xudp

https://github.com/XTLS/Xray-core/pull/7327#issuecomment-6634105144

Fixes https://github.com/XTLS/Xray-core/issues/7318

app/proxyman/outbound/handler.go

@@ -217,6 +217,7 @@ func (h *Handler) Dispatch(ctx context.Context, link *transport.Link) {
 		if ob.Target.Network == net.Network_UDP && ob.Target.Port == 443 {
 			switch h.udp443 {
 			case "reject":
+				proxy.DropUDP(ctx, link.Reader)
 				test(errors.New("XUDP rejected UDP/443 traffic"))
 				return
 			case "skip":

common/buf/io.go

@@ -73,7 +73,7 @@ func (r *TimeoutWrapperReader) ReadMultiBufferTimeout(duration time.Duration) (M
 		}
 		return r.mb, r.err
 	case <-timeout:
-		return nil, nil
+		return nil, ErrReadTimeout
 	}
 }
 

proxy/blackhole/blackhole.go

@@ -9,11 +9,10 @@ import (
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
-	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/common/signal"
+	"github.com/xtls/xray-core/proxy"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 )
@@ -69,14 +68,8 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	}
 	defer common.Interrupt(link.Writer)
 	defer common.Interrupt(link.Reader)
-	// wait to drain all the possible incoming UDP data
 	if ob.Target.Network == net.Network_UDP {
-		ctx, cancel := context.WithCancel(ctx)
-		timer := signal.CancelAfterInactivity(ctx, func() {
-			cancel()
-		}, time.Duration(30+dice.Roll(61))*time.Second)
-		go buf.Copy(link.Reader, buf.Discard, buf.UpdateActivity(timer))
-		<-ctx.Done()
+		proxy.DropUDP(ctx, link.Reader)
 	}
 	return nil
 }

proxy/drop.go

@@ -0,0 +1,24 @@
+package proxy
+
+import (
+	"context"
+	"math/rand/v2"
+	"time"
+
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
+	"github.com/xtls/xray-core/common/signal"
+)
+
+// wait to drain all the possible incoming UDP data
+// because re-established QUIC UDP may bypass the sniffer
+func DropUDP(ctx context.Context, reader buf.Reader) {
+	ctx, cancel := context.WithCancel(ctx)
+	timer := signal.CancelAfterInactivity(ctx, func() {
+		cancel()
+	}, time.Duration(30+rand.N(60))*time.Second)
+	context.AfterFunc(ctx, func() {
+		common.Interrupt(reader)
+	})
+	buf.Copy(reader, buf.Discard, buf.UpdateActivity(timer))
+}

proxy/tun/README.md

@@ -223,7 +223,7 @@ To make it start, wintun.dll specific for your Windows/arch must be present next
 
 After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running. A Wintun adapter that already has that name is reused.
 
-With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway`, `dns` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
+With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
 
 When `dns` is set, those servers are applied to the adapter. Windows is kept from registering the TUN's addresses in DNS, and its DNS cache is flushed when the TUN starts and stops. Xray's own lookups through the system's DNS servers, like those of the `localhost` DNS server with `autoOutboundsInterface`, skip them, unless another interface uses them as well, as they would lead back into the TUN.
 

proxy/tun/tun_windows.go

@@ -115,7 +115,6 @@ func (t *WindowsTun) Start() (err error) {
 	for _, ip := range t.options.DNS {
 		dns = append(dns, netip.MustParseAddr(ip))
 	}
-	dns6 := slices.ContainsFunc(dns, netip.Addr.Is6)
 
 	var route4, route6 bool
 	routesMap := make(map[winipcfg.RouteData]struct{})
@@ -176,7 +175,7 @@ startOver:
 		if err != nil {
 			// With IPv6 disabled system-wide (DisabledComponents), the adapter has no
 			// IPv6 interface at all. Skip the family unless the config asks for it.
-			if err == windows.ERROR_NOT_FOUND && family == windows.AF_INET6 && !address6 && !route6 && !dns6 {
+			if err == windows.ERROR_NOT_FOUND && family == windows.AF_INET6 && !address6 && !route6 {
 				continue
 			}
 			return err
@@ -205,7 +204,7 @@ startOver:
 			// Skip IPv6 the config does not ask for also when setting its DNS
 			// servers fails, as reported on Windows 11 24H2 with IPv6 disabled
 			// (Access is denied).
-			if family == windows.AF_INET6 && !address6 && !route6 && !dns6 {
+			if family == windows.AF_INET6 && !address6 && !route6 {
 				continue
 			}
 			firstErr = errors.New("unable to set DNS").Base(err)

proxy/vless/outbound/outbound.go

@@ -254,6 +254,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		switch request.Command {
 		case protocol.RequestCommandUDP:
 			if !allowUDP443 && request.Port == 443 {
+				proxy.DropUDP(ctx, link.Reader)
 				return errors.New("XTLS rejected UDP/443 traffic")
 			}
 		case protocol.RequestCommandMux: