detail

.github/docker/Dockerfile

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -40,15 +40,21 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 FROM gcr.io/distroless/static:nonroot
 
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/docker/Dockerfile.usa

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -40,6 +40,11 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 # Note on Distroless Base Image and Architecture Support:
 # - The official 'gcr.io/distroless/static' image provided by Google only supports a limited set of architectures for Linux:
@@ -55,9 +60,10 @@ FROM --platform=linux/amd64 gcr.io/distroless/static:nonroot
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/workflows/docker.yml

@@ -82,7 +82,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/scheduled-assets-update.yml

@@ -40,7 +40,7 @@ jobs:
           max_attempts: 60
           command: |
             [ -d 'resources' ] || mkdir resources
-            LIST=('XTLS Xray-rules-dat geoip/geoip-lite geoip' 'XTLS Xray-rules-dat geosite/geosite geosite')
+            LIST=('Loyalsoldier v2ray-rules-dat geoip geoip' 'Loyalsoldier v2ray-rules-dat geosite geosite')
             for i in "${LIST[@]}"
             do
               INFO=($(echo $i | awk 'BEGIN{FS=" ";OFS=" "} {print $1,$2,$3,$4}'))

.github/workflows/test.yml

@@ -35,7 +35,24 @@ jobs:
         if: steps.check-assets.outputs.missing == 'true'
         run: sleep 90
 
-  check-format-and-proto:
+  check-proto:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v7
+      - name: Check Proto Version Header
+        run: |
+          head -n 4 core/config.pb.go > ref.txt
+          find . -name "*.pb.go" ! -name "*_grpc.pb.go" -print0 | while IFS= read -r -d '' file; do
+            if ! cmp -s ref.txt <(head -n 4 "$file"); then
+              echo "Error: Header mismatch in $file"
+              head -n 4 "$file"
+              exit 1
+            fi
+          done
+
+  check-format:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     permissions:
@@ -51,8 +68,6 @@ jobs:
           cache: false
       - name: Check Format
         run: go run ./infra/vformat/main.go -mode check -pwd ./
-      - name: Check Protobuf
-        run: go run ./infra/vprotogen/main.go -mode check -pwd ./
 
   test:
     needs: check-assets

app/commander/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/commander/config.proto
 
 package commander

app/dispatcher/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/dispatcher/config.proto
 
 package dispatcher

app/dns/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/dns/config.proto
 
 package dns
@@ -266,9 +266,10 @@ type Config struct {
 	DisableFallback        bool          `protobuf:"varint,10,opt,name=disableFallback,proto3" json:"disableFallback,omitempty"`
 	DisableFallbackIfMatch bool          `protobuf:"varint,11,opt,name=disableFallbackIfMatch,proto3" json:"disableFallbackIfMatch,omitempty"`
 	EnableParallelQuery    bool          `protobuf:"varint,14,opt,name=enableParallelQuery,proto3" json:"enableParallelQuery,omitempty"`
-	Script                 string        `protobuf:"bytes,15,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields          protoimpl.UnknownFields
-	sizeCache              protoimpl.SizeCache
+	// Absolute path to the Lua DNS query script.
+	Script        string `protobuf:"bytes,15,opt,name=script,proto3" json:"script,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {

app/dns/config.proto

@@ -75,5 +75,6 @@ message Config {
 
   bool enableParallelQuery = 14;
 
+  // Absolute path to the Lua DNS query script.
   string script = 15;
 }

app/dns/dns.go

@@ -32,6 +32,7 @@ type DNS struct {
 	matcherInfos           []*DomainMatcherInfo
 	checkSystem            bool
 	script                 *scriptEngine
+	scriptPath             string
 }
 
 // DomainMatcherInfo contains information attached to index returned by Server.domainMatcher.
@@ -170,13 +171,6 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		clients = append(clients, NewLocalDNSClient(ipOption))
 	}
 
-	var script *scriptEngine
-	if config.Script != "" {
-		if script, err = newScriptEngine(config.Script); err != nil {
-			return nil, errors.New("failed to prepare DNS script").Base(err)
-		}
-	}
-
 	return &DNS{
 		hosts:                  hosts,
 		ipOption:               &ipOption,
@@ -188,7 +182,7 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		disableFallbackIfMatch: config.DisableFallbackIfMatch,
 		enableParallelQuery:    config.EnableParallelQuery,
 		checkSystem:            checkSystem,
-		script:                 script,
+		scriptPath:             config.Script,
 	}, nil
 }
 
@@ -199,10 +193,12 @@ func (*DNS) Type() interface{} {
 
 // Start implements common.Runnable.
 func (s *DNS) Start() error {
-	if s.script != nil {
-		if err := s.script.start(s); err != nil {
+	if s.scriptPath != "" {
+		engine, err := newScriptEngine(s.scriptPath, s)
+		if err != nil {
 			return errors.New("failed to initialize DNS script").Base(err)
 		}
+		s.script = engine
 	}
 	return nil
 }

app/dns/fakedns/fakedns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/dns/fakedns/fakedns.proto
 
 package fakedns

app/dns/lua.go

@@ -52,7 +52,7 @@ func luaServers(s *DNS) []luaDNSServer {
 
 func registerLua(L *lua.LState, servers []luaDNSServer, client featureDNS.Client) {
 	L.PreloadModule("xray.dns", func(L *lua.LState) int {
-		pushIPs := xlua.NewReadOnlySlicePusher[net.IP](L)
+		pushIPs := xlua.NewSlicePusher[net.IP](L)
 
 		serverList := L.CreateTable(len(servers), 0)
 		for i, client := range servers {

app/dns/lua_benchmark_test.go

@@ -72,13 +72,10 @@ end
 	if err := os.WriteFile(path, []byte(script), 0o600); err != nil {
 		b.Fatal(err)
 	}
-	engine, err := newScriptEngine(path)
+	engine, err := newScriptEngine(path, server)
 	if err != nil {
 		b.Fatal(err)
 	}
-	if err := engine.start(server); err != nil {
-		b.Fatal(err)
-	}
 	b.Cleanup(engine.close)
 	for _, bench := range []struct {
 		name  string

app/dns/script.go

@@ -15,22 +15,17 @@ import (
 const scriptExecutionTimeout = 6 * time.Second
 
 type scriptEngine struct {
-	program *xlua.Program
-	pool    *xlua.Pool
+	pool *xlua.Pool
 }
 
-func newScriptEngine(script string) (*scriptEngine, error) {
-	program, err := xlua.Compile(script)
+func newScriptEngine(path string, server *DNS) (*scriptEngine, error) {
+	program, err := xlua.CompileFile(path)
 	if err != nil {
 		return nil, err
 	}
-	return &scriptEngine{program: program}, nil
-}
 
-func (e *scriptEngine) start(server *DNS) error {
-	pool, err := xlua.NewPool(server.ctx, scriptExecutionTimeout, e.program.NewStateFactory(
+	pool, err := xlua.NewPool(server.ctx, scriptExecutionTimeout, program.NewStateFactory(
 		scriptExecutionTimeout*20,
-		256,
 		func(L *lua.LState) {
 			geodata.RegisterLua(L)
 			log.RegisterLua(L)
@@ -43,18 +38,15 @@ func (e *scriptEngine) start(server *DNS) error {
 			return nil
 		}))
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	e.pool = pool
-	errors.LogInfo(server.ctx, "DNS script initialized")
-	return nil
+	errors.LogInfo(server.ctx, "DNS script initialized from ", path)
+	return &scriptEngine{pool: pool}, nil
 }
 
 func (e *scriptEngine) close() {
-	if e.pool != nil {
-		e.pool.Close()
-	}
+	e.pool.Close()
 }
 
 func (e *scriptEngine) query(domain string, option dns.IPOption) (ips []net.IP, ttl uint32, queryErr error) {

app/dns/script_test.go

@@ -85,13 +85,10 @@ end
 				ctx:     context.Background(),
 				clients: []*Client{{server: upstream, ipOption: &option, timeoutMs: time.Second}},
 			}
-			engine, err := newScriptEngine(path)
+			engine, err := newScriptEngine(path, server)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if err := engine.start(server); err != nil {
-				t.Fatal(err)
-			}
 			defer engine.close()
 
 			ips, ttl, err := engine.query("good.example", option)
@@ -128,7 +125,7 @@ func TestDNSScriptGeoIPFallback(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 	script := `
 local servers = require("xray.dns").Servers
-local ru_ips = require("xray.geodata").BuildIPMatcher("geoip:ru")
+local us_ips = require("xray.geodata").BuildIPMatcher("geoip:us")
 
 local by_id = {}
 for _, server in ipairs(servers) do
@@ -138,7 +135,7 @@ assert(by_id.primary and by_id.fallback, "primary and fallback DNS servers are r
 
 function HandleDNSQuery(domain, ipv4, ipv6, fake)
     local ips, ttl, err = by_id.primary:Query(domain, ipv4, ipv6, fake)
-    if not err and ru_ips:AnyMatch(ips) then
+    if not err and us_ips:AnyMatch(ips) then
         return ips, ttl, nil
     end
     return by_id.fallback:Query(domain, ipv4, ipv6, fake)
@@ -152,7 +149,7 @@ end
 	primary := &scriptNameServer{
 		name: "primary",
 		answers: map[string]net.IP{
-			"ru.example":    net.ParseIP("2a02:6b8::feed:0ff"),
+			"us.example":    net.ParseIP("2001:4860:4860::8888"),
 			"other.example": net.ParseIP("127.0.0.1"),
 		},
 		ttl: 30,
@@ -167,15 +164,11 @@ end
 	if err != nil {
 		t.Fatal(err)
 	}
-	engine, err := newScriptEngine(scriptPath)
-	if err != nil {
-		t.Fatal(err)
-	}
 	server := &DNS{
-		ctx:      context.Background(),
-		hosts:    hosts,
-		ipOption: &option,
-		script:   engine,
+		ctx:        context.Background(),
+		hosts:      hosts,
+		ipOption:   &option,
+		scriptPath: scriptPath,
 		clients: []*Client{
 			{id: "primary", server: primary, ipOption: &option, timeoutMs: 2 * time.Second},
 			{id: "fallback", server: fallback, ipOption: &option, timeoutMs: 2 * time.Second},
@@ -191,7 +184,7 @@ end
 		ip     net.IP
 		ttl    uint32
 	}{
-		{"Ru.Example.", net.ParseIP("2a02:6b8::feed:0ff"), 30},
+		{"Us.Example.", net.ParseIP("2001:4860:4860::8888"), 30},
 		{"other.example", net.ParseIP("9.9.9.9"), 60},
 	} {
 		ips, ttl, err := server.LookupIP(tc.domain, option)
@@ -209,67 +202,29 @@ end
 
 func TestDNSScriptRejectsInvalidStartup(t *testing.T) {
 	for _, tc := range []struct {
-		name, script string
-		compileError bool
+		name   string
+		script string
 	}{
-		{"syntax", "function HandleDNSQuery(", true},
-		{"missing hook", "value = 1", false},
-		{"invalid hook", "HandleDNSQuery = true", false},
-		{"top-level error", `error("setup failed")`, false},
+		{"syntax", "function HandleDNSQuery("},
+		{"missing hook", "value = 1"},
+		{"top-level error", `error("setup failed")`},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "script.lua")
 			if err := os.WriteFile(path, []byte(tc.script), 0o600); err != nil {
 				t.Fatal(err)
 			}
-			server, err := New(context.Background(), &Config{Script: path})
-			if tc.compileError {
-				if server != nil || err == nil || !strings.Contains(err.Error(), "failed to prepare DNS script") {
-					t.Fatalf("New = %v, %v; want nil server and script preparation error", server, err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer server.Close()
-			if server.script.program == nil || server.script.pool != nil {
-				t.Fatal("New did not compile the script without starting its pool")
-			}
-			if err := server.Close(); err != nil {
-				t.Fatal(err)
-			}
+			server := &DNS{ctx: context.Background(), scriptPath: path}
 			if err := server.Start(); err == nil {
 				t.Fatal("Start accepted an invalid DNS script")
 			}
-			if server.script.pool != nil {
-				t.Fatal("Start retained a script pool after failure")
+			if server.script != nil {
+				t.Fatal("Start retained a script engine after failure")
 			}
 		})
 	}
 }
 
-func TestDNSScriptProgramSnapshot(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "script.lua")
-	if err := os.WriteFile(path, []byte(`function HandleDNSQuery() return nil, nil, "compiled" end`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer engine.close()
-	if err := os.Remove(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := engine.start(&DNS{ctx: context.Background()}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := engine.query("example.com", featureDNS.IPOption{}); err == nil || !strings.Contains(err.Error(), "compiled") {
-		t.Fatalf("query error = %v, want compiled", err)
-	}
-}
-
 func TestDNSScriptFakeDNSOption(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "script.lua")
 	script := `
@@ -296,16 +251,12 @@ end
 		answers: map[string]net.IP{"good.example": net.ParseIP("198.18.0.1")},
 		ttl:     30,
 	}
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
 	server := &DNS{
-		ctx:      context.Background(),
-		hosts:    hosts,
-		ipOption: &option,
-		script:   engine,
-		clients:  []*Client{{id: "fake", server: upstream, ipOption: &option, timeoutMs: time.Second}},
+		ctx:        context.Background(),
+		hosts:      hosts,
+		ipOption:   &option,
+		scriptPath: path,
+		clients:    []*Client{{id: "fake", server: upstream, ipOption: &option, timeoutMs: time.Second}},
 	}
 	if err := server.Start(); err != nil {
 		t.Fatal(err)

app/geodata/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/geodata/config.proto
 
 package geodata

app/geodata/download.go

@@ -21,13 +21,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-const (
-	idleTimeout           = 30 * time.Second
-	maxDownloadSize int64 = 256 * 1024 * 1024
-)
-
-// DO NOT EDIT. Ignored by geodata, rejected by Lua.
-const luaGuardHeader = "\x12\x01\x00"
+const idleTimeout = 30 * time.Second
 
 type stage struct {
 	target string
@@ -36,6 +30,7 @@ type stage struct {
 
 type downloader struct {
 	ctx         context.Context
+	httpClient  *http.Client
 	httpsClient *http.Client
 }
 
@@ -63,11 +58,12 @@ func (c *idleConn) Write(b []byte) (int, error) {
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
 		ctx:         ctx,
-		httpsClient: newClient(ctx, dispatcher, outbound),
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
 	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
 		var conn net.Conn
 		err := task.Run(ctx, func() error {
@@ -92,33 +88,53 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 			Conn: conn,
 		}, nil
 	}
-	return &http.Client{
-		Transport: &http2.Transport{
-			DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
-				conn, err := dial(ctx, network, address)
-				if err != nil {
-					return nil, err
-				}
-				host, _, _ := net.SplitHostPort(address)
-				tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
-				handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
-				defer cancel()
-				if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
-					conn.Close()
-					return nil, err
-				}
-				return tlsConn, nil
+	if isHTTPS {
+		return &http.Client{
+			Transport: &http2.Transport{
+				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+					conn, err := dial(ctx, network, address)
+					if err != nil {
+						return nil, err
+					}
+					host, _, _ := net.SplitHostPort(address)
+					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+					defer cancel()
+					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+						conn.Close()
+						return nil, err
+					}
+					return tlsConn, nil
+				},
 			},
-		},
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if req.URL.Scheme != "https" {
-				return errors.New("redirected to non-https URL: ", req.URL.String())
-			}
-			if len(via) >= 20 {
-				return errors.New("stopped after 20 redirects")
-			}
-			return nil
-		},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
 	}
 }
 
@@ -154,10 +170,6 @@ func (d *downloader) downloadOne(asset *Asset) (stage, error) {
 		}
 	}()
 
-	if _, err := temp.WriteString(luaGuardHeader); err != nil {
-		temp.Close()
-		return stage{}, err
-	}
 	if err := d.fetch(asset.Url, temp); err != nil {
 		temp.Close()
 		return stage{}, err
@@ -184,26 +196,27 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	resp, err := d.httpsClient.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		io.Copy(io.Discard, resp.Body)
 		return errors.New("unexpected status code: ", resp.StatusCode)
 	}
-	if resp.ContentLength > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 
-	n, err := io.Copy(writer, io.LimitReader(resp.Body, maxDownloadSize+1))
+	n, err := io.Copy(writer, resp.Body)
 	if err != nil {
 		return err
 	}
-	if n > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 	if n == 0 {
 		return errors.New("empty response body")
 	}

app/geodata/download_test.go

@@ -1,126 +0,0 @@
-package geodata
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	commongeodata "github.com/xtls/xray-core/common/geodata"
-	xlua "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
-	"github.com/yuin/gopher-lua/parse"
-	"google.golang.org/protobuf/proto"
-)
-
-func TestDownloadOneLuaGuard(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		body string
-		code string
-	}{
-		{"geodata", "\x0a\x03\x0a\x01A", "A"},
-		{"prefixed geodata", luaGuardHeader + "\x0a\x03\x0a\x01A", "A"},
-		{"Lua", "function HandleRoute() end", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			t.Setenv("xray.location.asset", dir)
-			if err := os.WriteFile(filepath.Join(dir, "asset.lua"), nil, 0o600); err != nil {
-				t.Fatal(err)
-			}
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				_, _ = w.Write([]byte(tc.body))
-			}))
-			defer server.Close()
-			d := &downloader{ctx: context.Background(), httpsClient: server.Client()}
-			staged, err := d.downloadOne(&Asset{Url: server.URL, File: "asset.lua"})
-			if err != nil {
-				t.Fatal(err)
-			}
-			tx, err := swapAll([]stage{staged})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := tx.commit(); err != nil {
-				t.Fatal(err)
-			}
-			data, err := os.ReadFile(staged.target)
-			if err != nil || string(data) != luaGuardHeader+tc.body {
-				t.Fatalf("downloaded data = % x, %v", data, err)
-			}
-			program, err := xlua.Compile(staged.target)
-			var syntaxErr *parse.Error
-			if program != nil || !errors.As(err, &syntaxErr) || syntaxErr.Pos.Line != 1 || syntaxErr.Pos.Column != 1 {
-				t.Fatalf("want Lua rejection at the first byte, got %v, %v", program, err)
-			}
-			if tc.code != "" {
-				var list commongeodata.GeoSiteList
-				if err := proto.Unmarshal(data, &list); err != nil {
-					t.Fatal(err)
-				}
-				if len(list.Entry) != 1 || list.Entry[0].Code != tc.code {
-					t.Fatalf("header changed geodata: %v", &list)
-				}
-				if _, err := commongeodata.ParseDomainRules([]string{"ext:" + filepath.Base(staged.target) + ":" + tc.code}, commongeodata.Domain_Full); err != nil {
-					t.Fatalf("geodata loader rejected the header: %v", err)
-				}
-			}
-		})
-	}
-}
-
-func TestProtobufConfigValidation(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	for _, name := range []string{"asset.dat", "asset.DAT"} {
-		if err := os.WriteFile(filepath.Join(dir, name), nil, 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.Mkdir(filepath.Join(dir, "directory.dat"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	server, err := core.New(&core.Config{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = server.Close() })
-	for _, tc := range []struct {
-		name      string
-		config    *Config
-		wantError string
-	}{
-		{"minutely cron", &Config{Cron: "* * * * *"}, ""},
-		{"minimum interval", &Config{Cron: "@every 1m"}, ""},
-		{"short interval", &Config{Cron: "@every 59s"}, "interval must be at least 1 minute"},
-		{"fractional interval", &Config{Cron: "@every 59.999s"}, "interval must be at least 1 minute"},
-		{"invalid cron", &Config{Cron: "invalid"}, "invalid geodata cron"},
-		{"dat extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.dat"}}}, ""},
-		{"uppercase extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.DAT"}}}, ""},
-		{"invalid extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.lua"}}}, "extension must be .dat"},
-		{"missing extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset"}}}, "extension must be .dat"},
-		{"missing file", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "missing.dat"}}}, "invalid geodata asset file"},
-		{"directory", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "directory.dat"}}}, "asset is not a regular file"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			config, err := serial.ToTypedMessage(tc.config).GetInstance()
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, err = core.CreateObject(server, config)
-			if tc.wantError == "" {
-				if err != nil {
-					t.Fatal(err)
-				}
-			} else if err == nil || !strings.Contains(err.Error(), tc.wantError) {
-				t.Fatalf("CreateObject() error = %v; want %q", err, tc.wantError)
-			}
-		})
-	}
-}

app/geodata/geodata.go

@@ -2,16 +2,12 @@ package geodata
 
 import (
 	"context"
-	"path/filepath"
-	"strings"
 	"sync"
-	"time"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	commongeodata "github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
 )
@@ -29,24 +25,6 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 	if config.Cron == "" {
 		return &Instance{}, nil
 	}
-	if len(config.Assets) > 100 {
-		return nil, errors.New("geodata supports at most 100 assets")
-	}
-	for _, asset := range config.Assets {
-		if !strings.EqualFold(filepath.Ext(asset.GetFile()), ".dat") {
-			return nil, errors.New("geodata asset file extension must be .dat")
-		}
-		if _, err := filesystem.ResolveAsset(asset.GetFile()); err != nil {
-			return nil, errors.New("invalid geodata asset file: ", asset.GetFile()).Base(err)
-		}
-	}
-	schedule, err := cron.ParseStandard(config.Cron)
-	if err != nil {
-		return nil, errors.New("invalid geodata cron").Base(err)
-	}
-	if interval, ok := schedule.(cron.ConstantDelaySchedule); ok && interval.Delay < time.Minute {
-		return nil, errors.New("geodata cron interval must be at least 1 minute")
-	}
 
 	g := &Instance{
 		assets: config.Assets,
@@ -66,7 +44,9 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 		cron.WithChain(cron.SkipIfStillRunning(cron.DiscardLogger)),
 		cron.WithLogger(cron.DiscardLogger),
 	)
-	g.tasker.Schedule(schedule, cron.FuncJob(g.execute))
+	if _, err := g.tasker.AddFunc(config.Cron, g.execute); err != nil {
+		return nil, errors.New("invalid geodata cron").Base(err)
+	}
 	errors.LogInfo(ctx, "scheduled geodata reload with cron: ", config.Cron)
 
 	return g, nil

app/log/command/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/command/config_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             (unknown)
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/log/config.proto
 
 package log

app/metrics/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/metrics/config.proto
 
 package metrics

app/observatory/burst/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/observatory/burst/config.proto
 
 package burst

app/observatory/burst/healthping_result.go

@@ -109,7 +109,7 @@ func (h *HealthPingRTTS) getStatistics() *HealthPingStats {
 		stats.Min = 0
 		return stats
 	}
-	stats.Average = sum / time.Duration(cnt)
+	stats.Average = time.Duration(int(sum) / cnt)
 	var std float64
 	if cnt < 2 {
 		// no enough data for standard deviation, we assume it's half of the average rtt

app/observatory/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             (unknown)
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/observatory/config.proto
 
 package observatory
@@ -152,23 +152,23 @@ func (x *HealthPingMeasurementResult) GetMin() int64 {
 type OutboundStatus struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Type time.ms
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The last error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	// @Document The outbound tag for this Server
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	OutboundTag string `protobuf:"bytes,4,opt,name=outbound_tag,json=outboundTag,proto3" json:"outbound_tag,omitempty"`
 	// @Document The time this outbound is known to be alive
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastSeenTime int64 `protobuf:"varint,5,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
 	// @Document The time this outbound is tried
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastTryTime   int64                        `protobuf:"varint,6,opt,name=last_try_time,json=lastTryTime,proto3" json:"last_try_time,omitempty"`
 	HealthPing    *HealthPingMeasurementResult `protobuf:"bytes,7,opt,name=health_ping,json=healthPing,proto3" json:"health_ping,omitempty"`
 	unknownFields protoimpl.UnknownFields
@@ -257,14 +257,14 @@ func (x *OutboundStatus) GetHealthPing() *HealthPingMeasurementResult {
 type ProbeResult struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Type time.ms
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -324,7 +324,7 @@ func (x *ProbeResult) GetLastErrorReason() string {
 type Intensity struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document The time interval for a probe request in ms.
-	//@Type time.ms
+	// @Type time.ms
 	ProbeInterval uint32 `protobuf:"varint,1,opt,name=probe_interval,json=probeInterval,proto3" json:"probe_interval,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache

app/policy/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/policy/config.proto
 
 package policy

app/proxyman/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             (unknown)
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/proxyman/config.proto
 
 package proxyman

app/proxyman/inbound/inbound.go

@@ -174,7 +174,7 @@ func NewHandler(ctx context.Context, config *core.InboundHandlerConfig) (inbound
 			Mark: streamSettings.SocketSettings.Mark,
 		})
 	}
-	if streamSettings != nil && (streamSettings.ProtocolName == "splithttp" || streamSettings.ProtocolName == "masque") {
+	if streamSettings != nil && streamSettings.ProtocolName == "splithttp" {
 		ctx = session.ContextWithAllowedNetwork(ctx, net.Network_UDP)
 	}
 

app/reverse/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/reverse/config.proto
 
 package reverse

app/router/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/command/command.proto

@@ -34,19 +34,18 @@ message RoutingContext {
 // opened by xray-core.
 // * FieldSelectors selects a subset of fields in routing statistics to return.
 // Valid selectors:
-//   - inbound: Selects connection's inbound tag.
-//   - network: Selects connection's network.
-//   - ip: Equivalent as "ip_source" and "ip_target", selects both source and
-//     target IP.
-//   - port: Equivalent as "port_source" and "port_target", selects both source
-//     and target port.
-//   - domain: Selects target domain.
-//   - protocol: Select connection's protocol.
-//   - user: Select connection's inbound user email.
-//   - attributes: Select connection's additional attributes.
-//   - outbound: Equivalent as "outbound" and "outbound_group", select both
-//     outbound tag and outbound group tags.
-//
+//  - inbound: Selects connection's inbound tag.
+//  - network: Selects connection's network.
+//  - ip: Equivalent as "ip_source" and "ip_target", selects both source and
+//  target IP.
+//  - port: Equivalent as "port_source" and "port_target", selects both source
+//  and target port.
+//  - domain: Selects target domain.
+//  - protocol: Select connection's protocol.
+//  - user: Select connection's inbound user email.
+//  - attributes: Select connection's additional attributes.
+//  - outbound: Equivalent as "outbound" and "outbound_group", select both
+//  outbound tag and outbound group tags.
 // * If FieldSelectors is left empty, all fields will be returned.
 message SubscribeRoutingStatsRequest {
   repeated string FieldSelectors = 1;

app/router/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             (unknown)
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/condition_test.go

@@ -415,7 +415,7 @@ func BenchmarkMphDomainMatcher(b *testing.B) {
 
 func BenchmarkMultiGeoIPMatcher(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
-	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:ir", "geoip:ru"})
+	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:jp", "geoip:ca", "geoip:us"})
 	common.Must(err)
 
 	matcher, err := NewIPMatcher(rules, MatcherAsType_Target)

app/router/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/router/config.proto
 
 package router
@@ -587,9 +587,10 @@ type Config struct {
 	DomainStrategy Config_DomainStrategy  `protobuf:"varint,1,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.app.router.Config_DomainStrategy" json:"domain_strategy,omitempty"`
 	Rule           []*RoutingRule         `protobuf:"bytes,2,rep,name=rule,proto3" json:"rule,omitempty"`
 	BalancingRule  []*BalancingRule       `protobuf:"bytes,3,rep,name=balancing_rule,json=balancingRule,proto3" json:"balancing_rule,omitempty"`
-	Script         string                 `protobuf:"bytes,4,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// Absolute path to the Lua routing script.
+	Script        string `protobuf:"bytes,4,opt,name=script,proto3" json:"script,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {

app/router/config.proto

@@ -110,5 +110,6 @@ message Config {
   DomainStrategy domain_strategy = 1;
   repeated RoutingRule rule = 2;
   repeated BalancingRule balancing_rule = 3;
+  // Absolute path to the Lua routing script.
   string script = 4;
 }

app/router/lua.go

@@ -30,9 +30,9 @@ func (r *Router) RegisterLua(L *lua.LState) {
 		module.RawSetString("LocalOS", lua.LString(runtime.GOOS))
 
 		module.RawSetString("PickOutbound", L.NewFunction(func(L *lua.LState) int {
-			tag, ok := L.Get(1).(lua.LString)
+			tag, ok := L.Get(2).(lua.LString)
 			if !ok {
-				L.ArgError(1, "balancer tag must be a string")
+				L.ArgError(2, "balancer tag must be a string")
 				return 0
 			}
 			balancer, found := (*r.balancers.Load())[string(tag)]
@@ -62,7 +62,7 @@ func (r *Router) RegisterLua(L *lua.LState) {
 }
 
 func registerLuaContext(L *lua.LState) {
-	pushIPs := xlua.NewReadOnlySlicePusher[net.IP](L)
+	pushIPs := xlua.NewSlicePusher[net.IP](L)
 	attributes := L.NewTypeMetatable(luaAttributesType)
 	L.SetField(attributes, "__index", L.NewFunction(func(L *lua.LState) int {
 		values := L.CheckUserData(1).Value.(map[string]string)

app/router/router.go

@@ -20,6 +20,7 @@ import (
 type Router struct {
 	domainStrategy Config_DomainStrategy
 	rules          atomic.Pointer[[]*Rule]
+	scriptPath     string
 	script         *scriptEngine
 	balancers      atomic.Pointer[map[string]*Balancer]
 	dns            dns.Client
@@ -41,19 +42,12 @@ type Route struct {
 // Init initializes the Router.
 func (r *Router) Init(ctx context.Context, config *Config, d dns.Client, ohm outbound.Manager, dispatcher routing.Dispatcher) error {
 	r.domainStrategy = config.DomainStrategy
+	r.scriptPath = config.Script
 	r.dns = d
 	r.ctx = ctx
 	r.ohm = ohm
 	r.dispatcher = dispatcher
 
-	if config.Script != "" {
-		script, err := newScriptEngine(config.Script)
-		if err != nil {
-			return errors.New("failed to prepare routing script").Base(err)
-		}
-		r.script = script
-	}
-
 	r.rules.Store(new([]*Rule))
 	r.balancers.Store(&map[string]*Balancer{})
 	return r.ReloadRules(config, false)
@@ -234,10 +228,12 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 
 // Start implements common.Runnable.
 func (r *Router) Start() error {
-	if r.script != nil {
-		if err := r.script.start(r); err != nil {
+	if r.scriptPath != "" {
+		engine, err := newScriptEngine(r.scriptPath, r)
+		if err != nil {
 			return errors.New("failed to initialize routing script").Base(err)
 		}
+		r.script = engine
 	}
 	return nil
 }

app/router/script.go

@@ -16,22 +16,17 @@ import (
 const scriptExecutionTimeout = 6 * time.Second
 
 type scriptEngine struct {
-	program *xlua.Program
-	pool    *xlua.Pool
+	pool *xlua.Pool
 }
 
-func newScriptEngine(script string) (*scriptEngine, error) {
-	program, err := xlua.Compile(script)
+func newScriptEngine(path string, router *Router) (*scriptEngine, error) {
+	program, err := xlua.CompileFile(path)
 	if err != nil {
 		return nil, err
 	}
-	return &scriptEngine{program: program}, nil
-}
 
-func (e *scriptEngine) start(router *Router) error {
-	pool, err := xlua.NewPool(router.ctx, scriptExecutionTimeout, e.program.NewStateFactory(
+	pool, err := xlua.NewPool(router.ctx, scriptExecutionTimeout, program.NewStateFactory(
 		scriptExecutionTimeout*20,
-		256,
 		func(L *lua.LState) {
 			geodata.RegisterLua(L)
 			log.RegisterLua(L)
@@ -45,18 +40,15 @@ func (e *scriptEngine) start(router *Router) error {
 			return nil
 		}))
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	e.pool = pool
-	errors.LogInfo(router.ctx, "routing script initialized")
-	return nil
+	errors.LogInfo(router.ctx, "routing script initialized from ", path)
+	return &scriptEngine{pool: pool}, nil
 }
 
 func (e *scriptEngine) close() {
-	if e.pool != nil {
-		e.pool.Close()
-	}
+	e.pool.Close()
 }
 
 func (e *scriptEngine) pickRoute(ctx routing.Context) (routing.Route, error) {

app/router/script_test.go

@@ -72,63 +72,24 @@ func startLuaRouter(t *testing.T, script string, d featureDNS.Client, config *Co
 }
 
 func TestRouterScriptStartup(t *testing.T) {
-	for _, tc := range []struct {
-		name, script string
-		compileError bool
-	}{
-		{"syntax error", "function HandleRoute(", true},
-		{"missing hook", "value = 1", false},
-		{"invalid hook", "HandleRoute = true", false},
-		{"initialization error", `error("setup failed")`, false},
+	for _, tc := range []struct{ name, script string }{
+		{"syntax error", "function HandleRoute("},
+		{"missing hook", "value = 1"},
+		{"initialization error", `error("setup failed")`},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			r := new(Router)
-			err := r.Init(context.Background(), &Config{Script: writeRouteScript(t, tc.script)}, nil, nil, nil)
-			if tc.compileError {
-				if r.script != nil || err == nil || !strings.Contains(err.Error(), "failed to prepare routing script") {
-					t.Fatalf("Init = %v; want no engine and script preparation error", err)
-				}
-				return
-			}
-			if err != nil {
+			if err := r.Init(context.Background(), &Config{Script: writeRouteScript(t, tc.script)}, nil, nil, nil); err != nil {
 				t.Fatal(err)
 			}
 			defer r.Close()
-			if r.script.program == nil || r.script.pool != nil {
-				t.Fatal("Init did not compile the script without starting its pool")
-			}
-			if err := r.Close(); err != nil {
-				t.Fatal(err)
-			}
 			if err := r.Start(); err == nil {
 				t.Fatal("Start accepted an invalid routing script")
 			}
-			if r.script.pool != nil {
-				t.Fatal("Start retained a script pool after failure")
-			}
 		})
 	}
 }
 
-func TestRouterScriptProgramSnapshot(t *testing.T) {
-	path := writeRouteScript(t, `function HandleRoute() return "compiled", "compiled-rule" end`)
-	engine, err := newScriptEngine(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer engine.close()
-	if err := os.Remove(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := engine.start(&Router{ctx: context.Background()}); err != nil {
-		t.Fatal(err)
-	}
-	route, err := engine.pickRoute(newLuaRouteTestContext())
-	if err != nil || route == nil || route.GetOutboundTag() != "compiled" || route.GetRuleTag() != "compiled-rule" {
-		t.Fatalf("route = %v, %v; want compiled, compiled-rule", route, err)
-	}
-}
-
 func TestRouterScriptRouting(t *testing.T) {
 	for _, tc := range []struct {
 		name, body        string
@@ -140,7 +101,7 @@ func TestRouterScriptRouting(t *testing.T) {
 		{name: "route", body: `return "lua-out", "lua-rule"`, wantTag: "lua-out", wantRule: "lua-rule", wantCalls: "2"},
 		{name: "no match", body: `return nil`, wantErr: common.ErrNoClue, wantCalls: "2"},
 		{name: "empty tag", body: `return ""`, wantErr: common.ErrNoClue, wantCalls: "2"},
-		{name: "balancer error", body: `local tag, err = router.PickOutbound("missing"); return tag, nil, err`, wantMessage: "not found", wantCalls: "2"},
+		{name: "balancer error", body: `local tag, err = router:PickOutbound("missing"); return tag, nil, err`, wantMessage: "not found", wantCalls: "2"},
 		{name: "string error", body: `return nil, nil, "blocked"`, wantMessage: "blocked", wantCalls: "2"},
 		{name: "invalid tag", body: `return false`, wantMessage: "outboundTag", wantCalls: "2"},
 		{name: "invalid rule", body: `return "lua-out", false`, wantMessage: "ruleTag", wantCalls: "2"},
@@ -241,7 +202,7 @@ func TestRouterScriptBalancerReload(t *testing.T) {
 	r := startLuaRouter(t, `
 local router = require("xray.router")
 function HandleRoute()
-    local tag, err = router.PickOutbound("balance")
+    local tag, err = router:PickOutbound("balance")
     return tag, "balanced", err
 end`, nil, config("old"))
 	pick := func(want string) {
@@ -275,7 +236,7 @@ func TestRouterScriptConcurrentBalancerReload(t *testing.T) {
 	r := startLuaRouter(t, `
 local router = require("xray.router")
 function HandleRoute()
-    local tag, err = router.PickOutbound("balance")
+    local tag, err = router:PickOutbound("balance")
     return tag, nil, err
 end`, nil, config("a"))
 
@@ -406,10 +367,10 @@ end`)
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer instance.Close()
 	if err := instance.Start(); err != nil {
 		t.Fatal(err)
 	}
-	defer instance.Close()
 	r := instance.GetFeature(routing.RouterType()).(*Router)
 	route, err := r.PickRoute(newLuaRouteTestContext())
 	if err != nil || route.GetOutboundTag() != "direct" || route.GetRuleTag() != "outer-route" {

app/stats/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             (unknown)
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/stats/config.proto
 
 package stats

app/version/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: app/version/config.proto
 
 package version

common/base64/base64.go

@@ -1,6 +0,0 @@
-package base64
-
-const (
-	Prefix     = "base64:"
-	GzipPrefix = "base64+gzip:"
-)

common/base64/decode.go

@@ -1,38 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-	"io"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// Decode decodes Base64 text with an optional [Prefix] or [GzipPrefix].
-func Decode(value string) ([]byte, error) {
-	value, zip := strings.CutPrefix(value, GzipPrefix)
-	if !zip {
-		value = strings.TrimPrefix(value, Prefix)
-	}
-
-	data, err := base64.StdEncoding.DecodeString(value)
-	if err != nil {
-		return nil, errors.New("failed to decode base64").Base(err)
-	}
-	if !zip {
-		return data, nil
-	}
-
-	reader, err := gzip.NewReader(bytes.NewReader(data))
-	if err != nil {
-		return nil, errors.New("failed to decompress gzip").Base(err)
-	}
-	defer reader.Close()
-	data, err = io.ReadAll(reader)
-	if err != nil {
-		return nil, errors.New("failed to decompress gzip").Base(err)
-	}
-	return data, nil
-}

common/base64/decode_test.go

@@ -1,28 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"testing"
-)
-
-func TestDecodeFormats(t *testing.T) {
-	compressed, err := Encode([]byte("x"), true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct {
-		name, value, want string
-	}{
-		{"unprefixed", "eA==", "x"},
-		{"base64", Prefix + "eA==", "x"},
-		{"gzip", compressed, "x"},
-		{"empty", Prefix, ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			data, err := Decode(tc.value)
-			if err != nil || !bytes.Equal(data, []byte(tc.want)) {
-				t.Fatalf("Decode = %q, %v; want %q", data, err, tc.want)
-			}
-		})
-	}
-}

common/base64/encode.go

@@ -1,29 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// Encode returns prefixed Base64 text, optionally compressed with gzip at the highest level.
-func Encode(data []byte, zip bool) (string, error) {
-	if !zip {
-		return Prefix + base64.StdEncoding.EncodeToString(data), nil
-	}
-
-	var buf bytes.Buffer
-	writer, err := gzip.NewWriterLevel(&buf, gzip.BestCompression)
-	if err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	if _, err := writer.Write(data); err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	if err := writer.Close(); err != nil {
-		return "", errors.New("failed to compress gzip").Base(err)
-	}
-	return GzipPrefix + base64.StdEncoding.EncodeToString(buf.Bytes()), nil
-}

common/base64/encode_test.go

@@ -1,62 +0,0 @@
-package base64
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/base64"
-	"io"
-	"strings"
-	"testing"
-)
-
-func TestEncodeFormats(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		data []byte
-	}{
-		{"empty", nil},
-		{"bytes", []byte("你好\r\n\x00\xff")},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			for _, zip := range []bool{false, true} {
-				prefix := Prefix
-				if zip {
-					prefix = GzipPrefix
-				}
-				t.Run(prefix, func(t *testing.T) {
-					value, err := Encode(tc.data, zip)
-					if err != nil {
-						t.Fatal(err)
-					}
-					payload, ok := strings.CutPrefix(value, prefix)
-					if !ok {
-						t.Fatalf("encoded value does not start with %q", prefix)
-					}
-					// Read the output independently of Decode so matching bugs cannot hide.
-					data, err := base64.StdEncoding.DecodeString(payload)
-					if err != nil {
-						t.Fatal(err)
-					}
-					if zip {
-						// gzip's XFL byte identifies the compression level we selected.
-						if len(data) < 10 || data[8] != 2 {
-							t.Fatal("gzip output does not use the highest compression level")
-						}
-						reader, err := gzip.NewReader(bytes.NewReader(data))
-						if err != nil {
-							t.Fatal(err)
-						}
-						defer reader.Close()
-						data, err = io.ReadAll(reader)
-						if err != nil {
-							t.Fatal(err)
-						}
-					}
-					if !bytes.Equal(data, tc.data) {
-						t.Fatal("encoded output does not preserve the input bytes")
-					}
-				})
-			}
-		})
-	}
-}

common/geodata/consts.go

@@ -8,65 +8,23 @@ import (
 
 var privateIPMatcher = sync.OnceValue(func() IPMatcher {
 	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
-		// https://www.iana.org/assignments/iana-ipv4-special-registry
-		"0.0.0.0/8",      // "This network"
-		"0.0.0.0/32",     // "This host on this network"
-		"10.0.0.0/8",     // Private-Use
-		"100.64.0.0/10",  // Shared Address Space
-		"127.0.0.0/8",    // Loopback
-		"169.254.0.0/16", // Link Local
-		"172.16.0.0/12",  // Private-Use
-		// "192.0.0.0/24",   // IETF Protocol Assignments
-		"192.0.0.0/29",   // IPv4 Service Continuity Prefix
-		"192.0.0.8/32",   // IPv4 dummy address
-		"192.0.0.9/32",   // Port Control Protocol Anycast
-		"192.0.0.10/32",  // Traversal Using Relays around NAT Anycast
-		"192.0.0.170/32", // NAT64/DNS64 Discovery
-		"192.0.0.171/32", // NAT64/DNS64 Discovery
-		"192.0.2.0/24",   // Documentation (TEST-NET-1)
-		// "192.31.196.0/24",    // AS112-v4
-		"192.52.193.0/24", // AMT
-		// "192.88.99.0/24",  // Deprecated (6to4 Relay Anycast)
-		"192.88.99.2/32", // 6a44-relay anycast address
-		"192.168.0.0/16", // Private-Use
-		// "192.175.48.0/24",    // Direct Delegation AS112 Service
-		"198.18.0.0/15",      // Benchmarking
-		"198.51.100.0/24",    // Documentation (TEST-NET-2)
-		"203.0.113.0/24",     // Documentation (TEST-NET-3)
-		"240.0.0.0/4",        // Reserved
-		"255.255.255.255/32", // Limited Broadcast
-
-		// https://www.iana.org/assignments/multicast-addresses
-		"224.0.0.0/4",
-
-		// https://www.iana.org/assignments/iana-ipv6-special-registry
-		"::1/128", // Loopback Address
-		"::/128",  // Unspecified Address
-		// "::ffff:0:0/96",     // IPv4-mapped Address
-		"64:ff9b::/96",   // IPv4-IPv6 Translat.
-		"64:ff9b:1::/48", // IPv4-IPv6 Translat.
-		"100::/64",       // Discard-Only Address Block
-		"100:0:0:1::/64", // Dummy IPv6 Prefix
-		// "2001::/23",      // IETF Protocol Assignments
-		"2001::/32",     // TEREDO
-		"2001:1::1/128", // Port Control Protocol Anycast
-		"2001:1::2/128", // Traversal Using Relays around NAT Anycast
-		"2001:1::3/128", // DNS-SD Service Registration Protocol Anycast
-		"2001:2::/48",   // Benchmarking
-		"2001:3::/32",   // AMT
-		// "2001:4:112::/48", // AS112-v6
-		// "2001:10::/28",    // Deprecated (previously ORCHID)
-		"2001:20::/28",  // ORCHIDv2
-		"2001:30::/28",  // Drone Remote ID Protocol Entity Tags (DETs) Prefix
-		"2001:db8::/32", // Documentation
-		"2002::/16",     // 6to4
-		// "2620:4f:8000::/48", // Direct Delegation AS112 Service
-		"3fff::/20", // Documentation
-		"5f00::/16", // Segment Routing (SRv6) SIDs
-		"fc00::/7",  // Unique-Local
-		"fe80::/10", // Link-Local Unicast
-
-		// https://www.iana.org/assignments/ipv6-multicast-addresses
+		"0.0.0.0/8",
+		"10.0.0.0/8",
+		"100.64.0.0/10",
+		"127.0.0.0/8",
+		"169.254.0.0/16",
+		"172.16.0.0/12",
+		"192.0.0.0/24",
+		"192.0.2.0/24",
+		"192.88.99.0/24",
+		"192.168.0.0/16",
+		"198.18.0.0/15",
+		"198.51.100.0/24",
+		"203.0.113.0/24",
+		"224.0.0.0/3",
+		"::/127",
+		"fc00::/7",
+		"fe80::/10",
 		"ff00::/8",
 	}))))
 })

common/geodata/geodat.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/geodata/geodat.proto
 
 package geodata

common/geodata/geodat_loader.go

@@ -17,12 +17,12 @@ import (
 )
 
 func checkFile(file, code string) error {
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
-	if _, err := find(r, []byte(code), false, size); err != nil {
+	if _, err := find(r, []byte(code), false); err != nil {
 		return errors.New("failed to check code ", code, " from ", file).Base(err)
 	}
 	return nil
@@ -30,12 +30,12 @@ func checkFile(file, code string) error {
 
 func loadFile(file, code string) ([]byte, error) {
 	runtime.GC() // peak mem
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return nil, errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
-	bs, err := find(r, []byte(code), true, size)
+	bs, err := find(r, []byte(code), true)
 	if err != nil {
 		return nil, errors.New("failed to load code ", code, " from ", file).Base(err)
 	}
@@ -60,13 +60,13 @@ func loadIP(file, code string) ([]*CIDR, error) {
 // unmarshalling it into a []*Domain, so value is only valid during fn.
 func loadSite(file, code, attrs string, fn func(Domain_Type, []byte)) error {
 	runtime.GC() // peak mem
-	r, size, err := filesystem.OpenAsset(file)
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
 		return errors.New("failed to open ", file).Base(err)
 	}
 	defer r.Close()
 	br := bufio.NewReaderSize(r, 64*1024)
-	n, err := seek(br, []byte(code), size)
+	n, err := seek(br, []byte(code))
 	if err != nil {
 		return errors.New("failed to load code ", code, " from ", file).Base(err)
 	}
@@ -114,9 +114,6 @@ func decodeVarint(br *bufio.Reader) (uint64, error) {
 		if err != nil {
 			return 0, err
 		}
-		if shift == 63 && b > 1 {
-			break // Only one value bit fits in the tenth byte.
-		}
 		x |= (uint64(b) & 0x7F) << shift
 		if (b & 0x80) == 0 {
 			return x, nil
@@ -126,9 +123,9 @@ func decodeVarint(br *bufio.Reader) (uint64, error) {
 	return 0, errors.New("varint overflow")
 }
 
-func find(r io.Reader, code []byte, readBody bool, size int64) ([]byte, error) {
+func find(r io.Reader, code []byte, readBody bool) ([]byte, error) {
 	br := bufio.NewReaderSize(r, 64*1024)
-	bodyL, err := seek(br, code, size)
+	bodyL, err := seek(br, code)
 	if err != nil || !readBody {
 		return nil, err
 	}
@@ -140,7 +137,7 @@ func find(r io.Reader, code []byte, readBody bool, size int64) ([]byte, error) {
 }
 
 // seek advances br to the body of the entry for code and returns the body length.
-func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
+func seek(br *bufio.Reader, code []byte) (int, error) {
 	codeL := len(code)
 	if codeL == 0 {
 		return 0, errors.New("empty code")
@@ -148,8 +145,7 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 	need := 2 + codeL // TODO: if code too long
 
 	for {
-		tag, err := br.ReadByte()
-		if err != nil {
+		if _, err := br.ReadByte(); err != nil {
 			return 0, err
 		}
 
@@ -157,10 +153,10 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 		if err != nil {
 			return 0, err
 		}
-		if x == 0 || x > uint64(size) || x > uint64(^uint(0)>>1) {
-			return 0, errors.New("invalid body length: ", x)
-		}
 		bodyL := int(x)
+		if bodyL <= 0 {
+			return 0, errors.New("invalid body length: ", bodyL)
+		}
 
 		// Peek no more than the buffer holds: a code longer than the buffer cannot match a single
 		// length byte anyway, so a short peek only skips it, as base find (io.ReadFull) does.
@@ -171,8 +167,7 @@ func seek(br *bufio.Reader, code []byte, size int64) (int, error) {
 			}
 			return 0, err
 		}
-		if tag == 0x0a && bodyL >= need && len(prefix) >= need &&
-			prefix[0] == 0x0a && int(prefix[1]) == codeL && bytes.Equal(prefix[2:], code) {
+		if bodyL >= need && len(prefix) >= need && int(prefix[1]) == codeL && bytes.Equal(prefix[2:], code) {
 			return bodyL, nil
 		}
 		if _, err := br.Discard(bodyL); err != nil {

common/geodata/geodat_loader_test.go

@@ -1,7 +1,6 @@
 package geodata
 
 import (
-	"bytes"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,58 +12,6 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-func TestFindChecksEntryAndCodeTags(t *testing.T) {
-	for _, payload := range [][]byte{
-		{0x12, 6, 0x0a, 4, 'T', 'E', 'S', 'T'}, // Unknown field posing as entry.
-		{0x08, 6, 0x0a, 4, 'T', 'E', 'S', 'T'}, // Wrong entry wire type.
-		{0x0a, 6, 0x1a, 4, 'T', 'E', 'S', 'T'}, // Unknown field posing as code.
-		{0x0a, 6, 0x08, 4, 'T', 'E', 'S', 'T'}, // Wrong code wire type.
-	} {
-		if _, err := find(bytes.NewReader(payload), []byte("TEST"), true, int64(len(payload))); err == nil {
-			t.Fatalf("matched incorrect entry/code tags in %x", payload)
-		}
-	}
-}
-
-func TestLoadFileRejectsVarintOverflow(t *testing.T) {
-	payload := []byte{
-		0x0a,
-		0x86, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x02, // 2^64 + 6
-		0x0a, 0x04, 'T', 'E', 'S', 'T',
-	}
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	if err := os.WriteFile(filepath.Join(dir, "overflow.dat"), payload, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := loadFile("overflow.dat", "TEST"); err == nil || !strings.Contains(err.Error(), "varint overflow") {
-		t.Fatalf("want varint overflow, got %v", err)
-	}
-}
-
-func TestLoadFileRejectsOversizedEntry(t *testing.T) {
-	payload := []byte{
-		0x0a, 0x03, 0x0a, 0x01, 'A', // A valid entry before the oversized one.
-		0x0a, 0x80, 0x80, 0x80, 0x80, 0x04, // Entry length: 1 GiB.
-		0x0a, 0x04, 'T', 'E', 'S', 'T',
-	}
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	if err := os.WriteFile(filepath.Join(dir, "oversized.dat"), payload, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	// Check without allocating the body first, so a regression fails safely.
-	if err := checkFile("oversized.dat", "TEST"); err == nil {
-		t.Fatal("accepted an entry length larger than the file")
-	}
-	if _, err := loadFile("oversized.dat", "TEST"); err == nil || !strings.Contains(err.Error(), "invalid body length") {
-		t.Fatalf("want invalid body length, got %v", err)
-	}
-	if err := loadSite("oversized.dat", "TEST", "", func(Domain_Type, []byte) {}); err == nil || !strings.Contains(err.Error(), "invalid body length") {
-		t.Fatalf("want invalid body length, got %v", err)
-	}
-}
-
 type siteEntry struct {
 	Type  Domain_Type
 	Value string

common/geodata/ip_matcher_test.go

@@ -400,13 +400,13 @@ func TestIPMatcher4CN(t *testing.T) {
 	}
 }
 
-func TestIPMatcher6RU(t *testing.T) {
+func TestIPMatcher6US(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
+	matcher := buildIPMatcher("geoip:us")
 
-	if !matcher.Match(xnet.ParseAddress("2a02:6b8::feed:0ff").IP()) {
-		t.Error("expect RU geoip contain 2a02:6b8::feed:0ff, but actually not")
+	if !matcher.Match(xnet.ParseAddress("2001:4860:4860::8888").IP()) {
+		t.Error("expect US geoip contain 2001:4860:4860::8888, but actually not")
 	}
 }
 
@@ -423,11 +423,11 @@ func BenchmarkIPMatcher4CN(b *testing.B) {
 	}
 }
 
-func BenchmarkIPMatcher6RU(b *testing.B) {
+func BenchmarkIPMatcher6US(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
-	ip := xnet.ParseAddress("2a02:6b8::feed:0ff").IP()
+	matcher := buildIPMatcher("geoip:us")
+	ip := xnet.ParseAddress("2001:4860:4860::8888").IP()
 
 	b.ResetTimer()
 

common/geodata/lua.go

@@ -44,8 +44,8 @@ func RegisterLua(L *lua.LState) {
 				"Match":     luaIPMatch,
 				"AnyMatch":  luaIPAnyMatch,
 				"Matches":   luaIPMatches,
-				"FilterIPs": newLuaIPFilterIPs(xlua.NewReadOnlySlicePusher[net.IP](L)),
-			}, "SetReverse", "ToggleReverse")
+				"FilterIPs": newLuaIPFilterIPs(xlua.NewSlicePusher[net.IP](L)),
+			})
 			return 1
 		}))
 

common/geodata/lua_test.go

@@ -78,7 +78,6 @@ local geodata = require("xray.geodata")
 local matcher = geodata.BuildIPMatcher("127.0.0.0/8")
 assert(matcher.Match == matcher.match and matcher.AnyMatch == matcher.anyMatch)
 assert(matcher.Matches == matcher.matches and matcher.FilterIPs == matcher.filterIPs)
-assert(matcher.Reload == nil and matcher.reload == nil)
 assert(matcher:match(ip))
 assert(matcher:anyMatch({ip}) and matcher:matches({ip}))
 assert(not matcher:AnyMatch(nil))
@@ -98,11 +97,6 @@ assert(matcher.missing == nil)
 
 local domain = geodata.BuildDomainMatcher("full:example.com")
 assert(domain.Match == domain.match and domain.MatchAny == domain.matchAny)
-assert(domain.Reload == nil and domain.reload == nil)
-for _, value in ipairs({matcher, domain}) do
-    assert(not pcall(function() return -value end))
-    assert(not pcall(function() return value ^ {} end))
-end
 assert(domain:matchAny("example.com"))
 assert(#domain:Match("example.com") == 1)
 assert(domain:match("example.com")[1] == 0)

common/geodata/rule_parser_test.go

@@ -11,7 +11,7 @@ func TestParseIPRules(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
 	rules := []string{
-		"geoip:ru",
+		"geoip:us",
 		"geoip:cn",
 		"!geoip:cn",
 		"!!geoip:cn",
@@ -20,9 +20,9 @@ func TestParseIPRules(t *testing.T) {
 		"!geoip:!cn",
 		"ext:geoip.dat:!cn",
 		"ext:geoip.dat:!!cn",
-		"ext:geoip.dat:ir",
+		"ext:geoip.dat:ca",
 		"ext-ip:geoip.dat:!cn",
-		"ext-ip:geoip.dat:!ir",
+		"ext-ip:geoip.dat:!ca",
 		"192.168.0.0/24",
 		"!192.168.0.0/24",
 		"!!192.168.0.0/24",

common/log/log.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/log/log.proto
 
 package log

common/lua/geodata_security_watchdog_test.go

@@ -1,19 +0,0 @@
-// DO NOT EDIT. Regression test for app/geodata's luaGuardHeader.
-
-package lua
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/yuin/gopher-lua/parse"
-)
-
-func TestGeodataLuaGuard(t *testing.T) {
-	_, err := parse.Parse(strings.NewReader("\x12\x01\x00function HandleRoute() end"), "geodata")
-	var syntaxErr *parse.Error
-	if !errors.As(err, &syntaxErr) || syntaxErr.Pos.Line != 1 || syntaxErr.Pos.Column != 1 {
-		t.Fatalf("want Lua rejection at the first byte, got %v", err)
-	}
-}

common/lua/luar.go

@@ -1,9 +1,6 @@
 package lua
 
 import (
-	"net"
-	"reflect"
-
 	glua "github.com/yuin/gopher-lua"
 	luar "layeh.com/gopher-luar"
 )
@@ -12,7 +9,7 @@ import (
 // The returned function wraps slices without reflection or metatable lookup,
 // and pushes nil for nil slices. Use it with this state or its coroutines.
 func NewSlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
-	metatable := luar.MT(L, []T(nil)).LTable
+	metatable := luar.New(L, []T{}).(*glua.LUserData).Metatable
 	return func(L *glua.LState, values []T) {
 		if values == nil {
 			L.Push(glua.LNil)
@@ -25,105 +22,21 @@ func NewSlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
 	}
 }
 
-// NewReadOnlySlicePusher borrows slices without copying and recursively makes
-// nested slice types read-only through their shared metatables. IP byte views
-// and masks are also read-only. Other referenced elements retain their mutability.
-// Element bindings are initialized on first indexing or iteration.
-func NewReadOnlySlicePusher[T any](L *glua.LState) func(*glua.LState, []T) {
-	sliceMetatable := luar.MT(L, []T{})
-	if sliceMetatable.RawGetString("__readonly") != glua.LTrue {
-		readOnly := L.NewFunction(func(L *glua.LState) int {
-			L.RaiseError("slice is read-only")
-			return 0
-		})
-		setSliceReadOnly[[]T](L, readOnly)
-	}
-	return NewSlicePusher[T](L)
-}
-
-func setSliceReadOnly[S ~[]E, E any](L *glua.LState, readOnly *glua.LFunction) {
-	var visit func(reflect.Type)
-	visit = func(typ reflect.Type) {
-		if typ.Kind() != reflect.Slice {
-			return
-		}
-		metatable := luar.MT(L, reflect.Zero(typ).Interface())
-		if metatable.RawGetString("__readonly") == glua.LTrue {
-			return
-		}
-		// Mark before descending because named slice types can be recursive.
-		metatable.RawSetString("__readonly", glua.LTrue)
-		metatable.RawSetString("__newindex", readOnly)
-		// Reject explicitly so Lua cannot fall back to the other operand.
-		metatable.RawSetString("__add", readOnly)
-		if typ == reflect.TypeFor[net.IP]() {
-			// A nil receiver lets AppendText return its argument as a writable []byte.
-			methods := metatable.RawGetString("methods").(*glua.LTable)
-			appendText := methods.RawGetString("AppendText")
-			for key, method := methods.Next(glua.LNil); key != glua.LNil; key, method = methods.Next(key) {
-				if method == appendText {
-					methods.RawSet(key, glua.LNil)
-				}
-			}
-			visit(reflect.TypeFor[net.IPMask]())
-		}
-		if element := typ.Elem(); element.Kind() == reflect.Slice {
-			index := metatable.RawGetString("__index").(*glua.LFunction)
-			call := metatable.RawGetString("__call").(*glua.LFunction)
-			initialize := func() {
-				visit(element)
-				metatable.RawSetString("__index", index)
-				metatable.RawSetString("__call", call)
-			}
-			metatable.RawSetString("__index", L.NewFunction(func(L *glua.LState) int {
-				initialize()
-				return index.GFunction(L)
-			}))
-			metatable.RawSetString("__call", L.NewFunction(func(L *glua.LState) int {
-				initialize()
-				return call.GFunction(L)
-			}))
-		}
-	}
-	visit(reflect.TypeFor[S]())
-}
-
 // DirectMethod handles a Lua call without luar's reflected method invocation.
 // It returns the result count and whether it handled the arguments. On false,
 // it must leave the stack unchanged for the original luar wrapper.
 type DirectMethod func(L *glua.LState) (nresults int, handled bool)
 
-// PushMethods pushes a luar userdata exposing only the named Go methods and
-// their aliases through reflected calls. The method list is fixed by the first
-// binding of that Go type in each LState.
-func PushMethods(L *glua.LState, value any, methods ...string) {
-	PushWithDirectMethods(L, value, nil, methods...)
-}
-
 // PushWithDirectMethods pushes a luar userdata with typed Go method bindings.
 // Handled calls bypass luar's argument conversion and reflect.Call; method lookup
 // uses the methods table directly instead of luar's reflected __index handler.
-// Only directMethods and additionalMethods are exposed, including their aliases.
-// Bindings and their closures are installed once per Go type per LState, outside
-// the method-call hot path.
-func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]DirectMethod, additionalMethods ...string) {
+// value must expose methods only. Bindings and their closures are installed once
+// per Go type per LState, outside the method-call hot path.
+func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]DirectMethod) {
 	userdata := luar.New(L, value).(*glua.LUserData)
 	metatable := userdata.Metatable.(*glua.LTable)
 	methods := metatable.RawGetString("methods").(*glua.LTable)
 	if metatable.RawGetString("__index") != methods {
-		// Keep all aliases for the explicitly exposed methods.
-		exposed := make(map[glua.LValue]bool, len(directMethods)+len(additionalMethods))
-		for name := range directMethods {
-			exposed[methods.RawGetString(name)] = true
-		}
-		for _, name := range additionalMethods {
-			exposed[methods.RawGetString(name)] = true
-		}
-		for key, method := methods.Next(glua.LNil); key != glua.LNil; key, method = methods.Next(key) {
-			if !exposed[method] {
-				methods.RawSet(key, glua.LNil)
-			}
-		}
 		for name, direct := range directMethods {
 			original := methods.RawGetString(name)
 			fn := L.NewFunction(func(L *glua.LState) int {
@@ -139,10 +52,6 @@ func PushWithDirectMethods(L *glua.LState, value any, directMethods map[string]D
 				}
 			}
 		}
-		// Pointer operations would bypass the method-only API.
-		metatable.RawSetString("__newindex", glua.LNil)
-		metatable.RawSetString("__pow", glua.LNil)
-		metatable.RawSetString("__unm", glua.LNil)
 		metatable.RawSetString("__index", methods)
 	}
 	L.Push(userdata)

common/lua/luar_test.go

@@ -2,7 +2,6 @@ package lua
 
 import (
 	"net"
-	"reflect"
 	"testing"
 
 	glua "github.com/yuin/gopher-lua"
@@ -48,188 +47,6 @@ assert(ok and result == true)
 	}
 }
 
-func TestReadOnlySlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := []int{3, 5}
-	NewReadOnlySlicePusher[int](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-assert(#values == 2 and values[1] == 3 and values[2] == 5)
-assert(not pcall(function() values[1] = 7 end))
-assert(not pcall(function() return values + 7 end))
-local sum = 0
-for _, value in values() do sum = sum + value end
-assert(sum == 8)
-`); err != nil {
-		t.Fatal(err)
-	}
-	got := L.GetGlobal("values").(*glua.LUserData).Value.([]int)
-	if &got[0] != &values[0] || values[0] != 3 || values[1] != 5 {
-		t.Fatal("read-only binding copied or modified the slice")
-	}
-}
-
-func TestReadOnlyIPSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	ips := []net.IP{{192, 0, 2, 1}, net.ParseIP("2001:db8::1")}
-	NewReadOnlySlicePusher[net.IP](L)(L, ips)
-	L.SetGlobal("ips", L.Get(-1))
-	L.Pop(1)
-	readOnly := luar.MT(L, ips).RawGetString("__newindex")
-	NewReadOnlySlicePusher[net.IP](L)
-	if luar.MT(L, ips).RawGetString("__newindex") != readOnly {
-		t.Fatal("IP metatables were initialized more than once")
-	}
-	if err := L.DoString(`
-local function readOnly(value)
-    assert(not pcall(function() value[1] = value[1] end))
-    assert(not pcall(function() return value + value[1] end))
-end
-assert(#ips == 2 and ips[1]:String() == "192.0.2.1")
-readOnly(ips)
-for _, ip in ips() do
-    readOnly(ip)
-    readOnly(ip:To16())
-    if ip:To4() then
-        readOnly(ip:To4())
-        readOnly(ip:DefaultMask())
-    end
-    assert(ip:Equal(ip:To16()) and type(ip:String()) == "string")
-    assert(ip.AppendText == nil and ip.appendText == nil)
-    local text, err = ip:MarshalText()
-    assert(not err)
-    text[1] = 88 -- Independently owned byte buffers remain writable.
-    assert(not pcall(function() return ips + text end))
-end
-`); err != nil {
-		t.Fatal(err)
-	}
-	got := L.GetGlobal("ips").(*glua.LUserData).Value.([]net.IP)
-	if &got[0] != &ips[0] || &got[0][0] != &ips[0][0] || &got[1][0] != &ips[1][0] {
-		t.Fatal("read-only binding copied the IP data")
-	}
-	for i, want := range []string{"192.0.2.1", "2001:db8::1"} {
-		if got[i].String() != want {
-			t.Fatalf("IP %d changed to %s; want %s", i, got[i], want)
-		}
-	}
-}
-
-func TestReadOnlyIPSlicePusherLazy(t *testing.T) {
-	for _, tc := range []struct{ name, access string }{
-		{"index", `local ip = ips[1]`},
-		{"iterate", `local _, ip = ips()()`},
-		{"coroutine", `local co = coroutine.create(function() return ips[1] end); local ok, ip = coroutine.resume(co); assert(ok)`},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			L := glua.NewState()
-			defer L.Close()
-			methods := 0
-			luar.GetConfig(L).MethodNames = func(_ reflect.Type, method reflect.Method) []string {
-				methods++
-				return []string{method.Name}
-			}
-			NewReadOnlySlicePusher[net.IP](L)(L, []net.IP{{192, 0, 2, 1}})
-			L.SetGlobal("ips", L.Get(-1))
-			L.Pop(1)
-			if err := L.DoString(`assert(#ips == 1); assert(not pcall(function() ips[1] = nil end))`); err != nil {
-				t.Fatal(err)
-			}
-			if methods != 0 {
-				t.Fatal("IP methods initialized without reading an element")
-			}
-			source := tc.access + `
-assert(ip:String() == "192.0.2.1" and ip.AppendText == nil)
-assert(not pcall(function() ip[1] = 0 end))
-assert(not pcall(function() ip:To4()[1] = 0 end))
-assert(not pcall(function() ip:To16()[1] = 0 end))
-assert(not pcall(function() ip:DefaultMask()[1] = 0 end))
-`
-			if err := L.DoString(source); err != nil {
-				t.Fatal(err)
-			}
-			initialized := methods
-			if initialized == 0 {
-				t.Fatal("IP access did not initialize its methods")
-			}
-			if err := L.DoString(source); err != nil {
-				t.Fatal(err)
-			}
-			if methods != initialized {
-				t.Fatal("IP methods initialized more than once")
-			}
-		})
-	}
-}
-
-func TestReadOnlyNestedSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := [][][]byte{{{3, 5}}}
-	NewReadOnlySlicePusher[[][]byte](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	ips := [][]net.IP{{{192, 0, 2, 1}}}
-	NewReadOnlySlicePusher[[]net.IP](L)(L, ips)
-	L.SetGlobal("ips", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-local function readOnly(value)
-    assert(not pcall(function() value[1] = value[1] end))
-    assert(not pcall(function() return value + value[1] end))
-end
-assert(values[1][1][1] == 3 and values[1][1][2] == 5)
-readOnly(values)
-for _, group in values() do
-    readOnly(group)
-    for _, bytes in group() do readOnly(bytes) end
-end
-readOnly(ips)
-readOnly(ips[1])
-local ip = ips[1][1]
-assert(ip:String() == "192.0.2.1")
-readOnly(ip)
-readOnly(ip:To4())
-readOnly(ip:To16())
-readOnly(ip:DefaultMask())
-assert(ip.AppendText == nil and ip.appendText == nil)
-`); err != nil {
-		t.Fatal(err)
-	}
-	readOnly := luar.MT(L, ips[0]).RawGetString("__newindex")
-	NewReadOnlySlicePusher[net.IP](L)
-	if luar.MT(L, ips[0]).RawGetString("__newindex") != readOnly {
-		t.Fatal("nested slice metatable was initialized again")
-	}
-	got := L.GetGlobal("values").(*glua.LUserData).Value.([][][]byte)
-	if &got[0][0][0] != &values[0][0][0] || values[0][0][0] != 3 || values[0][0][1] != 5 {
-		t.Fatal("read-only binding copied or modified the nested slice")
-	}
-}
-
-type recursiveReadOnlySlice []recursiveReadOnlySlice
-
-func TestReadOnlyRecursiveSlicePusher(t *testing.T) {
-	L := glua.NewState()
-	defer L.Close()
-	values := make(recursiveReadOnlySlice, 1)
-	values[0] = values
-	NewReadOnlySlicePusher[recursiveReadOnlySlice](L)(L, values)
-	L.SetGlobal("values", L.Get(-1))
-	L.Pop(1)
-	if err := L.DoString(`
-local nested = values[1][1][1]
-assert(#nested == 1)
-assert(not pcall(function() nested[1] = nested end))
-assert(not pcall(function() return nested + nested end))
-`); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestSlicePusherMetatablePerState(t *testing.T) {
 	first := glua.NewState()
 	defer first.Close()

common/lua/privileged.go

@@ -1,117 +0,0 @@
-package lua
-
-import (
-	"bytes"
-	"crypto/ed25519"
-	"crypto/sha256"
-	"encoding/base64"
-	"sync"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-var privilegedKey struct {
-	sync.Once
-	publicKey ed25519.PublicKey
-}
-
-// SetPrivilegedPublicKey configures the trusted Ed25519 public key once at
-// startup, before compiling scripts. An empty value disables authorization.
-// Nonempty values must be unpadded Base64URL encodings of exactly 32 bytes.
-func SetPrivilegedPublicKey(value string) error {
-	var publicKey ed25519.PublicKey
-	if value != "" {
-		decoded, err := decodePrivilegedValue(value, ed25519.PublicKeySize)
-		if err != nil {
-			return errors.New("invalid Lua privileged public key").Base(err)
-		}
-		publicKey = ed25519.PublicKey(decoded)
-	}
-	privilegedKey.Do(func() {
-		privilegedKey.publicKey = publicKey
-	})
-	return nil
-}
-
-func decodePrivilegedValue(value string, size int) ([]byte, error) {
-	encoding := base64.RawURLEncoding.Strict()
-	if len(value) != encoding.EncodedLen(size) {
-		return nil, errors.New("expected an unpadded Base64URL encoding of ", size, " bytes")
-	}
-	decoded, err := encoding.DecodeString(value)
-	if err != nil || len(decoded) != size || encoding.EncodeToString(decoded) != value {
-		return nil, errors.New("expected an unpadded Base64URL encoding of ", size, " bytes")
-	}
-	return decoded, nil
-}
-
-func verifyPrivilegedSignature(code []byte) (bool, error) {
-	_, end, value, found := privilegedSignatureLine(code)
-	if !found {
-		return false, nil
-	}
-
-	publicKey := privilegedKey.publicKey
-	if len(publicKey) == 0 {
-		return false, errors.New("Lua privileged signature requires --lua-privileged-pubkey")
-	}
-	signature, err := decodePrivilegedValue(string(bytes.TrimSpace(value)), ed25519.SignatureSize)
-	if err != nil {
-		return false, errors.New("invalid Lua privileged signature").Base(err)
-	}
-	digest := sha256.Sum256(bytes.TrimSpace(code[end:]))
-	if !ed25519.Verify(publicKey, digest[:], signature) {
-		return false, errors.New("Lua privileged signature verification failed")
-	}
-	return true, nil
-}
-
-// SignPrivilegedScript signs the script body, then prepends or replaces the signature line.
-func SignPrivilegedScript(code []byte, seed string) ([]byte, error) {
-	decoded, err := decodePrivilegedValue(seed, ed25519.SeedSize)
-	if err != nil {
-		return nil, errors.New("invalid Ed25519 private key seed").Base(err)
-	}
-
-	start, end, _, found := privilegedSignatureLine(code)
-	body := code
-	if found {
-		body = code[end:]
-	}
-
-	digest := sha256.Sum256(bytes.TrimSpace(body))
-	signature := ed25519.Sign(ed25519.NewKeyFromSeed(decoded), digest[:])
-	header := []byte("-- @xray:privileged-signature=" + base64.RawURLEncoding.EncodeToString(signature))
-
-	if !found {
-		if newline := bytes.IndexByte(code, '\n'); newline > 0 && code[newline-1] == '\r' {
-			header = append(header, '\r')
-		}
-		header = append(header, '\n')
-		return append(header, code...), nil
-	}
-	signed := make([]byte, 0, start+len(header)+len(code)-end)
-	signed = append(signed, code[:start]...)
-	signed = append(signed, header...)
-	return append(signed, code[end:]...), nil
-}
-
-func privilegedSignatureLine(code []byte) (start, end int, value []byte, found bool) {
-	for rest := code; len(rest) != 0; {
-		start = len(code) - len(rest)
-		var line []byte
-		line, rest, _ = bytes.Cut(rest, []byte{'\n'})
-		line = bytes.TrimSuffix(line, []byte{'\r'})
-		if len(bytes.TrimSpace(line)) == 0 {
-			continue
-		}
-		end = start + len(line)
-		line, found := bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("--"))
-		if !found {
-			return 0, 0, nil, false
-		}
-		value, found = bytes.CutPrefix(bytes.TrimLeft(line, " \t"), []byte("@xray:privileged-signature="))
-		return start, end, value, found
-	}
-	return 0, 0, nil, false
-}

common/lua/privileged_sign_test.go

@@ -1,85 +0,0 @@
-package lua
-
-// TODO: Re-enable these tests and their helper when Compile supports privileged signature authorization again.
-/*
-import (
-	"bytes"
-	"crypto/ed25519"
-	"encoding/base64"
-	"encoding/hex"
-	"strings"
-	"testing"
-)
-
-func privilegedSeed(t *testing.T) string {
-	t.Helper()
-	seed, err := hex.DecodeString(privilegedTestSeed)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return base64.RawURLEncoding.EncodeToString(seed)
-}
-
-func TestSignPrivilegedScriptPreservesSource(t *testing.T) {
-	setTestPrivilegedPublicKey(t, privilegedTestPublicKey)
-	seed := privilegedSeed(t)
-	for _, tc := range []struct {
-		name, prefix, header, body, newline string
-	}{
-		{name: "unsigned", body: privilegedFixtureBody, newline: "\n"},
-		{name: "unsigned boundary whitespace", body: " \t\n\n" + privilegedFixtureBody + " \t\n", newline: "\n"},
-		{name: "unsigned CRLF", body: strings.ReplaceAll(privilegedFixtureBody, "\n", "\r\n"), newline: "\r\n"},
-		{name: "replace invalid header", header: privilegedSignatureHeader + "%", body: "\n" + privilegedFixtureBody, newline: "\n"},
-		{name: "replace indented header", prefix: " \t\r\n\n", header: " \t--\t @xray:privileged-signature=% \t", body: "\r\n \t\r\n" + privilegedFixtureBody + "\r\n", newline: "\r\n"},
-		{name: "replace valid header", header: privilegedSignatureHeader + privilegedFixtureSignature, body: "\n" + privilegedFixtureBody, newline: "\n"},
-		{name: "empty script", newline: "\n"},
-		{name: "header without newline", header: privilegedSignatureHeader + "%"},
-		{name: "ordinary comment before marker", body: "-- ordinary comment\n" + privilegedSignatureHeader + "%\nvalue = 1", newline: "\n"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			code := []byte(tc.prefix + tc.header + tc.body)
-			original := bytes.Clone(code)
-			signed, err := SignPrivilegedScript(code, seed)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if !bytes.Equal(code, original) {
-				t.Fatal("signing modified the input buffer")
-			}
-			body := tc.body
-			if tc.header != "" {
-				body = strings.TrimPrefix(body, tc.newline)
-			}
-			header := privilegedSignatureHeader + testSignature(t, body)
-			want := header + tc.newline + tc.body
-			if tc.header != "" {
-				want = tc.prefix + header + tc.body
-			}
-			if string(signed) != want {
-				t.Fatalf("signed source = %q, want %q", signed, want)
-			}
-			program, err := Compile(writeTestScript(t, string(signed)))
-			if err != nil || program == nil || !program.privileged {
-				t.Fatalf("signed source Compile = %v, %v; want privileged program", program, err)
-			}
-			again, err := SignPrivilegedScript(signed, seed)
-			if err != nil || !bytes.Equal(again, signed) {
-				t.Fatalf("resigning changed the source: %q, %v", again, err)
-			}
-		})
-	}
-}
-
-func TestSignPrivilegedScriptRejectsInvalidSeed(t *testing.T) {
-	seed := privilegedSeed(t)
-	for _, value := range []string{
-		"", "%", seed + "=",
-		base64.RawURLEncoding.EncodeToString(make([]byte, ed25519.SeedSize-1)),
-		base64.RawURLEncoding.EncodeToString(make([]byte, ed25519.PrivateKeySize)),
-	} {
-		if signed, err := SignPrivilegedScript([]byte(privilegedFixtureBody), value); signed != nil || err == nil {
-			t.Fatalf("SignPrivilegedScript with invalid seed = %q, %v; want rejection", signed, err)
-		}
-	}
-}
-*/

common/lua/program.go

@@ -1,80 +1,47 @@
 package lua
 
 import (
-	"bytes"
+	"bufio"
 	"context"
-	"fmt"
 	"os"
-	"regexp"
-	"strings"
 	"time"
 
-	"github.com/xtls/xray-core/common/base64"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	glua "github.com/yuin/gopher-lua"
 	"github.com/yuin/gopher-lua/parse"
 )
 
 // Program holds immutable bytecode that can be run by independent LStates.
 type Program struct {
-	proto      *glua.FunctionProto
-	privileged bool
+	proto *glua.FunctionProto
 }
 
 // LStateFactory returns a fully initialized state or nil and an error.
 // Implementations must close partial states on failure; callers own successful states.
 type LStateFactory func(context.Context) (*glua.LState, error)
 
-// Compile reads a Lua file or decodes an inline script and compiles it into an immutable program.
-func Compile(script string) (*Program, error) {
-	var code []byte
-	var err error
-	name := "[inline]"
-	privileged := false
-	if strings.HasPrefix(script, base64.GzipPrefix) || strings.HasPrefix(script, base64.Prefix) {
-		// TODO: Restore inline script support and re-enable the related tests.
-		return nil, errors.New("currently unavailable")
-		code, err = base64.Decode(script)
-	} else if name, err = filesystem.ResolveLuaFile(script); err == nil {
-		code, err = os.ReadFile(name)
-		// TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries.
-		// if err == nil {
-		// 	privileged, err = verifyPrivilegedSignature(code)
-		// }
-	}
+// CompileFile reads and compiles a Lua file once.
+func CompileFile(path string) (*Program, error) {
+	f, err := os.Open(path)
 	if err != nil {
 		return nil, err
 	}
-
-	chunk, err := parse.Parse(bytes.NewReader(code), name)
+	defer f.Close()
+	chunk, err := parse.Parse(bufio.NewReader(f), path)
 	if err != nil {
 		return nil, err
 	}
-	proto, err := glua.Compile(chunk, name)
+	proto, err := glua.Compile(chunk, path)
 	if err != nil {
 		return nil, err
 	}
-	return &Program{proto: proto, privileged: privileged}, nil
+	return &Program{proto: proto}, nil
 }
 
 // NewState creates a state, runs register, executes the program under ctx, and
 // runs validate. It removes the initialization context before returning a state
 // owned by the caller.
-// Choose registrySize for the script type's expected stack usage, balancing
-// per-state memory usage against the number of states retained in a pool.
-func (p *Program) NewState(ctx context.Context, registrySize int, register func(*glua.LState), validate func(*glua.LState) error) (*glua.LState, error) {
-	options := glua.Options{
-		RegistrySize:     registrySize,
-		RegistryMaxSize:  glua.RegistrySize,
-		RegistryGrowStep: registrySize,
-	}
-	var L *glua.LState
-	if p.privileged {
-		L = glua.NewState(options)
-	} else {
-		L = newSandboxedState(options)
-	}
+func (p *Program) NewState(ctx context.Context, register func(*glua.LState), validate func(*glua.LState) error) (*glua.LState, error) {
+	L := glua.NewState()
 	valid := false
 	defer func() {
 		if !valid {
@@ -86,10 +53,6 @@ func (p *Program) NewState(ctx context.Context, registrySize int, register func(
 	if register != nil {
 		register(L)
 	}
-	if !p.privileged {
-		// Hide package internals to prevent data snooping and sandbox escape.
-		L.SetGlobal(glua.LoadLibName, glua.LNil)
-	}
 	L.Push(L.NewFunctionFromProto(p.proto))
 	// Execute the Lua script's top level.
 	if err := L.PCall(0, 0, nil); err != nil {
@@ -104,157 +67,11 @@ func (p *Program) NewState(ctx context.Context, registrySize int, register func(
 	return L, nil
 }
 
-func newSandboxedState(options glua.Options) *glua.LState {
-	options.SkipOpenLibs = true
-	L := glua.NewState(options)
-
-	for _, lib := range []struct {
-		name string
-		open glua.LGFunction
-	}{
-		{glua.LoadLibName, glua.OpenPackage},
-		{glua.BaseLibName, glua.OpenBase},
-		{glua.TabLibName, glua.OpenTable},
-		{glua.StringLibName, glua.OpenString},
-		{glua.MathLibName, glua.OpenMath},
-		{glua.OsLibName, glua.OpenOs},
-	} {
-		L.Push(L.NewFunction(lib.open))
-		L.Push(glua.LString(lib.name))
-		L.Call(1, 0)
-	}
-
-	for _, name := range []string{
-		"dofile", "loadfile", "load", "loadstring", "getfenv", "setfenv",
-		"getmetatable", "setmetatable", "rawget", "rawset",
-		"collectgarbage", "module", "newproxy", "print", "_printregs",
-	} {
-		L.SetGlobal(name, glua.LNil)
-	}
-
-	// Prevent printing memory addresses that reveal the memory layout.
-	toString := func(value glua.LValue) glua.LString {
-		result := "<opaque>"
-		switch value.Type() {
-		case glua.LTNil, glua.LTBool, glua.LTNumber, glua.LTString:
-			result = value.String()
-		case glua.LTUserData:
-			switch native := value.(*glua.LUserData).Value.(type) {
-			case error: // Errors can also implement fmt.Stringer; redact them first.
-				result = redactMemoryAddresses(native.Error())
-			case fmt.Stringer:
-				result = native.String()
-			}
-		}
-		return glua.LString(result)
-	}
-	L.SetGlobal("tostring", L.NewFunction(func(L *glua.LState) int {
-		L.Push(toString(L.CheckAny(1)))
-		return 1
-	}))
-
-	// Prevent printing memory addresses that reveal the memory layout.
-	stringLib := L.GetGlobal(glua.StringLibName).(*glua.LTable)
-	stringLib.RawSetString("dump", glua.LNil)
-	format := stringLib.RawGetString("format")
-	stringLib.RawSetString("format", L.NewFunction(func(L *glua.LState) int {
-		nargs := L.GetTop()
-		for i := 2; i <= nargs; i++ {
-			value := L.Get(i)
-			switch value.Type() {
-			case glua.LTBool, glua.LTNumber, glua.LTString:
-				continue
-			}
-			L.Replace(i, toString(value))
-		}
-		L.Insert(format, 1)
-		L.Call(nargs, 1)
-		return 1
-	}))
-
-	// Redact addresses before caught errors become readable by the script.
-	redactError := func(value glua.LValue) glua.LValue {
-		if message, ok := value.(glua.LString); ok {
-			if redacted := redactMemoryAddresses(string(message)); redacted != string(message) {
-				return glua.LString(redacted)
-			}
-		}
-		return value
-	}
-	for _, name := range []string{"pcall", "xpcall"} {
-		call := L.GetGlobal(name)
-		L.SetGlobal(name, L.NewFunction(func(L *glua.LState) int {
-			nargs := L.GetTop()
-			if name == "xpcall" {
-				L.CheckFunction(1)
-				handler := L.CheckFunction(2)
-				L.Replace(2, L.NewFunction(func(L *glua.LState) int {
-					L.Replace(1, redactError(L.Get(1)))
-					L.Insert(handler, 1)
-					L.Call(1, 1)
-					return 1
-				}))
-			}
-			L.Insert(call, 1)
-			L.Call(nargs, glua.MultRet)
-			if L.Get(1) == glua.LFalse {
-				L.Replace(2, redactError(L.Get(2)))
-			}
-			return L.GetTop()
-		}))
-	}
-
-	// Prevent seed output from compromising cryptographic security.
-	L.GetGlobal(glua.MathLibName).(*glua.LTable).RawSetString("randomseed", glua.LNil)
-
-	// Keep only time functions, including when os is accessed through require.
-	osLib := L.GetGlobal(glua.OsLibName).(*glua.LTable)
-	for key, _ := osLib.Next(glua.LNil); key != glua.LNil; key, _ = osLib.Next(key) {
-		switch key {
-		case glua.LString("clock"), glua.LString("date"), glua.LString("difftime"), glua.LString("time"):
-		default:
-			osLib.RawSet(key, glua.LNil)
-		}
-	}
-
-	// Prevent module injection through the global package table.
-	module := L.GetGlobal(glua.LoadLibName).(*glua.LTable)
-	preload := module.RawGetString("preload").(*glua.LTable)
-	loaders := L.CreateTable(1, 0)
-	loaders.RawSetInt(1, L.NewFunction(func(L *glua.LState) int {
-		name := L.CheckString(1)
-		loader := preload.RawGetString(name)
-		if loader == glua.LNil {
-			loader = glua.LString("no preloaded module: " + name)
-		}
-		L.Push(loader)
-		return 1
-	}))
-	module.RawSetString("loaders", loaders)
-	L.SetField(L.Get(glua.RegistryIndex), "_LOADERS", loaders)
-	for _, name := range []string{"loadlib", "seeall", "path", "cpath", "config"} {
-		module.RawSetString(name, glua.LNil)
-	}
-
-	return L
-}
-
-var memoryAddressPattern = regexp.MustCompile(`0[xX][0-9a-fA-F]+`)
-
-func redactMemoryAddresses(message string) string {
-	if !strings.Contains(message, "0x") && !strings.Contains(message, "0X") {
-		return message
-	}
-	return memoryAddressPattern.ReplaceAllString(message, "<address>")
-}
-
 // NewStateFactory returns a factory that gives each state an initialization timeout.
-// Choose registrySize for the script type's expected stack usage, balancing
-// per-state memory usage against the number of states retained in a pool.
-func (p *Program) NewStateFactory(initTimeout time.Duration, registrySize int, register func(*glua.LState), validate func(*glua.LState) error) LStateFactory {
+func (p *Program) NewStateFactory(initTimeout time.Duration, register func(*glua.LState), validate func(*glua.LState) error) LStateFactory {
 	return func(ctx context.Context) (*glua.LState, error) {
 		initCtx, cancel := context.WithTimeout(ctx, initTimeout)
 		defer cancel()
-		return p.NewState(initCtx, registrySize, register, validate)
+		return p.NewState(initCtx, register, validate)
 	}
 }

common/net/address.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/net/address.proto
 
 package net

common/net/destination.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/net/destination.proto
 
 package net

common/net/find_process_linux.go

@@ -4,7 +4,7 @@ package net
 
 import (
 	"bufio"
-	"encoding/binary"
+	"encoding/hex"
 	"fmt"
 	"net"
 	"os"
@@ -26,38 +26,36 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 		panic("Unsupported network type for process lookup.")
 	}
 
-	var procFiles []string
+	var procFile string
 
 	switch network {
 	case "tcp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/tcp"}
+			procFile = "/proc/net/tcp"
 		} else {
-			procFiles = []string{"/proc/net/tcp6"}
+			procFile = "/proc/net/tcp6"
 		}
 	case "udp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/udp", "/proc/net/udp6"}
+			procFile = "/proc/net/udp"
 		} else {
-			procFiles = []string{"/proc/net/udp6", "/proc/net/udp"}
+			procFile = "/proc/net/udp6"
 		}
 	default:
 		panic("Unsupported network type for process lookup.")
 	}
 
-	targetHexAddr := formatProcNetAddress(net.ParseIP(srcIP), Port(srcPort))
-
-	portFallback := ""
-	if network == "udp" {
-		portFallback = fmt.Sprintf(":%04X", srcPort)
+	targetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))
+	if err != nil {
+		return 0, "", "", errors.New("failed to format address: ", err)
 	}
 
-	inode, err := findInodeInFiles(procFiles, targetHexAddr, portFallback)
+	inode, err := findInodeInFile(procFile, targetHexAddr)
 	if err != nil {
-		return 0, "", "", errors.New("could not search in ", strings.Join(procFiles, " and ")).Base(err)
+		return 0, "", "", errors.New("could not search in ", procFile).Base(err)
 	}
 	if inode == "" {
-		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", strings.Join(procFiles, " or "))
+		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", procFile)
 	}
 
 	pidStr, err := findPidByInode(inode)
@@ -84,60 +82,51 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 	return pid, procName, absPath, nil
 }
 
-func formatProcNetAddress(addr net.IP, port Port) string {
+func formatLittleEndianString(addr net.IP, port Port) (string, error) {
+	ip := addr
 	var ipBytes []byte
-	if ipv4 := addr.To4(); ipv4 != nil {
-		ipBytes = ipv4
+	if ip.To4() != nil {
+		ipBytes = ip.To4()
 	} else {
-		ipBytes = addr.To16()
+		ipBytes = ip.To16()
+	}
+	if ipBytes == nil {
+		return "", errors.New("invalid IP format for ", addr, ": ", ip)
 	}
 
-	var formatted strings.Builder
-	formatted.Grow(len(ipBytes)*2 + 5)
-	for i := 0; i < len(ipBytes); i += 4 {
-		fmt.Fprintf(&formatted, "%08X", binary.NativeEndian.Uint32(ipBytes[i:i+4]))
+	for i, j := 0, len(ipBytes)-1; i < j; i, j = i+1, j-1 {
+		ipBytes[i], ipBytes[j] = ipBytes[j], ipBytes[i]
 	}
-	fmt.Fprintf(&formatted, ":%04X", uint16(port))
-	return formatted.String()
+	portHex := fmt.Sprintf("%04X", uint16(port))
+	ipHex := strings.ToUpper(hex.EncodeToString(ipBytes))
+	return fmt.Sprintf("%s:%s", ipHex, portHex), nil
 }
 
-func findInodeInFiles(filePaths []string, targetHexAddr, portFallback string) (string, error) {
-	onlyMatchedPort := ""
+func findInodeInFile(filePath, targetHexAddr string) (string, error) {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
 
-	for i, filePath := range filePaths {
-		file, err := os.Open(filePath)
-		if err != nil {
-			if i > 0 && os.IsNotExist(err) {
-				continue
-			}
-			return "", err
+	scanner := bufio.NewScanner(file)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		fields := strings.Fields(line)
+
+		if len(fields) < 10 {
+			continue
 		}
-		defer file.Close()
 
-		scanner := bufio.NewScanner(file)
-		for scanner.Scan() {
-			fields := strings.Fields(scanner.Text())
-			if len(fields) < 10 {
-				continue
-			}
-
-			localAddress := fields[1]
-			if localAddress == targetHexAddr {
-				return fields[9], nil
-			}
-			if portFallback != "" && strings.HasSuffix(localAddress, portFallback) {
-				wildcardIP := strings.TrimSuffix(localAddress, portFallback)
-				if (len(wildcardIP) == 8 || len(wildcardIP) == 32) && strings.Trim(wildcardIP, "0") == "" {
-					onlyMatchedPort = fields[9]
-				}
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			return "", err
+		localAddress := fields[1]
+		if localAddress == targetHexAddr {
+			inode := fields[9]
+			return inode, nil
 		}
 	}
 
-	return onlyMatchedPort, nil
+	return "", scanner.Err()
 }
 
 func findPidByInode(inode string) (string, error) {

common/net/network.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/net/network.proto
 
 package net

common/net/port.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/net/port.proto
 
 package net

common/platform/filesystem/file.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -27,13 +26,25 @@ func ReadFile(path string) ([]byte, error) {
 	return buf.ReadAllToBytes(reader)
 }
 
-func OpenAsset(file string) (io.ReadCloser, int64, error) {
-	path, info, err := getAssetFileLocation(file)
+func ReadAsset(file string) ([]byte, error) {
+	path, _, err := getAssetFileLocation(file)
 	if err != nil {
-		return nil, 0, err
+		return nil, err
 	}
-	r, err := NewFileReader(path)
-	return r, info.Size(), err
+	return ReadFile(path)
+}
+
+func OpenAsset(file string) (io.ReadCloser, error) {
+	path, _, err := getAssetFileLocation(file)
+	if err != nil {
+		return nil, err
+	}
+	return NewFileReader(path)
+}
+
+func StatAsset(file string) (os.FileInfo, error) {
+	_, info, err := getAssetFileLocation(file)
+	return info, err
 }
 
 func ResolveAsset(file string) (string, error) {
@@ -67,29 +78,17 @@ func ReadCert(file string) ([]byte, error) {
 	return ReadFile(platform.GetCertLocation(file))
 }
 
-// ResolveLuaFile finds a local .lua script and returns its absolute path.
-// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
-func ResolveLuaFile(path string) (string, error) {
-	if !strings.EqualFold(filepath.Ext(path), ".lua") {
-		return "", errors.New("Lua file extension must be .lua")
+func CopyFile(dst string, src string) error {
+	bytes, err := ReadFile(src)
+	if err != nil {
+		return err
 	}
-	if filepath.IsAbs(path) {
-		return path, nil
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
 	}
-	for _, dir := range []string{
-		platform.GetConfDirPath(),
-		platform.NewEnvFlag(platform.ConfigLocation).GetValue(func() string { return "" }),
-		".",
-		platform.GetExecutableDir(),
-	} {
-		if dir != "" {
-			resolved := filepath.Join(dir, path)
-			if _, err := os.Stat(resolved); err == nil {
-				return filepath.Abs(resolved)
-			} else if !os.IsNotExist(err) {
-				return "", err
-			}
-		}
-	}
-	return "", os.ErrNotExist
+	defer f.Close()
+
+	_, err = f.Write(bytes)
+	return err
 }

common/platform/filesystem/file_test.go

@@ -1,17 +1,13 @@
 package filesystem_test
 
 import (
-	"errors"
-	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/platform"
 	. "github.com/xtls/xray-core/common/platform/filesystem"
 )
 
-func TestResolveAssetRejectsInvalidPath(t *testing.T) {
+func TestStatAssetRejectsInvalidPath(t *testing.T) {
 	for _, file := range []string{
 		"",
 		".",
@@ -29,49 +25,8 @@ func TestResolveAssetRejectsInvalidPath(t *testing.T) {
 		`nested\..\geoip.dat`,
 		filepath.Join(t.TempDir(), "geoip.dat"),
 	} {
-		if _, err := ResolveAsset(file); err == nil {
+		if _, err := StatAsset(file); err == nil {
 			t.Fatalf("expected error for %q", file)
 		}
 	}
 }
-
-func TestResolveLuaFile(t *testing.T) {
-	t.Chdir(t.TempDir())
-	workingDir, err := os.Getwd()
-	common.Must(err)
-	executable, err := os.Executable()
-	common.Must(err)
-	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
-	common.Must(err)
-	common.Must(file.Close())
-	defer os.Remove(file.Name())
-
-	name := filepath.Base(file.Name())
-	paths := []string{
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(workingDir, name),
-		file.Name(),
-	}
-	t.Setenv(platform.ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(platform.ConfigLocation, filepath.Dir(paths[1]))
-	for _, path := range paths[:3] {
-		common.Must(os.WriteFile(path, nil, 0o600))
-	}
-	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
-		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
-	}
-	for i, want := range paths {
-		if i == 2 {
-			t.Setenv(platform.ConfdirLocation, "")
-			t.Setenv(platform.ConfigLocation, "")
-		}
-		if got, err := ResolveLuaFile(name); err != nil || got != want {
-			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
-		}
-		common.Must(os.Remove(want))
-	}
-	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("missing file error = %v", err)
-	}
-}

common/platform/others.go

@@ -14,7 +14,7 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir, the executable dir, and certain locations
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	defPath := filepath.Join(assetPath, file)
 	for _, p := range []string{
 		defPath,
@@ -36,6 +36,6 @@ func GetAssetLocation(file string) string {
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/platform/platform.go

@@ -1,6 +1,8 @@
 package platform // import "github.com/xtls/xray-core/common/platform"
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -72,7 +74,7 @@ func NormalizeEnvName(name string) string {
 	return strings.ReplaceAll(strings.ToUpper(strings.TrimSpace(name)), ".", "_")
 }
 
-func GetExecutableDir() string {
+func getExecutableDir() string {
 	exec, err := os.Executable()
 	if err != nil {
 		return ""
@@ -81,7 +83,7 @@ func GetExecutableDir() string {
 }
 
 func GetConfigurationPath() string {
-	configPath := NewEnvFlag(ConfigLocation).GetValue(GetExecutableDir)
+	configPath := NewEnvFlag(ConfigLocation).GetValue(getExecutableDir)
 	return filepath.Join(configPath, "config.json")
 }
 
@@ -90,3 +92,49 @@ func GetConfDirPath() string {
 	configPath := NewEnvFlag(ConfdirLocation).GetValue(func() string { return "" })
 	return configPath
 }
+
+// ResolveLuaFile finds a local Lua script and returns its absolute path.
+// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+func ResolveLuaFile(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("Lua file path is empty")
+	}
+	paths := []string{path}
+	if !filepath.IsAbs(path) {
+		paths = nil
+		for _, dir := range []string{
+			GetConfDirPath(),
+			NewEnvFlag(ConfigLocation).GetValue(func() string { return "" }),
+			".",
+			getExecutableDir(),
+		} {
+			if dir != "" {
+				paths = append(paths, filepath.Join(dir, path))
+			}
+		}
+	}
+	return resolveFile(paths)
+}
+
+func resolveFile(paths []string) (string, error) {
+	var tried []string
+	for _, path := range paths {
+		path, err := filepath.Abs(path)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve file path: %w", err)
+		}
+		tried = append(tried, path)
+		info, err := os.Stat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return "", fmt.Errorf("failed to inspect file %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("file is not a regular file: %s", path)
+		}
+		return path, nil
+	}
+	return "", fmt.Errorf("file not found; tried %q: %w", tried, os.ErrNotExist)
+}

common/platform/platform_test.go

@@ -1,6 +1,7 @@
 package platform_test
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -64,3 +65,53 @@ func TestGetAssetLocation(t *testing.T) {
 		}
 	}
 }
+
+func TestResolveLuaFile(t *testing.T) {
+	workingDir := t.TempDir()
+	t.Chdir(workingDir)
+	executable, err := os.Executable()
+	common.Must(err)
+	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
+	common.Must(err)
+	common.Must(file.Close())
+	defer os.Remove(file.Name())
+
+	name := filepath.Base(file.Name())
+	paths := []string{
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(workingDir, name),
+		file.Name(),
+	}
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	for _, path := range paths[:3] {
+		common.Must(os.WriteFile(path, nil, 0o600))
+	}
+	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
+		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
+	}
+	for i, want := range paths {
+		if i == 2 {
+			t.Setenv(ConfdirLocation, "")
+			t.Setenv(ConfigLocation, "")
+		}
+		if got, err := ResolveLuaFile(name); err != nil || got != want {
+			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
+		}
+		common.Must(os.Remove(want))
+	}
+	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing file error = %v", err)
+	}
+
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	common.Must(os.Mkdir(paths[0], 0o700))
+	common.Must(os.WriteFile(paths[1], nil, 0o600))
+	for _, path := range []string{"", name, filepath.Join(t.TempDir(), name)} {
+		if _, err := ResolveLuaFile(path); err == nil {
+			t.Fatalf("accepted invalid path %q", path)
+		}
+	}
+}

common/platform/windows.go

@@ -11,12 +11,12 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir and the executable dir
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	return filepath.Join(assetPath, file)
 }
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/protocol/headers.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/protocol/headers.proto
 
 package protocol

common/protocol/server_spec.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/protocol/server_spec.proto
 
 package protocol

common/protocol/user.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/protocol/user.proto
 
 package protocol

common/serial/typed_message.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: common/serial/typed_message.proto
 
 package serial

core/config.go

@@ -175,13 +175,9 @@ func init() {
 			switch v := input.(type) {
 			case cmdarg.Arg:
 				r, err := confloader.LoadConfig(v[0])
-				if err != nil {
-					return nil, err
-				}
+				common.Must(err)
 				data, err := buf.ReadAllToBytes(r)
-				if err != nil {
-					return nil, err
-				}
+				common.Must(err)
 				return loadProtobufConfig(data)
 			case io.Reader:
 				data, err := buf.ReadAllToBytes(v)

core/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
-// 	protoc        (unknown)
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: core/config.proto
 
 package core

core/core.go

@@ -20,7 +20,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 10
-	Version_z byte = 29
+	Version_z byte = 10
 )
 
 var (

core/proto.go

@@ -1,3 +1,5 @@
 package core
 
+//go:generate go install -v google.golang.org/protobuf/cmd/protoc-gen-go@latest
+//go:generate go install -v google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 //go:generate go run ../infra/vprotogen/main.go -pwd ./..

features/dns/localdns/client.go

@@ -2,7 +2,6 @@ package localdns
 
 import (
 	"context"
-	"net/netip"
 	"syscall"
 	"time"
 
@@ -101,15 +100,6 @@ func New() *Client {
 			if internet.IsSkippedDNSServer(address) {
 				return nil, errors.New("skipped DNS server ", address)
 			}
-			// A socket of the server's IP version only needs that version bound
-			// to the interface, which a dual-stack one would need both of.
-			if ap, err := netip.ParseAddrPort(address); err == nil && (network == "udp" || network == "tcp") {
-				if ap.Addr().Unmap().Is4() {
-					network += "4"
-				} else {
-					network += "6"
-				}
-			}
 			return d.DialContext(ctx, network, address)
 		},
 	}

go.mod

@@ -4,36 +4,36 @@ go 1.27
 
 require (
 	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/bufbuild/protocompile v0.14.1
+	github.com/cloudflare/circl v1.6.5
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.1
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.7
-	github.com/pires/go-proxyproto v0.16.0
+	github.com/pires/go-proxyproto v0.15.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/stretchr/testify v1.12.1
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8
+	github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0
 	github.com/yuin/gopher-lua v1.1.2
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.58.0
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a
+	golang.org/x/crypto v0.57.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.61.0
-	golang.org/x/sync v0.24.0
-	golang.org/x/sys v0.49.0
+	golang.org/x/net v0.59.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.1.1
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
+	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
 	layeh.com/gopher-luar v1.0.11
 	lukechampine.com/blake3 v1.4.1
@@ -41,12 +41,13 @@ require (
 )
 
 require (
-	github.com/andybalholm/brotli v1.2.3 // indirect
+	github.com/andybalholm/brotli v1.0.6 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
 	github.com/huin/goupnp v1.2.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/juju/ratelimit v1.0.2 // indirect
-	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
 	github.com/pion/dtls/v3 v3.1.5 // indirect
@@ -56,15 +57,10 @@ require (
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.43.0 // indirect
-	golang.org/x/tools v0.51.0 // indirect
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
-)
-
-tool (
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc
-	google.golang.org/protobuf/cmd/protoc-gen-go
 )

go.sum

@@ -1,12 +1,12 @@
-github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA5NQ=
-github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
+github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8=
-github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
-github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
+github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 h1:Arcl6UOIS/kgO2nW3A65HN+7CMjSDP/gofXL4CZt1V4=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=
 github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
@@ -33,10 +33,10 @@ github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7Bd
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
-github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
-github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
-github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -61,8 +61,8 @@ github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
 github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
 github.com/pion/transport/v4 v4.1.0 h1:8S+nF2reM2cJuqC6g78OVy2BBgmbdns+acx3jA97BvQ=
 github.com/pion/transport/v4 v4.1.0/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.16.0 h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
-github.com/pires/go-proxyproto v0.16.0/go.mod h1:n7yhg8yIfNl3KgYDCwBzmeUHNpKTVnUhcWpc7rV4RW4=
+github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
+github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -81,10 +81,8 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
-github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8 h1:RjLnVvlzK4q6zWaSBPNRGsrgx2fbJDeUWffjw574uzs=
-github.com/xtls/reality v0.0.0-20261014101318-83f621788ca8/go.mod h1:ptlSkJ8k/7IDauNH0SA96JPOo+nYGLTv2Y3UMpwvAsY=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0 h1:rb+fKQFhz+5I2PPuQsNYxI5mUU840XWYtRF0ZBjvkws=
+github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=
 github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
@@ -97,10 +95,10 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
-golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582 h1:wjDBrGbfLuifgrVLFEWUBJYAfh5Q1wkMc5t0FY0tCbs=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -109,12 +107,12 @@ golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
-golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -123,22 +121,22 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
-golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -154,8 +152,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
 google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/dns.go

@@ -14,6 +14,7 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/platform"
 )
 
 type NameServerConfig struct {
@@ -272,17 +273,6 @@ func (m *HostsWrapper) Build() ([]*dns.Config_HostMapping, error) {
 
 // Build implements Buildable
 func (c *DNSConfig) Build() (*dns.Config, error) {
-	if c.Script != "" {
-		if c.DisableFallback || c.DisableFallbackIfMatch || c.EnableParallelQuery {
-			return nil, errors.New("DNS script cannot be used with disableFallback, disableFallbackIfMatch or enableParallelQuery")
-		}
-		for i, server := range c.Servers {
-			if len(server.Domains) > 0 || server.SkipFallback || server.FinalQuery {
-				return nil, errors.New("DNS script cannot be used with domains, skipFallback or finalQuery in server ", i)
-			}
-		}
-	}
-
 	config := &dns.Config{
 		Tag:                    c.Tag,
 		DisableCache:           c.DisableCache,
@@ -292,7 +282,14 @@ func (c *DNSConfig) Build() (*dns.Config, error) {
 		DisableFallbackIfMatch: c.DisableFallbackIfMatch,
 		EnableParallelQuery:    c.EnableParallelQuery,
 		QueryStrategy:          resolveQueryStrategy(c.QueryStrategy),
-		Script:                 c.Script,
+	}
+
+	if c.Script != "" {
+		path, err := platform.ResolveLuaFile(c.Script)
+		if err != nil {
+			return nil, errors.New("failed to resolve DNS script: ", c.Script).Base(err)
+		}
+		config.Script = path
 	}
 
 	if c.ClientIP != nil {

infra/conf/dns_test.go

@@ -2,7 +2,8 @@ package conf_test
 
 import (
 	"encoding/json"
-	"strings"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -124,7 +125,41 @@ func TestDNSConfigParsing(t *testing.T) {
 	}
 }
 
-func TestDNSNameServerID(t *testing.T) {
+func TestDNSScriptConfig(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("xray.location.confdir", dir)
+	path := filepath.Join(dir, "lookup.lua")
+	if err := os.WriteFile(path, []byte("function HandleDNSQuery(domain, ipv4, ipv6, fake) end"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
+		name      string
+		script    string
+		wantError bool
+	}{
+		{"relative", "lookup.lua", false},
+		{"absolute", path, false},
+		{"missing", "missing.lua", true},
+		{"directory", dir, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			built, err := (&DNSConfig{Script: tc.script}).Build()
+			if tc.wantError {
+				if err == nil {
+					t.Fatal("Build accepted an invalid script path")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if built.Script != path {
+				t.Fatalf("script path = %q, want %q", built.Script, path)
+			}
+		})
+	}
+
 	var parsed DNSConfig
 	if err := json.Unmarshal([]byte(`{"servers":[{"id":"primary","address":"1.1.1.1"}]}`), &parsed); err != nil {
 		t.Fatal(err)
@@ -137,43 +172,3 @@ func TestDNSNameServerID(t *testing.T) {
 		t.Fatalf("nameserver IDs = %v, want primary", built.NameServer)
 	}
 }
-
-func TestDNSScriptConfig(t *testing.T) {
-	for _, test := range []struct {
-		name      string
-		input     string
-		wantError string
-	}{
-		{name: "script only", input: `{"script":"script.lua"}`},
-		{name: "compatible fields", input: `{"script":"script.lua","servers":["1.1.1.1",{"id":"primary","address":"8.8.8.8","expectedIPs":["8.8.8.8"],"queryStrategy":"UseIPv4","disableCache":true}],"hosts":{"example.com":"127.0.0.1"},"disableCache":true}`},
-		{name: "disabled options", input: `{"script":"script.lua","disableFallback":false,"disableFallbackIfMatch":false,"enableParallelQuery":false,"servers":[{"address":"1.1.1.1","domains":[],"skipFallback":false,"finalQuery":false}]}`},
-		{name: "domains", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","domains":["domain:example.com"]}]}`, wantError: "domains"},
-		{name: "skip fallback", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","skipFallback":true}]}`, wantError: "skipFallback"},
-		{name: "final query", input: `{"script":"script.lua","servers":[{"address":"1.1.1.1","finalQuery":true}]}`, wantError: "finalQuery"},
-		{name: "later server", input: `{"script":"script.lua","servers":["1.1.1.1",{"address":"8.8.8.8","finalQuery":true}]}`, wantError: "server 1"},
-		{name: "disable fallback", input: `{"script":"script.lua","disableFallback":true}`, wantError: "disableFallback"},
-		{name: "disable fallback if match", input: `{"script":"script.lua","disableFallbackIfMatch":true}`, wantError: "disableFallbackIfMatch"},
-		{name: "parallel query", input: `{"script":"script.lua","enableParallelQuery":true}`, wantError: "enableParallelQuery"},
-		{name: "empty script", input: `{"script":"","disableFallback":true,"disableFallbackIfMatch":true,"enableParallelQuery":true,"servers":[{"address":"1.1.1.1","domains":["example.com"],"skipFallback":true,"finalQuery":true}]}`},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var config DNSConfig
-			if err := json.Unmarshal([]byte(test.input), &config); err != nil {
-				t.Fatal(err)
-			}
-			built, err := config.Build()
-			if test.wantError != "" {
-				if built != nil || err == nil || !strings.Contains(err.Error(), "DNS script cannot be used with ") || !strings.Contains(err.Error(), test.wantError) {
-					t.Fatalf("Build() = %v, %v; want nil config and script conflict error mentioning %s", built, err, test.wantError)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if built.Script != config.Script || len(built.NameServer) != len(config.Servers) {
-				t.Fatalf("Build() did not preserve script or servers: %v", built)
-			}
-		})
-	}
-}

infra/conf/freedom.go

@@ -91,7 +91,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Fragment != nil {
-		errors.PrintDeprecatedFeatureWarning(`"fragment" in Freedom`, `"fragment" in "streamSettings.finalmask.tcp"`)
 		config.Fragment = new(freedom.Fragment)
 
 		switch strings.ToLower(c.Fragment.Packets) {
@@ -148,7 +147,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Noises != nil {
-		errors.PrintDeprecatedFeatureWarning(`"noises" in Freedom`, `"noise" in "streamSettings.finalmask.udp"`)
 		for _, n := range c.Noises {
 			NConfig, err := ParseNoise(n)
 			if err != nil {

infra/conf/geodata.go

@@ -6,6 +6,7 @@ import (
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/app/geodata"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -18,6 +19,9 @@ func (c *GeodataAssetConfig) Build() (*geodata.Asset, error) {
 	if err := validateHTTPS(c.URL); err != nil {
 		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
 	}
+	if _, err := filesystem.StatAsset(c.File); err != nil {
+		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
+	}
 	return &geodata.Asset{
 		Url:  c.URL,
 		File: c.File,

infra/conf/geodata_test.go

@@ -1,6 +1,7 @@
 package conf_test
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/xtls/xray-core/app/geodata"
@@ -8,6 +9,8 @@ import (
 )
 
 func TestGeodataConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	creator := func() Buildable {
 		return new(GeodataConfig)
 	}
@@ -35,7 +38,27 @@ func TestGeodataConfig(t *testing.T) {
 	})
 }
 
+func TestGeodataAssetConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "geoip.dat",
+	}).Build(); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "missing.dat",
+	}).Build(); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
 func TestGeodataAssetConfigInvalidURL(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	for _, rawURL := range []string{
 		"",
 		"http://example.com/geoip.dat",

infra/conf/masque_test.go

@@ -16,61 +16,8 @@ import (
 	. "github.com/xtls/xray-core/infra/conf"
 	masqueproxy "github.com/xtls/xray-core/proxy/masque"
 	"github.com/xtls/xray-core/transport/internet/masque"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
 )
 
-func defaultMasqueXmux() *splithttp.XmuxConfig {
-	return &splithttp.XmuxConfig{
-		MaxConcurrency:   &splithttp.RangeConfig{},
-		MaxConnections:   &splithttp.RangeConfig{From: 1, To: 1},
-		CMaxReuseTimes:   &splithttp.RangeConfig{},
-		HMaxRequestTimes: &splithttp.RangeConfig{},
-		HMaxReusableSecs: &splithttp.RangeConfig{From: 1800, To: 3000},
-	}
-}
-
-func TestMasqueXmuxConfig(t *testing.T) {
-	creator := func() Buildable {
-		return new(MasqueConfig)
-	}
-
-	runMultiTestCase(t, []TestCase{
-		{
-			Input:  `{"xmux": {"maxConnections": "2-4", "hMaxReusableSecs": 60, "hKeepAlivePeriod": -1}}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{
-				Path: "/.well-known/masque/ip/*/*/",
-				Xmux: &splithttp.XmuxConfig{
-					MaxConcurrency:   &splithttp.RangeConfig{},
-					MaxConnections:   &splithttp.RangeConfig{From: 2, To: 4},
-					CMaxReuseTimes:   &splithttp.RangeConfig{},
-					HMaxRequestTimes: &splithttp.RangeConfig{},
-					HMaxReusableSecs: &splithttp.RangeConfig{From: 60, To: 60},
-					HKeepAlivePeriod: -1,
-				},
-			},
-		},
-		{
-			Input:  `{"xmux": {"maxConcurrency": 8}}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{
-				Path: "/.well-known/masque/ip/*/*/",
-				Xmux: &splithttp.XmuxConfig{
-					MaxConcurrency:   &splithttp.RangeConfig{From: 8, To: 8},
-					MaxConnections:   &splithttp.RangeConfig{},
-					CMaxReuseTimes:   &splithttp.RangeConfig{},
-					HMaxRequestTimes: &splithttp.RangeConfig{},
-					HMaxReusableSecs: &splithttp.RangeConfig{},
-				},
-			},
-		},
-	})
-
-	if _, err := loadJSON(creator)(`{"xmux": {"maxConnections": 2, "maxConcurrency": 8}}`); err == nil {
-		t.Error("expected an error for maxConnections with maxConcurrency")
-	}
-}
-
 func TestMasqueConfig(t *testing.T) {
 	creator := func() Buildable {
 		return new(MasqueConfig)
@@ -80,7 +27,7 @@ func TestMasqueConfig(t *testing.T) {
 		{
 			Input:  `{}`,
 			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/.well-known/masque/ip/*/*/", Xmux: defaultMasqueXmux()},
+			Output: &masque.Config{Path: "/.well-known/masque/ip/*/*/"},
 		},
 		{
 			Input: `{
@@ -93,13 +40,12 @@ func TestMasqueConfig(t *testing.T) {
 				Host:    "example.com:8443",
 				Path:    "/.well-known/masque/ip/*/*/",
 				Headers: map[string]string{"Authorization": "Basic dTpw"},
-				Xmux:    defaultMasqueXmux(),
 			},
 		},
 		{
 			Input:  `{"path": "/masque/ip{?target,ipproto}"}`,
 			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/masque/ip?target=*&ipproto=*", Xmux: defaultMasqueXmux()},
+			Output: &masque.Config{Path: "/masque/ip?target=*&ipproto=*"},
 		},
 		{
 			Input:  `{"user": "u", "pass": "p:q", "headers": {"X-Token": "a"}}`,
@@ -107,7 +53,6 @@ func TestMasqueConfig(t *testing.T) {
 			Output: &masque.Config{
 				Path:    "/.well-known/masque/ip/*/*/",
 				Headers: map[string]string{"Authorization": "Basic dTpwOnE=", "X-Token": "a"},
-				Xmux:    defaultMasqueXmux(),
 			},
 		},
 	})
@@ -177,7 +122,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 					Host: "cloudflareaccess.com",
 					Path: "/",
 					Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: address},
-					Xmux: defaultMasqueXmux(),
 				},
 			},
 		})
@@ -190,7 +134,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 				Host: "example.com",
 				Path: "/warp",
 				Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: address},
-				Xmux: defaultMasqueXmux(),
 			},
 		},
 	})
@@ -221,7 +164,6 @@ func TestMasqueWarpConfig(t *testing.T) {
 				Host: "cloudflareaccess.com",
 				Path: "/",
 				Warp: &masque.Warp{PrivateKey: pkcs8, PublicKey: publicKey, Address: []string{"172.16.0.2/32"}},
-				Xmux: defaultMasqueXmux(),
 			},
 		},
 	})
@@ -257,17 +199,18 @@ func TestMasqueOutboundConfig(t *testing.T) {
 		return err
 	}
 
-	for _, input := range []string{
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": false, "concurrency": -1}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true, "concurrency": -1, "xudpConcurrency": 8}}`,
-	} {
-		if err := build(input); err != nil {
-			t.Errorf("%s: %v", input, err)
-		}
+	if err := build(`{
+		"protocol": "masque",
+		"settings": {"address": "example.com", "port": 443},
+		"streamSettings": {"network": "masque", "security": "tls"},
+		"mux": {"enabled": false, "concurrency": -1}
+	}`); err != nil {
+		t.Error(err)
 	}
 	for _, input := range []string{
 		`{"protocol": "masque", "settings": {"address": "example.com"}, "streamSettings": {"network": "masque", "security": "tls"}}`,
+		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true}}`,
+		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true, "concurrency": -1}}`,
 		`{"protocol": "freedom", "streamSettings": {"network": "masque", "security": "tls"}}`,
 	} {
 		if err := build(input); err == nil {

infra/conf/router.go

@@ -7,6 +7,7 @@ import (
 	"github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
+	"github.com/xtls/xray-core/common/platform"
 	"github.com/xtls/xray-core/common/serial"
 
 	"google.golang.org/protobuf/proto"
@@ -94,10 +95,13 @@ func (c *RouterConfig) getDomainStrategy() router.Config_DomainStrategy {
 func (c *RouterConfig) Build() (*router.Config, error) {
 	config := new(router.Config)
 
-	if c.Script != "" && (c.DomainStrategy != nil || len(c.RuleList) > 0) {
-		return nil, errors.New("routing script cannot be used with domainStrategy or rules")
+	if c.Script != "" {
+		path, err := platform.ResolveLuaFile(c.Script)
+		if err != nil {
+			return nil, errors.New("failed to resolve routing script").Base(err)
+		}
+		config.Script = path
 	}
-	config.Script = c.Script
 
 	config.DomainStrategy = c.getDomainStrategy()
 

infra/conf/router_test.go

@@ -2,7 +2,8 @@ package conf_test
 
 import (
 	"encoding/json"
-	"strings"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 	_ "unsafe"
@@ -239,37 +240,36 @@ func TestRouterConfig(t *testing.T) {
 }
 
 func TestRouterScriptConfig(t *testing.T) {
-	for _, test := range []struct {
+	dir := t.TempDir()
+	t.Setenv("xray.location.confdir", dir)
+	path := filepath.Join(dir, "route.lua")
+	if err := os.WriteFile(path, []byte("function HandleRoute() end"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
 		name      string
-		input     string
+		script    string
 		wantError bool
 	}{
-		{name: "script only", input: `{"script":"missing.lua"}`},
-		{name: "empty rules", input: `{"script":"missing.lua","rules":[]}`},
-		{name: "balancers", input: `{"script":"missing.lua","balancers":[{"tag":"b1","selector":["direct"]}]}`},
-		{name: "default domain strategy", input: `{"script":"missing.lua","domainStrategy":"AsIs"}`, wantError: true},
-		{name: "IP domain strategy", input: `{"script":"missing.lua","domainStrategy":"IPIfNonMatch"}`, wantError: true},
-		{name: "empty domain strategy", input: `{"script":"missing.lua","domainStrategy":""}`, wantError: true},
-		{name: "rules", input: `{"script":"missing.lua","rules":[{"outboundTag":"direct","domain":["example.com"]}]}`, wantError: true},
-		{name: "empty script", input: `{"script":"","domainStrategy":"IPOnDemand","rules":[{"outboundTag":"direct","domain":["example.com"]}]}`},
+		{"relative", "route.lua", false},
+		{"absolute", path, false},
+		{"missing", "missing.lua", true},
+		{"directory", dir, true},
 	} {
-		t.Run(test.name, func(t *testing.T) {
-			var config RouterConfig
-			if err := json.Unmarshal([]byte(test.input), &config); err != nil {
-				t.Fatal(err)
-			}
-			built, err := config.Build()
-			if test.wantError {
-				if built != nil || err == nil || !strings.Contains(err.Error(), "routing script cannot be used with domainStrategy or rules") {
-					t.Fatalf("Build() = %v, %v; want nil config and script conflict error", built, err)
+		t.Run(tc.name, func(t *testing.T) {
+			built, err := (&RouterConfig{Script: tc.script}).Build()
+			if tc.wantError {
+				if err == nil {
+					t.Fatal("Build accepted invalid script path")
 				}
 				return
 			}
 			if err != nil {
 				t.Fatal(err)
 			}
-			if built.Script != config.Script || len(built.Rule) != len(config.RuleList) || len(built.BalancingRule) != len(config.Balancers) {
-				t.Fatalf("Build() did not preserve script, rules or balancers: %v", built)
+			if built.Script != path {
+				t.Fatalf("script path = %q, want %q", built.Script, path)
 			}
 		})
 	}

infra/conf/transport_finalmask.go

@@ -9,17 +9,12 @@ import (
 	"fmt"
 	"net/netip"
 	"net/url"
-	"os"
 	"regexp"
 	"strings"
 
 	googleuuid "github.com/google/uuid"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/geodata"
-	xlua "github.com/xtls/xray-core/common/lua"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/finalmask/filter"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/aes128gcm"
@@ -33,7 +28,6 @@ import (
 	"github.com/xtls/xray-core/transport/internet/finalmask/xdns"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xicmp"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
-	"github.com/xtls/xray-core/transport/internet/hysteria/congestion/bbr"
 	"github.com/xtls/xray-core/transport/internet/tls"
 	"google.golang.org/protobuf/proto"
 )
@@ -76,7 +70,6 @@ var (
 	customVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
 
 	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
@@ -84,7 +77,6 @@ var (
 	}, "type", "settings")
 
 	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomUDP) },
 		"mkcp-legacy":   func() interface{} { return new(MkcpLegacy) },
 		"noise":         func() interface{} { return new(NoiseMask) },
@@ -97,23 +89,6 @@ var (
 	}, "type", "settings")
 )
 
-type Filter struct {
-	BlockedSourceIPs []string `json:"blockedSourceIPs"`
-	AllowedSourceIPs []string `json:"allowedSourceIPs"`
-}
-
-func (c *Filter) Build() (proto.Message, error) {
-	rules, err := geodata.ParseIPRules(c.BlockedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "blockedSourceIPs"`).Base(err)
-	}
-	allowed, err := geodata.ParseIPRules(c.AllowedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "allowedSourceIPs"`).Base(err)
-	}
-	return &filter.Config{BlockedSourceIps: rules, AllowedSourceIps: allowed}, nil
-}
-
 type TCPItem struct {
 	Delay     Int32Range       `json:"delay"`
 	Rand      int32            `json:"rand"`
@@ -329,26 +304,11 @@ type NoiseItem struct {
 }
 
 type NoiseMask struct {
-	Reset  Int32Range  `json:"reset"`
-	Noise  []NoiseItem `json:"noise"`
-	Script string      `json:"script"`
+	Reset Int32Range  `json:"reset"`
+	Noise []NoiseItem `json:"noise"`
 }
 
 func (c *NoiseMask) Build() (proto.Message, error) {
-	if c.Script != "" {
-		if len(c.Noise) > 0 {
-			return nil, errors.New(`"script" and "noise" can't be used together`)
-		}
-		if _, err := xlua.Compile(c.Script); err != nil {
-			return nil, errors.New("failed to compile the noise script").Base(err)
-		}
-		return &noise.Config{
-			ResetMin: int64(c.Reset.From),
-			ResetMax: int64(c.Reset.To),
-			Script:   c.Script,
-		}, nil
-	}
-
 	noiseSlice := make([]*noise.Item, 0, len(c.Noise))
 	for _, item := range c.Noise {
 		if len(item.Packet) > 0 && item.Rand.To > 0 {
@@ -839,10 +799,7 @@ type XDNSDomain struct {
 }
 
 type XDNSResolver struct {
-	Addrs      []string          `json:"addrs"`
-	Worker     int32             `json:"worker"`
-	TlsConfig  *TLSConfig        `json:"tlsConfig"`
-	QuicConfig *QuicParamsConfig `json:"quicConfig"`
+	Addrs []string `json:"addrs"`
 }
 
 type XDNS struct {
@@ -877,26 +834,6 @@ func (c *XDNS) Build() (proto.Message, error) {
 		}
 	}
 	for i := range c.Resolvers {
-		worker := c.Resolvers[i].Worker
-		if worker == 0 {
-			worker = 32
-		}
-		var tlsConfig *tls.Config
-		var quicConfig *internet.QuicParams
-		if c.Resolvers[i].TlsConfig != nil {
-			proto, err := c.Resolvers[i].TlsConfig.Build()
-			if err != nil {
-				return nil, err
-			}
-			tlsConfig = proto.(*tls.Config)
-		}
-		if c.Resolvers[i].QuicConfig != nil {
-			proto, err := c.Resolvers[i].QuicConfig.Build()
-			if err != nil {
-				return nil, err
-			}
-			quicConfig = proto.(*internet.QuicParams)
-		}
 		for j := range c.Resolvers[i].Addrs {
 			var u *url.URL
 			var e error
@@ -908,21 +845,18 @@ func (c *XDNS) Build() (proto.Message, error) {
 			if e != nil {
 				return nil, e
 			}
-			var addr string
 			switch u.Scheme {
 			case "tcp", "udp":
-				host := u.Hostname()
-				port := u.Port()
-				if port == "" {
-					port = "53"
-				}
-				addr = net.JoinHostPort(host, port)
-			case "https":
-				addr = u.String()
 			default:
 				return nil, errors.New("invalid protocol")
 			}
-			resolvers = append(resolvers, &xdns.ResolverProto{Type: u.Scheme, Addr: addr, Worker: worker, TlsConfig: tlsConfig, QuicConfig: quicConfig})
+			var host, port string
+			host = u.Hostname()
+			port = u.Port()
+			if port == "" {
+				port = "53"
+			}
+			resolvers = append(resolvers, &xdns.ResolverProto{Type: u.Scheme, Addr: net.JoinHostPort(host, port)})
 		}
 	}
 	if c.ExtraPoll < 0 || c.ExtraPoll > 3 {
@@ -1215,91 +1149,6 @@ type QuicParamsConfig struct {
 	DisableStatelessReset         bool      `json:"disableStatelessReset"`
 }
 
-func (config *QuicParamsConfig) Build() (proto.Message, error) {
-	profile := strings.ToLower(config.BbrProfile)
-	switch profile {
-	case "", string(bbr.ProfileConservative), string(bbr.ProfileStandard), string(bbr.ProfileAggressive):
-		if profile == "" {
-			profile = string(bbr.ProfileStandard)
-		}
-	default:
-		return nil, errors.New("unknown bbr profile")
-	}
-
-	up, err := config.BrutalUp.Bps()
-	if err != nil {
-		return nil, err
-	}
-	down, err := config.BrutalDown.Bps()
-	if err != nil {
-		return nil, err
-	}
-
-	if up > 0 && up < 65536 {
-		return nil, errors.New("BrutalUp must be at least 65536 bytes per second")
-	}
-	if down > 0 && down < 65536 {
-		return nil, errors.New("BrutalDown must be at least 65536 bytes per second")
-	}
-
-	config.Congestion = strings.ToLower(config.Congestion)
-	switch config.Congestion {
-	case "", "brutal", "reno", "bbr":
-	case "force-brutal":
-		if up == 0 {
-			return nil, errors.New("force-brutal requires up")
-		}
-	default:
-		return nil, errors.New("unknown congestion control: ", config.Congestion, ", valid values: reno, bbr, brutal, force-brutal")
-	}
-
-	if config.InitStreamReceiveWindow > 0 && config.InitStreamReceiveWindow < 16384 {
-		return nil, errors.New("InitStreamReceiveWindow must be at least 16384")
-	}
-	if config.MaxStreamReceiveWindow > 0 && config.MaxStreamReceiveWindow < 16384 {
-		return nil, errors.New("MaxStreamReceiveWindow must be at least 16384")
-	}
-	if config.InitConnectionReceiveWindow > 0 && config.InitConnectionReceiveWindow < 16384 {
-		return nil, errors.New("InitConnectionReceiveWindow must be at least 16384")
-	}
-	if config.MaxConnectionReceiveWindow > 0 && config.MaxConnectionReceiveWindow < 16384 {
-		return nil, errors.New("MaxConnectionReceiveWindow must be at least 16384")
-	}
-	if config.MaxIdleTimeout != 0 && (config.MaxIdleTimeout < 4 || config.MaxIdleTimeout > 120) {
-		return nil, errors.New("MaxIdleTimeout must be between 4 and 120")
-	}
-	if config.KeepAlivePeriod != 0 && (config.KeepAlivePeriod < 2 || config.KeepAlivePeriod > 60) {
-		return nil, errors.New("KeepAlivePeriod must be between 2 and 60")
-	}
-	if config.MaxIncomingStreams != 0 && config.MaxIncomingStreams < 8 {
-		return nil, errors.New("MaxIncomingStreams must be at least 8")
-	}
-
-	if config.Debug {
-		os.Setenv("HYSTERIA_BBR_DEBUG", "true")
-		os.Setenv("HYSTERIA_BRUTAL_DEBUG", "true")
-	}
-
-	return &internet.QuicParams{
-		Congestion:                    config.Congestion,
-		BbrProfile:                    profile,
-		BrutalUp:                      up,
-		BrutalDown:                    down,
-		BrutalDisableLossCompensation: config.BrutalDisableLossCompensation,
-		InitStreamReceiveWindow:       config.InitStreamReceiveWindow,
-		MaxStreamReceiveWindow:        config.MaxStreamReceiveWindow,
-		InitConnReceiveWindow:         config.InitConnectionReceiveWindow,
-		MaxConnReceiveWindow:          config.MaxConnectionReceiveWindow,
-		MaxIdleTimeout:                config.MaxIdleTimeout,
-		KeepAlivePeriod:               config.KeepAlivePeriod,
-		DisablePathMtuDiscovery:       config.DisablePathMTUDiscovery,
-		DisableChromeParrot:           config.DisableChromeParrot,
-		DisableGSO:                    config.DisableGSO,
-		MaxIncomingStreams:            config.MaxIncomingStreams,
-		DisableStatelessReset:         config.DisableStatelessReset,
-	}, nil
-}
-
 type FinalMask struct {
 	Tcp        []Mask            `json:"tcp"`
 	Udp        []Mask            `json:"udp"`