Refactor

The relay session context was derived from the inbound connection of the
source address that created the session. After a client changes its source
address (NAT rebinding), the UDP worker of the old address is cleaned up after
~2 minutes of inactivity and cancels that context, which tears down the
dispatched outbound flow; the next packet then creates a brand-new session and
outbound flow (new local port on the server, reset replay window).

Sessions are routed by client session ID (SIP022 3.2.4), so detach the session
context from the originating connection's cancellation and let the session's
own inactivity timer govern its lifetime.

.github/docker/Dockerfile

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -20,7 +20,7 @@ RUN cat <<EOF >/tmp/usr/local/etc/xray/00_log.json
 {
   "log": {
     "error": "/var/log/xray/error.log",
-    "logLevel": "warning",
+    "loglevel": "warning",
     "access": "none",
     "dnsLog": false
   }
@@ -40,15 +40,21 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 FROM gcr.io/distroless/static:nonroot
 
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/docker/Dockerfile.usa

@@ -9,8 +9,8 @@ ARG TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags "-s -w -buildid=" ./main
 
 # Download geodat into a staging directory
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geoip/geoip-full.dat /tmp/geodat/geoip.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat /tmp/geodat/geoip.dat
-ADD https://raw.githubusercontent.com/XTLS/Xray-rules-dat/release/geosite/geosite-expand.dat /tmp/geodat/geosite.dat
+ADD https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat /tmp/geodat/geosite.dat
 
 RUN mkdir -p /tmp/empty
 
@@ -20,7 +20,7 @@ RUN cat <<EOF >/tmp/usr/local/etc/xray/00_log.json
 {
   "log": {
     "error": "/var/log/xray/error.log",
-    "logLevel": "warning",
+    "loglevel": "warning",
     "access": "none",
     "dnsLog": false
   }
@@ -40,6 +40,11 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
+# Create log files
+RUN mkdir -p /tmp/var/log/xray && touch \
+  /tmp/var/log/xray/access.log \
+  /tmp/var/log/xray/error.log
+
 # Build finally image
 # Note on Distroless Base Image and Architecture Support:
 # - The official 'gcr.io/distroless/static' image provided by Google only supports a limited set of architectures for Linux:
@@ -55,9 +60,10 @@ FROM --platform=linux/amd64 gcr.io/distroless/static:nonroot
 COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray
 COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray
 COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/
-COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray
-COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
+COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/
-COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray
+COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /var/log/xray
+COPY --from=build --chown=65532:65532 --chmod=600 /tmp/var/log/xray/*.log /var/log/xray/
 
 VOLUME /usr/local/etc/xray
 VOLUME /var/log/xray

.github/workflows/docker.yml

@@ -82,7 +82,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/scheduled-assets-update.yml

@@ -40,7 +40,7 @@ jobs:
           max_attempts: 60
           command: |
             [ -d 'resources' ] || mkdir resources
-            LIST=('XTLS Xray-rules-dat geoip/geoip-lite geoip' 'XTLS Xray-rules-dat geosite/geosite geosite')
+            LIST=('Loyalsoldier v2ray-rules-dat geoip geoip' 'Loyalsoldier v2ray-rules-dat geosite geosite')
             for i in "${LIST[@]}"
             do
               INFO=($(echo $i | awk 'BEGIN{FS=" ";OFS=" "} {print $1,$2,$3,$4}'))

.github/workflows/test.yml

@@ -35,7 +35,24 @@ jobs:
         if: steps.check-assets.outputs.missing == 'true'
         run: sleep 90
 
-  check-format-and-proto:
+  check-proto:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v7
+      - name: Check Proto Version Header
+        run: |
+          head -n 4 core/config.pb.go > ref.txt
+          find . -name "*.pb.go" ! -name "*_grpc.pb.go" -print0 | while IFS= read -r -d '' file; do
+            if ! cmp -s ref.txt <(head -n 4 "$file"); then
+              echo "Error: Header mismatch in $file"
+              head -n 4 "$file"
+              exit 1
+            fi
+          done
+
+  check-format:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     permissions:
@@ -51,8 +68,6 @@ jobs:
           cache: false
       - name: Check Format
         run: go run ./infra/vformat/main.go -mode check -pwd ./
-      - name: Check Protobuf
-        run: go run ./infra/vprotogen/main.go -mode check -pwd ./
 
   test:
     needs: check-assets

app/commander/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/commander/config.proto
 
 package commander

app/dispatcher/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dispatcher/config.proto
 
 package dispatcher

app/dns/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dns/config.proto
 
 package dns

app/dns/fakedns/fakedns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/dns/fakedns/fakedns.proto
 
 package fakedns

app/dns/script_test.go

@@ -128,7 +128,7 @@ func TestDNSScriptGeoIPFallback(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 	script := `
 local servers = require("xray.dns").Servers
-local ru_ips = require("xray.geodata").BuildIPMatcher("geoip:ru")
+local us_ips = require("xray.geodata").BuildIPMatcher("geoip:us")
 
 local by_id = {}
 for _, server in ipairs(servers) do
@@ -138,7 +138,7 @@ assert(by_id.primary and by_id.fallback, "primary and fallback DNS servers are r
 
 function HandleDNSQuery(domain, ipv4, ipv6, fake)
     local ips, ttl, err = by_id.primary:Query(domain, ipv4, ipv6, fake)
-    if not err and ru_ips:AnyMatch(ips) then
+    if not err and us_ips:AnyMatch(ips) then
         return ips, ttl, nil
     end
     return by_id.fallback:Query(domain, ipv4, ipv6, fake)
@@ -152,7 +152,7 @@ end
 	primary := &scriptNameServer{
 		name: "primary",
 		answers: map[string]net.IP{
-			"ru.example":    net.ParseIP("2a02:6b8::feed:0ff"),
+			"us.example":    net.ParseIP("2001:4860:4860::8888"),
 			"other.example": net.ParseIP("127.0.0.1"),
 		},
 		ttl: 30,
@@ -191,7 +191,7 @@ end
 		ip     net.IP
 		ttl    uint32
 	}{
-		{"Ru.Example.", net.ParseIP("2a02:6b8::feed:0ff"), 30},
+		{"Us.Example.", net.ParseIP("2001:4860:4860::8888"), 30},
 		{"other.example", net.ParseIP("9.9.9.9"), 60},
 	} {
 		ips, ttl, err := server.LookupIP(tc.domain, option)

app/geodata/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/geodata/config.proto
 
 package geodata

app/geodata/download.go

@@ -1,8 +1,6 @@
 package geodata
 
 import (
-	"bufio"
-	"compress/gzip"
 	"context"
 	"crypto/tls"
 	go_errors "errors"
@@ -23,10 +21,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-const (
+const idleTimeout = 30 * time.Second
-	idleTimeout           = 30 * time.Second
-	maxDownloadSize int64 = 256 * 1024 * 1024
-)
 
 // DO NOT EDIT. Ignored by geodata, rejected by Lua.
 const luaGuardHeader = "\x12\x01\x00"
@@ -38,6 +33,7 @@ type stage struct {
 
 type downloader struct {
 	ctx         context.Context
+	httpClient  *http.Client
 	httpsClient *http.Client
 }
 
@@ -65,11 +61,12 @@ func (c *idleConn) Write(b []byte) (int, error) {
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
 		ctx:         ctx,
-		httpsClient: newClient(ctx, dispatcher, outbound),
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
 	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
 		var conn net.Conn
 		err := task.Run(ctx, func() error {
@@ -94,33 +91,53 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 			Conn: conn,
 		}, nil
 	}
-	return &http.Client{
+	if isHTTPS {
-		Transport: &http2.Transport{
+		return &http.Client{
-			DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+			Transport: &http2.Transport{
-				conn, err := dial(ctx, network, address)
+				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
-				if err != nil {
+					conn, err := dial(ctx, network, address)
-					return nil, err
+					if err != nil {
-				}
+						return nil, err
-				host, _, _ := net.SplitHostPort(address)
+					}
-				tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+					host, _, _ := net.SplitHostPort(address)
-				handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
-				defer cancel()
+					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
-				if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+					defer cancel()
-					conn.Close()
+					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
-					return nil, err
+						conn.Close()
-				}
+						return nil, err
-				return tlsConn, nil
+					}
+					return tlsConn, nil
+				},
 			},
-		},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
-			if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
-				return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
-			}
+				if len(via) >= 10 {
-			if len(via) >= 20 {
+					return errors.New("stopped after 10 redirects")
-				return errors.New("stopped after 20 redirects")
+				}
-			}
+				return nil
-			return nil
+			},
-		},
+		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
 	}
 }
 
@@ -186,41 +203,27 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	resp, err := d.httpsClient.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		io.Copy(io.Discard, resp.Body)
 		return errors.New("unexpected status code: ", resp.StatusCode)
 	}
-	if resp.ContentLength > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 
-	br := bufio.NewReader(resp.Body)
+	n, err := io.Copy(writer, resp.Body)
-	header, err := br.Peek(2)
-	if err != nil && err != io.EOF {
-		return err
-	}
-	var body io.Reader = br
-	if len(header) == 2 && header[0] == 0x1f && header[1] == 0x8b {
-		zr, err := gzip.NewReader(br)
-		if err != nil {
-			return err
-		}
-		defer zr.Close()
-		body = zr
-	}
-
-	n, err := io.Copy(writer, io.LimitReader(body, maxDownloadSize+1))
 	if err != nil {
 		return err
 	}
-	if n > maxDownloadSize {
-		return errors.New("geodata download exceeds 256 MiB")
-	}
 	if n == 0 {
 		return errors.New("empty response body")
 	}

app/geodata/download_test.go

@@ -7,13 +7,10 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	commongeodata "github.com/xtls/xray-core/common/geodata"
 	xlua "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
 	"github.com/yuin/gopher-lua/parse"
 	"google.golang.org/protobuf/proto"
 )
@@ -34,11 +31,11 @@ func TestDownloadOneLuaGuard(t *testing.T) {
 			if err := os.WriteFile(filepath.Join(dir, "asset.lua"), nil, 0o600); err != nil {
 				t.Fatal(err)
 			}
-			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 				_, _ = w.Write([]byte(tc.body))
 			}))
 			defer server.Close()
-			d := &downloader{ctx: context.Background(), httpsClient: server.Client()}
+			d := &downloader{ctx: context.Background(), httpClient: server.Client()}
 			staged, err := d.downloadOne(&Asset{Url: server.URL, File: "asset.lua"})
 			if err != nil {
 				t.Fatal(err)
@@ -74,53 +71,3 @@ func TestDownloadOneLuaGuard(t *testing.T) {
 		})
 	}
 }
-
-func TestProtobufConfigValidation(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.asset", dir)
-	for _, name := range []string{"asset.dat", "asset.DAT"} {
-		if err := os.WriteFile(filepath.Join(dir, name), nil, 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.Mkdir(filepath.Join(dir, "directory.dat"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	server, err := core.New(&core.Config{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = server.Close() })
-	for _, tc := range []struct {
-		name      string
-		config    *Config
-		wantError string
-	}{
-		{"minutely cron", &Config{Cron: "* * * * *"}, ""},
-		{"minimum interval", &Config{Cron: "@every 1m"}, ""},
-		{"short interval", &Config{Cron: "@every 59s"}, "interval must be at least 1 minute"},
-		{"fractional interval", &Config{Cron: "@every 59.999s"}, "interval must be at least 1 minute"},
-		{"invalid cron", &Config{Cron: "invalid"}, "invalid geodata cron"},
-		{"dat extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.dat"}}}, ""},
-		{"uppercase extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.DAT"}}}, ""},
-		{"invalid extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset.lua"}}}, "extension must be .dat"},
-		{"missing extension", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "asset"}}}, "extension must be .dat"},
-		{"missing file", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "missing.dat"}}}, "invalid geodata asset file"},
-		{"directory", &Config{Cron: "@daily", Assets: []*Asset{{Url: "https://example.com/asset.dat", File: "directory.dat"}}}, "asset is not a regular file"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			config, err := serial.ToTypedMessage(tc.config).GetInstance()
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, err = core.CreateObject(server, config)
-			if tc.wantError == "" {
-				if err != nil {
-					t.Fatal(err)
-				}
-			} else if err == nil || !strings.Contains(err.Error(), tc.wantError) {
-				t.Fatalf("CreateObject() error = %v; want %q", err, tc.wantError)
-			}
-		})
-	}
-}

app/geodata/geodata.go

@@ -2,16 +2,12 @@ package geodata
 
 import (
 	"context"
-	"path/filepath"
-	"strings"
 	"sync"
-	"time"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	commongeodata "github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
 )
@@ -29,24 +25,6 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 	if config.Cron == "" {
 		return &Instance{}, nil
 	}
-	if len(config.Assets) > 100 {
-		return nil, errors.New("geodata supports at most 100 assets")
-	}
-	for _, asset := range config.Assets {
-		if !strings.EqualFold(filepath.Ext(asset.GetFile()), ".dat") {
-			return nil, errors.New("geodata asset file extension must be .dat")
-		}
-		if _, err := filesystem.ResolveAsset(asset.GetFile()); err != nil {
-			return nil, errors.New("invalid geodata asset file: ", asset.GetFile()).Base(err)
-		}
-	}
-	schedule, err := cron.ParseStandard(config.Cron)
-	if err != nil {
-		return nil, errors.New("invalid geodata cron").Base(err)
-	}
-	if interval, ok := schedule.(cron.ConstantDelaySchedule); ok && interval.Delay < time.Minute {
-		return nil, errors.New("geodata cron interval must be at least 1 minute")
-	}
 
 	g := &Instance{
 		assets: config.Assets,
@@ -66,7 +44,9 @@ func New(ctx context.Context, config *Config) (*Instance, error) {
 		cron.WithChain(cron.SkipIfStillRunning(cron.DiscardLogger)),
 		cron.WithLogger(cron.DiscardLogger),
 	)
-	g.tasker.Schedule(schedule, cron.FuncJob(g.execute))
+	if _, err := g.tasker.AddFunc(config.Cron, g.execute); err != nil {
+		return nil, errors.New("invalid geodata cron").Base(err)
+	}
 	errors.LogInfo(ctx, "scheduled geodata reload with cron: ", config.Cron)
 
 	return g, nil

app/log/command/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/command/config_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/log/command/config.proto
 
 package command

app/log/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/log/config.proto
 
 package log

app/metrics/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/metrics/config.proto
 
 package metrics

app/observatory/burst/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/burst/config.proto
 
 package burst

app/observatory/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/observatory/command/command.proto
 
 package command

app/observatory/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/observatory/config.proto
 
 package observatory
@@ -152,23 +152,23 @@ func (x *HealthPingMeasurementResult) GetMin() int64 {
 type OutboundStatus struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
+	// @Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The last error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	// @Document The outbound tag for this Server
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	OutboundTag string `protobuf:"bytes,4,opt,name=outbound_tag,json=outboundTag,proto3" json:"outbound_tag,omitempty"`
 	// @Document The time this outbound is known to be alive
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastSeenTime int64 `protobuf:"varint,5,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
 	// @Document The time this outbound is tried
-	//@Type id.outboundTag
+	// @Type id.outboundTag
 	LastTryTime   int64                        `protobuf:"varint,6,opt,name=last_try_time,json=lastTryTime,proto3" json:"last_try_time,omitempty"`
 	HealthPing    *HealthPingMeasurementResult `protobuf:"bytes,7,opt,name=health_ping,json=healthPing,proto3" json:"health_ping,omitempty"`
 	unknownFields protoimpl.UnknownFields
@@ -257,14 +257,14 @@ func (x *OutboundStatus) GetHealthPing() *HealthPingMeasurementResult {
 type ProbeResult struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document Whether this outbound is usable
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Alive bool `protobuf:"varint,1,opt,name=alive,proto3" json:"alive,omitempty"`
 	// @Document The time for probe request to finish.
-	//@Type time.ms
+	// @Type time.ms
-	//@Restriction ReadOnlyForUser
+	// @Restriction ReadOnlyForUser
 	Delay int64 `protobuf:"varint,2,opt,name=delay,proto3" json:"delay,omitempty"`
 	// @Document The error caused this outbound failed to relay probe request
-	//@Restriction NotMachineReadable
+	// @Restriction NotMachineReadable
 	LastErrorReason string `protobuf:"bytes,3,opt,name=last_error_reason,json=lastErrorReason,proto3" json:"last_error_reason,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -324,7 +324,7 @@ func (x *ProbeResult) GetLastErrorReason() string {
 type Intensity struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// @Document The time interval for a probe request in ms.
-	//@Type time.ms
+	// @Type time.ms
 	ProbeInterval uint32 `protobuf:"varint,1,opt,name=probe_interval,json=probeInterval,proto3" json:"probe_interval,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache

app/policy/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/policy/config.proto
 
 package policy

app/proxyman/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/proxyman/command/command.proto
 
 package command

app/proxyman/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/proxyman/config.proto
 
 package proxyman

app/reverse/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/reverse/config.proto
 
 package reverse

app/router/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/command/command.proto

@@ -34,19 +34,18 @@ message RoutingContext {
 // opened by xray-core.
 // * FieldSelectors selects a subset of fields in routing statistics to return.
 // Valid selectors:
-//   - inbound: Selects connection's inbound tag.
+//  - inbound: Selects connection's inbound tag.
-//   - network: Selects connection's network.
+//  - network: Selects connection's network.
-//   - ip: Equivalent as "ip_source" and "ip_target", selects both source and
+//  - ip: Equivalent as "ip_source" and "ip_target", selects both source and
-//     target IP.
+//  target IP.
-//   - port: Equivalent as "port_source" and "port_target", selects both source
+//  - port: Equivalent as "port_source" and "port_target", selects both source
-//     and target port.
+//  and target port.
-//   - domain: Selects target domain.
+//  - domain: Selects target domain.
-//   - protocol: Select connection's protocol.
+//  - protocol: Select connection's protocol.
-//   - user: Select connection's inbound user email.
+//  - user: Select connection's inbound user email.
-//   - attributes: Select connection's additional attributes.
+//  - attributes: Select connection's additional attributes.
-//   - outbound: Equivalent as "outbound" and "outbound_group", select both
+//  - outbound: Equivalent as "outbound" and "outbound_group", select both
-//     outbound tag and outbound group tags.
+//  outbound tag and outbound group tags.
-//
 // * If FieldSelectors is left empty, all fields will be returned.
 message SubscribeRoutingStatsRequest {
   repeated string FieldSelectors = 1;

app/router/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/router/command/command.proto
 
 package command

app/router/condition_test.go

@@ -415,7 +415,7 @@ func BenchmarkMphDomainMatcher(b *testing.B) {
 
 func BenchmarkMultiGeoIPMatcher(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
-	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:ir", "geoip:ru"})
+	rules, err := geodata.ParseIPRules([]string{"geoip:cn", "geoip:jp", "geoip:ca", "geoip:us"})
 	common.Must(err)
 
 	matcher, err := NewIPMatcher(rules, MatcherAsType_Target)

app/router/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/router/config.proto
 
 package router

app/stats/command/command.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/command/command_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
+// - protoc-gen-go-grpc v1.6.0
-// - protoc             (unknown)
+// - protoc             v6.33.5
 // source: app/stats/command/command.proto
 
 package command

app/stats/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/stats/config.proto
 
 package stats

app/version/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: app/version/config.proto
 
 package version

common/geodata/consts.go

@@ -8,65 +8,23 @@ import (
 
 var privateIPMatcher = sync.OnceValue(func() IPMatcher {
 	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
-		// https://www.iana.org/assignments/iana-ipv4-special-registry
+		"0.0.0.0/8",
-		"0.0.0.0/8",      // "This network"
+		"10.0.0.0/8",
-		"0.0.0.0/32",     // "This host on this network"
+		"100.64.0.0/10",
-		"10.0.0.0/8",     // Private-Use
+		"127.0.0.0/8",
-		"100.64.0.0/10",  // Shared Address Space
+		"169.254.0.0/16",
-		"127.0.0.0/8",    // Loopback
+		"172.16.0.0/12",
-		"169.254.0.0/16", // Link Local
+		"192.0.0.0/24",
-		"172.16.0.0/12",  // Private-Use
+		"192.0.2.0/24",
-		// "192.0.0.0/24",   // IETF Protocol Assignments
+		"192.88.99.0/24",
-		"192.0.0.0/29",   // IPv4 Service Continuity Prefix
+		"192.168.0.0/16",
-		"192.0.0.8/32",   // IPv4 dummy address
+		"198.18.0.0/15",
-		"192.0.0.9/32",   // Port Control Protocol Anycast
+		"198.51.100.0/24",
-		"192.0.0.10/32",  // Traversal Using Relays around NAT Anycast
+		"203.0.113.0/24",
-		"192.0.0.170/32", // NAT64/DNS64 Discovery
+		"224.0.0.0/3",
-		"192.0.0.171/32", // NAT64/DNS64 Discovery
+		"::/127",
-		"192.0.2.0/24",   // Documentation (TEST-NET-1)
+		"fc00::/7",
-		// "192.31.196.0/24",    // AS112-v4
+		"fe80::/10",
-		"192.52.193.0/24", // AMT
-		// "192.88.99.0/24",  // Deprecated (6to4 Relay Anycast)
-		"192.88.99.2/32", // 6a44-relay anycast address
-		"192.168.0.0/16", // Private-Use
-		// "192.175.48.0/24",    // Direct Delegation AS112 Service
-		"198.18.0.0/15",      // Benchmarking
-		"198.51.100.0/24",    // Documentation (TEST-NET-2)
-		"203.0.113.0/24",     // Documentation (TEST-NET-3)
-		"240.0.0.0/4",        // Reserved
-		"255.255.255.255/32", // Limited Broadcast
-
-		// https://www.iana.org/assignments/multicast-addresses
-		"224.0.0.0/4",
-
-		// https://www.iana.org/assignments/iana-ipv6-special-registry
-		"::1/128", // Loopback Address
-		"::/128",  // Unspecified Address
-		// "::ffff:0:0/96",     // IPv4-mapped Address
-		"64:ff9b::/96",   // IPv4-IPv6 Translat.
-		"64:ff9b:1::/48", // IPv4-IPv6 Translat.
-		"100::/64",       // Discard-Only Address Block
-		"100:0:0:1::/64", // Dummy IPv6 Prefix
-		// "2001::/23",      // IETF Protocol Assignments
-		"2001::/32",     // TEREDO
-		"2001:1::1/128", // Port Control Protocol Anycast
-		"2001:1::2/128", // Traversal Using Relays around NAT Anycast
-		"2001:1::3/128", // DNS-SD Service Registration Protocol Anycast
-		"2001:2::/48",   // Benchmarking
-		"2001:3::/32",   // AMT
-		// "2001:4:112::/48", // AS112-v6
-		// "2001:10::/28",    // Deprecated (previously ORCHID)
-		"2001:20::/28",  // ORCHIDv2
-		"2001:30::/28",  // Drone Remote ID Protocol Entity Tags (DETs) Prefix
-		"2001:db8::/32", // Documentation
-		"2002::/16",     // 6to4
-		// "2620:4f:8000::/48", // Direct Delegation AS112 Service
-		"3fff::/20", // Documentation
-		"5f00::/16", // Segment Routing (SRv6) SIDs
-		"fc00::/7",  // Unique-Local
-		"fe80::/10", // Link-Local Unicast
-
-		// https://www.iana.org/assignments/ipv6-multicast-addresses
 		"ff00::/8",
 	}))))
 })

common/geodata/geodat.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/geodata/geodat.proto
 
 package geodata

common/geodata/ip_matcher_test.go

@@ -400,13 +400,13 @@ func TestIPMatcher4CN(t *testing.T) {
 	}
 }
 
-func TestIPMatcher6RU(t *testing.T) {
+func TestIPMatcher6US(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
+	matcher := buildIPMatcher("geoip:us")
 
-	if !matcher.Match(xnet.ParseAddress("2a02:6b8::feed:0ff").IP()) {
+	if !matcher.Match(xnet.ParseAddress("2001:4860:4860::8888").IP()) {
-		t.Error("expect RU geoip contain 2a02:6b8::feed:0ff, but actually not")
+		t.Error("expect US geoip contain 2001:4860:4860::8888, but actually not")
 	}
 }
 
@@ -423,11 +423,11 @@ func BenchmarkIPMatcher4CN(b *testing.B) {
 	}
 }
 
-func BenchmarkIPMatcher6RU(b *testing.B) {
+func BenchmarkIPMatcher6US(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
-	matcher := buildIPMatcher("geoip:ru")
+	matcher := buildIPMatcher("geoip:us")
-	ip := xnet.ParseAddress("2a02:6b8::feed:0ff").IP()
+	ip := xnet.ParseAddress("2001:4860:4860::8888").IP()
 
 	b.ResetTimer()
 

common/geodata/rule_parser_test.go

@@ -11,7 +11,7 @@ func TestParseIPRules(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 
 	rules := []string{
-		"geoip:ru",
+		"geoip:us",
 		"geoip:cn",
 		"!geoip:cn",
 		"!!geoip:cn",
@@ -20,9 +20,9 @@ func TestParseIPRules(t *testing.T) {
 		"!geoip:!cn",
 		"ext:geoip.dat:!cn",
 		"ext:geoip.dat:!!cn",
-		"ext:geoip.dat:ir",
+		"ext:geoip.dat:ca",
 		"ext-ip:geoip.dat:!cn",
-		"ext-ip:geoip.dat:!ir",
+		"ext-ip:geoip.dat:!ca",
 		"192.168.0.0/24",
 		"!192.168.0.0/24",
 		"!!192.168.0.0/24",

common/log/log.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/log/log.proto
 
 package log

common/lua/program.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/xtls/xray-core/common/base64"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/platform/filesystem"
+	"github.com/xtls/xray-core/common/platform"
 	glua "github.com/yuin/gopher-lua"
 	"github.com/yuin/gopher-lua/parse"
 )
@@ -36,7 +36,7 @@ func Compile(script string) (*Program, error) {
 		// TODO: Restore inline script support and re-enable the related tests.
 		return nil, errors.New("currently unavailable")
 		code, err = base64.Decode(script)
-	} else if name, err = filesystem.ResolveLuaFile(script); err == nil {
+	} else if name, err = platform.ResolveLuaFile(script); err == nil {
 		code, err = os.ReadFile(name)
 		// TODO: Restore privileged signature authorization and re-enable the related tests and CLI entries.
 		// if err == nil {

common/lua/program_test.go

@@ -187,20 +187,19 @@ func TestCompileInlineDiagnostics(t *testing.T) {
 */
 
 func TestCompileFileExtension(t *testing.T) {
-	for _, name := range []string{"script", "script.dat", "script.lua.txt"} {
+	for _, name := range []string{"script", "script.dat", "script.lua.txt", "script.LUA"} {
-		if program, err := Compile(name); program != nil || err == nil || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
-			t.Fatalf("Compile(%q) = %v, %v; want nil program and .lua extension error", name, program, err)
-		}
-	}
-	for _, name := range []string{"script.lua", "script.LUA", "script.Lua", "script.lUa"} {
 		path := filepath.Join(t.TempDir(), name)
 		if err := os.WriteFile(path, []byte("value = 42"), 0o600); err != nil {
 			t.Fatal(err)
 		}
-		if program, err := Compile(path); program == nil || err != nil {
+		if program, err := Compile(path); program != nil || err == nil || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
-			t.Fatalf("Compile(%q) = %v, %v; want successful compilation", path, program, err)
+			t.Fatalf("Compile(%q) = %v, %v; want nil program and .lua extension error", path, program, err)
 		}
 	}
+	path := writeTestScript(t, "value = 42") + string(filepath.Separator) + "."
+	if program, err := Compile(path); program == nil || err != nil {
+		t.Fatalf("Compile(%q) = %v, %v; want acceptance of the resolved .lua path", path, program, err)
+	}
 }
 
 func TestCompileRejectsReadFailure(t *testing.T) {
@@ -235,6 +234,10 @@ func writeTestScript(t *testing.T, code string) string {
 	if err := os.WriteFile(path, []byte(code), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	path, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		t.Fatal(err)
+	}
 	return path
 }
 

common/net/address.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/address.proto
 
 package net

common/net/destination.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/destination.proto
 
 package net

common/net/find_process_linux.go

@@ -4,7 +4,7 @@ package net
 
 import (
 	"bufio"
-	"encoding/binary"
+	"encoding/hex"
 	"fmt"
 	"net"
 	"os"
@@ -26,38 +26,36 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 		panic("Unsupported network type for process lookup.")
 	}
 
-	var procFiles []string
+	var procFile string
 
 	switch network {
 	case "tcp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/tcp"}
+			procFile = "/proc/net/tcp"
 		} else {
-			procFiles = []string{"/proc/net/tcp6"}
+			procFile = "/proc/net/tcp6"
 		}
 	case "udp":
 		if net.ParseIP(srcIP).To4() != nil {
-			procFiles = []string{"/proc/net/udp", "/proc/net/udp6"}
+			procFile = "/proc/net/udp"
 		} else {
-			procFiles = []string{"/proc/net/udp6", "/proc/net/udp"}
+			procFile = "/proc/net/udp6"
 		}
 	default:
 		panic("Unsupported network type for process lookup.")
 	}
 
-	targetHexAddr := formatProcNetAddress(net.ParseIP(srcIP), Port(srcPort))
+	targetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))
-
+	if err != nil {
-	portFallback := ""
+		return 0, "", "", errors.New("failed to format address: ", err)
-	if network == "udp" {
-		portFallback = fmt.Sprintf(":%04X", srcPort)
 	}
 
-	inode, err := findInodeInFiles(procFiles, targetHexAddr, portFallback)
+	inode, err := findInodeInFile(procFile, targetHexAddr)
 	if err != nil {
-		return 0, "", "", errors.New("could not search in ", strings.Join(procFiles, " and ")).Base(err)
+		return 0, "", "", errors.New("could not search in ", procFile).Base(err)
 	}
 	if inode == "" {
-		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", strings.Join(procFiles, " or "))
+		return 0, "", "", errors.New("connection for ", srcIP, ":", srcPort, " not found in ", procFile)
 	}
 
 	pidStr, err := findPidByInode(inode)
@@ -84,60 +82,51 @@ func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort
 	return pid, procName, absPath, nil
 }
 
-func formatProcNetAddress(addr net.IP, port Port) string {
+func formatLittleEndianString(addr net.IP, port Port) (string, error) {
+	ip := addr
 	var ipBytes []byte
-	if ipv4 := addr.To4(); ipv4 != nil {
+	if ip.To4() != nil {
-		ipBytes = ipv4
+		ipBytes = ip.To4()
 	} else {
-		ipBytes = addr.To16()
+		ipBytes = ip.To16()
+	}
+	if ipBytes == nil {
+		return "", errors.New("invalid IP format for ", addr, ": ", ip)
 	}
 
-	var formatted strings.Builder
+	for i, j := 0, len(ipBytes)-1; i < j; i, j = i+1, j-1 {
-	formatted.Grow(len(ipBytes)*2 + 5)
+		ipBytes[i], ipBytes[j] = ipBytes[j], ipBytes[i]
-	for i := 0; i < len(ipBytes); i += 4 {
-		fmt.Fprintf(&formatted, "%08X", binary.NativeEndian.Uint32(ipBytes[i:i+4]))
 	}
-	fmt.Fprintf(&formatted, ":%04X", uint16(port))
+	portHex := fmt.Sprintf("%04X", uint16(port))
-	return formatted.String()
+	ipHex := strings.ToUpper(hex.EncodeToString(ipBytes))
+	return fmt.Sprintf("%s:%s", ipHex, portHex), nil
 }
 
-func findInodeInFiles(filePaths []string, targetHexAddr, portFallback string) (string, error) {
+func findInodeInFile(filePath, targetHexAddr string) (string, error) {
-	onlyMatchedPort := ""
+	file, err := os.Open(filePath)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
 
-	for i, filePath := range filePaths {
+	scanner := bufio.NewScanner(file)
-		file, err := os.Open(filePath)
+
-		if err != nil {
+	for scanner.Scan() {
-			if i > 0 && os.IsNotExist(err) {
+		line := scanner.Text()
-				continue
+		fields := strings.Fields(line)
-			}
+
-			return "", err
+		if len(fields) < 10 {
+			continue
 		}
-		defer file.Close()
 
-		scanner := bufio.NewScanner(file)
+		localAddress := fields[1]
-		for scanner.Scan() {
+		if localAddress == targetHexAddr {
-			fields := strings.Fields(scanner.Text())
+			inode := fields[9]
-			if len(fields) < 10 {
+			return inode, nil
-				continue
-			}
-
-			localAddress := fields[1]
-			if localAddress == targetHexAddr {
-				return fields[9], nil
-			}
-			if portFallback != "" && strings.HasSuffix(localAddress, portFallback) {
-				wildcardIP := strings.TrimSuffix(localAddress, portFallback)
-				if (len(wildcardIP) == 8 || len(wildcardIP) == 32) && strings.Trim(wildcardIP, "0") == "" {
-					onlyMatchedPort = fields[9]
-				}
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			return "", err
 		}
 	}
 
-	return onlyMatchedPort, nil
+	return "", scanner.Err()
 }
 
 func findPidByInode(inode string) (string, error) {

common/net/network.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/network.proto
 
 package net

common/net/port.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/net/port.proto
 
 package net

common/platform/filesystem/file.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -27,6 +26,14 @@ func ReadFile(path string) ([]byte, error) {
 	return buf.ReadAllToBytes(reader)
 }
 
+func ReadAsset(file string) ([]byte, error) {
+	path, _, err := getAssetFileLocation(file)
+	if err != nil {
+		return nil, err
+	}
+	return ReadFile(path)
+}
+
 func OpenAsset(file string) (io.ReadCloser, int64, error) {
 	path, info, err := getAssetFileLocation(file)
 	if err != nil {
@@ -36,6 +43,11 @@ func OpenAsset(file string) (io.ReadCloser, int64, error) {
 	return r, info.Size(), err
 }
 
+func StatAsset(file string) (os.FileInfo, error) {
+	_, info, err := getAssetFileLocation(file)
+	return info, err
+}
+
 func ResolveAsset(file string) (string, error) {
 	path, _, err := getAssetFileLocation(file)
 	return path, err
@@ -67,29 +79,17 @@ func ReadCert(file string) ([]byte, error) {
 	return ReadFile(platform.GetCertLocation(file))
 }
 
-// ResolveLuaFile finds a local .lua script and returns its absolute path.
+func CopyFile(dst string, src string) error {
-// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+	bytes, err := ReadFile(src)
-func ResolveLuaFile(path string) (string, error) {
+	if err != nil {
-	if !strings.EqualFold(filepath.Ext(path), ".lua") {
+		return err
-		return "", errors.New("Lua file extension must be .lua")
 	}
-	if filepath.IsAbs(path) {
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY, 0o644)
-		return path, nil
+	if err != nil {
+		return err
 	}
-	for _, dir := range []string{
+	defer f.Close()
-		platform.GetConfDirPath(),
+
-		platform.NewEnvFlag(platform.ConfigLocation).GetValue(func() string { return "" }),
+	_, err = f.Write(bytes)
-		".",
+	return err
-		platform.GetExecutableDir(),
-	} {
-		if dir != "" {
-			resolved := filepath.Join(dir, path)
-			if _, err := os.Stat(resolved); err == nil {
-				return filepath.Abs(resolved)
-			} else if !os.IsNotExist(err) {
-				return "", err
-			}
-		}
-	}
-	return "", os.ErrNotExist
 }

common/platform/filesystem/file_test.go

@@ -1,17 +1,13 @@
 package filesystem_test
 
 import (
-	"errors"
-	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/platform"
 	. "github.com/xtls/xray-core/common/platform/filesystem"
 )
 
-func TestResolveAssetRejectsInvalidPath(t *testing.T) {
+func TestStatAssetRejectsInvalidPath(t *testing.T) {
 	for _, file := range []string{
 		"",
 		".",
@@ -29,49 +25,8 @@ func TestResolveAssetRejectsInvalidPath(t *testing.T) {
 		`nested\..\geoip.dat`,
 		filepath.Join(t.TempDir(), "geoip.dat"),
 	} {
-		if _, err := ResolveAsset(file); err == nil {
+		if _, err := StatAsset(file); err == nil {
 			t.Fatalf("expected error for %q", file)
 		}
 	}
 }
-
-func TestResolveLuaFile(t *testing.T) {
-	t.Chdir(t.TempDir())
-	workingDir, err := os.Getwd()
-	common.Must(err)
-	executable, err := os.Executable()
-	common.Must(err)
-	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
-	common.Must(err)
-	common.Must(file.Close())
-	defer os.Remove(file.Name())
-
-	name := filepath.Base(file.Name())
-	paths := []string{
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(workingDir, name),
-		file.Name(),
-	}
-	t.Setenv(platform.ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(platform.ConfigLocation, filepath.Dir(paths[1]))
-	for _, path := range paths[:3] {
-		common.Must(os.WriteFile(path, nil, 0o600))
-	}
-	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
-		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
-	}
-	for i, want := range paths {
-		if i == 2 {
-			t.Setenv(platform.ConfdirLocation, "")
-			t.Setenv(platform.ConfigLocation, "")
-		}
-		if got, err := ResolveLuaFile(name); err != nil || got != want {
-			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
-		}
-		common.Must(os.Remove(want))
-	}
-	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("missing file error = %v", err)
-	}
-}

common/platform/others.go

@@ -14,7 +14,7 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir, the executable dir, and certain locations
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	defPath := filepath.Join(assetPath, file)
 	for _, p := range []string{
 		defPath,
@@ -36,6 +36,6 @@ func GetAssetLocation(file string) string {
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/platform/platform.go

@@ -1,6 +1,8 @@
 package platform // import "github.com/xtls/xray-core/common/platform"
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -72,7 +74,7 @@ func NormalizeEnvName(name string) string {
 	return strings.ReplaceAll(strings.ToUpper(strings.TrimSpace(name)), ".", "_")
 }
 
-func GetExecutableDir() string {
+func getExecutableDir() string {
 	exec, err := os.Executable()
 	if err != nil {
 		return ""
@@ -81,7 +83,7 @@ func GetExecutableDir() string {
 }
 
 func GetConfigurationPath() string {
-	configPath := NewEnvFlag(ConfigLocation).GetValue(GetExecutableDir)
+	configPath := NewEnvFlag(ConfigLocation).GetValue(getExecutableDir)
 	return filepath.Join(configPath, "config.json")
 }
 
@@ -90,3 +92,64 @@ func GetConfDirPath() string {
 	configPath := NewEnvFlag(ConfdirLocation).GetValue(func() string { return "" })
 	return configPath
 }
+
+// ResolveLuaFile finds a local .lua script and returns its resolved absolute path.
+// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
+func ResolveLuaFile(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("Lua file path is empty")
+	}
+	paths := []string{path}
+	if !filepath.IsAbs(path) {
+		paths = nil
+		for _, dir := range []string{
+			GetConfDirPath(),
+			NewEnvFlag(ConfigLocation).GetValue(func() string { return "" }),
+			".",
+			getExecutableDir(),
+		} {
+			if dir != "" {
+				paths = append(paths, filepath.Join(dir, path))
+			}
+		}
+	}
+	path, err := resolveFile(paths)
+	if err != nil {
+		return "", err
+	}
+	return resolveLuaTarget(path)
+}
+
+func resolveLuaTarget(path string) (string, error) {
+	path, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve Lua file symlinks: %w", err)
+	}
+	if filepath.Ext(path) != ".lua" {
+		return "", errors.New("Lua file extension must be .lua")
+	}
+	return path, nil
+}
+
+func resolveFile(paths []string) (string, error) {
+	var tried []string
+	for _, path := range paths {
+		path, err := filepath.Abs(path)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve file path: %w", err)
+		}
+		tried = append(tried, path)
+		info, err := os.Stat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return "", fmt.Errorf("failed to inspect file %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("file is not a regular file: %s", path)
+		}
+		return path, nil
+	}
+	return "", fmt.Errorf("file not found; tried %q: %w", tried, os.ErrNotExist)
+}

common/platform/platform_test.go

@@ -1,9 +1,11 @@
 package platform_test
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/xtls/xray-core/common"
@@ -64,3 +66,89 @@ func TestGetAssetLocation(t *testing.T) {
 		}
 	}
 }
+
+func TestResolveLuaFile(t *testing.T) {
+	workingDir := t.TempDir()
+	t.Chdir(workingDir)
+	executable, err := os.Executable()
+	common.Must(err)
+	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
+	common.Must(err)
+	common.Must(file.Close())
+	defer os.Remove(file.Name())
+
+	name := filepath.Base(file.Name())
+	paths := []string{
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(t.TempDir(), name),
+		filepath.Join(workingDir, name),
+		file.Name(),
+	}
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	for _, path := range paths[:3] {
+		common.Must(os.WriteFile(path, nil, 0o600))
+	}
+	for i, path := range paths {
+		paths[i], err = filepath.EvalSymlinks(path)
+		common.Must(err)
+	}
+	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
+		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
+	}
+	for i, want := range paths {
+		if i == 2 {
+			t.Setenv(ConfdirLocation, "")
+			t.Setenv(ConfigLocation, "")
+		}
+		if got, err := ResolveLuaFile(name); err != nil || got != want {
+			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
+		}
+		common.Must(os.Remove(want))
+	}
+	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing file error = %v", err)
+	}
+
+	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
+	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
+	common.Must(os.Mkdir(paths[0], 0o700))
+	common.Must(os.WriteFile(paths[1], nil, 0o600))
+	for _, path := range []string{"", name, filepath.Join(t.TempDir(), name)} {
+		if _, err := ResolveLuaFile(path); err == nil {
+			t.Fatalf("accepted invalid path %q", path)
+		}
+	}
+}
+
+func TestResolveLuaFileSymlink(t *testing.T) {
+	for _, tc := range []struct {
+		link, target string
+		valid        bool
+	}{
+		{"alias.lua", "data.dat", false},
+		{"alias.dat", "script.lua", true},
+	} {
+		t.Run(tc.link, func(t *testing.T) {
+			dir, err := filepath.EvalSymlinks(t.TempDir())
+			common.Must(err)
+			target := filepath.Join(dir, tc.target)
+			common.Must(os.WriteFile(target, nil, 0o600))
+			link := filepath.Join(dir, tc.link)
+			if err := os.Symlink(tc.target, link); err != nil {
+				if runtime.GOOS == "windows" {
+					t.Skipf("cannot create symlinks: %v", err)
+				}
+				t.Fatal(err)
+			}
+			got, err := ResolveLuaFile(link)
+			if tc.valid {
+				if err != nil || got != target {
+					t.Fatalf("ResolveLuaFile(%q) = %q, %v; want %q", link, got, err, target)
+				}
+			} else if err == nil || got != "" || !strings.Contains(err.Error(), "Lua file extension must be .lua") {
+				t.Fatalf("ResolveLuaFile(%q) = %q, %v; want .lua extension error", link, got, err)
+			}
+		})
+	}
+}

common/platform/windows.go

@@ -11,12 +11,12 @@ func LineSeparator() string {
 
 // GetAssetLocation searches for `file` in the env dir and the executable dir
 func GetAssetLocation(file string) string {
-	assetPath := NewEnvFlag(AssetLocation).GetValue(GetExecutableDir)
+	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	return filepath.Join(assetPath, file)
 }
 
 // GetCertLocation searches for `file` in the env dir and the executable dir
 func GetCertLocation(file string) string {
-	certPath := NewEnvFlag(CertLocation).GetValue(GetExecutableDir)
+	certPath := NewEnvFlag(CertLocation).GetValue(getExecutableDir)
 	return filepath.Join(certPath, file)
 }

common/protocol/headers.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/headers.proto
 
 package protocol

common/protocol/server_spec.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/server_spec.proto
 
 package protocol

common/protocol/tls/sniff.go

@@ -101,10 +101,6 @@ func ReadClientHello(data []byte, h *SniffHeader) error {
 					return errNotClientHello
 				}
 				if nameType == 0 {
-					// RFC 6066 requires a non-empty HostName.
-					if nameLen == 0 {
-						return errNotClientHello
-					}
 					// QUIC separated across packets
 					// May cause the serverName to be incomplete
 					b := byte(0)

common/protocol/user.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/protocol/user.proto
 
 package protocol

common/reflect/marshal_test.go

@@ -134,7 +134,7 @@ func TestMarshalConfigJson(t *testing.T) {
 func getConfig() string {
 	return `{
   "log": {
-    "logLevel": "debug"
+    "loglevel": "debug"
   },
   "stats": {},
   "policy": {

common/serial/typed_message.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: common/serial/typed_message.proto
 
 package serial

core/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: core/config.proto
 
 package core

core/core.go

@@ -20,7 +20,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 10
-	Version_z byte = 31
+	Version_z byte = 17
 )
 
 var (

core/proto.go

@@ -1,3 +1,5 @@
 package core
 
+//go:generate go install -v google.golang.org/protobuf/cmd/protoc-gen-go@latest
+//go:generate go install -v google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 //go:generate go run ../infra/vprotogen/main.go -pwd ./..

features/dns/localdns/client.go

@@ -2,7 +2,6 @@ package localdns
 
 import (
 	"context"
-	"net/netip"
 	"syscall"
 	"time"
 
@@ -101,15 +100,6 @@ func New() *Client {
 			if internet.IsSkippedDNSServer(address) {
 				return nil, errors.New("skipped DNS server ", address)
 			}
-			// A socket of the server's IP version only needs that version bound
-			// to the interface, which a dual-stack one would need both of.
-			if ap, err := netip.ParseAddrPort(address); err == nil && (network == "udp" || network == "tcp") {
-				if ap.Addr().Unmap().Is4() {
-					network += "4"
-				} else {
-					network += "6"
-				}
-			}
 			return d.DialContext(ctx, network, address)
 		},
 	}

go.mod

@@ -4,18 +4,17 @@ go 1.27
 
 require (
 	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/bufbuild/protocompile v0.14.1
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.2
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.7
-	github.com/pires/go-proxyproto v0.16.0
+	github.com/pires/go-proxyproto v0.15.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/stretchr/testify v1.12.1
@@ -24,15 +23,15 @@ require (
 	github.com/yuin/gopher-lua v1.1.2
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
 	golang.org/x/crypto v0.58.0
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.62.0
+	golang.org/x/net v0.61.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.1.1
-	google.golang.org/grpc v1.85.0
+	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	h12.io/socks v1.0.3
 	layeh.com/gopher-luar v1.0.11
@@ -58,13 +57,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
 )
-
-tool (
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc
-	google.golang.org/protobuf/cmd/protoc-gen-go
-)

go.sum

@@ -2,8 +2,6 @@ github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA
 github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg=
 github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8=
-github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
-github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -35,8 +33,8 @@ github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
 github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/klauspost/cpuid/v2 v2.4.2 h1:xRw7IZEsAgVCp6trS/DgWbTAqpixhmywgVgBjYGg1bQ=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.2/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -61,8 +59,8 @@ github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
 github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
 github.com/pion/transport/v4 v4.1.0 h1:8S+nF2reM2cJuqC6g78OVy2BBgmbdns+acx3jA97BvQ=
 github.com/pion/transport/v4 v4.1.0/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.16.0 h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
+github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.16.0/go.mod h1:n7yhg8yIfNl3KgYDCwBzmeUHNpKTVnUhcWpc7rV4RW4=
+github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -99,8 +97,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
 golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582 h1:wjDBrGbfLuifgrVLFEWUBJYAfh5Q1wkMc5t0FY0tCbs=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20261020153306-9f2b28d4331a/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20261005185213-c3db4df58582/go.mod h1:HPze8vhfG6fO06AM+VSvxRm4E3+5Yk375mgrJ5M2z1E=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -109,8 +107,8 @@ golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
@@ -150,12 +148,10 @@ golang.zx2c4.com/wireguard/windows v1.1.1 h1:8/H97U1v1PNDNcBsMZgU3KFuND9MQdTsU2N
 golang.zx2c4.com/wireguard/windows v1.1.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/freedom.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/log"
 	xnet "github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/proxy/freedom"
@@ -49,8 +48,6 @@ type FreedomFinalRuleConfig struct {
 	Network    *NetworkList `json:"network"`
 	Port       *PortList    `json:"port"`
 	IP         *StringList  `json:"ip"`
-	Delay      *Int32Range  `json:"delay"`
-	LogLevel   string       `json:"logLevel"`
 	BlockDelay *Int32Range  `json:"blockDelay"`
 }
 
@@ -94,7 +91,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Fragment != nil {
-		errors.PrintDeprecatedFeatureWarning(`"fragment" in Freedom`, `"fragment" in "streamSettings.finalmask.tcp"`)
 		config.Fragment = new(freedom.Fragment)
 
 		switch strings.ToLower(c.Fragment.Packets) {
@@ -151,7 +147,6 @@ func (c *FreedomConfig) Build() (proto.Message, error) {
 	}
 
 	if c.Noises != nil {
-		errors.PrintDeprecatedFeatureWarning(`"noises" in Freedom`, `"noise" in "streamSettings.finalmask.udp"`)
 		for _, n := range c.Noises {
 			NConfig, err := ParseNoise(n)
 			if err != nil {
@@ -283,37 +278,10 @@ func (c *FreedomFinalRuleConfig) Build() (*freedom.FinalRuleConfig, error) {
 	}
 
 	if c.BlockDelay != nil {
-		errors.PrintDeprecatedFeatureWarning("finalRules.blockDelay", "finalRules.delay")
+		rule.BlockDelay = &freedom.Range{
-		c.Delay = c.BlockDelay
+			Min: uint64(c.BlockDelay.From),
-	}
+			Max: uint64(c.BlockDelay.To),
-
-	if rule.Action != freedom.RuleAction_Block {
-		if c.Delay != nil || c.LogLevel != "" {
-			return nil, errors.New("delay and logLevel are only supported for block finalRules")
 		}
-		return rule, nil
-	}
-
-	if c.Delay != nil {
-		rule.Delay = &freedom.Range{
-			Min: uint64(c.Delay.From),
-			Max: uint64(c.Delay.To),
-		}
-	}
-
-	switch strings.ToLower(c.LogLevel) {
-	case "", "info":
-		rule.LogLevel = log.Severity_Info.Enum()
-	case "none":
-		rule.LogLevel = log.Severity_Unknown.Enum()
-	case "debug":
-		rule.LogLevel = log.Severity_Debug.Enum()
-	case "warning":
-		rule.LogLevel = log.Severity_Warning.Enum()
-	case "error":
-		rule.LogLevel = log.Severity_Error.Enum()
-	default:
-		return nil, errors.New("unknown finalRules.logLevel: ", c.LogLevel)
 	}
 
 	return rule, nil

infra/conf/freedom_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	. "github.com/xtls/xray-core/infra/conf"
@@ -47,8 +46,7 @@ func TestFreedomConfig(t *testing.T) {
 					"network": "tcp,udp",
 					"port": "53,443",
 					"ip": ["10.0.0.0/8", "2001:db8::/32"],
-					"delay": "30-60",
+					"blockDelay": "30-60"
-					"logLevel": "debug"
 				}, {
 					"action": "allow",
 					"network": ["udp"]
@@ -88,8 +86,10 @@ func TestFreedomConfig(t *testing.T) {
 								},
 							},
 						},
-						Delay:    &freedom.Range{Min: 30, Max: 60},
+						BlockDelay: &freedom.Range{
-						LogLevel: log.Severity_Debug.Enum(),
+							Min: 30,
+							Max: 60,
+						},
 					},
 					{
 						Action:   freedom.RuleAction_Allow,

infra/conf/geodata.go

@@ -6,6 +6,7 @@ import (
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/app/geodata"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -18,6 +19,9 @@ func (c *GeodataAssetConfig) Build() (*geodata.Asset, error) {
 	if err := validateHTTPS(c.URL); err != nil {
 		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
 	}
+	if _, err := filesystem.StatAsset(c.File); err != nil {
+		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
+	}
 	return &geodata.Asset{
 		Url:  c.URL,
 		File: c.File,

infra/conf/geodata_test.go

@@ -1,6 +1,7 @@
 package conf_test
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/xtls/xray-core/app/geodata"
@@ -8,6 +9,8 @@ import (
 )
 
 func TestGeodataConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	creator := func() Buildable {
 		return new(GeodataConfig)
 	}
@@ -35,7 +38,27 @@ func TestGeodataConfig(t *testing.T) {
 	})
 }
 
+func TestGeodataAssetConfig(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "geoip.dat",
+	}).Build(); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := (&GeodataAssetConfig{
+		URL:  "https://example.com/geoip.dat",
+		File: "missing.dat",
+	}).Build(); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
 func TestGeodataAssetConfigInvalidURL(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
 	for _, rawURL := range []string{
 		"",
 		"http://example.com/geoip.dat",

infra/conf/log.go

@@ -18,7 +18,7 @@ func DefaultLogConfig() *log.Config {
 type LogConfig struct {
 	AccessLog   string `json:"access"`
 	ErrorLog    string `json:"error"`
-	LogLevel    string `json:"logLevel"`
+	LogLevel    string `json:"loglevel"`
 	DNSLog      bool   `json:"dnsLog"`
 	MaskAddress string `json:"maskAddress"`
 }

infra/conf/serial/loader_test.go

@@ -18,7 +18,7 @@ func TestLoaderError(t *testing.T) {
 				"log": {
 					// abcd
 					0,
-					"logLevel": "info"
+					"loglevel": "info"
 				}
 		}`,
 			Output: "line 4 char 6",
@@ -27,7 +27,7 @@ func TestLoaderError(t *testing.T) {
 			Input: `{
 				"log": {
 					// abcd
-					"logLevel": "info",
+					"loglevel": "info",
 				}
 		}`,
 			Output: "line 5 char 5",

infra/conf/transport_finalmask.go

@@ -15,11 +15,9 @@ import (
 
 	googleuuid "github.com/google/uuid"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/geodata"
 	xlua "github.com/xtls/xray-core/common/lua"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/finalmask/filter"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/aes128gcm"
@@ -76,7 +74,6 @@ var (
 	customVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
 
 	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
@@ -84,7 +81,6 @@ var (
 	}, "type", "settings")
 
 	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"filter":        func() interface{} { return new(Filter) },
 		"header-custom": func() interface{} { return new(HeaderCustomUDP) },
 		"mkcp-legacy":   func() interface{} { return new(MkcpLegacy) },
 		"noise":         func() interface{} { return new(NoiseMask) },
@@ -97,23 +93,6 @@ var (
 	}, "type", "settings")
 )
 
-type Filter struct {
-	BlockedSourceIPs []string `json:"blockedSourceIPs"`
-	AllowedSourceIPs []string `json:"allowedSourceIPs"`
-}
-
-func (c *Filter) Build() (proto.Message, error) {
-	rules, err := geodata.ParseIPRules(c.BlockedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "blockedSourceIPs"`).Base(err)
-	}
-	allowed, err := geodata.ParseIPRules(c.AllowedSourceIPs)
-	if err != nil {
-		return nil, errors.New(`invalid "allowedSourceIPs"`).Base(err)
-	}
-	return &filter.Config{BlockedSourceIps: rules, AllowedSourceIps: allowed}, nil
-}
-
 type TCPItem struct {
 	Delay     Int32Range       `json:"delay"`
 	Rand      int32            `json:"rand"`

infra/conf/transport_finalmask_filter_test.go

@@ -1,79 +0,0 @@
-package conf_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"net"
-	"strings"
-	"testing"
-
-	"github.com/xtls/xray-core/common/geodata"
-	. "github.com/xtls/xray-core/infra/conf"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/finalmask/filter"
-)
-
-func TestFinalMaskFilter(t *testing.T) {
-	for _, network := range []string{"tcp", "udp"} {
-		for _, test := range []struct {
-			name, settings   string
-			blocked, allowed int
-		}{
-			{"blacklist", `{"blockedSourceIPs":["192.0.2.0/24"]}`, 1, 0},
-			{"whitelist", `{"allowedSourceIPs":["192.0.2.0/24"]}`, 0, 1},
-			{"both", `{"blockedSourceIPs":["192.0.2.0/24"],"allowedSourceIPs":["192.0.2.0/24"]}`, 1, 1},
-			{"empty_whitelist", `{"allowedSourceIPs":[]}`, 0, 0},
-			{"empty_blacklist", `{"blockedSourceIPs":[]}`, 0, 0},
-		} {
-			t.Run(network+"/"+test.name, func(t *testing.T) {
-				input := fmt.Sprintf(`{"finalmask":{"%s":[{"type":"filter","settings":%s}]}}`, network, test.settings)
-				var config StreamConfig
-				if err := json.Unmarshal([]byte(input), &config); err != nil {
-					t.Fatal(err)
-				}
-				built, err := config.Build()
-				if err != nil {
-					t.Fatal(err)
-				}
-				masks := built.Tcpmasks
-				if network == "udp" {
-					masks = built.Udpmasks
-				}
-				if len(masks) != 1 {
-					t.Fatalf("expected one mask, got %d", len(masks))
-				}
-				instance, err := masks[0].GetInstance()
-				if err != nil {
-					t.Fatal(err)
-				}
-				filter, ok := instance.(*filter.Config)
-				if !ok {
-					t.Fatalf("unexpected mask type: %T", instance)
-				}
-				if len(filter.BlockedSourceIps) != test.blocked || len(filter.AllowedSourceIps) != test.allowed {
-					t.Fatalf("unexpected filter policy: %v", filter)
-				}
-				for _, rules := range [][]*geodata.IPRule{filter.BlockedSourceIps, filter.AllowedSourceIps} {
-					for _, rule := range rules {
-						cidr := rule.GetCustom().GetCidr()
-						if cidr.GetPrefix() != 24 || !net.IP(cidr.GetIp()).Equal(net.IPv4(192, 0, 2, 0)) {
-							t.Fatalf("unexpected IP rule: %v", cidr)
-						}
-					}
-				}
-				if _, err := internet.ToMemoryStreamConfig(built); err != nil {
-					t.Fatalf("failed to initialize runtime finalmask: %v", err)
-				}
-			})
-		}
-	}
-	for _, field := range []string{"blockedSourceIPs", "allowedSourceIPs"} {
-		var config Filter
-		if err := json.Unmarshal([]byte(fmt.Sprintf(`{"%s":["192.0.2.0/33"]}`, field)), &config); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), field) {
-			t.Errorf("expected invalid %s, got %v", field, err)
-		}
-	}
-}

infra/conf/transport_internet.go

@@ -90,7 +90,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		config.ProtocolName = protocol
 	}
 
-	var xdriveH3 bool
 	switch strings.ToLower(c.Security) {
 	case "", "none":
 	case "tls":
@@ -105,7 +104,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		tm := serial.ToTypedMessage(ts)
 		config.SecuritySettings = append(config.SecuritySettings, tm)
 		config.SecurityType = tm.Type
-		xdriveH3 = config.ProtocolName == "xdrive" && tlsSettings.ALPN != nil && slices.Equal(*tlsSettings.ALPN, StringList{"h3"})
 		if config.ProtocolName == "xdrive" && tlsSettings.ALPN != nil && slices.Equal(*tlsSettings.ALPN, StringList{"http/1.1"}) && tlsSettings.ECHConfigList == "" {
 			// a fingerprint puts its own ALPN into the hello, except Go TLS and the
 			// randomized ones, which take it from the config or send none
@@ -221,7 +219,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		})
 	}
 	if c.XDRIVESettings != nil {
-		c.XDRIVESettings.h3 = xdriveH3
 		xs, err := c.XDRIVESettings.Build()
 		if err != nil {
 			return nil, errors.New("Failed to build XDRIVE config.").Base(err)
@@ -263,20 +260,5 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 		}
 	}
 
-	if xdriveH3 && c.FinalMask != nil {
-		if c.XDRIVESettings != nil && c.XDRIVESettings.Service == "google-drive" {
-			// noise only sends datagrams of its own ahead of the QUIC ones, the
-			// other masks change those or need a peer that undoes them
-			for _, mask := range c.FinalMask.Udp {
-				if strings.ToLower(mask.Type) != "noise" {
-					return nil, errors.New(`XDRIVE: over h3 to Google Drive the only "udp" mask that works is "noise", not "`, mask.Type, `"`)
-				}
-			}
-		}
-		if config.QuicParams != nil && (config.QuicParams.Congestion == "brutal" || config.QuicParams.Congestion == "force-brutal") {
-			return nil, errors.New(`XDRIVE: brutal is for Hysteria servers, over h3 "congestion" is "bbr" or "reno", not "`, config.QuicParams.Congestion, `"`)
-		}
-	}
-
 	return config, nil
 }

infra/conf/transport_method.go

@@ -293,7 +293,6 @@ type SplitHTTPConfig struct {
 	ServerMaxHeaderBytes int32             `json:"serverMaxHeaderBytes"`
 	Xmux                 XmuxConfig        `json:"xmux"`
 	DownloadSettings     *StreamConfig     `json:"downloadSettings"`
-	H2Params             json.RawMessage   `json:"h2Params"`
 	Extra                json.RawMessage   `json:"extra"`
 }
 
@@ -496,7 +495,6 @@ func (c *SplitHTTPConfig) Build() (proto.Message, error) {
 		ServerMaxHeaderBytes: c.ServerMaxHeaderBytes,
 		SessionIDTable:       c.SessionIDTable,
 		SessionIDLength:      newRangeConfig(c.SessionIDLength),
-		H2Params:             c.H2Params,
 		Xmux: &splithttp.XmuxConfig{
 			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
 			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
@@ -999,18 +997,6 @@ type XDriveConfig struct {
 	EagerWindowMs     uint32          `json:"eagerWindowMs"`
 	HoleTimeoutMs     uint32          `json:"holeTimeoutMs"`
 	Template          json.RawMessage `json:"template"`
-	S3                *XDriveS3Config `json:"s3"`
-	Xmux              XmuxConfig      `json:"xmux"`
-
-	// set by StreamConfig when "alpn" is ["h3"]
-	h3 bool
-}
-
-type XDriveS3Config struct {
-	Endpoint  string `json:"endpoint"`
-	Region    string `json:"region"`
-	Bucket    string `json:"bucket"`
-	PathStyle *bool  `json:"pathStyle"`
 }
 
 // Build implements Buildable.
@@ -1029,27 +1015,8 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 		if len(c.Template) == 0 {
 			return nil, errors.New(`service "template" needs a "template" object`)
 		}
-	case "s3":
-		if c.S3 == nil {
-			return nil, errors.New(`service "s3" needs an "s3" object`)
-		}
 	default:
-		return nil, errors.New(`unknown "service": "`, c.Service, `", use "google-drive", "template", "s3" or "local"`)
+		return nil, errors.New(`unknown "service": "`, c.Service, `", use "google-drive", "template" or "local"`)
-	}
-	if c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {
-		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
-	}
-	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConnections.From = 1
-		c.Xmux.MaxConnections.To = 1
-		if c.Service == "google-drive" && !c.h3 {
-			// Google gives an h2 connection 1 MiB of window, which a few sessions on
-			// a long rtt would share, an h3 connection has no such limit
-			c.Xmux.MaxConnections.From = 4
-			c.Xmux.MaxConnections.To = 4
-		}
-		c.Xmux.HMaxReusableSecs.From = 1800
-		c.Xmux.HMaxReusableSecs.To = 3000
 	}
 	config := &xdrive.Config{
 		RemoteFolder:      c.RemoteFolder,
@@ -1064,25 +1031,6 @@ func (c *XDriveConfig) Build() (proto.Message, error) {
 		EagerWindowMs:     c.EagerWindowMs,
 		HoleTimeoutMs:     c.HoleTimeoutMs,
 		Template:          string(c.Template),
-		Xmux: &splithttp.XmuxConfig{
-			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
-			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
-			CMaxReuseTimes:   newRangeConfig(c.Xmux.CMaxReuseTimes),
-			HMaxRequestTimes: newRangeConfig(c.Xmux.HMaxRequestTimes),
-			HMaxReusableSecs: newRangeConfig(c.Xmux.HMaxReusableSecs),
-			HKeepAlivePeriod: c.Xmux.HKeepAlivePeriod,
-		},
-	}
-	if c.Service == "s3" {
-		config.S3 = &xdrive.S3Config{
-			Endpoint:  c.S3.Endpoint,
-			Region:    c.S3.Region,
-			Bucket:    c.S3.Bucket,
-			PathStyle: c.S3.PathStyle == nil || *c.S3.PathStyle,
-		}
-		if err := xdrive.ValidateS3Config(config); err != nil {
-			return nil, err
-		}
 	}
 	return config, nil
 }

infra/conf/transport_test.go

@@ -9,7 +9,6 @@ import (
 	. "github.com/xtls/xray-core/infra/conf"
 	"github.com/xtls/xray-core/transport/internet"
 	finalmaskcustom "github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
 	"github.com/xtls/xray-core/transport/internet/xdrive"
 	"google.golang.org/protobuf/proto"
 )
@@ -324,7 +323,7 @@ func TestXDriveRejectsUnknownService(t *testing.T) {
 	if err := json.Unmarshal([]byte(`{"remoteFolder": "/tmp/xdrive", "service": "Dropbox"}`), config); err != nil {
 		t.Fatalf("Unmarshal: %v", err)
 	}
-	if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), `use "google-drive", "template", "s3" or "local"`) {
+	if _, err := config.Build(); err == nil || !strings.Contains(err.Error(), `use "google-drive", "template" or "local"`) {
 		t.Fatalf("expected an unknown service error, got %v", err)
 	}
 }
@@ -425,81 +424,6 @@ func TestXDriveHTTP1ALPNWarning(t *testing.T) {
 	}
 }
 
-// over h3 Google Drive takes only the noise mask, and no service takes brutal
-func TestXDriveH3Checks(t *testing.T) {
-	const (
-		drive       = `"method": "xdrive", "xdriveSettings": {"remoteFolder": "f", "service": "google-drive", "secrets": ["a", "b", "c"]}`
-		local       = `"method": "xdrive", "xdriveSettings": {"remoteFolder": "/tmp/xdrive", "service": "local"}`
-		noise       = `{"type": "Noise", "settings": {"noise": [{"rand": "50-100"}]}}`
-		salamander  = `{"type": "salamander", "settings": {"password": "p"}}`
-		forceBrutal = `{"quicParams": {"congestion": "force-brutal", "brutalUp": "10 mbps"}}`
-	)
-	for _, c := range []struct {
-		alpn, transport, finalmask string
-		ok                         bool
-	}{
-		{`["h3"]`, drive, `{"udp": [` + noise + `]}`, true},
-		{`["h3"]`, drive, `{"udp": [` + salamander + `]}`, false},
-		{`["h3"]`, drive, `{"udp": [` + noise + `, ` + salamander + `]}`, false},
-		{`["h3"]`, local, `{"udp": [` + salamander + `]}`, true},
-		{`["h3"]`, `"method": "xdrive"`, `{"udp": [` + salamander + `]}`, true},
-		{`["h2"]`, drive, `{"udp": [` + salamander + `]}`, true},
-		{`null`, drive, `{"udp": [` + salamander + `]}`, true},
-		{`["h3"]`, drive, `null`, true},
-		{`["h3"]`, drive, `{"quicParams": {"congestion": "bbr"}}`, true},
-		{`["h3"]`, drive, `{"quicParams": {"congestion": "brutal"}}`, false},
-		{`["h3"]`, local, forceBrutal, false},
-		{`["h3", "h2"]`, drive, `{"quicParams": {"congestion": "brutal"}}`, true},
-		{`["h3"]`, `"method": "xhttp"`, forceBrutal, true},
-	} {
-		config := new(StreamConfig)
-		if err := json.Unmarshal([]byte(`{
-			`+c.transport+`,
-			"security": "tls",
-			"tlsSettings": {"alpn": `+c.alpn+`},
-			"finalmask": `+c.finalmask+`
-		}`), config); err != nil {
-			t.Fatalf("Unmarshal: %v", err)
-		}
-		if _, err := config.Build(); (err == nil) != c.ok {
-			t.Errorf("alpn %s, %s, finalmask %s: %v", c.alpn, c.transport, c.finalmask, err)
-		}
-	}
-}
-
-// one h3 connection is not held back by a window like h2, so h3 takes one by default
-func TestXDriveH3Connections(t *testing.T) {
-	for _, c := range []struct {
-		alpn string
-		want int32
-	}{
-		{`["h3"]`, 1},
-		{`["h2"]`, 4},
-		{`null`, 4},
-	} {
-		config := new(StreamConfig)
-		if err := json.Unmarshal([]byte(`{
-			"method": "xdrive",
-			"xdriveSettings": {"remoteFolder": "f", "service": "google-drive", "secrets": ["a", "b", "c"]},
-			"security": "tls",
-			"tlsSettings": {"alpn": `+c.alpn+`}
-		}`), config); err != nil {
-			t.Fatalf("Unmarshal: %v", err)
-		}
-		built, err := config.Build()
-		if err != nil {
-			t.Fatalf("alpn %s: %v", c.alpn, err)
-		}
-		xs, err := built.TransportSettings[0].Settings.GetInstance()
-		if err != nil {
-			t.Fatalf("alpn %s: %v", c.alpn, err)
-		}
-		if got := xs.(*xdrive.Config).Xmux.MaxConnections; got.From != c.want || got.To != c.want {
-			t.Errorf("alpn %s: maxConnections is %d-%d, want %d", c.alpn, got.From, got.To, c.want)
-		}
-	}
-}
-
 func TestXDriveTemplateNeedsTemplate(t *testing.T) {
 	config := new(XDriveConfig)
 	if err := json.Unmarshal([]byte(`{"remoteFolder": "f", "service": "template"}`), config); err != nil {
@@ -589,50 +513,3 @@ func TestXDriveInboundConfig(t *testing.T) {
 		}
 	}
 }
-
-func TestXDriveXmux(t *testing.T) {
-	defaults := func(connections int32) *splithttp.XmuxConfig {
-		return &splithttp.XmuxConfig{
-			MaxConcurrency:   &splithttp.RangeConfig{},
-			MaxConnections:   &splithttp.RangeConfig{From: connections, To: connections},
-			CMaxReuseTimes:   &splithttp.RangeConfig{},
-			HMaxRequestTimes: &splithttp.RangeConfig{},
-			HMaxReusableSecs: &splithttp.RangeConfig{From: 1800, To: 3000},
-		}
-	}
-	for _, c := range []struct {
-		input string
-		want  *splithttp.XmuxConfig
-	}{
-		{`{"service": "google-drive", "secrets": ["a", "b", "c"]}`, defaults(4)},
-		{`{"service": "template", "template": {}}`, defaults(1)},
-		{`{"service": "google-drive", "secrets": ["a", "b", "c"], "xmux": {"maxConcurrency": "1-2", "hMaxRequestTimes": 100, "hKeepAlivePeriod": -1}}`, &splithttp.XmuxConfig{
-			MaxConcurrency:   &splithttp.RangeConfig{From: 1, To: 2},
-			MaxConnections:   &splithttp.RangeConfig{},
-			CMaxReuseTimes:   &splithttp.RangeConfig{},
-			HMaxRequestTimes: &splithttp.RangeConfig{From: 100, To: 100},
-			HMaxReusableSecs: &splithttp.RangeConfig{},
-			HKeepAlivePeriod: -1,
-		}},
-	} {
-		config := new(XDriveConfig)
-		if err := json.Unmarshal([]byte(c.input), config); err != nil {
-			t.Fatalf("%s: Unmarshal: %v", c.input, err)
-		}
-		built, err := config.Build()
-		if err != nil {
-			t.Fatalf("%s: Build: %v", c.input, err)
-		}
-		if got := built.(*xdrive.Config).Xmux; !proto.Equal(got, c.want) {
-			t.Errorf("%s: xmux is %v, want %v", c.input, got, c.want)
-		}
-	}
-
-	config := new(XDriveConfig)
-	if err := json.Unmarshal([]byte(`{"service": "template", "template": {}, "xmux": {"maxConnections": 2, "maxConcurrency": 8}}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-	if _, err := config.Build(); err == nil {
-		t.Error("Build accepted maxConnections with maxConcurrency")
-	}
-}

infra/conf/tun.go

@@ -6,7 +6,9 @@ import (
 	"math/big"
 	"net"
 	"runtime"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/proxy/tun"
@@ -37,22 +39,25 @@ func (v *TunConfig) Build() (proto.Message, error) {
 		AutoSystemRoutingTable: v.AutoSystemRoutingTable,
 		AutoSystemDnsToGateway: v.AutoSystemDnsToGateway,
 	}
-	leaks, err := tun.ExpandWfpBlockLeak(v.AutoSystemWfpBlockLeak)
+	for _, leak := range v.AutoSystemWfpBlockLeak {
-	if err != nil {
+		switch leak := strings.ToLower(leak); leak {
-		return nil, err
+		case "dns", "misconfigtun":
+			config.AutoSystemWfpBlockLeak = append(config.AutoSystemWfpBlockLeak, leak)
+		default:
+			return nil, errors.New("unknown autoSystemWfpBlockLeak value: ", leak)
+		}
 	}
-	config.AutoSystemWfpBlockLeak = leaks
 	// Each option needs other settings on the system it takes effect on: the
-	// filters go along with the routes of autoSystemRoutingTable, keeping the
+	// filters go along with the routes of autoSystemRoutingTable, "dns" lets
-	// system's DNS inside the TUN needs DNS servers on it, and
+	// DNS through the TUN only, and autoSystemDnsToGateway points the system
-	// autoSystemDnsToGateway points the system DNS at the gateway.
+	// DNS at the gateway.
 	switch runtime.GOOS {
 	case "windows":
-		if len(leaks) > 0 && len(v.AutoSystemRoutingTable) == 0 {
+		if len(config.AutoSystemWfpBlockLeak) > 0 && len(v.AutoSystemRoutingTable) == 0 {
 			return nil, errors.New("autoSystemWfpBlockLeak needs autoSystemRoutingTable to be set")
 		}
-		if tun.BlocksSystemDNS(leaks) && len(v.DNS) == 0 {
+		if slices.Contains(config.AutoSystemWfpBlockLeak, "dns") && len(v.DNS) == 0 {
-			return nil, errors.New(`autoSystemWfpBlockLeak "all", "allexceptlan", "dns", "windnsclient", or TCP or UDP port 53, needs dns to be set`)
+			return nil, errors.New(`autoSystemWfpBlockLeak "dns" needs dns to be set`)
 		}
 	case "linux", "freebsd":
 		if v.AutoSystemDnsToGateway && len(v.Gateway) == 0 {

infra/conf/tun_test.go

@@ -29,37 +29,12 @@ func TestTunConfigAutoSystem(t *testing.T) {
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns", "misconfigtun"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"53", "853", "windnsclient", "misconfigtun"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns", "misconfigtun"}},
 		},
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["DNS"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"53", "853", "windnsclient"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns"}},
-		},
-		{
-			Input:  `{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["TCP/853", "udp/853", "tcp/0853"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"tcp/853", "udp/853"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["All", "UDP", "tcp/8000-9000", "icmp"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"all", "udp", "tcp/8000-9000", "icmp"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["AllExceptLAN"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"allexceptlan", "53", "853", "windnsclient"}},
-		},
-		{
-			Input:  `{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["1.1.1.1/24:TCP/853", "[2001:DB8::/32]:udp/10-20", "[::/0]:ICMP", "853"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"1.1.1.0/24:tcp/853", "[2001:db8::/32]:udp/10-20", "[::/0]:icmp", "853"}},
-		},
-		{
-			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:dns", "[::/0]:All", "53"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"0.0.0.0/0:53", "0.0.0.0/0:853", "0.0.0.0/0:windnsclient", "[::/0]:all", "53"}},
 		},
 	})
 }
@@ -74,24 +49,6 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["misconfigtun"]}`, []string{"windows"}},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["misconfigtun"]}`, nil},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["udp/53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["windnsclient"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/853", "udp/853"]}`, nil},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["udp"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/50-60"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/54-60", "icmp"]}`, nil},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["50-60"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["[::/0]:udp/53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["1.1.1.1/32:dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["[2001:db8::/32]:all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:windnsclient"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["0.0.0.0/0:tcp/853", "1.1.1.0/24:icmp", "[::/0]:misconfigtun", "54-60"]}`, nil},
-		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["[::/0]:misconfigtun"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["all"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["allexceptlan"]}`, []string{"windows"}},
-		{`{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["allexceptlan"]}`, nil},
 		{`{"name": "xray0", "autoSystemDnsToGateway": true}`, []string{"linux", "freebsd"}},
 	} {
 		config := new(TunConfig)
@@ -105,22 +62,11 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 }
 
 func TestTunConfigAutoSystemWfpBlockLeakUnknown(t *testing.T) {
-	// With the settings the values need on Windows, so that only an unknown
+	config := new(TunConfig)
-	// one fails.
+	if err := json.Unmarshal([]byte(`{"name": "xray0", "autoSystemWfpBlockLeak": ["dns", "ip"]}`), config); err != nil {
-	build := func(value string) error {
-		config := new(TunConfig)
-		if err := json.Unmarshal([]byte(`{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns", "`+value+`"]}`), config); err != nil {
-			t.Fatal(err)
-		}
-		_, err := config.Build()
-		return err
-	}
-	if err := build("1.1.1.0/24:53"); err != nil {
 		t.Fatal(err)
 	}
-	for _, value := range []string{"ip", "tcp/0", "tcp/0-10", "icmp/1", "udp/20-10", "0", "20-10", "53/tcp", "tcpv4", "ipv4:udp", "1.1.1.1:53", "2001:db8::/32:53", "[1.1.1.0/24]:53", "[::ffff:1.1.1.0/120]:53", "1.1.1.0/24"} {
+	if _, err := config.Build(); err == nil {
-		if build(value) == nil {
+		t.Error("an unknown autoSystemWfpBlockLeak value was accepted")
-			t.Errorf("autoSystemWfpBlockLeak value %q was accepted", value)
-		}
 	}
 }

infra/conf/xray.go

@@ -237,11 +237,10 @@ type OutboundDetourConfig struct {
 
 func requiresTransportSecurity(address *Address) bool {
 	if address == nil || address.Address == nil {
-		return true
+		return false
 	}
 	if address.Family().IsIP() {
-		ip := address.IP()
+		return !geodata.GetPrivateIPMatcher().Match(address.IP())
-		return !ip.IsPrivate() && !ip.IsLoopback() && !ip.IsLinkLocalUnicast()
 	}
 	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
 	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)
@@ -609,6 +608,7 @@ func (c *Config) Build() (*core.Config, error) {
 	config := &core.Config{
 		App: []*serial.TypedMessage{
 			serial.ToTypedMessage(&dispatcher.Config{}),
+			serial.ToTypedMessage(&proxyman.InboundConfig{}),
 			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 		},
 	}
@@ -718,9 +718,6 @@ func (c *Config) Build() (*core.Config, error) {
 		config.App = append(config.App, serial.ToTypedMessage(r))
 	}
 
-	// Initialize the inbound module last to ensure inbound connections are handled correctly.
-	config.App = append(config.App, serial.ToTypedMessage(&proxyman.InboundConfig{}))
-
 	var inbounds []InboundDetourConfig
 
 	if len(c.InboundConfigs) > 0 {

infra/conf/xray_test.go

@@ -42,7 +42,7 @@ func TestXrayConfig(t *testing.T) {
 			Input: `{
 				"log": {
 					"access": "/var/log/xray/access.log",
-					"logLevel": "error",
+					"loglevel": "error",
 					"error": "/var/log/xray/error.log"
 				},
 				"inbounds": [{
@@ -90,6 +90,7 @@ func TestXrayConfig(t *testing.T) {
 						AccessLogPath: "/var/log/xray/access.log",
 					}),
 					serial.ToTypedMessage(&dispatcher.Config{}),
+					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 					serial.ToTypedMessage(&proxyman.OutboundConfig{}),
 					serial.ToTypedMessage(&router.Config{
 						DomainStrategy: router.Config_AsIs,
@@ -110,7 +111,6 @@ func TestXrayConfig(t *testing.T) {
 							},
 						},
 					}),
-					serial.ToTypedMessage(&proxyman.InboundConfig{}),
 				},
 				Inbound: []*core.InboundHandlerConfig{
 					{

infra/vprotogen/main.go

@@ -1,87 +1,149 @@
 package main
 
 import (
-	"bytes"
+	"errors"
-	"context"
 	"flag"
 	"fmt"
-	"io/fs"
+	"go/build"
+	"io"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"runtime"
+	"strconv"
 	"strings"
-
-	"github.com/bufbuild/protocompile"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/reflect/protodesc"
-	"google.golang.org/protobuf/reflect/protoreflect"
-	"google.golang.org/protobuf/types/descriptorpb"
-	"google.golang.org/protobuf/types/pluginpb"
 )
 
-var (
+var directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
-	directory = flag.String("pwd", "", "Working directory of Xray vprotogen.")
-	mode      = flag.String("mode", "generate", "Execution mode. 'generate' (default) compiles and saves changes. 'check' reports out-of-date files and exits with non-zero.")
-)
 
-// topoSort sorts file descriptors so each dependency appears before files importing it.
+// envFile returns the name of the Go environment configuration file.
-func topoSort(files []protoreflect.FileDescriptor) []*descriptorpb.FileDescriptorProto {
+// Copy from https://github.com/golang/go/blob/c4f2a9788a7be04daf931ac54382fbe2cb754938/src/cmd/go/internal/cfg/cfg.go#L150-L166
-	fileMap := make(map[string]protoreflect.FileDescriptor)
+func envFile() (string, error) {
-	for _, f := range files {
+	if file := os.Getenv("GOENV"); file != "" {
-		fileMap[f.Path()] = f
+		if file == "off" {
-	}
+			return "", errors.New("GOENV=off")
-
-	visited := make(map[string]bool)
-	var sorted []*descriptorpb.FileDescriptorProto
-
-	var visit func(fd protoreflect.FileDescriptor)
-	visit = func(fd protoreflect.FileDescriptor) {
-		if visited[fd.Path()] {
-			return
 		}
-		visited[fd.Path()] = true
+		return file, nil
-
-		imports := fd.Imports()
-		for i := 0; i < imports.Len(); i++ {
-			if dep, ok := fileMap[imports.Get(i).Path()]; ok {
-				visit(dep)
-			}
-		}
-		sorted = append(sorted, protodesc.ToFileDescriptorProto(fd))
 	}
-
+	dir, err := os.UserConfigDir()
-	for _, f := range files {
+	if err != nil {
-		visit(f)
+		return "", err
 	}
-	return sorted
+	if dir == "" {
+		return "", errors.New("missing user-config dir")
+	}
+	return filepath.Join(dir, "go", "env"), nil
 }
 
-func runPlugin(pluginName, pwd string, req *pluginpb.CodeGeneratorRequest) (*pluginpb.CodeGeneratorResponse, error) {
+// GetRuntimeEnv returns the value of runtime environment variable,
-	reqBytes, err := proto.Marshal(req)
+// that is set by running following command: `go env -w key=value`.
+func GetRuntimeEnv(key string) (string, error) {
+	file, err := envFile()
 	if err != nil {
-		return nil, err
+		return "", err
 	}
+	if file == "" {
+		return "", errors.New("missing runtime env file")
+	}
+	var data []byte
+	var runtimeEnv string
+	data, readErr := os.ReadFile(file)
+	if readErr != nil {
+		return "", readErr
+	}
+	envStrings := strings.Split(string(data), "\n")
+	for _, envItem := range envStrings {
+		envItem = strings.TrimSuffix(envItem, "\r")
+		envKeyValue := strings.Split(envItem, "=")
+		if strings.EqualFold(strings.TrimSpace(envKeyValue[0]), key) {
+			runtimeEnv = strings.TrimSpace(envKeyValue[1])
+		}
+	}
+	return runtimeEnv, nil
+}
 
-	cmd := exec.Command("go", "tool", pluginName)
+// GetGOBIN returns GOBIN environment variable as a string. It will NOT be empty.
-	cmd.Dir = pwd
+func GetGOBIN() string {
-	cmd.Stdin = bytes.NewReader(reqBytes)
+	// The one set by user explicitly by `export GOBIN=/path` or `env GOBIN=/path command`
-	cmd.Env = os.Environ()
+	GOBIN := os.Getenv("GOBIN")
-	var stdout, stderr bytes.Buffer
+	if GOBIN == "" {
-	cmd.Stdout = &stdout
+		var err error
-	cmd.Stderr = &stderr
+		// The one set by user by running `go env -w GOBIN=/path`
+		GOBIN, err = GetRuntimeEnv("GOBIN")
+		if err != nil {
+			// The default one that Golang uses
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		if GOBIN == "" {
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		return GOBIN
+	}
+	return GOBIN
+}
 
-	if err := cmd.Run(); err != nil {
+func whichProtoc(suffix, targetedVersion string) (string, error) {
-		return nil, fmt.Errorf("%v: %s", err, stderr.String())
+	protoc := "protoc" + suffix
-	}
 
-	var resp pluginpb.CodeGeneratorResponse
+	path, err := exec.LookPath(protoc)
-	if err := proto.Unmarshal(stdout.Bytes(), &resp); err != nil {
+	if err != nil {
-		return nil, fmt.Errorf("failed to unmarshal response: %w", err)
+		return "", fmt.Errorf(`
+Command "%s" not found.
+Make sure that %s is in your system path or current path.
+Download %s v%s or later from https://github.com/protocolbuffers/protobuf/releases
+`, protoc, protoc, protoc, targetedVersion)
 	}
-	if resp.GetError() != "" {
+	return path, nil
-		return nil, fmt.Errorf("%s", resp.GetError())
+}
+
+func getProjectProtocVersion(url string) (string, error) {
+	resp, err := http.Get(url)
+	if err != nil {
+		return "", errors.New("can not get the version of protobuf used in xray project")
 	}
-	return &resp, nil
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", errors.New("can not read from body")
+	}
+	versionRegexp := regexp.MustCompile(`\/\/\s*protoc\s*v\d+\.(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(body))
+	return matched[1], nil
+}
+
+func getInstalledProtocVersion(protocPath string) (string, error) {
+	cmd := exec.Command(protocPath, "--version")
+	cmd.Env = append(cmd.Env, os.Environ()...)
+	output, cmdErr := cmd.CombinedOutput()
+	if cmdErr != nil {
+		return "", cmdErr
+	}
+	versionRegexp := regexp.MustCompile(`protoc\s*(\d+\.\d+)`)
+	matched := versionRegexp.FindStringSubmatch(string(output))
+	return matched[1], nil
+}
+
+func parseVersion(s string, width int) int64 {
+	strList := strings.Split(s, ".")
+	format := fmt.Sprintf("%%s%%0%ds", width)
+	v := ""
+	for _, value := range strList {
+		v = fmt.Sprintf(format, v, value)
+	}
+	var result int64
+	var err error
+	if result, err = strconv.ParseInt(v, 10, 64); err != nil {
+		return 0
+	}
+	return result
+}
+
+func needToUpdate(targetedVersion, installedVersion string) bool {
+	vt := parseVersion(targetedVersion, 4)
+	vi := parseVersion(installedVersion, 4)
+	return vt > vi
 }
 
 func main() {
@@ -92,145 +154,106 @@ func main() {
 	flag.Parse()
 
 	if !filepath.IsAbs(*directory) {
-		pwd, err := os.Getwd()
+		pwd, wdErr := os.Getwd()
-		if err != nil {
+		if wdErr != nil {
 			fmt.Println("Can not get current working directory.")
 			os.Exit(1)
 		}
 		*directory = filepath.Join(pwd, *directory)
 	}
-	pwd := *directory
 
-	isCheck := false
+	pwd := *directory
-	switch *mode {
+	GOBIN := GetGOBIN()
-	case "generate", "":
+	binPath := os.Getenv("PATH")
-		isCheck = false
+	pathSlice := []string{pwd, GOBIN, binPath}
-	case "check":
+	binPath = strings.Join(pathSlice, string(os.PathListSeparator))
-		isCheck = true
+	os.Setenv("PATH", binPath)
-	default:
+
-		fmt.Fprintf(os.Stderr, "Unrecognized 'mode': %s. Use 'generate' or 'check'.\n", *mode)
+	suffix := ""
+	if runtime.GOOS == "windows" {
+		suffix = ".exe"
+	}
+
+	/*
+		targetedVersion, err := getProjectProtocVersion("https://raw.githubusercontent.com/XTLS/Xray-core/HEAD/core/config.pb.go")
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	*/
+	targetedVersion := ""
+
+	protoc, err := whichProtoc(suffix, targetedVersion)
+	if err != nil {
+		fmt.Println(err)
 		os.Exit(1)
 	}
 
-	if isCheck {
+	installedVersion, err := getInstalledProtocVersion(protoc)
-		fmt.Println("Checking for out-of-date Protobuf generated files...")
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
 	}
 
-	var protoFiles []string
+	if needToUpdate(targetedVersion, installedVersion) {
-	var existingPbFiles []string
+		fmt.Printf(`
-	err := filepath.WalkDir(pwd, func(path string, d fs.DirEntry, err error) error {
+You are using an old protobuf version, please update to v%s or later.
-		if err != nil || d.IsDir() {
+Download it from https://github.com/protocolbuffers/protobuf/releases
+
+    * Protobuf version used in xray project: v%s
+    * Protobuf version you have installed: v%s
+
+`, targetedVersion, targetedVersion, installedVersion)
+		os.Exit(1)
+	}
+
+	protoFilesMap := make(map[string][]string)
+	walkErr := filepath.Walk(pwd, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			fmt.Println(err)
 			return err
 		}
-		if strings.HasSuffix(d.Name(), ".proto") {
+
-			rel, _ := filepath.Rel(pwd, path)
+		if info.IsDir() {
-			protoFiles = append(protoFiles, filepath.ToSlash(rel))
+			return nil
 		}
-		if strings.HasSuffix(d.Name(), ".pb.go") {
+
-			existingPbFiles = append(existingPbFiles, path)
+		dir := filepath.Dir(path)
+		filename := filepath.Base(path)
+		if strings.HasSuffix(filename, ".proto") {
+			path = path[len(pwd)+1:]
+			protoFilesMap[dir] = append(protoFilesMap[dir], path)
 		}
+
 		return nil
 	})
-	if err != nil {
+	if walkErr != nil {
-		fmt.Println("Walk error:", err)
+		fmt.Println(walkErr)
 		os.Exit(1)
 	}
 
-	compiler := protocompile.Compiler{
+	for _, files := range protoFilesMap {
-		Resolver: protocompile.WithStandardImports(&protocompile.SourceResolver{
+		for _, relProtoFile := range files {
-			ImportPaths: []string{pwd},
+			args := []string{
-		}),
+				"--go_out", pwd,
-		SourceInfoMode: protocompile.SourceInfoStandard,
+				"--go_opt", "paths=source_relative",
-	}
+				"--go-grpc_out", pwd,
-
+				"--go-grpc_opt", "paths=source_relative",
-	linkedFiles, err := compiler.Compile(context.Background(), protoFiles...)
+				"--plugin", "protoc-gen-go=" + filepath.Join(GOBIN, "protoc-gen-go"+suffix),
-	if err != nil {
+				"--plugin", "protoc-gen-go-grpc=" + filepath.Join(GOBIN, "protoc-gen-go-grpc"+suffix),
-		fmt.Fprintf(os.Stderr, "Protobuf compilation failed:\n%v\n", err)
-		os.Exit(1)
-	}
-
-	var fdList []protoreflect.FileDescriptor
-	for _, f := range linkedFiles {
-		fdList = append(fdList, f)
-	}
-
-	req := &pluginpb.CodeGeneratorRequest{
-		FileToGenerate: protoFiles,
-		Parameter:      new("paths=source_relative"),
-		ProtoFile:      topoSort(fdList),
-	}
-
-	var diffCount int
-	generatedFiles := make(map[string]struct{})
-	for _, plugin := range []string{"protoc-gen-go", "protoc-gen-go-grpc"} {
-		resp, err := runPlugin(plugin, pwd, req)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s failed: %v\n", plugin, err)
-			os.Exit(1)
-		}
-
-		for _, f := range resp.File {
-			targetPath := filepath.Join(pwd, filepath.FromSlash(f.GetName()))
-			generatedFiles[targetPath] = struct{}{}
-			content := []byte(f.GetContent())
-
-			hasDiff := false
-			existing, err := os.ReadFile(targetPath)
-			if err != nil {
-				hasDiff = true
-			} else {
-				oldNorm := bytes.ReplaceAll(existing, []byte("\r\n"), []byte("\n"))
-				newNorm := bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
-				if !bytes.Equal(oldNorm, newNorm) {
-					hasDiff = true
-				}
 			}
-
+			args = append(args, relProtoFile)
-			if hasDiff {
+			cmd := exec.Command(protoc, args...)
-				diffCount++
+			cmd.Env = append(cmd.Env, os.Environ()...)
-				fmt.Println(targetPath)
+			cmd.Dir = pwd
-
+			output, cmdErr := cmd.CombinedOutput()
-				if isCheck {
+			if len(output) > 0 {
-					continue
+				fmt.Println(string(output))
-				}
+			}
-
+			if cmdErr != nil {
-				if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
+				fmt.Println(cmdErr)
-					fmt.Fprintf(os.Stderr, "Error creating directory: %v\n", err)
+				os.Exit(1)
-					os.Exit(1)
-				}
-				mode := os.FileMode(0o644)
-				if stat, err := os.Stat(targetPath); err == nil {
-					mode = stat.Mode().Perm()
-				}
-				if err := os.WriteFile(targetPath, content, mode); err != nil {
-					fmt.Fprintf(os.Stderr, "Error writing %s: %v\n", targetPath, err)
-					os.Exit(1)
-				}
 			}
 		}
 	}
-
-	for _, path := range existingPbFiles {
-		if _, ok := generatedFiles[path]; !ok {
-			diffCount++
-			if isCheck {
-				fmt.Printf("Orphaned Protobuf file: %s\n", path)
-			} else {
-				fmt.Printf("Removing orphaned Protobuf file: %s\n", path)
-				if err := os.Remove(path); err != nil {
-					fmt.Fprintf(os.Stderr, "Error removing %s: %v\n", path, err)
-					os.Exit(1)
-				}
-			}
-		}
-	}
-
-	if isCheck {
-		if diffCount > 0 {
-			fmt.Println("Protobuf generated file problem(s) found.")
-			fmt.Println("Please run 'go run ./infra/vprotogen' to regenerate them.")
-			os.Exit(1)
-		}
-		fmt.Println("All Protobuf generated file check has been passed.")
-	}
 }

main/commands/all/api/balancer_info.go

@@ -47,19 +47,18 @@ func executeBalancerInfo(cmd *base.Command, args []string) {
 	conn, ctx, close := dialAPIServer()
 	defer close()
 	client := routerService.NewRoutingServiceClient(conn)
-	for _, tag := range unnamedArgs {
+	r := &routerService.GetBalancerInfoRequest{Tag: unnamedArgs[0]}
-		r := &routerService.GetBalancerInfoRequest{Tag: tag}
+	resp, err := client.GetBalancerInfo(ctx, r)
-		resp, err := client.GetBalancerInfo(ctx, r)
+	if err != nil {
-		if err != nil {
+		base.Fatalf("failed to get health information: %s", err)
-			base.Fatalf("failed to get health information: %s", err)
-		}
-
-		if apiJSON {
-			showJSONResponse(resp)
-		} else {
-			showBalancerInfo(resp.Balancer)
-		}
 	}
+
+	if apiJSON {
+		showJSONResponse(resp)
+		return
+	}
+
+	showBalancerInfo(resp.Balancer)
 }
 
 func showBalancerInfo(b *routerService.BalancerMsg) {

main/commands/all/api/rules_add.go

@@ -92,8 +92,6 @@ func executeAddRules(cmd *base.Command, args []string) {
 		if err != nil {
 			base.Fatalf("failed to perform AddRule: %s", err)
 		}
-		// if multiple files are specified, use append to merge them instead of overriding previous one
-		shouldAppend = true
 		showJSONResponse(resp)
 	}
 }

main/commands/all/lua/sign.go

@@ -3,7 +3,6 @@ package lua
 import (
 	"os"
 	"path/filepath"
-	"strings"
 
 	xlua "github.com/xtls/xray-core/common/lua"
 	"github.com/xtls/xray-core/main/commands/base"
@@ -33,13 +32,14 @@ func executeSign(cmd *base.Command, args []string) {
 		cmd.Usage()
 	}
 
-	if !strings.EqualFold(filepath.Ext(args[0]), ".lua") {
-		base.Fatalf("Lua file extension must be .lua")
-	}
 	info, err := os.Stat(args[0])
 	if err != nil {
 		base.Fatalf("failed to inspect Lua file: %s", err)
 	}
+	if !info.Mode().IsRegular() {
+		base.Fatalf("Lua input is not a regular file: %s", args[0])
+	}
+
 	code, err := os.ReadFile(args[0])
 	if err != nil {
 		base.Fatalf("failed to read Lua file: %s", err)
@@ -67,7 +67,14 @@ func executeSign(cmd *base.Command, args []string) {
 
 func writeSignedFile(path string, code []byte, mode os.FileMode) error {
 	if info, err := os.Stat(path); err == nil {
+		if !info.Mode().IsRegular() {
+			return &os.PathError{Op: "write", Path: path, Err: os.ErrInvalid}
+		}
 		mode = info.Mode().Perm()
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return err
+		}
 	} else if !os.IsNotExist(err) {
 		return err
 	}

main/confloader/external/external.go

@@ -58,10 +58,18 @@ func readConfigFile(file *os.File) ([]byte, error) {
 		return nil, err
 	}
 	if info.Mode().IsRegular() {
-		switch strings.ToLower(filepath.Ext(file.Name())) {
+		path, err := filepath.Abs(file.Name())
+		if err != nil {
+			return nil, err
+		}
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return nil, err
+		}
+		switch strings.ToLower(filepath.Ext(path)) {
 		case ".jsonc", ".json", ".yml", ".yaml", ".toml", ".pb", ".protobuf":
 		default:
-			return nil, errors.New("unsupported config file extension: ", file.Name())
+			return nil, errors.New("unsupported config file extension: ", path)
 		}
 	}
 	return io.ReadAll(file)

proxy/blackhole/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/blackhole/config.proto
 
 package blackhole

proxy/dns/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/dns/config.proto
 
 package dns

proxy/dns/dns.go

@@ -381,13 +381,6 @@ func (h *Handler) handleIPQuery(id uint16, qType dnsmessage.Type, domain string,
 		errors.LogInfoInner(context.Background(), err, "pack message")
 		b.Release()
 		timer.SetTimeout(0)
-		return
-	}
-	if len(msgBytes) > buf.Size {
-		b.Release()
-		timer.SetTimeout(0)
-		errors.LogError(context.Background(), "DNS response message too large")
-		return
 	}
 	b.Resize(0, int32(len(msgBytes)))
 

proxy/dokodemo/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/dokodemo/config.proto
 
 package dokodemo
@@ -23,14 +23,14 @@ const (
 )
 
 type Config struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	RewriteAddress *net.IPOrDomain        `protobuf:"bytes,1,opt,name=rewrite_address,json=rewriteAddress,proto3" json:"rewrite_address,omitempty"`
+	RewritePort    uint32                 `protobuf:"varint,2,opt,name=rewrite_port,json=rewritePort,proto3" json:"rewrite_port,omitempty"`
+	PortMap        map[string]string      `protobuf:"bytes,3,rep,name=port_map,json=portMap,proto3" json:"port_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// List of networks that the Dokodemo accepts.
-	AllowedNetworks []net.Network     `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
+	AllowedNetworks []net.Network `protobuf:"varint,7,rep,packed,name=allowed_networks,json=allowedNetworks,proto3,enum=xray.common.net.Network" json:"allowed_networks,omitempty"`
-	RewriteAddress  *net.IPOrDomain   `protobuf:"bytes,1,opt,name=rewrite_address,json=rewriteAddress,proto3" json:"rewrite_address,omitempty"`
+	FollowRedirect  bool          `protobuf:"varint,5,opt,name=follow_redirect,json=followRedirect,proto3" json:"follow_redirect,omitempty"`
-	RewritePort     uint32            `protobuf:"varint,2,opt,name=rewrite_port,json=rewritePort,proto3" json:"rewrite_port,omitempty"`
+	UserLevel       uint32        `protobuf:"varint,6,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
-	PortMap         map[string]string `protobuf:"bytes,3,rep,name=port_map,json=portMap,proto3" json:"port_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	FollowRedirect  bool              `protobuf:"varint,5,opt,name=follow_redirect,json=followRedirect,proto3" json:"follow_redirect,omitempty"`
-	UserLevel       uint32            `protobuf:"varint,6,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
 }
@@ -65,13 +65,6 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_proxy_dokodemo_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetAllowedNetworks() []net.Network {
-	if x != nil {
-		return x.AllowedNetworks
-	}
-	return nil
-}
-
 func (x *Config) GetRewriteAddress() *net.IPOrDomain {
 	if x != nil {
 		return x.RewriteAddress
@@ -93,6 +86,13 @@ func (x *Config) GetPortMap() map[string]string {
 	return nil
 }
 
+func (x *Config) GetAllowedNetworks() []net.Network {
+	if x != nil {
+		return x.AllowedNetworks
+	}
+	return nil
+}
+
 func (x *Config) GetFollowRedirect() bool {
 	if x != nil {
 		return x.FollowRedirect
@@ -112,11 +112,11 @@ var File_proxy_dokodemo_config_proto protoreflect.FileDescriptor
 const file_proxy_dokodemo_config_proto_rawDesc = "" +
 	"\n" +
 	"\x1bproxy/dokodemo/config.proto\x12\x13xray.proxy.dokodemo\x1a\x18common/net/address.proto\x1a\x18common/net/network.proto\"\xff\x02\n" +
-	"\x06Config\x12C\n" +
+	"\x06Config\x12D\n" +
-	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12D\n" +
 	"\x0frewrite_address\x18\x01 \x01(\v2\x1b.xray.common.net.IPOrDomainR\x0erewriteAddress\x12!\n" +
 	"\frewrite_port\x18\x02 \x01(\rR\vrewritePort\x12C\n" +
-	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12'\n" +
+	"\bport_map\x18\x03 \x03(\v2(.xray.proxy.dokodemo.Config.PortMapEntryR\aportMap\x12C\n" +
+	"\x10allowed_networks\x18\a \x03(\x0e2\x18.xray.common.net.NetworkR\x0fallowedNetworks\x12'\n" +
 	"\x0ffollow_redirect\x18\x05 \x01(\bR\x0efollowRedirect\x12\x1d\n" +
 	"\n" +
 	"user_level\x18\x06 \x01(\rR\tuserLevel\x1a:\n" +
@@ -141,13 +141,13 @@ var file_proxy_dokodemo_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_proxy_dokodemo_config_proto_goTypes = []any{
 	(*Config)(nil),         // 0: xray.proxy.dokodemo.Config
 	nil,                    // 1: xray.proxy.dokodemo.Config.PortMapEntry
-	(net.Network)(0),       // 2: xray.common.net.Network
+	(*net.IPOrDomain)(nil), // 2: xray.common.net.IPOrDomain
-	(*net.IPOrDomain)(nil), // 3: xray.common.net.IPOrDomain
+	(net.Network)(0),       // 3: xray.common.net.Network
 }
 var file_proxy_dokodemo_config_proto_depIdxs = []int32{
-	2, // 0: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
+	2, // 0: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
-	3, // 1: xray.proxy.dokodemo.Config.rewrite_address:type_name -> xray.common.net.IPOrDomain
+	1, // 1: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
-	1, // 2: xray.proxy.dokodemo.Config.port_map:type_name -> xray.proxy.dokodemo.Config.PortMapEntry
+	3, // 2: xray.proxy.dokodemo.Config.allowed_networks:type_name -> xray.common.net.Network
 	3, // [3:3] is the sub-list for method output_type
 	3, // [3:3] is the sub-list for method input_type
 	3, // [3:3] is the sub-list for extension type_name

proxy/freedom/config.pb.go

@@ -1,14 +1,13 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/freedom/config.proto
 
 package freedom
 
 import (
 	geodata "github.com/xtls/xray-core/common/geodata"
-	log "github.com/xtls/xray-core/common/log"
 	net "github.com/xtls/xray-core/common/net"
 	protocol "github.com/xtls/xray-core/common/protocol"
 	internet "github.com/xtls/xray-core/transport/internet"
@@ -358,8 +357,7 @@ type FinalRuleConfig struct {
 	Networks      []net.Network          `protobuf:"varint,2,rep,packed,name=networks,proto3,enum=xray.common.net.Network" json:"networks,omitempty"`
 	PortList      *net.PortList          `protobuf:"bytes,3,opt,name=port_list,json=portList,proto3" json:"port_list,omitempty"`
 	Ip            []*geodata.IPRule      `protobuf:"bytes,4,rep,name=ip,proto3" json:"ip,omitempty"`
-	Delay         *Range                 `protobuf:"bytes,5,opt,name=delay,proto3" json:"delay,omitempty"`
+	BlockDelay    *Range                 `protobuf:"bytes,5,opt,name=block_delay,json=blockDelay,proto3" json:"block_delay,omitempty"`
-	LogLevel      *log.Severity          `protobuf:"varint,6,opt,name=log_level,json=logLevel,proto3,enum=xray.common.log.Severity,oneof" json:"log_level,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -422,20 +420,13 @@ func (x *FinalRuleConfig) GetIp() []*geodata.IPRule {
 	return nil
 }
 
-func (x *FinalRuleConfig) GetDelay() *Range {
+func (x *FinalRuleConfig) GetBlockDelay() *Range {
 	if x != nil {
-		return x.Delay
+		return x.BlockDelay
 	}
 	return nil
 }
 
-func (x *FinalRuleConfig) GetLogLevel() log.Severity {
-	if x != nil && x.LogLevel != nil {
-		return *x.LogLevel
-	}
-	return log.Severity(0)
-}
-
 type Config struct {
 	state               protoimpl.MessageState  `protogen:"open.v1"`
 	DomainStrategy      internet.DomainStrategy `protobuf:"varint,1,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.transport.internet.DomainStrategy" json:"domain_strategy,omitempty"`
@@ -532,7 +523,7 @@ var File_proxy_freedom_config_proto protoreflect.FileDescriptor
 
 const file_proxy_freedom_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1aproxy/freedom/config.proto\x12\x12xray.proxy.freedom\x1a!common/protocol/server_spec.proto\x1a\x1ftransport/internet/config.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\x1a\x14common/log/log.proto\"S\n" +
+	"\x1aproxy/freedom/config.proto\x12\x12xray.proxy.freedom\x1a!common/protocol/server_spec.proto\x1a\x1ftransport/internet/config.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"S\n" +
 	"\x13DestinationOverride\x12<\n" +
 	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"\x98\x02\n" +
 	"\bFragment\x12!\n" +
@@ -558,16 +549,14 @@ const file_proxy_freedom_config_proto_rawDesc = "" +
 	"\bapply_to\x18\x06 \x01(\tR\aapplyTo\"+\n" +
 	"\x05Range\x12\x10\n" +
 	"\x03min\x18\x01 \x01(\x04R\x03min\x12\x10\n" +
-	"\x03max\x18\x02 \x01(\x04R\x03max\"\xe0\x02\n" +
+	"\x03max\x18\x02 \x01(\x04R\x03max\"\xa0\x02\n" +
 	"\x0fFinalRuleConfig\x126\n" +
 	"\x06action\x18\x01 \x01(\x0e2\x1e.xray.proxy.freedom.RuleActionR\x06action\x124\n" +
 	"\bnetworks\x18\x02 \x03(\x0e2\x18.xray.common.net.NetworkR\bnetworks\x126\n" +
 	"\tport_list\x18\x03 \x01(\v2\x19.xray.common.net.PortListR\bportList\x12+\n" +
-	"\x02ip\x18\x04 \x03(\v2\x1b.xray.common.geodata.IPRuleR\x02ip\x12/\n" +
+	"\x02ip\x18\x04 \x03(\v2\x1b.xray.common.geodata.IPRuleR\x02ip\x12:\n" +
-	"\x05delay\x18\x05 \x01(\v2\x19.xray.proxy.freedom.RangeR\x05delay\x12;\n" +
+	"\vblock_delay\x18\x05 \x01(\v2\x19.xray.proxy.freedom.RangeR\n" +
-	"\tlog_level\x18\x06 \x01(\x0e2\x19.xray.common.log.SeverityH\x00R\blogLevel\x88\x01\x01B\f\n" +
+	"blockDelay\"\xaf\x03\n" +
-	"\n" +
-	"_log_level\"\xaf\x03\n" +
 	"\x06Config\x12P\n" +
 	"\x0fdomain_strategy\x18\x01 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0edomainStrategy\x12Z\n" +
 	"\x14destination_override\x18\x03 \x01(\v2'.xray.proxy.freedom.DestinationOverrideR\x13destinationOverride\x12\x1d\n" +
@@ -610,8 +599,7 @@ var file_proxy_freedom_config_proto_goTypes = []any{
 	(net.Network)(0),                // 8: xray.common.net.Network
 	(*net.PortList)(nil),            // 9: xray.common.net.PortList
 	(*geodata.IPRule)(nil),          // 10: xray.common.geodata.IPRule
-	(log.Severity)(0),               // 11: xray.common.log.Severity
+	(internet.DomainStrategy)(0),    // 11: xray.transport.internet.DomainStrategy
-	(internet.DomainStrategy)(0),    // 12: xray.transport.internet.DomainStrategy
 }
 var file_proxy_freedom_config_proto_depIdxs = []int32{
 	7,  // 0: xray.proxy.freedom.DestinationOverride.server:type_name -> xray.common.protocol.ServerEndpoint
@@ -619,18 +607,17 @@ var file_proxy_freedom_config_proto_depIdxs = []int32{
 	8,  // 2: xray.proxy.freedom.FinalRuleConfig.networks:type_name -> xray.common.net.Network
 	9,  // 3: xray.proxy.freedom.FinalRuleConfig.port_list:type_name -> xray.common.net.PortList
 	10, // 4: xray.proxy.freedom.FinalRuleConfig.ip:type_name -> xray.common.geodata.IPRule
-	4,  // 5: xray.proxy.freedom.FinalRuleConfig.delay:type_name -> xray.proxy.freedom.Range
+	4,  // 5: xray.proxy.freedom.FinalRuleConfig.block_delay:type_name -> xray.proxy.freedom.Range
-	11, // 6: xray.proxy.freedom.FinalRuleConfig.log_level:type_name -> xray.common.log.Severity
+	11, // 6: xray.proxy.freedom.Config.domain_strategy:type_name -> xray.transport.internet.DomainStrategy
-	12, // 7: xray.proxy.freedom.Config.domain_strategy:type_name -> xray.transport.internet.DomainStrategy
+	1,  // 7: xray.proxy.freedom.Config.destination_override:type_name -> xray.proxy.freedom.DestinationOverride
-	1,  // 8: xray.proxy.freedom.Config.destination_override:type_name -> xray.proxy.freedom.DestinationOverride
+	2,  // 8: xray.proxy.freedom.Config.fragment:type_name -> xray.proxy.freedom.Fragment
-	2,  // 9: xray.proxy.freedom.Config.fragment:type_name -> xray.proxy.freedom.Fragment
+	3,  // 9: xray.proxy.freedom.Config.noises:type_name -> xray.proxy.freedom.Noise
-	3,  // 10: xray.proxy.freedom.Config.noises:type_name -> xray.proxy.freedom.Noise
+	5,  // 10: xray.proxy.freedom.Config.final_rules:type_name -> xray.proxy.freedom.FinalRuleConfig
-	5,  // 11: xray.proxy.freedom.Config.final_rules:type_name -> xray.proxy.freedom.FinalRuleConfig
+	11, // [11:11] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method output_type
+	11, // [11:11] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
-	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
-	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_proxy_freedom_config_proto_init() }
@@ -638,7 +625,6 @@ func file_proxy_freedom_config_proto_init() {
 	if File_proxy_freedom_config_proto != nil {
 		return
 	}
-	file_proxy_freedom_config_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{

proxy/freedom/config.proto

@@ -11,7 +11,6 @@ import "transport/internet/config.proto";
 import "common/net/port.proto";
 import "common/net/network.proto";
 import "common/geodata/geodat.proto";
-import "common/log/log.proto";
 
 message DestinationOverride {
   xray.common.protocol.ServerEndpoint server = 1;
@@ -52,8 +51,7 @@ message FinalRuleConfig {
   repeated xray.common.net.Network networks = 2;
   xray.common.net.PortList port_list = 3;
   repeated xray.common.geodata.IPRule ip = 4;
-  Range delay = 5;
+  Range block_delay = 5;
-  optional xray.common.log.Severity log_level = 6;
 }
 
 message Config {

proxy/freedom/freedom.go

@@ -15,7 +15,6 @@ import (
 	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/platform"
 	"github.com/xtls/xray-core/common/retry"
@@ -73,26 +72,23 @@ func init() {
 	}
 
 	defaultBlockPrivateRule = &FinalRule{
-		action:   RuleAction_Block,
+		action:  RuleAction_Block,
-		network:  allNetworks,
+		network: allNetworks,
-		ip:       geodata.GetPrivateIPMatcher(),
+		ip:      geodata.GetPrivateIPMatcher(),
-		logLevel: log.Severity_Warning.Enum(),
 	}
 
 	defaultBlockAllRule = &FinalRule{
-		action:   RuleAction_Block,
+		action:  RuleAction_Block,
-		network:  allNetworks,
+		network: allNetworks,
-		logLevel: log.Severity_Warning.Enum(),
 	}
 }
 
 type FinalRule struct {
-	action   RuleAction
+	action     RuleAction
-	network  [8]bool
+	network    [8]bool
-	port     net.MemoryPortList
+	port       net.MemoryPortList
-	ip       geodata.IPMatcher
+	ip         geodata.IPMatcher
-	delay    *Range
+	blockDelay *Range
-	logLevel *log.Severity
 }
 
 // Handler handles Freedom connections.
@@ -106,9 +102,8 @@ type Handler struct {
 
 func buildFinalRule(config *FinalRuleConfig) (*FinalRule, error) {
 	rule := &FinalRule{
-		action:   config.GetAction(),
+		action:     config.GetAction(),
-		delay:    config.GetDelay(),
+		blockDelay: config.GetBlockDelay(),
-		logLevel: config.LogLevel,
 	}
 
 	if len(config.Networks) == 0 {
@@ -169,7 +164,7 @@ func getDefaultFinalRule(inbound *session.Inbound) *FinalRule {
 	switch inbound.Name {
 	case "vless-reverse":
 		return defaultBlockAllRule
-	case "vless", "vmess", "trojan", "hysteria", "wireguard", "masque":
+	case "vless", "vmess", "trojan", "hysteria", "wireguard":
 		return defaultBlockPrivateRule
 	default:
 		if strings.HasPrefix(inbound.Name, "shadowsocks") {
@@ -217,12 +212,12 @@ func (h *Handler) policy() policy.Session {
 	return p
 }
 
-func (r *FinalRule) blockDuration() time.Duration {
+func (h *Handler) blockDelay(rule *FinalRule) time.Duration {
 	min := uint64(30)
 	max := uint64(90)
-	if r.delay != nil {
+	if rule.blockDelay != nil {
-		min = r.delay.Min
+		min = rule.blockDelay.Min
-		max = r.delay.Max
+		max = rule.blockDelay.Max
 	}
 	span := max - min
 	if max < min {
@@ -231,39 +226,17 @@ func (r *FinalRule) blockDuration() time.Duration {
 	return time.Duration(min+uint64(dice.Roll(int(span+1)))) * time.Second
 }
 
-func (r *FinalRule) log(ctx context.Context, msg ...interface{}) {
-	level := log.Severity_Info
-	if r.logLevel != nil {
-		level = *r.logLevel
-	}
-	switch level {
-	case log.Severity_Debug:
-		errors.LogDebug(ctx, msg...)
-	case log.Severity_Info:
-		errors.LogInfo(ctx, msg...)
-	case log.Severity_Warning:
-		errors.LogWarning(ctx, msg...)
-	case log.Severity_Error:
-		errors.LogError(ctx, msg...)
-	}
-}
-
 func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *FinalRule, dest *net.Destination) error {
-	delay := rule.blockDuration()
+	delay := h.blockDelay(rule)
-	rule.log(ctx, "target blocked by a finalrule: ", *dest, ", blackholing connection for ", delay)
+	errors.LogInfo(ctx, "blocked target: ", *dest, ", blackholing connection for ", delay)
-	defer common.Close(output)
+	timer := time.AfterFunc(delay, func() {
-	done := make(chan struct{})
-	go func() { // a DispatchLink inbound's reader ignores Interrupt, so don't wait for this copy
-		_ = buf.Copy(input, buf.Discard)
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(delay):
 		common.Interrupt(input)
 		common.Interrupt(output)
-		rule.log(ctx, "closed blackholed connection to blocked target: ", *dest)
+		errors.LogInfo(ctx, "closed blackholed connection to blocked target: ", *dest)
-	}
+	})
+	defer timer.Stop()
+	defer common.Close(output)
+	_ = buf.Copy(input, buf.Discard)
 	return nil
 }
 

proxy/http/client.go

@@ -10,7 +10,6 @@ import (
 	"net/url"
 	"sync"
 	"text/template"
-	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
@@ -87,13 +86,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	user := server.User
 	var conn stat.Connection
 
-	var mbuf buf.MultiBuffer
+	mbuf, _ := link.Reader.ReadMultiBuffer()
-	if reader, ok := link.Reader.(buf.TimeoutReader); ok {
-		// Don't wait forever: server-first protocols (SMTP, FTP, MySQL...) send nothing until the server greets.
-		mbuf, _ = reader.ReadMultiBufferTimeout(time.Millisecond * 500)
-	} else {
-		mbuf, _ = link.Reader.ReadMultiBuffer()
-	}
 	len := mbuf.Len()
 	firstPayload := bytespool.Alloc(len)
 	mbuf, _ = buf.SplitBytes(mbuf, firstPayload)
@@ -241,8 +234,7 @@ func setUpHTTPTunnel(ctx context.Context, dest net.Destination, target string, u
 			return nil, err
 		}
 
-		reader := bufio.NewReader(rawConn)
+		resp, err := http.ReadResponse(bufio.NewReader(rawConn), req)
-		resp, err := http.ReadResponse(reader, req)
 		if err != nil {
 			rawConn.Close()
 			return nil, err
@@ -253,11 +245,6 @@ func setUpHTTPTunnel(ctx context.Context, dest net.Destination, target string, u
 			rawConn.Close()
 			return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
 		}
-		// Tunneled bytes (e.g. a server-first greeting) may arrive in the same read as the 200 response.
-		if n := reader.Buffered(); n > 0 {
-			early, _ := reader.Peek(n)
-			return &earlyDataConn{Conn: rawConn, early: early}, nil
-		}
 		return rawConn, nil
 	}
 
@@ -388,21 +375,6 @@ func (h *http2Conn) Close() error {
 	return h.out.Close()
 }
 
-// earlyDataConn returns the bytes read ahead together with the CONNECT response before reading from Conn.
-type earlyDataConn struct {
-	net.Conn
-	early []byte
-}
-
-func (c *earlyDataConn) Read(p []byte) (int, error) {
-	if len(c.early) > 0 {
-		n := copy(p, c.early)
-		c.early = c.early[n:]
-		return n, nil
-	}
-	return c.Conn.Read(p)
-}
-
 func init() {
 	common.Must(common.RegisterConfig((*ClientConfig)(nil), func(ctx context.Context, config interface{}) (interface{}, error) {
 		return NewClient(ctx, config.(*ClientConfig))

proxy/http/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/http/config.proto
 
 package http

proxy/http/server.go

@@ -312,9 +312,8 @@ func (s *Server) handlePlainHTTP(ctx context.Context, request *http.Request, wri
 // Sometimes, server might send 1xx response to client
 // it should not be processed by http proxy handler, just forward it to client
 func readResponseAndHandle100Continue(r *bufio.Reader, req *http.Request, writer io.Writer) (*http.Response, error) {
-	// Wait for the HTTP/1.x status prefix before inspecting the buffered response.
+	// have a little look of response
-	r.Peek(12)
+	peekBytes, err := r.Peek(56)
-	peekBytes, err := r.Peek(min(56, r.Buffered()))
 	if err == nil || err == bufio.ErrBufferFull {
 		str := string(peekBytes)
 		ResponseLine := strings.Split(str, "\r\n")[0]

proxy/http/server_test.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"strings"
 	"testing"
-	"testing/iotest"
 )
 
 // A malformed upstream response containing a bare '\n' before the real
@@ -30,7 +29,7 @@ func TestReadResponseAndHandle100ContinueDoesNotPanicOnEarlyNewline(t *testing.T
 func TestReadResponseAndHandle100ContinueForwardsAndParsesFinalResponse(t *testing.T) {
 	payload := "HTTP/1.1 100 Continue\r\n\r\n" +
 		"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello"
-	r := bufio.NewReader(iotest.OneByteReader(bytes.NewReader([]byte(payload))))
+	r := bufio.NewReader(bytes.NewReader([]byte(payload)))
 	req, err := http.NewRequest("GET", "http://example.com/", nil)
 	if err != nil {
 		t.Fatal(err)

proxy/hysteria/account/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/hysteria/account/config.proto
 
 package account

proxy/hysteria/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/hysteria/config.proto
 
 package hysteria

proxy/loopback/config.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.12
+// 	protoc-gen-go v1.36.11
-// 	protoc        (unknown)
+// 	protoc        v6.33.5
 // source: proxy/loopback/config.proto
 
 package loopback