Add tests for TUN system stack (TCP/UDP)

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>

go.mod

@@ -24,11 +24,11 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.55.0
+	golang.org/x/crypto v0.57.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.58.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/net v0.59.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.0.1
@@ -57,7 +57,7 @@ require (
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect

go.sum

@@ -111,8 +111,8 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -121,12 +121,12 @@ golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -134,14 +134,14 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

infra/conf/transport_finalmask.go

@@ -14,7 +14,6 @@ import (
 	googleuuid "github.com/google/uuid"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/aes128gcm"
@@ -909,22 +908,13 @@ func (c *Realm) Build() (proto.Message, error) {
 }
 
 type UDPHop struct {
-	Sockopt     *SocketConfig `json:"sockopt"`
-	Mode        string        `json:"mode"`
-	Interval    Int32Range    `json:"interval"`
-	RemotePorts PortList      `json:"remotePorts"`
-	RemoteIPs   []string      `json:"remoteIPs"`
+	Mode        string     `json:"mode"`
+	Interval    Int32Range `json:"interval"`
+	RemoteIPs   []string   `json:"remoteIPs"`
+	RemotePorts PortList   `json:"remotePorts"`
 }
 
 func (c *UDPHop) Build() (proto.Message, error) {
-	var sockopt *internet.SocketConfig
-	if c.Sockopt != nil {
-		var err error
-		sockopt, err = c.Sockopt.Build()
-		if err != nil {
-			return nil, err
-		}
-	}
 	var local, remote, remoteOnce bool
 	for _, mode := range strings.Split(c.Mode, ",") {
 		switch strings.ToLower(mode) {
@@ -953,14 +943,13 @@ func (c *UDPHop) Build() (proto.Message, error) {
 		return nil, errors.New("invalid ip ", ip)
 	}
 	return &udphop.Config{
-		Sockopt:     sockopt,
 		Local:       local,
 		Remote:      remote,
 		RemoteOnce:  remoteOnce,
 		IntervalMin: int64(c.Interval.From),
 		IntervalMax: int64(c.Interval.To),
-		RemotePorts: c.RemotePorts.Build().Ports(),
 		RemoteIPs:   remoteIPs,
+		RemotePorts: c.RemotePorts.Build().Ports(),
 	}, nil
 }
 

infra/conf/tun.go

@@ -20,6 +20,7 @@ type TunConfig struct {
 	UserLevel              uint32   `json:"userLevel"`
 	AutoSystemRoutingTable []string `json:"autoSystemRoutingTable"`
 	AutoOutboundsInterface *string  `json:"autoOutboundsInterface"`
+	Stack                  string   `json:"stack"`
 }
 
 func (v *TunConfig) Build() (proto.Message, error) {
@@ -31,6 +32,7 @@ func (v *TunConfig) Build() (proto.Message, error) {
 		DNS:                    v.DNS,
 		UserLevel:              v.UserLevel,
 		AutoSystemRoutingTable: v.AutoSystemRoutingTable,
+		Stack:                  v.Stack,
 	}
 	if v.AutoOutboundsInterface != nil {
 		config.AutoOutboundsInterface = *v.AutoOutboundsInterface
@@ -52,6 +54,11 @@ func (v *TunConfig) Build() (proto.Message, error) {
 	if config.MTU == 0 {
 		config.MTU = 1500
 	}
+	switch config.Stack {
+	case "", "gvisor", "system":
+	default:
+		return nil, fmt.Errorf("unknown tun stack: %s (must be \"gvisor\" or \"system\")", config.Stack)
+	}
 	return config, nil
 }
 

infra/conf/wireguard.go

@@ -59,14 +59,13 @@ func (c *WireGuardPeerConfig) Build() (*wireguard.PeerConfig, error) {
 type WireGuardConfig struct {
 	IsClient bool `json:""`
 
-	NoKernelTun    bool                   `json:"noKernelTun"`
-	SecretKey      string                 `json:"secretKey"`
-	Address        []string               `json:"address"`
-	Peers          []*WireGuardPeerConfig `json:"peers"`
-	MTU            int32                  `json:"mtu"`
-	Reserved       []byte                 `json:"reserved"`
-	DomainStrategy string                 `json:"domainStrategy"`
-	DNS            []string               `json:"remoteDNS"`
+	NoKernelTun bool                   `json:"noKernelTun"`
+	SecretKey   string                 `json:"secretKey"`
+	Address     []string               `json:"address"`
+	Peers       []*WireGuardPeerConfig `json:"peers"`
+	MTU         int32                  `json:"mtu"`
+	Reserved    []byte                 `json:"reserved"`
+	DNS         []string               `json:"remoteDNS"`
 }
 
 func (c *WireGuardConfig) Build() (proto.Message, error) {
@@ -125,21 +124,6 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 	}
 	config.Reserved = c.Reserved
 
-	switch strings.ToLower(c.DomainStrategy) {
-	case "forceip", "":
-		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP
-	case "forceipv4":
-		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP4
-	case "forceipv6":
-		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP6
-	case "forceipv4v6":
-		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP46
-	case "forceipv6v4":
-		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP64
-	default:
-		return nil, errors.New("unsupported domain strategy: ", c.DomainStrategy)
-	}
-
 	config.IsClient = c.IsClient
 	config.NoKernelTun = c.NoKernelTun
 	config.DNS = c.DNS

proxy/hysteria/client.go

@@ -236,14 +236,14 @@ type UDPReader struct {
 
 func (r *UDPReader) ReadFrom(p []byte) (n int, addr *net.Destination, err error) {
 	for {
-		var buf [hysteria.MaxDatagramFrameSize]byte
+		var packet [1500]byte
 
-		n, err := r.reader.Read(buf[:])
+		n, err := r.reader.Read(packet[:])
 		if err != nil {
 			return 0, nil, err
 		}
 
-		msg, err := ParseUDPMessage(buf[:n])
+		msg, err := ParseUDPMessage(packet[:n])
 		if err != nil {
 			continue
 		}

proxy/tun/config.pb.go

@@ -32,6 +32,7 @@ type Config struct {
 	AutoSystemRoutingTable []string               `protobuf:"bytes,6,rep,name=auto_system_routing_table,json=autoSystemRoutingTable,proto3" json:"auto_system_routing_table,omitempty"`
 	AutoOutboundsInterface string                 `protobuf:"bytes,7,opt,name=auto_outbounds_interface,json=autoOutboundsInterface,proto3" json:"auto_outbounds_interface,omitempty"`
 	Desc                   string                 `protobuf:"bytes,8,opt,name=desc,proto3" json:"desc,omitempty"`
+	Stack                  string                 `protobuf:"bytes,9,opt,name=stack,proto3" json:"stack,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -122,11 +123,18 @@ func (x *Config) GetDesc() string {
 	return ""
 }
 
+func (x *Config) GetStack() string {
+	if x != nil {
+		return x.Stack
+	}
+	return ""
+}
+
 var File_proxy_tun_config_proto protoreflect.FileDescriptor
 
 const file_proxy_tun_config_proto_rawDesc = "" +
 	"\n" +
-	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\x82\x02\n" +
+	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\x98\x02\n" +
 	"\x06Config\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
 	"\x03MTU\x18\x02 \x01(\rR\x03MTU\x12\x18\n" +
@@ -136,7 +144,8 @@ const file_proxy_tun_config_proto_rawDesc = "" +
 	"user_level\x18\x05 \x01(\rR\tuserLevel\x129\n" +
 	"\x19auto_system_routing_table\x18\x06 \x03(\tR\x16autoSystemRoutingTable\x128\n" +
 	"\x18auto_outbounds_interface\x18\a \x01(\tR\x16autoOutboundsInterface\x12\x12\n" +
-	"\x04desc\x18\b \x01(\tR\x04descBL\n" +
+	"\x04desc\x18\b \x01(\tR\x04desc\x12\x14\n" +
+	"\x05stack\x18\t \x01(\tR\x05stackBL\n" +
 	"\x12com.xray.proxy.tunP\x01Z#github.com/xtls/xray-core/proxy/tun\xaa\x02\x0eXray.Proxy.Tunb\x06proto3"
 
 var (

proxy/tun/config.proto

@@ -15,4 +15,5 @@ message Config {
   repeated string auto_system_routing_table = 6;
   string auto_outbounds_interface = 7;
   string desc = 8;
+  string stack = 9;
 }

proxy/tun/handler.go

@@ -123,7 +123,7 @@ func (t *Handler) Start() error {
 			iface := updater.Get()
 			if iface == nil {
 				errors.LogInfo(context.Background(), "[tun] falied to set interface > iface == nil")
-				return nil
+				return errors.New("iface not found")
 			}
 			return c.Control(func(fd uintptr) {
 				addrPort, _ := netip.ParseAddrPort(address)
@@ -143,7 +143,9 @@ func (t *Handler) Start() error {
 
 	tunStackOptions := StackOptions{
 		Tun:         tunInterface,
+		MTU:         t.config.MTU,
 		IdleTimeout: t.policyManager.ForLevel(t.config.UserLevel).Timeouts.ConnectionIdle,
+		Backend:     t.config.Stack,
 	}
 	tunStack, err := NewStack(t.ctx, tunStackOptions, t)
 	if err != nil {

proxy/tun/stack.go

@@ -1,7 +1,10 @@
 package tun
 
 import (
+	"context"
 	"time"
+
+	"github.com/xtls/xray-core/common/errors"
 )
 
 // Stack interface implement ip protocol stack, bridging raw network packets and data streams
@@ -13,5 +16,39 @@ type Stack interface {
 // StackOptions for the stack implementation
 type StackOptions struct {
 	Tun         Tun
+	MTU         uint32
 	IdleTimeout time.Duration
+	// Backend selects the concrete Stack implementation, see NewStack.
+	Backend string
+}
+
+const (
+	// StackGVisor selects the full-featured gVisor based stack (default).
+	StackGVisor = "gvisor"
+	// StackSystem selects the lightweight, Xray-native stack, see newSystemStack.
+	StackSystem = "system"
+)
+
+// NewStack builds the ip stack selected by options.Backend.
+//
+// gVisor (the default/"gvisor" backend) is a general purpose stack, built
+// with the semantics needed for a real, lossy public network in mind:
+// congestion control, SACK/RACK loss recovery, retransmission timers, etc.
+// TUN traffic instead travels over a local, kernel-to-userspace channel that
+// neither reorders nor drops packets in normal operation, so none of that
+// complexity is actually required to shuffle bytes between it and the
+// dispatcher. The "system" backend trades gVisor's generality for a much
+// smaller, more direct code path tailored to that trusted, in-order channel:
+// no congestion control, no SACK/RACK, minimal buffering, and a plain RTO
+// timer as a safety net for the rare real loss, rather than a full
+// re-implementation of one. See stack_system.go for details.
+func NewStack(ctx context.Context, options StackOptions, handler *Handler) (Stack, error) {
+	switch options.Backend {
+	case "", StackGVisor:
+		return newGVisorStack(ctx, options, handler)
+	case StackSystem:
+		return newSystemStack(ctx, options, handler)
+	default:
+		return nil, errors.New("unknown tun stack: ", options.Backend)
+	}
 }

proxy/tun/stack_gvisor.go

@@ -42,8 +42,8 @@ type stackGVisor struct {
 	endpoint    stack.LinkEndpoint
 }
 
-// NewStack builds new ip stack (using gVisor)
-func NewStack(ctx context.Context, options StackOptions, handler *Handler) (Stack, error) {
+// newGVisorStack builds new ip stack (using gVisor)
+func newGVisorStack(ctx context.Context, options StackOptions, handler *Handler) (Stack, error) {
 	gStack := &stackGVisor{
 		ctx:         ctx,
 		tun:         options.Tun,

proxy/tun/stack_system.go

@@ -0,0 +1,370 @@
+package tun
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+	"sync"
+	"time"
+
+	xerrors "github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
+	tunicmp "github.com/xtls/xray-core/proxy/tun/icmp"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/checksum"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/seqnum"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// stackSystem is the lightweight, Xray-native ip stack, see NewStack.
+//
+// It reads and parses IPv4/IPv6 packets directly off the tun device (through
+// the GVisorDevice interface, already implemented for every supported
+// platform), without involving gVisor's stack.Stack, NIC or routing
+// machinery. UDP and ICMP echo reuse the exact same handlers as the gVisor
+// backend (udpConnectionHandler, tun/icmp) since those were already
+// implemented in terms of raw bytes. TCP is handled by a small dedicated
+// state machine, see stack_system_tcp.go.
+type stackSystem struct {
+	ctx         context.Context
+	device      GVisorDevice
+	mtu         uint32
+	idleTimeout time.Duration
+	// handler is stored as the narrower ConnectionHandler interface (which
+	// *Handler satisfies) rather than *Handler itself, so the stack can be
+	// exercised in tests with a lightweight fake, the same way stack_system_test.go does.
+	handler ConnectionHandler
+
+	udp *udpConnectionHandler
+
+	tcpMu sync.Mutex
+	tcp   map[tcpKey]*tcpConn
+
+	cancel context.CancelFunc
+}
+
+const systemStackDefaultMTU = 1500
+
+// newSystemStack builds the lightweight "system" ip stack, see NewStack.
+func newSystemStack(ctx context.Context, options StackOptions, handler *Handler) (Stack, error) {
+	device, ok := options.Tun.(GVisorDevice)
+	if !ok {
+		return nil, xerrors.New("tun stack \"system\" is not supported by this tun device")
+	}
+	mtu := options.MTU
+	if mtu == 0 {
+		mtu = systemStackDefaultMTU
+	}
+	return &stackSystem{
+		ctx:         ctx,
+		device:      device,
+		mtu:         mtu,
+		idleTimeout: options.IdleTimeout,
+		handler:     handler,
+		tcp:         make(map[tcpKey]*tcpConn),
+	}, nil
+}
+
+// Start is called by Handler to bring the stack to life
+func (s *stackSystem) Start() error {
+	ctx, cancel := context.WithCancel(s.ctx)
+	s.cancel = cancel
+	s.udp = newUdpConnectionHandler(s.handler.HandleConnection, s.writeRawUDPPacket)
+
+	go s.dispatchLoop(ctx)
+	go s.idleReapLoop(ctx)
+	return nil
+}
+
+// Close is called by Handler to shut down the stack
+func (s *stackSystem) Close() error {
+	if s.cancel != nil {
+		s.cancel()
+	}
+
+	s.tcpMu.Lock()
+	conns := make([]*tcpConn, 0, len(s.tcp))
+	for _, c := range s.tcp {
+		conns = append(conns, c)
+	}
+	s.tcp = make(map[tcpKey]*tcpConn)
+	s.tcpMu.Unlock()
+
+	for _, c := range conns {
+		c.abort(errStackClosed)
+	}
+
+	return nil
+}
+
+// dispatchLoop reads and demultiplexes packets off the tun device, until ctx
+// is cancelled or the device fails permanently. It mirrors LinkEndpoint's own
+// dispatchLoop (stack_gvisor_endpoint.go), reusing the exact same GVisorDevice
+// contract, but hands packets to this file's own IPv4/IPv6 parsing instead of
+// gVisor's NIC/stack.Stack.
+func (s *stackSystem) dispatchLoop(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		version, packet, err := s.device.ReadPacket()
+		if err != nil {
+			if errors.Is(err, ErrQueueEmpty) {
+				s.device.Wait()
+				continue
+			}
+			return
+		}
+
+		s.handlePacket(version, packet)
+		packet.DecRef()
+	}
+}
+
+func (s *stackSystem) handlePacket(version byte, packet *stack.PacketBuffer) {
+	data := concatSlices(packet.AsSlices())
+	if len(data) == 0 {
+		return
+	}
+
+	switch version {
+	case 4:
+		s.handleIPv4(data)
+	case 6:
+		s.handleIPv6(data)
+	}
+}
+
+func concatSlices(slices [][]byte) []byte {
+	if len(slices) == 1 {
+		return slices[0]
+	}
+	total := 0
+	for _, sl := range slices {
+		total += len(sl)
+	}
+	if total == 0 {
+		return nil
+	}
+	data := make([]byte, 0, total)
+	for _, sl := range slices {
+		data = append(data, sl...)
+	}
+	return data
+}
+
+func (s *stackSystem) handleIPv4(data []byte) {
+	hdr := header.IPv4(data)
+	if !hdr.IsValid(len(data)) {
+		return
+	}
+	// fragmentation is not supported: the tun MTU is expected to keep locally
+	// generated packets from ever needing it, same as the gVisor backend's
+	// default configuration
+	if hdr.More() || hdr.FragmentOffset() != 0 {
+		return
+	}
+
+	s.handleTransport(header.IPv4ProtocolNumber, hdr.TransportProtocol(), hdr.SourceAddress(), hdr.DestinationAddress(), hdr.Payload())
+}
+
+func (s *stackSystem) handleIPv6(data []byte) {
+	hdr := header.IPv6(data)
+	if !hdr.IsValid(len(data)) {
+		return
+	}
+
+	// only directly-encapsulated transport headers are handled, IPv6
+	// extension headers (rare for ordinary locally generated traffic) are not
+	// walked, same limitation as the fragmentation one above
+	s.handleTransport(header.IPv6ProtocolNumber, hdr.TransportProtocol(), hdr.SourceAddress(), hdr.DestinationAddress(), hdr.Payload())
+}
+
+func (s *stackSystem) handleTransport(netProto tcpip.NetworkProtocolNumber, transProto tcpip.TransportProtocolNumber, srcIP, dstIP tcpip.Address, payload []byte) {
+	switch transProto {
+	case header.TCPProtocolNumber:
+		s.handleTCP(netProto, srcIP, dstIP, payload)
+	case header.UDPProtocolNumber:
+		s.handleUDP(netProto, srcIP, dstIP, payload)
+	case header.ICMPv4ProtocolNumber:
+		if netProto == header.IPv4ProtocolNumber {
+			s.handleICMP(netProto, srcIP, dstIP, payload)
+		}
+	case header.ICMPv6ProtocolNumber:
+		if netProto == header.IPv6ProtocolNumber {
+			s.handleICMP(netProto, srcIP, dstIP, payload)
+		}
+	}
+}
+
+func (s *stackSystem) handleUDP(netProto tcpip.NetworkProtocolNumber, srcIP, dstIP tcpip.Address, payload []byte) {
+	if len(payload) < header.UDPMinimumSize {
+		return
+	}
+	udpHdr := header.UDP(payload)
+	length := udpHdr.Length()
+	if int(length) < header.UDPMinimumSize || int(length) > len(payload) {
+		return
+	}
+
+	// source/destination of the packet we process as incoming are, in other terms,
+	// src is the side behind tun, dst is the side behind the dispatcher
+	src := net.UDPDestination(net.IPAddress(srcIP.AsSlice()), net.Port(udpHdr.SourcePort()))
+	dst := net.UDPDestination(net.IPAddress(dstIP.AsSlice()), net.Port(udpHdr.DestinationPort()))
+	s.udp.HandlePacket(src, dst, payload[header.UDPMinimumSize:length])
+}
+
+func (s *stackSystem) handleICMP(netProto tcpip.NetworkProtocolNumber, srcIP, dstIP tcpip.Address, message []byte) {
+	ident, sequence, ok := tunicmp.ParseEchoRequest(netProto, message)
+	if !ok {
+		return
+	}
+
+	reply, err := tunicmp.BuildLocalEchoReply(netProto, message, dstIP, srcIP)
+	if err != nil {
+		xerrors.LogInfoInner(s.ctx, err, "[tun] failed to build local icmp echo reply")
+		return
+	}
+
+	xerrors.LogDebug(s.ctx, "[tun][icmp] ", tunicmp.ProtocolLabel(netProto), " local echo reply ", dstIP, " -> ", srcIP, " id=", ident, " seq=", sequence)
+
+	transProto := header.ICMPv4ProtocolNumber
+	if netProto == header.IPv6ProtocolNumber {
+		transProto = header.ICMPv6ProtocolNumber
+	}
+	if err := s.writeTransportSegment(netProto, tcpip.TransportProtocolNumber(transProto), dstIP, srcIP, reply); err != nil {
+		xerrors.LogInfoInner(s.ctx, err, "[tun] failed to write local icmp echo reply")
+	}
+}
+
+func (s *stackSystem) writeRawUDPPacket(payload []byte, src net.Destination, dst net.Destination) error {
+	udpLen := header.UDPMinimumSize + len(payload)
+	srcIP := tcpip.AddrFromSlice(src.Address.IP())
+	dstIP := tcpip.AddrFromSlice(dst.Address.IP())
+
+	netProto := header.IPv4ProtocolNumber
+	if !dst.Address.Family().IsIPv4() {
+		netProto = header.IPv6ProtocolNumber
+	}
+
+	segment := make([]byte, udpLen)
+	udpHdr := header.UDP(segment)
+	udpHdr.Encode(&header.UDPFields{
+		SrcPort: uint16(src.Port),
+		DstPort: uint16(dst.Port),
+		Length:  uint16(udpLen),
+	})
+	copy(segment[header.UDPMinimumSize:], payload)
+
+	xsum := header.PseudoHeaderChecksum(header.UDPProtocolNumber, srcIP, dstIP, uint16(udpLen))
+	udpHdr.SetChecksum(^udpHdr.CalculateChecksum(checksum.Checksum(payload, xsum)))
+
+	return s.writeTransportSegment(netProto, header.UDPProtocolNumber, srcIP, dstIP, segment)
+}
+
+// writeTransportSegment wraps a fully built, already checksummed transport
+// layer segment (UDP, ICMP or TCP) with an IP header and writes it to the tun
+// device.
+func (s *stackSystem) writeTransportSegment(netProto tcpip.NetworkProtocolNumber, transProto tcpip.TransportProtocolNumber, srcIP, dstIP tcpip.Address, segment []byte) error {
+	ipHdrSize := header.IPv4MinimumSize
+	if netProto == header.IPv6ProtocolNumber {
+		ipHdrSize = header.IPv6MinimumSize
+	}
+
+	pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
+		ReserveHeaderBytes: ipHdrSize,
+		Payload:            buffer.MakeWithData(segment),
+	})
+	defer pkt.DecRef()
+
+	if netProto == header.IPv4ProtocolNumber {
+		ipHdr := header.IPv4(pkt.NetworkHeader().Push(header.IPv4MinimumSize))
+		ipHdr.Encode(&header.IPv4Fields{
+			TotalLength: uint16(header.IPv4MinimumSize + len(segment)),
+			TTL:         64,
+			Protocol:    uint8(transProto),
+			SrcAddr:     srcIP,
+			DstAddr:     dstIP,
+		})
+		ipHdr.SetChecksum(^ipHdr.CalculateChecksum())
+	} else {
+		ipHdr := header.IPv6(pkt.NetworkHeader().Push(header.IPv6MinimumSize))
+		ipHdr.Encode(&header.IPv6Fields{
+			PayloadLength:     uint16(len(segment)),
+			TransportProtocol: transProto,
+			HopLimit:          64,
+			SrcAddr:           srcIP,
+			DstAddr:           dstIP,
+		})
+	}
+
+	if err := s.device.WritePacket(pkt); err != nil {
+		return xerrors.New("failed to write raw packet: ", err.String())
+	}
+	return nil
+}
+
+// idleReapLoop periodically aborts tcp connections that have seen no traffic
+// for longer than idleTimeout, finally putting that option to use (it was
+// tracked but never read anywhere before the "system" backend existed).
+func (s *stackSystem) idleReapLoop(ctx context.Context) {
+	if s.idleTimeout <= 0 {
+		return
+	}
+	interval := s.idleTimeout / 4
+	if interval < time.Second {
+		interval = time.Second
+	}
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.reapIdleConnections()
+		}
+	}
+}
+
+func (s *stackSystem) reapIdleConnections() {
+	deadline := time.Now().Add(-s.idleTimeout)
+
+	s.tcpMu.Lock()
+	var idle []*tcpConn
+	for _, c := range s.tcp {
+		if c.lastActiveTime().Before(deadline) {
+			idle = append(idle, c)
+		}
+	}
+	s.tcpMu.Unlock()
+
+	for _, c := range idle {
+		c.abort(errConnIdleTimeout)
+	}
+}
+
+func (s *stackSystem) removeTCPConn(key tcpKey, c *tcpConn) {
+	s.tcpMu.Lock()
+	if existing, ok := s.tcp[key]; ok && existing == c {
+		delete(s.tcp, key)
+	}
+	s.tcpMu.Unlock()
+}
+
+// randomSequenceNumber returns a random initial sequence number for a new
+// connection. It doesn't need to be cryptographically unpredictable (the tun
+// channel is local and trusted), just varied enough to avoid confusion with
+// prior incarnations of the same 4-tuple.
+func randomSequenceNumber() seqnum.Value {
+	var b [4]byte
+	_, _ = rand.Read(b[:])
+	return seqnum.Value(binary.BigEndian.Uint32(b[:]))
+}

proxy/tun/stack_system_tcp.go

@@ -0,0 +1,725 @@
+package tun
+
+import (
+	"io"
+	"sync"
+	"time"
+
+	xerrors "github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/checksum"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/seqnum"
+)
+
+// This file implements a small, dedicated TCP state machine for the "system"
+// tun stack, see stack_system.go. It intentionally does not implement window
+// scaling, SACK, timestamps, congestion control, fast retransmit or
+// out-of-order reassembly: the tun channel only ever carries packets produced
+// by the local OS network stack and handed to us directly, so it neither
+// reorders nor drops them the way the public internet does; a single RTO
+// timer (also used for zero-window probing) is enough to make the connection
+// robust against the rare occasions a segment does not make it through.
+const (
+	minRTO         = 300 * time.Millisecond
+	maxRTO         = 30 * time.Second
+	maxRTORetries  = 12
+	lingerDuration = 5 * time.Second
+
+	// maxSendBuffer/maxRecvBuffer match the gVisor backend's own default
+	// buffer sizes (tcp.DefaultSendBufferSize/DefaultReceiveBufferSize), so
+	// switching between backends does not change buffering expectations.
+	maxSendBuffer = 1 << 20
+	maxRecvBuffer = 1 << 20
+)
+
+var (
+	errStackClosed     = xerrors.New("tun stack closed")
+	errConnReset       = xerrors.New("connection reset by peer")
+	errConnClosed      = xerrors.New("use of closed network connection")
+	errConnIdleTimeout = xerrors.New("connection idle timeout")
+	errConnTimedOut    = xerrors.New("connection timed out")
+)
+
+type tcpState uint8
+
+const (
+	stateSynRcvd tcpState = iota
+	stateEstablished
+	stateCloseWait // peer's FIN was received; we may still send until we close too
+	stateClosing   // our FIN was sent (from Established or CloseWait)
+	stateTimeWait  // both FINs exchanged and acked; short linger before removal
+	stateClosed    // terminal, removed from the connection table
+)
+
+// tcpKey identifies a tcp connection the same way it appears on the wire
+// flowing from the app behind the tun device towards its destination.
+type tcpKey struct {
+	netProto tcpip.NetworkProtocolNumber
+	srcAddr  tcpip.Address
+	srcPort  uint16
+	dstAddr  tcpip.Address
+	dstPort  uint16
+}
+
+// tcpConn is a minimal TCP endpoint implementing net.Conn. It deliberately
+// exposes only plain Read/Write (never ReadMultiBuffer/WriteMultiBuffer) so
+// that stat.CounterConnection in handler.go keeps accounting traffic
+// correctly, matching the udpConn precedent in udp_fullcone.go.
+type tcpConn struct {
+	stack *stackSystem
+	key   tcpKey
+	src   net.Destination
+	dst   net.Destination
+
+	ourMSS int
+
+	mu   sync.Mutex
+	cond *sync.Cond
+
+	state tcpState
+
+	// send side. sendQueue[0] always holds the byte at sequence sndUna: acked
+	// bytes are trimmed off the front, so no separate "acked" bookkeeping is
+	// needed. sendQueue[:unsentOffset] has been transmitted at least once;
+	// sendQueue[unsentOffset:] never has.
+	iss          seqnum.Value
+	sndUna       seqnum.Value
+	sndNxt       seqnum.Value
+	sndMSS       int
+	peerWindow   uint32
+	sendQueue    []byte
+	unsentOffset int
+	closeCalled  bool
+	finSent      bool
+	finAcked     bool
+	finSeq       seqnum.Value
+
+	// receive side.
+	irs          seqnum.Value
+	rcvNxt       seqnum.Value
+	recvQueue    [][]byte
+	recvOffset   int
+	recvBuffered int
+	recvClosed   bool
+
+	err error
+
+	lastActive time.Time
+
+	rtoTimer    *time.Timer
+	rtoBackoff  int
+	lingerTimer *time.Timer
+}
+
+var _ net.Conn = (*tcpConn)(nil)
+
+// outgoingMSS returns the MSS we can use without ever needing IP
+// fragmentation (unsupported), given the tun device's MTU.
+func outgoingMSS(mtu uint32, netProto tcpip.NetworkProtocolNumber) int {
+	ipHdrSize := header.IPv4MinimumSize
+	if netProto == header.IPv6ProtocolNumber {
+		ipHdrSize = header.IPv6MinimumSize
+	}
+	mss := int(mtu) - ipHdrSize - header.TCPMinimumSize
+	const minMSS = 88
+	if mss < minMSS {
+		mss = minMSS
+	}
+	return mss
+}
+
+// handleTCP is the tcp entry point from stackSystem.handleTransport.
+func (s *stackSystem) handleTCP(netProto tcpip.NetworkProtocolNumber, srcIP, dstIP tcpip.Address, payload []byte) {
+	if len(payload) < header.TCPMinimumSize {
+		return
+	}
+	tcpHdr := header.TCP(payload)
+	if _, _, ok := header.TCPValid(tcpHdr, nil, 0, tcpip.Address{}, tcpip.Address{}, true); !ok {
+		return
+	}
+
+	key := tcpKey{
+		netProto: netProto,
+		srcAddr:  srcIP,
+		srcPort:  tcpHdr.SourcePort(),
+		dstAddr:  dstIP,
+		dstPort:  tcpHdr.DestinationPort(),
+	}
+
+	s.tcpMu.Lock()
+	conn, ok := s.tcp[key]
+	s.tcpMu.Unlock()
+
+	if ok {
+		conn.handleSegment(tcpHdr)
+		return
+	}
+
+	flags := tcpHdr.Flags()
+	if flags&header.TCPFlagRst != 0 {
+		return // never generate a reset in response to a reset
+	}
+	if flags&header.TCPFlagSyn != 0 && flags&header.TCPFlagAck == 0 {
+		s.newTCPConn(key, tcpHdr)
+		return
+	}
+
+	// any other segment referencing an unknown connection: let the peer know
+	// promptly it no longer/never existed, same as a real kernel would
+	s.sendRawTCPReset(key, tcpHdr)
+}
+
+func (s *stackSystem) newTCPConn(key tcpKey, tcpHdr header.TCP) {
+	synOpts := header.ParseSynOptions(tcpHdr.Options(), false)
+
+	c := &tcpConn{
+		stack: s,
+		key:   key,
+		src:   net.TCPDestination(net.IPAddress(key.srcAddr.AsSlice()), net.Port(key.srcPort)),
+		dst:   net.TCPDestination(net.IPAddress(key.dstAddr.AsSlice()), net.Port(key.dstPort)),
+		state: stateSynRcvd,
+	}
+	c.cond = sync.NewCond(&c.mu)
+
+	c.iss = randomSequenceNumber()
+	c.sndUna = c.iss
+	c.sndNxt = c.iss.Add(1)
+
+	c.irs = seqnum.Value(tcpHdr.SequenceNumber())
+	c.rcvNxt = c.irs.Add(1)
+
+	c.ourMSS = outgoingMSS(s.mtu, key.netProto)
+	c.sndMSS = int(synOpts.MSS)
+	if c.sndMSS <= 0 || c.sndMSS > c.ourMSS {
+		c.sndMSS = c.ourMSS
+	}
+	c.lastActive = time.Now()
+
+	s.tcpMu.Lock()
+	s.tcp[key] = c
+	s.tcpMu.Unlock()
+
+	c.mu.Lock()
+	c.sendSynAckLocked()
+	c.mu.Unlock()
+}
+
+// sendRawTCPReset replies to a segment that does not match any known
+// connection, following the rules of RFC 9293 §3.10.7.1.
+func (s *stackSystem) sendRawTCPReset(key tcpKey, tcpHdr header.TCP) {
+	flags := tcpHdr.Flags()
+	segLen := seqnum.Size(len(tcpHdr.Payload()))
+	if flags&header.TCPFlagSyn != 0 {
+		segLen++
+	}
+	if flags&header.TCPFlagFin != 0 {
+		segLen++
+	}
+
+	var seq, ack seqnum.Value
+	var ackFlag header.TCPFlags
+	if flags&header.TCPFlagAck != 0 {
+		seq = seqnum.Value(tcpHdr.AckNumber())
+	} else {
+		ack = seqnum.Value(tcpHdr.SequenceNumber()).Add(segLen)
+		ackFlag = header.TCPFlagAck
+	}
+
+	segment := make([]byte, header.TCPMinimumSize)
+	rst := header.TCP(segment)
+	rst.Encode(&header.TCPFields{
+		SrcPort:    key.dstPort,
+		DstPort:    key.srcPort,
+		SeqNum:     uint32(seq),
+		AckNum:     uint32(ack),
+		DataOffset: header.TCPMinimumSize,
+		Flags:      header.TCPFlagRst | ackFlag,
+		WindowSize: 0,
+	})
+	xsum := header.PseudoHeaderChecksum(header.TCPProtocolNumber, key.dstAddr, key.srcAddr, uint16(len(segment)))
+	rst.SetChecksum(^rst.CalculateChecksum(xsum))
+
+	if err := s.writeTransportSegment(key.netProto, header.TCPProtocolNumber, key.dstAddr, key.srcAddr, segment); err != nil {
+		xerrors.LogInfoInner(s.ctx, err, "[tun] failed to write tcp reset")
+	}
+}
+
+func (c *tcpConn) lastActiveTime() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.lastActive
+}
+
+// abort is the externally callable (unlocked) equivalent of abortLocked,
+// used by the idle reaper and by Close's callers indirectly through it.
+func (c *tcpConn) abort(err error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.abortLocked(err)
+}
+
+func (c *tcpConn) abortLocked(err error) {
+	if c.state == stateClosed {
+		return
+	}
+	c.state = stateClosed
+	c.stopRTOLocked()
+	c.stopLingerLocked()
+	c.err = err
+	c.cond.Broadcast()
+	// deliberately does not send an RST: if the peer sends anything else for
+	// this connection later, it will miss the (now removed) table entry and
+	// get a fresh, correctly-addressed reset from sendRawTCPReset above.
+	c.stack.removeTCPConn(c.key, c)
+}
+
+// handleSegment processes one already-demultiplexed incoming segment.
+func (c *tcpConn) handleSegment(tcpHdr header.TCP) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.state == stateClosed {
+		return
+	}
+	c.lastActive = time.Now()
+
+	flags := tcpHdr.Flags()
+
+	if flags&header.TCPFlagRst != 0 {
+		c.abortLocked(errConnReset)
+		return
+	}
+
+	if c.state == stateSynRcvd {
+		c.handleSynRcvdSegmentLocked(tcpHdr)
+		return
+	}
+
+	if flags&header.TCPFlagSyn != 0 {
+		// unexpected SYN on an already-established connection is not
+		// modeled; treat it like the peer abandoned and reset it
+		c.abortLocked(errConnReset)
+		return
+	}
+
+	if flags&header.TCPFlagAck != 0 {
+		c.handleAckLocked(seqnum.Value(tcpHdr.AckNumber()), tcpHdr.WindowSize())
+	}
+
+	c.acceptInOrderLocked(seqnum.Value(tcpHdr.SequenceNumber()), tcpHdr.Payload(), flags&header.TCPFlagFin != 0)
+}
+
+func (c *tcpConn) handleSynRcvdSegmentLocked(tcpHdr header.TCP) {
+	flags := tcpHdr.Flags()
+
+	if flags&header.TCPFlagSyn != 0 {
+		// peer's retransmission of the original SYN, our SYN-ACK likely
+		// hasn't reached them yet: resend it and rely entirely on their own
+		// retransmission timer rather than running one on our side too
+		c.sendSynAckLocked()
+		return
+	}
+	if flags&header.TCPFlagAck == 0 {
+		return
+	}
+	if seqnum.Value(tcpHdr.AckNumber()) != c.sndNxt {
+		// does not acknowledge our SYN correctly; a well-behaved peer will
+		// simply retry, so it is safe to just ignore this segment
+		return
+	}
+
+	c.state = stateEstablished
+	go c.stack.handler.HandleConnection(c, c.dst)
+
+	c.handleAckLocked(seqnum.Value(tcpHdr.AckNumber()), tcpHdr.WindowSize())
+	c.acceptInOrderLocked(seqnum.Value(tcpHdr.SequenceNumber()), tcpHdr.Payload(), flags&header.TCPFlagFin != 0)
+}
+
+// acceptInOrderLocked handles the data/FIN portion of a segment once it is
+// known to be neither a SYN nor a RST. Only strictly in-order segments are
+// accepted; anything else is dropped (relying on the peer's retransmission)
+// since the tun channel is expected to already deliver packets in order.
+func (c *tcpConn) acceptInOrderLocked(seq seqnum.Value, payload []byte, fin bool) {
+	if seq != c.rcvNxt {
+		c.sendAckLocked()
+		return
+	}
+
+	accept := payload
+	if room := c.recvWindowLocked(); uint32(len(accept)) > room {
+		accept = accept[:room]
+	}
+	if len(accept) > 0 {
+		c.enqueueRecvLocked(accept)
+		c.rcvNxt = c.rcvNxt.Add(seqnum.Size(len(accept)))
+	}
+
+	finAccepted := false
+	if fin && len(accept) == len(payload) {
+		c.onFinLocked()
+		c.rcvNxt = c.rcvNxt.Add(1)
+		finAccepted = true
+	}
+
+	if len(accept) > 0 || finAccepted || len(accept) < len(payload) {
+		c.sendAckLocked()
+	}
+}
+
+func (c *tcpConn) onFinLocked() {
+	if c.recvClosed {
+		return
+	}
+	c.recvClosed = true
+	c.cond.Broadcast()
+	if c.state == stateEstablished {
+		c.state = stateCloseWait
+	}
+	c.maybeFinishCloseLocked()
+}
+
+func (c *tcpConn) handleAckLocked(ackNum seqnum.Value, windowSize uint16) {
+	if ackNum.LessThan(c.sndUna) {
+		// old/duplicate ack: no fast-retransmit heuristics implemented
+		c.peerWindow = uint32(windowSize)
+		c.trySendLocked()
+		return
+	}
+	if c.sndNxt.LessThan(ackNum) {
+		// acknowledges more than we ever sent: lenient clamp instead of
+		// rejecting the segment outright
+		ackNum = c.sndNxt
+	}
+
+	if advanced := c.sndUna.Size(ackNum); advanced > 0 {
+		c.sndUna = ackNum
+		n := int(advanced)
+		if n > len(c.sendQueue) {
+			n = len(c.sendQueue)
+		}
+		c.sendQueue = c.sendQueue[n:]
+		c.unsentOffset -= n
+		if c.unsentOffset < 0 {
+			c.unsentOffset = 0
+		}
+		c.rtoBackoff = 0
+		if c.finSent && c.sndUna == c.sndNxt {
+			c.finAcked = true
+		}
+		c.cond.Broadcast()
+	}
+
+	c.peerWindow = uint32(windowSize)
+	c.trySendLocked()
+	c.maybeFinishCloseLocked()
+}
+
+func (c *tcpConn) maybeFinishCloseLocked() {
+	if c.state == stateClosing && c.finAcked && c.recvClosed {
+		c.state = stateTimeWait
+		c.startLingerLocked()
+	}
+}
+
+func (c *tcpConn) recvWindowLocked() uint32 {
+	room := maxRecvBuffer - c.recvBuffered
+	if room < 0 {
+		room = 0
+	}
+	if room > 0xffff {
+		room = 0xffff
+	}
+	return uint32(room)
+}
+
+func (c *tcpConn) enqueueRecvLocked(payload []byte) {
+	data := make([]byte, len(payload))
+	copy(data, payload)
+	c.recvQueue = append(c.recvQueue, data)
+	c.recvBuffered += len(data)
+	c.cond.Broadcast()
+}
+
+// sendOneChunkLocked transmits up to maxLen bytes of never-yet-sent data (if
+// any remains), advancing sndNxt/unsentOffset. It returns the number of
+// bytes sent, 0 if none remained.
+func (c *tcpConn) sendOneChunkLocked(maxLen int) int {
+	remaining := len(c.sendQueue) - c.unsentOffset
+	if remaining <= 0 {
+		return 0
+	}
+	if maxLen > remaining {
+		maxLen = remaining
+	}
+	if maxLen > c.sndMSS {
+		maxLen = c.sndMSS
+	}
+	if maxLen <= 0 {
+		return 0
+	}
+	data := c.sendQueue[c.unsentOffset : c.unsentOffset+maxLen]
+	c.sendDataSegmentLocked(c.sndNxt, data, false)
+	c.sndNxt = c.sndNxt.Add(seqnum.Size(maxLen))
+	c.unsentOffset += maxLen
+	return maxLen
+}
+
+func (c *tcpConn) trySendLocked() {
+	switch c.state {
+	case stateSynRcvd, stateTimeWait, stateClosed:
+		return
+	}
+
+	for {
+		inFlight := int(c.sndUna.Size(c.sndNxt))
+		windowLeft := int(c.peerWindow) - inFlight
+		if windowLeft <= 0 {
+			break
+		}
+		if c.sendOneChunkLocked(windowLeft) == 0 {
+			break
+		}
+	}
+
+	if c.closeCalled && !c.finSent && c.unsentOffset == len(c.sendQueue) {
+		c.finSeq = c.sndNxt
+		c.sendDataSegmentLocked(c.finSeq, nil, true)
+		c.sndNxt = c.sndNxt.Add(1)
+		c.finSent = true
+	}
+
+	c.refreshRTOLocked()
+}
+
+func (c *tcpConn) outstandingLocked() bool {
+	if c.unsentOffset > 0 {
+		return true // already-transmitted data pending ack
+	}
+	if len(c.sendQueue) > c.unsentOffset && c.peerWindow == 0 {
+		return true // blocked purely by a zero window; need to probe
+	}
+	if c.finSent && !c.finAcked {
+		return true // FIN transmitted but not yet acked
+	}
+	return false
+}
+
+func (c *tcpConn) refreshRTOLocked() {
+	if c.outstandingLocked() {
+		c.scheduleRTOLocked()
+	} else {
+		c.stopRTOLocked()
+	}
+}
+
+func (c *tcpConn) rtoDurationLocked() time.Duration {
+	d := minRTO * time.Duration(uint64(1)<<uint(c.rtoBackoff))
+	if d > maxRTO || d <= 0 {
+		d = maxRTO
+	}
+	return d
+}
+
+func (c *tcpConn) scheduleRTOLocked() {
+	d := c.rtoDurationLocked()
+	if c.rtoTimer == nil {
+		c.rtoTimer = time.AfterFunc(d, c.onRTOTimerFired)
+	} else {
+		c.rtoTimer.Reset(d)
+	}
+}
+
+func (c *tcpConn) stopRTOLocked() {
+	if c.rtoTimer != nil {
+		c.rtoTimer.Stop()
+	}
+}
+
+func (c *tcpConn) onRTOTimerFired() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.onRTOFireLocked()
+}
+
+func (c *tcpConn) onRTOFireLocked() {
+	if c.state == stateClosed || !c.outstandingLocked() {
+		return
+	}
+	if c.rtoBackoff >= maxRTORetries {
+		c.abortLocked(errConnTimedOut)
+		return
+	}
+	c.rtoBackoff++
+
+	switch {
+	case c.unsentOffset > 0:
+		c.sendDataSegmentLocked(c.sndUna, c.sendQueue[:c.unsentOffset], false)
+	case len(c.sendQueue) > c.unsentOffset:
+		// nothing in flight, but blocked by a zero peer window: probe with
+		// exactly one new byte, per RFC 9293 §3.8.6.1
+		c.sendOneChunkLocked(1)
+	case c.finSent && !c.finAcked:
+		c.sendDataSegmentLocked(c.finSeq, nil, true)
+	}
+
+	c.refreshRTOLocked()
+}
+
+func (c *tcpConn) startLingerLocked() {
+	c.stopRTOLocked()
+	c.lingerTimer = time.AfterFunc(lingerDuration, func() {
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		c.abortLocked(errConnClosed)
+	})
+}
+
+func (c *tcpConn) stopLingerLocked() {
+	if c.lingerTimer != nil {
+		c.lingerTimer.Stop()
+	}
+}
+
+// transmitLocked builds, checksums and writes a single tcp segment.
+func (c *tcpConn) transmitLocked(seq, ack seqnum.Value, flags header.TCPFlags, payload []byte, options []byte) {
+	headerLen := header.TCPMinimumSize + len(options)
+	segment := make([]byte, headerLen+len(payload))
+	tcpHdr := header.TCP(segment)
+	tcpHdr.Encode(&header.TCPFields{
+		SrcPort:    c.key.dstPort,
+		DstPort:    c.key.srcPort,
+		SeqNum:     uint32(seq),
+		AckNum:     uint32(ack),
+		DataOffset: uint8(headerLen),
+		Flags:      flags,
+		WindowSize: uint16(c.recvWindowLocked()),
+	})
+	copy(tcpHdr.Options(), options)
+	copy(segment[headerLen:], payload)
+
+	xsum := header.PseudoHeaderChecksum(header.TCPProtocolNumber, c.key.dstAddr, c.key.srcAddr, uint16(len(segment)))
+	xsum = checksum.Checksum(payload, xsum)
+	tcpHdr.SetChecksum(^tcpHdr.CalculateChecksum(xsum))
+
+	if err := c.stack.writeTransportSegment(c.key.netProto, header.TCPProtocolNumber, c.key.dstAddr, c.key.srcAddr, segment); err != nil {
+		xerrors.LogInfoInner(c.stack.ctx, err, "[tun] failed to write tcp segment")
+	}
+}
+
+func (c *tcpConn) sendSynAckLocked() {
+	var optBuf [header.TCPOptionMSSLength]byte
+	n := header.EncodeMSSOption(uint32(c.ourMSS), optBuf[:])
+	c.transmitLocked(c.iss, c.rcvNxt, header.TCPFlagSyn|header.TCPFlagAck, nil, optBuf[:n])
+}
+
+func (c *tcpConn) sendAckLocked() {
+	c.transmitLocked(c.sndNxt, c.rcvNxt, header.TCPFlagAck, nil, nil)
+}
+
+func (c *tcpConn) sendDataSegmentLocked(seq seqnum.Value, payload []byte, fin bool) {
+	flags := header.TCPFlagAck
+	if fin {
+		flags |= header.TCPFlagFin
+	}
+	c.transmitLocked(seq, c.rcvNxt, flags, payload, nil)
+}
+
+// Read implements net.Conn.
+func (c *tcpConn) Read(p []byte) (int, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for len(c.recvQueue) == 0 && c.err == nil && !c.recvClosed {
+		c.cond.Wait()
+	}
+	if c.err != nil {
+		return 0, c.err
+	}
+	if len(c.recvQueue) == 0 {
+		return 0, io.EOF
+	}
+
+	before := c.recvWindowLocked()
+
+	chunk := c.recvQueue[0]
+	n := copy(p, chunk[c.recvOffset:])
+	c.recvOffset += n
+	c.recvBuffered -= n
+	if c.recvOffset == len(chunk) {
+		c.recvQueue = c.recvQueue[1:]
+		c.recvOffset = 0
+	}
+
+	// let the peer know promptly if reading just freed up a previously
+	// exhausted window, instead of waiting for it to probe us for an update
+	if after := c.recvWindowLocked(); before == 0 && after > 0 {
+		c.sendAckLocked()
+	}
+
+	return n, nil
+}
+
+// Write implements net.Conn.
+func (c *tcpConn) Write(p []byte) (int, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.closeCalled {
+		return 0, errConnClosed
+	}
+
+	total := 0
+	for total < len(p) {
+		if c.err != nil {
+			return total, c.err
+		}
+		if c.closeCalled {
+			return total, errConnClosed
+		}
+		room := maxSendBuffer - len(c.sendQueue)
+		if room <= 0 {
+			c.cond.Wait()
+			continue
+		}
+		n := len(p) - total
+		if n > room {
+			n = room
+		}
+		c.sendQueue = append(c.sendQueue, p[total:total+n]...)
+		total += n
+	}
+
+	c.trySendLocked()
+	return total, nil
+}
+
+// Close implements net.Conn.
+func (c *tcpConn) Close() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.closeCalled {
+		return nil
+	}
+	c.closeCalled = true
+	c.cond.Broadcast()
+
+	switch c.state {
+	case stateEstablished, stateCloseWait:
+		c.state = stateClosing
+	default:
+		return nil
+	}
+
+	c.trySendLocked()
+	return nil
+}
+
+func (c *tcpConn) LocalAddr() net.Addr  { return c.dst.RawNetAddr() }
+func (c *tcpConn) RemoteAddr() net.Addr { return c.src.RawNetAddr() }
+
+func (c *tcpConn) SetDeadline(t time.Time) error      { return nil }
+func (c *tcpConn) SetReadDeadline(t time.Time) error  { return nil }
+func (c *tcpConn) SetWriteDeadline(t time.Time) error { return nil }

proxy/tun/stack_system_test.go

@@ -0,0 +1,448 @@
+package tun
+
+import (
+	"context"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/xtls/xray-core/common/net"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/checksum"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// fakeGVisorDevice is an in-memory GVisorDevice used to script conversations
+// with the "system" stack without any real tun device or privileges.
+type fakeGVisorDevice struct {
+	inbound  chan []byte
+	outbound chan []byte
+	notify   chan struct{}
+}
+
+func newFakeGVisorDevice() *fakeGVisorDevice {
+	return &fakeGVisorDevice{
+		inbound:  make(chan []byte, 256),
+		outbound: make(chan []byte, 256),
+		notify:   make(chan struct{}, 1),
+	}
+}
+
+func (d *fakeGVisorDevice) push(data []byte) {
+	d.inbound <- data
+	select {
+	case d.notify <- struct{}{}:
+	default:
+	}
+}
+
+func (d *fakeGVisorDevice) ReadPacket() (byte, *stack.PacketBuffer, error) {
+	select {
+	case data := <-d.inbound:
+		version := data[0] >> 4
+		pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{Payload: buffer.MakeWithData(data)})
+		return version, pkt, nil
+	default:
+		return 0, nil, ErrQueueEmpty
+	}
+}
+
+func (d *fakeGVisorDevice) WritePacket(packet *stack.PacketBuffer) tcpip.Error {
+	var data []byte
+	for _, s := range packet.AsSlices() {
+		data = append(data, s...)
+	}
+	d.outbound <- data
+	return nil
+}
+
+func (d *fakeGVisorDevice) Wait() {
+	select {
+	case <-d.notify:
+	case <-time.After(20 * time.Millisecond):
+	}
+}
+
+func (d *fakeGVisorDevice) recv(t *testing.T, timeout time.Duration) []byte {
+	t.Helper()
+	select {
+	case data := <-d.outbound:
+		return data
+	case <-time.After(timeout):
+		t.Fatal("timed out waiting for outbound packet")
+		return nil
+	}
+}
+
+var _ GVisorDevice = (*fakeGVisorDevice)(nil)
+
+// echoHandler is a ConnectionHandler that echoes back everything it reads on
+// each connection, and records connections/destinations it has seen.
+type echoHandler struct {
+	mu    sync.Mutex
+	conns []net.Conn
+	dests []net.Destination
+	done  chan struct{}
+}
+
+func newEchoHandler() *echoHandler {
+	return &echoHandler{done: make(chan struct{}, 8)}
+}
+
+func (h *echoHandler) HandleConnection(conn net.Conn, dest net.Destination) {
+	h.mu.Lock()
+	h.conns = append(h.conns, conn)
+	h.dests = append(h.dests, dest)
+	h.mu.Unlock()
+
+	_, _ = io.Copy(conn, conn)
+	_ = conn.Close()
+	h.done <- struct{}{}
+}
+
+func newTestStackSystem(device GVisorDevice, handler ConnectionHandler, idleTimeout time.Duration) (*stackSystem, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(context.Background())
+	s := &stackSystem{
+		ctx:         ctx,
+		device:      device,
+		mtu:         1500,
+		idleTimeout: idleTimeout,
+		handler:     handler,
+		tcp:         make(map[tcpKey]*tcpConn),
+	}
+	return s, cancel
+}
+
+func testIP(s string) tcpip.Address {
+	return tcpip.AddrFrom4Slice(net.ParseIP(s).To4())
+}
+
+const (
+	testPeerIP   = "10.0.0.2"
+	testTargetIP = "10.0.0.1"
+	testPeerPort = uint16(51234)
+	testDstPort  = uint16(8080)
+)
+
+// buildIPv4TCP builds a raw IPv4+TCP segment, computing valid checksums.
+func buildIPv4TCP(src, dst tcpip.Address, srcPort, dstPort uint16, seq, ack uint32, flags header.TCPFlags, window uint16, payload []byte, options []byte) []byte {
+	headerLen := header.TCPMinimumSize + len(options)
+	totalLen := header.IPv4MinimumSize + headerLen + len(payload)
+	data := make([]byte, totalLen)
+
+	ipHdr := header.IPv4(data)
+	ipHdr.Encode(&header.IPv4Fields{
+		TotalLength: uint16(totalLen),
+		TTL:         64,
+		Protocol:    uint8(header.TCPProtocolNumber),
+		SrcAddr:     src,
+		DstAddr:     dst,
+	})
+	ipHdr.SetChecksum(^ipHdr.CalculateChecksum())
+
+	tcpHdr := header.TCP(data[header.IPv4MinimumSize:])
+	tcpHdr.Encode(&header.TCPFields{
+		SrcPort:    srcPort,
+		DstPort:    dstPort,
+		SeqNum:     seq,
+		AckNum:     ack,
+		DataOffset: uint8(headerLen),
+		Flags:      flags,
+		WindowSize: window,
+	})
+	copy(tcpHdr.Options(), options)
+	copy(data[header.IPv4MinimumSize+headerLen:], payload)
+
+	xsum := header.PseudoHeaderChecksum(header.TCPProtocolNumber, src, dst, uint16(headerLen+len(payload)))
+	xsum = checksum.Checksum(payload, xsum)
+	tcpHdr.SetChecksum(^tcpHdr.CalculateChecksum(xsum))
+
+	return data
+}
+
+func parseIPv4TCP(t *testing.T, data []byte) header.TCP {
+	t.Helper()
+	ipHdr := header.IPv4(data)
+	if !ipHdr.IsValid(len(data)) {
+		t.Fatalf("invalid ipv4 packet")
+	}
+	return header.TCP(ipHdr.Payload())
+}
+
+func TestSystemStackTCPHandshakeEchoClose(t *testing.T) {
+	device := newFakeGVisorDevice()
+	handler := newEchoHandler()
+	s, cancel := newTestStackSystem(device, handler, time.Minute)
+	defer cancel()
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer s.Close()
+
+	src := testIP(testPeerIP)
+	dst := testIP(testTargetIP)
+
+	iss := uint32(1000)
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss, 0, header.TCPFlagSyn, 65535, nil, nil))
+
+	synAck := parseIPv4TCP(t, device.recv(t, time.Second))
+	if synAck.Flags() != header.TCPFlagSyn|header.TCPFlagAck {
+		t.Fatalf("expected SYN-ACK, got flags %v", synAck.Flags())
+	}
+	if synAck.AckNumber() != iss+1 {
+		t.Fatalf("unexpected ack number %d, want %d", synAck.AckNumber(), iss+1)
+	}
+	serverISS := synAck.SequenceNumber()
+
+	// final handshake ACK
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss+1, serverISS+1, header.TCPFlagAck, 65535, nil, nil))
+
+	// send data
+	payload := []byte("hello world")
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss+1, serverISS+1, header.TCPFlagAck|header.TCPFlagPsh, 65535, payload, nil))
+
+	// drain outbound packets until the full echo has been observed, acking
+	// any data segments as they arrive so the connection can make progress
+	var echoed []byte
+	deadline := time.After(2 * time.Second)
+	for len(echoed) < len(payload) {
+		select {
+		case raw := <-device.outbound:
+			tcpHdr := parseIPv4TCP(t, raw)
+			if len(tcpHdr.Payload()) > 0 {
+				echoed = append(echoed, tcpHdr.Payload()...)
+				device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort,
+					iss+1+uint32(len(payload)), tcpHdr.SequenceNumber()+uint32(len(tcpHdr.Payload())),
+					header.TCPFlagAck, 65535, nil, nil))
+			}
+		case <-deadline:
+			t.Fatalf("timed out waiting for echo, got %q so far", echoed)
+		}
+	}
+	if string(echoed) != string(payload) {
+		t.Fatalf("echo mismatch: got %q want %q", echoed, payload)
+	}
+
+	h := handler
+	h.mu.Lock()
+	if len(h.dests) != 1 || h.dests[0].NetAddr() != "10.0.0.1:8080" {
+		t.Fatalf("unexpected destination recorded: %+v", h.dests)
+	}
+	h.mu.Unlock()
+
+	// peer sends FIN
+	finSeq := iss + 1 + uint32(len(payload))
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, finSeq, serverISS+1+uint32(len(payload)), header.TCPFlagFin|header.TCPFlagAck, 65535, nil, nil))
+
+	select {
+	case <-handler.done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("echo handler never finished after peer FIN")
+	}
+
+	var sawAckOfFin, sawOurFin bool
+	var ourFinSeq uint32
+	deadline = time.After(2 * time.Second)
+	for !sawAckOfFin || !sawOurFin {
+		select {
+		case raw := <-device.outbound:
+			tcpHdr := parseIPv4TCP(t, raw)
+			if tcpHdr.Flags()&header.TCPFlagFin != 0 {
+				sawOurFin = true
+				ourFinSeq = tcpHdr.SequenceNumber()
+			}
+			if tcpHdr.AckNumber() == finSeq+1 {
+				sawAckOfFin = true
+			}
+		case <-deadline:
+			t.Fatalf("timed out waiting for our fin/ack (sawAckOfFin=%v sawOurFin=%v)", sawAckOfFin, sawOurFin)
+		}
+	}
+
+	// ack our FIN, completing a graceful close
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, finSeq+1, ourFinSeq+1, header.TCPFlagAck, 65535, nil, nil))
+
+	deadline = time.After(2 * time.Second)
+	for {
+		s.tcpMu.Lock()
+		var conn *tcpConn
+		for _, c := range s.tcp {
+			conn = c
+		}
+		s.tcpMu.Unlock()
+		if conn == nil {
+			t.Fatal("connection unexpectedly removed before linger")
+		}
+		conn.mu.Lock()
+		state := conn.state
+		conn.mu.Unlock()
+		if state == stateTimeWait {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("connection did not reach TimeWait, state=%d", state)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
+func TestSystemStackTCPUnknownConnectionReset(t *testing.T) {
+	device := newFakeGVisorDevice()
+	handler := newEchoHandler()
+	s, cancel := newTestStackSystem(device, handler, time.Minute)
+	defer cancel()
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer s.Close()
+
+	src := testIP(testPeerIP)
+	dst := testIP(testTargetIP)
+
+	// an ACK referencing a connection the stack has never seen
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, 5000, 0, header.TCPFlagAck, 65535, nil, nil))
+
+	rst := parseIPv4TCP(t, device.recv(t, time.Second))
+	if rst.Flags()&header.TCPFlagRst == 0 {
+		t.Fatalf("expected RST, got flags %v", rst.Flags())
+	}
+	if rst.SequenceNumber() != 5000 {
+		t.Fatalf("expected reset seq to echo the ack number 5000, got %d", rst.SequenceNumber())
+	}
+}
+
+func TestSystemStackTCPRetransmit(t *testing.T) {
+	device := newFakeGVisorDevice()
+	handler := newEchoHandler()
+	s, cancel := newTestStackSystem(device, handler, time.Minute)
+	defer cancel()
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer s.Close()
+
+	src := testIP(testPeerIP)
+	dst := testIP(testTargetIP)
+
+	iss := uint32(2000)
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss, 0, header.TCPFlagSyn, 65535, nil, nil))
+	synAck := parseIPv4TCP(t, device.recv(t, time.Second))
+	serverISS := synAck.SequenceNumber()
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss+1, serverISS+1, header.TCPFlagAck, 65535, nil, nil))
+
+	payload := []byte("hi")
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, iss+1, serverISS+1, header.TCPFlagAck|header.TCPFlagPsh, 65535, payload, nil))
+
+	// consume the data-ack and the first echoed data segment, but do NOT ack
+	// the echoed data, forcing a retransmit
+	var first []byte
+	deadline := time.After(2 * time.Second)
+	for len(first) == 0 {
+		select {
+		case raw := <-device.outbound:
+			tcpHdr := parseIPv4TCP(t, raw)
+			if len(tcpHdr.Payload()) > 0 {
+				first = append([]byte(nil), tcpHdr.Payload()...)
+			}
+		case <-deadline:
+			t.Fatal("timed out waiting for first echoed segment")
+		}
+	}
+
+	// now wait for a retransmission of the same bytes, without acking
+	deadline = time.After(2 * time.Second)
+	for {
+		select {
+		case raw := <-device.outbound:
+			tcpHdr := parseIPv4TCP(t, raw)
+			if string(tcpHdr.Payload()) == string(first) {
+				return // retransmit observed, test passes
+			}
+		case <-deadline:
+			t.Fatal("timed out waiting for retransmission of unacked data")
+		}
+	}
+}
+
+func TestSystemStackIdleReap(t *testing.T) {
+	device := newFakeGVisorDevice()
+	handler := newEchoHandler()
+	s, cancel := newTestStackSystem(device, handler, time.Millisecond)
+	defer cancel()
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer s.Close()
+
+	src := testIP(testPeerIP)
+	dst := testIP(testTargetIP)
+
+	device.push(buildIPv4TCP(src, dst, testPeerPort, testDstPort, 1, 0, header.TCPFlagSyn, 65535, nil, nil))
+	device.recv(t, time.Second) // SYN-ACK
+
+	deadline := time.After(2 * time.Second)
+	for {
+		s.tcpMu.Lock()
+		n := len(s.tcp)
+		s.tcpMu.Unlock()
+		if n == 0 {
+			return
+		}
+		select {
+		case <-deadline:
+			t.Fatal("idle connection was not reaped")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
+func TestSystemStackUDPEcho(t *testing.T) {
+	device := newFakeGVisorDevice()
+	handler := newEchoHandler()
+	s, cancel := newTestStackSystem(device, handler, time.Minute)
+	defer cancel()
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer s.Close()
+
+	src := testIP(testPeerIP)
+	dst := testIP(testTargetIP)
+
+	payload := []byte("ping")
+	udpLen := header.UDPMinimumSize + len(payload)
+	totalLen := header.IPv4MinimumSize + udpLen
+	data := make([]byte, totalLen)
+	ipHdr := header.IPv4(data)
+	ipHdr.Encode(&header.IPv4Fields{
+		TotalLength: uint16(totalLen),
+		TTL:         64,
+		Protocol:    uint8(header.UDPProtocolNumber),
+		SrcAddr:     src,
+		DstAddr:     dst,
+	})
+	ipHdr.SetChecksum(^ipHdr.CalculateChecksum())
+	udpHdr := header.UDP(data[header.IPv4MinimumSize:])
+	udpHdr.Encode(&header.UDPFields{SrcPort: testPeerPort, DstPort: testDstPort, Length: uint16(udpLen)})
+	copy(data[header.IPv4MinimumSize+header.UDPMinimumSize:], payload)
+	xsum := header.PseudoHeaderChecksum(header.UDPProtocolNumber, src, dst, uint16(udpLen))
+	udpHdr.SetChecksum(^udpHdr.CalculateChecksum(checksum.Checksum(payload, xsum)))
+
+	device.push(data)
+
+	select {
+	case <-handler.done:
+	case <-time.After(time.Second):
+		t.Fatal("udp handler never invoked/finished")
+	}
+
+	handler.mu.Lock()
+	defer handler.mu.Unlock()
+	if len(handler.dests) != 1 || handler.dests[0].Network != net.Network_UDP {
+		t.Fatalf("unexpected udp destination recorded: %+v", handler.dests)
+	}
+}

proxy/tun/tun_android.go

@@ -7,9 +7,12 @@ import (
 	"net"
 	"strconv"
 
+	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform"
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
@@ -22,6 +25,22 @@ type AndroidTun struct {
 // DefaultTun implements Tun
 var _ Tun = (*AndroidTun)(nil)
 
+// AndroidTun implements GVisorDevice, used by the "system" (lite) ip stack
+var _ GVisorDevice = (*AndroidTun)(nil)
+
+// fdReadWriter adapts a raw, already non-blocking file descriptor to io.Reader/io.Writer,
+// so it can be used with buf.Buffer.ReadFrom, without the ownership/finalizer overhead of
+// wrapping it in an *os.File (the fd is owned and closed elsewhere).
+type fdReadWriter int
+
+func (f fdReadWriter) Read(p []byte) (int, error) {
+	return unix.Read(int(f), p)
+}
+
+func (f fdReadWriter) Write(p []byte) (int, error) {
+	return unix.Write(int(f), p)
+}
+
 // NewTun builds new tun interface handler
 func NewTun(options *Config) (Tun, error) {
 	fd, err := strconv.Atoi(platform.NewEnvFlag(platform.TunFdKey).GetValue(func() string { return "0" }))
@@ -78,6 +97,72 @@ func (t *AndroidTun) newEndpoint() (stack.LinkEndpoint, error) {
 	})
 }
 
+// ReadPacket implements GVisorDevice method to read one packet from the tun device, used by
+// the "system" (lite) ip stack. The gVisor backed stack instead talks to the fd directly through
+// fdbased.New above, for lower overhead batched IO, bypassing GVisorDevice entirely.
+// It is expected that the method will not block, rather return ErrQueueEmpty when there is nothing on the line,
+// which will make the stack call Wait which should implement desired push-back
+func (t *AndroidTun) ReadPacket() (byte, *stack.PacketBuffer, error) {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+
+	// read the bytes from the interface file descriptor, which is already non-blocking
+	n, err := b.ReadFrom(fdReadWriter(t.tunFd))
+	if err == unix.EAGAIN || err == unix.EWOULDBLOCK || err == unix.EINTR {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+	if err != nil {
+		b.Release()
+		return 0, nil, err
+	}
+
+	// discard empty packets
+	if n == 0 {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+
+	// network protocol version from the first nibble of the raw packet
+	version := b.Byte(0) >> 4
+	packetBuffer := buffer.MakeWithData(b.Bytes())
+	return version, stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload:           packetBuffer,
+		IsForwardedPacket: true,
+		OnRelease: func() {
+			b.Release()
+		},
+	}), nil
+}
+
+// WritePacket implements GVisorDevice method to write one packet to the tun device
+func (t *AndroidTun) WritePacket(packet *stack.PacketBuffer) tcpip.Error {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+	defer b.Release()
+
+	// copy the bytes of slices that compose the packet into the allocated buffer, no
+	// extra header is needed here, unlike Darwin/FreeBSD's utun devices
+	for _, packetElement := range packet.AsSlices() {
+		_, _ = b.Write(packetElement)
+	}
+
+	if _, err := fdReadWriter(t.tunFd).Write(b.Bytes()); err != nil {
+		if err == unix.EAGAIN || err == unix.EWOULDBLOCK {
+			return &tcpip.ErrWouldBlock{}
+		}
+		return &tcpip.ErrAborted{}
+	}
+	return nil
+}
+
+// Wait blocks until the tun fd is likely readable again, rather than spinning the CPU.
+// A bounded timeout keeps this responsive to a Close() racing a call already parked here.
+func (t *AndroidTun) Wait() {
+	fds := []unix.PollFd{{Fd: int32(t.tunFd), Events: unix.POLLIN}}
+	_, _ = unix.Poll(fds, 1000)
+}
+
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }

proxy/tun/tun_linux.go

@@ -10,9 +10,12 @@ import (
 	"sync"
 
 	"github.com/vishvananda/netlink"
+	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform"
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
@@ -35,6 +38,22 @@ type LinuxTun struct {
 // LinuxTun implements Tun
 var _ Tun = (*LinuxTun)(nil)
 
+// LinuxTun implements GVisorDevice, used by the "system" (lite) ip stack
+var _ GVisorDevice = (*LinuxTun)(nil)
+
+// fdReadWriter adapts a raw, already non-blocking file descriptor to io.Reader/io.Writer,
+// so it can be used with buf.Buffer.ReadFrom, without the ownership/finalizer overhead of
+// wrapping it in an *os.File (the fd is owned and closed elsewhere, see LinuxTun.Close).
+type fdReadWriter int
+
+func (f fdReadWriter) Read(p []byte) (int, error) {
+	return unix.Read(int(f), p)
+}
+
+func (f fdReadWriter) Write(p []byte) (int, error) {
+	return unix.Write(int(f), p)
+}
+
 // NewTun builds new tun interface handler (linux specific)
 func NewTun(options *Config) (Tun, error) {
 	tunFd, tunLink, fdProvided, err := openFromEnv(options.Name)
@@ -228,6 +247,72 @@ func (t *LinuxTun) newEndpoint() (stack.LinkEndpoint, error) {
 	})
 }
 
+// ReadPacket implements GVisorDevice method to read one packet from the tun device, used by
+// the "system" (lite) ip stack. The gVisor backed stack instead talks to the fd directly through
+// fdbased.New above, for lower overhead batched IO, bypassing GVisorDevice entirely.
+// It is expected that the method will not block, rather return ErrQueueEmpty when there is nothing on the line,
+// which will make the stack call Wait which should implement desired push-back
+func (t *LinuxTun) ReadPacket() (byte, *stack.PacketBuffer, error) {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+
+	// read the bytes from the interface file descriptor, which is already non-blocking
+	n, err := b.ReadFrom(fdReadWriter(t.tunFd))
+	if err == unix.EAGAIN || err == unix.EWOULDBLOCK || err == unix.EINTR {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+	if err != nil {
+		b.Release()
+		return 0, nil, err
+	}
+
+	// discard empty packets
+	if n == 0 {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+
+	// network protocol version from the first nibble of the raw packet
+	version := b.Byte(0) >> 4
+	packetBuffer := buffer.MakeWithData(b.Bytes())
+	return version, stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload:           packetBuffer,
+		IsForwardedPacket: true,
+		OnRelease: func() {
+			b.Release()
+		},
+	}), nil
+}
+
+// WritePacket implements GVisorDevice method to write one packet to the tun device
+func (t *LinuxTun) WritePacket(packet *stack.PacketBuffer) tcpip.Error {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+	defer b.Release()
+
+	// copy the bytes of slices that compose the packet into the allocated buffer, no
+	// Linux specific header is needed here, unlike Darwin/FreeBSD's utun devices
+	for _, packetElement := range packet.AsSlices() {
+		_, _ = b.Write(packetElement)
+	}
+
+	if _, err := fdReadWriter(t.tunFd).Write(b.Bytes()); err != nil {
+		if err == unix.EAGAIN || err == unix.EWOULDBLOCK {
+			return &tcpip.ErrWouldBlock{}
+		}
+		return &tcpip.ErrAborted{}
+	}
+	return nil
+}
+
+// Wait blocks until the tun fd is likely readable again, rather than spinning the CPU.
+// A bounded timeout keeps this responsive to a Close() racing a call already parked here.
+func (t *LinuxTun) Wait() {
+	fds := []unix.PollFd{{Fd: int32(t.tunFd), Events: unix.POLLIN}}
+	_, _ = unix.Poll(fds, 1000)
+}
+
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }

proxy/wireguard/client.go

@@ -3,7 +3,6 @@ package wireguard
 import (
 	"context"
 	"fmt"
-	gonet "net"
 	"net/netip"
 	"reflect"
 	"strings"
@@ -28,14 +27,10 @@ import (
 	"github.com/xtls/xray-core/features/stats"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"golang.zx2c4.com/wireguard/device"
 )
 
-type entry struct {
-	got  []net.IP
-	time time.Time
-}
-
 type Handler struct {
 	conf          *DeviceConfig
 	policyManager policy.Manager
@@ -49,11 +44,6 @@ type Handler struct {
 	tnet *Net
 	dev  *device.Device
 	mu   sync.Mutex
-
-	// TODO: cache cleanup loop
-	local   bool
-	cache   map[string]entry
-	cacheMu sync.Mutex
 }
 
 func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
@@ -109,15 +99,10 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 		return nil, err
 	}
 
-	local := false
 	dns := conf.DNS
 	if len(dns) == 0 {
 		dns = []string{"1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"}
 	}
-	if len(dns) == 1 && dns[0] == "local" {
-		local = true
-		dns = nil
-	}
 	dnses := make([]netip.Addr, 0, len(dns))
 	for _, dns := range dns {
 		dnses = append(dnses, netip.MustParseAddr(dns))
@@ -151,9 +136,6 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 
 		tun:  tun,
 		tnet: tnet,
-
-		local: local,
-		cache: make(map[string]entry),
 	}, nil
 }
 
@@ -172,22 +154,6 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		return err
 	}
 
-	var addr netip.Addr
-	if ob.Target.Address.Family().IsDomain() {
-		ip, err := h.resolveRemote(ob.Target.Address.String())
-		if err != nil {
-			return errors.New("failed to resolve domain").Base(err)
-		}
-		addr, _ = netip.AddrFromSlice(ip)
-	} else {
-		addr, _ = netip.AddrFromSlice(ob.Target.Address.IP())
-	}
-
-	addrPort := netip.AddrPortFrom(addr, ob.Target.Port.Value())
-	if !addrPort.IsValid() {
-		return errors.New("invalid target ", ob.Target)
-	}
-
 	var newCtx context.Context
 	var newCancel context.CancelFunc
 	if session.TimeoutOnlyFromContext(ctx) {
@@ -216,10 +182,10 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		var err error
 		if sessionPolicy.Timeouts.Handshake != 0 {
 			timeoutCtx, timeoutCancel := context.WithTimeout(ctx, sessionPolicy.Timeouts.Handshake)
-			conn, err = h.tnet.DialContextTCPAddrPort(timeoutCtx, addrPort)
+			conn, err = h.tnet.DialContext(timeoutCtx, "tcp", ob.Target.NetAddr())
 			timeoutCancel()
 		} else {
-			conn, err = h.tnet.DialContextTCPAddrPort(ctx, addrPort)
+			conn, err = h.tnet.Dial("tcp", ob.Target.NetAddr())
 		}
 		if err != nil {
 			return errors.New("failed to create TCP connection").Base(err)
@@ -228,15 +194,14 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		reader = buf.NewReader(conn)
 		writer = buf.NewWriter(conn)
 	case net.Network_UDP:
-		conn, err := h.tnet.DialUDPAddrPort(netip.AddrPort{}, addrPort)
+		conn, err := h.tnet.Dial("udp", ob.Target.NetAddr())
 		if err != nil {
 			return errors.New("failed to create UDP connection").Base(err)
 		}
 		defer conn.Close()
 		c := &udpConnClient{
-			PacketConn:  conn.(*internet.PacketConnWrapper).PacketConn,
-			resolveFunc: h.resolveRemote,
-			dest:        gonet.UDPAddrFromAddrPort(addrPort),
+			PacketConn: conn.(*internet.PacketConnWrapper).PacketConn,
+			dest:       conn.RemoteAddr().(*net.UDPAddr),
 		}
 		reader = c
 		writer = c
@@ -293,26 +258,26 @@ func (h *Handler) init(ctx context.Context) error {
 		if err != nil {
 			return nil, err
 		}
-		conn, err := internet.DialSystem(ctx, dest, h.streamSettings.SocketSettings)
-		if err != nil {
-			return nil, err
-		}
 		var pktConn net.PacketConn
-		switch c := conn.(type) {
-		case *internet.PacketConnWrapper:
-			pktConn = c.PacketConn
-		case *cnc.Connection:
-			pktConn = &internet.FakePacketConn{Conn: c}
-		default:
-			panic(reflect.TypeOf(c))
-		}
-		if h.streamSettings.UdpmaskManager != nil {
-			newConn, err := h.streamSettings.UdpmaskManager.WrapPacketConnClient(pktConn)
+		if h.streamSettings.FinalMask != nil {
+			conn, err := h.streamSettings.FinalMask.DialUDP(ctx, dest)
 			if err != nil {
-				pktConn.Close()
-				return nil, errors.New("mask err").Base(err)
+				return nil, errors.New("failed to dial to dest").Base(err)
+			}
+			pktConn = conn.(*finalmask.PacketConnWrapper).PacketConn
+		} else {
+			conn, err := internet.DialSystem(ctx, dest, h.streamSettings.SocketSettings)
+			if err != nil {
+				return nil, errors.New("failed to dial to dest").Base(err)
+			}
+			switch c := conn.(type) {
+			case *internet.PacketConnWrapper:
+				pktConn = c.PacketConn
+			case *cnc.Connection:
+				pktConn = &internet.FakePacketConn{Conn: c}
+			default:
+				panic(reflect.TypeOf(c))
 			}
-			pktConn = newConn
 		}
 		if h.uplinkCounter != nil || h.downlinkCounter != nil {
 			pktConn = &PacketCounterConnection{
@@ -371,87 +336,48 @@ func (h *Handler) init(ctx context.Context) error {
 }
 
 func (h *Handler) resolveLocal(host string) (net.IP, error) {
-	return h.resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, uint32, error) {
-		return h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
-	})
-}
-
-func (h *Handler) resolveRemote(host string) (net.IP, error) {
-	return h.resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, uint32, error) {
-		if h.local {
-			return h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
-		}
-		return h.tnet.LookupHost(host)
-	})
-}
-
-func (h *Handler) resolveDomain(host string, strategy DeviceConfig_DomainStrategy, lookupIP func(host string) ([]net.IP, uint32, error)) (net.IP, error) {
-	if ip := net.ParseIP(host); ip != nil {
-		return ip, nil
-	}
-	h.cacheMu.Lock()
-	if entry, ok := h.cache[host]; ok {
-		if time.Now().Before(entry.time) {
-			h.cacheMu.Unlock()
-			return entry.got[dice.Roll(len(entry.got))], nil
-		}
-		delete(h.cache, host)
-	}
-	h.cacheMu.Unlock()
-	ips, ttl, err := lookupIP(host)
+	ips, _, err := h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
 	if err != nil {
 		return nil, err
 	}
-	if len(ips) == 0 {
-		return nil, dns.ErrEmptyResponse
-	}
-	var got4, got6 []net.IP
-	for _, ip := range ips {
-		if ip.To4() != nil {
-			got4 = append(got4, ip)
-		} else {
-			got6 = append(got6, ip)
+	got := ips
+	if h.streamSettings.SocketSettings != nil {
+		var got4, got6 []net.IP
+		for _, ip := range ips {
+			if ip.To4() != nil {
+				got4 = append(got4, ip)
+			} else {
+				got6 = append(got6, ip)
+			}
 		}
-	}
-	var got []net.IP
-	switch strategy {
-	case DeviceConfig_FORCE_IP:
-		got = ips
-		return ips[dice.Roll(len(ips))], nil
-	case DeviceConfig_FORCE_IP4:
-		got = got4
-	case DeviceConfig_FORCE_IP6:
-		got = got6
-	case DeviceConfig_FORCE_IP46:
-		got = got4
-		if len(got) == 0 {
-			got = got6
-		}
-	case DeviceConfig_FORCE_IP64:
-		got = got6
-		if len(got) == 0 {
+		switch h.streamSettings.SocketSettings.DomainStrategy {
+		case internet.DomainStrategy_AS_IS, internet.DomainStrategy_USE_IP, internet.DomainStrategy_FORCE_IP:
+			got = ips
+		case internet.DomainStrategy_USE_IP4, internet.DomainStrategy_FORCE_IP4:
 			got = got4
+		case internet.DomainStrategy_USE_IP6, internet.DomainStrategy_FORCE_IP6:
+			got = got6
+		case internet.DomainStrategy_USE_IP46, internet.DomainStrategy_FORCE_IP46:
+			got = got4
+			if len(got) == 0 {
+				got = got6
+			}
+		case internet.DomainStrategy_USE_IP64, internet.DomainStrategy_FORCE_IP64:
+			got = got6
+			if len(got) == 0 {
+				got = got4
+			}
+		}
+		if len(got) == 0 {
+			return nil, dns.ErrEmptyResponse
 		}
-	default:
-		panic(strategy)
 	}
-	if len(got) == 0 {
-		return nil, dns.ErrEmptyResponse
-	}
-	entry := entry{
-		got:  got,
-		time: time.Now().Add(time.Duration(ttl) * time.Second),
-	}
-	h.cacheMu.Lock()
-	h.cache[host] = entry
-	h.cacheMu.Unlock()
 	return got[dice.Roll(len(got))], nil
 }
 
 type udpConnClient struct {
 	net.PacketConn
-	resolveFunc func(host string) (net.IP, error)
-	dest        *net.UDPAddr
+	dest *net.UDPAddr
 }
 
 func (c *udpConnClient) ReadMultiBuffer() (buf.MultiBuffer, error) {
@@ -478,15 +404,8 @@ func (c *udpConnClient) WriteMultiBuffer(mb buf.MultiBuffer) error {
 		dst := c.dest
 		if b.UDP != nil {
 			if b.UDP.Address.Family().IsDomain() {
-				ip, err := c.resolveFunc(b.UDP.Address.String())
-				if err != nil {
-					errors.LogErrorInner(context.Background(), err, "drop packet to ", b.UDP, " with size ", len(b.Bytes()))
-					b.Release()
-					continue
-				}
-				dst = &net.UDPAddr{
-					IP:   ip,
-					Port: int(b.UDP.Port),
+				if b.UDP.Port != net.Port(dst.Port) {
+					dst = &net.UDPAddr{IP: dst.IP, Port: int(b.UDP.Port)}
 				}
 			} else {
 				dst = b.UDP.RawNetAddr().(*net.UDPAddr)
@@ -523,3 +442,59 @@ func (c *PacketCounterConnection) WriteTo(p []byte, addr net.Addr) (n int, err e
 	}
 	return
 }
+
+type entry struct {
+	saddr    []string
+	deadline time.Time
+}
+
+type cache struct {
+	running bool
+	m       map[string]entry
+	mu      sync.Mutex
+}
+
+func (c *cache) run() {
+	if c.running {
+		return
+	}
+	c.running = true
+	c.m = make(map[string]entry)
+	go c.gc()
+}
+
+func (c *cache) gc() {
+	ticker := time.NewTicker(time.Minute)
+	for {
+		now := <-ticker.C
+		c.mu.Lock()
+		for key, entry := range c.m {
+			if now.After(entry.deadline) {
+				delete(c.m, key)
+			}
+		}
+		c.mu.Unlock()
+	}
+}
+
+func (c *cache) LookupHost(host string) []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.run()
+	if entry, ok := c.m[host]; ok {
+		if time.Now().Before(entry.deadline) {
+			return entry.saddr
+		}
+		delete(c.m, host)
+	}
+	return nil
+}
+
+func (c *cache) Cache(host string, saddr []string, ttl uint32) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.m[host] = entry{
+		saddr:    saddr,
+		deadline: time.Now().Add(time.Second * time.Duration(ttl)),
+	}
+}

proxy/wireguard/config.pb.go

@@ -22,61 +22,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type DeviceConfig_DomainStrategy int32
-
-const (
-	DeviceConfig_FORCE_IP   DeviceConfig_DomainStrategy = 0
-	DeviceConfig_FORCE_IP4  DeviceConfig_DomainStrategy = 1
-	DeviceConfig_FORCE_IP6  DeviceConfig_DomainStrategy = 2
-	DeviceConfig_FORCE_IP46 DeviceConfig_DomainStrategy = 3
-	DeviceConfig_FORCE_IP64 DeviceConfig_DomainStrategy = 4
-)
-
-// Enum value maps for DeviceConfig_DomainStrategy.
-var (
-	DeviceConfig_DomainStrategy_name = map[int32]string{
-		0: "FORCE_IP",
-		1: "FORCE_IP4",
-		2: "FORCE_IP6",
-		3: "FORCE_IP46",
-		4: "FORCE_IP64",
-	}
-	DeviceConfig_DomainStrategy_value = map[string]int32{
-		"FORCE_IP":   0,
-		"FORCE_IP4":  1,
-		"FORCE_IP6":  2,
-		"FORCE_IP46": 3,
-		"FORCE_IP64": 4,
-	}
-)
-
-func (x DeviceConfig_DomainStrategy) Enum() *DeviceConfig_DomainStrategy {
-	p := new(DeviceConfig_DomainStrategy)
-	*p = x
-	return p
-}
-
-func (x DeviceConfig_DomainStrategy) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (DeviceConfig_DomainStrategy) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_wireguard_config_proto_enumTypes[0].Descriptor()
-}
-
-func (DeviceConfig_DomainStrategy) Type() protoreflect.EnumType {
-	return &file_proxy_wireguard_config_proto_enumTypes[0]
-}
-
-func (x DeviceConfig_DomainStrategy) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use DeviceConfig_DomainStrategy.Descriptor instead.
-func (DeviceConfig_DomainStrategy) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_wireguard_config_proto_rawDescGZIP(), []int{1, 0}
-}
-
 type PeerConfig struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	PublicKey     string                 `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
@@ -154,19 +99,18 @@ func (x *PeerConfig) GetAllowedIps() []string {
 }
 
 type DeviceConfig struct {
-	state          protoimpl.MessageState      `protogen:"open.v1"`
-	SecretKey      string                      `protobuf:"bytes,1,opt,name=secret_key,json=secretKey,proto3" json:"secret_key,omitempty"`
-	Endpoint       []string                    `protobuf:"bytes,2,rep,name=endpoint,proto3" json:"endpoint,omitempty"`
-	Peers          []*PeerConfig               `protobuf:"bytes,3,rep,name=peers,proto3" json:"peers,omitempty"`
-	Users          []*protocol.User            `protobuf:"bytes,5,rep,name=users,proto3" json:"users,omitempty"`
-	Mtu            int32                       `protobuf:"varint,4,opt,name=mtu,proto3" json:"mtu,omitempty"`
-	Reserved       []byte                      `protobuf:"bytes,6,opt,name=reserved,proto3" json:"reserved,omitempty"`
-	DomainStrategy DeviceConfig_DomainStrategy `protobuf:"varint,7,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.proxy.wireguard.DeviceConfig_DomainStrategy" json:"domain_strategy,omitempty"`
-	IsClient       bool                        `protobuf:"varint,8,opt,name=is_client,json=isClient,proto3" json:"is_client,omitempty"`
-	NoKernelTun    bool                        `protobuf:"varint,9,opt,name=no_kernel_tun,json=noKernelTun,proto3" json:"no_kernel_tun,omitempty"`
-	DNS            []string                    `protobuf:"bytes,10,rep,name=DNS,proto3" json:"DNS,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SecretKey     string                 `protobuf:"bytes,1,opt,name=secret_key,json=secretKey,proto3" json:"secret_key,omitempty"`
+	Endpoint      []string               `protobuf:"bytes,2,rep,name=endpoint,proto3" json:"endpoint,omitempty"`
+	Peers         []*PeerConfig          `protobuf:"bytes,3,rep,name=peers,proto3" json:"peers,omitempty"`
+	Users         []*protocol.User       `protobuf:"bytes,5,rep,name=users,proto3" json:"users,omitempty"`
+	Mtu           int32                  `protobuf:"varint,4,opt,name=mtu,proto3" json:"mtu,omitempty"`
+	Reserved      []byte                 `protobuf:"bytes,6,opt,name=reserved,proto3" json:"reserved,omitempty"`
+	IsClient      bool                   `protobuf:"varint,8,opt,name=is_client,json=isClient,proto3" json:"is_client,omitempty"`
+	NoKernelTun   bool                   `protobuf:"varint,9,opt,name=no_kernel_tun,json=noKernelTun,proto3" json:"no_kernel_tun,omitempty"`
+	DNS           []string               `protobuf:"bytes,10,rep,name=DNS,proto3" json:"DNS,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeviceConfig) Reset() {
@@ -241,13 +185,6 @@ func (x *DeviceConfig) GetReserved() []byte {
 	return nil
 }
 
-func (x *DeviceConfig) GetDomainStrategy() DeviceConfig_DomainStrategy {
-	if x != nil {
-		return x.DomainStrategy
-	}
-	return DeviceConfig_FORCE_IP
-}
-
 func (x *DeviceConfig) GetIsClient() bool {
 	if x != nil {
 		return x.IsClient
@@ -283,7 +220,7 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
 	"keep_alive\x18\x04 \x01(\tR\tkeepAlive\x12\x1f\n" +
 	"\vallowed_ips\x18\x05 \x03(\tR\n" +
-	"allowedIps\"\xee\x03\n" +
+	"allowedIps\"\xb4\x02\n" +
 	"\fDeviceConfig\x12\x1d\n" +
 	"\n" +
 	"secret_key\x18\x01 \x01(\tR\tsecretKey\x12\x1a\n" +
@@ -291,20 +228,11 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\x05peers\x18\x03 \x03(\v2 .xray.proxy.wireguard.PeerConfigR\x05peers\x120\n" +
 	"\x05users\x18\x05 \x03(\v2\x1a.xray.common.protocol.UserR\x05users\x12\x10\n" +
 	"\x03mtu\x18\x04 \x01(\x05R\x03mtu\x12\x1a\n" +
-	"\breserved\x18\x06 \x01(\fR\breserved\x12Z\n" +
-	"\x0fdomain_strategy\x18\a \x01(\x0e21.xray.proxy.wireguard.DeviceConfig.DomainStrategyR\x0edomainStrategy\x12\x1b\n" +
+	"\breserved\x18\x06 \x01(\fR\breserved\x12\x1b\n" +
 	"\tis_client\x18\b \x01(\bR\bisClient\x12\"\n" +
 	"\rno_kernel_tun\x18\t \x01(\bR\vnoKernelTun\x12\x10\n" +
 	"\x03DNS\x18\n" +
-	" \x03(\tR\x03DNS\"\\\n" +
-	"\x0eDomainStrategy\x12\f\n" +
-	"\bFORCE_IP\x10\x00\x12\r\n" +
-	"\tFORCE_IP4\x10\x01\x12\r\n" +
-	"\tFORCE_IP6\x10\x02\x12\x0e\n" +
-	"\n" +
-	"FORCE_IP46\x10\x03\x12\x0e\n" +
-	"\n" +
-	"FORCE_IP64\x10\x04B^\n" +
+	" \x03(\tR\x03DNSB^\n" +
 	"\x18com.xray.proxy.wireguardP\x01Z)github.com/xtls/xray-core/proxy/wireguard\xaa\x02\x14Xray.Proxy.WireGuardb\x06proto3"
 
 var (
@@ -319,23 +247,20 @@ func file_proxy_wireguard_config_proto_rawDescGZIP() []byte {
 	return file_proxy_wireguard_config_proto_rawDescData
 }
 
-var file_proxy_wireguard_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_proxy_wireguard_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_proxy_wireguard_config_proto_goTypes = []any{
-	(DeviceConfig_DomainStrategy)(0), // 0: xray.proxy.wireguard.DeviceConfig.DomainStrategy
-	(*PeerConfig)(nil),               // 1: xray.proxy.wireguard.PeerConfig
-	(*DeviceConfig)(nil),             // 2: xray.proxy.wireguard.DeviceConfig
-	(*protocol.User)(nil),            // 3: xray.common.protocol.User
+	(*PeerConfig)(nil),    // 0: xray.proxy.wireguard.PeerConfig
+	(*DeviceConfig)(nil),  // 1: xray.proxy.wireguard.DeviceConfig
+	(*protocol.User)(nil), // 2: xray.common.protocol.User
 }
 var file_proxy_wireguard_config_proto_depIdxs = []int32{
-	1, // 0: xray.proxy.wireguard.DeviceConfig.peers:type_name -> xray.proxy.wireguard.PeerConfig
-	3, // 1: xray.proxy.wireguard.DeviceConfig.users:type_name -> xray.common.protocol.User
-	0, // 2: xray.proxy.wireguard.DeviceConfig.domain_strategy:type_name -> xray.proxy.wireguard.DeviceConfig.DomainStrategy
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	0, // 0: xray.proxy.wireguard.DeviceConfig.peers:type_name -> xray.proxy.wireguard.PeerConfig
+	2, // 1: xray.proxy.wireguard.DeviceConfig.users:type_name -> xray.common.protocol.User
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_proxy_wireguard_config_proto_init() }
@@ -348,14 +273,13 @@ func file_proxy_wireguard_config_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proxy_wireguard_config_proto_rawDesc), len(file_proxy_wireguard_config_proto_rawDesc)),
-			NumEnums:      1,
+			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
 		GoTypes:           file_proxy_wireguard_config_proto_goTypes,
 		DependencyIndexes: file_proxy_wireguard_config_proto_depIdxs,
-		EnumInfos:         file_proxy_wireguard_config_proto_enumTypes,
 		MessageInfos:      file_proxy_wireguard_config_proto_msgTypes,
 	}.Build()
 	File_proxy_wireguard_config_proto = out.File

proxy/wireguard/config.proto

@@ -17,13 +17,6 @@ message PeerConfig {
 }
 
 message DeviceConfig {
-  enum DomainStrategy {
-    FORCE_IP = 0;
-    FORCE_IP4 = 1;
-    FORCE_IP6 = 2;
-    FORCE_IP46 = 3;
-    FORCE_IP64 = 4;
-  }
   string secret_key = 1;
   repeated string endpoint = 2;
   repeated PeerConfig peers = 3;
@@ -31,7 +24,6 @@ message DeviceConfig {
   int32 mtu = 4;
 
   bytes reserved = 6;
-  DomainStrategy domain_strategy = 7;
   bool is_client = 8;
   bool no_kernel_tun = 9;
   repeated string DNS = 10;

proxy/wireguard/netstack.go

@@ -15,6 +15,8 @@ import (
 	"net"
 	"net/netip"
 	"os"
+	"regexp"
+	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -42,6 +44,7 @@ type netTun struct {
 	events         chan tun.Event
 	notifyHandle   *channel.NotificationHandle
 	incomingPacket chan *buffer.View
+	closed         chan struct{}
 	mtu            int
 	dnsServers     []netip.Addr
 	hasV4, hasV6   bool
@@ -58,6 +61,7 @@ func CreateNetTUN(localAddresses, dnsServers []netip.Addr, mtu int, handleLocal
 		stack:          stack.New(opts),
 		events:         make(chan tun.Event, 10),
 		incomingPacket: make(chan *buffer.View),
+		closed:         make(chan struct{}),
 		dnsServers:     dnsServers,
 		mtu:            mtu,
 	}
@@ -124,8 +128,10 @@ func (tun *netTun) Events() <-chan tun.Event {
 }
 
 func (tun *netTun) Read(buf [][]byte, sizes []int, offset int) (int, error) {
-	view, ok := <-tun.incomingPacket
-	if !ok {
+	var view *buffer.View
+	select {
+	case view = <-tun.incomingPacket:
+	case <-tun.closed:
 		return 0, os.ErrClosed
 	}
 
@@ -166,7 +172,10 @@ func (tun *netTun) WriteNotify() {
 	view := pkt.ToView()
 	pkt.DecRef()
 
-	tun.incomingPacket <- view
+	select {
+	case tun.incomingPacket <- view:
+	case <-tun.closed:
+	}
 }
 
 func (tun *netTun) Close() error {
@@ -179,8 +188,9 @@ func (tun *netTun) Close() error {
 		close(tun.events)
 	}
 
-	if tun.incomingPacket != nil {
-		close(tun.incomingPacket)
+	// we don't close incomingPacket, because WriteNotify may be mid-send on it (DNS lookup) and would panic.
+	if tun.closed != nil {
+		close(tun.closed)
 	}
 
 	return nil
@@ -219,6 +229,7 @@ type Net struct {
 	DialUDPAddrPort        func(laddr, raddr netip.AddrPort) (net.Conn, error)
 	dnsServers             []netip.Addr
 	hasV4, hasV6           bool
+	cache                  cache
 }
 
 func convertToFullAddr(endpoint netip.AddrPort) (tcpip.FullAddress, tcpip.NetworkProtocolNumber) {
@@ -246,9 +257,12 @@ var (
 	errServerTemporarilyMisbehaving = errors.New("server misbehaving")
 	errCanceled                     = errors.New("operation was canceled")
 	errTimeout                      = errors.New("i/o timeout")
+	errNumericPort                  = errors.New("port must be numeric")
+	errNoSuitableAddress            = errors.New("no suitable address found")
+	errMissingAddress               = errors.New("missing address")
 )
 
-func (net *Net) LookupHost(host string) (addrs []net.IP, ttl uint32, err error) {
+func (net *Net) LookupHost(host string) (addrs []string, err error) {
 	return net.LookupContextHost(context.Background(), host)
 }
 
@@ -567,9 +581,12 @@ func (tnet *Net) tryOneName(ctx context.Context, name string, qtype dnsmessage.T
 	return dnsmessage.Parser{}, "", lastErr
 }
 
-func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]net.IP, uint32, error) {
+func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string, error) {
+	if saddr := tnet.cache.LookupHost(host); saddr != nil {
+		return saddr, nil
+	}
 	if host == "" || (!tnet.hasV6 && !tnet.hasV4) {
-		return nil, 0, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
+		return nil, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
 	}
 	zlen := len(host)
 	if strings.IndexByte(host, ':') != -1 {
@@ -578,11 +595,11 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]net.IP,
 		}
 	}
 	if ip, err := netip.ParseAddr(host[:zlen]); err == nil {
-		return []net.IP{ip.AsSlice()}, 0, nil
+		return []string{ip.String()}, nil
 	}
 
 	if !isDomainName(host) {
-		return nil, 0, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
+		return nil, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
 	}
 	type result struct {
 		p      dnsmessage.Parser
@@ -683,11 +700,137 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]net.IP,
 	}
 
 	if len(addrs) == 0 && lastErr != nil {
-		return nil, 0, lastErr
+		return nil, lastErr
 	}
-	ips := make([]net.IP, 0, len(addrs))
+	saddrs := make([]string, 0, len(addrs))
 	for _, ip := range addrs {
-		ips = append(ips, ip.AsSlice())
+		saddrs = append(saddrs, ip.String())
 	}
-	return ips, ttl, nil
+	tnet.cache.Cache(host, saddrs, ttl)
+	return saddrs, nil
+}
+
+func partialDeadline(now, deadline time.Time, addrsRemaining int) (time.Time, error) {
+	if deadline.IsZero() {
+		return deadline, nil
+	}
+	timeRemaining := deadline.Sub(now)
+	if timeRemaining <= 0 {
+		return time.Time{}, errTimeout
+	}
+	timeout := timeRemaining / time.Duration(addrsRemaining)
+	const saneMinimum = 2 * time.Second
+	if timeout < saneMinimum {
+		if timeRemaining < saneMinimum {
+			timeout = timeRemaining
+		} else {
+			timeout = saneMinimum
+		}
+	}
+	return now.Add(timeout), nil
+}
+
+var protoSplitter = regexp.MustCompile(`^(tcp|udp|ping)(4|6)?$`)
+
+func (tnet *Net) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	if ctx == nil {
+		panic("nil context")
+	}
+	var acceptV4, acceptV6 bool
+	matches := protoSplitter.FindStringSubmatch(network)
+	if matches == nil {
+		return nil, &net.OpError{Op: "dial", Err: net.UnknownNetworkError(network)}
+	} else if len(matches[2]) == 0 {
+		acceptV4 = true
+		acceptV6 = true
+	} else {
+		acceptV4 = matches[2][0] == '4'
+		acceptV6 = !acceptV4
+	}
+	var host string
+	var port int
+	if matches[1] == "ping" {
+		host = address
+	} else {
+		var sport string
+		var err error
+		host, sport, err = net.SplitHostPort(address)
+		if err != nil {
+			return nil, &net.OpError{Op: "dial", Err: err}
+		}
+		port, err = strconv.Atoi(sport)
+		if err != nil || port < 0 || port > 65535 {
+			return nil, &net.OpError{Op: "dial", Err: errNumericPort}
+		}
+	}
+	allAddr, err := tnet.LookupContextHost(ctx, host)
+	if err != nil {
+		return nil, &net.OpError{Op: "dial", Err: err}
+	}
+	var addrs []netip.AddrPort
+	for _, addr := range allAddr {
+		ip, err := netip.ParseAddr(addr)
+		if err == nil && ((ip.Is4() && acceptV4) || (ip.Is6() && acceptV6)) {
+			addrs = append(addrs, netip.AddrPortFrom(ip, uint16(port)))
+		}
+	}
+	if len(addrs) == 0 && len(allAddr) != 0 {
+		return nil, &net.OpError{Op: "dial", Err: errNoSuitableAddress}
+	}
+
+	var firstErr error
+	for i, addr := range addrs {
+		select {
+		case <-ctx.Done():
+			err := ctx.Err()
+			if err == context.Canceled {
+				err = errCanceled
+			} else if err == context.DeadlineExceeded {
+				err = errTimeout
+			}
+			return nil, &net.OpError{Op: "dial", Err: err}
+		default:
+		}
+
+		dialCtx := ctx
+		if deadline, hasDeadline := ctx.Deadline(); hasDeadline {
+			partialDeadline, err := partialDeadline(time.Now(), deadline, len(addrs)-i)
+			if err != nil {
+				if firstErr == nil {
+					firstErr = &net.OpError{Op: "dial", Err: err}
+				}
+				break
+			}
+			if partialDeadline.Before(deadline) {
+				var cancel context.CancelFunc
+				dialCtx, cancel = context.WithDeadline(ctx, partialDeadline)
+				defer cancel()
+			}
+		}
+
+		var c net.Conn
+		switch matches[1] {
+		case "tcp":
+			c, err = tnet.DialContextTCPAddrPort(dialCtx, addr)
+		case "udp":
+			c, err = tnet.DialUDPAddrPort(netip.AddrPort{}, addr)
+		case "ping":
+			err = errors.New("not support")
+			// c, err = tnet.DialPingAddr(netip.Addr{}, addr.Addr())
+		}
+		if err == nil {
+			return c, nil
+		}
+		if firstErr == nil {
+			firstErr = err
+		}
+	}
+	if firstErr == nil {
+		firstErr = &net.OpError{Op: "dial", Err: errMissingAddress}
+	}
+	return nil, firstErr
+}
+
+func (tnet *Net) Dial(network, address string) (net.Conn, error) {
+	return tnet.DialContext(context.Background(), network, address)
 }

proxy/wireguard/server.go

@@ -258,18 +258,16 @@ func (s *Server) Start() error {
 		return errors.New("address is domain")
 	}
 	listenFunc := func() (net.PacketConn, error) {
-		pktConn, err := internet.ListenSystemPacket(context.Background(), &net.UDPAddr{IP: s.src.Address.IP(), Port: int(s.src.Port)}, s.streamSettings.SocketSettings)
+		var pktConn net.PacketConn
+		var err error
+		if s.streamSettings.FinalMask != nil {
+			pktConn, err = s.streamSettings.FinalMask.ListenPacket(context.Background(), &net.UDPAddr{IP: s.src.Address.IP(), Port: int(s.src.Port)})
+		} else {
+			pktConn, err = internet.ListenSystemPacket(context.Background(), &net.UDPAddr{IP: s.src.Address.IP(), Port: int(s.src.Port)}, s.streamSettings.SocketSettings)
+		}
 		if err != nil {
 			return nil, err
 		}
-		if s.streamSettings.UdpmaskManager != nil {
-			newConn, err := s.streamSettings.UdpmaskManager.WrapPacketConnServer(pktConn)
-			if err != nil {
-				pktConn.Close()
-				return nil, errors.New("mask err").Base(err)
-			}
-			pktConn = newConn
-		}
 		if s.uplinkCounter != nil || s.downlinkCounter != nil {
 			pktConn = &PacketCounterConnection{
 				PacketConn:   pktConn,

testing/scenarios/wireguard_test.go

@@ -65,6 +65,7 @@ func TestWireguard(t *testing.T) {
 				ProxySettings: serial.ToTypedMessage(&freedom.Config{
 					FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}},
 				}),
+				SenderSettings: serial.ToTypedMessage(&proxyman.SenderConfig{}),
 			},
 		},
 	}
@@ -104,6 +105,7 @@ func TestWireguard(t *testing.T) {
 						AllowedIps: []string{"0.0.0.0/0", "::0/0"},
 					}},
 				}),
+				SenderSettings: serial.ToTypedMessage(&proxyman.SenderConfig{}),
 			},
 		},
 	}

transport/internet/finalmask/finalmask.go

@@ -2,103 +2,291 @@ package finalmask
 
 import (
 	"context"
-	"net"
+	"fmt"
 	"slices"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
 )
 
-type Udpmask interface {
-	WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error)
-	WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error)
+type Dialer struct {
+	DialTCP func(net.Destination) (net.Conn, error)
+	DialUDP func(net.Destination) (net.Conn, error)
 }
 
-type UdpmaskManager struct {
-	udpmasks []Udpmask
+type ListenConfig struct {
+	Listen       func(net.Addr) (net.Listener, error)
+	ListenPacket func(net.Addr) (net.PacketConn, error)
 }
 
-func NewUdpmaskManager(udpmasks []Udpmask) *UdpmaskManager {
-	slices.Reverse(udpmasks)
-	return &UdpmaskManager{udpmasks: udpmasks}
+type TCPMask interface {
+	WrapConnClient(net.Conn, *net.Destination, *Dialer) (net.Conn, error)
+	WrapConnServer(net.Conn) (net.Conn, error)
+	// Listen(net.Listener) (net.Listener, error)
 }
 
-func (m *UdpmaskManager) WrapPacketConnClient(raw net.PacketConn) (net.PacketConn, error) {
-	var sizes []int
-	var conns []net.PacketConn
-	for i, mask := range m.udpmasks {
-		if _, ok := mask.(headerConn); ok {
-			conn, err := mask.WrapPacketConnClient(nil, i, len(m.udpmasks)-1)
-			if err != nil {
-				return nil, err
-			}
-			sizes = append(sizes, conn.(headerSize).Size())
-			conns = append(conns, conn)
-		} else {
-			if len(conns) > 0 {
-				raw = &headerManagerConn{sizes: sizes, conns: conns, PacketConn: raw}
-				sizes = nil
-				conns = nil
-			}
-			var err error
-			raw, err = mask.WrapPacketConnClient(raw, i, len(m.udpmasks)-1)
-			if err != nil {
-				return nil, err
+type UDPMask interface {
+	WrapPacketConnClient(net.PacketConn, *net.Destination, *Dialer) (net.PacketConn, error)
+	WrapPacketConnServer(net.PacketConn, net.Addr, *ListenConfig) (net.PacketConn, error)
+}
+
+type FinalMask struct {
+	tcpMasks     []TCPMask
+	udpMasks     []UDPMask
+	dialTCP      func(context.Context, net.Destination) (net.Conn, error)
+	listen       func(context.Context, net.Addr) (net.Listener, error)
+	dialUDP      func(context.Context, net.Destination) (net.PacketConn, net.Addr, error)
+	listenPacket func(context.Context, net.Addr) (net.PacketConn, error)
+}
+
+func NewFinalMask(tcpMasks []TCPMask, udpMasks []UDPMask, dialTCP func(context.Context, net.Destination) (net.Conn, error), listen func(context.Context, net.Addr) (net.Listener, error), dialUDP func(context.Context, net.Destination) (net.PacketConn, net.Addr, error), listenPacket func(context.Context, net.Addr) (net.PacketConn, error)) *FinalMask {
+	slices.Reverse(tcpMasks)
+	slices.Reverse(udpMasks)
+	return &FinalMask{
+		tcpMasks:     tcpMasks,
+		udpMasks:     udpMasks,
+		dialTCP:      dialTCP,
+		dialUDP:      dialUDP,
+		listen:       listen,
+		listenPacket: listenPacket,
+	}
+}
+
+func (fm *FinalMask) DialTCP(ctx context.Context, dest net.Destination) (net.Conn, error) {
+	if len(fm.tcpMasks) == 0 {
+		return fm.dialTCP(ctx, dest)
+	}
+	for i := range fm.tcpMasks {
+		if i > 0 {
+			if _, ok := fm.tcpMasks[i].(interface{ HandleDial() }); ok {
+				return nil, fmt.Errorf("incorrect index: %d %T", i, fm.tcpMasks[i])
 			}
 		}
 	}
-
-	if len(conns) > 0 {
-		raw = &headerManagerConn{sizes: sizes, conns: conns, PacketConn: raw}
-		sizes = nil
-		conns = nil
+	var conn net.Conn
+	var err error
+	if _, ok := fm.tcpMasks[0].(interface{ HandleDial() }); !ok {
+		conn, err = fm.dialTCP(ctx, dest)
+		if err != nil {
+			return nil, err
+		}
 	}
-	return raw, nil
+	dialer := &Dialer{
+		DialTCP: func(dest net.Destination) (net.Conn, error) {
+			return fm.dialTCP(ctx, dest)
+		},
+		DialUDP: func(dest net.Destination) (net.Conn, error) {
+			conn, addr, err := fm.dialUDP(ctx, dest)
+			if err != nil {
+				return nil, err
+			}
+			return &PacketConnWrapper{PacketConn: conn, udpAddr: addr}, err
+		},
+	}
+	for i := range fm.tcpMasks {
+		var newConn net.Conn
+		newConn, err = fm.tcpMasks[i].WrapConnClient(conn, &dest, dialer)
+		if err != nil {
+			_ = conn.Close()
+			return nil, err
+		}
+		conn = newConn
+	}
+	return conn, nil
 }
 
-func (m *UdpmaskManager) WrapPacketConnServer(raw net.PacketConn) (net.PacketConn, error) {
-	var sizes []int
-	var conns []net.PacketConn
-	for i, mask := range m.udpmasks {
-		if _, ok := mask.(headerConn); ok {
-			conn, err := mask.WrapPacketConnServer(nil, i, len(m.udpmasks)-1)
-			if err != nil {
-				return nil, err
+func (fm *FinalMask) Listen(ctx context.Context, addr net.Addr) (net.Listener, error) {
+	if len(fm.tcpMasks) == 0 {
+		return fm.listen(ctx, addr)
+	}
+	off := 0
+	listener, err := fm.listen(ctx, addr)
+	if err != nil {
+		return nil, err
+	}
+	for i := range fm.tcpMasks {
+		if _, ok := fm.tcpMasks[i].(interface {
+			Listen(net.Listener) (net.Listener, error)
+		}); ok {
+			if i-off == 0 {
+				l, err := fm.tcpMasks[i].(interface {
+					Listen(net.Listener) (net.Listener, error)
+				}).Listen(listener)
+				if err != nil {
+					listener.Close()
+					return nil, err
+				}
+				listener = l
+			} else {
+				l, err := fm.tcpMasks[i].(interface {
+					Listen(net.Listener) (net.Listener, error)
+				}).Listen(&TCPListener{Listener: listener, tcpMasks: fm.tcpMasks[off:i]})
+				if err != nil {
+					listener.Close()
+					return nil, err
+				}
+				listener = l
 			}
-			sizes = append(sizes, conn.(headerSize).Size())
-			conns = append(conns, conn)
-		} else {
-			if len(conns) > 0 {
-				raw = &headerManagerConn{sizes: sizes, conns: conns, PacketConn: raw}
-				sizes = nil
-				conns = nil
-			}
-			var err error
-			raw, err = mask.WrapPacketConnServer(raw, i, len(m.udpmasks)-1)
-			if err != nil {
-				return nil, err
+			off = i + 1
+		}
+	}
+	if off < len(fm.tcpMasks) {
+		return &TCPListener{Listener: listener, tcpMasks: fm.tcpMasks[off:]}, nil
+	}
+	return listener, nil
+}
+
+func (fm *FinalMask) DialUDP(ctx context.Context, dest net.Destination) (net.Conn, error) {
+	if len(fm.udpMasks) == 0 {
+		conn, addr, err := fm.dialUDP(ctx, dest)
+		if err != nil {
+			return nil, err
+		}
+		return &PacketConnWrapper{PacketConn: conn, udpAddr: addr}, nil
+	}
+	for i := range fm.udpMasks {
+		if i > 0 {
+			if _, ok := fm.udpMasks[i].(interface{ HandleDial() }); ok {
+				return nil, fmt.Errorf("incorrect index: %d %T", i, fm.udpMasks[i])
 			}
 		}
 	}
-
+	var conn net.PacketConn
+	var addr net.Addr
+	var err error
+	if _, ok := fm.udpMasks[0].(interface{ HandleDial() }); !ok {
+		conn, addr, err = fm.dialUDP(ctx, dest)
+		if err != nil {
+			return nil, err
+		}
+	}
+	dialer := &Dialer{
+		DialTCP: func(dest net.Destination) (net.Conn, error) {
+			return fm.dialTCP(ctx, dest)
+		},
+		DialUDP: func(dest net.Destination) (net.Conn, error) {
+			conn, addr, err := fm.dialUDP(ctx, dest)
+			if err != nil {
+				return nil, err
+			}
+			return &PacketConnWrapper{PacketConn: conn, udpAddr: addr}, err
+		},
+	}
+	var sizes []int
+	var conns []net.PacketConn
+	for i := range fm.udpMasks {
+		var newConn net.PacketConn
+		if _, ok := fm.udpMasks[i].(interface{ HeaderConn() }); ok {
+			newConn, err = fm.udpMasks[i].WrapPacketConnClient(nil, nil, nil)
+			if err != nil {
+				_ = conn.Close()
+				return nil, err
+			}
+			sizes = append(sizes, newConn.(interface{ Size() int }).Size())
+			conns = append(conns, newConn)
+		} else {
+			if len(conns) > 0 {
+				conn = &headerManagerConn{PacketConn: conn, sizes: sizes, conns: conns}
+				sizes = nil
+				conns = nil
+			}
+			newConn, err = fm.udpMasks[i].WrapPacketConnClient(conn, &dest, dialer)
+			if err != nil {
+				_ = conn.Close()
+				return nil, err
+			}
+			conn = newConn
+		}
+	}
 	if len(conns) > 0 {
-		raw = &headerManagerConn{sizes: sizes, conns: conns, PacketConn: raw}
+		conn = &headerManagerConn{PacketConn: conn, sizes: sizes, conns: conns}
 		sizes = nil
 		conns = nil
 	}
-	return raw, nil
+	if addr == nil {
+		addr = &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
+	}
+	return &PacketConnWrapper{PacketConn: conn, udpAddr: addr}, nil
+}
+
+func (fm *FinalMask) ListenPacket(ctx context.Context, addr net.Addr) (net.PacketConn, error) {
+	if len(fm.udpMasks) == 0 {
+		return fm.listenPacket(ctx, addr)
+	}
+	for i := range fm.udpMasks {
+		if i > 0 {
+			if _, ok := fm.udpMasks[i].(interface{ HandleListen() }); ok {
+				return nil, fmt.Errorf("incorrect index: %d %T", i, fm.udpMasks[i])
+			}
+		}
+	}
+	var conn net.PacketConn
+	var err error
+	if _, ok := fm.udpMasks[0].(interface{ HandleListen() }); !ok {
+		conn, err = fm.listenPacket(ctx, addr)
+		if err != nil {
+			return nil, err
+		}
+	}
+	lc := &ListenConfig{
+		Listen:       func(addr net.Addr) (net.Listener, error) { return fm.listen(ctx, addr) },
+		ListenPacket: func(addr net.Addr) (net.PacketConn, error) { return fm.listenPacket(ctx, addr) },
+	}
+	var sizes []int
+	var conns []net.PacketConn
+	for i := range fm.udpMasks {
+		var newConn net.PacketConn
+		if _, ok := fm.udpMasks[i].(interface{ HeaderConn() }); ok {
+			newConn, err = fm.udpMasks[i].WrapPacketConnServer(nil, nil, nil)
+			if err != nil {
+				_ = conn.Close()
+				return nil, err
+			}
+			sizes = append(sizes, newConn.(interface{ Size() int }).Size())
+			conns = append(conns, newConn)
+		} else {
+			if len(conns) > 0 {
+				conn = &headerManagerConn{PacketConn: conn, sizes: sizes, conns: conns}
+				sizes = nil
+				conns = nil
+			}
+			newConn, err = fm.udpMasks[i].WrapPacketConnServer(conn, addr, lc)
+			if err != nil {
+				_ = conn.Close()
+				return nil, err
+			}
+			conn = newConn
+		}
+	}
+	if len(conns) > 0 {
+		conn = &headerManagerConn{PacketConn: conn, sizes: sizes, conns: conns}
+		sizes = nil
+		conns = nil
+	}
+	return conn, nil
 }
 
 const (
 	UDPSize = 4096
 )
 
-type headerConn interface {
-	HeaderConn()
+type PacketConnWrapper struct {
+	net.PacketConn
+	udpAddr net.Addr
 }
 
-type headerSize interface {
-	Size() int
+func (c *PacketConnWrapper) RemoteAddr() net.Addr {
+	return c.udpAddr
+}
+
+func (c *PacketConnWrapper) Read(b []byte) (n int, err error) {
+	n, _, err = c.PacketConn.ReadFrom(b)
+	return
+}
+
+func (c *PacketConnWrapper) Write(b []byte) (n int, err error) {
+	return c.PacketConn.WriteTo(b, c.udpAddr)
 }
 
 type headerManagerConn struct {
@@ -191,72 +379,27 @@ func (c *headerManagerConn) WriteTo(p []byte, addr net.Addr) (n int, err error)
 	return len(p), nil
 }
 
-type Tcpmask interface {
-	WrapConnClient(net.Conn) (net.Conn, error)
-	WrapConnServer(net.Conn) (net.Conn, error)
-}
-
-type TcpmaskManager struct {
-	tcpmasks []Tcpmask
-}
-
-func NewTcpmaskManager(tcpmasks []Tcpmask) *TcpmaskManager {
-	slices.Reverse(tcpmasks)
-	return &TcpmaskManager{tcpmasks: tcpmasks}
-}
-
-func (m *TcpmaskManager) WrapConnClient(raw net.Conn) (net.Conn, error) {
-	var err error
-	for _, mask := range m.tcpmasks {
-		raw, err = mask.WrapConnClient(raw)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return raw, nil
-}
-
-func (m *TcpmaskManager) WrapConnServer(raw net.Conn) (net.Conn, error) {
-	var err error
-	for _, mask := range m.tcpmasks {
-		raw, err = mask.WrapConnServer(raw)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return raw, nil
-}
-
-func (m *TcpmaskManager) WrapListener(l net.Listener) (net.Listener, error) {
-	return NewTcpListener(m, l)
-}
-
-type tcpListener struct {
-	m *TcpmaskManager
+type TCPListener struct {
 	net.Listener
+	tcpMasks []TCPMask
 }
 
-func NewTcpListener(m *TcpmaskManager, l net.Listener) (net.Listener, error) {
-	return &tcpListener{
-		m:        m,
-		Listener: l,
-	}, nil
-}
-
-func (l *tcpListener) Accept() (net.Conn, error) {
+func (l *TCPListener) Accept() (net.Conn, error) {
 	conn, err := l.Listener.Accept()
 	if err != nil {
 		return conn, err
 	}
 
-	newConn, err := l.m.WrapConnServer(conn)
-	if err != nil {
-		errors.LogDebugInner(context.Background(), err, "mask err")
-		_ = conn.Close()
-		return nil, err
+	for i := range l.tcpMasks {
+		var newConn net.Conn
+		newConn, err = l.tcpMasks[i].WrapConnServer(conn)
+		if err != nil {
+			_ = conn.Close()
+			return nil, err
+		}
+		conn = newConn
 	}
-
-	return newConn, nil
+	return conn, nil
 }
 
 type TcpMaskConn interface {

transport/internet/finalmask/fragment/config.go

@@ -1,11 +1,14 @@
 package fragment
 
-import "net"
+import (
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
+)
 
-func (c *Config) WrapConnClient(raw net.Conn) (net.Conn, error) {
-	return NewConnClient(c, raw, false)
+func (c *Config) WrapConnClient(conn net.Conn, dest *net.Destination, dialer *finalmask.Dialer) (net.Conn, error) {
+	return NewConnClient(c, conn, false)
 }
 
-func (c *Config) WrapConnServer(raw net.Conn) (net.Conn, error) {
-	return NewConnServer(c, raw, true)
+func (c *Config) WrapConnServer(conn net.Conn) (net.Conn, error) {
+	return NewConnServer(c, conn, true)
 }

transport/internet/finalmask/header/custom/config.go

@@ -1,29 +1,30 @@
 package custom
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *TCPConfig) WrapConnClient(raw net.Conn) (net.Conn, error) {
-	return NewConnClientTCP(c, raw)
+func (c *TCPConfig) WrapConnClient(conn net.Conn, dest *net.Destination, dialer *finalmask.Dialer) (net.Conn, error) {
+	return NewConnClientTCP(c, conn)
 }
 
-func (c *TCPConfig) WrapConnServer(raw net.Conn) (net.Conn, error) {
-	return NewConnServerTCP(c, raw)
+func (c *TCPConfig) WrapConnServer(conn net.Conn) (net.Conn, error) {
+	return NewConnServerTCP(c, conn)
 }
 
-func (c *UDPConfig) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClientUDP(c, raw)
+func (c *UDPConfig) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClientUDP(c, conn)
 }
 
-func (c *UDPConfig) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServerUDP(c, raw)
+func (c *UDPConfig) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServerUDP(c, conn)
 }
 
-func (c *UDPStandaloneConfig) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClientUDPStandalone(c, raw)
+func (c *UDPStandaloneConfig) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClientUDPStandalone(c, conn)
 }
 
-func (c *UDPStandaloneConfig) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServerUDPStandalone(c, raw)
+func (c *UDPStandaloneConfig) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServerUDPStandalone(c, conn)
 }

transport/internet/finalmask/header/custom/metadata_test.go

@@ -9,8 +9,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func TestMetadataEvaluatorRejectsUnknownName(t *testing.T) {
@@ -156,7 +154,7 @@ func TestMetadataUDPStandaloneWriteUsesRemotePort(t *testing.T) {
 	}
 	defer serverRaw.Close()
 
-	client, err := finalmask.NewUdpmaskManager([]finalmask.Udpmask{cfg}).WrapPacketConnClient(clientRaw)
+	client, err := cfg.WrapPacketConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -301,7 +299,7 @@ func TestMetadataTCPHandshakeUsesEndpointPorts(t *testing.T) {
 	}
 	defer serverRaw.Close()
 
-	client, err := clientCfg.WrapConnClient(clientRaw)
+	client, err := clientCfg.WrapConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

transport/internet/finalmask/header/custom/state_test.go

@@ -5,8 +5,6 @@ import (
 	"net"
 	"testing"
 	"time"
-
-	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func mustSendRecvUDP(t *testing.T, from net.PacketConn, to net.PacketConn, msg []byte) {
@@ -48,7 +46,6 @@ func TestStateUDPResponseReusesPriorCapturedValues(t *testing.T) {
 			},
 		},
 	}
-	maskManager := finalmask.NewUdpmaskManager([]finalmask.Udpmask{cfg})
 
 	clientRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
 	if err != nil {
@@ -62,11 +59,11 @@ func TestStateUDPResponseReusesPriorCapturedValues(t *testing.T) {
 	}
 	defer serverRaw.Close()
 
-	client, err := maskManager.WrapPacketConnClient(clientRaw)
+	client, err := cfg.WrapPacketConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
-	server, err := maskManager.WrapPacketConnServer(serverRaw)
+	server, err := cfg.WrapPacketConnServer(serverRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

transport/internet/finalmask/header/custom/tcp_runtime_test.go

@@ -37,7 +37,7 @@ func TestDSLTCPHandshakeReusesCapturedValue(t *testing.T) {
 	defer clientRaw.Close()
 	defer serverRaw.Close()
 
-	client, err := cfg.WrapConnClient(clientRaw)
+	client, err := cfg.WrapConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -117,7 +117,7 @@ func TestDSLTCPClientRejectsMismatchedResponseSequence(t *testing.T) {
 	defer clientRaw.Close()
 	defer serverRaw.Close()
 
-	client, err := clientCfg.WrapConnClient(clientRaw)
+	client, err := clientCfg.WrapConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

transport/internet/finalmask/mkcp/aes128gcm/config.go

@@ -1,15 +1,16 @@
 package aes128gcm
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func (c *Config) HeaderConn() {}
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/mkcp/header/config.go

@@ -1,15 +1,16 @@
 package header
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func (c *Config) HeaderConn() {}
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/mkcp/original/config.go

@@ -1,15 +1,16 @@
 package original
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func (c *Config) HeaderConn() {}
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/noise/config.go

@@ -1,11 +1,14 @@
 package noise
 
-import "net"
+import (
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
+)
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/realm/config.go

@@ -1,23 +1,14 @@
 package realm
 
 import (
-	"net"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	_, ok1 := raw.(*internet.FakePacketConn)
-	if level != 0 || ok1 {
-		return nil, errors.New("realm requires being at the outermost level")
-	}
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	if level != 0 {
-		return nil, errors.New("realm requires being at the outermost level")
-	}
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/salamander/config.go

@@ -1,23 +1,24 @@
 package salamander
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 func (c *Config) HeaderConn() {}
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewSalamanderConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewSalamanderConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewSalamanderConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewSalamanderConnServer(c, conn)
 }
 
-func (c *GeckoConfig) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewGeckoConnClient(c, raw)
+func (c *GeckoConfig) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewGeckoConnClient(c, conn)
 }
 
-func (c *GeckoConfig) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	return NewGeckoConnServer(c, raw)
+func (c *GeckoConfig) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewGeckoConnServer(c, conn)
 }

transport/internet/finalmask/sudoku/config.go

@@ -1,19 +1,18 @@
 package sudoku
 
 import (
-	"net"
-
-	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
 // Sudoku in finalmask mode is a pure appearance transform with no standalone handshake.
 // TCP always keeps classic sudoku on uplink and uses packed downlink optimization on server writes.
-func (c *Config) WrapConnClient(raw net.Conn) (net.Conn, error) {
-	return newPackedDirectionalConn(raw, c, true)
+func (c *Config) WrapConnClient(conn net.Conn, dest *net.Destination, dialer *finalmask.Dialer) (net.Conn, error) {
+	return newPackedDirectionalConn(conn, c, true)
 }
 
-func (c *Config) WrapConnServer(raw net.Conn) (net.Conn, error) {
-	return newPackedDirectionalConn(raw, c, false)
+func (c *Config) WrapConnServer(conn net.Conn) (net.Conn, error) {
+	return newPackedDirectionalConn(conn, c, false)
 }
 
 func newPackedDirectionalConn(raw net.Conn, config *Config, readPacked bool) (net.Conn, error) {
@@ -36,16 +35,10 @@ func newPackedDirectionalConn(raw net.Conn, config *Config, readPacked bool) (ne
 	return newWrappedConn(raw, reader, writer), nil
 }
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	if level != levelCount {
-		return nil, errors.New("sudoku udp mask must be the innermost mask in chain")
-	}
-	return NewUDPConn(raw, c)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewUDPConn(conn, c)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	if level != levelCount {
-		return nil, errors.New("sudoku udp mask must be the innermost mask in chain")
-	}
-	return NewUDPConn(raw, c)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewUDPConn(conn, c)
 }

transport/internet/finalmask/tcp_test.go

@@ -2,12 +2,14 @@ package finalmask_test
 
 import (
 	"bytes"
+	"context"
 	"io"
-	"net"
+	gonet "net"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
 )
@@ -20,11 +22,14 @@ func mustSendRecvTcp(
 ) {
 	t.Helper()
 
+	waitCh := make(chan error)
+
 	go func() {
 		_, err := from.Write(msg)
 		if err != nil {
-			t.Error(err)
+			t.Fatal(err)
 		}
+		close(waitCh)
 	}()
 
 	buf := make([]byte, 1024)
@@ -40,18 +45,23 @@ func mustSendRecvTcp(
 	if !bytes.Equal(buf[:n], msg) {
 		t.Fatalf("unexpected data %q", buf[:n])
 	}
+
+	<-waitCh
 }
 
 type layerMaskTcp struct {
 	name string
-	mask finalmask.Tcpmask
+	mask finalmask.TCPMask
 }
 
 type failingWrapMask struct{}
 
-func (failingWrapMask) TCP()                                            {}
-func (f failingWrapMask) WrapConnClient(raw net.Conn) (net.Conn, error) { return raw, nil }
-func (f failingWrapMask) WrapConnServer(raw net.Conn) (net.Conn, error) {
+func (failingWrapMask) TCP() {}
+func (f failingWrapMask) WrapConnClient(conn net.Conn, dest *net.Destination, dialer *finalmask.Dialer) (net.Conn, error) {
+	return conn, nil
+}
+
+func (f failingWrapMask) WrapConnServer(conn net.Conn) (net.Conn, error) {
 	return nil, io.ErrClosedPipe
 }
 
@@ -92,32 +102,31 @@ func TestConnReadWrite(t *testing.T) {
 		t.Run(c.name, func(t *testing.T) {
 			mask := c.mask
 
-			maskManager := finalmask.NewTcpmaskManager([]finalmask.Tcpmask{mask})
+			dialTCP := func(ctx context.Context, dest net.Destination) (net.Conn, error) {
+				return net.Dial("tcp", dest.NetAddr())
+			}
+			listen := func(ctx context.Context, addr net.Addr) (net.Listener, error) {
+				return net.Listen("tcp", addr.String())
+			}
+			finalMask := finalmask.NewFinalMask([]finalmask.TCPMask{mask}, nil, dialTCP, listen, nil, nil)
 
-			ln, err := net.Listen("tcp", "127.0.0.1:0")
+			listener, err := finalMask.Listen(context.Background(), &net.TCPAddr{IP: net.LocalHostIP.IP()})
 			if err != nil {
 				t.Fatal(err)
 			}
+			t.Cleanup(func() { listener.Close() })
 
-			client, err := net.Dial("tcp", ln.Addr().String())
+			client, err := finalMask.DialTCP(context.Background(), net.TCPDestination(net.IPAddress(listener.Addr().(*net.TCPAddr).IP), net.Port(listener.Addr().(*net.TCPAddr).Port)))
 			if err != nil {
 				t.Fatal(err)
 			}
+			t.Cleanup(func() { client.Close() })
 
-			client, err = maskManager.WrapConnClient(client)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			server, err := ln.Accept()
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			server, err = maskManager.WrapConnServer(server)
+			server, err := listener.Accept()
 			if err != nil {
 				t.Fatal(err)
 			}
+			t.Cleanup(func() { server.Close() })
 
 			_ = client.SetDeadline(time.Now().Add(time.Second))
 			_ = server.SetDeadline(time.Now().Add(time.Second))
@@ -150,34 +159,32 @@ func TestTCPcustomStaticHandshakeRoundTrip(t *testing.T) {
 			},
 		},
 	}
-	maskManager := finalmask.NewTcpmaskManager([]finalmask.Tcpmask{cfg})
 
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
+	dialTCP := func(ctx context.Context, dest net.Destination) (net.Conn, error) {
+		return net.Dial("tcp", dest.NetAddr())
 	}
-	defer ln.Close()
+	listen := func(ctx context.Context, addr net.Addr) (net.Listener, error) {
+		return net.Listen("tcp", addr.String())
+	}
+	finalMask := finalmask.NewFinalMask([]finalmask.TCPMask{cfg}, nil, dialTCP, listen, nil, nil)
 
-	clientRaw, err := net.Dial("tcp", ln.Addr().String())
+	listener, err := finalMask.Listen(context.Background(), &net.TCPAddr{IP: net.LocalHostIP.IP()})
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer clientRaw.Close()
+	defer listener.Close()
 
-	serverRaw, err := ln.Accept()
+	client, err := finalMask.DialTCP(context.Background(), net.TCPDestination(net.IPAddress(listener.Addr().(*net.TCPAddr).IP), net.Port(listener.Addr().(*net.TCPAddr).Port)))
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer serverRaw.Close()
+	defer client.Close()
 
-	client, err := maskManager.WrapConnClient(clientRaw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	server, err := maskManager.WrapConnServer(serverRaw)
+	server, err := listener.Accept()
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer server.Close()
 
 	_ = client.SetDeadline(time.Now().Add(time.Second))
 	_ = server.SetDeadline(time.Now().Add(time.Second))
@@ -220,11 +227,11 @@ func TestTCPcustomClientRejectsMismatchedServerSequence(t *testing.T) {
 		},
 	}
 
-	clientRaw, serverRaw := net.Pipe()
+	clientRaw, serverRaw := gonet.Pipe()
 	defer clientRaw.Close()
 	defer serverRaw.Close()
 
-	client, err := clientCfg.WrapConnClient(clientRaw)
+	client, err := clientCfg.WrapConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -257,42 +264,37 @@ func TestTCPcustomClientRejectsMismatchedServerSequence(t *testing.T) {
 }
 
 func TestTCPWrapListenerRejectsImmediateWrapErrors(t *testing.T) {
-	clientManager := finalmask.NewTcpmaskManager([]finalmask.Tcpmask{failingWrapMask{}})
-	serverManager := finalmask.NewTcpmaskManager([]finalmask.Tcpmask{failingWrapMask{}})
+	dialTCP := func(ctx context.Context, dest net.Destination) (net.Conn, error) {
+		return net.Dial("tcp", dest.NetAddr())
+	}
+	listen := func(ctx context.Context, addr net.Addr) (net.Listener, error) {
+		return net.Listen("tcp", addr.String())
+	}
+	finalMask := finalmask.NewFinalMask([]finalmask.TCPMask{failingWrapMask{}}, nil, dialTCP, listen, nil, nil)
 
-	rawLn, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer rawLn.Close()
-
-	ln, err := serverManager.WrapListener(rawLn)
+	listener, err := finalMask.Listen(context.Background(), &net.TCPAddr{IP: net.LocalHostIP.IP()})
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer listener.Close()
 
 	accepted := make(chan struct {
 		conn net.Conn
 		err  error
 	}, 1)
 	go func() {
-		conn, err := ln.Accept()
+		conn, err := listener.Accept()
 		accepted <- struct {
 			conn net.Conn
 			err  error
 		}{conn: conn, err: err}
 	}()
 
-	clientRaw, err := net.Dial("tcp", rawLn.Addr().String())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer clientRaw.Close()
-
-	client, err := clientManager.WrapConnClient(clientRaw)
+	client, err := finalMask.DialTCP(context.Background(), net.TCPDestination(net.IPAddress(listener.Addr().(*net.TCPAddr).IP), net.Port(listener.Addr().(*net.TCPAddr).Port)))
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer client.Close()
 
 	_ = client.SetDeadline(time.Now().Add(time.Second))
 

transport/internet/finalmask/udp_test.go

@@ -2,13 +2,15 @@ package finalmask_test
 
 import (
 	"bytes"
+	"context"
 	"encoding/binary"
 	"io"
-	"net"
+	gonet "net"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/proxy"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
@@ -51,7 +53,7 @@ func mustSendRecv(
 
 type layerMask struct {
 	name   string
-	mask   finalmask.Udpmask
+	mask   finalmask.UDPMask
 	layers int
 }
 
@@ -213,25 +215,23 @@ func newStandaloneStunLikeUDPServerConfig() *custom.UDPStandaloneConfig {
 func newUDPClientServerPair(t *testing.T, cfg *custom.UDPStandaloneConfig) (net.PacketConn, net.PacketConn, net.PacketConn, net.PacketConn) {
 	t.Helper()
 
-	clientRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+	clientRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = clientRaw.Close() })
 
-	serverRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+	serverRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = serverRaw.Close() })
 
-	maskManager := finalmask.NewUdpmaskManager([]finalmask.Udpmask{cfg})
-
-	client, err := maskManager.WrapPacketConnClient(clientRaw)
+	client, err := cfg.WrapPacketConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
-	server, err := maskManager.WrapPacketConnServer(serverRaw)
+	server, err := cfg.WrapPacketConnServer(serverRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -348,31 +348,39 @@ func TestPacketConnReadWrite(t *testing.T) {
 			if layers <= 0 {
 				layers = 1
 			}
-			masks := make([]finalmask.Udpmask, 0, layers)
+			masks := make([]finalmask.UDPMask, 0, layers)
 			for i := 0; i < layers; i++ {
 				masks = append(masks, mask)
 			}
-			maskManager := finalmask.NewUdpmaskManager(masks)
 
-			client, err := net.ListenPacket("udp", "127.0.0.1:0")
+			dialUDP := func(ctx context.Context, dest net.Destination) (net.PacketConn, net.Addr, error) {
+				udpAddr, err := net.ResolveUDPAddr("udp", dest.NetAddr())
+				if err != nil {
+					return nil, nil, err
+				}
+				conn, err := gonet.ListenPacket("udp", "127.0.0.1:0")
+				if err != nil {
+					return nil, nil, err
+				}
+				return conn, udpAddr, nil
+			}
+			listenPacket := func(ctx context.Context, addr net.Addr) (net.PacketConn, error) {
+				return gonet.ListenPacket(addr.Network(), addr.String())
+			}
+			finalMask := finalmask.NewFinalMask(nil, masks, nil, nil, dialUDP, listenPacket)
+
+			server, err := finalMask.ListenPacket(context.Background(), &net.UDPAddr{IP: net.LocalHostIP.IP()})
 			if err != nil {
 				t.Fatal(err)
 			}
+			t.Cleanup(func() { server.Close() })
 
-			client, err = maskManager.WrapPacketConnClient(client)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			server, err := net.ListenPacket("udp", "127.0.0.1:0")
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			server, err = maskManager.WrapPacketConnServer(server)
+			clientConn, err := finalMask.DialUDP(context.Background(), net.UDPDestination(net.IPAddress(server.LocalAddr().(*net.UDPAddr).IP), net.Port(server.LocalAddr().(*net.UDPAddr).Port)))
 			if err != nil {
 				t.Fatal(err)
 			}
+			t.Cleanup(func() { clientConn.Close() })
+			client := clientConn.(*finalmask.PacketConnWrapper).PacketConn
 
 			_ = client.SetDeadline(time.Now().Add(time.Second))
 			_ = server.SetDeadline(time.Now().Add(time.Second))
@@ -397,21 +405,20 @@ func TestUDPcustomStaticHeaderWireShape(t *testing.T) {
 			{Rand: 1, RandMin: 0x30, RandMax: 0x40},
 		},
 	}
-	maskManager := finalmask.NewUdpmaskManager([]finalmask.Udpmask{cfg})
 
-	clientRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+	clientRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer clientRaw.Close()
 
-	serverRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+	serverRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer serverRaw.Close()
 
-	client, err := maskManager.WrapPacketConnClient(clientRaw)
+	client, err := cfg.WrapPacketConnClient(clientRaw, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -642,11 +649,11 @@ func TestSudokuBDD(t *testing.T) {
 			Ascii:    "prefer_ascii",
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -683,11 +690,11 @@ func TestSudokuBDD(t *testing.T) {
 			PaddingMax: 0,
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -738,10 +745,10 @@ func TestSudokuBDD(t *testing.T) {
 		countWireBytes := func(wrapServer func(net.Conn, *sudoku.Config) (net.Conn, error), cfg *sudoku.Config) int64 {
 			t.Helper()
 
-			clientRaw, serverRaw := net.Pipe()
+			clientRaw, serverRaw := gonet.Pipe()
 			watchedServerRaw := &countingConn{Conn: serverRaw}
 
-			clientConn, err := cfg.WrapConnClient(clientRaw)
+			clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -793,11 +800,11 @@ func TestSudokuBDD(t *testing.T) {
 			CustomTables: []string{"xpxvvpvv", "vxpvxvvp"},
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -835,11 +842,11 @@ func TestSudokuBDD(t *testing.T) {
 			PaddingMax:   0,
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -868,19 +875,6 @@ func TestSudokuBDD(t *testing.T) {
 		}
 	})
 
-	t.Run("GivenSudokuUDPMask_WhenNotInnermost_ThenWrapFails", func(t *testing.T) {
-		cfg := &sudoku.Config{Password: "sudoku-udp"}
-		raw, err := net.ListenPacket("udp", "127.0.0.1:0")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer raw.Close()
-
-		if _, err := cfg.WrapPacketConnClient(raw, 0, 1); err == nil {
-			t.Fatal("expected innermost check failure")
-		}
-	})
-
 	t.Run("GivenSudokuMultiTableUDPMask_WhenClientSendsMultipleDatagrams_ThenPayloadMatches", func(t *testing.T) {
 		cfg := &sudoku.Config{
 			Password:     "sudoku-udp-multi",
@@ -889,25 +883,24 @@ func TestSudokuBDD(t *testing.T) {
 			PaddingMin:   0,
 			PaddingMax:   0,
 		}
-		maskManager := finalmask.NewUdpmaskManager([]finalmask.Udpmask{cfg})
 
-		clientRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+		clientRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 		if err != nil {
 			t.Fatal(err)
 		}
 		defer clientRaw.Close()
 
-		serverRaw, err := net.ListenPacket("udp", "127.0.0.1:0")
+		serverRaw, err := gonet.ListenPacket("udp", "127.0.0.1:0")
 		if err != nil {
 			t.Fatal(err)
 		}
 		defer serverRaw.Close()
 
-		client, err := maskManager.WrapPacketConnClient(clientRaw)
+		client, err := cfg.WrapPacketConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
-		server, err := maskManager.WrapPacketConnServer(serverRaw)
+		server, err := cfg.WrapPacketConnServer(serverRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -961,7 +954,7 @@ func TestSudokuBDD(t *testing.T) {
 		}
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -1008,11 +1001,11 @@ func TestSudokuBDD(t *testing.T) {
 			Ascii:    "prefer_entropy",
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -1032,11 +1025,11 @@ func TestSudokuBDD(t *testing.T) {
 			Ascii:    "prefer_entropy",
 		}
 
-		clientRaw, serverRaw := net.Pipe()
+		clientRaw, serverRaw := gonet.Pipe()
 		defer clientRaw.Close()
 		defer serverRaw.Close()
 
-		clientConn, err := cfg.WrapConnClient(clientRaw)
+		clientConn, err := cfg.WrapConnClient(clientRaw, nil, nil)
 		if err != nil {
 			t.Fatal(err)
 		}

transport/internet/finalmask/udphop/config.go

@@ -1,20 +1,17 @@
 package udphop
 
 import (
-	"net"
-
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	_, ok1 := raw.(*internet.FakePacketConn)
-	if level != 0 || ok1 {
-		return nil, errors.New("udphop requires being at the outermost level")
-	}
-	return NewUDPHopConn(c, raw)
+func (c *Config) HandleDial() {}
+
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewUDPHopConn(c, dest, dialer)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
 	return nil, errors.New("udphop: client only")
 }

transport/internet/finalmask/udphop/config.pb.go

@@ -7,7 +7,6 @@
 package udphop
 
 import (
-	internet "github.com/xtls/xray-core/transport/internet"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -24,14 +23,13 @@ const (
 
 type Config struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
-	Sockopt       *internet.SocketConfig `protobuf:"bytes,1,opt,name=sockopt,proto3" json:"sockopt,omitempty"`
 	Local         bool                   `protobuf:"varint,2,opt,name=local,proto3" json:"local,omitempty"`
 	Remote        bool                   `protobuf:"varint,3,opt,name=remote,proto3" json:"remote,omitempty"`
 	RemoteOnce    bool                   `protobuf:"varint,4,opt,name=remote_once,json=remoteOnce,proto3" json:"remote_once,omitempty"`
 	IntervalMin   int64                  `protobuf:"varint,5,opt,name=interval_min,json=intervalMin,proto3" json:"interval_min,omitempty"`
 	IntervalMax   int64                  `protobuf:"varint,6,opt,name=interval_max,json=intervalMax,proto3" json:"interval_max,omitempty"`
-	RemotePorts   []uint32               `protobuf:"varint,7,rep,packed,name=remote_ports,json=remotePorts,proto3" json:"remote_ports,omitempty"`
-	RemoteIPs     []string               `protobuf:"bytes,8,rep,name=remoteIPs,proto3" json:"remoteIPs,omitempty"`
+	RemoteIPs     []string               `protobuf:"bytes,7,rep,name=remoteIPs,proto3" json:"remoteIPs,omitempty"`
+	RemotePorts   []uint32               `protobuf:"varint,8,rep,packed,name=remote_ports,json=remotePorts,proto3" json:"remote_ports,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -66,13 +64,6 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_transport_internet_finalmask_udphop_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetSockopt() *internet.SocketConfig {
-	if x != nil {
-		return x.Sockopt
-	}
-	return nil
-}
-
 func (x *Config) GetLocal() bool {
 	if x != nil {
 		return x.Local
@@ -108,16 +99,16 @@ func (x *Config) GetIntervalMax() int64 {
 	return 0
 }
 
-func (x *Config) GetRemotePorts() []uint32 {
+func (x *Config) GetRemoteIPs() []string {
 	if x != nil {
-		return x.RemotePorts
+		return x.RemoteIPs
 	}
 	return nil
 }
 
-func (x *Config) GetRemoteIPs() []string {
+func (x *Config) GetRemotePorts() []uint32 {
 	if x != nil {
-		return x.RemoteIPs
+		return x.RemotePorts
 	}
 	return nil
 }
@@ -126,17 +117,16 @@ var File_transport_internet_finalmask_udphop_config_proto protoreflect.FileDescr
 
 const file_transport_internet_finalmask_udphop_config_proto_rawDesc = "" +
 	"\n" +
-	"0transport/internet/finalmask/udphop/config.proto\x12(xray.transport.internet.finalmask.udphop\x1a\x1ftransport/internet/config.proto\"\x9f\x02\n" +
-	"\x06Config\x12?\n" +
-	"\asockopt\x18\x01 \x01(\v2%.xray.transport.internet.SocketConfigR\asockopt\x12\x14\n" +
+	"0transport/internet/finalmask/udphop/config.proto\x12(xray.transport.internet.finalmask.udphop\"\xe4\x01\n" +
+	"\x06Config\x12\x14\n" +
 	"\x05local\x18\x02 \x01(\bR\x05local\x12\x16\n" +
 	"\x06remote\x18\x03 \x01(\bR\x06remote\x12\x1f\n" +
 	"\vremote_once\x18\x04 \x01(\bR\n" +
 	"remoteOnce\x12!\n" +
 	"\finterval_min\x18\x05 \x01(\x03R\vintervalMin\x12!\n" +
-	"\finterval_max\x18\x06 \x01(\x03R\vintervalMax\x12!\n" +
-	"\fremote_ports\x18\a \x03(\rR\vremotePorts\x12\x1c\n" +
-	"\tremoteIPs\x18\b \x03(\tR\tremoteIPsB\x9a\x01\n" +
+	"\finterval_max\x18\x06 \x01(\x03R\vintervalMax\x12\x1c\n" +
+	"\tremoteIPs\x18\a \x03(\tR\tremoteIPs\x12!\n" +
+	"\fremote_ports\x18\b \x03(\rR\vremotePortsJ\x04\b\x01\x10\x02B\x9a\x01\n" +
 	",com.xray.transport.internet.finalmask.udphopP\x01Z=github.com/xtls/xray-core/transport/internet/finalmask/udphop\xaa\x02(Xray.Transport.Internet.Finalmask.Udphopb\x06proto3"
 
 var (
@@ -153,16 +143,14 @@ func file_transport_internet_finalmask_udphop_config_proto_rawDescGZIP() []byte
 
 var file_transport_internet_finalmask_udphop_config_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_transport_internet_finalmask_udphop_config_proto_goTypes = []any{
-	(*Config)(nil),                // 0: xray.transport.internet.finalmask.udphop.Config
-	(*internet.SocketConfig)(nil), // 1: xray.transport.internet.SocketConfig
+	(*Config)(nil), // 0: xray.transport.internet.finalmask.udphop.Config
 }
 var file_transport_internet_finalmask_udphop_config_proto_depIdxs = []int32{
-	1, // 0: xray.transport.internet.finalmask.udphop.Config.sockopt:type_name -> xray.transport.internet.SocketConfig
-	1, // [1:1] is the sub-list for method output_type
-	1, // [1:1] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
 }
 
 func init() { file_transport_internet_finalmask_udphop_config_proto_init() }

transport/internet/finalmask/udphop/config.proto

@@ -6,16 +6,14 @@ option go_package = "github.com/xtls/xray-core/transport/internet/finalmask/udph
 option java_package = "com.xray.transport.internet.finalmask.udphop";
 option java_multiple_files = true;
 
-import "transport/internet/config.proto";
-
 message Config {
-  xray.transport.internet.SocketConfig sockopt = 1;
+  reserved 1;
   bool local = 2;
   bool remote = 3;
   bool remote_once = 4;
   int64 interval_min = 5;
   int64 interval_max = 6;
-  repeated uint32 remote_ports = 7;
-  repeated string remoteIPs = 8;
+  repeated string remoteIPs = 7;
+  repeated uint32 remote_ports = 8;
 }
 

transport/internet/finalmask/udphop/conn.go

@@ -6,9 +6,7 @@ import (
 	goerrors "errors"
 	"io"
 	mrand "math/rand"
-	gonet "net"
 	"net/netip"
-	"reflect"
 	"sync"
 	"time"
 
@@ -16,8 +14,6 @@ import (
 	"github.com/xtls/xray-core/common/crypto"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/net/cnc"
-	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
@@ -34,16 +30,14 @@ type packet struct {
 }
 
 type udpHopConn struct {
-	conn       net.PacketConn
-	sockopt    *internet.SocketConfig
-	local      bool
-	remote     bool
-	remoteOnce bool
+	dialer *finalmask.Dialer
+	local  bool
+	remote bool
 
 	intervalMin int64
 	intervalMax int64
-	remotePorts []uint32
 	remoteIPs   []netip.Prefix
+	remotePorts []uint32
 
 	deadline      time.Time
 	readDeadline  time.Time
@@ -55,10 +49,10 @@ type udpHopConn struct {
 	readCh  chan packet
 	closeCh chan struct{}
 	wg      sync.WaitGroup
-	mu      sync.Mutex
+	mu      sync.RWMutex
 }
 
-func NewUDPHopConn(c *Config, raw net.PacketConn) (net.PacketConn, error) {
+func NewUDPHopConn(c *Config, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
 	if c.IntervalMin < 5 || c.IntervalMax < 5 {
 		return nil, errors.New("invalid interval")
 	}
@@ -66,22 +60,40 @@ func NewUDPHopConn(c *Config, raw net.PacketConn) (net.PacketConn, error) {
 	for _, ip := range c.RemoteIPs {
 		remoteIPs = append(remoteIPs, netip.MustParsePrefix(ip))
 	}
-	conn := &udpHopConn{
-		conn:       raw,
-		sockopt:    c.Sockopt,
-		local:      c.Local,
-		remote:     c.Remote,
-		remoteOnce: c.RemoteOnce,
+	remotePorts := c.RemotePorts
+	if c.Remote || c.RemoteOnce {
+		if len(remoteIPs) > 0 {
+			dest.Address = net.IPAddress(randPrefix(remoteIPs[mrand.Intn(len(remoteIPs))]))
+		}
+		if len(remotePorts) > 0 {
+			dest.Port = net.Port(remotePorts[mrand.Intn(len(remotePorts))])
+		}
+	}
+	conn, err := dialer.DialUDP(*dest)
+	if err != nil {
+		return nil, err
+	}
+	cur := conn.(*finalmask.PacketConnWrapper).PacketConn
+	addr := conn.RemoteAddr().(*net.UDPAddr)
+	client := &udpHopConn{
+		dialer: dialer,
+		local:  c.Local,
+		remote: c.Remote,
 
 		intervalMin: c.IntervalMin,
 		intervalMax: c.IntervalMax,
-		remotePorts: c.RemotePorts,
 		remoteIPs:   remoteIPs,
+		remotePorts: remotePorts,
 
+		cur:     cur,
+		addr:    addr,
 		readCh:  make(chan packet),
 		closeCh: make(chan struct{}),
 	}
-	return conn, nil
+	go client.run()
+	client.wg.Add(1)
+	go client.recv(client.cur)
+	return client, nil
 }
 
 func (c *udpHopConn) closed() bool {
@@ -93,61 +105,67 @@ func (c *udpHopConn) closed() bool {
 	}
 }
 
-func (c *udpHopConn) hop(addr *net.UDPAddr) {
+func (c *udpHopConn) run() {
+	ticker := time.NewTicker(time.Second * time.Duration(crypto.RandBetween(c.intervalMin, c.intervalMax+1)))
+	defer ticker.Stop()
+	for {
+		select {
+		case <-c.closeCh:
+			return
+		case <-ticker.C:
+			ticker.Reset(time.Second * time.Duration(crypto.RandBetween(c.intervalMin, c.intervalMax+1)))
+			c.hop()
+		}
+	}
+}
+
+func (c *udpHopConn) hop() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
 	if c.closed() {
 		return
 	}
-	newAddr := &net.UDPAddr{IP: addr.IP, Port: addr.Port}
-	newConn := c.conn
-	if c.remote || c.remoteOnce && c.addr == nil {
-		if len(c.remotePorts) > 0 {
-			newAddr.Port = int(c.remotePorts[mrand.Intn(len(c.remotePorts))])
-		}
+	oldIP := c.addr.IP
+	oldPort := c.addr.Port
+	if c.remote {
 		if len(c.remoteIPs) > 0 {
-			newAddr.IP = randPrefix(c.remoteIPs[mrand.Intn(len(c.remoteIPs))])
+			c.addr.IP = randPrefix(c.remoteIPs[mrand.Intn(len(c.remoteIPs))])
+		}
+		if len(c.remotePorts) > 0 {
+			c.addr.Port = int(c.remotePorts[mrand.Intn(len(c.remotePorts))])
 		}
 	}
 	if c.local {
-		raw, err := internet.DialSystem(context.Background(), net.UDPDestination(net.IPAddress(newAddr.IP), net.Port(newAddr.Port)), c.sockopt)
+		conn, err := c.dialer.DialUDP(net.UDPDestination(net.IPAddress(c.addr.IP), net.Port(c.addr.Port)))
 		if err != nil {
+			c.addr.IP = oldIP
+			c.addr.Port = oldPort
 			errors.LogErrorInner(context.Background(), err, "hop err")
 			return
 		}
-		switch c := raw.(type) {
-		case *internet.PacketConnWrapper:
-			newConn = c.PacketConn
-		case *cnc.Connection:
-			newConn = &internet.FakePacketConn{Conn: c}
-		default:
-			panic(reflect.TypeOf(c))
-		}
-		newConn.SetDeadline(c.deadline)
-		newConn.SetReadDeadline(c.readDeadline)
-		newConn.SetWriteDeadline(c.writeDeadline)
+		conn.SetDeadline(c.deadline)
+		conn.SetReadDeadline(c.readDeadline)
+		conn.SetWriteDeadline(c.writeDeadline)
 		if c.pre != nil {
 			_ = c.pre.Close()
 		}
 		c.pre = c.cur
+		c.cur = conn.(*finalmask.PacketConnWrapper).PacketConn
 		c.wg.Add(1)
-		go c.recv(newConn)
+		go c.recv(c.cur)
 	}
-	c.addr = newAddr
-	c.cur = newConn
 }
 
 func (c *udpHopConn) recv(conn net.PacketConn) {
 	defer c.wg.Done()
 
 	for {
-		if c.closed() {
-			return
-		}
 		p := pool.Get().([]byte)
 		n, addr, err := conn.ReadFrom(p)
 		if err != nil {
 			pool.Put(p[:cap(p)])
-			if goerrors.Is(err, io.EOF) || goerrors.Is(err, io.ErrClosedPipe) || goerrors.Is(err, gonet.ErrClosed) {
-				break
+			if c.closed() {
+				return
 			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
@@ -156,9 +174,10 @@ func (c *udpHopConn) recv(conn net.PacketConn) {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
 			errors.LogErrorInner(context.Background(), err, "recv err")
-			continue
+			return
 		}
 		select {
 		case c.readCh <- packet{p: p[:n], addr: addr}:
@@ -169,22 +188,6 @@ func (c *udpHopConn) recv(conn net.PacketConn) {
 	}
 }
 
-func (c *udpHopConn) hopLoop() {
-	ticker := time.NewTicker(time.Second * time.Duration(crypto.RandBetween(c.intervalMin, c.intervalMax+1)))
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			ticker.Reset(time.Second * time.Duration(crypto.RandBetween(c.intervalMin, c.intervalMax+1)))
-			c.mu.Lock()
-			c.hop(c.addr)
-			c.mu.Unlock()
-		case <-c.closeCh:
-			return
-		}
-	}
-}
-
 func (c *udpHopConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
 	packet, ok := <-c.readCh
 	if ok {
@@ -194,21 +197,12 @@ func (c *udpHopConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
 		}
 		return n, packet.addr, packet.err
 	}
-	return 0, nil, io.EOF
+	return 0, nil, io.ErrClosedPipe
 }
 
 func (c *udpHopConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.cur == nil {
-		c.hop(addr.(*net.UDPAddr))
-		if c.cur == nil {
-			return 0, nil
-		}
-		go c.hopLoop()
-	}
-
+	c.mu.RLock()
+	defer c.mu.RUnlock()
 	_, err = c.cur.WriteTo(p, c.addr)
 	if err != nil {
 		errors.LogErrorInner(context.Background(), err, "send err")
@@ -227,15 +221,12 @@ func (c *udpHopConn) Close() error {
 	if c.pre != nil {
 		_ = c.pre.Close()
 	}
-	if c.cur != nil {
-		_ = c.cur.Close()
-	}
-	_ = c.conn.Close()
+	_ = c.cur.Close()
 	c.wg.Wait()
 	select {
-	case p := <-c.readCh:
-		if p.p != nil {
-			pool.Put(p.p[:cap(p.p)])
+	case packet := <-c.readCh:
+		if packet.p != nil {
+			pool.Put(packet.p[:cap(packet.p)])
 		}
 	default:
 	}
@@ -244,7 +235,9 @@ func (c *udpHopConn) Close() error {
 }
 
 func (c *udpHopConn) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.cur.LocalAddr()
 }
 
 func (c *udpHopConn) SetDeadline(t time.Time) error {
@@ -254,10 +247,7 @@ func (c *udpHopConn) SetDeadline(t time.Time) error {
 	if c.pre != nil {
 		_ = c.pre.SetDeadline(t)
 	}
-	if c.cur != nil {
-		_ = c.cur.SetDeadline(t)
-	}
-	return nil
+	return c.cur.SetDeadline(t)
 }
 
 func (c *udpHopConn) SetReadDeadline(t time.Time) error {
@@ -267,10 +257,7 @@ func (c *udpHopConn) SetReadDeadline(t time.Time) error {
 	if c.pre != nil {
 		_ = c.pre.SetReadDeadline(t)
 	}
-	if c.cur != nil {
-		_ = c.cur.SetReadDeadline(t)
-	}
-	return nil
+	return c.cur.SetReadDeadline(t)
 }
 
 func (c *udpHopConn) SetWriteDeadline(t time.Time) error {
@@ -280,10 +267,7 @@ func (c *udpHopConn) SetWriteDeadline(t time.Time) error {
 	if c.pre != nil {
 		_ = c.pre.SetWriteDeadline(t)
 	}
-	if c.cur != nil {
-		_ = c.cur.SetWriteDeadline(t)
-	}
-	return nil
+	return c.cur.SetWriteDeadline(t)
 }
 
 func randPrefix(p netip.Prefix) []byte {

transport/internet/finalmask/xdns/config.go

@@ -1,21 +1,14 @@
 package xdns
 
 import (
-	"net"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	// _, ok1 := raw.(*internet.FakePacketConn)
-	// _, ok2 := raw.(*udphop.UdpHopPacketConn)
-	// if level != 0 || ok1 || ok2 {
-	// 	return nil, errors.New("xdns requires being at the outermost level")
-	// }
-	return NewConnClient(c, raw)
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	return NewConnClient(c, conn)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	// if level != 0 {
-	// 	return nil, errors.New("xdns requires being at the outermost level")
-	// }
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c, conn)
 }

transport/internet/finalmask/xicmp/client.go

@@ -8,8 +8,7 @@ import (
 	goerrors "errors"
 	"fmt"
 	"io"
-	mathrand "math/rand"
-	"net"
+	mrand "math/rand"
 	"net/netip"
 	"sync"
 	"time"
@@ -17,6 +16,7 @@ import (
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"golang.org/x/net/icmp"
 	"golang.org/x/net/ipv4"
@@ -36,11 +36,11 @@ type packet struct {
 }
 
 type xicmpConnClient struct {
-	conn     net.PacketConn
 	icmp4    *icmp.PacketConn
 	icmp6    *icmp.PacketConn
 	udp      bool
 	ips      []netip.Addr
+	ip       net.IP
 	clientID [8]byte
 	id       int
 	seq      int
@@ -50,7 +50,7 @@ type xicmpConnClient struct {
 	mu       sync.Mutex
 }
 
-func NewConnClient(c *Config, raw net.PacketConn) (net.PacketConn, error) {
+func NewConnClient(c *Config, dest *net.Destination) (net.PacketConn, error) {
 	var icmp4, icmp6 *icmp.PacketConn
 	var err4, err6 error
 	if c.DGRAM {
@@ -69,17 +69,24 @@ func NewConnClient(c *Config, raw net.PacketConn) (net.PacketConn, error) {
 		ips = append(ips, netip.MustParseAddr(ip))
 	}
 
+	var ip net.IP
+	if len(ips) > 0 {
+		ip = ips[mrand.Intn(len(ips))].AsSlice()
+	} else {
+		ip = dest.Address.IP()
+	}
+
 	var clientID [8]byte
 	common.Must2(rand.Read(clientID[:]))
 
 	conn := &xicmpConnClient{
-		conn:     raw,
 		icmp4:    icmp4,
 		icmp6:    icmp6,
 		udp:      c.DGRAM,
 		ips:      ips,
+		ip:       ip,
 		clientID: clientID,
-		id:       mathrand.Intn(65536),
+		id:       mrand.Intn(65536),
 		seq:      1,
 		readCh:   make(chan packet),
 		closeCh:  make(chan struct{}),
@@ -92,10 +99,6 @@ func NewConnClient(c *Config, raw net.PacketConn) (net.PacketConn, error) {
 	return conn, nil
 }
 
-func (c *xicmpConnClient) ring(a, b uint16) uint16 {
-	return min(a-b, b-a)
-}
-
 func (c *xicmpConnClient) closed() bool {
 	select {
 	case <-c.closeCh:
@@ -110,12 +113,11 @@ func (c *xicmpConnClient) recv4() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, addr, err := c.icmp4.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -125,9 +127,10 @@ func (c *xicmpConnClient) recv4() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv4 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 4")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(1, b[:n])
@@ -150,10 +153,6 @@ func (c *xicmpConnClient) recv4() {
 			continue
 		}
 
-		if c.ring(uint16(echo.Seq), uint16(c.seq)) > 1000 {
-			continue
-		}
-
 		if len(echo.Data) > 8 && bytes.Equal(echo.Data[:8], c.clientID[:]) {
 			continue
 		}
@@ -182,12 +181,11 @@ func (c *xicmpConnClient) recv6() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, addr, err := c.icmp6.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -197,9 +195,10 @@ func (c *xicmpConnClient) recv6() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv6 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 6")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(58, b[:n])
@@ -222,10 +221,6 @@ func (c *xicmpConnClient) recv6() {
 			continue
 		}
 
-		if c.ring(uint16(echo.Seq), uint16(c.seq)) > 1000 {
-			continue
-		}
-
 		if len(echo.Data) > 8 && bytes.Equal(echo.Data[:8], c.clientID[:]) {
 			continue
 		}
@@ -273,9 +268,9 @@ func (c *xicmpConnClient) WriteTo(p []byte, addr net.Addr) (n int, err error) {
 	c.seq %= 65536
 	c.mu.Unlock()
 
-	ip := addr.(*net.UDPAddr).IP
+	ip := c.ip
 	if len(c.ips) > 0 {
-		ip = c.ips[mathrand.Intn(len(c.ips))].AsSlice()
+		ip = c.ips[mrand.Intn(len(c.ips))].AsSlice()
 	}
 
 	if c.udp {
@@ -314,7 +309,6 @@ func (c *xicmpConnClient) Close() error {
 	close(c.closeCh)
 	_ = c.icmp4.Close()
 	_ = c.icmp6.Close()
-	_ = c.conn.Close()
 	c.wg.Wait()
 	select {
 	case p := <-c.readCh:
@@ -328,7 +322,7 @@ func (c *xicmpConnClient) Close() error {
 }
 
 func (c *xicmpConnClient) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
+	return &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
 }
 
 func (c *xicmpConnClient) SetDeadline(t time.Time) error {

transport/internet/finalmask/xicmp/config.go

@@ -1,23 +1,23 @@
 package xicmp
 
 import (
-	"net"
+	"errors"
 
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *Config) WrapPacketConnClient(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	_, ok1 := raw.(*internet.FakePacketConn)
-	if level != 0 || ok1 {
-		return nil, errors.New("xicmp requires being at the outermost level")
+func (c *Config) HandleDial() {}
+
+func (c *Config) HandleListen() {}
+
+func (c *Config) WrapPacketConnClient(conn net.PacketConn, dest *net.Destination, dialer *finalmask.Dialer) (net.PacketConn, error) {
+	if dest.Address.Family().IsDomain() && len(c.IPs) == 0 {
+		return nil, errors.New("empty ip addresses")
 	}
-	return NewConnClient(c, raw)
+	return NewConnClient(c, dest)
 }
 
-func (c *Config) WrapPacketConnServer(raw net.PacketConn, level int, levelCount int) (net.PacketConn, error) {
-	if level != 0 {
-		return nil, errors.New("xicmp requires being at the outermost level")
-	}
-	return NewConnServer(c, raw)
+func (c *Config) WrapPacketConnServer(conn net.PacketConn, addr net.Addr, lc *finalmask.ListenConfig) (net.PacketConn, error) {
+	return NewConnServer(c)
 }

transport/internet/finalmask/xicmp/server.go

@@ -37,7 +37,6 @@ type record struct {
 }
 
 type xicmpConnServer struct {
-	conn    net.PacketConn
 	icmp4   *icmp.PacketConn
 	icmp6   *icmp.PacketConn
 	ips     map[netip.Addr]struct{}
@@ -48,7 +47,7 @@ type xicmpConnServer struct {
 	mu      sync.Mutex
 }
 
-func NewConnServer(c *Config, raw net.PacketConn) (net.PacketConn, error) {
+func NewConnServer(c *Config) (net.PacketConn, error) {
 	icmp4, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
 	if err != nil {
 		return nil, err
@@ -64,7 +63,6 @@ func NewConnServer(c *Config, raw net.PacketConn) (net.PacketConn, error) {
 	}
 
 	conn := &xicmpConnServer{
-		conn:    raw,
 		icmp4:   icmp4,
 		icmp6:   icmp6,
 		ips:     ips,
@@ -115,12 +113,11 @@ func (c *xicmpConnServer) recv4() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, addr, err := c.icmp4.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -130,9 +127,10 @@ func (c *xicmpConnServer) recv4() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv4 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 4")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(1, b[:n])
@@ -195,12 +193,11 @@ func (c *xicmpConnServer) recv6() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, addr, err := c.icmp6.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -210,9 +207,10 @@ func (c *xicmpConnServer) recv6() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv6 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 6")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(58, b[:n])
@@ -330,7 +328,6 @@ func (c *xicmpConnServer) Close() error {
 	close(c.closeCh)
 	_ = c.icmp4.Close()
 	_ = c.icmp6.Close()
-	_ = c.conn.Close()
 	c.wg.Wait()
 	select {
 	case p := <-c.readCh:
@@ -344,7 +341,7 @@ func (c *xicmpConnServer) Close() error {
 }
 
 func (c *xicmpConnServer) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
+	return &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
 }
 
 func (c *xicmpConnServer) SetDeadline(t time.Time) error {

transport/internet/finalmask/xicmp/server_oob.go

@@ -39,7 +39,6 @@ type record struct {
 }
 
 type xicmpConnServer struct {
-	conn    net.PacketConn
 	icmp4   *icmp.PacketConn
 	icmp6   *icmp.PacketConn
 	ipv4PC  *ipv4.PacketConn
@@ -52,7 +51,7 @@ type xicmpConnServer struct {
 	mu      sync.Mutex
 }
 
-func NewConnServer(c *Config, raw net.PacketConn) (net.PacketConn, error) {
+func NewConnServer(c *Config) (net.PacketConn, error) {
 	icmp4, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
 	if err != nil {
 		return nil, err
@@ -68,7 +67,6 @@ func NewConnServer(c *Config, raw net.PacketConn) (net.PacketConn, error) {
 	}
 
 	conn := &xicmpConnServer{
-		conn:    raw,
 		icmp4:   icmp4,
 		icmp6:   icmp6,
 		ipv4PC:  icmp4.IPv4PacketConn(),
@@ -124,12 +122,11 @@ func (c *xicmpConnServer) recv4() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, cm, addr, err := c.ipv4PC.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -139,9 +136,10 @@ func (c *xicmpConnServer) recv4() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv4 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 4")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(1, b[:n])
@@ -205,12 +203,11 @@ func (c *xicmpConnServer) recv6() {
 
 	var b [finalmask.UDPSize]byte
 	for {
-		if c.closed() {
-			return
-		}
-
 		n, cm, addr, err := c.ipv6PC.ReadFrom(b[:])
 		if err != nil {
+			if c.closed() {
+				return
+			}
 			var netErr net.Error
 			if goerrors.As(err, &netErr) && netErr.Timeout() {
 				select {
@@ -220,9 +217,10 @@ func (c *xicmpConnServer) recv6() {
 				case <-c.closeCh:
 					return
 				}
+				continue
 			}
-			errors.LogErrorInner(context.Background(), err, "recv6 err")
-			continue
+			errors.LogErrorInner(context.Background(), err, "recv err 6")
+			return
 		}
 
 		msg, err := icmp.ParseMessage(58, b[:n])
@@ -341,7 +339,6 @@ func (c *xicmpConnServer) Close() error {
 	close(c.closeCh)
 	_ = c.icmp4.Close()
 	_ = c.icmp6.Close()
-	_ = c.conn.Close()
 	c.wg.Wait()
 	select {
 	case p := <-c.readCh:
@@ -355,7 +352,7 @@ func (c *xicmpConnServer) Close() error {
 }
 
 func (c *xicmpConnServer) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
+	return &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
 }
 
 func (c *xicmpConnServer) SetDeadline(t time.Time) error {

transport/internet/finalmask/xmc/config.go

@@ -2,10 +2,12 @@ package xmc
 
 import (
 	"fmt"
-	"net"
+
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
-func (c *Config) WrapConnClient(conn net.Conn) (net.Conn, error) {
+func (c *Config) WrapConnClient(conn net.Conn, dest *net.Destination, dialer *finalmask.Dialer) (net.Conn, error) {
 	profiles, err := profilesFromConfig(c.Profiles)
 	if err != nil {
 		return nil, fmt.Errorf("minecraft finalmask: %w", err)

transport/internet/grpc/dial.go

@@ -83,7 +83,6 @@ func getGrpcClient(ctx context.Context, dest net.Destination, streamSettings *in
 	}
 	tlsConfig := tls.ConfigFromStreamSettings(streamSettings)
 	realityConfig := reality.ConfigFromStreamSettings(streamSettings)
-	sockopt := streamSettings.SocketSettings
 	grpcSettings := streamSettings.ProtocolSettings.(*Config)
 
 	if client, found := globalDialerMap[dialerConf{dest, streamSettings}]; found && client.GetState() != connectivity.Shutdown {
@@ -124,17 +123,13 @@ func getGrpcClient(ctx context.Context, dest net.Destination, streamSettings *in
 			gctx = session.ContextWithOutbounds(gctx, session.OutboundsFromContext(ctx))
 			gctx = session.ContextWithTimeoutOnly(gctx, true)
 
-			c, err := internet.DialSystem(gctx, net.TCPDestination(address, port), sockopt)
+			var c net.Conn
+			if streamSettings.FinalMask != nil {
+				c, err = streamSettings.FinalMask.DialTCP(gctx, net.TCPDestination(address, port))
+			} else {
+				c, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+			}
 			if err == nil {
-				if streamSettings.TcpmaskManager != nil {
-					newConn, err := streamSettings.TcpmaskManager.WrapConnClient(c)
-					if err != nil {
-						c.Close()
-						return nil, errors.New("mask err").Base(err)
-					}
-					c = newConn
-				}
-
 				if tlsConfig != nil {
 					config := tlsConfig.GetTLSConfig(tls.WithDestination(dest))
 					if fingerprint := tls.GetFingerprint(tlsConfig.Fingerprint); fingerprint != nil {

transport/internet/grpc/hub.go

@@ -104,28 +104,20 @@ func Listen(ctx context.Context, address net.Address, port net.Port, settings *i
 	go func() {
 		var streamListener net.Listener
 		var err error
+		var addr net.Addr
 		if port == net.Port(0) { // unix
-			streamListener, err = internet.ListenSystem(ctx, &net.UnixAddr{
-				Name: address.Domain(),
-				Net:  "unix",
-			}, settings.SocketSettings)
-			if err != nil {
-				errors.LogErrorInner(ctx, err, "failed to listen on ", address)
-				return
-			}
+			addr = &net.UnixAddr{Name: address.Domain(), Net: "unix"}
 		} else { // tcp
-			streamListener, err = internet.ListenSystem(ctx, &net.TCPAddr{
-				IP:   address.IP(),
-				Port: int(port),
-			}, settings.SocketSettings)
-			if err != nil {
-				errors.LogErrorInner(ctx, err, "failed to listen on ", address, ":", port)
-				return
-			}
+			addr = &net.TCPAddr{IP: address.IP(), Port: int(port)}
 		}
-
-		if settings.TcpmaskManager != nil {
-			streamListener, _ = settings.TcpmaskManager.WrapListener(streamListener)
+		if settings.FinalMask != nil {
+			streamListener, err = settings.FinalMask.Listen(ctx, addr)
+		} else {
+			streamListener, err = internet.ListenSystem(ctx, addr, settings.SocketSettings)
+		}
+		if err != nil {
+			errors.LogErrorInner(ctx, err, "failed to listen on ", address, ":", port)
+			return
 		}
 
 		errors.LogDebug(ctx, "gRPC listen for service name `"+grpcSettings.getServiceName()+"` tun `"+grpcSettings.getTunStreamName()+"` multi tun `"+grpcSettings.getTunMultiStreamName()+"`")

transport/internet/httpupgrade/dialer.go

@@ -46,21 +46,18 @@ func (c *ConnRF) Read(b []byte) (int, error) {
 func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings *internet.MemoryStreamConfig) (net.Conn, error) {
 	transportConfiguration := streamSettings.ProtocolSettings.(*Config)
 
-	pconn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+	var pconn net.Conn
+	var err error
+	if streamSettings.FinalMask != nil {
+		pconn, err = streamSettings.FinalMask.DialTCP(ctx, dest)
+	} else {
+		pconn, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+	}
 	if err != nil {
 		errors.LogErrorInner(ctx, err, "failed to dial to ", dest)
 		return nil, err
 	}
 
-	if streamSettings.TcpmaskManager != nil {
-		newConn, err := streamSettings.TcpmaskManager.WrapConnClient(pconn)
-		if err != nil {
-			pconn.Close()
-			return nil, errors.New("mask err").Base(err)
-		}
-		pconn = newConn
-	}
-
 	var conn net.Conn
 	var requestURL url.URL
 	tConfig := tls.ConfigFromStreamSettings(streamSettings)

transport/internet/httpupgrade/hub.go

@@ -124,29 +124,21 @@ func ListenHTTPUpgrade(ctx context.Context, address net.Address, port net.Port,
 	}
 	var listener net.Listener
 	var err error
+	var addr net.Addr
 	if port == net.Port(0) { // unix
-		listener, err = internet.ListenSystem(ctx, &net.UnixAddr{
-			Name: address.Domain(),
-			Net:  "unix",
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen unix domain socket(for HttpUpgrade) on ", address).Base(err)
-		}
-		errors.LogInfo(ctx, "listening unix domain socket(for HttpUpgrade) on ", address)
+		addr = &net.UnixAddr{Name: address.Domain(), Net: "unix"}
 	} else { // tcp
-		listener, err = internet.ListenSystem(ctx, &net.TCPAddr{
-			IP:   address.IP(),
-			Port: int(port),
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen TCP(for HttpUpgrade) on ", address, ":", port).Base(err)
-		}
-		errors.LogInfo(ctx, "listening TCP(for HttpUpgrade) on ", address, ":", port)
+		addr = &net.TCPAddr{IP: address.IP(), Port: int(port)}
 	}
-
-	if streamSettings.TcpmaskManager != nil {
-		listener, _ = streamSettings.TcpmaskManager.WrapListener(listener)
+	if streamSettings.FinalMask != nil {
+		listener, err = streamSettings.FinalMask.Listen(ctx, addr)
+	} else {
+		listener, err = internet.ListenSystem(ctx, addr, streamSettings.SocketSettings)
 	}
+	if err != nil {
+		return nil, errors.New("failed to listen ", addr.Network(), "(for HttpUpgrade) on ", address, ":", port).Base(err)
+	}
+	errors.LogInfo(ctx, "listening ", addr.Network(), "(for HttpUpgrade) on ", address, ":", port)
 
 	if streamSettings.SocketSettings != nil && streamSettings.SocketSettings.AcceptProxyProtocol {
 		errors.LogWarning(ctx, "accepting PROXY protocol")

transport/internet/hysteria/dialer.go

@@ -2,7 +2,7 @@ package hysteria
 
 import (
 	"context"
-	go_tls "crypto/tls"
+	gotls "crypto/tls"
 	"net/http"
 	"net/url"
 	"reflect"
@@ -28,12 +28,12 @@ import (
 type client struct {
 	sync.Mutex
 
-	dest           net.Destination
-	config         *Config
-	tlsConfig      *go_tls.Config
-	socketConfig   *internet.SocketConfig
-	udpmaskManager *finalmask.UdpmaskManager
-	quicParams     *internet.QuicParams
+	dest         net.Destination
+	config       *Config
+	tlsConfig    *gotls.Config
+	socketConfig *internet.SocketConfig
+	finalMask    *finalmask.FinalMask
+	quicParams   *internet.QuicParams
 
 	conn    *quic.Conn
 	tr      *quic.Transport
@@ -113,30 +113,29 @@ func (c *client) dial(ctx context.Context) error {
 	// }
 
 	var pktConn net.PacketConn
-	var udpAddr *net.UDPAddr
-
-	raw, err := internet.DialSystem(ctx, c.dest, c.socketConfig)
-	if err != nil {
-		return errors.New("failed to dial to dest").Base(err)
-	}
-	switch c := raw.(type) {
-	case *internet.PacketConnWrapper:
-		pktConn = c.PacketConn
-		udpAddr = raw.RemoteAddr().(*net.UDPAddr)
-	case *cnc.Connection:
-		pktConn = &internet.FakePacketConn{Conn: c}
-		udpAddr = &net.UDPAddr{IP: c.RemoteAddr().(*net.TCPAddr).IP, Port: c.RemoteAddr().(*net.TCPAddr).Port}
-	default:
-		panic(reflect.TypeOf(c))
-	}
-
-	if c.udpmaskManager != nil {
-		newConn, err := c.udpmaskManager.WrapPacketConnClient(pktConn)
+	var udpAddr net.Addr
+	if c.finalMask != nil {
+		conn, err := c.finalMask.DialUDP(ctx, c.dest)
 		if err != nil {
-			pktConn.Close()
-			return errors.New("mask err").Base(err)
+			return errors.New("failed to dial to dest").Base(err)
+		}
+		pktConn = conn.(*finalmask.PacketConnWrapper).PacketConn
+		udpAddr = conn.RemoteAddr()
+	} else {
+		conn, err := internet.DialSystem(ctx, c.dest, c.socketConfig)
+		if err != nil {
+			return errors.New("failed to dial to dest").Base(err)
+		}
+		switch c := conn.(type) {
+		case *internet.PacketConnWrapper:
+			pktConn = c.PacketConn
+			udpAddr = c.RemoteAddr()
+		case *cnc.Connection:
+			pktConn = &internet.FakePacketConn{Conn: c}
+			udpAddr = &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
+		default:
+			panic(reflect.TypeOf(c))
 		}
-		pktConn = newConn
 	}
 
 	tr := &quic.Transport{Conn: pktConn, DisableGSO: quicParams.DisableGSO}
@@ -150,7 +149,7 @@ func (c *client) dial(ctx context.Context) error {
 	rt := &http3.Transport{
 		TLSClientConfig: c.tlsConfig,
 		QUICConfig:      quicConfig,
-		Dial: func(ctx context.Context, _ string, tlsCfg *go_tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+		Dial: func(ctx context.Context, _ string, tlsCfg *gotls.Config, cfg *quic.Config) (*quic.Conn, error) {
 			qc, err := tr.DialEarly(ctx, udpAddr, tlsCfg, cfg)
 			if err != nil {
 				return nil, err
@@ -316,12 +315,12 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 		c = manager.m[dialerConf{dest, streamSettings}]
 		if c == nil {
 			c = &client{
-				dest:           dest,
-				config:         streamSettings.ProtocolSettings.(*Config),
-				tlsConfig:      tlsConfig.GetTLSConfig(tls.WithDestination(dest)),
-				socketConfig:   streamSettings.SocketSettings,
-				udpmaskManager: streamSettings.UdpmaskManager,
-				quicParams:     streamSettings.QuicParams,
+				dest:         dest,
+				config:       streamSettings.ProtocolSettings.(*Config),
+				tlsConfig:    tlsConfig.GetTLSConfig(tls.WithDestination(dest)),
+				socketConfig: streamSettings.SocketSettings,
+				finalMask:    streamSettings.FinalMask,
+				quicParams:   streamSettings.QuicParams,
 			}
 			manager.m[dialerConf{dest, streamSettings}] = c
 		}

transport/internet/hysteria/hub.go

@@ -316,20 +316,17 @@ func Listen(ctx context.Context, address net.Address, port net.Port, streamSetti
 		quicConfig.MaxIncomingStreams = 1024
 	}
 
-	pktConn, err := internet.ListenSystemPacket(context.Background(), &net.UDPAddr{IP: address.IP(), Port: int(port)}, streamSettings.SocketSettings)
+	var pktConn net.PacketConn
+	var err error
+	if streamSettings.FinalMask != nil {
+		pktConn, err = streamSettings.FinalMask.ListenPacket(context.Background(), &net.UDPAddr{IP: address.IP(), Port: int(port)})
+	} else {
+		pktConn, err = internet.ListenSystemPacket(context.Background(), &net.UDPAddr{IP: address.IP(), Port: int(port)}, streamSettings.SocketSettings)
+	}
 	if err != nil {
 		return nil, err
 	}
 
-	if streamSettings.UdpmaskManager != nil {
-		newConn, err := streamSettings.UdpmaskManager.WrapPacketConnServer(pktConn)
-		if err != nil {
-			pktConn.Close()
-			return nil, errors.New("mask err").Base(err)
-		}
-		pktConn = newConn
-	}
-
 	var k *quic.StatelessResetKey
 	if !quicParams.DisableStatelessReset {
 		k = &quic.StatelessResetKey{}

transport/internet/hysteria/hysteria_test.go

@@ -0,0 +1,165 @@
+package hysteria
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/apernet/quic-go"
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/protocol/tls/cert"
+)
+
+func TestDatagram(t *testing.T) {
+	run := func() (addr net.Addr, recv chan int64, cancel func()) {
+		cert, _ := cert.MustGenerate(nil)
+		Certificate := [][]byte{cert.Certificate}
+		PrivateKey := common.Must2(x509.ParsePKCS8PrivateKey(cert.PrivateKey))
+
+		tlsConf := &tls.Config{
+			Certificates: []tls.Certificate{
+				{
+					Certificate: Certificate,
+					PrivateKey:  PrivateKey,
+				},
+			},
+			NextProtos: []string{"h3"},
+		}
+
+		quicConf := &quic.Config{
+			InitialStreamReceiveWindow:     8388608,
+			MaxStreamReceiveWindow:         8388608,
+			InitialConnectionReceiveWindow: 8388608 * 5 / 2,
+			MaxConnectionReceiveWindow:     8388608 * 5 / 2,
+			MaxIdleTimeout:                 30 * time.Second,
+			MaxIncomingStreams:             1024,
+			DisablePathMTUDiscovery:        runtime.GOOS != "linux" && runtime.GOOS != "windows" && runtime.GOOS != "darwin",
+			EnableDatagrams:                true,
+			MaxDatagramFrameSize:           MaxDatagramFrameSize,
+			AssumePeerMaxDatagramFrameSize: MaxDatagramFrameSize,
+			DisablePathManager:             true,
+		}
+
+		pktConn := common.Must2(net.ListenPacket("udp", "127.0.0.1:0"))
+		tr := &quic.Transport{Conn: pktConn}
+		l := common.Must2(tr.Listen(tlsConf, quicConf))
+
+		recv = make(chan int64)
+		ctx, cancel := context.WithCancel(context.Background())
+
+		go func() {
+			defer pktConn.Close()
+			defer tr.Close()
+			defer l.Close()
+			defer close(recv)
+
+			var buf [1500]byte
+			for {
+				conn, err := l.Accept(ctx)
+				if err != nil {
+					if !errors.Is(err, context.Canceled) {
+						t.Error(err)
+					}
+					break
+				}
+				err = conn.SendDatagram(buf[:])
+				var qErr *quic.DatagramTooLargeError
+				if !errors.As(err, &qErr) {
+					t.Error(err)
+				}
+				recv <- qErr.MaxDatagramPayloadSize
+				defer conn.CloseWithError(0, "")
+			}
+		}()
+
+		return l.Addr(), recv, cancel
+	}
+
+	addr, recv, cancel := run()
+
+	t.Run("With ChromeParrot", func(t *testing.T) {
+		tlsConf := &tls.Config{
+			InsecureSkipVerify: true,
+		}
+
+		quicConf := &quic.Config{
+			InitialStreamReceiveWindow:     8388608,
+			MaxStreamReceiveWindow:         8388608,
+			InitialConnectionReceiveWindow: 8388608 * 5 / 2,
+			MaxConnectionReceiveWindow:     8388608 * 5 / 2,
+			MaxIdleTimeout:                 30 * time.Second,
+			KeepAlivePeriod:                10 * time.Second,
+			DisablePathMTUDiscovery:        runtime.GOOS != "linux" && runtime.GOOS != "windows" && runtime.GOOS != "darwin",
+			ChromeParrot:                   true,
+			EnableDatagrams:                true,
+			MaxDatagramFrameSize:           MaxDatagramFrameSize,
+			OmitMaxDatagramFrameSize:       true,
+			DisablePathManager:             true,
+		}
+
+		pktConn := common.Must2(net.ListenPacket("udp", "127.0.0.1:0"))
+		tr := &quic.Transport{Conn: pktConn, ConnectionIDGenerator: quic.ZeroLengthConnectionIDGenerator{}}
+		conn := common.Must2(tr.DialEarly(context.Background(), addr, tlsConf, quicConf))
+
+		defer pktConn.Close()
+		defer tr.Close()
+		defer conn.CloseWithError(0, "")
+
+		var buf [1500]byte
+		err := conn.SendDatagram(buf[:])
+		var qErr *quic.DatagramTooLargeError
+		if !errors.As(err, &qErr) || qErr.MaxDatagramPayloadSize != 1197 {
+			t.Error(err)
+		}
+		if server := <-recv; server != 1243 {
+			t.Error(server)
+		}
+	})
+
+	t.Run("Without ChromeParrot", func(t *testing.T) {
+		tlsConf := &tls.Config{
+			InsecureSkipVerify: true,
+			NextProtos:         []string{"h3"},
+		}
+
+		quicConf := &quic.Config{
+			InitialStreamReceiveWindow:     8388608,
+			MaxStreamReceiveWindow:         8388608,
+			InitialConnectionReceiveWindow: 8388608 * 5 / 2,
+			MaxConnectionReceiveWindow:     8388608 * 5 / 2,
+			MaxIdleTimeout:                 30 * time.Second,
+			KeepAlivePeriod:                10 * time.Second,
+			DisablePathMTUDiscovery:        runtime.GOOS != "linux" && runtime.GOOS != "windows" && runtime.GOOS != "darwin",
+			ChromeParrot:                   false,
+			EnableDatagrams:                true,
+			MaxDatagramFrameSize:           MaxDatagramFrameSize,
+			OmitMaxDatagramFrameSize:       true,
+			DisablePathManager:             true,
+		}
+
+		pktConn := common.Must2(net.ListenPacket("udp", "127.0.0.1:0"))
+		tr := &quic.Transport{Conn: pktConn}
+		conn := common.Must2(tr.DialEarly(context.Background(), addr, tlsConf, quicConf))
+
+		defer pktConn.Close()
+		defer tr.Close()
+		defer conn.CloseWithError(0, "")
+
+		var buf [1500]byte
+		err := conn.SendDatagram(buf[:])
+		var qErr *quic.DatagramTooLargeError
+		if !errors.As(err, &qErr) || qErr.MaxDatagramPayloadSize != 1197 {
+			t.Error(err)
+		}
+		if server := <-recv; server != 1197 {
+			t.Error(server)
+		}
+	})
+
+	cancel()
+}

transport/internet/kcp/dialer.go

@@ -3,7 +3,6 @@ package kcp
 import (
 	"context"
 	"io"
-	reflect "reflect"
 	"sync/atomic"
 
 	"github.com/xtls/xray-core/common"
@@ -11,7 +10,6 @@ import (
 	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
 	"github.com/xtls/xray-core/transport/internet/tls"
@@ -51,36 +49,17 @@ func DialKCP(ctx context.Context, dest net.Destination, streamSettings *internet
 	dest.Network = net.Network_UDP
 	errors.LogInfo(ctx, "dialing mKCP to ", dest)
 
-	conn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+	var conn net.Conn
+	var err error
+	if streamSettings.FinalMask != nil {
+		conn, err = streamSettings.FinalMask.DialUDP(ctx, dest)
+	} else {
+		conn, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+	}
 	if err != nil {
 		return nil, errors.New("failed to dial to dest: ", err).AtWarning().Base(err)
 	}
 
-	if streamSettings.UdpmaskManager != nil {
-		var pktConn net.PacketConn
-		var udpAddr *net.UDPAddr
-		switch c := conn.(type) {
-		case *internet.PacketConnWrapper:
-			pktConn = c.PacketConn
-			udpAddr = c.RemoteAddr().(*net.UDPAddr)
-		case *cnc.Connection:
-			pktConn = &internet.FakePacketConn{Conn: c}
-			udpAddr = &net.UDPAddr{IP: c.RemoteAddr().(*net.TCPAddr).IP, Port: c.RemoteAddr().(*net.TCPAddr).Port}
-		default:
-			panic(reflect.TypeOf(c))
-		}
-		newConn, err := streamSettings.UdpmaskManager.WrapPacketConnClient(pktConn)
-		if err != nil {
-			pktConn.Close()
-			return nil, errors.New("mask err").Base(err)
-		}
-		pktConn = newConn
-		conn = &internet.PacketConnWrapper{
-			PacketConn: pktConn,
-			Dest:       udpAddr,
-		}
-	}
-
 	kcpSettings := streamSettings.ProtocolSettings.(*Config)
 
 	reader := &KCPPacketReader{}

transport/internet/memory_settings.go

@@ -1,7 +1,12 @@
 package internet
 
 import (
+	"context"
+	"reflect"
+
+	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 )
 
@@ -12,8 +17,7 @@ type MemoryStreamConfig struct {
 	ProtocolSettings interface{}
 	SecurityType     string
 	SecuritySettings interface{}
-	TcpmaskManager   *finalmask.TcpmaskManager
-	UdpmaskManager   *finalmask.UdpmaskManager
+	FinalMask        *finalmask.FinalMask
 	QuicParams       *QuicParams
 	SocketSettings   *SocketConfig
 	DownloadSettings *MemoryStreamConfig
@@ -51,33 +55,53 @@ func ToMemoryStreamConfig(s *StreamConfig) (*MemoryStreamConfig, error) {
 		mss.SecuritySettings = ess
 	}
 
-	if s != nil && len(s.Tcpmasks) > 0 {
-		var masks []finalmask.Tcpmask
-		for _, msg := range s.Tcpmasks {
-			instance, err := msg.GetInstance()
-			if err != nil {
-				return nil, err
-			}
-			masks = append(masks, instance.(finalmask.Tcpmask))
+	var tcpMasks []finalmask.TCPMask
+	var udpMasks []finalmask.UDPMask
+
+	if s != nil {
+		for i := range s.Tcpmasks {
+			instance := common.Must2(s.Tcpmasks[i].GetInstance())
+			tcpMasks = append(tcpMasks, instance.(finalmask.TCPMask))
+		}
+		for i := range s.Udpmasks {
+			instance := common.Must2(s.Udpmasks[i].GetInstance())
+			udpMasks = append(udpMasks, instance.(finalmask.UDPMask))
 		}
-		mss.TcpmaskManager = finalmask.NewTcpmaskManager(masks)
 	}
 
+	dialTCP := func(ctx context.Context, dest net.Destination) (net.Conn, error) {
+		return DialSystem(ctx, dest, mss.SocketSettings)
+	}
+	listen := func(ctx context.Context, addr net.Addr) (net.Listener, error) {
+		return ListenSystem(ctx, addr, mss.SocketSettings)
+	}
+	dialUDP := func(ctx context.Context, dest net.Destination) (net.PacketConn, net.Addr, error) {
+		conn, err := DialSystem(ctx, dest, mss.SocketSettings)
+		if err != nil {
+			return nil, nil, err
+		}
+		var newConn net.PacketConn
+		var udpAddr net.Addr
+		switch c := conn.(type) {
+		case *PacketConnWrapper:
+			newConn = c.PacketConn
+			udpAddr = conn.RemoteAddr()
+		case *cnc.Connection:
+			newConn = &FakePacketConn{Conn: c}
+			udpAddr = &net.UDPAddr{IP: []byte{0, 0, 0, 0}, Port: 0}
+		default:
+			panic(reflect.TypeOf(c))
+		}
+		return newConn, udpAddr, nil
+	}
+	listenPacket := func(ctx context.Context, addr net.Addr) (net.PacketConn, error) {
+		return ListenSystemPacket(ctx, addr, mss.SocketSettings)
+	}
+	mss.FinalMask = finalmask.NewFinalMask(tcpMasks, udpMasks, dialTCP, listen, dialUDP, listenPacket)
+
 	if s != nil && s.QuicParams != nil {
 		mss.QuicParams = s.QuicParams
 	}
 
-	if s != nil && len(s.Udpmasks) > 0 {
-		var masks []finalmask.Udpmask
-		for _, msg := range s.Udpmasks {
-			instance, err := msg.GetInstance()
-			if err != nil {
-				return nil, err
-			}
-			masks = append(masks, instance.(finalmask.Udpmask))
-		}
-		mss.UdpmaskManager = finalmask.NewUdpmaskManager(masks)
-	}
-
 	return mss, nil
 }

transport/internet/splithttp/dialer.go

@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"net/http/httptrace"
 	"net/url"
-	reflect "reflect"
+	"reflect"
 	"runtime"
 	"strconv"
 	"sync"
@@ -25,6 +25,7 @@ import (
 	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/browser_dialer"
+	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"github.com/xtls/xray-core/transport/internet/hysteria/congestion"
 	"github.com/xtls/xray-core/transport/internet/hysteria/congestion/bbr"
 	"github.com/xtls/xray-core/transport/internet/reality"
@@ -116,20 +117,17 @@ func createHTTPClient(dest net.Destination, streamSettings *internet.MemoryStrea
 	transportConfig := streamSettings.ProtocolSettings.(*Config)
 
 	dialContext := func(ctxInner context.Context) (net.Conn, error) {
-		conn, err := internet.DialSystem(ctxInner, dest, streamSettings.SocketSettings)
+		var conn net.Conn
+		var err error
+		if streamSettings.FinalMask != nil {
+			conn, err = streamSettings.FinalMask.DialTCP(ctxInner, dest)
+		} else {
+			conn, err = internet.DialSystem(ctxInner, dest, streamSettings.SocketSettings)
+		}
 		if err != nil {
 			return nil, err
 		}
 
-		if streamSettings.TcpmaskManager != nil {
-			newConn, err := streamSettings.TcpmaskManager.WrapConnClient(conn)
-			if err != nil {
-				conn.Close()
-				return nil, errors.New("mask err").Base(err)
-			}
-			conn = newConn
-		}
-
 		if realityConfig != nil {
 			return reality.UClient(conn, realityConfig, ctxInner, dest)
 		}
@@ -196,30 +194,29 @@ func createHTTPClient(dest net.Destination, streamSettings *internet.MemoryStrea
 			TLSClientConfig: gotlsConfig,
 			Dial: func(ctx context.Context, addr string, tlsCfg *gotls.Config, cfg *quic.Config) (*quic.Conn, error) {
 				var pktConn net.PacketConn
-				var udpAddr *net.UDPAddr
-
-				raw, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
-				if err != nil {
-					return nil, errors.New("failed to dial to dest").Base(err)
-				}
-				switch c := raw.(type) {
-				case *internet.PacketConnWrapper:
-					pktConn = c.PacketConn
-					udpAddr = raw.RemoteAddr().(*net.UDPAddr)
-				case *cnc.Connection:
-					pktConn = &internet.FakePacketConn{Conn: c}
-					udpAddr = &net.UDPAddr{IP: c.RemoteAddr().(*net.TCPAddr).IP, Port: c.RemoteAddr().(*net.TCPAddr).Port}
-				default:
-					panic(reflect.TypeOf(c))
-				}
-
-				if streamSettings.UdpmaskManager != nil {
-					newConn, err := streamSettings.UdpmaskManager.WrapPacketConnClient(pktConn)
+				var udpAddr net.Addr
+				if streamSettings.FinalMask != nil {
+					conn, err := streamSettings.FinalMask.DialUDP(ctx, dest)
 					if err != nil {
-						pktConn.Close()
-						return nil, errors.New("mask err").Base(err)
+						return nil, errors.New("failed to dial to dest").Base(err)
+					}
+					pktConn = conn.(*finalmask.PacketConnWrapper).PacketConn
+					udpAddr = conn.RemoteAddr()
+				} else {
+					conn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+					if err != nil {
+						return nil, errors.New("failed to dial to dest").Base(err)
+					}
+					switch c := conn.(type) {
+					case *internet.PacketConnWrapper:
+						pktConn = c.PacketConn
+						udpAddr = c.RemoteAddr()
+					case *cnc.Connection:
+						pktConn = &internet.FakePacketConn{Conn: c}
+						udpAddr = &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
+					default:
+						panic(reflect.TypeOf(c))
 					}
-					pktConn = newConn
 				}
 
 				tr := &quic.Transport{Conn: pktConn, DisableGSO: quicParams.DisableGSO}

transport/internet/splithttp/hub.go

@@ -463,31 +463,17 @@ func ListenXH(ctx context.Context, address net.Address, port net.Port, streamSet
 	l.isH3 = len(tlsConfig.NextProtos) == 1 && tlsConfig.NextProtos[0] == "h3"
 
 	var err error
-	if port == net.Port(0) { // unix
-		l.listener, err = internet.ListenSystem(ctx, &net.UnixAddr{
-			Name: address.Domain(),
-			Net:  "unix",
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen UNIX domain socket for XHTTP on ", address).Base(err)
+	if l.isH3 {
+		var pktConn net.PacketConn
+		var err error
+		if streamSettings.FinalMask != nil {
+			pktConn, err = streamSettings.FinalMask.ListenPacket(context.Background(), &net.UDPAddr{IP: address.IP(), Port: int(port)})
+		} else {
+			pktConn, err = internet.ListenSystemPacket(context.Background(), &net.UDPAddr{IP: address.IP(), Port: int(port)}, streamSettings.SocketSettings)
 		}
-		errors.LogInfo(ctx, "listening UNIX domain socket for XHTTP on ", address)
-	} else if l.isH3 { // quic
-		Conn, err := internet.ListenSystemPacket(context.Background(), &net.UDPAddr{
-			IP:   address.IP(),
-			Port: int(port),
-		}, streamSettings.SocketSettings)
 		if err != nil {
 			return nil, errors.New("failed to listen UDP for XHTTP/3 on ", address, ":", port).Base(err)
 		}
-		if streamSettings.UdpmaskManager != nil {
-			newConn, err := streamSettings.UdpmaskManager.WrapPacketConnServer(Conn)
-			if err != nil {
-				Conn.Close()
-				return nil, errors.New("mask err").Base(err)
-			}
-			Conn = newConn
-		}
 
 		quicParams := streamSettings.QuicParams
 		if quicParams == nil {
@@ -512,7 +498,7 @@ func ListenXH(ctx context.Context, address net.Address, port net.Port, streamSet
 			common.Must2(rand.Read((*k)[:]))
 		}
 
-		tr := &quic.Transport{Conn: Conn, DisableGSO: quicParams.DisableGSO, StatelessResetKey: k}
+		tr := &quic.Transport{Conn: pktConn, DisableGSO: quicParams.DisableGSO, StatelessResetKey: k}
 
 		l.h3listener, err = tr.ListenEarly(tlsConfig, quicConfig)
 		if err != nil {
@@ -534,21 +520,24 @@ func ListenXH(ctx context.Context, address net.Address, port net.Port, streamSet
 				errors.LogErrorInner(ctx, err, "failed to serve HTTP/3 for XHTTP/3")
 			}
 			_ = tr.Close()
-			_ = Conn.Close()
+			_ = pktConn.Close()
 		}()
-	} else { // tcp
-		l.listener, err = internet.ListenSystem(ctx, &net.TCPAddr{
-			IP:   address.IP(),
-			Port: int(port),
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen TCP for XHTTP on ", address, ":", port).Base(err)
+	} else {
+		var addr net.Addr
+		if port == net.Port(0) { // unix
+			addr = &net.UnixAddr{Name: address.Domain(), Net: "unix"}
+		} else { // tcp
+			addr = &net.TCPAddr{IP: address.IP(), Port: int(port)}
 		}
-		errors.LogInfo(ctx, "listening TCP for XHTTP on ", address, ":", port)
-	}
-
-	if !l.isH3 && streamSettings.TcpmaskManager != nil {
-		l.listener, _ = streamSettings.TcpmaskManager.WrapListener(l.listener)
+		if streamSettings.FinalMask != nil {
+			l.listener, err = streamSettings.FinalMask.Listen(ctx, addr)
+		} else {
+			l.listener, err = internet.ListenSystem(ctx, addr, streamSettings.SocketSettings)
+		}
+		if err != nil {
+			return nil, errors.New("failed to listen ", addr.Network(), " for XHTTP on ", address, ":", port).Base(err)
+		}
+		errors.LogInfo(ctx, "listening ", addr.Network(), " for XHTTP on ", address, ":", port)
 	}
 
 	// tcp/unix (h1/h2)

transport/internet/system_dialer.go

@@ -235,5 +235,5 @@ func (c *FakePacketConn) WriteTo(p []byte, _ net.Addr) (n int, err error) {
 }
 
 func (c *FakePacketConn) LocalAddr() net.Addr {
-	return &net.UDPAddr{IP: c.Conn.LocalAddr().(*net.TCPAddr).IP, Port: c.Conn.LocalAddr().(*net.TCPAddr).Port}
+	return &net.UDPAddr{IP: []byte{0, 0, 0, 0}}
 }

transport/internet/tcp/dialer.go

@@ -19,18 +19,15 @@ import (
 // Dial dials a new TCP connection to the given destination.
 func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.MemoryStreamConfig) (stat.Connection, error) {
 	errors.LogInfo(ctx, "dialing TCP to ", dest)
-	conn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
-	if err != nil {
-		return nil, err
+	var conn net.Conn
+	var err error
+	if streamSettings.FinalMask != nil {
+		conn, err = streamSettings.FinalMask.DialTCP(ctx, dest)
+	} else {
+		conn, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
 	}
-
-	if streamSettings.TcpmaskManager != nil {
-		newConn, err := streamSettings.TcpmaskManager.WrapConnClient(conn)
-		if err != nil {
-			conn.Close()
-			return nil, errors.New("mask err").Base(err)
-		}
-		conn = newConn
+	if err != nil {
+		return nil, errors.New("failed to dial to dest").Base(err)
 	}
 
 	if config := tls.ConfigFromStreamSettings(streamSettings); config != nil {

transport/internet/tcp/hub.go

@@ -41,29 +41,21 @@ func ListenTCP(ctx context.Context, address net.Address, port net.Port, streamSe
 	}
 	var listener net.Listener
 	var err error
+	var addr net.Addr
 	if port == net.Port(0) { // unix
-		listener, err = internet.ListenSystem(ctx, &net.UnixAddr{
-			Name: address.Domain(),
-			Net:  "unix",
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen Unix Domain Socket on ", address).Base(err)
-		}
-		errors.LogInfo(ctx, "listening Unix Domain Socket on ", address)
+		addr = &net.UnixAddr{Name: address.Domain(), Net: "unix"}
+	} else { // tcp
+		addr = &net.TCPAddr{IP: address.IP(), Port: int(port)}
+	}
+	if streamSettings.FinalMask != nil {
+		listener, err = streamSettings.FinalMask.Listen(ctx, addr)
 	} else {
-		listener, err = internet.ListenSystem(ctx, &net.TCPAddr{
-			IP:   address.IP(),
-			Port: int(port),
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen TCP on ", address, ":", port).Base(err)
-		}
-		errors.LogInfo(ctx, "listening TCP on ", address, ":", port)
+		listener, err = internet.ListenSystem(ctx, addr, streamSettings.SocketSettings)
 	}
-
-	if streamSettings.TcpmaskManager != nil {
-		listener, _ = streamSettings.TcpmaskManager.WrapListener(listener)
+	if err != nil {
+		return nil, errors.New("failed to listen ", addr.Network(), " on ", address, ":", port).Base(err)
 	}
+	errors.LogInfo(ctx, "listening ", addr.Network(), " on ", address, ":", port)
 
 	if streamSettings.SocketSettings != nil && streamSettings.SocketSettings.AcceptProxyProtocol {
 		errors.LogWarning(ctx, "accepting PROXY protocol")

transport/internet/udp/dialer.go

@@ -2,12 +2,9 @@ package udp
 
 import (
 	"context"
-	"reflect"
 
 	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
 )
@@ -15,40 +12,14 @@ import (
 func init() {
 	common.Must(internet.RegisterTransportDialer(protocolName,
 		func(ctx context.Context, dest net.Destination, streamSettings *internet.MemoryStreamConfig) (stat.Connection, error) {
-			var sockopt *internet.SocketConfig
-			if streamSettings != nil {
-				sockopt = streamSettings.SocketSettings
-			}
-			conn, err := internet.DialSystem(ctx, dest, sockopt)
-			if err != nil {
-				return nil, err
-			}
-
-			if streamSettings != nil && streamSettings.UdpmaskManager != nil {
-				var pktConn net.PacketConn
-				var udpAddr *net.UDPAddr
-				switch c := conn.(type) {
-				case *internet.PacketConnWrapper:
-					pktConn = c.PacketConn
-					udpAddr = c.RemoteAddr().(*net.UDPAddr)
-				case *cnc.Connection:
-					pktConn = &internet.FakePacketConn{Conn: c}
-					udpAddr = &net.UDPAddr{IP: c.RemoteAddr().(*net.TCPAddr).IP, Port: c.RemoteAddr().(*net.TCPAddr).Port}
-				default:
-					panic(reflect.TypeOf(c))
-				}
-				newConn, err := streamSettings.UdpmaskManager.WrapPacketConnClient(pktConn)
-				if err != nil {
-					pktConn.Close()
-					return nil, errors.New("mask err").Base(err)
-				}
-				pktConn = newConn
-				conn = &internet.PacketConnWrapper{
-					PacketConn: pktConn,
-					Dest:       udpAddr,
+			if streamSettings != nil && streamSettings.FinalMask != nil {
+				return streamSettings.FinalMask.DialUDP(ctx, dest)
+			} else {
+				var sockopt *internet.SocketConfig
+				if streamSettings != nil && streamSettings.SocketSettings != nil {
+					sockopt = streamSettings.SocketSettings
 				}
+				return internet.DialSystem(ctx, dest, sockopt)
 			}
-
-			return conn, nil
 		}))
 }

transport/internet/udp/hub.go

@@ -58,24 +58,15 @@ func ListenUDP(ctx context.Context, address net.Address, port net.Port, streamSe
 	}
 
 	var err error
-	hub.conn, err = internet.ListenSystemPacket(ctx, &net.UDPAddr{
-		IP:   address.IP(),
-		Port: int(port),
-	}, sockopt)
+	if streamSettings.FinalMask != nil {
+		hub.conn, err = streamSettings.FinalMask.ListenPacket(ctx, &net.UDPAddr{IP: address.IP(), Port: int(port)})
+	} else {
+		hub.conn, err = internet.ListenSystemPacket(ctx, &net.UDPAddr{IP: address.IP(), Port: int(port)}, streamSettings.SocketSettings)
+	}
 	if err != nil {
 		return nil, err
 	}
 
-	raw := hub.conn
-
-	if streamSettings.UdpmaskManager != nil {
-		hub.conn, err = streamSettings.UdpmaskManager.WrapPacketConnServer(raw)
-		if err != nil {
-			raw.Close()
-			return nil, errors.New("mask err").Base(err)
-		}
-	}
-
 	errors.LogInfo(ctx, "listening UDP on ", address, ":", port)
 	hub.udpConn, _ = hub.conn.(*net.UDPConn)
 	hub.cache = make(chan *udp.Packet, hub.capacity)

transport/internet/websocket/dialer.go

@@ -48,20 +48,16 @@ func dialWebSocket(ctx context.Context, dest net.Destination, streamSettings *in
 
 	dialer := &websocket.Dialer{
 		NetDial: func(network, addr string) (net.Conn, error) {
-			conn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+			var conn net.Conn
+			var err error
+			if streamSettings.FinalMask != nil {
+				conn, err = streamSettings.FinalMask.DialTCP(ctx, dest)
+			} else {
+				conn, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
+			}
 			if err != nil {
-				return nil, err
+				return nil, errors.New("failed to dial to dest").Base(err)
 			}
-
-			if streamSettings.TcpmaskManager != nil {
-				newConn, err := streamSettings.TcpmaskManager.WrapConnClient(conn)
-				if err != nil {
-					conn.Close()
-					return nil, errors.New("mask err").Base(err)
-				}
-				conn = newConn
-			}
-
 			return conn, err
 		},
 		ReadBufferSize:   4 * 1024,
@@ -79,19 +75,15 @@ func dialWebSocket(ctx context.Context, dest net.Destination, streamSettings *in
 		if fingerprint := tls.GetFingerprint(tConfig.Fingerprint); fingerprint != nil {
 			dialer.NetDialTLSContext = func(_ context.Context, _, addr string) (net.Conn, error) {
 				// Like the NetDial in the dialer
-				pconn, err := internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
-				if err != nil {
-					errors.LogErrorInner(ctx, err, "failed to dial to "+addr)
-					return nil, err
+				var pconn net.Conn
+				var err error
+				if streamSettings.FinalMask != nil {
+					pconn, err = streamSettings.FinalMask.DialTCP(ctx, dest)
+				} else {
+					pconn, err = internet.DialSystem(ctx, dest, streamSettings.SocketSettings)
 				}
-
-				if streamSettings.TcpmaskManager != nil {
-					newConn, err := streamSettings.TcpmaskManager.WrapConnClient(pconn)
-					if err != nil {
-						pconn.Close()
-						return nil, errors.New("mask err").Base(err)
-					}
-					pconn = newConn
+				if err != nil {
+					return nil, errors.New("failed to dial to dest").Base(err)
 				}
 
 				// TLS and apply the handshake

transport/internet/websocket/hub.go

@@ -97,29 +97,21 @@ func ListenWS(ctx context.Context, address net.Address, port net.Port, streamSet
 	}
 	var listener net.Listener
 	var err error
+	var addr net.Addr
 	if port == net.Port(0) { // unix
-		listener, err = internet.ListenSystem(ctx, &net.UnixAddr{
-			Name: address.Domain(),
-			Net:  "unix",
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen unix domain socket(for WS) on ", address).Base(err)
-		}
-		errors.LogInfo(ctx, "listening unix domain socket(for WS) on ", address)
+		addr = &net.UnixAddr{Name: address.Domain(), Net: "unix"}
 	} else { // tcp
-		listener, err = internet.ListenSystem(ctx, &net.TCPAddr{
-			IP:   address.IP(),
-			Port: int(port),
-		}, streamSettings.SocketSettings)
-		if err != nil {
-			return nil, errors.New("failed to listen TCP(for WS) on ", address, ":", port).Base(err)
-		}
-		errors.LogInfo(ctx, "listening TCP(for WS) on ", address, ":", port)
+		addr = &net.TCPAddr{IP: address.IP(), Port: int(port)}
 	}
-
-	if streamSettings.TcpmaskManager != nil {
-		listener, _ = streamSettings.TcpmaskManager.WrapListener(listener)
+	if streamSettings.FinalMask != nil {
+		listener, err = streamSettings.FinalMask.Listen(ctx, addr)
+	} else {
+		listener, err = internet.ListenSystem(ctx, addr, streamSettings.SocketSettings)
 	}
+	if err != nil {
+		return nil, errors.New("failed to listen ", addr.Network(), "(for WS) on ", address, ":", port).Base(err)
+	}
+	errors.LogInfo(ctx, "listening ", addr.Network(), "(for WS) on ", address, ":", port)
 
 	if streamSettings.SocketSettings != nil && streamSettings.SocketSettings.AcceptProxyProtocol {
 		errors.LogWarning(ctx, "accepting PROXY protocol")

transport/internet/xdrive/client.go

@@ -55,17 +55,14 @@ func newServiceClient(streamSettings *internet.MemoryStreamConfig, timeout time.
 			}
 		}
 
-		conn, err := internet.DialSystem(ctx, target, sockopt)
-		if err != nil {
-			return nil, host, err
+		var conn net.Conn
+		if streamSettings.FinalMask != nil {
+			conn, err = streamSettings.FinalMask.DialTCP(ctx, target)
+		} else {
+			conn, err = internet.DialSystem(ctx, target, sockopt)
 		}
-		if streamSettings != nil && streamSettings.TcpmaskManager != nil {
-			masked, err := streamSettings.TcpmaskManager.WrapConnClient(conn)
-			if err != nil {
-				conn.Close()
-				return nil, host, errors.New("mask err").Base(err)
-			}
-			conn = masked
+		if err != nil {
+			return nil, host, errors.New("failed to dial to dest").Base(err)
 		}
 		return conn, host, nil
 	}