LState) int {
 		values := L.CheckUserData(1).Value.(map[string]string)

app/router/router.go

@@ -20,6 +20,7 @@ import (
 type Router struct {
 	domainStrategy Config_DomainStrategy
 	rules          atomic.Pointer[[]*Rule]
+	scriptPath     string
 	script         *scriptEngine
 	balancers      atomic.Pointer[map[string]*Balancer]
 	dns            dns.Client
@@ -41,19 +42,12 @@ type Route struct {
 // Init initializes the Router.
 func (r *Router) Init(ctx context.Context, config *Config, d dns.Client, ohm outbound.Manager, dispatcher routing.Dispatcher) error {
 	r.domainStrategy = config.DomainStrategy
+	r.scriptPath = config.Script
 	r.dns = d
 	r.ctx = ctx
 	r.ohm = ohm
 	r.dispatcher = dispatcher
 
-	if config.Script != "" {
-		script, err := newScriptEngine(config.Script)
-		if err != nil {
-			return errors.New("failed to prepare routing script").Base(err)
-		}
-		r.script = script
-	}
-
 	r.rules.Store(new([]*Rule))
 	r.balancers.Store(&map[string]*Balancer{})
 	return r.ReloadRules(config, false)
@@ -234,10 +228,12 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 
 // Start implements common.Runnable.
 func (r *Router) Start() error {
-	if r.script != nil {
-		if err := r.script.start(r); err != nil {
+	if r.scriptPath != "" {
+		engine, err := newScriptEngine(r.scriptPath, r)
+		if err != nil {
 			return errors.New("failed to initialize routing script").Base(err)
 		}
+		r.script = engine
 	}
 	return nil
 }

app/router/script.go

@@ -16,22 +16,17 @@ import (
 const scriptExecutionTimeout = 6 * time.Second
 
 type scriptEngine struct {
-	program *xlua.Program
-	pool    *xlua.Pool
+	pool *xlua.Pool
 }
 
-func newScriptEngine(script string) (*scriptEngine, error) {
-	program, err := xlua.Compile(script)
+func newScriptEngine(path string, router *Router) (*scriptEngine, error) {
+	program, err := xlua.CompileFile(path)
 	if err != nil {
 		return nil, err
 	}
-	return &scriptEngine{program: program}, nil
-}
 
-func (e *scriptEngine) start(router *Router) error {
-	pool, err := xlua.NewPool(router.ctx, scriptExecutionTimeout, e.program.NewStateFactory(
+	pool, err := xlua.NewPool(router.ctx, scriptExecutionTimeout, program.NewStateFactory(
 		scriptExecutionTimeout*20,
-		256,
 		func(L *lua.LState) {
 			geodata.RegisterLua(L)
 			log.RegisterLua(L)
@@ -45,18 +40,15 @@ func (e *scriptEngine) start(router *Router) error {
 			return nil
 		}))
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	e.pool = pool
-	errors.LogInfo(router.ctx, "routing script initialized")
-	return nil
+	errors.LogInfo(router.ctx, "routing script initialized from ", path)
+	return &scriptEngine{pool: pool}, nil
 }
 
 func (e *scriptEngine) close() {
-	if e.pool != nil {
-		e.pool.Close()
-	}
+	e.pool.Close()
 }
 
 func (e *scriptEngine) pickRoute(ctx routing.Context) (routing.Route, error) {

app/router/script_test.go

@@ -72,63 +72,24 @@ func startLuaRouter(t *testing.T, script string, d featureDNS.Client, config *Co
 }
 
 func TestRouterScriptStartup(t *testing.T) {
-	for _, tc := range []struct {
-		name, script string
-		compileError bool
-	}{
-		{"syntax error", "function HandleRoute(", true},
-		{"missing hook", "value = 1", false},
-		{"invalid hook", "HandleRoute = true", false},
-		{"initialization error", `error("setup failed")`, false},
+	for _, tc := range []struct{ name, script string }{
+		{"syntax error", "function HandleRoute("},
+		{"missing hook", "value = 1"},
+		{"initialization error", `error("setup failed")`},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			r := new(Router)
-			err := r.Init(context.Background(), &Config{Script: writeRouteScript(t, tc.script)}, nil, nil, nil)
-			if tc.compileError {
-				if r.script != nil || err == nil || !strings.Contains(err.Error(), "failed to prepare routing script") {
-					t.Fatalf("Init = %v; want no engine and script preparation error", err)
-				}
-				return
-			}
-			if err != nil {
+			if err := r.Init(context.Background(), &Config{Script: writeRouteScript(t, tc.script)}, nil, nil, nil); err != nil {
 				t.Fatal(err)
 			}
 			defer r.Close()
-			if r.script.program == nil || r.script.pool != nil {
-				t.Fatal("Init did not compile the script without starting its pool")
-			}
-			if err := r.Close(); err != nil {
-				t.Fatal(err)
-			}
 			if err := r.Start(); err == nil {
 				t.Fatal("Start accepted an invalid routing script")
 			}
-			if r.script.pool != nil {
-				t.Fatal("Start retained a script pool after failure")
-			}
 		})
 	}
 }
 
-func TestRouterScriptProgramSnapshot(t *testing.T) {
-	path := writeRouteScript(t, `function HandleRoute() return "compiled", "compiled-rule" end`)
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer engine.close()
-	if err := os.Remove(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := engine.start(&Router{ctx: context.Background()}); err != nil {
-		t.Fatal(err)
-	}
-	route, err := engine.pickRoute(newLuaRouteTestContext())
-	if err != nil || route == nil || route.GetOutboundTag() != "compiled" || route.GetRuleTag() != "compiled-rule" {
-		t.Fatalf("route = %v, %v; want compiled, compiled-rule", route, err)
-	}
-}
-
 func TestRouterScriptRouting(t *testing.T) {
 	for _, tc := range []struct {
 		name, body        string
@@ -140,7 +101,7 @@ func TestRouterScriptRouting(t *testing.T) {
 		{name: "route", body: `return "lua-out", "lua-rule"`, wantTag: "lua-out", wantRule: "lua-rule", wantCalls: "2"},
 		{name: "no match", body: `return nil`, wantErr: common.ErrNoClue, wantCalls: "2"},
 		{name: "empty tag", body: `return ""`, wantErr: common.ErrNoClue, wantCalls: "2"},
-		{name: "balancer error", body: `local tag, err = router.PickOutbound("missing"); return tag, nil, err`, wantMessage: "not found", wantCalls: "2"},
+		{name: "balancer error", body: `local tag, err = router:PickOutbound("missing"); return tag, nil, err`, wantMessage: "not found", wantCalls: "2"},
 		{name: "string error", body: `return nil, nil, "blocked"`, wantMessage: "blocked", wantCalls: "2"},
 		{name: "invalid tag", body: `return false`, wantMessage: "outboundTag", wantCalls: "2"},
 		{name: "invalid rule", body: `return "lua-out", false`, wantMessage: "ruleTag", wantCalls: "2"},
@@ -241,7 +202,7 @@ func TestRouterScriptBalancerReload(t *testing.T) {
 	r := startLuaRouter(t, `
 local router = require("xray.router")
 function HandleRoute()
-    local tag, err = router.PickOutbound("balance")
+    local tag, err = router:PickOutbound("balance")
     return tag, "balanced", err
 end`, nil, config("old"))
 	pick := func(want string) {
@@ -275,7 +236,7 @@ func TestRouterScriptConcurrentBalancerReload(t *testing.T) {
 	r := startLuaRouter(t, `
 local router = require("xray.router")
 function HandleRoute()
-    local tag, err = router.PickOutbound("balance")
+    local tag, err = router:PickOutbound("balance")
     return tag, nil, err
 end`, nil, config("a"))
 
@@ -406,10 +367,10 @@ end`)
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer instance.Close()
 	if err := instance.Start(); err != nil {
 		t.Fatal(err)
 	}
-	defer instance.Close()
 	r := instance.GetFeature(routing.RouterType()).(*Router)
 	route, err := r.PickRoute(newLuaRouteTestContext())
 	if err != nil || route.GetOutboundTag() != "direct" || route.GetRuleTag() != "outer-route" {

common/base64/base64.go

@@ -1,6 +0,0 @@
-package base64
-
-const (
-	Prefix     = "base64:"
-	GzipPrefix = "base64+gzip:"
-)

common/base64/decode.go

@@ -1,38 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-	"io"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// Decode decodes Base64 text with an optional [Prefix] or [GzipPrefix].
-func Decode(value string) ([]byte, error) {
-	value, zip := strings.CutPrefix(value, GzipPrefix)
-	if !zip {
-		value = strings.TrimPrefix(value, Prefix)
-	}
-
-	data, err := base64.StdEncoding.DecodeString(value)
-	if err != nil {
-		return nil, errors.New("failed to decode base64").Base(err)
-	}
-	if !zip {
-		return data, nil
-	}
-
-	reader, err := gzip.NewReader(bytes.NewReader(data))
-	if err != nil {
-		return nil, errors.New("failed to decompress gzip").Base(err)
-	}
-	defer reader.Close()
-	data, err = io.ReadAll(reader)
-	if err != nil {
-		return nil, errors.New("failed to decompress gzip").Base(err)
-	}
-	return data, nil
-}

common/base64/decode_test.go

@@ -1,28 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"testing"
-)
-
-func TestDecodeFormats(t *testing.T) {
-	compressed, err := Encode([]byte("x"), true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct {
-		name, value, want string
-	}{
-		{"unprefixed", "eA==", "x"},
-		{"base64", Prefix + "eA==", "x"},
-		{"gzip", compressed, "x"},
-		{"empty", Prefix, ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			data, err := Decode(tc.value)
-			if err != nil || !bytes.Equal(data, []byte(tc.want)) {
-				t.Fatalf("Decode = %q, %v; want %q", data, err, tc.want)
-			}
-		})
-	}
-}

common/base64/encode.go

@@ -1,29 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// Encode returns prefixed Base64 text, optionally compressed with gzip at the highest level.
-func Encode(data []byte, zip bool) (string, error) {
-	if !zip {
-		return Prefix + base64.StdEncoding.EncodeToString(data), nil
-	}
-
-	var buf bytes.Buffer
-	writer, err := gzip.NewWriterLevel(&buf, gzip.BestCompression)
-	if err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	if _, err := writer.Write(data); err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	if err := writer.Close(); err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	return GzipPrefix + base64.StdEncoding.EncodeToString(buf.Bytes()), nil
-}

common/base64/encode_test.go

@@ -1,62 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-	"io"
-	"strings"
-	"testing"
-)
-
-func TestEncodeFormats(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		data []byte
-	}{
-		{"empty", nil},
-		{"bytes", []byte("你好\r\n\x00\xff")},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			for _, zip := range []bool{false, true} {
-				prefix := Prefix
-				if zip {
-					prefix = GzipPrefix
-				}
-				t.Run(prefix, func(t *testing.T) {
-					value, err := Encode(tc.data, zip)
-					if err != nil {
-						t.Fatal(err)
-					}
-					payload, ok := strings.CutPrefix(value, prefix)
-					if !ok {
-						t.Fatalf("encoded value does not start with %q", prefix)
-					}
-					// Read the output independently of Decode so matching bugs cannot hide.
-					data, err := base64.StdEncoding.DecodeString(payload)
-					if err != nil {
-						t.Fatal(err)
-					}
-					if zip {
-						// gzip's XFL byte identifies the compression level we selected.
-						if len(data) < 10 || data[8] != 2 {
-							t.Fatal("gzip output does not use the highest compression level")
-						}
-						reader, err := gzip.NewReader(bytes.NewReader(data))
-						if err != nil {
-							t.Fatal(err)
-						}
-						defer reader.Close()
-						data, err = io.ReadAll(reader)
-						if err != nil {
-							t.Fatal(err)
-						}
-					}
-					if !bytes.Equal(data, tc.data) {
-						t.Fatal("encoded output does not preserve the input bytes")
-					}
-				})
-			}
-		})
-	}
-}

common/geodata/consts.go

@@ -8,65 +8,23 @@ import (
 
 var privateIPMatcher = sync.OnceValue(func() IPMatcher {
 	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
-		// https://www.iana.org/assignments/iana-ipv4-special-registry
-		"0.0.0.0/8",      // "This network"
-		"0.0.0.0/32",     // "This host on this network"
-		"10.0.0.0/8",     // Private-Use
-		"100.64.0.0/10",  // Shared Address Space
-		"127.0.0.0/8",    // Loopback
-		"169.254.0.0/16", // Link Local
-		"172.16.0.0/12",  // Private-Use
-		// "192.0.0.0/24",   // IETF Protocol Assignments
-		"192.0.0.0/29",   // IPv4 Service Continuity Prefix
-		"192.0.0.8/32",   // IPv4 dummy address
-		"192.0.0.9/32",   // Port Control Protocol Anycast
-		"192.0.0.10/32",  // Traversal Using Relays around NAT Anycast
-		"192.0.0.170/32", // NAT64/DNS64 Discovery
-		"192.0.0.171/32", // NAT64/DNS64 Discovery
-		"192.0.2.0/24",   // Documentation (TEST-NET-1)
-		// "192.31.196.0/24",    // AS112-v4
-		"192.52.193.0/24", // AMT
-		// "192.88.99.0/24",  // Deprecated (6to4 Relay Anycast)
-		"192.88.99.2/32", // 6a44-relay anycast address
-		"192.168.0.0/16", // Private-Use
-		// "192.175.48.0/24",    // Direct Delegation AS112 Service
-		"198.18.0.0/15",      // Benchmarking
-		"198.51.100.0/24",    // Documentation (TEST-NET-2)
-		"203.0.113.0/24",     // Documentation (TEST-NET-3)
-		"240.0.0.0/4",        // Reserved
-		"255.255.255.255/32", // Limited Broadcast
-
-		// https://www.iana.org/assignments/multicast-addresses
-		"224.0.0.0/4",
-
-		// https://www.iana.org/assignments/iana-ipv6-special-registry
-		"::1/128", // Loopback Address
-		"::/128",  // Unspecified Address
-		// "::ffff:0:0/96",     // IPv4-mapped Address
-		"64:ff9b::/96",   // IPv4-IPv6 Translat.
-		"64:ff9b:1::/48", // IPv4-IPv6 Translat.
-		"100::/64",       // Discard-Only Address Block
-		"100:0:0:1::/64", // Dummy IPv6 Prefix
-		// "2001::/23",      // IETF Protocol Assignments
-		"2001::/32",     // TEREDO
-		"2001:1::1/128", // Port Control Protocol Anycast
-		"2001:1::2/128", // Traversal Using Relays around NAT Anycast
-		"2001:1::3/128", // DNS-SD Service Registration Protocol Anycast
-		"2001:2::/48",   // Benchmarking
-		"2001:3::/32",   // AMT
-		// "2001:4:112::/48", // AS112-v6
-		// "2001:10::/28",    // Deprecated (previously ORCHID)
-		"2001:20::/28",  // ORCHIDv2
-		"2001:30::/28",  // Drone Remote ID Protocol Entity Tags (DETs) Prefix
-		"2001:db8::/32", // Documentation
-		"2002::/16",     // 6to4
-		// "2620:4f:8000::/48", // Direct Delegation AS112 Service
-		"3fff::/20", // Documentation
-		"5f00::/16", // Segment Routing (SRv6) SIDs
-		"fc00::/7",  // Unique-Local
-		"fe80::/10", // Link-Local Unicast
-
-		// https://www.iana.org/assignments/ipv6-multicast-addresses
+		"0.0.0.0/8",
+		"10.0.0.0/8",
+		"100.64.0.0/10",
+		"127.0.0.0/8",
+		"169.254.0.0/16",
+		"172.16.0.0/12",
+		"192.0.0.0/24",
+		"192.0.2.0/24",
+		"192.88.99.0/24",
+		"192.168.0.0/16",
+		"198.18.0.0/15",
+		"198.51.100.0/24",
+		"203.0.113.0/24",
+		"224.0.0.0/3",
+		"::/127",
+		"fc00::/7",
+		"fe80::/10",
 		"ff00::/8",
 	}))))
 })

common/geodata/geodat_loader.go

@@ -17,12 +17,12 @@ import (
 )
 
 func checkFile(file, code string) error {
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
-	if _, err := find(r, []byte(code), false, size); err != nil {
+	if _, err := find(r, []byte(code), false); err != nil {
 		return errors.New("failed to check code ", code, " from ", file).Base(err)
 	}
 	return nil
@@ -30,12 +30,12 @@ func checkFile(file, code string) error {
 
 func loadFile(file, code string) ([]byte, error) {
 	runtime.GC() // peak mem
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return nil, errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
-	bs, err := find(r, []byte(code), true, size)
+	bs, err := find(r, []byte(code), true)
 	if err != nil {
 		return nil, errors.New("failed to load code ", code, " from ", file).Base(err)
 	}
@@ -60,13 +60,13 @@ func loadIP(file, code string) ([]*CIDR, error) {
 // unmarshalling it into a []*Domain, so value is only valid during fn.
 func loadSite(file, code, attrs string, fn func(Domain_Type, []byte)) error {
 	runtime.GC() // peak mem
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
 	br := bufio.NewReaderSize(r, 64*1024)
-	n, err := seek(br, []byte(code), size)
+	n, err := seek(br, []byte(code))
 	if err != nil {
 		return errors.New("failed to load code ", code, " from ", file).Base(err)
 	}
@@ -114,9 +114,6 @@ func decodeVarint(br *bufio.Reader) (uint64, error) {
 		if err != nil {
 			return 0, err
 		}
-		if shift == 63 && b > 1 {
-			break // Only one value bit fits in the tenth byte.
-		}
 		x |= (uint64(b) & 0x7F) << shift
 		if (b & 0x80) == 0 {
 			return x, nil
@@ -126,9 +123,9 @@ func decodeVarint(br *bufio.Reader) (uint64, error) {
 	return 0, errors.New("varint overflow")
 }
 
-func find(r io.Reader, code []byte, readBody bool, size int64) ([]byte, error) {
+func find(r io.Reader, code []byte, readBody bool) ([]byte, error) {
 	br := bufio.NewReaderSize(r, 64*1024)
-	bodyL, err := seek(br, code, size)
+	bodyL, err := seek(br, code)
 	if err != nil || !readBody {
 		return nil, err
 	}
@@ -140,7 +137,7 @@ func find(r io.Reader, code []byte, readBody bool, size int64) ([]byte, error) {
 }
 
 // seek advances br to the body of the entry for code and returns the body length.
-func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
+func seek(br *bufio.Reader, code []byte) (int, error) {
 	codeL := len(code)
 	if codeL == 0 {
 		return 0, errors.New("empty code")
@@ -148,8 +145,7 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 	need := 2 + codeL // TODO: if code too long
 
 	for {
-		tag, err := br.ReadByte()
-		if err != nil {
+		if _, err := br.ReadByte(); err != nil {
 			return 0, err
 		}
 
@@ -157,10 +153,10 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 		if err != nil {
 			return 0, err
 		}
-		if x == 0 || x > uint64(size) || x > uint64(^uint(0)>>1) {
-			return 0, errors.New("invalid body length: ", x)
-		}
 		bodyL := int(x)
+		if bodyL <= 0 {
+			return 0, errors.New("invalid body length: ", bodyL)
+		}
 
 		// Peek no more than the buffer holds: a code longer than the buffer cannot match a single
 		// length byte anyway, so a short peek only skips it, as base find (io.ReadFull) does.
@@ -171,8 +167,7 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 			}
 			return 0, err
 		}
-		if tag == 0x0a && bodyL >= need && len(prefix) >= need &&
-			prefix[0] == 0x0a && int(prefix[1]) == codeL && bytes.Equal(prefix[2:], code) {
+		if bodyL >= need && len(prefix) >= need && int(prefix[1]) == codeL && bytes.Equal(prefix[2:], code) {
 			return bodyL, nil
 		}
 		if _, err := br.Discard(bodyL); err != nil {

common/geodata/geodat_loader_test.go

@@ -1,7 +1,6 @@
 package geodata
 
 import (
-	"bytes"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,58 +12,6 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-func TestFindChecksEntryAndCodeTags(t *testing.T) {
-	for _, payload := range [][]byte{
-		{0x12, 6, 0x0a, 4, 'T', 'E', 'S', 'T'}, // Unknown field posing as entry.
-		{0x08, 6, 0x0a, 4, 'T', 'E', 'S', 'T'}, // Wrong entry wire type.
-		{0x0a, 6, 0x1a, 4, 'T', 'E', 'S', 'T'}, // Unknown field posing as code.
-		{0x0a, 6, 0x08, 4, 'T', 'E', 'S', 'T'}, // Wrong code wire type.
-	} {
-		if _, err := find(bytes.NewReader(payload), []byte("TEST"), true, int64(len(payload))); err == nil {
-			t.Fatalf("matched incorrect entry/code tags in %x", payload)
-		}
-	}
-}
-
-func TestLoadFileRejectsVarintOverflow(t *testing.T) {
-	payload := []byte{
-		0x0a,
-		0x86, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x02, // 2^64 + 6
-		0x0a, 0x04, 'T', 'E', 'S', 'T',
-	}
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	if err := os.WriteFile(filepath.Join(dir, "overflow.dat"), payload, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := loadFile("overflow.dat", "TEST"); err == nil || !strings.Contains(err.Error(), "varint overflow") {
-		t.Fatalf("want varint overflow, got %v", err)
-	}
-}
-
-func TestLoadFileRejectsOversizedEntry(t *testing.T) {
-	payload := []byte{
-		0x0a, 0x03, 0x0a, 0x01, 'A', // A valid entry before the oversized one.
-		0x0a, 0x80, 0x80, 0x80, 0x80, 0x04, // Entry length: 1 GiB.
-		0x0a, 0x04, 'T', 'E', 'S', 'T',
-	}
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	if err := os.WriteFile(filepath.Join(dir, "oversized.dat"), payload, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// Check without allocating the body first, so a regression fails safely.
-	if err := checkFile("oversized.dat", "TEST"); err == nil {
-		t.Fatal("accepted an entry length larger than the file")
-	}
-	if _, err := loadFile("oversized.dat", "TEST"); err == nil || !strings.Contains(err.Error(), "invalid body length") {
-		t.Fatalf("want invalid body length, got %v", err)
-	}
-	if err := loadSite("oversized.dat", "TEST", "", func(Domain_Type, []byte) {}); err == nil || !strings.Contains(err.Error(), "invalid body length") {
-		t.Fatalf("want invalid body length, got %v", err)
-	}
-}
-
 type siteEntry struct {
 	Type  Domain_Type
 	Value string

common/geodata/ip_matcher_test.go

@@ -400,13 +400,13 @@ func TestIPMatcher4CN(t *testing.T) {
 	}
 }
 
-func TestIPMatcher6RU(t *testing.T) {
+func TestIPMatcher6US(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
+	matcher := buildIPMatcher("geoip:us")
 
-	if !matcher.Match(xnet.ParseAddress("2a02:6b8::feed:0ff").IP()) {
-		t.Error("expect RU geoip contain 2a02:6b8::feed:0ff, but actually not")
+	if !matcher.Match(xnet.ParseAddress("2001:4860:4860::8888").IP()) {
+		t.Error("expect US geoip contain 2001:4860:4860::8888, but actually not")
 	}
 }
 
@@ -423,11 +423,11 @@ func BenchmarkIPMatcher4CN(b *testing.B) {
 	}
 }
 
-func BenchmarkIPMatcher6RU(b *testing.B) {
+func BenchmarkIPMatcher6US(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
-	ip := xnet.ParseAddress("2a02:6b8::feed:0ff").IP()
+	matcher := buildIPMatcher("geoip:us")
+	ip := xnet.ParseAddress("2001:4860:4860::8888").IP()
 
 	b.ResetTimer()
 

common/geodata/lua.go

@@ -44,8 +44,8 @@ func RegisterLua(L *lua.LState) {
 				"Match":     luaIPMatch,
 				"AnyMatch":  luaIPAnyMatch,
 				"Matches":   luaIPMatches,
-				"FilterIPs": newLuaIPFilterIPs(xlua.NewReadOnlySlicePusher[net.IP](L)),
-			}, "SetReverse", "ToggleReverse")
+				"FilterIPs": newLuaIPFilterIPs(xlua.NewSlicePusher[net.IP](L)),
+			})
 			return 1
 		}))
 

common/geodata/lua_test.go

@@ -78,7 +78,6 @@ local geodata = require("xray.geodata")
 local matcher = geodata.BuildIPMatcher("127.0.0.0/8")
 assert(matcher.Match == matcher.match and matcher.AnyMatch == matcher.anyMatch)
 assert(matcher.Matches == matcher.matches and matcher.FilterIPs == matcher.filterIPs)
-assert(matcher.Reload == nil and matcher.reload == nil)
 assert(matcher:match(ip))
 assert(matcher:anyMatch({ip}) and matcher:matches({ip}))
 assert(not matcher:AnyMatch(nil))
@@ -98,11 +97,6 @@ assert(matcher.missing == nil)
 
 local domain = geodata.BuildDomainMatcher("full:example.com")
 assert(domain.Match == domain.match and domain.MatchAny == domain.matchAny)
-assert(domain.Reload == nil and domain.reload == nil)
-for _, value in ipairs({matcher, domain}) do
-    assert(not pcall(function() return -value end))
-    assert(not pcall(function() return value ^ {} end))
-end
 assert(domain:matchAny("example.com"))
 assert(#domain:Match("example.com") == 1)
 assert(domain:match("example.com")[1] == 0)

common/geodata/rule_parser_test.go

@@ -11,7 +11,7 @@ func TestParseIPRules(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
 	rules := []string{
-		"geoip:ru",
+		"geoip:us",
 		"geoip:cn",
 		"!geoip:cn",
 		"!!geoip:cn",
@@ -20,9 +20,9 @@ func TestParseIPRules(t *testing.T) {
 		"!geoip:!cn",
 		"ext:geoip.dat:!cn",
 		"ext:geoip.dat:!!cn",
-		"ext:geoip.dat:ir",
+		"ext:geoip.dat:ca",
 		"ext-ip:geoip.dat:!cn",
-		"ext-ip:geoip.dat:!ir",
+		"ext-ip:geoip.dat:!ca",
 		"192.168.0.0/24",
 		"!192.168.0.0/24",
 		"!!192.168.0.0/24",

common/lua/geodata_security_watchdog_test.go

@@ -1,19 +0,0 @@
-// DO NOT EDIT. Regression test for app/geodata's luaGuardHeader.
-
-package lua
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/yuin/gopher-lua/parse"
-)
-
-func TestGeodataLuaGuard(t *testing.T) {
-	_, err := parse.Parse(strings.NewReader("\x12\x01\x00function HandleRoute() end"), "geodata")
-	var syntaxErr *parse.Error
-	if !errors.As(err, &syntaxErr) || syntaxErr.Pos.Line != 1 || syntaxErr.Pos.Column != 1 {
-		t.Fatalf("want Lua rejection at the first byte, got %v", err)
-	}
-}

common/lua/luar.go

@@ -1,9 +1,6 @@
 package lua
 
 import (
-	"net"
-	"reflect"
-
 	glua "github.com/yuin/gopher-lua"
 	luar "layeh.com/gopher-luar"
 )
@@ -12,7 +9,7 @@ import (
 // The returned function wraps slices without reflection or metatable lookup,
 // and pushes nil for nil slices. Use it with this state or its coroutines.
 func NewSlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
-	metatable := luar.MT(L, []T(nil)).LTable
+	metatable := luar.New(L, []T{}).(*glua.LUserData).Metatable
 	return func(L *glua.LState, values []T) {
 		if values == nil {
 			L.Push(glua.LNil)
@@ -25,105 +22,21 @@ func NewSlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
 	}
 }
 
-// NewReadOnlySlicePusher borrows slices without copying and recursively makes
-// nested slice types read-only through their shared metatables. IP byte views
-// and masks are also read-only. Other referenced elements retain their mutability.
-// Element bindings are initialized on first indexing or iteration.
-func NewReadOnlySlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
-	sliceMetatable := luar.MT(L, []T{})
-	if sliceMetatable.RawGetString("__readonly") != glua.LTrue {
-		readOnly := L.NewFunction(func(L *glua.LState) int {
-			L.RaiseError("slice is read-only")
-			return 0
-		})
-		setSliceReadOnly[[]T](L, readOnly)
-	}
-	return NewSlicePusher[T](L)
-}
-
-func setSliceReadOnly[S ~[]E, E any](L *glua.LState, readOnly *glua.LFunction) {
-	var visit func(reflect.Type)
-	visit = func(typ reflect.Type) {
-		if typ.Kind() != reflect.Slice {
-			return
-		}
-		metatable := luar.MT(L, reflect.Zero(typ).Interface())
-		if metatable.RawGetString("__readonly") == glua.LTrue {
-			return
-		}
-		// Mark before descending because named slice types can be recursive.
-		metatable.RawSetString("__readonly", glua.LTrue)
-		metatable.RawSetString("__newindex", readOnly)
-		// Reject explicitly so Lua cannot fall back to the other operand.
-		metatable.RawSetString("__add", readOnly)
-		if typ == reflect.TypeFor[net.IP]() {
-			// A nil receiver lets AppendText return its argument as a writable []byte.
-			methods := metatable.RawGetString("methods").(*glua.LTable)
-			appendText := methods.RawGetString("AppendText")
-			for key, method := methods.Next(glua.LNil); key != glua.LNil; key, method = methods.Next(key) {
-				if method == appendText {
-					methods.RawSet(key, glua.LNil)
-				}
-			}
-			visit(reflect.TypeFor[net.IPMask]())
-		}
-		if element := typ.Elem(); element.Kind() == reflect.Slice {
-			index := metatable.RawGetString("__index").(*glua.LFunction)
-			call := metatable.RawGetString("__call").(*glua.LFunction)
-			initialize := func() {
-				visit(element)
-				metatable.RawSetString("__index", index)
-				metatable.RawSetString("__call", call)
-			}
-			metatable.RawSetString("__index", L.NewFunction(func(L *glua.LState) int {
-				initialize()
-				return index.GFunction(L)
-			}))
-			metatable.RawSetString("__call", L.NewFunction(func(L *glua.LState) int {
-				initialize()
-				return call.GFunction(L)
-			}))
-		}
-	}
-	visit(reflect.TypeFor[S]())
-}
-
 // DirectMethod handles a Lua call without luar's reflected method invocation.
 // It returns the result count and whether it handled the arguments. On false,
 // it must leave the stack unchanged for the original luar wrapper.
 type DirectMethod func(L *glua.LState) (nresults int, handled bool)
 
-// PushMethods pushes a luar userdata exposing only the named Go methods and
-// their aliases through reflected calls. The method list is fixed by the first
-// binding of that Go type in each LState.
-func PushMethods(L *glua.LState, value any, methods ...string) {
-	PushWithDirectMethods(L, value, nil, methods...)
-}
-
 // PushWithDirectMethods pushes a luar userdata with typed Go method bindings.
 // Handled calls bypass luar's argument conversion and reflect.Call; method lookup
 // uses the methods table directly instead of luar's reflected __index handler.
-// Only directMethods and additionalMethods are exposed, including their aliases.
-// Bindings and their closures are installed once per Go type per LState, outside
-// the method-call hot path.
-func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]DirectMethod, additionalMethods ...string) {
+// value must expose methods only. Bindings and their closures are installed once
+// per Go type per LState, outside the method-call hot path.
+func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]DirectMethod) {
 	userdata := luar.New(L, value).(*glua.LUserData)
 	metatable := userdata.Metatable.(*glua.LTable)
 	methods := metatable.RawGetString("methods").(*glua.LTable)
 	if metatable.RawGetString("__index") != methods {
-		// Keep all aliases for the explicitly exposed methods.
-		exposed := make(map[glua.LValue]bool, len(directMethods)+len(additionalMethods))
-		for name := range directMethods {
-			exposed[methods.RawGetString(name)] = true
-		}
-		for _, name := range additionalMethods {
-			exposed[methods.RawGetString(name)] = true
-		}
-		for key, method := methods.Next(glua.LNil); key != glua.LNil; key, method = methods.Next(key) {
-			if !exposed[method] {
-				methods.RawSet(key, glua.LNil)
-			}
-		}
 		for name, direct := range directMethods {
 			original := methods.RawGetString(name)
 			fn := L.NewFunction(func(L *glua.LState) int {
@@ -139,10 +52,6 @@ func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]D
 				}
 			}
 		}
-		// Pointer operations would bypass the method-only API.
-		metatable.RawSetString("__newindex", glua.LNil)
-		metatable.RawSetString("__pow", glua.LNil)
-		metatable.RawSetString("__unm", glua.LNil)
 		metatable.RawSetString("__index", methods)
 	}
 	L.Push(userdata)

common/lua/luar_test.go

@@ -2,7 +2,6 @@ package lua
 
 import (
 	"net"
-	"reflect"
 	"testing"
 
 	glua "github.com/yuin/gopher-lua"
@@ -48,188 +47,6 @@ assert(ok and result == true)
 	}
 }
 
-func TestReadOnlySlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := []int{3, 5}
-	NewReadOnlySlicePusher[int](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-assert(#values == 2 and values[1] == 3 and values[2] == 5)
-assert(not pcall(function() values[1] = 7 end))
-assert(not pcall(function() return values + 7 end))
-local sum = 0
-for _, value in values() do sum = sum + value end
-assert(sum == 8)
-`); err != nil {
-		t.Fatal(err)
-	}
-	got := L.GetGlobal("values").(*glua.LUserData).Value.([]int)
-	if &got[0] != &values[0] || values[0] != 3 || values[1] != 5 {
-		t.Fatal("read-only binding copied or modified the slice")
-	}
-}
-
-func TestReadOnlyIPSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	ips := []net.IP{{192, 0, 2, 1}, net.ParseIP("2001:db8::1")}
-	NewReadOnlySlicePusher[net.IP](L)(L, ips)
-	L.SetGlobal("ips", L.Get(-1))
-	L.Pop(1)
-	readOnly := luar.MT(L, ips).RawGetString("__newindex")
-	NewReadOnlySlicePusher[net.IP](L)
-	if luar.MT(L, ips).RawGetString("__newindex") != readOnly {
-		t.Fatal("IP metatables were initialized more than once")
-	}
-	if err := L.DoString(`
-local function readOnly(value)
-    assert(not pcall(function() value[1] = value[1] end))
-    assert(not pcall(function() return value + value[1] end))
-end
-assert(#ips == 2 and ips[1]:String() == "192.0.2.1")
-readOnly(ips)
-for _, ip in ips() do
-    readOnly(ip)
-    readOnly(ip:To16())
-    if ip:To4() then
-        readOnly(ip:To4())
-        readOnly(ip:DefaultMask())
-    end
-    assert(ip:Equal(ip:To16()) and type(ip:String()) == "string")
-    assert(ip.AppendText == nil and ip.appendText == nil)
-    local text, err = ip:MarshalText()
-    assert(not err)
-    text[1] = 88 -- Independently owned byte buffers remain writable.
-    assert(not pcall(function() return ips + text end))
-end
-`); err != nil {
-		t.Fatal(err)
-	}
-	got := L.GetGlobal("ips").(*glua.LUserData).Value.([]net.IP)
-	if &got[0] != &ips[0] || &got[0][0] != &ips[0][0] || &got[1][0] != &ips[1][0] {
-		t.Fatal("read-only binding copied the IP data")
-	}
-	for i, want := range []string{"192.0.2.1", "2001:db8::1"} {
-		if got[i].String() != want {
-			t.Fatalf("IP %d changed to %s; want %s", i, got[i], want)
-		}
-	}
-}
-
-func TestReadOnlyIPSlicePusherLazy(t *testing.T) {
-	for _, tc := range []struct{ name, access string }{
-		{"index", `local ip = ips[1]`},
-		{"iterate", `local _, ip = ips()()`},
-		{"coroutine", `local co = coroutine.create(function() return ips[1] end); local ok, ip = coroutine.resume(co); assert(ok)`},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			L := glua.NewState()
-			defer L.Close()
-			methods := 0
-			luar.GetConfig(L).MethodNames = func(_ reflect.Type, method reflect.Method) []string {
-				methods++
-				return []string{method.Name}
-			}
-			NewReadOnlySlicePusher[net.IP](L)(L, []net.IP{{192, 0, 2, 1}})
-			L.SetGlobal("ips", L.Get(-1))
-			L.Pop(1)
-			if err := L.DoString(`assert(#ips == 1); assert(not pcall(function() ips[1] = nil end))`); err != nil {
-				t.Fatal(err)
-			}
-			if methods != 0 {
-				t.Fatal("IP methods initialized without reading an element")
-			}
-			source := tc.access + `
-assert(ip:String() == "192.0.2.1" and ip.AppendText == nil)
-assert(not pcall(function() ip[1] = 0 end))
-assert(not pcall(function() ip:To4()[1] = 0 end))
-assert(not pcall(function() ip:To16()[1] = 0 end))
-assert(not pcall(function() ip:DefaultMask()[1] = 0 end))
-`
-			if err := L.DoString(source); err != nil {
-				t.Fatal(err)
-			}
-			initialized := methods
-			if initialized == 0 {
-				t.Fatal("IP access did not initialize its methods")
-			}
-			if err := L.DoString(source); err != nil {
-				t.Fatal(err)
-			}
-			if methods != initialized {
-				t.Fatal("IP methods initialized more than once")
-			}
-		})
-	}
-}
-
-func TestReadOnlyNestedSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := [][][]byte{{{3, 5}}}
-	NewReadOnlySlicePusher[[][]byte](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	ips := [][]net.IP{{{192, 0, 2, 1}}}
-	NewReadOnlySlicePusher[[]net.IP](L)(L, ips)
-	L.SetGlobal("ips", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-local function readOnly(value)
-    assert(not pcall(function() value[1] = value[1] end))
-    assert(not pcall(function() return value + value[1] end))
-end
-assert(values[1][1][1] == 3 and values[1][1][2] == 5)
-readOnly(values)
-for _, group in values() do
-    readOnly(group)
-    for _, bytes in group() do readOnly(bytes) end
-end
-readOnly(ips)
-readOnly(ips[1])
-local ip = ips[1][1]
-assert(ip:String() == "192.0.2.1")
-readOnly(ip)
-readOnly(ip:To4())
-readOnly(ip:To16())
-readOnly(ip:DefaultMask())
-assert(ip.AppendText == nil and ip.appendText == nil)
-`); err != nil {
-		t.Fatal(err)
-	}
-	readOnly := luar.MT(L, ips[0]).RawGetString("__newindex")
-	NewReadOnlySlicePusher[net.IP](L)
-	if luar.MT(L, ips[0]).RawGetString("__newindex") != readOnly {
-		t.Fatal("nested slice metatable was initialized again")
-	}
-	got := L.GetGlobal("values").(*glua.LUserData).Value.([][][]byte)
-	if &got[0][0][0] != &values[0][0][0] || values[0][0][0] != 3 || values[0][0][1] != 5 {
-		t.Fatal("read-only binding copied or modified the nested slice")
-	}
-}
-
-type recursiveReadOnlySlice []recursiveReadOnlySlice
-
-func TestReadOnlyRecursiveSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := make(recursiveReadOnlySlice, 1)
-	values[0] = values
-	NewReadOnlySlicePusher[recursiveReadOnlySlice](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-local nested = values[1][1][1]
-assert(#nested == 1)
-assert(not pcall(function() nested[1] = nested end))
-assert(not pcall(function() return nested + nested end))
-`); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestSlicePusherMetatablePerState(t *testing.T) {
 	first := glua.NewState()
 	defer first.Close()

common/lua/privileged.go

@@ -1,117 +0,0 @@
-package lua
-
-import (
-	"bytes"
-	"crypto/ed25519"
-	"crypto/sha256"
-	"encoding/base64"
-	"sync"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-var privilegedKey struct {
-	sync.Once
-	publicKey ed25519.PublicKey
-}
-
-// SetPrivilegedPublicKey configures the trusted Ed25519 public key once at
-// startup, before compiling scripts. An empty value disables authorization.
-// Nonempty values must be unpadded Base64URL encodings of exactly 32 bytes.
-func SetPrivilegedPublicKey(value string) error {
-	var publicKey ed25519.PublicKey
-	if value != "" {
-		decoded, err := decodePrivilegedValue(value, ed25519.PublicKeySize)
-		if err != nil {
-			return errors.New("invalid Lua privileged public key").Base(err)
-		}
-		publicKey = ed25519.PublicKey(decoded)
-	}
-	privilegedKey.Do(func() {
-		privilegedKey.publicKey = publicKey
-	})
-	return nil
-}
-
-func decodePrivilegedValue(value string, size int) ([]byte, error) {
-	encoding := base64.RawURLEncoding.Strict()
-	if len(value) != encoding.EncodedLen(size) {
-		return nil, errors.New("expected an unpadded Base64URL encoding of ", size, " bytes")
-	}
-	decoded, err := encoding.DecodeString(value)
-	if err != nil || len(decoded) != size || encoding.EncodeToString(decoded) != value {
-		return nil, errors.New("expected an unpadded Base64URL encoding of ", size, " bytes")
-	}
-	return decoded, nil
-}
-
-func verifyPrivilegedSignature(code []byte) (bool, error) {
-	_, end, value, found := privilegedSignatureLine(code)
-	if !found {
-		return false, nil
-	}
-
-	publicKey := privilegedKey.publicKey
-	if len(publicKey) == 0 {
-		return false, errors.New("Lua privileged signature requires --lua-privileged-pubkey")
-	}
-	signature, err := decodePrivilegedValue(string(bytes.TrimSpace(value)), ed25519.SignatureSize)
-	if err != nil {
-		return false, errors.New("invalid Lua privileged signature").Base(err)
-	}
-	digest := sha256.Sum256(bytes.TrimSpace(code[end:]))
-	if !ed25519.Verify(publicKey, digest[:], signature) {
-		return false, errors.New("Lua privileged signature verification failed")
-	}
-	return true, nil
-}
-
-// SignPrivilegedScript signs the script body, then prepends or replaces the signature line.
-func SignPrivilegedScript(code []byte, seed string) ([]byte, error) {
-	decoded, err := decodePrivilegedValue(seed, ed25519.SeedSize)
-	if err != nil {
-		return nil, errors.New("invalid Ed25519 private key seed").Base(err)
-	}
-
-	start, end, _, found := privilegedSignatureLine(code)
-	body := code
-	if found {
-		body = code[end:]
-	}
-
-	digest := sha256.Sum256(bytes.TrimSpace(body))
-	signature := ed25519.Sign(ed25519.NewKeyFromSeed(decoded), digest[:])
-	header := []byte("-- @xray:privileged-signature=" + base64.RawURLEncoding.EncodeToString(signature))
-
-	if !found {
-		if newline := bytes.IndexByte(code, '\n'); newline > 0 && code[newline-1] == '\r' {
-			header = append(header, '\r')
-		}
-		header = append(header, '\n')
-		return append(header, code...), nil
-	}
-	signed := make([]byte, 0, start+len(header)+len(code)-end)
-	signed = append(signed, code[:start]...)
-	signed = append(signed, header...)
-	return append(signed, code[end:]...), nil
-}
-
-func privilegedSignatureLine(code []byte) (start, end int, value []byte, found bool) {
-	for rest := code; len(rest) != 0; {
-		start = len(code) - len(rest)
-		var line []byte
-		line, rest, _ = bytes.Cut(rest, []byte{'\n'})
-		line = bytes.TrimSuffix(line, []byte{'\r'})
-		if len(bytes.TrimSpace(line)) == 0 {
-			continue
-		}
-		end = start + len(line)
-		line, found := bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("--"))
-		if !found {
-			return 0, 0, nil, false
-		}
-		value, found = bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("@xray:privileged-signature="))
-		return start, end, value, found
-	}
-	return 0, 0, nil, false
-}

common/lua/privileged_sign_test.go

@@ -1,85 +0,0 @@
-package lua
-
-// TODO: Re-enable these tests and their helper when Compile supports privileged signature authorization again.
-/*
-import (
-	"bytes"
-	"crypto/ed25519"
-	"encoding/base64"
-	"encoding/hex"
-	"strings"
-	"testing"
-)
-
-func privilegedSeed(t *testing.T) string {
-	t.Helper()
-	seed, err := hex.DecodeString(privilegedTestSeed)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return base64.RawURLEncoding.EncodeToString(seed)
-}
-
-func TestSignPrivilegedScriptPreservesSource(t *testing.T) {
-	setTestPrivilegedPublicKey(t, privilegedTestPublicKey)
-	seed := privilegedSeed(t)
-	for _, tc := range []struct {
-		name, prefix, header, body, newline string
-	}{
-		{name: "unsigned", body: privilegedFixtureBody, newline: "\n"},
-		{name: "unsigned boundary whitespace", body: " \t\n\n" + privilegedFixtureBody + " \t\n", newline: "\n"},
-		{name: "unsigned CRLF", body: strings.ReplaceAll(privilegedFixtureBody, "\n", "\r\n"), newline: "\r\n"},
-		{name: "replace invalid header", header: privilegedSignatureHeader + "%", body: "\n" + privilegedFixtureBody, newline: "\n"},
-		{name: "replace indented header", prefix: " \t\r\n\n", header: " \t--\t @xray:privileged-signature=% \t", body: "\r\n \t\r\n" + privilegedFixtureBody + "\r\n", newline: "\r\n"},
-		{name: "replace valid header", header: privilegedSignatureHeader + privilegedFixtureSignature, body: "\n" + privilegedFixtureBody, newline: "\n"},
-		{name: "empty script", newline: "\n"},
-		{name: "header without newline", header: privilegedSignatureHeader + "%"},
-		{name: "ordinary comment before marker", body: "-- ordinary comment\n" + privilegedSignatureHeader + "%\nvalue = 1", newline: "\n"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			code := []byte(tc.prefix + tc.header + tc.body)
-			original := bytes.Clone(code)
-			signed, err := SignPrivilegedScript(code, seed)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if !bytes.Equal(code, original) {
-				t.Fatal("signing modified the input buffer")
-			}
-			body := tc.body
-			if tc.header != "" {
-				body = strings.TrimPrefix(body, tc.newline)
-			}
-			header := privilegedSignatureHeader + testSignature(t, body)
-			want := header + tc.newline + tc.body
-			if tc.header != "" {
-				want = tc.prefix + header + tc.body
-			}
-			if string(signed) != want {
-				t.Fatalf("signed source = %q, want %q", signed, want)
-			}
-			program, err := Compile(writeTestScript(t, string(signed)))
-			if err != nil || program == nil || !program.privileged {
-				t.Fatalf("signed source Compile = %v, %v; want privileged program", program, err)
-			}
-			again, err := SignPrivilegedScript(signed, seed)
-			if err != nil || !bytes.Equal(again, signed) {
-				t.Fatalf("resigning changed the source: %q, %v", again, err)
-			}
-		})
-	}
-}
-
-func TestSignPrivilegedScriptRejectsInvalidSeed(t *testing.T) {
-	seed := privilegedSeed(t)
-	for _, value := range []string{
-		"", "%", seed + "=",
-		base64.RawURLEncoding.EncodeToString(make([]byte, ed25519.SeedSize-1)),
-		base64.RawURLEncoding.EncodeToString(make([]byte, ed25519.PrivateKeySize)),
-	} {
-		if signed, err := SignPrivilegedScript([]byte(privilegedFixtureBody), value); signed != nil || err == nil {
-			t.Fatalf("SignPrivilegedScript with invalid seed = %q, %v; want rejection", signed, err)
-		}
-	}
-}
-*/

common/lua/program.go

@@ -1,80 +1,47 @@
 package lua
 
 import (
-	"bytes"
+	"bufio"
 	"context"
-	"fmt"
 	"os"
-	"regexp"
-	"strings"
 	"time"
 
-	"github.com/xtls/xray-core/common/base64"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	glua "github.com/yuin/gopher-lua"
 	"github.com/yuin/gopher-lua/parse"
 )
 
 // Program holds immutable bytecode that can be run by independent LStates.
 type Program struct {
-	proto      *glua.FunctionProto
-	privileged bool
+	proto *glua.FunctionProto
 }
 
 // LStateFactory returns a fully initialized state or nil and an error.
 // Implementations must close partial states on failure; callers own successful states.
 type LStateFactory func(context.Context) (*glua.LState, error)
 
-// Compile reads a Lua file or decodes an inline script and compiles it into an immutable program.
-func Compile(script string) (*Program, error) {
-	var code []byte
-	var err error
-	name := "[inline]"
-	privileged := false
-	if strings.HasPrefix(script, base64.GzipPrefix) || strings.HasPrefix(script, base64.Prefix) {
-		// TODO: Restore inline script support and re-enable the related tests.
-		return nil, errors.New("currently unavailable")
-		code, err = base64.Decode(script)
-	} else if name, err = filesystem.ResolveLuaFile(script); err == nil {
-		code, err = os.ReadFile(name)
-		// TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries.
-		// if err == nil {
-		// 	privileged, err = verifyPrivilegedSignature(code)
-		// }
-	}
+// CompileFile reads and compiles a Lua file once.
+func CompileFile(path string) (*Program, error) {
+	f, err := os.Open(path)
 	if err != nil {
 		return nil, err
 	}
-
-	chunk, err := parse.Parse(bytes.NewReader(code), name)
+	defer f.Close()
+	chunk, err := parse.Parse(bufio.NewReader(f), path)
 	if err != nil {
 		return nil, err
 	}
-	proto, err := glua.Compile(chunk, name)
+	proto, err := glua.Compile(chunk, path)
 	if err != nil {
 		return nil, err
 	}
-	return &Program{proto: proto, privileged: privileged}, nil
+	return &Program{proto: proto}, nil
 }
 
 // NewState creates a state, runs register, executes the program under ctx, and
 // runs validate. It removes the initialization context before returning a state
 // owned by the caller.
-// Choose registrySize for the script type's expected stack usage, balancing
-// per-state memory usage against the number of states retained in a pool.
-func (p *Program) NewState(ctx context.Context, registrySize int, register func(*glua.LState), validate func(*glua.LState) error) (*glua.LState, error) {
-	options := glua.Options{
-		RegistrySize:     registrySize,
-		RegistryMaxSize:  glua.RegistrySize,
-		RegistryGrowStep: registrySize,
-	}
-	var L *glua.LState
-	if p.privileged {
-		L = glua.NewState(options)
-	} else {
-		L = newSandboxedState(options)
-	}
+func (p *Program) NewState(ctx context.Context, register func(*glua.LState), validate func(*glua.LState) error) (*glua.LState, error) {
+	L := glua.NewState()
 	valid := false
 	defer func() {
 		if !valid {
@@ -86,10 +53,6 @@ func (p *Program) NewState(ctx context.Context, registrySize int, register func(
 	if register != nil {
 		register(L)
 	}
-	if !p.privileged {
-		// Hide package internals to prevent data snooping and sandbox escape.
-		L.SetGlobal(glua.LoadLibName, glua.LNil)
-	}
 	L.Push(L.NewFunctionFromProto(p.proto))
 	// Execute the Lua script's top level.
 	if err := L.PCall(0, 0, nil); err != nil {
@@ -104,157 +67,11 @@ func (p *Program) NewState(ctx context.Context, registrySize int, register func(
 	return L, nil
 }
 
-func newSandboxedState(options glua.Options) *glua.LState {
-	options.SkipOpenLibs = true
-	L := glua.NewState(options)
-
-	for _, lib := range []struct {
-		name string
-		open glua.LGFunction
-	}{
-		{glua.LoadLibName, glua.OpenPackage},
-		{glua.BaseLibName, glua.OpenBase},
-		{glua.TabLibName, glua.OpenTable},
-		{glua.StringLibName, glua.OpenString},
-		{glua.MathLibName, glua.OpenMath},
-		{glua.OsLibName, glua.OpenOs},
-	} {
-		L.Push(L.NewFunction(lib.open))
-		L.Push(glua.LString(lib.name))
-		L.Call(1, 0)
-	}
-
-	for _, name := range []string{
-		"dofile", "loadfile", "load", "loadstring", "getfenv", "setfenv",
-		"getmetatable", "setmetatable", "rawget", "rawset",
-		"collectgarbage", "module", "newproxy", "print", "_printregs",
-	} {
-		L.SetGlobal(name, glua.LNil)
-	}
-
-	// Prevent printing memory addresses that reveal the memory layout.
-	toString := func(value glua.LValue) glua.LString {
-		result := "<opaque>"
-		switch value.Type() {
-		case glua.LTNil, glua.LTBool, glua.LTNumber, glua.LTString:
-			result = value.String()
-		case glua.LTUserData:
-			switch native := value.(*glua.LUserData).Value.(type) {
-			case error: // Errors can also implement fmt.Stringer; redact them first.
-				result = redactMemoryAddresses(native.Error())
-			case fmt.Stringer:
-				result = native.String()
-			}
-		}
-		return glua.LString(result)
-	}
-	L.SetGlobal("tostring", L.NewFunction(func(L *glua.LState) int {
-		L.Push(toString(L.CheckAny(1)))
-		return 1
-	}))
-
-	// Prevent printing memory addresses that reveal the memory layout.
-	stringLib := L.GetGlobal(glua.StringLibName).(*glua.LTable)
-	stringLib.RawSetString("dump", glua.LNil)
-	format := stringLib.RawGetString("format")
-	stringLib.RawSetString("format", L.NewFunction(func(L *glua.LState) int {
-		nargs := L.GetTop()
-		for i := 2; i <= nargs; i++ {
-			value := L.Get(i)
-			switch value.Type() {
-			case glua.LTBool, glua.LTNumber, glua.LTString:
-				continue
-			}
-			L.Replace(i, toString(value))
-		}
-		L.Insert(format, 1)
-		L.Call(nargs, 1)
-		return 1
-	}))
-
-	// Redact addresses before caught errors become readable by the script.
-	redactError := func(value glua.LValue) glua.LValue {
-		if message, ok := value.(glua.LString); ok {
-			if redacted := redactMemoryAddresses(string(message)); redacted != string(message) {
-				return glua.LString(redacted)
-			}
-		}
-		return value
-	}
-	for _, name := range []string{"pcall", "xpcall"} {
-		call := L.GetGlobal(name)
-		L.SetGlobal(name, L.NewFunction(func(L *glua.LState) int {
-			nargs := L.GetTop()
-			if name == "xpcall" {
-				L.CheckFunction(1)
-				handler := L.CheckFunction(2)
-				L.Replace(2, L.NewFunction(func(L *glua.LState) int {
-					L.Replace(1, redactError(L.Get(1)))
-					L.Insert(handler, 1)
-					L.Call(1, 1)
-					return 1
-				}))
-			}
-			L.Insert(call, 1)
-			L.Call(nargs, glua.MultRet)
-			if L.Get(1) == glua.LFalse {
-				L.Replace(2, redactError(L.Get(2)))
-			}
-			return L.GetTop()
-		}))
-	}
-
-	// Prevent seed output from compromising cryptographic security.
-	L.GetGlobal(glua.MathLibName).(*glua.LTable).RawSetString("randomseed", glua.LNil)
-
-	// Keep only time functions, including when os is accessed through require.
-	osLib := L.GetGlobal(glua.OsLibName).(*glua.LTable)
-	for key, _ := osLib.Next(glua.LNil); key != glua.LNil; key, _ = osLib.Next(key) {
-		switch key {
-		case glua.LString("clock"), glua.LString("date"), glua.LString("difftime"), glua.LString("time"):
-		default:
-			osLib.RawSet(key, glua.LNil)
-		}
-	}
-
-	// Prevent module injection through the global package table.
-	module := L.GetGlobal(glua.LoadLibName).(*glua.LTable)
-	preload := module.RawGetString("preload").(*glua.LTable)
-	loaders := L.CreateTable(1, 0)
-	loaders.RawSetInt(1, L.NewFunction(func(L *glua.LState) int {
-		name := L.CheckString(1)
-		loader := preload.RawGetString(name)
-		if loader == glua.LNil {
-			loader = glua.LString("no preloaded module: " + name)
-		}
-		L.Push(loader)
-		return 1
-	}))
-	module.RawSetString("loaders", loaders)
-	L.SetField(L.Get(glua.RegistryIndex), "_LOADERS", loaders)
-	for _, name := range []string{"loadlib", "seeall", "path", "cpath", "config"} {
-		module.RawSetString(name, glua.LNil)
-	}
-
-	return L
-}
-
-var memoryAddressPattern = regexp.MustCompile(`0[xX][0-9a-fA-F]+`)
-
-func redactMemoryAddresses(message string) string {
-	if !strings.Contains(message, "0x") && !strings.Contains(message, "0X") {
-		return message
-	}
-	return memoryAddressPattern.ReplaceAllString(message, "<address>")
-}
-
 // NewStateFactory returns a factory that gives each state an initialization timeout.
-// Choose registrySize for the script type's expected stack usage, balancing
-// per-state memory usage against the number of states retained in a pool.
-func (p *Program) NewStateFactory(initTimeout time.Duration, registrySize int, register func(*glua.LState), validate func(*glua.LState) error) LStateFactory {
+func (p *Program) NewStateFactory(initTimeout time.Duration, register func(*glua.LState), validate func(*glua.LState) error) LStateFactory {
 	return func(ctx context.Context) (*glua.LState, error) {
 		initCtx, cancel := context.WithTimeout(ctx, initTimeout)
 		defer cancel()
-		return p.NewState(initCtx, registrySize, register, validate)
+		return p.NewState(initCtx, register, validate)
 	}
 }

common/net/find_process_linux.go

@@ -4,7 +4,7 @@ package net
 
 import (
 	"bufio"
-	"encoding/binary"
+	"encoding/hex"
 	"fmt"
 	"net"
 	"os"
@@ -26,38 +26,36 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 		panic("Unsupported network type for process lookup.")
 	}
 
-	var procFiles []string
+	var procFile string
 
 	switch network {
 	case "tcp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/tcp"}
+			procFile = "/proc/net/tcp"
 		} else {
-			procFiles = []string{"/proc/net/tcp6"}
+			procFile = "/proc/net/tcp6"
 		}
 	case "udp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/udp", "/proc/net/udp6"}
+			procFile = "/proc/net/udp"
 		} else {
-			procFiles = []string{"/proc/net/udp6", "/proc/net/udp"}
+			procFile = "/proc/net/udp6"
 		}
 	default:
 		panic("Unsupported network type for process lookup.")
 	}
 
-	targetHexAddr := formatProcNetAddress(net.ParseIP(srcIP), Port(srcPort))
-
-	portFallback := ""
-	if network == "udp" {
-		portFallback = fmt.Sprintf(":%04X", srcPort)
+	targetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))
+	if err != nil {
+		return 0, "", "", errors.New("failed to format address: ", err)
 	}
 
-	inode, err := findInodeInFiles(procFiles, targetHexAddr, portFallback)
+	inode, err := findInodeInFile(procFile, targetHexAddr)
 	if err != nil {
-		return 0, "", "", errors.New("could not search in ", strings.Join(procFiles, " and ")).Base(err)
+		return 0, "", "", errors.New("could not search in ", procFile).Base(err)
 	}
 	if inode == "" {
-		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", strings.Join(procFiles, " or "))
+		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", procFile)
 	}
 
 	pidStr, err := findPidByInode(inode)
@@ -84,60 +82,51 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 	return pid, procName, absPath, nil
 }
 
-func formatProcNetAddress(addr net.IP, port Port) string {
+func formatLittleEndianString(addr net.IP, port Port) (string, error) {
+	ip := addr
 	var ipBytes []byte
-	if ipv4 := addr.To4(); ipv4 != nil {
-		ipBytes = ipv4
+	if ip.To4() != nil {
+		ipBytes = ip.To4()
 	} else {
-		ipBytes = addr.To16()
+		ipBytes = ip.To16()
+	}
+	if ipBytes == nil {
+		return "", errors.New("invalid IP format for ", addr, ": ", ip)
 	}
 
-	var formatted strings.Builder
-	formatted.Grow(len(ipBytes)*2 + 5)
-	for i := 0; i < len(ipBytes); i += 4 {
-		fmt.Fprintf(&formatted, "%08X", binary.NativeEndian.Uint32(ipBytes[i:i+4]))
+	for i, j := 0, len(ipBytes)-1; i < j; i, j = i+1, j-1 {
+		ipBytes[i], ipBytes[j] = ipBytes[j], ipBytes[i]
 	}
-	fmt.Fprintf(&formatted, ":%04X", uint16(port))
-	return formatted.String()
+	portHex := fmt.Sprintf("%04X", uint16(port))
+	ipHex := strings.ToUpper(hex.EncodeToString(ipBytes))
+	return fmt.Sprintf("%s:%s", ipHex, portHex), nil
 }
 
-func findInodeInFiles(filePaths []string, targetHexAddr, portFallback string) (string, error) {
-	onlyMatchedPort := ""
+func findInodeInFile(filePath, targetHexAddr string) (string, error) {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
 
-	for i, filePath := range filePaths {
-		file, err := os.Open(filePath)
-		if err != nil {
-			if i > 0 && os.IsNotExist(err) {
-				continue
-			}
-			return "", err
+	scanner := bufio.NewScanner(file)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		fields := strings.Fields(line)
+
+		if len(fields) < 10 {
+			continue
 		}
-		defer file.Close()
 
-		scanner := bufio.NewScanner(file)
-		for scanner.Scan() {
-			fields := strings.Fields(scanner.Text())
-			if len(fields) < 10 {
-				continue
-			}
-
-			localAddress := fields[1]
-			if localAddress == targetHexAddr {
-				return fields[9], nil
-			}
-			if portFallback != "" && strings.HasSuffix(localAddress, portFallback) {
-				wildcardIP := strings.TrimSuffix(localAddress, portFallback)
-				if (len(wildcardIP) == 8 || len(wildcardIP) == 32) && strings.Trim(wildcardIP, "0") == "" {
-					onlyMatchedPort = fields[9]
-				}
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			return "", err
+		localAddress := fields[1]
+		if localAddress == targetHexAddr {
+			inode := fields[9]
+			return inode, nil
 		}
 	}
 
-	return onlyMatchedPort, nil
+	return "", scanner.Err()
 }
 
 func findPidByInode(inode string) (string, error) {

common/platform/filesystem/file.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -27,13 +26,25 @@ func ReadFile(path string) ([]byte, error) {
 	return buf.ReadAllToBytes(reader)
 }
 
-func OpenAsset(file string) (io.ReadCloser, int64, error) {
-	path, info, err := getAssetFileLocation(file)
+func ReadAsset(file string) ([]byte, error) {
+	path, _, err := getAssetFileLocation(file)
 	if err != nil {
-		return nil, 0, err
+		return nil, err
 	}
-	r, err := NewFileReader(path)
-	return r, info.Size(), err
+	return ReadFile(path)
+}
+
+func OpenAsset(file string) (io.ReadCloser, error) {
+	path, _, err := getAssetFileLocation(file)
+	if err != nil {
+		return nil, err
+	}
+	return NewFileReader(path)
+}
+
+func StatAsset(file string) (os.FileInfo, error) {
+	_, info, err := getAssetFileLocation(file)
+	return info, err
 }
 
 func ResolveAsset(file string) (string, error) {
@@ -67,29 +78,17 @@ func ReadCert(file string) ([]byte, error) {
 	return ReadFile(platform.GetCertLocation(file))
 }
 
-// ResolveLuaFile finds a local .lua script and returns its absolute path.
-// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
-func ResolveLuaFile(path string) (string, error) {
-	if !strings.EqualFold(filepath.Ext(path), ".lua") {
-		return "", errors.New("Lua file extension must be .lua")
+func CopyFile(dst string, src string) error {
+	bytes, err := ReadFile(src)
+	if err != nil {
+		return err
 	}
-	if filepath.IsAbs(path) {
-		return path, nil
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
 	}
-	for _, dir := range []string{
-		platform.GetConfDirPath(),
-		platform.NewEnvFlag(platform.ConfigLocation).GetValue(func() string { return "" }),
-		".",
-		platform.GetExecutableDir(),
-	} {
-		if dir != "" {
-			resolved := filepath.Join(dir, path)
-			if _, err := os.Stat(resolved); err == nil {
-				return filepath.Abs(resolved)
-			} else if !os.IsNotExist(err) {
-				return "", err
-			}
-		}
-	}
-	return "", os.ErrNotExist
+	defer f.Close()
+
+	_, err = f.Write(bytes)
+	return err
 }

common/platform/filesystem/file_test.go

@@ -1,17 +1,13 @@
 package filesystem_test
 
 import (
-	"errors"
-	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/platform"
 	. "github.com/xtls/xray-core/common/platform/filesystem"
 )
 
-func TestResolveAssetRejectsInvalidPath(t *testing.T) {
+func TestStatAssetRejectsInvalidPath(t *testing.T) {
 	for _, file := range []string{
 		"",
 		".",
@@ -29,49 +25,8 @@ func TestResolveAssetRejectsInvalidPath(t *testing.T) {
 		`nested\..\geoip.dat`,
 		filepath.Join(t.TempDir(), "geoip.dat"),
 	} {
-		if _, err := ResolveAsset(file); err == nil {
+		if _, err := StatAsset(file); err == nil {
 			t.Fatalf("expected error for %q", file)
 		}
 	}
 }
-
-func TestResolveLuaFile(t *testing.T) {
-	t.Chdir(t.TempDir())
-	workingDir, err := os.Getwd()
-	common.Must(err)
-	executable, err := os.Executable()
-	common.Must(err)
-	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
-	common.Must(err)
-	common.Must(file.Close())
-	defer os.Remove(file.Name())
-
-	name := filepath.Base(file.Name())
-	paths := []string{
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(workingDir, name),
-		file.Name(),
-	}
-	t.Setenv(platform.ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(platform.ConfigLocation, filepath.Dir(paths[1]))
-	for _, path := range paths[:3] {
-		common.Must(os.WriteFile(path, nil, 0o600))
-	}
-	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
-		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
-	}
-	for i, want := range paths {
-		if i == 2 {
-			t.Setenv(platform.ConfdirLocation, "")
-			t.Setenv(platform.ConfigLocation, "")
-		}
-		if got, err := ResolveLuaFile(name); err != nil || got != want {
-			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
-		}
-		common.Must(os.Remove(want))
-	}
-	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("missing file error = %v", err)
-	}
-}

common/platform/others.go

@@ -14,7 +14,7 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir, the executable dir, and certain locations
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	defPath := filepath.Join(assetPath, file)
 	for _, p := range []string{
 		defPath,
@@ -36,6 +36,6 @@ func GetAssetLocation(file string) string {
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/platform/platform.go

@@ -1,6 +1,8 @@
 package platform // import "github.com/xtls/xray-core/common/platform"
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -72,7 +74,7 @@ func NormalizeEnvName(name string) string {
 	return strings.ReplaceAll(strings.ToUpper(strings.TrimSpace(name)), ".", "_")
 }
 
-func GetExecutableDir() string {
+func getExecutableDir() string {
 	exec, err := os.Executable()
 	if err != nil {
 		return ""
@@ -81,7 +83,7 @@ func GetExecutableDir() string {
 }
 
 func GetConfigurationPath() string {
-	configPath := NewEnvFlag(ConfigLocation).GetValue(GetExecutableDir)
+	configPath := NewEnvFlag(ConfigLocation).GetValue(getExecutableDir)
 	return filepath.Join(configPath, "config.json")
 }
 
@@ -90,3 +92,49 @@ func GetConfDirPath() string {
 	configPath := NewEnvFlag(ConfdirLocation).GetValue(func() string { return "" })
 	return configPath
 }
+
+// ResolveLuaFile finds a local Lua script and returns its absolute path.
+// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+func ResolveLuaFile(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("Lua file path is empty")
+	}
+	paths := []string{path}
+	if !filepath.IsAbs(path) {
+		paths = nil
+		for _, dir := range []string{
+			GetConfDirPath(),
+			NewEnvFlag(ConfigLocation).GetValue(func() string { return "" }),
+			".",
+			getExecutableDir(),
+		} {
+			if dir != "" {
+				paths = append(paths, filepath.Join(dir, path))
+			}
+		}
+	}
+	return resolveFile(paths)
+}
+
+func resolveFile(paths []string) (string, error) {
+	var tried []string
+	for _, path := range paths {
+		path, err := filepath.Abs(path)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve file path: %w", err)
+		}
+		tried = append(tried, path)
+		info, err := os.Stat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return "", fmt.Errorf("failed to inspect file %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("file is not a regular file: %s", path)
+		}
+		return path, nil
+	}
+	return "", fmt.Errorf("file not found; tried %q: %w", tried, os.ErrNotExist)
+}

common/platform/platform_test.go

@@ -1,6 +1,7 @@
 package platform_test
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -64,3 +65,53 @@ func TestGetAssetLocation(t *testing.T) {
 		}
 	}
 }
+
+func TestResolveLuaFile(t *testing.T) {
+	workingDir := t.TempDir()
+	t.Chdir(workingDir)
+	executable, err := os.Executable()
+	common.Must(err)
+	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
+	common.Must(err)
+	common.Must(file.Close())
+	defer os.Remove(file.Name())
+
+	name := filepath.Base(file.Name())
+	paths := []string{
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(workingDir, name),
+		file.Name(),
+	}
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	for _, path := range paths[:3] {
+		common.Must(os.WriteFile(path, nil, 0o600))
+	}
+	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
+		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
+	}
+	for i, want := range paths {
+		if i == 2 {
+			t.Setenv(ConfdirLocation, "")
+			t.Setenv(ConfigLocation, "")
+		}
+		if got, err := ResolveLuaFile(name); err != nil || got != want {
+			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
+		}
+		common.Must(os.Remove(want))
+	}
+	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing file error = %v", err)
+	}
+
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	common.Must(os.Mkdir(paths[0], 0o700))
+	common.Must(os.WriteFile(paths[1], nil, 0o600))
+	for _, path := range []string{"", name, filepath.Join(t.TempDir(), name)} {
+		if _, err := ResolveLuaFile(path); err == nil {
+			t.Fatalf("accepted invalid path %q", path)
+		}
+	}
+}

common/platform/windows.go

@@ -11,12 +11,12 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir and the executable dir
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	return filepath.Join(assetPath, file)
 }
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

core/config.go

@@ -175,13 +175,9 @@ func init() {
 			switch v := input.(type) {
 			case cmdarg.Arg:
 				r, err := confloader.LoadConfig(v[0])
-				if err != nil {
-					return nil, err
-				}
+				common.Must(err)
 				data, err := buf.ReadAllToBytes(r)
-				if err != nil {
-					return nil, err
-				}
+				common.Must(err)
 				return loadProtobufConfig(data)
 			case io.Reader:
 				data, err := buf.ReadAllToBytes(v)

core/core.go

@@ -20,7 +20,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 10
-	Version_z byte = 29
+	Version_z byte = 10
 )
 
 var (

core/proto.go

@@ -1,3 +1,5 @@
 package core
 
+//go:generate go install -v google.golang.org/protobuf/cmd/protoc-gen-go@latest
+//go:generate go install -v google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 //go:generate go run ../infra/vprotogen/main.go -pwd ./..

features/dns/localdns/client.go

@@ -2,7 +2,6 @@ package localdns
 
 import (
 	"context"
-	"net/netip"
 	"syscall"
 	"time"
 
@@ -101,15 +100,6 @@ func New() *Client {
 			if internet.IsSkippedDNSServer(address) {
 				return nil, errors.New("skipped DNS server ", address)
 			}
-			// A socket of the server's IP version only needs that version bound
-			// to the interface, which a dual-stack one would need both of.
-			if ap, err := netip.ParseAddrPort(address); err == nil && (network == "udp" || network == "tcp") {
-				if ap.Addr().Unmap().Is4() {
-					network += "4"
-				} else {
-					network += "6"
-				}
-			}
 			return d.DialContext(ctx, network, address)
 		},
 	}

go.mod

@@ -4,36 +4,36 @@ go 1.27
 
 require (
 	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/bufbuild/protocompile v0.14.1
+	github.com/cloudflare/circl v1.6.5
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.1
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.7
-	github.com/pires/go-proxyproto v0.16.0
+	github.com/pires/go-proxyproto v0.15.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/stretchr/testify v1.12.1
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8
+	github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0
 	github.com/yuin/gopher-lua v1.1.2
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.58.0
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a
+	golang.org/x/crypto v0.57.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.61.0
-	golang.org/x/sync v0.24.0
-	golang.org/x/sys v0.49.0
+	golang.org/x/net v0.59.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.1.1
 	google.golang.org/grpc v1.84.0
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/protobuf v1.36.12
+	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
 	layeh.com/gopher-luar v1.0.11
 	lukechampine.com/blake3 v1.4.1
@@ -41,12 +41,13 @@ require (
 )
 
 require (
-	github.com/andybalholm/brotli v1.2.3 // indirect
+	github.com/andybalholm/brotli v1.0.6 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
 	github.com/huin/goupnp v1.2.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/juju/ratelimit v1.0.2 // indirect
-	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
 	github.com/pion/dtls/v3 v3.1.5 // indirect
@@ -56,15 +57,10 @@ require (
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.43.0 // indirect
-	golang.org/x/tools v0.51.0 // indirect
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
-)
-
-tool (
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc
-	google.golang.org/protobuf/cmd/protoc-gen-go
 )

go.sum

@@ -1,12 +1,12 @@
-github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA5NQ=
-github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
+github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8=
-github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
-github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
+github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 h1:Arcl6UOIS/kgO2nW3A65HN+7CMjSDP/gofXL4CZt1V4=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=
 github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
@@ -33,10 +33,10 @@ github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7Bd
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
-github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
-github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
-github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -61,8 +61,8 @@ github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
 github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
 github.com/pion/transport/v4 v4.1.0 h1:8S+nF2reM2cJuqC6g78OVy2BBgmbdns+acx3jA97BvQ=
 github.com/pion/transport/v4 v4.1.0/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.16.0 h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
-github.com/pires/go-proxyproto v0.16.0/go.mod h1:n7yhg8yIfNl3KgYDCwBzmeUHNpKTVnUhcWpc7rV4RW4=
+github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
+github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -81,10 +81,8 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
-github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8 h1:RjLnVvlzK4q6zWaSBPNRGsrgx2fbJDeUWffjw574uzs=
-github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8/go.mod h1:ptlSkJ8k/7IDauNH0SA96JPOo+nYGLTv2Y3UMpwvAsY=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0 h1:rb+fKQFhz+5I2PPuQsNYxI5mUU840XWYtRF0ZBjvkws=
+github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=
 github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
@@ -97,10 +95,10 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
-golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582 h1:wjDBrGbfLuifgrVLFEWUBJYAfh5Q1wkMc5t0FY0tCbs=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -109,12 +107,12 @@ golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
-golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -123,22 +121,22 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
-golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -154,10 +152,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
 google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.0 h1:6Al3kEFFP9VJhRz3DID6quisgPnTeZVr4lep9kkxdPA=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.0/go.mod h1:QLvsjh0OIR0TYBeiu2bkWGTJBUNQ64st52iWj/yA93I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/dns.go

@@ -14,6 +14,7 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/platform"
 )
 
 type NameServerConfig struct {
@@ -272,17 +273,6 @@ func (m *HostsWrapper) Build() ([]*dns.Config_HostMapping, error) {
 
 // Build implements Buildable
 func (c *DNSConfig) Build() (*dns.Config, error) {
-	if c.Script != "" {
-		if c.DisableFallback || c.DisableFallbackIfMatch || c.EnableParallelQuery {
-			return nil, errors.New("DNS script cannot be used with disableFallback, disableFallbackIfMatch or enableParallelQuery")
-		}
-		for i, server := range c.Servers {
-			if len(server.Domains) > 0 || server.SkipFallback || server.FinalQuery {
-				return nil, errors.New("DNS script cannot be used with domains, skipFallback or finalQuery in server ", i)
-			}
-		}
-	}
-
 	config := &dns.Config{
 		Tag:                    c.Tag,
 		DisableCache:           c.DisableCache,
@@ -292,7 +282,14 @@ func (c *DNSConfig) Build() (*dns.Config, error) {
 		DisableFallbackIfMatch: c.DisableFallbackIfMatch,
 		EnableParallelQuery:    c.EnableParallelQuery,
 		QueryStrategy:          resolveQueryStrategy(c.QueryStrategy),
-		Script:                 c.Script,
+	}
+
+	if c.Script != "" {
+		path, err := platform.ResolveLuaFile(c.Script)
+		if err != nil {
+			return nil, errors.New("failed to resolve DNS script: ", c.Script).Base(err)
+		}
+		config.Script = path
 	}
 
 	if c.ClientIP != nil {

infra/conf/dns_test.go

@@ -2,7 +2,8 @@ package conf_test
 
 import (
 	"encoding/json"
-	"strings"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -124,7 +125,41 @@ func TestDNSConfigParsing(t *testing.T) {
 	}
 }
 
-func TestDNSNameServerID(t *testing.T) {
+func TestDNSScriptConfig(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("xray.location.confdir", dir)
+	path := filepath.Join(dir, "lookup.lua")
+	if err := os.WriteFile(path, []byte("function HandleDNSQuery(domain, ipv4, ipv6, fake) end"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
+		name      string
+		script    string
+		wantError bool
+	}{
+		{"relative", "lookup.lua", false},
+		{"absolute", path, false},
+		{"missing", "missing.lua", true},
+		{"directory", dir, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			built, err := (&DNSConfig{Script: tc.script}).Build()
+			if tc.wantError {
+				if err == nil {
+					t.Fatal("Build accepted an invalid script path")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if built.Script != path {
+				t.Fatalf("script path = %q, want %q", built.Script, path)
+			}
+		})
+	}
+
 	var parsed DNSConfig
 	if err := json.Unmarshal([]byte(`{"servers":[{"id":"primary","address":"1.1.1.1"}]}`), &parsed); err != nil {
 		t.Fatal(err)
@@ -137,43 +172,3 @@ func TestDNSNameServerID(t *testing.T) {
 		t.Fatalf("nameserver IDs = %v, want primary", built.NameServer)
 	}
 }
-
-func TestDNSScriptConfig(t *testing.T) {
-	for _, test := range []struct {
-		name      string
-		input     string
-		wantError string
-	}{
-		{name: "script only", input: `{"script":"script.lua"}`},
-		{name: "compatible fields", input: `{"script":"script.lua","servers":["1.1.1.1",{"id":"primary","address":"8.8.8.8","expectedIPs":["8.8.8.8"],"queryStrategy":"UseIPv4","disableCache":true}],"hosts":{"example.com":"127.0.0.1"},"disableCache":true}`},
-		{name: "disabled options", input: `{"script":"script.lua","disableFallback":false,"disableFallbackIfMatch":false,"enableParallelQuery":false,"servers":[{"address":"1.1.1.1","domains":[],"skipFallback":false,"finalQuery":false}]}`},
-		{name: "domains", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","domains":["domain:example.com"]}]}`, wantError: "domains"},
-		{name: "skip fallback", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","skipFallback":true}]}`, wantError: "skipFallback"},
-		{name: "final query", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","finalQuery":true}]}`, wantError: "finalQuery"},
-		{name: "later server", input: `{"script":"script.lua","servers":["1.1.1.1",{"address":"8.8.8.8","finalQuery":true}]}`, wantError: "server 1"},
-		{name: "disable fallback", input: `{"script":"script.lua","disableFallback":true}`, wantError: "disableFallback"},
-		{name: "disable fallback if match", input: `{"script":"script.lua","disableFallbackIfMatch":true}`, wantError: "disableFallbackIfMatch"},
-		{name: "parallel query", input: `{"script":"script.lua","enableParallelQuery":true}`, wantError: "enableParallelQuery"},
-		{name: "empty script", input: `{"script":"","disableFallback":true,"disableFallbackIfMatch":true,"enableParallelQuery":true,"servers":[{"address":"1.1.1.1","domains":["example.com"],"skipFallback":true,"finalQuery":true}]}`},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var config DNSConfig
-			if err := json.Unmarshal([]byte(test.input), &config); err != nil {
-				t.Fatal(err)
-			}
-			built, err := config.Build()
-			if test.wantError != "" {
-				if built != nil || err == nil || !strings.Contains(err.Error(), "DNS script cannot be used with ") || !strings.Contains(err.Error(), test.wantError) {
-					t.Fatalf("Build() = %v, %v; want nil config and script conflict error mentioning %s", built, err, test.wantError)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if built.Script != config.Script || len(built.NameServer) != len(config.Servers) {
-				t.Fatalf("Build() did not preserve script or servers: %v", built)
-			}
-		})
-	}
-}

infra/conf/freedom.go

@@ -91,7 +91,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Fragment != nil {
-		errors.PrintDeprecatedFeatureWarning(`"fragment" in Freedom`, `"fragment" in "streamSettings.finalmask.tcp"`)
 		config.Fragment = new(freedom.Fragment)
 
 		switch strings.ToLower(c.Fragment.Packets) {
@@ -148,7 +147,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Noises != nil {
-		errors.PrintDeprecatedFeatureWarning(`"noises" in Freedom`, `"noise" in "streamSettings.finalmask.udp"`)
 		for _, n := range c.Noises {
 			NConfig, err := ParseNoise(n)
 			if err != nil {

infra/conf/geodata.go

@@ -6,6 +6,7 @@ import (
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/app/geodata"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -18,6 +19,9 @@ func (c *GeodataAssetConfig) Build() (*geodata.Asset, error) {
 	if err := validateHTTPS(c.URL); err != nil {
 		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
 	}
+	if _, err := filesystem.StatAsset(c.File); err != nil {
+		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
+	}
 	return &geodata.Asset{
 		Url:  c.URL,
 		File: c.File,

infra/conf/geodata_test.go

@@ -1,6 +1,7 @@
 package conf_test
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/xtls/xray-core/app/geodata"
@@ -8,6 +9,8 @@ import (
 )
 
 func TestGeodataConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	creator := func() Buildable {
 		return new(GeodataConfig)
 	}
@@ -35,7 +38,27 @@ func TestGeodataConfig(t *testing.T) {
 	})
 }
 
+func TestGeodataAssetConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "geoip.dat",
+	}).Build(); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "missing.dat",
+	}).Build(); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
 func TestGeodataAssetConfigInvalidURL(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	for _, rawURL := range []string{
 		"",
 		"http://example.com/geoip.dat",

infra/conf/masque_test.go

@@ -16,61 +16,8 @@ import (
 	. "github.com/xtls/xray-core/infra/conf"
 	masqueproxy "github.com/xtls/xray-core/proxy/masque"
 	"github.com/xtls/xray-core/transport/internet/masque"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
 )
 
-func defaultMasqueXmux() *splithttp.XmuxConfig {
-	return &splithttp.XmuxConfig{
-		MaxConcurrency:   &splithttp.RangeConfig{},
-		MaxConnections:   &splithttp.RangeConfig{From: 1, To: 1},
-		CMaxReuseTimes:   &splithttp.RangeConfig{},
-		HMaxRequestTimes: &splithttp.RangeConfig{},
-		HMaxReusableSecs: &splithttp.RangeConfig{From: 1800, To: 3000},
-	}
-}
-
-func TestMasqueXmuxConfig(t *testing.T) {
-	creator := func() Buildable {
-		return new(MasqueConfig)
-	}
-
-	runMultiTestCase(t, []TestCase{
-		{
-			Input:  `{"xmux": {"maxConnections": "2-4", "hMaxReusableSecs": 60, "hKeepAlivePeriod": -1}}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{
-				Path: "/.well-known/masque/ip/*/*/",
-				Xmux: &splithttp.XmuxConfig{
-					MaxConcurrency:   &splithttp.RangeConfig{},
-					MaxConnections:   &splithttp.RangeConfig{From: 2, To: 4},
-					CMaxReuseTimes:   &splithttp.RangeConfig{},
-					HMaxRequestTimes: &splithttp.RangeConfig{},
-					HMaxReusableSecs: &splithttp.RangeConfig{From: 60, To: 60},
-					HKeepAlivePeriod: -1,
-				},
-			},
-		},
-		{
-			Input:  `{"xmux": {"maxConcurrency": 8}}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{
-				Path: "/.well-known/masque/ip/*/*/",
-				Xmux: &splithttp.XmuxConfig{
-					MaxConcurrency:   &splithttp.RangeConfig{From: 8, To: 8},
-					MaxConnections:   &splithttp.RangeConfig{},
-					CMaxReuseTimes:   &splithttp.RangeConfig{},
-					HMaxRequestTimes: &splithttp.RangeConfig{},
-					HMaxReusableSecs: &splithttp.RangeConfig{},
-				},
-			},
-		},
-	})
-
-	if _, err := loadJSON(creator)(`{"xmux": {"maxConnections": 2, "maxConcurrency": 8}}`); err == nil {
-		t.Error("expected an error for maxConnections with maxConcurrency")
-	}
-}
-
 func TestMasqueConfig(t *testing.T) {
 	creator := func() Buildable {
 		return new(MasqueConfig)
@@ -80,7 +27,7 @@ func TestMasqueConfig(t *testing.T) {
 		{
 			Input:  `{}`,
 			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/.well-known/masque/ip/*/*/", Xmux: defaultMasqueXmux()},
+			Output: &masque.Config{Path: "/.well-known/masque/ip/*/*/"},
 		},
 		{
 			Input: `{
@@ -93,13 +40,12 @@ func TestMasqueConfig(t *testing.T) {
 				Host:    "example.com:8443",
 				Path:    "/.well-known/masque/ip/*/*/",
 				Headers: map[string]string{"Authorization": "Basic dTpw"},
-				Xmux:    defaultMasqueXmux(),
 			},
 		},
 		{
 			Input:  `{"path": "/masque/ip{?target,ipproto}"}`,
 			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/masque/ip?target=*&ipproto=*", Xmux: defaultMasqueXmux()},
+			Output: &masque.Config{Path: "/masque/ip?target=*&ipproto=*"},
 		},
 		{
 			Input:  `{"user": "u", "pass": "p:q", "headers": {"X-Token": "a"}}`,
@@ -107,7 +53,6 @@ func TestMasqueConfig(t *testing.T) {
 			Output: &masque.Config{
 				Path:    "/.well-known/masque/ip/*/*/",
 				Headers: map[string]string{"Authorization": "Basic dTpwOnE=", "X-Token": "a"},
-				Xmux:    defaultMasqueXmux(),
 			},
 		},
 	})
@@ -177,7 +122,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 					Host: "cloudflareaccess.com",
 					Path: "/",
 					Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: address},
-					Xmux: defaultMasqueXmux(),
 				},
 			},
 		})
@@ -190,7 +134,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 				Host: "example.com",
 				Path: "/warp",
 				Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: address},
-				Xmux: defaultMasqueXmux(),
 			},
 		},
 	})
@@ -221,7 +164,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 				Host: "cloudflareaccess.com",
 				Path: "/",
 				Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: []string{"172.16.0.2/32"}},
-				Xmux: defaultMasqueXmux(),
 			},
 		},
 	})
@@ -257,17 +199,18 @@ func TestMasqueOutboundConfig(t *testing.T) {
 		return err
 	}
 
-	for _, input := range []string{
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": false, "concurrency": -1}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true, "concurrency": -1, "xudpConcurrency": 8}}`,
-	} {
-		if err := build(input); err != nil {
-			t.Errorf("%s: %v", input, err)
-		}
+	if err := build(`{
+		"protocol": "masque",
+		"settings": {"address": "example.com", "port": 443},
+		"streamSettings": {"network": "masque", "security": "tls"},
+		"mux": {"enabled": false, "concurrency": -1}
+	}`); err != nil {
+		t.Error(err)
 	}
 	for _, input := range []string{
 		`{"protocol": "masque", "settings": {"address": "example.com"}, "streamSettings": {"network": "masque", "security": "tls"}}`,
+		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true}}`,
+		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true, "concurrency": -1}}`,
 		`{"protocol": "freedom", "streamSettings": {"network": "masque", "security": "tls"}}`,
 	} {
 		if err := build(input); err == nil {

infra/conf/router.go

@@ -7,6 +7,7 @@ import (
 	"github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
+	"github.com/xtls/xray-core/common/platform"
 	"github.com/xtls/xray-core/common/serial"
 
 	"google.golang.org/protobuf/proto"
@@ -94,10 +95,13 @@ func (c *RouterConfig) getDomainStrategy() router.Config_DomainStrategy {
 func (c *RouterConfig) Build() (*router.Config, error) {
 	config := new(router.Config)
 
-	if c.Script != "" && (c.DomainStrategy != nil || len(c.RuleList) > 0) {
-		return nil, errors.New("routing script cannot be used with domainStrategy or rules")
+	if c.Script != "" {
+		path, err := platform.ResolveLuaFile(c.Script)
+		if err != nil {
+			return nil, errors.New("failed to resolve routing script").Base(err)
+		}
+		config.Script = path
 	}
-	config.Script = c.Script
 
 	config.DomainStrategy = c.getDomainStrategy()
 

infra/conf/router_test.go

@@ -2,7 +2,8 @@ package conf_test
 
 import (
 	"encoding/json"
-	"strings"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 	_ "unsafe"
@@ -239,37 +240,36 @@ func TestRouterConfig(t *testing.T) {
 }
 
 func TestRouterScriptConfig(t *testing.T) {
-	for _, test := range []struct {
+	dir := t.TempDir()
+	t.Setenv("xray.location.confdir", dir)
+	path := filepath.Join(dir, "route.lua")
+	if err := os.WriteFile(path, []byte("function HandleRoute() end"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
 		name      string
-		input     string
+		script    string
 		wantError bool
 	}{
-		{name: "script only", input: `{"script":"missing.lua"}`},
-		{name: "empty rules", input: `{"script":"missing.lua","rules":[]}`},
-		{name: "balancers", input: `{"script":"missing.lua","balancers":[{"tag":"b1","selector":["direct"]}]}`},
-		{name: "default domain strategy", input: `{"script":"missing.lua","domainStrategy":"AsIs"}`, wantError: true},
-		{name: "IP domain strategy", input: `{"script":"missing.lua","domainStrategy":"IPIfNonMatch"}`, wantError: true},
-		{name: "empty domain strategy", input: `{"script":"missing.lua","domainStrategy":""}`, wantError: true},
-		{name: "rules", input: `{"script":"missing.lua","rules":[{"outboundTag":"direct","domain":["example.com"]}]}`, wantError: true},
-		{name: "empty script", input: `{"script":"","domainStrategy":"IPOnDemand","rules":[{"outboundTag":"direct","domain":["example.com"]}]}`},
+		{"relative", "route.lua", false},
+		{"absolute", path, false},
+		{"missing", "missing.lua", true},
+		{"directory", dir, true},
 	} {
-		t.Run(test.name, func(t *testing.T) {
-			var config RouterConfig
-			if err := json.Unmarshal([]byte(test.input), &config); err != nil {
-				t.Fatal(err)
-			}
-			built, err := config.Build()
-			if test.wantError {
-				if built != nil || err == nil || !strings.Contains(err.Error(), "routing script cannot be used with domainStrategy or rules") {
-					t.Fatalf("Build() = %v, %v; want nil config and script conflict error", built, err)
+		t.Run(tc.name, func(t *testing.T) {
+			built, err := (&RouterConfig{Script: tc.script}).Build()
+			if tc.wantError {
+				if err == nil {
+					t.Fatal("Build accepted invalid script path")
 				}
 				return
 			}
 			if err != nil {
 				t.Fatal(err)
 			}
-			if built.Script != config.Script || len(built.Rule) != len(config.RuleList) || len(built.BalancingRule) != len(config.Balancers) {
-				t.Fatalf("Build() did not preserve script, rules or balancers: %v", built)
+			if built.Script != path {
+				t.Fatalf("script path = %q, want %q", built.Script, path)
 			}
 		})
 	}

infra/conf/transport_finalmask.go

@@ -9,17 +9,12 @@ import (
 	"fmt"
 	"net/netip"
 	"net/url"
-	"os"
 	"regexp"
 	"strings"
 
 	googleuuid "github.com/google/uuid"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/geodata"
-	xlua "github.com/xtls/xray-core/common/lua"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/finalmask/filter"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/aes128gcm"
@@ -33,7 +28,6 @@ import (
 	"github.com/xtls/xray-core/transport/internet/finalmask/xdns"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xicmp"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
-	"github.com/xtls/xray-core/transport/internet/hysteria/congestion/bbr"
 	"github.com/xtls/xray-core/transport/internet/tls"
 	"google.golang.org/protobuf/proto"
 )
@@ -76,7 +70,6 @@ var (
 	customVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
 
 	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
@@ -84,7 +77,6 @@ var (
 	}, "type", "settings")
 
 	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomUDP) },
 		"mkcp-legacy":   func() interface{} { return new(MkcpLegacy) },
 		"noise":         func() interface{} { return new(NoiseMask) },
@@ -97,23 +89,6 @@ var (
 	}, "type", "settings")
 )
 
-type Filter struct {
-	BlockedSourceIPs []string `json:"blockedSourceIPs"`
-	AllowedSourceIPs []string `json:"allowedSourceIPs"`
-}
-
-func (c *Filter) Build() (proto.Message, error) {
-	rules, err := geodata.ParseIPRules(c.BlockedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "blockedSourceIPs"`).Base(err)
-	}
-	allowed, err := geodata.ParseIPRules(c.AllowedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "allowedSourceIPs"`).Base(err)
-	}
-	return &filter.Config{BlockedSourceIps: rules, AllowedSourceIps: allowed}, nil
-}
-
 type TCPItem struct {
 	Delay     Int32Range       `json:"delay"`
 	Rand      int32            `json:"rand"`
@@ -329,26 +304,11 @@ type NoiseItem struct {
 }
 
 type NoiseMask struct {
-	Reset  Int32Range  `json:"reset"`
-	Noise  []NoiseItem `json:"noise"`
-	Script string      `json:"script"`
+	Reset Int32Range  `json:"reset"`
+	Noise []NoiseItem `json:"noise"`
 }
 
 func (c *NoiseMask) Build() (proto.Message, error) {
-	if c.Script != "" {
-		if len(c.Noise) > 0 {
-			return nil, errors.New(`"script" and "noise" can't be used together`)
-		}
-		if _, err := xlua.Compile(c.Script); err != nil {
-			return nil, errors.New("failed to compile the noise script").Base(err)
-		}
-		return &noise.Config{
-			ResetMin: int64(c.Reset.From),
-			ResetMax: int64(c.Reset.To),
-			Script:   c.Script,
-		}, nil
-	}
-
 	noiseSlice := make([]*noise.Item, 0, len(c.Noise))
 	for _, item := range c.Noise {
 		if len(item.Packet) > 0 && item.Rand.To > 0 {
@@ -839,10 +799,7 @@ type XDNSDomain struct {
 }
 
 type XDNSResolver struct {
-	Addrs      []string          `json:"addrs"`
-	Worker     int32             `json:"worker"`
-	TlsConfig  *TLSConfig        `json:"tlsConfig"`
-	QuicConfig *QuicParamsConfig `json:"quicConfig"`
+	Addrs []string `json:"addrs"`
 }
 
 type XDNS struct {
@@ -877,26 +834,6 @@ func (c *XDNS) Build() (proto.Message, error) {
 		}
 	}
 	for i := range c.Resolvers {
-		worker := c.Resolvers[i].Worker
-		if worker == 0 {
-			worker = 32
-		}
-		var tlsConfig *tls.Config
-		var quicConfig *internet.QuicParams
-		if c.Resolvers[i].TlsConfig != nil {
-			proto, err := c.Resolvers[i].TlsConfig.Build()
-			if err != nil {
-				return nil, err
-			}
-			tlsConfig = proto.(*tls.Config)
-		}
-		if c.Resolvers[i].QuicConfig != nil {
-			proto, err := c.Resolvers[i].QuicConfig.Build()
-			if err != nil {
-				return nil, err
-			}
-			quicConfig = proto.(*internet.QuicParams)
-		}
 		for j := range c.Resolvers[i].Addrs {
 			var u *url.URL
 			var e error
@@ -908,21 +845,18 @@ func (c *XDNS) Build() (proto.Message, error) {
 			if e != nil {
 				return nil, e
 			}
-			var addr string
 			switch u.Scheme {
 			case "tcp", "udp":
-				host := u.Hostname()
-				port := u.Port()
-				if port == "" {
-					port = "53"
-				}
-				addr = net.JoinHostPort(host, port)
-			case "https":
-				addr = u.String()
 			default:
 				return nil, errors.New("invalid protocol")
 			}
-			resolvers = append(resolvers, &xdns.ResolverProto{Type: u.Scheme, Addr: addr, Worker: worker, TlsConfig: tlsConfig, QuicConfig: quicConfig})
+			var host, port string
+			host = u.Hostname()
+			port = u.Port()
+			if port == "" {
+				port = "53"
+			}
+			resolvers = append(resolvers, &xdns.ResolverProto{Type: u.Scheme, Addr: net.JoinHostPort(host, port)})
 		}
 	}
 	if c.ExtraPoll < 0 || c.ExtraPoll > 3 {
@@ -1215,91 +1149,6 @@ type QuicParamsConfig struct {
 	DisableStatelessReset         bool      `json:"disableStatelessReset"`
 }
 
-func (config *QuicParamsConfig) Build() (proto.Message, error) {
-	profile := strings.ToLower(config.BbrProfile)
-	switch profile {
-	case "", string(bbr.ProfileConservative), string(bbr.ProfileStandard), string(bbr.ProfileAggressive):
-		if profile == "" {
-			profile = string(bbr.ProfileStandard)
-		}
-	default:
-		return nil, errors.New("unknown bbr profile")
-	}
-
-	up, err := config.BrutalUp.Bps()
-	if err != nil {
-		return nil, err
-	}
-	down, err := config.BrutalDown.Bps()
-	if err != nil {
-		return nil, err
-	}
-
-	if up > 0 && up < 65536 {
-		return nil, errors.New("BrutalUp must be at least 65536 bytes per second")
-	}
-	if down > 0 && down < 65536 {
-		return nil, errors.New("BrutalDown must be at least 65536 bytes per second")
-	}
-
-	config.Congestion = strings.ToLower(config.Congestion)
-	switch config.Congestion {
-	case "", "brutal", "reno", "bbr":
-	case "force-brutal":
-		if up == 0 {
-			return nil, errors.New("force-brutal requires up")
-		}
-	default:
-		return nil, errors.New("unknown congestion control: ", config.Congestion, ", valid values: reno, bbr, brutal, force-brutal")
-	}
-
-	if config.InitStreamReceiveWindow > 0 && config.InitStreamReceiveWindow < 16384 {
-		return nil, errors.New("InitStreamReceiveWindow must be at least 16384")
-	}
-	if config.MaxStreamReceiveWindow > 0 && config.MaxStreamReceiveWindow < 16384 {
-		return nil, errors.New("MaxStreamReceiveWindow must be at least 16384")
-	}
-	if config.InitConnectionReceiveWindow > 0 && config.InitConnectionReceiveWindow < 16384 {
-		return nil, errors.New("InitConnectionReceiveWindow must be at least 16384")
-	}
-	if config.MaxConnectionReceiveWindow > 0 && config.MaxConnectionReceiveWindow < 16384 {
-		return nil, errors.New("MaxConnectionReceiveWindow must be at least 16384")
-	}
-	if config.MaxIdleTimeout != 0 && (config.MaxIdleTimeout < 4 || config.MaxIdleTimeout > 120) {
-		return nil, errors.New("MaxIdleTimeout must be between 4 and 120")
-	}
-	if config.KeepAlivePeriod != 0 && (config.KeepAlivePeriod < 2 || config.KeepAlivePeriod > 60) {
-		return nil, errors.New("KeepAlivePeriod must be between 2 and 60")
-	}
-	if config.MaxIncomingStreams != 0 && config.MaxIncomingStreams < 8 {
-		return nil, errors.New("MaxIncomingStreams must be at least 8")
-	}
-
-	if config.Debug {
-		os.Setenv("HYSTERIA_BBR_DEBUG", "true")
-		os.Setenv("HYSTERIA_BRUTAL_DEBUG", "true")
-	}
-
-	return &internet.QuicParams{
-		Congestion:                    config.Congestion,
-		BbrProfile:                    profile,
-		BrutalUp:                      up,
-		BrutalDown:                    down,
-		BrutalDisableLossCompensation: config.BrutalDisableLossCompensation,
-		InitStreamReceiveWindow:       config.InitStreamReceiveWindow,
-		MaxStreamReceiveWindow:        config.MaxStreamReceiveWindow,
-		InitConnReceiveWindow:         config.InitConnectionReceiveWindow,
-		MaxConnReceiveWindow:          config.MaxConnectionReceiveWindow,
-		MaxIdleTimeout:                config.MaxIdleTimeout,
-		KeepAlivePeriod:               config.KeepAlivePeriod,
-		DisablePathMtuDiscovery:       config.DisablePathMTUDiscovery,
-		DisableChromeParrot:           config.DisableChromeParrot,
-		DisableGSO:                    config.DisableGSO,
-		MaxIncomingStreams:            config.MaxIncomingStreams,
-		DisableStatelessReset:         config.DisableStatelessReset,
-	}, nil
-}
-
 type FinalMask struct {
 	Tcp        []Mask            `json:"tcp"`
 	Udp        []Mask            `json:"udp"`

infra/conf/transport_finalmask_filter_test.go

@@ -1,79 +0,0 @@
-package conf_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"net"
-	"strings"
-	"testing"
-
-	"github.com/xtls/xray-core/common/geodata"
-	. "github.com/xtls/xray-core/infra/conf"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/finalmask/filter"
-)
-
-func TestFinalMaskFilter(t *testing.T) {
-	for _, network := range []string{"tcp", "udp"} {
-		for _, test := range []struct {
-			name, settings   string
-			blocked, allowed int
-		}{
-			{"blacklist", `{"blockedSourceIPs":["192.0.2.0/24"]}`, 1, 0},
-			{"whitelist", `{"allowedSourceIPs":["192.0.2.0/24"]}`, 0, 1},
-			{"both", `{"blockedSourceIPs":["192.0.2.0/24"],"allowedSourceIPs":["192.0.2.0/24"]}`, 1, 1},
-			{"empty_whitelist", `{"allowedSourceIPs":[]}`, 0, 0},
-			{"empty_blacklist", `{"blockedSourceIPs":[]}`, 0, 0},
-		} {
-			t.Run(network+"/"+test.name, func(t *testing.T) {
-				input := fmt.Sprintf(`{"finalmask":{"%s":[{"type":"filter","settings":%s}]}}`, network, test.settings)
-				var config StreamConfig
-				if err := json.Unmarshal([]byte(input), &config); err != nil {
-					t.Fatal(err)
-				}
-				built, err := config.Build()
-				if err != nil {
-					t.Fatal(err)
-				}
-				masks := built.Tcpmasks
-				if network == "udp" {
-					masks = built.Udpmasks
-				}
-				if len(masks) != 1 {
-					t.Fatalf("expected one mask, got %d", len(masks))
-				}
-				instance, err := masks[0].GetInstance()
-				if err != nil {
-					t.Fatal(err)
-				}
-				filter, ok := instance.(*filter.Config)
-				if !ok {
-					t.Fatalf("unexpected mask type: %T", instance)
-				}
-				if len(filter.BlockedSourceIps) != test.blocked || len(filter.AllowedSourceIps) != test.allowed {
-					t.Fatalf("unexpected filter policy: %v", filter)
-				}
-				for _, rules := range [][]*geodata.IPRule{filter.BlockedSourceIps, filter.AllowedSourceIps} {
-					for _, rule := range rules {
-						cidr := rule.GetCustom().GetCidr()
-						if cidr.GetPrefix() != 24 || !net.IP(cidr.GetIp()).Equal(net.IPv4(192, 0, 2, 0)) {
-							t.Fatalf("unexpected IP rule: %v", cidr)
-						}
-					}
-				}
-				if _, err := internet.ToMemoryStreamConfig(built); err != nil {
-					t.Fatalf("failed to initialize runtime finalmask: %v", err)
-				}
-			})
-		}
-	}
-	for _, field := range []string{"blockedSourceIPs", "allowedSourceIPs"} {
-		var config Filter
-		if err := json.Unmarshal([]byte(fmt.Sprintf(`{"%s":["192.0.2.0/33"]}`, field)), &config); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), field) {
-			t.Errorf("expected invalid %s, got %v", field, err)
-		}
-	}
-}

infra/conf/transport_finalmask_noise_test.go

@@ -2,9 +2,6 @@ package conf
 
 import (
 	"encoding/json"
-	"os"
-	"path/filepath"
-	"strconv"
 	"testing"
 
 	"github.com/xtls/xray-core/transport/internet/finalmask/noise"
@@ -137,68 +134,3 @@ func TestNoiseExpFromJSON(t *testing.T) {
 		t.Errorf("item 3 = %+v", items[3])
 	}
 }
-
-const noiseScript = `function HandleNoise(plan, address) plan:Add("n") end
-`
-
-func writeNoiseScript(t *testing.T, script string) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "noise.lua")
-	if err := os.WriteFile(path, []byte(script), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	return path
-}
-
-func buildNoiseMask(t *testing.T, mask *NoiseMask) *noise.Config {
-	t.Helper()
-	msg, err := mask.Build()
-	if err != nil {
-		t.Fatal(err)
-	}
-	return msg.(*noise.Config)
-}
-
-func TestNoiseScriptFromFile(t *testing.T) {
-	path := writeNoiseScript(t, noiseScript)
-	cfg := buildNoiseMask(t, &NoiseMask{Script: path, Reset: Int32Range{From: 30, To: 60}})
-
-	if cfg.Script != path {
-		t.Errorf("got script %q, want the path", cfg.Script)
-	}
-	if len(cfg.Items) != 0 {
-		t.Errorf("got %d items, want none", len(cfg.Items))
-	}
-	if cfg.ResetMin != 30 || cfg.ResetMax != 60 {
-		t.Errorf("got reset %d-%d, want 30-60", cfg.ResetMin, cfg.ResetMax)
-	}
-}
-
-func TestNoiseScriptFromJSON(t *testing.T) {
-	path := writeNoiseScript(t, noiseScript)
-	input := `{"script": ` + strconv.Quote(path) + `, "reset": "30-60"}`
-	var mask NoiseMask
-	if err := json.Unmarshal([]byte(input), &mask); err != nil {
-		t.Fatal(err)
-	}
-	if cfg := buildNoiseMask(t, &mask); cfg.Script != path {
-		t.Errorf("got script %q, want the path", cfg.Script)
-	}
-}
-
-func TestNoiseScriptRejected(t *testing.T) {
-	path := writeNoiseScript(t, noiseScript)
-	invalid := writeNoiseScript(t, "function HandleNoise(")
-
-	for name, mask := range map[string]*NoiseMask{
-		"script with noise": {Script: path, Noise: []NoiseItem{{Rand: Int32Range{From: 10, To: 20}}}},
-		"missing file":      {Script: filepath.Join(t.TempDir(), "absent.lua")},
-		"not lua":           {Script: invalid},
-	} {
-		t.Run(name, func(t *testing.T) {
-			if _, err := mask.Build(); err == nil {
-				t.Error("expected an error")
-			}
-		})
-	}
-}

infra/conf/transport_internet.go

@@ -1,15 +1,13 @@
 package conf
 
 import (
-	"context"
-	"slices"
+	"os"
 	"strings"
 
-	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/tls"
+	"github.com/xtls/xray-core/transport/internet/hysteria/congestion/bbr"
 )
 
 type TransportProtocol string
@@ -90,7 +88,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		config.ProtocolName = protocol
 	}
 
-	var xdriveH3 bool
 	switch strings.ToLower(c.Security) {
 	case "", "none":
 	case "tls":
@@ -105,15 +102,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		tm := serial.ToTypedMessage(ts)
 		config.SecuritySettings = append(config.SecuritySettings, tm)
 		config.SecurityType = tm.Type
-		xdriveH3 = config.ProtocolName == "xdrive" && tlsSettings.ALPN != nil && slices.Equal(*tlsSettings.ALPN, StringList{"h3"})
-		if config.ProtocolName == "xdrive" && tlsSettings.ALPN != nil && slices.Equal(*tlsSettings.ALPN, StringList{"http/1.1"}) && tlsSettings.ECHConfigList == "" {
-			// a fingerprint puts its own ALPN into the hello, except Go TLS and the
-			// randomized ones, which take it from the config or send none
-			if fp := tls.GetFingerprint(strings.ToLower(tlsSettings.Fingerprint)); fp != nil && fp.Client != utls.HelloGolang.Client &&
-				!strings.HasPrefix(fp.Client, utls.HelloRandomized.Client) {
-				errors.LogWarning(context.Background(), `XDRIVE: "alpn" ["http/1.1"] reaches the wire only inside ECH, without "echConfigList" the hello carries the ALPN of the fingerprint and the server may pick h2`)
-			}
-		}
 	case "reality":
 		if config.ProtocolName != "tcp" && config.ProtocolName != "splithttp" && config.ProtocolName != "grpc" {
 			return nil, errors.New("REALITY only supports RAW, XHTTP and gRPC for now.")
@@ -221,7 +209,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		})
 	}
 	if c.XDRIVESettings != nil {
-		c.XDRIVESettings.h3 = xdriveH3
 		xs, err := c.XDRIVESettings.Build()
 		if err != nil {
 			return nil, errors.New("Failed to build XDRIVE config.").Base(err)
@@ -241,40 +228,102 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 
 	if c.FinalMask != nil {
 		for _, mask := range c.FinalMask.Tcp {
-			proto, err := mask.Build(true)
+			u, err := mask.Build(true)
 			if err != nil {
 				return nil, errors.New("failed to build mask with type ", mask.Type).Base(err)
 			}
-			config.Tcpmasks = append(config.Tcpmasks, serial.ToTypedMessage(proto))
+			config.Tcpmasks = append(config.Tcpmasks, serial.ToTypedMessage(u))
 		}
 		for _, mask := range c.FinalMask.Udp {
-			proto, err := mask.Build(false)
+			u, err := mask.Build(false)
 			if err != nil {
 				return nil, errors.New("failed to build mask with type ", mask.Type).Base(err)
 			}
-			config.Udpmasks = append(config.Udpmasks, serial.ToTypedMessage(proto))
+			config.Udpmasks = append(config.Udpmasks, serial.ToTypedMessage(u))
 		}
 		if c.FinalMask.QuicParams != nil {
-			proto, err := c.FinalMask.QuicParams.Build()
+			profile := strings.ToLower(c.FinalMask.QuicParams.BbrProfile)
+			switch profile {
+			case "", string(bbr.ProfileConservative), string(bbr.ProfileStandard), string(bbr.ProfileAggressive):
+				if profile == "" {
+					profile = string(bbr.ProfileStandard)
+				}
+			default:
+				return nil, errors.New("unknown bbr profile")
+			}
+
+			up, err := c.FinalMask.QuicParams.BrutalUp.Bps()
 			if err != nil {
 				return nil, err
 			}
-			config.QuicParams = proto.(*internet.QuicParams)
-		}
-	}
-
-	if xdriveH3 && c.FinalMask != nil {
-		if c.XDRIVESettings != nil && c.XDRIVESettings.Service == "google-drive" {
-			// noise only sends datagrams of its own ahead of the QUIC ones, the
-			// other masks change those or need a peer that undoes them
-			for _, mask := range c.FinalMask.Udp {
-				if strings.ToLower(mask.Type) != "noise" {
-					return nil, errors.New(`XDRIVE: over h3 to Google Drive the only "udp" mask that works is "noise", not "`, mask.Type, `"`)
-				}
+			down, err := c.FinalMask.QuicParams.BrutalDown.Bps()
+			if err != nil {
+				return nil, err
+			}
+
+			if up > 0 && up < 65536 {
+				return nil, errors.New("BrutalUp must be at least 65536 bytes per second")
+			}
+			if down > 0 && down < 65536 {
+				return nil, errors.New("BrutalDown must be at least 65536 bytes per second")
+			}
+
+			c.FinalMask.QuicParams.Congestion = strings.ToLower(c.FinalMask.QuicParams.Congestion)
+			switch c.FinalMask.QuicParams.Congestion {
+			case "", "brutal", "reno", "bbr":
+			case "force-brutal":
+				if up == 0 {
+					return nil, errors.New("force-brutal requires up")
+				}
+			default:
+				return nil, errors.New("unknown congestion control: ", c.FinalMask.QuicParams.Congestion, ", valid values: reno, bbr, brutal, force-brutal")
+			}
+
+			if c.FinalMask.QuicParams.InitStreamReceiveWindow > 0 && c.FinalMask.QuicParams.InitStreamReceiveWindow < 16384 {
+				return nil, errors.New("InitStreamReceiveWindow must be at least 16384")
+			}
+			if c.FinalMask.QuicParams.MaxStreamReceiveWindow > 0 && c.FinalMask.QuicParams.MaxStreamReceiveWindow < 16384 {
+				return nil, errors.New("MaxStreamReceiveWindow must be at least 16384")
+			}
+			if c.FinalMask.QuicParams.InitConnectionReceiveWindow > 0 && c.FinalMask.QuicParams.InitConnectionReceiveWindow < 16384 {
+				return nil, errors.New("InitConnectionReceiveWindow must be at least 16384")
+			}
+			if c.FinalMask.QuicParams.MaxConnectionReceiveWindow > 0 && c.FinalMask.QuicParams.MaxConnectionReceiveWindow < 16384 {
+				return nil, errors.New("MaxConnectionReceiveWindow must be at least 16384")
+			}
+			if c.FinalMask.QuicParams.MaxIdleTimeout != 0 && (c.FinalMask.QuicParams.MaxIdleTimeout < 4 || c.FinalMask.QuicParams.MaxIdleTimeout > 120) {
+				return nil, errors.New("MaxIdleTimeout must be between 4 and 120")
+			}
+			if c.FinalMask.QuicParams.KeepAlivePeriod != 0 && (c.FinalMask.QuicParams.KeepAlivePeriod < 2 || c.FinalMask.QuicParams.KeepAlivePeriod > 60) {
+				return nil, errors.New("KeepAlivePeriod must be between 2 and 60")
+			}
+			if c.FinalMask.QuicParams.MaxIncomingStreams != 0 && c.FinalMask.QuicParams.MaxIncomingStreams < 8 {
+				return nil, errors.New("MaxIncomingStreams must be at least 8")
+			}
+
+			if c.FinalMask.QuicParams.Debug {
+				os.Setenv("HYSTERIA_BBR_DEBUG", "true")
+				os.Setenv("HYSTERIA_BRUTAL_DEBUG", "true")
+			}
+
+			config.QuicParams = &internet.QuicParams{
+				Congestion:                    c.FinalMask.QuicParams.Congestion,
+				BbrProfile:                    profile,
+				BrutalUp:                      up,
+				BrutalDown:                    down,
+				BrutalDisableLossCompensation: c.FinalMask.QuicParams.BrutalDisableLossCompensation,
+				InitStreamReceiveWindow:       c.FinalMask.QuicParams.InitStreamReceiveWindow,
+				MaxStreamReceiveWindow:        c.FinalMask.QuicParams.MaxStreamReceiveWindow,
+				InitConnReceiveWindow:         c.FinalMask.QuicParams.InitConnectionReceiveWindow,
+				MaxConnReceiveWindow:          c.FinalMask.QuicParams.MaxConnectionReceiveWindow,
+				MaxIdleTimeout:                c.FinalMask.QuicParams.MaxIdleTimeout,
+				KeepAlivePeriod:               c.FinalMask.QuicParams.KeepAlivePeriod,
+				DisablePathMtuDiscovery:       c.FinalMask.QuicParams.DisablePathMTUDiscovery,
+				DisableChromeParrot:           c.FinalMask.QuicParams.DisableChromeParrot,
+				DisableGSO:                    c.FinalMask.QuicParams.DisableGSO,
+				MaxIncomingStreams:            c.FinalMask.QuicParams.MaxIncomingStreams,
+				DisableStatelessReset:         c.FinalMask.QuicParams.DisableStatelessReset,
 			}
-		}
-		if config.QuicParams != nil && (config.QuicParams.Congestion == "brutal" || config.QuicParams.Congestion == "force-brutal") {
-			return nil, errors.New(`XDRIVE: brutal is for Hysteria servers, over h3 "congestion" is "bbr" or "reno", not "`, config.QuicParams.Congestion, `"`)
 		}
 	}
 

infra/conf/transport_method.go

@@ -808,7 +808,6 @@ type MasqueConfig struct {
 	Pass    string            `json:"pass"`
 	Headers map[string]string `json:"headers"`
 	Warp    *MasqueWarpConfig `json:"warp"`
-	Xmux    XmuxConfig        `json:"xmux"`
 }
 
 func (c *MasqueConfig) Build() (proto.Message, error) {
@@ -879,28 +878,11 @@ func (c *MasqueConfig) Build() (proto.Message, error) {
 		}
 		headers["Authorization"] = "Basic " + base64.StdEncoding.EncodeToString([]byte(c.User+":"+c.Pass))
 	}
-	if c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {
-		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
-	}
-	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConnections.From = 1
-		c.Xmux.MaxConnections.To = 1
-		c.Xmux.HMaxReusableSecs.From = 1800
-		c.Xmux.HMaxReusableSecs.To = 3000
-	}
 	return &masque.Config{
 		Host:    host,
 		Path:    path,
 		Headers: headers,
 		Warp:    warp,
-		Xmux: &splithttp.XmuxConfig{
-			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
-			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
-			CMaxReuseTimes:   newRangeConfig(c.Xmux.CMaxReuseTimes),
-			HMaxRequestTimes: newRangeConfig(c.Xmux.HMaxRequestTimes),
-			HMaxReusableSecs: newRangeConfig(c.Xmux.HMaxReusableSecs),
-			HKeepAlivePeriod: c.Xmux.HKeepAlivePeriod,
-		},
 	}, nil
 }
 
@@ -997,18 +979,6 @@ type XDriveConfig struct {
 	EagerWindowMs     uint32          `json:"eagerWindowMs"`
 	HoleTimeoutMs     uint32          `json:"holeTimeoutMs"`
 	Template          json.RawMessage `json:"template"`
-	S3                *XDriveS3Config `json:"s3"`
-	Xmux              XmuxConfig      `json:"xmux"`
-
-	// set by StreamConfig when "alpn" is ["h3"]
-	h3 bool
-}
-
-type XDriveS3Config struct {
-	Endpoint  string `json:"endpoint"`
-	Region    string `json:"region"`
-	Bucket    string `json:"bucket"`
-	PathStyle *bool  `json:"pathStyle"`
 }
 
 // Build implements Buildable.
@@ -1016,10 +986,6 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 	switch c.Service {
 	case "local":
 	case "Google Drive":
-		errors.PrintDeprecatedFeatureWarning(`"service": "Google Drive"`, `"service": "google-drive"`)
-		c.Service = "google-drive"
-		fallthrough
-	case "google-drive":
 		if len(c.Secrets) != 3 {
 			return nil, errors.New("Google Drive needs 3 secrets in order of ClientID, ClientSecret, RefreshToken")
 		}
@@ -1027,27 +993,8 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 		if len(c.Template) == 0 {
 			return nil, errors.New(`service "template" needs a "template" object`)
 		}
-	case "s3":
-		if c.S3 == nil {
-			return nil, errors.New(`service "s3" needs an "s3" object`)
-		}
 	default:
-		return nil, errors.New(`unknown "service": "`, c.Service, `", use "google-drive", "template", "s3" or "local"`)
-	}
-	if c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {
-		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
-	}
-	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConnections.From = 1
-		c.Xmux.MaxConnections.To = 1
-		if c.Service == "google-drive" && !c.h3 {
-			// Google gives an h2 connection 1 MiB of window, which a few sessions on
-			// a long rtt would share, an h3 connection has no such limit
-			c.Xmux.MaxConnections.From = 4
-			c.Xmux.MaxConnections.To = 4
-		}
-		c.Xmux.HMaxReusableSecs.From = 1800
-		c.Xmux.HMaxReusableSecs.To = 3000
+		return nil, errors.New("unsupported service")
 	}
 	config := &xdrive.Config{
 		RemoteFolder:      c.RemoteFolder,
@@ -1062,25 +1009,6 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 		EagerWindowMs:     c.EagerWindowMs,
 		HoleTimeoutMs:     c.HoleTimeoutMs,
 		Template:          string(c.Template),
-		Xmux: &splithttp.XmuxConfig{
-			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
-			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
-			CMaxReuseTimes:   newRangeConfig(c.Xmux.CMaxReuseTimes),
-			HMaxRequestTimes: newRangeConfig(c.Xmux.HMaxRequestTimes),
-			HMaxReusableSecs: newRangeConfig(c.Xmux.HMaxReusableSecs),
-			HKeepAlivePeriod: c.Xmux.HKeepAlivePeriod,
-		},
-	}
-	if c.Service == "s3" {
-		config.S3 = &xdrive.S3Config{
-			Endpoint:  c.S3.Endpoint,
-			Region:    c.S3.Region,
-			Bucket:    c.S3.Bucket,
-			PathStyle: c.S3.PathStyle == nil || *c.S3.PathStyle,
-		}
-		if err := xdrive.ValidateS3Config(config); err != nil {
-			return nil, err
-		}
 	}
 	return config, nil
 }

infra/conf/transport_test.go

@@ -5,12 +5,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/xtls/xray-core/common/log"
 	. "github.com/xtls/xray-core/infra/conf"
 	"github.com/xtls/xray-core/transport/internet"
 	finalmaskcustom "github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
-	"github.com/xtls/xray-core/transport/internet/xdrive"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -324,25 +321,8 @@ func TestXDriveRejectsUnknownService(t *testing.T) {
 	if err := json.Unmarshal([]byte(`{"remoteFolder": "/tmp/xdrive", "service": "Dropbox"}`), config); err != nil {
 		t.Fatalf("Unmarshal: %v", err)
 	}
-	if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), `use "google-drive", "template", "s3" or "local"`) {
-		t.Fatalf("expected an unknown service error, got %v", err)
-	}
-}
-
-func TestXDriveGoogleDriveName(t *testing.T) {
-	for _, service := range []string{"google-drive", "Google Drive"} {
-		config := &XDriveConfig{RemoteFolder: "folder-id", Service: service, Secrets: []string{"a", "b", "c"}}
-		built, err := config.Build()
-		if err != nil {
-			t.Fatalf("%s: %v", service, err)
-		}
-		if got := built.(*xdrive.Config).Service; got != "google-drive" {
-			t.Errorf("%s: service is %q, want google-drive", service, got)
-		}
-		config = &XDriveConfig{RemoteFolder: "folder-id", Service: service, Secrets: []string{"a", "b"}}
-		if _, err := config.Build(); err == nil {
-			t.Errorf("%s: accepted two secrets", service)
-		}
+	if _, err := config.Build(); err == nil {
+		t.Fatal("Build accepted an unsupported service")
 	}
 }
 
@@ -375,131 +355,6 @@ func TestXDriveTemplateStreamConfig(t *testing.T) {
 	}
 }
 
-type logLines []string
-
-func (l *logLines) Handle(msg log.Message) {
-	*l = append(*l, msg.String())
-}
-
-// "alpn" ["http/1.1"] is warned about where the hello does not carry it, which
-// is outside ECH with a fingerprint that has an ALPN of its own
-func TestXDriveHTTP1ALPNWarning(t *testing.T) {
-	var lines logLines
-	log.RegisterHandler(&lines)
-
-	for _, c := range []struct {
-		method, tlsSettings string
-		warn                bool
-	}{
-		{"xdrive", `{}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"]}`, true},
-		{"xdrive", `{"alpn": ["http/1.1"], "fingerprint": "Firefox"}`, true},
-		{"raw", `{"alpn": ["http/1.1"]}`, false},
-		{"xdrive", `{"alpn": ["h2", "http/1.1"]}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"], "echConfigList": "udp://1.1.1.1"}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"], "fingerprint": "unsafe"}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"], "fingerprint": "hellogolang"}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"], "fingerprint": "randomized"}`, false},
-		{"xdrive", `{"alpn": ["http/1.1"], "fingerprint": "hellorandomizednoalpn"}`, false},
-	} {
-		lines = nil
-		config := new(StreamConfig)
-		if err := json.Unmarshal([]byte(`{
-			"method": "`+c.method+`",
-			"security": "tls",
-			"tlsSettings": `+c.tlsSettings+`,
-			"xdriveSettings": {"remoteFolder": "/tmp/xdrive", "service": "local"}
-		}`), config); err != nil {
-			t.Fatalf("Unmarshal: %v", err)
-		}
-		if _, err := config.Build(); err != nil {
-			t.Fatalf("%s %s: %v", c.method, c.tlsSettings, err)
-		}
-		warned := false
-		for _, line := range lines {
-			warned = warned || strings.HasPrefix(line, "[Warning]") && strings.Contains(line, `"alpn"`)
-		}
-		if warned != c.warn {
-			t.Errorf("%s %s: warned %v, want %v", c.method, c.tlsSettings, warned, c.warn)
-		}
-	}
-}
-
-// over h3 Google Drive takes only the noise mask, and no service takes brutal
-func TestXDriveH3Checks(t *testing.T) {
-	const (
-		drive       = `"method": "xdrive", "xdriveSettings": {"remoteFolder": "f", "service": "google-drive", "secrets": ["a", "b", "c"]}`
-		local       = `"method": "xdrive", "xdriveSettings": {"remoteFolder": "/tmp/xdrive", "service": "local"}`
-		noise       = `{"type": "Noise", "settings": {"noise": [{"rand": "50-100"}]}}`
-		salamander  = `{"type": "salamander", "settings": {"password": "p"}}`
-		forceBrutal = `{"quicParams": {"congestion": "force-brutal", "brutalUp": "10 mbps"}}`
-	)
-	for _, c := range []struct {
-		alpn, transport, finalmask string
-		ok                         bool
-	}{
-		{`["h3"]`, drive, `{"udp": [` + noise + `]}`, true},
-		{`["h3"]`, drive, `{"udp": [` + salamander + `]}`, false},
-		{`["h3"]`, drive, `{"udp": [` + noise + `, ` + salamander + `]}`, false},
-		{`["h3"]`, local, `{"udp": [` + salamander + `]}`, true},
-		{`["h3"]`, `"method": "xdrive"`, `{"udp": [` + salamander + `]}`, true},
-		{`["h2"]`, drive, `{"udp": [` + salamander + `]}`, true},
-		{`null`, drive, `{"udp": [` + salamander + `]}`, true},
-		{`["h3"]`, drive, `null`, true},
-		{`["h3"]`, drive, `{"quicParams": {"congestion": "bbr"}}`, true},
-		{`["h3"]`, drive, `{"quicParams": {"congestion": "brutal"}}`, false},
-		{`["h3"]`, local, forceBrutal, false},
-		{`["h3", "h2"]`, drive, `{"quicParams": {"congestion": "brutal"}}`, true},
-		{`["h3"]`, `"method": "xhttp"`, forceBrutal, true},
-	} {
-		config := new(StreamConfig)
-		if err := json.Unmarshal([]byte(`{
-			`+c.transport+`,
-			"security": "tls",
-			"tlsSettings": {"alpn": `+c.alpn+`},
-			"finalmask": `+c.finalmask+`
-		}`), config); err != nil {
-			t.Fatalf("Unmarshal: %v", err)
-		}
-		if _, err := config.Build(); (err == nil) != c.ok {
-			t.Errorf("alpn %s, %s, finalmask %s: %v", c.alpn, c.transport, c.finalmask, err)
-		}
-	}
-}
-
-// one h3 connection is not held back by a window like h2, so h3 takes one by default
-func TestXDriveH3Connections(t *testing.T) {
-	for _, c := range []struct {
-		alpn string
-		want int32
-	}{
-		{`["h3"]`, 1},
-		{`["h2"]`, 4},
-		{`null`, 4},
-	} {
-		config := new(StreamConfig)
-		if err := json.Unmarshal([]byte(`{
-			"method": "xdrive",
-			"xdriveSettings": {"remoteFolder": "f", "service": "google-drive", "secrets": ["a", "b", "c"]},
-			"security": "tls",
-			"tlsSettings": {"alpn": `+c.alpn+`}
-		}`), config); err != nil {
-			t.Fatalf("Unmarshal: %v", err)
-		}
-		built, err := config.Build()
-		if err != nil {
-			t.Fatalf("alpn %s: %v", c.alpn, err)
-		}
-		xs, err := built.TransportSettings[0].Settings.GetInstance()
-		if err != nil {
-			t.Fatalf("alpn %s: %v", c.alpn, err)
-		}
-		if got := xs.(*xdrive.Config).Xmux.MaxConnections; got.From != c.want || got.To != c.want {
-			t.Errorf("alpn %s: maxConnections is %d-%d, want %d", c.alpn, got.From, got.To, c.want)
-		}
-	}
-}
-
 func TestXDriveTemplateNeedsTemplate(t *testing.T) {
 	config := new(XDriveConfig)
 	if err := json.Unmarshal([]byte(`{"remoteFolder": "f", "service": "template"}`), config); err != nil {
@@ -509,130 +364,3 @@ func TestXDriveTemplateNeedsTemplate(t *testing.T) {
 		t.Fatal("Build accepted a template service without a template")
 	}
 }
-
-const (
-	xdriveStream = `"streamSettings": {"network": "xdrive", "xdriveSettings": {"remoteFolder": "f", "service": "local"}}`
-	xdriveID     = `"id": "27848739-7e62-4138-9fd3-098a63964b6b"`
-	xdriveServer = `"address": "127.0.0.1", "port": 443, ` + xdriveID
-	xdriveEnc    = `"encryption": "mlkem768x25519plus.native.0rtt.XKbaq1BuzJKKKPxZbwgRpn-gYQbnhrYketgezASCL1I"`
-	xdriveDec    = `"decryption": "mlkem768x25519plus.native.600s.UKfUEMDdjlEnycTMBP0a08acky8vRRKSrM1MRnaYk3s"`
-)
-
-func TestXDriveOutboundConfig(t *testing.T) {
-	build := func(s string) error {
-		c := new(OutboundDetourConfig)
-		if err := json.Unmarshal([]byte(s), c); err != nil {
-			return err
-		}
-		_, err := c.Build()
-		return err
-	}
-
-	for _, input := range []string{
-		`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": true}}`,
-		`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": true, "concurrency": 0, "xudpConcurrency": 8, "xudpProxyUDP443": "allow"}}`,
-		`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `, "reverse": {"tag": "r"}}, ` + xdriveStream + `}`,
-		`{"protocol": "vless", "settings": {"vnext": [{"address": "127.0.0.1", "port": 443, "users": [{` + xdriveID + `, ` + xdriveEnc + `}]}]}, ` + xdriveStream + `, "mux": {"enabled": true}}`,
-	} {
-		if err := build(input); err != nil {
-			t.Errorf("%s: %v", input, err)
-		}
-	}
-	for _, c := range []struct{ input, err string }{
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, "encryption": "none"}, ` + xdriveStream + `, "mux": {"enabled": true}}`, `"encryption"`},
-		{`{"protocol": "vless", "settings": {"address": "example.com", "port": 443, ` + xdriveID + `, "encryption": "none"}, ` + xdriveStream + `, "mux": {"enabled": true}}`, `"encryption"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `}`, `"mux"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": false}}`, `"mux"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": true, "concurrency": -1}}`, `"mux"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": true, "xudpConcurrency": -1}}`, `"mux"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `}, ` + xdriveStream + `, "mux": {"enabled": true, "xudpProxyUDP443": "skip"}}`, `"mux"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `, "flow": "xtls-rprx-vision"}, ` + xdriveStream + `, "mux": {"enabled": true, "concurrency": -1}}`, `"flow"`},
-		{`{"protocol": "vless", "settings": {"vnext": [{"address": "127.0.0.1", "port": 443, "users": [{` + xdriveID + `, ` + xdriveEnc + `, "flow": "xtls-rprx-vision"}]}]}, ` + xdriveStream + `, "mux": {"enabled": true, "concurrency": -1}}`, `"flow"`},
-		{`{"protocol": "vless", "settings": {` + xdriveServer + `, ` + xdriveEnc + `, "testpre": 1}, ` + xdriveStream + `, "mux": {"enabled": true}}`, `"testpre"`},
-		{`{"protocol": "vmess", "settings": {` + xdriveServer + `}, ` + xdriveStream + `, "mux": {"enabled": true}}`, "VLESS"},
-		{`{"protocol": "trojan", "settings": {"address": "example.com", "port": 443, "password": "p"}, ` + xdriveStream + `, "mux": {"enabled": true}}`, "VLESS"},
-		{`{"protocol": "freedom", ` + xdriveStream + `}`, "VLESS"},
-	} {
-		if err := build(c.input); err == nil || !strings.Contains(err.Error(), "xdrive transport") || !strings.Contains(err.Error(), c.err) {
-			t.Errorf("expected an xdrive error about %s for %s, got %v", c.err, c.input, err)
-		}
-	}
-}
-
-func TestXDriveInboundConfig(t *testing.T) {
-	build := func(s string) error {
-		c := new(InboundDetourConfig)
-		if err := json.Unmarshal([]byte(s), c); err != nil {
-			return err
-		}
-		_, err := c.Build()
-		return err
-	}
-
-	for _, input := range []string{
-		`{"protocol": "vless", "port": 443, "settings": {"clients": [{` + xdriveID + `}], ` + xdriveDec + `}, ` + xdriveStream + `}`,
-		`{"protocol": "vless", "listen": "@xdrive", "settings": {"clients": [{` + xdriveID + `}], ` + xdriveDec + `}, ` + xdriveStream + `}`,
-	} {
-		if err := build(input); err != nil {
-			t.Errorf("%s: %v", input, err)
-		}
-	}
-	for _, c := range []struct{ input, err string }{
-		{`{"protocol": "vless", "port": 443, "settings": {"clients": [{` + xdriveID + `}], "decryption": "none"}, ` + xdriveStream + `}`, `"decryption"`},
-		{`{"protocol": "vless", "port": 443, "settings": {"clients": [{` + xdriveID + `}], ` + xdriveDec + `, "flow": "xtls-rprx-vision"}, ` + xdriveStream + `}`, `"flow"`},
-		{`{"protocol": "vless", "port": 443, "settings": {"clients": [{` + xdriveID + `, "flow": "xtls-rprx-vision"}], ` + xdriveDec + `}, ` + xdriveStream + `}`, `"flow"`},
-		{`{"protocol": "vmess", "port": 443, "settings": {"clients": [{` + xdriveID + `}]}, ` + xdriveStream + `}`, "VLESS"},
-		{`{"protocol": "vless", "port": "10800-10803", "settings": {"clients": [{` + xdriveID + `}], ` + xdriveDec + `}, ` + xdriveStream + `}`, "one port"},
-	} {
-		if err := build(c.input); err == nil || !strings.Contains(err.Error(), "xdrive transport") || !strings.Contains(err.Error(), c.err) {
-			t.Errorf("expected an xdrive error about %s for %s, got %v", c.err, c.input, err)
-		}
-	}
-}
-
-func TestXDriveXmux(t *testing.T) {
-	defaults := func(connections int32) *splithttp.XmuxConfig {
-		return &splithttp.XmuxConfig{
-			MaxConcurrency:   &splithttp.RangeConfig{},
-			MaxConnections:   &splithttp.RangeConfig{From: connections, To: connections},
-			CMaxReuseTimes:   &splithttp.RangeConfig{},
-			HMaxRequestTimes: &splithttp.RangeConfig{},
-			HMaxReusableSecs: &splithttp.RangeConfig{From: 1800, To: 3000},
-		}
-	}
-	for _, c := range []struct {
-		input string
-		want  *splithttp.XmuxConfig
-	}{
-		{`{"service": "google-drive", "secrets": ["a", "b", "c"]}`, defaults(4)},
-		{`{"service": "template", "template": {}}`, defaults(1)},
-		{`{"service": "google-drive", "secrets": ["a", "b", "c"], "xmux": {"maxConcurrency": "1-2", "hMaxRequestTimes": 100, "hKeepAlivePeriod": -1}}`, &splithttp.XmuxConfig{
-			MaxConcurrency:   &splithttp.RangeConfig{From: 1, To: 2},
-			MaxConnections:   &splithttp.RangeConfig{},
-			CMaxReuseTimes:   &splithttp.RangeConfig{},
-			HMaxRequestTimes: &splithttp.RangeConfig{From: 100, To: 100},
-			HMaxReusableSecs: &splithttp.RangeConfig{},
-			HKeepAlivePeriod: -1,
-		}},
-	} {
-		config := new(XDriveConfig)
-		if err := json.Unmarshal([]byte(c.input), config); err != nil {
-			t.Fatalf("%s: Unmarshal: %v", c.input, err)
-		}
-		built, err := config.Build()
-		if err != nil {
-			t.Fatalf("%s: Build: %v", c.input, err)
-		}
-		if got := built.(*xdrive.Config).Xmux; !proto.Equal(got, c.want) {
-			t.Errorf("%s: xmux is %v, want %v", c.input, got, c.want)
-		}
-	}
-
-	config := new(XDriveConfig)
-	if err := json.Unmarshal([]byte(`{"service": "template", "template": {}, "xmux": {"maxConnections": 2, "maxConcurrency": 8}}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-	if _, err := config.Build(); err == nil {
-		t.Error("Build accepted maxConnections with maxConcurrency")
-	}
-}

infra/conf/tun.go

@@ -59,7 +59,7 @@ func (v *TunConfig) Build() (proto.Message, error) {
 		if slices.Contains(config.AutoSystemWfpBlockLeak, "dns") && len(v.DNS) == 0 {
 			return nil, errors.New(`autoSystemWfpBlockLeak "dns" needs dns to be set`)
 		}
-	case "linux", "freebsd":
+	case "linux":
 		if v.AutoSystemDnsToGateway && len(v.Gateway) == 0 {
 			return nil, errors.New("autoSystemDnsToGateway needs gateway to be set")
 		}

infra/conf/tun_test.go

@@ -3,7 +3,6 @@ package conf_test
 import (
 	"encoding/json"
 	"runtime"
-	"slices"
 	"testing"
 
 	. "github.com/xtls/xray-core/infra/conf"
@@ -44,18 +43,18 @@ func TestTunConfigAutoSystem(t *testing.T) {
 func TestTunConfigAutoSystemNeeds(t *testing.T) {
 	for _, c := range []struct {
 		input string
-		goos  []string // where it is rejected
+		goos  string // where it is rejected
 	}{
-		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["misconfigtun"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["misconfigtun"]}`, nil},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemDnsToGateway": true}`, []string{"linux", "freebsd"}},
+		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["misconfigtun"]}`, "windows"},
+		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["misconfigtun"]}`, ""},
+		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns"]}`, "windows"},
+		{`{"name": "xray0", "autoSystemDnsToGateway": true}`, "linux"},
 	} {
 		config := new(TunConfig)
 		if err := json.Unmarshal([]byte(c.input), config); err != nil {
 			t.Fatal(err)
 		}
-		if _, err := config.Build(); (err != nil) != slices.Contains(c.goos, runtime.GOOS) {
+		if _, err := config.Build(); (err != nil) != (runtime.GOOS == c.goos) {
 			t.Errorf("%s on %s: error = %v", c.input, runtime.GOOS, err)
 		}
 	}

infra/conf/xray.go

@@ -17,11 +17,7 @@ import (
 	core "github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/proxy/freedom"
 	"github.com/xtls/xray-core/proxy/masque"
-	"github.com/xtls/xray-core/proxy/vless"
-	"github.com/xtls/xray-core/proxy/vless/inbound"
-	"github.com/xtls/xray-core/proxy/vless/outbound"
 	"github.com/xtls/xray-core/transport/internet"
-	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -213,9 +209,6 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 	if _, ok := ts.(*masque.ServerConfig); !ok && receiverSettings.StreamSettings != nil && receiverSettings.StreamSettings.ProtocolName == "masque" {
 		return nil, errors.New("the masque transport can only be used by the masque inbound")
 	}
-	if err := validateXDrive(ts, receiverSettings.StreamSettings, nil, receiverSettings.PortList); err != nil {
-		return nil, err
-	}
 
 	return &core.InboundHandlerConfig{
 		Tag:              c.Tag,
@@ -237,11 +230,10 @@ type OutboundDetourConfig struct {
 
 func requiresTransportSecurity(address *Address) bool {
 	if address == nil || address.Address == nil {
-		return true
+		return false
 	}
 	if address.Family().IsIP() {
-		ip := address.IP()
-		return !ip.IsPrivate() && !ip.IsLoopback() && !ip.IsLinkLocalUnicast()
+		return !geodata.GetPrivateIPMatcher().Match(address.IP())
 	}
 	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
 	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)
@@ -270,54 +262,6 @@ func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *pr
 	return nil
 }
 
-// validateXDrive allows only VLESS with encryption on xdrive, and on the client Mux.Cool for every connection
-func validateXDrive(ts proto.Message, ss *internet.StreamConfig, ms *proxyman.MultiplexingConfig, pl *net.PortList) error {
-	if ss == nil || ss.ProtocolName != "xdrive" {
-		return nil
-	}
-	switch c := ts.(type) {
-	case *outbound.Config:
-		a, err := c.Vnext.User.Account.GetInstance()
-		if err != nil {
-			return err
-		}
-		account := a.(*vless.Account)
-		if account.Flow != "" {
-			return errors.New(`the xdrive transport doesn't support VLESS "flow"`)
-		}
-		if account.Encryption == "none" {
-			return errors.New(`the xdrive transport needs VLESS "encryption", run "xray vlessenc" to get one`)
-		}
-		// reverse opens its own mux
-		if account.Reverse == nil && (ms == nil || !ms.Enabled || ms.Concurrency < 0 || ms.XudpConcurrency < 0 || ms.XudpProxyUDP443 == "skip") {
-			return errors.New(`the xdrive transport needs "mux" enabled, with no negative "concurrency" or "xudpConcurrency" and no "xudpProxyUDP443":"skip"`)
-		}
-		if account.Testpre != 0 {
-			return errors.New(`the xdrive transport doesn't support VLESS "testpre"`)
-		}
-	case *inbound.Config:
-		if c.Decryption == "none" {
-			return errors.New(`the xdrive transport needs VLESS "decryption", run "xray vlessenc" to get one`)
-		}
-		for _, user := range c.Users {
-			a, err := user.Account.GetInstance()
-			if err != nil {
-				return err
-			}
-			if a.(*vless.Account).Flow != "" {
-				return errors.New(`the xdrive transport doesn't support VLESS "flow"`)
-			}
-		}
-		// every port gets its own listener on the same folder, and each of them accepts the same session
-		if pl != nil && len(pl.Ports()) != 1 {
-			return errors.New("the xdrive transport can only listen on one port")
-		}
-	default:
-		return errors.New("the xdrive transport can only be used by VLESS")
-	}
-	return nil
-}
-
 // Build implements Buildable.
 func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	if c.ProxySettings != nil {
@@ -396,14 +340,15 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	if err != nil {
 		return nil, errors.New("failed to build outbound handler for protocol ", c.Protocol).Base(err)
 	}
-	if err := validateXDrive(ts, senderSettings.StreamSettings, senderSettings.MultiplexSettings, nil); err != nil {
-		return nil, err
-	}
 	if err := validateOutboundTransportSecurity(rawConfig, senderSettings); err != nil {
 		return nil, err
 	}
 
-	if _, ok := ts.(*masque.ClientConfig); !ok && senderSettings.StreamSettings != nil && senderSettings.StreamSettings.ProtocolName == "masque" {
+	if _, ok := ts.(*masque.ClientConfig); ok {
+		if ms := senderSettings.MultiplexSettings; ms != nil && ms.Enabled {
+			return nil, errors.New(`masque outbound does not support "mux"`)
+		}
+	} else if senderSettings.StreamSettings != nil && senderSettings.StreamSettings.ProtocolName == "masque" {
 		return nil, errors.New("the masque transport can only be used by the masque outbound")
 	}
 
@@ -609,6 +554,7 @@ func (c *Config) Build() (*core.Config, error) {
 	config := &core.Config{
 		App: []*serial.TypedMessage{
 			serial.ToTypedMessage(&dispatcher.Config{}),
+			serial.ToTypedMessage(&proxyman.InboundConfig{}),
 			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 		},
 	}
@@ -718,9 +664,6 @@ func (c *Config) Build() (*core.Config, error) {
 		config.App = append(config.App, serial.ToTypedMessage(r))
 	}
 
-	// Initialize the inbound module last to ensure inbound connections are handled correctly.
-	config.App = append(config.App, serial.ToTypedMessage(&proxyman.InboundConfig{}))
-
 	var inbounds []InboundDetourConfig
 
 	if len(c.InboundConfigs) > 0 {

infra/conf/xray_test.go

@@ -90,6 +90,7 @@ func TestXrayConfig(t *testing.T) {
 						AccessLogPath: "/var/log/xray/access.log",
 					}),
 					serial.ToTypedMessage(&dispatcher.Config{}),
+					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 					serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 					serial.ToTypedMessage(&router.Config{
 						DomainStrategy: router.Config_AsIs,
@@ -110,7 +111,6 @@ func TestXrayConfig(t *testing.T) {
 							},
 						},
 					}),
-					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 				},
 				Inbound: []*core.InboundHandlerConfig{
 					{

infra/vprotogen/main.go

@@ -1,87 +1,149 @@
 package main
 
 import (
-	"bytes"
-	"context"
+	"errors"
 	"flag"
 	"fmt"
-	"io/fs"
+	"go/build"
+	"io"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"runtime"
+	"strconv"
 	"strings"
-
-	"github.com/bufbuild/protocompile"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/reflect/protodesc"
-	"google.golang.org/protobuf/reflect/protoreflect"
-	"google.golang.org/protobuf/types/descriptorpb"
-	"google.golang.org/protobuf/types/pluginpb"
 )
 
-var (
-	directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
-	mode      = flag.String("mode", "generate", "Execution mode. 'generate' (default) compiles and saves changes. 'check' reports out-of-date files and exits with non-zero.")
-)
+var directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
 
-// topoSort sorts file descriptors so each dependency appears before files importing it.
-func topoSort(files []protoreflect.FileDescriptor) []*descriptorpb.FileDescriptorProto {
-	fileMap := make(map[string]protoreflect.FileDescriptor)
-	for _, f := range files {
-		fileMap[f.Path()] = f
-	}
-
-	visited := make(map[string]bool)
-	var sorted []*descriptorpb.FileDescriptorProto
-
-	var visit func(fd protoreflect.FileDescriptor)
-	visit = func(fd protoreflect.FileDescriptor) {
-		if visited[fd.Path()] {
-			return
+// envFile returns the name of the Go environment configuration file.
+// Copy from https://github.com/golang/go/blob/c4f2a9788a7be04daf931ac54382fbe2cb754938/src/cmd/go/internal/cfg/cfg.go#L150-L166
+func envFile() (string, error) {
+	if file := os.Getenv("GOENV"); file != "" {
+		if file == "off" {
+			return "", errors.New("GOENV=off")
 		}
-		visited[fd.Path()] = true
-
-		imports := fd.Imports()
-		for i := 0; i < imports.Len(); i++ {
-			if dep, ok := fileMap[imports.Get(i).Path()]; ok {
-				visit(dep)
-			}
-		}
-		sorted = append(sorted, protodesc.ToFileDescriptorProto(fd))
+		return file, nil
 	}
-
-	for _, f := range files {
-		visit(f)
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
 	}
-	return sorted
+	if dir == "" {
+		return "", errors.New("missing user-config dir")
+	}
+	return filepath.Join(dir, "go", "env"), nil
 }
 
-func runPlugin(pluginName, pwd string, req *pluginpb.CodeGeneratorRequest) (*pluginpb.CodeGeneratorResponse, error) {
-	reqBytes, err := proto.Marshal(req)
+// GetRuntimeEnv returns the value of runtime environment variable,
+// that is set by running following command: `go env -w key=value`.
+func GetRuntimeEnv(key string) (string, error) {
+	file, err := envFile()
 	if err != nil {
-		return nil, err
+		return "", err
 	}
+	if file == "" {
+		return "", errors.New("missing runtime env file")
+	}
+	var data []byte
+	var runtimeEnv string
+	data, readErr := os.ReadFile(file)
+	if readErr != nil {
+		return "", readErr
+	}
+	envStrings := strings.Split(string(data), "\n")
+	for _, envItem := range envStrings {
+		envItem = strings.TrimSuffix(envItem, "\r")
+		envKeyValue := strings.Split(envItem, "=")
+		if strings.EqualFold(strings.TrimSpace(envKeyValue[0]), key) {
+			runtimeEnv = strings.TrimSpace(envKeyValue[1])
+		}
+	}
+	return runtimeEnv, nil
+}
 
-	cmd := exec.Command("go", "tool", pluginName)
-	cmd.Dir = pwd
-	cmd.Stdin = bytes.NewReader(reqBytes)
-	cmd.Env = os.Environ()
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
+// GetGOBIN returns GOBIN environment variable as a string. It will NOT be empty.
+func GetGOBIN() string {
+	// The one set by user explicitly by `export GOBIN=/path` or `env GOBIN=/path command`
+	GOBIN := os.Getenv("GOBIN")
+	if GOBIN == "" {
+		var err error
+		// The one set by user by running `go env -w GOBIN=/path`
+		GOBIN, err = GetRuntimeEnv("GOBIN")
+		if err != nil {
+			// The default one that Golang uses
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		if GOBIN == "" {
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		return GOBIN
+	}
+	return GOBIN
+}
 
-	if err := cmd.Run(); err != nil {
-		return nil, fmt.Errorf("%v: %s", err, stderr.String())
-	}
+func whichProtoc(suffix, targetedVersion string) (string, error) {
+	protoc := "protoc" + suffix
 
-	var resp pluginpb.CodeGeneratorResponse
-	if err := proto.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal response: %w", err)
+	path, err := exec.LookPath(protoc)
+	if err != nil {
+		return "", fmt.Errorf(`
+Command "%s" not found.
+Make sure that %s is in your system path or current path.
+Download %s v%s or later from https://github.com/protocolbuffers/protobuf/releases
+`, protoc, protoc, protoc, targetedVersion)
 	}
-	if resp.GetError() != "" {
-		return nil, fmt.Errorf("%s", resp.GetError())
+	return path, nil
+}
+
+func getProjectProtocVersion(url string) (string, error) {
+	resp, err := http.Get(url)
+	if err != nil {
+		return "", errors.New("can not get the version of protobuf used in xray project")
 	}
-	return &resp, nil
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", errors.New("can not read from body")
+	}
+	versionRegexp := regexp.MustCompile(`\/\/\s*protoc\s*v\d+\.(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(body))
+	return matched[1], nil
+}
+
+func getInstalledProtocVersion(protocPath string) (string, error) {
+	cmd := exec.Command(protocPath, "--version")
+	cmd.Env = append(cmd.Env, os.Environ()...)
+	output, cmdErr := cmd.CombinedOutput()
+	if cmdErr != nil {
+		return "", cmdErr
+	}
+	versionRegexp := regexp.MustCompile(`protoc\s*(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(output))
+	return matched[1], nil
+}
+
+func parseVersion(s string, width int) int64 {
+	strList := strings.Split(s, ".")
+	format := fmt.Sprintf("%%s%%0%ds", width)
+	v := ""
+	for _, value := range strList {
+		v = fmt.Sprintf(format, v, value)
+	}
+	var result int64
+	var err error
+	if result, err = strconv.ParseInt(v, 10, 64); err != nil {
+		return 0
+	}
+	return result
+}
+
+func needToUpdate(targetedVersion, installedVersion string) bool {
+	vt := parseVersion(targetedVersion, 4)
+	vi := parseVersion(installedVersion, 4)
+	return vt > vi
 }
 
 func main() {
@@ -92,147 +154,106 @@ func main() {
 	flag.Parse()
 
 	if !filepath.IsAbs(*directory) {
-		pwd, err := os.Getwd()
-		if err != nil {
+		pwd, wdErr := os.Getwd()
+		if wdErr != nil {
 			fmt.Println("Can not get current working directory.")
 			os.Exit(1)
 		}
 		*directory = filepath.Join(pwd, *directory)
 	}
-	pwd := *directory
 
-	isCheck := false
-	switch *mode {
-	case "generate", "":
-		isCheck = false
-	case "check":
-		isCheck = true
-	default:
-		fmt.Fprintf(os.Stderr, "Unrecognized 'mode': %s. Use 'generate' or 'check'.\n", *mode)
+	pwd := *directory
+	GOBIN := GetGOBIN()
+	binPath := os.Getenv("PATH")
+	pathSlice := []string{pwd, GOBIN, binPath}
+	binPath = strings.Join(pathSlice, string(os.PathListSeparator))
+	os.Setenv("PATH", binPath)
+
+	suffix := ""
+	if runtime.GOOS == "windows" {
+		suffix = ".exe"
+	}
+
+	/*
+		targetedVersion, err := getProjectProtocVersion("https://raw.githubusercontent.com/XTLS/Xray-core/HEAD/core/config.pb.go")
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	*/
+	targetedVersion := ""
+
+	protoc, err := whichProtoc(suffix, targetedVersion)
+	if err != nil {
+		fmt.Println(err)
 		os.Exit(1)
 	}
 
-	if isCheck {
-		fmt.Println("Checking for out-of-date Protobuf generated files...")
+	installedVersion, err := getInstalledProtocVersion(protoc)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
 	}
 
-	var protoFiles []string
-	var pbCount int
-	err := filepath.WalkDir(pwd, func(path string, d fs.DirEntry, err error) error {
-		if err != nil || d.IsDir() {
+	if needToUpdate(targetedVersion, installedVersion) {
+		fmt.Printf(`
+You are using an old protobuf version, please update to v%s or later.
+Download it from https://github.com/protocolbuffers/protobuf/releases
+
+    * Protobuf version used in xray project: v%s
+    * Protobuf version you have installed: v%s
+
+`, targetedVersion, targetedVersion, installedVersion)
+		os.Exit(1)
+	}
+
+	protoFilesMap := make(map[string][]string)
+	walkErr := filepath.Walk(pwd, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			fmt.Println(err)
 			return err
 		}
-		if strings.HasSuffix(d.Name(), ".proto") {
-			rel, _ := filepath.Rel(pwd, path)
-			protoFiles = append(protoFiles, filepath.ToSlash(rel))
+
+		if info.IsDir() {
+			return nil
 		}
-		if strings.HasSuffix(d.Name(), ".pb.go") {
-			pbCount++
+
+		dir := filepath.Dir(path)
+		filename := filepath.Base(path)
+		if strings.HasSuffix(filename, ".proto") {
+			path = path[len(pwd)+1:]
+			protoFilesMap[dir] = append(protoFilesMap[dir], path)
 		}
+
 		return nil
 	})
-	if err != nil {
-		fmt.Println("Walk error:", err)
-		os.Exit(1)
-	}
-	if len(protoFiles) == 0 {
-		if isCheck && pbCount > 0 {
-			fmt.Fprintf(os.Stderr, "Found %d .pb.go files without any .proto files. Remove these orphaned files.\n", pbCount)
-			os.Exit(1)
-		}
-		return
-	}
-
-	compiler := protocompile.Compiler{
-		Resolver: protocompile.WithStandardImports(&protocompile.SourceResolver{
-			ImportPaths: []string{pwd},
-		}),
-		SourceInfoMode: protocompile.SourceInfoStandard,
-	}
-
-	linkedFiles, err := compiler.Compile(context.Background(), protoFiles...)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Protobuf compilation failed:\n%v\n", err)
+	if walkErr != nil {
+		fmt.Println(walkErr)
 		os.Exit(1)
 	}
 
-	var fdList []protoreflect.FileDescriptor
-	for _, f := range linkedFiles {
-		fdList = append(fdList, f)
-	}
-
-	req := &pluginpb.CodeGeneratorRequest{
-		FileToGenerate: protoFiles,
-		Parameter:      proto.String("paths=source_relative"),
-		ProtoFile:      topoSort(fdList),
-		// TODO: replace with unknown in the future
-		CompilerVersion: &pluginpb.Version{
-			Major: proto.Int32(6),
-			Minor: proto.Int32(33),
-			Patch: proto.Int32(5),
-		},
-	}
-
-	var diffCount int
-	generatedFiles := make(map[string]struct{})
-	for _, plugin := range []string{"protoc-gen-go", "protoc-gen-go-grpc"} {
-		resp, err := runPlugin(plugin, pwd, req)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s failed: %v\n", plugin, err)
-			os.Exit(1)
-		}
-
-		for _, f := range resp.File {
-			targetPath := filepath.Join(pwd, filepath.FromSlash(f.GetName()))
-			generatedFiles[targetPath] = struct{}{}
-			content := []byte(f.GetContent())
-
-			hasDiff := false
-			existing, err := os.ReadFile(targetPath)
-			if err != nil {
-				hasDiff = true
-			} else {
-				oldNorm := bytes.ReplaceAll(existing, []byte("\r\n"), []byte("\n"))
-				newNorm := bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
-				if !bytes.Equal(oldNorm, newNorm) {
-					hasDiff = true
-				}
+	for _, files := range protoFilesMap {
+		for _, relProtoFile := range files {
+			args := []string{
+				"--go_out", pwd,
+				"--go_opt", "paths=source_relative",
+				"--go-grpc_out", pwd,
+				"--go-grpc_opt", "paths=source_relative",
+				"--plugin", "protoc-gen-go=" + filepath.Join(GOBIN, "protoc-gen-go"+suffix),
+				"--plugin", "protoc-gen-go-grpc=" + filepath.Join(GOBIN, "protoc-gen-go-grpc"+suffix),
 			}
-
-			if hasDiff {
-				diffCount++
-				fmt.Println(targetPath)
-
-				if isCheck {
-					continue
-				}
-
-				if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
-					fmt.Fprintf(os.Stderr, "Error creating directory: %v\n", err)
-					os.Exit(1)
-				}
-				mode := os.FileMode(0o644)
-				if stat, err := os.Stat(targetPath); err == nil {
-					mode = stat.Mode().Perm()
-				}
-				if err := os.WriteFile(targetPath, content, mode); err != nil {
-					fmt.Fprintf(os.Stderr, "Error writing %s: %v\n", targetPath, err)
-					os.Exit(1)
-				}
+			args = append(args, relProtoFile)
+			cmd := exec.Command(protoc, args...)
+			cmd.Env = append(cmd.Env, os.Environ()...)
+			cmd.Dir = pwd
+			output, cmdErr := cmd.CombinedOutput()
+			if len(output) > 0 {
+				fmt.Println(string(output))
+			}
+			if cmdErr != nil {
+				fmt.Println(cmdErr)
+				os.Exit(1)
 			}
 		}
 	}
-
-	if isCheck {
-		if pbCount != len(generatedFiles) {
-			fmt.Printf("Protobuf file count mismatch: found %d, expected %d. Remove orphaned files and regenerate.\n", pbCount, len(generatedFiles))
-			diffCount++
-		}
-		if diffCount > 0 {
-			fmt.Println("Protobuf generated file problem(s) found.")
-			fmt.Println("Please run 'go run ./infra/vprotogen' to regenerate them.")
-			os.Exit(1)
-		}
-		fmt.Println("All Protobuf generated file check has been passed.")
-	}
 }

main/commands/all/api/rules_add.go

@@ -92,8 +92,6 @@ func executeAddRules(cmd *base.Command, args []string) {
 		if err != nil {
 			base.Fatalf("failed to perform AddRule: %s", err)
 		}
-		// if multiple files are specified, use append to merge them instead of overriding previous one
-		shouldAppend = true
 		showJSONResponse(resp)
 	}
 }

main/commands/all/base64/base64.go

@@ -1,14 +0,0 @@
-package base64
-
-import "github.com/xtls/xray-core/main/commands/base"
-
-// CmdBase64 holds all Base64 subcommands.
-var CmdBase64 = &base.Command{
-	UsageLine: "{{.Exec}} base64",
-	Short:     "Encode and decode Base64",
-	Long:      "{{.Exec}} {{.LongName}} provides tools to encode and decode arbitrary bytes.",
-	Commands: []*base.Command{
-		cmdEncode,
-		cmdDecode,
-	},
-}

main/commands/all/base64/decode.go

@@ -1,66 +0,0 @@
-package base64
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	xbase64 "github.com/xtls/xray-core/common/base64"
-	"github.com/xtls/xray-core/main/commands/base"
-)
-
-var cmdDecode = &base.Command{
-	UsageLine: "{{.Exec}} base64 decode [-gzip] <value | - | stdin:> [output-file]",
-	Short:     "Decode Base64",
-	Long: fmt.Sprintf(`
-Decode a Base64 value, or pass "-" or "stdin:" to read stdin.
-Write to output-file, or stdout if omitted.
-Accepts %s, %s, or no prefix; gzip is enabled by %s or -gzip.
-
-Examples:
-
-	{{.Exec}} base64 decode eA== out.bin
-	{{.Exec}} base64 decode -gzip H4sIAAAAAAAC/6sAAIMW3IwBAAAA out.bin
-`, xbase64.Prefix, xbase64.GzipPrefix, xbase64.GzipPrefix),
-}
-
-var decodeGzipEnabled = cmdDecode.Flag.Bool("gzip", false, "Decompress the decoded bytes with gzip.")
-
-func init() {
-	cmdDecode.Run = executeDecode
-}
-
-func executeDecode(cmd *base.Command, args []string) {
-	if len(args) == 0 || len(args) > 2 {
-		cmd.Usage()
-	}
-
-	value := args[0]
-	if value == "-" || value == "stdin:" {
-		input, err := io.ReadAll(os.Stdin)
-		if err != nil {
-			base.Fatalf("failed to read input: %s", err)
-		}
-		value = string(input)
-	}
-
-	value = strings.TrimSpace(value)
-	if *decodeGzipEnabled && !strings.HasPrefix(value, xbase64.GzipPrefix) {
-		value = xbase64.GzipPrefix + strings.TrimPrefix(value, xbase64.Prefix)
-	}
-
-	data, err := xbase64.Decode(value)
-	if err != nil {
-		base.Fatalf("failed to decode input: %s", err)
-	}
-
-	if len(args) == 2 && args[1] != "-" {
-		err = os.WriteFile(args[1], data, 0o666)
-	} else {
-		_, err = os.Stdout.Write(data)
-	}
-	if err != nil {
-		base.Fatalf("failed to write decoded output: %s", err)
-	}
-}

main/commands/all/base64/encode.go

@@ -1,57 +0,0 @@
-package base64
-
-import (
-	"fmt"
-	"io"
-	"os"
-
-	xbase64 "github.com/xtls/xray-core/common/base64"
-	"github.com/xtls/xray-core/main/commands/base"
-)
-
-var cmdEncode = &base.Command{
-	UsageLine: "{{.Exec}} base64 encode [-gzip] <input-file | - | stdin:>",
-	Short:     "Encode as Base64",
-	Long: fmt.Sprintf(`
-Encode input-file as Base64 with the %s prefix.
-Pass "-" or "stdin:" to read stdin.
-Use -gzip to compress and output %s.
-
-Examples:
-
-	{{.Exec}} base64 encode input.bin
-	{{.Exec}} base64 encode -gzip input.bin
-`, xbase64.Prefix, xbase64.GzipPrefix),
-}
-
-var gzipEnabled = cmdEncode.Flag.Bool("gzip", false, "Compress the input with gzip.")
-
-func init() {
-	cmdEncode.Run = executeEncode
-}
-
-func executeEncode(cmd *base.Command, args []string) {
-	if len(args) != 1 {
-		cmd.Usage()
-	}
-
-	var data []byte
-	var err error
-	if args[0] == "-" || args[0] == "stdin:" {
-		data, err = io.ReadAll(os.Stdin)
-	} else {
-		data, err = os.ReadFile(args[0])
-	}
-	if err != nil {
-		base.Fatalf("failed to read input: %s", err)
-	}
-
-	value, err := xbase64.Encode(data, *gzipEnabled)
-	if err != nil {
-		base.Fatalf("failed to encode input: %s", err)
-	}
-
-	if _, err := fmt.Fprintln(os.Stdout, value); err != nil {
-		base.Fatalf("failed to write encoded output: %s", err)
-	}
-}

main/commands/all/commands.go

@@ -2,10 +2,7 @@ package all
 
 import (
 	"github.com/xtls/xray-core/main/commands/all/api"
-	"github.com/xtls/xray-core/main/commands/all/base64"
 	"github.com/xtls/xray-core/main/commands/all/convert"
-	// TODO: Restore this import and lua.CmdLua when Lua privileged signature authorization is re-enabled.
-	// "github.com/xtls/xray-core/main/commands/all/lua"
 	"github.com/xtls/xray-core/main/commands/all/tls"
 	"github.com/xtls/xray-core/main/commands/base"
 )
@@ -14,13 +11,10 @@ func init() {
 	base.RootCommand.Commands = append(
 		base.RootCommand.Commands,
 		api.CmdAPI,
-		base64.CmdBase64,
 		convert.CmdConvert,
-		// lua.CmdLua,
 		tls.CmdTLS,
 		cmdUUID,
 		cmdX25519,
-		// cmdEd25519,
 		cmdWG,
 		cmdMLDSA65,
 		cmdMLKEM768,

main/commands/all/ed25519.go

@@ -1,53 +0,0 @@
-package all
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"encoding/base64"
-	"fmt"
-
-	"github.com/xtls/xray-core/main/commands/base"
-)
-
-var cmdEd25519 = &base.Command{
-	UsageLine: `{{.Exec}} ed25519 [-i "private key seed (Base64URL)"]`,
-	Short:     "Generate an Ed25519 key pair",
-	Long: `
-Generate an Ed25519 key pair, or restore it from a 32-byte private key seed
-with -i. PrivateKey (seed) and PublicKey use unpadded Base64URL.
-`,
-}
-
-var inputEd25519 = cmdEd25519.Flag.String("i", "", "Ed25519 private key seed in unpadded Base64URL.")
-
-func init() {
-	cmdEd25519.Run = executeEd25519
-}
-
-func executeEd25519(cmd *base.Command, args []string) {
-	if len(args) != 0 {
-		cmd.Usage()
-	}
-
-	var privateKey ed25519.PrivateKey
-	if *inputEd25519 == "" {
-		_, key, err := ed25519.GenerateKey(rand.Reader)
-		if err != nil {
-			base.Fatalf("failed to generate Ed25519 key: %s", err)
-		}
-		privateKey = key
-	} else {
-		encoding := base64.RawURLEncoding.Strict()
-		seed, err := encoding.DecodeString(*inputEd25519)
-		if err != nil || len(seed) != ed25519.SeedSize || encoding.EncodeToString(seed) != *inputEd25519 {
-			base.Fatalf("invalid Ed25519 private key seed: expected 32 bytes in unpadded Base64URL")
-		}
-		privateKey = ed25519.NewKeyFromSeed(seed)
-	}
-
-	if _, err := fmt.Printf("PrivateKey: %s\nPublicKey: %s\n",
-		base64.RawURLEncoding.EncodeToString(privateKey.Seed()),
-		base64.RawURLEncoding.EncodeToString(privateKey.Public().(ed25519.PublicKey))); err != nil {
-		base.Fatalf("failed to write Ed25519 keys: %s", err)
-	}
-}

main/commands/all/lua/lua.go

@@ -1,13 +0,0 @@
-package lua
-
-import "github.com/xtls/xray-core/main/commands/base"
-
-// CmdLua holds the Lua script commands.
-var CmdLua = &base.Command{
-	UsageLine: "{{.Exec}} lua",
-	Short:     "Manage Lua scripts",
-	Long:      "{{.Exec}} {{.LongName}} provides tools for local Lua scripts.",
-	Commands: []*base.Command{
-		cmdSign,
-	},
-}

main/commands/all/lua/sign.go

@@ -1,91 +0,0 @@
-package lua
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-
-	xlua "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/main/commands/base"
-)
-
-var cmdSign = &base.Command{
-	UsageLine: "{{.Exec}} lua sign [-key seed] [-o output-file] <input-file>",
-	Short:     "Sign a local Lua script for privileged execution",
-	Long: `
-Sign a local Lua file using a 32-byte Ed25519 private key seed in unpadded
-Base64URL. Use {{.Exec}} ed25519 to generate a key pair.
-Write back to the input file, or use -o to write another file (- for stdout).
-`,
-}
-
-var (
-	signKey    = cmdSign.Flag.String("key", "", "Ed25519 private key seed in unpadded Base64URL.")
-	signOutput = cmdSign.Flag.String("o", "", "Output file, or - for stdout. Default: input file.")
-)
-
-func init() {
-	cmdSign.Run = executeSign
-}
-
-func executeSign(cmd *base.Command, args []string) {
-	if len(args) != 1 {
-		cmd.Usage()
-	}
-
-	if !strings.EqualFold(filepath.Ext(args[0]), ".lua") {
-		base.Fatalf("Lua file extension must be .lua")
-	}
-	info, err := os.Stat(args[0])
-	if err != nil {
-		base.Fatalf("failed to inspect Lua file: %s", err)
-	}
-	code, err := os.ReadFile(args[0])
-	if err != nil {
-		base.Fatalf("failed to read Lua file: %s", err)
-	}
-
-	signed, err := xlua.SignPrivilegedScript(code, *signKey)
-	if err != nil {
-		base.Fatalf("failed to sign Lua file: %s", err)
-	}
-
-	if *signOutput == "-" {
-		if _, err := os.Stdout.Write(signed); err != nil {
-			base.Fatalf("failed to write signed Lua file: %s", err)
-		}
-		return
-	}
-	output := *signOutput
-	if output == "" {
-		output = args[0]
-	}
-	if err := writeSignedFile(output, signed, info.Mode().Perm()); err != nil {
-		base.Fatalf("failed to write signed Lua file: %s", err)
-	}
-}
-
-func writeSignedFile(path string, code []byte, mode os.FileMode) error {
-	if info, err := os.Stat(path); err == nil {
-		mode = info.Mode().Perm()
-	} else if !os.IsNotExist(err) {
-		return err
-	}
-
-	file, err := os.CreateTemp(filepath.Dir(path), ".xray-lua-sign-*")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(file.Name())
-	defer file.Close()
-	if _, err := file.Write(code); err != nil {
-		return err
-	}
-	if err := file.Chmod(mode); err != nil {
-		return err
-	}
-	if err := file.Close(); err != nil {
-		return err
-	}
-	return os.Rename(file.Name(), path)
-}

main/commands/all/mldsa65.go

@@ -1,11 +1,11 @@
 package all
 
 import (
-	"crypto/mldsa"
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
 
+	"github.com/cloudflare/circl/sign/mldsa/mldsa65"
 	"github.com/xtls/xray-core/main/commands/base"
 )
 
@@ -39,8 +39,8 @@ func executeMLDSA65(cmd *base.Command, args []string) {
 	} else {
 		rand.Read(seed[:])
 	}
-	key, _ := mldsa.NewPrivateKey(mldsa.MLDSA65(), seed[:])
+	pub, _ := mldsa65.NewKeyFromSeed(&seed)
 	fmt.Printf("Seed: %v\nVerify: %v\n",
 		base64.RawURLEncoding.EncodeToString(seed[:]),
-		base64.RawURLEncoding.EncodeToString(key.PublicKey().Bytes()))
+		base64.RawURLEncoding.EncodeToString(pub.Bytes()))
 }

main/commands/base/env.go

@@ -4,8 +4,6 @@ package base
 type CommandEnvHolder struct {
 	// Executable name of current binary
 	Exec string
-	// Full name of the command being executed
-	CommandName string
 	// commands column width of current command
 	CommandsWidth int
 }

main/commands/base/execute.go

@@ -61,7 +61,6 @@ BigCmdLoop:
 			}
 
 			buildCommandText(cmd)
-			CommandEnv.CommandName = cmdName
 			cmd.Run(cmd, args)
 			Exit()
 			return

main/confloader/external/external.go

@@ -8,14 +8,12 @@ import (
 	"net/http"
 	"net/url"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/utils"
-	"github.com/xtls/xray-core/main/commands/base"
 	"github.com/xtls/xray-core/main/confloader"
 )
 
@@ -33,12 +31,7 @@ func ConfigLoader(arg string) (out io.Reader, err error) {
 		data, err = io.ReadAll(os.Stdin)
 
 	default:
-		file, openErr := os.Open(arg)
-		if openErr != nil {
-			return nil, openErr
-		}
-		defer file.Close()
-		data, err = readConfigFile(file)
+		data, err = os.ReadFile(arg)
 	}
 
 	if err != nil {
@@ -48,25 +41,6 @@ func ConfigLoader(arg string) (out io.Reader, err error) {
 	return
 }
 
-func readConfigFile(file *os.File) ([]byte, error) {
-	if base.CommandEnv.CommandName != "run" {
-		return io.ReadAll(file)
-	}
-
-	info, err := file.Stat()
-	if err != nil {
-		return nil, err
-	}
-	if info.Mode().IsRegular() {
-		switch strings.ToLower(filepath.Ext(file.Name())) {
-		case ".jsonc", ".json", ".yml", ".yaml", ".toml", ".pb", ".protobuf":
-		default:
-			return nil, errors.New("unsupported config file extension: ", file.Name())
-		}
-	}
-	return io.ReadAll(file)
-}
-
 // FetchHTTPContent issues an HTTP GET against either a regular HTTP(S) URL
 // or a Unix socket HTTP endpoint.
 //

main/run.go

@@ -36,6 +36,10 @@ The -confdir=dir flag sets a dir with multiple json config
 The -format=json flag sets the format of config files.
 Default "auto".
 
+The config root env object sets process environment variables after all config
+files are parsed. Variables needed to locate or parse config files must be set
+in the process environment before Xray starts.
+
 The -test flag tells Xray to test config files only,
 without launching the server.
 
@@ -43,9 +47,6 @@ The -dump flag tells Xray to print the merged config.
 	`,
 }
 
-// The --lua-privileged-pubkey=key flag sets the trusted Ed25519 public key
-// for privileged local Lua scripts, encoded as unpadded Base64URL.
-
 func init() {
 	cmdRun.Run = executeRun // break init loop
 	log.SetFlags(log.Ldate | log.Ltime | log.Lmicroseconds)
@@ -57,8 +58,6 @@ var (
 	dump        = cmdRun.Flag.Bool("dump", false, "Dump merged config only, without launching Xray server.")
 	test        = cmdRun.Flag.Bool("test", false, "Test config file only, without launching Xray server.")
 	format      = cmdRun.Flag.String("format", "auto", "Format of input file.")
-	// TODO: Restore this flag and its help text when Lua privileged signature authorization is re-enabled.
-	// luaPrivilegedPublicKey = cmdRun.Flag.String("lua-privileged-pubkey", "", "Unpadded Base64URL Ed25519 public key for privileged local Lua scripts.")
 
 	/* We have to do this here because Golang's Test will also need to parse flag, before
 	 * main func in this file is run.
@@ -215,11 +214,6 @@ func getConfigFormat() string {
 }
 
 func startXray() (core.Server, error) {
-	// TODO: Restore public key initialization when Lua privileged signature authorization is re-enabled.
-	// if err := lua.SetPrivilegedPublicKey(*luaPrivilegedPublicKey); err != nil {
-	// 	return nil, errors.New("failed to configure Lua privileged authorization").Base(err)
-	// }
-
 	configFiles := getConfigFilePath(true)
 
 	c, err := core.LoadConfig(getConfigFormat(), configFiles)

main/run_test.go

@@ -1,85 +0,0 @@
-package main
-
-import (
-	"context"
-	"flag"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestRunConfigCommands(t *testing.T) {
-	if os.Getenv("XRAY_TEST_CONFIG_COMMAND") == "1" {
-		os.Args = append([]string{os.Args[0]}, flag.Args()...)
-		main()
-		return
-	}
-	dir := t.TempDir()
-	config := filepath.Join(dir, "config.yaml")
-	script := filepath.Join(dir, "config.lua")
-	binary := filepath.Join(dir, "config.pb")
-	message := filepath.Join(dir, "user.tmsg")
-	for path, body := range map[string]string{
-		config:  "{}",
-		script:  "{}",
-		binary:  "",
-		message: `{"type":"xray.app.dispatcher.Config","value":""}`,
-	} {
-		if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	file, err := os.Open(script)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	for _, tc := range []struct {
-		name  string
-		args  []string
-		code  int
-		input io.Reader
-	}{
-		{"format override", []string{"run", "-test", "-format", "json", "-c", config}, 0, nil},
-		{"invalid extension", []string{"run", "-test", "-format", "json", "-c", script}, 23, nil},
-		{"default command", []string{"-test", "-format", "json", "-c", script}, 23, nil},
-		{"protobuf config", []string{"run", "-test", "-c", binary}, 0, nil},
-		{"protobuf error", []string{"run", "-test", "-format", "protobuf", "-c", script}, 23, nil},
-		{"merged source", []string{"run", "-test", "-format", "json", "-c", config, "-c", script}, 23, nil},
-		{"dump", []string{"run", "-dump", "-c", config}, 0, nil},
-		{"stdin pipe", []string{"run", "-test", "-c", "stdin:"}, 0, nil},
-		{"stdin file", []string{"run", "-test", "-c", "stdin:"}, 0, file},
-		{"convert json", []string{"convert", "json", message}, 0, nil},
-		{"convert pb", []string{"convert", "pb", "-debug", config}, 0, nil},
-		{"convert pb stdin", []string{"convert", "pb", "-debug", "stdin:"}, 0, file},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-			defer cancel()
-			args := append([]string{"-test.run=^TestRunConfigCommands$", "--"}, tc.args...)
-			cmd := exec.CommandContext(ctx, os.Args[0], args...)
-			cmd.Env = append(os.Environ(), "XRAY_TEST_CONFIG_COMMAND=1")
-			cmd.Stdin = strings.NewReader("{}")
-			if tc.input != nil {
-				if _, err := file.Seek(0, io.SeekStart); err != nil {
-					t.Fatal(err)
-				}
-				cmd.Stdin = tc.input
-			}
-			output, err := cmd.CombinedOutput()
-			if cmd.ProcessState == nil {
-				t.Fatal(err)
-			}
-			if code := cmd.ProcessState.ExitCode(); code != tc.code {
-				t.Fatalf("exit code = %d, want %d: %v\n%s", code, tc.code, err, output)
-			}
-			if tc.code == 23 && !strings.Contains(string(output), "failed to load config files") {
-				t.Fatalf("missing config error:\n%s", output)
-			}
-		})
-	}
-}

proxy/dns/dns.go

@@ -381,13 +381,6 @@ func (h *Handler) handleIPQuery(id uint16, qType dnsmessage.Type, domain string,
 		errors.LogInfoInner(context.Background(), err, "pack message")
 		b.Release()
 		timer.SetTimeout(0)
-		return
-	}
-	if len(msgBytes) > buf.Size {
-		b.Release()
-		timer.SetTimeout(0)
-		errors.LogError(context.Background(), "DNS response message too large")
-		return
 	}
 	b.Resize(0, int32(len(msgBytes)))
 

proxy/dokodemo/config.pb.go

@@ -23,14 +23,14 @@ const (
 )
 
 type Config struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	RewriteAddress *net.IPOrDomain        `protobuf:"bytes,1,opt,name=rewrite_address,json=rewriteAddress,proto3" json:"rewrite_address,omitempty"`
+	RewritePort    uint32                 `protobuf:"varint,2,opt,name=rewrite_port,json=rewritePort,proto3" json:"rewrite_port,omitempty"`
+	PortMap        map[string]string      `protobuf:"bytes,3,rep,name=port_map,json=portMap,proto3" json:"port_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// List of networks that the Dokodemo accepts.
-	AllowedNetworks []net.Network     `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
-	RewriteAddress  *net.IPOrDomain   `protobuf:"bytes,1,opt,name=rewrite_address,json=rewriteAddress,proto3" json:"rewrite_address,omitempty"`
-	RewritePort     uint32            `protobuf:"varint,2,opt,name=rewrite_port,json=rewritePort,proto3" json:"rewrite_port,omitempty"`
-	PortMap         map[string]string `protobuf:"bytes,3,rep,name=port_map,json=portMap,proto3" json:"port_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	FollowRedirect  bool              `protobuf:"varint,5,opt,name=follow_redirect,json=followRedirect,proto3" json:"follow_redirect,omitempty"`
-	UserLevel       uint32            `protobuf:"varint,6,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
+	AllowedNetworks []net.Network `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
+	FollowRedirect  bool          `protobuf:"varint,5,opt,name=follow_redirect,json=followRedirect,proto3" json:"follow_redirect,omitempty"`
+	UserLevel       uint32        `protobuf:"varint,6,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
 }
@@ -65,13 +65,6 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_proxy_dokodemo_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetAllowedNetworks() []net.Network {
-	if x != nil {
-		return x.AllowedNetworks
-	}
-	return nil
-}
-
 func (x *Config) GetRewriteAddress() *net.IPOrDomain {
 	if x != nil {
 		return x.RewriteAddress
@@ -93,6 +86,13 @@ func (x *Config) GetPortMap() map[string]string {
 	return nil
 }
 
+func (x *Config) GetAllowedNetworks() []net.Network {
+	if x != nil {
+		return x.AllowedNetworks
+	}
+	return nil
+}
+
 func (x *Config) GetFollowRedirect() bool {
 	if x != nil {
 		return x.FollowRedirect
@@ -112,11 +112,11 @@ var File_proxy_dokodemo_config_proto protoreflect.FileDescriptor
 const file_proxy_dokodemo_config_proto_rawDesc = "" +
 	"\n" +
 	"\x1bproxy/dokodemo/config.proto\x12\x13xray.proxy.dokodemo\x1a\x18common/net/address.proto\x1a\x18common/net/network.proto\"\xff\x02\n" +
-	"\x06Config\x12C\n" +
-	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12D\n" +
+	"\x06Config\x12D\n" +
 	"\x0frewrite_address\x18\x01 \x01(\v2\x1b.xray.common.net.IPOrDomainR\x0erewriteAddress\x12!\n" +
 	"\frewrite_port\x18\x02 \x01(\rR\vrewritePort\x12C\n" +
-	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12'\n" +
+	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12C\n" +
+	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12'\n" +
 	"\x0ffollow_redirect\x18\x05 \x01(\bR\x0efollowRedirect\x12\x1d\n" +
 	"\n" +
 	"user_level\x18\x06 \x01(\rR\tuserLevel\x1a:\n" +
@@ -141,13 +141,13 @@ var file_proxy_dokodemo_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_proxy_dokodemo_config_proto_goTypes = []any{
 	(*Config)(nil),         // 0: xray.proxy.dokodemo.Config
 	nil,                    // 1: xray.proxy.dokodemo.Config.PortMapEntry
-	(net.Network)(0),       // 2: xray.common.net.Network
-	(*net.IPOrDomain)(nil), // 3: xray.common.net.IPOrDomain
+	(*net.IPOrDomain)(nil), // 2: xray.common.net.IPOrDomain
+	(net.Network)(0),       // 3: xray.common.net.Network
 }
 var file_proxy_dokodemo_config_proto_depIdxs = []int32{
-	2, // 0: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
-	3, // 1: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
-	1, // 2: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
+	2, // 0: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
+	1, // 1: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
+	3, // 2: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
 	3, // [3:3] is the sub-list for method output_type
 	3, // [3:3] is the sub-list for method input_type
 	3, // [3:3] is the sub-list for extension type_name

proxy/freedom/freedom.go

@@ -229,19 +229,14 @@ func (h *Handler) blockDelay(rule *FinalRule) time.Duration {
 func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *FinalRule, dest *net.Destination) error {
 	delay := h.blockDelay(rule)
 	errors.LogInfo(ctx, "blocked target: ", *dest, ", blackholing connection for ", delay)
-	defer common.Close(output)
-	done := make(chan struct{})
-	go func() { // a DispatchLink inbound's reader ignores Interrupt, so don't wait for this copy
-		_ = buf.Copy(input, buf.Discard)
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(delay):
+	timer := time.AfterFunc(delay, func() {
 		common.Interrupt(input)
 		common.Interrupt(output)
 		errors.LogInfo(ctx, "closed blackholed connection to blocked target: ", *dest)
-	}
+	})
+	defer timer.Stop()
+	defer common.Close(output)
+	_ = buf.Copy(input, buf.Discard)
 	return nil
 }
 

proxy/http/client.go

@@ -10,7 +10,6 @@ import (
 	"net/url"
 	"sync"
 	"text/template"
-	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
@@ -87,13 +86,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	user := server.User
 	var conn stat.Connection
 
-	var mbuf buf.MultiBuffer
-	if reader, ok := link.Reader.(buf.TimeoutReader); ok {
-		// Don't wait forever: server-first protocols (SMTP, FTP, MySQL...) send nothing until the server greets.
-		mbuf, _ = reader.ReadMultiBufferTimeout(time.Millisecond * 500)
-	} else {
-		mbuf, _ = link.Reader.ReadMultiBuffer()
-	}
+	mbuf, _ := link.Reader.ReadMultiBuffer()
 	len := mbuf.Len()
 	firstPayload := bytespool.Alloc(len)
 	mbuf, _ = buf.SplitBytes(mbuf, firstPayload)
@@ -241,8 +234,7 @@ func setUpHTTPTunnel(ctx context.Context, dest net.Destination, target string, u
 			return nil, err
 		}
 
-		reader := bufio.NewReader(rawConn)
-		resp, err := http.ReadResponse(reader, req)
+		resp, err := http.ReadResponse(bufio.NewReader(rawConn), req)
 		if err != nil {
 			rawConn.Close()
 			return nil, err
@@ -253,11 +245,6 @@ func setUpHTTPTunnel(ctx context.Context, dest net.Destination, target string, u
 			rawConn.Close()
 			return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
 		}
-		// Tunneled bytes (e.g. a server-first greeting) may arrive in the same read as the 200 response.
-		if n := reader.Buffered(); n > 0 {
-			early, _ := reader.Peek(n)
-			return &earlyDataConn{Conn: rawConn, early: early}, nil
-		}
 		return rawConn, nil
 	}
 
@@ -388,21 +375,6 @@ func (h *http2Conn) Close() error {
 	return h.out.Close()
 }
 
-// earlyDataConn returns the bytes read ahead together with the CONNECT response before reading from Conn.
-type earlyDataConn struct {
-	net.Conn
-	early []byte
-}
-
-func (c *earlyDataConn) Read(p []byte) (int, error) {
-	if len(c.early) > 0 {
-		n := copy(p, c.early)
-		c.early = c.early[n:]
-		return n, nil
-	}
-	return c.Conn.Read(p)
-}
-
 func init() {
 	common.Must(common.RegisterConfig((*ClientConfig)(nil), func(ctx context.Context, config interface{}) (interface{}, error) {
 		return NewClient(ctx, config.(*ClientConfig))

proxy/masque/client.go

@@ -7,6 +7,7 @@ import (
 	"net/netip"
 	"slices"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.zx2c4.com/wireguard/tun"
@@ -25,7 +26,6 @@ import (
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/masque"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
 	"github.com/xtls/xray-core/transport/internet/stat"
 	"github.com/xtls/xray-core/transport/internet/tls"
 )
@@ -43,15 +43,11 @@ type Client struct {
 	ctx    context.Context
 	cancel context.CancelFunc
 
+	tunnel atomic.Pointer[tunnel]
+
 	mu        sync.Mutex
-	xmux      *splithttp.XmuxManager
-	dialCtx   context.Context
-	dialer    internet.Dialer
 	lastErr   error
 	lastErrAt time.Time
-
-	tunnelsMu sync.Mutex
-	tunnels   map[*tunnel]struct{}
 }
 
 func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
@@ -59,8 +55,7 @@ func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
 	p := v.GetFeature(policy.ManagerType()).(policy.Manager)
 
 	streamSettings := session.StreamSettingsFromContext(ctx).(*internet.MemoryStreamConfig)
-	transportConfig, ok := streamSettings.ProtocolSettings.(*masque.Config)
-	if !ok {
+	if _, ok := streamSettings.ProtocolSettings.(*masque.Config); !ok {
 		return nil, errors.New("not masque transport")
 	}
 	if tls.ConfigFromStreamSettings(streamSettings) == nil {
@@ -91,13 +86,7 @@ func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
 		server:        server,
 		policyManager: p,
 		remoteDNS:     remoteDNS,
-		tunnels:       make(map[*tunnel]struct{}),
 	}
-	xmuxConfig := transportConfig.Xmux
-	if xmuxConfig == nil {
-		xmuxConfig = &splithttp.XmuxConfig{}
-	}
-	c.xmux = splithttp.NewXmuxManager(*xmuxConfig, c.newXmuxConn)
 	c.ctx, c.cancel = context.WithCancel(context.Background())
 	return c, nil
 }
@@ -111,11 +100,10 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	ob.Name = "masque"
 	ob.CanSpliceCopy = 3
 
-	xmuxClient, t, err := c.getTunnel(ctx, dialer)
+	t, err := c.getTunnel(ctx, dialer)
 	if err != nil {
 		return errors.New("failed to establish CONNECT-IP tunnel").Base(err)
 	}
-	defer xmuxClient.DoneRunning()
 
 	var newCtx context.Context
 	var newCancel context.CancelFunc
@@ -192,63 +180,40 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	return nil
 }
 
-func (c *Client) getTunnel(ctx context.Context, dialer internet.Dialer) (*splithttp.XmuxClient, *tunnel, error) {
+func (c *Client) getTunnel(ctx context.Context, dialer internet.Dialer) (*tunnel, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if c.ctx.Err() != nil {
-		return nil, nil, errors.New("closed")
+		return nil, errors.New("closed")
+	}
+	if t := c.tunnel.Load(); t != nil {
+		select {
+		case <-t.done:
+		default:
+			return t, nil
+		}
 	}
 	if err := ctx.Err(); err != nil {
-		return nil, nil, err
+		return nil, err
 	}
-	var xmuxClient *splithttp.XmuxClient
 	if c.lastErr != nil && time.Since(c.lastErrAt) < retryInterval {
-		if xmuxClient = c.xmux.GetExistingXmuxClient(ctx); xmuxClient == nil {
-			return nil, nil, c.lastErr
-		}
-	} else {
-		c.dialCtx, c.dialer = ctx, dialer
-		xmuxClient = c.xmux.GetXmuxClient(ctx)
-		c.dialCtx, c.dialer = nil, nil
-		if err := xmuxClient.XmuxConn.(*tunnel).err; err != nil {
-			if xmuxClient = c.xmux.GetExistingXmuxClient(ctx); xmuxClient == nil {
-				return nil, nil, err
-			}
-		}
+		return nil, c.lastErr
 	}
-	t := xmuxClient.XmuxConn.(*tunnel)
-	if c.ctx.Err() != nil {
-		return nil, nil, errors.New("closed")
-	}
-	xmuxClient.AddRunning()
-	return xmuxClient, t, nil
-}
 
-func (c *Client) newXmuxConn() splithttp.XmuxConn {
-	t, err := c.establish(c.dialCtx, c.dialer)
+	t, err := c.establish(ctx, dialer)
 	if err != nil {
 		c.lastErr, c.lastErrAt = err, time.Now()
-		return failedTunnel(err)
+		return nil, err
 	}
 	c.lastErr = nil
-	c.tunnelsMu.Lock()
-	if c.tunnels == nil {
-		c.tunnelsMu.Unlock()
-		t.close()
-		return failedTunnel(errors.New("closed"))
+	c.tunnel.Store(t)
+	if c.ctx.Err() != nil {
+		if c.tunnel.CompareAndSwap(t, nil) {
+			t.close()
+		}
+		return nil, errors.New("closed")
 	}
-	c.tunnels[t] = struct{}{}
-	c.tunnelsMu.Unlock()
-	if t.IsClosed() {
-		c.removeTunnel(t)
-	}
-	return t
-}
-
-func (c *Client) removeTunnel(t *tunnel) {
-	c.tunnelsMu.Lock()
-	delete(c.tunnels, t)
-	c.tunnelsMu.Unlock()
+	return t, nil
 }
 
 func (c *Client) establish(ctx context.Context, dialer internet.Dialer) (*tunnel, error) {
@@ -264,7 +229,7 @@ func (c *Client) establish(ctx context.Context, dialer internet.Dialer) (*tunnel
 		conn.Close()
 		return nil, errors.New("not a CONNECT-IP connection")
 	}
-	t, err := newTunnel(conn, mconn.LocalAddrs(), c.remoteDNS, c.removeTunnel)
+	t, err := newTunnel(conn, mconn.LocalAddrs(), c.remoteDNS)
 	if err != nil {
 		conn.Close()
 		return nil, err
@@ -275,11 +240,7 @@ func (c *Client) establish(ctx context.Context, dialer internet.Dialer) (*tunnel
 
 func (c *Client) Close() error {
 	c.cancel()
-	c.tunnelsMu.Lock()
-	tunnels := c.tunnels
-	c.tunnels = nil
-	c.tunnelsMu.Unlock()
-	for t := range tunnels {
+	if t := c.tunnel.Swap(nil); t != nil {
 		t.close()
 	}
 	return nil
@@ -291,31 +252,9 @@ type tunnel struct {
 	tnet      *wireguard.Net
 	done      chan struct{}
 	closeOnce sync.Once
-	onClose   func(*tunnel)
-	err       error
 }
 
-func failedTunnel(err error) *tunnel {
-	t := &tunnel{err: err, done: make(chan struct{})}
-	t.close()
-	return t
-}
-
-func (t *tunnel) IsClosed() bool {
-	select {
-	case <-t.done:
-		return true
-	default:
-		return false
-	}
-}
-
-func (t *tunnel) Close() error {
-	t.close()
-	return nil
-}
-
-func newTunnel(conn stat.Connection, local []netip.Addr, remoteDNS []netip.Addr, onClose func(*tunnel)) (*tunnel, error) {
+func newTunnel(conn stat.Connection, local []netip.Addr, remoteDNS []netip.Addr) (*tunnel, error) {
 	var dns []netip.Addr
 	for _, addr := range remoteDNS {
 		if slices.ContainsFunc(local, func(l netip.Addr) bool { return l.Is4() == addr.Is4() }) {
@@ -327,16 +266,15 @@ func newTunnel(conn stat.Connection, local []netip.Addr, remoteDNS []netip.Addr,
 		dns = remoteDNS
 	}
 
-	dev, tnet, err := wireguard.CreateNetTUN(local, dns, masque.MinPacketSize, nil)
+	dev, tnet, _, err := wireguard.CreateNetTUN(local, dns, masque.MinPacketSize, true)
 	if err != nil {
 		return nil, err
 	}
 	t := &tunnel{
-		conn:    conn,
-		dev:     dev,
-		tnet:    tnet,
-		done:    make(chan struct{}),
-		onClose: onClose,
+		conn: conn,
+		dev:  dev,
+		tnet: tnet,
+		done: make(chan struct{}),
 	}
 	go t.readFromTunnel()
 	go t.writeToTunnel()
@@ -378,15 +316,8 @@ func (t *tunnel) writeToTunnel() {
 func (t *tunnel) close() {
 	t.closeOnce.Do(func() {
 		close(t.done)
-		if t.conn != nil {
-			t.conn.Close()
-		}
-		if t.dev != nil {
-			t.dev.Close()
-		}
-		if t.onClose != nil {
-			t.onClose(t)
-		}
+		t.conn.Close()
+		t.dev.Close()
 	})
 }
 

proxy/masque/client_test.go

@@ -1,54 +0,0 @@
-package masque
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/xtls/xray-core/transport/internet/splithttp"
-)
-
-func newTestClient(newConn func(c *Client) splithttp.XmuxConn) *Client {
-	c := &Client{ctx: context.Background()}
-	c.xmux = splithttp.NewXmuxManager(splithttp.XmuxConfig{
-		MaxConnections: &splithttp.RangeConfig{From: 3, To: 3},
-	}, func() splithttp.XmuxConn {
-		return newConn(c)
-	})
-	return c
-}
-
-func TestGetTunnelFallsBack(t *testing.T) {
-	refused := errors.New("refused")
-	healthy := &tunnel{done: make(chan struct{})}
-	dials := 0
-	c := newTestClient(func(c *Client) splithttp.XmuxConn {
-		if dials++; dials == 1 {
-			return healthy
-		}
-		c.lastErr, c.lastErrAt = refused, time.Now()
-		return failedTunnel(refused)
-	})
-	for i := 0; i < 5; i++ {
-		if _, got, err := c.getTunnel(context.Background(), nil); err != nil || got != healthy {
-			t.Fatalf("flow %d: got %p, %v instead of the healthy tunnel", i, got, err)
-		}
-	}
-	if dials != 2 {
-		t.Errorf("dialed %d times, a failed tunnel should not be retried within %v", dials, retryInterval)
-	}
-}
-
-func TestGetTunnelFailsWithoutTunnels(t *testing.T) {
-	refused := errors.New("refused")
-	c := newTestClient(func(c *Client) splithttp.XmuxConn {
-		c.lastErr, c.lastErrAt = refused, time.Now()
-		return failedTunnel(refused)
-	})
-	for i := 0; i < 2; i++ {
-		if _, _, err := c.getTunnel(context.Background(), nil); err != refused {
-			t.Fatalf("flow %d: got %v instead of %v", i, err, refused)
-		}
-	}
-}

proxy/masque/server.go

@@ -22,7 +22,6 @@ import (
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
-	xtun "github.com/xtls/xray-core/proxy/tun"
 	"github.com/xtls/xray-core/proxy/wireguard"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
@@ -167,11 +166,17 @@ func NewServer(ctx context.Context, config *ServerConfig) (*Server, error) {
 	if mtu == 0 {
 		mtu = masque.MinPacketSize
 	}
+	dev, _, gstack, err := wireguard.CreateNetTUN(local, nil, mtu, false)
+	if err != nil {
+		return nil, err
+	}
+
 	s := &Server{
 		validator:  users,
 		dispatcher: v.GetFeature(routing.DispatcherType()).(routing.Dispatcher),
 		ctx:        core.ToBackgroundDetachedContext(ctx),
 		mtu:        mtu,
+		dev:        dev,
 		pools:      pools,
 		local:      local,
 		tunnels:    make(map[netip.Addr]*serverTunnel),
@@ -182,11 +187,7 @@ func NewServer(ctx context.Context, config *ServerConfig) (*Server, error) {
 	if content := session.ContentFromContext(ctx); content != nil {
 		s.sniffing = content.SniffingRequest
 	}
-	dev, _, err := wireguard.CreateNetTUN(local, nil, mtu, s)
-	if err != nil {
-		return nil, err
-	}
-	s.dev = dev
+	wireguard.CreateForwarder(gstack, s.handleConnection)
 	return s, nil
 }
 
@@ -499,8 +500,7 @@ func packetDestination(packet []byte) (netip.Addr, bool) {
 	return netip.Addr{}, false
 }
 
-// HandleConnection implements tun.ConnectionHandler
-func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
+func (s *Server) handleConnection(conn net.Conn, dest net.Destination) {
 	defer conn.Close()
 	source := net.DestinationFromAddr(conn.RemoteAddr())
 	addr, _ := netip.AddrFromSlice(source.Address.IP())
@@ -534,13 +534,9 @@ func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
 	})
 	errors.LogInfo(ctx, "processing from ", source, " to ", dest)
 
-	writer := buf.NewWriter(conn)
-	if dest.Network == net.Network_TCP {
-		writer = &xtun.TCPWriter{Writer: writer}
-	}
 	link := &transport.Link{
 		Reader: &buf.TimeoutWrapperReader{Reader: buf.NewReader(conn)},
-		Writer: writer,
+		Writer: buf.NewWriter(conn),
 	}
 	if err := s.dispatcher.DispatchLink(ctx, dest, link); err != nil {
 		errors.LogError(ctx, errors.New("connection closed").Base(err))