TUN inbound: Don't set IP_BOUND_IF on IPv6 sockets on Darwin

Since #7173, a failed interface binding fails the dial. On Darwin (macOS
and iOS), setinterface fell through from IPV6_BOUND_IF to IP_BOUND_IF on
IPv6 sockets, which Darwin rejects with EINVAL. So every UDP dial failed,
as Go opens a dual-stack IPv6 socket for it, and so did TCP to IPv6. TCP to
IPv4 uses an IPv4 socket and kept working. Before #7173 the error was only
logged.

IPV6_BOUND_IF binds the whole socket, so on a dual-stack socket it covers
its IPv4 traffic as well. Set only the option of the socket's family, as
sockopt_darwin.go already does for sockopt.interface. The new test binds
each kind of socket to lo0.

Linux, Android and FreeBSD bind with socket-level options (SO_BINDTODEVICE,
SO_SETFIB) that don't depend on the IP version. On Windows, the related case
of an adapter without IPv4 or IPv6 is handled in #7214.

Fixes #7228

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/docker/Dockerfile

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://github.com/XTLS/Xray-rules-dat/releases/latest/download/geoip-full.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://github.com/XTLS/Xray-rules-dat/releases/latest/download/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 

.github/docker/Dockerfile.usa

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://github.com/XTLS/Xray-rules-dat/releases/latest/download/geoip-full.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://github.com/XTLS/Xray-rules-dat/releases/latest/download/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 

.github/workflows/docker.yml

@@ -82,7 +82,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/test.yml

@@ -35,7 +35,24 @@ jobs:
         if: steps.check-assets.outputs.missing == 'true'
         run: sleep 90
 
-  check-format-and-proto:
+  check-proto:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v7
+      - name: Check Proto Version Header
+        run: |
+          head -n 4 core/config.pb.go > ref.txt
+          find . -name "*.pb.go" ! -name "*_grpc.pb.go" -print0 | while IFS= read -r -d '' file; do
+            if ! cmp -s ref.txt <(head -n 4 "$file"); then
+              echo "Error: Header mismatch in $file"
+              head -n 4 "$file"
+              exit 1
+            fi
+          done
+
+  check-format:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     permissions:
@@ -51,8 +68,6 @@ jobs:
           cache: false
       - name: Check Format
         run: go run ./infra/vformat/main.go -mode check -pwd ./
-      - name: Check Protobuf
-        run: go run ./infra/vprotogen/main.go -mode check -pwd ./
 
   test:
     needs: check-assets

app/commander/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/commander/config.proto
 
 package commander

app/dispatcher/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dispatcher/config.proto
 
 package dispatcher

app/dns/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dns/config.proto
 
 package dns

app/dns/fakedns/fakedns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dns/fakedns/fakedns.proto
 
 package fakedns

app/geodata/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/geodata/config.proto
 
 package geodata

app/geodata/download.go

@@ -1,8 +1,6 @@
 package geodata
 
 import (
-	"bufio"
-	"compress/gzip"
 	"context"
 	"crypto/tls"
 	go_errors "errors"
@@ -23,10 +21,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-const (
+const idleTimeout = 30 * time.Second
-	idleTimeout           = 30 * time.Second
-	maxDownloadSize int64 = 256 * 1024 * 1024
-)
 
 // DO NOT EDIT. Ignored by geodata, rejected by Lua.
 const luaGuardHeader = "\x12\x01\x00"
@@ -38,6 +33,7 @@ type stage struct {
 
 type downloader struct {
 	ctx         context.Context
+	httpClient  *http.Client
 	httpsClient *http.Client
 }
 
@@ -65,11 +61,12 @@ func (c *idleConn) Write(b []byte) (int, error) {
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
 		ctx:         ctx,
-		httpsClient: newClient(ctx, dispatcher, outbound),
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
 	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
 		var conn net.Conn
 		err := task.Run(ctx, func() error {
@@ -94,6 +91,7 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 			Conn: conn,
 		}, nil
 	}
+	if isHTTPS {
 		return &http.Client{
 			Transport: &http2.Transport{
 				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
@@ -116,12 +114,31 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 				if req.URL.Scheme != "https" {
 					return errors.New("redirected to non-https URL: ", req.URL.String())
 				}
-			if len(via) >= 20 {
+				if len(via) >= 10 {
-				return errors.New("stopped after 20 redirects")
+					return errors.New("stopped after 10 redirects")
 				}
 				return nil
 			},
 		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
+	}
 }
 
 func (d *downloader) download(assets []*Asset) ([]stage, error) {
@@ -186,41 +203,27 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	resp, err := d.httpsClient.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		io.Copy(io.Discard, resp.Body)
 		return errors.New("unexpected status code: ", resp.StatusCode)
 	}
-	if resp.ContentLength > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 
-	br := bufio.NewReader(resp.Body)
+	n, err := io.Copy(writer, resp.Body)
-	header, err := br.Peek(2)
-	if err != nil && err != io.EOF {
-		return err
-	}
-	var body io.Reader = br
-	if len(header) == 2 && header[0] == 0x1f && header[1] == 0x8b {
-		zr, err := gzip.NewReader(br)
 	if err != nil {
 		return err
 	}
-		defer zr.Close()
-		body = zr
-	}
-
-	n, err := io.Copy(writer, io.LimitReader(body, maxDownloadSize+1))
-	if err != nil {
-		return err
-	}
-	if n > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 	if n == 0 {
 		return errors.New("empty response body")
 	}

app/geodata/download_test.go

@@ -7,13 +7,10 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	commongeodata "github.com/xtls/xray-core/common/geodata"
 	xlua "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
 	"github.com/yuin/gopher-lua/parse"
 	"google.golang.org/protobuf/proto"
 )
@@ -34,11 +31,11 @@ func TestDownloadOneLuaGuard(t *testing.T) {
 			if err := os.WriteFile(filepath.Join(dir, "asset.lua"), nil, 0o600); err != nil {
 				t.Fatal(err)
 			}
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 				_, _ = w.Write([]byte(tc.body))
 			}))
 			defer server.Close()
-			d := &downloader{ctx: context.Background(), httpsClient: server.Client()}
+			d := &downloader{ctx: context.Background(), httpClient: server.Client()}
 			staged, err := d.downloadOne(&Asset{Url: server.URL, File: "asset.lua"})
 			if err != nil {
 				t.Fatal(err)
@@ -74,53 +71,3 @@ func TestDownloadOneLuaGuard(t *testing.T) {
 		})
 	}
 }
-
-func TestProtobufConfigValidation(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	for _, name := range []string{"asset.dat", "asset.DAT"} {
-		if err := os.WriteFile(filepath.Join(dir, name), nil, 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.Mkdir(filepath.Join(dir, "directory.dat"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	server, err := core.New(&core.Config{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = server.Close() })
-	for _, tc := range []struct {
-		name      string
-		config    *Config
-		wantError string
-	}{
-		{"minutely cron", &Config{Cron: "* * * * *"}, ""},
-		{"minimum interval", &Config{Cron: "@every 1m"}, ""},
-		{"short interval", &Config{Cron: "@every 59s"}, "interval must be at least 1 minute"},
-		{"fractional interval", &Config{Cron: "@every 59.999s"}, "interval must be at least 1 minute"},
-		{"invalid cron", &Config{Cron: "invalid"}, "invalid geodata cron"},
-		{"dat extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.dat"}}}, ""},
-		{"uppercase extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.DAT"}}}, ""},
-		{"invalid extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.lua"}}}, "extension must be .dat"},
-		{"missing extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset"}}}, "extension must be .dat"},
-		{"missing file", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "missing.dat"}}}, "invalid geodata asset file"},
-		{"directory", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "directory.dat"}}}, "asset is not a regular file"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			config, err := serial.ToTypedMessage(tc.config).GetInstance()
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, err = core.CreateObject(server, config)
-			if tc.wantError == "" {
-				if err != nil {
-					t.Fatal(err)
-				}
-			} else if err == nil || !strings.Contains(err.Error(), tc.wantError) {
-				t.Fatalf("CreateObject() error = %v; want %q", err, tc.wantError)
-			}
-		})
-	}
-}

app/geodata/geodata.go

@@ -2,16 +2,12 @@ package geodata
 
 import (
 	"context"
-	"path/filepath"
-	"strings"
 	"sync"
-	"time"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	commongeodata "github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
 )
@@ -29,24 +25,6 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 	if config.Cron == "" {
 		return &Instance{}, nil
 	}
-	if len(config.Assets) > 100 {
-		return nil, errors.New("geodata supports at most 100 assets")
-	}
-	for _, asset := range config.Assets {
-		if !strings.EqualFold(filepath.Ext(asset.GetFile()), ".dat") {
-			return nil, errors.New("geodata asset file extension must be .dat")
-		}
-		if _, err := filesystem.ResolveAsset(asset.GetFile()); err != nil {
-			return nil, errors.New("invalid geodata asset file: ", asset.GetFile()).Base(err)
-		}
-	}
-	schedule, err := cron.ParseStandard(config.Cron)
-	if err != nil {
-		return nil, errors.New("invalid geodata cron").Base(err)
-	}
-	if interval, ok := schedule.(cron.ConstantDelaySchedule); ok && interval.Delay < time.Minute {
-		return nil, errors.New("geodata cron interval must be at least 1 minute")
-	}
 
 	g := &Instance{
 		assets: config.Assets,
@@ -66,7 +44,9 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 		cron.WithChain(cron.SkipIfStillRunning(cron.DiscardLogger)),
 		cron.WithLogger(cron.DiscardLogger),
 	)
-	g.tasker.Schedule(schedule, cron.FuncJob(g.execute))
+	if _, err := g.tasker.AddFunc(config.Cron, g.execute); err != nil {
+		return nil, errors.New("invalid geodata cron").Base(err)
+	}
 	errors.LogInfo(ctx, "scheduled geodata reload with cron: ", config.Cron)
 
 	return g, nil

app/log/command/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/command/config_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/log/config.proto
 
 package log

app/metrics/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/metrics/config.proto
 
 package metrics

app/observatory/burst/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/burst/config.proto
 
 package burst

app/observatory/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/config.proto
 
 package observatory
@@ -152,23 +152,23 @@ func (x *HealthPingMeasurementResult) GetMin() int64 {
 type OutboundStatus struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
+	// @Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The last error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	// @Document The outbound tag for this Server
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	OutboundTag string `protobuf:"bytes,4,opt,name=outbound_tag,json=outboundTag,proto3" json:"outbound_tag,omitempty"`
 	// @Document The time this outbound is known to be alive
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastSeenTime int64 `protobuf:"varint,5,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
 	// @Document The time this outbound is tried
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastTryTime   int64                        `protobuf:"varint,6,opt,name=last_try_time,json=lastTryTime,proto3" json:"last_try_time,omitempty"`
 	HealthPing    *HealthPingMeasurementResult `protobuf:"bytes,7,opt,name=health_ping,json=healthPing,proto3" json:"health_ping,omitempty"`
 	unknownFields protoimpl.UnknownFields
@@ -257,14 +257,14 @@ func (x *OutboundStatus) GetHealthPing() *HealthPingMeasurementResult {
 type ProbeResult struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
+	// @Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -324,7 +324,7 @@ func (x *ProbeResult) GetLastErrorReason() string {
 type Intensity struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document The time interval for a probe request in ms.
-	//@Type time.ms
+	// @Type time.ms
 	ProbeInterval uint32 `protobuf:"varint,1,opt,name=probe_interval,json=probeInterval,proto3" json:"probe_interval,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache

app/policy/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/policy/config.proto
 
 package policy

app/proxyman/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/proxyman/config.proto
 
 package proxyman

app/reverse/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/reverse/config.proto
 
 package reverse

app/router/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/command/command.proto

@@ -46,7 +46,6 @@ message RoutingContext {
 //  - attributes: Select connection's additional attributes.
 //  - outbound: Equivalent as "outbound" and "outbound_group", select both
 //  outbound tag and outbound group tags.
-//
 // * If FieldSelectors is left empty, all fields will be returned.
 message SubscribeRoutingStatsRequest {
   repeated string FieldSelectors = 1;

app/router/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/router/config.proto
 
 package router

app/stats/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/stats/config.proto
 
 package stats

app/version/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/version/config.proto
 
 package version

common/geodata/consts.go

@@ -8,65 +8,23 @@ import (
 
 var privateIPMatcher = sync.OnceValue(func() IPMatcher {
 	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
-		// https://www.iana.org/assignments/iana-ipv4-special-registry
+		"0.0.0.0/8",
-		"0.0.0.0/8",      // "This network"
+		"10.0.0.0/8",
-		"0.0.0.0/32",     // "This host on this network"
+		"100.64.0.0/10",
-		"10.0.0.0/8",     // Private-Use
+		"127.0.0.0/8",
-		"100.64.0.0/10",  // Shared Address Space
+		"169.254.0.0/16",
-		"127.0.0.0/8",    // Loopback
+		"172.16.0.0/12",
-		"169.254.0.0/16", // Link Local
+		"192.0.0.0/24",
-		"172.16.0.0/12",  // Private-Use
+		"192.0.2.0/24",
-		// "192.0.0.0/24",   // IETF Protocol Assignments
+		"192.88.99.0/24",
-		"192.0.0.0/29",   // IPv4 Service Continuity Prefix
+		"192.168.0.0/16",
-		"192.0.0.8/32",   // IPv4 dummy address
+		"198.18.0.0/15",
-		"192.0.0.9/32",   // Port Control Protocol Anycast
+		"198.51.100.0/24",
-		"192.0.0.10/32",  // Traversal Using Relays around NAT Anycast
+		"203.0.113.0/24",
-		"192.0.0.170/32", // NAT64/DNS64 Discovery
+		"224.0.0.0/3",
-		"192.0.0.171/32", // NAT64/DNS64 Discovery
+		"::/127",
-		"192.0.2.0/24",   // Documentation (TEST-NET-1)
+		"fc00::/7",
-		// "192.31.196.0/24",    // AS112-v4
+		"fe80::/10",
-		"192.52.193.0/24", // AMT
-		// "192.88.99.0/24",  // Deprecated (6to4 Relay Anycast)
-		"192.88.99.2/32", // 6a44-relay anycast address
-		"192.168.0.0/16", // Private-Use
-		// "192.175.48.0/24",    // Direct Delegation AS112 Service
-		"198.18.0.0/15",      // Benchmarking
-		"198.51.100.0/24",    // Documentation (TEST-NET-2)
-		"203.0.113.0/24",     // Documentation (TEST-NET-3)
-		"240.0.0.0/4",        // Reserved
-		"255.255.255.255/32", // Limited Broadcast
-
-		// https://www.iana.org/assignments/multicast-addresses
-		"224.0.0.0/4",
-
-		// https://www.iana.org/assignments/iana-ipv6-special-registry
-		"::1/128", // Loopback Address
-		"::/128",  // Unspecified Address
-		// "::ffff:0:0/96",     // IPv4-mapped Address
-		"64:ff9b::/96",   // IPv4-IPv6 Translat.
-		"64:ff9b:1::/48", // IPv4-IPv6 Translat.
-		"100::/64",       // Discard-Only Address Block
-		"100:0:0:1::/64", // Dummy IPv6 Prefix
-		// "2001::/23",      // IETF Protocol Assignments
-		"2001::/32",     // TEREDO
-		"2001:1::1/128", // Port Control Protocol Anycast
-		"2001:1::2/128", // Traversal Using Relays around NAT Anycast
-		"2001:1::3/128", // DNS-SD Service Registration Protocol Anycast
-		"2001:2::/48",   // Benchmarking
-		"2001:3::/32",   // AMT
-		// "2001:4:112::/48", // AS112-v6
-		// "2001:10::/28",    // Deprecated (previously ORCHID)
-		"2001:20::/28",  // ORCHIDv2
-		"2001:30::/28",  // Drone Remote ID Protocol Entity Tags (DETs) Prefix
-		"2001:db8::/32", // Documentation
-		"2002::/16",     // 6to4
-		// "2620:4f:8000::/48", // Direct Delegation AS112 Service
-		"3fff::/20", // Documentation
-		"5f00::/16", // Segment Routing (SRv6) SIDs
-		"fc00::/7",  // Unique-Local
-		"fe80::/10", // Link-Local Unicast
-
-		// https://www.iana.org/assignments/ipv6-multicast-addresses
 		"ff00::/8",
 	}))))
 })

common/geodata/geodat.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/geodata/geodat.proto
 
 package geodata

common/log/log.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/log/log.proto
 
 package log

common/lua/program.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/xtls/xray-core/common/base64"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/platform/filesystem"
+	"github.com/xtls/xray-core/common/platform"
 	glua "github.com/yuin/gopher-lua"
 	"github.com/yuin/gopher-lua/parse"
 )
@@ -36,7 +36,7 @@ func Compile(script string) (*Program, error) {
 		// TODO: Restore inline script support and re-enable the related tests.
 		return nil, errors.New("currently unavailable")
 		code, err = base64.Decode(script)
-	} else if name, err = filesystem.ResolveLuaFile(script); err == nil {
+	} else if name, err = platform.ResolveLuaFile(script); err == nil {
 		code, err = os.ReadFile(name)
 		// TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries.
 		// if err == nil {

common/lua/program_test.go

@@ -187,20 +187,19 @@ func TestCompileInlineDiagnostics(t *testing.T) {
 */
 
 func TestCompileFileExtension(t *testing.T) {
-	for _, name := range []string{"script", "script.dat", "script.lua.txt"} {
+	for _, name := range []string{"script", "script.dat", "script.lua.txt", "script.LUA"} {
-		if program, err := Compile(name); program != nil || err == nil || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
-			t.Fatalf("Compile(%q) = %v, %v; want nil program and .lua extension error", name, program, err)
-		}
-	}
-	for _, name := range []string{"script.lua", "script.LUA", "script.Lua", "script.lUa"} {
 		path := filepath.Join(t.TempDir(), name)
 		if err := os.WriteFile(path, []byte("value = 42"), 0o600); err != nil {
 			t.Fatal(err)
 		}
-		if program, err := Compile(path); program == nil || err != nil {
+		if program, err := Compile(path); program != nil || err == nil || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
-			t.Fatalf("Compile(%q) = %v, %v; want successful compilation", path, program, err)
+			t.Fatalf("Compile(%q) = %v, %v; want nil program and .lua extension error", path, program, err)
 		}
 	}
+	path := writeTestScript(t, "value = 42") + string(filepath.Separator) + "."
+	if program, err := Compile(path); program == nil || err != nil {
+		t.Fatalf("Compile(%q) = %v, %v; want acceptance of the resolved .lua path", path, program, err)
+	}
 }
 
 func TestCompileRejectsReadFailure(t *testing.T) {
@@ -235,6 +234,10 @@ func writeTestScript(t *testing.T, code string) string {
 	if err := os.WriteFile(path, []byte(code), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	path, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		t.Fatal(err)
+	}
 	return path
 }
 

common/net/address.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/address.proto
 
 package net

common/net/destination.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/destination.proto
 
 package net

common/net/find_process_linux.go

@@ -4,7 +4,7 @@ package net
 
 import (
 	"bufio"
-	"encoding/binary"
+	"encoding/hex"
 	"fmt"
 	"net"
 	"os"
@@ -45,7 +45,10 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 		panic("Unsupported network type for process lookup.")
 	}
 
-	targetHexAddr := formatProcNetAddress(net.ParseIP(srcIP), Port(srcPort))
+	targetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))
+	if err != nil {
+		return 0, "", "", errors.New("failed to format address: ", err)
+	}
 
 	portFallback := ""
 	if network == "udp" {
@@ -84,21 +87,24 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 	return pid, procName, absPath, nil
 }
 
-func formatProcNetAddress(addr net.IP, port Port) string {
+func formatLittleEndianString(addr net.IP, port Port) (string, error) {
+	ip := addr
 	var ipBytes []byte
-	if ipv4 := addr.To4(); ipv4 != nil {
+	if ip.To4() != nil {
-		ipBytes = ipv4
+		ipBytes = ip.To4()
 	} else {
-		ipBytes = addr.To16()
+		ipBytes = ip.To16()
+	}
+	if ipBytes == nil {
+		return "", errors.New("invalid IP format for ", addr, ": ", ip)
 	}
 
-	var formatted strings.Builder
+	for i, j := 0, len(ipBytes)-1; i < j; i, j = i+1, j-1 {
-	formatted.Grow(len(ipBytes)*2 + 5)
+		ipBytes[i], ipBytes[j] = ipBytes[j], ipBytes[i]
-	for i := 0; i < len(ipBytes); i += 4 {
-		fmt.Fprintf(&formatted, "%08X", binary.NativeEndian.Uint32(ipBytes[i:i+4]))
 	}
-	fmt.Fprintf(&formatted, ":%04X", uint16(port))
+	portHex := fmt.Sprintf("%04X", uint16(port))
-	return formatted.String()
+	ipHex := strings.ToUpper(hex.EncodeToString(ipBytes))
+	return fmt.Sprintf("%s:%s", ipHex, portHex), nil
 }
 
 func findInodeInFiles(filePaths []string, targetHexAddr, portFallback string) (string, error) {

common/net/network.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/network.proto
 
 package net

common/net/port.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/port.proto
 
 package net

common/platform/filesystem/file.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -27,6 +26,14 @@ func ReadFile(path string) ([]byte, error) {
 	return buf.ReadAllToBytes(reader)
 }
 
+func ReadAsset(file string) ([]byte, error) {
+	path, _, err := getAssetFileLocation(file)
+	if err != nil {
+		return nil, err
+	}
+	return ReadFile(path)
+}
+
 func OpenAsset(file string) (io.ReadCloser, int64, error) {
 	path, info, err := getAssetFileLocation(file)
 	if err != nil {
@@ -36,6 +43,11 @@ func OpenAsset(file string) (io.ReadCloser, int64, error) {
 	return r, info.Size(), err
 }
 
+func StatAsset(file string) (os.FileInfo, error) {
+	_, info, err := getAssetFileLocation(file)
+	return info, err
+}
+
 func ResolveAsset(file string) (string, error) {
 	path, _, err := getAssetFileLocation(file)
 	return path, err
@@ -67,29 +79,17 @@ func ReadCert(file string) ([]byte, error) {
 	return ReadFile(platform.GetCertLocation(file))
 }
 
-// ResolveLuaFile finds a local .lua script and returns its absolute path.
+func CopyFile(dst string, src string) error {
-// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+	bytes, err := ReadFile(src)
-func ResolveLuaFile(path string) (string, error) {
+	if err != nil {
-	if !strings.EqualFold(filepath.Ext(path), ".lua") {
+		return err
-		return "", errors.New("Lua file extension must be .lua")
 	}
-	if filepath.IsAbs(path) {
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY, 0o644)
-		return path, nil
+	if err != nil {
+		return err
 	}
-	for _, dir := range []string{
+	defer f.Close()
-		platform.GetConfDirPath(),
+
-		platform.NewEnvFlag(platform.ConfigLocation).GetValue(func() string { return "" }),
+	_, err = f.Write(bytes)
-		".",
+	return err
-		platform.GetExecutableDir(),
-	} {
-		if dir != "" {
-			resolved := filepath.Join(dir, path)
-			if _, err := os.Stat(resolved); err == nil {
-				return filepath.Abs(resolved)
-			} else if !os.IsNotExist(err) {
-				return "", err
-			}
-		}
-	}
-	return "", os.ErrNotExist
 }

common/platform/filesystem/file_test.go

@@ -1,17 +1,13 @@
 package filesystem_test
 
 import (
-	"errors"
-	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/platform"
 	. "github.com/xtls/xray-core/common/platform/filesystem"
 )
 
-func TestResolveAssetRejectsInvalidPath(t *testing.T) {
+func TestStatAssetRejectsInvalidPath(t *testing.T) {
 	for _, file := range []string{
 		"",
 		".",
@@ -29,49 +25,8 @@ func TestResolveAssetRejectsInvalidPath(t *testing.T) {
 		`nested\..\geoip.dat`,
 		filepath.Join(t.TempDir(), "geoip.dat"),
 	} {
-		if _, err := ResolveAsset(file); err == nil {
+		if _, err := StatAsset(file); err == nil {
 			t.Fatalf("expected error for %q", file)
 		}
 	}
 }
-
-func TestResolveLuaFile(t *testing.T) {
-	t.Chdir(t.TempDir())
-	workingDir, err := os.Getwd()
-	common.Must(err)
-	executable, err := os.Executable()
-	common.Must(err)
-	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
-	common.Must(err)
-	common.Must(file.Close())
-	defer os.Remove(file.Name())
-
-	name := filepath.Base(file.Name())
-	paths := []string{
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(workingDir, name),
-		file.Name(),
-	}
-	t.Setenv(platform.ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(platform.ConfigLocation, filepath.Dir(paths[1]))
-	for _, path := range paths[:3] {
-		common.Must(os.WriteFile(path, nil, 0o600))
-	}
-	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
-		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
-	}
-	for i, want := range paths {
-		if i == 2 {
-			t.Setenv(platform.ConfdirLocation, "")
-			t.Setenv(platform.ConfigLocation, "")
-		}
-		if got, err := ResolveLuaFile(name); err != nil || got != want {
-			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
-		}
-		common.Must(os.Remove(want))
-	}
-	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("missing file error = %v", err)
-	}
-}

common/platform/others.go

@@ -14,7 +14,7 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir, the executable dir, and certain locations
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	defPath := filepath.Join(assetPath, file)
 	for _, p := range []string{
 		defPath,
@@ -36,6 +36,6 @@ func GetAssetLocation(file string) string {
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/platform/platform.go

@@ -1,6 +1,8 @@
 package platform // import "github.com/xtls/xray-core/common/platform"
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -72,7 +74,7 @@ func NormalizeEnvName(name string) string {
 	return strings.ReplaceAll(strings.ToUpper(strings.TrimSpace(name)), ".", "_")
 }
 
-func GetExecutableDir() string {
+func getExecutableDir() string {
 	exec, err := os.Executable()
 	if err != nil {
 		return ""
@@ -81,7 +83,7 @@ func GetExecutableDir() string {
 }
 
 func GetConfigurationPath() string {
-	configPath := NewEnvFlag(ConfigLocation).GetValue(GetExecutableDir)
+	configPath := NewEnvFlag(ConfigLocation).GetValue(getExecutableDir)
 	return filepath.Join(configPath, "config.json")
 }
 
@@ -90,3 +92,64 @@ func GetConfDirPath() string {
 	configPath := NewEnvFlag(ConfdirLocation).GetValue(func() string { return "" })
 	return configPath
 }
+
+// ResolveLuaFile finds a local .lua script and returns its resolved absolute path.
+// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+func ResolveLuaFile(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("Lua file path is empty")
+	}
+	paths := []string{path}
+	if !filepath.IsAbs(path) {
+		paths = nil
+		for _, dir := range []string{
+			GetConfDirPath(),
+			NewEnvFlag(ConfigLocation).GetValue(func() string { return "" }),
+			".",
+			getExecutableDir(),
+		} {
+			if dir != "" {
+				paths = append(paths, filepath.Join(dir, path))
+			}
+		}
+	}
+	path, err := resolveFile(paths)
+	if err != nil {
+		return "", err
+	}
+	return resolveLuaTarget(path)
+}
+
+func resolveLuaTarget(path string) (string, error) {
+	path, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve Lua file symlinks: %w", err)
+	}
+	if filepath.Ext(path) != ".lua" {
+		return "", errors.New("Lua file extension must be .lua")
+	}
+	return path, nil
+}
+
+func resolveFile(paths []string) (string, error) {
+	var tried []string
+	for _, path := range paths {
+		path, err := filepath.Abs(path)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve file path: %w", err)
+		}
+		tried = append(tried, path)
+		info, err := os.Stat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return "", fmt.Errorf("failed to inspect file %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("file is not a regular file: %s", path)
+		}
+		return path, nil
+	}
+	return "", fmt.Errorf("file not found; tried %q: %w", tried, os.ErrNotExist)
+}

common/platform/platform_test.go

@@ -1,9 +1,11 @@
 package platform_test
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/xtls/xray-core/common"
@@ -64,3 +66,89 @@ func TestGetAssetLocation(t *testing.T) {
 		}
 	}
 }
+
+func TestResolveLuaFile(t *testing.T) {
+	workingDir := t.TempDir()
+	t.Chdir(workingDir)
+	executable, err := os.Executable()
+	common.Must(err)
+	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
+	common.Must(err)
+	common.Must(file.Close())
+	defer os.Remove(file.Name())
+
+	name := filepath.Base(file.Name())
+	paths := []string{
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(workingDir, name),
+		file.Name(),
+	}
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	for _, path := range paths[:3] {
+		common.Must(os.WriteFile(path, nil, 0o600))
+	}
+	for i, path := range paths {
+		paths[i], err = filepath.EvalSymlinks(path)
+		common.Must(err)
+	}
+	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
+		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
+	}
+	for i, want := range paths {
+		if i == 2 {
+			t.Setenv(ConfdirLocation, "")
+			t.Setenv(ConfigLocation, "")
+		}
+		if got, err := ResolveLuaFile(name); err != nil || got != want {
+			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
+		}
+		common.Must(os.Remove(want))
+	}
+	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing file error = %v", err)
+	}
+
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	common.Must(os.Mkdir(paths[0], 0o700))
+	common.Must(os.WriteFile(paths[1], nil, 0o600))
+	for _, path := range []string{"", name, filepath.Join(t.TempDir(), name)} {
+		if _, err := ResolveLuaFile(path); err == nil {
+			t.Fatalf("accepted invalid path %q", path)
+		}
+	}
+}
+
+func TestResolveLuaFileSymlink(t *testing.T) {
+	for _, tc := range []struct {
+		link, target string
+		valid        bool
+	}{
+		{"alias.lua", "data.dat", false},
+		{"alias.dat", "script.lua", true},
+	} {
+		t.Run(tc.link, func(t *testing.T) {
+			dir, err := filepath.EvalSymlinks(t.TempDir())
+			common.Must(err)
+			target := filepath.Join(dir, tc.target)
+			common.Must(os.WriteFile(target, nil, 0o600))
+			link := filepath.Join(dir, tc.link)
+			if err := os.Symlink(tc.target, link); err != nil {
+				if runtime.GOOS == "windows" {
+					t.Skipf("cannot create symlinks: %v", err)
+				}
+				t.Fatal(err)
+			}
+			got, err := ResolveLuaFile(link)
+			if tc.valid {
+				if err != nil || got != target {
+					t.Fatalf("ResolveLuaFile(%q) = %q, %v; want %q", link, got, err, target)
+				}
+			} else if err == nil || got != "" || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
+				t.Fatalf("ResolveLuaFile(%q) = %q, %v; want .lua extension error", link, got, err)
+			}
+		})
+	}
+}

common/platform/windows.go

@@ -11,12 +11,12 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir and the executable dir
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	return filepath.Join(assetPath, file)
 }
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/protocol/headers.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/headers.proto
 
 package protocol

common/protocol/server_spec.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/server_spec.proto
 
 package protocol

common/protocol/tls/sniff.go

@@ -101,10 +101,6 @@ func ReadClientHello(data []byte, h *SniffHeader) error {
 					return errNotClientHello
 				}
 				if nameType == 0 {
-					// RFC 6066 requires a non-empty HostName.
-					if nameLen == 0 {
-						return errNotClientHello
-					}
 					// QUIC separated across packets
 					// May cause the serverName to be incomplete
 					b := byte(0)

common/protocol/user.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/user.proto
 
 package protocol

common/serial/typed_message.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/serial/typed_message.proto
 
 package serial

core/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: core/config.proto
 
 package core

core/core.go

@@ -20,7 +20,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 10
-	Version_z byte = 31
+	Version_z byte = 21
 )
 
 var (

core/proto.go

@@ -1,3 +1,5 @@
 package core
 
+//go:generate go install -v google.golang.org/protobuf/cmd/protoc-gen-go@latest
+//go:generate go install -v google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 //go:generate go run ../infra/vprotogen/main.go -pwd ./..

features/dns/localdns/client.go

@@ -2,7 +2,6 @@ package localdns
 
 import (
 	"context"
-	"net/netip"
 	"syscall"
 	"time"
 
@@ -101,15 +100,6 @@ func New() *Client {
 			if internet.IsSkippedDNSServer(address) {
 				return nil, errors.New("skipped DNS server ", address)
 			}
-			// A socket of the server's IP version only needs that version bound
-			// to the interface, which a dual-stack one would need both of.
-			if ap, err := netip.ParseAddrPort(address); err == nil && (network == "udp" || network == "tcp") {
-				if ap.Addr().Unmap().Is4() {
-					network += "4"
-				} else {
-					network += "6"
-				}
-			}
 			return d.DialContext(ctx, network, address)
 		},
 	}

go.mod

@@ -4,7 +4,6 @@ go 1.27
 
 require (
 	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/bufbuild/protocompile v0.14.1
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
@@ -15,7 +14,7 @@ require (
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.7
-	github.com/pires/go-proxyproto v0.16.0
+	github.com/pires/go-proxyproto v0.15.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/stretchr/testify v1.12.1
@@ -26,13 +25,13 @@ require (
 	golang.org/x/crypto v0.58.0
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.62.0
+	golang.org/x/net v0.61.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.1.1
-	google.golang.org/grpc v1.85.0
+	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	h12.io/socks v1.0.3
 	layeh.com/gopher-luar v1.0.11
@@ -58,13 +57,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
 )
-
-tool (
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc
-	google.golang.org/protobuf/cmd/protoc-gen-go
-)

go.sum

@@ -2,8 +2,6 @@ github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA
 github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8=
-github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
-github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -61,8 +59,8 @@ github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
 github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
 github.com/pion/transport/v4 v4.1.0 h1:8S+nF2reM2cJuqC6g78OVy2BBgmbdns+acx3jA97BvQ=
 github.com/pion/transport/v4 v4.1.0/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.16.0 h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
+github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.16.0/go.mod h1:n7yhg8yIfNl3KgYDCwBzmeUHNpKTVnUhcWpc7rV4RW4=
+github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -109,8 +107,8 @@ golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
@@ -150,12 +148,10 @@ golang.zx2c4.com/wireguard/windows v1.1.1 h1:8/H97U1v1PNDNcBsMZgU3KFuND9MQdTsU2N
 golang.zx2c4.com/wireguard/windows v1.1.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/freedom.go

@@ -91,7 +91,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Fragment != nil {
-		errors.PrintDeprecatedFeatureWarning(`"fragment" in Freedom`, `"fragment" in "streamSettings.finalmask.tcp"`)
 		config.Fragment = new(freedom.Fragment)
 
 		switch strings.ToLower(c.Fragment.Packets) {
@@ -148,7 +147,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Noises != nil {
-		errors.PrintDeprecatedFeatureWarning(`"noises" in Freedom`, `"noise" in "streamSettings.finalmask.udp"`)
 		for _, n := range c.Noises {
 			NConfig, err := ParseNoise(n)
 			if err != nil {

infra/conf/geodata.go

@@ -2,11 +2,11 @@ package conf
 
 import (
 	"net/url"
-	"strings"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/app/geodata"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -19,21 +19,15 @@ func (c *GeodataAssetConfig) Build() (*geodata.Asset, error) {
 	if err := validateHTTPS(c.URL); err != nil {
 		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
 	}
+	if _, err := filesystem.StatAsset(c.File); err != nil {
+		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
+	}
 	return &geodata.Asset{
-		Url:  migrateGeodataURL(c.URL),
+		Url:  c.URL,
 		File: c.File,
 	}, nil
 }
 
-func migrateGeodataURL(assetURL string) string {
-	if strings.HasSuffix(strings.ToLower(assetURL), ".dat") && (strings.HasPrefix(strings.ToLower(assetURL), "https://github.com/xtls/xray-rules-dat/") ||
-		strings.HasPrefix(strings.ToLower(assetURL), "https://raw.githubusercontent.com/xtls/xray-rules-dat/")) {
-		errors.PrintDeprecatedFeatureWarning(assetURL, assetURL+".gz")
-		return assetURL + ".gz"
-	}
-	return assetURL
-}
-
 func validateHTTPS(s string) error {
 	u, err := url.ParseRequestURI(s)
 	if err != nil {

infra/conf/geodata_test.go

@@ -1,6 +1,7 @@
 package conf_test
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/xtls/xray-core/app/geodata"
@@ -8,6 +9,8 @@ import (
 )
 
 func TestGeodataConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	creator := func() Buildable {
 		return new(GeodataConfig)
 	}
@@ -35,7 +38,27 @@ func TestGeodataConfig(t *testing.T) {
 	})
 }
 
+func TestGeodataAssetConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "geoip.dat",
+	}).Build(); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "missing.dat",
+	}).Build(); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
 func TestGeodataAssetConfigInvalidURL(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	for _, rawURL := range []string{
 		"",
 		"http://example.com/geoip.dat",

infra/conf/transport_method.go

@@ -293,7 +293,6 @@ type SplitHTTPConfig struct {
 	ServerMaxHeaderBytes int32             `json:"serverMaxHeaderBytes"`
 	Xmux                 XmuxConfig        `json:"xmux"`
 	DownloadSettings     *StreamConfig     `json:"downloadSettings"`
-	H2Params             json.RawMessage   `json:"h2Params"`
 	Extra                json.RawMessage   `json:"extra"`
 }
 
@@ -496,7 +495,6 @@ func (c *SplitHTTPConfig) Build() (proto.Message, error) {
 		ServerMaxHeaderBytes: c.ServerMaxHeaderBytes,
 		SessionIDTable:       c.SessionIDTable,
 		SessionIDLength:      newRangeConfig(c.SessionIDLength),
-		H2Params:             c.H2Params,
 		Xmux: &splithttp.XmuxConfig{
 			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
 			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
@@ -999,20 +997,12 @@ type XDriveConfig struct {
 	EagerWindowMs     uint32          `json:"eagerWindowMs"`
 	HoleTimeoutMs     uint32          `json:"holeTimeoutMs"`
 	Template          json.RawMessage `json:"template"`
-	S3                *XDriveS3Config `json:"s3"`
 	Xmux              XmuxConfig      `json:"xmux"`
 
 	// set by StreamConfig when "alpn" is ["h3"]
 	h3 bool
 }
 
-type XDriveS3Config struct {
-	Endpoint  string `json:"endpoint"`
-	Region    string `json:"region"`
-	Bucket    string `json:"bucket"`
-	PathStyle *bool  `json:"pathStyle"`
-}
-
 // Build implements Buildable.
 func (c *XDriveConfig) Build() (proto.Message, error) {
 	switch c.Service {
@@ -1029,12 +1019,8 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 		if len(c.Template) == 0 {
 			return nil, errors.New(`service "template" needs a "template" object`)
 		}
-	case "s3":
-		if c.S3 == nil {
-			return nil, errors.New(`service "s3" needs an "s3" object`)
-		}
 	default:
-		return nil, errors.New(`unknown "service": "`, c.Service, `", use "google-drive", "template", "s3" or "local"`)
+		return nil, errors.New(`unknown "service": "`, c.Service, `", use "google-drive", "template" or "local"`)
 	}
 	if c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {
 		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
@@ -1073,16 +1059,5 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 			HKeepAlivePeriod: c.Xmux.HKeepAlivePeriod,
 		},
 	}
-	if c.Service == "s3" {
-		config.S3 = &xdrive.S3Config{
-			Endpoint:  c.S3.Endpoint,
-			Region:    c.S3.Region,
-			Bucket:    c.S3.Bucket,
-			PathStyle: c.S3.PathStyle == nil || *c.S3.PathStyle,
-		}
-		if err := xdrive.ValidateS3Config(config); err != nil {
-			return nil, err
-		}
-	}
 	return config, nil
 }

infra/conf/transport_test.go

@@ -324,7 +324,7 @@ func TestXDriveRejectsUnknownService(t *testing.T) {
 	if err := json.Unmarshal([]byte(`{"remoteFolder": "/tmp/xdrive", "service": "Dropbox"}`), config); err != nil {
 		t.Fatalf("Unmarshal: %v", err)
 	}
-	if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), `use "google-drive", "template", "s3" or "local"`) {
+	if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), `use "google-drive", "template" or "local"`) {
 		t.Fatalf("expected an unknown service error, got %v", err)
 	}
 }

infra/conf/tun.go

@@ -6,7 +6,9 @@ import (
 	"math/big"
 	"net"
 	"runtime"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/proxy/tun"
@@ -37,22 +39,25 @@ func (v *TunConfig) Build() (proto.Message, error) {
 		AutoSystemRoutingTable: v.AutoSystemRoutingTable,
 		AutoSystemDnsToGateway: v.AutoSystemDnsToGateway,
 	}
-	leaks, err := tun.ExpandWfpBlockLeak(v.AutoSystemWfpBlockLeak)
+	for _, leak := range v.AutoSystemWfpBlockLeak {
-	if err != nil {
+		switch leak := strings.ToLower(leak); leak {
-		return nil, err
+		case "dns", "misconfigtun":
+			config.AutoSystemWfpBlockLeak = append(config.AutoSystemWfpBlockLeak, leak)
+		default:
+			return nil, errors.New("unknown autoSystemWfpBlockLeak value: ", leak)
+		}
 	}
-	config.AutoSystemWfpBlockLeak = leaks
 	// Each option needs other settings on the system it takes effect on: the
-	// filters go along with the routes of autoSystemRoutingTable, keeping the
+	// filters go along with the routes of autoSystemRoutingTable, "dns" lets
-	// system's DNS inside the TUN needs DNS servers on it, and
+	// DNS through the TUN only, and autoSystemDnsToGateway points the system
-	// autoSystemDnsToGateway points the system DNS at the gateway.
+	// DNS at the gateway.
 	switch runtime.GOOS {
 	case "windows":
-		if len(leaks) > 0 && len(v.AutoSystemRoutingTable) == 0 {
+		if len(config.AutoSystemWfpBlockLeak) > 0 && len(v.AutoSystemRoutingTable) == 0 {
 			return nil, errors.New("autoSystemWfpBlockLeak needs autoSystemRoutingTable to be set")
 		}
-		if tun.BlocksSystemDNS(leaks) && len(v.DNS) == 0 {
+		if slices.Contains(config.AutoSystemWfpBlockLeak, "dns") && len(v.DNS) == 0 {
-			return nil, errors.New(`autoSystemWfpBlockLeak "all", "allexceptlan", "dns", "windnsclient", or TCP or UDP port 53, needs dns to be set`)
+			return nil, errors.New(`autoSystemWfpBlockLeak "dns" needs dns to be set`)
 		}
 	case "linux", "freebsd":
 		if v.AutoSystemDnsToGateway && len(v.Gateway) == 0 {

infra/conf/tun_test.go

@@ -29,37 +29,12 @@ func TestTunConfigAutoSystem(t *testing.T) {
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns", "misconfigtun"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"53", "853", "windnsclient", "misconfigtun"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns", "misconfigtun"}},
 		},
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["DNS"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"53", "853", "windnsclient"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns"}},
-		},
-		{
-			Input:  `{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["TCP/853", "udp/853", "tcp/0853"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"tcp/853", "udp/853"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["All", "UDP", "tcp/8000-9000", "icmp"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"all", "udp", "tcp/8000-9000", "icmp"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["AllExceptLAN"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"allexceptlan", "53", "853", "windnsclient"}},
-		},
-		{
-			Input:  `{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["1.1.1.1/24:TCP/853", "[2001:DB8::/32]:udp/10-20", "[::/0]:ICMP", "853"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"1.1.1.0/24:tcp/853", "[2001:db8::/32]:udp/10-20", "[::/0]:icmp", "853"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:dns", "[::/0]:All", "53"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"0.0.0.0/0:53", "0.0.0.0/0:853", "0.0.0.0/0:windnsclient", "[::/0]:all", "53"}},
 		},
 	})
 }
@@ -74,24 +49,6 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["misconfigtun"]}`, []string{"windows"}},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["misconfigtun"]}`, nil},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["udp/53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["windnsclient"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/853", "udp/853"]}`, nil},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["udp"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/50-60"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/54-60", "icmp"]}`, nil},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["50-60"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["[::/0]:udp/53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["1.1.1.1/32:dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["[2001:db8::/32]:all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:windnsclient"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:tcp/853", "1.1.1.0/24:icmp", "[::/0]:misconfigtun", "54-60"]}`, nil},
-		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["[::/0]:misconfigtun"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["allexceptlan"]}`, []string{"windows"}},
-		{`{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["allexceptlan"]}`, nil},
 		{`{"name": "xray0", "autoSystemDnsToGateway": true}`, []string{"linux", "freebsd"}},
 	} {
 		config := new(TunConfig)
@@ -105,22 +62,11 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 }
 
 func TestTunConfigAutoSystemWfpBlockLeakUnknown(t *testing.T) {
-	// With the settings the values need on Windows, so that only an unknown
-	// one fails.
-	build := func(value string) error {
 	config := new(TunConfig)
-		if err := json.Unmarshal([]byte(`{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns", "`+value+`"]}`), config); err != nil {
+	if err := json.Unmarshal([]byte(`{"name": "xray0", "autoSystemWfpBlockLeak": ["dns", "ip"]}`), config); err != nil {
 		t.Fatal(err)
 	}
-		_, err := config.Build()
+	if _, err := config.Build(); err == nil {
-		return err
+		t.Error("an unknown autoSystemWfpBlockLeak value was accepted")
-	}
-	if err := build("1.1.1.0/24:53"); err != nil {
-		t.Fatal(err)
-	}
-	for _, value := range []string{"ip", "tcp/0", "tcp/0-10", "icmp/1", "udp/20-10", "0", "20-10", "53/tcp", "tcpv4", "ipv4:udp", "1.1.1.1:53", "2001:db8::/32:53", "[1.1.1.0/24]:53", "[::ffff:1.1.1.0/120]:53", "1.1.1.0/24"} {
-		if build(value) == nil {
-			t.Errorf("autoSystemWfpBlockLeak value %q was accepted", value)
-		}
 	}
 }

infra/conf/xray.go

@@ -237,11 +237,10 @@ type OutboundDetourConfig struct {
 
 func requiresTransportSecurity(address *Address) bool {
 	if address == nil || address.Address == nil {
-		return true
+		return false
 	}
 	if address.Family().IsIP() {
-		ip := address.IP()
+		return !geodata.GetPrivateIPMatcher().Match(address.IP())
-		return !ip.IsPrivate() && !ip.IsLoopback() && !ip.IsLinkLocalUnicast()
 	}
 	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
 	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)
@@ -609,6 +608,7 @@ func (c *Config) Build() (*core.Config, error) {
 	config := &core.Config{
 		App: []*serial.TypedMessage{
 			serial.ToTypedMessage(&dispatcher.Config{}),
+			serial.ToTypedMessage(&proxyman.InboundConfig{}),
 			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 		},
 	}
@@ -718,9 +718,6 @@ func (c *Config) Build() (*core.Config, error) {
 		config.App = append(config.App, serial.ToTypedMessage(r))
 	}
 
-	// Initialize the inbound module last to ensure inbound connections are handled correctly.
-	config.App = append(config.App, serial.ToTypedMessage(&proxyman.InboundConfig{}))
-
 	var inbounds []InboundDetourConfig
 
 	if len(c.InboundConfigs) > 0 {

infra/conf/xray_test.go

@@ -90,6 +90,7 @@ func TestXrayConfig(t *testing.T) {
 						AccessLogPath: "/var/log/xray/access.log",
 					}),
 					serial.ToTypedMessage(&dispatcher.Config{}),
+					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 					serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 					serial.ToTypedMessage(&router.Config{
 						DomainStrategy: router.Config_AsIs,
@@ -110,7 +111,6 @@ func TestXrayConfig(t *testing.T) {
 							},
 						},
 					}),
-					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 				},
 				Inbound: []*core.InboundHandlerConfig{
 					{

infra/vprotogen/main.go

@@ -1,87 +1,149 @@
 package main
 
 import (
-	"bytes"
+	"errors"
-	"context"
 	"flag"
 	"fmt"
-	"io/fs"
+	"go/build"
+	"io"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"runtime"
+	"strconv"
 	"strings"
-
-	"github.com/bufbuild/protocompile"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/reflect/protodesc"
-	"google.golang.org/protobuf/reflect/protoreflect"
-	"google.golang.org/protobuf/types/descriptorpb"
-	"google.golang.org/protobuf/types/pluginpb"
 )
 
-var (
+var directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
-	directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
-	mode      = flag.String("mode", "generate", "Execution mode. 'generate' (default) compiles and saves changes. 'check' reports out-of-date files and exits with non-zero.")
-)
 
-// topoSort sorts file descriptors so each dependency appears before files importing it.
+// envFile returns the name of the Go environment configuration file.
-func topoSort(files []protoreflect.FileDescriptor) []*descriptorpb.FileDescriptorProto {
+// Copy from https://github.com/golang/go/blob/c4f2a9788a7be04daf931ac54382fbe2cb754938/src/cmd/go/internal/cfg/cfg.go#L150-L166
-	fileMap := make(map[string]protoreflect.FileDescriptor)
+func envFile() (string, error) {
-	for _, f := range files {
+	if file := os.Getenv("GOENV"); file != "" {
-		fileMap[f.Path()] = f
+		if file == "off" {
+			return "", errors.New("GOENV=off")
 		}
-
+		return file, nil
-	visited := make(map[string]bool)
-	var sorted []*descriptorpb.FileDescriptorProto
-
-	var visit func(fd protoreflect.FileDescriptor)
-	visit = func(fd protoreflect.FileDescriptor) {
-		if visited[fd.Path()] {
-			return
 	}
-		visited[fd.Path()] = true
+	dir, err := os.UserConfigDir()
-
+	if err != nil {
-		imports := fd.Imports()
+		return "", err
-		for i := 0; i < imports.Len(); i++ {
-			if dep, ok := fileMap[imports.Get(i).Path()]; ok {
-				visit(dep)
 	}
+	if dir == "" {
+		return "", errors.New("missing user-config dir")
 	}
-		sorted = append(sorted, protodesc.ToFileDescriptorProto(fd))
+	return filepath.Join(dir, "go", "env"), nil
-	}
-
-	for _, f := range files {
-		visit(f)
-	}
-	return sorted
 }
 
-func runPlugin(pluginName, pwd string, req *pluginpb.CodeGeneratorRequest) (*pluginpb.CodeGeneratorResponse, error) {
+// GetRuntimeEnv returns the value of runtime environment variable,
-	reqBytes, err := proto.Marshal(req)
+// that is set by running following command: `go env -w key=value`.
+func GetRuntimeEnv(key string) (string, error) {
+	file, err := envFile()
 	if err != nil {
-		return nil, err
+		return "", err
 	}
+	if file == "" {
+		return "", errors.New("missing runtime env file")
+	}
+	var data []byte
+	var runtimeEnv string
+	data, readErr := os.ReadFile(file)
+	if readErr != nil {
+		return "", readErr
+	}
+	envStrings := strings.Split(string(data), "\n")
+	for _, envItem := range envStrings {
+		envItem = strings.TrimSuffix(envItem, "\r")
+		envKeyValue := strings.Split(envItem, "=")
+		if strings.EqualFold(strings.TrimSpace(envKeyValue[0]), key) {
+			runtimeEnv = strings.TrimSpace(envKeyValue[1])
+		}
+	}
+	return runtimeEnv, nil
+}
 
-	cmd := exec.Command("go", "tool", pluginName)
+// GetGOBIN returns GOBIN environment variable as a string. It will NOT be empty.
-	cmd.Dir = pwd
+func GetGOBIN() string {
-	cmd.Stdin = bytes.NewReader(reqBytes)
+	// The one set by user explicitly by `export GOBIN=/path` or `env GOBIN=/path command`
-	cmd.Env = os.Environ()
+	GOBIN := os.Getenv("GOBIN")
-	var stdout, stderr bytes.Buffer
+	if GOBIN == "" {
-	cmd.Stdout = &stdout
+		var err error
-	cmd.Stderr = &stderr
+		// The one set by user by running `go env -w GOBIN=/path`
+		GOBIN, err = GetRuntimeEnv("GOBIN")
+		if err != nil {
+			// The default one that Golang uses
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		if GOBIN == "" {
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		return GOBIN
+	}
+	return GOBIN
+}
 
-	if err := cmd.Run(); err != nil {
+func whichProtoc(suffix, targetedVersion string) (string, error) {
-		return nil, fmt.Errorf("%v: %s", err, stderr.String())
+	protoc := "protoc" + suffix
-	}
 
-	var resp pluginpb.CodeGeneratorResponse
+	path, err := exec.LookPath(protoc)
-	if err := proto.Unmarshal(stdout.Bytes(), &resp); err != nil {
+	if err != nil {
-		return nil, fmt.Errorf("failed to unmarshal response: %w", err)
+		return "", fmt.Errorf(`
+Command "%s" not found.
+Make sure that %s is in your system path or current path.
+Download %s v%s or later from https://github.com/protocolbuffers/protobuf/releases
+`, protoc, protoc, protoc, targetedVersion)
 	}
-	if resp.GetError() != "" {
+	return path, nil
-		return nil, fmt.Errorf("%s", resp.GetError())
+}
+
+func getProjectProtocVersion(url string) (string, error) {
+	resp, err := http.Get(url)
+	if err != nil {
+		return "", errors.New("can not get the version of protobuf used in xray project")
 	}
-	return &resp, nil
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", errors.New("can not read from body")
+	}
+	versionRegexp := regexp.MustCompile(`\/\/\s*protoc\s*v\d+\.(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(body))
+	return matched[1], nil
+}
+
+func getInstalledProtocVersion(protocPath string) (string, error) {
+	cmd := exec.Command(protocPath, "--version")
+	cmd.Env = append(cmd.Env, os.Environ()...)
+	output, cmdErr := cmd.CombinedOutput()
+	if cmdErr != nil {
+		return "", cmdErr
+	}
+	versionRegexp := regexp.MustCompile(`protoc\s*(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(output))
+	return matched[1], nil
+}
+
+func parseVersion(s string, width int) int64 {
+	strList := strings.Split(s, ".")
+	format := fmt.Sprintf("%%s%%0%ds", width)
+	v := ""
+	for _, value := range strList {
+		v = fmt.Sprintf(format, v, value)
+	}
+	var result int64
+	var err error
+	if result, err = strconv.ParseInt(v, 10, 64); err != nil {
+		return 0
+	}
+	return result
+}
+
+func needToUpdate(targetedVersion, installedVersion string) bool {
+	vt := parseVersion(targetedVersion, 4)
+	vi := parseVersion(installedVersion, 4)
+	return vt > vi
 }
 
 func main() {
@@ -92,145 +154,106 @@ func main() {
 	flag.Parse()
 
 	if !filepath.IsAbs(*directory) {
-		pwd, err := os.Getwd()
+		pwd, wdErr := os.Getwd()
-		if err != nil {
+		if wdErr != nil {
 			fmt.Println("Can not get current working directory.")
 			os.Exit(1)
 		}
 		*directory = filepath.Join(pwd, *directory)
 	}
-	pwd := *directory
 
-	isCheck := false
+	pwd := *directory
-	switch *mode {
+	GOBIN := GetGOBIN()
-	case "generate", "":
+	binPath := os.Getenv("PATH")
-		isCheck = false
+	pathSlice := []string{pwd, GOBIN, binPath}
-	case "check":
+	binPath = strings.Join(pathSlice, string(os.PathListSeparator))
-		isCheck = true
+	os.Setenv("PATH", binPath)
-	default:
+
-		fmt.Fprintf(os.Stderr, "Unrecognized 'mode': %s. Use 'generate' or 'check'.\n", *mode)
+	suffix := ""
+	if runtime.GOOS == "windows" {
+		suffix = ".exe"
+	}
+
+	/*
+		targetedVersion, err := getProjectProtocVersion("https://raw.githubusercontent.com/XTLS/Xray-core/HEAD/core/config.pb.go")
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	*/
+	targetedVersion := ""
+
+	protoc, err := whichProtoc(suffix, targetedVersion)
+	if err != nil {
+		fmt.Println(err)
 		os.Exit(1)
 	}
 
-	if isCheck {
+	installedVersion, err := getInstalledProtocVersion(protoc)
-		fmt.Println("Checking for out-of-date Protobuf generated files...")
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
 	}
 
-	var protoFiles []string
+	if needToUpdate(targetedVersion, installedVersion) {
-	var existingPbFiles []string
+		fmt.Printf(`
-	err := filepath.WalkDir(pwd, func(path string, d fs.DirEntry, err error) error {
+You are using an old protobuf version, please update to v%s or later.
-		if err != nil || d.IsDir() {
+Download it from https://github.com/protocolbuffers/protobuf/releases
+
+    * Protobuf version used in xray project: v%s
+    * Protobuf version you have installed: v%s
+
+`, targetedVersion, targetedVersion, installedVersion)
+		os.Exit(1)
+	}
+
+	protoFilesMap := make(map[string][]string)
+	walkErr := filepath.Walk(pwd, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			fmt.Println(err)
 			return err
 		}
-		if strings.HasSuffix(d.Name(), ".proto") {
+
-			rel, _ := filepath.Rel(pwd, path)
+		if info.IsDir() {
-			protoFiles = append(protoFiles, filepath.ToSlash(rel))
+			return nil
 		}
-		if strings.HasSuffix(d.Name(), ".pb.go") {
+
-			existingPbFiles = append(existingPbFiles, path)
+		dir := filepath.Dir(path)
+		filename := filepath.Base(path)
+		if strings.HasSuffix(filename, ".proto") {
+			path = path[len(pwd)+1:]
+			protoFilesMap[dir] = append(protoFilesMap[dir], path)
 		}
+
 		return nil
 	})
-	if err != nil {
+	if walkErr != nil {
-		fmt.Println("Walk error:", err)
+		fmt.Println(walkErr)
 		os.Exit(1)
 	}
 
-	compiler := protocompile.Compiler{
+	for _, files := range protoFilesMap {
-		Resolver: protocompile.WithStandardImports(&protocompile.SourceResolver{
+		for _, relProtoFile := range files {
-			ImportPaths: []string{pwd},
+			args := []string{
-		}),
+				"--go_out", pwd,
-		SourceInfoMode: protocompile.SourceInfoStandard,
+				"--go_opt", "paths=source_relative",
+				"--go-grpc_out", pwd,
+				"--go-grpc_opt", "paths=source_relative",
+				"--plugin", "protoc-gen-go=" + filepath.Join(GOBIN, "protoc-gen-go"+suffix),
+				"--plugin", "protoc-gen-go-grpc=" + filepath.Join(GOBIN, "protoc-gen-go-grpc"+suffix),
 			}
-
+			args = append(args, relProtoFile)
-	linkedFiles, err := compiler.Compile(context.Background(), protoFiles...)
+			cmd := exec.Command(protoc, args...)
-	if err != nil {
+			cmd.Env = append(cmd.Env, os.Environ()...)
-		fmt.Fprintf(os.Stderr, "Protobuf compilation failed:\n%v\n", err)
+			cmd.Dir = pwd
-		os.Exit(1)
+			output, cmdErr := cmd.CombinedOutput()
+			if len(output) > 0 {
+				fmt.Println(string(output))
 			}
-
+			if cmdErr != nil {
-	var fdList []protoreflect.FileDescriptor
+				fmt.Println(cmdErr)
-	for _, f := range linkedFiles {
-		fdList = append(fdList, f)
-	}
-
-	req := &pluginpb.CodeGeneratorRequest{
-		FileToGenerate: protoFiles,
-		Parameter:      new("paths=source_relative"),
-		ProtoFile:      topoSort(fdList),
-	}
-
-	var diffCount int
-	generatedFiles := make(map[string]struct{})
-	for _, plugin := range []string{"protoc-gen-go", "protoc-gen-go-grpc"} {
-		resp, err := runPlugin(plugin, pwd, req)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s failed: %v\n", plugin, err)
-			os.Exit(1)
-		}
-
-		for _, f := range resp.File {
-			targetPath := filepath.Join(pwd, filepath.FromSlash(f.GetName()))
-			generatedFiles[targetPath] = struct{}{}
-			content := []byte(f.GetContent())
-
-			hasDiff := false
-			existing, err := os.ReadFile(targetPath)
-			if err != nil {
-				hasDiff = true
-			} else {
-				oldNorm := bytes.ReplaceAll(existing, []byte("\r\n"), []byte("\n"))
-				newNorm := bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
-				if !bytes.Equal(oldNorm, newNorm) {
-					hasDiff = true
-				}
-			}
-
-			if hasDiff {
-				diffCount++
-				fmt.Println(targetPath)
-
-				if isCheck {
-					continue
-				}
-
-				if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
-					fmt.Fprintf(os.Stderr, "Error creating directory: %v\n", err)
-					os.Exit(1)
-				}
-				mode := os.FileMode(0o644)
-				if stat, err := os.Stat(targetPath); err == nil {
-					mode = stat.Mode().Perm()
-				}
-				if err := os.WriteFile(targetPath, content, mode); err != nil {
-					fmt.Fprintf(os.Stderr, "Error writing %s: %v\n", targetPath, err)
 				os.Exit(1)
 			}
 		}
 	}
-	}
-
-	for _, path := range existingPbFiles {
-		if _, ok := generatedFiles[path]; !ok {
-			diffCount++
-			if isCheck {
-				fmt.Printf("Orphaned Protobuf file: %s\n", path)
-			} else {
-				fmt.Printf("Removing orphaned Protobuf file: %s\n", path)
-				if err := os.Remove(path); err != nil {
-					fmt.Fprintf(os.Stderr, "Error removing %s: %v\n", path, err)
-					os.Exit(1)
-				}
-			}
-		}
-	}
-
-	if isCheck {
-		if diffCount > 0 {
-			fmt.Println("Protobuf generated file problem(s) found.")
-			fmt.Println("Please run 'go run ./infra/vprotogen' to regenerate them.")
-			os.Exit(1)
-		}
-		fmt.Println("All Protobuf generated file check has been passed.")
-	}
 }

main/commands/all/api/balancer_info.go

@@ -47,8 +47,7 @@ func executeBalancerInfo(cmd *base.Command, args []string) {
 	conn, ctx, close := dialAPIServer()
 	defer close()
 	client := routerService.NewRoutingServiceClient(conn)
-	for _, tag := range unnamedArgs {
+	r := &routerService.GetBalancerInfoRequest{Tag: unnamedArgs[0]}
-		r := &routerService.GetBalancerInfoRequest{Tag: tag}
 	resp, err := client.GetBalancerInfo(ctx, r)
 	if err != nil {
 		base.Fatalf("failed to get health information: %s", err)
@@ -56,10 +55,10 @@ func executeBalancerInfo(cmd *base.Command, args []string) {
 
 	if apiJSON {
 		showJSONResponse(resp)
-		} else {
+		return
+	}
+
 	showBalancerInfo(resp.Balancer)
-		}
-	}
 }
 
 func showBalancerInfo(b *routerService.BalancerMsg) {

main/commands/all/api/rules_add.go

@@ -92,8 +92,6 @@ func executeAddRules(cmd *base.Command, args []string) {
 		if err != nil {
 			base.Fatalf("failed to perform AddRule: %s", err)
 		}
-		// if multiple files are specified, use append to merge them instead of overriding previous one
-		shouldAppend = true
 		showJSONResponse(resp)
 	}
 }

main/commands/all/lua/sign.go

@@ -3,7 +3,6 @@ package lua
 import (
 	"os"
 	"path/filepath"
-	"strings"
 
 	xlua "github.com/xtls/xray-core/common/lua"
 	"github.com/xtls/xray-core/main/commands/base"
@@ -33,13 +32,14 @@ func executeSign(cmd *base.Command, args []string) {
 		cmd.Usage()
 	}
 
-	if !strings.EqualFold(filepath.Ext(args[0]), ".lua") {
-		base.Fatalf("Lua file extension must be .lua")
-	}
 	info, err := os.Stat(args[0])
 	if err != nil {
 		base.Fatalf("failed to inspect Lua file: %s", err)
 	}
+	if !info.Mode().IsRegular() {
+		base.Fatalf("Lua input is not a regular file: %s", args[0])
+	}
+
 	code, err := os.ReadFile(args[0])
 	if err != nil {
 		base.Fatalf("failed to read Lua file: %s", err)
@@ -67,7 +67,14 @@ func executeSign(cmd *base.Command, args []string) {
 
 func writeSignedFile(path string, code []byte, mode os.FileMode) error {
 	if info, err := os.Stat(path); err == nil {
+		if !info.Mode().IsRegular() {
+			return &os.PathError{Op: "write", Path: path, Err: os.ErrInvalid}
+		}
 		mode = info.Mode().Perm()
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return err
+		}
 	} else if !os.IsNotExist(err) {
 		return err
 	}

main/confloader/external/external.go

@@ -58,10 +58,18 @@ func readConfigFile(file *os.File) ([]byte, error) {
 		return nil, err
 	}
 	if info.Mode().IsRegular() {
-		switch strings.ToLower(filepath.Ext(file.Name())) {
+		path, err := filepath.Abs(file.Name())
+		if err != nil {
+			return nil, err
+		}
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return nil, err
+		}
+		switch strings.ToLower(filepath.Ext(path)) {
 		case ".jsonc", ".json", ".yml", ".yaml", ".toml", ".pb", ".protobuf":
 		default:
-			return nil, errors.New("unsupported config file extension: ", file.Name())
+			return nil, errors.New("unsupported config file extension: ", path)
 		}
 	}
 	return io.ReadAll(file)

proxy/blackhole/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/blackhole/config.proto
 
 package blackhole

proxy/dns/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/dns/config.proto
 
 package dns

proxy/dns/dns.go

@@ -381,13 +381,6 @@ func (h *Handler) handleIPQuery(id uint16, qType dnsmessage.Type, domain string,
 		errors.LogInfoInner(context.Background(), err, "pack message")
 		b.Release()
 		timer.SetTimeout(0)
-		return
-	}
-	if len(msgBytes) > buf.Size {
-		b.Release()
-		timer.SetTimeout(0)
-		errors.LogError(context.Background(), "DNS response message too large")
-		return
 	}
 	b.Resize(0, int32(len(msgBytes)))
 

proxy/dokodemo/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/dokodemo/config.proto
 
 package dokodemo
@@ -24,11 +24,11 @@ const (
 
 type Config struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
-	// List of networks that the Dokodemo accepts.
-	AllowedNetworks []net.Network     `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
 	RewriteAddress *net.IPOrDomain        `protobuf:"bytes,1,opt,name=rewrite_address,json=rewriteAddress,proto3" json:"rewrite_address,omitempty"`
 	RewritePort    uint32                 `protobuf:"varint,2,opt,name=rewrite_port,json=rewritePort,proto3" json:"rewrite_port,omitempty"`
 	PortMap        map[string]string      `protobuf:"bytes,3,rep,name=port_map,json=portMap,proto3" json:"port_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// List of networks that the Dokodemo accepts.
+	AllowedNetworks []net.Network `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
 	FollowRedirect  bool          `protobuf:"varint,5,opt,name=follow_redirect,json=followRedirect,proto3" json:"follow_redirect,omitempty"`
 	UserLevel       uint32        `protobuf:"varint,6,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
 	unknownFields   protoimpl.UnknownFields
@@ -65,13 +65,6 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_proxy_dokodemo_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetAllowedNetworks() []net.Network {
-	if x != nil {
-		return x.AllowedNetworks
-	}
-	return nil
-}
-
 func (x *Config) GetRewriteAddress() *net.IPOrDomain {
 	if x != nil {
 		return x.RewriteAddress
@@ -93,6 +86,13 @@ func (x *Config) GetPortMap() map[string]string {
 	return nil
 }
 
+func (x *Config) GetAllowedNetworks() []net.Network {
+	if x != nil {
+		return x.AllowedNetworks
+	}
+	return nil
+}
+
 func (x *Config) GetFollowRedirect() bool {
 	if x != nil {
 		return x.FollowRedirect
@@ -112,11 +112,11 @@ var File_proxy_dokodemo_config_proto protoreflect.FileDescriptor
 const file_proxy_dokodemo_config_proto_rawDesc = "" +
 	"\n" +
 	"\x1bproxy/dokodemo/config.proto\x12\x13xray.proxy.dokodemo\x1a\x18common/net/address.proto\x1a\x18common/net/network.proto\"\xff\x02\n" +
-	"\x06Config\x12C\n" +
+	"\x06Config\x12D\n" +
-	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12D\n" +
 	"\x0frewrite_address\x18\x01 \x01(\v2\x1b.xray.common.net.IPOrDomainR\x0erewriteAddress\x12!\n" +
 	"\frewrite_port\x18\x02 \x01(\rR\vrewritePort\x12C\n" +
-	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12'\n" +
+	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12C\n" +
+	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12'\n" +
 	"\x0ffollow_redirect\x18\x05 \x01(\bR\x0efollowRedirect\x12\x1d\n" +
 	"\n" +
 	"user_level\x18\x06 \x01(\rR\tuserLevel\x1a:\n" +
@@ -141,13 +141,13 @@ var file_proxy_dokodemo_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_proxy_dokodemo_config_proto_goTypes = []any{
 	(*Config)(nil),         // 0: xray.proxy.dokodemo.Config
 	nil,                    // 1: xray.proxy.dokodemo.Config.PortMapEntry
-	(net.Network)(0),       // 2: xray.common.net.Network
+	(*net.IPOrDomain)(nil), // 2: xray.common.net.IPOrDomain
-	(*net.IPOrDomain)(nil), // 3: xray.common.net.IPOrDomain
+	(net.Network)(0),       // 3: xray.common.net.Network
 }
 var file_proxy_dokodemo_config_proto_depIdxs = []int32{
-	2, // 0: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
+	2, // 0: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
-	3, // 1: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
+	1, // 1: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
-	1, // 2: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
+	3, // 2: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
 	3, // [3:3] is the sub-list for method output_type
 	3, // [3:3] is the sub-list for method input_type
 	3, // [3:3] is the sub-list for extension type_name

proxy/freedom/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/freedom/config.proto
 
 package freedom

proxy/freedom/freedom.go

@@ -229,19 +229,14 @@ func (h *Handler) blockDelay(rule *FinalRule) time.Duration {
 func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *FinalRule, dest *net.Destination) error {
 	delay := h.blockDelay(rule)
 	errors.LogInfo(ctx, "blocked target: ", *dest, ", blackholing connection for ", delay)
-	defer common.Close(output)
+	timer := time.AfterFunc(delay, func() {
-	done := make(chan struct{})
-	go func() { // a DispatchLink inbound's reader ignores Interrupt, so don't wait for this copy
-		_ = buf.Copy(input, buf.Discard)
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(delay):
 		common.Interrupt(input)
 		common.Interrupt(output)
 		errors.LogInfo(ctx, "closed blackholed connection to blocked target: ", *dest)
-	}
+	})
+	defer timer.Stop()
+	defer common.Close(output)
+	_ = buf.Copy(input, buf.Discard)
 	return nil
 }
 

proxy/http/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/http/config.proto
 
 package http

proxy/http/server.go

@@ -312,9 +312,8 @@ func (s *Server) handlePlainHTTP(ctx context.Context, request *http.Request, wri
 // Sometimes, server might send 1xx response to client
 // it should not be processed by http proxy handler, just forward it to client
 func readResponseAndHandle100Continue(r *bufio.Reader, req *http.Request, writer io.Writer) (*http.Response, error) {
-	// Wait for the HTTP/1.x status prefix before inspecting the buffered response.
+	// have a little look of response
-	r.Peek(12)
+	peekBytes, err := r.Peek(56)
-	peekBytes, err := r.Peek(min(56, r.Buffered()))
 	if err == nil || err == bufio.ErrBufferFull {
 		str := string(peekBytes)
 		ResponseLine := strings.Split(str, "\r\n")[0]

proxy/http/server_test.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"strings"
 	"testing"
-	"testing/iotest"
 )
 
 // A malformed upstream response containing a bare '\n' before the real
@@ -30,7 +29,7 @@ func TestReadResponseAndHandle100ContinueDoesNotPanicOnEarlyNewline(t *testing.T
 func TestReadResponseAndHandle100ContinueForwardsAndParsesFinalResponse(t *testing.T) {
 	payload := "HTTP/1.1 100 Continue\r\n\r\n" +
 		"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello"
-	r := bufio.NewReader(iotest.OneByteReader(bytes.NewReader([]byte(payload))))
+	r := bufio.NewReader(bytes.NewReader([]byte(payload)))
 	req, err := http.NewRequest("GET", "http://example.com/", nil)
 	if err != nil {
 		t.Fatal(err)

proxy/hysteria/account/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/hysteria/account/config.proto
 
 package account

proxy/hysteria/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/hysteria/config.proto
 
 package hysteria

proxy/loopback/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/loopback/config.proto
 
 package loopback

proxy/masque/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/masque/config.proto
 
 package masque

proxy/shadowsocks/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/shadowsocks/config.proto
 
 package shadowsocks

proxy/shadowsocks_2022/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/shadowsocks_2022/config.proto
 
 package shadowsocks_2022

proxy/socks/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/socks/config.proto
 
 package socks

proxy/trojan/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/trojan/config.proto
 
 package trojan

proxy/tun/README.md

@@ -4,7 +4,7 @@ TUN interface support bridges the gap between network layer 3 and layer 7, intro
 
 This functionality is targeted to assist applications/end devices that don't have proxy support, or can't run external applications (like Smart TV's). Making it possible to run Xray proxy right on network edge devices (routers) with support to route raw network traffic. \
 Primary targets are Linux based router devices. Like most popular OpenWRT option. \
-Support for Windows, macOS, FreeBSD, Android and iOS is also implemented (see below).
+Support for Windows, macOS, Android and iOS is also implemented (see below).
 
 ## PLEASE READ FOLLOWING CAREFULLY
 
@@ -23,12 +23,6 @@ For more advanced routing policies or rules, OS level configuration can still ma
 This keeps complex system level routing and rules in a single place of responsibility - the OS itself. \
 Examples of how to achieve this on a simple Linux system (Ubuntu with systemd-networkd) can be found at the end of this README.
 
-Packets are handled by Xray-core's own lightweight TCP/IP stack, which replaced gVisor (XTLS/Xray-core#7130).
-
-On Linux, as on Android, the TUN can also be a file descriptor handed over through the environment variable `xray.tun.fd` (or `XRAY_TUN_FD`), e.g. for lightweight or unprivileged setups.
-
-With `autoSystemRoutingTable`, Xray's own connections are kept out of the TUN through `autoOutboundsInterface` (then `"auto"` by default): each of their sockets is bound to another interface, the one named there, or with `"auto"` the one of the default route (Android needs the name). Linux and Android bind with `SO_BINDTODEVICE`, Windows with `IP_UNICAST_IF` and `IPV6_UNICAST_IF`, macOS and iOS with `IP_BOUND_IF` and `IPV6_BOUND_IF`, and FreeBSD switches them to another routing table (see [FreeBSD SUPPORT](#freebsd-support)). Connections to loopback addresses, TCP and UDP, stay unbound. If a socket cannot be bound, the connection fails rather than leave unbound, where it could loop back into the TUN (XTLS/Xray-core#7173).
-
 ### SYSTEM DNS ON LINUX AND FREEBSD (`autoSystemDnsToGateway`)
 
 On Linux and FreeBSD, setting `autoSystemDnsToGateway` to `true` lets the inbound point the system resolver at the tun interface, so name lookups resolve through Xray instead of going out over the physical link. It is off by default, and it exists only on those two systems. This section describes Linux; the FreeBSD differences follow in [SYSTEM DNS ON FREEBSD](#system-dns-on-freebsd).
@@ -221,33 +215,24 @@ All in all systemd-networkd and its derivatives (like netplan or NetworkManager)
 Windows version of the same functionality is implemented through Wintun library. \
 To make it start, wintun.dll specific for your Windows/arch must be present next to Xray.exe binary.
 
-After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running. A Wintun adapter that already has that name is reused.
+After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running.
 
-With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
+When `dns` is set, those servers are applied to the adapter. Windows is kept from registering the TUN's addresses in DNS, and its DNS cache is flushed when the TUN starts and stops.
 
-When `dns` is set, those servers are applied to the adapter. Windows is kept from registering the TUN's addresses in DNS, and its DNS cache is flushed when the TUN starts and stops. Xray's own lookups through the system's DNS servers, like those of the `localhost` DNS server with `autoOutboundsInterface`, skip them, unless another interface uses them as well, as they would lead back into the TUN.
+With `autoSystemWfpBlockLeak`, which needs `autoSystemRoutingTable` (the config is rejected otherwise), Xray also adds Windows Filtering Platform filters that keep two kinds of traffic of every program but Xray itself from leaving outside the TUN, each chosen by a value in the list, e.g. `"autoSystemWfpBlockLeak": ["dns", "misconfigtun"]`:
+- `"dns"` (needs `dns`, the config is rejected otherwise): DNS (port 53) only goes through the TUN. Windows keeps sending name queries to the DNS servers of the other interfaces as well, out through those interfaces whatever the routes say, and other programs reach a resolver on the local network (e.g. `192.168.1.1` handed out by DHCP) through its more specific LAN route instead of the TUN. On Windows 11 and Server 2022 and later, where those queries may also go over HTTPS or TLS, Windows' DNS Client service cannot connect outside the TUN at all, except for name resolution on the local network (LLMNR, mDNS). The `dns` servers therefore have to lie within `gateway` or `autoSystemRoutingTable` (a warning is logged otherwise), and DNS servers that should be reached directly belong in Xray's own `dns` settings.
+- `"misconfigtun"`: an IP version without routes in `autoSystemRoutingTable`, IPv4 or IPv6, is blocked entirely, in both directions, as it would bypass the TUN. Only loopback and what Windows itself needs on the local link (DHCP, and for IPv6 neighbor and multicast listener discovery) remain allowed. An address of that version in `gateway` is not needed: without one, Windows gives the TUN link-local addresses itself, an IPv6 one at once and an IPv4 one from `169.254.0.0/16` after some seconds (until then, IPv4 routed to the TUN is unreachable), and what is routed to the TUN goes through it with those.
 
-Setting `autoSystemWfpBlockLeak` to at least `["dns"]` is recommended, to block DNS leaks. It needs `autoSystemRoutingTable` (the config is rejected otherwise), and adds Windows Filtering Platform filters that let traffic of every program but Xray itself leave only through the TUN, each kind chosen by a value:
+With the filters in place, Xray's own connections out also get past Windows Firewall's block rules (other firewalls may still block them), while connections to Xray's inbounds stay subject to them.
-- `"dns"`: stands for `"53"`, `"853"` (DNS over TLS and QUIC) and `"windnsclient"`. Windows also queries the DNS servers of the other interfaces, through those interfaces whatever the routes say, and other programs reach a resolver on the local network (e.g. `192.168.1.1` from DHCP) through its more specific route.
-- `"windnsclient"`: Windows' DNS Client service, except for name resolution on the local network (LLMNR, mDNS). Since Windows 11 and Server 2022, it may query over HTTPS or TLS, to any port; earlier versions only query port 53, so there it does nothing.
-- `"tcp"`, `"udp"`: that protocol, to all ports, or with `/<port>` or `/<low>-<high>` (1 to 65535) to some, e.g. `"tcp/853"` or `"udp/10-20"`. The ports alone stand for both, e.g. `"53"` or `"10-20"`.
-- `"icmp"`: ICMP and ICMPv6, e.g. `ping`.
-- `"misconfigtun"`: an IP version without routes in `autoSystemRoutingTable`, which would bypass the TUN.
-- `"all"`: everything, in both directions. Access to the local network then breaks unless it is routed into the TUN as well, and so do incoming connections to other programs, other VPNs, and virtual machines whose NAT runs on the host.
-- `"allexceptlan"`: like `"all"`, but traffic to and from the local network stays allowed, e.g. for printers or casting to a TV: private, link-local, multicast and broadcast addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `224.0.0.0/4`, `255.255.255.255`, `fc00::/7`, `fe80::/10`, `ff00::/8`), not global IPv6 ones. It includes `"dns"`, and the other values apply there as well. `"all"` overrides it.
 
-A CIDR in front limits a value to its addresses, an IPv6 one in brackets, e.g. `"8.8.8.8/32:all"`, `"1.1.1.0/24:53"` or `"[::/0]:all"` (IPv6 only). It limits what the value stands for or includes as well: `"0.0.0.0/0:allexceptlan"`, for instance, leaves DNS over IPv6 open.
+Names that Xray resolves through the system resolver, such as an outbound's server address given as a domain with the default `AsIs` domain strategy, would be looked up by Windows on Xray's behalf, and those queries would then go into the TUN too. While DNS is restricted this way and `autoOutboundsInterface` is in use (the default with `autoSystemRoutingTable`), Xray therefore resolves them itself, with its own queries to the DNS servers of the other interfaces. That bypasses Windows' DNS cache, and its name resolution on the local network (LLMNR, mDNS): a server address given as a domain is looked up again for every connection, and a DNS server that does not answer delays each lookup. Having Xray's own `dns` resolve it, through the outbound's `sockopt.domainStrategy`, avoids that. The `localhost` DNS server queries the same servers whenever `autoOutboundsInterface` is in use. Both skip the TUN's own DNS servers, unless another interface uses them as well: queried from Xray itself, they would lead back into it, or nowhere.
 
-Loopback, DHCP, DHCPv6 and IPv6 neighbor discovery always stay allowed. Xray's own connections out also get past Windows Firewall's block rules, while connections to its inbounds stay subject to them. If the filters cannot be added, Xray does not start; they are removed when it exits. `"dns"` leaves name resolution on the local network (LLMNR, mDNS, NetBIOS) alone; `"all"` or `"udp"`, for instance, block it as well.
+If the filters cannot be added, Xray does not start. They are removed when Xray exits. Not covered is name resolution on the local network (LLMNR, mDNS, NetBIOS), except over an IP version that is blocked.
 
-Keeping the system's DNS inside the TUN, with `"all"`, `"allexceptlan"`, `"dns"`, `"windnsclient"`, or anything covering TCP or UDP port 53, even to some addresses only, needs `dns` (the config is rejected otherwise), whose servers have to lie within `gateway` or `autoSystemRoutingTable`, or be loopback addresses like `127.0.0.1` (a warning is logged otherwise); DNS servers to be reached directly belong in Xray's own `dns` settings. With `autoOutboundsInterface`, names that Xray would look up through the system, e.g. an outbound's server address with the default `AsIs` domain strategy, are then resolved by Xray itself, from the DNS servers of the other interfaces, as Windows would send those queries into the TUN. That bypasses Windows' DNS cache, so such a name is looked up for every connection; resolving it with Xray's own `dns`, through the outbound's `sockopt.domainStrategy`, avoids that.
+`autoSystemWfpBlockLeak` (Windows only) is empty by default, as the filters break some setups: with `"dns"`, a local DNS resolver other programs use (e.g. on `127.0.0.1:53`), the DNS of another VPN on its own interface, virtual machines whose NAT resolves names on the host, or signing in to a captive portal; with `"misconfigtun"`, IPv4 or IPv6 on the local network while no route of that version leads to the TUN. Without the filters, DNS may leak as described above. To keep an IP version out of the TUN on purpose while still blocking DNS leaks, use only `["dns"]`.
-
-`autoSystemWfpBlockLeak` is empty by default, as the filters break some setups: with `"dns"`, a local DNS resolver that queries through another interface, the DNS of another VPN, virtual machines whose NAT resolves names on the host, and captive portals; with `"misconfigtun"`, IPv4 or IPv6 on the local network while not routed into the TUN.
 
 `autoOutboundsInterface` (the default with `autoSystemRoutingTable`) keeps Xray's own connections out of the TUN by binding them to another interface, which Windows only honors while that interface has weak host send and forwarding off for the IP versions routed to the TUN. Otherwise, Windows sends them into the TUN, from that interface's address, and they stall. While the TUN runs, Xray therefore turns weak host send off on that interface, and on again when it stops or another interface takes over. Forwarding cannot be turned off this way, as Mobile Hotspot and Internet Connection Sharing need it, so a warning is logged while it is on. Having the hotspot share the TUN instead of that interface (Settings, Mobile hotspot, Share my internet connection from) moves forwarding to the TUN, where it does no harm, and sends the hotspot's devices through Xray as well.
 
-An outbound interface with only IPv4 or only IPv6 works as well: a UDP socket opened for both IP versions, which such an interface cannot be bound to, is opened again for the destination's version only, and IPv6 TCP is bound for IPv6 alone, so connections of the missing version fail rather than leave through another interface (XTLS/Xray-core#7214).
-
 You can give the adapter ip address manually, you can live Windows to give it autogenerated ip address (which take few seconds), it doesn't matter, the traffic going _through_ the interface will be forwarded into the app for proxying. \
 Minimal configuration that will work for local machine is routing passing the traffic on-link through the interface.
 You will need the interface id for that, unfortunately it is going to change with every Xray start due to implementation ambiguity between Xray and wintun driver.
@@ -322,7 +307,6 @@ sudo route add -inet6 -host 2606:4700:4700::1111 -iface utun10
 sudo route add -inet6 -host 2606:4700:4700::1001 -iface utun10
 ```
 Alternatively, configure `autoSystemRoutingTable` and Xray will add and remove those system routes while it is running.
-Xray's own connections are then kept out of the TUN through `autoOutboundsInterface`: an IPv4 socket is bound with `IP_BOUND_IF`, an IPv6 or dual-stack one with `IPV6_BOUND_IF`, which covers the IPv4 traffic of a dual-stack socket as well, since macOS rejects `IP_BOUND_IF` on IPv6 sockets (XTLS/Xray-core#7230).
 Important to remember that everything written above about Linux routing concept, also apply to Mac OS X. If you simply route default route through utun interface, that will result network loop and immediate network failure.
 
 ## ANDROID SUPPORT
@@ -354,7 +338,7 @@ let tunFd = ((0 ... 1024).first { (_ fd: Int32) -> Bool in var len = socklen_t(b
 }!
 ```
 
-Set the environment variable `xray.tun.fd` (or `XRAY_TUN_FD`) to the fd number before starting Xray. This can be done from Swift/Objective-C or by exposing a Go function via gomobile bindings. Xray works on a duplicate of the fd and closes only that, so the fd itself stays NetworkExtension's (XTLS/Xray-core#6883).
+Set the environment variable `xray.tun.fd` (or `XRAY_TUN_FD`) to the fd number before starting Xray. This can be done from Swift/Objective-C or by exposing a Go function via gomobile bindings.
 
 Build using gomobile for iOS framework integration:
 ```

proxy/tun/config.pb.go

@@ -1,17 +1,18 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/tun/config.proto
 
 package tun
 
 import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 )
 
 const (

proxy/tun/tun_windows.go

@@ -247,47 +247,44 @@ startOver:
 	}
 
 	// With autoSystemWfpBlockLeak, once the system routes lead to the TUN,
-	// keep the protocols and ports given ("dns" stands for those of DNS),
+	// keep DNS ("dns", if dns is set), and an IP version no route of which
-	// Windows' DNS Client service, an IP version no route of which leads to
+	// leads to the TUN ("misconfigtun"), from leaving through the other
-	// the TUN ("misconfigtun"), or everything ("all", or "allexceptlan" but
+	// interfaces. Addresses do not matter: without one of a version in
-	// for the local network), to the addresses of a CIDR or to all, from
+	// gateway, Windows gives the TUN a link-local one.
-	// leaving through the other interfaces. The TUN's own addresses do not
+	leaks := t.options.AutoSystemWfpBlockLeak
-	// matter: without one of a version in gateway, Windows gives it a
+	blockDNS := slices.Contains(leaks, "dns") && len(dns) > 0
-	// link-local one.
+	blockIPv4 := slices.Contains(leaks, "misconfigtun") && !route4
-	leaks, err := ExpandWfpBlockLeak(t.options.AutoSystemWfpBlockLeak)
+	blockIPv6 := slices.Contains(leaks, "misconfigtun") && !route6
-	if err != nil {
+	if (route4 || route6) && (blockDNS || blockIPv4 || blockIPv6) {
-		return err
+		if t.wfp, err = blockLeaks(t.luid, blockDNS, blockIPv4, blockIPv6); err != nil {
-	}
+			var blocked []string
-	block := newLeakFilters(leaks, route4, route6)
+			for _, b := range []struct {
-	if route4 || route6 {
+				on   bool
-		dnsClient := func(l leak) bool { return l.name == "windnsclient" }
+				what string
-		if slices.ContainsFunc(block, dnsClient) && !dnsClientUsesAnyPort() {
+			}{{blockDNS, "DNS"}, {blockIPv4, "IPv4"}, {blockIPv6, "IPv6"}} {
-			block = slices.DeleteFunc(block, dnsClient)
+				if b.on {
-			errors.LogInfo(context.Background(), "[tun] windnsclient skipped: before Windows 11 and Server 2022, the DNS Client service only queries port 53")
+					blocked = append(blocked, b.what)
-		}
-		if block.systemDNS() && len(dns) == 0 {
-			return errors.New("keeping the system's DNS inside the TUN needs dns to be set")
 				}
 			}
-	if blocked := block.String(); (route4 || route6) && blocked != "" {
-		if t.wfp, err = blockLeaks(t.luid, block); err != nil {
 			// Rather no TUN than a leaking one.
-			return errors.New("unable to block ", blocked, " outside the TUN (remove autoSystemWfpBlockLeak to run without)").Base(err)
+			return errors.New("unable to block ", strings.Join(blocked, " and "), " outside the TUN (remove autoSystemWfpBlockLeak to run without)").Base(err)
 		}
-		errors.LogInfo(context.Background(), "[tun] blocked outside the TUN: ", blocked)
+		errors.LogInfo(context.Background(), "[tun] outside the TUN, blocked DNS: ", blockDNS, ", blocked IPv4: ", blockIPv4, ", blocked IPv6: ", blockIPv6)
+		if blockDNS {
 			covered := slices.Clone(addresses)
 			for _, route := range routesData {
 				covered = append(covered, route.Destination)
 			}
-		for _, server := range dnsOutsideTUN(dns, covered, block) {
+			for _, server := range dnsOutsideTUN(dns, covered) {
 				errors.LogWarning(context.Background(), "[tun] DNS server ", server, " is in neither gateway nor autoSystemRoutingTable, so queries to it cannot go through the TUN and are blocked")
 			}
-		// With updater, the dialer controllers bind Xray's own sockets to the
+			// With updater, the dialer controllers bind Xray's own sockets
-		// physical interface.
+			// to the physical interface.
-		if block.systemDNS() && updater != nil {
+			if updater != nil {
 				t.resolver = resolveOnOwn()
 			}
 		}
+	}
 	if len(dns) > 0 || route4 || route6 {
 		if err := flushDNSCache(); err != nil {
 			errors.LogInfoInner(context.Background(), err, "[tun] unable to flush DNS cache")
@@ -404,15 +401,6 @@ func resolveOnOwn() *savedResolver {
 		if internet.IsSkippedDNSServer(address) {
 			return nil, errors.New("skipped DNS server ", address)
 		}
-		// A socket of the server's IP version only needs that version bound
-		// to the interface, which a dual-stack one would need both of.
-		if ap, err := netip.ParseAddrPort(address); err == nil && (network == "udp" || network == "tcp") {
-			if ap.Addr().Unmap().Is4() {
-				network += "4"
-			} else {
-				network += "6"
-			}
-		}
 		return dialer.DialContext(ctx, network, address)
 	}
 	net.DefaultResolver.PreferGo = true
@@ -570,22 +558,10 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 
 	switch network {
 	case "tcp6", "udp6", "ip6":
-		dualStack := false
-		if network == "udp6" {
-			ipv6Only, err := windows.GetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, windows.IPV6_V6ONLY)
-			if err != nil {
-				return internet.NewBindError(err)
-			}
-			dualStack = ipv6Only == 0
-		}
 		err1 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, IPV6_UNICAST_IF, iface.Index)
 		if network == "udp6" {
 			err2 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, windows.IPV6_MULTICAST_IF, iface.Index)
 		}
-		// Only dual-stack UDP can send to both IPv4 and IPv6 destinations.
-		if !dualStack {
-			break
-		}
 		fallthrough
 	case "tcp4", "udp4", "ip4":
 		err3 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, IP_UNICAST_IF, *(*int)(unsafe.Pointer(&index[0])))
@@ -596,10 +572,7 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 		panic(network + " " + address)
 	}
 
-	if err := errors.Combine(err1, err2, err3, err4); err != nil {
+	return errors.Combine(err1, err2, err3, err4)
-		return internet.NewBindError(err)
-	}
-	return nil
 }
 
 func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {

proxy/tun/tun_windows_wfp.go

@@ -3,12 +3,10 @@
 package tun
 
 import (
-	"encoding/binary"
 	"net/netip"
 	"os"
 	"runtime"
 	"slices"
-	"strings"
 	"unsafe"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -45,12 +43,8 @@ const (
 	fwpByteArray16Type        = 11 // FWP_BYTE_ARRAY16_TYPE
 	fwpByteBlobType           = 12 // FWP_BYTE_BLOB_TYPE
 	fwpSecurityDescriptorType = 14 // FWP_SECURITY_DESCRIPTOR_TYPE
-	fwpV4AddrMask             = 0x100 // FWP_V4_ADDR_MASK
-	fwpV6AddrMask             = 0x101 // FWP_V6_ADDR_MASK
-	fwpRangeType              = 0x102 // FWP_RANGE_TYPE
 
 	fwpMatchEqual       = 0 // FWP_MATCH_EQUAL
-	fwpMatchRange       = 5 // FWP_MATCH_RANGE
 	fwpMatchFlagsAllSet = 6 // FWP_MATCH_FLAGS_ALL_SET
 
 	fwpConditionFlagIsLoopback = 1 // FWP_CONDITION_FLAG_IS_LOOPBACK
@@ -99,37 +93,6 @@ type fwpValue0 struct {
 	value uintptr
 }
 
-// fwpRange0 is FWP_RANGE0, which an FWP_RANGE_TYPE condition points to.
-type fwpRange0 struct {
-	low, high fwpValue0
-}
-
-// fwpV4AddrAndMask is FWP_V4_ADDR_AND_MASK, in host byte order.
-type fwpV4AddrAndMask struct {
-	addr, mask uint32
-}
-
-// fwpV6AddrAndMask is FWP_V6_ADDR_AND_MASK.
-type fwpV6AddrAndMask struct {
-	addr         [16]byte
-	prefixLength uint8
-}
-
-// lanPrefixes are what "allexceptlan" leaves to the local network: private
-// and link-local addresses, and multicast and broadcast, which discovery on
-// it uses.
-var lanPrefixes = []netip.Prefix{
-	netip.MustParsePrefix("10.0.0.0/8"),
-	netip.MustParsePrefix("172.16.0.0/12"),
-	netip.MustParsePrefix("192.168.0.0/16"),
-	netip.MustParsePrefix("169.254.0.0/16"),
-	netip.MustParsePrefix("224.0.0.0/4"),
-	netip.MustParsePrefix("255.255.255.255/32"),
-	netip.MustParsePrefix("fc00::/7"),
-	netip.MustParsePrefix("fe80::/10"),
-	netip.MustParsePrefix("ff00::/8"),
-}
-
 type fwpmDisplayData0 struct {
 	name        *uint16
 	description *uint16
@@ -207,165 +170,33 @@ func condition(field *windows.GUID, typ uint32, value uintptr) fwpmFilterConditi
 	}
 }
 
-// leakFilters are the values of autoSystemWfpBlockLeak that blockLeaks keeps
-// from leaving outside the TUN.
-type leakFilters []leak
-
-// newLeakFilters turns expanded autoSystemWfpBlockLeak values into the filters
-// for a TUN that the routes of route4 (IPv4) and route6 (IPv6) lead to, which
-// leave "misconfigtun" over the IP versions without such routes only.
-func newLeakFilters(leaks []string, route4, route6 bool) leakFilters {
-	var block leakFilters
-	for _, value := range leaks {
-		l, ok := parseLeak(value)
-		if !ok {
-			continue
-		}
-		if l.name == "misconfigtun" {
-			unrouted4, unrouted6 := !route4, !route6
-			if l.prefix.IsValid() {
-				unrouted4, unrouted6 = unrouted4 && l.prefix.Addr().Is4(), unrouted6 && l.prefix.Addr().Is6()
-			}
-			switch {
-			case !unrouted4 && !unrouted6:
-				continue
-			case !l.prefix.IsValid() && !unrouted4:
-				l.prefix = allAddresses(true)
-			case !l.prefix.IsValid() && !unrouted6:
-				l.prefix = allAddresses(false)
-			}
-		}
-		if !slices.Contains(block, l) {
-			block = append(block, l)
-		}
-	}
-	return block
-}
-
-// String lists what block keeps inside the TUN, or is empty for nothing.
-func (block leakFilters) String() string {
-	values := make([]string, len(block))
-	for i, l := range block {
-		values[i] = l.String()
-	}
-	return strings.Join(values, ", ")
-}
-
-// systemDNS tells whether block keeps the system's DNS inside the TUN, to at
-// least some addresses: port 53, the DNS Client service, or everything ("all"),
-// though not everything but the local network ("allexceptlan"), where a
-// resolver like the router's may be.
-func (block leakFilters) systemDNS() bool {
-	return slices.ContainsFunc(block, leak.blocksDNS)
-}
-
-// prefixes returns the CIDRs of the values of block named name over an IP
-// version.
-func (block leakFilters) prefixes(name string, ipv6 bool) []netip.Prefix {
-	var prefixes []netip.Prefix
-	for _, l := range block {
-		if prefix, ok := l.over(ipv6); ok && l.name == name {
-			prefixes = append(prefixes, prefix)
-		}
-	}
-	return prefixes
-}
-
-// over returns the CIDR of l over an IP version, all its addresses for l
-// without one, or false for l over the other IP version only.
-func (l leak) over(ipv6 bool) (netip.Prefix, bool) {
-	if !l.prefix.IsValid() {
-		return allAddresses(ipv6), true
-	}
-	return l.prefix, l.prefix.Addr().Is6() == ipv6
-}
-
-// allAddresses is the CIDR of all addresses of an IP version.
-func allAddresses(ipv6 bool) netip.Prefix {
-	if ipv6 {
-		return netip.PrefixFrom(netip.IPv6Unspecified(), 0)
-	}
-	return netip.PrefixFrom(netip.IPv4Unspecified(), 0)
-}
-
-// lanWithin returns the parts of lanPrefixes that lie in any of prefixes: two
-// prefixes either share no address, or one holds the other.
-func lanWithin(prefixes ...netip.Prefix) []netip.Prefix {
-	var parts []netip.Prefix
-	for _, lan := range lanPrefixes {
-		for _, prefix := range prefixes {
-			if !prefix.Overlaps(lan) {
-				continue
-			}
-			part := lan
-			if prefix.Bits() > lan.Bits() {
-				part = prefix
-			}
-			if !slices.Contains(parts, part) {
-				parts = append(parts, part)
-			}
-		}
-	}
-	return parts
-}
-
-// dnsClientUsesAnyPort tells whether Windows' DNS Client service may send its
-// queries over HTTPS or TLS, and so to any port, which it does since Windows 11
-// and Server 2022 (build 20348). Earlier versions only query port 53, and may
-// run the service in one process with others, which its filters would catch
-// as well.
-func dnsClientUsesAnyPort() bool {
-	_, _, build := windows.RtlGetNtVersionNumbers()
-	return build >= 20348
-}
-
-// The weights of the filters of blockLeaks, the heaviest matching one of which
-// decides.
-const (
-	weightAllExceptLAN uint8 = iota // block "allexceptlan"
-	weightLAN                       // permit its local network
-	weightDNSClient                 // block "windnsclient"
-	weightLocalLink                 // permit its mDNS and LLMNR on the local network
-	weightBlock                     // block the other values
-	weightPermit                    // permit what always stays allowed, and the TUN
-	weightXray                      // permit Xray
-)
-
 // blockLeaks keeps traffic from leaving through interfaces other than tun,
 // for every program but Xray itself, whose outbounds (DNS included) use the
-// other interfaces on purpose, as the values of block say, each to the
+// other interfaces on purpose:
-// addresses of its CIDR, or to all:
 //
-//   - Protocols and ports: connections of these, TCP or UDP to some or all
+//   - dns: DNS (port 53) may only go through the TUN. Windows sends a name
-//     ports, or ICMP, may only go through the TUN, those of DNS (53), DNS
+//     query to the DNS servers of all interfaces, not only to those of the TUN:
-//     over TLS (TCP 853) and DNS over QUIC (UDP 853) with "dns". Windows
+//     to the first server of each interface, then to all of them when no answer
-//     sends a name query to the DNS servers of all interfaces, not only to
+//     arrives within a second or two. It sends the queries for the servers of
-//     those of the TUN: to the first server of each interface, then to all
+//     an interface out through that interface, whatever the routes say, and
-//     of them when no answer arrives within a second or two. It sends the
+//     other programs reach an on-link resolver, like 192.168.1.1 from DHCP,
-//     queries for the servers of an interface out through that interface,
+//     through its LAN route, which is more specific than the TUN's default
-//     whatever the routes say, and other programs reach an on-link resolver,
+//     route. Since Windows 11 and Server 2022, Windows may also send its
-//     like 192.168.1.1 from DHCP, through its LAN route, which is more
+//     queries over HTTPS or TLS, so there its DNS Client service may not
-//     specific than the TUN's default route.
+//     connect outside the TUN at all, except for name resolution on the local
-//   - "windnsclient": since Windows 11 and Server 2022, Windows may also send
+//     link (mDNS, LLMNR).
-//     its queries over HTTPS or TLS, to any port, so its DNS Client service
+//   - ipv4, ipv6: no IPv4, or no IPv6, at all, in either direction, for a TUN
-//     may not connect outside the TUN at all, except for name resolution on
+//     that no route of it leads to, except loopback and what Windows itself
-//     the local network (mDNS, LLMNR).
+//     needs on the local link (DHCP, and for IPv6 neighbor and multicast
-//   - "all", and "misconfigtun" over an IP version no route of which leads to
+//     listener discovery), none of which can leave it. The TUN carries what
-//     the TUN: nothing at all outside the TUN, in either direction. The TUN
+//     is routed to it even without an address of that IP version in gateway:
-//     carries what is routed to it even without an address of that IP
+//     Windows gives it link-local ones itself, an IPv6 one at once, an IPv4
-//     version in gateway: Windows gives it link-local ones itself, an IPv6
+//     one from 169.254.0.0/16 after some seconds (until then, IPv4 routed to
-//     one at once, an IPv4 one from 169.254.0.0/16 after some seconds (until
+//     the TUN is unreachable).
-//     then, IPv4 routed to the TUN is unreachable).
-//   - "allexceptlan": the same, but to and from the local network.
-//
-// The other values still apply to what "allexceptlan" and "windnsclient" leave
-// open on the local network. Whatever is blocked, loopback, which cannot leave
-// the system, and what Windows itself needs on the local link stay allowed:
-// DHCP, and for IPv6 neighbor and multicast listener discovery.
 //
 // The filters live in a dynamic WFP session: closing the returned engine handle
 // with closeWFPEngine deletes them, and so does Windows when the process dies.
-func blockLeaks(tun winipcfg.LUID, block leakFilters) (windows.Handle, error) {
+func blockLeaks(tun winipcfg.LUID, dns, ipv4, ipv6 bool) (windows.Handle, error) {
 	engine, err := openWFPEngine()
 	if err != nil {
 		return 0, err
@@ -374,7 +205,7 @@ func blockLeaks(tun winipcfg.LUID, block leakFilters) (windows.Handle, error) {
 		closeWFPEngine(engine)
 		return 0, errors.New("FwpmTransactionBegin0 failed").Base(err)
 	}
-	err = addLeakFilters(engine, tun, block)
+	err = addLeakFilters(engine, tun, dns, ipv4, ipv6)
 	if err == nil {
 		if err = fwpmResult(procFwpmTransactionCommit0.Call(uintptr(engine))); err != nil {
 			err = errors.New("FwpmTransactionCommit0 failed").Base(err)
@@ -411,7 +242,7 @@ func closeWFPEngine(engine windows.Handle) {
 
 // addLeakFilters adds the filters of blockLeaks in a sublayer of their own.
 // blockLeaks runs it in a transaction, so that they take effect all at once.
-func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters) error {
+func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, dns, ipv4, ipv6 bool) error {
 	exe, err := os.Executable()
 	if err != nil {
 		return err
@@ -454,170 +285,51 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 	// hard permit. Connections from outside to Xray get an ordinary one, so
 	// that firewalls keep guarding its inbounds.
 	self := condition(&fwpmConditionALEAppID, fwpByteBlobType, uintptr(unsafe.Pointer(appID)))
-	// A connection goes through the TUN when its local address is the TUN's,
+	dns53 := condition(&fwpmConditionIPRemotePort, fwpUint16, 53)
-	// and it also leaves, or arrives, through the TUN. The local address alone
+	// DNS goes through the TUN when its local address is the TUN's, and it
+	// also leaves, or arrives, through the TUN. The local address alone
 	// decides by default, but with weak host sending or receiving enabled,
 	// packets of the TUN's address can use other interfaces. (The next hop,
 	// the interface replies would leave by, is not known for arriving ones.)
 	onTUN := func(field *windows.GUID) fwpmFilterCondition0 {
 		return condition(field, fwpUint64, uintptr(unsafe.Pointer(tunLUID)))
 	}
-	// remote matches the remote addresses in any of prefixes, all of one IP
+	out := []fwpmFilterCondition0{dns53, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPNexthopInterface)}
-	// version: conditions on the same field match when any of them does. With
+	in := []fwpmFilterCondition0{dns53, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPArrivalInterface)}
-	// all addresses among them, no condition is needed.
-	remote := func(prefixes ...netip.Prefix) []fwpmFilterCondition0 {
-		if slices.ContainsFunc(prefixes, func(prefix netip.Prefix) bool { return prefix.Bits() == 0 }) {
-			return nil
-		}
-		var conditions []fwpmFilterCondition0
-		for _, prefix := range prefixes {
-			var value uintptr
-			typ := uint32(fwpV4AddrMask)
-			if prefix.Addr().Is6() {
-				addr := &fwpV6AddrAndMask{addr: prefix.Addr().As16(), prefixLength: uint8(prefix.Bits())}
-				pinner.Pin(addr) // the condition only holds it as uintptr
-				value, typ = uintptr(unsafe.Pointer(addr)), fwpV6AddrMask
-			} else {
-				a := prefix.Addr().As4()
-				addr := &fwpV4AddrAndMask{addr: binary.BigEndian.Uint32(a[:]), mask: ^uint32(0) << (32 - prefix.Bits())}
-				pinner.Pin(addr) // the condition only holds it as uintptr
-				value = uintptr(unsafe.Pointer(addr))
-			}
-			conditions = append(conditions, condition(&fwpmConditionIPRemoteAddress, typ, value))
-		}
-		return conditions
-	}
-	// toPorts matches the ports of traffic, if not all of them.
-	toPorts := func(traffic leak) []fwpmFilterCondition0 {
-		switch {
-		case traffic.low == 0:
-			return nil
-		case traffic.low == traffic.high:
-			return []fwpmFilterCondition0{condition(&fwpmConditionIPRemotePort, fwpUint16, uintptr(traffic.low))}
-		}
-		ports := &fwpRange0{
-			low:  fwpValue0{typ: fwpUint16, value: uintptr(traffic.low)},
-			high: fwpValue0{typ: fwpUint16, value: uintptr(traffic.high)},
-		}
-		pinner.Pin(ports) // the condition only holds it as uintptr
-		return []fwpmFilterCondition0{{
-			fieldKey:       fwpmConditionIPRemotePort,
-			matchType:      fwpMatchRange,
-			conditionValue: fwpValue0{typ: fwpRangeType, value: uintptr(unsafe.Pointer(ports))},
-		}}
-	}
-
-	// What stays allowed whatever is blocked, in both directions: replies to
-	// a connection accepted from outside would leave through the physical
-	// link as well.
-	type permit struct {
-		name       string
-		conditions []fwpmFilterCondition0
-	}
-	loopback := permit{"loopback", []fwpmFilterCondition0{{
-		fieldKey:       fwpmConditionFlags,
-		matchType:      fwpMatchFlagsAllSet,
-		conditionValue: fwpValue0{typ: fwpUint32, value: fwpConditionFlagIsLoopback},
-	}}}
-	// DHCP keeps the addresses of the other interfaces, which Xray's own
-	// connections use.
-	dhcp := permit{"DHCP", []fwpmFilterCondition0{
-		condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_UDP),
-		condition(&fwpmConditionIPLocalPort, fwpUint16, 68),
-		condition(&fwpmConditionIPRemotePort, fwpUint16, 67),
-	}}
-	// Neighbor and multicast listener discovery, ICMPv6 130-137 and 143,
-	// whose type and code sit where the local and remote port are.
-	discovery := permit{"IPv6 neighbor and multicast listener discovery", []fwpmFilterCondition0{condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_ICMPV6)}}
-	for _, typ := range []uintptr{130, 131, 132, 133, 134, 135, 136, 137, 143} {
-		discovery.conditions = append(discovery.conditions, condition(&fwpmConditionIPLocalPort, fwpUint16, typ))
-	}
-	discovery.conditions = append(discovery.conditions, condition(&fwpmConditionIPRemotePort, fwpUint16, 0))
-	dhcpv6 := []fwpmFilterCondition0{
-		condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_UDP),
-		condition(&fwpmConditionIPLocalPort, fwpUint16, 546),
-		condition(&fwpmConditionIPRemotePort, fwpUint16, 547),
-	}
-	// The DHCPv6 client sends to the servers' multicast address, and they
-	// answer from their own.
-	dhcpv6Out := permit{"DHCPv6", slices.Concat(dhcpv6, []fwpmFilterCondition0{condition(&fwpmConditionIPRemoteAddress, fwpByteArray16Type, uintptr(unsafe.Pointer(&ipv6AllDHCPv6Servers)))})}
-	dhcpv6In := permit{"DHCPv6", dhcpv6}
-
 	for _, layer := range []struct {
 		key        *windows.GUID
 		selfFlags  uint32
-		via       *windows.GUID // the interface that has to be the TUN as well
+		throughTUN []fwpmFilterCondition0
-		ipv6      bool
-		permits   []permit
 	}{
-		{&fwpmLayerALEAuthConnectV4, fwpmFilterFlagClearActionRight, &fwpmConditionIPNexthopInterface, false, []permit{loopback, dhcp}},
+		{&fwpmLayerALEAuthConnectV4, fwpmFilterFlagClearActionRight, out},
-		{&fwpmLayerALEAuthRecvAcceptV4, 0, &fwpmConditionIPArrivalInterface, false, []permit{loopback, dhcp}},
+		{&fwpmLayerALEAuthRecvAcceptV4, 0, in},
-		{&fwpmLayerALEAuthConnectV6, fwpmFilterFlagClearActionRight, &fwpmConditionIPNexthopInterface, true, []permit{loopback, discovery, dhcpv6Out}},
+		{&fwpmLayerALEAuthConnectV6, fwpmFilterFlagClearActionRight, out},
-		{&fwpmLayerALEAuthRecvAcceptV6, 0, &fwpmConditionIPArrivalInterface, true, []permit{loopback, discovery, dhcpv6In}},
+		{&fwpmLayerALEAuthRecvAcceptV6, 0, in},
 	} {
-		throughTUN := permit{"through the TUN", []fwpmFilterCondition0{onTUN(&fwpmConditionIPLocalInterface), onTUN(layer.via)}}
+		if err := add(layer.key, "permit Xray", layer.selfFlags, fwpActionPermit, 4, self); err != nil {
-		if err := add(layer.key, "permit Xray", layer.selfFlags, fwpActionPermit, weightXray, self); err != nil {
 			return err
 		}
-		for _, p := range append(layer.permits, throughTUN) {
+		if dns {
-			if err := add(layer.key, "permit "+p.name, 0, fwpActionPermit, weightPermit, p.conditions...); err != nil {
+			if err := add(layer.key, "permit DNS through the TUN", 0, fwpActionPermit, 3, layer.throughTUN...); err != nil {
 				return err
 			}
-		}
+			if err := add(layer.key, "block DNS", 0, fwpActionBlock, 2, dns53); err != nil {
-		for _, l := range block {
-			prefix, ok := l.over(layer.ipv6)
-			if !ok {
-				continue // for the other IP version only
-			}
-			var protocols []uintptr
-			switch l.name {
-			case "tcp":
-				protocols = []uintptr{windows.IPPROTO_TCP}
-			case "udp":
-				protocols = []uintptr{windows.IPPROTO_UDP}
-			case "":
-				protocols = []uintptr{windows.IPPROTO_TCP, windows.IPPROTO_UDP}
-			case "icmp":
-				protocols = []uintptr{windows.IPPROTO_ICMP}
-				if layer.ipv6 {
-					protocols = []uintptr{windows.IPPROTO_ICMPV6}
-				}
-			case "all", "misconfigtun":
-				// every protocol
-			default:
-				continue // "allexceptlan" and "windnsclient" have filters of their own
-			}
-			var matches []fwpmFilterCondition0
-			for _, protocol := range protocols {
-				matches = append(matches, condition(&fwpmConditionIPProtocol, fwpUint8, protocol))
-			}
-			matches = slices.Concat(matches, toPorts(l), remote(prefix))
-			if err := add(layer.key, "block "+l.String(), 0, fwpActionBlock, weightBlock, matches...); err != nil {
-				return err
-			}
-		}
-		if allExceptLAN := block.prefixes("allexceptlan", layer.ipv6); len(allExceptLAN) > 0 {
-			// Lighter than the other values, which so still apply on the
-			// local network, DNS with "allexceptlan" among them.
-			if lan := lanWithin(allExceptLAN...); len(lan) > 0 {
-				if err := add(layer.key, "permit the local network", 0, fwpActionPermit, weightLAN, remote(lan...)...); err != nil {
-					return err
-				}
-			}
-			if err := add(layer.key, "block allexceptlan", 0, fwpActionBlock, weightAllExceptLAN, remote(allExceptLAN...)...); err != nil {
 				return err
 			}
 		}
 	}
 
-	// Since Windows 11 and Server 2022, the DNS Client service may also send
+	// Since Windows 11 and Server 2022 (build 20348), the DNS Client service
-	// the queries for an interface's servers over HTTPS or TLS, out through
+	// may also send the queries for an interface's servers over HTTPS or TLS,
-	// that interface and to any port. So there it may only connect through
+	// out through that interface and to any port. So there it may only
-	// the TUN, except for mDNS and LLMNR on the local network. Like Windows
+	// connect through the TUN, except for mDNS and LLMNR, which stay on the
-	// Firewall's rules for it, the filters recognize the service by its SID,
+	// local link (over an IP version only while it is not blocked altogether).
+	// Earlier versions only query port 53, and may run the service in one
+	// process with others, which the filters would catch as well. Like
+	// Windows Firewall's rules for it, they recognize the service by its SID,
 	// which Windows puts in the token of its process: the security descriptor
 	// grants that SID the right to match (FWP_ACTRL_MATCH_FILTER, CC in SDDL).
-	if slices.ContainsFunc(block, func(l leak) bool { return l.name == "windnsclient" }) {
+	if _, _, build := windows.RtlGetNtVersionNumbers(); dns && build >= 20348 {
 		sd, err := windows.SecurityDescriptorFromString("O:SYG:SYD:(A;;CCRC;;;" + dnsClientSID + ")")
 		if err != nil {
 			return err
@@ -629,19 +341,84 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 		mdnsLLMNR := []fwpmFilterCondition0{dnsClient, condition(&fwpmConditionIPRemotePort, fwpUint16, 5353), condition(&fwpmConditionIPRemotePort, fwpUint16, 5355)}
 		for _, layer := range []struct {
 			key       *windows.GUID
-			ipv6 bool
+			localLink bool
 		}{
-			{&fwpmLayerALEAuthConnectV4, false},
+			{&fwpmLayerALEAuthConnectV4, !ipv4},
-			{&fwpmLayerALEAuthConnectV6, true},
+			{&fwpmLayerALEAuthConnectV6, !ipv6},
 		} {
-			prefixes := block.prefixes("windnsclient", layer.ipv6)
+			if err := add(layer.key, "permit the DNS Client service through the TUN", 0, fwpActionPermit, 3, dnsClient, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPNexthopInterface)); err != nil {
-			if len(prefixes) == 0 {
-				continue
-			}
-			if err := add(layer.key, "permit the DNS Client service's mDNS and LLMNR", 0, fwpActionPermit, weightLocalLink, slices.Concat(mdnsLLMNR, remote(lanWithin(allAddresses(layer.ipv6))...))...); err != nil {
 				return err
 			}
-			if err := add(layer.key, "block the DNS Client service", 0, fwpActionBlock, weightDNSClient, slices.Concat([]fwpmFilterCondition0{dnsClient}, remote(prefixes...))...); err != nil {
+			if layer.localLink {
+				if err := add(layer.key, "permit the DNS Client service's mDNS and LLMNR", 0, fwpActionPermit, 3, mdnsLLMNR...); err != nil {
+					return err
+				}
+			}
+			if err := add(layer.key, "block the DNS Client service", 0, fwpActionBlock, 2, dnsClient); err != nil {
+				return err
+			}
+		}
+	}
+
+	// Both directions: replies to a connection accepted from outside would
+	// leave through the physical link as well.
+	loopback := fwpmFilterCondition0{
+		fieldKey:       fwpmConditionFlags,
+		matchType:      fwpMatchFlagsAllSet,
+		conditionValue: fwpValue0{typ: fwpUint32, value: fwpConditionFlagIsLoopback},
+	}
+	if ipv4 {
+		// DHCP keeps the addresses of the other interfaces, which Xray's own
+		// connections use.
+		dhcp := []fwpmFilterCondition0{
+			condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_UDP),
+			condition(&fwpmConditionIPLocalPort, fwpUint16, 68),
+			condition(&fwpmConditionIPRemotePort, fwpUint16, 67),
+		}
+		for _, layer := range []*windows.GUID{&fwpmLayerALEAuthConnectV4, &fwpmLayerALEAuthRecvAcceptV4} {
+			if err := add(layer, "permit IPv4 loopback", 0, fwpActionPermit, 1, loopback); err != nil {
+				return err
+			}
+			if err := add(layer, "permit DHCP", 0, fwpActionPermit, 1, dhcp...); err != nil {
+				return err
+			}
+			if err := add(layer, "block IPv4", 0, fwpActionBlock, 0); err != nil {
+				return err
+			}
+		}
+	}
+	if ipv6 {
+		// Neighbor and multicast listener discovery, ICMPv6 130-137 and 143,
+		// whose type and code sit where the local and remote port are.
+		discovery := []fwpmFilterCondition0{condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_ICMPV6)}
+		for _, typ := range []uintptr{130, 131, 132, 133, 134, 135, 136, 137, 143} {
+			discovery = append(discovery, condition(&fwpmConditionIPLocalPort, fwpUint16, typ))
+		}
+		discovery = append(discovery, condition(&fwpmConditionIPRemotePort, fwpUint16, 0))
+		dhcpv6 := []fwpmFilterCondition0{
+			condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_UDP),
+			condition(&fwpmConditionIPLocalPort, fwpUint16, 546),
+			condition(&fwpmConditionIPRemotePort, fwpUint16, 547),
+		}
+		for _, direction := range []struct {
+			layer  *windows.GUID
+			dhcpv6 []fwpmFilterCondition0
+		}{
+			// The client sends to the servers' multicast address, and they
+			// answer from their own.
+			{&fwpmLayerALEAuthConnectV6, slices.Concat(dhcpv6, []fwpmFilterCondition0{condition(&fwpmConditionIPRemoteAddress, fwpByteArray16Type, uintptr(unsafe.Pointer(&ipv6AllDHCPv6Servers)))})},
+			{&fwpmLayerALEAuthRecvAcceptV6, dhcpv6},
+		} {
+			if err := add(direction.layer, "permit IPv6 loopback", 0, fwpActionPermit, 1, loopback); err != nil {
+				return err
+			}
+			if err := add(direction.layer, "permit IPv6 neighbor and multicast listener discovery", 0, fwpActionPermit, 1, discovery...); err != nil {
+				return err
+			}
+			if err := add(direction.layer, "permit DHCPv6", 0, fwpActionPermit, 1, direction.dhcpv6...); err != nil {
+				return err
+			}
+			if err := add(direction.layer, "block IPv6", 0, fwpActionBlock, 0); err != nil {
 				return err
 			}
 		}
@@ -668,22 +445,13 @@ func addFilter(engine windows.Handle, sublayer, layer *windows.GUID, name string
 	return nil
 }
 
-// dnsOutsideTUN returns the servers whose queries block blocks: those outside
+// dnsOutsideTUN returns the servers outside all of prefixes, the TUN's own
-// all of prefixes, the TUN's own subnets and routes, as queries to them cannot
+// subnets and routes: queries to them cannot go through the TUN.
-// go through the TUN, and inside the CIDR of a value that keeps DNS inside the
+func dnsOutsideTUN(servers []netip.Addr, prefixes []netip.Prefix) []netip.Addr {
-// TUN, or of "misconfigtun". Loopback ones, local resolvers, are not among
-// them, as loopback stays allowed.
-func dnsOutsideTUN(servers []netip.Addr, prefixes []netip.Prefix, block leakFilters) []netip.Addr {
 	var outside []netip.Addr
 	for _, server := range servers {
 		server = server.Unmap()
-		if server.IsLoopback() || slices.ContainsFunc(prefixes, func(p netip.Prefix) bool { return p.Contains(server) }) {
+		if !slices.ContainsFunc(prefixes, func(p netip.Prefix) bool { return p.Contains(server) }) {
-			continue
-		}
-		if slices.ContainsFunc(block, func(l leak) bool {
-			prefix, ok := l.over(server.Is6())
-			return ok && prefix.Contains(server) && (l.blocksDNS() || l.name == "misconfigtun")
-		}) {
 			outside = append(outside, server)
 		}
 	}

proxy/tun/tun_windows_wfp_test.go

@@ -40,21 +40,6 @@ func TestWFPStructLayout(t *testing.T) {
 		[]uintptr{unsafe.Sizeof(value), unsafe.Offsetof(value.value)},
 		[]uintptr{16, 8}, []uintptr{8, 4})
 
-	var ports fwpRange0
-	check("FWP_RANGE0",
-		[]uintptr{unsafe.Sizeof(ports), unsafe.Offsetof(ports.high)},
-		[]uintptr{32, 16}, []uintptr{16, 8})
-
-	var v4 fwpV4AddrAndMask
-	check("FWP_V4_ADDR_AND_MASK",
-		[]uintptr{unsafe.Sizeof(v4), unsafe.Offsetof(v4.mask)},
-		[]uintptr{8, 4}, []uintptr{8, 4})
-
-	var v6 fwpV6AddrAndMask
-	check("FWP_V6_ADDR_AND_MASK",
-		[]uintptr{unsafe.Sizeof(v6), unsafe.Offsetof(v6.prefixLength)},
-		[]uintptr{17, 16}, []uintptr{17, 16})
-
 	var display fwpmDisplayData0
 	check("FWPM_DISPLAY_DATA0",
 		[]uintptr{unsafe.Sizeof(display), unsafe.Offsetof(display.description)},
@@ -129,102 +114,9 @@ func TestLeakFiltersAccepted(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// Each with a sublayer of its own.
+	if err := addLeakFilters(engine, loopback, true, true, true); err != nil {
-	for _, c := range []struct {
-		values         []string
-		route4, route6 bool
-	}{
-		{[]string{"dns", "misconfigtun", "all", "tcp/443", "udp/1000-2000", "tcp", "icmp", "10-20", "1-65535"}, false, false},
-		// CIDRs, and the local network's addresses.
-		{[]string{"1.1.1.0/24:tcp/80", "[2001:db8::/32]:udp/5000-6000", "[::/0]:icmp", "8.8.8.8/32:all", "[2000::/3]:misconfigtun", "9.9.9.9/32:dns"}, true, false},
-		{[]string{"allexceptlan", "udp/1000-2000", "icmp", "192.168.1.5/32:all"}, true, false},
-		{[]string{"0.0.0.0/0:allexceptlan", "[::/0]:all", "[::/0]:windnsclient", "1.0.0.0/8:windnsclient"}, true, true},
-		{[]string{"[::/0]:allexceptlan", "0.0.0.0/0:misconfigtun", "10.0.0.0/8:allexceptlan", "1.0.0.0/8:allexceptlan"}, false, true},
-	} {
-		leaks, err := ExpandWfpBlockLeak(c.values)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := addLeakFilters(engine, loopback, newLeakFilters(leaks, c.route4, c.route6)); err != nil {
 		skipUnlessElevated(err)
 	}
-	}
-}
-
-func TestNewLeakFilters(t *testing.T) {
-	for _, c := range []struct {
-		values         []string
-		route4, route6 bool
-		blocked        string
-		systemDNS      bool
-	}{
-		{[]string{"dns", "misconfigtun"}, true, false, "53, 853, windnsclient, [::/0]:misconfigtun", true},
-		{[]string{"tcp/853", "udp/853", "misconfigtun"}, true, true, "tcp/853, udp/853", false},
-		{[]string{"all"}, true, true, "all", true},
-		{[]string{"all", "misconfigtun"}, true, true, "all", true},
-		{[]string{"misconfigtun"}, true, false, "[::/0]:misconfigtun", false},
-		{[]string{"misconfigtun"}, false, true, "0.0.0.0/0:misconfigtun", false},
-		{[]string{"misconfigtun"}, false, false, "misconfigtun", false},
-		{[]string{"tcp/10-20", "udp", "icmp"}, true, true, "tcp/10-20, udp, icmp", true},
-		{[]string{"tcp/54-60", "icmp", "54-60"}, true, true, "tcp/54-60, icmp, 54-60", false},
-		{[]string{"allexceptlan"}, true, true, "allexceptlan, 53, 853, windnsclient", true},
-		{[]string{"allexceptlan", "all"}, true, true, "allexceptlan, 53, 853, windnsclient, all", true},
-		{[]string{"misconfigtun", "allexceptlan"}, true, false, "[::/0]:misconfigtun, allexceptlan, 53, 853, windnsclient", true},
-		// Limited to the addresses of a CIDR.
-		{[]string{"0.0.0.0/0:TCP/10-20", "[::/0]:udp", "0.0.0.0/0:icmp"}, true, true, "0.0.0.0/0:tcp/10-20, [::/0]:udp, 0.0.0.0/0:icmp", true},
-		{[]string{"[::/0]:tcp/54-60", "[::/0]:icmp"}, true, true, "[::/0]:tcp/54-60, [::/0]:icmp", false},
-		{[]string{"0.0.0.0/0:windnsclient"}, true, true, "0.0.0.0/0:windnsclient", true},
-		{[]string{"1.1.1.0/24:53"}, true, true, "1.1.1.0/24:53", true},
-		{[]string{"[::/0]:all"}, true, false, "[::/0]:all", true},
-		{[]string{"0.0.0.0/0:allexceptlan", "[::/0]:all"}, true, true, "0.0.0.0/0:allexceptlan, 0.0.0.0/0:53, 0.0.0.0/0:853, 0.0.0.0/0:windnsclient, [::/0]:all", true},
-		{[]string{"0.0.0.0/0:misconfigtun"}, true, false, "", false},
-		{[]string{"[::/0]:misconfigtun"}, true, false, "[::/0]:misconfigtun", false},
-		{[]string{"[2000::/3]:misconfigtun", "1.0.0.0/8:misconfigtun"}, true, false, "[2000::/3]:misconfigtun", false},
-		{[]string{"misconfigtun", "[::/0]:misconfigtun"}, true, false, "[::/0]:misconfigtun", false},
-		{[]string{"0.0.0.0/0:misconfigtun", "[::/0]:allexceptlan"}, false, true, "0.0.0.0/0:misconfigtun, [::/0]:allexceptlan, [::/0]:53, [::/0]:853, [::/0]:windnsclient", true},
-	} {
-		leaks, err := ExpandWfpBlockLeak(c.values)
-		if err != nil {
-			t.Fatal(err)
-		}
-		block := newLeakFilters(leaks, c.route4, c.route6)
-		if got := block.String(); got != c.blocked {
-			t.Errorf("%v: String() = %q, want %q", c.values, got, c.blocked)
-		}
-		if got := block.systemDNS(); got != c.systemDNS {
-			t.Errorf("%v: systemDNS() = %v", c.values, got)
-		}
-	}
-	// Without the port 53 values "allexceptlan" brings along, a resolver on
-	// the local network, like the router's, stays reachable.
-	if (leakFilters{{name: "allexceptlan"}}).systemDNS() {
-		t.Error("systemDNS() = true with the local network open")
-	}
-}
-
-func TestLanWithin(t *testing.T) {
-	prefixes := func(cidrs ...string) []netip.Prefix {
-		var prefixes []netip.Prefix
-		for _, cidr := range cidrs {
-			prefixes = append(prefixes, netip.MustParsePrefix(cidr))
-		}
-		return prefixes
-	}
-	for _, c := range []struct {
-		within, lan []netip.Prefix
-	}{
-		{nil, nil},
-		{prefixes("0.0.0.0/0"), prefixes("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.0.0/16", "224.0.0.0/4", "255.255.255.255/32")},
-		{prefixes("::/0"), prefixes("fc00::/7", "fe80::/10", "ff00::/8")},
-		{prefixes("1.0.0.0/8", "10.1.0.0/16"), prefixes("10.1.0.0/16")},
-		{prefixes("192.0.0.0/2"), prefixes("192.168.0.0/16", "224.0.0.0/4", "255.255.255.255/32")},
-		{prefixes("2000::/3", "fe80::/64", "fe80::/10"), prefixes("fe80::/64", "fe80::/10")},
-		{prefixes("8.8.8.8/32", "2001:db8::/32"), nil},
-	} {
-		if got := lanWithin(c.within...); !slices.Equal(got, c.lan) {
-			t.Errorf("%v: got %v, want %v", c.within, got, c.lan)
-		}
-	}
 }
 
 func TestDNSClientSID(t *testing.T) {
@@ -248,38 +140,10 @@ func TestDNSOutsideTUN(t *testing.T) {
 		netip.MustParseAddr("::ffff:203.0.113.54"),
 		netip.MustParseAddr("8.8.8.8"),
 		netip.MustParseAddr("2001:db8::53"),
-		// Local resolvers, reachable over loopback whatever is blocked.
-		netip.MustParseAddr("127.0.0.1"),
-		netip.MustParseAddr("::ffff:127.0.0.53"),
-		netip.MustParseAddr("::1"),
-	}
-	// Only to the addresses of their CIDRs, if any, and "misconfigtun" over
-	// an IP version without routes to the TUN blocks DNS as well.
-	for _, c := range []struct {
-		values         []string
-		route4, route6 bool
-		want           []string
-	}{
-		{[]string{"dns"}, true, true, []string{"8.8.8.8", "2001:db8::53"}},
-		{[]string{"0.0.0.0/0:53"}, true, true, []string{"8.8.8.8"}},
-		{[]string{"8.8.8.0/24:windnsclient", "[2001:db8::/32]:tcp/853"}, true, true, []string{"8.8.8.8"}},
-		{[]string{"[2001:db8::53/128]:all", "9.9.9.9/32:53"}, true, true, []string{"2001:db8::53"}},
-		{[]string{"misconfigtun"}, true, false, []string{"2001:db8::53"}},
-		{[]string{"misconfigtun"}, true, true, nil},
-		{[]string{"tcp/853", "udp/5353", "icmp", "10.0.0.0/8:all"}, true, true, nil},
-		{[]string{"[::/0]:allexceptlan"}, true, true, []string{"2001:db8::53"}},
-	} {
-		leaks, err := ExpandWfpBlockLeak(c.values)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var want []netip.Addr
-		for _, server := range c.want {
-			want = append(want, netip.MustParseAddr(server))
-		}
-		if got := dnsOutsideTUN(servers, prefixes, newLeakFilters(leaks, c.route4, c.route6)); !slices.Equal(got, want) {
-			t.Errorf("%v: got %v, want %v", c.values, got, want)
 	}
+	want := []netip.Addr{netip.MustParseAddr("8.8.8.8"), netip.MustParseAddr("2001:db8::53")}
+	if got := dnsOutsideTUN(servers, prefixes); !slices.Equal(got, want) {
+		t.Errorf("got %v, want %v", got, want)
 	}
 }
 

proxy/tun/wfp_leak.go

@@ -1,160 +0,0 @@
-package tun
-
-import (
-	"net/netip"
-	"slices"
-	"strconv"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// dnsLeaks is what "dns" in autoSystemWfpBlockLeak stands for: DNS over TCP
-// and UDP, DNS over TLS and QUIC, and Windows' DNS Client service, which may
-// also use other protocols and ports.
-var dnsLeaks = []string{"53", "853", "windnsclient"}
-
-// leak is a value of autoSystemWfpBlockLeak: "dns", "windnsclient",
-// "misconfigtun", "all", "allexceptlan", "icmp", or "tcp" or "udp", the latter
-// two with "/<port>" or "/<low>-<high>" for some ports only, such as "tcp/853"
-// or "udp/10-20", or such ports alone for TCP and UDP, such as "53". A CIDR in
-// front limits any of them to its addresses, an IPv6 one in brackets, such as
-// "1.1.1.0/24:53" or "[::/0]:all".
-type leak struct {
-	prefix    netip.Prefix // all addresses of both IP versions if not valid
-	name      string       // empty for TCP and UDP to some ports
-	low, high uint16       // the ports of TCP and UDP, both 0 for all
-}
-
-func (l leak) String() string {
-	s := l.name
-	if l.low != 0 {
-		if s != "" {
-			s += "/"
-		}
-		s += strconv.Itoa(int(l.low))
-		if l.high != l.low {
-			s += "-" + strconv.Itoa(int(l.high))
-		}
-	}
-	switch {
-	case !l.prefix.IsValid():
-		return s
-	case l.prefix.Addr().Is6():
-		return "[" + l.prefix.String() + "]:" + s
-	default:
-		return l.prefix.String() + ":" + s
-	}
-}
-
-// covers tells whether l includes connections of protocol, "tcp" or "udp", to
-// port, to at least some addresses.
-func (l leak) covers(protocol string, port uint16) bool {
-	switch l.name {
-	case "all":
-		return true
-	case "", protocol:
-		return l.low == 0 || l.low <= port && port <= l.high
-	}
-	return false
-}
-
-// blocksDNS tells whether l keeps the system's DNS, TCP or UDP port 53 or
-// Windows' DNS Client service, inside the TUN, to at least some addresses.
-func (l leak) blocksDNS() bool {
-	return l.name == "windnsclient" || l.covers("udp", 53) || l.covers("tcp", 53)
-}
-
-// parseLeak parses a lower case value of autoSystemWfpBlockLeak. Ports go from
-// 1 to 65535, low not above high, and "tcp/1-65535" stands for all of them, as
-// does "tcp".
-func parseLeak(value string) (leak, bool) {
-	var l leak
-	cidr, rest, hasCIDR := strings.Cut(value, ":")
-	ipv6 := strings.HasPrefix(value, "[")
-	if ipv6 {
-		cidr, rest, hasCIDR = strings.Cut(value[1:], "]:")
-	}
-	if hasCIDR {
-		// IPv4-mapped IPv6 ones would not match: Windows checks such
-		// connections as IPv4.
-		prefix, err := netip.ParsePrefix(cidr)
-		if err != nil || prefix.Addr().Is6() != ipv6 || prefix.Addr().Is4In6() {
-			return leak{}, false
-		}
-		l.prefix, value = prefix.Masked(), rest
-	}
-	name, ports, hasPorts := strings.Cut(value, "/")
-	switch name {
-	case "tcp", "udp":
-		l.name = name
-		if !hasPorts {
-			return l, true
-		}
-	case "dns", "windnsclient", "misconfigtun", "all", "allexceptlan", "icmp":
-		l.name = name
-		return l, !hasPorts
-	default:
-		if hasPorts {
-			return leak{}, false
-		}
-		ports = name // for TCP and UDP
-	}
-	lowText, highText, isRange := strings.Cut(ports, "-")
-	low, err := strconv.ParseUint(lowText, 10, 16)
-	if err != nil || low == 0 {
-		return leak{}, false
-	}
-	high := low
-	if isRange {
-		if high, err = strconv.ParseUint(highText, 10, 16); err != nil || high < low {
-			return leak{}, false
-		}
-	}
-	if l.name == "" || low != 1 || high != 65535 {
-		l.low, l.high = uint16(low), uint16(high)
-	}
-	return l, true
-}
-
-// ExpandWfpBlockLeak checks the values of autoSystemWfpBlockLeak and returns
-// them in lower case, in order and each once, with "dns" replaced by what it
-// stands for, "allexceptlan" followed by that, CIDRs masked, and ports written
-// the same way, "tcp/1-65535" as "tcp" say.
-func ExpandWfpBlockLeak(values []string) ([]string, error) {
-	var expanded []string
-	add := func(l leak) {
-		if value := l.String(); !slices.Contains(expanded, value) {
-			expanded = append(expanded, value)
-		}
-	}
-	for _, value := range values {
-		l, ok := parseLeak(strings.ToLower(value))
-		if !ok {
-			return nil, errors.New("unknown autoSystemWfpBlockLeak value: ", value)
-		}
-		if l.name != "dns" {
-			add(l)
-		}
-		// The local network is no way out for DNS with "allexceptlan", as a
-		// resolver there, like the router, would forward outside the TUN.
-		if l.name == "dns" || l.name == "allexceptlan" {
-			for _, dnsLeak := range dnsLeaks {
-				dns, _ := parseLeak(dnsLeak)
-				dns.prefix = l.prefix
-				add(dns)
-			}
-		}
-	}
-	return expanded, nil
-}
-
-// BlocksSystemDNS tells whether expanded autoSystemWfpBlockLeak values keep the
-// system's DNS (TCP or UDP port 53, or Windows' DNS Client service) inside the
-// TUN, to at least some addresses, which then needs DNS servers of its own.
-func BlocksSystemDNS(leaks []string) bool {
-	return slices.ContainsFunc(leaks, func(value string) bool {
-		l, _ := parseLeak(value)
-		return l.blocksDNS()
-	})
-}

proxy/tun/wfp_leak_test.go

@@ -1,122 +0,0 @@
-package tun
-
-import (
-	"slices"
-	"testing"
-)
-
-func TestExpandWfpBlockLeak(t *testing.T) {
-	for _, c := range []struct {
-		values    []string
-		leaks     []string
-		systemDNS bool
-	}{
-		{nil, nil, false},
-		{[]string{"dns"}, []string{"53", "853", "windnsclient"}, true},
-		{[]string{"DNS", "MisconfigTUN"}, []string{"53", "853", "windnsclient", "misconfigtun"}, true},
-		{[]string{"tcp/853", "dns", "TCP/0853"}, []string{"tcp/853", "53", "853", "windnsclient"}, true},
-		{[]string{"tcp/853", "udp/853", "misconfigtun"}, []string{"tcp/853", "udp/853", "misconfigtun"}, false},
-		{[]string{"udp/65535", "tcp/1"}, []string{"udp/65535", "tcp/1"}, false},
-		{[]string{"tcp/53"}, []string{"tcp/53"}, true},
-		{[]string{"windnsclient"}, []string{"windnsclient"}, true},
-		{[]string{"ALL"}, []string{"all"}, true},
-		{[]string{"tcp", "TCP", "UDP"}, []string{"tcp", "udp"}, true},
-		{[]string{"tcp/1-65535", "udp/1-65535"}, []string{"tcp", "udp"}, true},
-		{[]string{"udp/10-20", "udp/53-53", "tcp/50-60"}, []string{"udp/10-20", "udp/53", "tcp/50-60"}, true},
-		{[]string{"tcp/54-60", "udp/1-52"}, []string{"tcp/54-60", "udp/1-52"}, false},
-		{[]string{"ICMP", "icmp"}, []string{"icmp"}, false},
-		{[]string{"AllExceptLAN"}, []string{"allexceptlan", "53", "853", "windnsclient"}, true},
-		{[]string{"dns", "allexceptlan", "all"}, []string{"53", "853", "windnsclient", "allexceptlan", "all"}, true},
-		// Ports alone, for TCP and UDP.
-		{[]string{"53"}, []string{"53"}, true},
-		{[]string{"10-20", "0053", "853-853", "53"}, []string{"10-20", "53", "853"}, true},
-		{[]string{"54-60", "1-52", "65535"}, []string{"54-60", "1-52", "65535"}, false},
-		{[]string{"1-65535"}, []string{"1-65535"}, true},
-		{[]string{"853", "tcp/853"}, []string{"853", "tcp/853"}, false},
-		// Limited to the addresses of a CIDR.
-		{[]string{"1.1.1.0/24:53"}, []string{"1.1.1.0/24:53"}, true},
-		{[]string{"1.1.1.1/24:TCP/853", "[2001:DB8::1/32]:udp/10-20", "[::/0]:ICMP"}, []string{"1.1.1.0/24:tcp/853", "[2001:db8::/32]:udp/10-20", "[::/0]:icmp"}, false},
-		{[]string{"0.0.0.0/0:dns"}, []string{"0.0.0.0/0:53", "0.0.0.0/0:853", "0.0.0.0/0:windnsclient"}, true},
-		{[]string{"[::/0]:all"}, []string{"[::/0]:all"}, true},
-		{[]string{"10.0.0.1/32:windnsclient"}, []string{"10.0.0.1/32:windnsclient"}, true},
-		{[]string{"[2000::/3]:misconfigtun"}, []string{"[2000::/3]:misconfigtun"}, false},
-		{[]string{"1.1.1.0/24:tcp/1-65535", "1.1.1.0/24:udp/53-53"}, []string{"1.1.1.0/24:tcp", "1.1.1.0/24:udp/53"}, true},
-		{[]string{"1.1.1.0/24:20-30", "[::/0]:10-10"}, []string{"1.1.1.0/24:20-30", "[::/0]:10"}, false},
-		{[]string{"0.0.0.0/0:allexceptlan", "[::/0]:all"}, []string{"0.0.0.0/0:allexceptlan", "0.0.0.0/0:53", "0.0.0.0/0:853", "0.0.0.0/0:windnsclient", "[::/0]:all"}, true},
-		{[]string{"1.1.1.1/32:53", "1.1.1.1/32:0053", "1.1.1.1/24:53", "1.1.1.0/24:53", "53"}, []string{"1.1.1.1/32:53", "1.1.1.0/24:53", "53"}, true},
-		{[]string{"1.2.3.4/0:icmp", "[::1/0]:icmp", "icmp"}, []string{"0.0.0.0/0:icmp", "[::/0]:icmp", "icmp"}, false},
-	} {
-		leaks, err := ExpandWfpBlockLeak(c.values)
-		if err != nil {
-			t.Errorf("%v: %v", c.values, err)
-			continue
-		}
-		if !slices.Equal(leaks, c.leaks) {
-			t.Errorf("%v: got %v, want %v", c.values, leaks, c.leaks)
-		}
-		if got := BlocksSystemDNS(leaks); got != c.systemDNS {
-			t.Errorf("%v: BlocksSystemDNS() = %v", c.values, got)
-		}
-	}
-	for _, value := range []string{
-		"", "ip", "tcp/", "udp/65536", "tcp/-1", "tcp/+53", "tcp/53/1", "udp/abc", "icmp/0", "icmp/8", "tcp:53", " dns",
-		"tcp/0-10", "tcp/20-10", "tcp/5-", "tcp/-5", "tcp/1-2-3", "tcp/1-65536", "udp/ 53", "all/0", "dns/53", "windnsclient/53",
-		"tcp/0", "udp/0", "tcp/00", "udp/0-0", "udp/65535-1",
-		// Ports alone.
-		"0", "00", "65536", "0-10", "20-10", "5-", "-5", "-", "1-2-3", "1-65536", "+53", " 53", "53 ", "53/1", "53/tcp", "0x35",
-		// IP versions are CIDRs now.
-		"ipv4", "ipv6", "ipv4:udp", "ipv6:all", "ipv4:dns", "tcpv4", "udpv6", "icmpv4", "tcp4", "dnsv4",
-		// CIDRs, IPv6 ones in brackets, but neither single addresses nor
-		// CIDRs on their own.
-		"1.1.1.0/24", "[2001:db8::/32]", "1.1.1.0/24:", "[::/0]:", ":udp", "[]:udp", "[:udp", "[::/0]udp",
-		"1.1.1.1:53", "[::1]:53", "[2001:db8::1]:tcp/53", "2001:db8::/32:53", "::/0:all", "[1.1.1.0/24]:53",
-		"[2001:db8::]/32:53", "1.1.1.0/33:53", "[::/129]:53", "1.1.1.0/24:1.1.1.0/24:53", "[::/0]:[::/0]:53",
-		"1.1.1.0/24 :53", "1.1.1.0/24: 53", " 1.1.1.0/24:53", "1.1.1.0/24::53", "[fe80::%1/64]:53", "geoip:cn:53",
-		"1.1.1.0/24:udp/0", "[::/0]:icmp/8", "1.1.1.0/24:dns/53", "[::/0]:20-10", "1.1.1.0/24:ipv4:53", "1.1.1.0/24:geoip",
-		"[::ffff:1.1.1.0/120]:53", "[::ffff:0:0/96]:all",
-	} {
-		if _, err := ExpandWfpBlockLeak([]string{value}); err == nil {
-			t.Errorf("%q was accepted", value)
-		}
-	}
-}
-
-func TestLeakCovers(t *testing.T) {
-	for _, c := range []struct {
-		value    string
-		protocol string
-		port     uint16
-		covers   bool
-	}{
-		{"tcp", "tcp", 1, true},
-		{"tcp", "udp", 53, false},
-		{"udp/53", "udp", 53, true},
-		{"udp/53", "udp", 54, false},
-		{"tcp/10-20", "tcp", 10, true},
-		{"tcp/10-20", "tcp", 20, true},
-		{"tcp/10-20", "tcp", 21, false},
-		{"tcp/10-20", "tcp", 9, false},
-		{"53", "udp", 53, true},
-		{"53", "tcp", 53, true},
-		{"10-20", "tcp", 15, true},
-		{"10-20", "udp", 21, false},
-		{"1.1.1.0/24:udp/53", "udp", 53, true},
-		{"[::/0]:tcp", "tcp", 443, true},
-		{"[2001:db8::/32]:53", "tcp", 53, true},
-		{"0.0.0.0/0:icmp", "udp", 53, false},
-		{"all", "udp", 53, true},
-		{"1.1.1.1/32:all", "tcp", 1, true},
-		{"allexceptlan", "udp", 53, false},
-		{"misconfigtun", "udp", 53, false},
-		{"windnsclient", "udp", 53, false},
-	} {
-		l, ok := parseLeak(c.value)
-		if !ok {
-			t.Errorf("%q was not parsed", c.value)
-			continue
-		}
-		if got := l.covers(c.protocol, c.port); got != c.covers {
-			t.Errorf("%q covers %s/%d = %v", c.value, c.protocol, c.port, got)
-		}
-	}
-}

proxy/vless/account.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/vless/account.proto
 
 package vless

proxy/vless/encoding/addons.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/vless/encoding/addons.proto
 
 package encoding